ruvnet-brain 4.6.4 → 4.7.0

package/plugin/scripts/substitution-wall.mjs

@@ -0,0 +1,222 @@
+#!/usr/bin/env node
+/**
+ * substitution-wall.mjs — "if you are rebuilding rUv's storage, stop and call his tool."
+ *
+ * THE RULING (owner, permanent): this plugin may only CALL rUv's memory tools (`ruflo memory
+ * store|retrieve|search|list|stats|backup|cleanup|compress`, `ruflo hooks ...`). It must never
+ * hand-roll its own storage, queue, journal or outbox for agent memory. Three incidents made the
+ * rule: 2026-07-13 (router), 2026-07-16 (router-optimizer), 2026-10-12 (a persistence layer in front
+ * of `ruflo memory store`: a 3.38 GB outbox, snapshots, queues, replay workers). The old CI gate
+ * (scripts/no-silent-substitution.mjs) said "none" on all of it: it only knew four rUv packages and
+ * counted any spawn of the `ruflo` binary as "rUv is used".
+ *
+ * WHY rUv's store is the answer, not a journal in front of it: `ruflo memory store` owns its own
+ * durability — it fails closed on a locked/damaged DB and reports the native bridge error
+ * (ruflo/v3/docs/releases/v3.32.34.md), and reports `persistWarning` instead of a blind success
+ * (ruflo/v3/@claude-flow/cli/__tests__/memory-store-persist-warning-2968.test.ts).
+ *
+ * ONE PURE FUNCTION, two callers: the decision-gate policy below (PreToolUse Write/Edit/MultiEdit/NotebookEdit/apply_patch)
+ * and the CI gate scripts/no-silent-substitution.mjs. No I/O, no clock, no network inside
+ * substitutionVerdict(); the CLI block at the bottom does the reading.
+ *
+ * ADR-106: refuse only on a FACT. The fact is a hand-built durable transport in code: a persistence
+ * primitive (fsync/append/O_APPEND) AND a transport construct (outbox/journal/queue/replay/spool/
+ * drain) AND a mechanism that only a transport needs (fsync durability, a lock file, or a
+ * self re-exec worker). Weaker evidence — state appended next to agent memory, or score ranking over
+ * it — WARNS through additionalContext and never blocks.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const RUV_TOOL = 'ruflo memory store|retrieve|search (or `ruflo hooks session-end|post-task`)';
+/** Repo-relative scope: our own executable code. Tests and fixtures are never in scope. */
+export const SCOPE = /(?:^|\/)(?:plugin\/scripts|scripts)\/(?:[^/]+\/)*[^/]+\.(?:mjs|cjs|js|sh)$/;
+/** The rulebook names every signal in order to police it; exempting it is not a loophole. */
+const EXEMPT = new Set(['plugin/scripts/substitution-wall.mjs', 'scripts/no-silent-substitution.mjs']);
+const TEST = /(?:^|\/)(?:tests?|__tests__|fixtures?)\/|\.test\.[cm]?js$|\.spec\.[cm]?js$/;
+
+export function inScope(p) {
+  const rel = String(p || '').split(path.sep).join('/');
+  return SCOPE.test(rel) && !TEST.test(rel) && ![...EXEMPT].some((e) => rel === e || rel.endsWith(`/${e}`));
+}
+
+/** Code only: comments describe a design, they do not implement one (and our headers name incidents). */
+export function codeOf(content, p = '') {
+  const s = String(content || '');
+  if (/\.sh$/.test(p)) return s.split('\n').filter((l) => !/^\s*#/.test(l)).join('\n');
+  return s.replace(/\/\*[\s\S]*?\*\//g, ' ').replace(/(^|[^:'"`\\])\/\/[^\n]*/g, '$1');
+}
+
+// pending/flush/retry joined after review M6: decision-record kept an fsynced `pending` dir with a `--flush` replay.
+// Bare "pending"/"retry" are status words (14 false refusals measured over this tree); only their storage/replay forms count.
+const TRANSPORT = /outbox|journal|spool|replay|\bdrain\w*|queue(?!d)|\bpending(?:Dir|Path|Records?|Writes?|Files?|Queue)\b|\bflush(?:Pending|Queue|Outbox|Journal)\w*|['"]--(?:flush|retry)['"]|\bretry(?:Queue|Pending|Worker|Dir)\w*/i;
+/** The distinct transport words in code: an edit to a debt file that adds a NEW one is a new transport. */
+export const transportTerms = (content, p = '') => new Set((codeOf(content, p).match(new RegExp(TRANSPORT.source, 'gi')) || []).map((t) => t.toLowerCase()));
+
+const RULES = {
+  persist: /\b(?:appendFileSync|appendFile|fsyncSync|fdatasyncSync|createWriteStream)\b|\bO_APPEND\b|flags?\s*:\s*['"]a\+?['"]/,
+  // A write-then-rename (the usual atomic JSON-file store) persists as surely as an append. It counts toward a
+  // TRANSPORT only: as a bare warn signal it flagged a settings writer (runtime-preferences.mjs) falsely.
+  atomicWrite: /\bwriteFileSync\([^;]{0,200};[\s\S]{0,300}?\brenameSync\(/,
+  durable: /\b(?:fsyncSync|fdatasyncSync)\b/,
+  // `readback` is verification (store, then retrieve) and `queued` is a status word: neither is a transport.
+  transport: TRANSPORT,
+  lock: /['"]wx\+?['"]|\.lock\b/,
+  worker: /spawn\(\s*process\.execPath\s*,\s*\[\s*(?:fileURLToPath\(\s*import\.meta\.url\s*\)|__filename|SELF\b)|['"]--(?:replay|drain)[\w-]*['"]/,
+  memorySink: /\.swarm\b|memory\.db\b|['"]memory['"]\s*,\s*['"](?:store|retrieve)['"]/,
+  rank: /\b(?:cosine|tf-?idf|bm25)\b/i,
+  sqlite: /node:sqlite|\bDatabaseSync\b|better-sqlite3|sql\.js/,
+  storeWrite: /\b(?:INSERT|UPDATE|DELETE|REPLACE)\b[^;'"`]{0,40}\bmemory_entries\b/i,
+};
+
+/** The signals present in this code, as a sorted list of names (deterministic). */
+export function signalsOf(content, p = '') {
+  const code = codeOf(content, p);
+  const hits = Object.entries(RULES).filter(([, re]) => re.test(code)).map(([k]) => k);
+  if (hits.includes('rank') && !/\.sort\(/.test(code)) hits.splice(hits.indexOf('rank'), 1);
+  return hits.sort();
+}
+
+const isTransport = (s) => (s.includes('persist') || s.includes('atomicWrite')) && s.includes('transport')
+  && (s.includes('durable') || s.includes('lock') || s.includes('worker'));
+
+/**
+ * The verdict for one file's FULL proposed content.
+ *   before  — the file's content before this change (null for a new file). A file that already
+ *             refused and gains no new signal is existing debt being edited (often removed): WARN.
+ *   allow   — repo-relative paths the OWNER exempted in config (never a header in the file itself).
+ * Returns { verdict: 'refuse'|'warn'|'pass', signals, tool, reason }.
+ */
+export function substitutionVerdict({ path: p, content, before = null, allow = [] }) {
+  const rel = String(p || '').split(path.sep).join('/');
+  const base = { signals: [], tool: RUV_TOOL, reason: '' };
+  if (!inScope(rel)) return { verdict: 'pass', ...base };
+  const signals = signalsOf(content, rel);
+  const out = (verdict, reason) => ({ verdict, signals, tool: RUV_TOOL, reason });
+  if (isTransport(signals)) {
+    const allowed = allow.find((a) => rel === a || rel.endsWith(`/${a}`));
+    if (allowed) return out('warn', `owner allowlist entry ${allowed}`);
+    if (before !== null) {
+      const prior = signalsOf(before, rel);
+      const priorTerms = transportTerms(before, rel);
+      const added = [...transportTerms(content, rel)].filter((t) => !priorTerms.has(t));
+      if (isTransport(prior) && signals.every((s) => prior.includes(s)) && !added.length) return out('warn', 'existing debt; this change adds no new transport signal');
+      if (added.length) return out('refuse', `existing debt gains a new transport signal (${added.join(', ')})`);
+    }
+    return out('refuse', 'hand-built durable transport for state');
+  }
+  if (signals.includes('sqlite') && signals.includes('storeWrite')) return out('refuse', "writes rUv's memory_entries table directly instead of calling ruflo memory store");
+  if (signals.includes('persist') && signals.includes('memorySink')) return out('warn', 'appends state next to agent memory');
+  if (signals.includes('sqlite') && signals.includes('memorySink')) return out('warn', "opens rUv's store directly (couples to its private schema)");
+  if (signals.includes('rank') && signals.includes('memorySink')) return out('warn', 'ranks agent-memory content by score');
+  return out('pass', '');
+}
+
+/** The refusal/warning text. Short, actionable, and says how an exception is really declared. */
+export function message(rel, v) {
+  if (v.verdict === 'pass') return '';
+  const head = v.verdict === 'refuse'
+    ? `⛔ BLOCKED — ${rel} rebuilds rUv's storage (${v.reason}; signals: ${v.signals.join(', ')}).`
+    : `⚠ substitution-wall — ${rel}: ${v.reason} (signals: ${v.signals.join(', ')}).`;
+  return [head,
+    `Call rUv's tool instead: ${v.tool}. Its store owns durability and fails closed; do not put an outbox, queue, journal, lock or replay worker in front of it.`,
+    ...(v.verdict === 'refuse' ? ['A `HAND-ROLLED: ... REAL TOOL: ...` header does NOT lift this. A real exception is an owner-approved entry in config/state-files.json `substitutionAllow`.'] : []),
+  ].join('\n');
+}
+
+/** Codex's apply_patch: per file, the content after its hunks (Add = the + lines; Update = hunks applied). */
+function patchChanges(patch, read) {
+  const out = []; let cur = null; let hunk = null;
+  // A hunk with no context, or context that is not in the file, fails CLOSED (review N3): its lines are
+  // appended to the after-text, so a pure-addition outbox module is judged, never skipped.
+  const flush = () => {
+    if (cur && hunk && cur.after !== null && hunk.new.length) {
+      const norm = (t) => t.replace(/\r\n?/g, '\n').replace(/[ \t]+$/gm, '');
+      const from = norm(hunk.old.join('\n')); const to = hunk.new.join('\n'); const hay = norm(cur.after);
+      cur.after = from && hay.includes(from) ? hay.replace(from, () => to) : `${hay}\n${to}`;
+    }
+    hunk = null;
+  };
+  for (const line of String(patch || '').split(/\r?\n/)) {
+    const m = /^\*\*\* (Add|Update|Delete) File: (.+)$/.exec(line);
+    if (m || /^\*\*\* (?:End Patch|Move to:)/.test(line)) { flush(); if (m) { cur = m[1] === 'Delete' ? null : { file: m[2].trim(), add: m[1] === 'Add', lines: [] }; if (cur) { cur.before = cur.add ? null : read(cur.file); cur.after = cur.add ? '' : cur.before; out.push(cur); } } continue; }
+    if (!cur) continue;
+    if (cur.add) { if (line.startsWith('+')) cur.lines.push(line.slice(1)); continue; }
+    if (line.startsWith('@@')) { flush(); hunk = { old: [], new: [] }; continue; }
+    if (!hunk) hunk = { old: [], new: [] };
+    if (line.startsWith('-')) hunk.old.push(line.slice(1)); else if (line.startsWith('+')) hunk.new.push(line.slice(1));
+    else if (line.startsWith(' ') || line === '') { hunk.old.push(line.slice(1)); hunk.new.push(line.slice(1)); }
+  }
+  flush();
+  for (const c of out) if (c.add) c.after = c.lines.join('\n'); // once, not per line (review 3: 80k lines took 53 s)
+  return out.filter((c) => c.after !== null).map(({ file, before, after }) => ({ file, before, after }));
+}
+
+/**
+ * Every file a write tool call would produce, as { file, before, after }. Write/Edit/MultiEdit,
+ * NotebookEdit (new_source; .ipynb is out of SCOPE, judged for completeness) and Codex's apply_patch
+ * (the patch text arrives as tool_input.command / .input, or as the bare string).
+ */
+export function proposedChanges(payload, read) {
+  const tool = String(payload?.tool_name || '');
+  const input = payload?.tool_input ?? {};
+  if (tool === 'apply_patch') return patchChanges(typeof input === 'string' ? input : input.command || input.input || input.patch, read);
+  // The REAL Codex path (review N2): codex-hook-adapter.mjs rewrites apply_patch into an Edit whose
+  // new_string is the whole patch and which has no old_string. Judge that patch, not the Edit.
+  if (tool === 'Edit' && !input.old_string && /^\s*\*\*\* Begin Patch/.test(String(input.new_string ?? ''))) return patchChanges(input.new_string, read);
+  if (tool === 'NotebookEdit') return typeof input.notebook_path === 'string' ? [{ file: input.notebook_path, before: read(input.notebook_path), after: String(input.new_source ?? '') }] : [];
+  const one = proposedContent(payload, read);
+  return one ? [{ file: input.file_path, ...one }] : [];
+}
+
+/** The file after an Edit/MultiEdit/Write, or null when this tool call is not a file write we judge. */
+export function proposedContent(payload, read) {
+  const tool = String(payload?.tool_name || '');
+  const input = payload?.tool_input || {};
+  if (!['Write', 'Edit', 'MultiEdit'].includes(tool) || typeof input.file_path !== 'string') return null;
+  const before = read(input.file_path);
+  if (tool === 'Write') return { before, after: String(input.content ?? '') };
+  if (before === null) return null;
+  let after = before;
+  for (const e of (tool === 'Edit' ? [input] : (Array.isArray(input.edits) ? input.edits : []))) {
+    const from = String(e?.old_string ?? ''); const to = String(e?.new_string ?? '');
+    if (from) after = e.replace_all ? after.split(from).join(to) : after.replace(from, () => to);
+  }
+  return { before, after };
+}
+
+/** Repo identity: the wall REFUSES only inside this repo; in any other project it can only warn. */
+function repoRootOf(file) {
+  let dir = path.dirname(file);
+  for (let i = 0; i < 12; i += 1) {
+    try { if (JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).name === 'ruvnet-brain') return dir; } catch { /* keep walking */ }
+    const up = path.dirname(dir); if (up === dir) break; dir = up;
+  }
+  return null;
+}
+
+function isMain() {
+  try { return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); } catch { return false; }
+}
+if (isMain()) {
+  let code = 0;
+  try {
+    const payload = JSON.parse(fs.readFileSync(0, 'utf8') || '{}');
+    const cwd = typeof payload.cwd === 'string' ? payload.cwd : process.cwd();
+    const abs = (p) => (path.isAbsolute(p) ? p : path.resolve(cwd, p));
+    const changes = proposedChanges(payload, (p) => { try { return fs.readFileSync(abs(p), 'utf8'); } catch { return null; } });
+    for (const change of String(process.env.RUVNET_SUBSTITUTION_WALL || '').toLowerCase() !== 'off' ? changes : []) {
+      const file = abs(change.file);
+      const root = repoRootOf(file);
+      const rel = root ? path.relative(root, file) : String(payload.tool_input.file_path);
+      let allow = [];
+      if (root) { try { allow = JSON.parse(fs.readFileSync(path.join(root, 'config', 'state-files.json'), 'utf8')).substitutionAllow?.map((a) => a.path) || []; } catch { /* no config: no exemptions */ } }
+      let v = substitutionVerdict({ path: rel, content: change.after, before: change.before, allow });
+      if (v.verdict === 'refuse' && !root) v = { ...v, verdict: 'warn', reason: `${v.reason} (outside the ruvnet-brain repo: advisory)` };
+      if (v.verdict === 'refuse') { process.stderr.write(`${message(rel, v)}\n`); code = 2; break; }
+      else if (v.verdict === 'warn') process.stdout.write(message(rel, v));
+    }
+  } catch { code = 0; /* fail open on the wall's own errors */ }
+  process.exit(code);
+}

package/plugin/scripts/turn-outcome-capture.mjs

@@ -1,7 +1,7 @@
 /**
  * turn-outcome-capture.mjs — record what each turn CONCLUDED, and make it recallable knowledge.
  *
- * Called from session-snapshot-hook.mjs's runSessionSnapshotHook, so it rides the capture boundary
+ * Called from session-snapshot-hook.mjs's hook entry, so it rides the capture boundary
  * both hosts already register (Claude: hooks.json; Codex: codex-hooks.json via codex-hook-adapter,
  * which sets RUVNET_HOOK_HOST=codex). Two jobs:
  *
@@ -27,10 +27,11 @@
  * SessionEnd and PreCompact recover a closing outcome when Stop payload text is absent. Tool IDs
  * correlate observable gate outcomes; opaque custom orchestration inputs remain unclassified.
  *
- * LATENCY: Stop runs synchronously in the host's turn, and one `ruflo memory store` costs ~0.7s
- * (measured). So the writes run in ONE detached worker (this file, `--run-steps`), store then
- * distill in order; the hook itself only reads, fingerprints and spawns. A project-local journal containing redacted content and canonical binding is fsynced BEFORE
- * spawning; fresh sessions replay stable keys without upsert and require exact readback receipts. Advisory always: nothing here throws to the caller.
+ * LATENCY AND FAILURE (owner ruling 2026-10-12): the turn is written DIRECTLY with one bounded
+ * `ruflo memory store` and proven by exact-key readback inside the hook's deadline (~0.5-1.3 s measured
+ * on a live-size store). There is no journal, outbox or replay worker. A refused or unverified write is
+ * recorded in the hook-failures ledger, which the next SessionStart summarizes. Only `memory distill run`
+ * (SessionEnd/PreCompact) is detached. Advisory always: nothing here throws to the caller.
  */
 import fs from 'node:fs';
 import os from 'node:os';
@@ -39,17 +40,26 @@ import crypto from 'node:crypto';
 import { spawn, spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { nativeTurnLines } from './native-turn-transcript.mjs';
-import { resolveRuflo, rufloInvocation } from './ruflo-bin.mjs';
-import { rufloCwdFor, rufloScratchRoot } from './project-progression-store.mjs';
+import { resolveRuflo, rufloInvocation, rufloCwdFor, rufloScratchRoot } from './ruflo-bin.mjs';
 import { redactText } from './continuity-events.mjs';
 import { resolveProjectStore, globalEnrollmentAllowed } from './project-store-resolver.mjs';
-import { digest, journalTurn, readJournal, pendingTurnFiles, acknowledgeJournal, appendReceipt, storeData } from './turn-transport-journal.mjs';
+import { recordHookFailure } from './hook-failures.mjs';
+
+const digest = (value) => crypto.createHash('sha256').update(String(value)).digest('hex');
+function appendReceipt(file, row) {
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+  try { if (fs.statSync(file).size > RECEIPTS_MAX_BYTES) fs.renameSync(file, `${file}.1`); } catch { /* absent */ } // bounded like hook-failures
+  fs.appendFileSync(file, `${JSON.stringify(row)}\n`, { mode: 0o600 });
+}
+const flagValue = (args, flag) => { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : undefined; };
 import { contentPathExcludes, pathIsExcluded, privateTurn, maskExcludedPaths, captureFailureReason, firstTurnCaptureNotice } from './turn-capture-privacy.mjs';
 
 export const TURN_NAMESPACE = 'turns';
 export const MIN_OUTCOME_CHARS = 200;
 const TRANSCRIPT_TAIL_BYTES = 2 * 1024 * 1024;
 const STEP_TIMEOUT_MS = 60_000;
+export const RECEIPTS_MAX_BYTES = 256 * 1024;
+export const TURN_STATUS_FRESH_MS /* ✓ only when the newest receipt is verified and younger */ = 24 * 3_600_000;
 const RUFLO_ENV = { RUFLO_DAEMON_AUTOSTART: '0' };
 
 function textOf(content) {
@@ -222,7 +232,7 @@ const projectName = (projectDir) => redactText(path.basename(path.resolve(projec
 
 /** Detached worker launch: the hook returns immediately; the worker runs the steps in order. */
 export function launchDetached(steps, { receipts, brainHome, projectDir, env = process.env }) {
-  const child = spawn(process.execPath, [fileURLToPath(import.meta.url), '--run-steps', JSON.stringify({ steps: steps.map((step) => step.kind === 'store' && step.journalFile ? { kind: 'journal', journalFile: step.journalFile, db: step.args[step.args.indexOf('--path') + 1] } : step), receipts })], {
+  const child = spawn(process.execPath, [fileURLToPath(import.meta.url), '--run-steps', JSON.stringify({ steps, receipts })], {
     cwd: os.tmpdir(), detached: true, stdio: 'ignore', windowsHide: true, env: { ...env, ...RUFLO_ENV, ...(brainHome ? { RUVNET_BRAIN_HOME: brainHome } : {}), ...(projectDir ? { RUVNET_TURN_PROJECT_DIR: projectDir } : {}) },
   });
   child.unref();
@@ -269,14 +279,18 @@ export function captureTurnOutcome({
   readTranscript = readSettledTranscript,
   settleMs = 2000,
   now = () => new Date(),
+  deadlineAt,
+  run,
+  write = runSteps,
 } = {}) {
   const report = { event, host, queued: false, recorded: false, distill: { queued: false } };
   if (String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() === 'off') {
     return { ...report, skipped: 'RUVNET_TURN_CAPTURE=off', distill: { queued: false, skipped: 'RUVNET_TURN_CAPTURE=off' } };
   }
-  if (!ruflo) return { ...report, skipped: 'ruflo not found', distill: { queued: false, skipped: 'ruflo not found' } };
+  // Review M1: a capture that cannot happen is LOUD (a ledger row with a fixed reason, never turn text).
+  const loud = (reason, store) => { recordHookFailure({ hook: 'turn-capture', event, error: reason.slice(0, 160), ...(store ? { store: digest(store).slice(0, 16) } : {}) }, { brainHome }); return reason; };
   let target;
-  try { target = resolveTurnDb({ projectDir, brainHome }); } catch (error) { return { ...report, skipped: `store resolution failed: ${redactText(error.message)}` }; }
+  try { target = resolveTurnDb({ projectDir, brainHome, ...(deadlineAt ? { deadlineAt } : {}) }); } catch (error) { return { ...report, skipped: loud(`store resolution failed: ${redactText(error.message)}`) }; }
   const { db, scope, projectRoot } = target;
   Object.assign(report, { db, scope });
   if (target.skipped) return { ...report, skipped: target.skipped, distill: { queued: false, skipped: target.skipped } };
@@ -313,16 +327,9 @@ export function captureTurnOutcome({
         const at = now();
         const key = `turn-${project}-${digest(`${identity}:${fingerprint}`).slice(0, 40)}`;
         dedupe = { stateFile, identity, fingerprint, key };
-        let value = buildTurnRecord({ turn, project, host, session: payload.session_id, at });
-        // Retry uses the original durable content (including its timestamp), never a new value.
-        const pendingFile = path.join(path.dirname(db), 'turn-outbox', `${digest(key)}.json`);
-        if (fs.existsSync(pendingFile)) {
-          try { const pending = readJournal(pendingFile, db); value = pending.value; }
-          catch (error) { return { ...report, skipped: `durable turn queue invalid: ${redactText(error.message)}` }; }
-        }
-        steps.push({ ...binding, kind: 'store', ruflo, args: ['memory', 'store', '-k', key, '--value', value, '-n', TURN_NAMESPACE,
+        const value = buildTurnRecord({ turn, project, host, session: payload.session_id, at });
+        steps.push({ ...binding, kind: 'store', ruflo, args: ['memory', 'store', '--key', key, '--value', value, '--namespace', TURN_NAMESPACE,
           '--path', db, '--no-upsert', '--require-native', '--append-only', '--tags', `project=${project},host=${host}`, '--provenance', 'agent_output'] });
-        // This synchronous boundary proves only queuing; the worker's exact receipt proves recording.
         Object.assign(report, { queued: true, key, value });
       }
     }
@@ -336,20 +343,26 @@ export function captureTurnOutcome({
     }
   }
   if (!steps.length) return report;
+  if (!ruflo) return { ...report, queued: false, skipped: loud('ruflo not found', db), distill: { queued: false, skipped: 'ruflo not found' } };
 
   try {
     // Only explicit persisted consent permits creating a project store directory.
     if (target.optedIn) fs.mkdirSync(path.dirname(db), { recursive: true, mode: 0o700 });
-    if (report.queued) {
-      const step = steps.find((item) => item.kind === 'store');
-      step.journalFile = journalTurn(step, db, report.key, { onDurability: (evidence) => { report.durability = evidence; } });
-      fs.appendFileSync(path.join(path.dirname(db), 'agentdb-turns.jsonl'),
-        `${JSON.stringify({ ts: Date.now(), key: report.key, hash: crypto.createHash('sha256').update(report.value).digest('hex'), len: report.value.length })}\n`, { mode: 0o600 });
+    // The turn is written NOW, bounded by the hook's deadline, and proven by exact-key readback (owner
+    // ruling 2026-10-12: no outbox, no journal, no replay). A refusal is recorded by runSteps in the
+    // hook-failures ledger, so SessionStart reports it. Only distillation runs detached.
+    const store = steps.filter((item) => item.kind === 'store');
+    if (store.length) {
+      const [row] = write({ steps: store, receipts, event }, { env, home, projectDir: binding.projectDir, brainHome,
+        ...(deadlineAt ? { deadlineMs: deadlineAt } : {}), ...(run ? { run } : {}) });
+      Object.assign(report, { recorded: row?.verified === true, receipt: row });
+      if (row?.verified && dedupe) markTurnQueued(dedupe.stateFile, dedupe.identity, dedupe.fingerprint, dedupe.key);
     }
-    report.launch = launch(steps, { receipts, brainHome, projectDir: binding.projectDir, env });
-    if (dedupe) markTurnQueued(dedupe.stateFile, dedupe.identity, dedupe.fingerprint, dedupe.key);
+    const detached = steps.filter((item) => item.kind !== 'store');
+    if (detached.length) report.launch = launch(detached, { receipts, brainHome, projectDir: binding.projectDir, env });
   } catch (error) {
-    return { ...report, queued: false, recorded: false, distill: { queued: false, skipped: `launch failed: ${redactText(error.message)}` }, skipped: `launch failed: ${redactText(error.message)}` };
+    const reason = loud(`launch failed: ${redactText(error.message)}`, db);
+    return { ...report, queued: false, recorded: false, distill: { queued: false, skipped: reason }, skipped: reason };
   }
   return report;
 }
@@ -362,39 +375,39 @@ function readBack({ ruflo, db, key, run, options }) {
 }
 
 /** The detached worker: bounded steps, safe error evidence, exact content readback. */
-export function runSteps({ steps = [], receipts } = {}, { run: suppliedRun = spawnSync, read = readBack,
+export function runSteps({ steps = [], receipts, event = '' } = {}, { run: suppliedRun = spawnSync, read = readBack,
   env = process.env, deadlineMs, home = os.homedir(),
   projectDir = env.RUVNET_TURN_PROJECT_DIR || process.cwd(),
   brainHome = env.RUVNET_BRAIN_HOME || path.join(home, '.cache', 'ruvnet-brain') } = {}) {
   const run = (binary, args, options) => {
     if (deadlineMs === undefined) return suppliedRun(binary, args, options);
     const remaining = deadlineMs - Date.now();
-    if (remaining <= 0) return { status: 1, error: new Error('turn replay deadline exhausted') };
+    if (remaining <= 0) return { status: 1, error: new Error('turn write deadline exhausted') };
     return suppliedRun(binary, args, { ...options, timeout: Math.min(options.timeout, remaining) });
   };
   const results = [];
   for (const queued of steps) {
     let status = 1; let error = null; let skipped = null; let verified = false; let db = ''; let key; let privacyPatterns = [];
-    const kind = queued.kind === 'journal' ? 'store' : queued.kind;
+    const kind = queued.kind;
     try {
       if (String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() === 'off') throw new Error('RUVNET_TURN_CAPTURE=off');
-      if (kind === 'store' && queued.kind !== 'journal') { const data = storeData(queued); key = data.key; db = data.db; }
-      if (queued.kind !== 'journal' && (!queued.projectRoot || !queued.projectDir || !queued.brainHome)) throw new Error('queued step has no canonical project binding');
-      const target = resolveTurnDb({ projectDir, brainHome, gitTimeoutMs: 1000 });
+      if (kind === 'store') { key = flagValue(queued.args, '--key'); db = flagValue(queued.args, '--path'); }
+      if ((!queued.projectRoot || !queued.projectDir || !queued.brainHome)) throw new Error('queued step has no canonical project binding');
+      const bound = deadlineMs === undefined ? {} : { deadlineAt: deadlineMs }; // review M4: git obeys the hook deadline
+      const target = resolveTurnDb({ projectDir, brainHome, gitTimeoutMs: 1000, ...bound });
       if (target.skipped) throw new Error(target.skipped);
       privacyPatterns = target.contentPathExcludes;
       db = target.db;
       let args; let value; let binding;
       if (kind === 'store') {
-        const data = queued.kind === 'journal' ? readJournal(queued.journalFile, db) : storeData(queued);
-        if (queued.kind === 'journal' && queued.db !== db) throw new Error('foreign turn queue store rejected');
-        if (queued.kind !== 'journal' && data.db !== db) throw new Error('foreign turn store rejected');
-        if (data.legacyBrainHome && data.legacyBrainHome !== brainHome) throw new Error('queued consent settings differ from trusted caller');
-        if (queued.kind !== 'journal' && queued.brainHome !== brainHome) throw new Error('queued consent settings differ from trusted caller');
-        binding = queued.kind === 'journal' ? data.binding : queued;
+        const data = { key: flagValue(queued.args, '--key'), value: flagValue(queued.args, '--value'), db: flagValue(queued.args, '--path') };
+        if (typeof data.key !== 'string' || typeof data.value !== 'string') throw new Error('invalid turn store step');
+        if (data.db !== db) throw new Error('foreign turn store rejected');
+        if (queued.brainHome !== brainHome) throw new Error('turn consent settings differ from trusted caller');
+        binding = queued;
         key = data.key; value = maskExcludedPaths(redactText(data.value), target.contentPathExcludes, target.capturePath);
-        if (value !== redactText(data.value)) throw new Error('content exclusions changed; immutable turn retained');
-        args = ['memory', 'store', '-k', key, '--value', value, '-n', TURN_NAMESPACE, '--path', db, '--no-upsert', '--require-native', '--append-only', '--provenance', 'agent_output'];
+        if (value !== redactText(data.value)) throw new Error('content exclusions changed; turn not written');
+        args = ['memory', 'store', '--key', key, '--value', value, '--namespace', TURN_NAMESPACE, '--path', db, '--no-upsert', '--require-native', '--append-only', '--provenance', 'agent_output'];
       } else if (kind === 'distill') {
         if (queued.brainHome !== brainHome) throw new Error('queued consent settings differ from trusted caller');
         const recipe = queued.args;
@@ -414,14 +427,14 @@ export function runSteps({ steps = [], receipts } = {}, { run: suppliedRun = spa
       const rootStat = fs.statSync(target.projectRoot);
       if (binding.rootIdentity && binding.rootIdentity !== `${rootStat.dev}:${rootStat.ino}`) throw new Error('queued canonical project identity changed');
       if (binding.projectRoot !== target.projectRoot) throw new Error('queued canonical project/store identity changed');
-      const origin = resolveTurnDb({ projectDir: binding.projectDir, brainHome, requestedStorePath: db, gitTimeoutMs: 1000 });
+      const origin = resolveTurnDb({ projectDir: binding.projectDir, brainHome, requestedStorePath: db, gitTimeoutMs: 1000, ...bound });
       if (origin.skipped) throw new Error(origin.skipped);
       if (origin.projectRoot !== target.projectRoot || origin.db !== db) throw new Error('queued canonical capture origin changed');
       const ruflo = resolveRuflo({ env, home });
-      if (!ruflo) throw new Error('ruflo not found for durable replay');
+      if (!ruflo) throw new Error('ruflo not found');
       const invocation = rufloInvocation(ruflo, args);
       const remaining = deadlineMs === undefined ? STEP_TIMEOUT_MS : deadlineMs - Date.now();
-      if (remaining <= 0) throw new Error('turn replay deadline exhausted');
+      if (remaining <= 0) throw new Error('turn write deadline exhausted');
       // Measured 2026-10-10 with global Ruflo 3.56.3: cwd=<project>/.swarm litters ruvector.db/.claude-flow there, and
       // CLAUDE_FLOW_MEMORY_PATH=<.swarm> makes Ruflo create a second agentdb-memory.db beside the canonical store.
       // The explicit --path already binds the store, so run from private scratch with neither.
@@ -429,10 +442,7 @@ export function runSteps({ steps = [], receipts } = {}, { run: suppliedRun = spa
         cwd: rufloCwdFor(db, { root: rufloScratchRoot({ ...env, RUVNET_BRAIN_HOME: brainHome }) }),
         maxBuffer: 1024 * 1024, env: { ...env, ...RUFLO_ENV } };
       delete options.env.CLAUDE_FLOW_MEMORY_PATH;
-      const existing = kind === 'store' && queued.journalFile ? read({ ruflo, db, key, run, options }) : null;
-      if (existing !== null && existing !== value) throw new Error('existing turn key content differs; no upsert permitted');
-      verified = kind === 'store' && existing === value;
-      const r = verified ? { status: 0 } : run(invocation.executable, invocation.args, options);
+      const r = run(invocation.executable, invocation.args, options);
       status = Number.isInteger(r.status) ? r.status : 1;
       if (kind === 'store' && !verified && status === 0) verified = read({ ruflo, db, key, run, options }) === value;
       if (verified) status = 0;
@@ -447,33 +457,14 @@ export function runSteps({ steps = [], receipts } = {}, { run: suppliedRun = spa
     const row = { at: new Date().toISOString(), kind, db: redactText(db), storeIdentity: digest(db), key, status, error,
       ...(kind === 'store' ? { verified } : {}), ...(skipped ? { skipped } : {}) };
     results.push(row);
-    if (receipts) {
-      try { appendReceipt(receipts, row); if (verified && queued.journalFile) acknowledgeJournal(queued.journalFile, db); }
-      catch { /* failed receipt persistence retains the journal for exact-key retry */ }
+    if (receipts) { try { appendReceipt(receipts, row); } catch { /* the ledger row below still reports a failure */ } }
+    if (error || (kind === 'store' && !verified)) {
+      recordHookFailure({ hook: kind === 'store' ? 'turn-capture' : 'turn-distill', event, error: String(error || 'exact turn key/content readback failed').slice(0, 160), ...(db ? { store: digest(db).slice(0, 16) } : {}) }, { brainHome });
     }
   }
   return results;
 }
 
-/** Replay only bounded canonical project entries; consent suspends rather than deletes them. */
-export function replayTurnQueue({ projectDir = process.cwd(), env = process.env, home = os.homedir(),
-  brainHome = env.RUVNET_BRAIN_HOME || path.join(home, '.cache', 'ruvnet-brain'), limit = 10,
-  launch = launchDetached, synchronous = false, runner, deadlineMs } = {}) {
-  if (String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() === 'off') return { queued: false, skipped: 'RUVNET_TURN_CAPTURE=off' };
-  try {
-    const target = resolveTurnDb({ projectDir, brainHome });
-    if (target.skipped) return { queued: false, skipped: target.skipped };
-    const steps = pendingTurnFiles(target.db, limit).map((journalFile) => ({ kind: 'journal', journalFile, db: target.db }));
-    if (!steps.length) return { queued: false, count: 0 };
-    if (synchronous) {
-      const results = runSteps({ steps, receipts: path.join(brainHome, 'turn-capture', 'receipts.jsonl') }, { env, home, projectDir, brainHome, ...(runner ? { run: runner } : {}), deadlineMs });
-      const pending = pendingTurnFiles(target.db, 25).length;
-      return { queued: false, count: steps.length, pending, failed: results.filter((row) => row.status !== 0).length, verified: results.filter((row) => row.verified === true).length, results };
-    }
-    return { queued: true, count: steps.length, pending: steps.length, launch: launch(steps, { receipts: path.join(brainHome, 'turn-capture', 'receipts.jsonl'), projectDir, brainHome, env }) };
-  } catch (error) { return { queued: false, skipped: redactText(error.message) }; }
-}
-
 /** Bounded recent evidence, isolated by canonical db. A continuity success cannot mask turn failures. */
 export function turnRecordingStatus({ projectDir = process.cwd(), env = process.env, home = os.homedir(), now = Date.now(), noticeOnFirstUse = false } = {}) {
   const brainHome = env.RUVNET_BRAIN_HOME || path.join(home, '.cache', 'ruvnet-brain');
@@ -489,13 +480,16 @@ export function turnRecordingStatus({ projectDir = process.cwd(), env = process.
     }).filter((r) => r.kind === 'store' && (r.storeIdentity === crypto.createHash('sha256').update(target.db).digest('hex') || r.db === target.db) && now - Date.parse(r.at) < 7 * 86_400_000).slice(-20);
   } catch { /* first run */ }
   rows = [...new Map(rows.map((row) => [row.key || row.at, row])).values()];
-  let pending = 0;
-  try { pending = pendingTurnFiles(target.db, 25).length; } catch { return status({ state: 'warn', line: 'turn recording durable queue unsafe or unreadable' }); }
   const historical = rows.filter((r) => r.status === 0 && r.verified === undefined);
   const failed = rows.filter((r) => r.status !== 0 || r.verified === false);
   if (failed.length) return status({ state: 'warn', line: `turn recording failing ${failed.length}/${rows.length} — ${redactText(failed.at(-1).error || 'write has no exact readback evidence').slice(0, 300)}` });
   if (historical.length) return status({ state: 'unknown', line: `turn recording unverified historical (${historical.length} receipts without exact readback evidence)` });
-  if (pending) return status({ state: 'unknown', line: `turn recording pending durable replay (${pending} entries); not yet proven` });
+  // Review M1: ✓ needs the NEWEST receipt verified, < TURN_STATUS_FRESH_MS old, and no later turn-capture ledger row.
+  const newest = rows.at(-1); const id = digest(target.db).slice(0, 16); let laterFailure = null;
+  try { laterFailure = readTail(path.join(brainHome, 'hook-failures.jsonl'), 64 * 1024).flatMap((l) => { try { return [JSON.parse(l)]; } catch { return []; } })
+    .findLast((r) => r.hook === 'turn-capture' && (!r.store || r.store === id) && (!newest || Date.parse(r.at) > Date.parse(newest.at))); } catch { /* no ledger */ }
+  if (laterFailure) return status({ state: 'warn', line: `turn recording failing — ${redactText(String(laterFailure.error || 'capture skipped')).slice(0, 200)} (since ${laterFailure.at})` });
+  if (newest && now - Date.parse(newest.at) >= TURN_STATUS_FRESH_MS) return status({ state: 'unknown', line: `turn recording not proven recently — newest exact readback ${newest.at}` });
   return status(rows.length ? { state: 'ok', line: `turn recording ✓ (${rows.length}/${rows.length} exact readbacks)` }
     : { state: 'unknown', line: 'turn recording not yet proven — no exact readback receipt' });
 }

package/scripts/codex-host-execution-proof.mjs

@@ -25,7 +25,7 @@ export function startupDeclaration(listed, cwd) {
   const triggered = new Set(['sessionStart', 'userPromptSubmit', 'stop', 'sessionEnd']);
   if (groups[0].hooks.some((row) => triggered.has(row.eventName) && row.enabled !== false
     && (row.pluginId !== OWNER || row.handlerType !== 'command' || !['trusted', 'managed'].includes(row.trustStatus)))) throw new Error('Foreign or non-command enabled turn/startup handler prevents owned execution');
-  // Independently bound published siblings (e.g. learn-flush) may share this event/source file.
+  // Independently bound published siblings (e.g. a learning hook) may share this event/source file.
   const bodies = starts.filter((row) => /\s(?:\d+\s+)?session-start\s*$/.test(row.command || ''));
   if (bodies.length !== 1 || !Number.isSafeInteger(bodies[0].displayOrder) || bodies[0].displayOrder < 0) throw new Error('Exact published SessionStart body identity is unavailable');
   return bodies[0];

package/scripts/console-engine.mjs

@@ -99,38 +99,6 @@ export function buildHealthRecommendations({ memory = null, learning = null } =
     }));
   }
 
-  // 2. A capture queue that fills but does not drain. The depth IS the evidence.
-  const depth = learning?.enabled === false || learning?.queueKnown === false ? 0 : Number(learning?.queueDepth);
-  if (Number.isFinite(depth) && (depth > 50 || depth > 0 && learning.capturePendingFailure || learning.workerRetirementUnconfirmed)) {
-    recs.push(makeRecommendation({
-      id: 'learning:flush',
-      scope: learning?.scope === 'project' ? 'project' : 'user',
-      title: learning.workerRetirementUnconfirmed ? 'Learning recovery is paused' : 'Feed your captured work into the learner',
-      rationale: learning.workerRetirementUnconfirmed ? 'A previous learning worker could not be confirmed stopped. Its queue remains fenced and original observations are retained.' : 'Captured workflow observations remain pending until their canonical AgentDB rows are verified.',
-      severity: 'IMPORTANT',
-      touchesMachine: true,
-      plainImpact:
-        'Stores already captured workflow observations in local project memory. '
-        + 'Canonical AgentDB readback verifies each observation; original queue bytes stay retained.',
-      evidence: [{ observed: `${depth} captured events waiting, undelivered${learning?.queueDir ? ` in ${learning.queueDir}` : ''}` }],
-      cost: { time: 'under a minute', risk: 'low — local only; queue preserved on failure' },
-      change: { human: 'drain the capture queue into the learner' },
-      undo: { human: 'nothing to reverse — this only adds observations; learned state can be cleared separately' },
-    }));
-  }
-
-  if (learning?.enabled && learning.scope === 'project' && learning.legacyUserKnown && learning.legacyUserDepth > 0) {
-    recs.push(makeRecommendation({
-      id: 'learning:flush-legacy-user', scope: 'user', title: 'Process retained legacy user history',
-      rationale: 'Older captures belong to the home learner and are isolated from this project.',
-      severity: 'IMPORTANT', touchesMachine: true,
-      plainImpact: 'Minimizes old actions again and feeds only the original local home learner. Original queue bytes remain retained. Project learning is separate.',
-      evidence: [{ observed: `${learning.legacyUserDepth} legacy user events pending` }],
-      cost: { time: 'bounded rounds', risk: 'local observations; originals retained' },
-      change: { human: 'explicitly drain legacy user queue into home learner' },
-      undo: { human: 'original history retained; learned observations can be reset separately' },
-    }));
-  }
 
   // 3. A learner that has not trained in days. Installed-but-dormant is a DEFECT, not a neutral
   //    state — the entire point of shipping a learning system is that it runs.