ruvnet-brain 4.3.35 → 4.3.37

package/scripts/release.mjs

@@ -66,6 +66,9 @@ const recallNotes = (receipt) => {
 };
 import { verifyBundle } from './verify-bundle.mjs';
 import { CORPUS_GENERATION_FIELD, evaluateCorpusPromotion } from './corpus-promotion.mjs';
+import { bindCoverageToReceipt, writeCoverageAssets } from './corpus-coverage-sidecar.mjs';
+import { degradedPublication } from './corpus-store-failure.mjs';
+import { assertNoNewerCorpusGeneration } from './code-release-corpus.mjs';
 
 const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const PUBLISH = process.argv.includes('--publish');
@@ -114,6 +117,28 @@ function corpusFailure(message) {
   throw new Error(`[corpus-seed] ${message}`);
 }
 
+/**
+ * A newer code release was published after this corpus was built at its approved runtime. Promoting
+ * it now would put an OLDER runtime on releases/latest over a newer live code release (fresh installs
+ * then fail on a version mismatch). That is not a broken night -- the next night builds at the newer
+ * runtime -- so it is a distinct, typed outcome: exit CORPUS_SUPERSEDED_EXIT, recorded as `superseded`.
+ */
+export const CORPUS_SUPERSEDED_EXIT = 4;
+export class CorpusSuperseded extends Error {
+  constructor(message) {
+    super(`[corpus-seed] superseded: ${message}`);
+    this.name = 'CorpusSuperseded';
+    this.code = 'CORPUS_SUPERSEDED';
+  }
+}
+
+const CODE_TAG = /^v(\d+)\.(\d+)\.(\d+)$/;
+const compareCodeTags = (left, right) => {
+  const a = CODE_TAG.exec(left).slice(1).map(Number);
+  const b = CODE_TAG.exec(right).slice(1).map(Number);
+  return Math.sign(a[0] - b[0] || a[1] - b[1] || a[2] - b[2]);
+};
+
 export async function runProtectedCorpusSeed({
   argv = process.argv.slice(2),
   env = process.env,
@@ -135,13 +160,15 @@ export async function runProtectedCorpusSeed({
   const tag = cliArg(argv, '--corpus-tag');
   const bundleFile = cliArg(argv, '--corpus-bundle');
   const receiptFile = cliArg(argv, '--corpus-receipt');
+  // ADR-0091 D6.2: the generation's sealed coverage (the prepared artifact's source-coverage.json).
+  const coverageFile = cliArg(argv, '--corpus-coverage');
   const target = cliArg(argv, '--target');
   const repo = cliArg(argv, '--repo') || env.GITHUB_REPOSITORY;
   const digestMatch = String(tag || '').match(/^corpus-sha256-([a-f0-9]{64})$/);
   if (!digestMatch) corpusFailure('corpus tag must be corpus-sha256- followed by 64 lowercase hex characters');
   if (repo !== env.GITHUB_REPOSITORY || repo !== 'stuinfla/ruvnet-brain') corpusFailure('repository does not match the protected workflow');
 
-  for (const [label, file] of [['bundle', bundleFile], ['receipt', receiptFile]]) {
+  for (const [label, file] of [['bundle', bundleFile], ['receipt', receiptFile], ['coverage', coverageFile]]) {
     if (!file || !path.isAbsolute(file)) corpusFailure(`${label} must be an absolute regular file`);
     try {
       const stat = fs.lstatSync(file);
@@ -164,14 +191,28 @@ export async function runProtectedCorpusSeed({
   } catch (error) {
     corpusFailure(`corpus receipt is unreadable/corrupt (${error.message})`);
   }
-  // EXACT equality, never "GITHUB_SHA or an ancestor of it" (independent review of ADR-0091 D3,
-  // 2026-09-28). Accepting an ancestor let the unattended corpus job promote an OLDER runtime over the
-  // current live code release as `releases/latest` — fresh installs then fail on a version mismatch
-  // and already-updated clients refuse it as incompatible. The corpus is built at the newest
-  // install-verified release's sourceSha, and that must BE the protected main commit this run executes.
-  // The format check runs first; the comparisons below never hand the value to a subprocess.
-  if (!isHex(target, 40) || target !== head || target !== env.GITHUB_SHA || target !== receipt.builderSourceSha) {
-    corpusFailure('target must exactly equal HEAD, GITHUB_SHA, and the corpus receipt builderSourceSha');
+  // DECOUPLED FROM main HEAD (2026-09-29 nightly redesign). The corpus is built at the APPROVED
+  // runtime -- the newest code release with a verified install aggregate -- whose source is on main's
+  // history but is usually NOT main HEAD. The old rule (target === GITHUB_SHA) stood the nightly down
+  // whenever main was ahead of the newest verified release. The guard that rule was protecting
+  // (independent review of ADR-0091 D3: never promote an OLDER runtime over the live code release)
+  // is now enforced directly: target must be the checkout, the receipt's builder, an ancestor of this
+  // protected run's GITHUB_SHA, and -- for a customer promotion -- the commit of --approved-tag, which
+  // must still be the NEWEST code release at publish time (below; otherwise CorpusSuperseded).
+  // Format checks run first; no value reaches a subprocess unvalidated.
+  if (!isHex(target, 40) || target !== head || target !== receipt.builderSourceSha || !isHex(env.GITHUB_SHA, 40)) {
+    corpusFailure('target must exactly equal HEAD and the corpus receipt builderSourceSha (and GITHUB_SHA must be a commit)');
+  }
+  const ancestry = run('git', ['merge-base', '--is-ancestor', target, env.GITHUB_SHA], {
+    cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  if (ancestry.error || ancestry.status !== 0) corpusFailure(`target ${target} is not an ancestor of this run's GITHUB_SHA ${env.GITHUB_SHA}`);
+  const approvedTag = cliArg(argv, '--approved-tag');
+  if (promoteLatest) {
+    if (!CODE_TAG.test(String(approvedTag || ''))) corpusFailure('customer promotion requires --approved-tag vX.Y.Z (the approved runtime this corpus was built at)');
+    if (receipt.archiveManifestReleaseTag !== approvedTag) {
+      corpusFailure(`the archive ships runtime ${receipt.archiveManifestReleaseTag}, not the approved runtime ${approvedTag}`);
+    }
   }
 
   // Schema 3 (ADR-086 Step 15 / A6): the receipt binds the full provenance closure shipped INSIDE
@@ -261,11 +302,16 @@ export async function runProtectedCorpusSeed({
     || fs.statSync(recallReportFile).size !== receipt.recallReport.bytes) {
     corpusFailure('detached repo-recall report bytes do not match the corpus receipt');
   }
+  // ADR-0091 D7.3: a claimed retirement is recomputed from THIS generation's sealed coverage (the bytes
+  // published beside the archive as CORPUS-COVERAGE.json), never taken from the report's own claim.
+  const recallFixture = loadFixture();
   try {
     readRecallReport({
       reportFile: recallReportFile,
       archive: archiveIdentity,
-      expectedFixtureSha256: loadFixture().fixtureSha256,
+      expectedFixtureSha256: recallFixture.fixtureSha256,
+      coverageBytes: fs.readFileSync(coverageFile),
+      fixtureStores: recallFixture.questions.map((question) => question.store),
     });
   } catch (error) {
     corpusFailure(`retrieval does not qualify this corpus for publication (${error.message})`);
@@ -280,12 +326,39 @@ export async function runProtectedCorpusSeed({
   // here. It runs before any `gh` call so an untrue candidate never reaches the network.
   try {
     await verifyCorpusReceipt({
-      receiptFile, bundleFile, accuracyReportFile, recallReportFile, expectedBuilderSha: target, expectedArchiveSha256: archiveSha256,
+      receiptFile, bundleFile, accuracyReportFile, recallReportFile, coverageFile, expectedBuilderSha: target, expectedArchiveSha256: archiveSha256,
     });
   } catch (error) {
     corpusFailure(`corpus receipt does not verify against the sealed archive (${error.message})`);
   }
 
+  // ADR-0091 D6.2 + D10. The archive carries no coverage and the schema-3 receipt binds none, so this
+  // is the one place the publisher can SEE whether the generation is degraded. The coverage must be
+  // the coverage of THIS archive (bound store by store to the receipt), it is published beside the
+  // archive as CORPUS-COVERAGE.json + coverage-receipt.json (no receipt schema bump), and a
+  // generation with any carried or missing store is refused while D10 has recorded no soaked
+  // tolerant-validator transition -- installed clients would reject it. Local, before any network.
+  let coverageAssets;
+  try {
+    coverageAssets = writeCoverageAssets({
+      dir: fs.mkdtempSync(path.join(os.tmpdir(), 'corpus-coverage-assets-')),
+      coverageFile, generationTag: tag, archiveSha256, archiveBytes: archiveIdentity.bytes,
+    });
+    const degraded = bindCoverageToReceipt({
+      coverage: JSON.parse(fs.readFileSync(coverageAssets.coverageFile, 'utf8')), receipt,
+    });
+    if (degraded.carried.length + degraded.missing.length > 0) {
+      const decision = degradedPublication();
+      if (!decision.allowed) {
+        corpusFailure(`degraded generation (${degraded.carried.length} carried, ${degraded.missing.length} missing) `
+          + `must not be published: ${decision.reason}`);
+      }
+    }
+  } catch (error) {
+    if (String(error.message).startsWith('[corpus-seed]')) throw error;
+    corpusFailure(`the generation's sealed coverage does not bind this archive (${error.message})`);
+  }
+
   // EVERY local proof happens before the first network call. `gh` must never be reached by a
   // candidate that is already known to be unpublishable — that is the same discipline the deep
   // verifyCorpusReceipt above follows, and a customer release with an unusable signature is exactly
@@ -307,16 +380,48 @@ export async function runProtectedCorpusSeed({
     if (!Number.isFinite(Date.parse(generation))) corpusFailure('corpus receipt createdAt is not a readable generation timestamp');
   }
 
-  const viewArgs = ['release', 'view', tag, '--json', 'tagName', '--repo', repo];
   const ghCommand = env.RUVNET_GH_COMMAND || 'gh';
   const ghPrefix = env.RUVNET_GH_SCRIPT ? [env.RUVNET_GH_SCRIPT] : [];
-  const view = run(ghCommand, [...ghPrefix, ...viewArgs], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+  const gh = (args) => run(ghCommand, [...ghPrefix, ...args], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+  const ghJson = (args, label) => {
+    const result = gh(args);
+    if (result.error || result.status !== 0) {
+      corpusFailure(`cannot read ${label} (${String(result.error?.message || result.stderr || result.stdout || '').trim() || `gh exited ${result.status}`})`);
+    }
+    try { return JSON.parse(String(result.stdout || 'null')); }
+    catch (error) { corpusFailure(`cannot parse ${label} (${error.message})`); }
+  };
+
+  if (promoteLatest) {
+    // PUBLISH-TIME RE-RESOLVE, before anything is written. Preparation takes hours; a code release
+    // may have been published meanwhile. The newest code release is selected exactly as
+    // scripts/approved-runtime.mjs selects it (non-draft, non-prerelease vX.Y.Z, highest version).
+    // Its signed install aggregate was re-verified for --approved-tag by the workflow step that built
+    // the runtime pin moments ago; what can change after that is only WHICH release is newest.
+    const listed = ghJson(['release', 'list', '--repo', repo, '--limit', '200', '--json', 'tagName,isDraft,isPrerelease'], 'the code release list');
+    const [newest] = (Array.isArray(listed) ? listed : [])
+      .filter((row) => !row?.isDraft && !row?.isPrerelease && CODE_TAG.test(String(row?.tagName || '')))
+      .map((row) => row.tagName).sort((a, b) => compareCodeTags(b, a));
+    if (!newest) corpusFailure(`no published code release is listed on ${repo}; the approved runtime ${approvedTag} cannot be confirmed`);
+    const order = compareCodeTags(newest, approvedTag);
+    if (order > 0) {
+      throw new CorpusSuperseded(`code release ${newest} was published after this corpus was built at ${approvedTag}; `
+        + 'promoting it would put an older runtime over the live code release. The next night builds at the newer runtime.');
+    }
+    if (order < 0) corpusFailure(`approved runtime ${approvedTag} is newer than every published code release (newest ${newest})`);
+    const commit = ghJson(['api', `repos/${repo}/commits/${approvedTag}`], `the commit of ${approvedTag}`);
+    if (String(commit?.sha || '').toLowerCase() !== target) {
+      corpusFailure(`target ${target} is not the source of the approved runtime ${approvedTag} (${commit?.sha || 'unknown'})`);
+    }
+  }
+
+  const viewArgs = ['release', 'view', tag, '--json', 'tagName', '--repo', repo];
+  const view = gh(viewArgs);
   if (!view.error && view.status === 0) corpusFailure(`release ${tag} already exists; refusing to overwrite immutable corpus seed`);
   const viewError = String(view.error?.message || view.stderr || view.stdout || '');
   if (!/(release not found|no release found)/i.test(viewError)) corpusFailure(`cannot prove ${tag} is absent (${viewError.trim() || `gh exited ${view.status}`})`);
 
   const receiptSha256 = sha256File(receiptFile);
-  const gh = (args) => run(ghCommand, [...ghPrefix, ...args], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
 
   if (!promoteLatest) {
     // BOOTSTRAP/RECOVERY seeds stay exactly as ADR-086's original contract left them: an immutable
@@ -344,6 +449,7 @@ export async function runProtectedCorpusSeed({
       '--title', `Immutable corpus seed ${archiveSha256.slice(0, 16)}`,
       '--notes', notes,
       bundleFile, receiptFile, accuracyReportFile, recallReportFile,
+      coverageAssets.coverageFile, coverageAssets.receiptFile,
     ];
     const create = gh(createArgs);
     if (create.error || create.status !== 0) {
@@ -395,7 +501,8 @@ export async function runProtectedCorpusSeed({
   // (or the next night's dispatcher) that downloads the archive must be able to reverify it against
   // the identity it was actually measured under — the blocking recall gate AND the C3 diagnostic it
   // scored 59.0% on, so nobody has to take either number on trust.
-  const assetFiles = [bundleFile, signatureFile, digestFile, receiptFile, accuracyReportFile, recallReportFile];
+  const assetFiles = [bundleFile, signatureFile, digestFile, receiptFile, accuracyReportFile, recallReportFile,
+    coverageAssets.coverageFile, coverageAssets.receiptFile];
   const create = gh([
     'release', 'create', tag,
     '--draft',
@@ -425,13 +532,22 @@ export async function runProtectedCorpusSeed({
     corpusFailure(`corpus promotion to latest failed (${String(promote.error?.message || promote.stderr || promote.stdout || '').trim()})`);
   }
 
-  const finalView = gh(['release', 'view', tag, '--json', 'tagName,isDraft,isLatest,isPrerelease,assets', '--repo', repo]);
+  // `isLatest` is NOT a `gh release view` field (gh 2.101.0: "Unknown JSON field"; it exists only on
+  // `gh release list`), so asking for it made this confirmation fail against the real CLI every time.
+  // Latest-ness is read from the one authoritative endpoint instead: releases/latest must BE this tag.
+  // tests/unit/gh-json-fields.test.mjs checks every --json field list against the captured real CLI.
+  const finalView = gh(['release', 'view', tag, '--json', 'tagName,isDraft,isPrerelease,assets', '--repo', repo]);
   if (finalView.error || finalView.status !== 0) corpusFailure('cannot confirm the promoted corpus release');
   let promoted;
   try { promoted = JSON.parse(String(finalView.stdout || 'null')); }
   catch (error) { corpusFailure(`cannot read the promoted corpus release (${error.message})`); }
+  const latestNow = gh(['api', `repos/${repo}/releases/latest`]);
+  let latestTag = null;
+  if (!latestNow.error && latestNow.status === 0) {
+    try { latestTag = JSON.parse(String(latestNow.stdout || 'null'))?.tag_name ?? null; } catch { latestTag = null; }
+  }
   const promotedAssets = (promoted?.assets || []).map((asset) => asset?.name).sort();
-  if (promoted?.tagName !== tag || promoted.isDraft !== false || promoted.isLatest !== true
+  if (promoted?.tagName !== tag || promoted.isDraft !== false || latestTag !== tag
     || promoted.isPrerelease !== false || JSON.stringify(promotedAssets) !== JSON.stringify(expectedAssets)) {
     corpusFailure('corpus release did not reach a complete, non-draft, non-prerelease latest state');
   }
@@ -448,7 +564,13 @@ if (CORPUS_SEED) {
     console.log(JSON.stringify({ ok: true, mode: 'corpus-seed', ...result }, null, 2));
   } catch (error) {
     console.error(error.message);
-    process.exitCode = 1;
+    if (error instanceof CorpusSuperseded) {
+      // Typed, not red: stdout carries the outcome the workflow records.
+      console.log(JSON.stringify({ ok: false, mode: 'corpus-seed', outcome: 'superseded', reason: error.message }));
+      process.exitCode = CORPUS_SUPERSEDED_EXIT;
+    } else {
+      process.exitCode = 1;
+    }
   }
 } else {
 
@@ -556,6 +678,22 @@ if (PUBLISH) {
       process.exit(1);
     }
   }
+  // ADR-0091 D6.6 — THE BACKWARD-MOVE RACE. Release QE sealed the corpus generation this bundle was
+  // built from; publication happens later, after owner approval. Clients always accept a code release
+  // and drop their corpusGeneration marker when they install one (kb/forge-update.mjs), so publishing
+  // a bundle built from generation G after G+1 already shipped rolls every user back one night.
+  // Re-resolve with the SAME resolver, before any asset upload, and refuse on any difference -- or on
+  // any answer that could not prove there is no newer generation.
+  try {
+    const guard = await assertNoNewerCorpusGeneration({
+      sealedFile: assets.corpusSeedPath, repo: 'stuinfla/ruvnet-brain', runtimeRoot: ROOT,
+    });
+    console.log(`  corpus seed still current at publish time: ${guard.origin} ${guard.tag}`);
+  } catch (error) {
+    console.error(`\n${c.r('✗ GATE FAILED: corpus generation moved after release QE')} ${c.dim(error.message)}`);
+    console.error(`${c.r('  NOT shipped. Re-run release QE so this release is built from the newest generation.')}\n`);
+    process.exit(1);
+  }
   const bundleSha256 = fs.readFileSync(assets.bundleDigestPath, 'utf8').trim().split(/\s+/)[0];
   if (!/^[a-f0-9]{64}$/i.test(bundleSha256)) {
     console.error(`\n${c.r('✗ GATE FAILED: release digest is not a SHA-256 value')}`);

package/scripts/retrieval-canary.mjs

@@ -5,10 +5,12 @@ import crypto from 'node:crypto';
 import readline from 'node:readline';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import { canonicalJson, digest, validateCoverageLedger } from './coverage-integrity.mjs';
+import { canonicalJson, digest, eligibleRepositoryStanding, validateCoverageLedger } from './coverage-integrity.mjs';
+import { fixtureDenominator } from './fixture-denominator.mjs';
+import { passageMatches } from './retrieval-passage-identity.mjs';
 
 // Both release phases resolve against an explicit installed context, never the checkout.
-export async function resolveInstalledCanaryCitation({ kbDir, matched, expected, passageFileDigests = new Map() }) {
+export async function resolveInstalledCanaryCitation({ kbDir, matched, expected, passageFileDigests = new Map(), contentMap }) {
   if (!path.isAbsolute(kbDir || '')) throw new Error('installed canary KB path must be absolute');
   if (String(matched?.repo || '').toLowerCase() !== expected.repo || matched?.path !== expected.path) return { resolved: false };
   if (!/^[a-z0-9][a-z0-9._-]*$/i.test(expected.repo)) throw new Error('installed citation repository violates containment');
@@ -34,7 +36,7 @@ export async function resolveInstalledCanaryCitation({ kbDir, matched, expected,
         let record;
         try { record = JSON.parse(line); } catch { continue; }
         if (record?.path !== expected.path) continue;
-        if (digest(record) !== expected.passageSha256) continue;
+        if (!passageMatches(record, expected.passageSha256, contentMap)) continue;
         const text = record.fullText || record.text;
         if (typeof text !== 'string' || !text || typeof matched.text !== 'string' || !matched.text.includes(text)) continue;
         passageSha256 = expected.passageSha256;
@@ -204,8 +206,10 @@ export function auditOracleCoverage({ coverage, queryEvidence, exemptions = null
   const checked = validateCoverageLedger(coverage);
   if (!checked.valid) throw new Error(`coverage ledger is invalid: ${checked.failures.join('; ')}`);
   validateRetrievalQueryEvidence(queryEvidence);
+  // ADR-0091 D5: a shipped store is CURRENT or STALE with a verified carry (its bytes ship). A
+  // MISSING-with-failure store ships nothing; the fixture-vs-available denominator is D6.4's change.
   const eligibleRows = coverage.rows.filter((row) => row.kind === 'repository'
-    && row.disposition === 'eligible' && row.status === 'CURRENT');
+    && row.disposition === 'eligible' && eligibleRepositoryStanding(row) === 'shipped');
   const eligible = ordered(eligibleRows.map(storeOf));
   if (!eligible.length || new Set(eligible).size !== eligible.length || eligible.some((store) => !store)) {
     throw new Error('eligible coverage denominator is invalid');
@@ -310,9 +314,20 @@ export function validateRetrievalCanaryPlan(plan) {
     'legacy population denominator');
   checkedSet(plan.denominator.legacySelectedStores, plan.denominator.legacySelectedStoreSetSha256,
     'legacy selected denominator');
+  // ADR-0091 D6.4: `eligibleStores` is the FROZEN FIXTURE denominator (it must equal the oracle's store
+  // set exactly, as before). Retired fixture stores are excluded from questioning; eligible stores the
+  // fixture does not cover are recorded, never questioned and never blocking.
+  checkedSet(plan.denominator.retiredFixtureStores, plan.denominator.retiredFixtureStoreSetSha256, 'retired fixture denominator');
+  checkedSet(plan.denominator.unfixturedEligibleStores, plan.denominator.unfixturedEligibleStoreSetSha256,
+    'unfixtured eligible record');
   if (setDigest(plan.denominator.eligibleStores) !== plan.oracle.queryStoreSetSha256) {
     throw new Error('oracle denominator differs from eligible coverage');
   }
+  if (plan.denominator.retiredFixtureStores.some((store) => !plan.denominator.eligibleStores.includes(store))
+    || plan.denominator.unfixturedEligibleStores.some((store) => plan.denominator.eligibleStores.includes(store))
+    || plan.denominator.unfixturedEligibleCount !== plan.denominator.unfixturedEligibleStores.length) {
+    throw new Error('retrieval canary fixture denominator is inconsistent');
+  }
   if (new Set(ids).size !== ids.length) throw new Error('retrieval canary plan has duplicate case ids');
   const hasDelta = plan.cases.some(({ cohort }) => cohort === 'delta');
   if ((!hasDelta && plan.noDelta !== true) || (hasDelta && plan.noDelta === true)
@@ -352,14 +367,18 @@ export function validatePlanAgainstCoverage(plan, coverage, { allowObservedBasel
   if (!checked.valid) throw new Error(`coverage ledger is invalid: ${checked.failures.join('; ')}`);
   const generation = coverage.kind === 'ruvnet-brain-release-coverage'
     ? coverage.releaseCoverageGeneration : coverage.coverageGeneration;
-  const eligible = ordered(coverage.rows.filter((row) => row.kind === 'repository'
-    && row.disposition === 'eligible' && row.status === 'CURRENT').map(storeOf));
-  if (!eligible.length || new Set(eligible).size !== eligible.length) throw new Error('eligible coverage denominator is invalid');
+  // Recomputed from the coverage and the plan's own sealed fixture, never trusted from the plan.
+  const denominator = fixtureDenominator({ coverage, fixtureStores: Object.keys(plan.oracle.evidence.queries) });
+  if (denominator.blocking.length) throw new Error(`fixture store(s) neither available nor retired: ${denominator.blocking.map(({ store }) => store).join(', ')}`);
+  const eligible = denominator.questioned;
+  if (!eligible.length) throw new Error('eligible coverage denominator is invalid');
   const baseline = new Set(plan.baseline.stores);
   const delta = eligible.filter((store) => !baseline.has(store));
   const legacy = eligible.filter((store) => baseline.has(store));
   if (generation !== plan.coverage.releaseCoverageGeneration
-    || canonicalJson(eligible) !== canonicalJson(plan.denominator.eligibleStores)
+    || canonicalJson(denominator.fixture) !== canonicalJson(plan.denominator.eligibleStores)
+    || canonicalJson(denominator.retired) !== canonicalJson(plan.denominator.retiredFixtureStores)
+    || canonicalJson(denominator.unfixturedEligible) !== canonicalJson(plan.denominator.unfixturedEligibleStores)
     || canonicalJson(delta) !== canonicalJson(plan.denominator.deltaStores)
     || canonicalJson(legacy) !== canonicalJson(plan.denominator.legacyPopulationStores)
     || plan.denominator.legacySelectedStores.some((store) => !legacy.includes(store))) {
@@ -368,7 +387,8 @@ export function validatePlanAgainstCoverage(plan, coverage, { allowObservedBasel
   return plan;
 }
 export function buildRetrievalCanaryPlan({ coverage, baseline, candidate, coverageIdentity = null, queryEvidence, assetsDir = '.',
-  readPassages = defaultReadPassages, legacySampleSize, allowNoDelta = false } = {}) {
+  readPassages = defaultReadPassages, legacySampleSize, allowNoDelta = false, contentMap, knownHitStores = null,
+  notice = (message) => process.stderr.write(`${message}\n`) } = {}) {
   const checked = validateCoverageLedger(coverage);
   if (!checked.valid) throw new Error(`coverage ledger is invalid: ${checked.failures.join('; ')}`);
   const coverageGeneration = coverage.kind === 'ruvnet-brain-release-coverage'
@@ -417,20 +437,19 @@ export function buildRetrievalCanaryPlan({ coverage, baseline, candidate, covera
   }
   validateRetrievalQueryEvidence(queryEvidence);
   if (queryEvidence.sourceCommit === candidate.sourceSha) throw new Error('independent query source is not pre-candidate');
-  const eligible = coverage.rows.filter((row) => row.kind === 'repository' && row.disposition === 'eligible');
-  if (!eligible.length || eligible.some((row) => row.status !== 'CURRENT' || !storeOf(row))) {
-    throw new Error('eligible repository coverage is incomplete');
-  }
-  const duplicateStores = eligible.map(storeOf).filter((store, index, stores) => stores.indexOf(store) !== index);
-  if (duplicateStores.length) throw new Error(`eligible repository stores are duplicated: ${ordered(new Set(duplicateStores)).join(', ')}`);
-  const eligibleStores = ordered(eligible.map(storeOf));
-  if (queryEvidence.queryStoreSetSha256 !== setDigest(eligibleStores)
-    || canonicalJson(ordered(Object.keys(queryEvidence.queries))) !== canonicalJson(eligibleStores)) {
-    const oracleStores = new Set(Object.keys(queryEvidence.queries));
-    const missing = eligibleStores.filter((store) => !oracleStores.has(store));
-    const extra = [...oracleStores].filter((store) => !eligibleStores.includes(store)).sort();
-    throw new Error(`independent query oracle does not cover the exact eligible store set (eligible=${eligibleStores.length}, oracle=${oracleStores.size}, missing=${missing.join(',') || 'none'}, extra=${extra.join(',') || 'none'})`);
-  }
+  // ADR-0091 D6.4: fixture ⊆ available. The frozen fixture no longer has to EQUAL a living eligible
+  // set; every fixture store must ship (or be verified retired), and eligible stores the fixture does
+  // not cover are recorded as unfixturedEligible, never blocking.
+  let denominator;
+  try { denominator = fixtureDenominator({ coverage, fixtureStores: Object.keys(queryEvidence.queries) }); }
+  catch (error) { throw new Error(`eligible repository coverage is incomplete (${error.message})`); }
+  if (denominator.blocking.length) {
+    throw new Error(`independent query oracle names ${denominator.blocking.length} fixture store(s) that are neither shipped nor `
+      + `verified retired: ${denominator.blocking.map(({ store, status }) => `${store}:${status ?? 'no-row'}`).join(', ')}`);
+  }
+  const eligibleStores = denominator.fixture;
+  const eligible = denominator.questionedRows;
+  if (!eligible.length) throw new Error('eligible repository coverage is incomplete');
   const baselineStores = new Set(baseline.stores.map((name) => String(name).toLowerCase()));
   const delta = eligible.filter((row) => !baselineStores.has(storeOf(row)));
   const legacyPool = eligible.filter((row) => baselineStores.has(storeOf(row)));
@@ -438,12 +457,47 @@ export function buildRetrievalCanaryPlan({ coverage, baseline, candidate, covera
   const passages = new Map(eligible.map((row) => [storeOf(row), readPassages(assetsDir, storeOf(row))]));
   const rankedLegacy = legacyPool.map((row) => ({ row, count: passages.get(storeOf(row)).length }))
     .sort((a, b) => a.count - b.count || storeOf(a.row).localeCompare(storeOf(b.row)));
+  // The legacy sample is drawn only from stores whose sealed passage still exists, unchanged, exactly
+  // once in the shipped store. When upstream edits the very file a fixture question was written against,
+  // that question can no longer identify its passage — the fixture is stale for that store, which says
+  // nothing about retrieval. Such stores stay in the sealed POPULATION (recomputed from coverage by
+  // validatePlanAgainstCoverage) but cannot be sampled; they are named below so it is never silent, and
+  // the nightly per-repository recall gate still exercises every one of them by file path.
+  const sealedPassageResolves = (store) => {
+    const evidence = queryEvidence.queries[store];
+    return Boolean(evidence) && expectedSources(evidence.expected).every((source) =>
+      passages.get(store).filter((row) => row.path === source.path && passageMatches(row, source.passageSha256, contentMap)).length === 1);
+  };
+  // INTEGRITY, NOT QUALITY. When the generation being shipped carries its own repo-recall measurement,
+  // `knownHitStores` names the stores that measurement retrieved. The release sample is then drawn from
+  // them, so the canary proves the SHIPPED, INSTALLED bundle reproduces what the generation measured on
+  // the same stores (a packaging, index, model or runtime break shows up as a miss on a store that hit).
+  // It deliberately does NOT re-judge stores the generation already missed: whole-corpus retrieval quality
+  // is the recall report's job and stays visible there (and in the corpus watchdog), because sampling ~19
+  // stores at an absolute 98% bar is a coin flip for any corpus below ~98% true recall (measured
+  // 2026-09-30: previous corpus 18/19, fresh corpus 17/19 on the same questions). Without a measurement
+  // (the committed bootstrap seed) nothing is filtered and the historical behaviour is unchanged.
+  const measuredHit = (store) => !knownHitStores || knownHitStores.has(store);
   const strata = new Map();
+  const staleFixtureStores = [];
+  const generationMissStores = [];
   rankedLegacy.forEach((entry, index) => {
     const stratum = Math.min(3, Math.floor(index * 4 / rankedLegacy.length));
+    const store = storeOf(entry.row);
+    if (!sealedPassageResolves(store)) { staleFixtureStores.push(store); return; }
+    if (!measuredHit(store)) { generationMissStores.push(store); return; }
     if (!strata.has(stratum)) strata.set(stratum, []);
     strata.get(stratum).push(entry);
   });
+  if (generationMissStores.length) {
+    notice(`[retrieval-canary] ${generationMissStores.length} of ${rankedLegacy.length} fixture store(s) not sampled: the generation's own `
+      + `recall measurement did not retrieve their sealed file (retrieval-quality debt, tracked by the recall report, not re-judged here): `
+      + `${ordered(generationMissStores).join(', ')}`);
+  }
+  if (staleFixtureStores.length) {
+    notice(`[retrieval-canary] ${staleFixtureStores.length} of ${rankedLegacy.length} fixture store(s) excluded from the legacy sample: `
+      + `their sealed passage no longer exists unchanged in the shipped store: ${ordered(staleFixtureStores).join(', ')}`);
+  }
   // Source-only releases retain the same corpus sample; the plan still seals exact release bytes.
   const samplingGeneration = coverage.kind === 'ruvnet-brain-release-coverage'
     ? coverage.corpusCoverage.coverageGeneration : coverageGeneration;
@@ -470,7 +524,7 @@ export function buildRetrievalCanaryPlan({ coverage, baseline, candidate, covera
       const observedPassageCount = passageCount ?? passages.get(store).length;
       const evidence = queryEvidence.queries[store];
       if (!evidence || expectedSources(evidence.expected).some((source) =>
-        passages.get(store).filter((row) => row.path === source.path && digest(row) === source.passageSha256).length !== 1)) {
+        passages.get(store).filter((row) => row.path === source.path && passageMatches(row, source.passageSha256, contentMap)).length !== 1)) {
         throw new Error(`${store} has no sealed independent query evidence`);
       }
       return {
@@ -502,6 +556,11 @@ export function buildRetrievalCanaryPlan({ coverage, baseline, candidate, covera
     denominator: {
       eligibleStores,
       eligibleStoreSetSha256: setDigest(eligibleStores),
+      retiredFixtureStores: denominator.retired,
+      retiredFixtureStoreSetSha256: setDigest(denominator.retired),
+      unfixturedEligibleStores: denominator.unfixturedEligible,
+      unfixturedEligibleStoreSetSha256: setDigest(denominator.unfixturedEligible),
+      unfixturedEligibleCount: denominator.unfixturedEligible.length,
       deltaStores: ordered(delta.map(storeOf)),
       deltaStoreSetSha256: setDigest(delta.map(storeOf)),
       legacyPopulationStores: ordered(legacyPool.map(storeOf)),

package/scripts/retrieval-passage-identity.mjs

@@ -0,0 +1,58 @@
+// How the retrieval fixture recognises "the expected passage" across store rebuilds.
+//
+// data/retrieval-query-evidence.json pins each expected passage by digest(row), where a row is
+// { id, path, text, title }. Until 2026-09-29 the `id` was an ordinal ("2824"); the CI corpus builder
+// now writes content-addressed ids ("chunk:<hash>"). The same passage — identical path, title and text —
+// therefore changed digest with no content change, and every release that consumed a freshly built
+// generation failed with "<store> has no sealed independent query evidence" (4.3.37 preflight, 2026-09-29).
+//
+// The fixture bytes are FROZEN on purpose: its sha256 is what corpus-next-seed judges a generation's
+// recall report against, so editing it would make the newest generation an incompatible seed and force
+// a full multi-hour rebuild. Instead this module adds a second, id-independent identity, looked up
+// through a committed map (pinned digest -> content digest) derived once, mechanically, from the last
+// corpus built with ordinal ids (scripts/derive-passage-content-map.mjs). The map can only ADD
+// acceptance for a row whose path, title and text equal the row the fixture originally pinned.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { digest } from './coverage-integrity.mjs';
+
+export const CONTENT_MAP_FILE = path.resolve(path.dirname(fileURLToPath(import.meta.url)),
+  '..', 'data', 'retrieval-passage-content-digests.json');
+export const CONTENT_MAP_KIND = 'ruvnet-brain-retrieval-passage-content-digests';
+const HEX64 = /^[a-f0-9]{64}$/;
+
+/** Digest of everything about a passage row except its (build-dependent) id. */
+export function passageContentDigest(row) {
+  const { id: _id, ...rest } = row ?? {};
+  return digest(rest);
+}
+
+/** pinned digest -> content digest. A missing file is an empty map: legacy exact-digest matching only. */
+export function loadContentMap(file = CONTENT_MAP_FILE) {
+  let parsed;
+  try { parsed = JSON.parse(fs.readFileSync(file, 'utf8')); } catch (error) {
+    if (error.code === 'ENOENT') return new Map();
+    throw new Error(`passage content map is unreadable: ${error.message}`);
+  }
+  if (parsed?.kind !== CONTENT_MAP_KIND || parsed.schemaVersion !== 1
+    || !parsed.entries || typeof parsed.entries !== 'object' || Array.isArray(parsed.entries)) {
+    throw new Error('passage content map is malformed');
+  }
+  const map = new Map();
+  for (const [pinned, content] of Object.entries(parsed.entries)) {
+    if (!HEX64.test(pinned) || !HEX64.test(String(content))) throw new Error('passage content map holds a non-sha256 entry');
+    map.set(pinned, content);
+  }
+  return map;
+}
+
+let cachedMap = null;
+const defaultMap = () => (cachedMap ??= loadContentMap());
+
+/** Does this row satisfy a fixture pin: exact digest, or (when the map knows the pin) equal content. */
+export function passageMatches(row, pinnedSha256, map = defaultMap()) {
+  if (digest(row) === pinnedSha256) return true;
+  const content = map.get(pinnedSha256);
+  return Boolean(content) && passageContentDigest(row) === content;
+}

package/scripts/source-coverage.mjs

@@ -341,7 +341,13 @@ function assertExclusionEvidence(repo, exclusion, upstreamSha) {
   }
 }
 
-export function classifyRepository(repo, evidence, exclusion = null) {
+// ADR-0091 D5: `outcome` is what reconciliation recorded for this store when its refresh FAILED this
+// generation -- { carry } (previous bytes kept, already re-hashed against the ledger), { failure } (no
+// prior bytes), or { integrity } (carried bytes failed that re-hash). The status token is always the
+// one the evidence proves; the record is attached only where it agrees with that status, so a carry
+// can never dress up a row the bytes do not support. Rows are annotated BEFORE sealing, so the
+// coverage generation digest covers them.
+export function classifyRepository(repo, evidence, exclusion = null, outcome = null) {
   const upstreamSha = repo.defaultBranchRef?.target?.oid || null;
   const activeExclusion = Boolean(exclusion && String(exclusion.pushedAt || '') !== ''
     && String(exclusion.pushedAt) === String(repo.pushedAt || ''));
@@ -373,6 +379,14 @@ export function classifyRepository(repo, evidence, exclusion = null) {
   else if (evidence.receipt.sourceCommit !== upstreamSha) { status = 'STALE'; reasons.push('receipt sourceCommit differs from upstream HEAD'); }
   else if (!evidence.bytesVerified) { status = 'FAILED'; reasons.push('RVF bytes do not match receipt'); }
   else if (!evidence.passagesPresent) { status = 'FAILED'; reasons.push('passage inventory is absent'); }
+  const disposed = isIngestibleDisposition(disposition);
+  if (disposed && outcome?.integrity && ['CURRENT', 'STALE'].includes(status)) {
+    status = 'FAILED';
+    reasons.push(outcome.integrity);
+  }
+  const record = {};
+  if (disposed && outcome?.carry && status === 'STALE') record.carry = { ...outcome.carry };
+  if (disposed && outcome?.failure && status === 'MISSING') record.failure = { ...outcome.failure };
   return {
     key: repo.fullName ? `repo:${repo.fullName.toLowerCase()}` : `repo:${repo.databaseId}`,
     kind: 'repository',
@@ -391,6 +405,7 @@ export function classifyRepository(repo, evidence, exclusion = null) {
       cardPresent: evidence.cardPresent },
     status,
     reasons,
+    ...record,
   };
 }
 
@@ -567,7 +582,7 @@ export function explainCoverageDrift(recorded, current) {
 // where they are source-controlled (`<repo>/kb`) unless the caller names both directories, as the
 // release path does with `--assets`.
 export function buildCoverage({ owner = 'ruvnet', env = process.env, home = os.homedir(), kbDir = null, policyDir = null,
-  observation = null, gh = runGh, now = () => new Date().toISOString() } = {}) {
+  observation = null, gh = runGh, now = () => new Date().toISOString(), storeOutcomes = null } = {}) {
   policyDir ??= kbDir ?? path.join(ROOT, 'kb');
   kbDir ??= storeRoot(env, home);
   if (rootNeverMaterialized(kbDir)) {
@@ -597,7 +612,8 @@ export function buildCoverage({ owner = 'ruvnet', env = process.env, home = os.h
   const exclusions = fs.existsSync(exclusionsPath) ? JSON.parse(fs.readFileSync(exclusionsPath, 'utf8')) : {};
   const rows = repositories.rows.map((repo) => {
     const store = storeName(repo.storeName || repo.name);
-    return classifyRepository(repo, artifactEvidence(kbDir, ledger, cardStores, store), exclusions[store] || null);
+    return classifyRepository(repo, artifactEvidence(kbDir, ledger, cardStores, store), exclusions[store] || null,
+      storeOutcomes?.[store.toLowerCase()] || null);
   });
   const gistEvidence = { ...artifactEvidence(kbDir, ledger, cardStores, 'ruv-gists'), sources: gistSources };
   try {

package/scripts/wired-check.mjs

@@ -120,6 +120,10 @@ const STANDALONE = [
   ['self-update', 'author-run candidate rebuild; --apply is guarded by worktree-integrity.mjs and is not scheduled'],
   ['ingest-new-repos', 'author-run corpus expansion; --apply is guarded by worktree-integrity.mjs and is not scheduled'],
   ['count-chunks', 'human-run CLI — recount + restamp chunk surfaces (--check for drift); no scheduler'],
+  ['derive-passage-content-map', 'human-run maintainer tool — regenerates data/retrieval-passage-content-digests.json '
+    + 'from a corpus built with ordinal passage ids, only when the frozen fixture changes; '
+    + 'tests/unit/retrieval-passage-identity.test.mjs fails if the committed map stops matching the fixture, '
+    + 'so a stale map cannot go unnoticed and there is nothing to schedule'],
   ['brain-stamp', 'invoked by the author-run self-update.mjs candidate builder'],
   ['lesson-promote', 'human-run CLI — promotion is manual (--apply); no scheduler yet (automation is ADR-029 #4, open)'],
   ['behavioral-l1-l4', 'behavioural harness invoked by its own test file — not a product path'],