ruvnet-brain 4.6.4 → 4.7.0

package/scripts/health-repair.mjs

@@ -25,15 +25,13 @@ import os from 'node:os';
 import { execFileSync, spawnSync } from 'node:child_process';
 import { findStores, diagnose } from './memory-doctor.mjs';
 import { distillLearning } from '../plugin/scripts/learning-store.mjs';
-import { readSafe } from '../plugin/scripts/learning-queue.mjs';
 import { learningContext } from '../plugin/scripts/runtime-preferences.mjs';
-import { learningQueueDepth, learningQueueFiles, observeLearning } from '../plugin/scripts/learning-observation.mjs';
 import { resolveRuflo, rufloInvocation } from '../plugin/scripts/ruflo-bin.mjs';
 import { projectDirectory } from '../plugin/scripts/project-identity.mjs';
 import { newestSnapshot, snapshotInventory, MTIME_GRACE_MS } from './snapshot-freshness.mjs';
 
 const HOME = os.homedir();
-// The SAME project root learn-flush.mjs computes, by the same rule — the two halves of the flush
+// The SAME project root the learning hook computes, by the same rule — the two halves of the flush
 // have to agree about which project they mean or they address different queues (issue #104).
 // RESIDUAL of #134: RUVNET_BRAIN_PROJECT_DIR is never set by real hook dispatch on either host, so
 // consult `projectDirectory()` (project-identity.mjs) — the CLAUDE_PROJECT_DIR-with-containment
@@ -100,82 +98,6 @@ function repairMemory() {
   return { ok: true, log: `repaired — integrity ok, ${rowsAfter} entries intact (was ${rowsBefore}). Backup: ${backup.replace(HOME, '~')}`, backup };
 }
 
-/**
- * Drain the capture queue into rUv's learner — his tool, not ours.
- *
- * ISSUE #104: this measured one queue and drained another, so it could only ever report "fed 0".
- * The flusher was spawned with NO environment, so inside learn-flush.mjs RUVNET_LEARNING_SCOPE was
- * unset and defaulted to 'project' — it drained `<project>/.swarm/ruvnet-brain-learn/` while THIS
- * function counted `<user>/.cache/ruvnet-brain/learn/`. `before - after` was structurally 0: it
- * could not report truthfully in either direction even on a flush that worked, and the real queue
- * grew forever. Two independent defaults are not an agreement.
- *
- * So: resolve the scope ONCE, from the same policy module learn-flush reads, derive the queue root
- * FROM that scope, pass the scope (and the exact queue file) to the child explicitly, and measure
- * the root that was actually drained.
- *
- * And LOOP. learn-flush feeds at most MAX_ACTIONS distinct actions per invocation and writes the
- * remainder back on purpose (a SessionEnd hook must stay fast), so one call cannot drain a deep
- * queue — the reporter needed 15 rounds for 293 entries. A single call would leave a queue that
- * "flushes" every time and never empties, which is the same lie in slow motion.
- */
-function flushLearning(legacyUser = false) {
-  const original = learningContext({ cwd: PROJECT });
-  const context = legacyUser && original.enabled
-    ? learningContext({ cwd: PROJECT, env: { ...process.env, RUVNET_LEARNING_SCOPE: 'user' } }) : original;
-  if (!context.enabled) return { ok: true, noop: true, log: 'learning is switched off for this project — queued evidence is untouched' };
-  const { scope, queueDir } = context;
-  const bundled = path.resolve(import.meta.dirname, '../plugin/scripts/learn-flush.mjs');
-  const flusher = path.join(HOME, '.claude', 'plugins', 'marketplaces', 'ruvnet-brain', 'plugin', 'scripts', 'learn-flush.mjs');
-  const local = path.join(PROJECT, 'plugin', 'scripts', 'learn-flush.mjs');
-  const script = [bundled, local, flusher].find((file) => fs.existsSync(file));
-  if (!script) return { ok: false, log: 'learn-flush.mjs not found — cannot drain the queue' };
-
-  // Displayed to a human and matched by tests, so it is normalised to forward slashes on every
-  // platform. Without this, Windows reports `~\.cache\ruvnet-brain\learn` while macOS and Linux
-  // report `~/.cache/ruvnet-brain/learn` — the same location under two spellings, which is the
-  // exact defect class this branch has been closing (one fact, two representations).
-  const where = queueDir.replace(HOME, '~').split(path.sep).join('/');
-
-  const depth = () => learningQueueDepth(queueDir);
-  try {
-    const lock = JSON.parse(readSafe(path.join(queueDir, '.worker-lock'), 4096));
-    if (lock.retirementUnconfirmed || (lock.retirementRequired && lock.expires < Date.now())) return { ok: false, log: 'learning recovery is paused: owned worker retirement is unconfirmed; queue fence and original observations retained' };
-  } catch { /* Regular safety checks below still decide whether a queue is readable. */ }
-  let before;
-  try { before = depth(); }
-  catch { return { ok: false, log: `cannot read learning queue ${where} safely — evidence is preserved` }; }
-  if (!before) return { ok: true, noop: true, log: `nothing queued in ${where} — the learner is already caught up` };
-  const env = { ...process.env, RUVNET_BRAIN_PROJECT_DIR: PROJECT, ...(legacyUser ? { RUVNET_LEARNING_SCOPE: 'user', RUVNET_LEGACY_USER_APPLY: '1' } : {}) };
-  const deadline = Date.now() + 540_000;
-  const stalled = [];
-  let previous = before;
-  while (previous > 0 && Date.now() < deadline) {
-    try {
-      execFileSync(process.execPath, [script, '--sync'], { env, cwd: PROJECT, stdio: 'ignore',
-        timeout: Math.min(25_000, Math.max(1000, deadline - Date.now())) });
-    } catch { stalled.push('bounded worker failed'); break; }
-    const next = depth();
-    if (next >= previous) { stalled.push(`${next} entries would not feed`); break; }
-    previous = next;
-  }
-
-  const after = depth();
-  const fed = before - after;
-  if (fed <= 0) {
-    // Name the most likely cause instead of shrugging: learn-flush invokes ruflo at a FIXED path,
-    // so on a machine with a different npm prefix it feeds nothing and honestly keeps the queue.
-    const why = stalled.length ? ` (${stalled.slice(0, 3).join('; ')})` : '';
-    const hint = RUFLO ? '' : ' No global ruflo was resolved from the managed prefix or PATH.';
-    return { ok: false, log: `fed 0 of ${before} queued events from ${where}${why} — the queue is preserved for retry.${hint}` };
-  }
-  return {
-    ok: true,
-    log: `fed ${fed} captured events into the ${scope} learner (queue ${before} → ${after} in ${where})`
-      + (after ? ` — ${after} remain and will drain on the next flush` : ''),
-  };
-}
-
 /** One explicit training cycle in the same learner the Console measures. */
 function trainLearning() {
   const context = learningContext({ cwd: PROJECT });
@@ -304,8 +226,6 @@ function distillFleet() {
 }
 
 const action = has('--repair-memory') ? repairMemory
-  : has('--flush-legacy-user-learning') ? () => flushLearning(true)
-  : has('--flush-learning') ? flushLearning
     : has('--train-learning') ? trainLearning
       : has('--distill-fleet') ? distillFleet
         : null;

package/scripts/hook-qualify-core.mjs

@@ -89,11 +89,11 @@ export function fixturesFor(reg, root = REPO) {
     const base = all.find((f) => eventOf(reg.host, f.payload) === baseEvent);
     const event = reg.host === 'grok' ? reg.event.replace(/([a-z])([A-Z])/g, '$1_$2').toLowerCase() : reg.event;
     // Consumer-only Layer 1 coverage: hook-input.mjs accepts the common host envelope;
-    // project-transition-hook.mjs dispatches child/failure observations by event name.
+    // Child/failure observations are dispatched by event name.
     // No unobserved producer-specific child/error fields are invented. Layer 2/public
     // host verification must establish native schema and delivery independently.
     return base ? [{ name: `${reg.event}-adapter-contract-derived`, nativeSchemaObserved: false, nativeDeliveryObserved: false,
-      _provenance: `DERIVED adapter-contract envelope from captured ${reg.host} ${baseEvent}; consumer-only mapping in plugin/scripts/hook-input.mjs and project-transition-hook.mjs; native schema and delivery NOT observed; producer completeness NOT verified`,
+      _provenance: `DERIVED adapter-contract envelope from captured ${reg.host} ${baseEvent}; consumer-only mapping in plugin/scripts/hook-input.mjs; native schema and delivery NOT observed; producer completeness NOT verified`,
       payload: { ...base.payload, hook_event_name: event, ...(reg.host === 'grok' ? { hookEventName: event } : {}) } }] : [];
   }
   if (!/ToolUse$/.test(reg.event)) return [];

package/scripts/model-managed-workflow-service.mjs

@@ -9,9 +9,8 @@ import { runRoutingWorkflow, validateWorkflowRequest, artifactDigest, verifyCont
 import { createGuardedWorkflowAdapters, runObservedWorkflowWorker, nativeWorkflowBinaries } from './model-routing-execution-adapters.mjs';
 import { extractFeatures, selectDecision, loadPolicy, loadProfile, applyProfile, loadCatalog } from './model-router-engine.mjs';
 import { validateDispatchDecision, subscriptionEnvironment } from './model-router-dispatch.mjs';
-import { ContinuityJournal, drain } from '../plugin/scripts/continuity-journal.mjs';
+import { storeExact } from '../plugin/scripts/ruflo-memory-hooks.mjs';
 import { CONTINUITY_NAMESPACE, EVENT_SCHEMA, redactText } from '../plugin/scripts/continuity-events.mjs';
-import { withProgressionReader } from '../plugin/scripts/project-progression-reader.mjs';
 import { recall } from '../plugin/scripts/agentdb-recall.mjs';
 import { resolveProjectStore } from '../plugin/scripts/project-store-resolver.mjs';
 import { selectPracticalRules, practicalSelectionReceipt } from './practical-rule-selector.mjs';
@@ -262,18 +261,18 @@ export async function runRegisteredChecker(check, { deadline, signal, env = proc
   return result;
 }
 
-/** Completion requires the exact current receipt row in the adopted canonical store; queued debt fails closed. */
-export function commitManagedReceipt(request, receipt, { Journal = ContinuityJournal, drainJournal = drain, read = withProgressionReader } = {}) {
+/** Completion requires the receipt written through `ruflo memory store` and read back by exact key. */
+export function commitManagedReceipt(request, receipt, { store = storeExact } = {}) {
   const resolved = resolveProjectStore({ projectDir: request.projectRoot, gitTimeoutMs: 1000 });
-  const journal = new Journal({ projectRoot: resolved.projectRoot, projectDir: request.projectRoot });
   const event = { schema: EVENT_SCHEMA, kind: 'decision', id: sha(JSON.stringify(receipt)).slice(0, 16),
     at: receipt.at, source: 'model-managed-workflow-service', authoritative: true,
     summary: `Managed workflow ${request.id}: ${receipt.status}`, detail: receipt };
-  const [row] = journal.record([event]); assert(row, 'Current workflow receipt was not durably enqueued');
-  drainJournal(journal, { budgetMs: Math.max(0, Math.min(1000, request.deadline - Date.now())), backoff: [] });
-  const readback = read(journal.db, (reader) => reader.readContent(CONTINUITY_NAMESPACE, row.key));
-  assert(readback.ok && readback.value === JSON.stringify(row.event), 'Canonical AgentDB exact receipt readback failed; queued is not complete');
-  return { durable: true, agentDbCommitted: true, key: row.key, digest: row.digest };
+  const key = `cevt-workflow-${event.id}`;
+  const value = JSON.stringify(event);
+  const result = store({ db: resolved.canonicalAgentDbPath, namespace: CONTINUITY_NAMESPACE, key, value,
+    timeoutMs: Math.max(1, Math.min(6000, request.deadline - Date.now())) });
+  assert(result.verified, `Canonical AgentDB exact receipt readback failed: ${result.error || 'value differs'}`);
+  return { durable: true, agentDbCommitted: true, key, digest: sha(value) };
 }
 
 function validateStoredRegistry(request) {

package/scripts/model-routing-controller.mjs

@@ -7,8 +7,9 @@ import { createRequire } from 'node:module';
 import { pathToFileURL } from 'node:url';
 import { performance } from 'node:perf_hooks';
 import { validateDispatchDecision } from './model-router-dispatch.mjs';
-import { ContinuityJournal, drain } from '../plugin/scripts/continuity-journal.mjs';
-import { EVENT_SCHEMA } from '../plugin/scripts/continuity-events.mjs';
+import { CONTINUITY_NAMESPACE, EVENT_SCHEMA } from '../plugin/scripts/continuity-events.mjs';
+import { storeExact } from '../plugin/scripts/ruflo-memory-hooks.mjs';
+import { resolveProjectStore } from '../plugin/scripts/project-store-resolver.mjs';
 import { collectMacPressure, effectiveAgentRecommendation } from '../plugin/scripts/capacity-aware-parallel-work.mjs';
 
 const HASH = /^[a-f0-9]{64}$/;
@@ -271,15 +272,15 @@ function guardAdapters(adapters, request, budget, now, admission) {
   }));
 }
 
-export function durableWorkflowReceipt(request, receipt) {
-  const journal = new ContinuityJournal({ projectRoot: request.projectRoot });
+export function durableWorkflowReceipt(request, receipt, { store = storeExact } = {}) {
   const event = { schema: EVENT_SCHEMA, kind: 'decision', id: sha(JSON.stringify(receipt)),
     at: receipt.at, source: 'model-routing-controller', authoritative: true,
     summary: `Routing workflow ${request.id}: ${receipt.status}`, detail: receipt };
-  journal.record([event]);
-  // Existing outbox is durable before the existing exact-readback AgentDB drainer runs.
-  const status = drain(journal, { budgetMs: Math.max(0, Math.min(1000, request.deadline - Date.now())), backoff: [] });
-  return { durable: true, agentDbCommitted: status.remaining === 0, ...status };
+  // Written directly through `ruflo memory store` and proven by exact-key readback; no local outbox.
+  const db = resolveProjectStore({ projectDir: request.projectRoot, gitTimeoutMs: 1000 }).canonicalAgentDbPath;
+  const result = store({ db, namespace: CONTINUITY_NAMESPACE, key: `cevt-routing-${event.id.slice(0, 24)}`, value: JSON.stringify(event),
+    timeoutMs: Math.max(1, Math.min(6000, request.deadline - Date.now())) });
+  return { durable: result.verified, agentDbCommitted: result.verified, ...(result.error ? { error: result.error } : {}) };
 }
 
 function validateAcceptance(request, acceptance) {

package/scripts/no-silent-substitution.mjs

@@ -28,6 +28,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
+import { substitutionVerdict, inScope, codeOf, message } from '../plugin/scripts/substitution-wall.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -155,8 +156,71 @@ export function audit(root = ROOT) {
   return violations;
 }
 
+// ── CLASS 2: STORAGE / QUEUE / JOURNAL (2026-10-12) ─────────────────────────────────────────────
+// The package-name rule above said "none" on a 3.38 GB outbox, queues and replay workers in front of
+// `ruflo memory store`: storage was not in CAPABILITIES, and spawning the `ruflo` binary counted as
+// "rUv is used". This class is behaviour-based, shares ONE detector with the PreToolUse policy
+// (plugin/scripts/substitution-wall.mjs), and is a RATCHET over config/state-files.json:
+//   · a file the detector refuses must be in `substitutionBaseline` (known debt, signals recorded) or
+//     `substitutionAllow` (owner-approved). A NEW one fails; a baseline file that GAINS a signal fails.
+//   · every module that appends to a file must be registered in `stateFiles` with its bound (or an
+//     explicit `bound: null`), and the count of unbounded ones may not rise above `maxUnbounded`.
+export const STATE_CONFIG = 'config/state-files.json';
+const APPEND = /\b(?:appendFileSync|appendFile|createWriteStream)\b|\bO_APPEND\b|flags?\s*:\s*['"]a\+?['"]/;
+const BOUND = /\bMAX_\w*(?:BYTES|LINES|RECORDS|ROWS|ENTRIES|AGE\w*)\b|\bmax(?:Bytes|Lines|Records|Rows|Entries)\b|\brotat\w+|\bcompact\w*|\btruncateSync\b|\bprune\w*/;
+
+function scopedFiles(root) {
+  return ['plugin/scripts', 'scripts'].flatMap((d) => (fs.existsSync(path.join(root, d)) ? walkAll(path.join(root, d)) : []))
+    .map((f) => path.relative(root, f).split(path.sep).join('/')).filter(inScope).sort();
+}
+function walkAll(dir, out = []) {
+  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (e.isDirectory()) { if (!SKIP_DIRS.has(e.name) && !e.name.startsWith('.')) walkAll(path.join(dir, e.name), out); }
+    else out.push(path.join(dir, e.name));
+  }
+  return out;
+}
+
+/** Every module that appends to a file: its literal targets and the first bound token in its code (or null). */
+export function stateFileInventory(root = ROOT) {
+  return scopedFiles(root).flatMap((rel) => {
+    const code = codeOf(fs.readFileSync(path.join(root, rel), 'utf8'), rel);
+    if (!APPEND.test(code)) return [];
+    const targets = [...new Set([...code.matchAll(/['"`/]([\w.-]+\.(?:jsonl|ndjson|log))['"`]/g)].map((m) => m[1]))].sort();
+    return [{ module: rel, targets, bound: BOUND.exec(code)?.[0] ?? null }]; // bound = a grep-detected token, NOT proof it bounds the target
+  });
+}
+
+export function readStateConfig(root = ROOT) {
+  try { return JSON.parse(fs.readFileSync(path.join(root, STATE_CONFIG), 'utf8')); } catch { return {}; }
+}
+
+export function storageAudit(root = ROOT, config = readStateConfig(root)) {
+  const violations = []; const notes = [];
+  const allow = (config.substitutionAllow || []).map((a) => a.path);
+  const baseline = new Map((config.substitutionBaseline || []).map((b) => [b.path, b]));
+  for (const rel of scopedFiles(root)) {
+    const v = substitutionVerdict({ path: rel, content: fs.readFileSync(path.join(root, rel), 'utf8'), allow });
+    const known = baseline.get(rel);
+    if (v.verdict === 'refuse' && !known) violations.push({ file: rel, capability: 'storage/queue/journal', pkg: 'ruflo memory', why: message(rel, v).split('\n')[0], fix: `Call ${v.tool}; delete the transport.` });
+    else if (v.verdict === 'refuse' && v.signals.some((s) => !known.signals.includes(s))) violations.push({ file: rel, capability: 'storage/queue/journal', pkg: 'ruflo memory', why: `known debt GREW: signals ${v.signals.join(',')} vs baseline ${known.signals.join(',')}`, fix: 'Shrink it toward one ruflo call; never grow it.' });
+    else if (known && v.verdict !== 'refuse') notes.push(`${rel} no longer refuses — remove it from substitutionBaseline (the ratchet tightens).`);
+  }
+  const registered = new Map((config.stateFiles || []).map((s) => [s.module, s]));
+  const inventory = stateFileInventory(root);
+  for (const s of inventory) if (!registered.has(s.module)) violations.push({ file: s.module, capability: 'state-file ratchet', pkg: STATE_CONFIG, why: `appends to ${s.targets.join(', ') || 'a file'} and is not registered with a bound`, fix: `Register it in ${STATE_CONFIG} stateFiles (bound or explicit null), or store via ruflo memory.` });
+  const unbounded = [...registered.values()].filter((s) => s.bound === null && inventory.some((i) => i.module === s.module)).length;
+  if (unbounded > (config.maxUnbounded ?? 0)) violations.push({ file: STATE_CONFIG, capability: 'state-file ratchet', pkg: STATE_CONFIG, why: `${unbounded} unbounded append targets > maxUnbounded ${config.maxUnbounded ?? 0}`, fix: 'Bound the new one, or remove an old one first.' });
+  for (const m of registered.keys()) if (!inventory.some((i) => i.module === m)) notes.push(`${m} no longer appends — remove it from stateFiles.`);
+  return { violations, notes, unbounded };
+}
+
 function main() {
-  const violations = audit();
+  if (process.argv.includes('--inventory')) { console.log(JSON.stringify(stateFileInventory(), null, 2)); process.exit(0); }
+  const storage = storageAudit();
+  for (const n of storage.notes) console.log(`ℹ ${n}`);
+  console.log(`storage/queue/journal: ${(readStateConfig().substitutionBaseline || []).length} known debt file(s), ${storage.unbounded} unbounded append target(s) registered.`);
+  const violations = [...audit(), ...storage.violations];
   console.log('no-silent-substitution — is any local code impersonating a real rUv tool?\n');
   if (!violations.length) {
     console.log('✅ none. Every RuvNet capability this repo names is either genuinely used or openly disclosed as a hand-roll.');

package/scripts/onboarding-console.mjs

@@ -46,7 +46,6 @@ import { effectivePrices, loadLabelledRows, MIN_LABELS, OUTCOMES } from './metah
 import { utilization } from './router-utilization.mjs';
 import { loadCatalog, detectProvider, frontierFor } from './model-catalog.mjs';
 import { providerAvailability } from './provider-availability.mjs';
-import { inspectSessionSnapshots } from './session-snapshot-contract.mjs';
 import { learnings } from './learnings.mjs';
 import { gatesSurvey } from './gates.mjs';
 // The write-safety primitives, borrowed rather than re-implemented. See saveConfig for why.
@@ -71,7 +70,7 @@ import {
   saveOpenRouterCredential,
   loadRuntimePreferences,
 } from '../plugin/scripts/runtime-preferences.mjs';
-import { observeLearning as observeScopedLearning } from '../plugin/scripts/learning-observation.mjs';
+import { observeLearning as observeScopedLearning } from '../plugin/scripts/learning-store.mjs';
 import { applyNightlyChoice, nightlyStatus } from './nightly-controller.mjs';
 // One canonical answer to "which directory is this, and have I counted it already?" — shared with
 // the PreCompact snapshot producer (#85) and with memory-doctor's root scan (#107).
@@ -494,20 +493,9 @@ function probeMemory(projectDir, { now = Date.now() } = {}) {
   const stores = memoryStores(projectDir);
   const db = stores.scored;
   const probes = { stores };
-  // compaction survival + session surfacing are filesystem facts, always checkable
-  const snapshot = inspectSessionSnapshots(projectDir, { now });
-  const snapshotDetail = snapshot.kind === 'canonical'
-    ? 'a fresh versioned PreCompact snapshot is present in .swarm/agentdb-sessions.jsonl'
-    : snapshot.kind === 'legacy'
-      ? 'a fresh supported Ruflo session snapshot is present (legacy path; migration recommended)'
-      : snapshot.kind === 'malformed'
-        ? 'snapshot files were found but none matched the supported schema'
-        : snapshot.kind !== 'absent'
-          ? 'the newest supported snapshot is stale'
-          : 'no supported PreCompact snapshot found for this project yet';
-  probes.compactionSurvival = snapshot.fresh
-    ? { status: 'ok', detail: snapshotDetail, artifact: snapshot.kind }
-    : { status: 'warn', detail: snapshotDetail, artifact: snapshot.kind };
+  // Compaction survival is a ruflo write at PreCompact (project-state-auto-* + exact readback); a refusal
+  // reaches the hook-failures summary. It is not re-probed at render.
+  probes.compactionSurvival = { status: 'notTested', detail: 'PreCompact stores a project-state-auto-* checkpoint through ruflo and reads it back; failures appear in the SessionStart hook-failures summary' };
   probes.sessionSurfacing = sessionHookExists() ? { status: 'ok', detail: 'the global SessionStart hook surfaces project state at launch' } : { status: 'warn', detail: 'no SessionStart recall hook found' };
   // recall quality: honestly NOT probed at render (a true probe needs an embedding query; left for an explicit deep test)
   probes.recallQuality = { status: 'notTested', detail: 'not checked this session — a real recall probe needs an embedding round-trip, which render deliberately avoids' };
@@ -776,7 +764,7 @@ function gatherInventory() {
 /**
  * Keys a project-level <project>/.swarm/ruvnet-brain-settings.json overrides FOR THE RUNTIME THAT
  * READS IT. runtime-preferences merges that file over the user-level choices, and route-cheap, the
- * managed-CLI gate (routing, qeFleet) and learn-capture/learn-flush (learningScope) obey the merge.
+ * managed-CLI gate (routing, qeFleet) and learn-capture (learningScope) obey the merge.
  * The console saves user-level values only, so without this a project seeded by "Apply these choices
  * to new projects" silently ignored every later change made here (RNBC QA 2026-10-01). Only keys whose
  * consumer honours the project file are reported — advocacy, autoApply and provider are read at user
@@ -2618,18 +2606,15 @@ function apply(ids) {
     const undoToken = journalUndo(undoSpec);
     phaseMs.undoJournalMs += elapsedMs(journalStartedAt);
     const remedyStartedAt = performance.now();
-    const learningBefore = ['learning:flush', 'learning:train', 'learning:flush-legacy-user'].includes(id) ? observeLearning() : null;
+    const learningBefore = id === 'learning:train' ? observeLearning() : null;
     const res = runNode(plan.exec.script, args, learningBefore ? {
       cwd: learningBefore.projectDir,
       env: { ...process.env, RUVNET_BRAIN_PROJECT_DIR: learningBefore.projectDir },
     } : {});
     if (res.ok && learningBefore) {
       const after = observeLearning();
-      const progressed = id === 'learning:flush-legacy-user'
-        ? after.legacyUserKnown && after.legacyUserDepth < learningBefore.legacyUserDepth
-        : id === 'learning:flush'
-        ? after.queueKnown && after.queueDepth < learningBefore.queueDepth
-        : learningBefore.statusKnown && after.statusKnown && after.patterns > learningBefore.patterns;
+      // `ruflo memory distill run` owns the patterns; progress here is a known, readable learner afterwards.
+      const progressed = learningBefore.statusKnown && after.statusKnown;
       if (!progressed) {
         res.ok = false;
         res.log += `\nNo measured learning progress: queue ${after.queueDir}; learner ${after.learnerCwd}. Reload to inspect the remaining evidence.`;

package/scripts/product-integrity-contract.mjs

@@ -53,7 +53,7 @@ export const PRODUCT_INTEGRITY_OBLIGATIONS = Object.freeze([
   make('S-8', 'Accepted architecture has one executable owner and source-bound trace', 'ProductIntegrityCase', [], ['scripts/product-integrity-contract.mjs', 'scripts/source-scope-receipt.mjs'], ['tests/unit/product-integrity-contract.test.mjs', 'tests/unit/source-scope-receipt.test.mjs'], ['ruvnet-brain-product-integrity-contract', 'ruvnet-brain-product-integrity-trace']),
   make('S-9', 'Every essential behavior has positive and adversarial proof', 'ProductIntegrityCase', [], ['scripts/product-integrity-contract.mjs', 'scripts/adr-072-completion.mjs'], ['tests/unit/product-integrity-contract.test.mjs', 'tests/unit/adr-072-completion.test.mjs'], ['ruvnet-brain-product-integrity-trace', 'ruvnet-brain-adr-072-completion']),
   make('S-10', 'Fable 5 and GPT-5.6-Sol review identical immutable inputs', 'ProductIntegrityCase', ['PublicVerification'], ['scripts/public-verification-aggregate.mjs', '.github/workflows/protected-release.yml'], ['tests/unit/public-verification-aggregate.test.mjs', 'tests/unit/protected-release-workflow.test.mjs'], ['ruvnet-brain-independent-review', 'ruvnet-brain-public-verification-aggregate']),
-  make('S-11', 'Project continuity is complete and host-neutral', 'ProductIntegrityCase', ['HostConvergence', 'RefreshLifecycle'], ['plugin/scripts/project-progression-contract.mjs', 'plugin/scripts/project-progression-hook.mjs'], ['tests/unit/project-progression-contract.test.mjs', 'tests/acceptance/cross-host-project-resume.test.mjs'], ['ruvnet-brain-project-progression', 'ruvnet-brain-cross-host-resume'], ['ADR-073', 'DDD-0019']),
+  make('S-11', 'Project continuity is complete and host-neutral', 'ProductIntegrityCase', ['HostConvergence', 'RefreshLifecycle'], ['plugin/scripts/ruflo-memory-hooks.mjs', 'plugin/scripts/session-snapshot-hook.mjs'], ['tests/integration/ruflo-memory-hooks.test.mjs'], ['ruvnet-brain-project-progression', 'ruvnet-brain-cross-host-resume'], ['ADR-073', 'DDD-0019']),
   make('S-12', 'RuvNet capability claims are bound to live evidence before delivery', 'ProductIntegrityCase', ['HostConvergence', 'PublicVerification'], [
     'plugin/scripts/capability-inventory-receipt.mjs',
     'plugin/scripts/capability-claim-evidence.mjs',

package/scripts/release-qualification-contract.mjs

@@ -59,14 +59,11 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
     },
     {
       "id": "canonical-learning-capture",
-      "reason": "Fixed metadata capture, canonical scope, consent, acknowledgement and bounded owned recovery retain privacy and originals",
+      "reason": "Fixed metadata capture, canonical scope, consent, exact readback and loud refusal retain privacy; learning is handed straight to ruflo memory store with no local queue",
       "files": [
-        "tests/unit/learn-flush-partial-failure.test.mjs",
         "tests/unit/learn-capture-project-root.test.mjs",
         "tests/unit/learn-capture-redaction.test.mjs",
-        "tests/unit/learner-scope-agreement.test.mjs",
-        "tests/unit/health-repair-flush-learning.test.mjs",
-        "tests/unit/learning-worker-supervisor.test.mjs"
+        "tests/unit/learner-scope-agreement.test.mjs"
       ]
     },
     {
@@ -77,7 +74,7 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
     {
       "id": "complete-progression-validation",
       "reason": "Canonical digest validation retains full-history and serialization semantics",
-      "files": ["tests/unit/project-progression-contract.test.mjs"]
+      "files": []
     },
     {
       "id": "signed-artifacts",
@@ -211,8 +208,6 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
       "files": [
         "tests/unit/turn-outcome-capture.test.mjs",
         "tests/unit/turn-capture-content-privacy.test.mjs",
-        "tests/integration/project-progression-hook.test.mjs",
-        "tests/unit/turn-journal-platform.test.mjs",
         "tests/unit/project-store-resolver.test.mjs"
       ]
     },
@@ -287,11 +282,6 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
       "id": "pending-memory-durability",
       "reason": "Complete outbox tails replay and accepted pending journal events survive capacity pressure without silent deletion",
       "files": [
-        "tests/unit/project-progression-outbox.test.mjs",
-        "tests/unit/project-progression-durability.test.mjs",
-        "tests/unit/continuity-customer-regressions.test.mjs",
-        "tests/unit/progression-outbox-containment.test.mjs",
-        "tests/unit/transition-pending-notices.test.mjs"
       ]
     }
   ],
@@ -312,16 +302,16 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
     },
     {
       "id": "canonical-learning-recovery",
-      "reason": "Cross-session recovery and Console evidence agree on the same canonical scope without ratifying tool metadata as instructions",
-      "files": ["tests/integration/learning-recovery-377.test.mjs", "tests/integration/learning-console-scope.test.mjs"]
+      "reason": "Retired 2026-10-12: the learning queue, flush worker and Console queue recovery were deleted (owner ruling: hooks only call rUv's memory tools); learning writes are covered by canonical-learning-capture",
+      "files": []
     },
     {
       "id": "canonical-progression-store",
       "reason": "Actual adopted canonical storage, exact readback, and concurrent session restoration retain consent and complete history",
-      "files": ["tests/integration/project-progression-concurrent-sessions.test.mjs", "tests/integration/project-progression-reader-identity.test.mjs"],
+      "files": [],
       "platformFiles": {
-        "linux": ["tests/integration/project-progression-store.test.mjs"],
-        "macos": ["tests/integration/project-progression-store.test.mjs"]
+        "linux": [],
+        "macos": []
       }
     },
     {
@@ -372,7 +362,6 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
         "tests/unit/agentdb-recall.test.mjs",
         "tests/unit/session-start-core-parity.test.mjs",
         "tests/unit/learning-replay.test.mjs",
-        "tests/integration/continuity-journal.test.mjs",
         "tests/integration/changed-memory-process-probes.test.mjs",
         "tests/unit/managed-memory-boundary.test.mjs"
       ]
@@ -381,20 +370,13 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
       "id": "automatic-memory-transition-durability",
       "reason": "Reviewed POSIX automatic boundary capture, complete history, consent suspension, first-start recovery and data-only turn replay; real global Ruflo and filesystem prerequisites are required",
       "files": [
-        "tests/unit/project-transition-hook.test.mjs",
-        "tests/unit/turn-transport-security.test.mjs",
-        "tests/unit/turn-durable-transport.test.mjs",
-        "tests/integration/automatic-progression-continuation.test.mjs",
-        "tests/integration/capture-consent-boundary.test.mjs",
-        "tests/integration/session-start-turn-replay.test.mjs",
-        "tests/integration/progression-suspension.test.mjs"
+        "tests/integration/capture-consent-boundary.test.mjs"
       ]
     },
     {
       "id": "pending-continuity-capacity",
       "reason": "POSIX non-root permission refusal, capacity-pressure reporting and recovery preserve all accepted pending continuity events",
       "files": [
-        "tests/unit/continuity-journal-bounds.test.mjs"
       ]
     }
   ]

package/scripts/remedy-registry.mjs

@@ -68,22 +68,6 @@ export const REMEDIES = [
     // The inverse is restoring it. This is the branch whose absence made the promise a lie.
     inverse: () => ({ kind: K.RESTORE_MEMORY_BACKUP }),
   },
-  {
-    key: 'learning-flush',
-    summary: 'drain the capture queue into the learner',
-    match: (id) => (id === 'learning:flush' ? {} : null),
-    plan: () => ({ script: 'scripts/health-repair.mjs', args: ['--flush-learning'] }),
-    // Genuinely additive: it moves already-captured local events into the learner. Declared NONE on
-    // purpose, and the human string says what a user would actually do instead.
-    inverse: () => ({ kind: K.NONE, human: 'nothing to reverse — this only adds observations the learner already had queued; learned state can be reset separately' }),
-  },
-  {
-    key: 'learning-legacy-user-flush',
-    summary: 'drain retained legacy user history into its original home learner',
-    match: (id) => (id === 'learning:flush-legacy-user' ? {} : null),
-    plan: () => ({ script: 'scripts/health-repair.mjs', args: ['--flush-legacy-user-learning'] }),
-    inverse: () => ({ kind: K.NONE, human: 'original queue bytes stay retained; learned observations can be reset separately' }),
-  },
   {
     key: 'learning-train',
     summary: 'distill canonical observations into structural patterns',
@@ -235,8 +219,6 @@ export function assertRegistryClosure(offeredIds = [], handledUndoKinds = []) {
 export function sampleIdFor(remedy) {
   switch (remedy.key) {
     case 'memory-index': return 'repair:memory-index';
-    case 'learning-flush': return 'learning:flush';
-    case 'learning-legacy-user-flush': return 'learning:flush-legacy-user';
     case 'learning-train': return 'learning:train';
     case 'distill-fleet': return 'learning:distill-fleet';
     case 'enable-memory-distillation': return 'enable:memory-distillation';

package/scripts/wired-check.mjs

@@ -104,10 +104,6 @@ const STANDALONE = [
   ['grounding-turn-replay', 'human-run measurement harness for grounding-turn-gate.mjs (ADR-0030 #1 and shadow #2/#3): replays real transcripts read-only through the same pure functions the hooks call, sharing completion-claim-replay.mjs\'s turn walkers; nothing to schedule'],
   ['duplicate-gate-replay','human-run tuning harness for plugin/scripts/duplicate-gate.mjs: replays the gate over git history, read-only, when its thresholds are re-tuned; it imports the gate\'s own scoring functions, so there is no second copy to drift and nothing to schedule'],
   ['sync-commands', 'explicit maintainer alias synchronizer; run deliberately before release, never from a lifecycle hook'],
-  ['project-progression-checkpoint', 'the body of the shipped `/ruvnet-brain:checkpoint` command '
-    + '(plugin/commands/checkpoint.md:39; added a7167b6b 2026-09-11). The command host executes that '
-    + 'instruction, and this check does not scan command markdown — the same shape as '
-    + '`onboarding-console` below. Recorded 2026-09-11 when wired-check first named it.'],
   ['handoff-asset', 'client explainer handoff to a named host, run by a human per docs/CLIENT-ASSET-HANDOFF.md '
     + '(added 32b7b7ca 2026-09-11 with the TriSmart sub-product); nothing may schedule a copy to a client '
     + 'machine. Surfaced 2026-09-11 the first time wired-check ran with no agent worktrees under '
@@ -953,7 +949,7 @@ export function hookWiringAudit({
   // below double-counts every OTHER entry in its TABLE as "spawned", because the pass's own predicate
   // (callerPattern) matches any quoted filename — and every TABLE entry is, by construction, a quoted
   // filename in hook-shim.mjs's source, dispatched or not. Measured: before this exclusion,
-  // design-wall.sh, route-dispatch.sh, verify-interface.sh, learn-capture.sh, learn-flush.mjs,
+  // design-wall.sh, route-dispatch.sh, verify-interface.sh, learn-capture.sh,
   // md-stamp.mjs, signal-watch.mjs, routing-outcome-capture.mjs and swarm-slot-recycler.mjs all read
   // "wired · via spawned by plugin/scripts/hook-shim.mjs" while zero manifest (hooks.json,
   // codex-hooks.json, this repo's or the user's settings.json) ever dispatches most of their ids —