ruvnet-brain 4.6.4 → 4.7.0

package/plugin/mcp/managed-cli-interface.mjs

@@ -7,9 +7,6 @@ import { managedGenerationIdentity } from './managed-cli-generation.mjs';
 import { loadRuntimePreferences, runtimeChildEnv } from '../scripts/runtime-preferences.mjs';
 import { projectDirectory } from '../scripts/project-identity.mjs';
 import { recordManagedCliObservation, recordRegistryLatestObservation } from '../scripts/capability-claim-evidence.mjs';
-import { runSessionSnapshotHook } from '../scripts/session-snapshot-hook.mjs';
-import { resolveProjectStore } from '../scripts/project-store-resolver.mjs';
-import { isAutomaticProgressionSuspension } from '../scripts/project-progression-suspension.mjs';
 
 export const MANAGED_EXECUTABLES = Object.freeze([
   'ruflo',
@@ -275,40 +272,6 @@ export function normalizeManagedExecution(execution) {
   return { outcome: execution.code === 0 ? 'success' : 'failure', output, contradictoryFailure };
 }
 
-function managedSessionId(env) {
-  const supplied = env.RUVNET_BRAIN_SESSION_ID || env.RUVNET_HOOK_SESSION_ID;
-  return typeof supplied === 'string' && supplied.trim() ? supplied.trim() : `managed-cli-${process.pid}`;
-}
-
-/** Bind managed CLI execution to the existing progression writer when this project has adopted it. */
-function managedProgressionCapture({ executable, argv, projectRoot, env, event, execution, normalized }) {
-  const adopted = fs.existsSync(path.join(projectRoot, '.swarm'));
-  if (!adopted) return { adopted: false, skipped: 'project has not adopted the canonical store' };
-  const host = String(env.RUVNET_HOOK_HOST || '').toLowerCase();
-  if (!['claude', 'codex'].includes(host)) return { adopted: true, error: 'managed host identity unavailable' };
-  let resolution;
-  try { resolution = resolveProjectStore({ projectDir: projectRoot }); }
-  catch (error) { return { adopted: true, error: `project store could not be resolved: ${error?.message || error}` }; }
-  const payload = {
-    session_id: managedSessionId(env),
-    hook_event_name: event,
-    tool_name: executable,
-    tool_input: { command: [executable, ...argv].join(' ') },
-    ...(execution ? {
-      tool_response: {
-        stdout: execution.stdout,
-        stderr: execution.stderr,
-        exit_code: execution.code,
-        ...(execution.signal ? { signal: execution.signal, interrupted: true } : {}),
-        outcome: normalized?.outcome,
-        ...(execution.error ? { error: execution.error } : {}),
-      },
-    } : {}),
-  };
-  const result = runSessionSnapshotHook(projectRoot, event, { rawInput: JSON.stringify(payload), host, env });
-  return isAutomaticProgressionSuspension(result) ? result : { adopted: true, ...result };
-}
-
 function resultOf(executable, argv, result) {
   const output = [result.stdout, result.stderr].filter(Boolean).join(result.stdout && result.stderr ? '\n' : '');
   const normalized = normalizeManagedExecution(result);
@@ -406,35 +369,16 @@ export async function callManagedCli(toolName, args, env = process.env, fetchImp
       const childEnv = (executable === 'agentic-flow' || executable === 'agentic-qe')
         ? runtimeChildEnv({ env, cwd: projectRoot })
         : env;
-      const capture = typeof lifecycle.capture === 'function' ? lifecycle.capture : managedProgressionCapture;
-      const beforeCapture = await capture({ executable, argv, projectRoot, env: childEnv, event: 'PreToolUse' });
-      if (beforeCapture?.error || (beforeCapture?.adopted && beforeCapture.progressionCaptured !== true
-        && !isAutomaticProgressionSuspension(beforeCapture))) {
-        const reason = beforeCapture.error || beforeCapture.skipped || 'pre-execution progression was not durably captured';
-        return { content: [{ type: 'text', text: `managed execution refused: ${reason}` }], isError: true };
-      }
       if (lifecycle && typeof lifecycle.beforeExecute === 'function') {
         await lifecycle.beforeExecute({ executable, argv, projectRoot, env: childEnv });
       }
       const execution = await execute(executable, argv, childEnv);
       const normalized = normalizeManagedExecution(execution);
-      const afterCapture = await capture({ executable, argv, projectRoot, env: childEnv, event: 'PostToolUse', execution, normalized });
       if (lifecycle && typeof lifecycle.afterExecute === 'function') {
         await lifecycle.afterExecute({ executable, argv, projectRoot, env: childEnv, execution, normalized });
       }
       recordManagedCliObservation({ toolName, executable, argv, execution, env });
-      if (afterCapture?.adopted && afterCapture.progressionCaptured !== true
-        && !isAutomaticProgressionSuspension(afterCapture)) {
-        return {
-          content: [{ type: 'text', text: `managed command ${normalized.outcome}; continuity result was not durably captured: ${afterCapture.skipped || 'unknown reason'}` }],
-          isError: true,
-        };
-      }
       const result = resultOf(executable, argv, execution);
-      if (isAutomaticProgressionSuspension(beforeCapture) || isAutomaticProgressionSuspension(afterCapture)) {
-        result.content.push({ type: 'text', text: 'Automatic project progression is operator-suspended; suspended captures produced no progression receipt. Ordinary AgentDB memory and explicit checkpoints remain available.' });
-        result.structuredContent.continuity = 'operator-suspended';
-      }
       return result;
     }
 

package/plugin/scripts/agentdb-recall-reader.mjs

@@ -1,8 +1,15 @@
-/** Bounded read-only projection of canonical Ruflo rows; never opens a second store.
- * Run as an owned child so SQLite/filesystem stalls can be retired at the recall deadline.
- * Unsupported schema stands down to global Ruflo; malformed/duplicate rows fail closed.
+/** Bounded read-only projection of canonical Ruflo rows THROUGH THE RUFLO CLI — never direct SQLite
+ * (owner ruling 2026-10-12: hooks call rUv's tools, they do not reimplement them). Run as an owned child
+ * so a stalled CLI is retired at the recall deadline. Output contract unchanged: {ok, value}.
  */
-import { withProgressionReader } from './project-progression-reader.mjs';
+import { execFile } from 'node:child_process';
+import { resolveRuflo } from './ruflo-bin.mjs';
+
+const call = (bin, args, deadline) => new Promise((resolve) => {
+  const timeout = Math.max(1, deadline - Date.now());
+  execFile(bin, args, { timeout, killSignal: 'SIGKILL', encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' } },
+    (error, stdout) => resolve(error ? null : String(stdout || '')));
+});
 
 try {
   const [storePath, input] = process.argv.slice(2);
@@ -12,11 +19,24 @@ try {
       || requests.some(row => typeof row?.namespace !== 'string' || typeof row?.key !== 'string' || !row.key))
     || namespaces && (!Array.isArray(namespaces) || namespaces.length > 8 || namespaces.some(value => typeof value !== 'string'))
     || Boolean(requests) === Boolean(namespaces)) throw new Error('invalid bounded read');
-  const result = withProgressionReader(storePath, reader => requests
-    ? requests.map(({ namespace, key }) => reader.readContent(namespace, key))
-    : Object.fromEntries(namespaces.map(namespace => [namespace, reader.listKeys(namespace, { maxEntries: 100000 })])),
-  { deadlineAt: deadline });
-  process.stdout.write(JSON.stringify(result));
+  const bin = resolveRuflo();
+  if (!bin) throw new Error('global Ruflo unavailable');
+  let value;
+  if (requests) {
+    value = await Promise.all(requests.map(async ({ namespace, key }) => {
+      const out = await call(bin, ['memory', 'retrieve', '--key', key, '--namespace', namespace, '--value-only', '--path', storePath], deadline);
+      return out === null ? null : out.trim();
+    }));
+  } else {
+    const lists = await Promise.all(namespaces.map(async (namespace) => {
+      const out = await call(bin, ['memory', 'list', '--namespace', namespace, '--limit', '100000', '--format', 'json', '--path', storePath], deadline);
+      if (out === null) throw new Error('list failed');
+      const at = out.indexOf('[');
+      return [namespace, at < 0 ? [] : JSON.parse(out.slice(at)).map((row) => row.key).filter((key) => typeof key === 'string')];
+    }));
+    value = Object.fromEntries(lists);
+  }
+  process.stdout.write(JSON.stringify({ ok: true, value }));
 } catch {
   process.stdout.write(JSON.stringify({ ok: false, fatal: true }));
 }

package/plugin/scripts/agentdb-recall.mjs

@@ -12,12 +12,12 @@ import path from 'node:path';
 import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { resolveRuflo } from './ruflo-bin.mjs';
-import { rufloCwdFor, rufloScratchRoot } from './project-progression-store.mjs';
+import { rufloCwdFor, rufloScratchRoot } from './ruflo-bin.mjs';
 import { resolveProjectStore } from './project-store-resolver.mjs';
 import { isHarnessGenerated, readStdinBounded } from './hook-input.mjs';
 import { learningContext } from './runtime-preferences.mjs';
 import { learningTarget, LEARNING_NAMESPACE } from './learning-store.mjs';
-import { safeAction } from './learning-queue.mjs';
+import { safeAction } from './learn-capture.mjs';
 
 import { redactText } from './continuity-events.mjs';
 import { resolveTurnDb } from './turn-outcome-capture.mjs';
@@ -345,11 +345,6 @@ export async function recall({ prompt, projectDir = process.cwd(), env = process
     const scratchFor = scratch || ((storePath) => rufloCwdFor(storePath, { root: rufloScratchRoot(env) }));
     if (consequential) return await consequentialRecall({ prompt, root, store, bin, scratch: scratchFor, env, deadline, binding, signal, enumerateKeys, exclusions });
     const namespaces = [...new Set(['lessons', 'patterns', 'pattern', 'turns', 'continuity-events', path.basename(root), 'default'])];
-    const family = /\bhooks?\b|hook.harness/i.test(prompt) ? 'decision-hook-harness-index'
-      : /score|grade|north.star/i.test(prompt) ? 'scorecard'
-      : /where are we|status|catch me up/i.test(prompt) ? 'project-state-current'
-      : /releas|publish|workflow run|dispatch/i.test(prompt) ? 'release'
-      : /requirement|always|every prompt/i.test(prompt) ? 'decision-agentdb' : null;
     // This machine runs loaded (load average 30-60 measured 2026-10-10) and ranked search spawns one Ruflo process
     // per namespace; run concurrently they starve every other read past the deadline. So: ONE native enumeration
     // (reused for the curated pass and for pruning empty namespaces), then exact curated state/lessons/decisions,
@@ -362,13 +357,12 @@ export async function recall({ prompt, projectDir = process.cwd(), env = process
       enumerateKeys: sharedKeys, exclusions, rankedSearch: false }).catch(() => null) : null;
     const searchDeadline = searchDeadlineFor(Date.now(), deadline);
     const activeNamespaces = presence?.ok ? namespaces.filter(namespace => presence.value[namespace]?.length) : namespaces;
-    const jobs = (store ? activeNamespaces : []).flatMap((namespace) => [{ store, namespace, family: null, args: ['--format', 'json', '-q', query, '-n', namespace, '--limit', '12'] },
-      ...(family && !SIGNAL_NAMESPACES.has(namespace) && namespace !== 'turns' ? [{ store, namespace, family, args: ['--format', 'json', '-q', family, '-n', namespace, '-t', 'keyword', '--limit', '4'] }] : [])]);
-    const words = promptKeywords(prompt, 14);
-    const workflowQuery = words.map(word => safeAction('Bash', word))
-      .find(action => action && action !== 'command');
-    if (learningStore && workflowQuery) jobs.push({ store: learningStore, namespace: LEARNING_NAMESPACE, family: null,
-      args: ['--format', 'json', '-q', workflowQuery, '-n', LEARNING_NAMESPACE, '-t', 'keyword', '--limit', '4'] });
+    // ONE supplementary search (owner ruling 2026-10-12). Measured on a live-size store at load 17: ~10
+    // concurrent `ruflo memory search` processes took 1.34-1.45 s each against a ~1.1 s window, so every
+    // ranked search timed out. Curated state/lessons/decisions already came from exact reads above.
+    const searchNamespace = [path.basename(root), 'default', 'turns'].find((namespace) => activeNamespaces.includes(namespace));
+    const jobs = store && searchNamespace ? [{ store, namespace: searchNamespace, family: null,
+      args: ['--format', 'json', '-q', query, '-n', searchNamespace, '--limit', '12'] }] : [];
     const results = await Promise.all(jobs.map(async ({ store: jobStore, namespace, family: recordFamily, args }) => ({ namespace, family: recordFamily, storePath: jobStore.path,
       ...await searchOnce({ ruflo: bin, store: jobStore, deadline: searchDeadline, env, scratch: scratchFor, args, signal }) })));
     let status = results.every((r) => r.state === 'ok') ? 'ok'

package/plugin/scripts/brain-footprint.mjs

@@ -41,7 +41,7 @@ export const FOOTPRINT_POLICY = Object.freeze({
   staleStageMs: 2 * 3_600_000,       // an install stage nobody activated in 2h is debris
   staleForgeCandidateMs: 24 * 3_600_000,
   staleLeaseMs: 6 * 3_600_000,       // plugin/scripts/update-apply.mjs LEASE_FRESH_MS
-  staleRufloRunMs: 3_600_000,        // plugin/scripts/project-progression-store.mjs STALE_RUN_MS
+  staleRufloRunMs: 3_600_000,        // plugin/scripts/ruflo-bin.mjs STALE_RUN_MS
 });
 
 /** Every full-KB copy name this product (or a recovery) has ever created beside the live KB. A superset of

package/plugin/scripts/codex-hook-wrapper.mjs

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
+import { pathToFileURL } from 'node:url';
 
 // New installs colocate the helper. Older standalone fixtures/installations can omit it;
 // they retain their prior behavior until the installer upgrades both files.
@@ -44,8 +45,8 @@ const blockingHooks = new Set([
  *
  *     warning: clamping SessionEnd hook timeout to 3s in .../hooks.json
  *
- * SessionEnd is HARD-CAPPED at 3 seconds and no registration can ask for more. learn-flush needs
- * 18s: measured with a real 10-entry queue and the real `ruflo`, 18342 / 18347 / 18384 ms, because
+ * SessionEnd is HARD-CAPPED at 3 seconds and no registration can ask for more. The former learning
+ * flusher needed 18s: measured with a real 10-entry queue and the real `ruflo`, 18342 / 18347 / 18384 ms, because
  * one `ruflo hooks` call alone costs seconds and it self-bounds at LEARN_FLUSH_DEADLINE_MS.
  *
  * So the arithmetic never closes, and what shipped was the worst version of that: this wrapper
@@ -57,7 +58,8 @@ const blockingHooks = new Set([
  * exactly — the hook returns immediately — while the flush runs to its own deadline and does its
  * own write-back. Raising the number instead would have been a fiction the host silently clamps.
  */
-const DETACHED_HOOKS = new Set(['learn-flush']);
+// Empty since the learning flusher was deleted (2026-10-12): learning writes directly through ruflo.
+const DETACHED_HOOKS = new Set([]);
 
 /** THE BUDGET IS DERIVED FROM WHAT THE HOOK MEASURABLY COSTS, never from what looks tidy. */
 function timeoutFor(hookId, event = '', sessionBudgetMs = 0) {
@@ -226,6 +228,14 @@ const result = spawnSync(process.execPath, [adapter, ...process.argv.slice(2)],
   timeout: budgetMs,
   killSignal: 'SIGKILL',
 });
+// Review N5: Codex has no shim watchdog in front of the body, so a kill here was silent. One ledger row,
+// read by the next SessionStart (same writer and file as the shim's own rows). Never throws.
+if (result.error?.code === 'ETIMEDOUT' || result.signal === 'SIGKILL') {
+  try {
+    const { recordHookFailure } = await import(pathToFileURL(path.join(root, 'scripts', 'hook-failures.mjs')).href);
+    recordHookFailure({ hook: hookId, event: process.argv[3] || '', error: 'killed-by-codex-wrapper', limitMs: budgetMs }, { brainHome });
+  } catch { /* an unrecordable failure must not become a second one */ }
+}
 if (hookId === 'session-start' && result.status !== 0) {
   process.stderr.write('[RuvNet Brain — PROJECT CONTINUITY UNKNOWN] SessionStart did not complete inside its host deadline; no restoration success is claimed.\n');
 }

package/plugin/scripts/completion-claim-evidence.mjs

@@ -18,7 +18,7 @@
  *
  * HOSTS. Claude Code transcripts (`transcript_path`, JSONL) are parsed. Codex's Stop payload also
  * carries `transcript_path`, but its rollout format is NOT parsed anywhere in this repository
- * (project-progression-sources.mjs and turn-outcome-capture.mjs both decline it), so on Codex the
+ * (turn-outcome-capture.mjs declines it), so on Codex the
  * transcript half is UNKNOWN and only the answer-side half (2)+(3) is enforced — disclosed in the
  * correction text, never silently treated as proven.
  */

package/plugin/scripts/continuity-events.mjs

@@ -18,7 +18,7 @@
  *   lesson     an owner correction / standing rule, or explicit        explicit only is authoritative
  *   open-item  explicit only (the work ledger is read live, not copied) authoritative
  *
- * Each event is redacted (redactProgression), bounded (SUMMARY_LIMIT), and carries a content-derived
+ * Each event is redacted (redactProgression, below), bounded (SUMMARY_LIMIT), and carries a content-derived
  * `id` so the same commit, decision or lesson is recorded once however many boundaries see it.
  *
  * PRIVACY. Turn capture never stores user text (a 2026-07-13 measurement: prompt echoes were 87% of a
@@ -31,7 +31,95 @@
 import { nativeTurnLines } from './native-turn-transcript.mjs';
 import crypto from 'node:crypto';
 import { execFileSync } from 'node:child_process';
-import { redactProgression } from './project-progression-contract.mjs';
+
+// Secret redaction for event payloads: pure functions, no storage.
+function canonicalize(value) {
+  if (value === null || typeof value === 'string' || typeof value === 'boolean') return value;
+  if (typeof value === 'number' && Number.isFinite(value)) return value;
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (value && typeof value === 'object' && Object.getPrototypeOf(value) === Object.prototype) {
+    return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonicalize(value[key])]));
+  }
+  throw new TypeError('progression values must be JSON-compatible');
+}
+
+function secretKind(key) {
+  const normalized = key.replace(/[^a-z0-9]/gi, '').toLowerCase();
+  if (normalized.includes('privatekey')) return 'private-key';
+  if (normalized.includes('apikey')) return 'api-key';
+  if (normalized.includes('authorization')) return 'authorization';
+  if (normalized.includes('password') || normalized.includes('passwd')) return 'password';
+  if (normalized.includes('token')) return 'token';
+  if (normalized.includes('secret')) return 'secret';
+  if (normalized.includes('credential')) return 'credential';
+  return null;
+}
+
+const INLINE_SECRETS = Object.freeze([
+  {
+    kind: 'private-key',
+    pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+    replace: '[REDACTED:private-key]',
+  },
+  {
+    kind: 'bearer-token',
+    pattern: /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/gi,
+    replace: 'Bearer [REDACTED:bearer-token]',
+  },
+  {
+    kind: 'api-key',
+    pattern: /\b(?:sk|api-key|ghp|github_pat)[-_][A-Za-z0-9._-]{8,}/gi,
+    replace: '[REDACTED:api-key]',
+  },
+  {
+    kind: 'password',
+    pattern: /\b(password|passwd)\s*[:=]\s*[^\s;,]+/gi,
+    replace: '$1=[REDACTED:password]',
+  },
+  {
+    kind: 'token',
+    pattern: /\b(token|secret|credential)\s*[:=]\s*[^\s;,]+/gi,
+    replace: '$1=[REDACTED:token]',
+  },
+]);
+
+export function redactProgression(value) {
+  const redactions = [];
+  const mark = (path, kind) => {
+    if (!redactions.some((row) => row.path === path && row.kind === kind)) redactions.push({ path, kind });
+  };
+  const walk = (current, currentPath) => {
+    if (typeof current === 'string') {
+      let output = current;
+      for (const rule of INLINE_SECRETS) {
+        rule.pattern.lastIndex = 0;
+        const replaced = output.replace(rule.pattern, rule.replace);
+        if (replaced !== output) {
+          mark(currentPath, rule.kind);
+          output = replaced;
+        }
+      }
+      return output;
+    }
+    if (Array.isArray(current)) return current.map((item, index) => walk(item, `${currentPath}[${index}]`));
+    if (current && typeof current === 'object' && Object.getPrototypeOf(current) === Object.prototype) {
+      return Object.fromEntries(Object.keys(current).sort().map((key) => {
+        const path = `${currentPath}.${key}`;
+        const kind = secretKind(key);
+        if (kind && current[key] !== null && current[key] !== undefined) {
+          if (current[key] !== `[REDACTED:${kind}]`) mark(path, kind);
+          return [key, `[REDACTED:${kind}]`];
+        }
+        return [key, walk(current[key], path)];
+      }));
+    }
+    return canonicalize(current);
+  };
+  const redacted = walk(value, '$');
+  redactions.sort((left, right) => left.path.localeCompare(right.path) || left.kind.localeCompare(right.kind));
+  return { value: redacted, redactions };
+}
+
 
 export const CONTINUITY_NAMESPACE = 'continuity-events';
 export const EVENT_SCHEMA = 'ruvnet-brain.continuity-event';

package/plugin/scripts/continuity-hook-policy.mjs

@@ -20,9 +20,10 @@
  *   session-start       continuity recovery   at SessionStart       claude, codex
  *   unprompted-speech   advisory delivery     at UserPromptSubmit   claude, codex
  *   continuation-gate   continuation nudge    at turn end           claude, codex
- *   session-snapshot    continuity capture    at turn end           claude, codex
- *   session-snapshot    continuity capture    at PreCompact         claude
- *   session-snapshot    continuity capture    at SessionEnd         claude, codex
+ *   session-snapshot    turn outcome (ruflo)  at Stop               claude, codex
+ *   session-snapshot    checkpoint (ruflo)    at PreCompact         claude, codex
+ *   session-snapshot    checkpoint (ruflo)    at SessionEnd         claude, codex
+ *   session-snapshot    learning (opt-in)     at PostToolUse        claude, codex
  *   ground-ruvnet       grounding injection   at UserPromptSubmit   claude, codex
  *   capacity-aware-parallel-work coordination guidance at UserPromptSubmit claude, codex
  *   decision-gate       write authorization   at PreToolUse (write) claude, codex
@@ -122,11 +123,9 @@ const registration = (id, matcher, hosts) => Object.freeze({ id, matcher, hosts:
  */
 export const CONTINUITY_EVENTS = Object.freeze({
   SessionStart: Object.freeze([
-    // learn-flush is no longer its own registration (ADR-106): session-start schedules it detached.
     registration('session-start', 'startup|resume|clear|compact|fork', ['claude', 'codex']),
   ]),
   UserPromptSubmit: Object.freeze([
-    registration('session-snapshot', '*', ['claude', 'codex']),
     registration('unprompted-speech', '*', ['claude', 'codex']),
     registration('ground-ruvnet', '*', ['claude', 'codex']),
     // Context-only recommendation for clearly substantial, independently splittable work. The
@@ -144,7 +143,6 @@ export const CONTINUITY_EVENTS = Object.freeze({
   // Claude's `Edit` shape for decision-gate.mjs's own policies (protect-state, hijack-ruvnet,
   // ground-before-write, adr-currency all then see tool_name:"Edit" exactly as on Claude).
   PreToolUse: Object.freeze([
-    registration('session-snapshot', '*', ['claude', 'codex']),
     registration('decision-gate', '^(Write|Edit|MultiEdit|NotebookEdit|apply_patch)$', ['claude', 'codex']),
   ]),
   // Extended to Codex 2026-09-12: a real MCP `search_ruvnet` call was measured to fire PostToolUse
@@ -154,16 +152,10 @@ export const CONTINUITY_EVENTS = Object.freeze({
   // no change either (proven live: the real MCP tool_response's `content[0].text` carries the exact
   // "Searched N RuvNet repos" banner and query text the script already looks for).
   PostToolUse: Object.freeze([
-    // learn-capture runs in-process inside session-snapshot's PostToolUse boundary (ADR-106).
+    // Learning observation (consent-gated `ruflo memory store`) runs inside session-snapshot's PostToolUse body.
     registration('session-snapshot', '*', ['claude', 'codex']),
     registration('grounding-stamp', '^(?:.*__)?search_ruvnet$', ['claude', 'codex']),
   ]),
-  PostToolUseFailure: Object.freeze([
-    registration('session-snapshot', '*', ['claude']),
-  ]),
-  SubagentStop: Object.freeze([
-    registration('session-snapshot', '*', ['claude', 'codex']),
-  ]),
   Stop: Object.freeze([
     registration('continuation-gate', '*', ['claude', 'codex']),
     // Codex added 2026-09-29 (owner requirement: every turn's outcome recorded on BOTH hosts —
@@ -186,7 +178,6 @@ export const CONTINUITY_EVENTS = Object.freeze({
     registration('session-snapshot', '*', ['claude', 'codex']),
   ]),
   SessionEnd: Object.freeze([
-    // learn-flush is scheduled by session-snapshot's SessionEnd boundary (ADR-106).
     registration('session-snapshot', '*', ['claude', 'codex']),
   ]),
 });

package/plugin/scripts/decision-gate.mjs

@@ -162,6 +162,7 @@ const POLICY = (id, file, interpreter = 'bash') => ({ id, file, interpreter });
 const REFUSAL_POLICIES = [
   POLICY('protect-state', 'protect-brain-state.sh'),
   POLICY('hijack-ruvnet', 'hijack-ruvnet.sh'),
+  POLICY('substitution-wall', 'substitution-wall.mjs', 'node'), // owner ruling 2026-10-12: only CALL rUv's memory tools; refuses a rebuilt transport (outbox/queue/journal/replay), in this repo only
   POLICY('ground-before-write', 'ground-before-write.sh'), POLICY('decision-recall', 'decision-recall-gate.mjs', 'node'), // ADR-106
   // adr-currency-gate fires on the EDIT, where the pre-push gate fires on the push. Same rule, same
   // machinery (it calls doc-currency.mjs, never a second copy of the logic) — moved to the earliest
@@ -181,7 +182,7 @@ const SPEECH = { id: 'unprompted-speech', file: 'unprompted-runtime.mjs', interp
 
 /** Which policies apply to which PreToolUse sub-event, mirroring the matchers they replaced. */
 const REGISTRY = {
-  'write': ['protect-state', 'hijack-ruvnet', 'ground-before-write', 'decision-recall', 'adr-currency', 'duplicate-code'],
+  'write': ['protect-state', 'hijack-ruvnet', 'substitution-wall', 'ground-before-write', 'decision-recall', 'adr-currency', 'duplicate-code'],
 };
 
 export function policiesFor(event, registry = REGISTRY, all = REFUSAL_POLICIES) {
@@ -287,7 +288,6 @@ function payloadInput(payload) { return parsed(payload).tool_input || {}; }
  * `Cannot access 'speechEventFor' before initialization` on this gate's first live refusal.
  */
 function speechEventFor(event) { return event === 'bash' ? 'PreToolUse-bash' : 'PreToolUse-write'; }
-
 // ── Runtime ──────────────────────────────────────────────────────────────────────────────────────
 if (isMain()) {
   const started = Date.now();

package/plugin/scripts/decision-record.mjs

@@ -6,7 +6,6 @@
  *   node decision-record.mjs --consult "<topic>"            consequential recall + persisted receipt
  *   node decision-record.mjs --record --what W --why Y --shape S --evidence kind:ref [...]
  *                            [--supersedes <key>]... [--status ratified|detected-unconfirmed]
- *   node decision-record.mjs --flush                        retry records left pending by a refusal
  *
  * Two hooks consume the facts this file produces (ADR-106): decision-gate's `decision-recall` policy
  * reads the consult receipt before a new ADR or an ADR status change; continuation-gate reads the
@@ -15,7 +14,8 @@
  * Store contract (ADR-105 §3, `ruflo memory store --help` read 2026-10-11): every write is
  * `--no-upsert --require-native --append-only --path <abs>` from a private scratch cwd with no
  * CLAUDE_FLOW_MEMORY_PATH; a row is committed only when an exact-key readback returns the same
- * bytes; any other refusal stays pending on disk (mode 0600, fsynced) and is never reported as done.
+ * bytes; any other refusal is LOUD — a hook-failures row plus the printed reason — and is never reported as
+ * done. Nothing is kept on disk for a later replay (owner ruling 2026-10-12: no private outbox).
  */
 import fs from 'node:fs';
 import os from 'node:os';
@@ -28,8 +28,9 @@ import { maskExcludedPaths } from './turn-capture-privacy.mjs';
 import { resolveTurnDb, readSettledTranscript } from './turn-outcome-capture.mjs';
 import { resolveProjectStore } from './project-store-resolver.mjs';
 import { resolveRuflo, rufloInvocation } from './ruflo-bin.mjs';
-import { rufloRunDir } from './project-progression-store.mjs';
+import { rufloRunDir } from './ruflo-bin.mjs';
 import { currentTurnRecords } from './completion-claim-evidence.mjs';
+import { recordHookFailure } from './hook-failures.mjs';
 
 export const DECISION_SCHEMA = 'ruvnet-brain.decision-record';
 export const STATUSES = Object.freeze(['ratified', 'detected-unconfirmed']);
@@ -151,21 +152,11 @@ export function defaultReadBack({ ruflo, db, namespace, key }) {
   return { content: r.status === 0 ? r.stdout.trim() : null };
 }
 
-const pendingDir = (db) => path.join(path.dirname(db), '.decision-records-pending');
-function writePending(db, entry) {
-  const dir = pendingDir(db);
-  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-  const file = path.join(dir, `${entry.key}.json`);
-  const fd = fs.openSync(file, 'w', 0o600);
-  try { fs.writeSync(fd, JSON.stringify(entry)); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
-  return file;
-}
-
 /**
- * The §3 door. committed | already-stored | quarantined | pending — never "committed" without an
+ * The §3 door. committed | already-stored | quarantined | refused — never "committed" without an
  * exact readback of the same bytes, and a refusal is never treated as a duplicate.
  */
-export function storeDecision({ ruflo, db, namespace, key, value, store = defaultStore, readBack = defaultReadBack, keepPending = true }) {
+export function storeDecision({ ruflo, db, namespace, key, value, store = defaultStore, readBack = defaultReadBack }) {
   const prior = readBack({ ruflo, db, namespace, key });
   if (typeof prior.content === 'string' && prior.content === value) return { state: 'already-stored', key };
   if (typeof prior.content === 'string' && prior.content && prior.content !== value) return { state: 'quarantined', key, reason: 'a different stored row holds this key' };
@@ -174,23 +165,8 @@ export function storeDecision({ ruflo, db, namespace, key, value, store = defaul
   if (result.status === 0 && back.content === value) return { state: 'committed', key };
   if (typeof back.content === 'string' && back.content && back.content !== value) return { state: 'quarantined', key, reason: 'a different stored row holds this key' };
   const reason = redactText(String(result.output || '').trim().split('\n').filter(Boolean).slice(-1)[0] || `store exited ${result.status}`).slice(0, 300);
-  const pending = keepPending ? writePending(db, { key, namespace, value, at: new Date().toISOString(), reason }) : null;
-  return { state: 'pending', key, reason, pending };
-}
-
-/** Replay pending records through the same door; a committed one leaves the pending directory. */
-export function flushPending({ ruflo, db, store = defaultStore, readBack = defaultReadBack }) {
-  const out = [];
-  let names = [];
-  try { names = fs.readdirSync(pendingDir(db)).filter((n) => n.endsWith('.json')); } catch { return out; }
-  for (const name of names) {
-    const file = path.join(pendingDir(db), name);
-    let entry; try { entry = JSON.parse(fs.readFileSync(file, 'utf8')); } catch { out.push({ state: 'unreadable', file }); continue; }
-    const r = storeDecision({ ruflo, db, namespace: entry.namespace, key: entry.key, value: entry.value, store, readBack, keepPending: false });
-    if (r.state === 'committed' || r.state === 'already-stored') fs.rmSync(file, { force: true });
-    out.push(r);
-  }
-  return out;
+  recordHookFailure({ hook: 'decision-record', event: 'record', error: `not recorded: ${reason}`.slice(0, 160) });
+  return { state: 'refused', key, reason };
 }
 
 // ── consult receipt (read before deciding) ─────────────────────────────────────────────────────
@@ -267,7 +243,7 @@ function parseArgs(argv) {
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     const next = () => { const v = argv[++i]; if (v === undefined) throw new Error(`${a} needs a value`); return v; };
-    if (['--consult', '--record', '--flush'].includes(a)) { o.mode = a.slice(2); if (a === '--consult') o.topic = next(); }
+    if (['--consult', '--record'].includes(a)) { o.mode = a.slice(2); if (a === '--consult') o.topic = next(); }
     else if (a === '--what') o.what = next();
     else if (a === '--why') o.why = next();
     else if (a === '--shape') o.shape = next();
@@ -286,7 +262,7 @@ function parseArgs(argv) {
 export async function main(argv = process.argv.slice(2), { env = process.env, out = process.stdout, err = process.stderr, recallFn, store, readBack } = {}) {
   let o;
   try { o = parseArgs(argv); } catch (e) { err.write(`decision-record: ${e.message}\n`); return 2; }
-  if (!o.mode) { err.write('decision-record: one of --consult "<topic>", --record, --flush is required\n'); return 2; }
+  if (!o.mode) { err.write('decision-record: one of --consult "<topic>", --record is required\n'); return 2; }
   const projectDir = path.resolve(o.project || process.cwd());
   const brainHome = brainHomeOf(env);
   let target;
@@ -306,11 +282,6 @@ export async function main(argv = process.argv.slice(2), { env = process.env, ou
   const ruflo = resolveRuflo({ env });
   if (!ruflo) { err.write('decision-record: not recorded — global ruflo not found\n'); return 3; }
   try { if (!fs.statSync(target.db).isFile()) throw new Error(); } catch { err.write('decision-record: not recorded — project has no canonical store (.swarm/memory.db)\n'); return 3; }
-  if (o.mode === 'flush') {
-    const rows = flushPending({ ruflo, db: target.db });
-    out.write(`decision-record flush: ${rows.map((r) => `${r.key || r.file} ${r.state}`).join('; ') || 'nothing pending'}\n`);
-    return rows.every((r) => ['committed', 'already-stored'].includes(r.state)) ? 0 : 3;
-  }
   const identity = resolveProjectStore({ projectDir, gitTimeoutMs: 1000 }).projectIdentity.id;
   const built = buildDecisionRecord(o, { projectRoot: target.projectRoot, projectIdentity: identity,
     host: env.RUVNET_HOOK_HOST === 'codex' ? 'codex' : env.CLAUDE_PLUGIN_ROOT || env.CLAUDECODE ? 'claude' : 'cli',
@@ -329,7 +300,7 @@ export async function main(argv = process.argv.slice(2), { env = process.env, ou
     out.write(`decision-record: supersedes ${key} — ${String(row.what).slice(0, 120)}\n`);
   }
   const r = storeDecision({ ruflo, db: target.db, namespace, key: built.key, value: built.value, ...(store ? { store } : {}), ...(readBack ? { readBack } : {}) });
-  out.write(`decision-record: ${r.state} ${r.key} (namespace ${namespace})${r.reason ? ` — ${r.reason}` : ''}${r.pending ? ` — retained for --flush` : ''}\n`);
+  out.write(`decision-record: ${r.state} ${r.key} (namespace ${namespace})${r.reason ? ` — ${r.reason}` : ''}${r.state === 'refused' ? ` — NOT recorded (logged to hook-failures). A store that committed but did not read back may still hold it: run \`ruflo memory retrieve -k ${r.key} -n ${namespace} --path ${target.db}\` before re-running --record` : ''}\n`);
   if (!['committed', 'already-stored'].includes(r.state)) return 3;
   let ok = true;
   for (const oldKey of built.record.supersedes) {

package/plugin/scripts/hook-failures.mjs

@@ -8,6 +8,7 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
+import os from 'node:os';
 
 export const FAILURE_FILE = 'hook-failures.jsonl';
 export const FAILURE_LINE_PREFIX = '[RuvNet Brain — HOOK FAILURES]';
@@ -43,3 +44,18 @@ export function failureLine(brainHome, { advance = true } = {}) {
   return `${FAILURE_LINE_PREFIX} ${rows.length} advisory hook run(s) did not complete or did not resolve since ${rows[0].at}: ${parts.join('; ')}. `
     + `They failed open. Details: ${file}`;
 }
+
+/**
+ * The writer for bodies that run OUTSIDE the shim's watchdog (a refused `ruflo memory store`, a failed
+ * exact readback). Same file, same row shape as hook-shim.mjs's inlined recordFailure, so the next
+ * SessionStart's failureLine() reports it. Never throws: an unrecordable failure must not become a second one.
+ */
+export function recordHookFailure(fields, { brainHome = process.env.RUVNET_BRAIN_HOME || path.join(os.homedir(), '.cache', 'ruvnet-brain') } = {}) {
+  try {
+    const file = path.join(brainHome, FAILURE_FILE);
+    fs.mkdirSync(brainHome, { recursive: true });
+    try { if (fs.statSync(file).size > 256 * 1024) fs.renameSync(file, `${file}.1`); } catch { /* absent */ }
+    fs.appendFileSync(file, `${JSON.stringify({ at: new Date().toISOString(), ...fields })}\n`, { mode: 0o600 });
+    return true;
+  } catch { return false; }
+}

package/plugin/scripts/hook-shim.mjs

@@ -122,7 +122,6 @@ const TABLE = {
   // invocation". Restored. wired-check.mjs's H6 fix does not depend on these keys existing either
   // way — it stopped trusting hook-shim.mjs as a blind generic spawner, not their presence here.
   'learn-capture':    { file: 'learn-capture.mjs',   interpreter: 'node', mode: 'advisory', offBehavior: 'silence', stdinBytes: 65536 },
-  'learn-flush':      { file: 'learn-flush.mjs',     interpreter: 'node', mode: 'advisory', offBehavior: 'silence' },
   // 1 MiB, not 64 KiB: the Stop payload now carries `last_assistant_message`, and a long closing
   // message truncated mid-JSON would parse as `{}` and silently drop the whole capture.
   'session-snapshot': { file: 'session-snapshot-hook.mjs', interpreter: 'node', mode: 'advisory', offBehavior: 'run', stdinBytes: 1048576 },
@@ -268,7 +267,7 @@ function readHookInput(limit) {
  * even if an older one was already reported.
  *
  * WHY A TTL RATHER THAN A TRUE SESSION ID, stated plainly rather than implied: no session identifier
- * reaches this dispatcher. Claude Code does not set CLAUDE_SESSION_ID (learn-flush.mjs documents the
+ * reaches this dispatcher. Claude Code does not set CLAUDE_SESSION_ID (the learning hook documented the
  * same finding), and the only place `session_id` exists is the stdin payload — which the majority of
  * these table entries deliberately never read. So the window is an approximation of a session, not a
  * claim to be one: it bounds a persistent breakage to roughly one line per working session instead