ruvnet-brain 4.7.10 → 4.7.12

package/README.md

@@ -9,7 +9,7 @@ Created: 2026-06-29 22:36:38 EDT
 
 ### Discover the stack. Read the source. Build with confidence.
 
-[![RuvNet Brain version 4.6.2 — README updated 2026-10-10 EDT](https://img.shields.io/badge/version_4.7.10-updated_2026--10--10_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](plugin/.claude-plugin/plugin.json)
+[![RuvNet Brain version 4.6.2 — README updated 2026-10-10 EDT](https://img.shields.io/badge/version_4.7.12-updated_2026--10--10_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](plugin/.claude-plugin/plugin.json)
 
 **A source-grounded companion for Claude Code and Codex that helps you find and use Reuven Cohen's (rUv's) RuvNet ecosystem.**
 
@@ -255,7 +255,7 @@ uses the protected release workflow; a consumer update downloads an available ge
 does not rebuild upstream knowledge. Check `--doctor`, `SOURCE.json` and refresh receipts
 before treating an installation as current.
 
-The **4.6.0 published-corpus baseline** is **199 public stores · 162,680 public source chunks**.
+The **4.6.0 published-corpus baseline** is **203 public stores · 164,393 public source chunks**.
 Those are bundle census values, not a claim that every upstream repository is fresh today.
 Later corpus publication may advance the knowledge generation independently of code changes.
 

package/bin/install.mjs

@@ -1770,9 +1770,29 @@ function legacyBrainWrapperOwnership(wrapperPath, home) {
   if (installed && shippedByRetainedGeneration(installed, path.join(home, '.cache', 'ruvnet-brain', 'versions'))) {
     return { state: 'prior-generation' };
   }
+  // A PRUNED generation's bridge (owner's machine, 2026-10-17): the bytes an EARLIER shipped release wrote,
+  // whose versions/<v>/ copy is gone (pruned, or written by a release that predates the Spine). The proof
+  // is the committed history of every wrapper each release tag carried, derived from git by
+  // scripts/codex-hook-wrapper-history.mjs and checked against git in the unit suite. Bytes only: the
+  // path, link, inode and uid checks above have already passed by the time this is consulted.
+  const past = installed && shippedByPastRelease(installed);
+  if (past) return { state: 'prior-release', release: past.tags[past.tags.length - 1] };
   return { state: 'conflict', reason: 'existing bridge differs from the shipped Brain source' };
 }
 
+// Test seam only: RUVNET_WRAPPER_HISTORY_FILE points the proof at another history file, so the unit suite
+// can hand the installer a malformed or hostile history without touching the committed data file.
+const WRAPPER_HISTORY_FILE = path.join(REPO_ROOT, 'data', 'codex-hook-wrapper-history.json');
+function shippedByPastRelease(bytes, historyFile = process.env.RUVNET_WRAPPER_HISTORY_FILE || WRAPPER_HISTORY_FILE) {
+  let history;
+  try { history = JSON.parse(fs.readFileSync(historyFile, 'utf8')); } catch { return null; }
+  if (history?.schemaVersion !== 1 || history.kind !== 'ruvnet-brain-codex-hook-wrapper-history' || !Array.isArray(history.wrappers)) return null;
+  const sha256 = crypto.createHash('sha256').update(bytes).digest('hex');
+  const hit = history.wrappers.find((row) => row?.sha256 === sha256 && row.bytes === bytes.length
+    && Array.isArray(row.tags) && row.tags.length > 0 && row.tags.every((tag) => /^v\d+\.\d+\.\d+$/.test(tag)));
+  return hit || null;
+}
+
 function shippedByRetainedGeneration(bytes, versionsDir) {
   const ownedDir = (dir) => {
     try {
@@ -1907,7 +1927,7 @@ export function wireCodexHost({
     const currentOwnership = legacyBrainWrapperOwnership(hookWrapperPath, path.dirname(codexDir));
     if (currentOwnership.state === 'conflict') throw new Error(currentOwnership.reason);
     hookRetirement = retireManagedHookRegistrations({ home: path.dirname(codexDir), codexDir, wrapperPath: hookWrapperPath });
-    if (currentOwnership.state === 'prior-generation') hookWrapperBackup = backupPriorWrapper(hookWrapperPath);
+    if (currentOwnership.state === 'prior-generation' || currentOwnership.state === 'prior-release') hookWrapperBackup = backupPriorWrapper(hookWrapperPath);
     atomicReplace(hookWrapperPath, (tmp) => fs.copyFileSync(hookWrapperSource, tmp));
   } catch (error) {
     if (announce) warn(`could not install the Codex hook bridge at ${hookWrapperPath}: ${error.message}`);
@@ -2413,8 +2433,8 @@ export function retireManagedHookRegistrations({ home = os.homedir(), codexDir =
   let removed = 0;
   const changedFiles = [];
   const conflicts = [];
-  // A bridge a retained Brain generation shipped is as much the Brain's as the new source.
-  const verifiedWrapper = ['verified', 'prior-generation']
+  // A bridge a retained Brain generation, or any earlier shipped release, wrote is as much the Brain's as the new source.
+  const verifiedWrapper = ['verified', 'prior-generation', 'prior-release']
     .includes(legacyBrainWrapperOwnership(wrapperPath, path.dirname(codexDir)).state);
   const tokensOf = (command) => (command.match(/"[^"]*"|'[^']*'|[^\s]+/g) || [])
     .map((token) => token.replace(/^["']|["']$/g, ''));

package/data/codex-hook-wrapper-history.json

@@ -0,0 +1,146 @@
+{
+  "schemaVersion": 1,
+  "kind": "ruvnet-brain-codex-hook-wrapper-history",
+  "source": "plugin/scripts/codex-hook-wrapper.mjs",
+  "releaseTags": 86,
+  "wrappers": [
+    {
+      "sha256": "f4a3159e06e8d7783be4f14070ddc34d298ace6ab120d92456d987b4d451f0f7",
+      "bytes": 1309,
+      "tags": [
+        "v4.0.1",
+        "v4.0.2",
+        "v4.0.3",
+        "v4.0.4",
+        "v4.0.5"
+      ]
+    },
+    {
+      "sha256": "37accf7f90aa61e538cb2ef1d162e95636947a0f177c6194ebe938a477c5642c",
+      "bytes": 2392,
+      "tags": [
+        "v4.0.6",
+        "v4.0.7"
+      ]
+    },
+    {
+      "sha256": "53b1b27b98ba7d20777a2b2877ffb5d0348f5b8e69e8cc24215d2e0fb6e50939",
+      "bytes": 4904,
+      "tags": [
+        "v4.0.8"
+      ]
+    },
+    {
+      "sha256": "48599192eff873bc95d7f849e42ae3d4fcd2d218e4c98caede65e5ddf9333d67",
+      "bytes": 4991,
+      "tags": [
+        "v4.0.24",
+        "v4.0.28",
+        "v4.0.35",
+        "v4.0.36"
+      ]
+    },
+    {
+      "sha256": "d29208f812a90d1507f3c928bd22dd37569d1f13d45fb7ce09592fc8e2dd6bd5",
+      "bytes": 8692,
+      "tags": [
+        "v4.3.1",
+        "v4.3.8",
+        "v4.3.9"
+      ]
+    },
+    {
+      "sha256": "16cbfd7083d50ad36ac187096e8b1dea7d5784ce5083ec436d4e54e2ce4d74a5",
+      "bytes": 10151,
+      "tags": [
+        "v4.3.10",
+        "v4.3.11",
+        "v4.3.14",
+        "v4.3.15",
+        "v4.3.16",
+        "v4.3.17",
+        "v4.3.18",
+        "v4.3.19",
+        "v4.3.20",
+        "v4.3.21",
+        "v4.3.22",
+        "v4.3.25",
+        "v4.3.26",
+        "v4.3.27",
+        "v4.3.28",
+        "v4.3.29",
+        "v4.3.30",
+        "v4.3.31",
+        "v4.3.32",
+        "v4.3.33",
+        "v4.3.34",
+        "v4.3.35",
+        "v4.3.36",
+        "v4.3.37",
+        "v4.3.38"
+      ]
+    },
+    {
+      "sha256": "801d813bd76a06a85f6874a69d548d455a23d9c0d142b2f84712e37c5dd61566",
+      "bytes": 10441,
+      "tags": [
+        "v4.3.39",
+        "v4.3.40"
+      ]
+    },
+    {
+      "sha256": "d3ee284722aadd9699ba7b7ece624cd59c5dd4a773cd2d7300340d1a662d0a15",
+      "bytes": 10924,
+      "tags": [
+        "v4.4.0",
+        "v4.4.1",
+        "v4.5.0",
+        "v4.5.1",
+        "v4.5.2",
+        "v4.5.3",
+        "v4.5.4",
+        "v4.5.5",
+        "v4.5.6",
+        "v4.5.7",
+        "v4.5.8",
+        "v4.5.9",
+        "v4.5.10",
+        "v4.5.11",
+        "v4.5.12",
+        "v4.5.13",
+        "v4.5.14",
+        "v4.5.15",
+        "v4.5.16"
+      ]
+    },
+    {
+      "sha256": "ea953c7329ea7c99ad681ae216a2bc537ff9ae3d75a1bb8b5ab69706df9ea6d3",
+      "bytes": 12180,
+      "tags": [
+        "v4.5.17",
+        "v4.6.0",
+        "v4.6.1",
+        "v4.6.2",
+        "v4.6.3",
+        "v4.6.4"
+      ]
+    },
+    {
+      "sha256": "d3c650ec9f211629d8a8aadb4d4dd0016d9e3ee0cc7a989c86f5629fefef664d",
+      "bytes": 12940,
+      "tags": [
+        "v4.7.0",
+        "v4.7.1",
+        "v4.7.2",
+        "v4.7.3",
+        "v4.7.4",
+        "v4.7.5",
+        "v4.7.6",
+        "v4.7.7",
+        "v4.7.8",
+        "v4.7.9",
+        "v4.7.10"
+      ]
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.7.10",
+  "version": "4.7.12",
   "description": "One-command installer for RuvNet Brain — a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {
@@ -101,7 +101,7 @@
     "config/model-router/",
     "config/practical-rule-catalog.json",
     "tri-smart-skill/",
-    "data/model-catalog.json",
+    "data/model-catalog.json","data/codex-hook-wrapper-history.json",
     "scripts/",
     "kb/verify-citation.mjs",
     "kb/retrieval-result.mjs",

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships a UserPromptSubmit retrieve-and-inject grounding hook and a PreToolUse write gate that refuses ungrounded rUv-product code until search_ruvnet has been consulted (ADR-0012 / ADR-067).",
-  "version": "4.7.10",
+  "version": "4.7.12",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.7.10",
+  "version": "4.7.12",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/scripts/code-release-corpus.mjs

@@ -189,7 +189,8 @@ export function assembleCodeReleaseCorpus({
   }
   if (verified.degraded.carried.length || verified.degraded.missing.length) {
     fail(`generation ${descriptor.tag} is degraded (${verified.degraded.carried.length} carried, `
-      + `${verified.degraded.missing.length} missing); a code release does not ship one (ADR-0091 D10)`);
+      + `${verified.degraded.missing.length} missing); a code release ships only an all-CURRENT corpus -- its install `
+      + 'verification (scripts/public-verification-aggregate.mjs) requires every eligible store CURRENT');
   }
   const before = treeDigest(assets);
   // build-bundle reads the sealed coverage from the ONE canonical path (<root>/data/source-coverage.json),

package/scripts/codex-hook-wrapper-history.mjs

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+// scripts/codex-hook-wrapper-history.mjs — every byte-exact Codex hook bridge the Brain has ever shipped.
+//
+// WHY (owner's machine, 2026-10-17). bin/install.mjs trusts an existing ~/.cache/ruvnet-brain/codex-hook.mjs
+// only when it equals the NEW source or a wrapper in a RETAINED Stable Spine generation (versions/<v>/).
+// A bridge written by an older release whose generation has since been pruned (for example the 4.5.2
+// wrapper, sha256 d3ee284722aa…, written while stale 4.5.2 code ran) is still the Brain's own bytes, but
+// nothing on disk proves it any more, so every update reported hook-wrapper-ownership-conflict and failed
+// host convergence night after night. The proof that was missing is HISTORICAL: the set of wrapper bytes
+// each shipped tag carried. That set is derived here from git, committed as data/codex-hook-wrapper-history.json
+// (shipped in the npm package), and checked against git in the unit suite so it cannot drift.
+//
+// It proves only identity of BYTES. Links, hard links, another uid, a foreign path and edited bytes stay
+// conflicts: those checks run first in legacyBrainWrapperOwnership and are untouched.
+//
+//   node scripts/codex-hook-wrapper-history.mjs --write   # regenerate data/codex-hook-wrapper-history.json
+//   node scripts/codex-hook-wrapper-history.mjs --check   # exit 1 when the committed file differs from git
+
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+export const HISTORY_FILE = path.join('data', 'codex-hook-wrapper-history.json');
+export const HISTORY_KIND = 'ruvnet-brain-codex-hook-wrapper-history';
+export const WRAPPER_SOURCE = 'plugin/scripts/codex-hook-wrapper.mjs';
+const RELEASE_TAG = /^v\d+\.\d+\.\d+$/;
+
+const semver = (tag) => tag.slice(1).split('.').map(Number);
+const byVersion = (a, b) => { const [x, y] = [semver(a), semver(b)]; return x[0] - y[0] || x[1] - y[1] || x[2] - y[2]; };
+
+function git(root, args) {
+  return execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 64 * 1024 * 1024 });
+}
+
+/** Release tags (vX.Y.Z) in this checkout, ascending. Empty when git or the tags are unavailable. */
+export function releaseTags(root = ROOT) {
+  try {
+    return git(root, ['tag', '-l', 'v*']).split('\n').map((line) => line.trim()).filter((tag) => RELEASE_TAG.test(tag)).sort(byVersion);
+  } catch { return []; }
+}
+
+/** { sha256, bytes, tags } for every distinct wrapper the release tags carried, ordered by first shipping tag. */
+export function deriveWrapperHistory(root = ROOT) {
+  const tags = releaseTags(root);
+  const wrappers = new Map();
+  for (const tag of tags) {
+    let bytes;
+    try { bytes = execFileSync('git', ['show', `${tag}:${WRAPPER_SOURCE}`], { cwd: root, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 16 * 1024 * 1024 }); }
+    catch { continue; } // a tag that predates the wrapper shipped no bridge
+    const sha256 = crypto.createHash('sha256').update(bytes).digest('hex');
+    if (!wrappers.has(sha256)) wrappers.set(sha256, { sha256, bytes: bytes.length, tags: [] });
+    wrappers.get(sha256).tags.push(tag);
+  }
+  return {
+    schemaVersion: 1,
+    kind: HISTORY_KIND,
+    source: WRAPPER_SOURCE,
+    releaseTags: tags.length,
+    wrappers: [...wrappers.values()],
+  };
+}
+
+export function readWrapperHistory(root = ROOT) {
+  const history = JSON.parse(fs.readFileSync(path.join(root, HISTORY_FILE), 'utf8'));
+  if (history?.schemaVersion !== 1 || history.kind !== HISTORY_KIND || !Array.isArray(history.wrappers)) {
+    throw new Error(`${HISTORY_FILE} is not a schema-1 ${HISTORY_KIND}`);
+  }
+  return history;
+}
+
+/**
+ * How the committed history differs from git: `missing` = wrappers a release tag shipped that the file lacks
+ * (an upgrade of those bytes would be a conflict again); `extra` = rows in the file no release tag shipped
+ * (bytes the installer would trust that git never did -- a hand-added row is exactly the forgery this must name).
+ */
+export function historyDrift(committed, derived) {
+  const key = (row) => `${row.sha256}:${row.bytes}`;
+  const known = new Set((committed.wrappers || []).map(key));
+  const shipped = new Set(derived.wrappers.map(key));
+  return {
+    missing: derived.wrappers.filter((row) => !known.has(key(row))),
+    extra: (committed.wrappers || []).filter((row) => !shipped.has(key(row))),
+  };
+}
+/** Kept for callers that only ask the one-sided question. */
+export function missingWrappers(committed, derived) { return historyDrift(committed, derived).missing; }
+export function describeDrift({ missing, extra }) {
+  const name = (row) => `${String(row.sha256 || '').slice(0, 12)} (${row.tags?.[0] ?? 'no tag'})`;
+  return [missing.length ? `missing ${missing.map(name).join(', ')}` : '', extra.length ? `not shipped by any release tag: ${extra.map(name).join(', ')}` : '']
+    .filter(Boolean).join('; ');
+}
+
+export function main(argv = process.argv.slice(2)) {
+  const derived = deriveWrapperHistory();
+  if (!derived.releaseTags) {
+    console.error('[wrapper-history] no vX.Y.Z tags are visible to git here; nothing to derive');
+    return 1;
+  }
+  const text = `${JSON.stringify(derived, null, 2)}\n`;
+  const file = path.join(ROOT, HISTORY_FILE);
+  if (argv.includes('--write')) {
+    fs.writeFileSync(file, text);
+    console.log(`wrote ${HISTORY_FILE}: ${derived.wrappers.length} distinct wrapper(s) across ${derived.releaseTags} release tag(s)`);
+    return 0;
+  }
+  if (argv.includes('--check')) {
+    // The BYTES are the contract; the tag lists are provenance. A new release that ships an unchanged wrapper
+    // adds a tag without adding a wrapper and must not fail this check at the next checkout.
+    let drift;
+    try { drift = historyDrift(readWrapperHistory(ROOT), derived); } catch (error) { console.error(`[wrapper-history] ${error.message}`); return 1; }
+    if (!drift.missing.length && !drift.extra.length) {
+      console.log(`${HISTORY_FILE} carries exactly the wrappers git's release tags shipped (${derived.wrappers.length} wrapper(s), ${derived.releaseTags} tag(s))`);
+      return 0;
+    }
+    console.error(`${HISTORY_FILE} differs from git: ${describeDrift(drift)}; run: node scripts/codex-hook-wrapper-history.mjs --write`);
+    return 1;
+  }
+  console.error('usage: codex-hook-wrapper-history.mjs --write | --check');
+  return 2;
+}
+
+if (process.argv[1] && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url))) {
+  process.exitCode = main();
+}

package/scripts/corpus-canary.mjs

@@ -46,6 +46,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { addPrivateStore, resolveRuntime, resultFromRefreshReceipt, runInstallerDoor } from './customer-seams.mjs';
 import { CANARY_VERDICT_KIND, CORPUS_TAG_PATTERN, REQUIRED_CANARY_CHECKS } from './corpus-promotion.mjs';
 import { inventoryFootprint } from '../plugin/scripts/brain-footprint.mjs';
+import { eligibleRepositoryStanding } from '../plugin/scripts/coverage-integrity.mjs';
 
 export const PUBLIC_API = 'https://api.github.com';
 export const FRESHNESS_LIMIT_MS = 48 * 3_600_000;
@@ -126,6 +127,13 @@ function coverageRows(file) {
  * 2026-09-30), so a "moved store must be ingested within 48h of now" rule would wrongly refuse a
  * perfectly fresh generation about three nights after every code release.
  * MISSING/INELIGIBLE rows are the coverage validator's business (it already ran), not a freshness question.
+ *
+ * CARRIED STORES (ADR-0091 D5, decided 2026-10-17): a repository row the shipped validator accepts as
+ * `shipped` WITH a `carry` record -- STALE, bytes re-hashed against the ledger, `carry.carriedSourceCommit`
+ * equal to the shipped commit and `carry.missedUpstream` equal to the observed upstream -- is not a stale
+ * store: the generation names the miss and keeps the last verified bytes on purpose. It is reported here by
+ * name, never silently. A row whose shipped commit differs from its upstream WITHOUT that record is still
+ * stale and still fails: that is the shape an unrecorded miss has.
  */
 export function storeFreshness({ after, before = null, now }) {
   if (!after) return { ok: false, detail: 'CORPUS-COVERAGE.json is missing from the installed tree' };
@@ -136,19 +144,25 @@ export function storeFreshness({ after, before = null, now }) {
   if (age > FRESHNESS_LIMIT_MS || age < 0) problems.push(`upstream observed ${(age / 3_600_000).toFixed(1)}h ago (limit 48h)`);
   const priorCommit = new Map((before?.rows || []).map((row) => [row.key, row.artifact?.sourceCommit || null]));
   const stale = [];
+  const carried = [];
   let moved = 0;
   for (const row of after.rows) {
     if (row.status === 'INELIGIBLE') continue;
     const upstream = row.upstream?.sha || null;
     const built = row.artifact?.sourceCommit || null;
     if (!upstream || !built) continue;
-    if (upstream !== built) { stale.push(row.artifact?.store || row.key); continue; }
+    if (upstream !== built) {
+      if (row.kind === 'repository' && row.carry && eligibleRepositoryStanding(row) === 'shipped') carried.push(row.artifact?.store || row.key);
+      else stale.push(row.artifact?.store || row.key);
+      continue;
+    }
     if (before && priorCommit.get(row.key) !== upstream) moved += 1;
   }
-  if (stale.length) problems.push(`${stale.length} store(s) built from a commit older than their observed upstream: ${stale.slice(0, 10).join(', ')}`);
+  if (stale.length) problems.push(`${stale.length} store(s) built from a commit older than their observed upstream with no recorded carry: ${stale.slice(0, 10).join(', ')}`);
+  const carriedDetail = carried.length ? `${carried.length} carried at their last verified bytes with a recorded reason: ${carried.slice(0, 10).join(', ')}` : '0 carried';
   return problems.length
-    ? { ok: false, detail: problems.join('; ') }
-    : { ok: true, detail: `observed ${(age / 3_600_000).toFixed(1)}h ago; ${after.rows.length} row(s), 0 stale; ${before ? `${moved} moved since the installed generation, all at their observed upstream commit` : 'no prior coverage to diff against'}` };
+    ? { ok: false, detail: `${problems.join('; ')}; ${carriedDetail}` }
+    : { ok: true, detail: `observed ${(age / 3_600_000).toFixed(1)}h ago; ${after.rows.length} row(s), 0 stale, ${carriedDetail}; ${before ? `${moved} moved since the installed generation, all at their observed upstream commit` : 'no prior coverage to diff against'}` };
 }
 
 /**

package/scripts/corpus-coverage-sidecar.mjs

@@ -11,7 +11,9 @@
 // and the receipt binds none, so nothing downstream of preparation could tell a degraded generation
 // (carried / missing stores) from a fully current one. The coverage lived only in a 14-day workflow
 // artifact. D6's code-release path needs the generation's sealed coverage to assemble single-pass,
-// and D10's publisher-side "no degraded generation before the soak" check needs it to exist at all.
+// the publisher (release.mjs) binds it to the receipt and names a degraded generation's stores from it,
+// and the watchdog's 7-day carry rule and corpus-next-seed's code-release refusal of a degraded seed
+// both read it. (The former ADR-0091 D10 soak gate also read it; that gate was removed 2026-10-17.)
 //
 //   CORPUS-COVERAGE.json  -- the sealed ruvnet-brain-corpus-coverage ledger, exact bytes.
 //   coverage-receipt.json -- { generationTag, archiveSha256, archiveBytes, coverageSha256, ... }.

package/scripts/corpus-next-seed.mjs

@@ -148,8 +148,8 @@ const sha256Of = (file) => crypto.createHash('sha256').update(fs.readFileSync(fi
 function judgeRelease({ run, repo, tag, digest, profile, rejected, requireCoverage = false }) {
   // `indeterminate` marks a rejection that says nothing about the release itself -- the network or
   // `gh` failed. A publish-time re-check (ADR-0091 D6.6) must not read one as "no newer generation".
-  const reject = (reason, { indeterminate = false } = {}) => {
-    rejected.push({ tag, reason, ...(indeterminate ? { indeterminate: true } : {}) });
+  const reject = (reason, { indeterminate = false, kind = null } = {}) => {
+    rejected.push({ tag, reason, ...(indeterminate ? { indeterminate: true } : {}), ...(kind ? { kind } : {}) });
     return null;
   };
   let view;
@@ -250,6 +250,18 @@ function judgeRelease({ run, repo, tag, digest, profile, rejected, requireCovera
       } catch (error) {
         return reject(`unverified: coverage sidecar does not bind this generation (${error.message})`);
       }
+      // A CODE release ships only an all-CURRENT corpus. Its install verification
+      // (scripts/public-verification-aggregate.mjs) requires coverage.eligibleCurrent === eligibleTotal on
+      // every lane, so a release assembled from a degraded generation could never become install-verified
+      // and the nightly would stand down on it. The nightly seed may be degraded: the next night re-plans
+      // the carried stores. Decided 2026-10-17 with the D10 removal.
+      const degradedCount = coverage.degraded.carried.length + coverage.degraded.missing.length;
+      if (requireCoverage && degradedCount > 0) {
+        return reject(`incompatible for a code release: degraded generation (${coverage.degraded.carried.length} carried: `
+          + `${coverage.degraded.carried.join(', ') || 'none'}; ${coverage.degraded.missing.length} missing: `
+          + `${coverage.degraded.missing.join(', ') || 'none'}); install verification requires every eligible store CURRENT`,
+        { kind: 'degraded' });
+      }
     }
 
     try {
@@ -303,7 +315,7 @@ export async function resolveNextCorpusSeed({
   const rejected = [];
   let listed = [];
   try {
-    listed = ghJson(run, ['release', 'list', '--repo', repo, '--limit', String(limit), '--json', 'tagName,isDraft,createdAt']) || [];
+    listed = ghJson(run, ['release', 'list', '--repo', repo, '--limit', String(limit), '--json', 'tagName,isDraft,isPrerelease,createdAt']) || [];
   } catch (error) {
     rejected.push({ tag: null, reason: `release list failed (${error.message})`, indeterminate: true });
   }
@@ -316,21 +328,38 @@ export async function resolveNextCorpusSeed({
   const candidates = [];
   for (const row of corpusShaped) {
     if (row.isDraft) { rejected.push({ tag: row.tagName, reason: 'unverified: release is still a draft' }); continue; }
+    // A corpus generation is STAGED as a prerelease and PROMOTED (prerelease flag cleared) only after the
+    // customer canary applied it (protected-release.yml corpus-canary -> corpus-promote). A generation
+    // still a prerelease was refused by that canary, superseded, or is mid-flight: no customer received
+    // it, so no night and no code release may build on it (reviewer finding, 2026-10-17). The committed
+    // bootstrap is a code-release tag, never corpus-shaped, so this never touches it.
+    if (row.isPrerelease) { rejected.push({ tag: row.tagName, reason: 'unpromoted: still a prerelease (the customer canary never promoted it); not a seed' }); continue; }
     const createdAt = Date.parse(row.createdAt);
     if (!Number.isFinite(createdAt)) { rejected.push({ tag: row.tagName, reason: 'unverified: release has no readable publication time' }); continue; }
     candidates.push({ tag: row.tagName, digest: CORPUS_TAG.exec(row.tagName)[1], createdAt });
   }
   candidates.sort((left, right) => right.createdAt - left.createdAt);
 
-  const judged = candidates.slice(0, searchBound);
-  for (const skipped of candidates.slice(searchBound)) {
-    rejected.push({ tag: skipped.tag, reason: `not judged: older than the ${searchBound} newest generations (ADR-0091 D4 search bound)` });
-  }
   const expects = { model: compatibility.model, dimensions: compatibility.dimensions, fixtureSha256: compatibility.fixtureSha256 };
-  for (const candidate of judged) {
+  // The bound counts generations JUDGED incompatible or unverifiable (ADR-0091 D4: one bad format change can
+  // cost at most SEARCH_BOUND downloads). In code-release mode a DEGRADED promoted generation is skipped
+  // without consuming it: a carried store is a transient state the next night re-plans, and if each such
+  // night used up the bound, SEARCH_BOUND degraded nights in a row would walk every code release back to the
+  // committed bootstrap (a pre-ADR-0091 corpus) with nothing paging (reviewer finding, 2026-10-17). The
+  // release listing (`--limit`) remains the absolute cap on the walk.
+  let judged = 0;
+  let skippedDegraded = 0;
+  for (const candidate of candidates) {
+    if (judged >= searchBound) {
+      rejected.push({ tag: candidate.tag, reason: `not judged: older than the ${searchBound} newest generations (ADR-0091 D4 search bound)` });
+      continue;
+    }
     const resolved = judgeRelease({ run, repo, tag: candidate.tag, digest: candidate.digest, profile: compatibility, rejected,
       requireCoverage });
-    if (resolved) return { seed: resolved, rejected, judged: judged.length, expects };
+    if (resolved) return { seed: resolved, rejected, judged: judged + 1, skippedDegraded, expects };
+    if (requireCoverage && rejected[rejected.length - 1]?.tag === candidate.tag && rejected[rejected.length - 1]?.kind === 'degraded') {
+      skippedDegraded += 1;
+    } else judged += 1;
   }
 
   return {
@@ -344,7 +373,8 @@ export async function resolveNextCorpusSeed({
       brainVersion: null,
     },
     rejected,
-    judged: judged.length,
+    judged,
+    skippedDegraded,
     expects,
   };
 }

package/scripts/corpus-reconcile.mjs

@@ -18,7 +18,7 @@ import { rebuildCorpusAggregates } from './corpus-aggregates.mjs';
 import { assertCapabilityOnlyStore, isCapabilityOnly, CAPABILITY_RETIRED_SUFFIXES } from '../kb/capability-only.mjs';
 import { eligibleRepositoryStanding, fileIdentity, validateCoverageLedger } from '../plugin/scripts/coverage-integrity.mjs';
 import {
-  CORPUS_QA_FAILED_EXIT, FAILURE_CLASS, StoreWorkerError, degradedBound, degradedPublication, failureReason, isRetryable,
+  CORPUS_QA_FAILED_EXIT, FAILURE_CLASS, StoreWorkerError, degradedBound, describeDegraded, failureReason, isRetryable,
 } from './corpus-store-failure.mjs';
 import { readDiagnosticAccuracyReport } from './oracle/retrieval-accuracy.mjs';
 import { storeRoot } from '../kb/store-root.mjs';
@@ -132,10 +132,6 @@ function filesNamed(root, wanted) {
 // corpus-seed.yml can re-run seed extraction ONCE from the committed bootstrap in the same job.
 export const SEED_LEDGER_SCHEMA_VERSION = 2;
 export const SEED_LEDGER_INCOMPATIBLE_EXIT = 3;
-// ADR-0091 D5 + D10: the generation was built and SEALED with carried/missing stores, but degraded
-// publication is not yet allowed (no soaked tolerant-validator transition). It must not be published;
-// the next night re-plans the carried stores automatically because their sourceCommit still differs.
-export const DEGRADED_UNPUBLISHED_EXIT = 4;
 
 export class SeedLedgerIncompatibleError extends Error {
   constructor(reason) {
@@ -1256,17 +1252,13 @@ export async function main(argv = process.argv.slice(2), {
     return 0;
   }
   const { plan } = summarizeReconciliation(reconciliation);
+  // ADR-0091 D5: a generation inside the degraded bound (assessCandidateCoverage already refused one
+  // above it) is sealed and goes on to be published like any other; the night's log and step summary
+  // say which stores were carried or are missing, and each row says so in the sealed coverage.
   const degraded = candidate.degraded || { carried: [], missing: [] };
-  const isDegraded = degraded.carried.length + degraded.missing.length > 0;
-  const publication = isDegraded ? degradedPublication() : { allowed: true, reason: 'every eligible row is CURRENT' };
-  stdout.write(`${JSON.stringify({ ok: publication.allowed, seedTag, seedSha256, plan, reconciliation, ...candidate,
-    degraded: { ...degraded, publishable: publication.allowed, reason: publication.reason } }, null, 2)}\n`);
-  if (!publication.allowed) {
-    stderr.write(`::warning title=Degraded corpus generation sealed, not published::${degraded.carried.length} carried `
-      + `(${degraded.carried.map((row) => row.store).join(', ') || 'none'}), ${degraded.missing.length} missing `
-      + `(${degraded.missing.map((row) => row.store).join(', ') || 'none'}); ${publication.reason}\n`);
-    return DEGRADED_UNPUBLISHED_EXIT;
-  }
+  const summary = describeDegraded(degraded);
+  stdout.write(`${JSON.stringify({ ok: true, seedTag, seedSha256, plan, reconciliation, ...candidate, degraded }, null, 2)}\n`);
+  if (summary) stderr.write(`::warning title=Degraded corpus generation::${summary}; the carried stores keep their last verified bytes and are re-planned next night\n`);
   return 0;
 }
 

package/scripts/corpus-store-failure.mjs

@@ -1,6 +1,6 @@
 // ADR-0091 D5 — per-store failure isolation for corpus reconciliation.
 //
-// One store failing to refresh must not abort the whole generation. This module owns the three
+// One store failing to refresh must not abort the whole generation. This module owns the two
 // pure decisions that make that safe, so the reconciler, the rehearsal and the tests share them:
 //
 //   1. WHICH failures are retried. Only transient ones (clone, fetch, runner I/O), exactly once, in a
@@ -10,11 +10,25 @@
 //      from log text.
 //   2. HOW MANY stores may be carried or missing before the failure is systemic and the generation
 //      must fail loudly: carried + missing <= max(3, 5% of eligible).
-//   3. WHETHER a degraded generation may be published at all. Installed clients judge every bundle
-//      with their INSTALLED validator, and every validator shipped before this change rejects any
-//      non-CURRENT eligible row. ADR-0091 D10 therefore gates degraded publication behind a
-//      transition release plus a 14-day soak; until D10 records that transition, a degraded
-//      generation is built and sealed but never published.
+//
+// A generation inside that bound PUBLISHES like any other, each carried or missing store named in its
+// sealed coverage (CORPUS-COVERAGE.json: `carry` / `failure` records). Whether installed clients accept
+// it is proven every night by the customer canary (protected-release.yml `customer-canary`: a clean
+// install, a private-overlay install and the previous runtime each apply the staged candidate through
+// the real updater before anything is promoted; scripts/corpus-canary.mjs storeFreshness names each
+// carried store), not by a hand-set constant. The former ADR-0091 D10 gate -- a committed
+// `VALIDATOR_TRANSITION` plus a 14-day soak -- was removed on 2026-10-17: the tolerant validator
+// (`eligibleRepositoryStanding`) has shipped in every code release since v4.3.36 (2026-09-29) and every
+// corpus generation since 2026-10-01, the soak it demanded ended on 2026-10-13, and the constant was
+// never set. Measured on the one night it decided (run 39069376585, 2026-10-17, runtime 4.7.10): the
+// external source cognitum-one/ruOS had been deleted upstream; 4.7.10's `ifGone` entry carried it at
+// b1762a71 while the live corpus served 576dc8c8, so the store was re-planned, the clone of the gone
+// repository failed twice, the store was carried, the 201-store generation was built and sealed over
+// ~1h40m, and this gate threw it away with exit 4 (4.7.11 fixed the `ifGone` commit). The four nights
+// before it (38529261934, 38699673841, 38867855193, 39013743592) died earlier, exit 1, on the HTTP 404
+// itself. A gate that only a code release can open, that nobody opens, is not a safety property.
+// A CODE release still ships only an all-CURRENT corpus: scripts/corpus-next-seed.mjs --require-coverage
+// refuses a degraded seed, because install verification requires eligibleCurrent === eligibleTotal.
 
 /** kb/forge-refresh.mjs exits with this status when corpus-qa rejected its candidate. */
 export const CORPUS_QA_FAILED_EXIT = 3;
@@ -57,26 +71,11 @@ export function degradedBound(eligibleCount) {
 }
 
 /**
- * ADR-0091 D10 owns this value. It stays null until the transition release N (the first release
- * shipping the tolerant validator while its own coverage is all-CURRENT) has become releases/latest;
- * D10 then records { version, latestSince } here. Null means no transition: never publish degraded.
+ * One line a run log or step summary can print for a generation's carried/missing stores; '' when none.
+ * Rows are the reconciler's `{ store, ... }` records or the coverage sidecar's bare store names.
  */
-export const VALIDATOR_TRANSITION = null;
-export const TRANSITION_SOAK_DAYS = 14;
-
-export function degradedPublication({ transition = VALIDATOR_TRANSITION, now = new Date() } = {}) {
-  if (!transition) {
-    return { allowed: false,
-      reason: 'no tolerant-validator transition release is recorded (ADR-0091 D10); installed clients would reject a non-CURRENT row' };
-  }
-  const since = Date.parse(transition.latestSince);
-  if (typeof transition.version !== 'string' || !transition.version || !Number.isFinite(since)) {
-    return { allowed: false, reason: 'the recorded validator transition is malformed' };
-  }
-  const soakEnds = since + TRANSITION_SOAK_DAYS * 24 * 60 * 60 * 1000;
-  if (now.getTime() < soakEnds) {
-    return { allowed: false,
-      reason: `validator transition ${transition.version} soaks until ${new Date(soakEnds).toISOString()} (ADR-0091 D10)` };
-  }
-  return { allowed: true, reason: `validator transition ${transition.version} has soaked ${TRANSITION_SOAK_DAYS} days` };
+export function describeDegraded({ carried = [], missing = [] } = {}) {
+  if (!carried.length && !missing.length) return '';
+  const names = (rows) => rows.map((row) => (typeof row === 'string' ? row : row.store)).join(', ') || 'none';
+  return `${carried.length} carried (${names(carried)}), ${missing.length} missing (${names(missing)})`;
 }

package/scripts/corpus-watchdog.mjs

@@ -188,7 +188,21 @@ export function judgeCorpusHealth(input, now) {
   // (c) the newest code release must reach a verified aggregate within 24h of publish.
   const code = input?.codeRelease;
   if (!code) add(RED, 'code-aggregate', 'no published vX.Y.Z code release was found');
-  else if (code.aggregate?.state === 'verified') add(GREEN, 'code-aggregate', `${code.tag} carries a verified PASS aggregate`);
+  else if (code.aggregate?.state === 'verified') {
+    add(GREEN, 'code-aggregate', `${code.tag} carries a verified PASS aggregate`);
+    // (c2) THE CORPUS FRESH INSTALLS RECEIVE. A code release ships a corpus too, and its signed aggregate
+    // records how many eligible stores the three install lanes found CURRENT. The aggregate VERIFIES only when
+    // eligibleCurrent === eligibleTotal (scripts/public-verification-aggregate.mjs), so a verified code release
+    // never ships a carried or missing store; this line says so with the measured counts rather than leaving
+    // it implied. Counts that are absent (the verifier does not require their presence) are reported, not
+    // read as "all current".
+    const shipped = code.aggregate.coverage;
+    if (!shipped || !Number.isSafeInteger(shipped.eligibleTotal) || !Number.isSafeInteger(shipped.eligibleCurrent)) {
+      add(WARNING, 'code-corpus', `${code.tag}: the aggregate records no eligible/CURRENT store counts; what fresh installs receive is unmeasured`);
+    } else {
+      add(GREEN, 'code-corpus', `${code.tag} ships ${shipped.eligibleCurrent}/${shipped.eligibleTotal} eligible stores CURRENT`);
+    }
+  }
   else if (code.aggregate?.state === 'invalid') add(RED, 'code-aggregate', `${code.tag} carries an aggregate that does not verify `
     + `under this checkout's verifier (the one approved-runtime --resolve runs, so the nightly will refuse it too): ${code.aggregate.reason}`);
   else {
@@ -210,7 +224,10 @@ export function judgeCorpusHealth(input, now) {
         .map((row) => `${row.store} (${row.lowerBound ? '≥' : ''}${hours(age(row.since))})`).join(', ')}`);
     } else add(GREEN, 'deferral', `${(deferral.stores || []).length} deferred store(s), none older than 7 days`);
     const degraded = [...(deferral.degraded?.carried || []), ...(deferral.degraded?.missing || [])];
-    if (degraded.length) add(WARNING, 'degraded', `${deferral.newestTag} is degraded: ${deferral.degraded.carried.length} carried, ${deferral.degraded.missing.length} missing`);
+    if (degraded.length) {
+      add(WARNING, 'degraded', `${deferral.newestTag} is degraded: ${deferral.degraded.carried.length} carried `
+        + `(${deferral.degraded.carried.join(', ') || 'none'}), ${deferral.degraded.missing.length} missing (${deferral.degraded.missing.join(', ') || 'none'})`);
+    }
   }
 
   // (e) the generation customers receive. Its own generation stamp when it carries one (the corpus
@@ -267,7 +284,12 @@ async function aggregateState({ gh, repo, tag, root, scratch }) {
     const { verifyPublicVerificationAggregate } = await import('./public-verification-aggregate.mjs');
     verifyPublicVerificationAggregate(aggregate, crypto.createPublicKey(fs.readFileSync(path.join(root, SIGNING_PUBLIC_KEY_FILE), 'utf8')));
     if (aggregate.identity?.tag !== tag) throw new Error(`aggregate describes ${aggregate.identity?.tag}, not ${tag}`);
-    return { state: 'verified' };
+    // The corpus a CODE release ships, as its three install lanes measured it: the signed aggregate carries
+    // the eligible/CURRENT counts and the coverage generation of the installed COVERAGE.json. The code
+    // release publishes no coverage sidecar of its own (verified 2026-10-17: v4.7.10 assets), so this is
+    // the one small, signed place that says what fresh installs receive.
+    return { state: 'verified', coverage: { eligibleTotal: aggregate.coverage?.eligibleTotal ?? null,
+      eligibleCurrent: aggregate.coverage?.eligibleCurrent ?? null, coverageGeneration: aggregate.identity?.coverageGeneration ?? null } };
   } catch (error) {
     return { state: 'invalid', reason: error.message.slice(0, 200) };
   }

package/scripts/rehearse-corpus-pipeline.mjs

@@ -917,17 +917,11 @@ async function runGeneration({ index, api, checkoutRoot, workRoot, seed, bounds,
   });
   log(`[gen ${index}] extracted-byte verification passed with staging revoked (${generation.extractedByteVerification.files} files)`);
 
-  // --- ADR-0091 D5 + D10: a degraded generation is sealed but not published until D10 allows it ---
+  // --- ADR-0091 D5: a degraded generation inside the bound is published like any other, named -----
   const corpusTag = `corpus-sha256-${archiveSha256}`;
   if (generation.degraded.carried.length || generation.degraded.missing.length) {
-    const decision = api.degradedPublication();
-    if (!decision.allowed) {
-      generation.publication = { status: 'WITHHELD-DEGRADED', corpusTag, reason: decision.reason,
-        carried: generation.degraded.carried.map((entry) => entry.store), missing: generation.degraded.missing.map((entry) => entry.store) };
-      generation.finishedAt = new Date().toISOString();
-      log(`[gen ${index}] degraded generation sealed and WITHHELD from publication: ${decision.reason}`);
-      return { generation, withheld: true, nextSeed: null, published: null };
-    }
+    log(`[gen ${index}] degraded generation (${generation.degraded.carried.length} carried, `
+      + `${generation.degraded.missing.length} missing) is published with its stores named in the sealed coverage`);
   }
 
   // --- rehearse the real product-consumption path, publication RECORDED not executed -----------
@@ -1371,7 +1365,6 @@ export async function rehearseCorpusPipeline({
       prepareCorpusCandidate: reconcileMod.prepareCorpusCandidate,
       executeReconciliation: reconcileMod.executeReconciliation,
       defaultRunAsync: reconcileMod.defaultRunAsync,
-      degradedPublication: failureMod.degradedPublication,
       observeSourceUniverse: coverageMod.observeSourceUniverse,
       canonicalSourceObservation: coverageMod.canonicalSourceObservation,
       buildCoverage: coverageMod.buildCoverage,
@@ -1479,14 +1472,6 @@ export async function rehearseCorpusPipeline({
       phase(`generation-${index}-approved-runtime`, 'PASS', { ...runtimeCheck,
         reason: `verifyApprovedRuntime PASS: ${verdict.checked} runtime files equal the checkout's, none unpinned, seed ${seed.tag} did not leak an executable` });
 
-      if (result.withheld) {
-        phase(`generation-${index}-publication`, 'PASS', { status: 'WITHHELD-DEGRADED', ...result.generation.publication,
-          reason: `degraded generation sealed but not published (ADR-0091 D5/D10): ${result.generation.publication.reason}` });
-        if (index < generations) {
-          phase('remaining-generations', 'SKIP', { reason: `generation ${index} was withheld, so there is no published generation ${index} to seed from` });
-        }
-        break;
-      }
       const consumeNow = seedSelection && codeReleaseConsumption && !codeRelease;
       if (seedSelection && (index < generations || codeRelease)) {
         lastPublished = publishLocally({ selectionMod, registryDir, published: result.published, workRoot, index });

package/scripts/release.mjs

@@ -69,7 +69,7 @@ import {
   CORPUS_GENERATION_FIELD, CORPUS_TAG_PATTERN, evaluateCanaryVerdict, evaluateCorpusPromotion, parseCorpusGeneration,
 } from './corpus-promotion.mjs';
 import { bindCoverageToReceipt, writeCoverageAssets } from './corpus-coverage-sidecar.mjs';
-import { degradedPublication } from './corpus-store-failure.mjs';
+import { describeDegraded } from './corpus-store-failure.mjs';
 import { assertNoNewerCorpusGeneration } from './code-release-corpus.mjs';
 
 const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
@@ -404,12 +404,12 @@ export async function runProtectedCorpusSeed({
     corpusFailure(`corpus receipt does not verify against the sealed archive (${error.message})`);
   }
 
-  // ADR-0091 D6.2 + D10. The archive carries no coverage and the schema-3 receipt binds none, so this
-  // is the one place the publisher can SEE whether the generation is degraded. The coverage must be
-  // the coverage of THIS archive (bound store by store to the receipt), it is published beside the
-  // archive as CORPUS-COVERAGE.json + coverage-receipt.json (no receipt schema bump), and a
-  // generation with any carried or missing store is refused while D10 has recorded no soaked
-  // tolerant-validator transition -- installed clients would reject it. Local, before any network.
+  // ADR-0091 D6.2. The archive carries no coverage and the schema-3 receipt binds none, so this is the
+  // one place the publisher can SEE whether the generation is degraded. The coverage must be the
+  // coverage of THIS archive (bound store by store to the receipt) and is published beside the archive
+  // as CORPUS-COVERAGE.json + coverage-receipt.json (no receipt schema bump). A generation inside the
+  // degraded bound is staged like any other: the customer canary, not a constant, decides whether
+  // installed clients accept it before it is promoted. Local, before any network.
   let coverageAssets;
   try {
     coverageAssets = writeCoverageAssets({
@@ -419,13 +419,8 @@ export async function runProtectedCorpusSeed({
     const degraded = bindCoverageToReceipt({
       coverage: JSON.parse(fs.readFileSync(coverageAssets.coverageFile, 'utf8')), receipt,
     });
-    if (degraded.carried.length + degraded.missing.length > 0) {
-      const decision = degradedPublication();
-      if (!decision.allowed) {
-        corpusFailure(`degraded generation (${degraded.carried.length} carried, ${degraded.missing.length} missing) `
-          + `must not be published: ${decision.reason}`);
-      }
-    }
+    const summary = describeDegraded(degraded);
+    if (summary) console.error(`[corpus-seed] degraded generation staged: ${summary} (each named in CORPUS-COVERAGE.json)`);
   } catch (error) {
     if (String(error.message).startsWith('[corpus-seed]')) throw error;
     corpusFailure(`the generation's sealed coverage does not bind this archive (${error.message})`);

package/scripts/single-source-check.mjs

@@ -17,6 +17,7 @@ import { fileURLToPath } from 'node:url';
 import { readCheckpoint, checkpointStaleness } from './loop-checkpoint.mjs';
 import { PRODUCTION_ENVIRONMENT, productionEnvironmentVerdict } from './release-environment-policy.mjs';
 import { approvalHits, LOCAL_INSTRUCTION_DRIFT } from './human-approval-phrases.mjs';
+import { deriveWrapperHistory, describeDrift, historyDrift, readWrapperHistory } from './codex-hook-wrapper-history.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HOME = os.homedir();
@@ -192,6 +193,19 @@ const checks = [
       return none([...extra, ...drift]);
     } },
 
+  // The installer proves a pre-existing Codex hook bridge is the Brain's own by its bytes: the new source, a
+  // retained Spine generation, or (2026-10-17) any wrapper an earlier release tag shipped, from the committed
+  // data/codex-hook-wrapper-history.json. That file is derived from git; a release that ships NEW wrapper
+  // bytes without regenerating it would make the next upgrade of those bytes a conflict again.
+  { id: 'D4', area: 'corpus', scope: 'repo', title: 'The committed Codex hook wrapper history carries exactly the wrappers the release tags shipped',
+    run: () => {
+      const derived = deriveWrapperHistory(ROOT);
+      if (!derived.releaseTags) return { ok: true, detail: 'no vX.Y.Z tags visible to git here; nothing to compare' };
+      const drift = historyDrift(readWrapperHistory(ROOT), derived);
+      const ok = !drift.missing.length && !drift.extra.length;
+      return { ok, detail: ok ? `${derived.wrappers.length} wrapper(s) across ${derived.releaseTags} tag(s)`
+        : `${describeDrift(drift)}; run node scripts/codex-hook-wrapper-history.mjs --write` };
+    } },
   { id: 'D2', area: 'corpus', scope: 'machine', title: 'Installed knowledge matches the installed plugin version',
     run: () => {
       const tag = String(json(readAbs(path.join(HOME, '.cache/ruvnet-brain/kb/SOURCE.json'))).releaseTag || '').replace(/^v/, '');