session-orchestrator 3.17.0 → 3.20.0

package/scripts/lib/quality-gate.mjs

@@ -60,7 +60,10 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync } from '
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+import { emitEvent, sessionAttribution } from './events.mjs';
+import { admitSuiteCounts, extractTestCounts } from './gates/gate-helpers.mjs';
 import { redactDiagnosticsBundle } from './quality-gate/diagnostics.mjs';
+
 export { redactDiagnosticsBundle } from './quality-gate/diagnostics.mjs';
 
 // ---------------------------------------------------------------------------
@@ -361,6 +364,44 @@ export function detectSharedLibTouch(opts) {
   return { touched: matched.length > 0, paths: matched };
 }
 
+/**
+ * INPUT ADAPTER for this module's `counts` field (#954, #967 item 2).
+ *
+ * Holds NO admission policy of its own. Every verdict — including both
+ * rejections this function used to make itself — is delegated to
+ * {@link admitSuiteCounts}, the single policy shared with the CLI producer
+ * `suiteCountsFromGateStdout` (`scripts/run-quality-gate.mjs`). Before that
+ * convergence the two producers wrote the SAME event field under DIFFERENT
+ * rules (this one admitted `passed > total` and a negative `passed`), so a
+ * consumer had to know two policies to read one field.
+ *
+ * What stays here is the part the shared policy cannot see: the raw-text tail
+ * parse. `extractTestCounts` has no "did it match?" channel — it returns
+ * `0/0/0` both for "no `<N> passed` marker in the output" and for a genuinely
+ * empty run — so a text-less input is handed to the policy as `null` rather
+ * than as a zero triple, and the policy refuses it. The result is `null`, never
+ * a zero triple: `counts.failed === 0` means "measured, zero failures"; an
+ * ABSENT `counts` means "not measured".
+ *
+ * That null hand-over is ALSO how this adapter reports "the gate loop never
+ * reached the test step" (#969 MED-2). A `null` output fails the string check on
+ * the first line, so the positional evidence and the unparseable-text case land
+ * on the SAME channel the policy already has to check. The policy previously
+ * took a second `measured` boolean for the positional case; it was unreachable
+ * with a non-null triple precisely because this line runs first, and two ways to
+ * say "not measured" is one more than the field can be read with.
+ *
+ * @param {string|null} output — captured stdout+stderr tail from the test gate,
+ *   or `null` when the gate loop never reached the test step.
+ * @returns {{ passed: number, failed: number, total: number }|null}
+ */
+function suiteCountsFromOutput(output) {
+  if (typeof output !== 'string' || output.length === 0) {
+    return admitSuiteCounts(null);
+  }
+  return admitSuiteCounts(extractTestCounts(output));
+}
+
 /**
  * Coerce `maxRetries` to [0, MAX_RETRIES_HARD_CAP] integer.
  *
@@ -379,6 +420,97 @@ function coerceMaxRetries(n) {
 // Public API
 // ---------------------------------------------------------------------------
 
+/**
+ * Emit exactly one `orchestrator.quality_gate.{passed,failed}` event per
+ * `runQualityGateWithRetry` CALL (#928b).
+ *
+ * NO DOUBLE-COUNTING. The two gate paths never nest:
+ *   - `scripts/run-quality-gate.mjs` spawns `scripts/lib/gates/gate-*.mjs`
+ *     directly and does not import this module;
+ *   - this module spawns the resolved gate COMMANDS (and `parse-config.mjs`)
+ *     directly and does not invoke that wrapper.
+ * A single run therefore passes through exactly one emitter.
+ *
+ * Granularity is the CALL, not the attempt: the retry loop may run the gates
+ * up to `maxRetries + 1` times, but emitting per attempt would inflate every
+ * rate computed over these events. `attempts` carries that detail instead.
+ * `variant: 'auto-fix-loop'` distinguishes this path from the CLI's
+ * baseline/incremental/full-gate/per-file variants.
+ *
+ * The destination is pinned to the `repoRoot` this gate actually ran against,
+ * via the `opts.repoRoot` parameter (#941; formerly a hand-built `opts.filePath`
+ * recipe, #611). `emitEvent`'s BARE default resolution goes through the
+ * module-level `SO_PROJECT_DIR` constant, which ignores `repoRoot` entirely — so
+ * a caller running the gate against another tree (every unit test does, using a
+ * tmp `repoRoot`) would otherwise append synthetic records to the REAL repo's
+ * telemetry. That is not a test-hygiene nicety: injected `quality_gate.failed`
+ * records are exactly what `/eval`'s gate-health dimension reads, so the
+ * instrument would be scored against its own test fixtures.
+ *
+ * `counts` (#954) carries the suite numbers this gate already had in hand. It
+ * is OMITTED — never zero-filled — whenever the final attempt did not reach the
+ * test gate (fail-fast on lint/typecheck) or its output carried no parseable
+ * count. See {@link suiteCountsFromOutput}.
+ *
+ * IT DOES NOT YET REPLACE THE PROSE PATH (#957/F1 — the earlier wording here
+ * claimed it did). `waves[].suite_passed` / `suite_failed` still travel as prose
+ * through two LLM hops: `skills/wave-executor/wave-loop.md` step 7 hand-writes
+ * them, `skills/session-end/metrics-collection.md` § 1.7 parses them back out of
+ * the STATE.md Wave History header into sessions.jsonl. `counts` is a SECOND,
+ * machine-measured emission of the same fact, and as of 2026-07-31 it has zero
+ * readers (`grep -c '"counts"' .orchestrator/metrics/events.jsonl` → 0 across
+ * 4404 `orchestrator.quality_gate.*` records).
+ *
+ * Retiring the prose path needs a producer change no docblock can make:
+ * `waves[].*` is PER-WAVE, and gate events carry no `wave_number` (0 of those
+ * 4404 records). A session-end reader could only attribute a gate event to a
+ * wave by a wall-clock window whose own boundaries (`waves[].started_at` /
+ * `completed_at`) are themselves LLM-written — one LLM hop traded for another,
+ * against the posture `scripts/lib/eval/session-resolve.mjs` already documents
+ * for window-attributed gate events ("a contaminated window means
+ * gate-attribution is unsafe"). The concrete remaining work is named in
+ * `skills/session-end/metrics-collection.md` § 1.7.
+ *
+ * Note also that THIS emitter only runs under `verification-auto-fix.enabled:
+ * true` (default `false`, and `false` in this repo's Session Config). The gate
+ * that actually fires between waves is the `scripts/run-quality-gate.mjs`
+ * wrapper, which emits its own `counts` via `suiteCountsFromGateStdout` — under
+ * the SAME admission policy since #967 item 2 (`admitSuiteCounts`), so a
+ * consumer reads one field with one set of rules regardless of which producer
+ * wrote it.
+ *
+ * Extraction margin: {@link suiteCountsFromOutput} sees only the
+ * `OUTPUT_TAIL_LINES` (50) tail `runCheck` retains. Measured on `npm test`
+ * (vitest 2026-07-31), the `Tests` summary line sits 5 lines from the end — 45
+ * lines of headroom. A runner epilogue longer than that (coverage table, long
+ * unhandled-error dump) pushes the summary out of the window; `counts` is then
+ * omitted, which fails safe but is indistinguishable from "no test gate ran".
+ *
+ * Best-effort: never throws, never alters the gate verdict.
+ *
+ * @param {string} repoRoot
+ * @param {boolean} ok
+ * @param {number} attempts
+ * @param {string|null} gate
+ * @param {{passed: number, failed: number, total: number}|null} [counts]
+ */
+async function emitGateEvent(repoRoot, ok, attempts, gate, counts) {
+  try {
+    await emitEvent(
+      `orchestrator.quality_gate.${ok ? 'passed' : 'failed'}`,
+      {
+        variant: 'auto-fix-loop',
+        exit_code: ok ? 0 : 1,
+        attempts,
+        ...(gate ? { gate } : {}),
+        ...(counts ? { counts } : {}),
+        ...sessionAttribution(repoRoot),
+      },
+      { repoRoot },
+    );
+  } catch { /* best-effort telemetry — gate result is authoritative */ }
+}
+
 /**
  * Run quality gate (lint → typecheck → test, fail-fast), dispatching a fixer
  * callback on each failure up to `maxRetries` times.
@@ -421,6 +553,14 @@ export async function runQualityGateWithRetry(opts) {
   const allFailures = [];
   let attempt = 0;
   let lastFailure = null;
+  /**
+   * Suite counts observed in the CURRENT attempt only (#954). Re-assigned
+   * unconditionally after every attempt's gate loop, so a failure that
+   * fail-fasts on lint can never re-report a stale count from an earlier
+   * attempt's test run.
+   * @type {{passed: number, failed: number, total: number}|null}
+   */
+  let testCounts = null;
 
   // Total loop budget = maxRetries + 1 (one initial run + up to maxRetries fixer-driven retries).
   const totalAttempts = maxRetries + 1;
@@ -428,10 +568,30 @@ export async function runQualityGateWithRetry(opts) {
   while (attempt < totalAttempts) {
     attempt += 1;
     let gateFailure = null;
+    /**
+     * The test gate's captured output for THIS attempt — `null` until the
+     * `test` branch below assigns it, which happens only if the gate loop
+     * actually reaches the test step. A fail-fast on lint or typecheck leaves
+     * it `null`.
+     *
+     * That null-ness is the positional evidence {@link admitSuiteCounts}
+     * cannot observe for itself: the shared policy sees a candidate triple and
+     * nothing else, never the control flow that produced it. It reaches the
+     * policy AS the null triple {@link suiteCountsFromOutput} hands over, so an
+     * unmeasured gate can never publish a zero triple attributed to a run that
+     * never happened.
+     * @type {string|null}
+     */
+    let testOutput = null;
 
     for (const gate of GATE_ORDER) {
       const cmd = commands[gate];
       const result = runGate(cmd, repoRoot);
+      if (gate === 'test') {
+        // The numbers are in hand right here — capture them at the seam rather
+        // than letting them travel as prose (#954).
+        testOutput = result.output;
+      }
       if (result.exitCode === 0) {
         process.stderr.write(`🔁 quality-gate attempt ${attempt}/${totalAttempts} (gate=${gate}): pass\n`);
         continue;
@@ -449,9 +609,14 @@ export async function runQualityGateWithRetry(opts) {
       break;
     }
 
+    // Non-fatal by construction: an unmeasured, unparseable or inconsistent
+    // run yields null, which the emitter omits rather than zero-fills.
+    testCounts = suiteCountsFromOutput(testOutput);
+
     if (gateFailure === null) {
       // All gates passed this attempt.
       writeLastGreenSha(repoRoot);
+      await emitGateEvent(repoRoot, true, attempt, null, testCounts);
       return { ok: true, attempts: attempt };
     }
 
@@ -516,6 +681,8 @@ export async function runQualityGateWithRetry(opts) {
     `❌ quality-gate exhausted retries (${attempt}), writing diagnostics to ${bundlePath ?? '<unwritable>'}\n`,
   );
 
+  await emitGateEvent(repoRoot, false, attempt, lastFailure?.gate ?? null, testCounts);
+
   const out = {
     ok: false,
     attempts: attempt,

package/scripts/lib/recommendations-v0.mjs

@@ -26,7 +26,7 @@ const VALID_MODES = new Set([
  * @param {number} input.completionRate  — 0.00..1.00; share of planned issues closed
  * @param {number} input.carryoverRatio  — 0.00..1.00; carryover / planned (0 when planned=0)
  * @param {Array<number|string>} [input.carryoverIssues] — IDs/IIDs of carried-over issues,
- *   pre-sorted (priority:critical/high first, FIFO tiebreak). Sliced to 0-5 entries for
+ *   pre-sorted (priority::critical/high first, FIFO tiebreak). Sliced to 0-5 entries for
  *   the `priorities` field.
  * @returns {{mode: string, priorities: number[], rationale: string}}
  */

package/scripts/lib/reconcile/eligibility.mjs

@@ -135,7 +135,7 @@ export function classifyLearning(learning, { now, minInsightChars } = {}) {
   if (!Array.isArray(filePaths) || filePaths.length === 0) {
     return {
       eligible: false,
-      reason: `eligible type '${type}' but empty file_paths[] — cannot scope a conditional rule`,
+      reason: `eligible type '${type}' but empty file_paths[] — cannot scope a conditional rule (propose with --file-paths to make this convertible)`,
     };
   }
 

package/scripts/lib/reconcile/emitter.mjs

@@ -30,6 +30,7 @@
 
 import { dirname } from 'node:path';
 
+import { learningKeyOf } from '../learnings/kebab.mjs';
 import { deriveExpiresAt } from '../learnings/schema.mjs';
 
 const DAY_MS = 86400 * 1000;
@@ -44,34 +45,88 @@ const DESCRIPTION_MAX = 120;
 // shortens a healthy future one.
 const MIN_RULE_DAYS_DEFAULT = 7;
 
+// ── #1015: field-shape gates (VALIDATION, never transformation) ──────────────
+// This emitter REJECTS agent-authored values whose SHAPE cannot be serialised
+// into frontmatter safely. It deliberately does NOT escape or neutralise
+// content: neutralisation of agent text happens exactly once, in the renderer's
+// render path. Escaping here as well would double-escape the output — a defect
+// invisible to a file-level diff, because each file still looks locally correct.
+// Rejection is idempotent, so it composes safely with the renderer's sanitiser.
+
+/**
+ * Accepted shape for `learning.host_class`.
+ *
+ * `host-class` is by far the highest-escalation field this emitter copies: the
+ * renderer serialises it UNQUOTED as `host-class: <value>`, so a newline in it
+ * injects sibling TOP-LEVEL frontmatter keys. An injected `alwaysApply: true`
+ * plus `expires-at: 2099-01-01` converts a scoped, expiring auto-generated rule
+ * into a permanent always-on one — defeating BOTH the never-always-on
+ * brandmauer below AND the expiry sweep, because each of those inspects the
+ * emitter's in-memory values rather than the serialised document.
+ *
+ * `validateLearning` (scripts/lib/learnings/schema.mjs) only asserts "string or
+ * null" for this field — ANY string, newlines included — and
+ * `validateProposalRecord` performs no unknown-key rejection, so every key on a
+ * proposal record is spread verbatim into the learning
+ * (scripts/lib/memory-proposals/sink.mjs). That is the mechanism that makes an
+ * attacker-shaped `host_class` reachable at all; this gate is where it stops.
+ *
+ * The pattern admits every value `classifyHost()` in scripts/lib/host-identity.mjs
+ * can produce (`macos-arm64-m4pro`, `linux-x86_64`, `windows-arm64`,
+ * `<osName>-<arch>`) with generous headroom, and rejects everything that could
+ * alter frontmatter structure: control chars, whitespace, `:`, `#`, quotes, and
+ * a leading `-` (a YAML sequence marker). The 64-char ceiling bounds the emitted
+ * line; the longest real value today is 17 chars, so the ceiling is inert in
+ * practice. Revisit if a future host taxonomy needs richer tokens.
+ */
+const HOST_CLASS_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+
+// Characters that make a `file_paths[]` entry unsafe to serialise as a glob.
+// The renderer emits each glob as `  - "<value>"`, so a control char (a newline
+// above all) breaks out of the block sequence into new top-level frontmatter
+// keys, and a quote character breaks out of the quoted scalar. Entries carrying
+// either are SKIPPED — the same defense-in-depth posture as the
+// glob-metacharacter guard below, and for the same reason: this emitter also
+// processes learnings.jsonl records that predate the #900 argv/schema guards.
+const UNSAFE_PATH_QUOTE_RE = /["']/;
+
 // Control chars: C0 range (U+0000–U+001F, includes \n \r \t) plus DEL (U+007F).
 // A newline in frontmatter would corrupt the YAML parse — stripping these is
 // critical. Written with \u escapes so the source stays pure ASCII.
 // eslint-disable-next-line no-control-regex
 const CONTROL_CHARS_RE = /[\u0000-\u001F\u007F]/g;
 
-/**
- * Slugify a string into a stable kebab-case token.
- * Lowercases, collapses every run of non-`[a-z0-9]` chars into a single `-`,
- * and trims leading/trailing `-`. UUID subjects produce ugly-but-stable keys.
- *
- * @param {string} s
- * @returns {string}
- */
-function kebab(s) {
-  return String(s)
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, '-')
-    .replace(/^-+|-+$/g, '');
-}
+// Non-global twin of CONTROL_CHARS_RE for stateless `.test()` calls. A /g regex
+// carries `lastIndex` across calls, so testing with CONTROL_CHARS_RE directly
+// would alternate true/false on identical input. Derived from the same `.source`
+// so the two can never drift — and so this line stays pure ASCII (a literal
+// control char here would be a NUL-class corruption; see
+// .claude/rules/proven-pattern-nul-byte-corruption...).
+const CONTROL_CHARS_TEST_RE = new RegExp(CONTROL_CHARS_RE.source);
+
+// Glob metacharacters (issue #900-follow-up, Q3-MED). A top-level
+// (dirname==='.') file_paths entry is emitted AS THE GLOB ITSELF below — so a
+// stray '**' or '[ab]' entry (e.g. from an OLD learning record predating the
+// #900 C / schema.mjs argv-boundary guards) must never reach the renderer
+// verbatim, or it would produce an effectively always-on rule glob. Skipped
+// here as defense-in-depth even though the argv (memory-propose.mjs) and
+// schema (memory-proposals/schema.mjs) layers already reject these at write
+// time — this emitter also processes learnings.jsonl entries that predate
+// those guards.
+const GLOB_METACHAR_RE = /[*?[\]{}]/;
 
 /**
  * Derive non-empty directory globs from a learning's `file_paths`.
  *
  * For each path: take its directory (`path.dirname`) and emit `<dir>/**`. When
  * the file sits at the repo top level (`dirname` === '.'), emit the bare
- * basename pattern instead of `./**` (e.g. `"foo.mjs"`). Results are deduped,
- * order-preserving on first occurrence.
+ * basename pattern instead of `./**` (e.g. `"foo.mjs"`). Entries containing a
+ * glob metacharacter (`* ? [ ] { }`) are skipped entirely — see
+ * {@link GLOB_METACHAR_RE} — as are entries carrying a control char or a quote
+ * character, which would break out of the renderer's `  - "<glob>"` sequence
+ * item into new top-level frontmatter keys (#1015; see
+ * {@link CONTROL_CHARS_TEST_RE} / {@link UNSAFE_PATH_QUOTE_RE}). Results are
+ * deduped, order-preserving on first occurrence.
  *
  * @param {string[]} filePaths
  * @returns {string[]}
@@ -81,6 +136,10 @@ function globsFromFilePaths(filePaths) {
   const seen = new Set();
   for (const raw of filePaths) {
     if (typeof raw !== 'string' || raw === '') continue;
+    if (GLOB_METACHAR_RE.test(raw)) continue;
+    // #1015: frontmatter-structure guard. Skipping (never escaping) keeps this
+    // idempotent and non-overlapping with the renderer's sanitiser.
+    if (CONTROL_CHARS_TEST_RE.test(raw) || UNSAFE_PATH_QUOTE_RE.test(raw)) continue;
     const normalized = raw.replace(/\\/g, '/');
     const dir = dirname(normalized);
     const pattern = dir === '.' ? normalized : `${dir}/**`;
@@ -181,8 +240,13 @@ function computeExpiresAt(learning, ruleExpiryDays, now, minRuleDays) {
  * @param {object} [opts]
  * @param {number} [opts.ruleExpiryDays] - explicit expiry window in days; when a
  *   finite number, overrides the per-type TTL.
- * @param {number|Date} [opts.now] - injectable clock used ONLY as a fallback when
- *   `created_at` is missing/unparseable (keeps expiry deterministic in tests).
+ * @param {number|Date} [opts.now] - injectable clock (defaults to `Date.now()`).
+ *   Used for BOTH the born-dead expiry floor (`now + minRuleDays`, applied on
+ *   every call — see {@link computeExpiresAt}) and, secondarily, as the base
+ *   date when `created_at` is missing/unparseable. Because the floor consults
+ *   it unconditionally, any test asserting a literal `expiresAt` MUST inject
+ *   `now` — otherwise the wall clock eventually raises the floor past the
+ *   derived expiry and the assertion silently starts measuring the floor.
  * @param {number} [opts.minRuleDays] - floor window (days) applied to the
  *   emitted expiry so it never falls in the past — see
  *   {@link computeExpiresAt} and {@link MIN_RULE_DAYS_DEFAULT}. Defaults
@@ -199,6 +263,9 @@ function computeExpiresAt(learning, ruleExpiryDays, now, minRuleDays) {
  * }}
  * @throws {Error} when no activation axis can be produced (empty globs AND no
  *   hostClass) — the never-always-on invariant.
+ * @throws {Error} when the learning has no derivable `learning_key` (no usable
+ *   `type`, or no `title`/`subject` that slugs to a non-empty token) — a rule
+ *   whose key resolves to no learning is worse than no rule.
  */
 export function toActivationMetadata(learning, { ruleExpiryDays, now, minRuleDays } = {}) {
   if (learning === null || typeof learning !== 'object' || Array.isArray(learning)) {
@@ -208,10 +275,25 @@ export function toActivationMetadata(learning, { ruleExpiryDays, now, minRuleDay
   const filePaths = Array.isArray(learning.file_paths) ? learning.file_paths : [];
   const globs = globsFromFilePaths(filePaths);
 
-  const hostClass =
-    typeof learning.host_class === 'string' && learning.host_class !== ''
-      ? learning.host_class
-      : undefined;
+  // #1015: `host_class` is copied straight into an UNQUOTED `host-class:`
+  // frontmatter line by the renderer, so its SHAPE is load-bearing. Reject a
+  // malformed value loudly rather than degrade to "no host axis" — a
+  // structurally-invalid host_class is a corruption/injection signal, and
+  // silently emitting the rest of the rule from the same record would hide it.
+  // The engine wraps each learning in its own try/catch, so this throw degrades
+  // to ONE recorded rejection with an auditable reason, never a crashed run.
+  let hostClass;
+  if (typeof learning.host_class === 'string' && learning.host_class !== '') {
+    if (!HOST_CLASS_RE.test(learning.host_class)) {
+      throw new Error(
+        `emitter: host_class has an unsafe shape (${JSON.stringify(learning.host_class)}) — refusing to emit; ` +
+          'the renderer serialises it as an unquoted `host-class:` line, so a newline / colon / quote there ' +
+          'injects sibling top-level frontmatter keys (e.g. alwaysApply: true + a far-future expires-at), ' +
+          `defeating the never-always-on brandmauer and the expiry sweep. Expected ${HOST_CLASS_RE.source}.`,
+      );
+    }
+    hostClass = learning.host_class;
+  }
 
   // The brandmauer: an auto-generated rule must carry ≥1 activation axis. If we
   // could derive neither a glob nor a host-class, refuse — never emit always-on.
@@ -221,8 +303,30 @@ export function toActivationMetadata(learning, { ruleExpiryDays, now, minRuleDay
     );
   }
 
-  const subjectOrTitle = learning.title || learning.subject || '';
-  const learningKey = `${learning.type}/${kebab(subjectOrTitle)}`;
+  // THE key. Derived through the shared `learningKeyOf` so the writer and every
+  // reader (engine's rejection path, validate/check-learning-provenance,
+  // learnings/candidates dedupe, claude-md-drift-check) compute one identity
+  // from one rule. This line previously kebab'd the TYPE half, which no reader
+  // does: harmless while every live type is kebab-identical, and silently
+  // divergent in both directions the moment one is not — the writer stamps one
+  // key into `.claude/rules/*.md` + `reconcile-candidates.jsonl` while every
+  // reader computes another, so dedupe stops matching with nothing failing.
+  //
+  // The injection hazard that motivated the kebab is closed downstream and
+  // LOUDLY: the key becomes an unquoted `learning-key:` frontmatter scalar, and
+  // `renderer.mjs` asserts `LEARNING_KEY_RE` (`/^[a-z0-9/-]+$/`) on it before
+  // rendering. A type carrying a newline/colon/quote is therefore rejected with
+  // an auditable reason instead of being silently re-keyed here — the same
+  // reject-don't-degrade posture as the `host_class` guard above.
+  const learningKey = learningKeyOf(learning);
+  if (learningKey === null) {
+    throw new Error(
+      'emitter: unkeyable learning (no usable type, or no title/subject that slugs to a non-empty token) — ' +
+        'refusing to emit; `learning_key` is the dedupe identity, and a record without one would either ' +
+        'stamp a rule no reader can resolve back to a learning or collide with every other unkeyable record ' +
+        'of its type.',
+    );
+  }
 
   const confidence = typeof learning.confidence === 'number' ? learning.confidence : 0;