ruvnet-brain 4.5.6 → 4.5.8

package/scripts/health-repair.mjs

@@ -24,7 +24,11 @@ import path from 'node:path';
 import os from 'node:os';
 import { execFileSync, spawnSync } from 'node:child_process';
 import { findStores, diagnose } from './memory-doctor.mjs';
-import { learnerCwd, loadRuntimePreferences } from '../plugin/scripts/runtime-preferences.mjs';
+import { distillLearning } from '../plugin/scripts/learning-store.mjs';
+import { readSafe } from '../plugin/scripts/learning-queue.mjs';
+import { learningContext } from '../plugin/scripts/runtime-preferences.mjs';
+import { learningQueueDepth, learningQueueFiles, observeLearning } from '../plugin/scripts/learning-observation.mjs';
+import { resolveRuflo, rufloInvocation } from '../plugin/scripts/ruflo-bin.mjs';
 import { projectDirectory } from '../plugin/scripts/project-identity.mjs';
 import { newestSnapshot, snapshotInventory, MTIME_GRACE_MS } from './snapshot-freshness.mjs';
 
@@ -34,9 +38,10 @@ const HOME = os.homedir();
 // RESIDUAL of #134: RUVNET_BRAIN_PROJECT_DIR is never set by real hook dispatch on either host, so
 // consult `projectDirectory()` (project-identity.mjs) — the CLAUDE_PROJECT_DIR-with-containment
 // rule #85/#107 already established, reused rather than trusting the variable unconditionally.
-const PROJECT = process.env.RUVNET_BRAIN_PROJECT_DIR || projectDirectory();
 const argv = process.argv.slice(2);
 const has = (f) => argv.includes(f);
+const requestedProject = has('--project') ? argv[argv.indexOf('--project') + 1] : undefined;
+const PROJECT = learningContext({ cwd: requestedProject || process.env.RUVNET_BRAIN_PROJECT_DIR || projectDirectory() }).projectDir;
 
 /**
  * Find ruflo HONESTLY.
@@ -50,13 +55,6 @@ const has = (f) => argv.includes(f);
  * Rule 21 still holds — ONE ruflo, the global one, never `npx ruflo@latest`. This resolves WHERE
  * that one global binary is rather than assuming a path.
  */
-function resolveRuflo() {
-  const preferred = path.join(HOME, '.npm-global/bin/ruflo');
-  if (fs.existsSync(preferred)) return preferred;
-  const which = spawnSync('sh', ['-lc', 'command -v ruflo'], { encoding: 'utf8', timeout: 10_000 });
-  const found = String(which.stdout || '').trim().split('\n')[0];
-  return found && fs.existsSync(found) ? found : null;
-}
 const RUFLO = resolveRuflo();
 const RUFLO_ENV = { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' };
 
@@ -121,61 +119,45 @@ function repairMemory() {
  * queue — the reporter needed 15 rounds for 293 entries. A single call would leave a queue that
  * "flushes" every time and never empties, which is the same lie in slow motion.
  */
-function flushLearning() {
+function flushLearning(legacyUser = false) {
+  const original = learningContext({ cwd: PROJECT });
+  const context = legacyUser && original.enabled
+    ? learningContext({ cwd: PROJECT, env: { ...process.env, RUVNET_LEARNING_SCOPE: 'user' } }) : original;
+  if (!context.enabled) return { ok: true, noop: true, log: 'learning is switched off for this project — queued evidence is untouched' };
+  const { scope, queueDir } = context;
+  const bundled = path.resolve(import.meta.dirname, '../plugin/scripts/learn-flush.mjs');
   const flusher = path.join(HOME, '.claude', 'plugins', 'marketplaces', 'ruvnet-brain', 'plugin', 'scripts', 'learn-flush.mjs');
   const local = path.join(PROJECT, 'plugin', 'scripts', 'learn-flush.mjs');
-  const script = fs.existsSync(flusher) ? flusher : (fs.existsSync(local) ? local : null);
+  const script = [bundled, local, flusher].find((file) => fs.existsSync(file));
   if (!script) return { ok: false, log: 'learn-flush.mjs not found — cannot drain the queue' };
 
-  const configured = process.env.RUVNET_LEARNING_SCOPE
-    || loadRuntimePreferences({ cwd: PROJECT }).values.learningScope;
-  const scope = ['off', 'project', 'user'].includes(configured) ? configured : 'project';
-  if (scope === 'off') {
-    return { ok: true, noop: true, log: 'learning is switched off for this project — nothing is being captured, so there is nothing to feed' };
-  }
-
-  // Derived from the scope, never assumed: this is the directory the child will actually read.
-  const queueDir = scope === 'user'
-    ? path.join(HOME, '.cache', 'ruvnet-brain', 'learn')
-    : path.join(PROJECT, '.swarm', 'ruvnet-brain-learn');
   // Displayed to a human and matched by tests, so it is normalised to forward slashes on every
   // platform. Without this, Windows reports `~\.cache\ruvnet-brain\learn` while macOS and Linux
   // report `~/.cache/ruvnet-brain/learn` — the same location under two spellings, which is the
   // exact defect class this branch has been closing (one fact, two representations).
   const where = queueDir.replace(HOME, '~').split(path.sep).join('/');
 
-  const queueFiles = () => {
-    try { return fs.readdirSync(queueDir).filter((f) => f.endsWith('.jsonl')).map((f) => path.join(queueDir, f)); }
-    catch { return []; }
-  };
-  const depthOf = (f) => {
-    try { return fs.readFileSync(f, 'utf8').split('\n').filter(Boolean).length; } catch { return 0; }
-  };
-  const depth = () => queueFiles().reduce((n, f) => n + depthOf(f), 0);
-
-  const before = depth();
+  const depth = () => learningQueueDepth(queueDir);
+  try {
+    const lock = JSON.parse(readSafe(path.join(queueDir, '.worker-lock'), 4096));
+    if (lock.retirementUnconfirmed || (lock.retirementRequired && lock.expires < Date.now())) return { ok: false, log: 'learning recovery is paused: owned worker retirement is unconfirmed; queue fence and original observations retained' };
+  } catch { /* Regular safety checks below still decide whether a queue is readable. */ }
+  let before;
+  try { before = depth(); }
+  catch { return { ok: false, log: `cannot read learning queue ${where} safely — evidence is preserved` }; }
   if (!before) return { ok: true, noop: true, log: `nothing queued in ${where} — the learner is already caught up` };
-
-  const env = { ...process.env, RUVNET_LEARNING_SCOPE: scope, RUVNET_BRAIN_PROJECT_DIR: PROJECT };
-  const deadline = Date.now() + 540_000; // inside the 600s this action is allowed overall
+  const env = { ...process.env, RUVNET_BRAIN_PROJECT_DIR: PROJECT, ...(legacyUser ? { RUVNET_LEARNING_SCOPE: 'user', RUVNET_LEGACY_USER_APPLY: '1' } : {}) };
+  const deadline = Date.now() + 540_000;
   const stalled = [];
-  for (const file of queueFiles()) {
-    let d = depthOf(file);
-    while (d > 0 && Date.now() < deadline) {
-      try {
-        execFileSync(process.execPath, [script], {
-          env: { ...env, LEARN_QUEUE: file },
-          stdio: 'ignore',
-          timeout: Math.min(120_000, Math.max(1_000, deadline - Date.now())),
-        });
-      } catch (e) { stalled.push(`${path.basename(file)}: ${String(e.message).split('\n')[0].slice(0, 80)}`); break; }
-      const next = depthOf(file);
-      // STRICT progress, or stop. learn-flush KEEPS a queue it could not feed (by design — the queue
-      // is evidence), so a round that shrinks nothing means the learner is not accepting the work.
-      // Spinning on it would burn the whole budget and still report zero.
-      if (next >= d) { stalled.push(`${path.basename(file)}: ${d} entr${d === 1 ? 'y' : 'ies'} would not feed`); break; }
-      d = next;
-    }
+  let previous = before;
+  while (previous > 0 && Date.now() < deadline) {
+    try {
+      execFileSync(process.execPath, [script, '--sync'], { env, cwd: PROJECT, stdio: 'ignore',
+        timeout: Math.min(25_000, Math.max(1000, deadline - Date.now())) });
+    } catch { stalled.push('bounded worker failed'); break; }
+    const next = depth();
+    if (next >= previous) { stalled.push(`${next} entries would not feed`); break; }
+    previous = next;
   }
 
   const after = depth();
@@ -183,10 +165,8 @@ function flushLearning() {
   if (fed <= 0) {
     // Name the most likely cause instead of shrugging: learn-flush invokes ruflo at a FIXED path,
     // so on a machine with a different npm prefix it feeds nothing and honestly keeps the queue.
-    const rufloAtFixedPath = fs.existsSync(path.join(HOME, '.npm-global/bin/ruflo'));
     const why = stalled.length ? ` (${stalled.slice(0, 3).join('; ')})` : '';
-    const hint = rufloAtFixedPath ? '' : ' ruflo is not at ~/.npm-global/bin/ruflo, which is where the flusher looks for it —'
-      + ' `npm i -g ruflo@latest` installs it there.';
+    const hint = RUFLO ? '' : ' No global ruflo was resolved from the managed prefix or PATH.';
     return { ok: false, log: `fed 0 of ${before} queued events from ${where}${why} — the queue is preserved for retry.${hint}` };
   }
   return {
@@ -196,22 +176,20 @@ function flushLearning() {
   };
 }
 
-/** One training cycle, via rUv's own CLI, in the GLOBAL (cross-project) learner. */
+/** One explicit training cycle in the same learner the Console measures. */
 function trainLearning() {
+  const context = learningContext({ cwd: PROJECT });
+  if (!context.enabled) return { ok: true, noop: true, log: 'learning is switched off — queued evidence and learner are untouched' };
   if (!RUFLO) return { ok: false, log: 'ruflo is not on this machine — install it with `npm i -g ruflo@latest` to enable learning' };
   try {
-    // ISSUE #136: train the SAME store the console card reads. With `cwd: HOME` the card read the
-    // project's learner and this trained the home one, so the button could never clear the card it
-    // was offered for — a remedy that cannot resolve its own finding is worse than no button.
-    // PROJECT is the same root learn-flush.mjs and learn-capture.sh resolve (#134).
-    // ISSUE #139 — now that ruflo v3.38.9 made `--train` REAL (ruvnet/ruflo#2940 was a no-op
-    // before), training the wrong store is no longer harmless: it moves that store's
-    // lastAdaptation to 0s and the card SILENTLY SELF-CLEARS while the learner the operator
-    // actually uses is untouched. #136 already moved this off `cwd: HOME`; it now shares the
-    // console's resolver so the remedy provably trains the store the card measured.
-    execFileSync(RUFLO, ['hooks', 'intelligence', '--train'], { cwd: learnerCwd({ cwd: PROJECT }), env: RUFLO_ENV, stdio: 'ignore', timeout: 600_000 });
-  } catch (e) { return { ok: false, log: `training cycle failed: ${e.message}` }; }
-  return { ok: true, log: 'ran one training cycle in the cross-project learner' };
+    const evidence = distillLearning(RUFLO, context, { deadline: Date.now() + 18_000, allowed: () => {
+      const current = learningContext({ cwd: PROJECT }); return current.enabled && current.scope === context.scope && current.queueDir === context.queueDir;
+    } });
+    const verified = evidence.completed && evidence.patternDelta > 0;
+    return { ok: verified, log: verified
+      ? `verified ${evidence.patternDelta} new structural patterns in ${evidence.db}; no ratified lessons claimed; snapshot ${evidence.snapshot}`
+      : `distillation returned without measurable pattern progress in ${evidence.db}; recorded observations remain separate; snapshot retained` };
+  } catch { return { ok: false, log: 'canonical distillation unavailable; observations and pending queue retained' }; }
 }
 
 /**
@@ -326,6 +304,7 @@ function distillFleet() {
 }
 
 const action = has('--repair-memory') ? repairMemory
+  : has('--flush-legacy-user-learning') ? () => flushLearning(true)
   : has('--flush-learning') ? flushLearning
     : has('--train-learning') ? trainLearning
       : has('--distill-fleet') ? distillFleet

package/scripts/onboarding-console.mjs

@@ -67,9 +67,9 @@ import { loadLessons, updateLessons, ratify, demote, restore, pending, weightOf,
 import {
   openRouterCredentialStatus,
   saveOpenRouterCredential,
-  learnerCwd,
   loadRuntimePreferences,
 } from '../plugin/scripts/runtime-preferences.mjs';
+import { observeLearning as observeScopedLearning } from '../plugin/scripts/learning-observation.mjs';
 import { applyNightlyChoice, nightlyStatus } from './nightly-controller.mjs';
 // One canonical answer to "which directory is this, and have I counted it already?" — shared with
 // the PreCompact snapshot producer (#85) and with memory-doctor's root scan (#107).
@@ -2461,8 +2461,8 @@ function journalUndo(entry) {
   fs.appendFileSync(UNDO_JOURNAL, JSON.stringify({ token, at: new Date().toISOString(), ...entry }) + '\n');
   return token;
 }
-function runNode(scriptRelPath, args) {
-  const r = spawnSync(process.execPath, [path.join(REPO, scriptRelPath), ...args], { encoding: 'utf8', timeout: 16 * 60 * 1000, cwd: REPO });
+function runNode(scriptRelPath, args, options = {}) {
+  const r = spawnSync(process.execPath, [path.join(REPO, scriptRelPath), ...args], { encoding: 'utf8', timeout: 16 * 60 * 1000, cwd: REPO, ...options });
   return { ok: r.status === 0, code: r.status, log: `${r.stdout || ''}${r.stderr || ''}`.trim().slice(-4000) };
 }
 function elapsedMs(startedAt) {
@@ -2483,57 +2483,11 @@ function resolveProjectDir(project) {
 /**
  * Observe the learner's REAL state, for the health recommendations.
  *
- * Deliberately reads the global learner, because that is the store the capture flush
- * actually writes to. Reading the project-local `.claude-flow/neural` instead is exactly the mistake
- * that made the console display a dead learner (5 trajectories, last trained 6 days earlier) while
- * the live one held 412 — rUv documents this fragmentation as issue #2245, "four contradictory
- * sources". Until it is unified upstream we read the store that learning writes, never the corpse.
+ * The queue and learner are selected together for the served project. Apply uses this same
+ * snapshot and remeasures it, so a successful child exit alone cannot clear a learning finding.
  */
 function observeLearning() {
-  const queueDir = path.join(SYSTEM_HOME, '.cache', 'ruvnet-brain', 'learn');
-  let queueDepth = 0;
-  try {
-    for (const f of fs.readdirSync(queueDir)) {
-      if (!f.endsWith('.jsonl')) continue;
-      queueDepth += fs.readFileSync(path.join(queueDir, f), 'utf8').split('\n').filter(Boolean).length;
-    }
-  } catch { /* no queue dir yet — depth stays 0, which is honest */ }
-
-  let lastTrainSeconds = null; let trajectories = 0;
-  try {
-    // ISSUE #136 — THE LEARNER IS PROJECT-SCOPED, so this must ask about the SERVED project.
-    //
-    // `ruflo hooks intelligence --status` reports `Data Dir: <cwd>/.claude-flow/neural`. With
-    // `cwd: SYSTEM_HOME` this measured `~/.claude-flow/neural` — a store nothing writes to on a
-    // machine whose work happens inside project directories. Measured on one machine, one minute:
-    // the home store held 1,216 trajectories last trained 6.9 DAYS ago while the served project held
-    // 9,940 last trained 22 SECONDS ago. The card said "Your learner has gone quiet" about a learner
-    // training every few seconds.
-    //
-    // This file already carries the verdict on this exact mistake at the refresh-child spawn: "cwd =
-    // the SERVED project, NOT REPO … it was a real console-honesty bug". Same rule, same file,
-    // different call site — #104's and #134's residual arriving a third time.
-    // ISSUE #139 (@ObiWanKenobi) — `process.cwd()` was a HARDCODE in the opposite direction from
-    // #136's `SYSTEM_HOME`. Neither asked which scope was in effect; the first was wrong by default
-    // and the second is right only BECAUSE `project` is the default. Under
-    // `RUVNET_LEARNING_SCOPE=user` the flush feeds ~/.claude-flow/neural while this read
-    // <project>/.claude-flow/neural — the same false-positive card, inverted. The writer and this
-    // reader now call ONE resolver (runtime-preferences.learnerCwd), so they agree by construction
-    // instead of by coincidence.
-    const r = spawnSync(path.join(SYSTEM_HOME, '.npm-global/bin/ruflo'),
-      ['hooks', 'intelligence', '--status'],
-      {
-        cwd: learnerCwd(),
-        env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' },
-        encoding: 'utf8',
-        timeout: 20_000,
-      });
-    const out = `${r.stdout || ''}`;
-    const t = out.match(/Last Training:\s*(\d+)s ago/);
-    const j = out.match(/Trajectories\s*\|\s*(\d+)/);
-    if (t) lastTrainSeconds = Number(t[1]);
-    if (j) trajectories = Number(j[1]);
-  } catch { /* ruflo absent or slow — leave null, and null NEVER produces a recommendation */ }
+  const learning = observeScopedLearning({ cwd: projectDirectory() });
 
   // The fleet is what makes ADR-027's North Star recommendation constructible at all — without it,
   // `learning:distill-fleet` can never be built, so it can never be offered, so clicking it would be
@@ -2545,7 +2499,7 @@ function observeLearning() {
   // produces no recommendation, which is the correct answer when we have not looked.
   const fleet = readJSON(MEMORY_CACHE)?.data?.fleet ?? [];
 
-  return { queueDepth, lastTrainSeconds, trajectories, fleet };
+  return { ...learning, fleet };
 }
 
 function currentValidIds(onlyId = null) {
@@ -2649,7 +2603,23 @@ function apply(ids) {
     const undoToken = journalUndo(undoSpec);
     phaseMs.undoJournalMs += elapsedMs(journalStartedAt);
     const remedyStartedAt = performance.now();
-    const res = runNode(plan.exec.script, args);
+    const learningBefore = ['learning:flush', 'learning:train', 'learning:flush-legacy-user'].includes(id) ? observeLearning() : null;
+    const res = runNode(plan.exec.script, args, learningBefore ? {
+      cwd: learningBefore.projectDir,
+      env: { ...process.env, RUVNET_BRAIN_PROJECT_DIR: learningBefore.projectDir },
+    } : {});
+    if (res.ok && learningBefore) {
+      const after = observeLearning();
+      const progressed = id === 'learning:flush-legacy-user'
+        ? after.legacyUserKnown && after.legacyUserDepth < learningBefore.legacyUserDepth
+        : id === 'learning:flush'
+        ? after.queueKnown && after.queueDepth < learningBefore.queueDepth
+        : learningBefore.statusKnown && after.statusKnown && after.patterns > learningBefore.patterns;
+      if (!progressed) {
+        res.ok = false;
+        res.log += `\nNo measured learning progress: queue ${after.queueDir}; learner ${after.learnerCwd}. Reload to inspect the remaining evidence.`;
+      }
+    }
     phaseMs.childRemedyMs += elapsedMs(remedyStartedAt);
     results.push({ id, ...res, undoToken });
   }
@@ -3531,6 +3501,7 @@ export {
   autoEligibleIds,
   gatherConfig,
   gatherSavings,
+  observeLearning,
 };
 // Exported for the cross-project cache-isolation test (console-cache-scope.test.mjs). serveCached's
 // scopeKey is the guard that stops one project's cached state being served for another.

package/scripts/qa/progression-validation-benchmark.mjs

@@ -0,0 +1,66 @@
+/** Source-bound synthetic validation comparison; deliberately excludes database/host I/O. */
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { performance } from 'node:perf_hooks';
+import { createProgressionSnapshot, restoreProjectProgression, digestCanonical } from '../../plugin/scripts/project-progression-contract.mjs';
+
+const flag = (name) => process.argv[process.argv.indexOf(name) + 1];
+if (!process.argv.includes('--baseline-module') || !process.argv.includes('--output')) {
+  throw new Error('Require --baseline-module <unchanged contract module> --output <receipt.json>');
+}
+const baselinePath = path.resolve(flag('--baseline-module'));
+const baseline = await import(pathToFileURL(baselinePath).href);
+const currentPath = fileURLToPath(new URL('../../plugin/scripts/project-progression-contract.mjs', import.meta.url));
+const hash = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+const sizes = (process.argv.includes('--sizes') ? flag('--sizes') : '100,400,1000').split(',').map(Number);
+if (!sizes.every(n => Number.isSafeInteger(n) && n > 0 && n <= 10_000)) throw new Error('sizes must be positive integers <= 10000');
+const projectIdentity = { id: 'synthetic-validation', canonicalAgentDbPath: '/synthetic/project/.swarm/memory.db' };
+const sourceIdentity = { checkoutPath: '/synthetic/project', worktreeId: 'primary', branch: 'main', head: 'a'.repeat(40),
+  trackedDigest: 'b'.repeat(64), untrackedDigest: 'c'.repeat(64), dirtyTreeDigest: 'd'.repeat(64) };
+const empty = Object.fromEntries(['plan', 'completed', 'inProgress', 'blockers', 'failures', 'decisions',
+  'changedFiles', 'commands', 'proofArtifacts', 'untested', 'resumeConflicts'].map(k => [k, []]));
+const receipt = { scope: 'Synthetic CPU-only complete-history validation; no native capture/restore deadline claim',
+  node: process.version, platform: process.platform, arch: process.arch,
+  sources: { baseline: { path: baselinePath, sha256: hash(baselinePath) }, candidate: { path: currentPath, sha256: hash(currentPath) } },
+  workloads: [] };
+for (const size of sizes) {
+  const snapshots = [], observations = [];
+  let parents = [];
+  for (let sequence = 1; sequence <= size; sequence++) {
+    observations.push({ id: `event-${sequence}`, occurredAt: '2026-10-05T00:00:00.000Z', trigger: 'PostToolUse',
+      kind: 'tool-observation', source: 'host-observation', authoritative: false, outcome: 'success', exitCode: 0,
+      intent: { action: 'verify', subjects: ['project memory'] }, tool: 'exec_command' });
+    const snapshot = createProgressionSnapshot({ projectIdentity, sourceIdentity,
+      hostIdentity: { host: 'codex', adapterVersion: 'synthetic-benchmark' }, sessionIdentity: 'synthetic',
+      sequence, parentEventKeys: parents, occurredAt: '2026-10-05T00:00:00.000Z', trigger: 'PostToolUse', dedupId: `event-${sequence}`,
+      completeProjectState: { ...empty, currentGoal: 'Preserve complete history', nextAction: 'Validate all evidence',
+        acceptanceContract: { required: ['exact equality'] }, activeProcess: 'verification', activeStep: 'PostToolUse',
+        observations: [...observations], commands: [...observations] } });
+    snapshots.push(snapshot); parents = [snapshot.eventKey];
+  }
+  const run = (restore) => {
+    const started = performance.now();
+    const value = restore(snapshots, { expectedProjectIdentity: projectIdentity });
+    return { ms: performance.now() - started, value };
+  };
+  const original = run(baseline.restoreProjectProgression);
+  const candidate = run(restoreProjectProgression);
+  if (JSON.stringify(original.value) !== JSON.stringify(candidate.value)) throw new Error('full restored result differs from baseline');
+  // Check a historical mutation whose digest was not recomputed, not just the current head.
+  const oldGoal = snapshots[0].completeProjectState.currentGoal;
+  snapshots[0].completeProjectState.currentGoal = 'tampered historical state';
+  const mutatedOriginal = baseline.restoreProjectProgression(snapshots, { expectedProjectIdentity: projectIdentity });
+  const mutatedCandidate = restoreProjectProgression(snapshots, { expectedProjectIdentity: projectIdentity });
+  if (JSON.stringify(mutatedOriginal) !== JSON.stringify(mutatedCandidate) || mutatedCandidate.ok) {
+    throw new Error('historical mutation negative semantics differ');
+  }
+  snapshots[0].completeProjectState.currentGoal = oldGoal;
+  receipt.workloads.push({ snapshots: size, bytes: snapshots.reduce((n, s) => n + Buffer.byteLength(JSON.stringify(s)), 0),
+    baselineMs: original.ms, candidateMs: candidate.ms, resultDigest: digestCanonical(candidate.value),
+    fullResultEqual: true, historicalMutationRejected: true, observations: candidate.value.state.observations.length,
+    commands: candidate.value.state.commands.length, peakRssKiB: process.resourceUsage().maxRSS });
+  fs.writeFileSync(path.resolve(flag('--output')), JSON.stringify(receipt, null, 2));
+  process.stdout.write(`${JSON.stringify(receipt.workloads.at(-1))}\n`);
+}

package/scripts/release-qualification-contract.mjs

@@ -1,6 +1,33 @@
 // Reviewed stabilization release boundaries. Legacy tests remain developer diagnostics.
 export const RELEASE_REQUIREMENTS = Object.freeze({
   "source": [
+    {
+      "id": "owned-startup-execution-evidence",
+      "reason": "Opt-in native execution and private stage diagnostics bind released source and preserve unknown convergence and incomplete cleanup boundaries",
+      "files": ["tests/unit/codex-host-execution-proof.test.mjs", "tests/unit/codex-host-proof-runtime.test.mjs", "tests/unit/session-start-proof.test.mjs"]
+    },
+    {
+      "id": "canonical-learning-capture",
+      "reason": "Fixed metadata capture, canonical scope, consent, acknowledgement and bounded owned recovery retain privacy and originals",
+      "files": [
+        "tests/unit/learn-flush-partial-failure.test.mjs",
+        "tests/unit/learn-capture-project-root.test.mjs",
+        "tests/unit/learn-capture-redaction.test.mjs",
+        "tests/unit/learner-scope-agreement.test.mjs",
+        "tests/unit/health-repair-flush-learning.test.mjs",
+        "tests/unit/learning-worker-supervisor.test.mjs"
+      ]
+    },
+    {
+      "id": "fresh-owned-host-proof",
+      "reason": "Source-bound native registry declarations reject warnings, trust changes and unretired owned processes",
+      "files": ["tests/unit/codex-fresh-host-proof.test.mjs"]
+    },
+    {
+      "id": "complete-progression-validation",
+      "reason": "Canonical digest validation retains full-history and serialization semantics",
+      "files": ["tests/unit/project-progression-contract.test.mjs"]
+    },
     {
       "id": "signed-artifacts",
       "reason": "Signature verification and exact assembled coverage reject changed bytes",
@@ -44,7 +71,10 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
       "files": [
         "tests/unit/automatic-hook-retirement.test.mjs",
         "tests/unit/install-activation-rollback.test.mjs",
-        "tests/unit/forge-update-apply-rollback.test.mjs"
+        "tests/unit/forge-update-apply-rollback.test.mjs",
+        "tests/unit/forge-update-archive-digest.test.mjs",
+        "tests/unit/kb-copy-proof-legacy-sidecars.test.mjs",
+        "tests/unit/kb-copy-proof-unknown-content.test.mjs"
       ]
     },
     {
@@ -93,7 +123,8 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
       "files": [
         "tests/unit/nightly-scheduler.test.mjs",
         "tests/unit/nightly-refresh-launcher.test.mjs",
-        "tests/unit/nightly-two-run-proof.test.mjs"
+        "tests/unit/nightly-two-run-proof.test.mjs",
+        "tests/unit/nightly-refresh-run-health.test.mjs"
       ]
     },
     {
@@ -151,22 +182,55 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
         "tests/mutation/citation-binding-mutation.test.mjs"
       ]
     },
+    {
+      "id": "owner-capture-and-off-controls",
+      "reason": "Brain OFF suppresses capacity execution; promise opt-out suppresses only new capture and preserves existing closure and capability truth",
+      "files": [
+        "tests/unit/capacity-aware-parallel-work.test.mjs",
+        "tests/unit/continuation-gate-capability-truth.test.mjs",
+        "tests/unit/continuation-gate-completion-claims.test.mjs"
+      ]
+    },
+    {
+      "id": "active-managed-generation",
+      "reason": "Active code selection binds help authorization and execution to one immutable leased generation across promotion",
+      "files": [
+        "tests/unit/managed-cli-generation.test.mjs"
+      ]
+    },
     {
       "id": "pending-memory-durability",
       "reason": "Complete outbox tails replay and accepted pending journal events survive capacity pressure without silent deletion",
       "files": [
         "tests/unit/project-progression-outbox.test.mjs",
         "tests/unit/project-progression-durability.test.mjs",
-        "tests/unit/continuity-customer-regressions.test.mjs"
+        "tests/unit/continuity-customer-regressions.test.mjs",
+        "tests/unit/progression-outbox-containment.test.mjs",
+        "tests/unit/transition-pending-notices.test.mjs"
       ]
     }
   ],
   "integration": [
+    {
+      "id": "canonical-learning-recovery",
+      "reason": "Cross-session recovery and Console evidence agree on the same canonical scope without ratifying tool metadata as instructions",
+      "files": ["tests/integration/learning-recovery-377.test.mjs", "tests/integration/learning-console-scope.test.mjs"]
+    },
+    {
+      "id": "canonical-progression-store",
+      "reason": "Actual adopted canonical storage, exact readback, and concurrent session restoration retain consent and complete history",
+      "files": ["tests/integration/project-progression-concurrent-sessions.test.mjs", "tests/integration/project-progression-reader-identity.test.mjs"],
+      "platformFiles": {
+        "linux": ["tests/integration/project-progression-store.test.mjs"],
+        "macos": ["tests/integration/project-progression-store.test.mjs"]
+      }
+    },
     {
       "id": "native-explicit-interface",
       "reason": "Real MCP subprocess readiness, command policy and literal argv safety",
       "files": [
-        "tests/integration/managed-cli-mcp.test.mjs"
+        "tests/integration/managed-cli-mcp.test.mjs",
+        "tests/integration/managed-cli-server-boundary.test.mjs"
       ]
     },
     {
@@ -193,10 +257,14 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
     },
     {
       "id": "owned-uninstall",
-      "reason": "Actual offline uninstall preserves unrelated files and user guidance",
+      "reason": "Actual offline uninstall and POSIX copy-cleanup callers preserve unrelated files, changed unknown bytes and private state",
       "files": [
         "tests/integration/uninstall-footprint.test.mjs"
-      ]
+      ],
+      "platformFiles": {
+        "linux": ["tests/unit/brain-footprint.test.mjs"],
+        "macos": ["tests/unit/brain-footprint.test.mjs"]
+      }
     },
     {
       "id": "canonical-memory-native-boundary",
@@ -219,7 +287,8 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
         "tests/unit/turn-durable-transport.test.mjs",
         "tests/integration/automatic-progression-continuation.test.mjs",
         "tests/integration/capture-consent-boundary.test.mjs",
-        "tests/integration/session-start-turn-replay.test.mjs"
+        "tests/integration/session-start-turn-replay.test.mjs",
+        "tests/integration/progression-suspension.test.mjs"
       ]
     },
     {

package/scripts/remedy-registry.mjs

@@ -77,12 +77,19 @@ export const REMEDIES = [
     // purpose, and the human string says what a user would actually do instead.
     inverse: () => ({ kind: K.NONE, human: 'nothing to reverse — this only adds observations the learner already had queued; learned state can be reset separately' }),
   },
+  {
+    key: 'learning-legacy-user-flush',
+    summary: 'drain retained legacy user history into its original home learner',
+    match: (id) => (id === 'learning:flush-legacy-user' ? {} : null),
+    plan: () => ({ script: 'scripts/health-repair.mjs', args: ['--flush-legacy-user-learning'] }),
+    inverse: () => ({ kind: K.NONE, human: 'original queue bytes stay retained; learned observations can be reset separately' }),
+  },
   {
     key: 'learning-train',
-    summary: 'run one training cycle',
+    summary: 'distill canonical observations into structural patterns',
     match: (id) => (id === 'learning:train' ? {} : null),
     plan: () => ({ script: 'scripts/health-repair.mjs', args: ['--train-learning'] }),
-    inverse: () => ({ kind: K.NONE, human: 'nothing to reverse here — learned state is reset with `ruflo hooks intelligence --reset`, which is a separate, deliberate action' }),
+    inverse: () => ({ kind: K.NONE, human: 'a verified snapshot is retained; automatic exact restore is unavailable and no ratified lessons are claimed' }),
   },
   {
     // THE ONE THAT HAD NO EXECUTOR. See ADR-027's North Star case: stores full of memories that