ruvnet-brain 4.7.21 → 4.7.22

package/scripts/codex-boot-surface-proof.mjs

@@ -0,0 +1,208 @@
+// Proof that the Codex boot surface a release changed is the surface a FRESH Codex session will load (issue #391,
+// ADR-0070, ADR-0051). A receipt that names `scripts/hook-shim.mjs`, `mcp/server.mjs` or `skills/` as changed used to stay
+// restartScope:'unproven' forever, because only the two hook-declaration files could be cleared. Each path is proven by
+// the strongest evidence that can be gathered without a Codex relaunch, and any path with no prover stays unproven,
+// NAMED in the result:
+//   hooks/codex-hooks.json, hooks/hooks.json  the fresh-declarations proof (scripts/codex-fresh-host-proof.mjs)
+//   skills/                                    that proof plus a byte-identical skills/ tree
+//   scripts/hook-shim.mjs                      byte-identical AND a real run of the INSTALLED shim with an unknown hook
+//                                              id (it exits 0 doing nothing and lists its roles; every registered Codex
+//                                              role must be listed)
+//   mcp/server.mjs                             byte-identical AND a real stdio initialize + tools/list that must
+//                                              include search_ruvnet
+// The result ALWAYS reports windows that are already open as `unproven` and a host relaunch as `not-observed`. It is
+// read-only: both real processes run against an isolated temporary HOME and brain home (the MCP server leases its
+// generation while running), under a hard deadline, and the temp tree is removed. It never touches a receipt.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { shellDiff } from '../plugin/scripts/host-shell-boundary.mjs';
+
+export const BOOT_REASON_PREFIX = 'boot-level declarations changed: ';
+export const PROVABLE_PATHS = Object.freeze(['hooks/codex-hooks.json', 'hooks/hooks.json', 'skills/',
+  'scripts/hook-shim.mjs', 'mcp/server.mjs']);
+const MAX_CAPTURE = 64 * 1024;
+
+/** The changed paths a machine-generated sessionSafetyReason names, or [] when it names none. */
+export function parseChangedPaths(reason) {
+  if (typeof reason !== 'string' || !reason.startsWith(BOOT_REASON_PREFIX)) return [];
+  return reason.slice(BOOT_REASON_PREFIX.length).split(', ').map((entry) => entry.trim()).filter(Boolean);
+}
+
+/** The hook roles a Codex hooks file registers: the id after the timeout in each `... <timeoutMs> <role> [event]` command. */
+export function registeredCodexRoles(hooksFile) {
+  const parsed = JSON.parse(fs.readFileSync(hooksFile, 'utf8'));
+  const roles = new Set();
+  for (const groups of Object.values(parsed.hooks || {})) {
+    for (const group of groups) {
+      for (const handler of group.hooks || []) {
+        const match = /"\s+\d+\s+([a-z][a-z0-9-]*)(?:\s+\S+)?\s*$/.exec(String(handler.command || ''));
+        if (match) roles.add(match[1]);
+      }
+    }
+  }
+  return [...roles];
+}
+
+// Windows cannot start node (or resolve DLLs, temp, shells) without these; copied only when present, never a secret.
+const WINDOWS_NEEDS = ['SystemRoot', 'windir', 'ComSpec', 'PATHEXT'];
+const IS_WIN = process.platform === 'win32';
+
+/** SIGKILL the probe's whole process group (it is spawned detached, so it leads one); the child alone on Windows. */
+function killTree(child) {
+  try {
+    if (!IS_WIN && Number.isInteger(child?.pid) && child.pid > 1) process.kill(-child.pid, 'SIGKILL');
+    else child?.kill('SIGKILL');
+  } catch { try { child?.kill('SIGKILL'); } catch { /* gone */ } }
+}
+
+export function isolatedEnv(tmp, extra = {}, source = process.env) {
+  const needs = {};
+  for (const name of WINDOWS_NEEDS) if (source[name]) needs[name] = source[name];
+  const env = { ...needs, PATH: source.PATH || source.Path || '', HOME: tmp, USERPROFILE: tmp, TMPDIR: tmp,
+    RUVNET_BRAIN_HOME: path.join(tmp, 'brain'), RUVNET_BRAIN_STATE_DIR: path.join(tmp, 'state'),
+    XDG_CACHE_HOME: path.join(tmp, 'xdg'), XDG_CONFIG_HOME: path.join(tmp, 'xdgc'), CODEX_HOME: path.join(tmp, 'codex'),
+    RUVNET_BRAIN_KB: path.join(tmp, 'kb'), RUVNET_NIGHTLY: '', ...extra };
+  if (IS_WIN) { env.TEMP = tmp; env.TMP = tmp; }   // USERPROFILE is already the isolated tmp; TEMP/TMP must not point at the real profile
+  return env;
+}
+
+function runBounded(args, { cwd, env, timeoutMs }) {
+  return new Promise((resolve) => {
+    let out = ''; let err = ''; let timedOut = false; let settled = false;
+    const child = spawn(process.execPath, args, { cwd, env, detached: !IS_WIN, windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] });
+    const finish = (result) => { if (settled) return; settled = true; clearTimeout(timer); resolve({ stdout: out, stderr: err, timedOut, ...result }); };
+    const timer = setTimeout(() => { timedOut = true; killTree(child); }, timeoutMs);
+    child.stdout.on('data', (b) => { if (out.length < MAX_CAPTURE) out += b; });
+    child.stderr.on('data', (b) => { if (err.length < MAX_CAPTURE) err += b; });
+    child.once('error', (error) => finish({ code: null, signal: null, spawnError: error.message }));
+    child.once('close', (code, signal) => { killTree(child); finish({ code, signal }); });
+  });
+}
+
+/** Run the INSTALLED shim with an id it does not know. Proven only by exit 0 plus a role list covering every registered role. */
+export async function runShimProbe({ installedRoot, roles, tmp, timeoutMs }) {
+  const shim = path.join(installedRoot, 'scripts', 'hook-shim.mjs');
+  const started = Date.now();
+  const run = await runBounded([shim, 'boot-surface-proof-unknown-hook'], { cwd: tmp, env: isolatedEnv(tmp), timeoutMs });
+  const elapsedMs = Date.now() - started;
+  if (run.timedOut) return { ok: false, elapsedMs, reason: `the installed hook shim did not exit within ${timeoutMs} ms and was killed` };
+  if (run.spawnError) return { ok: false, elapsedMs, reason: `the installed hook shim could not start: ${run.spawnError}` };
+  if (run.code !== 0) return { ok: false, elapsedMs, reason: `the installed hook shim exited ${run.code ?? run.signal} for an unknown hook id (expected 0)` };
+  const listed = /known:\s*([^\n]*)/.exec(run.stderr)?.[1]?.split(',').map((s) => s.trim()).filter(Boolean) || [];
+  const missing = roles.filter((role) => !listed.includes(role));
+  if (!listed.length) return { ok: false, elapsedMs, reason: 'the installed hook shim listed no hook roles' };
+  if (missing.length) return { ok: false, elapsedMs, listed, reason: `the installed hook shim does not list registered Codex role(s): ${missing.join(', ')}` };
+  return { ok: true, elapsedMs, rolesListed: listed.length, rolesRegistered: roles.length };
+}
+
+const STUB_WORKER = "require('node:fs').writeFileSync(process.env.RNB_PROOF_MARKER,String(process.pid));process.exit(0);\n";
+
+/** Real stdio MCP handshake against the INSTALLED server: initialize, tools/list. Never starts the real search worker. */
+export async function runMcpProbe({ installedRoot, tmp, timeoutMs }) {
+  const server = path.join(installedRoot, 'mcp', 'server.mjs');
+  const stub = path.join(tmp, 'stub-worker.cjs'); const marker = path.join(tmp, 'worker-started');
+  fs.writeFileSync(stub, STUB_WORKER);
+  const env = isolatedEnv(tmp, { RUVNET_BRAIN_CHILD_MCP: stub, RNB_PROOF_MARKER: marker });
+  const started = Date.now();
+  return await new Promise((resolve) => {
+    let buffer = ''; let settled = false; let timedOut = false;
+    const replies = new Map(); let stderr = '';
+    const child = spawn(process.execPath, [server], { cwd: tmp, env, detached: !IS_WIN, windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'] });
+    const kill = () => killTree(child);
+    const deadline = setTimeout(() => { timedOut = true; kill(); }, timeoutMs);
+    const send = (message) => { try { child.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', ...message })}\n`); } catch { /* exit handler reports */ } };
+    const done = (result) => { if (settled) return; settled = true; clearTimeout(deadline); resolve({ elapsedMs: Date.now() - started, ...result }); };
+    child.stdout.on('data', (chunk) => {
+      buffer += chunk;
+      let at;
+      while ((at = buffer.indexOf('\n')) >= 0) {
+        const line = buffer.slice(0, at); buffer = buffer.slice(at + 1);
+        let message; try { message = JSON.parse(line); } catch { continue; }
+        if (message.id !== undefined) replies.set(message.id, message);
+        if (message.id === 1) { send({ method: 'notifications/initialized' }); send({ id: 2, method: 'tools/list', params: {} }); }
+        if (message.id === 2) {
+          // initialize launches the warm search worker in the background (plugin/mcp/server.mjs `void ensureChild()`); the
+          // stub worker records that it was launched, so the result reports the fact instead of assuming it.
+          setTimeout(() => { try { child.stdin.end(); } catch { /* gone */ } }, 400);
+        }
+      }
+    });
+    child.stderr.on('data', (b) => { if (stderr.length < MAX_CAPTURE) stderr += b; });
+    child.once('error', (error) => done({ ok: false, reason: `the installed MCP server could not start: ${error.message}` }));
+    child.once('close', (code, signal) => {
+      killTree(child);
+      const leaseLeft = fs.existsSync(path.join(tmp, 'brain', 'leases')) && fs.readdirSync(path.join(tmp, 'brain', 'leases')).length > 0;
+      const initialize = replies.get(1); const list = replies.get(2);
+      const workerStarted = fs.existsSync(marker);
+      const base = { exit: code ?? signal, leaseLeftBehind: leaseLeft, initializeStartsWarmWorker: workerStarted };
+      if (timedOut) return done({ ok: false, ...base, reason: `the installed MCP server did not finish an initialize + tools/list within ${timeoutMs} ms and was killed` });
+      if (!initialize?.result) return done({ ok: false, ...base, reason: 'the installed MCP server did not answer initialize' });
+      const names = Array.isArray(list?.result?.tools) ? list.result.tools.map((tool) => tool?.name) : null;
+      if (!names) return done({ ok: false, ...base, reason: 'the installed MCP server did not answer tools/list' });
+      if (!names.includes('search_ruvnet')) return done({ ok: false, ...base, tools: names, reason: 'the installed MCP server tools/list does not include search_ruvnet' });
+      if (leaseLeft) return done({ ok: false, ...base, tools: names, reason: 'the installed MCP server left its lease file behind after exit' });
+      return done({ ok: true, ...base, tools: names.length });
+    });
+    send({ id: 1, method: 'initialize', params: { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'boot-surface-proof', version: '1' } } });
+  });
+}
+
+/**
+ * @param {object} o
+ * @param {string[]} o.changedPaths        paths the convergence receipt names as changed at boot level
+ * @param {string} o.releasedPluginRoot    the release being converged to (its plugin/ directory)
+ * @param {string} o.installedPluginRoot   the plugin tree Codex loads (its plugin cache for the active version)
+ * @param {object} [o.declarations]        a probeFreshCodexDeclarations() result; required for the declaration paths
+ */
+export async function proveCodexBootSurface({ changedPaths, releasedPluginRoot, installedPluginRoot, declarations = null, timeoutMs = 15_000 } = {}) {
+  const proven = []; const unproven = [];
+  const result = (extra = {}) => ({ ok: !extra.error && changedPaths?.length > 0 && unproven.length === 0,
+    state: !extra.error && changedPaths?.length > 0 && unproven.length === 0 ? 'boot-surface-ready' : 'boot-surface-unproven',
+    scope: 'fresh-codex-boot-surface', changed: changedPaths || [], proven, unproven,
+    reason: extra.error || (unproven.length ? unproven.map((u) => `${u.path}: ${u.reason}`).join('; ') : null),
+    existingWindows: 'unproven', hostRelaunch: 'not-observed', inferenceRequests: 0, ...extra.detail });
+  if (!Array.isArray(changedPaths) || !changedPaths.length) return result({ error: 'no changed boot-level paths are recorded, so there is nothing to prove' });
+  if (!releasedPluginRoot || !installedPluginRoot) return result({ error: 'the released or installed plugin root is unknown' });
+  let diff;
+  try { diff = new Set(shellDiff(installedPluginRoot, releasedPluginRoot)); }
+  catch (error) { return result({ error: `the installed and released plugin trees could not be compared: ${error.message}` }); }
+  const identical = (rel) => !diff.has(rel);
+  const declarationsReady = declarations?.ok === true && declarations.state === 'fresh-declarations-ready';
+  const wants = (rel) => changedPaths.includes(rel);
+  let tmp = null; let shim = null; let mcp = null;
+  try {
+    if (wants('scripts/hook-shim.mjs') || wants('mcp/server.mjs')) {
+      tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'rnb-boot-proof-'));
+      for (const dir of ['brain', 'state', 'xdg', 'xdgc', 'codex', 'kb']) fs.mkdirSync(path.join(tmp, dir), { recursive: true });
+    }
+    for (const rel of changedPaths) {
+      if (!PROVABLE_PATHS.includes(rel)) { unproven.push({ path: rel, reason: 'no prover exists for this path; it stays unproven' }); continue; }
+      if (rel === 'hooks/codex-hooks.json' || rel === 'hooks/hooks.json') {
+        if (declarationsReady) proven.push({ path: rel, evidence: 'fresh-declarations-ready' });
+        else unproven.push({ path: rel, reason: `fresh Codex hook declarations are not proven${declarations?.reason ? ` (${declarations.reason})` : ''}` });
+      } else if (rel === 'skills/') {
+        if (!identical(rel)) unproven.push({ path: rel, reason: 'the installed skills/ tree is not byte-identical to the release' });
+        else if (!declarationsReady) unproven.push({ path: rel, reason: `fresh Codex declarations are not proven${declarations?.reason ? ` (${declarations.reason})` : ''}` });
+        else proven.push({ path: rel, evidence: 'byte-identical skills/ tree plus fresh-declarations-ready' });
+      } else if (rel === 'scripts/hook-shim.mjs') {
+        if (!identical(rel)) { unproven.push({ path: rel, reason: 'the installed hook shim is not byte-identical to the release' }); continue; }
+        let roles;
+        try { roles = registeredCodexRoles(path.join(installedPluginRoot, 'hooks', 'codex-hooks.json')); }
+        catch (error) { unproven.push({ path: rel, reason: `the registered Codex roles could not be read: ${error.message}` }); continue; }
+        shim = await runShimProbe({ installedRoot: installedPluginRoot, roles, tmp, timeoutMs });
+        if (shim.ok) proven.push({ path: rel, evidence: `byte-identical; real run exited 0 and listed all ${shim.rolesRegistered} registered Codex roles` });
+        else unproven.push({ path: rel, reason: shim.reason });
+      } else if (rel === 'mcp/server.mjs') {
+        if (!identical(rel)) { unproven.push({ path: rel, reason: 'the installed MCP server is not byte-identical to the release' }); continue; }
+        mcp = await runMcpProbe({ installedRoot: installedPluginRoot, tmp, timeoutMs });
+        if (mcp.ok) proven.push({ path: rel, evidence: `byte-identical; real stdio initialize + tools/list returned ${mcp.tools} tools including search_ruvnet` });
+        else unproven.push({ path: rel, reason: mcp.reason });
+      }
+    }
+  } finally {
+    if (tmp) { try { fs.rmSync(tmp, { recursive: true, force: true }); } catch { /* best effort */ } }
+  }
+  return result({ detail: { ...(shim ? { shim } : {}), ...(mcp ? { mcp } : {}) } });
+}

package/scripts/onboarding-console.mjs

@@ -64,7 +64,7 @@ import {
 } from '../kb/brain-profile.mjs';
 // Lessons: read model + the two user verbs. Every mutation goes through lesson-store's own
 // updateLessons/ratify/demote/restore — this file adds a SURFACE, never a second writer.
-import { loadLessons, updateLessons, ratify, demote, restore, pending, weightOf, TRIGGERS, ENFORCEMENT, ORIGIN, SOURCE_CLASS, STATUS } from './lesson-store.mjs';
+import { loadLessons, lessonApplies, projectNameFor, STORE_PATH as LESSON_STORE_PATH, updateLessons, ratify, demote, restore, pending, weightOf, TRIGGERS, ENFORCEMENT, ORIGIN, SOURCE_CLASS, STATUS } from './lesson-store.mjs';
 import {
   openRouterCredentialStatus,
   saveOpenRouterCredential,
@@ -1401,6 +1401,8 @@ function setLesson(body) {
 // --refresh-cache child. A request never scans — not inline on a first-ever run, and not via
 // setImmediate either (deferring synchronous work still blocks the loop when it runs). A machine with
 // no fleet scan yet is reported `warming`, never as a fabricated zero.
+// #500: bump when the meaning of the cached fleet changes. 2 = one entry per resolved store; 3 = + stable `id`.
+const ACTIVITY_CACHE_SCHEMA = 3; // 3 = each project also carries `id`, the store's dev:inode identity
 let ACTIVITY_MACHINE_CACHE = null;
 const CONSOLE_CACHE_PATH = path.join(CONSOLE_ROOT, '.cache/ruvnet-brain/console-cache.json');
 
@@ -1862,7 +1864,9 @@ function loadConsoleCache() {
   let restored = false;
   try {
     const j = JSON.parse(fs.readFileSync(CONSOLE_CACHE_PATH, 'utf8'));
-    if (j.activity && j.activity.at) { ACTIVITY_MACHINE_CACHE = j.activity; restored = true; }
+    // #500: a cache written before the fleet scan deduped by store identity can hold one database
+    // counted twice (a nested docs/adr/.swarm beside its parent). Never trust it — re-measure.
+    if (j.activity && j.activity.at && j.activity.schema === ACTIVITY_CACHE_SCHEMA) { ACTIVITY_MACHINE_CACHE = j.activity; restored = true; }
     if (j.trust && j.trust.at) { TRUST_CACHE = j.trust; restored = true; }
   } catch { /* no cache yet — first ever boot */ }
   return restored;
@@ -1896,7 +1900,7 @@ function saveConsoleCache() {
 function adoptFleetFromDisk() {
   try {
     const j = readJSON(CONSOLE_CACHE_PATH);
-    if (j && j.activity && j.activity.at && (!ACTIVITY_MACHINE_CACHE || j.activity.at > ACTIVITY_MACHINE_CACHE.at)) {
+    if (j && j.activity && j.activity.at && j.activity.schema === ACTIVITY_CACHE_SCHEMA && (!ACTIVITY_MACHINE_CACHE || j.activity.at > ACTIVITY_MACHINE_CACHE.at)) {
       ACTIVITY_MACHINE_CACHE = j.activity;
     }
   } catch { /* no cache yet — the caller kicks a child and reports `warming` */ }
@@ -1912,8 +1916,10 @@ function refreshFleetCache() {
       // pathIdentity, not path.resolve: resolve() normalises `.`/`..` and nothing else, so a project
       // reached through a symlink OR through the other capitalisation of a case-insensitive volume
       // was two distinct strings for one directory, and its memories were summed twice (#107).
-      const resolved = pathIdentity(s.project) ?? path.resolve(s.project);
-      if (seen.has(resolved)) continue; // a project visible under two roots counts once
+      // #500: dedupe on the DATABASE, which is what holds the memories. Two directories (a repo and its
+      // nested docs/adr/.swarm, or a linked worktree) can resolve to one store; project paths differ.
+      const resolved = pathIdentity(s.db) ?? path.resolve(s.db);
+      if (seen.has(resolved)) continue; // a store visible twice counts once
       seen.add(resolved);
       const n = Number(robustRead(s.db, "SELECT COUNT(*) FROM memory_entries WHERE status='active'").value || 0);
       if (n > 0) {
@@ -1922,17 +1928,25 @@ function refreshFleetCache() {
         const lastTouched = Number(robustRead(s.db, 'SELECT MAX(updated_at) FROM memory_entries').value || 0);
         // rel = the root-relative path — the SAME key reconcile:<id> recommendations use (wiringSurvey
         // computes projName the same way, relative to whichever root the project was found under).
-        projects.push({ name: path.basename(s.project), rel: path.relative(root, s.project), memories: n, lastTouched });
+        // Name from the RESOLVED project root. A linked worktree whose main checkout lies outside this
+        // scan root would give a '..'-prefixed rel, but reconcile:<id> keys (wiringSurvey) are relative to
+        // the directory found under the root — so fall back to the found directory in that case.
+        const inRoot = path.relative(root, s.project);
+        const rel = (inRoot === '' || inRoot.startsWith('..') || path.isAbsolute(inRoot)) ? path.relative(root, s.found || s.project) : inRoot;
+        // `id` = the store's own dev:inode identity (pathIdentity follows symlinks and sees hard links), so a
+        // client can tell WHICH project is "you" without comparing folder names (two repos can share one).
+        projects.push({ id: resolved, name: path.basename(s.project), rel, memories: n, lastTouched });
         total += n;
       }
     }
   }
   projects.sort((a, b) => b.memories - a.memories);
-  ACTIVITY_MACHINE_CACHE = { at: Date.now(), projects, totalMemories: total };
+  ACTIVITY_MACHINE_CACHE = { schema: ACTIVITY_CACHE_SCHEMA, at: Date.now(), projects, totalMemories: total };
   saveConsoleCache();
 }
-function findMemoryStores(root) {
+export function findMemoryStores(root) {
   const out = [];
+  const seenDb = new Set();
   const walk = (dir, depth) => {
     if (depth > 3) return;
     let ents; try { ents = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
@@ -1944,8 +1958,12 @@ function findMemoryStores(root) {
         // Fleet activity is project memory, so resolve the canonical store rather than selecting a
         // coordination database by size. The latter is diagnostic-only and can contain unrelated rows.
         try {
-          const resolved = resolveProjectStore({ projectDir: dir }).canonicalAgentDbPath;
-          if (fs.existsSync(resolved)) out.push({ project: dir, db: resolved });
+          const store = resolveProjectStore({ projectDir: dir });
+          const resolved = store.canonicalAgentDbPath;
+          // #500: record the RESOLVED project root and one entry per database. A nested docs/adr/.swarm
+          // resolves to its parent's store; recording `dir` listed that one database twice.
+          const id = pathIdentity(resolved) ?? path.resolve(resolved);
+          if (fs.existsSync(resolved) && !seenDb.has(id)) { seenDb.add(id); out.push({ project: store.projectRoot, found: dir, db: resolved }); }
         } catch { /* an unresolvable directory is not a project store */ }
         continue;
       }
@@ -1956,6 +1974,38 @@ function findMemoryStores(root) {
   walk(root, 0);
   return out;
 }
+// #499: approved lessons are the ratified rules in the lesson store (the SAME active rule as
+// gatherLessons().counts.active). `available:false` means the store could not be read — unknown, never 0.
+//   count      = machine-wide (every ratified/active, non-demoted lesson)
+//   applicable = the subset that applies to THIS project, by the SAME rule plugin/scripts/lesson-gate.mjs
+//                uses (lesson-store.lessonApplies): unscoped, or scoped to this project, or proven in >=2 projects.
+//   items      = per-lesson id/title/scope/enforcement/status for the applicable ones, bounded (the metadata
+//                the reporter asked to keep), `itemsTruncated` says when the bound cut the list.
+const APPROVED_ITEMS_MAX = 25;
+function approvedLessonsFigure(here) {
+  try {
+    // loadLessons() swallows a parse failure and returns [] — which would read as "0 approved". A file
+    // that exists but does not parse is UNKNOWN; only an absent file is a true zero.
+    if (fs.existsSync(LESSON_STORE_PATH)) JSON.parse(fs.readFileSync(LESSON_STORE_PATH, 'utf8'));
+    const approved = loadLessons().filter((l) => (l.status === STATUS.RATIFIED || l.status === STATUS.ACTIVE) && !l.demoted);
+    const mine = approved.filter((l) => lessonApplies(l, here)); // the gate's own rule (lesson-store.lessonApplies)
+    const items = mine.slice(0, APPROVED_ITEMS_MAX).map((l) => {
+      const ps = Array.isArray(l.projects) ? l.projects : [];
+      const text = String(l.statement || '');
+      return { id: l.id, title: text.length > 140 ? `${text.slice(0, 139)}…` : text,
+        scope: ps.length ? ps.join(', ') : 'all projects', enforcement: l.enforcement ?? null,
+        ratified: l.status === STATUS.RATIFIED || l.status === STATUS.ACTIVE, status: l.status };
+    });
+    return { available: true, count: approved.length, applicable: mine.length, items, itemsTruncated: mine.length > items.length };
+  } catch { return { available: false, count: null, applicable: null, items: [], itemsTruncated: false }; }
+}
+// #499: a count that could not be read is null, not 0 — "0" would claim the store is empty.
+function readCount(db, sql) {
+  const r = robustRead(db, sql);
+  if (!r.ok) return null;
+  const n = Number(r.value ?? 0);
+  return Number.isFinite(n) ? n : null;
+}
 function gatherActivity(cwd) {
   let project;
   let db;
@@ -1965,19 +2015,27 @@ function gatherActivity(cwd) {
     db = resolved.canonicalAgentDbPath;
   } catch {
     const measuredAt = new Date().toISOString();
-    return { generatedAt: measuredAt, project: path.basename(cwd), hasStore: false, continuity: 'unavailable', ...freshnessOf(measuredAt) };
+    return { generatedAt: measuredAt, project: path.basename(cwd), hasStore: false, continuity: 'unavailable', approvedLessons: approvedLessonsFigure(projectNameFor(cwd)), ...freshnessOf(measuredAt) };
   }
   if (!fs.existsSync(db)) {
     // No store to read — the existence check above IS the entire measurement, so it IS the
     // observation instant. Stamped here, not with a value taken before the check ran.
     const measuredAt = new Date().toISOString();
-    return { generatedAt: measuredAt, project: path.basename(project), hasStore: false, ...freshnessOf(measuredAt) };
+    return { generatedAt: measuredAt, project: path.basename(project), hasStore: false, approvedLessons: approvedLessonsFigure(path.basename(project)), ...freshnessOf(measuredAt) };
   }
-  const out = { project: path.basename(project), hasStore: true };
+  // projectId = the same dev:inode identity the fleet entries carry, so the client matches on identity, not the folder name.
+  const out = { project: path.basename(project), projectId: pathIdentity(db) ?? path.resolve(db), hasStore: true, approvedLessons: approvedLessonsFigure(path.basename(project)) };
   const rows = (sql) => robustReadJSON(db, sql).rows;
+  const agentdbLessons = readCount(db, "SELECT COUNT(*) FROM memory_entries WHERE namespace='lessons' AND status='active'");
   out.totals = {
-    memories: Number(robustRead(db, "SELECT COUNT(*) FROM memory_entries WHERE status='active'").value || 0),
-    lessons: Number(robustRead(db, "SELECT COUNT(*) FROM memory_entries WHERE namespace='lessons' AND status='active'").value || 0),
+    memories: readCount(db, "SELECT COUNT(*) FROM memory_entries WHERE status='active'"),
+    agentdbLessons,
+    lessons: agentdbLessons, // legacy alias of agentdbLessons
+    // #499: the learning pipeline's OWN measurements (null = unreadable, shown as Unknown, never 0). Distillation
+    // writes patterns/episodes, never `lessons` rows; observations are the namespace it mines.
+    observations: readCount(db, "SELECT COUNT(*) FROM memory_entries WHERE namespace='learning-observations' AND status='active'"),
+    patterns: readCount(db, 'SELECT COUNT(*) FROM reasoning_patterns'),
+    episodes: readCount(db, 'SELECT COUNT(*) FROM episodes'),
   };
   out.lessons = rows("SELECT key, access_count, date(created_at/1000,'unixepoch') AS learned, substr(content,1,600) AS excerpt FROM memory_entries WHERE namespace='lessons' AND status='active' ORDER BY created_at DESC");
   out.recent = rows("SELECT key, namespace, type, datetime(updated_at/1000,'unixepoch','localtime') AS at FROM memory_entries WHERE status='active' ORDER BY updated_at DESC LIMIT 18");
@@ -3550,6 +3608,9 @@ export {
   saveBrainProfile,
   setLesson,
   gatherLessons,
+  gatherActivity,
+  refreshFleetCache,
+  loadConsoleCache,
   gatherRouterEngine,
   autoEligibleIds,
   gatherConfig,

package/scripts/recall-latency-probe.mjs

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+/**
+ * Measures the real hook paths against a real store (#429): prompt-time recall() and SessionStart restore().
+ *   node scripts/recall-latency-probe.mjs --project <repo> [--runs N]
+ * Prints per-run milliseconds, outcome and `uptime` (machine load). Exit 1 unless EVERY prompt recall is
+ * ok-with-results / ok-empty within 1900 ms and EVERY restore is 'restored' within 3500 ms. The thresholds are
+ * the product's budgets, not tuned to the machine.
+ */
+import { execFileSync } from 'node:child_process';
+import path from 'node:path';
+import { recall } from '../plugin/scripts/agentdb-recall.mjs';
+import { restore } from '../plugin/scripts/ruflo-memory-hooks.mjs';
+
+export const RECALL_LIMIT_MS = 1900;
+export const RESTORE_LIMIT_MS = 3500;
+const PROMPT = 'Where are we on the recall latency work? Catch me up on the last decision.';
+
+const argValue = (name) => { const at = process.argv.indexOf(name); return at >= 0 ? process.argv[at + 1] : undefined; };
+const uptime = () => { try { return execFileSync('uptime', { encoding: 'utf8' }).trim(); } catch { return 'uptime unavailable'; } };
+
+async function main() {
+  const project = argValue('--project');
+  const runs = Number(argValue('--runs') ?? 5);
+  if (!project || !Number.isInteger(runs) || runs < 1) {
+    console.error('usage: recall-latency-probe.mjs --project <repo> [--runs N]');
+    process.exit(2);
+  }
+  const dir = path.resolve(project);
+  let failures = 0;
+  for (let run = 1; run <= runs; run += 1) {
+    const t0 = Date.now();
+    const r = await recall({ prompt: PROMPT, projectDir: dir });
+    const recallMs = Date.now() - t0;
+    const recallOk = ['ok-with-results', 'ok-empty'].includes(r.outcome) && recallMs <= RECALL_LIMIT_MS;
+    const t1 = Date.now();
+    const s = await restore({ cwd: dir });
+    const restoreMs = Date.now() - t1;
+    const restoreOk = s.status === 'restored' && restoreMs <= RESTORE_LIMIT_MS;
+    if (!recallOk) failures += 1;
+    if (!restoreOk) failures += 1;
+    console.log(`run ${run}: recall ${recallMs} ms ${r.outcome}${r.status?.['memory.db'] && r.outcome !== 'ok-with-results' ? ` [${r.status['memory.db']}]` : ''}${r.reason ? ` (${r.reason})` : ''} ${recallOk ? 'PASS' : 'FAIL'}`
+      + ` | restore ${restoreMs} ms ${s.status} ${restoreOk ? 'PASS' : 'FAIL'} | ${uptime()}`);
+  }
+  console.log(failures ? `FAIL: ${failures} of ${runs * 2} measurements outside budget (recall <= ${RECALL_LIMIT_MS} ms, restore <= ${RESTORE_LIMIT_MS} ms)`
+    : `PASS: all ${runs * 2} measurements within budget`);
+  process.exit(failures ? 1 : 0);
+}
+await main();

package/scripts/release-qualification-contract.mjs

@@ -345,6 +345,15 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
       "reason": "Complete outbox tails replay and accepted pending journal events survive capacity pressure without silent deletion",
       "files": [
       ]
+    },
+    {
+      "id": "open-issue-fixes-4-7-22",
+      "reason": "Reporter-filed defects stay fixed: completion evidence never binds a masked or negated check and a masked check is an advisory, not a false 'no check ran' stop; the boot surface of a recovered Codex host is proven per changed path; Console fleet and lesson counts match by store identity and never show unknown as zero; one project-scope rule is shared by the lesson gate and the Console; a refused or unreadable memory restore is reported as such and an aborted Ruflo call leaves no child process",
+      "files": [],
+      "platformFiles": {
+        "linux": ["tests/unit/continuation-gate-codex-transcript.test.mjs", "tests/unit/codex-boot-surface-proof.test.mjs", "tests/unit/console-activity-fleet-dedupe.test.mjs", "tests/unit/console-activity-identity.test.mjs", "tests/unit/console-activity-lessons.test.mjs", "tests/unit/lesson-gate.test.mjs", "tests/unit/ruflo-memory-session.test.mjs"],
+        "macos": ["tests/unit/continuation-gate-codex-transcript.test.mjs", "tests/unit/codex-boot-surface-proof.test.mjs", "tests/unit/console-activity-fleet-dedupe.test.mjs", "tests/unit/console-activity-identity.test.mjs", "tests/unit/console-activity-lessons.test.mjs", "tests/unit/lesson-gate.test.mjs", "tests/unit/ruflo-memory-session.test.mjs"]
+      }
     }
   ],
   "integration": [
@@ -441,6 +450,15 @@ export const RELEASE_REQUIREMENTS = Object.freeze({
       "reason": "POSIX non-root permission refusal, capacity-pressure reporting and recovery preserve all accepted pending continuity events",
       "files": [
       ]
+    },
+    {
+      "id": "open-issue-fixes-4-7-22-integration",
+      "reason": "A named release over an existing install moves, skips truthfully or warns on a downgrade instead of reporting a false lookup failure; the Ruflo memory hooks honour the absolute deadline and abort, kill the whole child process group, and never report a refused or partly unreadable restore as restored",
+      "files": [],
+      "platformFiles": {
+        "linux": ["tests/integration/stale-install-trap.test.mjs", "tests/integration/ruflo-memory-hooks.test.mjs"],
+        "macos": ["tests/integration/stale-install-trap.test.mjs", "tests/integration/ruflo-memory-hooks.test.mjs"]
+      }
     }
   ]
 });

package/scripts/wired-check.mjs

@@ -226,6 +226,8 @@ const STANDALONE = [
     + 'starts themselves (--url http://127.0.0.1:.../page.html, via Playwright) — needs a live '
     + 'rendered page, not a static diff, so it is a dev-loop tool like gen-console-images.mjs, not a '
     + 'CI step'],
+  ['recall-latency-probe', 'human-run measurement (#429): times prompt recall and SessionStart restore against a real '
+    + 'project store and exits 1 outside the budgets; it reads the owner\'s live store and loads the machine, so no scheduler runs it'],
   ['dev-plugin-link', 'developer convenience CLI — its own header: "Users never run it." Hot-links '
     + 'the cached plugin install to the working tree so hook edits apply without a CC restart'],