ruvnet-brain 4.5.1 → 4.5.3

package/plugin/scripts/session-start-update-plane.mjs

@@ -13,16 +13,30 @@ import { inventoryFootprint } from './brain-footprint.mjs';
 import { confirm, footprintAlarm } from './brain-confirmation.mjs';
 
 /**
- * KNOWLEDGE SELF-HEAL (owner invariant 2026-09-30: no brain may ever be more than 48h old). The
- * nightly scheduler is opt-in and can silently never register, so this does not depend on it: when
- * a session starts and nothing proves the knowledge current inside 24h, launch ONE detached, bounded
- * `npx ruvnet-brain@latest --update --no-nightly-prompt` (the exact argv bin/nightly-refresh.mjs
- * runs) through the existing host-update.mjs credential boundary and detach.mjs TTL supervisor.
- * Per machine (all state under brainHome), at most one launch per 6h (30 min after an offline
- * probe), never while a refresh lock or another launch is live, never blocks (spawn + unref, no
- * wait). The outcome is recorded by the worker and spoken by the NEXT session's knowledge line.
+ * KNOWLEDGE SELF-HEAL (owner invariant 2026-09-30: no brain may ever be more than 48h old) AND
+ * NEWER-PUBLISHED CHECK (owner requirement 2026-10-02: "all accounts auto update anytime a new corpus of
+ * knowledge happens"). Two triggers, ONE updater:
+ *   • 'update' — nothing proves the knowledge current inside 24h: launch the detached, bounded
+ *     `npx ruvnet-brain@latest --update --no-nightly-prompt` (the exact argv bin/nightly-refresh.mjs runs)
+ *     through host-update.mjs's credential boundary and detach.mjs's TTL supervisor. At most one launch
+ *     per 6h (30 min after an offline probe).
+ *   • 'check' — the knowledge is fresh BY AGE, but age never says whether something newer was published
+ *     (measured: v4.4.1 stayed live ~13h after v4.5.0 shipped). At most once per checkMinutes per machine,
+ *     the same detached worker first runs the installed `kb/forge-update.mjs --check` (one GET of the
+ *     canonical releases/latest pointer, no download) and proceeds to the SAME update only on a newer
+ *     identity — forge-update's currencyVerdict(): UPDATE_AVAILABLE/UNKNOWN; CURRENT and REFUSED (the
+ *     published corpus is older: never downgrade) stop there.
+ * Per machine (all state under brainHome), never while a refresh lock or another launch is live, never
+ * blocks (spawn + unref, no wait). SessionStart calls this; so does the long-lived MCP server on a timer
+ * (plugin/mcp/server.mjs, announce:false so it never consumes the once-per-session line). The outcome is
+ * recorded by the worker and spoken by the NEXT session's knowledge line.
  */
-export const AUTO_UPDATE_POLICY = Object.freeze({ staleHours: 24, retryHours: 6, offlineRetryMinutes: 30, ttlSec: 1800 });
+export const AUTO_UPDATE_POLICY = Object.freeze({ staleHours: 24, retryHours: 6, offlineRetryMinutes: 30, ttlSec: 1800, checkMinutes: 60 });
+export const corpusCheckMinutes = (env = {}) => {
+  const raw = env.RUVNET_CORPUS_CHECK_MINUTES;
+  const n = Number(raw);
+  return raw !== undefined && raw !== '' && Number.isFinite(n) && n >= 0 ? n : AUTO_UPDATE_POLICY.checkMinutes;
+};
 
 const writeJsonAtomic = (file, value) => {
   const tmp = `${file}.tmp-${process.pid}`;
@@ -30,14 +44,17 @@ const writeJsonAtomic = (file, value) => {
   catch { try { fs.rmSync(tmp, { force: true }); } catch { /* ignore */ } return false; }
 };
 
-export const knowledgeAutoUpdate = ({ env, home, now, hookDir, emit = () => {}, spawnFn = spawn }) => {
+export const knowledgeAutoUpdate = ({ env, home, now, hookDir, emit = () => {}, spawnFn = spawn, announce = true }) => {
   const facts = knowledgeFacts({ env, home, now });
-  const { attemptFile, lockFile, logFile } = facts.auto;
+  const { attemptFile, lockFile, logFile, checkFile, checkResultFile } = facts.auto;
   const attempt = facts.attempt;
   const hoursAgo = (iso) => (now - Date.parse(iso || '')) / 3_600_000;
-  if (attempt?.outcome === 'succeeded' && !attempt.reported) {
+  if (announce && attempt?.outcome === 'succeeded' && !attempt.reported) {
     const built = facts.builtMs;
-    const tag = facts.source?.releaseTag ? `corpus ${facts.source.releaseTag}` : 'the latest corpus';
+    // A corpus-only release carries its identity in corpusReleaseTag; releaseTag is the code release beside it.
+    const id = facts.source?.corpusReleaseTag || facts.source?.releaseTag;
+    const short = id && id.length > 28 ? `${id.slice(0, 26)}…` : id;
+    const tag = !id ? 'the latest corpus' : id.startsWith('corpus-') ? short : `corpus ${short}`;
     emit(`${KNOWLEDGE_LINE_PREFIX}UPDATED] automatic update finished ${Math.round(hoursAgo(attempt.finishedAt))}h ago: ${tag}, `
       + `knowledge base built ${Number.isFinite(built) ? `${Math.round(facts.hours(built))}h ago` : 'at an UNKNOWN time'}.`);
     writeJsonAtomic(attemptFile, { ...attempt, reported: true });
@@ -46,7 +63,14 @@ export const knowledgeAutoUpdate = ({ env, home, now, hookDir, emit = () => {},
   if (optOut) return { launched: false, why: optOut };
   const fresh = facts.provenWithin(AUTO_UPDATE_POLICY.staleHours)
     || (Number.isFinite(facts.builtMs) && facts.hours(facts.builtMs) <= AUTO_UPDATE_POLICY.staleHours);
-  if (fresh) return { launched: false, why: 'fresh' };
+  const mode = fresh ? 'check' : 'update';
+  if (mode === 'check') {
+    const lastCheck = Date.parse(facts.corpusCheck?.launchedAt || '');
+    const sinceCheck = now - lastCheck;
+    if (Number.isFinite(lastCheck) && sinceCheck >= 0 && sinceCheck < corpusCheckMinutes(env) * 60_000) {
+      return { launched: false, why: 'fresh' };
+    }
+  }
   // A nightly or manual --update holds this lock (kb/refresh-run.mjs refreshLockPath, duplicated here
   // because the plugin payload cannot import kb/); --update would refuse anyway, this saves the launch.
   if (exists(path.join(path.dirname(facts.kbDir), `.${path.basename(facts.kbDir)}.refresh-run.lock`))) {
@@ -54,8 +78,11 @@ export const knowledgeAutoUpdate = ({ env, home, now, hookDir, emit = () => {},
   }
   const since = hoursAgo(attempt?.launchedAt);
   const retryHours = attempt?.outcome === 'offline' ? AUTO_UPDATE_POLICY.offlineRetryMinutes / 60 : AUTO_UPDATE_POLICY.retryHours;
-  if (since >= 0 && since < retryHours) return { launched: false, why: 'throttled' };
-  // Cross-process: exactly one session wins the O_EXCL create; a lock older than the TTL is stale.
+  // A SUCCEEDED update never delays the next newer-published check: a different, newer corpus may proceed
+  // at once. The same target is not re-run within 6h (host-update.mjs --if-newer's 'not-converged' guard).
+  const retryBlocks = !(mode === 'check' && attempt?.outcome === 'succeeded');
+  if (retryBlocks && since >= 0 && since < retryHours) return { launched: false, why: 'throttled' };
+  // Cross-process: exactly one session (or MCP server timer) wins the O_EXCL create; a stale lock is reclaimed.
   const claim = () => { try { fs.writeFileSync(lockFile, `${JSON.stringify({ pid: process.pid, at: new Date(now).toISOString() })}\n`, { flag: 'wx' }); return true; } catch { return false; } };
   if (!claim()) {
     const lockMs = Date.parse(json(lockFile)?.at || '') || mtimeMs(lockFile);
@@ -63,20 +90,26 @@ export const knowledgeAutoUpdate = ({ env, home, now, hookDir, emit = () => {},
     try { fs.rmSync(lockFile, { force: true }); } catch { /* raced */ }
     if (!claim()) return { launched: false, why: 'locked' };
   }
-  writeJsonAtomic(attemptFile, { schemaVersion: 1, launchedAt: new Date(now).toISOString(), outcome: 'launched' });
+  const at = new Date(now).toISOString();
+  // A check is not an update attempt: it must not reset the 6h retry or read as an abandoned launch.
+  if (mode === 'update') writeJsonAtomic(attemptFile, { schemaVersion: 1, launchedAt: at, outcome: 'launched' });
+  else writeJsonAtomic(checkFile, { ...(facts.corpusCheck || {}), schemaVersion: 1, launchedAt: at, outcome: 'checking' });
   try {
     const child = spawnFn(process.execPath, [path.join(hookDir, 'detach.mjs'), String(AUTO_UPDATE_POLICY.ttlSec), logFile,
-      process.execPath, path.join(hookDir, 'host-update.mjs'), '--knowledge', attemptFile, lockFile],
+      process.execPath, path.join(hookDir, 'host-update.mjs'), '--knowledge', attemptFile, lockFile,
+      ...(mode === 'check' ? ['--if-newer', facts.kbDir, checkFile, checkResultFile] : [])],
     { detached: true, stdio: 'ignore', env, windowsHide: true });
     child.on?.('error', () => {});
     child.unref?.();
   } catch (error) {
-    writeJsonAtomic(attemptFile, { schemaVersion: 1, launchedAt: new Date(now).toISOString(), outcome: 'failed',
-      code: null, reason: `could not launch: ${error.message}`, finishedAt: new Date(now).toISOString() });
+    const reason = `could not launch: ${error.message}`;
+    if (mode === 'update') {
+      writeJsonAtomic(attemptFile, { schemaVersion: 1, launchedAt: at, outcome: 'failed', code: null, reason, finishedAt: at });
+    } else writeJsonAtomic(checkFile, { schemaVersion: 1, launchedAt: at, outcome: 'failed', reason, checkedAt: at });
     try { fs.rmSync(lockFile, { force: true }); } catch { /* ignore */ }
-    return { launched: false, why: 'launch failed' };
+    return { launched: false, why: 'launch failed', mode };
   }
-  return { launched: true, why: 'stale' };
+  return { launched: true, why: mode === 'check' ? 'checking for a newer published corpus' : 'stale', mode };
 };
 
 /**
@@ -179,7 +212,9 @@ export const heartbeat = ({ env, hookDir, stateDir, home, running, seedDispatche
   const kbDir = path.join(home, '.cache', 'ruvnet-brain', 'kb');
   if (pref === 'yes' && exists(path.join(kbDir, 'forge-update.mjs'))) {
     const kbLog = path.join(stateDir, '.last-kb-check.log');
-    if (/\bBEHIND\b/.test(read(kbLog))) {
+    // Only when the automatic knowledge update is OFF on this machine: otherwise it IS applied (signature
+    // verified first) and the knowledge line says so — this notice would be a false statement.
+    if (/\bBEHIND\b/.test(read(kbLog)) && autoUpdateOptOut({ env, home, facts: knowledgeFacts({ env, home, now }) })) {
       emit('[RuvNet Brain — a newer knowledge bundle is available. It is signed (Ed25519) and the updater verifies that signature before extracting anything. We do NOT auto-apply it: applying replaces executable tool files, which is your call. To update: npx ruvnet-brain@latest --update]');
     }
     // S2 (ONE CURRENCY VERDICT): --result-file records the SAME structured verdict --check/--apply

package/plugin/scripts/turn-outcome-capture.mjs

@@ -10,9 +10,8 @@
  *                           is the RECORDING tier; distill mines it into episodes/reasoning_patterns/
  *                           causal_edges, the KNOWLEDGE tier, which stays empty unless it is run)
  *
- * WHERE: the project's `.swarm/memory.db` when it exists, else the machine-wide
- * `~/.claude/global-memory/.swarm/memory.db` (outside every repository). `.swarm` is NEVER created
- * inside a project — see session-snapshot-hook.mjs's writeSessionSnapshot for why that is trespass.
+ * WHERE: only the canonical project's `.swarm/memory.db` (including linked worktrees).
+ * An absent store requires persisted opt-in; there is no automatic machine-wide fallback.
  *
  * WHAT (measured facts carried over from the owner's local Claude hook, 2026-09-29):
  *   • The Brain's continuation gate continues most turns, so the turn's REAL final Stop carries
@@ -33,7 +32,7 @@
  * LATENCY: Stop runs synchronously in the host's turn, and one `ruflo memory store` costs ~0.7s
  * (measured). So the writes run in ONE detached worker (this file, `--run-steps`), store then
  * distill in order; the hook itself only reads, fingerprints and spawns. A breadcrumb line is
- * appended next to the db BEFORE the spawn, and the worker appends a receipt per step, so a lost
+ * containing only key, hash and length is appended BEFORE the spawn; exact readback receipts make a lost
  * write is visible rather than silent. Advisory always: nothing here throws to the caller.
  */
 import fs from 'node:fs';
@@ -43,7 +42,8 @@ import crypto from 'node:crypto';
 import { spawn, spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { resolveRuflo, rufloInvocation } from './ruflo-bin.mjs';
-import { userLevelAgentdbHooks } from './continuity-events.mjs';
+import { redactText, userLevelAgentdbHooks } from './continuity-events.mjs';
+import { resolveProjectStore } from './project-store-resolver.mjs';
 
 export const TURN_NAMESPACE = 'turns';
 export const MIN_OUTCOME_CHARS = 200;
@@ -87,7 +87,7 @@ export function claudeTurn(lines) {
     if ((o?.message?.role || o?.role) !== 'assistant') continue;
     const c = o.message?.content;
     const t = textOf(c).trim();
-    if (t) texts.push(t);
+    if (t) texts.push(redactText(t));
     if (!Array.isArray(c)) continue;
     for (const u of c) {
       if (!u || u.type !== 'tool_use') continue;
@@ -138,22 +138,63 @@ export function readSettledTranscript(file, { stableMs = 400, maxMs = 2000, slee
 
 export function buildTurnRecord({ turn, project, host, session, at = new Date() }) {
   const parts = [`[turn ${at.toISOString()} project=${project} host=${host}]`,
-    `OUTCOME: ${turn.finalText.replace(/\s+/g, ' ').slice(0, 2500)}`];
-  if (turn.files.length) parts.push(`FILES CHANGED: ${turn.files.slice(0, 25).join(', ')}`);
-  if (turn.actions.length) parts.push(`ACTIONS: ${turn.actions.slice(-15).join(' • ')}`);
+    `OUTCOME: ${redactText(turn.finalText).replace(/\s+/g, ' ').slice(0, 2500)}`];
+  if (turn.files.length) parts.push(`FILES CHANGED: ${turn.files.slice(0, 25).map(redactText).join(', ')}`);
+  if (turn.actions.length) parts.push(`ACTIONS: ${turn.actions.slice(-15).map(redactText).join(' • ')}`);
   parts.push(`SESSION: ${session || '?'}`);
-  return parts.join('  ||  ').slice(0, 4000);
+  return redactText(parts.join('  ||  ')).slice(0, 4000);
 }
 
-/** Project db if the project already has one; otherwise the machine-wide db outside every repo. */
-export function resolveTurnDb({ projectDir, home = os.homedir(), env = process.env } = {}) {
-  const projectDb = path.join(projectDir, '.swarm', 'memory.db');
-  try { if (fs.statSync(projectDb).isFile()) return { db: projectDb, scope: 'project' }; } catch { /* absent */ }
-  const globalDb = env.RUVNET_TURN_GLOBAL_DB || path.join(home, '.claude', 'global-memory', '.swarm', 'memory.db');
-  return { db: globalDb, scope: 'global' };
+/** Persisted per-canonical-project/per-path consent, reread at every boundary (no restart). */
+export function turnCapturePolicyFile(brainHome) {
+  return path.join(brainHome, 'turn-capture', 'policy.json');
 }
 
-const projectName = (projectDir) => path.basename(path.resolve(projectDir)).replace(/[^A-Za-z0-9._-]/g, '_') || 'project';
+const consentMap = (value) => value !== null && typeof value === 'object'
+  && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype
+  && Object.values(value).every((setting) => setting === 'on' || setting === 'off');
+
+export function resolveTurnDb({ projectDir, brainHome, requestedStorePath, gitTimeoutMs = 1000 } = {}) {
+  const resolved = resolveProjectStore({ projectDir, requestedStorePath, gitTimeoutMs });
+  let policy = {};
+  const file = brainHome && turnCapturePolicyFile(brainHome);
+  if (file && fs.existsSync(file)) {
+    try {
+      policy = JSON.parse(fs.readFileSync(file, 'utf8'));
+      if (policy?.schemaVersion !== 1 || !consentMap(policy.projects)
+        || (Object.hasOwn(policy, 'paths') && !consentMap(policy.paths))) throw new Error('invalid policy');
+    } catch { return { skipped: 'turn capture policy unreadable or invalid', projectRoot: resolved.projectRoot }; }
+  }
+  // A path rule wins over a project rule, allowing a linked checkout/subdirectory to opt out.
+  const setting = policy.paths?.[fs.realpathSync.native(projectDir)] ?? policy.projects?.[resolved.projectRoot];
+  if (setting !== undefined && !['on', 'off'].includes(setting)) return { skipped: 'invalid turn capture consent', projectRoot: resolved.projectRoot };
+  const db = resolved.canonicalAgentDbPath;
+  assertTurnStoreFiles(db);
+  if (setting === 'off') return { db, scope: 'project', projectRoot: resolved.projectRoot, skipped: 'persisted turn capture opt-out' };
+  let exists = false;
+  try { exists = fs.statSync(db).isFile(); } catch { /* absent */ }
+  if (!exists && setting !== 'on') return { db, scope: 'project', projectRoot: resolved.projectRoot, skipped: 'no project memory db; persisted opt-in required' };
+  return { db, scope: 'project', projectRoot: resolved.projectRoot, optedIn: setting === 'on' };
+}
+
+// Revalidation narrows the queue-to-launch window; it does not make SQLite's later open atomic.
+function assertTurnStoreFiles(db) {
+  const directory = path.dirname(db);
+  let stat;
+  try { stat = fs.lstatSync(directory); } catch (error) { if (error.code !== 'ENOENT') throw error; }
+  if (stat && (!stat.isDirectory() || stat.isSymbolicLink() || fs.realpathSync.native(directory) !== directory)) {
+    throw new Error('store directory is not a canonical regular directory');
+  }
+  for (const file of [db, `${db}-wal`, `${db}-shm`, `${db}-journal`]) {
+    let entry;
+    try { entry = fs.lstatSync(file); } catch (error) { if (error.code !== 'ENOENT') throw error; }
+    if (entry && (!entry.isFile() || entry.isSymbolicLink() || entry.nlink > 1)) {
+      throw new Error('store or SQLite side file is a symlink, hard link or non-regular file');
+    }
+  }
+}
+
+const projectName = (projectDir) => redactText(path.basename(path.resolve(projectDir))).replace(/[^A-Za-z0-9._-]/g, '_') || 'project';
 
 /** Detached worker launch: the hook returns immediately; the worker runs the steps in order. */
 export function launchDetached(steps, { receipts }) {
@@ -164,22 +205,36 @@ export function launchDetached(steps, { receipts }) {
   return { launched: true, pid: child.pid };
 }
 
-function sameTurnSeen(stateFile, sessionKey, fingerprint) {
-  let last = {};
-  try { last = JSON.parse(fs.readFileSync(stateFile, 'utf8')) || {}; } catch { /* first run */ }
-  if (last[sessionKey] === fingerprint) return true;
+function readTurnState(stateFile) {
+  try { return JSON.parse(fs.readFileSync(stateFile, 'utf8')) || {}; } catch { return {}; }
+}
+
+function sameTurnSeen(stateFile, sessionKey, fingerprint, receipts) {
+  const previous = readTurnState(stateFile)[sessionKey];
+  if (previous?.fingerprint !== fingerprint) return false;
+  try {
+    const rows = readTail(receipts, 128 * 1024).flatMap((line) => { try { return [JSON.parse(line)]; } catch { return []; } });
+    const receipt = rows.findLast((r) => r.kind === 'store' && r.key === previous.key);
+    if (receipt) return receipt.status === 0 && receipt.verified === true;
+  } catch { /* queued worker has no receipt yet */ }
+  // An in-flight worker gets a bounded grace period; a killed/lost worker cannot consume the turn forever.
+  return Date.now() - previous.at < 2 * STEP_TIMEOUT_MS + 10_000;
+}
+
+function markTurnQueued(stateFile, sessionKey, fingerprint, key) {
+  const last = readTurnState(stateFile);
   const keys = Object.keys(last);
   for (const k of keys.slice(0, Math.max(0, keys.length - 200))) delete last[k];
   try {
     fs.mkdirSync(path.dirname(stateFile), { recursive: true, mode: 0o700 });
-    fs.writeFileSync(stateFile, JSON.stringify({ ...last, [sessionKey]: fingerprint }), { mode: 0o600 });
+    fs.writeFileSync(stateFile, JSON.stringify({ ...last, [sessionKey]: { fingerprint, key, at: Date.now() } }), { mode: 0o600 });
   } catch { /* dedupe is best effort; a duplicate record beats a lost one */ }
-  return false;
 }
 
 /**
  * Capture this turn's outcome (Stop) and/or queue distillation (SessionEnd, PreCompact).
- * Returns a plain report; `skipped` / `distill.skipped` carry the reason whenever nothing is written.
+ * Returns a plain report; `queued` means a worker request, never proof the store committed.
+ * `skipped` / `distill.skipped` carry the reason whenever nothing is requested.
  */
 export function captureTurnOutcome({
   projectDir, event, payload = {}, host = 'claude',
@@ -191,15 +246,20 @@ export function captureTurnOutcome({
   settleMs = 2000,
   now = () => new Date(),
 } = {}) {
-  const report = { event, host, recorded: false, distill: { queued: false } };
+  const report = { event, host, queued: false, recorded: false, distill: { queued: false } };
   if (String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() === 'off') {
     return { ...report, skipped: 'RUVNET_TURN_CAPTURE=off', distill: { queued: false, skipped: 'RUVNET_TURN_CAPTURE=off' } };
   }
   if (!ruflo) return { ...report, skipped: 'ruflo not found', distill: { queued: false, skipped: 'ruflo not found' } };
-  const { db, scope } = resolveTurnDb({ projectDir, home, env });
+  let target;
+  try { target = resolveTurnDb({ projectDir, brainHome }); } catch (error) { return { ...report, skipped: `store resolution failed: ${redactText(error.message)}` }; }
+  const { db, scope, projectRoot } = target;
   Object.assign(report, { db, scope });
+  if (target.skipped) return { ...report, skipped: target.skipped, distill: { queued: false, skipped: target.skipped } };
   const steps = [];
-  const project = projectName(projectDir);
+  const binding = { projectRoot, projectDir: fs.realpathSync.native(projectDir), brainHome };
+  let dedupe;
+  const project = projectName(projectRoot);
   const receipts = path.join(brainHome, 'turn-capture', 'receipts.jsonl');
 
   // ONE WRITER PER TURN (ADR-100 §3). Measured 2026-10-01 on this repo's real store: 624 `turns` rows
@@ -228,14 +288,17 @@ export function captureTurnOutcome({
     } else {
       const fingerprint = crypto.createHash('sha256').update(JSON.stringify([turn.finalText, turn.files])).digest('hex');
       const stateFile = path.join(brainHome, 'turn-capture', 'last-turn.json');
-      if (sameTurnSeen(stateFile, `${host}:${sessionKey}`, fingerprint)) report.skipped = 'same turn outcome already recorded';
+      const identity = crypto.createHash('sha256').update(`${host}:${db}:${sessionKey}`).digest('hex');
+      if (sameTurnSeen(stateFile, identity, fingerprint, receipts)) report.skipped = 'same turn outcome already queued or verified';
       else {
         const at = now();
-        const key = `turn-${project}-${at.getTime()}`;
+        const key = `turn-${project}-${at.getTime()}-${crypto.randomBytes(6).toString('hex')}`;
+        dedupe = { stateFile, identity, fingerprint, key };
         const value = buildTurnRecord({ turn, project, host, session: payload.session_id, at });
-        steps.push({ kind: 'store', ruflo, args: ['memory', 'store', '-k', key, '--value', value, '-n', TURN_NAMESPACE,
+        steps.push({ ...binding, kind: 'store', ruflo, args: ['memory', 'store', '-k', key, '--value', value, '-n', TURN_NAMESPACE,
           '--path', db, '--tags', `project=${project},host=${host}`, '--provenance', 'agent_output'] });
-        Object.assign(report, { recorded: true, key, value });
+        // This synchronous boundary proves only queuing; the worker's exact receipt proves recording.
+        Object.assign(report, { queued: true, key, value });
       }
     }
   } else report.skipped = `turn outcomes are recorded at Stop, not ${event}`;
@@ -243,49 +306,66 @@ export function captureTurnOutcome({
   if (event === 'SessionEnd' || event === 'PreCompact') {
     if (!fs.existsSync(db)) report.distill = { queued: false, skipped: 'no memory db to distill yet' };
     else {
-      steps.push({ kind: 'distill', ruflo, args: ['memory', 'distill', 'run', '--db', db, '--namespace', TURN_NAMESPACE, '--max-entries', '500'] });
+      steps.push({ ...binding, kind: 'distill', ruflo, args: ['memory', 'distill', 'run', '--db', db, '--namespace', TURN_NAMESPACE, '--max-entries', '500'] });
       report.distill = { queued: true, db };
     }
   }
   if (!steps.length) return report;
 
   try {
-    // The machine-wide db lives outside every repository; its directory is created on first use so a
-    // fresh machine records from its first turn. A project's `.swarm` is never created (scope check).
-    if (scope === 'global') fs.mkdirSync(path.dirname(db), { recursive: true, mode: 0o700 });
-    if (report.recorded) {
+    // Only explicit persisted consent permits creating a project store directory.
+    if (target.optedIn) fs.mkdirSync(path.dirname(db), { recursive: true, mode: 0o700 });
+    if (report.queued) {
       fs.appendFileSync(path.join(path.dirname(db), 'agentdb-turns.jsonl'),
-        `${JSON.stringify({ ts: Date.now(), key: report.key, project, host, value: report.value })}\n`, { mode: 0o600 });
+        `${JSON.stringify({ ts: Date.now(), key: report.key, hash: crypto.createHash('sha256').update(report.value).digest('hex'), len: report.value.length })}\n`, { mode: 0o600 });
     }
     report.launch = launch(steps, { receipts });
+    if (dedupe) markTurnQueued(dedupe.stateFile, dedupe.identity, dedupe.fingerprint, dedupe.key);
   } catch (error) {
-    return { ...report, recorded: false, distill: { queued: false, skipped: `launch failed: ${error.message}` }, skipped: `launch failed: ${error.message}` };
+    return { ...report, queued: false, recorded: false, distill: { queued: false, skipped: `launch failed: ${redactText(error.message)}` }, skipped: `launch failed: ${redactText(error.message)}` };
   }
   return report;
 }
 
-/** The detached worker: run each step in order, bounded, and append one receipt per step. */
-export function runSteps({ steps = [], receipts } = {}, { run = spawnSync } = {}) {
+/** Exact (namespace, key, content) readback. Exit zero alone never proves capture. */
+function readBack({ ruflo, db, key, run, options }) {
+  const invocation = rufloInvocation(ruflo, ['memory', 'retrieve', '--key', key, '--namespace', TURN_NAMESPACE, '--value-only', '--path', db]);
+  const result = run(invocation.executable, invocation.args, options);
+  return result.status === 0 ? String(result.stdout || '').trim() : null;
+}
+
+/** The detached worker: bounded steps, safe error evidence, exact content readback. */
+export function runSteps({ steps = [], receipts } = {}, { run = spawnSync, read = readBack, env = process.env } = {}) {
   const results = [];
   for (const step of steps) {
-    let status = null;
-    let error = null;
-    const db = step.args[step.args.indexOf(step.kind === 'store' ? '--path' : '--db') + 1];
+    let status = null; let error = null; let verified = false;
+    const args = [...step.args];
+    const db = args[args.indexOf(step.kind === 'store' ? '--path' : '--db') + 1];
+    const key = step.kind === 'store' ? args[args.indexOf('-k') + 1] : undefined;
+    const valueIndex = args.indexOf('--value') + 1;
+    if (step.kind === 'store') args[valueIndex] = redactText(args[valueIndex]);
     try {
-      const { executable, args } = rufloInvocation(step.ruflo, step.args);
-      // CONTAINMENT (measured 2026-09-29, ruflo 3.48.0): even with an explicit --path, `memory store`
-      // writes `.swarm/hnsw.index` and `ruvector.db` relative to its CWD. Run from an inherited cwd,
-      // that planted `.swarm/` + `ruvector.db` in a repository that never adopted the brain — the
-      // exact trespass session-snapshot-hook.mjs forbids. So every step runs INSIDE the db's own
-      // directory, with ruflo's memory root pinned there too.
+      if (!step.projectRoot || !step.projectDir || !step.brainHome) throw new Error('queued step has no canonical project binding');
+      const target = resolveTurnDb({ projectDir: step.projectDir, brainHome: step.brainHome, requestedStorePath: db, gitTimeoutMs: 1000 });
+      if (target.skipped) throw new Error(target.skipped);
+      if (target.projectRoot !== step.projectRoot || target.db !== db) throw new Error('queued canonical project/store identity changed');
+      if (String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() === 'off') throw new Error('RUVNET_TURN_CAPTURE=off');
+      const invocation = rufloInvocation(step.ruflo, args);
+      // Contain Ruflo's auxiliary writes in the canonical store's own directory.
       const home = path.dirname(db);
-      const r = run(executable, args, { stdio: 'ignore', timeout: STEP_TIMEOUT_MS, cwd: home, windowsHide: true,
-        env: { ...process.env, ...RUFLO_ENV, CLAUDE_FLOW_MEMORY_PATH: home } });
-      status = r.status;
-      if (r.error) error = r.error.message;
-    } catch (e) { error = e.message; }
-    const row = { at: new Date().toISOString(), kind: step.kind, db,
-      key: step.kind === 'store' ? step.args[step.args.indexOf('-k') + 1] : undefined, status, error };
+      const options = { encoding: 'utf8', timeout: STEP_TIMEOUT_MS, cwd: home, windowsHide: true,
+        maxBuffer: 1024 * 1024, env: { ...env, ...RUFLO_ENV, CLAUDE_FLOW_MEMORY_PATH: home } };
+      const r = run(invocation.executable, invocation.args, options);
+      status = Number.isInteger(r.status) ? r.status : 1;
+      if (r.error || status !== 0) error = redactText(r.error?.message || String(r.stderr || '').trim().split(/\r?\n/)[0] || `ruflo exited ${status}`).slice(0, 300);
+      else if (step.kind === 'store') {
+        verified = read({ ruflo: step.ruflo, db, key, run, options }) === args[valueIndex];
+        if (!verified) { status = 1; error = 'exact turn key/content readback failed'; }
+      }
+    } catch (e) { status = 1; error = redactText(e.message).slice(0, 300); }
+    const row = { at: new Date().toISOString(), kind: step.kind, db: redactText(db),
+      storeIdentity: crypto.createHash('sha256').update(db).digest('hex'), key, status, error,
+      ...(step.kind === 'store' ? { verified } : {}) };
     results.push(row);
     if (receipts) {
       try {
@@ -297,6 +377,24 @@ export function runSteps({ steps = [], receipts } = {}, { run = spawnSync } = {}
   return results;
 }
 
+/** Bounded recent evidence, isolated by canonical db. A continuity success cannot mask turn failures. */
+export function turnRecordingStatus({ projectDir = process.cwd(), env = process.env, home = os.homedir(), now = Date.now() } = {}) {
+  const brainHome = env.RUVNET_BRAIN_HOME || path.join(home, '.cache', 'ruvnet-brain');
+  let target;
+  try { target = resolveTurnDb({ projectDir, brainHome }); } catch { return { state: 'unknown', line: 'turn recording unavailable: canonical store resolution failed' }; }
+  if (String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() === 'off' || target.skipped) return { state: 'unknown', line: `turn recording n/a — ${target.skipped || 'RUVNET_TURN_CAPTURE=off'}` };
+  let rows = [];
+  try {
+    rows = readTail(path.join(brainHome, 'turn-capture', 'receipts.jsonl'), 128 * 1024).flatMap((line) => {
+      try { return [JSON.parse(line)]; } catch { return []; }
+    }).filter((r) => r.kind === 'store' && (r.storeIdentity === crypto.createHash('sha256').update(target.db).digest('hex') || r.db === target.db) && now - Date.parse(r.at) < 7 * 86_400_000).slice(-20);
+  } catch { /* first run */ }
+  const failed = rows.filter((r) => r.status !== 0 || r.verified !== true);
+  if (failed.length) return { state: 'warn', line: `turn recording failing ${failed.length}/${rows.length} — ${redactText(failed.at(-1).error || 'write has no exact readback evidence').slice(0, 300)}` };
+  return rows.length ? { state: 'ok', line: `turn recording ✓ (${rows.length}/${rows.length} exact readbacks)` }
+    : { state: 'unknown', line: 'turn recording not yet proven — no exact readback receipt' };
+}
+
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url) && process.argv[2] === '--run-steps') {
   try { runSteps(JSON.parse(process.argv[3] || '{}')); } catch { /* a detached worker has no one to report to */ }
   process.exit(0);

package/scripts/learning-replay-cli.mjs

@@ -41,6 +41,7 @@ const usage = () => `Usage:
   node scripts/learning-replay.mjs [--trap ${TRAP.MEMORY_SEARCH}|${TRAP.POST_TASK}] [--n N] [--host codex|claude-code] [--model MODEL]
   node scripts/learning-replay.mjs --check
   node scripts/learning-replay.mjs --check-portfolio
+  node scripts/learning-replay.mjs --measure-portfolio --host codex --model MODEL
   node scripts/learning-replay.mjs --check-mutants
   node scripts/learning-replay.mjs --dry-run
   node scripts/learning-replay.mjs --mutant <${Object.keys(MUTANTS).join('|')}>
@@ -86,6 +87,19 @@ function printed(label, result) {
   return EXIT[result.status] ?? EXIT.UNKNOWN;
 }
 
+// A portfolio includes both positive traps AND all four causal mutants. Run every scenario even
+// after a failure, then let the unchanged evidence checker decide the result; child exit 1 is the
+// expected outcome of a causal mutant, and is never by itself a successful portfolio measurement.
+export async function measurePortfolio({ host, model, execute = main, check = checkPortfolio }) {
+  for (const trap of [TRAP.MEMORY_SEARCH, TRAP.POST_TASK]) {
+    await execute(['--trap', trap, '--n', '3', '--host', host, '--model', model]);
+    for (const mutant of ['delete-lesson', 'brain-off-treated']) {
+      await execute(['--trap', trap, '--mutant', mutant, '--n', '1', '--host', host, '--model', model]);
+    }
+  }
+  return printed(`${INVARIANT}-PORTFOLIO`, check());
+}
+
 export async function main(argv = process.argv.slice(2)) {
   const { has, arg } = parse(argv);
   if (has('--help') || has('-h')) {
@@ -113,6 +127,7 @@ export async function main(argv = process.argv.slice(2)) {
   }
   if (has('--check-portfolio')) return printed(`${INVARIANT}-PORTFOLIO`, checkPortfolio());
   if (has('--check-mutants')) return printed(`${INVARIANT}-MUTANTS`, checkMutantArtifacts());
+  if (has('--measure-portfolio')) return measurePortfolio({ host, model });
 
   const source = checkSourceIdentity();
   if (!source.clean) {

package/scripts/learning-replay.mjs

@@ -8,7 +8,7 @@ export * from './learning-replay-contract.mjs';
 export * from './learning-replay-execution.mjs';
 export * from './learning-replay-fixture.mjs';
 export * from './learning-replay-proof.mjs';
-export { main } from './learning-replay-cli.mjs';
+export { main, measurePortfolio } from './learning-replay-cli.mjs';
 
 const invokedDirectly = process.argv[1]
   && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);

package/scripts/nightly-wrapper.sh

@@ -177,14 +177,14 @@ sh scripts/memdb-health.sh "$RUVNET_PROJECT_MEMORY_DB" >> "$LOG" 2>&1 \
   && echo "===== memdb-health canary: OK =====" >> "$LOG" \
   || echo "===== memdb-health canary: UNHEALTHY (see line above) =====" >> "$LOG"
 
-# ── LEARNING-REPLAY: the D4 counterfactual trap (ADR-058 §D4). THE ONE STANDING TOKEN SPEND, priced
-# in the open: N=3 replay, two model arms per run, ~$0.09 and ~55s measured 2026-07-27 on haiku.
+# ── LEARNING-REPLAY: the D4 counterfactual portfolio (ADR-058 §D4). This manual author run spends
+# real model tokens: two N=3 positive traps and four N=1 causal mutants, with two arms per run.
 #
 # It runs HERE, and not on a GitHub runner, because the trap needs credentials a bare runner does not
 # have — a real model session AND the real global `ruflo` binary (it records into a fixture project's
 # .swarm/memory.db and refreshes it with `ruflo memory distill`). .github/workflows/learning-replay.yml
-# is the currency gate on the artifact this writes; if this step stops running, that workflow goes red
-# on staleness rather than everything staying quietly green.
+# is the currency gate on the evidence this writes; if evidence stops being refreshed, it goes red
+# on staleness. This wrapper is an author diagnostic, not an installed scheduler or publisher.
 #
 # Best-effort, same shape as the canaries below: it never blocks the rebuild. Its exit code is not
 # thrown away though — it is written to the log by name, because 0/1/3/4 are four different facts
@@ -222,7 +222,7 @@ echo "===== RELEASE-CONVERGENCE watchdog — $(date -u +%FT%TZ) =====" >> "$LOG"
   || echo "[release-watchdog] exited non-zero — see above; nightly continues" >> "$LOG"
 
 echo "===== LEARNING-REPLAY counterfactual trap — $(date -u +%FT%TZ) =====" >> "$LOG"
-"$NODE_BIN" scripts/learning-replay.mjs --n 3 --model haiku >> "$LOG" 2>&1
+"$NODE_BIN" scripts/learning-replay.mjs --measure-portfolio --host codex --model gpt-6.1-sol >> "$LOG" 2>&1
 LR_RC=$?
 case "$LR_RC" in
   0) echo "===== LEARNING-REPLAY: PASS =====" >> "$LOG" ;;