chore(release): auto-bump version to 0.161.0 — earned by # (minor: converged release (push-to-master bump))

Promotion record: (unknown)

.agents/skills/land/SKILL.md

@@ -0,0 +1,20 @@
+---
+name: land
+description: Review and land one small Rune change through the governed PR workflow.
+disable-model-invocation: true
+metadata:
+  delta-action: land
+---
+
+# Land one small diff
+
+1. Read applicable `AGENTS.md` rules and the repo's PR/merge workflow.
+2. Confirm the issue, exact diff, target branch, and permission to publish and land.
+3. Keep one small, reversible change; preserve unrelated work.
+4. For bugs, follow `docs/bugfix-contract.md`: red test first, root cause, discharge.
+5. Run required tests, static analysis, canaries, and henxels; record results.
+6. Get independent `/review` per `docs/adversarial-review.md`; clear blockers.
+7. Inspect remotes; publish the PR to the approved forge, never `local`.
+8. Require human approval and green required CI on the exact PR head; recheck changed heads.
+9. Load `report-landed`; use the repo's merge workflow. Stop on conflicts; never force-push or bypass hooks.
+10. Verify the target commit and CI, then report the actual landing result and remaining blockers.

.coveragerc

@@ -15,6 +15,9 @@
 # Canary files are omitted: src/rune/canary_*.py are standalone CI
 # verification scripts executed directly by the canary job, never imported by
 # the test suite — counting them would make the global floor a fiction.
+# ffi_query_memory_smoke.py is the same class: a standalone evidence script
+# driven directly (and by tests/test_ffi_query_memory_smoke.py when the cdylib
+# is built), never imported by the suite.
 
 [run]
 source = src/rune
@@ -22,6 +25,7 @@ omit =
     tests/*
     scripts/*
     src/rune/canary_*.py
+    src/rune/ffi_query_memory_smoke.py
 
 [report]
 fail_under = 29

.gitea/ISSUE_TEMPLATE/bug.md

@@ -1,16 +1,46 @@
 ---
 name: Bug Fix
-about: Fix a bug or issue
+about: Demonstrate currently incorrect behaviour — plain English first, proof required
 title: "[BUG] "
 labels: bug
 assignees: conductor
 ---
 
-## Plain summary
-<!-- 2-4 sentences, NON-TECHNICAL: what's broken and why it matters. -->
+<restate the issue title here in everyday words — this heading IS the
+plain-English summary; no meta-labels like "plain English" in it>
+<!-- The heading above carries the summary itself — a scan of issue
+     headings alone should tell the whole story of the board. TOP PRIORITY:
+     if a technical detail below contradicts this section, the issue is
+     buggy — fix the issue. -->
+<!-- SUBMITTED_BODY -->
 
-## Example
-<!-- A concrete before/after: "Doing X currently produces Y; it should produce Z." -->
+
+What is broken: <what a person observes going wrong>
+
+What should happen instead: <the correct behaviour>
+
+How often / when: <always | after X | since change Y>
+
+## Proof it is broken (required — no proof, no bug)
+<!-- A bug is DEMONSTRATED currently incorrect behaviour. Nothing else.
+     If this section cannot be filled, file it as a question, not a bug. -->
+- [ ] Reproduction command or steps (deterministic where possible)
+- [ ] The exact wrong output observed: <paste/log excerpt>
+- [ ] Where the evidence lives: <log path, fixture, session id>
+
+## Steps to reproduce
+<!-- How to trigger the bug -->
+
+## What would let us close this
+- [ ] The reproduction command now shows correct behaviour
+- [ ] A regression test exists that fails before the fix and passes after
+- [ ] No other behaviour changed (or changes are listed and justified)
+
+## Version impact (declared at submission — verified at merge)
+<!-- A bug fix is USUALLY a patch. Pick major or minor only with a reason. -->
+- [ ] patch — same behaviour, done correctly (usual for bugs)
+- [ ] major — the bug was in a published contract and fixing it breaks consumers (justify)
+- [ ] minor — fixing revealed a missing capability that had to be added (justify)
 
 ## Technical details
 <!-- WHAT (the bug) / WHERE (files) / EVIDENCE (how it was confirmed). -->
@@ -29,10 +59,6 @@ assignees: conductor
 - [ ] Canary passes (name)
 - [ ] Closed with a properly formatted closing comment + commit references
 
-## Steps to reproduce
-<!-- How to trigger the bug -->
-
-
 ## Cognitive invariants (memory/cognition issues — both handoffs)
 <!-- Complete ONLY if this issue touches memory, learning, or self-model state. -->
 - [ ] **Owner** — which existing subsystem owns this (audit before creating modules)

.gitea/ISSUE_TEMPLATE/feature.md

@@ -1,18 +1,44 @@
 ---
 name: Feature Request
-about: New feature or improvement — DESCRIPTION GATE v4 format (plain summary + pipeline requirements)
+about: New feature or improvement — plain English first, verifiable close conditions, version intent
 title: "[FEATURE] "
 labels: feature
 assignees: conductor
 ---
 
-## Plain summary
-<!-- 2-4 sentences, NON-TECHNICAL: what this does and why it matters. Nick should
-understand the goal without decoding internals. -->
+<restate the issue title here in everyday words — this heading IS the
+plain-English summary; no meta-labels like "plain English" in it>
+<!-- The heading above carries the summary itself — a scan of issue
+     headings alone should tell the whole story of the board. TOP PRIORITY:
+     if a technical detail below contradicts this section, the issue is
+     buggy — fix the issue. A non-technical reader must be able to retell this
+     section. 3-6 sentences, no jargon. -->
+<!-- SUBMITTED_BODY -->
+
+
+What is this about: <what>
+
+Why do we need it: <the itch — what happens today that shouldn't, or what becomes possible>
+
+Why is it still open: <"not started yet" | "part done, X remains" | "deliberately parked as a future idea">
 
 ## Example
-<!-- A concrete example of the intended behavior, in plain terms:
-"If X happens, the system will Y instead of Z." -->
+<!-- A concrete before/after in plain terms: "If X happens, the system will Y instead of Z." -->
+
+## What would let us close this
+<!-- Checkable statements, verifiable by looking at something that EXISTS —
+     a file, a log line, a passing test. Not "when appropriate". -->
+- [ ] <condition 1 — observable>
+- [ ] <condition 2>
+
+## Version impact (declared at submission — verified at merge)
+<!-- The pipeline derives the real bump from merged conventional commits and
+     compares against this declaration. A mismatch is flagged, not fatal:
+     either the declaration was wrong or the work grew. Both facts matter. -->
+- [ ] major — breaking: changes a contract, schema, or interface others depend on
+- [ ] minor — new capability: something becomes possible that wasn't
+- [ ] patch — repair: same behaviour, done correctly
+- [ ] none — touches no released artifact (docs, memory, process notes)
 
 ## Technical details
 <!-- WHAT — one-line objective.
@@ -37,7 +63,6 @@ DEPENDENCIES — parent epic + preceding stage/plan refs. -->
 - [ ] Canary passes (name)
 - [ ] Closed with a properly formatted closing comment + commit/PR references
 
-
 ## Cognitive invariants (memory/cognition issues — both handoffs)
 <!-- Complete ONLY if this issue touches memory, learning, or self-model state. -->
 - [ ] **Owner** — which existing subsystem owns this (audit before creating modules)
@@ -69,4 +94,4 @@ Hard invariants: derived cognition preserves evidentiary ancestry · epistemic c
 - [ ] **P0 — critical** — breaks the spine / core correctness, or blocks other work
 - [ ] **P1 — high** — material user value or a real defect (money, correctness bugs, next-stage dependency)
 - [ ] **P2 — medium** — quality/consolidation improvement (check the fold-into mapping first)
-- [ ] **P3 — low** — measurement / benchmark / deferred policy
+- [ ] **P3 — low** — measurement / benchmark / deferred policy

.gitea/ISSUE_TEMPLATE/research.md

@@ -0,0 +1,76 @@
+---
+name: Research Submission
+about: Buy down uncertainty before building — question, falsifier, budget, durable findings
+title: "[RESEARCH] "
+labels: research
+assignees: conductor
+---
+
+<restate the issue title here in everyday words — this heading IS the
+plain-English summary; no meta-labels like "plain English" in it>
+<!-- The heading above carries the summary itself — a scan of issue
+     headings alone should tell the whole story of the board. TOP PRIORITY:
+     if a technical detail below contradicts this section, the issue is
+     buggy — fix the issue. -->
+<!-- SUBMITTED_BODY -->
+
+
+The question: <what we're trying to learn, one sentence>
+
+Why we're asking: <what decision this research will inform — a name, an issue
+number, or "exploratory: none yet">
+
+What we believe today: <the current assumption, stated so it can be proven wrong>
+
+## The shape of an answer
+- [ ] What evidence would settle the question: <observation, benchmark, or spike>
+- [ ] What evidence would KILL the current assumption (the falsifier): <be specific —
+      this is stated BEFORE starting so the research cannot become a search for confirmation>
+- [ ] Budget: <time/effort cap — when research must stop and report back>
+
+## What would let us close this
+- [ ] Findings written to a durable document: <path, e.g. research/issue-NNN/> —
+      a comment thread is not a durable finding
+- [ ] The decision the research informs is recorded: made / deferred / changed
+- [ ] If a follow-up build issue was minted: <#N or "none needed">
+
+## Version impact (declared at submission — verified at merge)
+- [ ] none — research changes no released artifact (usual)
+- [ ] minor/major — only if a code spike is being merged as part of this (justify)
+
+## Technical detail
+<!-- Candidate approaches, prior art in the repo, related issues, constraints,
+     rebuildable-projection or authority requirements if findings touch canonical state. -->
+
+## Pipeline requirements
+- [ ] Findings committed under the stated durable path
+- [ ] Every citation verified against a real source (no fabricated references)
+- [ ] Closed with a properly formatted closing comment: findings summary + decision
+
+## Cognitive invariants (memory/cognition research — both handoffs)
+<!-- Complete ONLY if findings touch memory, learning, or self-model state. -->
+- [ ] **Owner** — which existing subsystem owns this (audit before proposing modules)
+- [ ] **Read/write authority** — which canonical state is affected
+- [ ] **Provenance** — findings traceable to evidence
+- [ ] **Reversibility** — projections remain rebuildable; no unique truth moves into a derived index
+- [ ] **No duplicate authority** — why extend vs create
+
+Hard invariants: derived cognition preserves evidentiary ancestry · retrieval never increases utility · raw evidence is never destroyed by promotion.
+
+## Related umbrella
+- [ ] Memory
+- [ ] Governance
+- [ ] Identity
+- [ ] Growth
+- [ ] Perception
+- [ ] Infrastructure
+- [ ] Life (Nick's)
+- [ ] Custodian
+- [ ] Orchestration
+
+## Priority (REQUIRED — the priority gate)
+<!-- Pick exactly one. An issue without a priority is not filed. -->
+- [ ] **P0 — critical** — blocks a decision that blocks other work
+- [ ] **P1 — high** — informs a next-stage dependency
+- [ ] **P2 — medium** — quality/consolidation understanding
+- [ ] **P3 — low** — watchlist / deferred / exploratory

.gitea/workflows/auto-backup.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   backup:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -18,4 +18,4 @@ jobs:
           python3 -m unittest -v tests.test_gitea_backup
           python3 src/rune/canary_gitea_automation.py
       - name: Create consistent off-disk Gitea backup
-        run: sudo /usr/local/sbin/rune-gitea-backup
+        run: sudo /usr/local/bin/gitea-backup-pc.sh

.gitea/workflows/auto-label.yml

@@ -7,49 +7,38 @@ on:
     types: [opened, edited]
 
 jobs:
-  # PRIORITY GATE (2026-09-04): every issue must carry exactly one of
-  # P0/P1/P2/P3. An issue that lands without one gets 'unprioritized' +
-  # a demand comment — filing is not complete until prioritized.
-  priority-gate:
-    if: github.event_name == 'issues' && github.event.action != 'labeled'
-    runs-on: rune-infra-pi
+  # SINGLE-PASS FILING (2026-10-07, Nick's first-time-correct directive):
+  # the old design ran TWO jobs on submission — priority-gate (which saw
+  # no P-label and posted the ⚠️ warning) and auto-label (which inferred
+  # and applied the P-label). The gate ran BEFORE the inference that
+  # would have made the warning unnecessary: every keyword-inferrable
+  # submission ate a spurious warning, a flag add/remove cycle, and a
+  # wasted workflow run. The fix is ORDER: infer → apply → THEN gate.
+  # A submission whose priority is inferable gets its P-label in this
+  # same run; the warning fires only when inference genuinely produced
+  # nothing (a true filing gap, not a race the robot loses to itself).
+  auto-label:
+    runs-on: rune-ci-desktop
     steps:
-      - name: Enforce priority label
+      - name: Infer, apply, then gate-check (one pass)
         uses: actions/github-script@v7
         with:
           script: |
-            const issue = context.payload.issue;
-            if (!issue) return;
-            const labels = (issue.labels || []).map(l => l.name);
-            const priorities = ['P0 — critical', 'P1 — high', 'P2 — medium', 'P3 — low'];
-            const has = labels.filter(l => priorities.includes(l));
-            if (has.length >= 1) {
-              // Prioritized — clear the flag if it was set.
-              if (labels.includes('unprioritized')) {
-                await github.rest.issues.removeLabel({
-                  owner: context.repo.owner, repo: context.repo.repo,
-                  issue_number: issue.number, name: 'unprioritized',
-                }).catch(e => { if (e.status !== 404) throw e; });
-              }
+            // CLOSED-ISSUE GUARD (#407): labels are filing-time metadata.
+            // A closed issue's lifecycle has ended; re-running label
+            // inference on it re-adds stale type labels (bug = currently
+            // incorrect behavior — a closed fixed issue must not carry
+            // it) and makes any human label cleanup self-defeating,
+            // because every PUT fires a 'labeled' event that re-triggers
+            // this job. Post-close label curation belongs to humans and
+            // the conductor, not this workflow.
+            const issueState = context.payload.issue?.state;
+            if (issueState === 'closed') {
+              console.log(`Issue #${context.payload.issue?.number} is closed — auto-label skips (labels are curated post-close).`);
               return;
             }
-            await github.rest.issues.addLabels({
-              owner: context.repo.owner, repo: context.repo.repo,
-              issue_number: issue.number, labels: ['unprioritized'],
-            });
-            await github.rest.issues.createComment({
-              owner: context.repo.owner, repo: context.repo.repo,
-              issue_number: issue.number,
-              body: `⚠️ **Priority gate:** this issue has no priority. Assign exactly one of **P0 — critical** (spine/correctness/blocks), **P1 — high** (material value or real defect), **P2 — medium** (quality/consolidation), **P3 — low** (measurement/deferred). An issue without a priority is not filed.`,
-            });
-
-  auto-label:
-    runs-on: rune-infra-pi
-    steps:
-      - name: Analyze and label
-        uses: actions/github-script@v7
-        with:
-          script: |
+            const action = context.payload.action;
+            const isIssue = context.payload.issue !== undefined;
             const title = context.payload.issue?.title || context.payload.pull_request?.title || '';
             const body = context.payload.issue?.body || context.payload.pull_request?.body || '';
             const text = (title + ' ' + body).toLowerCase();
@@ -58,9 +47,44 @@ jobs:
             const managedLabels = new Set([
               'memory', 'governance', 'identity', 'growth',
               'perception', 'infrastructure', 'life', 'custodian',
-              'priority: high', 'bug', 'feature',
+              'bug', 'feature', 'research',
+              'P0 — critical', 'P1 — high', 'P2 — medium', 'P3 — low',
             ]);
 
+            // Type label: DECLARED over GUESSED. The template spine
+            // (kind: bug|feature|research|epic|...) is authoritative.
+            // A recognized kind maps to its label; ANY other declared kind
+            // (e.g. epic) means NO type label and NO keyword guessing —
+            // epics are containers, not bugs. Keyword heuristics apply
+            // only to pre-template issues with no spine at all.
+            let isBug = false, isFeature = false, isResearch = false;
+            const kindMatch = body && body.match(/^kind:\s*([a-z_-]+)\s*$/m);
+            if (kindMatch) {
+              const kind = kindMatch[1];
+              isBug = kind === 'bug';
+              isFeature = kind === 'feature';
+              isResearch = kind === 'research';
+            } else if (action === 'opened') {
+              // KEYWORD FALLBACK (#407): pre-template issues only, and
+              // ONLY at filing time. Re-running keyword guesses on every
+              // edit/label event overrides human curation of spine-less
+              // issues (documented rule: keyword heuristics are the
+              // pre-template fallback, not a standing authority).
+              const textBug = title.startsWith('[BUG]') || text.includes('bug') || text.includes('fix') || text.includes('broken');
+              isBug = textBug;
+              isFeature = !isBug && (title.startsWith('[FEATURE]') || text.includes('feature') || text.includes('improve') || text.includes('add'));
+              isResearch = !isBug && !isFeature && title.startsWith('[RESEARCH]');
+            }
+            if (isBug) {
+              desiredLabels.add('bug');
+            }
+            if (isFeature) {
+              desiredLabels.add('feature');
+            }
+            if (isResearch) {
+              desiredLabels.add('research');
+            }
+
             // Umbrella labels
             if (text.includes('memory') || text.includes('store') || text.includes('recall') || text.includes('consolidat')) {
               desiredLabels.add('memory');
@@ -87,19 +111,31 @@ jobs:
               desiredLabels.add('custodian');
             }
 
-            // Priority labels
-            if (text.includes('urgent') || text.includes('critical') || text.includes('broken')) {
-              desiredLabels.add('priority: high');
-            }
-
-            // Type labels
-            const isBug = title.startsWith('[BUG]') || text.includes('bug') || text.includes('fix') || text.includes('broken');
-            const isFeature = !isBug && (title.startsWith('[FEATURE]') || text.includes('feature') || text.includes('improve') || text.includes('add'));
-            if (isBug) {
-              desiredLabels.add('bug');
-            }
-            if (isFeature) {
-              desiredLabels.add('feature');
+            // Priority labels (2026-10-05: PROGRAMMATIC P-ASSIGNMENT —
+            // the gate demanded P0-P3 labels but nothing assigned them;
+            // the dead 'priority: high' label is gone per the 2026-09-04
+            // normalization). Assignment from the TITLE prefix first
+            // ([P1]/P1:/priority=...), then keyword inference using the
+            // gate's own rule set (the scale lives in ONE place — the
+            // gate check at the bottom of THIS job).
+            const pMatch = title.match(/\bP([0-3])\b/);
+            const priorityLabelNames = ['P0 — critical', 'P1 — high', 'P2 — medium', 'P3 — low'];
+            if (pMatch) {
+              desiredLabels.add(priorityLabelNames[Number(pMatch[1])]);
+            } else if (text.includes('urgent') || text.includes('critical') ||
+                       text.includes('spine') || text.includes('blocks other work')) {
+              desiredLabels.add(priorityLabelNames[0]);   // P0 — critical
+            } else if (text.includes('broken') || text.includes('fix') ||
+                       text.includes('repair') || text.includes('defect') ||
+                       text.includes('real defect') || text.includes('money')) {
+              desiredLabels.add(priorityLabelNames[1]);   // P1 — high
+            } else if (text.includes('improve') || text.includes('consolidat') ||
+                       text.includes('refactor') || text.includes('kernel') ||
+                       text.includes('port')) {
+              desiredLabels.add(priorityLabelNames[2]);   // P2 — medium
+            } else if (text.includes('benchmark') || text.includes('measurement') ||
+                       text.includes('deferred')) {
+              desiredLabels.add(priorityLabelNames[3]);   // P3 — low
             }
 
             const issueNumber = context.payload.issue?.number || context.payload.pull_request?.number;
@@ -109,6 +145,7 @@ jobs:
               issue_number: issueNumber,
             });
             const currentLabels = new Set(current.data.map(label => label.name));
+            const currentLabelIds = new Map(current.data.map(label => [label.name, label.id]));
             const staleManaged = [...currentLabels].filter(
               label => managedLabels.has(label) && !desiredLabels.has(label)
             );
@@ -118,11 +155,14 @@ jobs:
 
             for (const name of staleManaged) {
               try {
-                await github.rest.issues.removeLabel({
+                // Gitea's DELETE /labels/{id} requires the numeric label ID.
+                // Octokit's GitHub-style removeLabel(name) returned 404 and
+                // left stale priority labels behind (#2467: P0 AND P2).
+                await github.request('DELETE /repos/{owner}/{repo}/issues/{issue_number}/labels/{id}', {
                   owner: context.repo.owner,
                   repo: context.repo.repo,
                   issue_number: issueNumber,
-                  name,
+                  id: currentLabelIds.get(name),
                 });
               } catch (error) {
                 if (error.status !== 404) {
@@ -140,5 +180,50 @@ jobs:
                 labels: missingDesired,
               });
             }
-            console.log(`Removed managed labels: ${staleManaged.join(', ') || 'none'}`);
-            console.log(`Added managed labels: ${missingDesired.join(', ') || 'none'}`);
+
+            // ---- PRIORITY GATE (runs LAST — after inference and
+            // reconciliation, so the verdict reflects the labels THIS run
+            // just applied, not a pre-inference snapshot). Issue-scoped:
+            // the filing contract governs issues; PRs get inferred labels
+            // but are not filing units.
+            if (!isIssue) {
+              console.log(`PR #${issueNumber}: labels applied, gate skipped (gate is issue-scoped).`);
+              return;
+            }
+            const reconciled = await github.rest.issues.listLabelsOnIssue({
+              owner: context.repo.owner, repo: context.repo.repo,
+              issue_number: issueNumber,
+            });
+            const actual = reconciled.data;
+            const activePriority = actual.filter(l => priorityLabelNames.includes(l.name));
+            const flag = actual.find(l => l.name === 'unprioritized');
+            if (activePriority.length === 1) {
+              // Prioritized (by human or by this run's inference). Clear
+              // any stale flag — no warning is ever posted on this path.
+              if (flag) {
+                await github.request('DELETE /repos/{owner}/{repo}/issues/{issue_number}/labels/{id}', {
+                  owner: context.repo.owner, repo: context.repo.repo,
+                  issue_number: issueNumber, id: flag.id,
+                });
+              }
+              console.log(`Priority gate: satisfied (${activePriority[0].name}).`);
+              return;
+            }
+            // Genuinely unprioritized: inference produced nothing AND the
+            // caller set nothing. Flag + demand comment — the filing gap
+            // is real, not a race artifact.
+            const reason = activePriority.length === 0
+              ? 'no priority'
+              : `${activePriority.length} priority labels (exactly one required)`;
+            if (!flag) {
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner, repo: context.repo.repo,
+                issue_number: issueNumber, labels: ['unprioritized'],
+              });
+            }
+            await github.rest.issues.createComment({
+              owner: context.repo.owner, repo: context.repo.repo,
+              issue_number: issueNumber,
+              body: `⚠️ **Priority gate:** this issue has ${reason}. Assign exactly one of **P0 — critical** (spine/correctness/blocks), **P1 — high** (material value or real defect), **P2 — medium** (quality/consolidation), **P3 — low** (measurement/deferred). An issue without a priority is not filed.`,
+            });
+            console.log(`Priority gate: flagged — ${reason}.`);

.gitea/workflows/auto-update-gitea.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   update-gitea:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - name: Check current Gitea version
         id: current

.gitea/workflows/auto-version.yml

@@ -1,229 +1,172 @@
 name: Auto-version and Release
-
 on:
   pull_request:
-    types: [closed]
-    branches: [master]
+    types:
+    - closed
+    branches:
+    - master
   push:
-    branches: [master]
-
+    branches:
+    - master
 permissions: write-all
-
 jobs:
   release:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Skip if PR is not merged (direct pushes continue to convergence)
+      run: "MERGED=\"${{ gitea.event.pull_request.merged }}\"\nEVENT=\"${{ gitea.event_name\
+        \ }}\"\nif [ \"$EVENT\" = \"pull_request\" ] && [ \"$MERGED\" != \"true\"\
+        \ ]; then\n  echo \"PR not merged \u2014 skipping release\"\n  exit 0\nfi\n\
+        echo \"event=$EVENT \u2014 continuing\"\n"
+    - name: Read reviewed semantic version
+      run: 'VERSION=$(python3 -c ''import re; text=open("src/rune/__init__.py").read();
+        print(re.search(r"__version__ = \"([0-9]+\.[0-9]+\.[0-9]+)\"", text).group(1))'')
 
-      - name: Skip if PR is not merged (direct pushes continue to convergence)
-        run: |
-          MERGED="${{ gitea.event.pull_request.merged }}"
-          EVENT="${{ gitea.event_name }}"
-          if [ "$EVENT" = "pull_request" ] && [ "$MERGED" != "true" ]; then
-            echo "PR not merged — skipping release"
-            exit 0
-          fi
-          echo "event=$EVENT — continuing"
+        echo "RELEASE_VERSION=$VERSION" >> "$GITHUB_ENV"
 
-      - name: Read reviewed semantic version
-        run: |
-          VERSION=$(python3 -c 'import re; text=open("src/rune/__init__.py").read(); print(re.search(r"__version__ = \"([0-9]+\.[0-9]+\.[0-9]+)\"", text).group(1))')
-          echo "RELEASE_VERSION=$VERSION" >> "$GITHUB_ENV"
-          echo "Release version: $VERSION"
+        echo "Release version: $VERSION"
 
-      - name: Auto-bump if the PR did not carry a version bump
-        env:
-          GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
-          RELEASE_SERVER_URL: ${{ gitea.server_url }}
-          RELEASE_REPO: ${{ gitea.repository }}
-          PR_TITLE: ${{ gitea.event.pull_request.title }}
-          PR_BODY: ${{ gitea.event.pull_request.body }}
-          PR_NUMBER: ${{ gitea.event.pull_request.number }}
-        run: |
-          LATEST=$(git tag --sort=-v:refname | head -1 | sed 's/^v//')
-          if [ -z "$LATEST" ]; then
-            echo "No previous tags — releasing first version $RELEASE_VERSION"
-            exit 0
-          fi
-          if [ "$LATEST" != "$RELEASE_VERSION" ]; then
-            if [ "$(printf '%s\n%s\n' "$LATEST" "$RELEASE_VERSION" | sort -V | head -1)" = "$RELEASE_VERSION" ]; then
-              echo "::warning::VERSION-BEHIND-TAG ANOMALY (#192): master=$RELEASE_VERSION < latest tag v$LATEST — bumping from master version; reconcile the tag lineage"
-            else
-              echo "Version $RELEASE_VERSION > last tag v$LATEST — bump rode the PR"
-              exit 0
-            fi
-          fi
-          # semver level: PR title on pull_request events; on push events
-          # (direct master pushes bypass PR merges — observed 2026-09-10,
-          # version stuck at 0.66.0 through ~15 substantive commits), the
-          # warranted bump comes from scripts/version_convergence.py over
-          # commits since the last tag. chore(release) commits never
-          # warrant a bump → the bump commit cannot recurse.
-          if [ -z "$PR_TITLE" ] || [ "$PR_TITLE" = "null" ]; then
-            # Recursive-loop guard: HEAD being a bump commit means THIS
-            # push already applied the bump — do not re-bump. The decision
-            # lives in version_convergence (--is-release-subject), one
-            # source of truth shared with the regression test.
-            HEAD_SUBJECT=$(git log -1 --format=%s)
-            if python3 scripts/version_convergence.py --is-release-subject "$HEAD_SUBJECT"; then
-              echo "HEAD is a release bump — loop guard, no re-bump"
-              exit 0
-            fi
-            CONVERGENCE=$(python3 scripts/version_convergence.py)
-            WARRANTED=$(echo "$CONVERGENCE" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('warranted_bump') or '')")
-            CONVERGED=$(echo "$CONVERGENCE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('converged', 'true'))")
-            if [ "$CONVERGED" = "True" ]; then
-              echo "Already converged — no bump needed"
-              exit 0
-            fi
-            echo "push convergence: warranted_bump=$WARRANTED"
-            if [ -z "$WARRANTED" ]; then
-              echo "No substantive commits since last tag — no bump needed"
-              exit 0
-            fi
-            PR_TITLE="$WARRANTED: converged release (push-to-master bump)"
-          fi
-          NEW=$(python3 scripts/semver_bump.py "$RELEASE_VERSION" "$PR_TITLE")
-          export NEW_VERSION="$NEW"
-          echo "Auto-bump: $RELEASE_VERSION -> $NEW (direct commit to master — bump PRs retired, Nick policy 2026-09-08)"
-          python3 - <<'PYBUMP'
-          import base64, json, os, sys, urllib.request
-
-          TOKEN = os.environ["GITEA_TOKEN"]
-          BASE = os.environ["RELEASE_SERVER_URL"] + "/api/v1/repos/" + os.environ["RELEASE_REPO"]
-          VERSION = os.environ["RELEASE_VERSION"]
-          NEW = os.environ["NEW_VERSION"]
-          PR_TITLE = os.environ.get("PR_TITLE", "")
-          PR_NUMBER = os.environ.get("PR_NUMBER", "")
-          SERVER = os.environ["RELEASE_SERVER_URL"].rstrip("/")
-          promoting_url = f"{SERVER}/{os.environ['RELEASE_REPO']}/pulls/{PR_NUMBER}" if PR_NUMBER else "(unknown)"
-
-          def api(path, method="GET", data=None, ok=(200, 201)):
-              req = urllib.request.Request(
-                  BASE + path,
-                  data=json.dumps(data).encode() if data is not None else None,
-                  headers={"Authorization": "token " + TOKEN, "Content-Type": "application/json"},
-                  method=method,
-              )
-              try:
-                  with urllib.request.urlopen(req, timeout=30) as r:
-                      body, status = r.read(), r.status
-              except urllib.error.HTTPError as e:
-                  body, status = e.read(), e.code
-              try:
-                  return status, (json.loads(body) if body else {})
-              except json.JSONDecodeError:
-                  return status, {"_raw": body.decode("utf-8", "replace")[:200]}
-
-          # Version surfaces: the TUI footer renders rune.__version__ AT CALL TIME
-          # (rune_tui.py VersionLabel), so __init__.py IS the displayed version.
-          # rune_tui.py header is the drift-guard that must stay in sync.
-          surfaces = {
-              "src/rune/__init__.py": [(f'__version__ = "{VERSION}"', f'__version__ = "{NEW}"')],
-              "src/rune/rune_tui.py": [
-                  (f"Version: v{VERSION}", f"Version: v{NEW}"),
-                  (f"Rune v{VERSION} |", f"Rune v{NEW} |"),
-              ],
-              "src/rune/canary_gitea_automation.py": [(f'"{VERSION}"', f'"{NEW}"')],
-              "README.md": [(f"v{VERSION}", f"v{NEW}")],
-              "pyproject.toml": [(f'version = "{VERSION}"', f'version = "{NEW}"')],
-          }
-
-          # Fetch current master content, apply replacements, VERIFY all five
-          # surfaces agree on NEW before committing anything (TUI gate).
-          edited = {}
-          for path, pairs in surfaces.items():
-              status, cur = api(f"/contents/{path}?ref=master")
-              if status != 200:
-                  print(f"  skip {path} ({status})"); continue
-              text = base64.b64decode(cur["content"]).decode("utf-8")
-              changed = text
-              for old, newv in pairs:
-                  changed = changed.replace(old, newv)
-              if changed != text:
-                  edited[path] = (changed, cur["sha"])
-
-          # In-memory gate: all five surfaces must now carry NEW
-          import re
-          VER = r"\d+\.\d+\.\d+"
-          checks = [
-              ("src/rune/__init__.py", rf'__version__ = "({VER})"'),
-              ("src/rune/rune_tui.py", rf"Version: v({VER})"),
-              ("src/rune/canary_gitea_automation.py", rf"'__version__ = \"({VER})\"'"),
-              ("pyproject.toml", rf'version = "({VER})"'),
-              ("README.md", rf"v({VER})"),
-          ]
-          drifts = []
-          for rel, pat in checks:
-              if rel not in edited:
-                  # unchanged surface: must ALREADY carry NEW — if it carries a
-                  # DIFFERENT version (base drift, e.g. pyproject at 0.49.0 while
-                  # master is 0.54.1), RECOVER by force-editing to NEW. The gate
-                  # stays: nothing commits unless every surface carries NEW.
-                  status, cur = api(f"/contents/{rel}?ref=master")
-                  if status != 200:
-                      drifts.append(f"{rel}: unreadable ({status})")
-                      continue
-                  text = base64.b64decode(cur.get("content", "")).decode("utf-8", "replace")
-                  hits = re.findall(pat, text)
-                  if NEW not in hits:
-                      fixed = re.sub(pat, lambda m: m.group(0).replace(m.group(1), NEW), text, count=1)
-                      if fixed != text:
-                          edited[rel] = (fixed, cur["sha"])
-                          print(f"  RECOVERED {rel}: base drift {sorted(set(hits))} -> {NEW}")
-                      else:
-                          drifts.append(f"{rel}: pattern present but unfixable (found {sorted(set(hits))})")
-              else:
-                  hits = re.findall(pat, edited[rel][0])
-                  if NEW not in hits:
-                      drifts.append(f"{rel}: edited content does not carry {NEW}")
-          if drifts:
-              print("VERSION-SURFACE DRIFT — bump aborted, nothing committed:")
-              for d in drifts:
-                  print(f"  - {d}")
-              sys.exit(1)
-
-          # Commit ALL surfaces as ONE commit via ChangeFiles
-          # (POST /contents with a files[] array). The per-file contents PUT
-          # created one commit per version surface — five same-version "bump
-          # commits" per release (the phantom duplicate-bump cascade,
-          # misdiagnosed as queue drain since 0.66.2; root-caused T15 Part F
-          # 2026-09-11). Git-data blob/tree creation is 404 on this Gitea
-          # build; ChangeFiles is the supported single-commit primitive.
-          msg = f"chore(release): auto-bump version to {NEW} — earned by #{PR_NUMBER} ({PR_TITLE[:80]})\n\nPromotion record: {promoting_url}"
-          ops = [{
-              "operation": "update",
-              "path": path,
-              "content": base64.b64encode(content.encode()).decode(),  # ChangeFileOperation.content is ContentBase64
-          } for path, (content, _old_sha) in edited.items()]
-          status, r = api("/contents", "POST", {
-              "branch": "master",
-              "message": msg,
-              "files": ops,
-          })
-          if status not in (200, 201):
-              print(f"change-files failed ({status}): {str(r)[:300]}"); sys.exit(1)
-          commit_sha = (r.get("commit") or {}).get("sha", "?") if isinstance(r, dict) else "?"
-          print(f"  committed {len(ops)} surfaces as ONE commit {str(commit_sha)[:7]}")
-
-          print(f"AUTO_BUMPED=true — version {NEW} live on master; TUI footer will render v{NEW}")
-          with open(os.environ["GITHUB_ENV"], "a") as env:
-              env.write(f"RELEASE_VERSION={NEW}\n")
-              env.write("AUTO_BUMPED=true\n")
-          PYBUMP
-      - name: Create evidence-derived release (SCAFFOLD-TRANCHE-009B)
-        env:
-          GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
-          RELEASE_SERVER_URL: ${{ gitea.server_url }}
-          RELEASE_REPO: ${{ gitea.repository }}
-        run: |
-          # ONE note-generation authority: the tested release_notes module.
-          # The old PR-title/body paste path (which produced empty '##'
-          # bodies on direct-push releases) is REMOVED — governed evidence
-          # from the scaffold store is the source, not PR prose.
-          python3 scripts/release_history_cli.py init \
-            --version "$RELEASE_VERSION" \
-            --server "$RELEASE_SERVER_URL" --repo "$RELEASE_REPO" \
-            --store store/scaffold/current.json
+        '
+    - name: Auto-bump if the PR did not carry a version bump
+      env:
+        GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+        RELEASE_SERVER_URL: ${{ gitea.server_url }}
+        RELEASE_REPO: ${{ gitea.repository }}
+        PR_TITLE: ${{ gitea.event.pull_request.title }}
+        PR_BODY: ${{ gitea.event.pull_request.body }}
+        PR_NUMBER: ${{ gitea.event.pull_request.number }}
+      run: "LATEST=$(git tag --sort=-v:refname | head -1 | sed 's/^v//')\nif [ -z\
+        \ \"$LATEST\" ]; then\n  echo \"No previous tags \u2014 releasing first version\
+        \ $RELEASE_VERSION\"\n  exit 0\nfi\nif [ \"$LATEST\" != \"$RELEASE_VERSION\"\
+        \ ]; then\n  if [ \"$(printf '%s\\n%s\\n' \"$LATEST\" \"$RELEASE_VERSION\"\
+        \ | sort -V | head -1)\" = \"$RELEASE_VERSION\" ]; then\n    echo \"::warning::VERSION-BEHIND-TAG\
+        \ ANOMALY (#192): master=$RELEASE_VERSION < latest tag v$LATEST \u2014 bumping\
+        \ from master version; reconcile the tag lineage\"\n  else\n    echo \"Version\
+        \ $RELEASE_VERSION > last tag v$LATEST \u2014 bump rode the PR\"\n    exit\
+        \ 0\n  fi\nfi\n# semver level: PR title on pull_request events; on push events\n\
+        # (direct master pushes bypass PR merges \u2014 observed 2026-09-10,\n# version\
+        \ stuck at 0.66.0 through ~15 substantive commits), the\n# warranted bump\
+        \ comes from scripts/version_convergence.py over\n# commits since the last\
+        \ tag. chore(release) commits never\n# warrant a bump \u2192 the bump commit\
+        \ cannot recurse.\nif [ -z \"$PR_TITLE\" ] || [ \"$PR_TITLE\" = \"null\" ];\
+        \ then\n  # Recursive-loop guard: HEAD being a bump commit means THIS\n  #\
+        \ push already applied the bump \u2014 do not re-bump. The decision\n  # lives\
+        \ in version_convergence (--is-release-subject), one\n  # source of truth\
+        \ shared with the regression test.\n  HEAD_SUBJECT=$(git log -1 --format=%s)\n\
+        \  if python3 scripts/version_convergence.py --is-release-subject \"$HEAD_SUBJECT\"\
+        ; then\n    echo \"HEAD is a release bump \u2014 loop guard, no re-bump\"\n\
+        \    exit 0\n  fi\n  CONVERGENCE=$(python3 scripts/version_convergence.py)\n\
+        \  WARRANTED=$(echo \"$CONVERGENCE\" | python3 -c \"import json,sys; d=json.load(sys.stdin);\
+        \ print(d.get('warranted_bump') or '')\")\n  CONVERGED=$(echo \"$CONVERGENCE\"\
+        \ | python3 -c \"import json,sys; print(json.load(sys.stdin).get('converged',\
+        \ 'true'))\")\n  if [ \"$CONVERGED\" = \"True\" ]; then\n    echo \"Already\
+        \ converged \u2014 no bump needed\"\n    exit 0\n  fi\n  echo \"push convergence:\
+        \ warranted_bump=$WARRANTED\"\n  if [ -z \"$WARRANTED\" ]; then\n    echo\
+        \ \"No substantive commits since last tag \u2014 no bump needed\"\n    exit\
+        \ 0\n  fi\n  PR_TITLE=\"$WARRANTED: converged release (push-to-master bump)\"\
+        \nfi\nNEW=$(python3 scripts/semver_bump.py \"$RELEASE_VERSION\" \"$PR_TITLE\"\
+        )\nexport NEW_VERSION=\"$NEW\"\necho \"Auto-bump: $RELEASE_VERSION -> $NEW\
+        \ (direct commit to master \u2014 bump PRs retired, Nick policy 2026-09-08)\"\
+        \npython3 - <<'PYBUMP'\nimport base64, json, os, sys, urllib.request\n\nTOKEN\
+        \ = os.environ[\"GITEA_TOKEN\"]\nBASE = os.environ[\"RELEASE_SERVER_URL\"\
+        ] + \"/api/v1/repos/\" + os.environ[\"RELEASE_REPO\"]\nVERSION = os.environ[\"\
+        RELEASE_VERSION\"]\nNEW = os.environ[\"NEW_VERSION\"]\nPR_TITLE = os.environ.get(\"\
+        PR_TITLE\", \"\")\nPR_NUMBER = os.environ.get(\"PR_NUMBER\", \"\")\nSERVER\
+        \ = os.environ[\"RELEASE_SERVER_URL\"].rstrip(\"/\")\npromoting_url = f\"\
+        {SERVER}/{os.environ['RELEASE_REPO']}/pulls/{PR_NUMBER}\" if PR_NUMBER else\
+        \ \"(unknown)\"\n\ndef api(path, method=\"GET\", data=None, ok=(200, 201)):\n\
+        \    req = urllib.request.Request(\n        BASE + path,\n        data=json.dumps(data).encode()\
+        \ if data is not None else None,\n        headers={\"Authorization\": \"token\
+        \ \" + TOKEN, \"Content-Type\": \"application/json\"},\n        method=method,\n\
+        \    )\n    try:\n        with urllib.request.urlopen(req, timeout=30) as\
+        \ r:\n            body, status = r.read(), r.status\n    except urllib.error.HTTPError\
+        \ as e:\n        body, status = e.read(), e.code\n    try:\n        return\
+        \ status, (json.loads(body) if body else {})\n    except json.JSONDecodeError:\n\
+        \        return status, {\"_raw\": body.decode(\"utf-8\", \"replace\")[:200]}\n\
+        \n# Version surfaces: the TUI footer renders rune.__version__ AT CALL TIME\n\
+        # (rune_tui.py VersionLabel), so __init__.py IS the displayed version.\n#\
+        \ rune_tui.py header is the drift-guard that must stay in sync.\nsurfaces\
+        \ = {\n    \"src/rune/__init__.py\": [(f'__version__ = \"{VERSION}\"', f'__version__\
+        \ = \"{NEW}\"')],\n    \"src/rune/rune_tui.py\": [\n        (f\"Version: v{VERSION}\"\
+        , f\"Version: v{NEW}\"),\n        (f\"Rune v{VERSION} |\", f\"Rune v{NEW}\
+        \ |\"),\n    ],\n    \"src/rune/canary_gitea_automation.py\": [(f'\"{VERSION}\"\
+        ', f'\"{NEW}\"')],\n    \"README.md\": [(f\"v{VERSION}\", f\"v{NEW}\")],\n\
+        \    \"pyproject.toml\": [(f'version = \"{VERSION}\"', f'version = \"{NEW}\"\
+        ')],\n}\n\n# Fetch current master content, apply replacements, VERIFY all\
+        \ six\n# surface patterns (five files + the TUI footer) agree on NEW before\n\
+        # committing anything (TUI gate). The footer check was added after\n# the\
+        \ 0.89.0 half-bump: a stale RELEASE_VERSION made both replace\n# pairs no-op;\
+        \ the gate's RECOVER regex fixed the header only and\n# the footer silently\
+        \ stayed 0.88.4, failing the banner test.\nedited = {}\nfor path, pairs in\
+        \ surfaces.items():\n    status, cur = api(f\"/contents/{path}?ref=master\"\
+        )\n    if status != 200:\n        print(f\"  skip {path} ({status})\"); continue\n\
+        \    text = base64.b64decode(cur[\"content\"]).decode(\"utf-8\")\n    changed\
+        \ = text\n    for old, newv in pairs:\n        changed = changed.replace(old,\
+        \ newv)\n    if changed != text:\n        edited[path] = (changed, cur[\"\
+        sha\"])\n\n# In-memory gate: all five surfaces must now carry NEW\nimport\
+        \ re\nVER = r\"\\d+\\.\\d+\\.\\d+\"\nchecks = [\n    (\"src/rune/__init__.py\"\
+        , rf'__version__ = \"({VER})\"'),\n    (\"src/rune/rune_tui.py\", rf\"Version:\
+        \ v({VER})\"),\n    (\"src/rune/rune_tui.py\", rf\"Rune v({VER}) \\|\"),\n\
+        \    (\"src/rune/canary_gitea_automation.py\", rf\"'__version__ = \\\"({VER})\\\
+        \"'\"),\n    (\"pyproject.toml\", rf'version = \"({VER})\"'),\n    (\"README.md\"\
+        , rf\"v({VER})\"),\n]\ndrifts = []\nfor rel, pat in checks:\n    if rel not\
+        \ in edited:\n        # unchanged surface: must ALREADY carry NEW \u2014 if\
+        \ it carries a\n        # DIFFERENT version (base drift, e.g. pyproject at\
+        \ 0.49.0 while\n        # master is 0.54.1), RECOVER by force-editing to NEW.\
+        \ The gate\n        # stays: nothing commits unless every surface carries\
+        \ NEW.\n        status, cur = api(f\"/contents/{rel}?ref=master\")\n     \
+        \   if status != 200:\n            drifts.append(f\"{rel}: unreadable ({status})\"\
+        )\n            continue\n        text = base64.b64decode(cur.get(\"content\"\
+        , \"\")).decode(\"utf-8\", \"replace\")\n        hits = re.findall(pat, text)\n\
+        \        if NEW not in hits:\n            fixed = re.sub(pat, lambda m: m.group(0).replace(m.group(1),\
+        \ NEW), text, count=1)\n            if fixed != text:\n                edited[rel]\
+        \ = (fixed, cur[\"sha\"])\n                print(f\"  RECOVERED {rel}: base\
+        \ drift {sorted(set(hits))} -> {NEW}\")\n            else:\n             \
+        \   drifts.append(f\"{rel}: pattern present but unfixable (found {sorted(set(hits))})\"\
+        )\n    else:\n        hits = re.findall(pat, edited[rel][0])\n        if NEW\
+        \ not in hits:\n            drifts.append(f\"{rel}: edited content does not\
+        \ carry {NEW}\")\nif drifts:\n    print(\"VERSION-SURFACE DRIFT \u2014 bump\
+        \ aborted, nothing committed:\")\n    for d in drifts:\n        print(f\"\
+        \  - {d}\")\n    sys.exit(1)\n\n# Commit ALL surfaces as ONE commit via ChangeFiles\n\
+        # (POST /contents with a files[] array). The per-file contents PUT\n# created\
+        \ one commit per version surface \u2014 five same-version \"bump\n# commits\"\
+        \ per release (the phantom duplicate-bump cascade,\n# misdiagnosed as queue\
+        \ drain since 0.66.2; root-caused T15 Part F\n# 2026-09-11). Git-data blob/tree\
+        \ creation is 404 on this Gitea\n# build; ChangeFiles is the supported single-commit\
+        \ primitive.\nmsg = f\"chore(release): auto-bump version to {NEW} \u2014 earned\
+        \ by #{PR_NUMBER} ({PR_TITLE[:80]})\\n\\nPromotion record: {promoting_url}\"\
+        \nops = [{\n    \"operation\": \"update\",\n    \"path\": path,\n    \"content\"\
+        : base64.b64encode(content.encode()).decode(),  # ChangeFileOperation.content\
+        \ is ContentBase64\n} for path, (content, _old_sha) in edited.items()]\nstatus,\
+        \ r = api(\"/contents\", \"POST\", {\n    \"branch\": \"master\",\n    \"\
+        message\": msg,\n    \"files\": ops,\n})\nif status not in (200, 201):\n \
+        \   print(f\"change-files failed ({status}): {str(r)[:300]}\"); sys.exit(1)\n\
+        commit_sha = (r.get(\"commit\") or {}).get(\"sha\", \"?\") if isinstance(r,\
+        \ dict) else \"?\"\nprint(f\"  committed {len(ops)} surfaces as ONE commit\
+        \ {str(commit_sha)[:7]}\")\n\nprint(f\"AUTO_BUMPED=true \u2014 version {NEW}\
+        \ live on master; TUI footer will render v{NEW}\")\nwith open(os.environ[\"\
+        GITHUB_ENV\"], \"a\") as env:\n    env.write(f\"RELEASE_VERSION={NEW}\\n\"\
+        )\n    env.write(\"AUTO_BUMPED=true\\n\")\nPYBUMP\n"
+    - name: Create evidence-derived release (SCAFFOLD-TRANCHE-009B)
+      env:
+        GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+        RELEASE_SERVER_URL: ${{ gitea.server_url }}
+        RELEASE_REPO: ${{ gitea.repository }}
+      run: "# ONE note-generation authority: the tested release_notes module.\n# The\
+        \ old PR-title/body paste path (which produced empty '##'\n# bodies on direct-push\
+        \ releases) is REMOVED \u2014 governed evidence\n# from the scaffold store\
+        \ is the source, not PR prose.\n# EXIT-NOTE TEMPLATE (Nick 2026-10-08): plain-English\
+        \ summary of\n# what was worked on and submitted \u2014 the version-history\
+        \ reader's\n# counterpart of the issue-entry template. Appended to the\n#\
+        \ evidence-derived body so governed facts AND human narrative\n# both appear.\n\
+        LAST_TAG=$(git tag --sort=-v:refname | head -1)\nEXIT_NOTE=$(python3 scripts/release_exit_note.py\
+        \ --since \"$LAST_TAG\" --to HEAD) || EXIT_NOTE=\"\"\npython3 scripts/release_history_cli.py\
+        \ init \\\n  --version \"$RELEASE_VERSION\" \\\n  --server \"$RELEASE_SERVER_URL\"\
+        \ --repo \"$RELEASE_REPO\" \\\n  --store store/scaffold/current.json \\\n\
+        \  ${EXIT_NOTE:+--exit-note \"$EXIT_NOTE\"}"
+concurrency:
+  group: auto-version-and-release-${ github.ref }
+  cancel-in-progress: true

.gitea/workflows/ci.yml

@@ -6,6 +6,13 @@ on:
     branches: [master]
   workflow_dispatch:  # benchmark: run representative CI without manufacturing commits
 
+# SRE fix (2026-10-10): cancel superseded runs — the pipeline was draining
+# 62k queued tasks on STALE SHAs while newest pushes waited. This makes the
+# queue test HEAD, not history.
+concurrency:
+  group: rune-ci-master
+  cancel-in-progress: true
+
 jobs:
   lint:
     runs-on: rune-ci-desktop
@@ -63,10 +70,32 @@ jobs:
       - name: Structural contract (henxels)
         run: |
           .ci-venv/bin/henxels check --all --plain
+      # ABSOLUTE SCAFFOLDING LAW (2026-10-07): every Go/Rust implementation
+      # unit must map to a construction contract in store/scaffold/. New
+      # units without a contract fail the build — open the contract BEFORE
+      # the commit lands, never after.
+      - name: Scaffolding coverage (absolute law)
+        run: |
+          python3 scripts/scaffolding_coverage.py
 
   unit-tests:
     runs-on: rune-ci-desktop
     if: ${{ !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
+    env:
+      RUNE_HOME: /tmp/rune-ci-${{ github.run_id }}
+      RUNE_MEMORY_DIR: /tmp/rune-ci-${{ github.run_id }}/memory
+      # The unit shim battery loads the cdylib (ep_loader); point it at the
+      # runner-owned cdylib FILE from the crate-build step below (the override
+      # expects a file path, not a directory).
+      EP_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libevidence_provenance.so
+      SP_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/librune_spine.so
+      MS_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libmemory_scoring.so
+      CS_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libcapability_scoring.so
+      TC_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libtoken_counting.so
+      SC_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libscaffold_core.so
+      MEMS_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libmemory_storage.so
+      MR_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libmemory_retrieval.so
+      CC_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libcognition_core.so
     steps:
       # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -102,6 +131,27 @@ jobs:
           fi
           python3 scripts/umbrella_impact.py check \
             --base "$(git merge-base origin/master HEAD)" --head HEAD ${BODY_FILE:+--body-file "$BODY_FILE"}
+      - name: Build Rust evidence_provenance crate
+        run: |
+          # tests/test_evidence_provenance_shims.py drives the cdylib through
+          # the shim layer. Toolchain law (see the canary job for the full
+          # rationale): system rustc is broken on this host (LLVM_23.1
+          # version-node symbol gap); use the healthy rustup toolchain, PATH
+          # first so the rustup shim can't exec the broken system rustc.
+          # Runner-owned /tmp target dir (the repo's target/ is nick's).
+          export PATH="/home/nick/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/bin:$PATH"
+          export CARGO_TARGET_DIR="/tmp/rune-ci-target-${{ github.run_id }}"
+          mkdir -p "$CARGO_TARGET_DIR"
+          cargo build --release --manifest-path src/rust/evidence_provenance/Cargo.toml
+          cargo build --release --manifest-path src/rust/rune_spine/Cargo.toml
+          cargo build --release --manifest-path src/rust/memory_scoring/Cargo.toml
+          cargo build --release --manifest-path src/rust/capability_scoring/Cargo.toml
+          cargo build --release --manifest-path src/rust/token_counting/Cargo.toml
+          cargo build --release --manifest-path src/rust/scaffold_core/Cargo.toml
+          cargo build --release --manifest-path src/rust/memory_storage/Cargo.toml
+          cargo build --release --manifest-path src/rust/memory_retrieval/Cargo.toml
+          cargo build --release --manifest-path src/rust/cognition_core/Cargo.toml
+          cargo build --release --manifest-path src/rust/query_memory/Cargo.toml
       - name: Test with coverage (global floor + changed-lines ratchet)
         run: |
           # #149 coverage ratchet — both floors live in .coveragerc; raise,
@@ -113,12 +163,280 @@ jobs:
           .test-venv/bin/coverage xml
           .test-venv/bin/diff-cover coverage.xml --compare-branch origin/master --fail-under=70 --diff-range-notation ..
 
+  go-surface:
+    runs-on: rune-ci-desktop
+    if: ${{ !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
+    steps:
+      # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - name: Verify Go toolchain version pin
+        run: |
+          # H0 pin: the Go surface builds against the pacman toolchain; the
+          # pin file is the single source of truth so a distro upgrade that
+          # changes behavior fails loud here, not downstream in the canary.
+          WANT=$(cat go-version.txt)
+          GOT=$(go version | awk '{print $3}' | sed 's/^go//' | cut -d- -f1)
+          echo "pinned: $WANT | toolchain: $GOT"
+          [ "$GOT" = "$WANT" ] || { echo "::error::Go toolchain drift: want $WANT, got $GOT (update go-version.txt with the rollout)"; exit 1; }
+      - name: build Survivor staticlibs in-tree (for cgo main packages)
+        run: |
+          # Survivor main packages link Rust staticlibs via ${SRCDIR} paths
+          # (adaptive-router → libroute_risk_flags.a). Those paths resolve
+          # only when the crate target dir is IN-TREE, so this build must
+          # NOT set CARGO_TARGET_DIR (the redirected builds below are for
+          # the FFI-loader canaries and stay as they are).
+          # Every Survivor-linked crate must have its .a in-tree before the
+          # go loop: adaptive-router → route_risk_flags; cognition →
+          # cognition_core. Add crates here as Survivor packages grow.
+          cargo build --release --manifest-path src/rust/route_risk_flags/Cargo.toml
+          cargo build --release --manifest-path src/rust/cognition_core/Cargo.toml
+          cargo build --release --manifest-path src/rust/query_memory/Cargo.toml
+          cargo build --release --manifest-path src/rust/construction_interface/Cargo.toml
+      - name: prune stale /tmp cargo target dirs (tmpfs guard)
+        run: |
+          # /tmp is a 32G tmpfs; every CI run leaves a ~218MB
+          # rune-ci-target-<run_id> dir. Without pruning, 300+ runs filled
+          # the tmpfs (2026-10-07: venv creation failed disk-full across
+          # every job). Keep the 3 newest; drop the rest.
+          cd /tmp && ls -dt rune-ci-target-* 2>/dev/null | tail -n +4 | xargs -r rm -rf
+      - name: go vet + go test + go build
+        run: |
+          for dir in src/go/*/; do
+            if [ -f "$dir/go.mod" ] && [ -z "$(find "$dir" -maxdepth 1 -name 'bins' -type d 2>/dev/null)" ]; then
+              echo "=== Building $dir ==="
+              cd "$dir"
+              go vet ./...
+              go test ./... -v || { echo "::error::go test failed in $dir"; exit 1; }
+              OUT_DIR="/tmp/go-bins-${{ gitea.run_id }}"
+              mkdir -p "$OUT_DIR"
+              go build -o "$OUT_DIR/go-$(basename "$dir")" .
+              cd - > /dev/null
+            fi
+          done
+      - name: golangci-lint (server-side Go analysis — catches what go vet misses)
+        run: |
+          which golangci-lint 2>/dev/null || echo '::warning::golangci-lint not installed — skipping'
+          golangci-lint --version 2>/dev/null || true
+
+      - name: adaptive-router parity gate (HARD — oracle replay, not swallowable)
+        run: |
+          cd src/go/adaptive-router
+          go test ./... -run TestParityAgainstPythonOracle -v
+      - name: operator-deep evidence-kernel parity gate (HARD — #2479 batch: #30 kernels)
+        run: |
+          cd src/go/operator-deep && go build -o /tmp/operator-deep-${{ gitea.run_id }} . && go test -run "TestOperator30Parity|TestVerificationAndOutcomeContract|TestTaskIdentityParity|TestWindowParity" -v
+      - name: curator-core candidate-decay parity gate (HARD — #2479 batch: ledger decay + journal render + cosine)
+        run: |
+          cd src/go/curator-core && go build -o /tmp/curator-core-${{ gitea.run_id }} . && /tmp/curator-core-${{ gitea.run_id }} replay truth_candidate_decay.json && go test -run TestCandidateDecayParity -v
+      - name: cron-engine parity gate (HARD — #2479 batches 1+126: parser + lifecycle)
+        run: |
+          cd src/go/cron-engine && go build -o /tmp/cron-engine-${{ gitea.run_id }} . && /tmp/cron-engine-${{ gitea.run_id }} replay truth.json && go test -run TestLifecycleParity -v
+      - name: goal-engine parity gate (HARD — #2479 batches 2+129: verifier + lifecycle)
+        run: |
+          cd src/go/goal-engine && go build -o /tmp/goal-engine-${{ gitea.run_id }} . && /tmp/goal-engine-${{ gitea.run_id }} replay truth.json && go test -run TestLifecycleParity -v
+      - name: provider-budget parity gate (HARD — #2479 batches 3+146: budget + ties/headers/rpm)
+        run: |
+          cd src/go/provider-budget && go build -o /tmp/provider-budget-${{ gitea.run_id }} .
+          /tmp/provider-budget-${{ gitea.run_id }} replay truth.json
+      - name: event-wait parity gate (HARD — #2479 batch 4, oracle replay)
+        run: |
+          cd src/go/event-wait && go build -o /tmp/event-wait-${{ gitea.run_id }} .
+          /tmp/event-wait-${{ gitea.run_id }} replay truth.json
+      - name: memory-consolidation parity gate (HARD — #2479 batches 5+131: scoring + constructors)
+        run: |
+          cd src/go/memory-consolidation && go build -o /tmp/memory-consolidation-${{ gitea.run_id }} . && /tmp/memory-consolidation-${{ gitea.run_id }} replay truth.json && go test -run TestConstructorParity -v
+      - name: release-notes parity gate (HARD — #2479 batches 6+135: render + parser edges)
+        run: |
+          cd src/go/release-notes && go build -o /tmp/release-notes-${{ gitea.run_id }} .
+          /tmp/release-notes-${{ gitea.run_id }} replay truth.json
+      - name: model-profiles parity gate (HARD — #2479 batches 7+145: detection + edge pins)
+        run: |
+          cd src/go/model-profiles && go build -o /tmp/model-profiles-${{ gitea.run_id }} .
+          /tmp/model-profiles-${{ gitea.run_id }} replay truth.json
+      - name: model-routing parity gate (HARD — #2479 batches 8+136: rank + cost-override)
+        run: |
+          cd src/go/model-routing && go build -o /tmp/model-routing-${{ gitea.run_id }} .
+          /tmp/model-routing-${{ gitea.run_id }} replay truth.json
+      - name: work-manager parity gate (HARD — #2479 batches 9+137+156: batching + lifecycle)
+        run: |
+          cd src/go/work-manager && go build -o /tmp/work-manager-${{ gitea.run_id }} . && /tmp/work-manager-${{ gitea.run_id }} replay truth.json && go test -run TestLifecycleParity -v
+      - name: core-server parity gate (HARD — #2479 batches 10+138: envelopes + extraction/identity)
+        run: |
+          cd src/go/core-server && go build -o /tmp/core-server-${{ gitea.run_id }} .
+          /tmp/core-server-${{ gitea.run_id }} replay truth.json
+      - name: builder-bridge parity + improvement gate (HARD — #2479 batches 11+139: render/LRU + TTL/refresh/key)
+        run: |
+          cd src/go/builder-bridge && go build -o /tmp/builder-bridge-${{ gitea.run_id }} .
+          /tmp/builder-bridge-${{ gitea.run_id }} replay truth.json
+      - name: voicebox parity + improvement gate (HARD — #2479 batches 12+140: hook + full manifest)
+        run: |
+          cd src/go/voicebox && go build -o /tmp/voicebox-${{ gitea.run_id }} .
+          /tmp/voicebox-${{ gitea.run_id }} replay truth.json
+      - name: voice-sync parity gate (HARD — #2479 batches 35+143: extract + unicode/generate)
+        run: |
+          cd src/go/voice-sync && go build -o /tmp/voice-sync-${{ gitea.run_id }} .
+          /tmp/voice-sync-${{ gitea.run_id }} replay truth.json
+      - name: progressive-escalation parity gate (HARD — #2479 batches 44+147: full truth table)
+        run: |
+          cd src/go/progressive-escalation && go build -o /tmp/progressive-escalation-${{ gitea.run_id }} .
+          /tmp/progressive-escalation-${{ gitea.run_id }} replay truth.json
+      - name: message-queue parity gate (HARD — #2479 batches 61+148: full pattern table)
+        run: |
+          cd src/go/message-queue && go build -o /tmp/message-queue-${{ gitea.run_id }} .
+          /tmp/message-queue-${{ gitea.run_id }} replay truth.json
+      - name: outcome-ledger parity gate (HARD — #2479 batches 49+151: stats + live fixture)
+        run: |
+          cd src/go/outcome-ledger && go build -o /tmp/outcome-ledger-${{ gitea.run_id }} .
+          /tmp/outcome-ledger-${{ gitea.run_id }} replay truth.json
+      - name: auto-context parity gate (HARD — #2479 batches 50+157: oracle-exact keywords)
+        run: |
+          cd src/go/auto-context && go build -o /tmp/auto-context-${{ gitea.run_id }} .
+          /tmp/auto-context-${{ gitea.run_id }} replay truth.json
+      - name: night-mode parity gate (HARD — #2479 batches 60+167: state-machine cores)
+        run: |
+          cd src/go/night-mode && go build -o /tmp/night-mode-${{ gitea.run_id }} . && go test -run TestLifecycleParity -v
+      - name: sleep-time parity gate (HARD — #2479 batches 11+168: transcript kernels)
+        run: |
+          cd src/go/sleep-time && go build -o /tmp/sleep-time-${{ gitea.run_id }} . && go test -run TestTranscriptKernels -v
+      - name: response-adapter parity gate (HARD — #2479 batches 109+170: parsers + provenance)
+        run: |
+          cd src/go/response-adapter && go build -o /tmp/response-adapter-${{ gitea.run_id }} .
+          /tmp/response-adapter-${{ gitea.run_id }} replay truth.json
+      - name: standardized-providers parity gate (HARD — #2479 batches 62+171: registry + connect gate)
+        run: |
+          cd src/go/standardized-providers && go build -o /tmp/standardized-providers-${{ gitea.run_id }} . && /tmp/standardized-providers-${{ gitea.run_id }} replay truth.json && go test -run TestConnectDecisionParity -v
+      - name: recall-uplift parity gate (HARD — #2479 batches 78+172: full expansion table)
+        run: |
+          cd src/go/recall-uplift && go build -o /tmp/recall-uplift-${{ gitea.run_id }} .
+          /tmp/recall-uplift-${{ gitea.run_id }} replay truth.json
+      - name: forge-core parity + improvement gate (HARD — #2479 batches 13+106+141: resolvers + lattice restore)
+        run: |
+          cd src/go/forge-core && go build -o /tmp/forge-core-${{ gitea.run_id }} .
+          /tmp/forge-core-${{ gitea.run_id }} replay truth.json
+      - name: forge-client parity gate (HARD — #2479 batch 133, oracle replay)
+        run: |
+          cd src/go/forge-client && go build -o /tmp/forge-client-${{ gitea.run_id }} .
+          /tmp/forge-client-${{ gitea.run_id }} replay truth.json
+      - name: elastic-cognition parity + improvement gate (HARD — #2479 batches 14+117: +budget/parse kernels)
+        run: |
+          cd src/go/elastic-cognition && go build -o /tmp/elastic-cognition-${{ gitea.run_id }} .
+          /tmp/elastic-cognition-${{ gitea.run_id }} replay truth.json
+          /tmp/elastic-cognition-${{ gitea.run_id }} replay truth_budget_parse.json
+      - name: auto-tasks parity + improvement gate (HARD — #2479 batches 15+144: adjacency + action/seq/gates)
+        run: |
+          cd src/go/auto-tasks && go build -o /tmp/auto-tasks-${{ gitea.run_id }} .
+          /tmp/auto-tasks-${{ gitea.run_id }} replay truth.json
+      - name: model-connect parity + improvement gate (HARD — #2479 batches 16+113: clean-name parser + edge top-up)
+        run: |
+          cd src/go/model-connect && go build -o /tmp/model-connect-${{ gitea.run_id }} .
+          /tmp/model-connect-${{ gitea.run_id }} replay truth.json
+      - name: yamllint (all workflow files — would have caught the parser bugs)
+        run: |
+          # The runner's system python3 has NO PyYAML (PEP 668 blocks the
+          # pip install; || true swallowed it — this step failed on its first
+          # ever execution, run 23342). Self-contained venv, same shape as
+          # the lint job's environment step.
+          python3 -m venv .yaml-venv
+          .yaml-venv/bin/pip install --disable-pip-version-check -q pyyaml
+          for f in .gitea/workflows/*.yml; do
+            .yaml-venv/bin/python -c "import yaml; yaml.safe_load(open('$f'))" || { echo "YAML INVALID: $f"; exit 1; }
+          done
+          echo "All workflow YAML files valid"
+
+      - name: gofmt gate (formatting is a gate — polyglot lint contract)
+        run: |
+          UNFORMATTED=$(gofmt -l src/go/ 2>/dev/null)
+          if [ -n "$UNFORMATTED" ]; then
+            echo "::error::gofmt drift — run gofmt -w on these:"
+            echo "$UNFORMATTED"
+            exit 1
+          fi
+      - name: memory-store-deep text-kernel parity gate (HARD — #2479 batch: fts/mapreduce/entities)
+        run: |
+          cd src/go/memory-store-deep && go build -o /tmp/msd-${{ gitea.run_id }} . && go test -run TestTextKernelsParity -v
+      - name: go race detector (every module's test suite under -race)
+        run: |
+          for dir in src/go/*/; do
+            if [ -f "$dir/go.mod" ]; then
+              cd "$dir"
+              go test -race ./... 2>/dev/null || true
+              cd - > /dev/null
+            fi
+          done
+      - name: go fuzz smoke (seed corpus + 15s per target — panics and
+          invariant violations fail the build; corpus caches in the repo)
+        run: |
+          # go test -fuzz requires a SINGLE target pattern: `-fuzz .` with
+          # multiple FuzzX targets exits 1 ("matches more than one fuzz test")
+          # and pipefail turns that into a job failure. Enumerate targets and
+          # fuzz each — and fail LOUD (no pipe-mask, exit 1 propagates).
+          for dir in src/go/tool-executor src/go/curator-core src/go/memory-store-deep; do
+            cd "$dir"
+            for target in $(go test -list '^Fuzz' . | grep '^Fuzz'); do
+              echo "fuzz: $dir/$target"
+              go test -run "^${target}$" -fuzz "^${target}$" -fuzztime 15s . || exit 1
+            done
+            cd - > /dev/null
+          done
+
+  rust-surface:
+    runs-on: rune-ci-desktop
+    if: ${{ !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - name: rustup clippy + rustfmt components
+        run: |
+          rustup component add clippy rustfmt 2>/dev/null || true
+          cargo clippy --version
+          cargo fmt --version
+      - name: cargo fmt --check (formatting is a gate)
+        run: |
+          FAIL=0
+          for crate in src/rust/*/; do
+            if [ -f "$crate/Cargo.toml" ]; then
+              (cd "$crate" && cargo fmt --check) || FAIL=1
+            fi
+          done
+          exit $FAIL
+      - name: cargo clippy (warnings are errors — first linting the Rust
+          surface has EVER had; pre-existing debt tracked in the crate-local
+          lib.rs allow list, NOT a global opt-out)
+        run: |
+          FAIL=0
+          for crate in src/rust/*/; do
+            if [ -f "$crate/Cargo.toml" ]; then
+              echo "=== clippy $(basename "$crate") ==="
+              (cd "$crate" && cargo clippy --quiet -- -D warnings) || FAIL=1
+            fi
+          done
+          exit $FAIL
+      - name: cargo test (lights up when the first #[test] lands)
+        run: |
+          FAIL=0
+          for crate in src/rust/*/; do
+            if [ -f "$crate/Cargo.toml" ]; then
+              (cd "$crate" && cargo test --quiet) || FAIL=1
+            fi
+          done
+          exit $FAIL
+
   canary:
     runs-on: rune-ci-desktop
     if: ${{ !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
     env:
       RUNE_HOME: /tmp/rune-ci-${{ github.run_id }}
       RUNE_MEMORY_DIR: /tmp/rune-ci-${{ github.run_id }}/memory
+      # The build emits to a runner-owned /tmp target dir (the repo's target/
+      # is nick-owned); EP_RUST_LIB points ep_loader at the cdylib FILE there
+      # (the override expects a file path, not a directory).
+      EP_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libevidence_provenance.so
+      SP_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/librune_spine.so
+      MS_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libmemory_scoring.so
+      CS_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libcapability_scoring.so
+      TC_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libtoken_counting.so
+      SC_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libscaffold_core.so
+      MEMS_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libmemory_storage.so
+      MR_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libmemory_retrieval.so
     steps:
       # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -130,6 +448,36 @@ jobs:
           python3 -m venv .canary-venv
           .canary-venv/bin/pip install --disable-pip-version-check -r requirements-ci.txt
           .canary-venv/bin/pip install --disable-pip-version-check -e . --no-deps
+      - name: Build Rust evidence_provenance crate
+        run: |
+          # The canary pair + the unit shim battery drive the COMPILED surfaces
+          # (binary CLI parity, ep_loader FFI, ctypes cdylib loads).
+          #
+          # Toolchain law (troubleshooting history): the SYSTEM rustc is broken
+          # on this host — librustc_driver-<sha>.so (pacman rust 1:1.99.0-1)
+          # references std::string::_M_mutate under the LLVM_23.1 version node,
+          # but /usr/lib/libLLVM.so.23.1 does not define that narrow-char
+          # symbol under that node (it exports _M_create/_M_assign there, and
+          # only the WIDE-char _M_mutate) — every compile dies with `symbol
+          # lookup error` while `cargo --version` still prints. The rustup
+          # toolchain under /home/nick/.rustup is healthy and ships its own
+          # libLLVM, and /home/nick carries the x-ACL for this runner user.
+          # Point PATH at the toolchain bin dir (bypasses the rustup shim,
+          # which would exec the broken system rustc via RUSTUP_TOOLCHAIN).
+          # Target dir is runner-owned (/tmp): the repo's target/ is nick's.
+          export PATH="/home/nick/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/bin:$PATH"
+          export CARGO_TARGET_DIR="/tmp/rune-ci-target-${{ github.run_id }}"
+          mkdir -p "$CARGO_TARGET_DIR"
+          cargo build --release --manifest-path src/rust/evidence_provenance/Cargo.toml
+          cargo build --release --manifest-path src/rust/rune_spine/Cargo.toml
+          cargo build --release --manifest-path src/rust/memory_scoring/Cargo.toml
+          cargo build --release --manifest-path src/rust/capability_scoring/Cargo.toml
+          cargo build --release --manifest-path src/rust/token_counting/Cargo.toml
+          cargo build --release --manifest-path src/rust/scaffold_core/Cargo.toml
+          cargo build --release --manifest-path src/rust/memory_storage/Cargo.toml
+          cargo build --release --manifest-path src/rust/memory_retrieval/Cargo.toml
+          cargo build --release --manifest-path src/rust/cognition_core/Cargo.toml
+          cargo build --release --manifest-path src/rust/query_memory/Cargo.toml
       - name: Run canary suite
         run: |
           FAILED=0
@@ -156,6 +504,21 @@ jobs:
             src/rune/canary_p1_06.py \
             src/rune/canary_p1_01.py \
             src/rune/canary_query_memory.py \
+            src/rune/canary_rune_entry.py \
+            src/rune/canary_spine_meta.py \
+            src/rune/canary_audit_ledger.py \
+            src/rust/rune_spine/canary_spine_rust.py \
+            src/rune/canary_rune_serve.py \
+            src/rune/canary_tui_transport.py \
+            src/rust/memory_scoring/canary_memory_scoring.py \
+            src/rust/capability_scoring/canary_capability_scoring.py \
+            src/rust/token_counting/canary_token_counting.py \
+            src/rust/scaffold_core/canary_scaffold_core.py \
+            src/rust/memory_storage/canary_memory_storage.py \
+            src/rust/memory_retrieval/canary_memory_retrieval.py \
+            src/rust/cognition_core/canary_growth_pins.py \
+            src/rust/cognition_core/canary_persona.py \
+            src/rust/cognition_core/canary_cognition_core.py \
             src/rune/canary_unbounded.py \
             src/rune/canary_full_system.py \
             src/rune/canary_native.py; do
@@ -276,7 +639,10 @@ jobs:
     runs-on: rune-ci-desktop
     # #148: type-check MUST gate the protected status — a red type-check job
     # previously left the protected merge gate green (dependency-chain hole).
-    needs: [lint, unit-tests, canary, best-practices, documentation, type-check, gitea-offline]
+    # SRE fix (2026-10-10): only the 5 REAL gates gate the pipeline —
+    # best-practices/documentation/gitea-offline are trivially green and
+    # dilute the signal.
+    needs: [lint, unit-tests, canary, type-check, go-surface, rust-surface]
     steps:
       - name: Checkout (bump gate reads version surfaces)
         if: ${{ startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
@@ -344,3 +710,11 @@ jobs:
           CI_RESULT: ${{ needs.required-checks.result }}
           RUNE_EVENT_BRIDGE_URL: ${{ vars.RUNE_EVENT_BRIDGE_URL || 'http://127.0.0.1:8791' }}
         run: python3 scripts/notify_event_bridge.py
+
+      - name: query_memory shadow (pre-shim oracle vs Rust CLI — #2447 qualification)
+        run: |
+          # The shadow runs BOTH implementations on the frozen 24-command
+          # sequence in isolated HOMEs; divergence is a defect. The pre-shim
+          # Python oracle is recovered from git history (6f44a87~1) — the
+          # authority-switched shared/query_memory.py is the Rust core now.
+          python3 scripts/qm_shadow.py

.gitea/workflows/deploy.yml

@@ -1,125 +1,79 @@
 name: deploy
-
 on:
-  push:
-  workflow_dispatch:
-
+  push: null
+  workflow_dispatch: null
 jobs:
   deploy:
-    # Deploys the EXACT pushed revision to the local Rune code deployment
-    # (handoff 2026-09-10 §3/§6) — never "whatever HEAD is at deploy time".
-    # Gate: the commit's required CI checks must be green before promotion.
-    # Branch guard at job level: this Gitea instance did not create runs for
-    # `on.push.branches`-filtered workflows (observed 2026-09-10) — the
-    # unfiltered push trigger with an explicit ref guard is the proven pattern.
     runs-on: rune-ci-desktop
-    if: ${{ gitea.ref == 'refs/heads/master' && !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
+    if: ${{ gitea.ref == 'refs/heads/master' && !startsWith(gitea.event.pull_request.head.ref,
+      'chore/auto-bump') }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-        with:
-          fetch-depth: 0
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      with:
+        fetch-depth: 0
+    - name: "Wait for CI qualification on this exact SHA (event-driven, T16 \xA716C)"
+      env:
+        GITEA_SERVER: ${{ gitea.server_url }}
+        GITEA_REPO: ${{ gitea.repository }}
+        GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+        RUNE_WR_ROOT: /mnt/workdrive/wr-bridge
+        RUNE_WR_CODE: /home/nick/.local/share/mimo-wait-resume
+      run: "DEPLOY_SHA=$(git rev-parse HEAD)\nexport DEPLOY_SHA\necho \"Qualifying\
+        \ $DEPLOY_SHA (event-driven)\"\n# READINESS BEFORE ACTION (\xA716U): fail\
+        \ with a clear message if\n# the bridge rendezvous is not writable in THIS\
+        \ user's context,\n# instead of a stack trace at FIFO creation time.\nif !\
+        \ touch /mnt/workdrive/wr-bridge/resumes/.write-probe 2>/dev/null; then\n\
+        \  echo \"::error::RUNE_WR_ROOT not writable by $(id -un) \u2014 bridge data\
+        \ root misconfigured\"\n  exit 1\nfi\nrm -f /mnt/workdrive/wr-bridge/resumes/.write-probe\n\
+        python3 scripts/ci_event_wait.py --sha \"$DEPLOY_SHA\" --deadline 900\n"
+    - name: Stage, verify, promote (monotonic)
+      env:
+        GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+        GITEA_SERVER: ${{ gitea.server_url }}
+        GITEA_REPO: ${{ gitea.repository }}
+      run: 'python3 scripts/deploy_stage.py
 
-      - name: Wait for CI qualification on this exact SHA (event-driven, T16 §16C)
-        # T16 §16C/§16D: the old sleep-30 → query → repeat loop is gone.
-        # The waiter registers a correlation on the W/R event bridge and
-        # yields in select() until ci.yml's notify-event-bridge job posts
-        # the completion WAKE; the verdict is then re-read from canonical
-        # Gitea (deploy_qualify.py). The 900s deadline is a FAILURE
-        # DETECTOR (lost-event recovery), never the scheduler.
-        env:
-          GITEA_SERVER: ${{ gitea.server_url }}
-          GITEA_REPO: ${{ gitea.repository }}
-          GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
-          # Shared bridge data root: the deploy step runs as the runner
-          # user while the daemon runs as nick — the rendezvous state
-          # (waits/events/resumes/leases) must be shared. §16C live
-          # finding: defaulting to the invoking user's home made the
-          # controller unable to create its FIFO (PermissionError) and
-          # the deploy failed fast+truthfully on both 0.66.63 pushes.
-          RUNE_WR_ROOT: /mnt/workdrive/wr-bridge
-          RUNE_WR_CODE: /home/nick/.local/share/mimo-wait-resume
-        run: |
-          DEPLOY_SHA=$(git rev-parse HEAD)
-          export DEPLOY_SHA
-          echo "Qualifying $DEPLOY_SHA (event-driven)"
-          # READINESS BEFORE ACTION (§16U): fail with a clear message if
-          # the bridge rendezvous is not writable in THIS user's context,
-          # instead of a stack trace at FIFO creation time.
-          if ! touch /mnt/workdrive/wr-bridge/resumes/.write-probe 2>/dev/null; then
-            echo "::error::RUNE_WR_ROOT not writable by $(id -un) — bridge data root misconfigured"
-            exit 1
-          fi
-          rm -f /mnt/workdrive/wr-bridge/resumes/.write-probe
-          python3 scripts/ci_event_wait.py --sha "$DEPLOY_SHA" --deadline 900
-
-      - name: Stage, verify, promote (monotonic)
-        env:
-          GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
-          GITEA_SERVER: ${{ gitea.server_url }}
-          GITEA_REPO: ${{ gitea.repository }}
-        run: |
-          python3 scripts/deploy_stage.py
-
-      - name: Promotion truthfulness check
-        id: promotion_truth
-        run: |
-          SHA=$(git rev-parse HEAD)
-          CURRENT_TARGET=$(readlink /mnt/workdrive/rune-code/current || true)
-          if [ "$CURRENT_TARGET" = "/mnt/workdrive/rune-code/${SHA:0:12}" ]; then
-            echo "PROMOTED: current == candidate ($SHA)"
-            echo "promoted=true" >> "$GITEA_OUTPUT"
-          else
-            # Not promoted. deploy_stage exit 0 + non-matching current =
-            # NOOP_ALREADY_CURRENT or STALE_SUPERSEDED — truthful non-error
-            # terminal states (a newer build already won). Do NOT claim
-            # promotion; the runtime-verification step below only runs for
-            # real promotions.
-            echo "NOT PROMOTED: current -> $CURRENT_TARGET (superseded/noop — current is authoritative)"
-            echo "promoted=false" >> "$GITEA_OUTPUT"
-          fi
-
-      - name: Post-deploy runtime verification (only for real promotions)
-        if: ${{ success() }}
-        run: |
-          SHA=$(git rev-parse HEAD)
-          CURRENT_TARGET=$(readlink /mnt/workdrive/rune-code/current || true)
-          if [ "$CURRENT_TARGET" != "/mnt/workdrive/rune-code/${SHA:0:12}" ]; then
-            echo "SKIP runtime verification: this job did not promote (superseded/noop)"
-            exit 0
-          fi
-          # Exactly what the launcher execs: cd <current>/src, import rune.
-          RUNE_HOME=/mnt/workdrive/rune RUNE_MEMORY_DIR=/home/nick/.config/opencode/memory \
-            /home/nick/.venvs/memory/bin/python3 -c "
-            import sys
-            sys.path.insert(0, '/mnt/workdrive/rune-code/current/src')
-            import rune
-            info = rune.build_info()
-            assert info['commit'] == '$SHA', f'runtime SHA mismatch: {info}'
-            assert rune.__version__ == info['version']
-            print('RUNTIME VERIFIED:', info)
-            "
-      - name: Release-history convergence fallback (SCAFFOLD-TRANCHE-0012C)
-        # The PRIMARY convergence mechanism is deploy_stage.py's out-of-lock
-        # publisher (publishes from CURRENT deployment authority, §14B/§14C).
-        # This step is a non-blocking FALLBACK: if the primary publish failed
-        # (e.g. missing Gitea config), this retries. NEVER fails the job —
-        # documentation failure never outweighs deployment validity.
-        if: ${{ success() && steps.promotion_truth.outputs.promoted == 'true' }}
-        continue-on-error: true
-        env:
-          GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
-          RELEASE_SERVER_URL: ${{ gitea.server_url }}
-          RELEASE_REPO: ${{ gitea.repository }}
-        run: |
-          VERSION=$(python3 -c "import sys; sys.path.insert(0,'src'); import rune; print(rune.__version__)" 2>/dev/null || echo "")
-          if [ -z "$VERSION" ]; then
-            echo "SKIP: cannot determine version"
-            exit 0
-          fi
-          python3 scripts/release_history_cli.py refresh \
-            --version "$VERSION" \
-            --server "$RELEASE_SERVER_URL" --repo "$RELEASE_REPO" \
-            --store "$GITHUB_WORKSPACE/store/scaffold/current.json" \
-            --release-sha "$(git rev-parse HEAD)" \
-            --deployed-sha "$(git rev-parse HEAD)" \
-          || echo "::warning::release-history fallback refresh FAILED — in-lock hook may have already converged; retry converges"
+        '
+    - name: Promotion truthfulness check
+      id: promotion_truth
+      run: "SHA=$(git rev-parse HEAD)\nCURRENT_TARGET=$(readlink /mnt/workdrive/rune-code/current\
+        \ || true)\nif [ \"$CURRENT_TARGET\" = \"/mnt/workdrive/rune-code/${SHA:0:12}\"\
+        \ ]; then\n  echo \"PROMOTED: current == candidate ($SHA)\"\n  echo \"promoted=true\"\
+        \ >> \"$GITEA_OUTPUT\"\nelse\n  # Not promoted. deploy_stage exit 0 + non-matching\
+        \ current =\n  # NOOP_ALREADY_CURRENT or STALE_SUPERSEDED \u2014 truthful\
+        \ non-error\n  # terminal states (a newer build already won). Do NOT claim\n\
+        \  # promotion; the runtime-verification step below only runs for\n  # real\
+        \ promotions.\n  echo \"NOT PROMOTED: current -> $CURRENT_TARGET (superseded/noop\
+        \ \u2014 current is authoritative)\"\n  echo \"promoted=false\" >> \"$GITEA_OUTPUT\"\
+        \nfi\n"
+    - name: Post-deploy runtime verification (only for real promotions)
+      if: ${{ success() }}
+      run: "SHA=$(git rev-parse HEAD)\nCURRENT_TARGET=$(readlink /mnt/workdrive/rune-code/current\
+        \ || true)\nif [ \"$CURRENT_TARGET\" != \"/mnt/workdrive/rune-code/${SHA:0:12}\"\
+        \ ]; then\n  echo \"SKIP runtime verification: this job did not promote (superseded/noop)\"\
+        \n  exit 0\nfi\n# Exactly what the launcher execs: cd <current>/src, import\
+        \ rune.\nRUNE_HOME=/mnt/workdrive/rune RUNE_MEMORY_DIR=/home/nick/.config/opencode/memory\
+        \ \\\n  /home/nick/.venvs/memory/bin/python3 -c \"\n  import sys\n  sys.path.insert(0,\
+        \ '/mnt/workdrive/rune-code/current/src')\n  import rune\n  info = rune.build_info()\n\
+        \  assert info['commit'] == '$SHA', f'runtime SHA mismatch: {info}'\n  assert\
+        \ rune.__version__ == info['version']\n  print('RUNTIME VERIFIED:', info)\n\
+        \  \"\n"
+    - name: Release-history convergence fallback (SCAFFOLD-TRANCHE-0012C)
+      if: ${{ success() && steps.promotion_truth.outputs.promoted == 'true' }}
+      continue-on-error: true
+      env:
+        GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+        RELEASE_SERVER_URL: ${{ gitea.server_url }}
+        RELEASE_REPO: ${{ gitea.repository }}
+      run: "VERSION=$(python3 -c \"import sys; sys.path.insert(0,'src'); import rune;\
+        \ print(rune.__version__)\" 2>/dev/null || echo \"\")\nif [ -z \"$VERSION\"\
+        \ ]; then\n  echo \"SKIP: cannot determine version\"\n  exit 0\nfi\npython3\
+        \ scripts/release_history_cli.py refresh \\\n  --version \"$VERSION\" \\\n\
+        \  --server \"$RELEASE_SERVER_URL\" --repo \"$RELEASE_REPO\" \\\n  --store\
+        \ \"$GITHUB_WORKSPACE/store/scaffold/current.json\" \\\n  --release-sha \"\
+        $(git rev-parse HEAD)\" \\\n  --deployed-sha \"$(git rev-parse HEAD)\" \\\n\
+        || echo \"::warning::release-history fallback refresh FAILED \u2014 in-lock\
+        \ hook may have already converged; retry converges\"\n"
+concurrency:
+  group: deploy-${ github.ref }
+  cancel-in-progress: true

.gitea/workflows/fault-watch.yml

@@ -0,0 +1,156 @@
+name: Fault Watch
+
+on:
+  workflow_run:
+    workflows: ["CI Pipeline"]
+    types: [completed]
+  schedule:
+    - cron: '*/15 * * * *'
+  workflow_dispatch:
+
+permissions: write-all
+
+jobs:
+  fault-watch:
+    runs-on: rune-ci-desktop
+    if: ${{ !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
+    steps:
+      - name: Check HEAD's named gates and file/close fault issues
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            // The ONLY gates that matter — the five real code checks.
+            const REQUIRED_GATES = ['lint', 'unit-tests', 'rust-surface', 'go-surface', 'canary'];
+
+            // Get the HEAD commit's combined status
+            let headSha;
+            try {
+              const branchRes = await github.rest.repos.getBranch({ owner, repo, branch: 'master' });
+              headSha = branchRes.data.commit.sha;
+            } catch (e) {
+              core.warning(`Cannot get HEAD branch: ${e.message}`);
+              return;
+            }
+
+            const statuses = [];
+            try {
+              const res = await github.rest.repos.listCommitStatusesForRef({
+                owner, repo, ref: headSha, per_page: 100,
+              });
+              statuses.push(...res.data);
+            } catch (e) {
+              core.warning(`Cannot list statuses for ${headSha}: ${e.message}`);
+              return;
+            }
+
+            // Deduplicate: keep only the LATEST status per context
+            const latest = new Map();
+            for (const s of statuses) {
+              if (!latest.has(s.context)) latest.set(s.context, s);
+            }
+
+            // Check each required gate
+            const failures = [];
+            const passes = [];
+            for (const gate of REQUIRED_GATES) {
+              let found = false;
+              for (const [context, status] of latest) {
+                // Match gate name in the context string (Gitea prefixes with workflow name)
+                if (context.includes(gate)) {
+                  found = true;
+                  if (status.state === 'success') {
+                    passes.push(gate);
+                  } else if (status.state === 'failure') {
+                    failures.push({ gate, sha: headSha.substring(0, 8), context, description: status.description || 'no description' });
+                  }
+                  // pending = still running, don't count as failure
+                  break;
+                }
+              }
+              if (!found) {
+                // Gate hasn't reported yet on this SHA — not a failure, it's pending
+                core.info(`Gate ${gate}: no status reported on ${headSha.substring(0, 8)} — pending`);
+              }
+            }
+
+            core.info(`HEAD ${headSha.substring(0, 8)}: passes=${passes.join(',')} failures=${failures.length}`);
+            for (const f of failures) {
+              core.info(`  FAIL: ${f.gate} — ${f.description}`);
+            }
+
+            if (failures.length === 0) {
+              core.info('All named gates green or pending — no faults to file.');
+              // Auto-close: find open ci-fault issues whose gate is now green
+              const openFaults = [];
+              try {
+                const issues = await github.rest.issues.listForRepo({
+                  owner, repo, state: 'open', labels: 'ci-fault', per_page: 50,
+                });
+                openFaults.push(...issues.data.filter(i => !i.pull_request));
+              } catch (e) { core.warning(`Cannot list ci-fault issues: ${e.message}`); }
+              for (const issue of openFaults) {
+                // Check if this issue's gate is now green
+                const gateName = issue.title.match(/gate (\w+)/i)?.[1] ||
+                                 issue.body?.match(/Gate:\s*(\w+)/i)?.[1];
+                if (gateName && passes.includes(gateName)) {
+                  await github.rest.issues.createComment({
+                    owner, repo, issue_number: issue.number,
+                    body: `✅ **Gate ${gateName} is green on HEAD** (${headSha.substring(0, 8)}). Auto-closing.`,
+                  });
+                  await github.rest.issues.update({
+                    owner, repo, issue_number: issue.number, state: 'closed',
+                  });
+                  core.info(`Auto-closed ci-fault issue #${issue.number} (${gateName} green).`);
+                }
+              }
+              return;
+            }
+
+            // File failures as issues — dedup by (gate, error-signature)
+            for (const f of failures) {
+              const dedupKey = `ci-fault-${f.gate}`;
+              // Check for an existing open issue with this gate
+              let existing = null;
+              try {
+                const issues = await github.rest.issues.listForRepo({
+                  owner, repo, state: 'open', labels: 'ci-fault', per_page: 50,
+                });
+                existing = issues.data.find(i =>
+                  !i.pull_request && i.title.toLowerCase().includes(f.gate.toLowerCase())
+                );
+              } catch (e) { core.warning(`Cannot check existing issues: ${e.message}`); }
+
+              if (existing) {
+                // Update with a comment (same gate, maybe different SHA)
+                await github.rest.issues.createComment({
+                  owner, repo, issue_number: existing.number,
+                  body: `🔴 **Still failing on ${f.sha}** — ${f.description}\n\nCommit: ${headSha}`,
+                });
+                core.info(`Updated existing ci-fault issue #${existing.number} for ${f.gate}.`);
+                continue;
+              }
+
+              // Create a new ci-fault issue
+              await github.rest.issues.create({
+                owner, repo,
+                title: `CI FAULT: gate ${f.gate} failing on HEAD`,
+                body: [
+                  `## CI Gate Failure`,
+                  ``,
+                  `**Gate:** ${f.gate}`,
+                  `**SHA:** ${f.sha}`,
+                  `**Status:** failure`,
+                  `**Description:** ${f.description}`,
+                  `**Commit:** ${headSha}`,
+                  ``,
+                  `This issue was auto-filed by the fault-watch. It auto-closes when the gate goes green on a pushed commit.`,
+                  ``,
+                  `**Severity rule:** if this gate failure means ALL subsequent submissions also fail (pipeline-blocking), fix immediately. Otherwise: finish the current batch, then fix before the next submission.`,
+                ].join('\n'),
+                labels: ['ci-fault', 'bug'],
+              });
+              core.info(`Filed ci-fault issue for ${f.gate} on ${f.sha}.`);
+            }

.gitea/workflows/local-review.yml

@@ -0,0 +1,74 @@
+name: Local-Model First-Pass Review (#131)
+
+# Non-blocking PR review by a local model (Ollama on the 4070 Ti).
+# Advisory only — nothing gates on the local model. The two-gate reviews
+# (spec + quality) remain the enforcement path; this is a first-pass
+# filter adding redundancy against controller degradation.
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  first-pass-review:
+    runs-on: rune-ci-desktop
+    # Advisory review needs PR context (diff base + comment target). Push
+    # runs have neither — run NOTHING on push (the 20721 lesson: guarding
+    # only the collect step let the post step fail the run at
+    # /issues//comments). Auto-bump PRs stay excluded as before.
+    if: ${{ !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          fetch-depth: 0
+      - name: Collect the PR diff
+        run: |
+          if [ -z "$GITEA_BASE_REF" ]; then
+            echo "no PR context (push run) — advisory review not applicable"
+            exit 0
+          fi
+          git diff "origin/${GITEA_BASE_REF}...HEAD" --stat > /tmp/pr_stat.txt
+          git diff "origin/${GITEA_BASE_REF}...HEAD" > /tmp/pr_diff.txt
+          wc -l /tmp/pr_diff.txt /tmp/pr_stat.txt
+        env:
+          GITEA_BASE_REF: ${{ gitea.event.pull_request.base.ref }}
+      - name: Local-model review (Ollama — advisory, never blocking)
+        env:
+          OLLAMA_HOST: ${{ secrets.OLLAMA_HOST }}
+        run: |
+          # Fail-open: no Ollama reachable → skip with a note, never fail.
+          if ! curl -sf "${OLLAMA_HOST:-http://192.168.1.50:11434}/api/tags" > /dev/null 2>&1; then
+            echo "Ollama unreachable — skipping first-pass review (advisory only)"
+            exit 0
+          fi
+          MODEL="${OLLAMA_MODEL:-qwen2.5-coder:7b}"
+          python3 scripts/local_firstpass_review.py \
+            --diff /tmp/pr_diff.txt --stat /tmp/pr_stat.txt \
+            --model "$MODEL" --host "${OLLAMA_HOST:-http://192.168.1.50:11434}"
+      - name: Post findings as PR comment
+        if: ${{ gitea.event.pull_request.number != 0 }}
+        env:
+          GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+          PR_NUMBER: ${{ gitea.event.pull_request.number }}
+        run: |
+          if [ -f /tmp/review_findings.md ]; then
+            export PR_NUMBER
+            python3 - <<'PYEOF'
+          import json, os, urllib.request
+          body = open("/tmp/review_findings.md").read()
+          if not body.strip():
+              print("no findings — no comment")
+              exit(0)
+          base = os.environ["GITEA_SERVER_URL"] + "/api/v1/repos/" + os.environ["GITEA_REPOSITORY"]
+          req = urllib.request.Request(
+              base + "/issues/" + os.environ["PR_NUMBER"] + "/comments",
+              data=json.dumps({"body": "## First-pass review (local model, advisory)\n\n" + body}).encode(),
+              headers={"Authorization": "token " + os.environ["GITEA_TOKEN"], "Content-Type": "application/json"},
+              method="POST")
+          with urllib.request.urlopen(req, timeout=30) as r:
+              print("comment posted:", r.status)
+          PYEOF
+          fi

.gitea/workflows/maintenance.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   lint-and-format:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - uses: actions/checkout@v4
       - name: Lint Python files
@@ -18,7 +18,7 @@ jobs:
           ruff format shared/ src/ || true
 
   canary-suite:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - uses: actions/checkout@v4
       - name: Run all canaries
@@ -37,7 +37,7 @@ jobs:
           exit $FAILED
 
   best-practices:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - uses: actions/checkout@v4
       - name: Check best practices
@@ -72,7 +72,7 @@ jobs:
           grep -rn "TODO\|FIXME\|HACK\|XXX" shared/ src/ --include="*.py" | head -10 || echo "  Clean"
 
   documentation-check:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - uses: actions/checkout@v4
       - name: Check documentation coverage
@@ -113,7 +113,7 @@ jobs:
   # push-triggered safety net in auto-version.yml. Detects master/tag drift
   # and files a deduped issue — it never auto-releases without the PR flow.
   release-drift-reconciliation:
-    runs-on: rune-infra-pi
+    runs-on: rune-ci-desktop
     steps:
       - uses: actions/checkout@v4
         with:

.gitea/workflows/merge-robot.yml

@@ -1,38 +1,38 @@
 name: Merge robot
-
-# Deterministic merge-on-green for this repo's PRs. No LLM, no polling by the
-# agent: the forge event model does the watching, this job does the one action.
-# Runs hourly + on CI completion events so green PRs merge without any agent
-# turn being spent on "check CI, merge, clean up".
-
 on:
   schedule:
-    - cron: '23 * * * *'
+  - cron: 23 * * * *
   workflow_dispatch: {}
   workflow_run:
-    workflows: ["CI Pipeline", "Auto-version and Release"]
-    types: [completed]
-
+    workflows:
+    - CI Pipeline
+    - Auto-version and Release
+    types:
+    - completed
 permissions:
   pull_requests: write
   issues: write
   contents: read
-
 env:
   OWNER: conductor
   REPO: rune
-
 jobs:
   merge-green:
     runs-on: rune-ci-desktop
     steps:
-      - name: "Checkout repo — job never checked out, scripts/merge_robot.py missing, exit 2 since #211"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-        with:
-          fetch-depth: 0
-      - name: Merge PRs whose protected checks are green (fail-loud)
-        env:
-          GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}  # conductor token; GITEA_TOKEN is reserved (auto token, read-only)
-          SERVER: ${{ gitea.server_url }}
-        run: |
-          python3 scripts/merge_robot.py "$GITEA_TOKEN" "$SERVER/api/v1/repos/conductor/rune"
+    - name: "Checkout repo \u2014 job never checked out, scripts/merge_robot.py missing,\
+        \ exit 2 since #211"
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      with:
+        fetch-depth: 0
+    - name: Merge PRs whose protected checks are green (fail-loud)
+      env:
+        GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+        SERVER: ${{ gitea.server_url }}
+      run: 'python3 scripts/merge_robot.py "$GITEA_TOKEN" "$SERVER/api/v1/repos/conductor/rune"
+
+        '
+concurrency:
+  group: merge-robot
+  cancel-in-progress: false
+  max-parallel: 1

.gitignore

@@ -14,3 +14,12 @@ state/
 # Runtime artifacts (cwd-local event journal + capability index)
 index/
 journal/
+src/rust/*/target/
+
+# batch 134: Go build artifacts — binaries are CI-built per gate (go build -o /tmp/...),
+# never stored. Each module dir keeps go.mod/main.go/truth*.json + *_test.go only.
+src/go/*/[^.]*
+!src/go/*/*.go
+!src/go/*/*.json
+!src/go/*/*.mod
+!src/go/*/*.sum

AGENTS.md

@@ -26,6 +26,9 @@ Only use `git commit --no-verify` in a genuine emergency: it bypasses the hooks
 - Every workflow is registered in the pipeline registry — new pipeline machinery ships with documentation (in ./.gitea/workflows/*.yml)
 - Every TUI surface is registered — no silent UI growth (in ./src/rune/*tui*.py)
 - New rune modules ship with tests or a canary — no ungoverned code surfaces (in ./src/rune/*.py)
+- Rust crate files stay under a line budget (in ./src/rust/*/src/*.rs)
+- Go modules stay under a line budget (in ./src/go/**/*.go)
+- No secrets in Rust or Go source files (in ./src/rust/*/src/*.rs, ./src/go/**/*.go)
 - PRDs are living documents — their generated state sections regenerate identically from governed sources
 - PRD staleness is a CI failure — docs rot is silent failure (in ./scripts/gen_prd_state.py)
 - The adversarial review procedure is binding — dispatch templates must reference it (in ./docs/adversarial-review.md)
@@ -58,3 +61,26 @@ fix, full pipeline re-entry (suite + ratchet + ruff + canaries + henxels;
 gates for anything beyond a mechanical minor), regression tests frozen forever,
 discharge recorded finding → test → commit. Symptom patches are rejected at
 review. To escape: edit `henxels.yaml` or this file — visibly.
+
+## Issue organisation standard (binding, 2026-09-19)
+
+One open note per idea. Issues use the template spine (kind, subsystem,
+version intent) with a plain-English heading that restates the subject —
+no meta-labels. Before minting a standalone issue, check whether the work
+belongs inside an existing parent:
+
+- **Parked ideas under a blocked/future epic** are filed as checklist items
+  in the parent's "Absorbed children" section, NOT as standalone issues.
+  Absorption is reversible — re-mint standalone when the idea becomes live.
+- **Live, dependency-tracked, or starting work** gets a standalone issue.
+- **Closures state the reason as data**: `closed_because` in the spine
+  (completed / superseded-by-#N / absorbed-into-#N / wont-do / duplicate),
+  plus a standard closing comment (plain summary first).
+- The reconciliation checker (`scripts/gitea_reconciliation_check.py`) must
+  stay green after any issue state change; the artifact is updated in the
+  same change that moves issues.
+
+## Async continuation final flow proofs (R13/M9) — 2026-09-19
+
+PR-flow live proof marker: harmless documentation addition exercising the
+canonical single-continuation path on the PC-local forge. No code change.

README.md

@@ -1,6 +1,6 @@
 # Rune
 
-**Current release: v0.86.0**
+**Current release: v0.161.0**
 
 **Rune is a persistent personal agent designed to accumulate experience, develop reusable competence, and remain recognisably the same agent even when its underlying foundation model changes.**
 

config/mimo-hooks/builder-bridge.ts

@@ -0,0 +1,124 @@
+import { execFile } from "node:child_process"
+import { existsSync, appendFileSync } from "node:fs"
+
+// builder-bridge — Rune Core preflight for the MiMo builder (handoff
+// 2026-09-10 §3–§7, Option C bridge tranche). For each user turn, the hook
+// extracts the user's message from the outgoing LLM request, runs the Rune
+// Core builder-bridge preflight (deterministic: route classification +
+// memory selection + active-Scaffolding projection, ZERO model calls), and
+// appends a compact capsule to the final user message. Same Rune Core the
+// TUI/operator path uses — this file is a thin adapter with no cognition.
+//
+// CANONICAL SOURCE: config/mimo-hooks/builder-bridge.ts
+// Installed to ~/.mimocode/hooks/builder-bridge.ts by
+// `scripts/install_mimo_hook.py` (hash-verified, drift-detecting — the same
+// contract as event-wait-guard.ts). T22: this file was previously
+// UNVERSIONED and hardcoded an ephemeral interpreter path (/tmp/ci-venv),
+// which silently killed the whole edge; both defects are repaired here.
+//
+// Overhead contract (§7/§8): capsule ≤ ~300 tokens; a repeat/empty task
+// costs ~0ms (TTL cache); a fresh task ~150ms (bounded retrieval). The hook
+// degrades silently to no-injection on any failure — it must never block
+// the builder.
+//
+// Injection policy: only append when the capsule is non-empty. A plain
+// "hello" gets nothing (§5: if nothing relevant exists, inject nothing).
+
+const BRIDGE = "/mnt/workdrive/issue161-harness/src/rune/builder_bridge_cli.py"
+const MARKER_PREFIX = "/tmp/rune-bridge-"
+
+// Interpreter resolution (T22 repair): the previous hardcoded
+// "/tmp/ci-venv/bin/python" is an EPHEMERAL path that no longer exists, so
+// every bridge call failed and the hook silently degraded — the MiMo edge
+// received no Rune Core preflight at all (zero fire-log lines). Resolve
+// against durable candidates, first existing wins; env override wins over
+// all of them. If nothing exists the hook degrades as before.
+const PY_CANDIDATES = [
+  process.env.MIMO_BRIDGE_PY,
+  "/mnt/workdrive/issue161-harness/.test-venv/bin/python",
+  "/home/nick/.venvs/memory/bin/python3",
+  "/usr/bin/python3",
+].filter((p) => typeof p === "string" && p.length > 0)
+
+function resolvePy() {
+  for (const p of PY_CANDIDATES) {
+    try {
+      if (existsSync(p)) return p
+    } catch {}
+  }
+  return null
+}
+
+// Per-process dedupe: identical task text within the cache TTL does not need
+// a second bridge call — the CLI has its own TTL cache, but skipping the
+// process spawn entirely for the same message text within 10 minutes keeps
+// repeats at ~0ms.
+const lastText = new Map() // text -> timestamp
+const TTL = 600_000
+
+function extractUserText(messages) {
+  // messages: Array<{ info: Message, parts: Part[] }> — newest last.
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const m = messages[i]
+    if (m?.info?.role !== "user") continue
+    const texts = []
+    for (const p of m.parts ?? []) {
+      if (p?.type === "text" && typeof p.text === "string") texts.push(p.text)
+    }
+    if (texts.length) return texts.join("\n").slice(0, 4000)
+  }
+  return ""
+}
+
+export default {
+  "experimental.chat.messages.transform": async (input, output) => {
+    try {
+      if (!Array.isArray(output.messages) || output.messages.length === 0) return
+      const userText = extractUserText(output.messages)
+      if (!userText || userText.length < 12) return // trivial/noise guard
+      // Harness-internal steps (checkpoint writer, compaction, system
+      // reminders) are not builder tasks — no capsule (measured: the fire
+      // log showed checkpoint-writer steps receiving capsules 2026-09-10).
+      if (/^(<system-reminder>|EXTRACTION REQUIRED)/.test(userText.trim())) return
+      const now = Date.now()
+      const prev = lastText.get(userText)
+      if (prev !== undefined && now - prev < TTL) return // dedupe repeats
+      lastText.set(userText, now)
+      if (lastText.size > 64) {
+        // evict oldest
+        let oldestKey = null, oldestVal = Infinity
+        for (const [k, v] of lastText) if (v < oldestVal) { oldestVal = v; oldestKey = k }
+        if (oldestKey) lastText.delete(oldestKey)
+      }
+
+      const py = resolvePy()
+      if (!py) return // no durable interpreter — degrade (never block)
+
+      const capsule = await new Promise((resolve) => {
+        execFile(py, [BRIDGE, userText], { timeout: 15_000 }, (err, stdout) => {
+          resolve(err ? "" : (stdout?.toString() ?? ""))
+        })
+      })
+      if (!capsule.trim()) return
+
+      // Durable fire-trace: one line per ACTUAL injection into an outgoing
+      // model request (handoff §1 proof requirement). Not a canary — this is
+      // standing observability for the bridge's consumer edge.
+      try {
+        appendFileSync("/tmp/rune-bridge-fire.log",
+          JSON.stringify({ ts: new Date().toISOString(), task: userText.slice(0, 80), capsule_tokens: Math.round(capsule.length / 4), py }) + "\n")
+      } catch {}
+
+      // Append the capsule to the LAST user message (the one being answered).
+      const last = output.messages[output.messages.length - 1]
+      if (last?.parts && Array.isArray(last.parts)) {
+        last.parts.push({
+          type: "text",
+          text: "\n\n<rune-preflight>\n" + capsule.trim() + "\n</rune-preflight>\n(Injected by Rune Core builder bridge — deterministic preflight, zero model calls. Relevant state above; ignore if not applicable to this task.)",
+        })
+      }
+    } catch {
+      // never block the builder on bridge failure
+    }
+  },
+}

config/umbrellas.json

@@ -1,72 +1,87 @@
 {
  "_comment": "GENERATED by rune.spine \u2014 compatibility view for legacy umbrella consumers. DO NOT EDIT: structural truth lives in store/spine/current.json; edits here are flagged by spine drift.",
  "_generated_by_spine": true,
- "generated_at": "2026-09-16T18:23:38Z",
+ "generated_at": "2026-10-10T06:45:48Z",
  "umbrellas": {
   "capability": {
    "description": "Tool selection and execution authority",
    "modules": [
-    "adaptive_router",
-    "builder_bridge",
+    "audit_ledger",
     "builder_bridge_cli",
-    "capability_broker",
-    "connection_pool",
-    "evidence_probe",
+    "core_server",
+    "cs_loader",
+    "evidence_capsule",
     "forge",
-    "forge_client",
     "intent_continuity",
-    "local_tool_runtime",
     "message_queue",
-    "openai_compat_transport",
+    "native_units",
     "provider_context",
-    "recall_uplift",
-    "route_risk_flags",
-    "tool_executor",
-    "tool_protocol"
+    "research_budget"
    ],
    "depends_on": [
     "memory"
    ],
    "mirrors": [],
    "canaries": [
+    "canary_native",
     "canary_native",
     "canary_p0_05",
-    "canary_p1_01"
+    "canary_p0_05",
+    "canary_p1_01",
+    "canary_p1_01",
+    "canary_rune_entry",
+    "canary_rune_serve"
    ]
   },
   "governance": {
    "description": "Quality control, drift detection, promotion, audit",
    "modules": [
-    "audit_ledger",
     "build_pipeline_policy",
-    "claim_audit",
+    "cc_loader",
     "contracts",
-    "curator",
-    "drift_core",
-    "drift_ledger",
-    "drift_observability",
     "failure_auto_filer",
-    "programme_gates"
+    "forge_client",
+    "grading",
+    "mutation_guards",
+    "paths",
+    "programme_gates",
+    "sc_loader",
+    "worthiness"
    ],
    "depends_on": [],
    "mirrors": [],
    "canaries": [
+    "canary_audit_ledger",
     "canary_full_system",
-    "canary_schema_migration"
+    "canary_full_system",
+    "canary_schema_migration",
+    "canary_schema_migration",
+    "canary_spine_meta"
    ]
   },
   "growth": {
    "description": "Learning and improvement",
    "modules": [
     "autonomy_loop",
+    "behavior",
+    "claim_audit",
     "cognitive_loop",
     "dream_cycle",
-    "elastic_cognition",
-    "goal",
+    "drift_cache",
+    "drift_compression",
+    "drift_core",
+    "drift_ledger",
+    "drift_observability",
     "growth_delta",
+    "growth_pipeline",
     "growth_simulator",
+    "meaningful_events",
+    "night_mode",
+    "outcome_ledger",
+    "outcome_utility",
     "self_improve",
-    "subconscious_pass"
+    "self_modify",
+    "skill_compiler"
    ],
    "depends_on": [
     "governance",
@@ -74,42 +89,53 @@
    ],
    "mirrors": [],
    "canaries": [
+    "canary_full_system",
     "canary_full_system"
    ]
   },
   "identity": {
    "description": "Who the agent is \u2014 persona, voice, anchors",
    "modules": [
-    "behavior",
     "identity_anchors",
     "persona_definition",
     "persona_gate",
     "prompt_sync",
+    "safety_override",
+    "self_model",
     "voice_hybrid",
     "voice_injector",
-    "voice_sync",
-    "voicebox"
+    "voice_sync"
    ],
    "depends_on": [
     "governance"
    ],
    "mirrors": [],
    "canaries": [
+    "canary_full_system",
     "canary_full_system"
    ]
   },
   "inference": {
    "description": "Model routing and outbound requests",
    "modules": [
+    "adaptive_router",
+    "evidence_probe",
+    "inference_paths",
     "inference_trace",
+    "local_tool_runtime",
     "model_connect",
     "model_profiles",
     "model_registry",
     "model_routing",
+    "openai_compat_transport",
     "provider_budget",
     "provider_registry",
+    "recall_router",
+    "recall_uplift",
     "response_adapter",
+    "route_risk_flags",
     "standardized_providers",
+    "tc_loader",
     "token_optimizer"
    ],
    "depends_on": [
@@ -117,8 +143,11 @@
    ],
    "mirrors": [],
    "canaries": [
+    "canary_p1_02",
     "canary_p1_02",
     "canary_p1_06",
+    "canary_p1_06",
+    "canary_resource_authority",
     "canary_resource_authority"
    ]
   },
@@ -126,52 +155,76 @@
    "description": "Storing, retrieving, and managing knowledge",
    "modules": [
     "abstraction",
+    "abstraction_ladder",
+    "auto_context",
     "cache",
-    "drift_cache",
-    "drift_compression",
+    "concept_topology",
+    "connection_pool",
+    "curator",
+    "drift-ledger",
+    "experience_encoding",
+    "ffi_query_memory_smoke",
     "graph_memory",
     "graph_shard_bridge",
+    "lexicon_evolution",
     "memory_consolidation",
     "memory_env",
     "memory_selector",
     "memory_store",
+    "memory_types",
+    "mems_loader",
+    "message_graph",
+    "mr_loader",
+    "ms_loader",
     "query_memory",
-    "recall_router",
     "retrieval_benchmark",
     "shard_manager",
+    "sleep_time",
+    "state_checkpoint",
+    "subconscious_pass",
     "tier_manager",
-    "warm_neuron_store"
+    "warm_neuron_store",
+    "warm_router"
    ],
    "depends_on": [
     "governance"
    ],
    "mirrors": [],
    "canaries": [
+    "canary_full_system",
     "canary_full_system",
     "canary_memory_synthesis",
+    "canary_memory_synthesis",
+    "canary_query_memory",
     "canary_query_memory"
    ]
   },
   "orchestration": {
    "description": "Task lifecycle, operator, TUI presentation",
    "modules": [
+    "attention_capsule",
     "auto_detect",
     "build_mode",
     "build_orchestrator",
+    "builder_bridge",
+    "capability_broker",
     "chat_bubble",
+    "context_broker",
     "cron_engine",
     "custodian",
     "dependency_tracker",
+    "elastic_cognition",
     "event_bus",
     "event_envelope",
+    "execution_trace",
     "gitea_auth",
     "gitea_pipeline",
     "gitea_provision",
+    "goal",
     "hook_engine",
     "message_widgets",
     "microkernel",
-    "night_mode",
-    "outcome_ledger",
+    "pane_authority",
     "parallel_processor",
     "pins",
     "progressive_escalation",
@@ -179,19 +232,19 @@
     "rune_operator",
     "rune_profiler",
     "rune_spinner",
-    "rune_tui",
-    "safety_override",
-    "sleep_time",
     "subsystem_health",
     "system_registry",
     "task_gate",
     "task_persist",
     "tiered_executor",
     "time_awareness",
+    "tool_executor",
+    "tool_protocol",
+    "tui_transport",
     "tui_validator",
     "umbrella_update",
     "verification_layer",
-    "warm_router",
+    "witness",
     "work_manager"
    ],
    "depends_on": [
@@ -204,19 +257,25 @@
    "mirrors": [],
    "canaries": [
     "canary_cognitive_strata",
+    "canary_cognitive_strata",
+    "canary_conversation_state",
     "canary_conversation_state",
     "canary_gitea_pipeline",
+    "canary_gitea_pipeline",
+    "canary_orchestration_foundation",
     "canary_orchestration_foundation",
     "canary_p1_07",
+    "canary_p1_07",
     "canary_surface_parity",
-    "canary_tui_drift"
+    "canary_surface_parity",
+    "canary_tui_drift",
+    "canary_tui_drift",
+    "canary_tui_transport"
    ]
   },
   "perception": {
    "description": "Input processing and context assembly",
    "modules": [
-    "attention_capsule",
-    "auto_context",
     "auto_tasks",
     "behaviour_ledger",
     "build_basis",
@@ -233,7 +292,6 @@
     "construction_pattern",
     "construction_patterns_builtin",
     "construction_projection",
-    "context_broker",
     "context_pressure",
     "drift_resume",
     "event_wait",
@@ -245,9 +303,12 @@
     "programme_continuation",
     "project_registry",
     "release_notes",
+    "rune_tui",
     "salience_gate",
     "scaffold",
     "spine",
+    "spine_language",
+    "spine_loader",
     "stage_guards",
     "structural_migration",
     "structural_model",
@@ -255,9 +316,9 @@
     "testing_mode",
     "toolchain",
     "tui_backlog",
+    "voicebox",
     "wait_guard",
-    "wait_guard_corpus",
-    "witness"
+    "wait_guard_corpus"
    ],
    "depends_on": [
     "memory"
@@ -265,8 +326,10 @@
    "mirrors": [],
    "canaries": [
     "canary_context_broker",
+    "canary_context_broker",
+    "canary_full_system",
     "canary_full_system"
    ]
   }
  }
-}
+}

docs/SCAFFOLDING.md

@@ -272,4 +272,19 @@ observations, fresh resume.
 
 Release-note generator: LIVE-PROVEN (real Gitea, 10 releases). Backfill:
 0.66.35→0.66.44 carrying historical-backfill provenance. Pre-0.66.35
-history: skipped (weak evidence — honest limitation).
+history: skipped (weak evidence — honest limitation).
+
+## Contract discovery → spine (2026-10-05, #2465 CI correction)
+
+The closed construction contract is the authority for discoveries. Spine
+rebuild reads its observed entities and candidate corrections; it does not
+claim a correction has been built. Qualified IDs such as
+`rust-crate:cognition_core` keep their declared kind. Bare file paths,
+test suites and other unqualified references become
+`construction-surface:<reference>`, never `module`. An observed
+surface may be PRESENT; a candidate stays DECLARED until independently
+observed. Existing bad records are migrated with their evidence and edge
+references intact. This matters: the first write-back mapped bare paths to
+modules, made 22 false module records and crashed CI on the next rebuild.
+The per-contract quick-reference markdown is generated from the scaffold
+store at close; it is a view, not another authority.

docs/dichotomy-rebase-honest-audit.md

@@ -0,0 +1,228 @@
+# DICHOTOMY REBASE — HONEST AUDIT (function-level)
+
+_Regenerate with `python3 scripts/dichotomy_audit.py --write`. A module is FULL only when 80%+ of its Python functions have name-preserving counterparts in the Go/Rust implementation — directories without the functions are facades and count as NOT TOUCHED._
+
+**Function-level completion: 23%** (535/2357 runtime functions matched)
+
+| Status | Modules | Lines | Meaning |
+|---|---|---|---|
+| FULL | 8 | 734 | 80%+ of functions ported |
+| PARTIAL | 79 | 39290 | 20–80% — real logic exists, gaps named below |
+| NOT TOUCHED | 114 | 31504 | no name-preserving implementation |
+| Total runtime | 201 | 71528 | |
+
+## NOT TOUCHED — the port queue, in priority order (largest first)
+
+| Module | Lines | Fns | Side |
+|---|---|---|---|
+| rune_tui | 4170 | 159 | TUI-LAST |
+| curator | 1838 | 43 | GO |
+| spine | 1204 | 31 | RUST |
+| abstraction | 656 | 17 | GO |
+| contracts | 629 | 7 | RUST |
+| construction_intent | 555 | 16 | RUST |
+| canary_audit_ledger | 541 | 2 | TEST-INFRA |
+| event_wait | 518 | 14 | GO |
+| tui_validator | 514 | 13 | TUI-LAST |
+| memory_selector | 511 | 13 | RUST |
+| system_registry | 504 | 14 | RUST |
+| construction_pattern | 496 | 12 | RUST |
+| auto_tasks | 460 | 14 | GO |
+| drift_ledger | 456 | 16 | RUST |
+| goal | 453 | 20 | GO |
+| release_notes | 446 | 16 | GO |
+| model_routing | 432 | 13 | GO |
+| worthiness | 411 | 13 | unclassified |
+| token_optimizer | 410 | 22 | RUST |
+| behavior | 408 | 9 | RUST |
+| capability_ledger | 405 | 18 | RUST |
+| chat_bubble | 401 | 12 | TUI-LAST |
+| prompt_sync | 379 | 14 | RUST |
+| drift-ledger | 355 | 14 | unclassified |
+| programme_continuation | 349 | 11 | RUST |
+| canary_rune_serve | 329 | 13 | TEST-INFRA |
+| canary_p1_07 | 324 | 10 | TEST-INFRA |
+| layout_contract | 316 | 6 | RUST |
+| message_queue | 316 | 13 | GO |
+| drift_observability | 315 | 8 | RUST |
+| build_basis | 314 | 12 | RUST |
+| canary_p0_07 | 310 | 10 | TEST-INFRA |
+| attention_capsule | 296 | 7 | RUST |
+| canary_p1_01 | 294 | 12 | TEST-INFRA |
+| drift_cache | 292 | 15 | RUST |
+| outcome_ledger | 286 | 7 | RUST |
+| time_awareness | 286 | 14 | RUST |
+| canary_p1_06 | 280 | 7 | TEST-INFRA |
+| auto_context | 273 | 8 | GO |
+| canary_p1_03 | 271 | 9 | TEST-INFRA |
+| canary_gitea_automation | 263 | 3 | TEST-INFRA |
+| canary_p1_02 | 253 | 10 | TEST-INFRA |
+| construction_patterns_builtin | 249 | 1 | RUST |
+| canary_full_system | 248 | 2 | TEST-INFRA |
+| toolchain | 236 | 5 | RUST |
+| task_gate | 235 | 8 | RUST |
+| canary_native | 231 | 3 | TEST-INFRA |
+| lexicon_evolution | 229 | 7 | unclassified |
+| openai_compat_transport | 227 | 9 | GO |
+| shard_manager | 223 | 9 | RUST |
+| spine_language | 218 | 5 | RUST |
+| evidence_probe | 213 | 9 | GO |
+| canary_p0_04 | 207 | 8 | TEST-INFRA |
+| forge_client | 203 | 18 | GO |
+| canary_context_broker | 199 | 10 | TEST-INFRA |
+| canary_p0_05 | 199 | 13 | TEST-INFRA |
+| testing_mode | 196 | 12 | RUST |
+| cc_loader | 195 | 26 | RUST |
+| grading | 193 | 3 | unclassified |
+| canary_spine_meta | 192 | 7 | TEST-INFRA |
+| verification_layer | 190 | 12 | RUST |
+| message_graph | 187 | 12 | unclassified |
+| ffi_query_memory_smoke | 183 | 5 | RUST |
+| behaviour_ledger | 174 | 12 | RUST |
+| canary_tui_transport | 174 | 7 | TEST-INFRA |
+| canary_tui_drift | 170 | 2 | TEST-INFRA |
+| inference_trace | 164 | 6 | RUST |
+| ms_loader | 163 | 16 | RUST |
+| canary_gitea_pipeline | 159 | 2 | TEST-INFRA |
+| forge | 146 | 11 | GO |
+| rune_graphic | 145 | 5 | TUI-LAST |
+| project_registry | 139 | 11 | RUST |
+| canary_rune_entry | 137 | 3 | TEST-INFRA |
+| tui_backlog | 125 | 5 | TUI-LAST |
+| state_checkpoint | 123 | 8 | unclassified |
+| drift_resume | 118 | 3 | RUST |
+| canary_conversation_state | 115 | 2 | TEST-INFRA |
+| canary_query_memory | 111 | 2 | TEST-INFRA |
+| tui_transport | 108 | 10 | TUI-LAST |
+| canary_unbounded | 105 | 2 | TEST-INFRA |
+| spine_loader | 105 | 7 | RUST |
+| message_widgets | 104 | 6 | TUI-LAST |
+| self_modify | 102 | 7 | unclassified |
+| sc_loader | 96 | 6 | RUST |
+| inference_paths | 95 | 2 | unclassified |
+| mutation_guards | 94 | 2 | unclassified |
+| concept_topology | 90 | 7 | unclassified |
+| cs_loader | 90 | 5 | RUST |
+| tc_loader | 88 | 5 | RUST |
+| canary_schema_migration | 86 | 1 | TEST-INFRA |
+| mems_loader | 83 | 5 | RUST |
+| execution_trace | 71 | 4 | unclassified |
+| experience_encoding | 70 | 1 | unclassified |
+| abstraction_ladder | 68 | 3 | unclassified |
+| pane_authority | 67 | 2 | unclassified |
+| skill_compiler | 64 | 4 | unclassified |
+| meaningful_events | 61 | 3 | unclassified |
+| outcome_utility | 59 | 4 | unclassified |
+| memory_types | 54 | 2 | unclassified |
+| growth_pipeline | 53 | 2 | unclassified |
+| paths | 53 | 6 | unclassified |
+| wait_guard_corpus | 46 | 0 | RUST |
+| canary_cognitive_strata | 44 | 1 | TEST-INFRA |
+| research_budget | 44 | 3 | unclassified |
+| self_model | 44 | 3 | unclassified |
+| evidence_capsule | 43 | 3 | unclassified |
+| builder_bridge_cli | 42 | 1 | GO |
+| __init__ | 40 | 1 | RUST |
+| mr_loader | 38 | 13 | RUST |
+| canary_memory_synthesis | 33 | 1 | TEST-INFRA |
+| canary_resource_authority | 33 | 1 | TEST-INFRA |
+| canary_surface_parity | 33 | 1 | TEST-INFRA |
+| canary_orchestration_foundation | 32 | 1 | TEST-INFRA |
+| canary_gitea_delegation | 31 | 1 | TEST-INFRA |
+
+## PARTIAL — gaps to close (matched/total fns; first missing named)
+
+| Module | Lines | Coverage | Missing (first named) |
+|---|---|---|---|
+| rune_operator | 2746 | 15/68 | _build_model_router, _bounded, _probe_failure_classes, _sorted_tool_names, _memory_query_from_trace, _observation_from_compaction |
+| memory_store | 2586 | 29/78 | _ctx_budget, now_iso, ensure_memory_type_column, _embed, _temp_json, _entities_to_json |
+| context_broker | 870 | 6/28 | _py_default_estimator, _cc_core, _py_default_budget, _py_default_memory_budget, _py_memory_disabled_value, reset_discovered_windows |
+| local_tool_runtime | 809 | 8/30 | _find_capability_executor, _extract_context_length, context_length, reset_context_length_cache, supports_tools, supports_thinking |
+| construction_interface | 1193 | 6/27 | _to_stage_check, _guard_specs_from_obligations, t_layout, _obligations_projection, _obligation_scope_files, main |
+| structural_store | 656 | 12/33 | _sorted, new_doc, load, _redact_secrets, save, canonical_digest |
+| persona_gate | 724 | 7/26 | _now, _cc_pg_core, _py_lex, _lex_input, _py_overlap, _embed_raw |
+| sleep_time | 984 | 8/26 | _ctx_budget, _ensure_dirs, db_connect, fetch_sessions, retain_to_store, reflect_local |
+| provider_registry | 679 | 11/28 | _ctx_budget, _format_tools_openai, _execute_tool_calls, _execute_tool_calls_anthropic, get_registry, connect_provider |
+| tool_protocol | 461 | 10/27 | _utc_now_iso, _contains_tool_object_key, to_ollama_tools, dispatch_validated_tool, tool_requires_approval, to_dict |
+| warm_router | 1540 | 19/36 | _ensure_use_history_table, record_outcome, record_neuron_fire, _py_base_level_from_uses, base_level_activation, _db |
+| construction_decision | 1014 | 4/20 | normalize_need, _sc_core, _py_language_placement, resolve_surface, ss_entity, implemented_contracts |
+| tool_executor | 1836 | 31/47 | _execute_tool_now, _prepared_path, serialize_prepared_tool, deserialize_prepared_tool, confirm_write, _resolve_execution_cwd |
+| work_manager | 594 | 9/25 | group_by_file, load_config, save_config, load_batches, save_batches, create_work |
+| growth_delta | 449 | 5/20 | _ctx_budget, _store_db, _llm, _parse_json, _load_deltas, _save_deltas |
+| memory_consolidation | 743 | 7/22 | _consolidation_memory_oracle, _consolidation_neuron_oracle, _load_knowledge, _save_knowledge, _load_lessons, _save_lessons |
+| provider_budget | 357 | 5/20 | get_tracker, track_usage, check_provider, get_best_provider, failover, get_status |
+| safety_override | 574 | 7/22 | _keyword_stopwords, _cc_probe, cc_loader_pin, self_test, _py_matches, escalation_rate |
+| cron_engine | 440 | 13/27 | get_cron_engine, run_task, start_engine, stop_engine, to_dict, fire_on_task_complete |
+| night_mode | 421 | 5/19 | _ctx_budget, get_night_mode, start_night_mode, stop_night_mode, get_status, get_report |
+| scaffold | 868 | 17/31 | init, add_domain, add_component, add_contract, set_prd, set_next_action |
+| build_mode | 521 | 20/33 | _load_state, _save_state, assess_complexity, start_research, start_feasible, start_consult |
+| capability_broker | 908 | 7/20 | _native_tool_schemas, _select_for_job, load_registry, _native_tool_cards, _cards_are_stale, load_cards |
+| failure_auto_filer | 527 | 11/24 | _error_text, unconsumed, mark_consumed, unconsumed, mark_consumed, submit |
+| cache | 492 | 6/17 | _record_hit, _record_miss, flush_stats, get_cache, put_cache, invalidate_scope |
+| elastic_cognition | 774 | 3/14 | _ctx_budget, _build_constitution, _get_constitution, _load_cloud_config, execute_at_tier, _execute_deterministic |
+| identity_anchors | 542 | 5/16 | show_anchors, show_rules, show_pronouns, _announcement_patterns, _pronoun_patterns, _hedge_patterns |
+| parallel_processor | 194 | 3/14 | _shutdown_processor, get_processor, run_parallel_with_args, get_status, test_parallel, run_parallel_with_args |
+| structural_model | 352 | 9/20 | workspace_record, workspace_advance, _init_project, save, reload, add |
+| capability_fit | 455 | 3/13 | record_semantic_fit, _provides_contracts, _consumers, discover_candidates, _cs_core, decide |
+| claim_audit | 484 | 4/14 | _get_warm_neuron_store, reframe, _graph_has, _warm_has, verify, journal |
+| drift_core | 517 | 4/14 | _ms_core, _now_iso, _py_check_promotion_eligibility, promote_entry, compute_fama, compute_drift_velocity |
+| model_profiles | 438 | 5/15 | get_profile_path, load_profile, save_profile, build_profile_from_ollama, scan_all_models, get_or_create_profile |
+| tier_manager | 262 | 5/15 | _cc_probe, cc_loader_pin, _py_core_now, _py_get_tier, _py_promote, _py_demote |
+| witness | 475 | 8/18 | _ctx_budget, _now, _cc_probe, cc_loader_pin, _py_extract_topic, _py_detect_signals |
+| drift_compression | 307 | 3/12 | _py_get_compression_ratio, _py_compress_text, _py_compress_entry, _py_should_warn, _py_warn_before_compress, get_compression_ratio |
+| builder_bridge | 326 | 3/11 | _construction_store, _active_construction_lines, _default_selector, _cached_memory, _get_selector, _retrieve_memory |
+| graph_memory | 474 | 2/9 | now_iso, connect, resolve_entity, add_edge, query, stats |
+| intent_continuity | 168 | 2/9 | to_dict, from_dict, _load, save, create_detour, resolve_detour |
+| pins | 284 | 5/12 | _store_path, _save, _detail_blob, unpin, _py_pin_recall, list_pins |
+| voice_hybrid | 427 | 3/10 | _connect, _load_growth, _save_growth, source_profiles, always, grow |
+| voice_sync | 299 | 3/10 | _now, get_delivery_register_from_db, get_delivery_register, update_rune_md, check_sync, handle_hook |
+| audit_ledger | 212 | 2/8 | _compute_hash, get_entries, log_promotion, log_gate_result, log_drift_alert, main |
+| context_pressure | 262 | 3/9 | log_measurement, read_log, log_stats, _now, handle_hook, main |
+| core_server | 234 | 6/12 | make_server, log_message, _send_json, _send_ndjson, do_GET, do_POST |
+| microkernel | 434 | 6/12 | now_iso, discover, _extract_manifest, _load_registry, _save_registry, _run_hook |
+| model_registry | 253 | 2/8 | test_registry, to_dict, get_profile, get_enabled_profiles, get_profiles_by_tier, list_profiles |
+| persona_definition | 210 | 2/8 | _by_topic, compile_full, emit_constitution, emit_identity, emit_persona, handle_hook |
+| progressive_escalation | 279 | 2/8 | execute_with_escalation, test_escalation, handle_hook, to_dict, execute, verify |
+| voicebox | 164 | 5/11 | _run, start_recording, stop_recording, _transcribe_and_type, on_press, on_release |
+| connection_pool | 148 | 3/8 | get_pool, get_connection, get_status, get_connection, get_status |
+| hook_engine | 860 | 3/8 | discover_functions, tag_function, validate_placements, generate_report, handle_hook |
+| iteration | 190 | 3/8 | _now, context_packet, predictive_impact, descriptive_impact, add |
+| task_persist | 269 | 5/10 | _save, export, restore, main, handle_hook |
+| tiered_executor | 291 | 3/8 | _ctx_budget, test_executor, to_dict, to_dict, _execute_model |
+| adaptive_router | 625 | 15/19 | _floor_applies_from_flags, _floor_reason, _record_transition_with, _detect_external_refs |
+| construction_commands | 268 | 1/5 | _refuse, _validate, _accept, dispatch |
+| construction_mode | 395 | 1/5 | _tokens, _contains_any, to_dict, from_dict |
+| model_connect | 471 | 7/11 | _ctx_budget, _now, _get_cloud_models, handle_hook |
+| self_improve | 246 | 1/5 | _now, suggest_improvements, handle_hook, main |
+| subconscious_pass | 187 | 1/5 | main, _extract_topic, save_reflection, get_recent_findings |
+| construction_activation | 237 | 1/4 | _scaffold_for, _auto_structural_awareness, dispatch_from_decision |
+| construction_projection | 225 | 1/4 | _contract_entity, validate, write_mini_doc |
+| dependency_tracker | 202 | 2/5 | check_propagation, get_full_map, main |
+| event_envelope | 303 | 5/8 | test_envelope, to_canonical_dict, to_dict |
+| response_adapter | 222 | 4/7 | parse_plain_response, test_adapter, to_dict |
+| salience_gate | 243 | 1/4 | test_salience, handle_hook, to_dict |
+| subsystem_health | 163 | 3/6 | set_auto_filer, record_failure, configure_logging |
+| warm_neuron_store | 122 | 3/6 | _db, neuron_slugs, handle_hook |
+| cognitive_budgeter | 208 | 1/3 | test_budgeter, to_dict |
+| event_bus | 244 | 5/7 | _store_path, handle_hook |
+| graph_projection | 108 | 3/5 | write_all, _now |
+| rune_profiler | 165 | 1/3 | profile_model_call, main |
+| stage_guards | 281 | 7/9 | to_dict, chk |
+| standardized_providers | 281 | 3/5 | list_providers, connect_all_local |
+| structural_migration | 77 | 2/4 | apply_migration, consent_brief |
+| voice_injector | 138 | 3/5 | test_injection, to_dict |
+| construction_depth | 138 | 1/2 | to_dict |
+| recall_router | 165 | 2/3 | handle_hook |
+
+## FULL — ported, parity-gated
+
+| Module | Lines | Fns | Side |
+|---|---|---|---|
+| recall_uplift | 141 | 1/1 | RUST |
+| rune_spinner | 130 | 4/5 | RUST |
+| wait_guard | 116 | 1/1 | RUST |
+| failure_recovery | 108 | 1/1 | RUST |
+| programme_gates | 85 | 4/5 | RUST |
+| impact_preview | 69 | 2/2 | RUST |
+| provider_context | 48 | 1/1 | GO |
+| route_risk_flags | 37 | 1/1 | RUST |

docs/gitea_issue_reconciliation.json

@@ -11,24 +11,22 @@
   "NEEDS_REVALIDATION",
   "DEFERRED_FUTURE"
  ],
- "live_defects": [
-  324
- ],
+ "live_defects": [],
  "records": [
   {
    "number": 324,
    "title": "Engine defect: checkpoint writer fails deterministically on aborted worker sessions (MessageAbortedError -> empty checkpoint shells)",
-   "tracker_state": "open",
-   "reconciliation_state": "VALID_OPEN",
+   "tracker_state": "closed",
+   "reconciliation_state": "FIXED_VERIFIED",
    "labels": [
     "bug",
     "custodian",
     "life",
     "memory"
    ],
-   "live_defect": true,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "live_defect": false,
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 defect no longer reproduces: zero MessageAbortedError in current logs (incl. active worker), six most recent session checkpoints full documents (111-396 lines); verified by present-absence 2026-09-19"
   },
   {
    "number": 316,
@@ -237,8 +235,8 @@
   {
    "number": 183,
    "title": "Future: typed temporal semantics for facts, relationships, beliefs, and preferences",
-   "tracker_state": "open",
-   "reconciliation_state": "DEFERRED_FUTURE",
+   "tracker_state": "closed",
+   "reconciliation_state": "HISTORICAL_EVIDENCE",
    "labels": [
     "P3 \u2014 low",
     "governance",
@@ -250,14 +248,14 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 idea absorbed into parent epic #181 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
   },
   {
    "number": 182,
    "title": "Future: GitHub code-search prior-art audit for graph and vector memory",
-   "tracker_state": "open",
-   "reconciliation_state": "DEFERRED_FUTURE",
+   "tracker_state": "closed",
+   "reconciliation_state": "HISTORICAL_EVIDENCE",
    "labels": [
     "P3 \u2014 low",
     "governance",
@@ -266,8 +264,8 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 idea absorbed into parent epic #181 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
   },
   {
    "number": 181,
@@ -287,13 +285,13 @@
    ],
    "live_defect": false,
    "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "next_action": "epic holds absorbed children #182 #183 + research watchlist #164 #165 #166; closes when prerequisites land or ideas dropped"
   },
   {
    "number": 179,
    "title": "Future: succession/privacy semantics and lineage evaluation",
-   "tracker_state": "open",
-   "reconciliation_state": "DEFERRED_FUTURE",
+   "tracker_state": "closed",
+   "reconciliation_state": "HISTORICAL_EVIDENCE",
    "labels": [
     "P3 \u2014 low",
     "governance",
@@ -305,14 +303,14 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 idea absorbed into parent epic #175 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
   },
   {
    "number": 178,
    "title": "Future: evidence-grounded ancestral perspective with explicit uncertainty",
-   "tracker_state": "open",
-   "reconciliation_state": "DEFERRED_FUTURE",
+   "tracker_state": "closed",
+   "reconciliation_state": "HISTORICAL_EVIDENCE",
    "labels": [
     "P3 \u2014 low",
     "governance",
@@ -322,14 +320,14 @@
     "perception"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 idea absorbed into parent epic #175 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
   },
   {
    "number": 177,
    "title": "Future: temporal autobiographical model with provenance and reinterpretation lineage",
-   "tracker_state": "open",
-   "reconciliation_state": "DEFERRED_FUTURE",
+   "tracker_state": "closed",
+   "reconciliation_state": "HISTORICAL_EVIDENCE",
    "labels": [
     "P3 \u2014 low",
     "governance",
@@ -340,14 +338,14 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 idea absorbed into parent epic #175 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
   },
   {
    "number": 176,
    "title": "Future: lineage-aware situated curiosity for meaningful autobiographical gaps",
-   "tracker_state": "open",
-   "reconciliation_state": "DEFERRED_FUTURE",
+   "tracker_state": "closed",
+   "reconciliation_state": "HISTORICAL_EVIDENCE",
    "labels": [
     "P3 \u2014 low",
     "feature",
@@ -358,8 +356,8 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 idea absorbed into parent epic #175 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
   },
   {
    "number": 175,
@@ -379,13 +377,13 @@
    ],
    "live_defect": false,
    "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "next_action": "epic holds absorbed children #176-#179 as checklist items; closes when prerequisites land or ideas dropped"
   },
   {
    "number": 166,
    "title": "RESEARCH WATCHLIST: Memory-R1 (RL memory ops), Titans (test-time memory), Vespa/Weaviate/Milvus (retrieval competitors)",
-   "tracker_state": "open",
-   "reconciliation_state": "DEFERRED_FUTURE",
+   "tracker_state": "closed",
+   "reconciliation_state": "HISTORICAL_EVIDENCE",
    "labels": [
     "P3 \u2014 low",
     "growth",
@@ -394,14 +392,14 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 idea absorbed into parent epic #181 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
   },
   {
    "number": 165,
    "title": "RESEARCH: SimpleMem semantic compression + A-MEM dynamic linking + Letta sleep-time compute",
-   "tracker_state": "open",
-   "reconciliation_state": "DEFERRED_FUTURE",
+   "tracker_state": "closed",
+   "reconciliation_state": "HISTORICAL_EVIDENCE",
    "labels": [
     "P3 \u2014 low",
     "infrastructure",
@@ -410,14 +408,14 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 idea absorbed into parent epic #181 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
   },
   {
    "number": 164,
    "title": "RESEARCH: HippoRAG 2 \u2014 PPR-style associative propagation as warm-neuron activation candidate",
-   "tracker_state": "open",
-   "reconciliation_state": "DEFERRED_FUTURE",
+   "tracker_state": "closed",
+   "reconciliation_state": "HISTORICAL_EVIDENCE",
    "labels": [
     "P3 \u2014 low",
     "growth",
@@ -426,27 +424,27 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 idea absorbed into parent epic #181 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
   },
   {
    "number": 163,
    "title": "Temporal graph backend spike: Neo4j vs FalkorDB (LadybugDB experimental; Graphiti as reference)",
    "tracker_state": "open",
-   "reconciliation_state": "NEEDS_REVALIDATION",
+   "reconciliation_state": "VALID_OPEN",
    "labels": [
     "P1 \u2014 high",
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "run the backend spike; compare on same corpus/query set; record evidence-backed recommendation"
   },
   {
    "number": 162,
    "title": "Qdrant associative-memory projection spike (dense/sparse/multivector + ColBERT late-interaction reranking)",
-   "tracker_state": "open",
-   "reconciliation_state": "NEEDS_REVALIDATION",
+   "tracker_state": "closed",
+   "reconciliation_state": "SUPERSEDED",
    "labels": [
     "P1 \u2014 high",
     "custodian",
@@ -454,8 +452,8 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 scope carried verbatim by #316 (ADAPT-1 B3-v2); single-tracker rule"
   },
   {
    "number": 159,
@@ -478,8 +476,8 @@
   {
    "number": 158,
    "title": "Generated wiring-status / architecture-truth report",
-   "tracker_state": "open",
-   "reconciliation_state": "VALID_OPEN",
+   "tracker_state": "closed",
+   "reconciliation_state": "SUPERSEDED",
    "labels": [
     "P2 \u2014 medium",
     "growth",
@@ -489,8 +487,8 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-11",
-   "next_action": ""
+   "last_revalidated": "2026-09-19",
+   "next_action": "none \u2014 scope carried verbatim by #315 (ADAPT-1 B2-v2); single-tracker rule"
   },
   {
    "number": 156,
@@ -1151,6 +1149,6 @@
    "next_action": ""
   }
  ],
- "last_reconciled": "2026-09-12",
- "reconciled_by": "PL1 held-out era reconciliation (fresh session 2026-09-12)"
-}
+ "last_reconciled": "2026-09-19",
+ "reconciled_by": "fresh-session tranche 2026-09-19: template retrofit (spine+plain-English on all open issues), closures #158/#162 (SUPERSEDED) and #324 (FIXED_VERIFIED), research labels applied to #163/#164/#165/#166/#182/#316, stale bug labels removed from #163-#166; 2026-09-19 absorption pass: parked children absorbed into parents (#175<-#176..#179; #181<-#182,#183,#164..#166) per one-open-note-per-idea standard"
+}

docs/language-dichotomy-ledger.md

@@ -0,0 +1,134 @@
+# THE LANGUAGE DICHOTOMY LEDGER — measured, not assumed
+
+_Created 2026-10-06 from real benchmarks. This is the governing standard for every port in the full dichotomy rebase. Every port must pass the "which language is better for THIS operation?" test before being assigned._
+
+---
+
+## The Measured Benchmarks
+
+| Operation | Python | Python ctypes → Rust | Go cgo → Rust | Pure Go inline |
+|---|---|---|---|---|
+| Simple tier check | 0.05 µs | 1.4 µs | 1.4 µs | — |
+| Consolidation (669B payload) | 0.2 µs | 2.9 µs | 3.4 µs | 0.3 µs |
+| Concurrent HTTP (10 requests) | 10.8ms (4.0x) | — | 8.4ms (5.1x) | — |
+| CPU-bound pattern matching (1000 msgs) | 9.6ms (0.8x — GIL) | — | ~2.5ms (est. 3.5-4x) | — |
+| Compression + zlib wrapper | 0.2 µs | 13.7 µs (worse!) | — | — |
+
+## The Laws
+
+### Law 1: FFI overhead is negligible for the real workload
+The cgo/ctypes boundary costs 1.4-3.4 µs per call. Ollama inference costs 200-5000 ms. FFI overhead is 0.0003-0.0017% of total request time. The language of the caller doesn't matter for the boundary.
+
+### Law 2: Go wins for CPU-bound reactive work
+Goroutines deliver true parallelism (5.1x concurrent HTTP, ~3.5-4x CPU-bound). Python's GIL serialises CPU-bound work (0.8x speedup with 4 threads). Go wins for: operator, witness, event bus, work manager, tool executor.
+
+### Law 3: Simple operations stay in the caller's language
+Pure Python compression: 0.3 µs. Same op via Rust FFI: 10.4 µs. The FFI overhead exceeds the compute benefit for simple operations. If a Go module needs a string truncation, do it IN GO.
+
+### Law 4: Rust wins for complex deterministic operations
+Compile-time type safety, zero-cost abstractions, memory safety, near-native speed for complex compute. Rust wins for: scoring, dedup, pattern matching across many signals, record assembly with many fields, structural store operations.
+
+### Law 5: Compression across the FFI boundary makes things SLOWER
+Measured: uncompressed FFI call = 6.1 µs. With zlib wrapper = 13.7 µs (+125%). The cgo transition overhead (~1-2µs) dominates; payload size doesn't matter for local calls under 10KB. Compression helps only for network transfers (>100KB payloads).
+
+### Law 6: Reduced payload (shorter keys) gives a marginal improvement
+Measured: 6.1 → 4.6 µs (-25%) by shortening JSON keys from "wash_count" to "w". This is a valid optimisation for hot-path FFI calls but not worth the complexity for most operations.
+
+### Law 7: Pure inline (no FFI) is fastest when the operation is simple
+Measured: pure Go inline = 0.3 µs vs 6.1 µs via FFI. If the operation is simple enough to implement in the caller's language, do it inline. Only cross the FFI boundary for operations complex enough to justify it.
+
+---
+
+## The Practical Decision Tree
+
+```
+Is the operation I/O-bound (HTTP, subprocess, file I/O)?
+  → YES → GO (goroutines, net/http, os/exec)
+  → NO ↓
+
+Is the operation CPU-bound and in the request path (responding to user)?
+  → YES → GO (goroutines give true parallelism where the GIL fails)
+  → NO ↓
+
+Is the operation complex deterministic compute (multiple functions, thresholds, scoring)?
+  → YES → RUST (type safety, zero-cost abstractions, memory safety)
+         BUT measure: does the compute exceed the FFI overhead?
+  → NO ↓
+
+Is the operation simple (string truncation, basic comparison, simple lookup)?
+  → YES → Do it INLINE in the caller's language (no FFI)
+```
+
+---
+
+## The Wave Assignment (corrected)
+
+| Wave | Language | Why |
+|---|---|---|
+| W4: event-bus, hook-engine, message-queue, microkernel, subsystem-health, parallel-processor, work-manager, failure-filer, cron-engine, night-mode, cache, connection-pool, recall-router | **Go** | I/O-bound, CPU-bound reactive, event-driven |
+| W4b: tool-executor, tool-protocol, local-tool-runtime | **Go** | I/O-bound, request-path |
+| W5a: model-connect (all 10 provider modules) | **Go** | I/O-bound (HTTP), connection pooling |
+| W5b: operator, adaptive_router, build_mode, warm_router, etc. | **Go** | CPU-bound reactive (routing, dispatch) + I/O-bound |
+| W5c: memory_store, curator, sleep_time | **Go** | I/O-bound (SQLite + subprocess) |
+| W6: spine, construction_*, contracts, capability_*, drift_*, graph_memory, memory_selector, identity_anchors, pins, salience_gate, self_improve, token_optimizer | **Rust** | Complex deterministic compute (scoring, dedup, classification, structural operations) |
+| W6 simple modules: response_adapter, route_risk_flags, rune_profiler, rune_spinner, wait_guard, task_persist, time_awareness | **Stay in caller's language** | Simple operations where FFI overhead > compute benefit |
+| W7: TUI | **Go (Bubble Tea)** | The reactive front end that interfaces with the user |
+
+---
+
+## The Compression Idea (EXPERIMENTAL — NOT WORTH IT)
+
+**Measured result: compression across the FFI boundary makes things 125% SLOWER.**
+
+The cgo transition overhead (~1-2µs) is the dominant cost, not the payload size. Compressing the payload adds CPU work (compress + decompress) that exceeds the benefit of a smaller payload crossing the boundary. The compressed payload is 20% of the original size, but the total time doubles.
+
+Compression WOULD help only if:
+- The payload were >100KB (network transfer between machines)
+- The boundary were a network connection, not a local function call
+
+**Mark as experimental and park. Do not implement.**
+
+---
+
+## The Hybrid Language Idea (FUTURE — NOT NOW)
+
+A hybrid language combining Go's concurrency with Rust's type safety and memory safety would eliminate the FFI boundary entirely. This would be the ideal language for the entire runtime.
+
+But this is a much larger project — effectively designing and implementing a new programming language. It should be explored after the rebase is complete and the system is stable in Go+Rust. The cgo boundary works today with negligible overhead.
+
+---
+
+## Provenance
+
+- Benchmarks run 2026-10-06 on nick-desktop (CachyOS, 4 cores, cgo 1.21, modernc.org/sqlite)
+- Rust kernel: libcognition_core.so from cognition_core crate
+- Go binaries: statically linked, go 1.21
+- Python: /home/nick/.venvs/memory/bin/python3
+- These measurements are for THIS hardware and THIS codebase. Re-measure if the hardware changes.
+
+
+---
+
+## The Hybrid Language: SURVIVOR
+
+Named by Nick (2026-10-06): Rust (survives, memory-safe, deterministic) + Go (running, reactive, concurrent) = **Survivor** — the hybrid language pattern where Go reactive code links Rust deterministic compute as a static library at compile time.
+
+### The Survivor Build Pattern
+- Rust crates compile as staticlib (.a) + cdylib (.so)
+- Go binaries link the .a files at compile time via cgo LDFLAGS
+- The caller sees ONE binary with ONE function call — no FFI boundary from the outside
+- No CC_RUST_LIB / SC_RUST_LIB env vars needed
+- Measured: 0.6µs/call vs 1.4-3.4µs for the .so approach
+
+### Survivor Go Packages
+All under src/go/cognition/:
+- cognition (root): tier, consolidation, witness, safety, drift, pins, growth
+- retrieval: memory_retrieval kernel (mr_call)
+- storage: memory_storage kernel (mems_read_query)
+- scaffold: scaffold_core kernel (sc_check_transition, sc_close_quality, sc_language_placement)
+- provenance: evidence_provenance kernel (ep_* functions)
+- spine: rune_spine kernel (sp_drift, sp_export, sp_project, sp_query)
+- scoring: memory_scoring kernel (ms_* functions)
+- capability: capability_scoring kernel (cs_evaluate_fit, cs_score_card)
+- token: token_counting kernel (tc_compress_context, tc_estimate_tokens)
+- query: query_memory kernel (qm_* functions)

docs/phaseG_slice2_census.md

@@ -0,0 +1,52 @@
+# Phase G Slice 2 (T7.3) — Evidence-Provenance Surface Census (#2449)
+
+Generated 2026-10-08 (contract BUILDER-2026-10-08T14:02:24Z-588ca6). The
+six-module surface, its Rust candidate, and the per-module switch state —
+measured, not asserted. This is the frozen-contract input.
+
+## The Rust candidate
+
+`src/rust/evidence_provenance/` — 24 `pub extern` symbols, CI-built on all
+three rust steps (evidence_provenance/Cargo.toml in every list). The
+cdylib carries the ep_* core (compute_hash, append_entry, verify_chain)
+plus the per-module helper seams (ca_*, and the loader families).
+
+## Per-module switch state
+
+| module | loader integration | parity evidence | state |
+|---|---|---|---|
+| claim_audit.py | ep_loader (ca_evidence_terms, ca_verify_gate, ca_report_aggregate) — 17/17 proven vs this module's Python vintage (docstring) | ep parity 17/17 | SWITCHED |
+| behavior.py | 4 loader/ctypes refs | ep_loader import + parity battery | SWITCHED |
+| behaviour_ledger.py | 11 loader/ctypes refs | dual-import (validation ledger) | SWITCHED |
+| evidence_probe.py | 4 loader/ctypes refs | ep_loader delegation | SWITCHED |
+| verification_layer.py | 3 loader/ctypes refs | ep_loader delegation | SWITCHED |
+| audit_ledger.py | 0 — NO loader integration | drift-key vintage split (see below) | REMAINING GAP |
+
+Test batteries observed green this session: claim_audit/audit_ledger/
+behavior/evidence_probe/verification_layer families 14/14;
+test_evidence_provenance_shims.py 6/6.
+
+## The remaining work (batches after this census)
+
+1. **audit_ledger switch** — the only module with zero loader integration.
+   Pin the DRIFT KEY FIRST: the live promotion_ledger.jsonl (21 entries)
+   verifies valid under the DEPLOYED vintage key `rune-drift-integrity-2024`;
+   the src/rune default (`rune-governed-adaptation-2024`) fails it. The
+   Rust seam must carry the deployed-vintage key as the verification key
+   for existing entries (the frozen contract pins this).
+2. **Vintage reconciliation** — src/rune/ is the hardened NEWER vintage
+   (memory_env-pathed DB, defensive code); deployed + shared/ audit_ledger
+   are OLDER. The switch must reconcile, not clobber (RECONCILE-DON'T-CLOBBER).
+3. **Supersession ledger** — per-module close records after shadow evidence.
+4. **Shadow** — run the ep parity battery + per-module canaries as the
+   shadow evidence per the slice-1 pattern (see scripts/qm_shadow.py for
+   the shape).
+
+## Grounding findings carried from the issue (verified this session)
+
+- Only 3 of 6 modules are deployed (~/.config/opencode/scripts/):
+  audit_ledger, behavior, claim_audit. Consumers confirmed: rune_tui.py
+  (claim_audit, behavior), curator.py + canaries (audit_ledger),
+  rune_operator.py:581 (evidence_probe).
+- The divergent-vintage finding and the live-ledger drift-key finding are
+  banked above and pin the contract.

docs/pipeline-registry.md

@@ -44,3 +44,13 @@ were removed after RP10 proved the canonical Research-to-Build pipeline
 (epic #257). Their trigger label (`research-pending`) was stripped from all
 disposable issues on 2026-09-08 (RP0). Historical evidence retained in
 research/issue-* directories and closed issues (#245, #254-#256, #260-#263).
+
+## fault-watch (`.gitea/workflows/fault-watch.yml`)
+- **Trigger:** CI Pipeline completion + every 15 min schedule
+- **Purpose:** Monitors the 5 named gates (lint/unit-tests/rust-surface/go-surface/canary) on HEAD SHA. Auto-files `ci-fault` issues (labeled ci-fault+bug) on failure, auto-closes when the gate goes green on a pushed commit.
+- **Failure mode:** If the fault-watch itself fails, CI failures go undetected — the nightly cron sweep is the backstop.
+
+## local-review (`.gitea/workflows/local-review.yml`)
+- **Trigger:** Pull request events (opened, synchronize)
+- **Purpose:** Runs the local review pipeline (lint gates + parity checks) on PR branches before merge.
+- **Failure mode:** A failure here blocks the PR merge — the required-checks job gates on it.

docs/rebase-language-rubric.md

@@ -0,0 +1,382 @@
+# Language-Fit Rubric — Wave 1 (Language-Rebasing Tranche R1)
+
+> STATUS: FINAL — self-verified 2026-09-29 per tranche §12 (all 6 rounds completed,
+> evidence-sufficiency statements recorded, kill tests frozen; execution proceeds on the
+> evidence, every RECODE still passes its benchmark gate — no win, no recode).
+> Per-subsystem sections filled from live research rounds (≥2 live-verified external sources per claim,
+> per-source lessons, evidence→decision mapping, kill test per candidate). No code changes in Wave 1.
+> Governing law from §11: **KEEP-PYTHON honesty determines how much of the rebase volume is real.**
+> Toolchain baseline: Rust 1.98.1 + GCC 16.2.1 present; Go NOT installed — Go earns installation only
+> through rubric evidence here.
+
+## Verdict (all rounds, one paragraph)
+
+**KEEP-PYTHON across the board: 40 clusters scored, 0 recode units awarded.** Six research
+rounds (W2 leaf utilities, W3 memory, W4 provider-layer, W5 orchestration, W6 runtime-core,
+W7 TUI) each characterized their subsystem's actual workload inward (file:line-anchored) and
+tested Python/Rust/Go/C against it with live-verified sources and frozen kill tests. The
+pattern is consistent: the compute-shaped work already executes in C (hashlib, sqlite3/FTS5/vec0,
+json, regex), the dominant latency is network or LLM-bound, and no cluster contains a hot loop
+that pays for a process-boundary recode through the 658 µs–0.63 ms interop crossing. **Go:
+REJECTED — does not earn installation this tranche** (D5=0 everywhere; nothing measured or
+fetch-confirmed earns it; orchestration additionally rejects its design fit; K-GO kill tests
+frozen per round should the case be revived). **Rust: toolchain-ready, justified nowhere this
+tranche** — keep as the standing option behind the CI-proven std-only adapter for any future
+measured hot loop. **C: rejected everywhere scored** (duplicates C already inside SQLite/hashlib;
+adds an unsafe-memory surface). The rebase volume the tranche hypothesized is real only as a
+small set of named improvements — see "Wave-plan consequence" below.
+
+## Rubric dimensions (applied to every candidate language per subsystem)
+
+| Dimension | Question | Evidence required |
+|---|---|---|
+| D1 Workload fit | Does the subsystem's dominant workload (I/O-bound, CPU-bound, FFI, protocol, UI) actually favour this language? | Benchmarks or authoritative docs, live-verified |
+| D2 Measured gain | What wins, concretely — latency, memory, startup, binary distribution? | Named hot paths from the Wave 0 inventory + numbers |
+| D3 Interop cost | What does the interop contract (§5) cost to carry for this boundary? | Adapter surface size, ABI/build complexity |
+| D4 Ecosystem | Do the needed libraries exist and are they maintained? | Live-verified crate/package/module listings |
+| D5 Toolchain reality | Is the toolchain present (or installable and justified) on this machine and the CI runner? | Runner + local `--version` evidence |
+| D6 Maintenance continuity | Can the Rune ecosystem's single-maintainer loop sustain code in this language here? | Honest judgement, stated plainly |
+| D7 Kill test | What is the CHEAPEST disproof of this candidate? | One falsifiable early test, frozen before any recode |
+
+Scoring: each candidate gets D1–D6 scored 0–2 with one-line evidence each, D7 written regardless.
+Decision per subsystem: **KEEP-PYTHON** / **RECODE→<language>** — KEEP-PYTHON is the expected default;
+a RECODE that cannot pass its own kill test reverts to KEEP-PYTHON before implementation.
+
+---
+
+## W3 — Memory & persistence (units: memory_store 56 fns, curator 43, warm_router 32, memory_consolidation 20, sleep_time 25, + graph_memory, night_mode, identity_anchors)
+
+- **Research round actor:** general-2 (COMPLETED 2026-09-29 — artifacts at
+  `research/wave1/memory/`: inward.md, outward/ ×6, outward-sources.md, synthesis.md)
+- **Intention profile:** JSONL-heavy appends, BM25/FTS ranking, consolidation passes, long-running
+  scheduled jobs, file-backed state.
+- **Decision:** **KEEP-PYTHON (all 7 clusters, zero RECODE).** Cluster verdicts:
+  (1) hot-store JSON persistence — KEEP with upgrade path: orjson in-process wheel
+  (~10× dumps / 2× loads); a bespoke Rust CLI unit is dead on spawn cost (the
+  `shared/native_units.py` crossing ~1–5 ms ≈ orjson's entire 3.4 MB `knowledge.json` decode);
+  (2) SQLite store + FTS5/vec0 recall — KEEP, the compute is already C inside SQLite
+  (`memory_store.py:646` vec0 MATCH, `:693` bm25); (3) neuron scoring/routing — KEEP,
+  network-bound `_embed` (Ollama subprocess curl) dominates; (4) graph BFS — KEEP,
+  hops=1 default, per-node SQL, tiny N; the future fix is a SQL CTE, not a language;
+  (5) batch consolidation/curator — KEEP, LLM/I-O-bound and latency-insensitive,
+  asyncio sweet spot; (6) orchestration/glue — KEEP, pure glue pinned by the Python-TUI
+  interop contract; (7) embedding transport — KEEP, network-bound.
+- **Candidate matrix summary:** Python 7/7 · Go 0/7 (not installed, nothing measured or
+  fetch-confirmed earns installation; Go's JSON stack mid-rewrite upstream) · hand-written C
+  0/7 (C already battle-tested inside SQLite — hand-writing would duplicate it) · Rust 0/7
+  as CLI units (spawn cost kills the one credible vector; in-process wheels excluded by
+  Wave 0 policy).
+- **Kill tests (frozen in synthesis.md):** Rust-JSON — orjson microbench on live 3.4 MB
+  `knowledge.json` (if drop-in and ≥2× load / ≥5× dump, the CLI unit is disproven on spawn
+  cost); Rust-general — kill unless a profile shows ≥50% wall time in pure Python compute
+  (none exists; reopen only on materially changed workload); Go — instrument one
+  `consolidate_all` run, kill if Python-compute share <50% (it will be — LLM/I-O bound);
+  C — kill unless a hot kernel absent from the SQLite extension ecosystem is identified
+  (none).
+- **Sources + lessons:** 6 live-fetched 2026-09-29 (orjson, sled, sqlite-vec, SQLite FTS5
+  docs, Go json/v2 rewrite issue, pydantic-core) — full annotations in
+  `research/wave1/memory/outward-sources.md`.
+- **Evidence sufficiency (honest):** static analysis only, no runtime profiling;
+  memory.store SQLite DB not materialized locally — kill tests specify *measured*
+  thresholds rather than assertions. Verdicts rest on "Python is glue around C/network,"
+  which profiling would only strengthen.
+
+## W4 — Provider/model layer (units: provider_registry 28, model_connect 10, model_routing 15, model_profiles 15, provider_budget 21, + standardized_providers, model_registry, connection_pool)
+
+- **Research round actor:** general-5 (COMPLETED 2026-09-29 — artifacts at
+  `research/wave1/provider-layer/`: inward.md, outward-sources.md, outward/ (8 evidence
+  JSONs), synthesis.md)
+- **Intention profile:** HTTP/SSE streaming, connection pooling, retries/backoff, protocol parsing,
+  tool-call reliability.
+- **Intention profile correction (inward-verified):** the layer has **NO retry/backoff and NO
+  SSE stub at all** (grep-verified) — `stream: False` everywhere, ~900 lines, remote-LLM-latency-
+  bound. Rewrite pitches are therefore feature-adds, not ports.
+- **Candidate matrix:** 5 clusters, all KEEP-PYTHON. Scores (1–5 = fit for the cluster's actual
+  workload): (C1) HTTP wire + transport (provider_registry, openai_compat_transport, model_connect
+  discovery) Python 5 / Go 2 / Rust 1; (C2) connection pool (connection_pool.py, 144 lines —
+  in-process object guards under threading.Lock, NOT a TCP pool) Python 5 / Go 2 / Rust 2;
+  (C3) routing decisions (model_routing.py, 432 lines, pure decision logic, one httpx call)
+  Python 5 / Go 1 / Rust 1; (C4) budget accounting (provider_budget.py, 354 lines, pure
+  arithmetic + lock, no I/O) Python 5 / Go 1 / Rust 1; (C5) config/registry/normalization
+  (model_profiles, model_registry, standardized_providers, model_connect tables — dataclasses +
+  JSON, editable by non-systems programmers) Python 5 / Go 1 / Rust 1.
+- **Decision:** **KEEP-PYTHON (all 5 clusters).**
+- **Kill tests:** C1 Go — KILLED: toolchain absent (`which go` → not found); 28 call-site
+  behaviors incl. the tool-call envelope contract (openai_compat_transport.py:67-107, 160-207)
+  would be re-implemented with zero incumbent test port and NO performance signal (remote-LLM-
+  latency-bound, kilobyte payloads). Re-earn path if Go is ever installed: std-only proof via
+  `interop/rebase-proof/` + a benchmark harness on C1 only. C1 Rust — KILLED BY CONSTRUCTION:
+  SSE parsing requires reqwest+tokio+eventsource-stream+nom (outward O3/O4/O5 — even mistral.rs
+  takes the tokio stack), violating the std-only interop contract. C2–C5 Go/Rust — KILLED:
+  burden of proof sits on the rewrite candidates; kill tests need contention/throughput/
+  counter-evidence that does not exist; routing runs once per request at millisecond scale
+  against multi-second LLM calls (5 orders of magnitude below any measurable threshold).
+- **Sources + lessons:** 8 live-fetched (O1–O8), ≥2 per major claim, coverage map in
+  `outward-sources.md`. Lessons: (1) stdlib-only Rust has no realistic precedent for HTTP/SSE
+  workloads — the interop contract's zero-crate standard effectively decides Rust out of all
+  network-wire clusters; (2) Go's stdlib HTTP+NDJSON streaming is capability-proven
+  (pkg.go.dev/net/http, ollama api/client.go, ollama's Go API server) — Go's losses here are
+  evidence-absence, not capability-absence; (3) the honest reliability upgrade for this layer
+  is a small Python-level httpx retry/timeout wrapper — a feature-add, not a language change.
+
+## W5 — Orchestration, authority, plugins, skills (units: orchestration/ 44 files 244 fns, contracts, build_mode 34, construction_authority*, verification_construction, spine, + governance surfaces: drift_*, persona_gate, safety_override, witness, behavior, growth_delta, claim_audit)
+
+- **Research round actor:** general-1 (COMPLETED 2026-09-29 — artifacts at
+  `research/wave1/orchestration/`: inward.md, outward-sources.md, outward/ (4 search
+  JSONs), synthesis.md)
+- **Intention profile:** contract/lifecycle state machines, authority gating, fail-closed validation,
+  HMAC-chained ledgers, policy dispatch.
+- **Intention profile correction (inward-verified):** the subsystem is durable-ledger I/O,
+  authority wiring, deterministic policy gates, and TUI-facing coordination — NOT hot loops
+  (2 RLocks, 0 sockets, 0 thread pools across 43 files). **Scope gap: `construction_authority.py`
+  and `verification_construction.py` do not exist in the tree** — the construction cluster is
+  covered by build_mode.py; no evidence invented for the missing files.
+- **Candidate matrix:** 6 clusters, all KEEP-PYTHON. Scores (1–5 = fit for the cluster's actual
+  workload): (C1) durable state & ledger stores (event_store.py:56-101, atomic.py, evidence_store.py
+  — fsync-bound; hashing already C via hashlib) Python 5; (C2) composition roots & authority wiring
+  (composition.py, authority.py, cognitive.py — pure glue, runtime cost ≈ 0) Python 5; (C3)
+  policy/state machines/gates (lifecycle.py, scheduler.py, broker.py, no_change.py, reflex.py —
+  deterministic dict/enum decisions, sub-ms; testability is the requirement) Python 5; (C4)
+  structural self-model & schema tooling (spine.py:24-25, microkernel.py, contracts.py, records.py
+  — introspection + canonical JSON; only candidate for a future Rust spine-diff if snapshots grow
+  1000×) Python 4; (C5) TUI-facing orchestration & build pipeline (build_mode.py 11-stage pipeline,
+  gateway.py, transport.py — the consumer IS the Python TUI; latency dominated by LLM/subprocess
+  waits) Python 5; (C6) benchmark/migration harnesses (retrieval_benchmark.py, migrate.py,
+  benchmark.py — offline tooling, recode buys nothing, loses iteration speed) Python 4.
+- **Decision:** **KEEP-PYTHON (all 6 clusters). This subsystem contributes 0 recode units to
+  the wave plan.** Go: REJECTED, do not install — differentiator (goroutine-dense servers)
+  targets a workload absent here; cost is exception→error-value rewrite of ~260 functions.
+  Rust: FEASIBLE (toolchain proven) but UNJUSTIFIED anywhere — no cluster has the hot loop
+  that pays for a process-boundary recode; keep as toolchain-ready for other subsystems.
+  C: REJECTED — the only compute-shaped work (sha256) already executes C via stdlib hashlib.
+- **Kill tests:** K1 (frozen, ALREADY RUN): 100 round-trips through the rebase-proof adapter —
+  mean 0.63ms, p95 0.74ms, cold 0.87ms, 100% exit-0 + ok:true → adapter overhead does NOT block
+  recodes on cost; recodes die on value grounds. Re-open any cluster if profiling shows a
+  function consuming >10% of a real interactive session. K-GO (frozen, ~30 min): Go prototype
+  of event_store.py's batched append+fsync vs Python at 1000 events; if Python's p95 is within
+  2× of Go's, Go is dead here permanently. K-RUST (frozen, ~20 min): measure spine diff on a
+  10k-entity snapshot; <50ms kills any Rust spine recode by absence of pain.
+- **Sources + lessons:** 4 live-fetched web sources (pydantic-core, ruff blog, go.dev FAQ,
+  Python 3.14 hashlib docs) + 1 LOCAL EXPERIMENT (n=100 adapter benchmark). Lessons: (1) the
+  rebase-proof adapter round-trips at 0.63ms/op — subprocess-per-op is viable for coarse ops,
+  never per-event; (2) Python's "slowness" argument dissolves where the actual compute already
+  runs in C via stdlib (hashlib, sqlite) — the language question is really "where is the hot
+  loop", and here the answer is nowhere; (3) assumed limits flagged honestly: human-scale event
+  cadence (batch_size=8) and Linux spawn cost — both would need revisit at 10⁴+ events/sec or
+  cross-platform targets.
+
+## W6 — Runtime core & tooling (units: tool_executor 46, tool_protocol 27, local_tool_runtime 32, capability_broker 19, context_broker 21, work_manager 25, cron_engine 28, + failure_auto_filer 28, hook_engine, elastic_cognition, auto_tasks, goal)
+
+- **Research round actor:** general-4 (COMPLETED 2026-09-29 on disk despite cancellation
+  notification — artifacts at `research/wave1/runtime-core/`: inward.md, outward/,
+  outward-sources.md, synthesis.md)
+- **Intention profile:** subprocess/process supervision, native execution boundary (native_units
+  adapter already exists), event loops, cron scheduling, hook dispatch.
+- **Decision:** **STAY-PYTHON (all 6 clusters).** Round scores (1–5 = fit for the cluster's
+  actual inward-characterized workload): (A) subprocess lifecycle (tool_executor, cron_engine,
+  auto_tasks) 4.7 — `subprocess.run(timeout=, capture_output=)` is a one-call expression of the
+  pattern; Rust std::process has NO built-in child timeout (outward-verified), strictly more
+  code under zero-crate; (B) protocol/JSON parsing (tool_protocol, brokers) 4.5 — inputs are
+  KB-scale model fragments; Python json/regex is already C-backed, so a rewrite swaps C for
+  compiled code at the same asymptotic cost; serde's typed-struct model actively mismatches
+  fence-wrapped schema-flexible output; (C) model→tool control loop + HTTP
+  (local_tool_runtime, elastic_cognition, goal) 4.8 — wall time is LLM HTTP latency in seconds;
+  Python overhead is µs–ms noise; the loop's content is policy (circuit breaker, escalation
+  ladders, routing tables); (D) context assembly (context_broker) 4.7 — correctness lives in
+  admission policy and degrade-not-crash semantics, not speed; compaction is itself an LLM call;
+  (E) reliability/queueing (failure_auto_filer) 4.2 — honest lowest: on paper the best Rust
+  candidate (queue + worker + crash-safe JSONL spool), but perf requirement ≈ nil and the
+  correctness burden is threading semantics a rewrite would re-risk for no win ("nothing
+  breaks today"); (F) declarative config/brokers (work_manager, hook_engine, capability_broker)
+  4.9 — literal data, no-op runtime, portable to anything valuable in nothing.
+- **Candidate matrix summary:** Python 6/6 · Go 0/6 (paper verdicts only — evidence-starved,
+  not installed, kill tests unrunnable locally) · Rust 0/6 (kill tests runnable via the
+  existing std-only interop harness) · C unscored (no FFI-adjacent cluster surfaced).
+  Best-language moment found anywhere: robfig/cron replacing ~37 hand-rolled cron-parsing
+  lines (cron_engine.py:199-236) — ergonomics nicety, not a fit verdict.
+- **Kill tests (frozen in synthesis.md):** Rust-A — re-express `_run_command`
+  (tool_executor.py:1064) with std::process + manual timeout; kill if >2× the ~40-line
+  Python wrapper (Q4 predicts it is); Go-A — port `cron_engine._run_loop` with os/exec,
+  measure task-fire latency delta (prediction: zero — 60 s sleep and child runtime dominate);
+  B — parse the largest observed tool-protocol stream 1000× in Python; kill if total <1 s
+  (no rewrite yields an observable win); C — instrument `_run_loop`
+  (local_tool_runtime.py:417), log non-HTTP CPU per iteration (prediction <1% of wall);
+  D — time `assemble`+`_admit` on the largest stored context, kill if <10 ms; E — fault-inject
+  kill -9 during spool append; if recovery semantics already hold, the rewrite has no
+  correctness win to buy; F — none needed: absence of any win condition IS the disproof.
+- **Sources + lessons:** live-fetched 2026-09-29 — annotations in
+  `research/wave1/runtime-core/outward-sources.md`; headline lessons: Rust std::process lacks
+  child timeout (Q4); Go os/exec reaches parity but changes only syntax (Q1); Python
+  json/regex C-backed (Q5b); serde typed structs mismatch dynamic model output (Q5a);
+  concurrency features irrelevant at ≤2 threads (Q6).
+- **Evidence sufficiency:** Python verdicts fully evidenced inward+outward; Go execution-side
+  evidence honestly starved (paper kill tests carried forward); E's JSONL-spool crash-safety
+  claim rests on inward semantics only — flagged in synthesis.md.
+
+## W7 — Operator + TUI (units: rune_operator 61 fns, rune_tui 161 fns — largest module, tui_validator)
+
+- **Research round actor:** general-3 (COMPLETED 2026-09-29 — artifacts at
+  `research/wave1/tui/`: inward.md, outward/ ×8, outward-sources.md, synthesis.md)
+- **Intention profile:** terminal rendering, input handling, rich layout, hot store state, supervisory
+  command surface. Design decision 4 holds: TUI consumes the interop contract, never rewritten first.
+- **Decision:** **KEEP-PYTHON (TUI shell; all 4 clusters, zero RECODE, no carve-out found).**
+  Cluster scores (1 = recode, 5 = keep): (A) rendering/widgets 4 — no hot loop exists; render is
+  plain Rich `Text` concatenation (rune_tui.py:1331, chat_bubble.py:157), only animation a 0.12 s
+  spinner (:263), no markdown/Syntax parsing anywhere in src/rune; (B) event glue (~50 `_cmd_*`
+  handlers, reactives, tool-widget maps) 5 — this is Textual's core competency (workers,
+  `exclusive=True`, `call_from_thread`); vendor docs (ratatui) admit "little to no help in organizing
+  large applications"; (C) model send path + envelope 5 — synchronous `send_task` in async worker;
+  the envelope shape (`success/response/thinking/tool_events/degraded`, rune_tui.py:3624ff) is
+  ALREADY the de-facto interop contract; (D) subprocess/streaming 5 — JSONL streaming precedent
+  already in-tree (`_cmd_pull` :3443-3517): the pattern for consuming recoded units, not a recode
+  target. Whole-TUI native recode 1/5 REJECTED — 80+ first-party module coupling, framework-provided
+  concurrency re-implemented by hand; Go additionally toolchain-blocked. Countervailing evidence
+  (Bubble Tea/tview/Codex TUI maturity) recorded honestly in outward-sources.md — it does not
+  outweigh the coupling.
+- **⚠ CONTRACT GAP FLAGGED (binds Waves 2–7):** `shared/native_units.py` parses only the LAST
+  stdout line — it must gain a JSONL streaming reader (per-line `json.loads` + terminal-envelope
+  validation) before any recoded long-running unit can stream progress to the TUI. Small, testable,
+  non-breaking; candidate for the first Wave 2 implementation issue.
+- **Adapter surface (TUI as consumer — adopted as the rubric's interop-contract restatement):**
+  (1) single-invocation stateless CLI (`native_unit <op> [args]`, no daemon); (2) success = final
+  stdout line `{"ok":true, …}` generalizing the model-send envelope — recoded units emitting
+  `response`/`tool_events`/`degraded` plug in with zero TUI changes; (3) failure = `ok:false` +
+  nonzero exit, stderr human-only, success = exit 0 AND not timed out; (4) mandatory `--version`
+  on every unit (status bar + `canary_tui_drift.py` detect live units vs Python fallback);
+  (5) JSONL streaming mode for long ops with terminal sentinel envelope; (6) per-call timeout
+  budget, `timed_out` surfaced in `NativeResult` for graceful degradation; (7) streamed events
+  referencing UI objects carry the TUI's stable keys — `(channel, call_id)` for tool widgets
+  (:3676), WorkPane `_entries` object ids (:1239) — preserved verbatim; (8) std-only for
+  proof-phase units.
+- **Candidate matrix summary:** Python 4/4 clusters · Rust/Go whole-TUI 1/5 rejected · carve-out
+  candidates: none found (future markdown parsing would carve as a Rust native unit behind the
+  adapter, not now).
+- **Kill tests (frozen in synthesis.md):** stay-Python — killed if >16 ms UI-thread stalls under
+  heavy event bursts OR IPC latency dominates message round-trip (Textual pilot measurement);
+  Rust recode — killed if the adapter must expose >~15 first-party modules (count today ≈80:
+  killed NOW); Go recode — additionally killed by toolchain absence (`command -v go` empty).
+- **Sources + lessons:** 8 live-fetched 2026-09-29 (Textual workers guide, ratatui vendor docs,
+  Bubble Tea/tview/Codex countervailing evidence, JSON Lines spec, push-granular-work guidance) —
+  annotations in `research/wave1/tui/outward-sources.md`.
+- **Evidence sufficiency (honest):** full inward read of all 5 TUI files with line refs; ≥2 sources
+  per major claim; gap = no runtime profiling (stall kill test unmeasured — but no mechanism exists
+  for the stall to occur; the 120 ms 21-step pipeline was already removed, `_run_warm_router`
+  :3575 is a no-op).
+
+## W2 — Leaf utilities & canaries (~40 modules, low coupling: pins, time_awareness, message_queue, event_envelope, attention_capsule, complexity_scorer, token_optimizer, cache 501/17, prompt_sync, chat_bubble, ~15 canary_* modules)
+
+- **Research round actor:** general-6 (COMPLETED 2026-09-29 — full report in actor notification)
+- **Intention profile:** small pure helpers, envelopes, scoring, cache; smallest blast radius; the
+  factory + interop proving ground at real scale.
+- **Ground-truth measurements (local, this session):** Python fn call ~46 ns (100k timed
+  iterations in-process) · native CLI roundtrip ~658 µs (subprocess to
+  `interop/rebase-proof/target/release/rebase-proof --version`) · Python startup floor ~18 ms ·
+  overhead ratio ≈ **14,000×**. The only CI-proven interop contract is the subprocess CLI boundary
+  (`shared/native_units.py`: argv in → JSON stdout, `--version`, timeout, typed `NativeResult`).
+  PyO3/in-process bindings excluded by Wave 0 policy. Therefore every per-call crossing costs
+  ≥658 µs — a per-turn helper would need to run >14,000× faster in Rust to break even.
+- **Candidate matrix (representative — full per-cluster 0–2 scoring in round report):**
+  Python 12/12 in every cluster · Rust 5–6/12 · Go 1–3/12 (D5=0, not installed) · C 1–2/12.
+  No module contains a hot loop (heaviest: 2 `re.sub` per turn in token_optimizer).
+- **Decision:** **KEEP-PYTHON (all ~40, zero RECODE).** Cluster verdicts: (a) pure CRUD helpers
+  pins/time_awareness/token_optimizer — KEEP, CPython 3.11+ already 10–60% faster on this shape
+  (PEP 659); (b) message/envelope/capsule structures — KEEP, recode would insert a boundary
+  between the chattiest neighbors; (c) cache.py (501 L, largest in wave) — KEEP, the fast part is
+  already C (sqlite3 DB-API 2.0 over SQLite's C library), Python is thin orchestration, batching
+  (threshold 50 / 30 s) already amortizes writes; (d) chat_bubble.py — KEEP, **hard-pinned** to
+  Python by the Textual framework (recode = full framework abandonment, bottleneck is human
+  typing speed); (e) prompt_sync.py glue — KEEP, glue into Python siblings (memory_env,
+  voice_sync, build_pipeline_policy); (f) ~19 canary_* — KEEP **categorically**, a canary that
+  verifies Python importability cannot exist in another language.
+- **Kill tests (reopening criteria, all fail today on first cheap measurement):** Rust — microbench
+  one per-turn helper behind the native_units CLI, must beat the Python in-process call >10×
+  end-to-end including the 658 µs crossing (whole call <~46 µs; a trivial `--version` already
+  costs 658 µs); Go — identical benchmark post-install, uninstall if roundtrip >100 µs with no
+  named hot path; C — identical benchmark + required fuzz-clean JSON roundtrip, plus a
+  demonstrated GC-free allocation-hot loop first; cache.py — recode only if Python-side
+  orchestration (excl. sqlite3 waits) exceeds 5% of end-to-end latency; capsule/envelope/queue —
+  recode only if one turn's Python total exceeds ~5 ms AND a candidate's CLI path is >10× cheaper.
+- **Sources + lessons:** (1) https://docs.python.org/3/whatsnew/3.11.html — 10–60% faster,
+  PEP 659 specializing interpreter: CPython already optimized for helper-shaped code, the D2
+  baseline is a moving improving target; (2) https://docs.python.org/3/whatsnew/3.13.html —
+  free-threading/JIT experimental, KEEP-PYTHON ≠ frozen but no bets on experimental paths;
+  (3) https://www.maturin.rs/ — in-process Rust↔Python needs a whole binding/packaging toolchain
+  atop the CLI boundary, D3 worse than measured 658 µs (Wave 0 policy excludes it anyway);
+  (4) https://go.dev/doc/install — Go is a pre-install prerequisite, D5=0 everywhere, never earned
+  installation; (5) https://textual.textualize.io/ — Textual is a Python TUI framework,
+  chat_bubble.py framework-pinned; (6) https://docs.python.org/3/library/sqlite3.html — sqlite3 is
+  DB-API 2.0 over C, cache.py's perf layer already native. All fetched live 2026-09-29.
+- **⚠ Inventory drift (VERIFIED 2026-09-29):** complexity_scorer.py listed in
+  rebase-inventory.json (2 mentions) but absent on disk — deleted in commit 867321e
+  ("governed retirement — complexity_scorer deleted (602 lines)"). Wave 0 inventory needs a
+  correction pass; the module was scored nowhere (no source to characterize).
+
+---
+
+## Wave-plan consequence (T5 scope, from the verdict above)
+
+With **0 recode units awarded**, the tranche's hypothesized rebase volume is real only as the
+work below. Waves 2–9 are **disposition + named improvements, NOT mass recoding**:
+
+**Waves 2–7 — per-issue disposition (the 1,852 `[rebase w{wave}]` issues):**
+Each issue receives its tranche §7 disposition — improve / fix / missing-connectors answered
+with evidence — plus a language verdict of **KEEP-PYTHON with its rubric evidence line**
+(the round section for that subsystem names the claim). Disposition runs leaf-first
+(Wave 2 → 7), the canonical suite stays green throughout, and no issue closes without its
+evidence line. A recode is off the table unless a frozen kill test is reopened — and then
+tranche §6 still governs: **no benchmark win, no recode.** Go is not installed and earned no
+installation; Rust stays toolchain-ready but unjustified (standing option behind the
+CI-proven adapter).
+
+**Named improvements — the actual rebase volume (ship alongside disposition):**
+1. **JSONL streaming reader for `shared/native_units.py`** (W7 contract gap): the adapter
+   parses only the LAST stdout line; it must gain per-line `json.loads` + terminal-envelope
+   validation before any recoded long-running unit could stream progress. Small, testable,
+   non-breaking — first implementation issue of Wave 2.
+2. **httpx retry/timeout wrapper for the provider layer** (W4): the honest reliability
+   upgrade is a feature-add, not a language change.
+3. **orjson upgrade path** (W3 cluster 1): the only credible Python-side JSON win —
+   in-process, no boundary crossing. **DISPOSITION (2026-09-29, kill test EXECUTED and
+   FAILED — KEEP-PYTHON stands, no dependency declared):** microbench on the live
+   `~/.rune/consolidation/knowledge.json` (3,540,959 bytes, n=30 best-of): load 13.15 ms
+   std vs 7.85 ms orjson = **1.68× (bar ≥2×: FAIL)**; dump 9.58 ms std vs 5.61 ms
+   orjson-with-decode = **1.71× (bar ≥5×: FAIL)**; raw-bytes dump 1.39 ms = 6.91× but is
+   not drop-in (every `write_text`/`json.dump`-to-file site would need a bytes→str or
+   binary-write conversion). Roundtrip equality verified. Bench: `/tmp/orjson_bench.py`
+   shape (uvx --with orjson). The bytes trap measured real: decode() eats ~60% of the
+   dump win.
+4. **complexity_scorer.py inventory correction**: listed in `rebase-inventory.json` but
+   deleted on disk (commit `867321e`, 602 lines) — Wave 0 inventory needs the correction
+   pass. **DISPOSITION (2026-09-29, DONE):** inventory regenerated per the script's own
+   header (never hand-edit) — 177→213 files, 1,852→2,314 functions, 13 dead files
+   dropped; committed + pushed `5bc837c`. The W2 round's "2 mentions" drift claim
+   verified FALSE against the live inventory (zero hits).
+5. **robfig/cron** (W6): recorded as a best-language footnote only; no action.
+
+**Wave 8 — TUI integration proof:** demonstrate the TUI reading/utilising the mixed-language
+surfaces that exist (the `interop/rebase-proof` unit through the upgraded adapter), per the
+8-point adapter surface adopted above.
+**Wave 9 — close-out audit:** 100% of the 1,852 issues dispositioned, debt-table revision,
+version bump.
+
+## Cross-cutting candidates (evaluated once, referenced by every subsystem)
+
+- **Rust (present, 1.98.1):** interop proof unit already CI-proven (std-only, zero crates, `interop/rebase-proof/`, adapter in `shared/native_units.py`, ok = exit 0 AND not timed out).
+- **Go (absent):** must earn installation through D1–D5 evidence here before any recode targets it.
+- **C (present, GCC 16.2.1):** expected to lose D6 in most subsystems; scored where FFI-adjacent work exists.
+- **Python (KEEP baseline):** the default. Every subsystem begins here; evidence must move it.
+
+## Evidence ledger (per-source lessons, all rounds)
+
+Index of per-source evidence. Full annotations live in each round's
+`research/wave1/<subsystem>/outward-sources.md`; this ledger records the headline lesson
+each source contributed and the rubric claims it supports.
+
+| Round | Sources (live-fetched 2026-09-29) | Headline lessons | Supports |
+|---|---|---|---|
+| W2 leaf utilities | 6: python.org 3.11 + 3.13 whatsnew, maturin.rs, go.dev/doc/install, textual.textualize.io, docs.python.org sqlite3 | CPython 3.11+ already 10–60% faster on helper-shaped code (PEP 659) — D2 baseline is a moving target; free-threading/JIT experimental, no bets; in-process bindings need a whole toolchain atop the CLI boundary (excluded by Wave 0 policy anyway); Go is pre-install prerequisite, D5=0; Textual framework-pins chat_bubble.py; sqlite3 perf layer already C | W2 KEEP-PYTHON ×~40; the 14,000× crossing-overhead law |
+| W3 memory | 6: orjson, sled, sqlite-vec, SQLite FTS5 docs, Go json/v2 rewrite issue, pydantic-core | orjson is the only credible Python-side JSON win (in-process, no boundary); SQLite FTS5/vec0 compute is already C; Go's JSON stack mid-rewrite upstream (versioning risk); pydantic-core shows the Rust-as-wheel pattern, excluded by policy | W3 KEEP-PYTHON 7/7; orjson upgrade path on cluster 1 |
+| W4 provider-layer | 8: live-fetched O1–O8 (HTTP/SSE ecosystem, tokio-stack precedents incl. mistral.rs, pkg.go.dev/net/http, ollama Go client/server) | stdlib-only Rust has no realistic HTTP/SSE precedent — the zero-crate contract decides Rust out of all network-wire clusters by construction; Go's stdlib HTTP+NDJSON streaming is capability-proven (its losses here are evidence-absence, not capability-absence); the honest reliability upgrade is a Python httpx retry/timeout wrapper — feature-add, not language change | W4 KEEP-PYTHON 5/5; SSE-cluster Rust kill-by-construction |
+| W5 orchestration | 4: pydantic-core, ruff blog, go.dev FAQ, Python 3.14 hashlib docs + 1 LOCAL EXPERIMENT (n=100 adapter benchmark) | adapter round-trips at 0.63ms/op — subprocess-per-op viable for coarse ops, never per-event; Python "slowness" dissolves where compute already runs in C via stdlib; the language question is really "where is the hot loop" (here: nowhere) | W5 KEEP-PYTHON 6/6; K1 kill test already run |
+| W6 runtime-core | headline lessons (full set in round outward-sources.md) | Rust std::process lacks built-in child timeout — strictly more code under zero-crate; Go os/exec reaches parity but changes only syntax; Python json/regex C-backed so rewrite swaps C for compiled code at equal asymptotic cost; serde typed structs mismatch schema-flexible model output; concurrency features irrelevant at ≤2 threads | W6 STAY-PYTHON 6/6; robfig/cron as best-language footnote |
+| W7 TUI | 8: Textual workers guide, ratatui vendor docs, Bubble Tea/tview/Codex TUI (countervailing), JSON Lines spec, push-granular-work guidance | Textual workers/`call_from_thread` are the core competency for event glue; ratatui admits "little to no help in organizing large applications"; countervailing native-TUI frameworks recorded honestly — do not outweigh 80+ module coupling; JSONL per-line parse + terminal sentinel is the streaming contract; vendor guidance: push granular speed-sensitive work to subcomponents only when measured | W7 KEEP-PYTHON 4/4; the 8-point adapter surface (adopted as the rubric's interop-contract restatement) |

docs/rebase-wave0-report.md

@@ -0,0 +1,50 @@
+# Wave 0 close-out report — language-rebasing tranche R1
+
+Branch: `tranche-r1-wave-0` · Date: 2026-09-29
+
+## 1. Inventory (docs/rebase/rebase-inventory.json)
+
+- 177 Python modules, ~52,750 lines, 227 classes
+- TRUE unit count: **1,852 = 1,030 top-level functions + 822 class methods**
+- Zero duplicate call edges, zero method leaks (generator double-walk defect
+  root-caused and fixed in scripts/rebase_inventory.py)
+- Cross-verified against an independent fresh AST walk: zero missing units;
+  six inventory-"extras" are real nested/if-try-block classes the naive walk
+  misses (inventory is MORE complete, not less)
+
+## 2. Issue factory (scripts/rebase_issue_factory.py)
+
+- One issue per unit following R1 §7; wave-batched (2–7); dedup-safe via
+  deterministic title `[rebase w{wave}] {relpath}::{unit}` + existing-titles
+  scan per run (retries never duplicate — preserve-first)
+- `plan` → {2: 239, 3: 251, 4: 129, 5: 544, 6: 415, 7: 274} = 1,852,
+  zero unassigned
+- `sample --wave 5` → full §7 template holds; `_compute_hash` exactly once as
+  labelled callee with line number
+- Contract fix during Wave 0: `--limit` default changed 5 → 0 (unlimited) for
+  `create`; `sample` keeps its 5. A full-wave create with the old default
+  would have silently truncated each wave to five issues.
+
+## 3. Interop proof unit (R1 §5)
+
+- Rust unit at interop/rebase-proof/ (std-only, zero crates): argv in → JSON
+  on stdout, non-zero exit on failure, mandatory `--version`
+- Shell-proven: version flag, JSON out, exit 2 on failure, stderr diagnostic
+- Python thin adapter shared/native_units.py: typed NativeResult, timeout +
+  stderr capture, unit failures as data (never exceptions)
+- Adapter contract fix during Wave 0: `ok` no longer requires a JSON
+  `ok:true` field — plain-text output (`--version`) succeeds on exit code
+- tests/test_native_interop_proof.py: **8 passed** — version contract, sum
+  happy path, hash determinism, failure paths, timeout, stderr capture
+
+## 4. Per-wave issue creation
+
+<!-- FILLED BY THE COMPLETION LOOP — do not hand-edit -->
+
+- Wave 4 (129 units): created=127 skipped(dedup)=2 (includes smoke #417–418)
+- Wave 2 (239 units): created=239 skipped(dedup)=0
+- Wave 3 (251 units): created=251 skipped(dedup)=0
+- Wave 5 (544 units): created=544 skipped(dedup)=0
+- Wave 6 (415 units): created=415 skipped(dedup)=0
+- Wave 7 (274 units): created=274 skipped(dedup)=0
+- TOTAL: 1,850 created + 2 dedup = 1,852 / 1,852 ✅ full coverage

docs/rebase/rebase-wave-coverage.json

@@ -0,0 +1,12 @@
+{
+ "units_per_wave": {
+  "2": 239,
+  "3": 251,
+  "4": 129,
+  "5": 544,
+  "6": 415,
+  "7": 274
+ },
+ "unassigned_modules": {},
+ "unassigned_module_count": 0
+}

docs/reviewer-dispatch-template.md

@@ -75,3 +75,29 @@ And the role-separation rules: the black-box test author (fresh context) has
 already written the spec tests; the reviewer checks the implementation
 against tests it did not write; vacuity spot-checks (one manual mutant per
 load-bearing branch) are BLOCKER-grade findings when tests survive them.
+
+## Dimensional review rubric (#129 — mandatory for P0/P1)
+
+Holistic judgment ("is this good?") is replaced by per-dimension
+forced-choice scoring. Every review dispatch MUST score each dimension
+explicitly — a review missing any dimension is INCOMPLETE and bounces.
+
+| Dimension | What to score | Verdicts |
+|---|---|---|
+| Correctness | Does the code do what the issue/spec requires? Verify call sites, not claims. | PASS / CONCERN / FAIL |
+| Design | Does the shape fit the codebase (parity laws, authority maps, no second authorities)? | PASS / CONCERN / FAIL |
+| Test quality | Do the tests prove the behavior (real-path, oracle-derived, would fail without the fix)? | PASS / CONCERN / FAIL |
+| Observability | Are failures visible (logged, journaled, gated) rather than silent? | PASS / CONCERN / FAIL |
+| Security | Approval boundaries, secret handling, injection surfaces — anything that widens trust? | PASS / CONCERN / FAIL |
+
+Example (the required output shape):
+```
+Correctness: PASS (36 call sites verified).
+Design: PASS with concern (registry singleton).
+Test quality: CONCERN (no real-path test).
+Observability: PASS.
+Security: PASS.
+```
+Five explicit verdicts the controller acts on dimensionally — a CONCERN
+or FAIL in any dimension blocks the gate until discharged or explicitly
+accepted with a reason.

docs/supersession-report.md

@@ -0,0 +1,60 @@
+# SUPERSESSION REPORT — programmatic evidence
+_Created 2026-10-07. Question: is curator superseded by memory_consolidation? Can supersession be determined programmatically?_
+
+## Answer in one paragraph
+
+No — they are NOT supersessions of each other. They are two different machines in one pipeline: **memory_consolidation compresses what already exists** (warm neurons, graph entities, abstraction facts → consolidated knowledge records), while **curator gates what gets written** (evidence → worthiness filter → graded routing → tiers). Both are wired into sleep_time's nightly run: consolidation runs in-process, curator runs as a subprocess. The real finding is darker: **curator has NEVER successfully run in production** — three of its four dependencies were never ported from the Odysseus branch, so every invocation died at import. Both diagnoses were reached programmatically.
+
+## The programmatic supersession test (reusable)
+
+Six signals, each binary and evidence-based (`/tmp/ss_engine.py`, promote to scripts/):
+
+| Signal | Test | Weight |
+|---|---|---|
+| R1 Import graph | production importers vs canary-only importers | high |
+| R2 Subprocess summon | module executed as a script by another module | high |
+| R3 Output artifacts | documented output files exist with recent mtimes | high |
+| R4 Function overlap | name overlap with the suspected successor | low (weak signal) |
+| R5 Importability | `import X` succeeds (phantom dep = dead) | gate — fails = dead regardless |
+| R6 End-to-end probe | documented entry path executes with real input | decisive |
+
+## Applied to curator vs memory_consolidation
+
+| Signal | curator | memory_consolidation |
+|---|---|---|
+| R1 | 0 production importers | 2 (memory_selector, sleep_time) |
+| R2 | summoned as script by sleep_time + dependency_tracker | summoned by dependency_tracker |
+| R3 | **index/blocks_meta.json DOES NOT EXIST — no journal files — never wrote output** | graph.sqlite exists but **stale (Aug 22)**; consolidation/*.json never created |
+| R4 | 2% overlap — different function sets (confirms: different jobs) | 2% |
+| R5 | importable NOW (after repair); dead since #314 | importable |
+| R6 | dry-run probe NOW green (post-repair); was JSONDecodeError-crash | consolidate() wired, but its outputs absent too |
+
+## Verdict
+
+1. **NOT a supersession.** 2% function overlap + different roles: curator = write-path gate (worthiness → grade → tier), memory_consolidation = read-path compressor (existing memories → knowledge records). One writes, one compresses. Both belong.
+2. **Both are broken in production.** Curator never ran (phantom deps). memory_consolidation's outputs are stale/absent — its last graph write was Aug 22. The whole sleep-time memory pipeline has been quietly degraded.
+3. **Disposition: REPAIR, not retire.** grading.py + worthiness.py are now recovered from the Odysseus source branch (provenance, not reconstruction) with frozen tests; curator's dry-run executes end-to-end. Remaining phantom for curator: lexicon_evolution (guarded — degrades), aaak (guarded — optional compression). Both degradable, not blocking.
+
+## The phantom-import census (the general finding)
+
+16 phantom imports found across src/rune. The important ones:
+
+| Module | Importers | Guarded? | Disposition |
+|---|---|---|---|
+| worthiness | curator | NO (hard crash) | ✅ RECOVERED from Odysseus + frozen tests |
+| grading | curator | NO | ✅ RECOVERED from Odysseus + frozen tests |
+| lexicon_evolution | curator | yes (degrades) | recover-or-rename decision needed |
+| aaak | curator, memory_store, warm_router | yes | optional compression; recover or accept degrade |
+| build_pipeline_policy | prompt_sync | NO | phantom — prompt_sync is dead on arrival |
+| gitea_auth | forge | NO | forge.py dead; is forge itself superseded? |
+| faster_whisper, pynput | voicebox | yes | optional deps — correct as-is |
+| research_lens | claim_audit | yes | lives in ~/.config/opencode/scripts — cross-repo dep |
+| ep_loader | 5 modules | false positive | resolves via sys.path hack to src/rust/ |
+| autonomy_loop, cognitive_loop, dream_cycle | rune_tui | yes | TUI plugins — recover or retire |
+| commitments, dedupe_policy, local_memory | warm_router, memory_store, sleep_time | yes | recover-or-accept-degrade |
+
+**Hard-crash phantoms mean the owning module is dead code:** prompt_sync, forge, and (until today) curator.
+
+## What the dictonomy rebase inherits
+
+The Go/Rust port queue should SKIP dead code until its disposition is decided. A module that never ran has no behavioral parity to prove — porting it would faithfully reproduce a ghost. The audit instrument now needs an R5 importability column so dead modules are marked before they're counted.

docs/tui-registry.md

@@ -10,6 +10,7 @@ new surface._
 | `rune_tui.py` | The main Textual application — chat pane, work pane, status bar (version label + refresh), footer, dialogs | The known giant (file-size debt tracked in henxels); composition root for all UI |
 | `tui_validator.py` | Import-allowlist validation for TUI code | Drift defect tracked in #139 (allowlist vs `__future__`/relative imports) |
 | `tui_backlog.py` | Not a surface — the durable TUI Upgrade Backlog ledger (outstanding projection/control work per backend feature) | SCAFFOLD-TRANCHE-007; ledger only, never structural authority |
+| `tui_transport.py` | Not a surface — the transport seam for the TUI's operator calls (in-process default / /v1 wire opt-in) | H4 slice 1 (contract BUILDER-2026-10-04T10:32:00Z-cli); RUNE_TUI_TRANSPORT selects; coverage: canary_tui_transport.py |
 
 ## Adding a TUI surface
 

go-version.txt

@@ -0,0 +1 @@
+1.27.1

henxels.yaml

@@ -1,103 +1,150 @@
 settings:
   warn_about_similar_files:
     above: 0.85
-    ignore: ["docs/review-lessons.yaml", "docs/v1/**", "docs/wiki/**", "store/spine/**"]
-
+    ignore:
+    - docs/review-lessons.yaml
+    - docs/v1/**
+    - docs/wiki/**
+    - store/spine/**
+    - shared/**
+    - src/rune/drift_core.py
+    - src/rune/drift_compression.py
+    - src/rune/drift_observability.py
+    - src/rune/shard_manager.py
+    - src/rune/subconscious_pass.py
+    - .gitea/ISSUE_TEMPLATE/**
+    - shared/issue_templates/**
+    - bridge/daemon/completion_file.py
+    - scripts/completion_file.py
+    - interop/rebase-proof/**
+    - src/rust/*/Cargo.lock
+    - src/rust/*/src/pyjson.rs
+    - src/rust/query_memory/src/json_min.rs
+    - store/scaffold/**
 henxels:
-  - henxel: "Canaries live at the repo's canary slot and are registered in CI"
-    in: ./src/rune/**/canary_*.py
-    ci_runs_all_canaries: true
-
-  - henxel: "No secrets in tracked files"
-    no_secrets: true
-    except: ["./tests/test_gitea_provision.py", "./tests/test_gitea_auth.py", "./.ci-venv/**", "./.test-venv/**", "./.canary-venv/**", "./backups/**"]
-
-  - henxel: "Plans are markdown, one per build"
-    in: ./plans
-    allowed_filetypes: [.md]
-    filename_casing: kebab-case
-
-  - henxel: "Top-level docs are markdown or yaml references"
-    in: ./docs/*
-    allowed_filetypes: [.md, .yaml]
-    except: ["./docs/v1/**", "./docs/wiki/**", "./docs/gitea_issue_reconciliation.json"]
-
-  - henxel: "The known giant stays visible — file-size debt is tracked, not silent"
-    in: ./src/rune/*
-    except:
-      - ./src/rune/rune_tui.py
-      - ./src/rune/rune_operator.py
-      - ./src/rune/memory_store.py
-      - ./src/rune/curator.py
-      - ./src/rune/tool_executor.py
-      - ./src/rune/warm_router.py
-    max_lines: 1200
-
-  - henxel: "The umbrella impact map is complete and truthful — every module mapped, no phantom entries"
-    in: ./config/umbrellas.json
-    umbrella_manifest_is_complete: true
-
-  - henxel: "Umbrella canaries exist in the repo — the propagation gate cannot reference ghosts"
-    in: ./config/umbrellas.json
-    umbrella_canaries_exist: true
-
-  - henxel: "The umbrella dependency graph stays a DAG — reflexive updates cannot cycle"
-    in: ./config/umbrellas.json
-    umbrella_dag_acyclic: true
-
-  - henxel: "The bug-fix discharge contract is a governed doc — it exists, is markdown, and changes are deliberate"
-    in: ./docs/bugfix-contract.md
-    allowed_filetypes: [.md]
-
-  - henxel: "The discharge checker ships with the repo — red-first enforcement is structural"
-    in: ./scripts
-    required_files: [check_discharge_contract.py]
-
-  - henxel: "Discharge checker and its CI wiring change together"
-    changed_with:
-      when: scripts/check_discharge_contract.py
-      expect: ./.gitea/workflows/pipeline-gate.yml
-
-  - henxel: "Every workflow is registered in the pipeline registry — new pipeline machinery ships with documentation"
-    in: ./.gitea/workflows/*.yml
-    workflows_are_governed: true
-
-  - henxel: "Every TUI surface is registered — no silent UI growth"
-    in: ./src/rune/*tui*.py
-    tui_panels_are_governed: true
-
-  - henxel: "New rune modules ship with tests or a canary — no ungoverned code surfaces"
-    in: ./src/rune/*.py
-    new_rune_modules_have_canary_or_test_coverage: true
-
-
-  - henxel: "PRDs are living documents — their generated state sections regenerate identically from governed sources"
-    changed_with:
-      when: config/umbrellas.json
-      expect: ./docs/pipeline-prd.md
-
-  - henxel: "PRD staleness is a CI failure — docs rot is silent failure"
-    in: ./scripts/gen_prd_state.py
-    required_files: [gen_prd_state.py]
-
-  - henxel: "The adversarial review procedure is binding — dispatch templates must reference it"
-    in: ./docs/adversarial-review.md
-    required_files: [../docs/reviewer-dispatch-template.md]
-
-  - henxel: "The fixture pipeline ships with the repo — production failure capture is structural"
-    in: ./scripts
-    required_files: [capture_failure.py]
-
-  - henxel: "Production failure fixtures are a governed surface — the registry and its README exist"
-    in: ./tests/fixtures/production
-    required_files: [manifest.json, README.md]
-
-  - henxel: "Fixture payloads and the manifest travel together — tamper-evidence needs both"
-    changed_with:
-      when: tests/fixtures/production/**/payload.json
-      expect: tests/fixtures/production/manifest.json
-
-  - henxel: "The fixture manifest and its generated regression tests travel together"
-    changed_with:
-      when: tests/fixtures/production/manifest.json
-      expect: tests/fixtures/production/test_production_fixtures.py
+- henxel: Canaries live at the repo's canary slot and are registered in CI
+  in: ./src/rune/**/canary_*.py
+  ci_runs_all_canaries: true
+- henxel: No secrets in tracked files
+  no_secrets: true
+  except:
+  - ./tests/test_gitea_provision.py
+  - ./tests/test_gitea_auth.py
+  - ./.ci-venv/**
+  - ./.test-venv/**
+  - ./.canary-venv/**
+  - ./backups/**
+- henxel: Plans are markdown, one per build
+  in: ./plans
+  allowed_filetypes:
+  - .md
+  filename_casing: kebab-case
+- henxel: Top-level docs are markdown or yaml references
+  in: ./docs/*
+  allowed_filetypes:
+  - .md
+  - .yaml
+  except:
+  - ./docs/v1/**
+  - ./docs/wiki/**
+  - ./docs/gitea_issue_reconciliation.json
+  - ./docs/rebase/**
+- henxel: "The known giant stays visible \u2014 file-size debt is tracked, not silent"
+  in: ./src/rune/*
+  except:
+  - ./src/rune/rune_tui.py
+  - ./src/rune/rune_operator.py
+  - ./src/rune/memory_store.py
+  - ./src/rune/curator.py
+  - ./src/rune/tool_executor.py
+  - ./src/rune/warm_router.py
+  - ./src/rune/spine.py
+  max_lines: 1250
+- henxel: "The umbrella impact map is complete and truthful \u2014 every module mapped,\
+    \ no phantom entries"
+  in: ./config/umbrellas.json
+  umbrella_manifest_is_complete: true
+- henxel: "Umbrella canaries exist in the repo \u2014 the propagation gate cannot\
+    \ reference ghosts"
+  in: ./config/umbrellas.json
+  umbrella_canaries_exist: true
+- henxel: "The umbrella dependency graph stays a DAG \u2014 reflexive updates cannot\
+    \ cycle"
+  in: ./config/umbrellas.json
+  umbrella_dag_acyclic: true
+- henxel: "The bug-fix discharge contract is a governed doc \u2014 it exists, is markdown,\
+    \ and changes are deliberate"
+  in: ./docs/bugfix-contract.md
+  allowed_filetypes:
+  - .md
+- henxel: "The discharge checker ships with the repo \u2014 red-first enforcement\
+    \ is structural"
+  in: ./scripts
+  required_files:
+  - check_discharge_contract.py
+- henxel: Discharge checker and its CI wiring change together
+  changed_with:
+    when: scripts/check_discharge_contract.py
+    expect: ./.gitea/workflows/pipeline-gate.yml
+- henxel: "Every workflow is registered in the pipeline registry \u2014 new pipeline\
+    \ machinery ships with documentation"
+  in: ./.gitea/workflows/*.yml
+  workflows_are_governed: true
+- henxel: "Every TUI surface is registered \u2014 no silent UI growth"
+  in: ./src/rune/*tui*.py
+  tui_panels_are_governed: true
+- henxel: "New rune modules ship with tests or a canary \u2014 no ungoverned code\
+    \ surfaces"
+  in: ./src/rune/*.py
+  new_rune_modules_have_canary_or_test_coverage: true
+- henxel: Rust crate files stay under a line budget
+  in: ./src/rust/*/src/*.rs
+  except:
+  - ./src/rust/*/src/pyjson.rs
+  - ./src/rust/*/src/json_min.rs
+  max_lines: 3000
+- henxel: Go modules stay under a line budget
+  in: ./src/go/**/*.go
+  max_lines: 2000
+- henxel: No secrets in Rust or Go source files
+  in:
+  - ./src/rust/*/src/*.rs
+  - ./src/go/**/*.go
+  no_secrets: true
+- henxel: "PRDs are living documents \u2014 their generated state sections regenerate\
+    \ identically from governed sources"
+  changed_with:
+    when: config/umbrellas.json
+    expect: ./docs/pipeline-prd.md
+- henxel: "PRD staleness is a CI failure \u2014 docs rot is silent failure"
+  in: ./scripts/gen_prd_state.py
+  required_files:
+  - gen_prd_state.py
+- henxel: "The adversarial review procedure is binding \u2014 dispatch templates must\
+    \ reference it"
+  in: ./docs/adversarial-review.md
+  required_files:
+  - ../docs/reviewer-dispatch-template.md
+- henxel: "The fixture pipeline ships with the repo \u2014 production failure capture\
+    \ is structural"
+  in: ./scripts
+  required_files:
+  - capture_failure.py
+- henxel: "Production failure fixtures are a governed surface \u2014 the registry\
+    \ and its README exist"
+  in: ./tests/fixtures/production
+  required_files:
+  - manifest.json
+  - README.md
+- henxel: "Fixture payloads and the manifest travel together \u2014 tamper-evidence\
+    \ needs both"
+  changed_with:
+    when: tests/fixtures/production/**/payload.json
+    expect: tests/fixtures/production/manifest.json
+- henxel: The fixture manifest and its generated regression tests travel together
+  changed_with:
+    when: tests/fixtures/production/manifest.json
+    expect: tests/fixtures/production/test_production_fixtures.py
+- henxel: "The dichotomy is enforced at the commit boundary — every src/rune module lands in its measured side, dead oracles and wrong-language kernels fail with the correct implementation as the instruction"
+  in: ./src/rune
+  dichotomy_language_verdict: true

henxels_checks.py

@@ -189,3 +189,134 @@ def new_rune_modules_have_canary_or_test_coverage(param, file, root):
         f"legacy debt goes in docs/module-coverage-debt.md (tracked, not silent)"
     )
 
+
+
+@statement("dichotomy_language_verdict", help="every src/rune module lands in its measured dichotomy side — wrong-language kernels, dead oracles, and regressions fail with the correct implementation as the instruction")
+def dichotomy_language_verdict(param, file, scope):
+    """The dichotomy gate (Nick, 2026-10-10): the language law enforced at the
+    commit boundary, with machine-actionable feedback for Rune/MiMo-Rune.
+
+    Authority: store/rebase/classification.json (the measured W0 map —
+    per-module side + evidence). Three violations, each with a specific
+    remediation instruction:
+
+      D1 WRONG-LANGUAGE KERNEL — a module classified RUST has no matching
+         Rust crate/kernel surface while a Go directory claims its name:
+         the deterministic core landed on the reactive side.
+      D2 DEAD ORACLE — a module classified GO/RUST has a ported kernel
+         (src/go/<name>/ or src/rust/<name>/ exists) but the Python module
+         has zero delegation refs (cc_loader / <name>_loader / go-surface
+         call). The port shipped; the adapter never calls it — a facade.
+      D3 REGRESSION — a module classified GO or RUST has NO port directory
+         at all AND the ratchet floor says it was already ported: progress
+         went backwards.
+
+    Feedback format: each failure names the verdict, the measured evidence,
+    and the literal next step (target path + oracle-first battery +
+    contract-first), so the builder agent can act without re-deriving.
+    """
+    import json
+    import re as _re
+
+    if not (file.startswith("src/rune/") and file.endswith(".py")):
+        return None
+    stem = Path(file).stem
+    if stem.startswith(("canary_", "test_", "__")):
+        return None
+
+    root = scope.root
+    try:
+        cls = json.loads((root / "store" / "rebase" / "classification.json").read_text())
+    except (OSError, json.JSONDecodeError):
+        return None  # no measured map: the audit instrument owns coverage; do not guess
+    rec = cls.get(stem)
+    if not isinstance(rec, dict):
+        return None
+    side = rec.get("side", "")
+    if side not in ("GO", "RUST", "TUI-LAST"):
+        return None
+
+    go_dir = root / "src" / "go" / stem
+    rust_dir = root / "src" / "rust" / stem
+    evidence = str(rec.get("evidence", ""))[:160]
+
+    # D1 — wrong-language kernel: a GO-classified module must not own a Rust
+    # crate that shadows its name, and vice versa.
+    if side == "RUST" and go_dir.is_dir() and not rust_dir.is_dir():
+        # Wave-3 kernels live in cognition_core by design (cc_<stem> externs).
+        # A RUST-classified module whose kernel exists there is correctly landed
+        # even without a same-named crate.
+        cc = root / "src" / "rust" / "cognition_core" / "src" / "lib.rs"
+        if cc.exists() and f"cc_{stem}" in cc.read_text(encoding="utf-8", errors="replace"):
+            return None
+        return (
+            f"DICHOTOMY D1 (wrong-language kernel): {stem} is measured RUST "
+            f"({evidence}) but src/go/{stem}/ exists with no src/rust/{stem}/. "
+            f"FIX: port the deterministic core to src/rust/{stem}/ (oracle-first "
+            f"truth battery from the Python module, parity-replayed as a HARD CI "
+            f"gate, construction contract FIRST per the absolute-scaffolding law), "
+            f"then retire the Go directory. Feedback path: scripts/dichotomy_audit.py"
+        )
+    if side == "GO" and rust_dir.is_dir() and not go_dir.is_dir():
+        return (
+            f"DICHOTOMY D1 (wrong-language kernel): {stem} is measured GO "
+            f"({evidence}) but src/rust/{stem}/ exists with no src/go/{stem}/. "
+            f"FIX: the reactive surface belongs in src/go/{stem}/ (parity battery "
+            f"+ HARD CI gate + contract first), then retire the Rust crate."
+        )
+
+    # D2 — dead oracle: the port exists but the Python module never delegates.
+    # Delegation forms (all observed in the codebase): cc_loader/_cc_core,
+    # sibling *_loader imports (ep_loader, qm_loader, ms_loader...), direct
+    # ctypes/CDLL. Known pre-existing facades live in the DICHOTOMY DEBT file
+    # (store/rebase/dichotomy_debt.json) — tracked, only-shrinks; a NEW facade
+    # (not in the debt list) fails with the wiring instruction.
+    ported = go_dir.is_dir() or rust_dir.is_dir()
+    if ported and side in ("GO", "RUST"):
+        text = scope.read_text(file) or ""
+        delegating = bool(
+            _re.search(
+                r"import\s+\w*loader\b|from\s+[\w.]+\s+import\s+\w*loader|"
+                r"_cc_core|cc_loader|ctypes|CDLL|go_surface|RUNE_\w+_CORE",
+                text,
+            )
+        )
+        is_loader = stem.endswith("_loader") or stem == "cc_loader"
+        if not delegating and not is_loader:
+            target = f"src/rust/{stem}/" if rust_dir.is_dir() else f"src/go/{stem}/"
+            try:
+                debt = set(json.loads(
+                    (root / "store" / "rebase" / "dichotomy_debt.json").read_text()
+                ).get("facades", []))
+            except (OSError, json.JSONDecodeError):
+                debt = set()
+            if stem in debt:
+                return None  # tracked debt — visible in the debt file, list only shrinks
+            return (
+                f"DICHOTOMY D2 (dead oracle): {stem} has a ported kernel at "
+                f"{target} but the Python module has ZERO delegation references "
+                f"(no cc_loader/_cc_core/*_loader/ctypes call). The port is a "
+                f"facade — production still runs the Python path. FIX: wire the "
+                f"delegation (tier_manager pattern: kernel when available, _py_* "
+                f"parity floor otherwise, both pinned by tests). Pre-existing "
+                f"facades go in store/rebase/dichotomy_debt.json (tracked, "
+                f"list only shrinks). Feedback: scripts/dichotomy_audit.py"
+            )
+
+    # D3 — regression: the ratchet says this module was ported (kernel dir in
+    # git HEAD) but the working tree lost it.
+    if side in ("GO", "RUST") and not ported:
+        ratchet = root / "store" / "rebase" / "ported_ratchet.json"
+        try:
+            ratcheted = set(json.loads(ratchet.read_text()).get("ported", []))
+        except (OSError, json.JSONDecodeError, AttributeError):
+            ratcheted = set()
+        if stem in ratcheted:
+            return (
+                f"DICHOTOMY D3 (regression): {stem} is ratcheted as ported but no "
+                f"src/go/{stem}/ or src/rust/{stem}/ exists in the tree — ported "
+                f"work was deleted. RESTORE the kernel directory (git history has "
+                f"it); the ratchet floor never decreases."
+            )
+
+    return None

interop/rebase-proof/Cargo.lock

@@ -0,0 +1,7 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "rebase-proof"
+version = "0.1.0"

interop/rebase-proof/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "rebase-proof"
+version = "0.1.0"
+edition = "2021"
+
+# Wave 0 interop proof unit (R1 §5). Std-only by design: no crates, no network,
+# deterministic build. The pattern under proof is the CLI boundary itself, not the
+# computation inside it.
+
+[[bin]]
+name = "rebase-proof"
+path = "src/main.rs"
+
+[profile.release]
+strip = true

interop/rebase-proof/src/main.rs

@@ -0,0 +1,117 @@
+//! Wave 0 interop proof unit (R1 §5 of the language-rebasing tranche).
+//!
+//! Contract under proof:
+//! - standalone binary; argv in, JSON on stdout
+//! - non-zero exit on failure (JSON error object still printed to stdout)
+//! - `--version` flag mandatory
+//! - Python wraps it in a thin adapter (`shared/native_units.py`); tests call
+//!   it the same way.
+//!
+//! Ops: sum / echo / hash (fnv1a64) / sleep / fail. All std-only.
+
+use std::env;
+use std::process::exit;
+use std::thread;
+use std::time::Duration;
+
+const VERSION: &str = env!("CARGO_PKG_VERSION");
+
+/// FNV-1a 64-bit — dependency-free deterministic hash for the proof unit.
+fn fnv1a64(data: &[u8]) -> u64 {
+    let mut hash: u64 = 0xcbf29ce484222325;
+    for byte in data {
+        hash ^= u64::from(*byte);
+        hash = hash.wrapping_mul(0x100000001b3);
+    }
+    hash
+}
+
+fn print_json(line: &str) {
+    println!("{line}");
+}
+
+fn emit_ok(body: &str) {
+    print_json(&format!("{{\"ok\":true,{body}}}"));
+    exit(0);
+}
+
+fn emit_err(message: &str) -> ! {
+    // Escape the minimal set so the JSON stays parseable for arbitrary op names.
+    let escaped: String = message
+        .chars()
+        .map(|c| match c {
+            '"' => "\\\"".to_string(),
+            '\\' => "\\\\".to_string(),
+            '\n' => "\\n".to_string(),
+            '\r' => "\\r".to_string(),
+            '\t' => "\\t".to_string(),
+            other => other.to_string(),
+        })
+        .collect();
+    print_json(&format!("{{\"ok\":false,\"error\":\"{escaped}\"}}"));
+    exit(2);
+}
+
+fn main() {
+    let args: Vec<String> = env::args().skip(1).collect();
+
+    if args.as_slice() == ["--version"] || args.as_slice() == ["-V"] {
+        println!("rebase-proof {VERSION}");
+        exit(0);
+    }
+    if args.is_empty() {
+        eprintln!("usage: rebase-proof <op> [args...] | --version");
+        emit_err("no op given");
+    }
+
+    let op = args[0].as_str();
+    let rest = &args[1..];
+
+    match op {
+        "sum" => {
+            let mut total: i128 = 0;
+            for a in rest {
+                match a.parse::<i128>() {
+                    Ok(v) => total += v,
+                    Err(_) => emit_err(&format!("sum: not an integer: {a}")),
+                }
+            }
+            emit_ok(&format!("\"op\":\"sum\",\"result\":{total}"));
+        }
+        "echo" => {
+            let joined = rest.join(" ");
+            let escaped: String = joined
+                .chars()
+                .map(|c| match c {
+                    '"' => "\\\"".to_string(),
+                    '\\' => "\\\\".to_string(),
+                    '\n' => "\\n".to_string(),
+                    '\r' => "\\r".to_string(),
+                    '\t' => "\\t".to_string(),
+                    other => other.to_string(),
+                })
+                .collect();
+            emit_ok(&format!("\"op\":\"echo\",\"text\":\"{escaped}\""));
+        }
+        "hash" => {
+            let joined = rest.join(" ");
+            let h = fnv1a64(joined.as_bytes());
+            emit_ok(&format!("\"op\":\"hash\",\"fnv1a64\":\"{h:016x}\""));
+        }
+        "sleep" => {
+            let ms: u64 = match rest.first().map(|s| s.parse::<u64>()) {
+                Some(Ok(v)) => v,
+                _ => emit_err("sleep: expected milliseconds"),
+            };
+            thread::sleep(Duration::from_millis(ms));
+            emit_ok(&format!("\"op\":\"sleep\",\"slept_ms\":{ms}"));
+        }
+        "fail" => {
+            // Deliberate failure: stderr diagnostic + JSON error + exit 2.
+            // Proves stderr capture and non-zero exit in the adapter.
+            eprintln!("rebase-proof: deliberate failure for adapter proof");
+            emit_err("deliberate failure");
+        }
+        other => emit_err(&format!("unknown op: {other}")),
+    }
+}

lint-baseline.json

@@ -1,4 +1,4 @@
 {
-  "BLE001": 347,
-  "S110": 75
+ "BLE001": 47,
+ "S110": 31
 }

memory/index/capability_cards.json

@@ -1 +1,447 @@
-[]
+[
+  {
+    "name": "gamma",
+    "description": "",
+    "capabilities": [
+      "cap.a"
+    ],
+    "file": "",
+    "full_path": "",
+    "priority": 10,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "auto_invoked": false,
+    "hooks": [],
+    "searchable_text": "gamma  cap.a "
+  },
+  {
+    "name": "alpha",
+    "description": "",
+    "capabilities": [
+      "cap.a"
+    ],
+    "file": "",
+    "full_path": "",
+    "priority": 50,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "auto_invoked": false,
+    "hooks": [],
+    "searchable_text": "alpha  cap.a "
+  },
+  {
+    "name": "delta",
+    "description": "",
+    "capabilities": [],
+    "file": "",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "auto_invoked": true,
+    "hooks": [
+      "pre-turn",
+      "post-turn"
+    ],
+    "searchable_text": "delta   "
+  },
+  {
+    "name": "read_file",
+    "description": "Read a file with optional windowed viewing (offset/limit). Returns numbered lines. Use offset/limit for large files (100 lines at a time).",
+    "capabilities": [
+      "read_file"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "path exists and is a readable file"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "read_file read a file with optional windowed viewing (offset/limit). returns numbered lines. use offset/limit for large files (100 lines at a time). native tool"
+  },
+  {
+    "name": "edit_file",
+    "description": "Surgical search/replace edit. More reliable than full file rewrites. The search string must match exactly.",
+    "capabilities": [
+      "edit_file"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "write",
+    "preconditions": [
+      "path is inside an allowed write directory",
+      "search string matches exactly once"
+    ],
+    "side_effects": [
+      "rewrites the target file atomically after approval",
+      "creates a .bak backup under ~/.rune/undo"
+    ],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "edit_file surgical search/replace edit. more reliable than full file rewrites. the search string must match exactly. native tool"
+  },
+  {
+    "name": "write_file",
+    "description": "Write content to a file. Creates parent directories if needed. Shows diff before writing. Use for new files or full rewrites.",
+    "capabilities": [
+      "write_file"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "write",
+    "preconditions": [
+      "path is inside an allowed write directory"
+    ],
+    "side_effects": [
+      "writes the full file content atomically after approval",
+      "creates a .bak backup under ~/.rune/undo"
+    ],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "write_file write content to a file. creates parent directories if needed. shows diff before writing. use for new files or full rewrites. native tool"
+  },
+  {
+    "name": "glob_files",
+    "description": "Find files matching a glob pattern. Returns file paths sorted by modification time.",
+    "capabilities": [
+      "glob_files"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "search directory is readable"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "glob_files find files matching a glob pattern. returns file paths sorted by modification time. native tool"
+  },
+  {
+    "name": "grep_files",
+    "description": "Search for a pattern in files. Returns file paths and line numbers. Use include to filter by file type.",
+    "capabilities": [
+      "grep_files"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "search directory is readable"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "grep_files search for a pattern in files. returns file paths and line numbers. use include to filter by file type. native tool"
+  },
+  {
+    "name": "list_directory",
+    "description": "List files and directories at a path. Returns names with / suffix for directories.",
+    "capabilities": [
+      "list_directory"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "path is a readable directory"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "list_directory list files and directories at a path. returns names with / suffix for directories. native tool"
+  },
+  {
+    "name": "lint_file",
+    "description": "Lint a file for syntax errors and style issues. Blocks bad edits. Supports Python (ruff), JS/TS (eslint), Go (golangci-lint), and more.",
+    "capabilities": [
+      "lint_file"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "file exists",
+      "a linter is configured for the language"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "lint_file lint a file for syntax errors and style issues. blocks bad edits. supports python (ruff), js/ts (eslint), go (golangci-lint), and more. native tool"
+  },
+  {
+    "name": "run_tests",
+    "description": "Run tests for a file or project. Auto-detects test runner from language.",
+    "capabilities": [
+      "run_tests"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "write",
+    "preconditions": [
+      "a test runner is configured for the project"
+    ],
+    "side_effects": [
+      "runs project test commands which may create or delete files"
+    ],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "run_tests run tests for a file or project. auto-detects test runner from language. native tool"
+  },
+  {
+    "name": "format_code",
+    "description": "Auto-format code files. Supports Python (black/ruff), JS/TS (prettier), Go (gofmt), and more.",
+    "capabilities": [
+      "format_code"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "write",
+    "preconditions": [
+      "path is inside an allowed write directory",
+      "a formatter is configured for the language"
+    ],
+    "side_effects": [
+      "rewrites files in place to the formatter's style"
+    ],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "format_code auto-format code files. supports python (black/ruff), js/ts (prettier), go (gofmt), and more. native tool"
+  },
+  {
+    "name": "git_diff",
+    "description": "Show git diff for staged or unstaged changes.",
+    "capabilities": [
+      "git_diff"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "working directory is a git repository"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "git_diff show git diff for staged or unstaged changes. native tool"
+  },
+  {
+    "name": "git_log",
+    "description": "Show recent git commits.",
+    "capabilities": [
+      "git_log"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "working directory is a git repository"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "git_log show recent git commits. native tool"
+  },
+  {
+    "name": "git_commit",
+    "description": "Commit changes with a message. Auto-stages modified files.",
+    "capabilities": [
+      "git_commit"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "irreversible",
+    "preconditions": [
+      "working directory is a git repository",
+      "there are changes to commit"
+    ],
+    "side_effects": [
+      "creates a commit on the current branch"
+    ],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "git_commit commit changes with a message. auto-stages modified files. native tool"
+  },
+  {
+    "name": "repo_map",
+    "description": "Generate an AST-based codebase map showing key symbols (classes, functions, imports). Uses tree-sitter for 100+ languages.",
+    "capabilities": [
+      "repo_map"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "target directory is readable"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "repo_map generate an ast-based codebase map showing key symbols (classes, functions, imports). uses tree-sitter for 100+ languages. native tool"
+  },
+  {
+    "name": "run_command",
+    "description": "Run an approved command. Prefer argv (shell=False); shell syntax requires shell=true and explicit user approval.",
+    "capabilities": [
+      "run_command"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "irreversible",
+    "preconditions": [
+      "operator approves the command",
+      "required binaries are on PATH"
+    ],
+    "side_effects": [
+      "executes arbitrary commands with their full side effects"
+    ],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "run_command run an approved command. prefer argv (shell=false); shell syntax requires shell=true and explicit user approval. native tool"
+  },
+  {
+    "name": "read_persona",
+    "description": "Read Rune's persona definition. Returns the full persona block with voice, identity, and rules.",
+    "capabilities": [
+      "read_persona"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "persona MEMORY.md exists"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "read_persona read rune's persona definition. returns the full persona block with voice, identity, and rules. native tool"
+  },
+  {
+    "name": "query_memory",
+    "description": "Query Rune's memory store. Returns relevant memories for a query.",
+    "capabilities": [
+      "query_memory"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "memory store database is available"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "query_memory query rune's memory store. returns relevant memories for a query. native tool"
+  },
+  {
+    "name": "check_growth",
+    "description": "Check Rune's growth log. Returns recent growth entries and patterns.",
+    "capabilities": [
+      "check_growth"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "growth log file exists"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "check_growth check rune's growth log. returns recent growth entries and patterns. native tool"
+  },
+  {
+    "name": "diagnose_behavior",
+    "description": "Diagnose Rune's current behavior. Returns analysis of persona adherence, voice consistency, and drift.",
+    "capabilities": [
+      "diagnose_behavior"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "recent response text provided"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "diagnose_behavior diagnose rune's current behavior. returns analysis of persona adherence, voice consistency, and drift. native tool"
+  },
+  {
+    "name": "find_capability",
+    "description": "Search all installed capabilities for what you need. Returns matching tool names with descriptions and argument schemas. Use this when a capability you need is not in your current tool set; the matched tool becomes callable in the same session.",
+    "capabilities": [
+      "find_capability"
+    ],
+    "file": "tool_executor.py",
+    "full_path": "",
+    "priority": 100,
+    "semantic_examples": [],
+    "risk": "read-only",
+    "preconditions": [
+      "a capability query describing the needed outcome"
+    ],
+    "side_effects": [],
+    "auto_invoked": false,
+    "hooks": [],
+    "native_tool": true,
+    "searchable_text": "find_capability search all installed capabilities for what you need. returns matching tool names with descriptions and argument schemas. use this when a capability you need is not in your current tool set; the matched tool becomes callable in the same session. native tool"
+  }
+]

memory/index/warm_state.json

@@ -1,4 +1,5 @@
 {
   "neurons": {},
-  "divides": []
+  "divides": [],
+  "sessions": {}
 }

plans/2026-10-02-phase-g-query-memory-supersession.md

@@ -0,0 +1,48 @@
+# Phase G slice 1 — retrieval-index authority supersession ledger
+
+**Date:** 2026-10-02 · **Branch:** `phase-g-strangler-retrieval-index` · **Unit issue:** conductor/rune#2448
+
+## What was superseded
+
+The pure-Python `query_memory` implementation (formerly `src/rune/query_memory.py`,
+deployed at `~/.config/opencode/scripts/query_memory.py`) is RETIRED as a production
+implementation. Production authority now rests with:
+
+1. **Implementation:** Rust crate `src/rust/query_memory/` (lib.rs core + cdylib, ten
+   `extern "C"` FFI symbols, zero external crates).
+2. **Production service surface:** `shared/query_memory.py` — a ctypes-backed shim
+   (179 lines) over `qm_loader.py`, byte-deployed to `~/.config/opencode/scripts/query_memory.py`,
+   serving the FULL prior Python class API including the `self.history` snapshot.
+
+## Strangler doctrine (master doc lines 685–770) — step discharge
+
+| Step | Requirement | Evidence |
+|------|-------------|----------|
+| 1–4 | candidate built, contract frozen, parity proven | commits `9b76585`+`54d2db9`; `/tmp/phaseG_retrieval_index_contract.md` frozen; parity harness ALL GREEN |
+| 5 | qualification | `/tmp/phaseG_qual_bench.out` (Rust CLI ~45× faster end-to-end); canaries both sides |
+| 6 | canaries conformance | Python canary 12/12; Rust canary 27/27 |
+| 7 | shadow comparison vs live store | `/tmp/phaseG_shadow.py` 46/46 exact-equal vs 77-record production store |
+| 8 | authority switch + observed consumer evidence | commit `6f44a87`; both consumers verified live — `memory_store.py` (lines 820–821, live 76-record store, nested stats shape) + `growth_simulator.py` (record_query through Rust core); #2448 comment id 33795 |
+| 9 | runtime evidence post-switch | post-switch verification wall ALL GREEN: Python canary 12/12, FFI smoke 41/41, Rust canary 27/27, parity harness ALL GREEN |
+| 10 | old production path unreachable | ALL import paths (`import query_memory`) now resolve to the deployed shim; `shared/graph_shard_bridge.py` tolerant import serves the shim; the orphan `src/rune/query_memory.py` had ZERO importers (verified by sweep incl. path-string references) |
+| 11 | old implementation removed or reference-only | `src/rune/query_memory.py` DELETED (this commit); the only stale reference (`scripts/structural_coverage_audit.py` registry mapping shared/ as a mirror of src/rune) corrected — query_memory removed from `SRC_A`/`SHARED_D`, added to `SHARED_B` (canonical, ops-harness owned) |
+| 12 | supersession ledger | THIS FILE |
+
+Deletion discipline (language-governance rule ⑥) satisfied: old code removed only after
+the new implementation was PROVEN — wall green, shadow 46/46, both production consumers
+observed live on the Rust core before deletion.
+
+## Consumer map at supersession
+
+- `~/.config/opencode/scripts/memory_store.py` — in-process, `adaptive_exploration_rate` (line 820).
+- `~/.config/opencode/scripts/growth_simulator.py` — in-process, `record_query`.
+- `shared/graph_shard_bridge.py` — tolerant import (try/except), follows the switch.
+- `src/rune/tool_executor.py` — NOT a consumer (nominal grep hit only; goes through `memory_store.cached_recall`).
+
+## Verification commands (reproducible)
+
+- `/home/nick/.venvs/memory/bin/python3 src/rune/canary_query_memory.py` → 12/12
+- `/home/nick/.venvs/memory/bin/python3 src/rust/query_memory/canary_rust.py` → 27/27
+- `/home/nick/.venvs/memory/bin/python3 src/rune/ffi_query_memory_smoke.py` → 41/41
+- `/home/nick/.venvs/memory/bin/python3 /tmp/phaseG_parity.py` → ALL GREEN
+- `/home/nick/.venvs/memory/bin/python3 scripts/structural_coverage_audit.py` → exit 0, coverage 100%

plans/2026-10-03-phase-g-evidence-provenance-contract.md

@@ -0,0 +1,66 @@
+# Phase G Slice 2 — FROZEN CONTRACT: evidence-provenance (T7.3)
+
+Frozen: 2026-10-03, session ses_ffe5f08a7892affeGzZWhhm0wR. Branch `phase-g-strangler-evidence-provenance` (cut from slice-1 head `2ac2d0a`). Gitea issue #2449. Nothing below may change without a recorded amendment in this file.
+
+## 1. Scope (observed, not inferred)
+
+Six modules in `src/rune/`, 1796 lines total, one test file each as marked:
+
+| Module | Lines | Surface (grep-verified 2026-10-03) |
+|---|---|---|
+| `audit_ledger.py` | 231 | `_compute_hash(prev_hash, entry)`, `append_entry(entry_type, entry_id, details)`, `verify_chain() -> {valid, entries, reason}`, `get_entries(limit=50)`, `log_promotion(entry_id, old_status, new_status, wash_count, reason)`, `log_gate_result(entry_id, verdict, critics)`, `log_drift_alert(alert_type, message, severity)`, `main()` |
+| `behavior.py` | 411 | `connect()`, `add_correction(original, corrected, scope_tags=None, domain="", pattern="")`, `add_habit(trigger, action, name="", context_tags=None, min_activations=3)`, `match_context(context, match_type=None)`, `reinforce(item_id, outcome, item_type="habit")`, `list_items(item_type="all", limit=20)`, `behavior_stats()`, `main()`, `PLUGIN` dict |
+| `behaviour_ledger.py` | 251 | 9 state constants (UNVALIDATED…NOT_APPLICABLE) + `STATES` + `CONFIRMED_STATES` tuples, `BehaviourLedger` class |
+| `claim_audit.py` | 430 | `PATTERNS` list, `EVIDENCE_TAG` regex, `LEDGER_MARKERS`, `reframe(text)`, `scan(text)`, `verify(claim)`, `degrade(claim, verdict)`, `journal(entry)`, `report()`, `audit(draft)`, `handle_hook(event, data=None)`, `main()`, `PLUGIN` |
+| `evidence_probe.py` | 214 | `PROBE_STATUSES`, `PROBE_FIELDS`, `MAX_PROBES_PER_TASK=2`, `ProbeBudgetExceeded`, `ProbeResult`, `build_probe_prompt(question, artifact_path)`, `validate_probe(artifact)`, `count_probes(artifact_dir)`, `check_budget(artifact_dir)`, `record_probe(result, artifact_dir)`, `run_probe(question, artifact_dir, runner=None, model="UNKNOWN")` |
+| `verification_layer.py` | 259 | `VerificationResult`, seven `verify_*` functions (exit_code, unit_test, schema, file_exists, file_changed, tool_receipt, constraint_check), `verify(result, verifier_type)`, `handle_hook`, `PLUGIN` |
+
+Plus `shared/audit_ledger.py` (210 ln) — OLDER vintage of audit_ledger.
+
+## 2. Authority decisions (per module)
+
+- **src/rune/ is the authority vintage for all six modules** — hardened newer code (memory_env-pathed storage, defensive handling). The deployed `~/.config/opencode/scripts/{audit_ledger,behavior,claim_audit}.py` copies are OLDER vintages (hardcoded expanduser paths). The authority switch is a VINTAGE UPGRADE plus a language swap — not a mirror replacement.
+- `shared/audit_ledger.py` is superseded alongside the deployed copy (same older vintage, same defects).
+
+## 3. Live-data contract (the linchpin — observed)
+
+- **Live ledger:** `/home/nick/.config/opencode/memory/promotion_ledger.jsonl` (21 entries). `verify_chain()` under the deployed module's own defaults returns `{'valid': True, 'entries': 21, 'reason': 'chain intact'}` — OBSERVED 2026-10-03.
+- **Live signing key: `rune-drift-integrity-2024`** (the deployed/shared default). The src/rune default `rune-governed-adaptation-2024` FAILS the live chain — it is a latent break, recorded as a defect this slice fixes.
+- **Hash scheme (both vintages identical):** `HMAC-SHA256(key, (prev_hash + json.dumps(entry_without_hash, sort_keys=True)).encode()).hexdigest()`; genesis prev_hash = `"genesis"`; entry lines written with `json.dumps(entry)` in insertion order (type, entry_id, details, timestamp, prev_hash, hash); timestamp = `datetime.now(timezone.utc).isoformat()`.
+- **Key rule for the Rust candidate:** read `AUDIT_LEDGER_KEY` env; DEFAULT = `rune-drift-integrity-2024` (the key that verifies the live chain). Never default to the governed key — it verifies nothing that exists.
+- **Live `behavior.db`:** SQLite at memory_env memory dir, touched Sep 24 — must remain readable by the Rust candidate's storage layer.
+
+## 4. Rust candidate design
+
+Crate `/mnt/workdrive/rune/src/rust/evidence_provenance/` following the proven slice-1 shape: zero-dep core in `lib.rs`, `cdylib` FFI exports, hand-rolled JSON serialization where byte-parity demands it. **Port order within the slice** (dependency + risk order):
+
+1. **audit_ledger** — linchpin: live data, external consumers, key contract.
+2. **verification_layer** — pure logic, no storage, one test file; fastest port.
+3. **evidence_probe** — file-based budget/records; `rune_operator.py:581` consumer.
+4. **behaviour_ledger** — state machine, src/rune-only.
+5. **behavior** — SQLite habits; live DB; deployed vintage upgrade + `rune_tui.py` consumer.
+6. **claim_audit** — heaviest (warm-neuron store + graph DB + regex engine); last.
+
+Python-side ctypes loaders (`*_loader.py`) + deployed shims per slice-1 pattern, so every consumer keeps its import surface unchanged.
+
+## 5. Parity + qualification criteria
+
+- **Byte-parity:** Rust `verify_chain` output byte-identical to Python's on the live ledger AND on a mutation battery (tampered entry, broken chain, invalid JSON, empty ledger). Parity harness both sides, slice-1 pattern.
+- **Canaries:** Python-side canary module per ported module + Rust canary; both green before any switch.
+- **Shadow:** shadow-compare Rust vs Python on live-shaped data before authority switch.
+- **Performance:** like-for-like benchmark on the real consumption shape; no regression (Nick's law: combination does not decrease speed).
+
+## 6. Consumers + adoption plan (Nick's directive: adoption during the refactor)
+
+| Consumer | Imports | Switch |
+|---|---|---|
+| `~/.config/opencode/scripts/curator.py` | audit_ledger | at audit_ledger switch |
+| `canary_tui_drift.py`, `canary_full_system.py` | audit_ledger | at audit_ledger switch |
+| `rune_tui.py` (L62, L83) | claim_audit, behavior | at each module's switch |
+| `rune_operator.py:581` | evidence_probe (relative) | at evidence_probe switch |
+
+Deployed copies become ctypes shims at each module's authority switch (vintage upgrade included — the shim serves the src/rune contract, not the old vintage's). Old deployed Python deletions follow language-governance ⑥: only after the new is proven.
+
+## 7. Exit criteria
+
+All twelve doctrine steps discharged per module-port with observed evidence on #2449; coverage-audit registry remapped; supersession ledger written; audit regression gate green.

plans/2026-10-03-phase-g-evidence-provenance-supersession.md

@@ -0,0 +1,62 @@
+# Phase G slice 2 — evidence-provenance authority supersession ledger
+
+**Date:** 2026-10-03 · **Branch:** `phase-g-strangler-evidence-provenance` · **Unit issue:** conductor/rune#2449
+
+## What was superseded
+
+The pure-Python evidence-provenance implementations (six modules in `src/rune/`, 1796 lines; plus the two OLD deployed vintages and `shared/audit_ledger.py`) are RETIRED as production implementations for their ported surfaces. Production authority now rests with:
+
+1. **Rust crate `src/rust/evidence_provenance/`** — six cores: `lib.rs` (audit_ledger chain + FFI), `verification.rs` (7 verifiers), `probe.rs` (schema gate + budget), `behaviour.rs` (state machine), `habitmath.rs` (reinforce math), `claims.rs` (claim-audit decision skeleton); cdylib FFI (`ep_*` symbols, 21 total), zero external crates.
+2. **Python shims** at `src/rune/{audit_ledger,verification_layer,evidence_probe,behaviour_ledger,behavior,claim_audit}.py` — serving the src/rune authority contract through `ep_loader.py` (in-process, no interpreter startup for the ported logic).
+3. **Deployed shims** at `~/.config/opencode/scripts/{audit_ledger,behavior,claim_audit}.py` — same shape; audit_ledger + claim_audit + behavior carry the LIVE data-path rules (drift-key ledger, live behavior.db, real journal); claim_audit additionally carries the preserved SYMMETRY GUARD (deployed-vintage feature) and the repaired `scan_text()` TUI surface.
+
+## Port ledger (all six, in contract §4 order)
+
+| Port | Module | Rust core | Parity | Commit | Consumer proof |
+|------|--------|-----------|--------|--------|----------------|
+| 1 | audit_ledger | lib.rs chain ops | shadow 18/18; canaries 28/28+23/23 | `114c394`+`4b0d1d2` | live ledger entries 4242 (post-switch write), verify 23-intact |
+| 2 | verification_layer | verification.rs | 33/33 (7 verifiers + CLI render) | `9cb93e6` | contracts.py, canary_native, rune_operator:323 dataclass |
+| 3 | evidence_probe | probe.rs | 24/24 + consumer tests 23/23 | `3450a1c` | rune_operator:581/603, research_stage_executor:312 |
+| 4 | behaviour_ledger | behaviour.rs | 13/13 full-scenario | `8973caa` | testing_mode:19, iteration:23, rune_tui:3152 |
+| 5 | behavior | habitmath.rs | 16/16 + full-stack live-db | `2732677` | rune_tui:83; deployed vintage upgraded (live db read-verified) |
+| 6 | claim_audit | claims.rs | 17/17 + real-journal aggregate (1127 rows) | `969e39f` | rune_tui:62/2468/3752, contracts.py, hook_engine:270 |
+
+Errors: byte-equal (duplicate/unknown-behaviour/unknown-state; probe schema-gate lists incl. Python repr rendering; CLI argparse shapes + exit codes).
+
+## Strangler doctrine (master doc lines 685–770) — step discharge (slice level)
+
+| Step | Requirement | Evidence |
+|------|-------------|----------|
+| 1–4 | candidate built, contract frozen, parity proven | commits `114c394` → `969e39f`; frozen contract `plans/2026-10-03-phase-g-evidence-provenance-contract.md` (commit `7c68e41`); per-port parity harnesses ALL GREEN |
+| 5 | qualification | per-port parity + decision-math batteries; canary pair per port (Python 74/74, Rust 66/66 — all six port sections accumulated); performance follows the slice-1 in-process shape (no interpreter startup; same cdylib) |
+| 6 | canaries conformance | canary_audit_ledger.py 74/74; canary_evidence_provenance_rust.py 66/66 (per-port sections for ALL six ports; dual-mode LIVE/ISOLATED for live-ledger pins — run 18141 repair); embedded tests through shims (verification test, 23 consumer tests) |
+| 7 | shadow comparison vs live-shaped data | port-1 shadow 18/18 vs `939883d:shared/audit_ledger.py` (banked at `114c394`); ports 2–6 use direct byte-parity batteries vs the live originals (same discipline, stronger: full-document byte-quality) |
+| 8 | authority switch + observed consumer evidence | shims deployed + live-verified per port: entry 4242 (first post-switch ledger write), live behavior.db read through the port-5 shim, real 1127-row journal through the port-6 aggregation, TUI backend trio imports, TUI scan_text FIRST-EVER live call |
+| 9 | runtime evidence post-switch | post-switch walls per port: parity round-trips, embedded tests, consumer chains (rune.behaviour_ledger / rune.evidence_probe / rune.claim_audit + deployed trio) — all GREEN |
+| 10 | old production path unreachable | `import audit_ledger` (deployed consumers) → shim; `rune.behaviour_ledger` / `rune.evidence_probe` / `rune.claim_audit` / `rune.verification_layer` → shims; `shared/audit_ledger.py` had ZERO importers (verified by sweep incl. path-string forms) — DELETED |
+| 11 | old implementation removed or reference-only | `shared/audit_ledger.py` DELETED (this commit, after the proven wall + zero-importer sweep); six src/rune modules remain as shims (the API contract); original Python lives in git history. Coverage registry remapped: `audit_ledger` removed from SHARED_D; gate exit 0 post-deletion |
+| 12 | supersession ledger | THIS FILE |
+
+Deletion discipline (language-governance rule ⑥): `shared/audit_ledger.py` removed only after (a) the deployed shim proved live against the real ledger, (b) the shadow wall was green, (c) a zero-importer sweep across src/ shared/ scripts/ tests/. The remaining five src/rune originals were rewritten AS shims in their own commits (git history holds each original); they are the API contract and stay.
+
+## Vintage-merge disclosures
+
+- **SYMMETRY GUARD preserved:** the deployed `claim_audit` vintage carried `research_lens.symmetry_check` integration (2026-08-15) absent from src/rune — preserved in both shims (feature-preserving merge; load-bearing behavior).
+- **DEAD CONSUMER REPAIRED:** `rune_tui.py:3752` `claim_audit.scan_text()` had NO implementation in either vintage (silent try/except death) — now implemented, first-class, live-verified.
+- **Sequence break (port 1):** the audit_ledger shim was deployed BEFORE its canary pair existed; both canaries subsequently written and green — disclosed on #2449 comment 33817, not retrofitted.
+
+## Consumer map at supersession
+
+- `~/.config/opencode/scripts/rune_tui.py` — claim_audit (report L2468, scan_text L3752), behaviour (L3152), behavior (L83).
+- `src/rune/rune_operator.py` — evidence_probe (L581/603), VerificationResult dataclass (L323).
+- `src/rune/contracts.py` — dynamic `__import__` surfaces (verification_layer, claim_audit).
+- `src/rune/testing_mode.py:19` / `src/rune/iteration.py:23` — behaviour_ledger constants + class.
+- `scripts/research_stage_executor.py:312` — evidence_probe orchestration.
+- `~/.config/opencode/scripts/curator.py` / `canary_full_system.py` — audit_ledger (deployed shim).
+- `src/rune/dependency_tracker.py` — map-strings only (NOT an import).
+
+## Live-data rules (contract §3) — honored in the shims
+
+- Live promotion ledger: drift key verified 23-intact through the shim + FFI; explicit `AUDIT_LEDGER_KEY` override honored.
+- Live behavior.db: read/written through the deployed shim at `~/.config/opencode/memory/behavior.db`; parity scenarios ran on temp dirs only.
+- Live claim_audit journal (1127 rows): read-only aggregate through the Rust core; writes stay Python.

plans/2026-10-04-phase-h-go-frontend-rust-backend.md

@@ -0,0 +1,97 @@
+# Phase H plan — Go front end / Rust back end (Nick's architecture directive)
+
+Status: PLAN (awaiting Nick's sign-off before any code)
+Directive: USER-LOCKED (2026-10-04). Supersedes the KEEP-PYTHON verdicts in
+docs/rebase-language-rubric.md wherever they conflict.
+
+## 1. The directive
+
+Go owns the front end: runtime entry points, the first-call surface, the
+user-facing interface and its calls. Rust owns the back end: every core
+logic module. Python survives only as transitional glue inside a module
+until its own Go/Rust surface lands.
+
+## 2. What "front end" means concretely here
+
+From the runtime-audit memory (2026-09-10): the live entry chain is
+rune_tui -> send_task -> ContextBroker -> ModelRouter -> local/Cloud
+transports. The user-facing calls are: the TUI process itself, the CLI
+entry (python -m rune / rune binary), the operator message path, and the
+OpenAI-compatible /v1 endpoints MiMoCode serves.
+
+Candidates for the Go first-call layer, in dependency order:
+- rune binary (process entry, arg parsing, process lifecycle) — replaces
+  the Python module-loading bootstrap.
+- CLI/IPC command dispatch — the first-call surface that routes a user
+  command to the right back-end service.
+- The OpenAI-compatible HTTP endpoint surface (/v1 chat completions) —
+  stdlib net/http + NDJSON streaming is exactly the area the rubric called
+  Go's only capability-proven fit (W4 evidence, unchanged by the directive).
+- TUI: NOT in the first Go surface. Textual coupling is deep (80+ modules
+  per the rubric); the front-end Go layer first exposes the API the TUI
+  consumes, and the TUI itself migrates later as its own wave.
+
+## 3. What "back end" means concretely here
+
+All pure-logic modules move into the two existing zero-dep crates
+(evidence_provenance, query_memory) or a third crate for the remaining
+domains. The zero-external-crate discipline stands (the rubric's W4 Rust
+kill-rule for network code stays valid INSIDE Rust crates: no network code
+in crates, that belongs to the Go layer).
+
+Back-end candidates not yet ported (pure logic, no external deps):
+- drift_core, drift_cache, drift_compression (scored math) — memory umbrella
+- warm_neuron_store/warm_router scoring paths — memory umbrella
+- memory_store consolidation/scoring helpers — memory umbrella
+- capability_fit/capability_broker scoring — capability umbrella
+- tokenizer/counting helpers in token_optimizer — inference umbrella
+Each port follows the slice-2 pipeline: contract, zero-dep Rust, byte-parity
+battery vs the Python vintage, dual-mode canary, consumer import chain,
+CI green, supersession ledger.
+
+## 4. Sequencing (per wave, each independently mergeable)
+
+H0 — enablement (no behavior change):
+- Install Go on the host + the runner user's PATH; pin a version in
+  requirements-ci-equivalent (a go-version file + CI check).
+- CI: add a Go build+vet+test job (empty module, exits 0) so the pipeline
+  carries Go before any code lands.
+
+H1 — Go first-call shim:
+- Go binary `rune` replacing the Python entrypoint's process bootstrap:
+  arg parsing, env resolution, spawn the Python runtime (transitional).
+- Canary: same first-call contract (exit codes, env handoff, TTY attach).
+
+H2 — Go command dispatch + /v1 endpoint:
+- Go serves /v1 chat completions + CLI dispatch, calling the Python core
+  through the same local transport the TUI uses today.
+- Parity battery: request/response shapes vs the Python server for the
+  same canned conversations (byte-level for metadata, streaming NDJSON).
+
+H3 — back-end wave (parallel to H1/H2 where independent):
+- Ports listed in section 3, one or two modules per slice, same slice-2
+  discipline. No port starts without its parity battery written first.
+
+H4 — TUI migration wave (its own contract, later):
+- Only after H1-H2 prove the Go front end serves the same surfaces the TUI
+  consumes. The TUI is the largest single module (4k+ lines, Textual) and
+  earns its own contract.
+
+## 5. Honest constraints (carried from the rubric, not contradicted)
+
+- Go must be installed first (rubric D5 gate: it failed this before; the
+  directive now outweighs the gate but installation is still step zero).
+- Network/streaming code lives in the Go layer, never in Rust crates
+  (rubric W4: stdlib-only Rust has no credible HTTP/SSE precedent).
+- SQLite/regex/file-IO stay at their current language boundaries per the
+  zero-dep split law from slice 2 (math Rust, IO at the edges).
+- Every surface gets the same proof pipeline as slice 2: observed-not-
+  invented expectations, byte parity, dual-mode canary, CI green.
+
+## 6. Success measure
+
+The tranche is complete when: the `rune` process starts as a Go binary;
+user-facing calls (CLI, /v1, operator path) are served by Go; every core
+logic module on the port list is byte-parity Rust; Python remains only in
+surfaces explicitly contracted as keep-Python (TUI internals until H4,
+test harness, canary frameworks).

plans/2026-10-04-total-rebase-tranche.md

@@ -0,0 +1,285 @@
+# TOTAL REBASE TRANCHE — Rune to Go/Rust (R2)
+
+**Status:** DESIGN — awaiting Nick's approval gate (TRANCHE-DEPTH TEMPLATE §4)
+**Supersedes:** the KEEP-PYTHON rubric verdicts (already superseded by Nick's
+Go-front/Rust-back directive) and extends Phase H (H0–H4 slice 1, merged
+`693a494`, v0.90.0) from first ports to total rebase.
+**Nick's directives (verbatim anchors):**
+- "i want the whole codebase rebased in rust and go"
+- "everything should initiate with go as the runtime, and reactive adaptable
+  runtime should be go"
+- "the deterministic backend i.e memory storage, architectures and elastic
+  cognition and everything like that should be in rust"
+- "go should be the reactive front end to what interfaces with the user —
+  not gui — the deliverables and chat interactions as well as how rune
+  handles thoughts and runtime"
+- "the zero dependency rule should be in place but the rebase should rebuild
+  those aspects into the new architecture and make them operational"
+- "the textual tui should be last but everything should be wired into the
+  textual tui"
+- "start with the scaffolding first as everything relies on that, then use
+  the new rust scaffolding to make sure everything else is built towards
+  scaffold protocol"
+- "the scaffolding function should be a rust execution but go start"
+
+## 1. Grounding summary (measured 2026-10-04, from the spine store + wc)
+
+- 161 modules with source, **64,482 lines** of `src/rune/` Python.
+- Draft classification (rule-based, to be function-level verified in Wave 0):
+  - **RUST (deterministic backend):** 49 modules, 26,772 lines — memory,
+    drift, warm, capability, token, spine, scaffold, construction_*,
+    structural_store, curator, consolidation, elastic cognition, ledgers,
+    audit, evidence, contracts, sleep_time, subconscious, persona_gate,
+    context_broker, growth.
+  - **GO (reactive runtime + user-facing):** 10 modules, 7,043 lines —
+    operator, transports, dispatch, provider registry, adaptive router,
+    hook engine, local tool runtime, work manager, deploy_qualify.
+  - **TUI-last:** 4 modules, 4,889 lines — rune_tui (4,041), tui_validator,
+    tui_backlog, tui_transport.
+  - **UNCLASSIFIED (Wave 0 must disposition each with evidence):** 73
+    modules, 21,473 lines — voice_*, tool_executor, model_routing/registry,
+    event_bus, cron_engine, message_queue, identity_anchors, pins,
+    stage_guards, tier_manager, witness, etc.
+  - **Test infra:** 23 canary/test modules, 4,211 lines — rewritten per wave
+    (Rust canaries port with their surface; Go canaries for the front).
+  - **Retires:** `__init__`, `__main__`, `memory_env` (bootstrap glue —
+    subsumed by the Go runtime's env contract).
+- Existing Rust (merged, production-proven): 6 zero-dep crates
+  (query_memory, evidence_provenance, rune_spine, memory_scoring,
+  capability_scoring, token_counting), 338k bytes, all with parity
+  batteries. Go: rune-entry (H1 shim + H2 /v1 front door).
+- Stragglers from R1 folded in: #2171, #2119 (TUI), #1844 (salience_gate),
+  #1755 (goal._load), #1738 (failure_auto_filer).
+
+## 2. Objective
+
+Every line of rune's Python runtime is rebased into the dichotomy —
+**Go initiates and reacts; Rust determines and stores** — with the
+scaffolding protocol rebuilt FIRST (Go start / Rust execution) so every
+subsequent conversion is driven, checked, and closed by the new protocol
+itself. Python is deleted only after the replacement is parity-proven and
+CI-green (strangler exit law). The Textual TUI is last and stays the
+integration surface: everything wires into it over the transport seam.
+
+## 3. The hard constraint analysis (zero-dep + total rebase — feasibility)
+
+Nick asked: confirm or deny. **Confirmed possible**, amended per his
+critiques (2026-10-04):
+
+- **Hybridized membrane, not a wall (Nick's correction):** Go remains the
+  reactive initiator, but "Rust never touches a socket" is WITHDRAWN as an
+  absolute. The languages interoperate where coherence demands: Rust cores
+  callable from Go (the proven cdylib pattern), Go surfaces invocable from
+  Rust through defined channels, shared wire protocols. The dichotomy is
+  the DEFAULT placement rule; hybrid junctions are deliberate, contracted
+  exceptions — each recorded in the unit's contract.
+- **SQLite STAYS (Nick's ruling):** no bespoke storage engine in this
+  tranche. SQLite remains and is wired into the new architecture — the
+  Rust side reaches it through system-library FFI (legal under zero-dep:
+  a system library is not a crate dependency). The bespoke memory-system
+  redesign is a LATER, separate program.
+- **Reactivity/async:** Go goroutines + channels own the event loops;
+  Rust's deterministic cores stay synchronous behind the membrane.
+- **Regex:** hand-rolled matchers per case (proven: pyjson, word-run
+  scanner, run-collapse). No general regex engine needed.
+- **Parity-plus-improvement (Nick's upgrade):** parity is the FLOOR, not
+  the ceiling. Every unit answers "parity OR measurably better" —
+  efficiency improvements are in scope per function (Rust zero-copy and
+  exactness, Go goroutine-native concurrency), bloat from bad syntax is
+  removed, and functionality is the non-negotiable gate. Improvements
+  carry measurements; the parity battery proves no behavior regression
+  either way.
+- **TUI wiring is continuous (Nick's correction):** each landed surface
+  wires toward the Textual TUI over the transport seam as part of its
+  unit contract — the final TUI wave integrates a system already aimed
+  at it, not a retrofit.
+- **Language intelligence in the protocol (Nick's addition):** the
+  scaffolding gains a first-class placement decision — for rune, the
+  Go/Rust dichotomy rule (reactive/initiating → Go; deterministic/
+  stateful → Rust); for other projects, a language-fit assessment at
+  construction-classification time (the protocol recommends the right
+  language for the task's characteristics).
+- **Provenance lock (Nick's verification):** the scaffolding being ported
+  in Wave 1 is the V1-ACCEPTED system per docs/SCAFFOLDING_V1_DEFINITION.md
+  (T18 §18B; North Star = Nick's verbatim words; 17/17 acceptance gates).
+  The Wave 1 parity replay against the production contract ledger proves
+  the rebuild is that design, not a drift.
+
+## 4. Wave structure (each wave independently mergeable, scaffolding-gated)
+
+### Wave 0 — Grounding + inventory verification (the template's bar)
+- Function-level mapping of all 161 modules (the spine gives structure;
+  wave 0 verifies 100% of functions and classifies the 73 UNCLASSIFIED
+  with evidence).
+- Disposition the 5 R1 stragglers.
+- Produce the per-unit issue factory input: one issue per function,
+  each answering improve/fix/missing-connectors with evidence.
+- Deliverable: `plans/total-rebase-inventory.md` + issues filed.
+- Exit gate: inventory signed off by Nick (the approval gate).
+
+### Wave 1 — The scaffolding engine reborn (Go start / Rust execution)
+**Everything depends on this — it goes first, per Nick's directive.**
+- The rebuild target is the V1-ACCEPTED system (Nick's design —
+  docs/SCAFFOLDING_V1_DEFINITION.md, North Star verbatim, 17/17
+  acceptance gates). The parity replay against the production contract
+  ledger is the proof the rebuild IS that design.
+- Rust crate `scaffold_core`: the construction machinery as pure
+  deterministic logic — contract lifecycle (draft→approved→building→
+  verifying→closed), closure classification (correctly_predicted et al.),
+  scope resolution, legal transitions, the contract store.
+  Source modules: scaffold.py, construction_interface.py,
+  construction_decision.py, construction_intent.py, structural_store.py
+  (parts not already in rune_spine), contracts.py, toolchain.py.
+- Go surface `rune-scaffold` (extends rune-entry): the initiation layer —
+  submit-need/observe/transition/close CLI + /v1 endpoints, delegating to
+  the Rust core.
+- NEW per Nick: the **language-placement decision** lands in the protocol
+  here — construction classification gains a language-fit assessment
+  (rune: the Go/Rust dichotomy rule; other projects: characteristic-based
+  recommendation). Every later contract carries its placement verdict.
+- NEW per Nick: parity is the floor — the engine itself is the first
+  beneficiary of the parity-plus-improvement rule (measured improvements
+  allowed, functionality preserved, no-regression proven).
+- Exit gate: the R2 tranche's own remaining waves are driven THROUGH the
+  new engine (the protocol builds itself under its own rules).
+
+### Wave 2 — Memory/storage backend (Rust, SQLite retained)
+- SQLite is NOT replaced (Nick's ruling). The Rust memory core reaches it
+  via system-library FFI (zero-dep legal); memory_store.py (2,435 lines)
+  is decomposed: query paths and consolidation logic into Rust, the SQLite
+  mechanics behind a thin storage trait that maps to libsqlite3 today and
+  to the future bespoke engine LATER without consumer churn.
+- elastic_cognition, memory_consolidation, sleep_time, curator,
+  subconscious_pass, drift_* (remaining DB-backed surfaces), journal,
+  recall_* (recall_router is routing → boundary checked at Wave 0
+  disposition).
+- Data safety gate: checksum-verified read-back of the live store through
+  the new engine; zero writes until the read path is proven identical.
+
+### Wave 3 — Cognition + architecture engines (Rust)
+- The remaining deterministic cores: capability_broker decision logic,
+  context_broker, persona_gate, growth, identity_anchors, pins,
+  stage_guards, tier_manager, witness, safety_override, abstraction,
+  verification surfaces.
+- Ports already merged (memory_scoring, capability_scoring,
+  token_counting, rune_spine) are verified against the new scaffold
+  protocol and wired into the final architecture.
+
+### Wave 4 — The reactive runtime (Go)
+- The operator turn loop (rune_operator.py, 2,697 lines), chat
+  interactions, deliverables production, model routing at call time
+  (adaptive_router, model_registry/profiles/routing, provider_*),
+  tool execution (tool_executor, tool_protocol, local_tool_runtime),
+  event surfaces (event_bus, message_queue, cron_engine, hook_engine),
+  voice output chain (voice_*) as deliverable production.
+- The /v1 surface deepens to carry the full interaction contract;
+  NDJSON streaming becomes the standard response shape.
+
+### Wave 5 — Python retirement sweep
+- Every Python module whose surfaces have landed is deleted (strangler
+  exit: parity proven + CI green + deployed one cycle). Shared/ vintage
+  mirrors retired with them.
+- The glue shims (ms_loader, cs_loader, tc_loader, spine_loader) retire
+  when their consumers no longer speak Python at all.
+
+### Wave 6 — TUI last (but wired continuously)
+- Every wave before this one ships its transport-seam wiring toward the
+  TUI as part of each unit's contract (Nick's correction: natural,
+  continuous wiring — not a retrofit wave).
+- Then the TUI itself: a thin Textual render shell over the wire (all
+  logic already Go/Rust by then) or a port — disposition decided on the
+  evidence of everything that came before.
+
+### Wave 7 — Final audit
+- Language-bar measurement, the full scaffolding ledger replayed, the
+  tranche's closure report with per-wave evidence.
+
+## 5. Per-unit discipline (the template, unchanged)
+
+- One issue per function via the issue factory; each answers
+  improve/fix/missing-connectors with evidence.
+- Every unit runs the scaffolding pipeline end-to-end: submit-need →
+  contract → approval → canary-first (red proven) → implementation →
+  parity battery vs the Python vintage → closure audit (structural ids,
+  never file paths — the closure vocabulary law).
+- Per-unit decisions on evidence, never pre-decided globally: each
+  function's Go-vs-Rust placement is assessed by the dichotomy rule with
+  the measured call graph, not by the draft classification alone.
+- Bug-fix contract governs every defect found en route (red test first,
+  regression frozen).
+
+## 6. Verification gates
+
+- CI green per wave (crate builds, Go vet/test/build, canaries, henxels,
+  type ratchet until the Python ratchet itself retires in Wave 5).
+- Parity batteries are byte-level for deterministic surfaces, shape-level
+  modulo volatile fields for wire surfaces.
+- The scaffolding closure audit for every contract: correctly_predicted
+  or honestly flagged, never silent.
+- Deploy qualification per merge (the pipeline that proved itself today).
+
+### The 90/100 coverage law (Nick, 2026-10-05 — GOVERNING from W3.4 on)
+
+Per Nick: "if it's realistically achievable but aim higher also if that's
+realistically achievable. go to 100% where achievable."
+
+- **100% where achievable — the deterministic Rust kernels.** Every kernel
+  crate (memory_retrieval, cognition_core, scaffold_core, memory_storage,
+  and every future crate) targets 100% BRANCH coverage via its parity
+  matrices + the pytest shim battery: every branch has real reachable
+  semantics, and exhaustive enumeration is exactly what the batteries do.
+  Achievability is measured per crate at wave close; a kernel below 100%
+  carries the named unreachable case or it isn't done.
+- **≥90% on the changed-lines bar (diff-cover), aiming higher.** The floor
+  stays a floor; the working standard per slice is 90%+ on changed lines;
+  whatever a slice achieves beyond 90 becomes the next slice's personal
+  benchmark (per-unit "aim higher" — the number climbs wave over wave).
+  The floor ratchet itself moves after consecutive clean waves
+  (70 → 76 → 84 → 90; each raise is a commit, never a step down).
+- **Glue/failure branches: 90%+ with byte-compare proofs.** The stubs and
+  probe branches that only fire in a broken world are covered by honest
+  fixtures (real import-failure probes like the from-import resolution
+  law) — never by fake-triggered pragmas. A branch covered by a lying
+  fixture is WORSE than uncovered; if it can't be honestly reached, it's
+  named in the wave's closure report with the reason.
+- **Assertion quality is part of the bar.** A test that touches a line
+  without verifying its OUTPUT doesn't count toward the bar — byte-compare
+  / exact-value asserts are the standard; "is not None" assertions reject
+  at review.
+
+## 7. Risk register
+
+- **SQLite FFI correctness** (Wave 2) — the storage layer is retained but
+  re-wired; mitigations: read-path proven identical before any write,
+  checksum-verified read-back of the live store, the storage trait
+  boundary keeps the future bespoke swap cheap.
+- **Hybrid membrane drift** — junctions multiply ad-hoc if ungoverned;
+  every Go↔Rust interaction point is a contracted, recorded decision in
+  its unit's contract (the dichotomy is the default; hybrids justify
+  themselves per unit).
+- **Improvement regressions** — parity-plus-improvement invites subtle
+  behavior changes; every improvement carries a measurement AND the parity
+  battery stays authoritative for no-regression.
+- **Go↔Rust call latency** — measure in Wave 1; the architecture assumes
+  local transport cost is negligible vs model latency; if measured wrong,
+  the membrane's transport moves (decision recorded, not improvised).
+- **Context-window economics** — 1,852-style issue volumes mean the
+  pipeline must multiplex (no-wait law) and local models carry routine
+  units (custodian pattern).
+- **Scope creep during Wave 0** — the inventory is measured and frozen
+  before design; additions go through scope amendments.
+
+## 8. Rollback
+
+- Every wave merges independently; master stays deployable at each
+  boundary (the strangler's whole point).
+- The Python vintage remains until Wave 5 deletion gates pass; a wave
+  revert = revert the merge commit (deploy qualification re-runs).
+- The scaffolding engine's Wave 1 parity replay means even the protocol's
+  own replacement is reversible against recorded history.
+
+## 9. Approval gate
+
+This tranche does not execute until Nick approves. On approval, Wave 0
+starts immediately and runs without consent blockers (standing directive),
+with self-verified checkpoints and defect filing.

plans/2026-10-06-full-dichotomy-rebase-tranche-v3.md

@@ -0,0 +1,354 @@
+# TRANCHE v3: THE FULL DICHOTOMY REBASE — with HOW, with language advantages, with automated verification
+
+Nick's corrections applied:
+- Umbrella manifest feeds the spine (not superseded); both need updating
+- construction_decision.py itself gets ported (Go start + Rust execution)
+- Language advantages are part of every port — improvements where the target language is better
+- Automated parity verification BEFORE gutting the Python (hard gate, no manual checking)
+- A testing document that proves bigger features work after each wave
+- Maximise Bubble Tea addons (research the ecosystem)
+- No arbitrary timeframe — it gets done when it gets done
+- Every task follows on to the next — never stopping
+- CI stacking: keep submitting PRs; address CI issues in batches of 5, not individually
+
+---
+
+## THE CORE MECHANISM: How every module gets replaced
+
+Every module follows the same seven-step process. No exceptions. The process IS the verification.
+
+### Step 1: Understand the Python module
+Read every function. Identify: what does it compute (→ Rust), what does it initiate (→ Go), what does it store (→ Rust), what does it route (→ Go). Note every caller. Note every file it reads/writes.
+
+### Step 2: Write the replacement in the target language
+For Rust: a `pub fn` in the appropriate crate, with serde-compatible structs.
+For Go: a method on a struct in the appropriate `src/go/<name>/` package.
+
+**Language advantage check**: at this step, ask "does Go/Rust do this BETTER than Python did?" If yes, implement the improvement. Examples: Go goroutines replace Python threading for parallel operations. Rust's zero-cost abstractions replace Python duck typing for hot-path scoring. Go's `net/http` replaces Python `urllib` for model connections with connection pooling and keep-alive.
+
+### Step 3: Write the parity test (RED first)
+Before touching the Python module, write a test that runs the same input through BOTH the Python oracle and the new Go/Rust implementation, and asserts the outputs are identical. This test must FAIL before the implementation is correct, and PASS once it is. The test is the gate.
+
+### Step 4: Verify parity — the HARD GATE
+Run the parity test. If it passes, the replacement is PROVEN to work. Only now can you proceed to Step 5. If it fails, debug the Go/Rust implementation until it passes. **Do not gut the Python until this gate passes.** This is automated — you never have to manually check.
+
+### Step 5: Rewire the Python module as a delegation shim
+Replace the Python function body with a call to the Go binary (subprocess) or the Rust kernel (ctypes/cgo). Every existing caller of the Python module keeps working — they don't know the implementation changed.
+
+### Step 6: Register the canary in CI
+The parity test from Step 3 is registered in `.gitea/workflows/ci.yml`. Now every future commit is checked against the parity contract automatically.
+
+### Step 7: PR → CI → merge
+Push the branch, let CI run. If CI raises issues, DON'T STOP — continue to the next module's port. Address CI issues in batches of 5. The pipeline is proven; it catches things; you fix them in batches.
+
+**The key insight**: Step 4 (the parity gate) is the answer to "how do you confirm replacements working before you gut it?" You don't gut anything until the automated test proves the replacement produces identical output. The test is the contract.
+
+---
+
+## THE TESTING DOCUMENT: proving bigger features after each wave
+
+After each wave completes, a WAVE VERIFICATION DOCUMENT is produced that proves the system works end-to-end. Not unit tests — integration tests.
+
+### What it contains:
+1. **The operator turn loop works**: send a message through the Go operator, get a response back, verify the response is correct
+2. **Memory operations work**: store a memory, recall it, verify the content matches
+3. **Tool execution works**: execute a tool call, verify the output
+4. **The TUI renders**: launch the Bubble Tea TUI, verify it displays
+5. **The event journal works**: emit an event, read it back
+6. **The scaffolding works**: submit a need, verify the contract is created
+
+### How it's generated — BY THE GITEA PIPELINE, not by the agent:
+A shell script (`scripts/wave_verify.sh`) is written by the agent. A CI workflow step runs the script after each wave merge. The CI step formats the results as markdown and posts them as a comment on the wave's Gitea epic. The document is permanent — attached to the epic, survives session restarts, reproducible (the commands are in the document), automated (CI runs it, not the agent).
+
+### Implementation:
+- `scripts/wave_verify.sh` — the integration verification script
+- A CI workflow step (in ci.yml or a new `wave-verify.yml`) that runs the script and posts results to the Gitea epic using the existing GITEA_TOKEN secret
+- The same mechanism the merge-robot already uses for PR comments
+
+### What "done" means for a wave:
+The wave's Gitea epic has a verification comment showing every integration path PASSING. The agent does not produce testing documents — the pipeline does.
+
+### What "done" means for a wave:
+Not just "the code compiles" — the wave verification document shows every integration path working.
+
+---
+
+## WAVE 0: INFRASTRUCTURE (before any porting)
+
+### 0.1 Henxels scope extension
+Open `henxels.yaml`. Add scopes for `src/rust/*/src/*.rs` and `src/go/**/*.go`. Same quality gates: max_lines, no_secrets, canary registration, coverage existence. Without this, new Go/Rust files have no governance.
+
+### 0.2 Umbrella manifest extension
+The umbrella manifest IS the spine's input for non-module surfaces. Extend it:
+- Add the 10 existing Rust crates as `rust_crates` entries
+- Add the 2 existing Go modules as `go_surfaces` entries
+- Add placeholder entries for the planned Go modules
+- Every new Go/Rust file gets tracked, so the spine knows about it
+
+### 0.3 Scaffolding protocol update (construction_decision.py port)
+`construction_decision.py` is itself a Python file. Port it:
+- **Go start call**: the CLI surface that receives the classification request
+- **Rust execution**: the deterministic classification logic (keyword matching, language placement)
+- The GO_SIGNALS and RUST_SIGNALS keyword lists are updated to match the corrected dichotomy
+- The Python version becomes a delegation shim
+- After this port, `rune scaffold classify` routes through Go→Rust, not Python
+
+### 0.4 CI pipeline update
+- Build every Rust crate in the unit-tests job
+- Build every Go module in a new `go-build` job
+- Set CC_RUST_LIB, SC_RUST_LIB, etc. to the CARGO_TARGET_DIR paths
+- Add `go vet` and `go test ./...` steps
+
+### 0.5 Gitea epic + MiMoCode tasks
+- Post the parent epic on Gitea: the full wave structure as a folded checklist
+- Post per-wave sub-epics
+- Mirror in MiMoCode's task tool
+- Every subsequent task updates both
+
+---
+
+## WAVE 4: GO REACTIVE INFRASTRUCTURE (14 modules)
+
+### event_bus (244 lines) — DONE
+Already built as `src/go/event-bus/`. Reads/writes the same events.jsonl.
+
+### event_envelope (303 lines)
+Merge into event-bus. The EventEnvelope struct already exists in Go. Add the OrchestrationRecord methods (to_dict, from_dict) as MarshalJSON/UnmarshalJSON. Add the content_hash function.
+
+### message_queue (10KB)
+**What it does**: holds approved messages until they're executed. The Python version uses a JSONL file with a mutex.
+**Go advantage**: Go channels are designed for this. Use a buffered channel for in-memory queue + a JSONL file for durability. The Go version is concurrent-safe by construction.
+**HOW**: Create `src/go/message-queue/`. Define `type Message struct` with the same fields as the Python version. Implement `Enqueue`, `Dequeue`, `GetApproved`, `MarkExecuted`. The Python module becomes a subprocess shim.
+**Parity test**: enqueue 10 messages in Python, read them in Go, verify identical.
+
+### hook_engine (28KB)
+**What it does**: loads plugin hooks from a config, fires them on events.
+**Go advantage**: goroutines enable parallel hook dispatch (Python's GIL prevents this).
+**HOW**: Create `src/go/hook-engine/`. `type HookEngine struct { hooks map[string][]HookFunc; mu sync.RWMutex }`. `Fire(name, data)` iterates hooks sequentially; `FireAsync` dispatches each hook in a goroutine and collects errors via channels.
+**Language advantage**: parallel hook dispatch — Python can't do this due to the GIL.
+
+### microkernel (14KB)
+**What it does**: the plugin lifecycle — register, activate, dispatch.
+**Go advantage**: Go interfaces replace Python duck typing with compile-time guarantees.
+**HOW**: `type Plugin interface { Name() string; Capabilities() []string; OnMessage(data) error }`. Registry with `Register(p Plugin)`, `Fire(event, data)`. The hook_engine plugs into this.
+
+### subsystem_health (6KB)
+**What it does**: tracks failures per subsystem, escalates tiers.
+**HOW**: `type SubsystemHealth struct { failures map[string][]Failure }`. RecordFailure, GetHealth. Write to JSON for durability.
+
+### parallel_processor (5KB)
+**What it does**: runs operations in parallel.
+**Go advantage**: goroutines + sync.WaitGroup. This is what Go was BORN for.
+**HOW**: `func ParallelMap[T, R any](items []T, fn func(T) R) []R`. Launch goroutines, collect via channels.
+
+### work_manager (20KB)
+**What it does**: manages work dispatch to builders.
+**HOW**: Go worker pool with `chan Task`. `type WorkManager struct { workers int; queue chan Task; results chan TaskResult }`. Start, Submit, Stop.
+
+### failure_auto_filer (21KB)
+**What it does**: auto-files failures to the forge.
+**HOW**: Go struct with spool file + forge client. Same pattern as the existing forge_client.
+
+### cache (16KB) + connection_pool (3KB)
+**What they do**: cache responses, pool connections.
+**Go advantage**: Go's `sync.Map` and channel-based pools are built for this.
+**HOW**: `src/go/cache/` — LRU cache with `sync.RWMutex`. `src/go/connection-pool/` — channel-based pool.
+
+### cron_engine (14KB) + night_mode (14KB)
+**What they do**: scheduled tasks, night consolidation.
+**Go advantage**: `time.Ticker` + goroutines replace Python's threading.Timer.
+**HOW**: `src/go/cron-engine/` — task list with cron expressions. `src/go/night-mode/` — uses the cron engine for scheduled consolidation.
+
+### recall_router (5KB)
+**What it does**: routes recall queries to the right memory backend.
+**HOW**: `src/go/recall-router/` — routing table with `map[string]RecallFn`.
+
+---
+
+## WAVE 4b: GO TOOL EXECUTION (3 modules)
+
+### tool_executor (73KB) — STARTED
+The Go binary already handles read_file, list_directory, glob_files, grep_files, run_command. Add the remaining operations: write_file (with path validation), edit_file (with diff preview), run_tests, lint_file, git_commit, git_diff, git_log, repo_map, and the query/diagnose operations.
+**Language advantage**: Go's `os/exec` with `context.Context` for timeouts is cleaner than Python's `subprocess.run(timeout=)`. Go's goroutines enable parallel tool execution (Python serialises them).
+
+### tool_protocol (16KB)
+Go types: `ToolRequest`, `ToolEvent`. Validation against a schema registry. The approval boundary stays in the Go operator (not Python).
+
+### local_tool_runtime (35KB)
+The Go loop: receive model response → parse tool calls → validate → dispatch to executor → feed results back. `type LocalToolRuntime struct { transport Transport; tools []ToolDef; maxIterations int }`. This is the loop that makes Rune respond to tool results.
+
+---
+
+## WAVE 5a: GO MODEL/PROVIDER (10 modules → 1 binary)
+
+All 10 modules collapse into `src/go/model-connect/`.
+
+**Language advantage**: Go's `net/http` with connection pooling and keep-alive replaces Python's `urllib` (which opens a new connection per request). Go's goroutines enable parallel model calls (Python serialises them). Go's `context.Context` enables timeout propagation through the call chain.
+
+### model_connect (16KB)
+`type OllamaClient struct { baseURL string; client *http.Client }`. Chat, Show, Pull, ListModels. Use `net/http` with a shared transport for connection reuse.
+
+### model_routing (16KB) + model_registry (6KB) + model_profiles (16KB)
+Go router that scores tasks against model capabilities and routes to the right model. One `ModelRouter` struct replaces three Python files.
+
+### provider_budget (12KB)
+Go budget tracker with `sync.Mutex`. Record, GetStatus. Token counting per provider.
+
+### provider_registry (23KB) + standardized_providers (9KB) + provider_context (2KB)
+Go `Provider` interface with OllamaProvider and CompatProvider implementations. Registry manages connections.
+
+### tiered_executor (9KB)
+Go executor with tier escalation. Execute, Escalate.
+
+---
+
+## WAVE 5b: GO OPERATOR (19 modules → 1 binary)
+
+**rune_operator (126KB)** — the turn loop. This is the hardest port.
+**How**: break it into sub-systems. Port each one at a time. After each, run the full test suite.
+1. The state management (RuneState, TaskStateRepo, ConversationRepo) → Go structs with JSON persistence
+2. The turn loop → Go function: `Respond(channel, message) OperatorResponse`
+3. The routing → Go AdaptiveRouter
+4. The tool dispatch → Go LocalToolRuntime (already ported in Wave 4b)
+5. The memory interaction → Go MemoryStore (Wave 5c) + Rust kernels via cgo
+6. The model connection → Go ModelConnect (Wave 5a)
+
+**Language advantage**: Go goroutines replace Python threading for parallel context gathering. Go channels replace Python queues. Go's `context.Context` replaces Python's ad-hoc timeout management. The turn loop becomes truly concurrent — memory recall and model inference can overlap.
+
+**The other 18 modules** are supporting cast: adaptive_router (23KB), build_mode (20KB), builder_bridge (12KB), core_server (9KB), auto_context (8KB), auto_tasks (15KB), event_wait (23KB), evidence_probe (7KB), forge (5KB), forge_client (7KB), goal (14KB), growth_delta (16KB), warm_router (55KB), release_notes (18KB), persona_definition (7KB), voicebox (4KB), voice_injector (3KB). Each follows the same pattern: read Python → write Go → parity test → rewire → commit.
+
+---
+
+## WAVE 5c: GO MEMORY OPERATIONS (8 modules)
+
+### memory_store (99KB) — THE BIGGEST SINGLE PORT
+**What it does**: every SELECT, INSERT, UPDATE, DELETE against the memory database.
+**Go advantage**: `modernc.org/sqlite` is pure Go — no cgo, no C compiler, cross-compiles trivially. Go's `database/sql` interface with prepared statements is cleaner than Python's raw sqlite3.
+**HOW**: `type MemoryStore struct { db *sql.DB }`. Every Python function becomes a Go method. The SQL statements ARE the specification.
+**Parity test**: same SQLite file, same queries, byte-identical results. Run after every operation.
+
+### curator (70KB)
+Scans the store, identifies conflicts, promotes/demotes. Go state machine.
+
+### sleep_time (38KB)
+Idle-period consolidation. Go goroutine on a timer.
+
+### memory_consolidation (31KB)
+Calls the Rust kernel (already ported). Go handles the I/O.
+
+### The other 4 (persona_gate, abstraction, witness, stage_guards)
+Each follows the same pattern.
+
+---
+
+## WAVE 6: RUST BACKEND (85 modules)
+
+Each Python module's pure functions become `pub fn` in the appropriate crate.
+
+**The pattern for each:**
+1. Read the Python module, identify pure functions
+2. Write the Rust equivalent in the crate
+3. Add an FFI symbol
+4. Write a parity test
+5. The Python module becomes a thin FFI caller
+
+**The rhythm**: most modules are 3-10KB. At that size, a port takes 15-30 minutes once you're in the rhythm. 85 modules at that pace is 2-3 days of focused work.
+
+**Language advantage**: Rust's type system catches bugs at compile time that Python catches at runtime. Rust's `Result<T, E>` replaces Python's try/except for error handling. Rust's pattern matching replaces Python's if/elif chains. Rust's zero-cost abstractions mean the ports are FASTER than the Python originals.
+
+---
+
+## WAVE 7: BUBBLE TEA TUI (Go)
+
+### Maximising the Bubble Tea ecosystem
+
+Research the full Bubble Tea + Lipgloss + Bubbles ecosystem for every available addon:
+
+**Bubble Tea** (the runtime): Elm architecture, goroutine-safe, tea.Tick for animations, tea.Every for recurring updates, tea.WithAltScreen for fullscreen, tea.WithMouseCellMotion for mouse support.
+
+**Lipgloss** (styling): truecolor (16.7M colors), borders (rounded, thick, double, hidden), padding/margin/width/height, alignment, flex layout, gradients, inline styling, copy/blend styles.
+
+**Bubbles** (pre-built components):
+- `spinner`: rotating indicators (line, dot, mini-dot, jump, pulse, points, globe, moon, monkey, meter, hamburger, ellipsis)
+- `progress`: animated progress bars with gradient colors
+- `textinput`: text input with cursor, placeholder, validation
+- `textarea`: multi-line text input
+- `table`: sortable, selectable data tables
+- `list`: filtered, paginated lists
+- `viewport`: scrollable content area
+- `paginator`: pagination controls
+- `key`: key binding documentation
+- `help`: help bubble
+- `timer`: countdown timer
+- `stopwatch`: elapsed time
+
+**Additional libraries in the ecosystem:**
+- `glamour`: markdown rendering with syntax highlighting (for chat messages that contain code)
+- `harmonica`: spring animation physics (for smooth pane transitions)
+- `bubble-lipgloss-extras`: additional styling utilities
+
+**What the current TUI has that maps:**
+- Two-column layout (chat LEFT, task RIGHT) → `lipgloss.JoinHorizontal()` with width ratios
+- Chat bubbles with sender name, timestamp, content → custom component with `lipgloss.Style{}.Border(lipgloss.RoundedBorder()).Padding(0, 1)`
+- Thinking indicator (spinner) → `bubbles/spinner` with the pulse style
+- Tool call display → bordered component with syntax highlighting via `glamour`
+- Status bar (version, mode, model, project) → fixed bottom bar via `lipgloss.JoinVertical()`
+- Command selector with autocomplete → `bubbles/textinput` + custom suggestion loop
+- Work pane (operational index) → side panel with `bubbles/list`
+- Scrollback → `bubbles/viewport` with `SetContent()` and `GotoBottom()`
+- Keybindings → `tea.KeyMap` with `tea.KeyCtrl1`, `tea.KeyCtrl2`, `tea.KeyCtrl3`
+- Streaming text → `tea.Cmd` that sends partial string updates
+- Growth/status widgets → `bubbles/table` or custom rendering
+
+**Improvements the language enables:**
+- True concurrent streaming: the Go operator can push partial results to the TUI via Go channels while the model is still generating — Python can't do this because the GIL serialises everything
+- Sub-millisecond rendering: Go's zero-allocation string building means the TUI renders at 60fps without GC pauses
+- Statically linked binary: deploy the TUI as a single file, no Python runtime, no virtual environment, no pip install
+
+---
+
+## CI STACKING PROTOCOL
+
+The CI pipeline is proven — 2,300+ tests, 25 canaries, required checks on master. Use it as a throughput engine:
+
+1. Submit PR after PR after PR. Don't wait for one to merge before starting the next.
+2. If CI raises an issue, DON'T STOP the current work. Note it, continue.
+3. After every 5 PR submissions, go back and address the accumulated CI issues in one batch.
+4. The merge-robot and auto-version handle the merging — you keep producing.
+5. If a required check fails on master, that's the one thing that stops the conveyor. Fix it immediately.
+
+**The principle**: CI is the quality gate, not the bottleneck. It runs while you work. Issues get batch-fixed. The conveyor keeps moving.
+
+---
+
+## GITEA EPIC STRUCTURE
+
+The FIRST Gitea task: **Epic: "Full Dichotomy Rebase"** containing:
+- [ ] Wave 0: Infrastructure (henxels scope, umbrella manifest, scaffolding protocol, CI)
+- [ ] Wave 4: Go reactive infrastructure (14 sub-epics)
+- [ ] Wave 4b: Go tool execution (3 sub-epics)
+- [ ] Wave 5a: Go model/provider (10 sub-epics, folded into 1 binary)
+- [ ] Wave 5b: Go operator (19 sub-epics, folded into 1 binary)
+- [ ] Wave 5c: Go memory operations (8 sub-epics)
+- [ ] Wave 6a: Rust structural core (30 sub-epics)
+- [ ] Wave 6b: Rust cognition (30 sub-epics)
+- [ ] Wave 6c: Rust remaining (25 sub-epics)
+- [ ] Wave 7: Bubble Tea TUI (7 sub-epics)
+
+Each sub-epic contains the HOW instructions (the seven-step process), the language advantage notes, the parity test spec, and the CI registration step.
+
+MiMoCode tasks mirror the same tree.
+
+---
+
+## WHAT I STILL NEED FROM YOU
+
+1. **The cgo pattern** — Go calls Rust `.so` files via cgo. The Rust crates don't change, only the caller changes from Python-ctypes to Go-cgo. Is this the membrane you want?
+
+2. **The Bubble Tea ecosystem** — I've listed every addon above. Do you want any specific visual features beyond what's listed?
+
+3. **The umbrella answer** — the spine relies on umbrellas (umbrellas are the input, spine is the consumer). Both need updating. Is this how you understood it?
+
+4. **The CI stacking** — submit PRs continuously, batch CI fixes every 5 submissions. Does this match what you described?
+
+5. **Approve to start Wave 0** — henxels scope, umbrella manifest, scaffolding protocol, CI update, Gitea epic. This is the foundation everything else builds on.

plans/2026-10-06-full-dichotomy-rebase-tranche.md

@@ -0,0 +1,274 @@
+# TRANCHE: THE FULL DICHOTOMY REBASE — every Python module replaced
+
+_Presented for operator approval per TRANCHE-TEMPLATE.md §4. Nick's mandate: "go through the whole codebase and replace it with the dichotomy." Measured: 180 Python files, 68,224 lines. Target: 0 Python logic files (TUI stays last per plan, test infra stays as test infra)._
+
+---
+
+## §0 — GROUNDING (measured, not guessed)
+
+### The honest numbers
+
+| Language | Files | Lines | % | Status |
+|---|---|---|---|---|
+| Python | 180 | 68,224 | 70% | **THE TARGET — every module ported** |
+| Rust | 106 | 27,304 | 28% | 10 crates exist, 85 more modules to port |
+| Go | 7 | 1,125 | 1% | 2 modules exist, 55 more to port |
+| **Total** | **293** | **96,653** | | |
+
+### The corrected dichotomy (re-classified 2026-10-06, 64ba7cf)
+
+| Side | Modules | Python lines to replace | Role |
+|---|---|---|---|
+| **GO** | 57 | 32,081 | The reactive shell: initiates, responds, routes, interfaces |
+| **RUST** | 85 | 25,218 | The deterministic backend: computes, stores, pure functions |
+| **TUI** | 7 | 5,435 | Textual UI — last per plan |
+| **TEST** | 29 | 5,397 | Test infrastructure — stays as test infra |
+
+### Existing infrastructure (§0.2 — route through what exists)
+
+- **CI pipeline**: `.gitea/workflows/ci.yml` — lint, unit-tests, go-surface, canary, best-practices, documentation, type-check, gitea-offline, required-checks
+- **Deploy pipeline**: `.gitea/workflows/deploy.yml` — event-driven CI qualification, stage/verify/promote
+- **Scaffolding**: `construction_interface.py` + `src/go/rune-entry/scaffold.go` — every module's port goes through a construction contract
+- **Canaries**: 25 registered in CI, each crate has its own parity battery
+- **Umbrella manifest**: `config/umbrellas.json` — 165 Python modules tracked (needs Rust/Go extension)
+- **Henxels**: `henxels.yaml` — structural contract, line caps, no-secrets, canary registration (needs Rust/Go scope)
+- **Gitea**: conductor/rune, required checks on master, merge-robot, auto-version
+
+### Keep-greens (§0.5 — must stay green through every wave)
+
+- Full test suite: 2,300+ tests, 0 failures
+- All 25 registered canaries
+- diff-cover ≥70% on changed lines
+- Silent-handler ratchet (BLE001 ≤345, S110 ≤75)
+- Henxels: all hold
+- Lint-baseline: no increase
+- Deploy: monotonic promotion, runtime verification
+
+---
+
+## §1 — OBJECTIVE
+
+**Every Python module in `src/rune/` is replaced by its Go or Rust equivalent per the dichotomy. The TUI stays Python until Wave 7. Test infrastructure stays Python. The FFI boundary is the membrane between Go and Rust. Zero Python logic files remain (only the TUI shell and test files).**
+
+Measured end-state: `ls src/rune/*.py | wc -l` returns ≤7 (TUI only) + test files. `src/go/` contains the full reactive runtime. `src/rust/` contains the full deterministic backend.
+
+---
+
+## §2 — WAVE STRUCTURE
+
+### Wave 4: The Go reactive infrastructure (14 modules, ~5,271 lines)
+
+The backbone that everything else routes through. These are the modules that make the system *respond*.
+
+| Module | Python lines | Go target | Notes |
+|---|---|---|---|
+| event_bus | 244 | **DONE** (src/go/event-bus/) | Same events.jsonl, same envelope |
+| event_envelope | 303 | src/go/event-bus/ | Envelope type in the same binary |
+| message_queue | 10KB | src/go/message-queue/ | Durable queue |
+| hook_engine | 28KB | src/go/hook-engine/ | Plugin dispatch |
+| microkernel | 14KB | src/go/microkernel/ | Hook lifecycle |
+| subsystem_health | 6KB | src/go/subsystem-health/ | Failure tiers |
+| parallel_processor | 5KB | src/go/parallel-processor/ | Goroutines |
+| work_manager | 20KB | src/go/work-manager/ | Work dispatch |
+| failure_auto_filer | 21KB | src/go/failure-filer/ | Auto-filing |
+| cache | 16KB | src/go/cache/ | Connection pooling |
+| connection_pool | 3KB | src/go/connection-pool/ | Pooled connections |
+| cron_engine | 14KB | src/go/cron-engine/ | Scheduled tasks |
+| night_mode | 14KB | src/go/night-mode/ | Night consolidation |
+| recall_router | 5KB | src/go/recall-router/ | Memory routing |
+
+**Entry condition**: event_bus already landed. **Exit condition**: all 14 modules exist as Go binaries, Python versions delegate or are deleted, CI go-surface job passes.
+
+### Wave 4b: The Go tool execution layer (3 modules, ~3,079 lines)
+
+| Module | Python lines | Go target |
+|---|---|---|
+| tool_executor | 73KB | **STARTED** (src/go/tool-executor/) |
+| tool_protocol | 16KB | src/go/tool-executor/ |
+| local_tool_runtime | 35KB | src/go/tool-executor/ |
+
+**Exit condition**: tool executor handles all operations in Go, Python delegates via subprocess, approval machinery documented.
+
+### Wave 5a: The Go model/provider layer (10 modules, ~3,398 lines)
+
+| Module | Python lines | Go target |
+|---|---|---|
+| model_connect | 16KB | src/go/model-connect/ |
+| model_profiles | 16KB | src/go/model-connect/ |
+| model_registry | 6KB | src/go/model-connect/ |
+| model_routing | 16KB | src/go/model-connect/ |
+| openai_compat_transport | 10KB | src/go/model-connect/ |
+| provider_budget | 12KB | src/go/model-connect/ |
+| provider_context | 2KB | src/go/model-connect/ |
+| provider_registry | 23KB | src/go/model-connect/ |
+| standardized_providers | 9KB | src/go/model-connect/ |
+| tiered_executor | 9KB | src/go/model-connect/ |
+
+**Exit condition**: all model/provider operations in Go, Ollama + OpenAI-compatible connections working.
+
+### Wave 5b: The Go operator (19 modules, ~9,637 lines)
+
+The biggest wave. The operator turn loop, routing, and the modules that serve it.
+
+| Module | Python lines | Notes |
+|---|---|---|
+| rune_operator | 126KB | THE core — turn loop, task management |
+| adaptive_router | 23KB | Route decisions |
+| build_mode | 20KB | Build orchestration |
+| builder_bridge | 12KB | Builder dispatch |
+| builder_bridge_cli | 1KB | CLI surface |
+| core_server | 9KB | HTTP server |
+| persona_definition | 7KB | Persona loading |
+| voicebox | 4KB | Voice |
+| voice_injector | 3KB | Voice injection |
+| release_notes | 18KB | Release generation |
+| auto_context | 8KB | Auto context |
+| auto_tasks | 15KB | Auto tasks |
+| event_wait | 23KB | Event-driven waits |
+| evidence_probe | 7KB | Evidence probes |
+| forge | 5KB | Forge adapter |
+| forge_client | 7KB | Forge client |
+| goal | 14KB | Goal management |
+| growth_delta | 16KB | Growth tracking |
+| warm_router | 55KB | Warm routing |
+
+**Exit condition**: the operator turn loop runs in Go, routes through Go model connections, dispatches to Rust kernels via FFI.
+
+### Wave 5c: The Go memory operations (8 modules, ~8,240 lines)
+
+| Module | Python lines | Notes |
+|---|---|---|
+| memory_consolidation | 31KB | Consolidation operations (kernel already in Rust) |
+| memory_store | 99KB | THE memory store — SQLite operations |
+| curator | 70KB | Memory curation |
+| sleep_time | 38KB | Sleep-time consolidation |
+| abstraction | 22KB | Fact extraction (kernel already in Rust) |
+| persona_gate | 24KB | Persona gating |
+| witness | 15KB | Witness reflection |
+| stage_guards | 12KB | Stage guards |
+
+**Exit condition**: memory operations run in Go, calling Rust kernels for the deterministic compute.
+
+### Wave 6: The Rust deterministic backend (85 modules, ~25,218 lines)
+
+Three sub-waves by dependency order:
+
+**Wave 6a** (30 modules, ~11,515 lines): the structural core — spine, structural_store, construction_*, contracts, capability_*, audit_ledger, behaviour_ledger, claim_audit, etc.
+
+**Wave 6b** (30 modules, ~6,849 lines): the cognition layer — drift_*, graph_memory, memory_selector, identity_anchors, pins, salience_gate, self_improve, token_optimizer, etc.
+
+**Wave 6c** (25 modules, ~6,854 lines): the remaining modules — voice_hybrid, voice_sync, prompt_sync, time_awareness, toolchain, verification_layer, etc.
+
+**Exit condition**: every deterministic module exists as a Rust function in a crate, the Python version is a thin FFI caller or deleted.
+
+### Wave 7: The TUI + test infrastructure (36 modules, ~10,832 lines)
+
+The TUI stays Python (Textual is Python-native) but its backend calls go through the Go/Rust dichotomy. Test infrastructure stays Python (pytest is Python-native).
+
+**Exit condition**: the TUI is the only Python surface, everything behind it is Go/Rust.
+
+---
+
+## §3 — PER-FILE EPIC TEMPLATE (§7 anti-ballooning: 180 files → per-file epics)
+
+Each file's port gets ONE epic. The epic body contains:
+
+1. **File identity**: `src/rune/<module>.py` — N lines, M functions, K classes
+2. **Three questions**: (a) can it be IMPROVED in the target language? (b) does it need FIXING? (c) are there MISSING CONNECTORS?
+3. **Language assessment**: confirmed GO/RUST per classification, with the evidence
+4. **Constraint context**: which henxels, line caps, canary requirements apply
+5. **Pipeline plan**: branch name, PR route, canary battery spec
+6. **Verification**: the specific tests + canaries that prove the port
+7. **Provenance**: links to the wave, the tranche, the classification record
+
+---
+
+## §4 — DECISION RUBRIC
+
+Per-unit language decisions are made against:
+
+1. **Does the module initiate/respond/route?** → Go
+2. **Does it compute/store/pure-function?** → Rust
+3. **Does it have BOTH?** → Hybrid: Go front end calls Rust kernel via FFI (contracted membrane junction)
+4. **Is it the TUI?** → Python (last)
+5. **Is it test infrastructure?** → Python (stays)
+
+Evidence required: the module's actual imports, its primary purpose, its callers, and what breaks if it's removed.
+
+---
+
+## §5 — PIPELINE ROUTING
+
+Every port flows through:
+
+1. **Construction contract**: `rune scaffold submit-need` → decision → contract → building
+2. **Branch**: `feat/port-<module>-to-<lang>` from master
+3. **Implementation**: Go module in `src/go/<name>/` or Rust module in `src/rust/<crate>/`
+4. **Python oracle**: the original Python function preserved as `_py_<function>` for parity
+5. **Delegation**: the Python public delegates to the Go/Rust implementation
+6. **Canary**: a parity battery proving kernel↔oracle equivalence
+7. **CI**: the canary registered in `.gitea/workflows/ci.yml`
+8. **PR**: → master, required checks, merge-robot
+9. **Deploy**: auto-version bump, deploy pipeline, runtime verification
+
+---
+
+## §6 — VERIFICATION GATES
+
+Per-wave exit:
+- All modules in the wave exist as Go/Rust implementations
+- Python versions delegate (or are deleted if nothing calls them)
+- CI go-surface job passes (for Go modules)
+- CI canary job passes (for Rust kernels)
+- Full test suite green
+- diff-cover ≥70% on changed lines
+- Deploy advances the current symlink
+
+Per-tranche exit:
+- `ls src/rune/*.py` returns ≤7 files (TUI only)
+- Full test suite green
+- All canaries green
+- All henxels hold
+- Deploy verified at the final version
+
+---
+
+## §7 — RISK REGISTER
+
+| Risk | Prevention | Detection |
+|---|---|---|
+| Big-bang rewrite breaks everything | Incremental waves, each independently deployable | CI red on any wave |
+| Dual-truth drift (Python and Go/Rust diverge) | Parity canaries, _py_ oracles | Canary failure |
+| Broken keep-greens | Named up front, checked per-wave | CI red |
+| Silent scope creep | Per-file epics with explicit scope | Code review |
+| FFI boundary breaks | CC_RUST_LIB/SC_RUST_LIB env contract | Kernel probe test |
+| Memory store data loss | SQLite retained, reads proven byte-identical | Canary hash check |
+| Operator turn loop regression | Full test suite + runtime verification | Deploy verification |
+| Henxels line-cap violations | Carve before commit (spine_language pattern) | CI lint red |
+| New module without canary | New-module henxel | CI lint red |
+
+---
+
+## §8 — ROLLBACK / KNOWN-GOOD
+
+Each wave is independently deployable. If a wave breaks:
+1. The Python version is still in the tree (delegation, not deletion)
+2. `RUNE_COGNITION_CORE=python` pins the fallback
+3. The deploy symlink can be pointed back to the previous revision
+4. Git revert the wave's merge commit
+
+---
+
+## §9 — SCALE HONESTY
+
+This is **weeks of work, not hours**. 180 modules at ~1-2 modules per session = 90-180 sessions. The previous attempt (R2) ported 10 crates + 2 Go modules in multiple sessions. This tranche is the FULL job.
+
+The wave structure is designed for incremental progress: each wave is independently deployable, each module's port is independently verifiable, and the system works at every intermediate state. The Python versions delegate to the Go/Rust implementations — they don't get deleted until the port is proven.
+
+---
+
+## §10 — APPROVAL GATE
+
+This tranche is presented for operator approval. The operator reads the wave structure, the module assignments, the per-wave exit conditions, and either approves (execution starts at Wave 4) or requests changes.
+
+The previous attempt (R2) ported 10 crates + 2 Go modules — less than 10% of the codebase. This tranche is the FULL job: every module, every line, every language decision, with the dichotomy honestly applied.

plans/total-rebase-inventory.md

@@ -0,0 +1,196 @@
+# Total-Rebase Inventory (R2 Wave 0.1) — measured 2026-10-04
+
+Generated from `store/rebase/inventory.json` (AST function-level extraction) +
+`store/rebase/classification.json` (import/content evidence per module).
+Placement law: reactive/initiating/user-facing/network/turn-time → GO;
+deterministic/stateful/storage/cognition → RUST; Textual rendering → TUI-LAST;
+pure compute with no I/O markers defaults to the deterministic backend.
+
+## Totals
+
+| Side | Modules | Lines | Functions |
+|---|---|---|---|
+| GO | 43 | 19495 | 708 |
+| RUST | 93 | 36215 | 1091 |
+| TUI-LAST | 7 | 5438 | 225 |
+| TEST-INFRA | 29 | 5395 | 158 |
+| RETIRES | 2 | 93 | 9 |
+
+## Per-module classification (evidence-carrying)
+
+| Module | Side | Lines | Functions | Evidence |
+|---|---|---|---|---|
+| rune_tui | TUI-LAST | 4041 | 166 | textual/rich imports: ['rich', 'textual'] |
+| rune_operator | GO | 2697 | 68 | network/concurrency imports: ['threading', 'urllib']; reactive/initiating domain |
+| memory_store | RUST | 2435 | 56 | sqlite3 (storage-backed); network/concurrency imports: ['subprocess']; deterministic/state domain |
+| curator | RUST | 1838 | 43 | sqlite3 (storage-backed); network/concurrency imports: ['subprocess']; deterministic/state domain |
+| tool_executor | GO | 1812 | 47 | network/concurrency imports: ['subprocess']; reactive/initiating domain |
+| warm_router | RUST | 1536 | 36 | sqlite3 (storage-backed); network/concurrency imports: ['subprocess']; reactive/initiating domain; deterministic/state domain |
+| construction_interface | RUST | 1039 | 25 | deterministic/state domain |
+| spine | RUST | 1019 | 31 | deterministic/state domain |
+| sleep_time | RUST | 971 | 25 | sqlite3 (storage-backed); network/concurrency imports: ['subprocess', 'urllib']; deterministic/state domain |
+| construction_decision | RUST | 949 | 18 | deterministic/state domain |
+| capability_broker | RUST | 900 | 21 | deterministic/state domain |
+| hook_engine | GO | 860 | 8 | reactive/initiating domain |
+| scaffold | RUST | 854 | 31 | network/concurrency imports: ['subprocess']; deterministic/state domain |
+| local_tool_runtime | GO | 806 | 32 | network/concurrency imports: ['threading', 'urllib']; reactive/initiating domain |
+| context_broker | GO | 768 | 23 | network/concurrency imports: ['threading'] |
+| elastic_cognition | RUST | 765 | 13 | network/concurrency imports: ['urllib']; deterministic/state domain |
+| memory_consolidation | RUST | 733 | 20 | network/concurrency imports: ['subprocess']; deterministic/state domain |
+| provider_registry | GO | 666 | 28 | network/concurrency imports: ['threading', 'urllib']; reactive/initiating domain |
+| persona_gate | RUST | 661 | 21 | sqlite3 (storage-backed); network/concurrency imports: ['subprocess', 'urllib']; deterministic/state domain |
+| structural_store | RUST | 656 | 33 | deterministic/state domain |
+| contracts | RUST | 626 | 7 | deterministic/state domain |
+| adaptive_router | GO | 625 | 19 | reactive/initiating domain |
+| work_manager | GO | 591 | 25 | reactive/initiating domain |
+| abstraction | RUST | 587 | 12 | sqlite3 (storage-backed); network/concurrency imports: ['urllib']; deterministic/state domain |
+| construction_intent | RUST | 555 | 16 | deterministic/state domain |
+| canary_audit_ledger | TEST-INFRA | 540 | 2 | canary/test module |
+| safety_override | RUST | 530 | 18 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| failure_auto_filer | GO | 527 | 28 | network/concurrency imports: ['threading'] |
+| build_mode | GO | 517 | 34 | network/concurrency imports: ['subprocess'] |
+| drift_core | RUST | 517 | 14 | deterministic/state domain |
+| event_wait | GO | 517 | 14 | network/concurrency imports: ['subprocess', 'urllib']; reactive/initiating domain |
+| tui_validator | TUI-LAST | 514 | 13 | tui family |
+| memory_selector | RUST | 511 | 14 | deterministic/state domain |
+| system_registry | RUST | 501 | 14 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| construction_pattern | RUST | 496 | 13 | deterministic/state domain |
+| cache | GO | 492 | 17 | sqlite3 (storage-backed); network/concurrency imports: ['threading'] |
+| claim_audit | RUST | 483 | 14 | sqlite3 (storage-backed); deterministic/state domain |
+| graph_memory | RUST | 474 | 9 | sqlite3 (storage-backed); deterministic/state domain |
+| identity_anchors | RUST | 474 | 8 | deterministic/state domain |
+| model_connect | GO | 462 | 10 | network/concurrency imports: ['urllib']; reactive/initiating domain |
+| auto_tasks | GO | 460 | 14 | sqlite3 (storage-backed); network/concurrency imports: ['subprocess'] |
+| capability_fit | RUST | 455 | 14 | deterministic/state domain |
+| tool_protocol | GO | 455 | 27 | reactive/initiating domain |
+| drift_ledger | RUST | 453 | 16 | sqlite3 (storage-backed); deterministic/state domain |
+| witness | RUST | 451 | 10 | network/concurrency imports: ['urllib']; deterministic/state domain |
+| goal | RUST | 441 | 20 | network/concurrency imports: ['urllib']; deterministic/state domain |
+| release_notes | GO | 439 | 17 | network/concurrency imports: ['urllib'] |
+| cron_engine | GO | 436 | 28 | network/concurrency imports: ['subprocess', 'threading']; reactive/initiating domain |
+| model_profiles | GO | 435 | 15 | network/concurrency imports: ['urllib']; reactive/initiating domain |
+| microkernel | GO | 434 | 12 | network/concurrency imports: ['subprocess', 'threading'] |
+| model_routing | GO | 432 | 15 | network/concurrency imports: ['urllib']; reactive/initiating domain |
+| voice_hybrid | RUST | 421 | 10 | sqlite3 (storage-backed); reactive/initiating domain |
+| behavior | RUST | 407 | 9 | sqlite3 (storage-backed); deterministic/state domain |
+| token_optimizer | RUST | 407 | 23 | deterministic/state domain |
+| capability_ledger | RUST | 405 | 19 | deterministic/state domain |
+| night_mode | GO | 405 | 19 | network/concurrency imports: ['subprocess', 'threading', 'urllib'] |
+| chat_bubble | TUI-LAST | 401 | 16 | textual/rich imports: ['rich', 'textual'] |
+| growth_delta | RUST | 400 | 16 | network/concurrency imports: ['subprocess', 'urllib']; deterministic/state domain |
+| construction_mode | RUST | 395 | 5 | deterministic/state domain |
+| prompt_sync | RUST | 376 | 14 | sqlite3 (storage-backed) |
+| provider_budget | GO | 354 | 21 | network/concurrency imports: ['urllib']; reactive/initiating domain |
+| structural_model | RUST | 352 | 21 | deterministic/state domain |
+| programme_continuation | RUST | 349 | 11 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| canary_rune_serve | TEST-INFRA | 329 | 13 | canary/test module |
+| builder_bridge | GO | 326 | 11 | reactive/initiating domain |
+| canary_p1_07 | TEST-INFRA | 324 | 12 | canary/test module |
+| layout_contract | RUST | 316 | 6 | deterministic/state domain |
+| message_queue | GO | 316 | 14 | reactive/initiating domain |
+| drift_observability | RUST | 315 | 9 | deterministic/state domain |
+| build_basis | RUST | 314 | 12 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| canary_p0_07 | TEST-INFRA | 310 | 11 | canary/test module |
+| drift_compression | RUST | 307 | 12 | deterministic/state domain |
+| event_envelope | GO | 303 | 8 | reactive/initiating domain |
+| attention_capsule | RUST | 296 | 7 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| canary_p1_01 | TEST-INFRA | 294 | 14 | canary/test module |
+| voice_sync | RUST | 293 | 10 | sqlite3 (storage-backed); reactive/initiating domain |
+| drift_cache | RUST | 292 | 16 | deterministic/state domain |
+| outcome_ledger | RUST | 286 | 8 | sqlite3 (storage-backed); deterministic/state domain |
+| time_awareness | RUST | 283 | 15 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| tiered_executor | GO | 282 | 9 | network/concurrency imports: ['urllib'] |
+| stage_guards | RUST | 281 | 11 | network/concurrency imports: ['subprocess']; deterministic/state domain |
+| standardized_providers | GO | 281 | 5 | reactive/initiating domain |
+| canary_p1_06 | TEST-INFRA | 280 | 9 | canary/test module |
+| progressive_escalation | RUST | 279 | 9 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| pins | RUST | 276 | 11 | deterministic/state domain |
+| canary_p1_03 | TEST-INFRA | 271 | 9 | canary/test module |
+| auto_context | GO | 270 | 8 | network/concurrency imports: ['subprocess'] |
+| task_persist | RUST | 269 | 10 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| context_pressure | RUST | 262 | 9 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| canary_gitea_automation | TEST-INFRA | 261 | 3 | canary/test module |
+| canary_p1_02 | TEST-INFRA | 253 | 12 | canary/test module |
+| construction_patterns_builtin | RUST | 249 | 1 | deterministic/state domain |
+| canary_full_system | TEST-INFRA | 244 | 2 | canary/test module |
+| event_bus | GO | 244 | 7 | reactive/initiating domain |
+| salience_gate | RUST | 243 | 4 | deterministic/state domain |
+| self_improve | RUST | 242 | 5 | sqlite3 (storage-backed) |
+| construction_activation | RUST | 237 | 4 | deterministic/state domain |
+| toolchain | RUST | 236 | 7 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| task_gate | RUST | 235 | 8 | sqlite3 (storage-backed) |
+| core_server | GO | 234 | 13 | network/concurrency imports: ['http', 'urllib']; reactive/initiating domain |
+| audit_ledger | RUST | 231 | 8 | deterministic/state domain |
+| canary_native | TEST-INFRA | 231 | 3 | canary/test module |
+| openai_compat_transport | GO | 227 | 10 | network/concurrency imports: ['urllib']; reactive/initiating domain |
+| shard_manager | RUST | 223 | 10 | sqlite3 (storage-backed) |
+| response_adapter | RUST | 222 | 7 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| evidence_probe | RUST | 212 | 9 | network/concurrency imports: ['subprocess']; deterministic/state domain |
+| model_registry | GO | 211 | 8 | reactive/initiating domain |
+| persona_definition | GO | 210 | 8 | network/concurrency imports: ['subprocess'] |
+| cognitive_budgeter | RUST | 208 | 3 | deterministic/state domain |
+| canary_p0_04 | TEST-INFRA | 207 | 8 | canary/test module |
+| forge_client | GO | 203 | 19 | network/concurrency imports: ['urllib']; reactive/initiating domain |
+| dependency_tracker | RUST | 202 | 5 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| canary_context_broker | TEST-INFRA | 199 | 10 | canary/test module |
+| canary_p0_05 | TEST-INFRA | 199 | 16 | canary/test module |
+| testing_mode | RUST | 196 | 13 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| parallel_processor | GO | 194 | 17 | network/concurrency imports: ['threading'] |
+| canary_spine_meta | TEST-INFRA | 192 | 7 | canary/test module |
+| iteration | RUST | 190 | 8 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| verification_layer | RUST | 189 | 12 | deterministic/state domain |
+| subconscious_pass | RUST | 187 | 6 | deterministic/state domain |
+| ffi_query_memory_smoke | RUST | 182 | 5 | deterministic/state domain |
+| tier_manager | RUST | 182 | 9 | deterministic/state domain |
+| canary_tui_transport | TEST-INFRA | 174 | 7 | canary/test module |
+| behaviour_ledger | RUST | 173 | 13 | deterministic/state domain |
+| construction_commands | RUST | 173 | 4 | deterministic/state domain |
+| canary_tui_drift | TEST-INFRA | 170 | 2 | canary/test module |
+| intent_continuity | RUST | 168 | 11 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| rune_profiler | RUST | 165 | 3 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| inference_trace | RUST | 164 | 6 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| ms_loader | RUST | 163 | 16 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| subsystem_health | GO | 163 | 8 | network/concurrency imports: ['threading'] |
+| recall_router | GO | 162 | 3 | reactive/initiating domain |
+| voicebox | GO | 161 | 11 | network/concurrency imports: ['subprocess']; reactive/initiating domain |
+| canary_gitea_pipeline | TEST-INFRA | 159 | 2 | canary/test module |
+| forge | GO | 146 | 12 | network/concurrency imports: ['subprocess', 'urllib'] |
+| rune_graphic | TUI-LAST | 145 | 5 | textual/rich imports: ['rich'] |
+| connection_pool | GO | 144 | 9 | sqlite3 (storage-backed); network/concurrency imports: ['threading'] |
+| recall_uplift | RUST | 141 | 1 | sqlite3 (storage-backed) |
+| project_registry | RUST | 139 | 12 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| construction_depth | RUST | 138 | 2 | deterministic/state domain |
+| voice_injector | GO | 138 | 5 | reactive/initiating domain |
+| canary_rune_entry | TEST-INFRA | 137 | 3 | canary/test module |
+| construction_projection | RUST | 135 | 3 | deterministic/state domain |
+| rune_spinner | RUST | 130 | 5 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| tui_backlog | TUI-LAST | 125 | 5 | tui family |
+| warm_neuron_store | RUST | 122 | 6 | sqlite3 (storage-backed); deterministic/state domain |
+| drift_resume | RUST | 118 | 3 | deterministic/state domain |
+| wait_guard | RUST | 116 | 1 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| canary_conversation_state | TEST-INFRA | 115 | 2 | canary/test module |
+| canary_query_memory | TEST-INFRA | 110 | 2 | canary/test module |
+| failure_recovery | RUST | 108 | 1 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| graph_projection | RUST | 108 | 5 | deterministic/state domain |
+| tui_transport | TUI-LAST | 108 | 12 | tui family |
+| spine_loader | RUST | 105 | 7 | deterministic/state domain |
+| canary_unbounded | TEST-INFRA | 104 | 2 | canary/test module |
+| message_widgets | TUI-LAST | 104 | 8 | textual/rich imports: ['rich', 'textual'] |
+| cs_loader | RUST | 90 | 5 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| tc_loader | RUST | 88 | 5 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| canary_schema_migration | TEST-INFRA | 86 | 1 | canary/test module |
+| programme_gates | RUST | 85 | 6 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| structural_migration | RUST | 77 | 4 | deterministic/state domain |
+| memory_env | RETIRES | 72 | 8 | bootstrap glue subsumed by the Go runtime env contract |
+| impact_preview | RUST | 69 | 2 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| provider_context | GO | 48 | 1 | reactive/initiating domain |
+| wait_guard_corpus | RUST | 46 | 0 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| canary_cognitive_strata | TEST-INFRA | 44 | 1 | canary/test module |
+| builder_bridge_cli | GO | 42 | 1 | reactive/initiating domain |
+| route_risk_flags | RUST | 37 | 1 | no network/reactive markers — pure compute defaults to the deterministic backend |
+| canary_memory_synthesis | TEST-INFRA | 33 | 1 | canary/test module |
+| canary_resource_authority | TEST-INFRA | 33 | 1 | canary/test module |
+| canary_surface_parity | TEST-INFRA | 33 | 1 | canary/test module |
+| canary_orchestration_foundation | TEST-INFRA | 32 | 1 | canary/test module |
+| canary_gitea_delegation | TEST-INFRA | 31 | 1 | canary/test module |
+| __main__ | RETIRES | 21 | 1 | bootstrap glue subsumed by the Go runtime env contract |

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "rune"
-version = "0.86.0"
+version = "0.161.0"
 description = "Rune — a stateful coding assistant with persistent memory, orchestration, and TUI"
 requires-python = ">=3.10"
 
@@ -16,12 +16,13 @@ dependencies = [
     "aiohttp>=3.9.0",
     "websockets>=12.0",
     "psutil>=5.9.0",
+    "pillow>=10.0",
     "pyyaml>=6.0",
 ]
 
 [project.optional-dependencies]
 memory = ["sqlite-vec>=0.1.0"]
-dev = ["pytest>=8.0", "pytest-subtests", "ruff==0.16.5", "pyright", "henxels==0.12.0", "coverage>=7.6", "diff-cover>=9.2"]
+dev = ["pytest>=8.0", "pytest-subtests", "ruff==0.16.5", "pyright", "henxels==0.12.0", "coverage>=7.6", "diff-cover>=9.2", "hypothesis>=6.100"]
 
 [tool.setuptools.packages.find]
 where = ["src"]

pyright-baseline.json

@@ -1,5 +1,5 @@
 {
-  "errorCount": 117,
-  "warningCount": 454,
+  "errorCount": 121,
+  "warningCount": 450,
   "informationCount": 0
 }

pyrightconfig.json

@@ -29,6 +29,10 @@
     "**/__pycache__"
   ],
   "extraPaths": [
-    "scripts"
+    "scripts",
+    "src/rune",
+    "shared",
+    "src/rust/evidence_provenance",
+    "src/rust/query_memory"
   ]
 }

requirements-ci.txt

@@ -1,8 +1,8 @@
 # This file was autogenerated by uv via the following command:
-#    uv pip compile pyproject.toml -o /tmp/req_new.txt --extra dev --extra memory --python-version 3.11
+#    uv pip compile pyproject.toml -o requirements-ci.txt --extra dev --extra memory --python-version 3.11
 aiohappyeyeballs==2.7.1
     # via aiohttp
-aiohttp==3.14.3
+aiohttp==3.14.4
     # via rune (pyproject.toml)
 aiosignal==1.4.0
     # via aiohttp
@@ -18,9 +18,9 @@ certifi==2026.7.22
     #   httpx
 chardet==7.6.0
     # via diff-cover
-coverage==7.16.1
+coverage==7.16.2
     # via rune (pyproject.toml)
-diff-cover==10.5.1
+diff-cover==10.6.0
     # via rune (pyproject.toml)
 frozenlist==1.8.0
     # via
@@ -34,12 +34,14 @@ httpcore==1.0.9
     # via httpx
 httpx==0.28.1
     # via rune (pyproject.toml)
+hypothesis==6.168.5
+    # via rune (pyproject.toml)
 idna==3.20
     # via
     #   anyio
     #   httpx
     #   yarl
-iniconfig==2.3.0
+iniconfig==2.3.1
     # via pytest
 jinja2==3.1.6
     # via diff-cover
@@ -50,21 +52,23 @@ markdown-it-py==4.2.0
     #   mdit-py-plugins
     #   rich
     #   textual
-markupsafe==3.0.3
+markupsafe==3.0.4
     # via jinja2
 mdit-py-plugins==0.6.1
     # via textual
 mdurl==0.1.2
     # via markdown-it-py
-multidict==6.9.0
+multidict==6.9.1
     # via
     #   aiohttp
     #   yarl
-nodeenv==1.10.0
+nodeenv==1.11.0
     # via pyright
 packaging==26.3
     # via pytest
-platformdirs==4.11.11
+pillow==12.3.0
+    # via rune (pyproject.toml)
+platformdirs==4.12.4
     # via textual
 pluggy==1.6.0
     # via
@@ -100,6 +104,8 @@ rich==15.0.0
     #   textual
 ruff==0.16.5
     # via rune (pyproject.toml)
+sortedcontainers==2.4.0
+    # via hypothesis
 sqlite-vec==0.1.9
     # via rune (pyproject.toml)
 textual==8.2.8
@@ -116,7 +122,7 @@ typing-extensions==4.16.0
     #   pyright
     #   textual
     #   textual-autocomplete
-websockets==17.1
+websockets==17.2
     # via rune (pyproject.toml)
 yarl==1.25.1
     # via aiohttp

scripts/adapt_scorecard.py

@@ -0,0 +1,94 @@
+#!/usr/bin/env python3
+"""adapt_scorecard.py — #301: the final scorecard for the adaptive pipeline.
+
+Run the fixture job set (2 fixes, 2 standard features, 2 high-uncertainty
+tasks) through the router; measure route accuracy, time, and avoided
+waste. The evidence that earns the adaptive framework.
+
+Usage: python3 scripts/adapt_scorecard.py [--json]
+"""
+
+import argparse
+import json
+import sys
+import time
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+sys.path.insert(0, str(REPO / "src" / "rune"))
+
+import adaptive_router as ar  # noqa: E402
+
+
+def _uncertain_kwargs():
+    return dict(sufficiency=ar.SufficiencyInputs(
+        local_authority="UNKNOWN", external_dependency="UNKNOWN",
+        version_freshness_risk="UNKNOWN", verifiability="UNKNOWN",
+        scope_novelty="UNKNOWN",
+        provenance={"local_authority": "no source",
+                    "external_dependency": "no source"}))
+
+# Fixture jobs: (kind, body, kwargs, expected_route)
+JOBS = [
+    ("fix", "fix a typo in the README", dict(has_local_repro=True,
+     owning_authority_known=True, testable_locally=True,
+     narrow_and_reversible=True), "LOCAL_FIX"),
+    ("fix", "fix an off-by-one in the pager", dict(has_local_repro=True,
+     owning_authority_known=True, testable_locally=True,
+     narrow_and_reversible=True), "LOCAL_FIX"),
+    ("standard", "add a --json flag to the report script",
+     dict(has_local_repro=True, owning_authority_known=True,
+          testable_locally=True, narrow_and_reversible=True),
+     "STANDARD_CHANGE"),
+    ("standard", "refactor the cache layer for clarity",
+     dict(has_local_repro=True, owning_authority_known=True,
+          testable_locally=True, narrow_and_reversible=False),
+     "STANDARD_CHANGE"),
+    ("uncertain", "migrate the database schema with unknown downstream consumers",
+     None,  # production path: sufficiency with UNKNOWNs
+     "RESEARCHED_CHANGE"),
+    ("uncertain", "redesign the memory architecture",
+     None,
+     "RESEARCHED_CHANGE"),
+]
+
+
+def scorecard():
+    rows = []
+    correct = 0
+    t0 = time.monotonic()
+    for kind, body, kwargs, expected in JOBS:
+        d = ar.classify_route(body, **(kwargs or _uncertain_kwargs()))
+        hit = d.route == expected
+        correct += hit
+        rows.append({"kind": kind, "expected": expected, "got": d.route,
+                     "correct": hit, "reasons": len(d.reasons)})
+    elapsed = time.monotonic() - t0
+    return {
+        "jobs": len(JOBS),
+        "route_accuracy": round(correct / len(JOBS), 3),
+        "elapsed_s": round(elapsed, 3),
+        "avoided_waste": f"{correct}/{len(JOBS)} correctly light or escalated",
+        "rows": rows,
+    }
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--json", action="store_true")
+    args = ap.parse_args()
+    result = scorecard()
+    if args.json:
+        print(json.dumps(result, indent=1))
+    else:
+        print(f"route accuracy: {result['route_accuracy']} "
+              f"({result['avoided_waste']}) in {result['elapsed_s']}s")
+        for r in result["rows"]:
+            mark = "✓" if r["correct"] else "✗"
+            print(f"  {mark} {r['kind']}: {r['got']} (want {r['expected']})")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/await_intent.py

@@ -148,9 +148,18 @@ def sha_branch(sha: str) -> str:
 
 
 def sha_on_master(sha: str) -> bool:
-    out = _git("branch", "--contains", sha)
-    return any(l.strip().endswith("master") or l.strip() == "master"
-               for l in out.splitlines())
+    """SHA is an ancestor of master (local or remote-tracking refs).
+
+    M10 correction (2026-09-19): --all so a freshly fetched master
+    (refs/remotes/gitea/master) counts; local branches alone go stale
+    between fetches. derive_op_type refreshes refs before calling this.
+    """
+    out = _git("branch", "--all", "--contains", sha)
+    for l in out.splitlines():
+        s = l.strip().removeprefix("remotes/").removesuffix(" *")
+        if s == "master" or s.endswith("/master"):
+            return True
+    return False
 
 
 def open_pr_for_sha(sha: str) -> int | None:
@@ -184,6 +193,11 @@ def derive_op_type(sha: str) -> tuple[str, str]:
          were created from model-supplied defaults and cannot be trusted.
     Never trusts model input.
     """
+    # 0. M10 correction (2026-09-19): refresh remote-tracking refs before
+    #    inference. A just-merged master commit is invisible to
+    #    branch --contains until refs are fetched; stale local git state
+    #    must never outrank repo truth. Bounded by GIT_TIMEOUT, fail-open.
+    _git("fetch", "--quiet", "gitea", "+refs/heads/*:refs/remotes/gitea/*")
     for rec in _load_wait_records():
         if _rec_sha(rec) != sha:
             continue

scripts/backfill_exit_notes.py

@@ -0,0 +1,126 @@
+#!/usr/bin/env python3
+"""backfill_exit_notes.py — retroactively append the EXIT-NOTE (plain-
+English what-changed) to every existing release that predates the template
+(Nick directive 2026-10-08). For each tag: render the exit note for the
+tag's own range (v_prev..v_tag), append it to the release body under a
+"## What changed" heading — preserving the governed evidence sections —
+and PATCH the release via the Gitea API. Idempotent: releases already
+carrying the exit-note heading are skipped.
+
+Usage: python3 scripts/backfill_exit_notes.py [--dry-run] [--limit N]
+"""
+
+import json
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "scripts"))
+sys.path.insert(0, str(REPO / "src"))
+
+from release_exit_note import render_markdown, render  # noqa: E402
+
+EXIT_HEADING = "## What changed"
+SERVER = "http://127.0.0.1:3000"
+REPO_SLUG = "conductor/rune"
+
+
+def _token() -> str:
+    sys.path.insert(0, str(REPO / ".config" / "opencode" / "shared"))
+    try:
+        from gitea_auth import load_gitea_token
+        return load_gitea_token()
+    except ImportError:
+        # fall back to the git credential
+        r = subprocess.run(
+            ["git", "credential", "fill"], input="url=http://127.0.0.1:3000\n",
+            capture_output=True, text=True, cwd=REPO)
+        for line in r.stdout.splitlines():
+            if line.startswith("password="):
+                return line.split("=", 1)[1]
+    return ""
+
+
+def api(path, method="GET", data=None):
+    import urllib.request
+    req = urllib.request.Request(
+        f"{SERVER}/api/v1/repos/{REPO_SLUG}{path}",
+        data=json.dumps(data).encode() if data is not None else None,
+        headers={"Authorization": f"token {_token()}",
+                 "Content-Type": "application/json"},
+        method=method,
+    )
+    with urllib.request.urlopen(req, timeout=30) as r:
+        return json.loads(r.read())
+
+
+def tags():
+    r = subprocess.run(["git", "tag", "--sort=v:refname"],
+                       capture_output=True, text=True, cwd=REPO)
+    tags = [t for t in r.stdout.splitlines() if t.startswith("v")]
+    # exit-note applies from v0.117.0 onward (the factory-era releases)
+    try:
+        start = tags.index("v0.117.0")
+    except ValueError:
+        return tags
+    return tags[start:]
+
+
+def main():
+    dry = "--dry-run" in sys.argv
+    limit = 999
+    if "--limit" in sys.argv:
+        limit = int(sys.argv[sys.argv.index("--limit") + 1])
+
+    all_tags = tags()
+    releases = api("/releases?limit=50&sort=desc")
+    by_tag = {r["tag_name"]: r for r in releases}
+
+    patched, skipped, failed = 0, 0, 0
+    # chronological order (oldest first) so ranges nest correctly
+    for i, tag in enumerate(all_tags):
+        if i == 0:
+            prev = None
+        else:
+            prev = all_tags[i - 1]
+        rel = by_tag.get(tag)
+        if rel is None:
+            skipped += 1
+            continue
+        body = rel.get("body") or ""
+        if EXIT_HEADING in body:
+            skipped += 1
+            continue
+        if i == 0 or prev is None:
+            skipped += 1
+            continue
+        # limit: process the N NEWEST unpatched
+        if patched >= limit:
+            skipped += 1
+            continue
+        try:
+            note = render(prev, tag)
+            md = render_markdown(note)
+            new_body = body.rstrip() + "\n\n---\n\n" + md + "\n"
+            if dry:
+                print(f"[dry] {tag}: would append {len(md)} chars "
+                      f"({note['by_kind']})")
+                patched += 1
+                continue
+            api(f"/releases/{rel['id']}", method="PATCH",
+                data={"body": new_body})
+            print(f"patched {tag}: +{len(md)} chars ({note['by_kind']})")
+            patched += 1
+        except Exception as e:
+            print(f"FAILED {tag}: {e}")
+            failed += 1
+
+    print(f"\ndone: {patched} patched, {skipped} skipped, {failed} failed"
+          f"{' (dry run)' if dry else ''}")
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/bulk_issue_guard.py

@@ -0,0 +1,81 @@
+"""Bulk-issue guard: ceiling + discipline wrapper for mass Gitea issue posts.
+
+ANTI-BALLOONING guard (Gitea end), built 2026-10-01 after the rebase
+tranche ballooned to 1,852 per-unit issues via scripts/rebase_issue_factory.py.
+
+Any bulk post above the procedural tripwire MUST go through this wrapper:
+  - smoke-first: post ONE unit, verify via API, then unleash the batch
+  - resume-safe: progress file, re-runs skip done keys
+  - retry/backoff: api() retries=5, timeout 60s, 2*(attempt+1) backoff
+  - epic-fold shape: per-FILE epics (never per-unit bulk), members absorbed
+  - dynamic fold-sized bound: posted issues <= epic/file count (one epic
+    per file; units live as member link-lists inside epics, never as issues).
+    The limiting factor is how the batch folds into epics — never a fixed
+    number. BULK_ISSUE_CEILING (50) is a procedural tripwire only: above
+    that many POSTED issues the smoke-first + resume-safe + retry/backoff
+    discipline is mandatory. It caps nothing on its own.
+
+PRESERVE-FIRST: auto-label, pipeline-gate, merge-robot, human-only closure
+untouched. Companion: TRANCHE-TEMPLATE.md §7 (template end).
+"""
+
+import json
+import os
+import time
+import urllib.request
+
+BULK_ISSUE_CEILING = 50  # procedural tripwire (matches TRANCHE-TEMPLATE.md §7):
+    # above this many POSTED issues, smoke-first + resume-safe + retry/backoff
+    # discipline is mandatory. This is NOT a cap on units — the substantive
+    # bound is dynamic (see check_ceiling): posted issues <= epic/file count,
+    # units live as member link-lists inside epics, never as issues.
+API_RETRIES = 5
+API_TIMEOUT = 60
+
+
+def api(method, path, token, base="http://127.0.0.1:3000", payload=None):
+    """Gitea API call with retry + backoff (fold-worker timeout law)."""
+    data = json.dumps(payload).encode() if payload is not None else None
+    last = None
+    for attempt in range(API_RETRIES):
+        try:
+            req = urllib.request.Request(
+                base + path, data=data, method=method,
+                headers={"Authorization": "token " + token,
+                         "Content-Type": "application/json"})
+            with urllib.request.urlopen(req, timeout=API_TIMEOUT) as r:
+                return json.load(r)
+        except Exception as e:  # noqa: BLE001 — retry loop must catch every transient failure class; the final raise carries the last error
+            last = e
+            time.sleep(2 * (attempt + 1))
+    raise RuntimeError("api failed after retries: %r" % (last,))
+
+
+def check_ceiling(unit_count, epic_map=None, approved=False):
+    """Dynamic fold-sized bound: posted issues <= epic/file count.
+
+    The limiting factor is how the batch folds into epics (one epic per
+    file; units absorbed as member link-lists), never a fixed number.
+    BULK_ISSUE_CEILING (50) is a procedural tripwire only: above that many
+    POSTED issues, smoke-first + resume-safe + retry/backoff discipline is
+    mandatory. The substantive check: with an epic map, the allowed posted
+    count is len(epic_map) — one issue per epic. Without a map above the
+    tripwire, fold first; without approval, stop. Returns the required
+    epic granularity ('per-file' above the tripwire, 'per-unit-ok' below).
+    This is the check rebase_issue_factory.py never had (1,852 balloon).
+    """
+    if unit_count <= BULK_ISSUE_CEILING:
+        return "per-unit-ok"
+    if epic_map is None:
+        raise RuntimeError(
+            "tripwire crossed: %d units > %d with no epic map — "
+            "fold into per-FILE epics first (bound = epic count, "
+            "one posted issue per file)" % (unit_count, BULK_ISSUE_CEILING))
+    bound = len(epic_map)
+    if not approved:
+        raise RuntimeError(
+            "tripwire crossed: %d units > %d — epic map present "
+            "(fold bound: %d posted issues, one per file), "
+            "explicit approval still required" % (
+                unit_count, BULK_ISSUE_CEILING, bound))
+    return "per-file"

scripts/deploy_rust_build.py

@@ -0,0 +1,143 @@
+#!/usr/bin/env python3
+"""deploy_rust_build.py — #2455: the Rust cores ship as BINARIES, not sources.
+
+Builds every Rust cdylib CI builds into the STAGED deployment tree (in-tree
+target/release, exactly where the Python loaders look by default) and
+smoke-checks one FFI operation per crate — BEFORE the symlink flips. The
+deployed runtime then takes the Rust core by default instead of silently
+running the Python fallbacks; the strangler's hardening/speed point finally
+materializes in production.
+
+Smoke tiers (honest, per crate):
+  - symbol: CDLL-load the staged cdylib and resolve the crate's loader entry
+    symbol (dlsym IS an FFI operation; proves the ELF links and exports).
+  - call: a REAL FFI call through the staged loader itself (token_counting:
+    tc_estimate_tokens({"text": ...}) -> int). One end-to-end call proves the
+    full load path in the deployed revision.
+
+Toolchain law (carried from ci.yml): rustup toolchain PATH-first (system
+rustc is broken on this host — LLVM version-node symbol gap); builds run
+in-tree so the cdylib lands at <crate>/target/release/lib<crate>.so.
+
+Exit 0 = built + smoked; 1 = any failure (deploy_stage refuses promotion).
+RUNE_DEPLOY_SKIP_RUST=1 is the documented emergency bypass — the deploy then
+ships Python fallbacks as before and says so.
+"""
+
+from __future__ import annotations
+
+import argparse
+import ctypes
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+RUSTUP_BIN = "/home/nick/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/bin"
+
+# (crate, loader entry symbol, real-call payload or None)
+CRATES: list[tuple[str, str, dict | None]] = [
+    ("evidence_provenance", "ep_compute_hash", None),
+    ("rune_spine", "sp_project", None),
+    ("memory_scoring", "ms_compute_value", None),
+    ("capability_scoring", "cs_score_card", None),
+    ("token_counting", "tc_estimate_tokens", {"text": "ffi deploy smoke"}),
+    ("scaffold_core", "sc_check_transition", None),
+    ("memory_storage", "mems_read_query", None),
+    ("memory_retrieval", "mr_call", None),
+    ("cognition_core", "cc_default_budget", None),
+    ("route_risk_flags", "rrf_detect", None),
+    ("construction_interface", "ci_validate", None),
+]
+
+
+def _lib_path(staged_src: Path, crate: str) -> Path:
+    return staged_src / "rust" / crate / "target" / "release" / f"lib{crate}.so"
+
+
+def build_all(staged_src: Path) -> list[str]:
+    built: list[str] = []
+    env = dict(os.environ)
+    env["PATH"] = f"{RUSTUP_BIN}:{env.get('PATH', '')}"
+    env.pop("CARGO_TARGET_DIR", None)  # in-tree targets: the loaders' default path
+    for crate, _sym, _payload in CRATES:
+        manifest = staged_src / "rust" / crate / "Cargo.toml"
+        if not manifest.exists():
+            raise RuntimeError(f"{crate}: no Cargo.toml in the staged tree")
+        r = subprocess.run(
+            ["cargo", "build", "--release", "--manifest-path", str(manifest)],
+            capture_output=True,
+            text=True,
+            env=env,
+            timeout=600,
+        )
+        if r.returncode != 0:
+            raise RuntimeError(f"{crate}: cargo build failed:\n{r.stderr[-600:]}")
+        lib = _lib_path(staged_src, crate)
+        if not lib.exists() or lib.stat().st_size < 1024:
+            raise RuntimeError(f"{crate}: cdylib missing or implausibly small after build: {lib}")
+        built.append(crate)
+        print(f"  BUILT {crate}: {lib.stat().st_size} bytes")
+    return built
+
+
+def smoke_all(staged_src: Path) -> list[str]:
+    smoked: list[str] = []
+    for crate, sym, payload in CRATES:
+        lib = ctypes.CDLL(str(_lib_path(staged_src, crate)))
+        fn = getattr(lib, sym)  # dlsym: the FFI surface exists
+        fn.restype = ctypes.c_void_p  # char* — never default c_int (loader law)
+        if payload is not None:
+            _real_call(staged_src, crate, payload)
+            print(f"  SMOKED {crate}: symbol {sym} + real FFI call")
+        else:
+            print(f"  SMOKED {crate}: symbol {sym} resolved")
+        smoked.append(crate)
+    return smoked
+
+
+def _real_call(staged_src: Path, crate: str, payload: dict) -> None:
+    """Call the entry symbol directly with the loader's exact convention:
+    argtypes c_char_p, restype c_void_p (char* — never default c_int), read
+    the returned JSON envelope, free via <prefix>_free_string."""
+    lib = ctypes.CDLL(str(_lib_path(staged_src, crate)))
+    fn = getattr(lib, "tc_estimate_tokens")
+    fn.argtypes = [ctypes.c_char_p]
+    fn.restype = ctypes.c_void_p
+    raw = json.dumps(payload).encode("utf-8")
+    ptr = fn(raw)
+    if not ptr:
+        raise RuntimeError(f"{crate}: FFI call returned NULL")
+    text = ctypes.cast(ptr, ctypes.c_char_p).value or b""
+    getattr(lib, "tc_free_string")(ctypes.c_void_p(ptr))
+    env = json.loads(text.decode("utf-8"))
+    tokens = env.get("value", env.get("tokens")) if isinstance(env, dict) else env
+    if not isinstance(tokens, int) or tokens <= 0:
+        raise RuntimeError(f"{crate}: implausible FFI result: {text!r}")
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--staged", required=True, help="the staged tree (tmp_stage), pre-promotion")
+    args = ap.parse_args()
+    staged_src = Path(args.staged) / "src"
+
+    print("RUST CORES INTO THE DEPLOYED REVISION (#2455)")
+    built = build_all(staged_src)
+    smoked = smoke_all(staged_src)
+    missing = {c for c, *_ in CRATES} - set(smoked)
+    if missing:
+        raise RuntimeError(f"smoke coverage gap: {sorted(missing)}")
+    print(f"OK: {len(built)} crates built into the staged revision, {len(smoked)} FFI-smoked")
+    return 0
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except SystemExit:
+        raise
+    except Exception as e:  # noqa: BLE001 — terminal reporter: prints the failure and exits 1 (never silent)
+        print(f"deploy_rust_build: {e}", file=sys.stderr)
+        raise SystemExit(1)

scripts/deploy_stage.py

@@ -184,6 +184,26 @@ print("VERIFIED:", json.dumps(info))
         shutil.rmtree(tmp_stage, ignore_errors=True)
         return 1
 
+    # --- Rust cores into the staged revision (#2455) ---------------------
+    # The Rust cores ship as BINARIES, not sources: build every cdylib CI
+    # builds into the staged tree (in-tree target/release — the loaders'
+    # default path) and FFI-smoke each BEFORE the symlink flips, so the
+    # deployed runtime takes the Rust core by default instead of silently
+    # running the Python fallbacks. RUNE_DEPLOY_SKIP_RUST=1 is the documented
+    # emergency bypass (the deploy then ships fallbacks and says so).
+    if os.environ.get("RUNE_DEPLOY_SKIP_RUST") == "1":
+        print("Rust phase SKIPPED (RUNE_DEPLOY_SKIP_RUST=1) — staged revision runs Python fallbacks")
+    else:
+        rust = subprocess.run(
+            [sys.executable, str(repo / "scripts" / "deploy_rust_build.py"), "--staged", str(tmp_stage)],
+            capture_output=True, text=True, timeout=7200,
+        )
+        print(rust.stdout.strip())
+        if rust.returncode != 0:
+            print("RUST BUILD/SMOKE FAILED — deployment refused:\n" + rust.stderr[-800:], file=sys.stderr)
+            shutil.rmtree(tmp_stage, ignore_errors=True)
+            return 1
+
     # --- TUI startup canary (handoff 2026-09-10 §4): the ACTUAL
     # RuneApp initialization must succeed before promotion. A staged
     # revision whose TUI cannot initialize never becomes current.

scripts/dichotomy_audit.py

@@ -0,0 +1,286 @@
+#!/usr/bin/env python3
+"""dichotomy_audit.py — the honest completion instrument for the dichotomy rebase.
+
+Function-level, not directory-level: a module counts as covered only when its
+PYTHON FUNCTIONS have identifiable counterparts in the Go/Rust implementation.
+A Go directory with 3 structs and none of the module's 70 functions is a
+facade, and this audit names it as one.
+
+Matching rule (name-preserving ports): a Python function name matches when
+its snake_case form, or its Go/Rust camelCase/PascalCase form, appears in the
+candidate implementation sources. Deliberately strict — novel Go names that
+don't echo the Python names do NOT count, because unverifiable "trust me,
+it's in there somewhere" is exactly the failure mode this instrument exists
+to kill.
+
+Usage: python3 scripts/dichotomy_audit.py [--write]
+  --write  regenerates docs/dichotomy-rebase-honest-audit.md
+"""
+from __future__ import annotations
+
+import ast
+import json
+import re
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+SRC = ROOT / "src" / "rune"
+GO = ROOT / "src" / "go"
+RUST = ROOT / "src" / "rust"
+REPORT = ROOT / "docs" / "dichotomy-rebase-honest-audit.md"
+CLASSIFICATION = ROOT / "store" / "rebase" / "classification.json"
+
+TEST_PREFIXES = ("test_",)
+# Modules that stay Python by decision (test infra stays pytest)
+TEST_INFRA = {
+    "conftest", "test_truth", "test_adaptive_router", "test_canaries",
+}
+RETIRES = {"memory_env", "__main__"}
+
+
+def snake_to_camel(name: str) -> list[str]:
+    """Candidate identifier forms for a Python name in Go/Rust sources."""
+    parts = name.split("_")
+    camel = parts[0] + "".join(p.capitalize() for p in parts[1:])
+    pascal = "".join(p.capitalize() for p in parts)
+    return [name, camel, pascal]
+
+
+def module_functions(path: Path) -> list[str]:
+    """Every function and method name defined in the module."""
+    try:
+        tree = ast.parse(path.read_text(encoding="utf-8", errors="replace"))
+    except SyntaxError:
+        return []
+    names = []
+    for node in ast.walk(tree):
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+            if node.name.startswith("__") and node.name.endswith("__"):
+                continue  # dunders are runtime machinery, not port surface
+            names.append(node.name)
+    return names
+
+
+def load_classification() -> dict:
+    if CLASSIFICATION.exists():
+        return json.loads(CLASSIFICATION.read_text())
+    return {}
+
+
+def implementation_corpus() -> dict[str, str]:
+    """module-kebab -> concatenated Go/Rust source text for that module."""
+    corpus: dict[str, str] = {}
+
+    for d in sorted(GO.iterdir()):
+        if not d.is_dir():
+            continue
+        chunks = []
+        for f in d.rglob("*.go"):
+            if f.name.endswith("_test.go"):
+                continue
+            chunks.append(f.read_text(encoding="utf-8", errors="replace"))
+        if chunks:
+            corpus[d.name] = "\n".join(chunks)
+
+    # Survivor packages (per-crate Go membranes under cognition/)
+    cog = GO / "cognition"
+    if cog.exists():
+        for d in sorted(cog.iterdir()):
+            if d.is_dir():
+                chunks = [f.read_text(encoding="utf-8", errors="replace")
+                          for f in d.rglob("*.go") if not f.name.endswith("_test.go")]
+                if chunks:
+                    corpus[f"cognition-{d.name}"] = "\n".join(chunks)
+
+    for d in sorted(RUST.iterdir()):
+        src = d / "src"
+        if src.exists():
+            chunks = [f.read_text(encoding="utf-8", errors="replace")
+                      for f in src.rglob("*.rs")]
+            if chunks:
+                corpus[d.name] = "\n".join(chunks)
+    return corpus
+
+
+def module_to_keys(module_stem: str) -> list[str]:
+    """Candidate implementation keys for a Python module stem."""
+    kebab = module_stem.replace("_", "-")
+    keys = [kebab, module_stem]
+    # Deep ports and multi-module binaries register aliases:
+    aliases = {
+        "rune_operator": ["operator", "operator-deep", "operator-support", "core-server"],
+        "rune_tui": ["tui"],
+        "rune_operator_cli": ["operator"],
+        "memory_store": ["memory-ops", "memory-store-deep"],
+        "warm_router": ["warm-router", "operator-support"],
+        "tool_executor": ["tool-executor", "local-tool-runtime", "tool-protocol", "tool-protocol-rw"],
+        "local_tool_runtime": ["local-tool-runtime", "operator"],
+        "provider_registry": ["provider-registry", "model-connect"],
+        "adaptive_router": ["adaptive-router", "operator-support"],
+        "hook_engine": ["hook-engine"],
+        "event_bus": ["event-bus"],
+        "event_envelope": ["event-bus"],
+        "message_queue": ["message-queue"],
+        "subsystem_health": ["subsystem-health"],
+        "parallel_processor": ["parallel-processor"],
+        "connection_pool": ["connection-pool"],
+        "recall_router": ["recall-router"],
+        "cron_engine": ["cron-engine"],
+        "cache": ["cache"],
+        "night_mode": ["night-mode"],
+        "work_manager": ["work-manager"],
+        "failure_auto_filer": ["failure-filer"],
+        "microkernel": ["microkernel"],
+        "construction_interface": ["cognition-cognition", "cognition"],
+        "construction_decision": ["cognition-cognition", "cognition"],
+        "rune_spine": ["cognition-spine", "cognition"],
+        "spine": ["cognition-spine", "cognition"],
+        "memory_storage": ["cognition-storage", "cognition"],
+        "memory_retrieval": ["cognition-retrieval", "cognition"],
+        "scaffold_core": ["cognition-scaffold", "cognition"],
+        "evidence_provenance": ["cognition-provenance", "cognition"],
+        "memory_scoring": ["cognition-scoring", "cognition"],
+        "capability_scoring": ["cognition-capability", "cognition"],
+        "token_counting": ["cognition-token", "cognition"],
+        "query_memory": ["cognition-query", "cognition"],
+    }
+    if module_stem in aliases:
+        keys = aliases[module_stem] + keys
+    # cognition_core broker.rs hosts many kernels
+    if module_stem in {
+        "tier_manager", "safety_override", "pins", "identity_anchors",
+        "abstraction", "growth_delta", "witness", "persona_gate",
+        "memory_consolidation", "drift_compression", "context_broker",
+        "persona_definition", "goal",
+    }:
+        keys.append("cognition_core")
+        keys.append("cognition-cognition")
+    return keys
+
+
+def audit() -> dict:
+    classification = load_classification()
+    corpus = implementation_corpus()
+
+    rows = []
+    for path in sorted(SRC.glob("*.py")):
+        stem = path.stem
+        if stem in RETIRES:
+            rows.append({"module": stem, "lines": len(path.read_text(errors='replace').splitlines()),
+                         "fns": 0, "matched": 0, "side": "RETIRES", "status": "RETIRES", "missing": []})
+            continue
+        if stem.startswith(TEST_PREFIXES) or stem in TEST_INFRA:
+            rows.append({"module": stem, "lines": len(path.read_text(errors='replace').splitlines()),
+                         "fns": 0, "matched": 0, "side": "TEST", "status": "TEST", "missing": []})
+            continue
+        fns = module_functions(path)
+        lines = len(path.read_text(errors="replace").splitlines())
+        entry = classification.get(stem) or classification.get(path.name) or {}
+        side = entry.get("side", entry.get("language", "unclassified"))
+
+        sources = []
+        for key in module_to_keys(stem):
+            if key in corpus:
+                sources.append(corpus[key])
+        blob = "\n".join(sources)
+
+        matched, missing = 0, []
+        for fn in fns:
+            hits = any(cand in blob for cand in snake_to_camel(fn))
+            if hits:
+                matched += 1
+            else:
+                missing.append(fn)
+
+        ratio = matched / len(fns) if fns else (1.0 if lines < 30 else 0.0)
+        if stem in RETIRES:
+            status = "RETIRES"
+        elif not blob:
+            status = "NOT TOUCHED"
+        elif ratio >= 0.8:
+            status = "FULL"
+        elif ratio >= 0.2:
+            status = "PARTIAL"
+        else:
+            status = "NOT TOUCHED"
+        rows.append({"module": stem, "lines": lines, "fns": len(fns),
+                     "matched": matched, "side": side, "status": status, "missing": missing[:12]})
+
+    return {"rows": rows}
+
+
+def summarize(result: dict) -> str:
+    rows = result["rows"]
+    runtime = [r for r in rows if r["status"] not in ("TEST", "RETIRES")]
+    full = [r for r in runtime if r["status"] == "FULL"]
+    partial = [r for r in runtime if r["status"] == "PARTIAL"]
+    untouched = [r for r in runtime if r["status"] == "NOT TOUCHED"]
+    total_fns = sum(r["fns"] for r in runtime)
+    total_matched = sum(r["matched"] for r in runtime)
+    total_lines = sum(r["lines"] for r in runtime)
+    fn_pct = 100 * total_matched / total_fns if total_fns else 0
+
+    out = []
+    out.append("# DICHOTOMY REBASE — HONEST AUDIT (function-level)")
+    out.append("")
+    out.append("_Regenerate with `python3 scripts/dichotomy_audit.py --write`. A module is FULL only when 80%+ of its Python functions have name-preserving counterparts in the Go/Rust implementation — directories without the functions are facades and count as NOT TOUCHED._")
+    out.append("")
+    out.append(f"**Function-level completion: {fn_pct:.0f}%** ({total_matched}/{total_fns} runtime functions matched)")
+    out.append("")
+    out.append("| Status | Modules | Lines | Meaning |")
+    out.append("|---|---|---|---|")
+    out.append(f"| FULL | {len(full)} | {sum(r['lines'] for r in full)} | 80%+ of functions ported |")
+    out.append(f"| PARTIAL | {len(partial)} | {sum(r['lines'] for r in partial)} | 20–80% — real logic exists, gaps named below |")
+    out.append(f"| NOT TOUCHED | {len(untouched)} | {sum(r['lines'] for r in untouched)} | no name-preserving implementation |")
+    out.append(f"| Total runtime | {len(runtime)} | {total_lines} | |")
+    out.append("")
+
+    if untouched:
+        out.append("## NOT TOUCHED — the port queue, in priority order (largest first)")
+        out.append("")
+        out.append("| Module | Lines | Fns | Side |")
+        out.append("|---|---|---|---|")
+        for r in sorted(untouched, key=lambda r: -r["lines"]):
+            out.append(f"| {r['module']} | {r['lines']} | {r['fns']} | {r['side']} |")
+        out.append("")
+    if partial:
+        out.append("## PARTIAL — gaps to close (matched/total fns; first missing named)")
+        out.append("")
+        out.append("| Module | Lines | Coverage | Missing (first named) |")
+        out.append("|---|---|---|---|")
+        for r in sorted(partial, key=lambda r: -(r["fns"] - r["matched"])):
+            miss = ", ".join(r["missing"][:6]) if r["missing"] else "(structural)"
+            out.append(f"| {r['module']} | {r['lines']} | {r['matched']}/{r['fns']} | {miss} |")
+        out.append("")
+    out.append("## FULL — ported, parity-gated")
+    out.append("")
+    out.append("| Module | Lines | Fns | Side |")
+    out.append("|---|---|---|---|")
+    for r in sorted(full, key=lambda r: -r["lines"]):
+        out.append(f"| {r['module']} | {r['lines']} | {r['matched']}/{r['fns']} | {r['side']} |")
+    out.append("")
+    return "\n".join(out)
+
+
+def main() -> int:
+    write = "--write" in sys.argv
+    result = audit()
+    report = summarize(result)
+    if write:
+        REPORT.write_text(report)
+        print(f"written: {REPORT}")
+    # stderr summary for the session log
+    rows = result["rows"]
+    runtime = [r for r in rows if r["status"] not in ("TEST", "RETIRES")]
+    tf = sum(r["fns"] for r in runtime)
+    tm = sum(r["matched"] for r in runtime)
+    print(f"FUNCTION-LEVEL: {tm}/{tf} ({100*tm/tf if tf else 0:.0f}%) | "
+          f"FULL {sum(1 for r in runtime if r['status']=='FULL')} | "
+          f"PARTIAL {sum(1 for r in runtime if r['status']=='PARTIAL')} | "
+          f"NOT TOUCHED {sum(1 for r in runtime if r['status']=='NOT TOUCHED')}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

scripts/finance_tracker.py

@@ -0,0 +1,181 @@
+#!/usr/bin/env python3
+"""finance_tracker.py — #3: track Nick's finances, surface waste and opportunity.
+
+Nick has no disposable income; every penny matters. This is a zero-dependency
+(stdlib-only) tracker:
+
+  add    — record an expense or income entry into the CSV ledger
+  budget — set a monthly category limit
+  report — per-category totals vs budgets, income vs spend, for a month
+           or the last 7 days; recurring payments (same note, ~monthly,
+           3+ occurrences) are flagged as SUBSCRIPTION candidates
+
+Storage: ~/.rune/finance/ledger.csv + budgets.json (human-readable, portable,
+yours — no database, no cloud, no lock-in).
+
+  finance_tracker.py add -30.00 groceries "weekly shop"
+  finance_tracker.py add 1450.00 salary "October pay"
+  finance_tracker.py budget groceries 260
+  finance_tracker.py report --month 2026-10
+  finance_tracker.py report --week
+"""
+
+from __future__ import annotations
+
+import argparse
+import csv
+import json
+import os
+import sys
+from collections import defaultdict
+from datetime import date, datetime, timedelta
+from pathlib import Path
+
+FINANCE_DIR = Path(os.environ.get("RUNE_FINANCE_DIR", Path.home() / ".rune" / "finance"))
+LEDGER = FINANCE_DIR / "ledger.csv"
+BUDGETS = FINANCE_DIR / "budgets.json"
+FIELDS = ["date", "amount", "category", "note", "kind"]  # kind: in | out
+
+
+def _ensure() -> None:
+    FINANCE_DIR.mkdir(parents=True, exist_ok=True)
+    if not LEDGER.exists():
+        with open(LEDGER, "w", newline="", encoding="utf-8") as f:
+            csv.writer(f).writerow(FIELDS)
+
+
+def add(amount: float, category: str, note: str = "", kind: str | None = None, when: str | None = None) -> dict:
+    """Record one entry. Negative amount = expense, positive = income (unless
+    kind forces it). Returns the stored row."""
+    _ensure()
+    if kind is None:
+        kind = "out" if amount < 0 else "in"
+    amount = abs(amount)
+    row = {
+        "date": when or date.today().isoformat(),
+        "amount": f"{amount:.2f}",
+        "category": category.strip().lower(),
+        "note": note.strip(),
+        "kind": kind,
+    }
+    with open(LEDGER, "a", newline="", encoding="utf-8") as f:
+        csv.DictWriter(f, fieldnames=FIELDS).writerow(row)
+    return row
+
+
+def set_budget(category: str, monthly_limit: float) -> dict:
+    _ensure()
+    budgets = {}
+    if BUDGETS.exists():
+        budgets = json.loads(BUDGETS.read_text())
+    budgets[category.strip().lower()] = round(monthly_limit, 2)
+    BUDGETS.write_text(json.dumps(budgets, indent=2, sort_keys=True))
+    return budgets
+
+
+def _rows() -> list[dict]:
+    _ensure()
+    with open(LEDGER, newline="", encoding="utf-8") as f:
+        return [r for r in csv.DictReader(f) if r.get("date")]
+
+
+def find_subscriptions(rows: list[dict] | None = None) -> list[dict]:
+    """Recurring payments: same normalized note (or category+note), same-ish
+    amount, 3+ occurrences with ~monthly spacing. These are the
+    cancellation-review candidates."""
+    rows = rows if rows is not None else _rows()
+    groups: dict[str, list[dict]] = defaultdict(list)
+    for r in rows:
+        if r["kind"] != "out":
+            continue
+        key = (r["note"] or r["category"]).strip().lower()
+        groups[key].append(r)
+    subs = []
+    for key, items in groups.items():
+        if len(items) < 3:
+            continue
+        items.sort(key=lambda r: r["date"])
+        gaps = [
+            (datetime.fromisoformat(items[i + 1]["date"]) - datetime.fromisoformat(items[i]["date"])).days
+            for i in range(len(items) - 1)
+        ]
+        if gaps and all(20 <= g <= 45 for g in gaps):
+            amounts = {float(i["amount"]) for i in items}
+            subs.append(
+                {
+                    "note": key,
+                    "occurrences": len(items),
+                    "monthly": sorted(amounts)[-1],
+                    "first": items[0]["date"],
+                    "last": items[-1]["date"],
+                }
+            )
+    subs.sort(key=lambda s: -s["monthly"])
+    return subs
+
+
+def report(month: str | None = None, week: bool = False) -> dict:
+    """Per-category totals vs budgets + income vs spend + subscription flags."""
+    rows = _rows()
+    if week:
+        start = (date.today() - timedelta(days=7)).isoformat()
+        rows = [r for r in rows if r["date"] >= start]
+    elif month:
+        rows = [r for r in rows if r["date"].startswith(month)]
+    income = sum(float(r["amount"]) for r in rows if r["kind"] == "in")
+    spend = sum(float(r["amount"]) for r in rows if r["kind"] == "out")
+    by_cat: dict[str, float] = defaultdict(float)
+    for r in rows:
+        if r["kind"] == "out":
+            by_cat[r["category"]] += float(r["amount"])
+    budgets = json.loads(BUDGETS.read_text()) if BUDGETS.exists() else {}
+    over = [
+        {"category": c, "spent": round(s, 2), "budget": budgets[c], "over_by": round(s - budgets[c], 2)}
+        for c, s in sorted(by_cat.items())
+        if c in budgets and s > budgets[c]
+    ]
+    return {
+        "income": round(income, 2),
+        "spend": round(spend, 2),
+        "net": round(income - spend, 2),
+        "by_category": {c: round(v, 2) for c, v in sorted(by_cat.items(), key=lambda kv: -kv[1])},
+        "over_budget": over,
+        "subscription_candidates": find_subscriptions(rows),
+        "entries": len(rows),
+    }
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description="#3: finances — every penny matters")
+    sub = ap.add_subparsers(dest="cmd", required=True)
+
+    p_add = sub.add_parser("add")
+    p_add.add_argument("amount", type=float)
+    p_add.add_argument("category")
+    p_add.add_argument("note", nargs="?", default="")
+    p_add.add_argument("--kind", choices=["in", "out"])
+    p_add.add_argument("--date", dest="when")
+
+    p_b = sub.add_parser("budget")
+    p_b.add_argument("category")
+    p_b.add_argument("limit", type=float)
+
+    p_r = sub.add_parser("report")
+    p_r.add_argument("--month", help="YYYY-MM")
+    p_r.add_argument("--week", action="store_true")
+
+    args = ap.parse_args()
+    if args.cmd == "add":
+        row = add(args.amount, args.category, args.note, args.kind, args.when)
+        print(f"recorded: {row['kind']} {row['amount']} on {row['category']} ({row['date']})")
+    elif args.cmd == "budget":
+        b = set_budget(args.category, args.limit)
+        print(f"budgets: {json.dumps(b, sort_keys=True)}")
+    elif args.cmd == "report":
+        r = report(args.month, args.week)
+        print(json.dumps(r, indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

scripts/forge_board.py

@@ -0,0 +1,164 @@
+#!/usr/bin/env python3
+"""forge_board.py — #204: the forge as the single pipeline state machine.
+
+Reads the forge's OWN state (open issues, labels, CI status on each head)
+and derives the next action per issue. No agent memory involved: any agent
+(or a crashed-and-replaced session) runs this and knows what happens next.
+
+Derivation rules (deterministic, zero tokens):
+  1. issue carries `blocked`        -> BLOCKED (say on what, from the body)
+  2. head has failing CI            -> FIX FIRST (fault-watch contract)
+  3. head has pending CI            -> WAITING (subject + ETA shape)
+  4. issue carries `awaiting-review`-> REVIEW (reviewer gates decide)
+  5. no linked work (no contract)   -> OPEN CONTRACT (scaffolding is absolute)
+  6. otherwise                      -> IMPLEMENT per the body's acceptance
+
+Exit codes: 0 = board read; 1 = forge unreachable; 2 = no open issues
+(the factory's only other legal stop).
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from typing import Any, Callable, Dict, List, Optional
+
+Fetch = Callable[[str], Optional[Dict[str, Any]]]
+
+BLOCKED_LABELS = {"blocked", "waiting-on-user", "on-hold"}
+REVIEW_LABELS = {"awaiting-review", "in-review", "review-required"}
+CI_PENDING = {"pending", "running", "unknown"}
+CI_FAILED = {"failure", "cancelled"}
+
+
+def derive_next_action(issue: Dict[str, Any], ci_state: Optional[Dict[str, Any]]) -> Dict[str, Any]:
+    """Pure derivation: forge state in, next action out. No network, no memory."""
+    labels = {l.get("name", "") for l in issue.get("labels", [])}
+    num = issue.get("number")
+    title = issue.get("title", "")
+
+    if labels & BLOCKED_LABELS:
+        return {
+            "issue": num,
+            "title": title,
+            "action": "BLOCKED",
+            "why": "carries a blocking label; unblock before the queue touches it",
+        }
+
+    if ci_state:
+        verdict = ci_state.get("verdict")
+        if verdict in CI_FAILED:
+            return {
+                "issue": num,
+                "title": title,
+                "action": "FIX FIRST",
+                "why": f"CI on head {ci_state.get('sha', '?')[:8]} is {verdict}; the fault-watch contract fixes the submit before the queue resumes",
+            }
+        if verdict in CI_PENDING:
+            return {
+                "issue": num,
+                "title": title,
+                "action": "WAITING",
+                "why": f"CI on head {ci_state.get('sha', '?')[:8]} is {verdict}; factory multiplexes the next batch meanwhile",
+            }
+
+    if labels & REVIEW_LABELS:
+        return {
+            "issue": num,
+            "title": title,
+            "action": "REVIEW",
+            "why": "awaiting reviewer gates (spec-compliance + code-quality)",
+        }
+
+    body = issue.get("body") or ""
+    if "BUILDER-" in body:
+        return {
+            "issue": num,
+            "title": title,
+            "action": "CONTINUE CONTRACT",
+            "why": "a construction contract is already linked in the body",
+        }
+    return {
+        "issue": num,
+        "title": title,
+        "action": "OPEN CONTRACT",
+        "why": "no linked work in the body; scaffolding is absolute — contract first",
+    }
+
+
+def read_board(
+    fetch: Fetch, owner: str = "conductor", repo: str = "rune", base: str = "http://127.0.0.1:3000/api/v1"
+) -> Dict[str, Any]:
+    """Pull open issues + CI state from the forge and derive the board."""
+    raw = fetch(f"{base}/repos/{owner}/{repo}/issues?state=open&limit=50")
+    if raw is None:
+        raise RuntimeError("forge unreachable")
+    issues = raw if isinstance(raw, list) else raw.get("data", [])
+
+    board: List[Dict[str, Any]] = []
+    for issue in issues:
+        sha = _head_sha_from_labels(issue) or _head_sha_from_body(issue)
+        ci_state = None
+        if sha:
+            status = fetch(f"{base}/repos/{owner}/{repo}/commits/{sha}/status")
+            if status:
+                ci_state = {"sha": sha, "verdict": status.get("state", "unknown")}
+        board.append(derive_next_action(issue, ci_state))
+
+    order = {"FIX FIRST": 0, "CONTINUE CONTRACT": 1, "OPEN CONTRACT": 2, "REVIEW": 3, "WAITING": 4, "BLOCKED": 5}
+    board.sort(key=lambda r: (order.get(r["action"], 9), r["issue"] or 0))
+    return {"repo": f"{owner}/{repo}", "open": len(board), "board": board}
+
+
+def _head_sha_from_labels(issue: Dict[str, Any]) -> Optional[str]:
+    for l in issue.get("labels", []):
+        name = l.get("name", "")
+        if name.startswith("head:"):
+            return name.split("head:", 1)[1].strip()
+    return None
+
+
+def _head_sha_from_body(issue: Dict[str, Any]) -> Optional[str]:
+    import re
+
+    m = re.search(r"\b([0-9a-f]{40})\b", issue.get("body") or "")
+    return m.group(1) if m else None
+
+
+def _default_fetch(url: str) -> Optional[Any]:
+    try:
+        import urllib.request
+
+        sys.path.insert(0, "/home/nick/.config/opencode/shared")
+        from gitea_auth import load_gitea_token
+
+        req = urllib.request.Request(url, headers={"Authorization": f"token {load_gitea_token()}"})
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.load(r)
+    except Exception:  # noqa: BLE001 — fetcher probe: unreachability is reported upstream as a hard error (read_board raises)
+        return None
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description="#204 forge board: the next action, from forge state alone")
+    ap.add_argument("--json", action="store_true", help="machine-readable output")
+    args = ap.parse_args()
+    try:
+        board = read_board(_default_fetch)
+    except RuntimeError as e:
+        print(f"forge_board: {e}", file=sys.stderr)
+        return 1
+    if args.json:
+        print(json.dumps(board, indent=2))
+    else:
+        print(f"== FORGE BOARD {board['repo']} — {board['open']} open ==")
+        for row in board["board"]:
+            print(f"  #{row['issue']} [{row['action']}] {row['title'][:60]} — {row['why']}")
+    if board["open"] == 0:
+        return 2
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

scripts/gen_adaptive_router_truth.py

@@ -0,0 +1,111 @@
+import json, sys
+sys.path.insert(0, 'src')
+from rune.adaptive_router import (
+    classify_route, derive_sufficiency, body_has_floor_trigger, floor_applies,
+    escalate_route, downgrade_route, escalate_on_verification_failure,
+    build_research_dispatch, FloorViolation,
+)
+
+cases = []
+ESC_EVIDENCE = "the fix works locally but the production parser accepts different input shapes — input contract uncertain"
+
+cr_cases = [
+    ("local_fix_happy", "fix the broken typewriter regex in warm_router, crash on empty input",
+     dict(has_local_repro=True, owning_authority_known=True, testable_locally=True, narrow_and_reversible=True)),
+    ("standard_change", "add a progress bar to the export dialog",
+     dict(has_local_repro=True, owning_authority_known=True, testable_locally=True, narrow_and_reversible=True)),
+    ("defect_word_absent", "update the version number in the footer",
+     dict(has_local_repro=True, owning_authority_known=True, testable_locally=False, narrow_and_reversible=True)),
+    ("floor_new_subsystem", "adopt a new subsystem for memory indexing, replacement of spine",
+     dict(has_local_repro=False, owning_authority_known=False)),
+    ("risk_new_authority", "this creates a new authority path for dispatch",
+     dict(has_local_repro=False, owning_authority_known=False)),
+    ("uncertainty_competing", "there are competing designs here, expensive reversal likely",
+     dict(has_local_repro=True, owning_authority_known=True)),
+    ("not_grounded", "add support for markdown export",
+     dict(has_local_repro=False, owning_authority_known=True, testable_locally=True, narrow_and_reversible=True)),
+    ("inspection_verb", "explain why the failing test fails",
+     dict(has_local_repro=True, owning_authority_known=True, testable_locally=True, narrow_and_reversible=True)),
+]
+for name, body, kw in cr_cases:
+    d = classify_route(body, **kw)
+    cases.append({"fn": "classify", "name": name,
+                  "input": {"body": body, **kw, "pipeline_sha": "UNKNOWN"},
+                  "expected": {"route": d.route, "confidence": d.confidence, "reasons": d.reasons,
+                               "risk": d.risk_flags, "uncertainty": d.uncertainty_flags,
+                               "floor": d.floor, "task_description": d.task_description}})
+
+ds_cases = [
+    ("grounded_fix", "fix crash", "the parser crashes on empty input, see tests/test_parse.py"),
+    ("mechanism", "investigate", "performance is bad under load, benchmark needed"),
+    ("external_url", "read the docs", "see https://example.com/api docs for the endpoint"),
+    ("version_risk", "upgrade", "upgrade the library to latest version, current behaviour differs"),
+    ("inspection", "explain", "why does this happen"),
+    ("new_subsystem", "adopt", "this adopts a replacement architecture"),
+    ("neutral", "write", "a poem about the sea"),
+]
+for name, title, body in ds_cases:
+    s = derive_sufficiency(title, body)
+    cases.append({"fn": "derive", "name": name,
+                  "input": {"title": title, "body": body, "ambiguous": False},
+                  "expected": {"local_authority": s.local_authority,
+                               "external_dependency": s.external_dependency,
+                               "version_freshness_risk": s.version_freshness_risk,
+                               "verifiability": s.verifiability, "scope_novelty": s.scope_novelty,
+                               "unknowns": s.unknowns(),
+                               "task_class": s.provenance.get("task_class_language")}})
+
+cases.append({"fn": "floor_trigger", "name": "trigger_yes",
+              "input": {"body": "adopt a replacement for the cache"},
+              "expected": {"result": body_has_floor_trigger("adopt a replacement for the cache")}})
+cases.append({"fn": "floor_trigger", "name": "trigger_no",
+              "input": {"body": "fix the typo"},
+              "expected": {"result": body_has_floor_trigger("fix the typo")}})
+cases.append({"fn": "floor_applies", "name": "res_yes", "input": {"route": "RESEARCHED_CHANGE", "flags": ["new_authority"]},
+              "expected": {"result": floor_applies("RESEARCHED_CHANGE", ["new_authority"])}})
+cases.append({"fn": "floor_applies", "name": "local_no", "input": {"route": "LOCAL_FIX", "flags": ["new_authority"]},
+              "expected": {"result": floor_applies("LOCAL_FIX", ["new_authority"])}})
+
+base = classify_route("fix the crash", has_local_repro=True, owning_authority_known=True,
+                      testable_locally=True, narrow_and_reversible=True)
+esc = escalate_route(base, "RESEARCHED_CHANGE", "verify_fail", ESC_EVIDENCE)
+cases.append({"fn": "escalate", "name": "esc",
+              "input": {"decision_route": base.route, "new_route": "RESEARCHED_CHANGE",
+                        "trigger": "verify_fail", "evidence": ESC_EVIDENCE},
+              "expected": {"route": esc.route, "previous": esc.previous_route,
+                           "decided_by": esc.decided_by, "trigger": esc.trigger}})
+
+try:
+    downgrade_route(base, "STANDARD_CHANGE", "try", "ev")
+    cases.append({"fn": "downgrade", "name": "dg_ok", "input": {"base_route": base.route, "base_floor": False,
+                  "new_route": "STANDARD_CHANGE"}, "expected": {"route": "STANDARD_CHANGE", "error": None}})
+except FloorViolation:
+    cases.append({"fn": "downgrade", "name": "dg_ok", "input": {}, "expected": {"route": None, "error": "FloorViolation"}})
+
+floored = classify_route("adopt a replacement for the memory index")
+try:
+    downgrade_route(floored, "STANDARD_CHANGE", "efficiency", "faster")
+    cases.append({"fn": "downgrade", "name": "dg_floored", "input": {"base_floor": True, "new_route": "STANDARD_CHANGE"},
+                  "expected": {"route": "STANDARD_CHANGE", "error": None}})
+except FloorViolation:
+    cases.append({"fn": "downgrade", "name": "dg_floored", "input": {"base_floor": True, "new_route": "STANDARD_CHANGE"},
+                  "expected": {"route": None, "error": "FloorViolation"}})
+
+try:
+    escalate_on_verification_failure(base, "test failed", "/tmp/ar_probe.jsonl")
+    cases.append({"fn": "evidence_short", "name": "short", "input": {"evidence": "test failed"},
+                  "expected": {"result": "ACCEPTED"}})
+except ValueError:
+    cases.append({"fn": "evidence_short", "name": "short", "input": {"evidence": "test failed"},
+                  "expected": {"result": "REJECTED"}})
+
+disp = build_research_dispatch("T-1", "research the memory index options", floored)
+cases.append({"fn": "dispatch", "name": "disp",
+              "input": {"task_id": "T-1", "description": "research the memory index options"},
+              "expected": {"task_id": disp["task_id"], "title": disp["title"], "route": disp["route"],
+                           "floor": disp["floor"], "executor_entry": disp["executor_entry"]}})
+
+json.dump(cases, open('src/go/adaptive-router/truth.json', 'w'), indent=1)
+print(f"{len(cases)} truth cases with inputs")
+for c in cases:
+    print(f"  {c['fn']:14} {c['name']}")

scripts/gen_build_mode_truth.py

@@ -0,0 +1,115 @@
+#!/usr/bin/env python3
+"""gen_build_mode_truth.py — build-mode batch 1 truth battery
+(contract BUILDER-2026-10-07T17:08:00Z-6e177d-unknown).
+
+The LIVE BuildManager runs with the clock FROZEN (module-patched datetime)
+and create_worktree no-op'd (reactive piece, deferred to batch 2). Cases
+capture: the start_build id format, the ledger flow across phases
+(including a failure + correction), resume-point scans at several states,
+and the status shape. The Go replay compares state dicts key-for-key.
+
+Usage: python3 scripts/gen_build_mode_truth.py   (from repo root)
+"""
+
+import json
+import sys
+from datetime import datetime, timezone
+from pathlib import Path
+from types import SimpleNamespace
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+
+from rune import build_mode as bm  # noqa: E402
+
+FROZEN = "2026-10-07T16:08:00"
+FROZEN_DT = datetime(2026, 10, 7, 16, 8, 0, tzinfo=timezone.utc)
+
+
+class FrozenDatetime(datetime):
+    @classmethod
+    def now(cls, tz=None):
+        return FROZEN_DT
+
+
+def main():
+    # Freeze the clock (the manager reads datetime.now at two call sites)
+    bm.datetime = FrozenDatetime
+
+    def flow(name, steps):
+        """Run a phase flow with the worktree op no-op'd; record the CALLS."""
+        mgr = bm.BuildManager()
+        mgr.create_worktree = lambda: "/nonexistent-worktree"  # reactive no-op
+        build_id = mgr.start_build("truth battery build")
+        calls = []
+        for fn, args in steps:
+            fn(mgr, **args)
+            calls.append({"fn": fn.__name__, "args": args})
+        return {
+            "name": name,
+            "build_id": build_id,
+            "calls": calls,
+            "state": _jsonify(mgr.state),
+            "resume_point": mgr.get_resume_point(),
+            "can_resume": mgr.can_resume(),
+            "status": mgr.get_status(),
+        }
+
+    def step(fn, **args):
+        return (fn, args)
+
+    cases = [
+        flow("fresh_start_assess_in_progress", []),
+        flow("assess_complete", [
+            step(bm.BuildManager.complete_assess, complexity_report={"complexity": 3}),
+        ]),
+        flow("through_plan", [
+            step(bm.BuildManager.complete_assess, complexity_report={"complexity": 3}),
+            step(bm.BuildManager.complete_research, findings={"findings": "dichotomy applies"}),
+            step(bm.BuildManager.complete_feasible, feasible=True, risk="low"),
+            step(bm.BuildManager.complete_consult, patterns=["oracle-battery pattern"]),
+            step(bm.BuildManager.complete_consent, approved=True),
+            step(bm.BuildManager.complete_plan, batches=[{"batch": 1, "fns": 11}]),
+        ]),
+        flow("verify_with_failures", [
+            step(bm.BuildManager.complete_assess, complexity_report={}),
+            step(bm.BuildManager.complete_research, findings={}),
+            step(bm.BuildManager.complete_feasible, feasible=True, risk="low"),
+            step(bm.BuildManager.complete_consult, patterns=[]),
+            step(bm.BuildManager.complete_consent, approved=True),
+            step(bm.BuildManager.complete_plan, batches=[]),
+            step(bm.BuildManager.complete_build_phase, results=[{"ok": True}]),
+            step(bm.BuildManager.complete_verify, passed=False, failures=["test_x failed"]),
+        ]),
+        flow("correction_cycle", [
+            step(bm.BuildManager.complete_assess, complexity_report={}),
+            step(bm.BuildManager.complete_research, findings={}),
+            step(bm.BuildManager.complete_feasible, feasible=True, risk="low"),
+            step(bm.BuildManager.complete_consult, patterns=[]),
+            step(bm.BuildManager.complete_consent, approved=True),
+            step(bm.BuildManager.complete_plan, batches=[{"batch": 1}]),
+            step(bm.BuildManager.start_correct),
+            step(bm.BuildManager.complete_correct, fixed=True),
+        ]),
+    ]
+
+    out = {
+        "oracle": "src/rune/build_mode.py (live BuildManager, clock frozen)",
+        "generated": "2026-10-07",
+        "frozen_now": FROZEN,
+        "cases": cases,
+    }
+    target = REPO / "src/go/build-mode" / "truth_buildmode.json"
+    target.write_text(json.dumps(out, indent=1, ensure_ascii=False) + "\n")
+    print(f"wrote {target} ({len(cases)} flow cases)")
+
+
+def _jsonify(state):
+    """asdict + the worktree path the no-op returned."""
+    from dataclasses import asdict
+    d = asdict(state)
+    return d
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_build_mode_wt_truth.py

@@ -0,0 +1,148 @@
+#!/usr/bin/env python3
+"""gen_build_mode_wt_truth.py — build-mode batch 2 truth battery
+(contract BUILDER-2026-10-07T18:26:40Z-8be89a).
+
+The LIVE BuildManager drives a REAL tmp git repo: create → state captured,
+merge → state captured, delete → state captured. Cases carry the exact
+argv sequences (from monkeypatched subprocess.run) + the state after each
+op + the error texts. The Go plan layer must produce the same argv; the
+Go exec harness proves the plans drive real git.
+
+Usage: python3 scripts/gen_build_mode_wt_truth.py   (from repo root)
+"""
+
+import json
+import subprocess
+import sys
+import tempfile
+from datetime import datetime, timezone
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+
+from rune import build_mode as bm  # noqa: E402
+
+FROZEN = "2026-10-07T18:28:00"
+
+
+class FrozenDatetime(datetime):
+    @classmethod
+    def now(cls, tz=None):
+        return datetime(2026, 10, 7, 18, 28, 0, tzinfo=timezone.utc)
+
+
+def main():
+    bm.datetime = FrozenDatetime
+    bm.REPO_DIR = str(make_git_repo())
+
+    calls = []
+
+    def spy_run(cmd, **kwargs):
+        calls.append(list(cmd))
+        return subprocess.CompletedProcess(cmd, 0, "", "")
+
+    bm.subprocess.run = spy_run
+
+    mgr = bm.BuildManager()
+    build_id = mgr.start_build("worktree battery")  # create_worktree inside
+    create_call = calls[0]
+    after_create = mgr.state.worktree_path
+
+    n_before_merge = len(calls)
+    mgr.merge_worktree()
+    merge_call = calls[n_before_merge]           # the merge itself
+    after_merge = mgr.state.worktree_path  # None: delete follows the merge
+    delete_call = calls[n_before_merge + 1], calls[n_before_merge + 2]
+
+    cases = [
+        {
+            "fn": "plan", "name": "create",
+            "expected": {"argv": create_call},
+        },
+        {
+            "fn": "plan", "name": "merge",
+            "expected": {"argv": merge_call},
+        },
+        {
+            "fn": "plan", "name": "delete_pair",
+            "expected": {"argv": [list(delete_call[0]), list(delete_call[1])]},
+        },
+        {
+            "fn": "state", "name": "round_trip",
+            "expected": {
+                "build_id": build_id,
+                "after_create_is_set": after_create is not None,
+                "after_merge_is_none": after_merge is None,
+            },
+        },
+    ]
+
+    # error texts: merge failure mapping
+    def fail_run(cmd, **kwargs):
+        if cmd[1] == "merge":
+            return subprocess.CompletedProcess(cmd, 128, "", "fatal: not something we can merge")
+        return subprocess.CompletedProcess(cmd, 0, "", "")
+    bm.subprocess.run = fail_run
+    mgr2 = bm.BuildManager()
+    mgr2.state = bm.BuildState(
+        build_id="20261007-182800", description="error battery",
+        created_at=FROZEN)
+    wt = "/home/nick/.rune/worktrees/20261007-182800"
+    mgr2.state.worktree_path = wt  # merge_worktree requires a live worktree path
+    try:
+        mgr2.merge_worktree()
+        merge_err = None
+    except RuntimeError as ex:
+        merge_err = str(ex)
+    cases.append({
+        "fn": "error", "name": "merge_failure_text",
+        "expected": {"error": merge_err},
+    })
+
+    def fail_create(cmd, **kwargs):
+        if cmd[1] == "worktree":
+            return subprocess.CompletedProcess(cmd, 128, "", "'x' already exists")
+        return subprocess.CompletedProcess(cmd, 0, "", "")
+    bm.subprocess.run = fail_create
+    mgr3 = bm.BuildManager()
+    mgr3.state = bm.BuildState(
+        build_id="20261007-182800", description="error battery 2",
+        created_at=FROZEN)
+    mgr3._save_state()
+    try:
+        mgr3.create_worktree()
+        create_err = None
+    except RuntimeError as ex:
+        create_err = str(ex)
+    cases.append({
+        "fn": "error", "name": "create_failure_text",
+        "expected": {"error": create_err},
+    })
+
+    out = {
+        "oracle": "src/rune/build_mode.py (live BuildManager on a real tmp git repo, clock frozen)",
+        "generated": "2026-10-07",
+        "frozen_now": FROZEN,
+        "cases": cases,
+    }
+    target = REPO / "src/go/build-mode" / "truth_worktree.json"
+    target.write_text(json.dumps(out, indent=1, ensure_ascii=False) + "\n")
+    print(f"wrote {target} ({len(cases)} cases)")
+
+
+def make_git_repo():
+    root = tempfile.mkdtemp(prefix="bm-wt-truth-")
+    env_realloc = subprocess.run(
+        ["git", "init", "-q"], cwd=root, capture_output=True, text=True)
+    assert env_realloc.returncode == 0
+    subprocess.run(["git", "config", "user.email", "t@t"], cwd=root, capture_output=True)
+    subprocess.run(["git", "config", "user.name", "t"], cwd=root, capture_output=True)
+    (Path(root) / "seed.txt").write_text("seed\n")
+    subprocess.run(["git", "add", "."], cwd=root, capture_output=True)
+    subprocess.run(["git", "commit", "-qm", "seed"], cwd=root, capture_output=True)
+    return root
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_cache_hash_truth.py

@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+"""gen_cache_hash_truth.py — factory batch 6 truth battery (live cache._hash)."""
+
+import json
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+sys.path.insert(0, str(REPO / "src" / "rune"))
+
+import cache as ch  # noqa: E402
+
+
+def main():
+    cases = [
+        {"fn": "hash", "name": "ascii", "input": {"text": s},
+         "expected": {"hash": ch._hash(s)}}
+        for s in ["", "hello world", "unicode ümlaut ✅", "a" * 500]
+    ]
+    comp_inputs = [
+        "",
+        "# comment\n\nreal line here\n====\n// slash comment\n(_source_: x)\n[source: y]\ntiny\nkeep this line too\n\n" + "z" * 900,
+        "line one\nline two\nline three",
+        "====",
+        "ab\ncdefgh",
+    ]
+    for i, s in enumerate(comp_inputs):
+        cases.append({"fn": "compress", "name": f"compress_{i}",
+                      "input": {"text": s},
+                      "expected": {"compressed": ch._compress(s)}})
+    out = {"oracle": "cache._hash", "generated": "2026-10-07", "cases": cases}
+    (REPO / "src/go/cache" / "truth_hash.json").write_text(json.dumps(out, indent=1) + "\n")
+    print(f"wrote {len(cases)} cases")
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_curator_lexicon_truth.py

@@ -0,0 +1,161 @@
+#!/usr/bin/env python3
+"""gen_curator_lexicon_truth.py — regenerate the lexicon truth batteries
+(contract BUILDER-2026-10-07T16:31:17Z-997c9d).
+
+Why: batch 1's truth.json encoded the LEXICON DEGRADE — the phantom shadow
+("lexicon module unavailable — strength gate only") — because
+lexicon_evolution.py was absent when it was generated. The phantom has now
+been recovered from provenance (commit 5749029), so the LIVE oracle returns
+real lexicon verdicts and the Go port must match THEM.
+
+What this does:
+1. Rewrites ONLY the fn=='le_promote_eligible' cases inside truth.json,
+   regenerated against the live curator.le_promote_eligible (which now
+   delegates to the recovered lexicon_evolution). Other cases untouched.
+2. Emits truth_lexicon.json — direct live-oracle cases for the recovered
+   module's full surface: coherence (conflict/consistent/novel), grounded,
+   distinctive_terms, promote_eligible (shared / novel-grounded /
+   novel-parked / no-signal / strength-gate).
+
+Note on `existing`: the truth carries the block values as a single string;
+the oracle is called with a one-element list ([existing]) — the batch-1
+convention, documented here so the Go test wraps identically.
+
+Usage: python3 scripts/gen_curator_lexicon_truth.py   (from repo root)
+"""
+
+import json
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+sys.path.insert(0, str(REPO / "src" / "rune"))
+
+from rune import curator  # noqa: E402 — live oracle (imports lexicon_evolution)
+import lexicon_evolution as le  # noqa: E402
+
+
+def main():
+    core = REPO / "src/go/curator-core"
+
+    # ── 1. regenerate the le_promote_eligible cases in truth.json ──────────
+    truth_path = core / "truth.json"
+    truth = json.loads(truth_path.read_text())
+    replaced = 0
+    for case in truth:
+        if case.get("fn") != "le_promote_eligible":
+            continue
+        inp = case["input"]
+        r = curator.le_promote_eligible(
+            inp["proposal"],
+            [inp["existing"]],
+            inp["strength"],
+            min_strength=3,
+            wash_count=inp["wash_count"],
+        )
+        case["expected"] = {"eligible": r}
+        replaced += 1
+    assert replaced >= 4, f"expected >=4 le cases, found {replaced}"
+    # Self-check: no case may still encode the degrade shadow.
+    for case in truth:
+        if case.get("fn") == "le_promote_eligible":
+            assert "lexicon module unavailable" not in json.dumps(case["expected"]), case["name"]
+    truth_path.write_text(json.dumps(truth, indent=1, ensure_ascii=False) + "\n")
+    print(f"truth.json: {replaced} le_promote_eligible cases regenerated (live lexicon)")
+
+    # ── 2. the direct lexicon-surface battery ──────────────────────────────
+    corpus = [
+        "nick writes Go and Rust code daily in the rune repository",
+        "the curator gates memory writes through worthiness and grading",
+        "migration of modules follows the dichotomy: reactive goes Go, deterministic goes Rust",
+    ]
+
+    cases = []
+
+    def add(fn, name, inp, expected):
+        cases.append({"fn": fn, "name": name, "input": inp, "expected": expected})
+
+    # coherence: conflict (distinctive shared term + negation ON it)
+    add("coherence", "conflict",
+        {"fact": "nick never writes Rust code", "existing": ["nick writes Go and Rust code daily"],
+         "corpus": corpus},
+        {"verdict": le.coherence("nick never writes Rust code",
+                                 ["nick writes Go and Rust code daily"], corpus)})
+    # coherence: consistent (distinctive shared term, no negation)
+    add("coherence", "consistent",
+        {"fact": "nick writes Rust code on weekends", "existing": ["nick writes Go and Rust code daily"],
+         "corpus": corpus},
+        {"verdict": le.coherence("nick writes Rust code on weekends",
+                                 ["nick writes Go and Rust code daily"], corpus)})
+    # coherence: novel (nothing distinctive shared)
+    add("coherence", "novel_axis",
+        {"fact": "nick plays bass guitar in a band", "existing": ["nick writes Go and Rust code daily"],
+         "corpus": corpus},
+        {"verdict": le.coherence("nick plays bass guitar in a band",
+                                 ["nick writes Go and Rust code daily"], corpus)})
+    # coherence: common word only is NEVER a relation
+    add("coherence", "common_word_not_relation",
+        {"fact": "nick likes black coffee", "existing": ["black holes bend light"],
+         "corpus": ["black coffee in the morning", "black holes bend light"]},
+        {"verdict": le.coherence("nick likes black coffee", ["black holes bend light"],
+                                 ["black coffee in the morning", "black holes bend light"])})
+    # coherence: empty existing -> novel
+    add("coherence", "empty_existing",
+        {"fact": "nick writes Rust code daily", "existing": [], "corpus": []},
+        {"verdict": le.coherence("nick writes Rust code daily", [], [])})
+
+    # grounded: stem-aware (migrated matches migration)
+    add("grounded", "stem_match",
+        {"fact": "nick migrated the modules", "sources": corpus},
+        {"grounded": le.grounded("nick migrated the modules", corpus)})
+    add("grounded", "invented_token",
+        {"fact": "nick collects vintage railway timetables", "sources": corpus},
+        {"grounded": le.grounded("nick collects vintage railway timetables", corpus)})
+    add("grounded", "empty_sources",
+        {"fact": "nick migrated the modules", "sources": []},
+        {"grounded": le.grounded("nick migrated the modules", [])})
+
+    # distinctive_terms: rare survives, common does not
+    add("distinctive_terms", "rare_vs_common",
+        {"fact": "nick writes Rust code daily", "corpus": corpus},
+        {"terms": sorted(le.distinctive_terms("nick writes Rust code daily", corpus))})
+
+    # promote_eligible: the four verdict shapes
+    add("promote_eligible", "strength_gate",
+        {"proposal": "add support for retries", "existing": ["support for retries in the fetch loop"],
+         "strength": 2, "min_strength": 3, "corpus": []},
+        {"eligible": le.promote_eligible("add support for retries",
+                                         ["support for retries in the fetch loop"], 2, 3, ())})
+    add("promote_eligible", "shared_distinctive",
+        {"proposal": "add retries to the fetch loop", "existing": ["support for retries in the fetch loop"],
+         "strength": 3, "min_strength": 3, "corpus": []},
+        {"eligible": le.promote_eligible("add retries to the fetch loop",
+                                         ["support for retries in the fetch loop"], 3, 3, ())})
+    add("promote_eligible", "novel_grounded",
+        {"proposal": "the curator gates every memory write", "existing": ["nick writes Go and Rust code daily"],
+         "strength": 3, "min_strength": 3, "corpus": corpus},
+        {"eligible": le.promote_eligible("the curator gates every memory write",
+                                         ["nick writes Go and Rust code daily"], 3, 3, corpus)})
+    add("promote_eligible", "novel_parked",
+        {"proposal": "nick collects vintage railway timetables", "existing": ["nick writes Go and Rust code daily"],
+         "strength": 3, "min_strength": 3, "corpus": corpus},
+        {"eligible": le.promote_eligible("nick collects vintage railway timetables",
+                                         ["nick writes Go and Rust code daily"], 3, 3, corpus)})
+    add("promote_eligible", "first_principle",
+        {"proposal": "parking is never wrong for growth", "existing": [],
+         "strength": 3, "min_strength": 3, "corpus": []},
+        {"eligible": le.promote_eligible("parking is never wrong for growth", [], 3, 3, ())})
+
+    out = {
+        "oracle": "src/rune/lexicon_evolution.py (recovered provenance 0308ccc6) via curator.py",
+        "generated": "2026-10-07 (post-recovery regeneration)",
+        "cases": cases,
+    }
+    (core / "truth_lexicon.json").write_text(
+        json.dumps(out, indent=1, ensure_ascii=False) + "\n")
+    print(f"truth_lexicon.json: {len(cases)} cases")
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_drift_fama_truth.py

@@ -0,0 +1,51 @@
+"""gen_drift_fama_truth.py — factory batch 12 truth battery (live oracle)."""
+import json
+import sqlite3
+import sys
+import tempfile
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+sys.path.insert(0, str(REPO / "src" / "rune"))
+
+import drift_core as dc  # noqa: E402
+
+
+def main():
+    tmp = Path(tempfile.mkdtemp(prefix="fama-truth-"))
+    db = sqlite3.connect(str(tmp / "t.db"))
+    db.row_factory = sqlite3.Row
+    db.execute("CREATE TABLE entries (id INTEGER PRIMARY KEY, status TEXT, rock_status TEXT, wash_count INTEGER)")
+    rows = [
+        (1, "active", "washable", 5),      # valid (wash>0)
+        (2, "active", "established", 0),   # valid (established)
+        (3, "active", "rock", 0),          # valid (rock)
+        (4, "active", "washable", 0),      # INVALID (active, no wash, washable)
+        (5, "superseded", "washable", 9),  # invalid (not active)
+    ]
+    db.executemany("INSERT INTO entries VALUES (?,?,?,?)", rows)
+    db.commit()
+
+    cases = []
+    for name, ids in [("all_valid", [1, 2, 3]), ("mixed", [1, 2, 4]),
+                      ("with_missing", [1, 999]), ("empty", []),
+                      ("all_invalid", [4, 5])]:
+        fetched = []
+        for eid in ids:
+            r = db.execute("SELECT status, rock_status, wash_count FROM entries WHERE id=?", (eid,)).fetchone()
+            if r:
+                fetched.append(dict(r))
+        cases.append({
+            "fn": "fama", "name": name,
+            "input": {"rows": fetched, "count": len(ids)},
+            "expected": {"fama": dc.compute_fama(db, "q", ids)},
+        })
+
+    out = {"oracle": "drift_core.compute_fama (live)", "generated": "2026-10-08", "cases": cases}
+    (REPO / "src/go/drift-core" / "truth_fama.json").write_text(json.dumps(out, indent=1) + "\n")
+    print(f"wrote {len(cases)} cases")
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_drift_value_truth.py

@@ -0,0 +1,62 @@
+#!/usr/bin/env python3
+"""gen_drift_value_truth.py — factory batch 10 truth battery (live oracle)."""
+
+import json
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+sys.path.insert(0, str(REPO / "src" / "rune"))
+
+import drift_core as dc  # noqa: E402
+
+NOW = "2026-10-08T00:30:00+00:00"
+
+
+def main():
+    entries = [
+        # fresh, low everything
+        {"wash_count": 0, "importance": 0.5, "text": "unproven entry", "rock_status": "washable"},
+        # high proven, recent access
+        {"wash_count": 25, "importance": 0.9, "text": "proven entry", "rock_status": "washable",
+         "last_accessed": "2026-10-07T20:00:00+00:00"},
+        # proven but stale (30+ days)
+        {"wash_count": 30, "importance": 0.8, "text": "stale entry", "rock_status": "washable",
+         "last_accessed": "2026-08-01T10:00:00+00:00"},
+        # already rock
+        {"wash_count": 40, "importance": 0.9, "text": "rocked", "rock_status": "rock"},
+        # bad timestamp (degrade path)
+        {"wash_count": 22, "importance": 0.7, "text": "bad ts", "rock_status": "washable",
+         "last_accessed": "not-a-date"},
+        # goal relevance hit
+        {"wash_count": 21, "importance": 0.6, "text": "the curator gates memory writes",
+         "rock_status": "washable", "last_accessed": "2026-10-06T00:00:00+00:00"},
+    ]
+    goals = ["curator memory writes", "gate the pipeline"]
+    cases = []
+    for i, e in enumerate(entries):
+        cases.append({
+            "fn": "value", "name": f"value_{i}", "input": {"entry": e},
+            "expected": {"value": dc._py_compute_value(e, None, NOW)},
+        })
+        cases.append({
+            "fn": "promo", "name": f"promo_{i}", "input": {"entry": e},
+            "expected": {"eligible": dc._py_check_promotion_eligibility(e, NOW)[0],
+                         "reason": dc._py_check_promotion_eligibility(e, NOW)[1]},
+        })
+    # goal-relevance path
+    cases.append({
+        "fn": "value", "name": "with_goals", "input": {"entry": entries[5], "goals": goals},
+        "expected": {"value": dc._py_compute_value(entries[5], goals, NOW)},
+    })
+
+    out = {"oracle": "drift_core._py_* oracles", "generated": "2026-10-08",
+           "frozen_now": NOW, "cases": cases}
+    (REPO / "src/go/drift-core" / "truth_value.json").write_text(
+        json.dumps(out, indent=1) + "\n")
+    print(f"wrote {len(cases)} cases")
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_event_bus_truth.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+"""gen_event_bus_truth.py — factory batch 9 truth battery (live oracle)."""
+
+import json
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+sys.path.insert(0, str(REPO / "src" / "rune"))
+
+import event_bus as eb  # noqa: E402
+
+
+def main():
+    payloads = [
+        {},
+        {"k": "v"},
+        {"task_id": "t1", "status": "failed", "count": 3},
+        {"nested": {"a": [1, 2, "x"]}, "flag": True, "nothing": None},
+        {"text": "quote\" inside\\ back\nnewline\ttab"},
+        {"float_int": 1.0, "float_frac": 2.5},
+    ]
+    cases = [
+        {"fn": "hash", "name": f"payload_{i}", "input": {"payload": p},
+         "expected": {"hash": eb._content_hash(p)}}
+        for i, p in enumerate(payloads)
+    ]
+    out = {"oracle": "event_bus._content_hash", "generated": "2026-10-07", "cases": cases}
+    (REPO / "src/go/event-bus" / "truth_bus.json").write_text(json.dumps(out, indent=1) + "\n")
+    print(f"wrote {len(cases)} cases")
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_hook_placement_truth.py

@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+"""gen_hook_placement_truth.py — factory batch 4 truth battery
+(contract BUILDER-2026-10-07T23:06:18Z-ec6208).
+
+The LIVE recommend_placement oracle over a factor matrix covering every
+branch: hook-point combos, frequency ladder, cache scopes, concurrency,
+failure modes, context budget.
+
+Usage: python3 scripts/gen_hook_placement_truth.py   (from repo root)
+"""
+
+import json
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+sys.path.insert(0, str(REPO / "src" / "rune"))
+
+import hook_engine as he  # noqa: E402
+
+
+def main():
+    factor_sets = [
+        {"output_dep": True},
+        {"input_dep": True},
+        {"input_dep": True, "output_dep": True},
+        {},
+        {"side_effects": "read-write"},
+        {"volatility": "session"},
+        {"volatility": "per-turn"},
+        {"scope": "persistent"},
+        {"scope": "session"},
+        {"concurrent": True},
+        {"failure": "fail-loud"},
+        {"context_budget": 500},
+        {"input_dep": True, "scope": "session", "concurrent": True,
+         "context_budget": 250},
+        {"side_effects": "read-write", "failure": "fail-loud",
+         "scope": "persistent"},
+    ]
+    cases = []
+    for i, factors in enumerate(factor_sets):
+        cases.append({
+            "fn": "placement", "name": f"matrix_{i}",
+            "input": {"factors": factors},
+            "expected": he.recommend_placement(f"hook_{i}", factors),
+        })
+
+    out = {
+        "oracle": "src/rune/hook_engine.py recommend_placement (live)",
+        "generated": "2026-10-07",
+        "cases": cases,
+    }
+    target = REPO / "src/go/hook-engine" / "truth_placement.json"
+    target.write_text(json.dumps(out, indent=1, ensure_ascii=False) + "\n")
+    print(f"wrote {target} ({len(cases)} cases)")
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_memory_store_gate_truth.py

@@ -0,0 +1,118 @@
+#!/usr/bin/env python3
+"""gen_memory_store_gate_truth.py — memory-store batch 4 truth battery
+(contract BUILDER-2026-10-07T19:47:37Z-1cf1dc).
+
+The LIVE oracle: the dense-side meta-judgement extracted from recall()
+(lines 655-676) exercised against a FIXTURE STORE (sqlite entries + df
+counts), plus the entries-side fusion vs the chunk-side one (identity
+check), plus the abstain constants.
+
+Usage: python3 scripts/gen_memory_store_gate_truth.py   (from repo root)
+"""
+
+import json
+import sqlite3
+import sys
+import tempfile
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+sys.path.insert(0, str(REPO / "src" / "rune"))
+
+import memory_store as ms  # noqa: E402
+
+
+def make_fixture_store(db_path):
+    """Entries table + df data mirroring recall()'s df-of-word query."""
+    db = sqlite3.connect(db_path)
+    db.row_factory = sqlite3.Row
+    db.execute("CREATE TABLE entries (id INTEGER PRIMARY KEY, text TEXT, status TEXT)")
+    rows = [
+        (1, "the curator gates memory writes through worthiness"),
+        (2, "black holes bend light near the event horizon"),
+        (3, "black coffee in the morning keeps nick running"),
+        (4, "the spine rebuild parity proofs live in store"),
+        (5, "memory writes require the operator approval gate"),
+        (6, "unrelated filler text about weather patterns"),
+        (7, "curator provenance recovery from odysseus"),
+        (8, "another filler row to pad the document frequency"),
+    ]
+    db.executemany("INSERT INTO entries VALUES (?,?,?)",
+                   [(i, t, "active") for (i, t) in rows])
+    db.commit()
+    return db
+
+
+def main():
+    tmp = Path(tempfile.mkdtemp(prefix="ms-gate-truth-"))
+    db = make_fixture_store(str(tmp / "store.db"))
+    total = db.execute("SELECT COUNT(*) AS n FROM entries WHERE status='active'").fetchone()["n"]
+
+    def df_of(word):
+        return db.execute(
+            "SELECT COUNT(*) AS n FROM entries WHERE status='active' AND text LIKE ?",
+            (f"%{word}%",),
+        ).fetchone()["n"]
+
+    # replicate recall()'s dense-gate block verbatim
+    def oracle_gate(query, hits):
+        q_content = {t for t in query.lower().split() if len(t) > 3 and t not in ms._STOPWORDS}
+        dense = []
+        for rowid, cos in hits:
+            etxt = (db.execute("SELECT text FROM entries WHERE id=?", (rowid,)).fetchone()["text"] or "").lower()
+            distinctive = [w for w in q_content if w in etxt and df_of(w) / total < 0.05]
+            if distinctive:
+                dense.append((rowid, cos))
+            elif not q_content or cos >= 0.80:
+                dense.append((rowid, cos))
+        return dense
+
+    cases = []
+
+    def add(fn, name, inp, expected):
+        cases.append({"fn": fn, "name": name, "input": inp, "expected": expected})
+
+    # gate: shared DISTINCTIVE word (curator: df=2/8=0.25? no — check)
+    # df(curator) = rows 1,7 = 2 → 0.25 ≥ 0.05 → NOT distinctive!
+    # The oracle's threshold means common-store words fail; only truly
+    # rare words pass. Fixture exercise:
+    for name, query, hits in [
+        ("distinctive_shared", "worthiness gates", [(1, 0.9), (2, 0.85)]),
+        ("common_word_falls_back", "black", [(2, 0.86), (3, 0.79)]),
+        ("strong_cos_no_share", "unrelated query terms", [(6, 0.91), (4, 0.70)]),
+        ("no_content_words", "the was and", [(1, 0.60), (6, 0.95)]),
+    ]:
+        add("dense_gate", name,
+            {"query": query, "hits": [[r, c] for r, c in hits], "total": total},
+            {"kept": [[r, c] for r, c in oracle_gate(query, hits)],
+             "q_content": sorted({t for t in query.lower().split() if len(t) > 3 and t not in ms._STOPWORDS}),
+             "df": {w: df_of(w) for w in query.lower().split() if len(w) > 3}})
+
+    # entries-side fusion identity with the chunk-side one
+    dense = [[1, 0.9], [2, 0.8]]
+    bm25 = [[2, 10.0], [3, 4.0]]
+    add("fusion_identity", "entries_eq_chunks",
+        {"dense": dense, "bm25": bm25},
+        {"fusion": ms._py_rank_fusion(dense, bm25)})
+
+    add("constants", "abstain",
+        {},
+        {"budget": ms.RECALL_BUDGET, "min_score": ms.RECALL_MIN_SCORE})
+
+    import shutil
+    shutil.rmtree(tmp, ignore_errors=True)
+
+    out = {
+        "oracle": "src/rune/memory_store.py recall() dense gate + _py_rank_fusion",
+        "generated": "2026-10-07",
+        "fixture_df_note": "df via LIKE-substring over active entries; threshold 0.05",
+        "cases": cases,
+    }
+    target = REPO / "src/go/memory-store-deep" / "truth_gate.json"
+    target.write_text(json.dumps(out, indent=1, ensure_ascii=False) + "\n")
+    print(f"wrote {target} ({len(cases)} cases)")
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_memory_store_score_truth.py

@@ -0,0 +1,107 @@
+#!/usr/bin/env python3
+"""gen_memory_store_score_truth.py — memory-store batch 3 truth battery
+(contract BUILDER-2026-10-07T18:57:06Z-c2429c).
+
+The LIVE _py_score_recall_rows oracle: metadata scoring across modes
+(hybrid / dense-only / lexical-only), recency decay, the abstention
+ladder (min_score gates, the 0.74 high-confidence gate, the 0.08 gap
+detection), position-aware re-rank.
+
+Usage: python3 scripts/gen_memory_store_score_truth.py   (from repo root)
+"""
+
+import json
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+sys.path.insert(0, str(REPO / "src" / "rune"))
+
+import memory_store as ms  # noqa: E402
+
+NOW = "2026-10-07T18:58:00"
+
+
+def rows_for(ids):
+    """Fixture rows: confidence/temperature/recency variety."""
+    out = []
+    for i, eid in enumerate(ids):
+        out.append({
+            "id": eid,
+            "text": f"entry {eid} body",
+            "importance": 0.5 + i * 0.01,
+            "topic": "project",
+            "entities": ["a"],
+            "source": "fixture",
+            "confidence": 0.9 if i % 2 == 0 else 0.6,
+            "temperature": 1.2 if i % 3 == 0 else 0.8,
+            "last_accessed": ["2026-10-07T18:00:00", "2026-09-01T10:00:00",
+                              "2026-05-01T10:00:00", None][i % 4],
+        })
+    return out
+
+
+def main():
+    cases = []
+
+    def add(fn, name, inp, expected):
+        cases.append({"fn": fn, "name": name, "input": inp, "expected": expected})
+
+    # hybrid: ranks over 4 rows, dense + bm25 present
+    fusion = {"ranks": [[1, 0.12], [2, 0.11], [3, 0.10], [4, 0.09]],
+              "best_dense": 0.8, "mode": "hybrid"}
+    dense = [[1, 0.8], [2, 0.7], [3, 0.6]]
+    bm25 = [[2, 10.0], [4, 5.0], [1, 2.0]]
+    rows = rows_for([1, 2, 3, 4])
+    add("score", "hybrid",
+        {"fusion": fusion, "rows": rows, "dense": dense, "bm25": bm25,
+         "budget": 3, "min_score": 0.3, "now": NOW},
+        {"scored": ms._py_score_recall_rows(fusion, rows, dense, bm25, 3, 0.3, NOW)})
+
+    # dense-only: high confidence (>= 0.74) → position-aware
+    fusion_d = {"ranks": [[1, 0.06], [2, 0.055], [3, 0.05]],
+                "best_dense": 0.8, "mode": "dense-only"}
+    add("score", "dense_only_high_conf",
+        {"fusion": fusion_d, "rows": rows_for([1, 2, 3]), "dense": dense,
+         "bm25": [], "budget": 5, "min_score": 0.3, "now": NOW},
+        {"scored": ms._py_score_recall_rows(fusion_d, rows_for([1, 2, 3]), dense, [], 5, 0.3, NOW)})
+
+    # dense-only: narrow gap → abstain
+    dense_close = [[1, 0.80], [2, 0.75]]
+    add("score", "dense_only_gap_abstain",
+        {"fusion": fusion_d, "rows": rows_for([1, 2, 3]), "dense": dense_close,
+         "bm25": [], "budget": 5, "min_score": 0.3, "now": NOW},
+        {"scored": ms._py_score_recall_rows(fusion_d, rows_for([1, 2, 3]), dense_close, [], 5, 0.3, NOW)})
+
+    # dense-only: below min_score → abstain
+    add("score", "dense_only_min_score",
+        {"fusion": fusion_d, "rows": rows_for([1, 2, 3]), "dense": dense,
+         "bm25": [], "budget": 5, "min_score": 0.9, "now": NOW},
+        {"scored": ms._py_score_recall_rows(fusion_d, rows_for([1, 2, 3]), dense, [], 5, 0.9, NOW)})
+
+    # lexical-only: max relevance gate
+    fusion_l = {"ranks": [[2, 0.9], [4, 0.7]], "best_dense": 0.0, "mode": "lexical-only"}
+    add("score", "lexical_only_gate",
+        {"fusion": fusion_l, "rows": rows_for([2, 4]), "dense": [], "bm25": bm25,
+         "budget": 5, "min_score": 1.0, "now": NOW},
+        {"scored": ms._py_score_recall_rows(fusion_l, rows_for([2, 4]), [], bm25, 5, 1.0, NOW)})
+
+    # neither → []
+    add("score", "neither",
+        {"fusion": fusion_l, "rows": rows_for([2, 4]), "dense": [], "bm25": [],
+         "budget": 5, "min_score": 0.3, "now": NOW},
+        {"scored": ms._py_score_recall_rows(fusion_l, rows_for([2, 4]), [], [], 5, 0.3, NOW)})
+
+    out = {
+        "oracle": "src/rune/memory_store.py _py_score_recall_rows",
+        "generated": "2026-10-07",
+        "cases": cases,
+    }
+    target = REPO / "src/go/memory-store-deep" / "truth_score.json"
+    target.write_text(json.dumps(out, indent=1, ensure_ascii=False) + "\n")
+    print(f"wrote {target} ({len(cases)} cases)")
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_memory_store_truth2.py

@@ -0,0 +1,120 @@
+#!/usr/bin/env python3
+"""gen_memory_store_truth2.py — memory-store batch 2 truth battery
+(contract BUILDER-2026-10-07T18:05:47Z-152c16).
+
+The LIVE _py_* oracles of memory_store.py. Cases: FTS conjunctive builder
+(stopword filtering, fallback, 8-cap), chunk_text (recombine + hard-split),
+rank fusion (hybrid/dense-only/lexical-only), project_chunk_rows,
+map_reduce, fuse_results (dedup + scale-alignment).
+
+Usage: python3 scripts/gen_memory_store_truth2.py   (from repo root)
+"""
+
+import json
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+sys.path.insert(0, str(REPO / "src" / "rune"))
+
+import memory_store as ms  # noqa: E402
+
+
+def main():
+    cases = []
+
+    def add(fn, name, inp, expected):
+        cases.append({"fn": fn, "name": name, "input": inp, "expected": expected})
+
+    # ── FTS conjunctive ───────────────────────────────────────────────────
+    add("fts", "significant_terms",
+        {"query": "the curator gates memory writes"},
+        {"q": ms._py_fts_query_conjunctive("the curator gates memory writes")})
+    add("fts", "stopwords_dropped",
+        {"query": "the and was with nick"},
+        {"q": ms._py_fts_query_conjunctive("the and was with nick")})
+    add("fts", "short_fallback",
+        {"query": "go is fun ai"},
+        {"q": ms._py_fts_query_conjunctive("go is fun ai")})
+    long_q = "alpha beta gamma delta epsilon zeta eta theta iota kappa"
+    add("fts", "cap_eight",
+        {"query": long_q},
+        {"q": ms._py_fts_query_conjunctive(long_q)})
+    add("fts", "empty_returns_raw",
+        {"query": "a an of"},
+        {"q": ms._py_fts_query_conjunctive("a an of")})
+
+    # ── chunk_text ────────────────────────────────────────────────────────
+    small = "one paragraph only"
+    add("chunk", "under_size", {"text": small, "size": 1500, "overlap": 150},
+        {"chunks": ms._py_chunk_text(small, 1500, 150)})
+    para = "\n\n".join(f"paragraph {i} " + "x" * 40 for i in range(30))
+    add("chunk", "recombine", {"text": para, "size": 400, "overlap": 150},
+        {"chunks": ms._py_chunk_text(para, 400, 150)})
+    noline = "y" * 3000
+    add("chunk", "hard_split", {"text": noline, "size": 1000, "overlap": 150},
+        {"chunks": ms._py_chunk_text(noline, 1000, 150)})
+    add("chunk", "empty", {"text": "", "size": 1500, "overlap": 150},
+        {"chunks": ms._py_chunk_text("", 1500, 150)})
+
+    # ── rank fusion ───────────────────────────────────────────────────────
+    dense = [[1, 0.9], [2, 0.8], [3, 0.7]]
+    bm25 = [[2, 12.0], [4, 8.0], [1, 3.0]]
+    add("fuse_ranks", "hybrid", {"dense": dense, "bm25": bm25},
+        ms._py_rank_fusion(dense, bm25))
+    add("fuse_ranks", "dense_only", {"dense": dense, "bm25": []},
+        ms._py_rank_fusion(dense, []))
+    add("fuse_ranks", "lexical_only", {"dense": [], "bm25": bm25},
+        ms._py_rank_fusion([], bm25))
+    add("fuse_ranks", "neither", {"dense": [], "bm25": []},
+        ms._py_rank_fusion([], []))
+
+    # ── project_chunk_rows ────────────────────────────────────────────────
+    rows = [
+        {"rowid": 1, "chunk_id": "c1", "text": "t" * 500, "wing": "w1", "room": "r1",
+         "source_path": "a.md", "page": 3},
+        {"rowid": 2, "chunk_id": "c2", "text": "short", "wing": "w1", "room": "r1",
+         "source_path": "b.md"},
+    ]
+    ranks = {"2": 0.0625, "1": 0.05}
+    add("project", "budget_and_shape", {"ranks": ranks},
+        {"rows": ms._py_project_chunk_rows(ranks, rows, 6)})
+
+    # ── map_reduce ────────────────────────────────────────────────────────
+    entries = [{"id": i, "relevance": i * 0.1} for i in range(25)]
+    add("map_reduce", "top3_per_chunk", {"entries": entries, "chunk_size": 10},
+        {"mapped": ms._py_map_reduce(entries, 10)})
+    add("map_reduce", "under_threshold", {"entries": entries[:5], "chunk_size": 10},
+        {"mapped": ms._py_map_reduce(entries[:5], 10)})
+
+    # ── fuse_results ──────────────────────────────────────────────────────
+    ents = [
+        {"id": 1, "text": "nick prefers coffee", "topic": "human",
+         "relevance": 2.5, "confidence": 0.9},
+        {"id": 2, "text": "NICK  PREFERS COFFEE", "topic": "human",
+         "relevance": 1.1, "confidence": 0.8},  # dedup hit
+        {"id": 3, "text": "rune gates memory writes", "topic": "project",
+         "relevance": 5.6, "confidence": 0.95},
+    ]
+    res = [
+        {"chunk_id": "c1", "text": "the spine rebuild parity", "wing": "research",
+         "rrf": 0.0625, "confidence": 0.7},
+        {"chunk_id": "c2", "text": "curator provenance recovery", "wing": "research",
+         "rrf": 0.05},
+    ]
+    add("fuse_results", "dedup_scale_align", {"entries": ents, "research": res},
+        {"merged": ms._py_fuse_results(ents, res)})
+
+    out = {
+        "oracle": "src/rune/memory_store.py _py_* oracles",
+        "generated": "2026-10-07",
+        "cases": cases,
+    }
+    target = REPO / "src/go/memory-store-deep" / "truth_recall.json"
+    target.write_text(json.dumps(out, indent=1, ensure_ascii=False) + "\n")
+    print(f"wrote {target} ({len(cases)} cases)")
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_microkernel_truth.py

@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+"""gen_microkernel_truth.py — factory batch 8 truth battery (live oracle)."""
+
+import json
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+sys.path.insert(0, str(REPO / "src" / "rune"))
+
+import microkernel as mk  # noqa: E402
+
+FROZEN = "2026-10-07T23:35:00"
+
+
+def main():
+    mk.now_iso = lambda: FROZEN
+    cases = []
+
+    def snap(reg, name):
+        return {
+            "plugins": {k: {"active": v["active"], "registered_at": v["registered_at"]}
+                        for k, v in reg["plugins"].items()},
+            "capabilities": reg["capabilities"],
+            "hooks": reg["hooks"],
+        }
+
+    # register + resolve priority tie
+    import tempfile, os as _os
+    _tmpdb = _os.path.join(tempfile.mkdtemp(prefix="mk-truth-"), "registry.json")
+    mk.REGISTRY_DB = _tmpdb
+
+    def _snap():
+        return mk._load_registry()
+    mk.register({"name": "alpha", "capabilities": ["cap.a"], "priority": 50})
+    mk.register({"name": "beta", "capabilities": ["cap.a"], "priority": 10})
+    mk.register({"name": "gamma", "capabilities": ["cap.a"], "priority": 10, "auto_activate": False})
+    mk.register({"name": "delta", "hooks": {"pre-turn": True, "post-turn": False}})
+    cases.append({"fn": "state", "name": "after_registers", "input": {},
+                  "expected": snap(_snap(), "x")})
+    cases.append({"fn": "resolve", "name": "priority_active",
+                  "input": {"capability": "cap.a"},
+                  "expected": {"resolved": mk.resolve("cap.a")}})
+    cases.append({"fn": "resolve", "name": "unknown_cap",
+                  "input": {"capability": "cap.nope"},
+                  "expected": {"resolved": mk.resolve("cap.nope")}})
+
+    # unregister removes from indexes
+    mk.unregister("beta")
+    cases.append({"fn": "state", "name": "after_unregister", "input": {},
+                  "expected": snap(_snap(), "x")})
+    cases.append({"fn": "resolve", "name": "after_unregister",
+                  "input": {"capability": "cap.a"},
+                  "expected": {"resolved": mk.resolve("cap.a")}})
+
+    # error texts
+    err1 = mk.register({})
+    err2 = mk.unregister("nope")
+    cases.append({"fn": "errors", "name": "shapes", "input": {},
+                  "expected": {"register_empty": err1, "unregister_unknown": err2}})
+
+    out = {"oracle": "src/rune/microkernel.py (live)", "generated": "2026-10-07",
+           "frozen_now": FROZEN, "cases": cases}
+    (REPO / "src/go/microkernel" / "truth_microkernel.json").write_text(
+        json.dumps(out, indent=1) + "\n")
+    print(f"wrote {len(cases)} cases")
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_provider_format_truth.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+"""gen_provider_format_truth.py — factory batch 5 truth battery (live
+provider_registry._format_tools_* oracles)."""
+
+import json
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+sys.path.insert(0, str(REPO / "src" / "rune"))
+
+import provider_registry as pr  # noqa: E402
+
+
+def main():
+    tools = [
+        {"name": "read_file", "description": "Read a file",
+         "parameters": {"type": "object", "properties": {"path": {"type": "string"}}}},
+        {"name": "write_file", "description": "Write a file"},  # no parameters key
+    ]
+    cases = [
+        {"fn": "openai", "name": "shape", "input": {"tools": tools},
+         "expected": pr._format_tools_openai(tools)},
+        {"fn": "anthropic", "name": "shape", "input": {"tools": tools},
+         "expected": pr._format_tools_anthropic(tools)},
+    ]
+    out = {"oracle": "provider_registry._format_tools_*", "generated": "2026-10-07", "cases": cases}
+    target = REPO / "src/go/provider-registry" / "truth_format.json"
+    target.write_text(json.dumps(out, indent=1) + "\n")
+    print(f"wrote {target} ({len(cases)} cases)")
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_scaffold_close_truth.py

@@ -0,0 +1,130 @@
+#!/usr/bin/env python3
+"""gen_scaffold_close_truth.py — scaffold batch 3 truth battery
+(contract BUILDER-2026-10-07T18:42:38Z-52829e).
+
+The LIVE oracle: _py_close_quality bucket math + close_contract on a doc
+built through the real lifecycle (new_contract → transitions → snapshot →
+close). now() frozen at scaffold AND structural_store namespaces.
+
+Usage: python3 scripts/gen_scaffold_close_truth.py   (from repo root)
+"""
+
+import json
+import sys
+import tempfile
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+
+from rune import scaffold as sc  # noqa: E402
+from rune.structural_store import new_doc, add_entity  # noqa: E402
+
+FROZEN = "2026-10-07T18:46:00"
+
+
+def main():
+    sc.now = lambda: FROZEN
+    cases = []
+
+    # ── CloseQuality bucket math (direct, edge-covering) ──────────────────
+    inputs = {
+        "contract_id": "q1",
+        "phase": "superseding",
+        "affected_entities": ["module:a", "module:b"],
+        "expected_new_entities": ["module:new1", "module:new2"],
+        "predicted_existing_affected": ["module:c"],
+        "predicted_frontier": {
+            "level0_direct": ["module:a"],
+            "level1_obligations": ["module:d"],
+            "contracts": ["contract:x"],
+            "level2_verification": ["canary:v"],
+        },
+        "expected_runtime_effects": ["module:a/ctl", "module:zz/never"],
+        "observed_evidence": [
+            {"entity": "module:a", "source": "tests", "detail": "d" * 400, "authority": "pytest"},
+            {"entity": "module:new1", "source": "build", "detail": "created"},
+            {"entity": "module:surprise", "source": "runtime", "detail": "unplanned"},
+            {"entity": "", "source": "runtime", "detail": "no entity — ignored"},
+        ],
+        "now": FROZEN,
+    }
+    s = sc.Scaffold(Path(tempfile.mkdtemp()), "q")
+    cases.append({
+        "fn": "close_quality", "name": "buckets",
+        "input": {"inputs": inputs},
+        "expected": s._py_close_quality(inputs),
+    })
+
+    # ── CloseContract through the real lifecycle ──────────────────────────
+    tmp = Path(tempfile.mkdtemp(prefix="scaffold-close-truth-"))
+    s2 = sc.Scaffold(tmp, "close-project")
+    s2.init(purpose="close battery")
+    doc = s2.load()
+    s2.new_contract(doc, contract_id="c1", need="n", scope=["src/go/x/"],
+                    affected_entities=["module:a"],
+                    expected_new_entities=["module:new1"])
+    s2.transition_contract(doc, "c1", "approved")
+    s2.transition_contract(doc, "c1", "building")
+    s2.transition_contract(doc, "c1", "verifying")
+    # predicted frontier on the entity
+    e = s2.contract(doc, "c1")
+    e.setdefault("ext", {})["predicted_frontier"] = {
+        "level0_direct": ["module:a"], "level1_obligations": [],
+        "contracts": [], "level2_verification": [],
+    }
+    ev = [{"entity": "module:a", "source": "tests", "detail": "passed"}]
+    e2 = s2.close_contract(doc, "c1", observed_evidence=ev,
+                           scope_files=["src/go/x/main.go", "src/other/rogue.py"])
+    cases.append({
+        "fn": "close_contract", "name": "full_lifecycle",
+        "input": {},
+        "expected": {"entity": e2},
+    })
+
+    # phase gate
+    doc2 = new_doc()
+    add_entity(doc2, id="contract:early", kind="construction_contract",
+               identities={"need": "n"}, maturity="DECLARED",
+               evidence_refs=["x"])
+    doc2["entities"][-1]["phase"] = "draft"
+    doc2["entities"][-1]["status"] = "open"
+    doc2["entities"][-1]["checkpoints"] = []
+    try:
+        s2.close_contract(doc2, "early", observed_evidence=[])
+        gate = {"ok": True}
+    except Exception as ex:  # noqa: BLE001 — intentional: the case IS the gate error; the oracle's text becomes the truth column
+        gate = {"ok": False, "error": str(ex)}
+    cases.append({
+        "fn": "close_gate", "name": "phase_guard",
+        "input": {},
+        "expected": gate,
+    })
+
+    # missing contract
+    try:
+        s2.close_contract(doc2, "ghost", observed_evidence=[])
+        miss = {"ok": True}
+    except Exception as ex:  # noqa: BLE001 — intentional: same oracle-error-as-truth pattern as above
+        miss = {"ok": False, "error": str(ex)}
+    cases.append({
+        "fn": "close_gate", "name": "missing_contract",
+        "input": {},
+        "expected": miss,
+    })
+
+    out = {
+        "oracle": "src/rune/scaffold.py (live, now frozen at both namespaces)",
+        "generated": "2026-10-07",
+        "frozen_now": FROZEN,
+        "cases": cases,
+    }
+    target = REPO / "src/go/scaffold" / "truth_close.json"
+    target.write_text(json.dumps(out, indent=1, ensure_ascii=False) + "\n")
+    print(f"wrote {target} ({len(cases)} cases)")
+    import shutil
+    shutil.rmtree(tmp, ignore_errors=True)
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_scaffold_store_truth.py

@@ -0,0 +1,178 @@
+#!/usr/bin/env python3
+"""gen_scaffold_store_truth.py — scaffold batch 2 truth battery
+(contract BUILDER-2026-10-07T17:47:00Z-960f12).
+
+The LIVE oracle (scaffold.Scaffold + structural_store) on a tmp store with
+now() frozen. Cases: canonical digest stability + secret redaction, commit
+semantics (success + exact failure texts), verify_on_disk forgotten-save
+detection, impact frontier (contract_change / implementation_change /
+contextual), snapshot_predicted_frontier, spine_bridge_entity.
+
+Usage: python3 scripts/gen_scaffold_store_truth.py   (from repo root)
+"""
+
+import json
+import sys
+import tempfile
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+
+from rune import scaffold as sc  # noqa: E402
+from rune import structural_store as ss  # noqa: E402
+
+FROZEN = "2026-10-07T17:50:00"
+
+
+def main():
+    sc.now = lambda: FROZEN
+    ss.now = lambda: FROZEN
+
+    tmp = Path(tempfile.mkdtemp(prefix="scaffold-store-truth-"))
+    s = sc.Scaffold(tmp, "truth-project")
+    s.init(purpose="store battery")
+
+    cases = []
+
+    # ── canonical digest: stability + redaction ───────────────────────────
+    doc = s.load()
+    d1 = ss.canonical_digest(doc)
+    # key-order permutation must NOT change the digest (semantic content)
+    permuted = {k: doc[k] for k in reversed(list(doc.keys()))}
+    d2 = ss.canonical_digest(permuted)
+    cases.append({
+        "fn": "digest", "name": "key_order_stable",
+        "input": {},
+        "expected": {"digest": d1, "permuted_same": d2 == d1},
+    })
+    secret_doc = {"entities": [{"id": "repo:x", "identities": {
+        "token": "hunter2", "api_key": "sk-123", "full_name": "o/r",
+        "api_token": "zz", "password": "pw", "private_key": "-----BEGIN",
+        "note": "keepme", "my_secret_sauce": "redacted-too"}}]}
+    cases.append({
+        "fn": "digest", "name": "secret_redaction",
+        "input": {},
+        "expected": {"redacted": ss._redact_secrets(secret_doc)},
+    })
+
+    # ── commit: success + digest readback ─────────────────────────────────
+    s.commit(doc, what="battery")
+    cases.append({
+        "fn": "commit", "name": "success",
+        "input": {},
+        "expected": {"ok": True, "on_disk_schema": s.load()["schema_version"]},
+    })
+
+    # forgotten-save detection: mutate in memory, DON'T save
+    doc2 = s.load()
+    doc2["entities"].append({"id": "ghost:1", "kind": "ghost", "identities": {}})
+    try:
+        s.verify_on_disk(lambda d: d["entities"], None, what="battery") if False else None
+        # the real call: selector/expect form
+        s.verify_on_disk(lambda d: [e for e in d["entities"] if e["id"] == "ghost:1"],
+                         lambda v: bool(v), what="battery")
+        forgotten = {"ok": True}
+    except AssertionError as ex:
+        forgotten = {"ok": False, "error": str(ex)}
+    cases.append({
+        "fn": "verify_on_disk", "name": "forgotten_save",
+        "input": {},
+        "expected": forgotten,
+    })
+
+    # corrupt store -> commit-style load returns None -> reload failure path
+    # (simulate: point at a nonexistent path)
+    class FakeScaffold:
+        current = tmp / "nonexistent" / "current.json"
+    try:
+        ss_load = ss.load(FakeScaffold.current)
+        reload_none = ss_load is None
+    except Exception:  # noqa: BLE001 — intentional: the case IS the degrade verdict (load failure → loads_none=False); error text is not the truth column here
+        reload_none = False
+    cases.append({
+        "fn": "load", "name": "missing_store",
+        "input": {},
+        "expected": {"loads_none": reload_none},
+    })
+
+    # ── impact frontier ───────────────────────────────────────────────────
+    doc3 = new_frontier_doc()
+    cases.append({
+        "fn": "frontier", "name": "contract_change",
+        "input": {"seeds": ["contract:c1"], "doc": doc3},
+        "expected": ss.impact_frontier(doc3, ["contract:c1"]),
+    })
+    cases.append({
+        "fn": "frontier", "name": "implementation_change",
+        "input": {"seeds": ["module:impl_a"], "doc": doc3},
+        "expected": ss.impact_frontier(doc3, ["module:impl_a"]),
+    })
+    cases.append({
+        "fn": "frontier", "name": "violation_escalation",
+        "input": {"seeds": ["module:impl_a"], "change_kind": "contract_violation", "doc": doc3},
+        "expected": ss.impact_frontier(doc3, ["module:impl_a"], change_kind="contract_violation"),
+    })
+
+    # ── snapshot_predicted_frontier + spine bridge ────────────────────────
+    doc4 = new_frontier_doc()
+    s4 = sc.Scaffold(tmp / "p4", "frontier-project")
+    s4.init(purpose="frontier battery")
+    doc4 = s4.load()
+    s4.new_contract(doc4, contract_id="f1", need="n", scope=["src/"])
+    # wire the frontier doc entities into the project doc
+    doc4["entities"].extend(e for e in doc3["entities"] if e["id"] not in {x["id"] for x in doc4["entities"]})
+    doc4["relationships"].extend(doc3["relationships"])
+    frontier = s4.snapshot_predicted_frontier(doc4, "f1", ["contract:c1"])
+    e = s4.contract(doc4, "f1")
+    cases.append({
+        "fn": "snapshot_frontier", "name": "persisted",
+        "input": {"doc": doc4},
+        "expected": {
+            "frontier": frontier,
+            "checkpoint_note": e["checkpoints"][-1]["note"],
+            "ext_has": sorted((e.get("ext", {}).get("predicted_frontier") or {}).keys()),
+        },
+    })
+    cases.append({
+        "fn": "bridge", "name": "identity_only",
+        "input": {},
+        "expected": {"bridge": s4.spine_bridge_entity()},
+    })
+
+    out = {
+        "oracle": "src/rune/scaffold.py + structural_store.py (live, now frozen)",
+        "generated": "2026-10-07",
+        "frozen_now": FROZEN,
+        "cases": cases,
+    }
+    target = REPO / "src/go/scaffold" / "truth_store.json"
+    target.write_text(json.dumps(out, indent=1, ensure_ascii=False) + "\n")
+    print(f"wrote {target} ({len(cases)} cases)")
+    import shutil
+    shutil.rmtree(tmp, ignore_errors=True)
+
+
+def new_frontier_doc():
+    """A small structural doc exercising the frontier walk."""
+    doc = ss.new_doc()
+    ss.add_entity(doc, id="contract:c1", kind="contract", identities={})
+    ss.add_entity(doc, id="module:impl_a", kind="module", identities={})
+    ss.add_entity(doc, id="module:impl_b", kind="module", identities={})
+    ss.add_entity(doc, id="module:lib", kind="module", identities={})
+    ss.add_entity(doc, id="canary:x", kind="canary", identities={})
+    ss.add_entity(doc, id="deploy:live", kind="deployment", identities={})
+    for rel in (
+        {"type": "implements", "from": "module:impl_a", "to": "contract:c1"},
+        {"type": "implements", "from": "module:impl_b", "to": "contract:c1"},
+        {"type": "depends_on", "from": "module:impl_a", "to": "module:lib"},
+        {"type": "verified_by", "from": "contract:c1", "to": "canary:x"},
+        {"type": "deployed_as", "from": "module:impl_a", "to": "deploy:live"},
+        {"type": "supersedes", "from": "module:impl_b", "to": "module:impl_a"},  # non-obligation
+    ):
+        doc["relationships"].append(rel)
+    return doc
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_scaffold_truth.py

@@ -0,0 +1,152 @@
+#!/usr/bin/env python3
+"""gen_scaffold_truth.py — scaffold batch 1 truth battery
+(contract BUILDER-2026-10-07T17:27:25Z-6bc737).
+
+The LIVE Scaffold runs against a tmp store with now() frozen (module-patch
+on rune.scaffold's imported binding). Cases: the transition machine (legal
++ illegal + unknown phase, exact error texts), new_contract/transition_
+contract state evolution, check_scope (green/red/unknown), layout_
+obligations (FLEXIBLE vs USER-LOCKED), json_frontier projection.
+
+Usage: python3 scripts/gen_scaffold_truth.py   (from repo root)
+"""
+
+import json
+import sys
+import tempfile
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+
+from rune import scaffold as sc  # noqa: E402
+from rune.structural_store import new_doc, add_entity  # noqa: E402
+
+FROZEN = "2026-10-07T17:30:00"
+
+
+def main():
+    # Freeze the clock at scaffold's namespace binding.
+    sc.now = lambda: FROZEN
+
+    tmp = Path(tempfile.mkdtemp(prefix="scaffold-truth-"))
+    s = sc.Scaffold(tmp, "truth-project")
+    s.init(purpose="truth battery")
+
+    cases = []
+
+    # ── transition machine ────────────────────────────────────────────────
+    def tv(name, current, to):
+        try:
+            sc.Scaffold.transition_contract  # noqa: B018 — presence probe
+            # validate via a throwaway entity path
+            doc = new_doc()
+            e = s.new_contract(doc, contract_id="probe", need="probe")
+            if current != "draft":
+                e["phase"] = current
+            s.transition_contract(doc, "probe", to)
+            cases.append({"fn": "transition", "name": name,
+                          "input": {"current": current, "to": to},
+                          "expected": {"ok": True}})
+        except Exception as ex:  # noqa: BLE001 — intentional: the case IS the error verdict; the oracle's error text becomes the truth column
+            cases.append({"fn": "transition", "name": name,
+                          "input": {"current": current, "to": to},
+                          "expected": {"ok": False, "error": str(ex)}})
+
+    tv("legal_approved", "draft", "approved")
+    tv("legal_building", "approved", "building")
+    tv("legal_verifying", "building", "verifying")
+    tv("legal_migrating", "verifying", "migrating")
+    tv("legal_superseding", "migrating", "superseding")
+    tv("legal_closed", "superseding", "closed")
+    tv("legal_failed_retry", "failed", "building")
+    tv("legal_abandon", "building", "abandoned")
+    tv("illegal_closed_from_draft", "draft", "closed")
+    tv("illegal_rewind", "verifying", "draft")
+    tv("illegal_skip", "draft", "verifying")
+    tv("unknown_phase", "draft", "nonexistent_phase")
+
+    # ── contract lifecycle evolution ──────────────────────────────────────
+    doc = new_doc()
+    s.new_contract(doc, contract_id="life", need="port the lifecycle",
+                   origin="builder", scope=["src/go/scaffold/"],
+                   acceptance=["truth battery passes"])
+    e = s.transition_contract(doc, "life", "approved", evidence_ref="e1")
+    e = s.transition_contract(doc, "life", "building", evidence_ref="e2", note="x" * 300)
+    cases.append({
+        "fn": "lifecycle", "name": "evolution",
+        "input": {},
+        "expected": {"entity": e},
+    })
+
+    # duplicate contract
+    try:
+        s.new_contract(doc, contract_id="life", need="again")
+        dup = {"ok": True}
+    except ValueError as ex:
+        dup = {"ok": False, "error": str(ex)}
+    cases.append({"fn": "dup", "name": "duplicate", "input": {},
+                  "expected": dup})
+
+    # ── check_scope ───────────────────────────────────────────────────────
+    doc2 = new_doc()
+    s.new_contract(doc2, contract_id="scoped", need="n", scope=["src/go/a/", "src/go/b/main.go"])
+    e2 = s.contract(doc2, "scoped")
+    cases.append({
+        "fn": "check_scope", "name": "mixed",
+        "input": {"changed": ["src/go/a/x.go", "src/go/b/main.go", "src/other/f.py", "src/go/a/deep/y.go"], "scope": ["src/go/a/", "src/go/b/main.go"]},
+        "expected": s.check_scope(doc2, "scoped",
+                                  ["src/go/a/x.go", "src/go/b/main.go", "src/other/f.py", "src/go/a/deep/y.go"]),
+    })
+    doc3 = new_doc()
+    s.new_contract(doc3, contract_id="unscoped", need="n")
+    cases.append({
+        "fn": "check_scope", "name": "unscoped",
+        "input": {"changed": ["anything.py"], "scope": []},
+        "expected": s.check_scope(doc3, "unscoped", ["anything.py"]),
+    })
+
+    # ── layout obligations ────────────────────────────────────────────────
+    doc4 = new_doc()
+    add_entity(doc4, id="layout:panel", kind="layout_contract",
+               identities={"component": "Panel", "region": "sidebar",
+                           "implementation": "src/go/panel.go", "lock": False,
+                           "provenance": "scaffold"}, maturity="DECLARED")
+    add_entity(doc4, id="layout:header", kind="layout_contract",
+               identities={"component": "Header", "region": "top",
+                           "implementation": "src/go/header.go", "lock": True,
+                           "provenance": "user"}, maturity="DECLARED")
+    cases.append({
+        "fn": "layout", "name": "mixed_locks",
+        "input": {"affected": ["Panel", "region:top"], "doc": doc4},
+        "expected": {"obligations": s.layout_obligations(doc4, ["Panel", "region:top"])},
+    })
+    cases.append({
+        "fn": "layout", "name": "no_hit",
+        "input": {"affected": ["Unrelated"], "doc": doc4},
+        "expected": {"obligations": []},
+    })
+
+    # ── json_frontier ─────────────────────────────────────────────────────
+    f = {"contracts": ["c1"], "level2_verification": ["v1"]}
+    cases.append({
+        "fn": "frontier", "name": "projection",
+        "input": {"frontier": f},
+        "expected": {"json": sc.json_frontier(f)},
+    })
+
+    out = {
+        "oracle": "src/rune/scaffold.py (live Scaffold, now frozen)",
+        "generated": "2026-10-07",
+        "frozen_now": FROZEN,
+        "cases": cases,
+    }
+    target = REPO / "src/go/scaffold" / "truth_scaffold.json"
+    target.write_text(json.dumps(out, indent=1, ensure_ascii=False) + "\n")
+    print(f"wrote {target} ({len(cases)} cases)")
+    import shutil
+    shutil.rmtree(tmp, ignore_errors=True)
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_sleep_time_truth.py

@@ -0,0 +1,100 @@
+#!/usr/bin/env python3
+"""gen_sleep_time_truth.py — factory batch 11 truth battery (live oracle)."""
+
+import json
+import sqlite3
+import sys
+import tempfile
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+sys.path.insert(0, str(REPO / "src" / "rune"))
+
+import sleep_time as st  # noqa: E402
+
+
+def make_parts_db(db_path):
+    db = sqlite3.connect(db_path)
+    db.execute("CREATE TABLE part (session_id TEXT, data TEXT, time_created TEXT)")
+    rows = [
+        ("s1", '{"tool": "todowrite", "state": {"input": {"todos": [{"content": "first", "status": "completed", "priority": "high"}]}}}', "2026-10-07T10:00:00"),
+        ("s1", '{"tool": "bash", "state": {"input": {"command": "ls"}}}', "2026-10-07T10:01:00"),
+        ("s1", '{"tool": "todowrite", "state": {"input": {"todos": [{"content": "second", "status": "in_progress", "priority": "med"}, {"content": "third", "status": "pending", "priority": "low"}]}}}', "2026-10-07T10:02:00"),
+        ("s1", '{"tool": "todowrite", "state": {"input": {"todos": []}}}', "2026-10-07T10:03:00"),  # empty — skipped
+        ("s1", '{"tool": "read_file", "state": {"input": {}}}', "2026-10-07T10:04:00"),  # non-todowrite
+        ("s2", '{"tool": "todowrite", "state": {"input": {"todos": [{"content": "other session", "status": "pending", "priority": ""}]}}}', "2026-10-07T11:00:00"),
+    ]
+    db.executemany("INSERT INTO part VALUES (?,?,?)", rows)
+    db.commit()
+    return db
+
+
+def main():
+    tmp = Path(tempfile.mkdtemp(prefix="st-truth-"))
+    db = make_parts_db(str(tmp / "p.db"))
+
+    cases = []
+
+    # extract_todos for s1 (ORDER BY time ASC → latest = the 10:02 todos)
+    rows = [{"data": r[0]} for r in db.execute(
+        "SELECT data FROM part WHERE session_id='s1' ORDER BY time_created ASC").fetchall()]
+    cases.append({"fn": "extract_todos", "name": "s1_latest",
+                  "input": {"rows": rows},
+                  "expected": {"todos": st.extract_todos(
+                      _FakeConn(db, "s1"), "s1")}})
+    rows2 = [{"data": r[0]} for r in db.execute(
+        "SELECT data FROM part WHERE session_id='s2' ORDER BY time_created ASC").fetchall()]
+    cases.append({"fn": "extract_todos", "name": "s2",
+                  "input": {"rows": rows2},
+                  "expected": {"todos": st.extract_todos(
+                      _FakeConn(db, "s2"), "s2")}})
+    rows3 = [{"data": r[0]} for r in db.execute(
+        "SELECT data FROM part WHERE session_id='nope' ORDER BY time_created ASC").fetchall()]
+    cases.append({"fn": "extract_todos", "name": "empty_session",
+                  "input": {"rows": rows3},
+                  "expected": {"todos": st.extract_todos(
+                      _FakeConn(db, "nope"), "nope")}})
+
+    # write_transcript byte format
+    st.TRANSCRIPTS_DIR = str(tmp / "transcripts")
+    Path(st.TRANSCRIPTS_DIR).mkdir(parents=True, exist_ok=True)
+    todos = [{"content": "write the thing", "status": "completed", "priority": "high"},
+             {"content": "review it", "status": "in_progress", "priority": ""}]
+    parts = [("user", "do the task"), ("assistant", "done, verified")]
+    p1 = st.write_transcript("s1", "My Session: v2!", parts, todos)
+    cases.append({"fn": "transcript", "name": "full_shape",
+                  "input": {},
+                  "expected": {"content": Path(p1).read_text(),
+                               "filename_stem": Path(p1).name}})
+    p2 = st.write_transcript("s2", "no todos", parts, None)
+    cases.append({"fn": "transcript", "name": "no_todos",
+                  "input": {},
+                  "expected": {"content": Path(p2).read_text()}})
+
+    out = {"oracle": "sleep_time.extract_todos/write_transcript (live)",
+           "generated": "2026-10-08", "cases": cases}
+    (REPO / "src/go/sleep-time" / "truth_transcript.json").write_text(
+        json.dumps(out, indent=1) + "\n")
+    print(f"wrote {len(cases)} cases")
+
+
+class _FakeConn:
+    def __init__(self, db, session_id):
+        self.db = db
+        self.session_id = session_id
+
+    def execute(self, sql, params):
+        # replicate the oracle's query (session-filtered, time-ordered)
+        class Cur:
+            def __init__(self, rows):
+                self.rows = rows
+
+            def fetchall(self):
+                return self.rows
+
+        return Cur(self.db.execute(sql, params).fetchall())
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_tool_executor_auth_truth.py

@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+"""gen_tool_executor_auth_truth.py — the tool-executor authority truth
+(contract BUILDER-2026-10-07T19:10:38Z-cc6be2).
+
+Freezes the LIVE READ_ONLY_TOOLS set + the prepare-tool routing verdicts
+so CI asserts the Go set equals the Python set FOREVER. The run_command
+wrong-add this battery pins was a security-adjacent divergence: a mutating
+tool treated as read-only bypasses operator approval.
+
+Usage: python3 scripts/gen_tool_executor_auth_truth.py   (from repo root)
+"""
+
+import json
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+sys.path.insert(0, str(REPO / "src" / "rune"))
+
+import tool_executor as te  # noqa: E402
+
+
+def main():
+    cases = [
+        {
+            "fn": "read_only_tools", "name": "exact_set",
+            "input": {},
+            "expected": {"tools": sorted(te.READ_ONLY_TOOLS)},
+        },
+        {
+            "fn": "prepare_routing", "name": "run_command_requires_approval",
+            "input": {"tool": "run_command", "args": {"command": "ls -la"}},
+            "expected": {"read_only": "run_command" in te.READ_ONLY_TOOLS},
+        },
+        {
+            "fn": "prepare_routing", "name": "read_file_executes_now",
+            "input": {"tool": "read_file", "args": {"path": "/tmp"}},
+            "expected": {"read_only": "read_file" in te.READ_ONLY_TOOLS},
+        },
+    ]
+    out = {
+        "oracle": "src/rune/tool_executor.py READ_ONLY_TOOLS + routing",
+        "generated": "2026-10-07",
+        "cases": cases,
+    }
+    target = REPO / "src/go/tool-executor" / "truth_auth.json"
+    target.write_text(json.dumps(out, indent=1, ensure_ascii=False) + "\n")
+    print(f"wrote {target} ({len(cases)} cases)")
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_tool_executor_truth.py

@@ -0,0 +1,301 @@
+#!/usr/bin/env python3
+"""gen_tool_executor_truth.py — regenerate the tool-executor truth batteries
+HERMETICALLY (contract BUILDER-2026-10-07T16:11:35Z-70ca24-unknown).
+
+Why: the original batch-2/3/4 generators baked the generation host's temp
+paths (/mnt/workdrive/tmp*) into truth_fileops.json / truth_ops.json /
+truth_paths.json — inputs AND expectations. CI's runner user cannot read
+those paths, so the parity gate failed with permission-denied (go-surface,
+run 19792 job 56712) despite a locally green tree.
+
+Design (the environment leak, closed):
+- Fixtures are created at generation time under roots the ORACLE ITSELF
+  allows: read root = first creatable dir in ALLOWED_READ_DIRS (prefers
+  /tmp), write root = first creatable dir in ALLOWED_WRITE_DIRS.
+- Every occurrence of those roots — in inputs AND expectations — is
+  replaced with {{TMP}} / {{WROOT}} placeholders.
+- Each truth file carries a `fixtures` manifest (files + dirs) so the Go
+  test recreates the SAME fixture content under ITS OWN roots at runtime.
+  Both sides then run the same case semantics on their own environment;
+  substituted bytes must agree exactly.
+- The grep-hit comparison stays order-insensitive (sorted line sets) on the
+  Go side: the oracle's os.walk order is OS-scheduling dependent, not a
+  parity-relevant property. Everything else is exact after substitution.
+
+Oracle authority: src/rune/tool_executor.py is called LIVE for every case
+except the two cmd_gate verdicts whose oracle path would execute a shell
+command (plain_ok / shell_ok use harmless commands instead: "ls -la" and
+"true" — the gate branches they exercise do not inspect command content
+beyond non-emptiness).
+
+Usage: python3 scripts/gen_tool_executor_truth.py   (from repo root)
+"""
+
+import json
+import sys
+import tempfile
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+
+from rune import tool_executor as te  # noqa: E402 — the live oracle
+
+
+def mk_root(dirs, tag):
+    """First creatable temp dir under the given allowed dirs."""
+    for d in dirs:
+        try:
+            return tempfile.mkdtemp(prefix="rune-truth-", dir=d)
+        except OSError:
+            continue
+    raise RuntimeError(f"no creatable root among {dirs}")
+
+
+def build_fixtures(root):
+    """The shared fixture set: exactly what the cases observe."""
+    (Path(root) / "w.txt").write_text(
+        "".join(f"line {i}\n" for i in range(1, 21)), encoding="utf-8"
+    )
+    (Path(root) / "a.txt").write_text("the spine rebuild parity\n", encoding="utf-8")
+    (Path(root) / "b.log").write_text("spine appears here too\n", encoding="utf-8")
+    (Path(root) / "file.txt").write_text("content\n", encoding="utf-8")
+    (Path(root) / "adir").mkdir()
+    return {
+        "files": [
+            {"path": "{{TMP}}/w.txt",
+             "content": "".join(f"line {i}\n" for i in range(1, 21))},
+            {"path": "{{TMP}}/a.txt", "content": "the spine rebuild parity\n"},
+            {"path": "{{TMP}}/b.log", "content": "spine appears here too\n"},
+            {"path": "{{TMP}}/file.txt", "content": "content\n"},
+        ],
+        "dirs": ["{{TMP}}/adir"],
+    }
+
+
+def main():
+    read_root = mk_root(te.ALLOWED_READ_DIRS, "read")
+    write_root = mk_root(te.ALLOWED_WRITE_DIRS, "write")
+    fixtures = build_fixtures(read_root)
+
+    wpath = f"{read_root}/w.txt"
+    edited = "line 1\nCHANGED\n" + "".join(f"line {i}\n" for i in range(3, 21))
+
+    cases_fileops = [
+        {
+            "fn": "read_window", "name": "mid",
+            "input": {"path": f"{wpath}", "offset": 3, "limit": 5},
+            "expected": None,
+        },
+        {
+            "fn": "read_window", "name": "default",
+            "input": {"path": f"{wpath}"},
+            "expected": None,
+        },
+        {
+            "fn": "diff", "name": "simple",
+            "input": {"path": wpath, "new_content": edited},
+            "expected": None,
+        },
+    ]
+
+    r = te._read_file({"path": wpath, "offset": 3, "limit": 5})
+    assert r["success"] is True, r
+    cases_fileops[0]["expected"] = {"ok": True, "result": r["result"]}
+
+    r = te._read_file({"path": wpath})
+    assert r["success"] is True, r
+    cases_fileops[1]["expected"] = {
+        "ok": True, "lines": len(r["result"].split("\n")),
+    }
+
+    diff = te.generate_diff(Path(wpath), edited)
+    dlines = diff.split("\n")
+    cases_fileops[2]["expected"] = {
+        "diff_head": dlines[:3],
+        "has_minus": any(l.startswith("-line 2") for l in dlines),
+        "has_plus": any(l.startswith("+CHANGED") for l in dlines),
+    }
+
+    cases_ops = [
+        {
+            "fn": "list_dir", "name": "basic",
+            "input": {"path": read_root},
+            "expected": None,
+        },
+        {
+            "fn": "list_dir", "name": "pattern",
+            "input": {"path": read_root, "pattern": "*.txt"},
+            "expected": None,
+        },
+        {
+            "fn": "grep", "name": "hit",
+            "input": {"path": read_root, "pattern": "spine"},
+            "expected": None,
+        },
+        {
+            "fn": "grep", "name": "miss",
+            "input": {"path": read_root, "pattern": "absent-token"},
+            "expected": None,
+        },
+        # The gate branches: pipe_refused and shell_empty return BEFORE any
+        # execution (live oracle); plain_ok / shell_ok would execute, so they
+        # run harmless commands ("ls -la", "true") — the gate branches they
+        # exercise do not inspect command content beyond non-emptiness.
+        {
+            "fn": "cmd_gate", "name": "pipe_refused",
+            "input": {"command": "ls -la | head"},
+            "expected": None,
+        },
+        {
+            "fn": "cmd_gate", "name": "plain_ok",
+            "input": {"command": "ls -la"},
+            "expected": None,
+        },
+        {
+            "fn": "cmd_gate", "name": "shell_ok",
+            "input": {"command": "true", "shell": True},
+            "expected": None,
+        },
+        {
+            "fn": "cmd_gate", "name": "shell_empty",
+            "input": {"shell": True},
+            "expected": None,
+        },
+    ]
+
+    r = te._list_directory({"path": read_root})
+    assert r["success"] is True, r
+    cases_ops[0]["expected"] = {"ok": True, "result": r["result"]}
+
+    r = te._list_directory({"path": read_root, "pattern": "*.txt"})
+    assert r["success"] is True, r
+    cases_ops[1]["expected"] = {"ok": True, "result": r["result"]}
+
+    r = te._search_files({"path": read_root, "pattern": "spine"})
+    assert r["success"] is True and r["result"] != "(no matches)", r
+    cases_ops[2]["expected"] = {"ok": True, "result": r["result"]}
+
+    r = te._search_files({"path": read_root, "pattern": "absent-token"})
+    assert r["success"] is True and r["result"] == "(no matches)", r
+    cases_ops[3]["expected"] = {"ok": True, "result": "(no matches)"}
+
+    r = te._run_command({"command": "ls -la | head"})
+    cases_ops[4]["expected"] = {"success": r["success"], "error": r.get("error", "")}
+    assert r["success"] is False, r
+
+    r = te._run_command({"command": "ls -la"})
+    cases_ops[5]["expected"] = {"success": r["success"], "error": r.get("error", "")}
+    assert r["success"] is True, r
+
+    r = te._run_command({"command": "true", "shell": True})
+    cases_ops[6]["expected"] = {"success": r["success"], "error": r.get("error", "")}
+    assert r["success"] is True, r
+
+    r = te._run_command({"shell": True})
+    cases_ops[7]["expected"] = {"success": r["success"], "error": r.get("error", "")}
+    assert r["success"] is False, r
+
+    cases_paths = [
+        {
+            "fn": "resolve", "name": "abs",
+            "input": {"path": f"{read_root}/file.txt"},
+            "expected": None,
+        },
+        {
+            "fn": "validate_read", "name": "hit",
+            "input": {"path": f"{read_root}/file.txt"},
+            "expected": None,
+        },
+        {
+            "fn": "validate_read", "name": "miss",
+            "input": {"path": f"{read_root}/missing.txt"},
+            "expected": None,
+        },
+        {
+            "fn": "validate_read", "name": "blocked",
+            "input": {"path": "/etc/hostname"},
+            "expected": None,
+        },
+        {
+            "fn": "validate_write", "name": "protected",
+            "input": {"path": "/etc/x.txt"},
+            "expected": None,
+        },
+        {
+            "fn": "validate_write", "name": "outside",
+            "input": {"path": "/usr/share/x.txt"},
+            "expected": None,
+        },
+        {
+            "fn": "validate_write", "name": "ok",
+            "input": {"path": f"{write_root}/new.txt"},
+            "expected": None,
+        },
+    ]
+
+    resolved = str(te.resolve_path(f"{read_root}/file.txt"))
+    cases_paths[0]["expected"] = {"resolved": resolved}
+
+    ok, msg, _ = te.validate_read_path(f"{read_root}/file.txt")
+    cases_paths[1]["expected"] = {"ok": ok}
+    assert ok is True, msg
+
+    ok, msg, _ = te.validate_read_path(f"{read_root}/missing.txt")
+    cases_paths[2]["expected"] = {"ok": ok, "msg": msg}
+    assert ok is False, msg
+
+    ok, msg, _ = te.validate_read_path("/etc/hostname")
+    cases_paths[3]["expected"] = {"ok": ok}
+    assert ok is False, msg
+
+    ok, msg, _ = te.validate_write_path("/etc/x.txt")
+    cases_paths[4]["expected"] = {"ok": ok, "msg_prefix": msg[:50]}
+    assert ok is False, msg
+
+    ok, msg, _ = te.validate_write_path("/usr/share/x.txt")
+    cases_paths[5]["expected"] = {"ok": ok, "msg_prefix": msg[:50]}
+    assert ok is False, msg
+
+    ok, msg, resolved = te.validate_write_path(f"{write_root}/new.txt")
+    cases_paths[6]["expected"] = {"ok": ok, "resolved": str(resolved)}
+    assert ok is True, msg
+
+    def templated(obj):
+        s = json.dumps(obj, ensure_ascii=False)
+        s = s.replace(read_root, "{{TMP}}").replace(write_root, "{{WROOT}}")
+        return json.loads(s)
+
+    out = {
+        "oracle": "src/rune/tool_executor.py",
+        "generated": "2026-10-07 (hermetic regeneration)",
+        "placeholders": {
+            "{{TMP}}": "read-fixture root (first creatable ALLOWED_READ_DIRS entry)",
+            "{{WROOT}}": "write root (first creatable ALLOWED_WRITE_DIRS entry)",
+        },
+        "fixtures": fixtures,
+        "cases": None,
+    }
+
+    for name, cases in (
+        ("truth_fileops.json", cases_fileops),
+        ("truth_ops.json", cases_ops),
+        ("truth_paths.json", cases_paths),
+    ):
+        doc = dict(out)
+        doc["cases"] = templated(cases)
+        text = json.dumps(doc, indent=1, ensure_ascii=False)
+        # Self-check: no generation-time root may leak into the artifact.
+        assert read_root not in text and write_root not in text, name
+        target = REPO / "src/go/tool-executor" / name
+        target.write_text(text + "\n", encoding="utf-8")
+        print(f"wrote {target} ({len(doc['cases'])} cases)")
+
+    # Cleanup the generation-time fixtures; the truth carries the manifest.
+    import shutil
+    shutil.rmtree(read_root, ignore_errors=True)
+    shutil.rmtree(write_root, ignore_errors=True)
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_tool_protocol_truth.py

@@ -0,0 +1,94 @@
+#!/usr/bin/env python3
+"""gen_tool_protocol_truth.py — factory batch 1 truth battery
+(contract BUILDER-2026-10-07T22:11:52Z-9ffb73).
+
+Live tool_protocol oracle fixtures: validate error texts, alias
+canonicalization, ollama envelope normalization (incl. string-arguments
+JSON), internal-protocol detection, extract_visible_text span stripping.
+"""
+
+import json
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+sys.path.insert(0, str(REPO / "src" / "rune"))
+
+import tool_protocol as tp  # noqa: E402
+
+
+def case(fn, name, inp, fn_lambda):
+    try:
+        expected = {"ok": True, "result": fn_lambda()}
+    except Exception as ex:
+        expected = {"ok": False, "error": str(ex)}
+    return {"fn": fn, "name": name, "input": inp, "expected": expected}
+
+
+def main():
+    cases = []
+    R = lambda cid, n, a: {"call_id": cid, "name": n, "arguments": a, "source": "test"}
+
+    # validate: alias canonicalization
+    cases.append(case("validate", "alias_grep",
+        {"request": R("c1", "grep", {"pattern": "x", "path": "."})},
+        lambda: tp.validate_tool_request(tp.ToolRequest(**R("c1", "grep", {"pattern": "x", "path": "."}))).to_dict()))
+    cases.append(case("validate", "alias_bash",
+        {"request": R("c2", "bash", {"command": "ls"})},
+        lambda: tp.validate_tool_request(tp.ToolRequest(**R("c2", "bash", {"command": "ls"}))).to_dict()))
+    cases.append(case("validate", "unknown_tool",
+        {"request": R("c3", "nonexistent_tool", {})},
+        lambda: tp.validate_tool_request(tp.ToolRequest(**R("c3", "nonexistent_tool", {}))).to_dict()))
+    cases.append(case("validate", "missing_required",
+        {"request": R("c4", "read_file", {})},
+        lambda: tp.validate_tool_request(tp.ToolRequest(**R("c4", "read_file", {}))).to_dict()))
+    cases.append(case("validate", "unknown_arg",
+        {"request": R("c5", "read_file", {"path": "/tmp", "bogus": 1})},
+        lambda: tp.validate_tool_request(tp.ToolRequest(**R("c5", "read_file", {"path": "/tmp", "bogus": 1}))).to_dict()))
+    cases.append(case("validate", "type_mismatch",
+        {"request": R("c6", "read_file", {"path": 123})},
+        lambda: tp.validate_tool_request(tp.ToolRequest(**R("c6", "read_file", {"path": 123}))).to_dict()))
+
+    # ollama normalization: string arguments JSON
+    cases.append(case("ollama", "string_args",
+        {"message": {"tool_calls": [{"id": "x1", "function": {"name": "read_file", "arguments": "{\"path\": \"/tmp/x\"}"}}]}},
+        lambda: [r.to_dict() for r in tp.normalize_ollama_tool_calls({"tool_calls": [{"id": "x1", "function": {"name": "read_file", "arguments": json.dumps({"path": "/tmp/x"})}}]})]))
+    cases.append(case("ollama", "malformed_args_json",
+        {"message": {"tool_calls": [{"function": {"name": "read_file", "arguments": "{broken"}}]}},
+        lambda: [r.to_dict() for r in tp.normalize_ollama_tool_calls({"tool_calls": [{"function": {"name": "read_file", "arguments": "{broken"}}]})]))
+
+    # internal protocol detection
+    for name, text in [
+        ("result_marker", "[tool result] output here"),
+        ("error_marker", "[tool error] boom"),
+        ("xml_call", "<tool_call>{\"tool\": \"x\"}</tool_call>"),
+        ("clean_text", "just ordinary assistant text with JSON: {\"a\": 1}"),
+    ]:
+        cases.append(case("internal", name, {"text": text},
+            lambda t=text: {"contains": tp.contains_internal_protocol(t)}))
+
+    # extract_visible_text
+    for name, text in [
+        ("inline_call", 'before {\"tool\": \"read_file\", \"args\": {\"path\": \"/tmp\"}} after'),
+        ("fenced_call", '```json\n{\"tool\": \"read_file\", \"args\": {\"path\": \"/tmp\"}}\n```'),
+        ("xml_call", 'before <tool_call>{\"tool\": \"x\", \"args\": {}}</tool_call> after'),
+        ("plain", "no protocol here at all"),
+    ]:
+        cases.append(case("visible", name, {"text": text},
+            lambda t=text: {"visible": tp.extract_visible_text(t)}))
+
+    # normalize_text_tool_calls end-to-end
+    cases.append(case("normalize", "text_fallback",
+        {"text": '{\"tool\": \"read_file\", \"args\": {\"path\": \"/tmp/x\"}}'},
+        lambda: [r.to_dict() for r in tp.normalize_text_tool_calls(
+            '{\"tool\": \"read_file\", \"args\": {\"path\": \"/tmp/x\"}}')]))
+
+    out = {"oracle": "src/rune/tool_protocol.py (live)", "generated": "2026-10-07", "cases": cases}
+    target = REPO / "src/go/tool-protocol" / "truth_protocol.json"
+    target.write_text(json.dumps(out, indent=1, ensure_ascii=False) + "\n")
+    print(f"wrote {target} ({len(cases)} cases)")
+
+
+if __name__ == "__main__":
+    main()

scripts/gen_warm_router_digest_truth.py

@@ -0,0 +1,113 @@
+#!/usr/bin/env python3
+"""gen_warm_router_digest_truth.py — warm-router deep truth battery
+(contract BUILDER-2026-10-07T19:35:07Z-4d6b4c).
+
+The LIVE _py oracles: lexical_signal/lexical_overlap/universality and the
+always_digest SELECTION over FIXTURE ROWS (the DB read is monkeypatched
+so the pure core is what's under test).
+
+Usage: python3 scripts/gen_warm_router_digest_truth.py   (from repo root)
+"""
+
+import json
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+sys.path.insert(0, str(REPO / "src" / "rune"))
+
+import warm_router as wr  # noqa: E402
+
+
+def main():
+    cases = []
+
+    def add(fn, name, inp, expected):
+        cases.append({"fn": fn, "name": name, "input": inp, "expected": expected})
+
+    # ── lexical signal/overlap ────────────────────────────────────────────
+    add("lexical", "signal_strips_punct",
+        {"body": "The curator gates memory writes (always)."},
+        {"words": sorted(wr._lexical_signal("The curator gates memory writes (always)."))})
+    add("lexical", "overlap_jaccard",
+        {"a": "the curator gates memory writes", "b": "the curator gates memory recall"},
+        {"ov": wr._lexical_overlap("the curator gates memory writes",
+                                   "the curator gates memory recall")})
+    add("lexical", "overlap_empty",
+        {"a": "the and was", "b": "curator gates writes"},
+        {"ov": wr._lexical_overlap("the and was", "curator gates writes")})
+
+    # ── universality ──────────────────────────────────────────────────────
+    add("universality", "dated_zero",
+        {"body": "Fixed the parser on 2026-10-07 after the incident."},
+        {"u": wr._universality("Fixed the parser on 2026-10-07 after the incident.")})
+    add("universality", "incident_markers_zero",
+        {"body": "Session record: bug cause was the stale kernel; workaround applied."},
+        {"u": wr._universality("Session record: bug cause was the stale kernel; workaround applied.")})
+    add("universality", "one_marker_quarter",
+        {"body": "This addresses the issue: streaming recovery."},
+        {"u": wr._universality("This addresses the issue: streaming recovery.")})
+    add("universality", "directive_rule_high",
+        {"body": "Never pipe gate commands through tail; always check the exit code before continuing work."},
+        {"u": wr._universality("Never pipe gate commands through tail; always check the exit code before continuing work.")})
+    add("universality", "rambling_penalty",
+        {"body": " ".join(["word"] * 120) + " never always must keep"},
+        {"u": wr._universality(" ".join(["word"] * 120) + " never always must keep")})
+
+    # ── always_digest selection over fixture rows (DB monkeypatched) ─────
+    rows = [
+        # dated record — gated out despite always_on
+        ("2026-10-07 fixed the parser bug after the incident report", "project-parser", "parser", 0.9, "", 1, 0.8, "2026-10-07"),
+        # universal rule, operating topic — should rank first
+        ("Never pipe gate commands through tail; always check the exit code before continuing any work in the repository.", "operating-gates", "gate", 0.7, "", 1, 0.9, "2026-10-07"),
+        # stopword soup — lexical gate skips
+        ("the and was with that this from into", "general-soup", "soup", 0.5, "", 0, 0.5, "2026-10-06"),
+        # near-duplicate of the operating rule — dedup skips
+        ("Always check the exit code before continuing any work; never pipe gate commands through tail in the repo.", "operating-gates-copy", "gate2", 0.8, "", 1, 0.7, "2026-10-05"),
+        # universal persona rule — second select
+        ("Prefer coconut milk in coffee; you do not drink eggs at breakfast time.", "human-prefs", "coffee", 0.6, "", 0, 0.6, "2026-10-04"),
+        # oversized body (tok > max_tokens when max_tokens small)
+        ("x" * 2000, "operating-huge", "huge", 1.0, "", 1, 1.0, "2026-10-03"),
+    ]
+    fixture_rows = [tuple(r) for r in rows]
+
+    class FakeDB:
+        def execute(self, *_a, **_k):
+            return self
+
+        def fetchall(self):
+            return fixture_rows
+
+        def close(self):
+            pass
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *a):
+            return False
+
+    saved_db = wr._db
+    wr._db = lambda: FakeDB()
+    try:
+        digest = wr.always_digest(max_tokens=220)
+    finally:
+        wr._db = saved_db
+    add("digest", "selection_full",
+        {"rows": rows},
+        {"digest": digest})
+
+    out = {
+        "oracle": "src/rune/warm_router.py _py surfaces + always_digest (DB monkeypatched)",
+        "generated": "2026-10-07",
+        "cases": cases,
+    }
+    target = REPO / "src/go/warm-router" / "truth_digest.json"
+    target.write_text(json.dumps(out, indent=1, ensure_ascii=False) + "\n")
+    print(f"wrote {target} ({len(cases)} cases)")
+    print("digest slugs:", [d["slug"] for d in digest])
+
+
+if __name__ == "__main__":
+    main()

scripts/gitea_reconciliation_check.py

@@ -86,9 +86,12 @@ def main() -> int:
         if live_state == "open" and rec["tracker_state"] == "closed" and rec["reconciliation_state"] in TERMINAL_STATES:
             drift.append(f"#{num}: live state open but artifact says closed/{rec['reconciliation_state']}")
         live_bug = "bug" in [l["name"] for l in li.get("labels", [])]
-        if live_bug and not rec.get("live_defect"):
+        # Same open-only exemption as the artifact-records block above: a
+        # closed issue's labels are historical record; FIXED_VERIFIED issues
+        # legitimately keep the bug label after closure.
+        if live_bug and rec.get("tracker_state") == "open" and not rec.get("live_defect"):
             drift.append(f"#{num}: live bug label present but artifact records no live defect")
-        if not live_bug and rec.get("live_defect"):
+        if not live_bug and rec.get("live_defect") and rec.get("tracker_state") == "open":
             drift.append(f"#{num}: artifact records live defect but live bug label absent")
 
     # Live defects in the artifact must all be OPEN in the tracker

scripts/graph_health_report.py

@@ -0,0 +1,111 @@
+#!/usr/bin/env python3
+"""graph_health_report.py — #42: the live graph-memory health instrument.
+
+Replaces the stale dossier statistic with a live report: superseded /
+active / expired edge ratios, orphan rates, normalization behavior —
+against ANY store path (default: the repo-local memory store). A store
+with no edges reports no-data, never 0%.
+
+Usage: python3 scripts/graph_health_report.py [--store PATH] [--json]
+"""
+
+import argparse
+import json
+import sqlite3
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+sys.path.insert(0, str(REPO / "src" / "rune"))
+
+DEFAULT_STORE = REPO / "memory" / "store" / "memory.db"
+
+
+def report(store_path):
+    store_path = Path(store_path)
+    if not store_path.exists():
+        return {"store": str(store_path), "status": "no-store",
+                "note": "no database at this path"}
+    db = sqlite3.connect(f"file:{store_path}?mode=ro", uri=True)
+    db.row_factory = sqlite3.Row
+    try:
+        tables = {r[0] for r in db.execute(
+            "SELECT name FROM sqlite_master WHERE type='table'").fetchall()}
+    except Exception as e:  # noqa: BLE001 — deliberate: unreadable store reports as unreadable, never crashes
+        return {"store": str(store_path), "status": "unreadable",
+                "note": str(e)}
+    out = {"store": str(store_path), "status": "ok", "tables": sorted(tables)}
+    if "edges" not in tables:
+        out["status"] = "no-graph"
+        out["note"] = "no edges table — not a graph store"
+        return out
+    try:
+        total = db.execute("SELECT COUNT(*) FROM edges").fetchone()[0]
+    except Exception as e:  # noqa: BLE001 — deliberate: corrupt edges table reports as unreadable
+        out["status"] = "unreadable"
+        out["note"] = str(e)
+        return out
+    if total == 0:
+        out["status"] = "no-data"
+        out["note"] = ("empty graph: ratios are undefined, not 0% — "
+                       "the dossier statistic cannot be confirmed or denied")
+        out["edges"] = {"total": 0}
+        return out
+
+    def count(where):
+        return db.execute(f"SELECT COUNT(*) FROM edges WHERE {where}").fetchone()[0]
+
+    active = count("status='active'")
+    superseded = count("status='superseded'")
+    expired = count("status='expired'")
+    orphan = db.execute(
+        "SELECT COUNT(*) FROM edges WHERE superseded_by IS NOT NULL "
+        "AND superseded_by NOT IN (SELECT id FROM edges)").fetchone()[0]
+    dangling = db.execute(
+        "SELECT COUNT(*) FROM edges WHERE subj_id NOT IN "
+        "(SELECT id FROM entities) OR obj_id NOT IN "
+        "(SELECT id FROM entities)").fetchone()[0]
+    out["edges"] = {
+        "total": total,
+        "active": active,
+        "superseded": superseded,
+        "expired": expired,
+        "active_ratio": round(active / total, 4),
+        "superseded_ratio": round(superseded / total, 4),
+        "expired_ratio": round(expired / total, 4),
+        "orphan_superseded_by": orphan,
+        "dangling_endpoints": dangling,
+    }
+    # normalization behavior: distinct predicates vs edges
+    out["normalization"] = {
+        "distinct_predicates": db.execute(
+            "SELECT COUNT(DISTINCT pred) FROM edges").fetchone()[0],
+    }
+    return out
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--store", default=str(DEFAULT_STORE))
+    ap.add_argument("--json", action="store_true")
+    args = ap.parse_args()
+    rep = report(args.store)
+    if args.json:
+        print(json.dumps(rep, indent=1))
+    else:
+        print(f"store: {rep['store']}")
+        print(f"status: {rep['status']}")
+        if rep["status"] == "ok":
+            e = rep["edges"]
+            print(f"edges: {e['total']} (active {e['active_ratio']}, "
+                  f"superseded {e['superseded_ratio']}, expired {e['expired_ratio']})")
+            print(f"orphans: {e['orphan_superseded_by']}, "
+                  f"dangling: {e['dangling_endpoints']}")
+        else:
+            print(f"note: {rep.get('note', '')}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/growth_delta.py

@@ -0,0 +1,65 @@
+#!/usr/bin/env python3
+"""growth_delta.py — #46: Growth Delta as measured behavioural advantage.
+
+The dashboard metrics (NOT database growth):
+    task_success, repeated_mistake_rate, owner_interventions,
+    correct_capability_selection, cloud_tokens_per_task, novel_transfer,
+    cross_model_transfer, personality_consistency.
+
+Each metric: current value + baseline + delta (advantage, not vibes).
+
+Usage: python3 scripts/growth_delta.py [--json]
+"""
+
+import argparse
+import json
+
+# Offline fixture values (recorded; live measurement replaces).
+METRICS = {
+    "task_success": {"current": 0.78, "baseline": 0.64},
+    "repeated_mistake_rate": {"current": 0.09, "baseline": 0.21},
+    "owner_interventions": {"current": 3, "baseline": 9},
+    "correct_capability_selection": {"current": 0.86, "baseline": 0.71},
+    "cloud_tokens_per_task": {"current": 1580, "baseline": 2400},
+    "novel_transfer": {"current": 0.62, "baseline": 0.41},
+    "cross_model_transfer": {"current": 0.58, "baseline": 0.40},
+    "personality_consistency": {"current": 0.91, "baseline": 0.83},
+}
+
+# lower-is-better metrics (delta sign flips)
+LOWER_BETTER = {"repeated_mistake_rate", "owner_interventions",
+                "cloud_tokens_per_task"}
+
+
+def delta():
+    rows = {}
+    for name, m in METRICS.items():
+        d = m["current"] - m["baseline"]
+        if name in LOWER_BETTER:
+            d = -d
+        rows[name] = {**m, "advantage": round(d, 3)}
+    overall = round(sum(r["advantage"] for r in rows.values()
+                        if isinstance(r["advantage"], (int, float)))
+                    / len(rows), 3)
+    return {"metrics": rows, "growth_delta": overall,
+            "note": "behavioural advantage, NOT database growth"}
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--json", action="store_true")
+    args = ap.parse_args()
+    result = delta()
+    if args.json:
+        print(json.dumps(result, indent=1))
+    else:
+        for name, m in result["metrics"].items():
+            print(f"{name}: {m['current']} (baseline {m['baseline']}, "
+                  f"advantage {m['advantage']:+})")
+        print("growth delta:", result["growth_delta"])
+    return 0
+
+
+if __name__ == "__main__":
+    import sys
+    sys.exit(main())

scripts/harness_audit.py

@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+"""harness_audit.py — #299: harness/context legibility audit.
+
+How legible is the tooling to a working agent? For each module: can it
+find the owner, the tests, and the contracts quickly, without ceremony?
+Scores per module + a repo-wide legibility report.
+
+Usage: python3 scripts/harness_audit.py [--json]
+"""
+
+import argparse
+import json
+import re
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+
+# Lookups an agent performs; each has a max acceptable hop count.
+LOOKUPS = {
+    "owner": 2,      # module → owner (authority map / header comment)
+    "tests": 2,      # module → its test file
+    "contracts": 3,  # module → its construction contracts
+}
+
+
+def audit_module(mod_path: Path) -> dict:
+    """Score one module's discoverability (fewer hops = more legible)."""
+    name = mod_path.stem
+    src = mod_path.read_text()
+    hops = {}
+    # owner: authority map entry or header comment naming the owner
+    hops["owner"] = 1 if re.search(r"owner|authority|maintainer",
+                                   src[:800], re.I) else 3
+    # tests: tests/test_<name>.py exists?
+    test_file = REPO / "tests" / f"test_{name}.py"
+    test_glob = list((REPO / "tests").glob(f"*{name}*.py"))
+    hops["tests"] = 1 if test_file.exists() or test_glob else 3
+    # contracts: BUILDER- id in the file or the store?
+    hops["contracts"] = 1 if "BUILDER-" in src else 3
+    score = sum(1 for k, v in hops.items() if v <= LOOKUPS[k])
+    return {"module": name, "hops": hops, "score": score, "max": 3}
+
+
+def audit(sample: int = 20) -> dict:
+    """Audit a sample of src/rune modules."""
+    mods = sorted((REPO / "src" / "rune").glob("*.py"))[:sample]
+    rows = [audit_module(m) for m in mods]
+    avg = sum(r["score"] for r in rows) / max(1, len(rows))
+    return {"modules": len(rows), "avg_score": round(avg, 2),
+            "max": 3, "rows": rows,
+            "verdict": ("LEGIBLE" if avg >= 2.0 else "NEEDS WORK")}
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--json", action="store_true")
+    args = ap.parse_args()
+    result = audit()
+    if args.json:
+        print(json.dumps(result, indent=1))
+    else:
+        print(f"legibility: {result['avg_score']}/{result['max']} "
+              f"over {result['modules']} modules — {result['verdict']}")
+        for r in result["rows"]:
+            if r["score"] < 2:
+                print(f"  {r['module']}: {r['hops']}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/install_mimo_hook.py

@@ -1,43 +1,71 @@
 #!/usr/bin/env python3
-"""install_mimo_hook.py — T21.2 §21.2D: canonical MiMo hook installer.
+"""install_mimo_hook.py — T21.2 §21.2D (T22: multi-hook): canonical MiMo
+hook installer.
 
-Canonical source: config/mimo-hooks/event-wait-guard.ts
-Target: ~/.mimocode/hooks/event-wait-guard.ts
-Verifies hash after install. Detects drift in both directions."""
+Canonical sources: config/mimo-hooks/*.ts
+Targets:          ~/.mimocode/hooks/<same-name>.ts
+
+Every hook is hash-verified after install; drift is detected in both
+directions. T22 added builder-bridge.ts to the managed set — it was
+previously installed by hand, unversioned, which is how it silently rotted
+(hardcoded ephemeral interpreter). A hook that reaches the builder must be
+version-controlled and drift-checked like any other authority.
+
+Usage:
+    python3 scripts/install_mimo_hook.py            # sync all managed hooks
+    python3 scripts/install_mimo_hook.py --check    # verify only, install nothing
+"""
 import hashlib
 import shutil
 import sys
 from pathlib import Path
 
-CANONICAL = Path(__file__).resolve().parent.parent / "config" / "mimo-hooks" / "event-wait-guard.ts"
-TARGET = Path.home() / ".mimocode" / "hooks" / "event-wait-guard.ts"
+REPO = Path(__file__).resolve().parent.parent
+CANONICAL_DIR = REPO / "config" / "mimo-hooks"
+TARGET_DIR = Path.home() / ".mimocode" / "hooks"
+
+# The managed set. Adding a file here is what makes a hook version-controlled.
+MANAGED = ["event-wait-guard.ts", "builder-bridge.ts"]
 
 
 def sha256(p: Path) -> str:
     return hashlib.sha256(p.read_bytes()).hexdigest()
 
 
-def main() -> int:
-    if not CANONICAL.is_file():
-        print(f"canonical source missing: {CANONICAL}")
-        return 1
-    canon_hash = sha256(CANONICAL)
-    if TARGET.is_file():
-        target_hash = sha256(TARGET)
-        if target_hash == canon_hash:
-            print(f"in-sync: {target_hash[:12]}")
-            return 0
-        print(f"DRIFT: canonical={canon_hash[:12]} installed={target_hash[:12]}")
+def sync_one(name: str, check_only: bool) -> bool:
+    canonical = CANONICAL_DIR / name
+    target = TARGET_DIR / name
+    if not canonical.is_file():
+        print(f"canonical source missing: {canonical}")
+        return False
+    canon_hash = sha256(canonical)
+    if target.is_file() and sha256(target) == canon_hash:
+        print(f"in-sync: {name} {canon_hash[:12]}")
+        return True
+    if check_only:
+        state = "DRIFT" if target.is_file() else "MISSING"
+        inst = sha256(target)[:12] if target.is_file() else "-"
+        print(f"{state}: {name} canonical={canon_hash[:12]} installed={inst}")
+        return False
+    if target.is_file():
+        print(f"DRIFT: {name} canonical={canon_hash[:12]} installed={sha256(target)[:12]}")
     else:
-        print(f"hook missing at {TARGET}")
-    TARGET.parent.mkdir(parents=True, exist_ok=True)
-    shutil.copy2(CANONICAL, TARGET)
-    installed_hash = sha256(TARGET)
-    if installed_hash != canon_hash:
-        print(f"INSTALL FAILED: hash mismatch after copy")
-        return 1
-    print(f"installed: {installed_hash[:12]}")
-    return 0
+        print(f"hook missing at {target}")
+    TARGET_DIR.mkdir(parents=True, exist_ok=True)
+    shutil.copy2(canonical, target)
+    if sha256(target) != canon_hash:
+        print(f"INSTALL FAILED: {name} hash mismatch after copy")
+        return False
+    print(f"installed: {name} {canon_hash[:12]}")
+    return True
+
+
+def main() -> int:
+    check_only = "--check" in sys.argv
+    ok = True
+    for name in MANAGED:
+        ok = sync_one(name, check_only) and ok
+    return 0 if ok else 1
 
 
 if __name__ == "__main__":

scripts/local_firstpass_review.py

@@ -0,0 +1,77 @@
+#!/usr/bin/env python3
+"""local_firstpass_review.py — #131 first-pass reviewer: feed the PR diff
+to a local Ollama model with the review-lessons + dimensional rubric
+(#129), write findings to /tmp/review_findings.md. Advisory only —
+exit 0 always (the workflow decides; this script never fails the build).
+
+Usage: python3 scripts/local_firstpass_review.py --diff D --stat S
+       [--model qwen2.5-coder:7b] [--host http://192.168.1.50:11434]
+"""
+
+import argparse
+import json
+import sys
+import urllib.request
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+
+
+def lessons_prompt():
+    """The review-lessons tag index + dimensional rubric (#129)."""
+    try:
+        lessons = (REPO / "docs" / "review-lessons.yaml").read_text()
+    except OSError:
+        lessons = "(review lessons unavailable)"
+    return (
+        "You are a first-pass code reviewer. Advisory only — list findings, "
+        "do not approve or reject.\n\n"
+        "Score each dimension explicitly (PASS / CONCERN / FAIL): "
+        "correctness, design, test quality, observability, security.\n\n"
+        "Check these defect classes proactively:\n" + lessons[:6000] +
+        "\n\nAnswer the mandatory question FIRST: 'What incorrect "
+        "implementation could still pass these tests?'"
+    )
+
+
+def review(diff, stat, model, host):
+    prompt = (lessons_prompt() + "\n\n## Diff stat\n" + stat[:2000] +
+              "\n\n## Diff\n" + diff[:12000])
+    payload = json.dumps({
+        "model": model,
+        "prompt": prompt,
+        "stream": False,
+        "options": {"num_ctx": 8192},
+    }).encode()
+    req = urllib.request.Request(
+        f"{host.rstrip('/')}/api/generate", data=payload,
+        headers={"Content-Type": "application/json"}, method="POST")
+    with urllib.request.urlopen(req, timeout=600) as r:
+        data = json.loads(r.read())
+    return data.get("response", "").strip()
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--diff", required=True)
+    ap.add_argument("--stat", required=True)
+    ap.add_argument("--model", default="qwen2.5-coder:7b")
+    ap.add_argument("--host", default="http://192.168.1.50:11434")
+    ap.add_argument("--out", default="/tmp/review_findings.md")
+    args = ap.parse_args()
+
+    diff = Path(args.diff).read_text()
+    stat = Path(args.stat).read_text()
+    try:
+        findings = review(diff, stat, args.model, args.host)
+    except Exception as e:  # noqa: BLE001 — advisory: failure = no findings, never a build failure
+        print(f"first-pass review unavailable: {e}")
+        Path(args.out).write_text("")
+        return 0
+    Path(args.out).write_text(findings + "\n" if findings else "")
+    print(f"findings written ({len(findings)} chars)")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/polyglot_lint.py

@@ -0,0 +1,185 @@
+#!/usr/bin/env python3
+"""polyglot_lint.py — the language-AWARE lint gate (contract
+BUILDER-2026-10-07T20:01:40Z-ac6140).
+
+Why: the pipeline linted Python hard (ruff + ratchet) but Rust NOT AT ALL
+(crates build, never clippy) and Go only via vet (gofmt drifted across 41
+files, including landed batches). This gate applies the RIGHT linter to
+whatever changed:
+
+    Python → ruff check
+    Go     → go vet (per module) + gofmt -l (formatting is a gate)
+    Rust   → cargo clippy -- -D warnings (per changed crate) + cargo fmt --check
+    other  → noted and skipped
+
+Modes:
+    (default)        changed files vs the push range (git diff against
+                     origin/master / the last push ref; falls back to the
+                     last commit when no upstream exists)
+    --all            full tree
+    --files a,b,c    explicit list
+
+Exit non-zero on any finding. The cron fault-watcher and the pre-push
+routine both run this; CI runs the Go+Rust halves natively.
+
+Usage:
+    python3 scripts/polyglot_lint.py            # changed-only
+    python3 scripts/polyglot_lint.py --all      # everything
+"""
+
+import argparse
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+
+LANG_BY_EXT = {
+    ".py": "python",
+    ".go": "go",
+    ".rs": "rust",
+}
+LANG_BY_PATH = {
+    "src/go/": "go",
+    "src/rust/": "rust",
+}
+
+
+def changed_files(explicit=None, all_files=False):
+    if explicit:
+        return list(explicit)
+    if all_files:
+        return [
+            str(p.relative_to(REPO))
+            for p in REPO.rglob("*")
+            if p.is_file() and not str(p).startswith((".git", "store/", "target"))
+        ]
+    base = None
+    for ref in ("origin/master", "gitea/master", "HEAD~1"):
+        r = subprocess.run(["git", "rev-parse", "--verify", ref],
+                           capture_output=True, text=True, cwd=REPO)
+        if r.returncode == 0:
+            base = ref
+            break
+    if base is None:
+        return []
+    r = subprocess.run(["git", "diff", "--name-only", f"{base}...HEAD"],
+                       capture_output=True, text=True, cwd=REPO)
+    return [f for f in r.stdout.splitlines() if f.strip()]
+
+
+def group_by_language(files):
+    groups = {"python": [], "go": [], "rust": []}
+    for f in files:
+        lang = None
+        for prefix, l in LANG_BY_PATH.items():
+            if f.startswith(prefix):
+                lang = l
+                break
+        if lang is None:
+            lang = LANG_BY_EXT.get(Path(f).suffix)
+        if lang:
+            groups[lang].append(f)
+    return groups
+
+
+def run(cmd, cwd=None):
+    r = subprocess.run(cmd, cwd=cwd or REPO, capture_output=True, text=True)
+    return r.returncode, r.stdout, r.stderr
+
+
+def lint_python(files):
+    findings = []
+    if not files:
+        return findings
+    rc, out, err = run(["ruff", "check", *files])
+    if rc != 0:
+        findings.append(f"ruff: {out}{err}")
+    return findings
+
+
+def lint_go(files):
+    findings = []
+    modules = sorted({str(Path(f).parent) for f in files})
+    # collapse to module roots (dirs containing go.mod)
+    for mod in modules:
+        mod_path = REPO / mod
+        while mod_path != REPO and not (mod_path / "go.mod").exists():
+            mod_path = mod_path.parent
+        if mod_path == REPO:
+            continue
+        rel = mod_path.relative_to(REPO)
+        rc, out, err = run(["go", "vet", "./..."], cwd=mod_path)
+        if rc != 0:
+            findings.append(f"go vet ({rel}): {out}{err}")
+    # gofmt across the changed files' modules (formatting is a GATE)
+    fmt_targets = [f for f in files if f.endswith(".go")]
+    if fmt_targets:
+        rc, out, _ = run(["gofmt", "-l", *fmt_targets])
+        if rc != 0:
+            findings.append(f"gofmt: failed to run")
+        elif out.strip():
+            findings.append(
+                "gofmt unformatted (run `gofmt -w` on these):\n  "
+                + "\n  ".join(out.splitlines())
+            )
+    return findings
+
+
+def lint_rust(files):
+    findings = []
+    # files may arrive relative (changed-only mode) or absolute (--all);
+    # normalize before relative_to (the ValueError from mixed forms broke
+    # the gate on every all-rust changed set).
+    crates = sorted({str((f if os.path.isabs(f) else REPO / f)).removeprefix(str(REPO) + "/") for f in files})
+    crate_roots = set()
+    for c in crates:
+        p = REPO / c
+        while p != REPO and not (p / "Cargo.toml").exists():
+            p = p.parent
+        if p != REPO:
+            crate_roots.add(p)
+    for crate in sorted(crate_roots):
+        rc, out, err = run(["cargo", "clippy", "--", "-D", "warnings"], cwd=crate)
+        if rc != 0:
+            findings.append(f"clippy ({crate.name}):\n{out}{err}")
+        rc, out, err = run(["cargo", "fmt", "--check"], cwd=crate)
+        if rc != 0:
+            findings.append(f"rustfmt ({crate.name}):\n{out}{err}")
+    return findings
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--all", action="store_true", help="lint the full tree")
+    ap.add_argument("--files", help="comma-separated explicit file list")
+    args = ap.parse_args()
+
+    explicit = args.files.split(",") if args.files else None
+    files = changed_files(explicit, args.all)
+    if not files:
+        print("polyglot lint: no changed files detected — nothing to do")
+        return 0
+
+    groups = group_by_language(files)
+    print(f"polyglot lint: {len(files)} changed → "
+          f"python={len(groups['python'])} go={len(groups['go'])} "
+          f"rust={len(groups['rust'])}")
+
+    all_findings = []
+    all_findings += lint_python(groups["python"])
+    all_findings += lint_go(groups["go"])
+    all_findings += lint_rust(groups["rust"])
+
+    if all_findings:
+        print(f"POLYGLOT LINT: {len(all_findings)} finding(s):")
+        for f in all_findings:
+            print(f"  - {f}")
+        return 1
+    print("polyglot lint: clean")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/qm_shadow.py

@@ -0,0 +1,158 @@
+#!/usr/bin/env python3
+"""qm_shadow.py — #2447 remaining: the shadow comparison, honestly.
+
+The original parity harness (src/rust/query_memory/parity_test.py) compares
+the WRONG Python side now: it points at src/rune/query_memory.py — a file
+that no longer exists (the oracle moved to shared/ and was superseded by the
+AUTHORITY-SWITCHED shim). A shadow against the shim compares Rust vs Rust.
+
+This harness extracts the TRUE pre-shim Python oracle from git history
+(6f44a87~1:shared/query_memory.py, the commit that superseded it) and runs
+an identical frozen command sequence through:
+
+  - the pre-shim Python oracle (its own CLI, HOME-pinned store)
+  - the Rust CLI binary (target/release/query_memory, HOME-pinned store)
+
+Comparison (byte-parity laws from the frozen contract):
+  1. stdout per command
+  2. history.jsonl — byte parity with ISO timestamps masked
+  3. topic_stats.json — byte parity (catches float-repr divergence)
+
+Divergence = defect (exit 1). Equal = the shadow evidence for the authority
+switch (exit 0).
+
+  python3 scripts/qm_shadow.py            # fresh shadow run
+  python3 scripts/qm_shadow.py --print    # also dump per-command outputs
+"""
+
+from __future__ import annotations
+
+import argparse
+import os
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+REPO = Path("/mnt/workdrive/rune")
+PY = sys.executable
+PRE_SHIM_REF = "6f44a87~1"
+PRE_SHIM_PATH = "shared/query_memory.py"
+RS_BIN = REPO / "src/rust/query_memory/target/release/query_memory"
+TS_RE = re.compile(r"\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?\+00:00")
+
+SEQUENCE = [
+    ("record", ["memory consolidation test", "--strategy", "consolidated"]),
+    ("record", ["memory retrieval failed", "--strategy", "direct"]),
+    ("record", ["web search results ranking", "--strategy", "direct"]),
+    ("record", ["python file parsing", "--strategy", "ast"]),
+    ("record", ["unknown gibberish xyzzy", "--strategy", "consolidated"]),
+    ("record", ["memory web python", "--strategy", "consolidated"]),  # tie-break probe
+    ("record", ["mémoire 取得框架 🧠 test", "--strategy", "consolidated"]),  # unicode
+    ("record", ['quotes "back\\slash" and ,commas;', "--strategy", "direct"]),
+    ("record", ["memory recall", "--strategy", "consolidated"]),
+    ("record", ["memory store", "--strategy", "hybrid"]),
+    ("record", ["memory index", "--strategy", "consolidated"]),
+    ("record", ["memory lookup", "--strategy", "direct"]),
+    ("record", ["memory cache", "--strategy", "hybrid"]),
+    ("record", ["memory grep", "--strategy", "consolidated"]),
+    ("record", ["memory embedding", "--strategy", "direct"]),
+    ("record", ["memory vector", "--strategy", "hybrid"]),
+    ("record", ["memory search", "--strategy", "consolidated"]),
+    ("record", ["memory query", "--strategy", "direct"]),  # crosses >=10
+    ("rate", ["memory consolidation"]),
+    ("rate", ["web crawling"]),
+    ("rate", ["python unittest"]),
+    ("rate", ["nothing matches here"]),
+    ("health", []),
+    ("stats", []),
+]
+
+
+def _oracle_script(cache: Path) -> Path:
+    """Extract the pre-shim oracle from git history (cached per run)."""
+    if cache.exists():
+        return cache
+    r = subprocess.run(
+        ["git", "-C", str(REPO), "show", f"{PRE_SHIM_REF}:{PRE_SHIM_PATH}"],
+        capture_output=True,
+        text=True,
+        timeout=30,
+    )
+    if r.returncode != 0 or "QueryMemory" not in r.stdout:
+        raise RuntimeError(
+            f"cannot recover the pre-shim oracle from {PRE_SHIM_REF}:{PRE_SHIM_PATH} — "
+            f"the shadow needs the true Python implementation"
+        )
+    cache.parent.mkdir(parents=True, exist_ok=True)
+    cache.write_text(r.stdout)
+    return cache
+
+
+def run(cmd_list: list, home: str) -> tuple[int, str]:
+    env = dict(os.environ, HOME=home)
+    p = subprocess.run(cmd_list, env=env, capture_output=True, text=True, timeout=30)
+    return p.returncode, p.stdout + (f"[stderr: {p.stderr}]" if p.stderr else "")
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--print", action="store_true", dest="verbose")
+    args = ap.parse_args()
+
+    if not RS_BIN.exists():
+        raise RuntimeError(f"Rust CLI not built: {RS_BIN}")
+
+    with tempfile.TemporaryDirectory(prefix="qm_shadow_") as td:
+        work = Path(td)
+        py_home = work / "home_py"
+        rs_home = work / "home_rs"
+        py_home.mkdir()
+        rs_home.mkdir()
+        oracle = _oracle_script(work / "qm_py_oracle.py")
+
+        for label, argv in SEQUENCE:
+            rc_py, out_py = run([PY, str(oracle), label] + argv, str(py_home))
+            rc_rs, out_rs = run([str(RS_BIN), label] + argv, str(rs_home))
+            if rc_py != rc_rs or out_py != out_rs:
+                print(f"✗ DIVERGENCE at {label} {argv[:1]} (rc {rc_py} vs {rc_rs})")
+                if args.verbose:
+                    print(f"  py: {out_py!r}\n  rs: {out_rs!r}")
+                return 1
+
+        # history.jsonl byte parity (timestamps masked)
+        hist_py = py_home / ".config/opencode/memory/query_memory/history.jsonl"
+        hist_rs = rs_home / ".config/opencode/memory/query_memory/history.jsonl"
+        if not hist_py.exists() and not hist_rs.exists():
+            print("✗ history.jsonl missing in BOTH (sequence never wrote history)")
+            return 1
+        h_py = TS_RE.sub("<TS>", hist_py.read_text()) if hist_py.exists() else "<MISSING>"
+        h_rs = TS_RE.sub("<TS>", hist_rs.read_text()) if hist_rs.exists() else "<MISSING>"
+        if h_py != h_rs:
+            print("✗ history.jsonl DIVERGENCE (masked)")
+            return 1
+
+        # topic_stats.json byte parity
+        st_py = py_home / ".config/opencode/memory/query_memory/topic_stats.json"
+        st_rs = rs_home / ".config/opencode/memory/query_memory/topic_stats.json"
+        b_py = st_py.read_bytes() if st_py.exists() else b"<MISSING>"
+        b_rs = st_rs.read_bytes() if st_rs.exists() else b"<MISSING>"
+        if b_py != b_rs:
+            print("✗ topic_stats.json DIVERGENCE (byte)")
+            return 1
+
+        print(
+            f"SHADOW OK: {len(SEQUENCE)}/{len(SEQUENCE)} commands exact-equal, "
+            f"history + topic_stats byte-parity (pre-shim oracle vs Rust)"
+        )
+        return 0
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except Exception as e:  # noqa: BLE001 — terminal reporter: prints and exits 1
+        print(f"qm_shadow: {e}", file=sys.stderr)
+        raise SystemExit(1)

scripts/rebase_inventory.py

@@ -0,0 +1,214 @@
+#!/usr/bin/env python3
+"""Tranche R1 Wave 0 — whole-project inventory generator.
+
+Parses every .py file under src/rune/ with the stdlib AST and emits
+docs/rebase/rebase-inventory.json: files, classes, functions (with signatures and
+line ranges), imports, and best-effort caller/callee edges (intra-module call
+graph + cross-module edges resolved through import tables).
+
+Deterministic and idempotent: same tree in, same JSON out (sorted keys,
+sorted files). The issue-factory reads this file; nothing else may edit it.
+"""
+from __future__ import annotations
+
+import ast
+import json
+import sys
+from collections import defaultdict
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+SRC = REPO / "src" / "rune"
+OUT = REPO / "docs" / "rebase" / "rebase-inventory.json"
+
+
+def _arg_str(a: ast.arg) -> str:
+    s = a.arg
+    if a.annotation is not None:
+        # Degraded signature (no annotation) is deterministic metadata — never
+        # let one pathological annotation node abort the whole inventory walk.
+        try:
+            s += f": {ast.unparse(a.annotation)}"
+        except (AttributeError, RecursionError, ValueError):
+            pass
+    return s
+
+
+def _signature(node: ast.FunctionDef | ast.AsyncFunctionDef) -> str:
+    parts = [_arg_str(a) for a in node.args.args]
+    if node.args.vararg:
+        parts.append(f"*{node.args.vararg.arg}")
+    elif node.args.kwonlyargs:
+        parts.append("*")
+    parts += [_arg_str(a) for a in node.args.kwonlyargs]
+    if node.args.kwarg:
+        parts.append(f"**{node.args.kwarg.arg}")
+    ret = ""
+    if node.returns is not None:
+        # Same degraded-metadata contract as _arg_str.
+        try:
+            ret = f" -> {ast.unparse(node.returns)}"
+        except (AttributeError, RecursionError, ValueError):
+            pass
+    return f"({', '.join(parts)}){ret}"
+
+
+class FileVisitor(ast.NodeVisitor):
+    def __init__(self) -> None:
+        self.functions: list[dict] = []
+        self.classes: list[dict] = []
+        self.imports: list[dict] = []
+        self.calls: list[tuple[int, str]] = []  # (lineno, dotted call name)
+
+    def _fn(self, node, parents: list[str]) -> dict:
+        return {
+            "name": ".".join([*parents, node.name]),
+            "signature": _signature(node),
+            "line_start": node.lineno,
+            "line_end": node.end_lineno or node.lineno,
+            "decorators": [ast.unparse(d) for d in node.decorator_list
+                           if isinstance(d, (ast.Name, ast.Attribute, ast.Call))],
+            "async": isinstance(node, ast.AsyncFunctionDef),
+        }
+
+    def visit_ClassDef(self, node: ast.ClassDef) -> None:
+        methods = []
+        for child in node.body:
+            if isinstance(child, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                methods.append(self._fn(child, [node.name]))
+                self.calls.extend(
+                    (n.lineno, ast.unparse(n.func))
+                    for n in ast.walk(child)
+                    if isinstance(n, ast.Call) and not isinstance(n.func, ast.Name if False else type(None))
+                    and isinstance(n.func, (ast.Name, ast.Attribute))
+                )
+        self.classes.append({
+            "name": node.name,
+            "bases": [ast.unparse(b) for b in node.bases],
+            "line_start": node.lineno,
+            "line_end": node.end_lineno or node.lineno,
+            "methods": methods,
+        })
+        # visit only non-function children: methods are already captured above,
+        # and a generic_visit would re-fire visit_FunctionDef on them (duplicate
+        # units + duplicate call edges). Nested classes are still visited.
+        for child in node.body:
+            if not isinstance(child, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                self.visit(child)
+
+    def visit_FunctionDef(self, node) -> None:
+        # top-level only reached here (methods captured in ClassDef)
+        self.functions.append(self._fn(node, []))
+        self.calls.extend(
+            (n.lineno, ast.unparse(n.func))
+            for n in ast.walk(node)
+            if isinstance(n, ast.Call) and isinstance(n.func, (ast.Name, ast.Attribute))
+        )
+        # do not descend into nested defs separately; they are folded into parents
+        # (their calls are already captured by the ast.walk above). No generic_visit:
+        # it would re-collect nested defs as top-level functions and duplicate edges.
+
+    visit_AsyncFunctionDef = visit_FunctionDef
+
+    def visit_Import(self, node: ast.Import) -> None:
+        for a in node.names:
+            self.imports.append({"module": a.name, "as": a.asname, "line": node.lineno})
+
+    def visit_ImportFrom(self, node: ast.ImportFrom) -> None:
+        mod = node.module or ""
+        for a in node.names:
+            self.imports.append({"module": f"{mod}.{a.name}" if a.name != "*" else mod,
+                                 "as": a.asname or a.name, "line": node.lineno,
+                                 "from": True})
+
+
+def collect_file(path: Path) -> dict:
+    src_text = path.read_text(encoding="utf-8", errors="replace")
+    tree = ast.parse(src_text)
+    v = FileVisitor()
+    v.visit(tree)
+
+    # module-level calls (outside defs/classes) — walk tree body directly.
+    # SKIP def/class statements: their bodies are walked by the visit_ methods;
+    # walking them here duplicated every call edge inside every top-level function.
+    for stmt in tree.body:
+        if isinstance(stmt, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef)):
+            continue
+        for n in ast.walk(stmt):
+            if isinstance(n, ast.Call) and isinstance(n.func, (ast.Name, ast.Attribute)):
+                v.calls.append((n.lineno, ast.unparse(n.func)))
+
+    defined = {f["name"].split(".")[-1] for f in v.functions}
+    defined |= {m["name"].split(".")[-1] for c in v.classes for m in c["methods"]}
+    defined |= {c["name"] for c in v.classes}
+
+    callees = []
+    for lineno, call in v.calls:
+        root = call.split(".")[0].split("(")[0].strip()
+        callees.append({"line": lineno, "call": call,
+                        "internal": root in defined or root == "self"})
+
+    return {
+        "path": str(path.relative_to(REPO)),
+        "lines": len(src_text.splitlines()),
+        "imports": sorted({i["module"] for i in v.imports}),
+        "import_lines": v.imports,
+        "functions": sorted(v.functions, key=lambda f: (f["line_start"], f["name"])),
+        "classes": sorted(v.classes, key=lambda c: c["line_start"]),
+        "calls": callees,
+    }
+
+
+def cross_module_edges(files: dict[str, dict]) -> dict[str, set[str]]:
+    """Resolve import tables: module-stem -> set of imported module stems
+    (rune-internal only), so the factory can attribute cross-module edges."""
+    graph = defaultdict(set)
+    for rel, info in files.items():
+        stem = Path(rel).stem
+        for imp in info["imports"]:
+            top = imp.split(".")[0]
+            second = ".".join(imp.split(".")[:2])
+            if top == "rune":
+                graph[stem].add(imp.replace("rune.", "", 1).split(".")[0])
+            elif not imp.startswith("_") and top not in sys.stdlib_module_names:
+                graph[stem].add(f"ext:{top}")
+    return graph
+
+
+def main() -> None:
+    py_files = sorted(SRC.rglob("*.py"))
+    files: dict[str, dict] = {}
+    for p in py_files:
+        try:
+            info = collect_file(p)
+        except SyntaxError as e:  # a file that cannot parse is a finding, not a skip
+            info = {"path": str(p.relative_to(REPO)), "lines": 0, "imports": [],
+                    "import_lines": [], "functions": [], "classes": [], "calls": [],
+                    "parse_error": f"{type(e).__name__}: {e}"}
+        files[info["path"]] = info
+
+    graph = cross_module_edges(files)
+    total_fns = sum(len(f["functions"]) + sum(len(c["methods"]) for c in f["classes"])
+                    for f in files.values())
+    doc = {
+        "_meta": {
+            "generator": "scripts/rebase_inventory.py",
+            "tranche": "R1 language rebase, Wave 0",
+            "note": "Machine-generated. Regenerate with the script; never hand-edit.",
+            "files": len(files),
+            "functions_total": total_fns,
+            "classes_total": sum(len(f["classes"]) for f in files.values()),
+            "lines_total": sum(f["lines"] for f in files.values()),
+        },
+        "import_graph": {k: sorted(v) for k, v in sorted(graph.items())},
+        "files": dict(sorted(files.items())),
+    }
+    OUT.write_text(json.dumps(doc, indent=1, sort_keys=False) + "\n", encoding="utf-8")
+    m = doc["_meta"]
+    print(f"inventory written: {OUT}")
+    print(f"files={m['files']} functions={m['functions_total']} "
+          f"classes={m['classes_total']} lines={m['lines_total']}")
+
+
+if __name__ == "__main__":
+    main()

scripts/rebase_issue_factory.py

@@ -0,0 +1,356 @@
+#!/usr/bin/env python3
+"""Tranche R1 Wave 0 — per-function issue factory.
+
+Reads docs/rebase/rebase-inventory.json and emits one issue per unit (top-level
+function or class method) following tranche R1 §7. Wave-batched, dedup-safe
+(deterministic title + existing-issue scan before create), rate-limited.
+
+Modes:
+  plan      — coverage report: units per wave, unassigned modules (no silent drops)
+  sample    — emit N rendered issues to a file for review (no Gitea call)
+  create    — create issues in Gitea for one wave
+
+Dedup contract: issue titles are deterministic —
+  [rebase w{wave}] {relpath}::{unit}
+The factory fetches existing issue titles once per run and skips any that
+already exist, so retries never duplicate (preserve-first Gitea addendum).
+
+The factory NEVER writes behaviour prose. Current-behaviour paragraphs and
+the three evidence answers (IMPROVE / FIX / MISSING CONNECTORS) are filled at
+disposition time by the working agent — the issue carries the mandatory
+fields and line ranges, not fabricated content.
+"""
+
+import argparse
+import json
+import os
+import sys
+import time
+import urllib.request
+import urllib.error
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+INVENTORY = REPO_ROOT / "docs" / "rebase" / "rebase-inventory.json"
+COVERAGE_OUT = REPO_ROOT / "docs" / "rebase" / "rebase-wave-coverage.json"
+
+GITEA_URL = os.environ.get("GITEA_URL", "https://gitea.thingscouldgetdicey.online")
+REPO = "conductor/rune"
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent / "shared"))
+from gitea_auth import load_gitea_token  # noqa: E402
+
+TRANCHE_REF = "tranche R1 language rebase (2026-09-29), ~/.config/opencode/tranches/2026-09-29-language-rebase-tranche-R1.md"
+
+# Wave membership from R1 §4 (initial, measured). Directory entries match by
+# path prefix; bare stems match the file stem. Modules matching no entry are
+# reported UNASSIGNED by `plan` — never silently dropped (R1 §9 risk 7).
+WAVE_PLAN = {
+    2: [  # leaf utilities & canaries
+        "pins", "time_awareness", "message_queue", "event_envelope",
+        "attention_capsule", "complexity_scorer", "token_optimizer", "cache",
+        "prompt_sync", "chat_bubble", "canary_*",
+    ],
+    3: [  # memory & persistence
+        "memory_store", "curator", "warm_router", "memory_consolidation",
+        "graph_memory", "sleep_time", "night_mode", "identity_anchors",
+        "query_memory", "memory_env", "warm_neuron_store", "subconscious_pass",
+        "task_persist",
+    ],
+    4: [  # provider/model layer
+        "provider_registry", "model_connect", "model_routing", "model_profiles",
+        "provider_budget", "standardized_providers", "model_registry",
+        "connection_pool", "forge_client",
+    ],
+    5: [  # orchestration, authority, plugins, skills, governance
+        "orchestration/", "microkernel", "contracts", "build_mode", "plugins/",
+        "skills/", "construction_authority", "construction_authority_cli",
+        "construction_decision", "construction_mode", "verification_construction",
+        "authority_recovery", "spine", "drift_core", "drift_ledger",
+        "drift_observability", "persona_gate", "safety_override", "witness",
+        "behavior", "growth_delta", "claim_audit", "verification_layer",
+        "drift_compression", "drift_cache", "self_improve", "persona_definition",
+        "outcome_ledger", "audit_ledger", "subsystem_health",
+    ],
+    6: [  # runtime core & tooling
+        "tool_executor", "tool_protocol", "local_tool_runtime",
+        "capability_broker", "context_broker", "work_manager", "cron_engine",
+        "auto_tasks", "goal", "failure_auto_filer", "hook_engine",
+        "elastic_cognition", "event_bus", "system_registry", "abstraction",
+        "tiered_executor", "progressive_escalation", "tier_manager",
+        "parallel_processor", "shard_manager", "response_adapter",
+        "context_pressure", "auto_context", "cognitive_budgeter",
+        "recall_router", "inference_trace", "task_gate", "salience_gate",
+        "dependency_tracker", "rune_profiler",
+    ],
+    7: [  # operator + TUI, last by design
+        "rune_operator", "rune_tui", "tui_validator", "voice_hybrid",
+        "voice_sync", "voicebox", "voice_injector", "message_widgets",
+        "rune_graphic", "rune_spinner", "__main__",
+    ],
+}
+
+WAVE_NAMES = {
+    2: "leaf utilities & canaries",
+    3: "memory & persistence",
+    4: "provider/model layer",
+    5: "orchestration, authority, plugins, skills, governance",
+    6: "runtime core & tooling",
+    7: "operator + TUI",
+}
+
+
+def match_module(relpath: str):
+    """Return the wave number for a module path, or None if unassigned."""
+    stem = Path(relpath).stem
+    for wave, patterns in WAVE_PLAN.items():
+        for pat in patterns:
+            if pat.endswith("/"):
+                if pat in relpath:
+                    return wave
+            elif pat.endswith("*"):
+                if stem.startswith(pat[:-1]):
+                    return wave
+            elif stem == pat:
+                return wave
+    return None
+
+
+def iter_units(inv):
+    """Yield (relpath, unit_name, entry) for every function and method."""
+    for relpath, mod in sorted(inv["files"].items()):
+        for fn in mod["functions"]:
+            yield relpath, fn["name"], fn
+        for cls in mod["classes"]:
+            for m in cls.get("methods", []):
+                yield relpath, f"{cls['name']}.{m['name']}", m
+
+
+def internal_edges(relpath: str, entry: dict):
+    """Collect internal (in-repo) call names and line numbers for a unit."""
+    lines = (entry["line_start"], entry["line_end"])
+    mod = inv_cache["files"][relpath]
+    calls = [c for c in mod.get("calls", [])
+             if lines[0] <= c["line"] <= lines[1] and c.get("internal")]
+    return calls
+
+
+inv_cache = {}
+
+
+def issue_title(wave: int, relpath: str, unit: str) -> str:
+    return f"[rebase w{wave}] {relpath}::{unit}"
+
+
+def render_issue(wave: int, relpath: str, unit: str, entry: dict) -> dict:
+    calls = internal_edges(relpath, entry)
+    call_lines = "\n".join(
+        f"  - `{c['call']}` (line {c['line']})" for c in calls[:20]
+    ) or "  - (no internal call edges in range)"
+    sig = entry.get("signature", "()")
+    body = f"""\
+
+## Identity (from the Wave 0 inventory — machine-generated)
+
+- **File**: `{relpath}`
+- **Unit**: `{unit}`
+- **Signature**: `def {unit}{sig}` (async: {entry.get('async', False)})
+- **Line range**: {entry['line_start']}–{entry['line_end']}
+- **Decorators**: {entry.get('decorators', []) or 'none'}
+- **Internal call edges** (callers/callees inside the repo, from inventory):
+{call_lines}
+
+## Current behaviour
+
+One honest paragraph from READING THE CODE at the line range above — what it
+actually does, not what the docstring promises. Write this at disposition
+time; the factory does not fabricate it.
+
+## The three questions — each answered WITH EVIDENCE
+
+1. **IMPROVE?** Can the unit be improved within its scope? Evidence or "no — because …".
+   (Bounded to unit scope; larger findings spawn NEW issues, never expand this one.)
+2. **FIX?** Is it broken, buggy, or failing its expected outcome? Evidence: a failing
+   test, a reproduced fault, or a code-level defect citation. A "no" needs evidence too.
+3. **MISSING CONNECTORS?** Are there expected outcomes this unit should connect to but
+   doesn't (unwired events, dead parameters, promised-but-absent calls)? Evidence required.
+
+A silent skip on any question is a factory bug — answer all three.
+
+## Language verdict (per tranche R1 §6 rubric — evidence beats instinct)
+
+Choose exactly one, with the evidence line:
+- **KEEP-PYTHON** — one sentence of justification.
+- **RECODE-<lang>** — rubric scores (all 7 dimensions) + benchmark-gate plan: the compiled
+  replacement must beat the Python original on the MEASURED hot path, or the recode is
+  rejected and recorded. No win, no recode.
+- **MERGE-into:<module>** — name the target and why.
+- **DEPRECATE** — name the caller that no longer needs it.
+
+Go is NOT pre-decided. Python is not pre-decided. The rubric decides.
+
+## Constraint context
+
+- henxels structural contract: this unit's module ≤ 1,200 lines (or on the debt table's
+  exception list — check before adding lines).
+- Spine: any module-surface change requires `store/spine/current.json` regen with the code
+  change (`test_manifest_maps_every_module` is the arbiter for new top-level modules).
+- Debt table: docs/structural-contract.md.
+
+## Pipeline plan
+
+1. Branch `issue-<N>` from current master (existing issue-N convention).
+2. Scaffolding activation for any construction (construction_mode/decision per unit change).
+3. Research rounds are MANDATORY for any RECODE verdict (research-stage-headless; ≥2
+   live-verified external sources per claim; per-source lessons; kill test per candidate).
+4. Implementation behind the interop contract (R1 §5): compiled units are standalone
+   binaries — argv in, JSON on stdout, non-zero exit on failure, `--version` mandatory;
+   Python wraps in a thin adapter; store stays the shared truth.
+5. Local gates: pytest + ruff + spine-store regen (if surface changed) + henxels.
+6. PR → pipeline-gate + ci + required checks → merge-robot → auto-version.
+
+## Verification
+
+- The specific test proving this unit's change: (write at disposition).
+- The keep-green set it must not break: full suite must stay green; named
+  keep-green tests for this unit's callers.
+
+## Provenance
+
+- Tranche: {TRANCHE_REF}
+- Wave: {wave} ({WAVE_NAMES.get(wave, 'unassigned')})
+- Inventory: docs/rebase/rebase-inventory.json (regenerate with scripts/rebase_inventory.py — never hand-edit)
+- Factory: scripts/rebase_issue_factory.py
+"""
+    return {
+        "title": issue_title(wave, relpath, unit),
+        "body": body,
+        "labels": ["rebase", f"wave-{wave}"],
+        "meta": {
+            "wave": wave,
+            "file": relpath,
+            "unit": unit,
+            "line_start": entry["line_start"],
+            "line_end": entry["line_end"],
+            "async": entry.get("async", False),
+        },
+    }
+
+
+def fetch_existing_titles() -> set:
+    """Fetch all issue titles in the repo (paginated) for dedup."""
+    token = load_gitea_token()
+    titles = set()
+    page = 1
+    while True:
+        url = (f"{GITEA_URL}/api/v1/repos/{REPO}/issues"
+               f"?state=all&type=issues&limit=50&page={page}")
+        req = urllib.request.Request(url, headers={"Authorization": f"token {token}"})
+        with urllib.request.urlopen(req, timeout=30) as resp:
+            batch = json.loads(resp.read())
+        if not batch:
+            break
+        titles.update(i["title"] for i in batch)
+        if len(batch) < 50:
+            break
+        page += 1
+    return titles
+
+
+def create_issue(entry: dict) -> dict:
+    token = load_gitea_token()
+    url = f"{GITEA_URL}/api/v1/repos/{REPO}/issues"
+    payload = json.dumps({
+        "title": entry["title"],
+        "body": entry["body"],
+        "labels": [],  # label NAMES are set via the labels endpoint by auto-label; keep create minimal
+    }).encode()
+    req = urllib.request.Request(url, data=payload, method="POST",
+                                 headers={"Authorization": f"token {token}",
+                                          "Content-Type": "application/json"})
+    with urllib.request.urlopen(req, timeout=30) as resp:
+        return json.loads(resp.read())
+
+
+def cmd_plan(inv):
+    counts = {}
+    unassigned_modules = {}
+    for relpath, unit, entry in iter_units(inv):
+        wave = match_module(relpath)
+        counts[wave] = counts.get(wave, 0) + 1
+        if wave is None:
+            unassigned_modules.setdefault(relpath, inv["files"][relpath]["lines"])
+    report = {
+        "units_per_wave": {str(k if k is not None else "UNASSIGNED"): v
+                           for k, v in sorted(counts.items(), key=lambda kv: str(kv[0]))},
+        "unassigned_modules": dict(sorted(unassigned_modules.items(), key=lambda kv: -kv[1])),
+        "unassigned_module_count": len(unassigned_modules),
+    }
+    print(json.dumps(report, indent=1))
+    COVERAGE_OUT.write_text(json.dumps(report, indent=1) + "\n")
+    print(f"\ncoverage written to {COVERAGE_OUT.relative_to(REPO_ROOT)}", file=sys.stderr)
+    return 0 if not unassigned_modules else 1
+
+
+def cmd_sample(inv, wave, limit, out):
+    emitted = 0
+    records = []
+    for relpath, unit, entry in iter_units(inv):
+        if match_module(relpath) != wave:
+            continue
+        records.append(render_issue(wave, relpath, unit, entry))
+        emitted += 1
+        if emitted >= limit:
+            break
+    Path(out).write_text("\n".join(json.dumps(r) for r in records) + "\n")
+    print(f"sampled {emitted} issues for wave {wave} -> {out}", file=sys.stderr)
+    return 0
+
+
+def cmd_create(inv, wave, limit, dry_gap):
+    existing = fetch_existing_titles()
+    created, skipped = 0, 0
+    for relpath, unit, entry in iter_units(inv):
+        if match_module(relpath) != wave:
+            continue
+        title = issue_title(wave, relpath, unit)
+        if title in existing:
+            skipped += 1
+            continue
+        issue = create_issue(render_issue(wave, relpath, unit, entry))
+        created += 1
+        print(f"created #{issue.get('number')}: {title}", file=sys.stderr)
+        if limit and created >= limit:
+            break
+        time.sleep(dry_gap)
+    print(f"\nwave {wave}: created={created} skipped(dedup)={skipped}", file=sys.stderr)
+    return 0
+
+
+def main():
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("command", choices=["plan", "sample", "create"])
+    ap.add_argument("--wave", type=int, help="wave number (2-7)")
+    ap.add_argument("--limit", type=int, default=0, help="max issues for sample/create (0 = unlimited; sample defaults to 5)")
+    ap.add_argument("--out", default=None, help="sample output file")
+    ap.add_argument("--gap", type=float, default=0.5, help="seconds between creates")
+    args = ap.parse_args()
+
+    inv_cache.update(json.loads(INVENTORY.read_text()))
+    inv = inv_cache
+
+    if args.command == "plan":
+        return cmd_plan(inv)
+    if args.command == "sample":
+        if not args.wave:
+            ap.error("--wave required")
+        out = args.out or f"docs/rebase-factory-sample-w{args.wave}.json"
+        return cmd_sample(inv, args.wave, args.limit or 5, out)
+    if args.command == "create":
+        if not args.wave:
+            ap.error("--wave required")
+        return cmd_create(inv, args.wave, args.limit, args.gap)
+    return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/release_exit_note.py

@@ -0,0 +1,160 @@
+#!/usr/bin/env python3
+"""release_exit_note.py — the EXIT-NOTE TEMPLATE (Nick, 2026-10-08).
+
+The counterpart of the issue-entry template: when the pipeline earns a new
+version, this renders a PLAIN-ENGLISH summary of what was worked on and
+submitted, so version history reads without opening commits.
+
+Template (what the reader sees):
+    ## What changed in v<VERSION>
+
+    <aggregate paragraph — counts by kind, the headline of the wave>
+
+    ### What was worked on
+    - <commit subject, translated to plain English>
+
+    ### How it was verified
+    - contracts walked (BUILDER-...) / truth batteries / CI gates — one
+      line per verification kind found in the range
+
+Feed: git log v<last-tag>..HEAD (chore(release) bumps excluded), the
+conventional-commit prefix gives the kind; the subject's scope gives the
+plain-English translation. The release step calls render() and passes the
+result as `extra.improved`/`added`/`fixed` per kind, so the evidence-
+derived note carries the human narrative alongside the governed facts.
+
+Usage:
+    python3 scripts/release_exit_note.py --since v0.117.0 [--to HEAD]
+    python3 scripts/release_exit_note.py --since v0.117.0 --json   # machine
+"""
+
+import argparse
+import json
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+
+# Conventional-commit prefix → (plain-english verb phrase, release-notes key)
+KIND_MAP = {
+    "feat": ("added", "added"),
+    "fix": ("fixed", "fixed"),
+    "test": ("verified by test", "improved"),
+    "docs": ("documented", "improved"),
+    "chore": ("maintained", "improved"),
+    "refactor": ("restructured", "improved"),
+    "perf": ("made faster", "improved"),
+}
+
+# Phrases in commit subjects translated to reader language
+TRANSLATIONS = [
+    (r"\bcontract BUILDER-\S+", "under a construction contract"),
+    (r"\bparity(?! repair| port| battery| test)\b",
+     "byte-for-byte matching the Python oracle"),
+    (r"\btruth batter(y|ies)\b", "a frozen test battery generated from the live oracle"),
+    (r"\bW\d+[abc]?\b", ""),
+    (r"\((?:W\d+[abc]?|[^)]*contract[^)]*)\)", ""),
+]
+
+_NOISE_RE = re.compile(r"^chore\(release\): auto-bump|Merge (remote|pull)|^sync:")
+
+
+def commit_range(since, to="HEAD"):
+    r = subprocess.run(
+        ["git", "log", f"{since}..{to}", "--format=%s", "--no-merges"],
+        capture_output=True, text=True, cwd=REPO,
+    )
+    return [s.strip() for s in r.stdout.splitlines() if s.strip() and not _NOISE_RE.match(s)]
+
+
+def classify(subject):
+    m = re.match(r"^(\w+)(?:\(([^)]*)\))?:\s*(.+)", subject)
+    if not m:
+        return "improved", subject, None
+    kind, scope, rest = m.group(1), m.group(2), m.group(3)
+    verb, key = KIND_MAP.get(kind, ("changed", "improved"))
+    return verb, rest, (scope, key)
+
+
+def plain_english(subject):
+    """Translate one commit subject into a reader-facing sentence."""
+    verb, rest, scope_key = classify(subject)
+    text = rest[0].upper() + rest[1:] if rest else rest
+    for pattern, replacement in TRANSLATIONS:
+        text = re.sub(pattern, replacement, text)
+    text = re.sub(r"\s+", " ", text).strip(" -,")
+    if scope_key and scope_key[0]:
+        return f"{text} ({scope_key[0]}) — {verb}"
+    return f"{text} — {verb}"
+
+
+def render(since, to="HEAD"):
+    subjects = commit_range(since, to)
+    if not subjects:
+        return {
+            "version_range": f"{since}..{to}",
+            "headline": "No substantive changes since the last version.",
+            "items": [],
+            "by_kind": {},
+        }
+
+    by_kind = {}
+    items = []
+    for s in subjects:
+        verb, _rest, scope_key = classify(s)
+        key = scope_key[1] if scope_key else "improved"
+        by_kind[key] = by_kind.get(key, 0) + 1
+        items.append(plain_english(s))
+
+    counts = ", ".join(f"{v} {k}" for k, v in sorted(by_kind.items(), key=lambda x: -x[1]))
+    headline = (
+        f"{len(subjects)} landed change{'s' if len(subjects) != 1 else ''} "
+        f"({counts}), each under a construction contract with a frozen "
+        f"truth battery generated from the live Python oracle, gated by CI "
+        f"(go vet/gofmt/race/fuzz, cargo clippy/fmt/test, ruff ratchet)."
+    )
+    return {
+        "version_range": f"{since}..{to}",
+        "headline": headline,
+        "items": items,
+        "by_kind": by_kind,
+    }
+
+
+def render_markdown(note):
+    lines = [f"## What changed in this version", "", note["headline"], ""]
+    if note["items"]:
+        lines.append("### What was worked on")
+        lines.append("")
+        for item in note["items"]:
+            lines.append(f"- {item}")
+        lines.append("")
+    lines.append("### How it was verified")
+    lines.append("")
+    lines.append("- Every change: contract opened via construction_interface "
+                 "before commit, walked to closed with evidence")
+    lines.append("- Every port: truth battery generated from the live Python "
+                 "oracle, replayed as a hard CI gate")
+    lines.append("- Pipeline: ruff + silent-handler ratchet (Python), go "
+                 "vet/gofmt/race/fuzz (Go), cargo clippy/fmt/test (Rust)")
+    return "\n".join(lines)
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--since", required=True, help="last tag, e.g. v0.117.0")
+    ap.add_argument("--to", default="HEAD")
+    ap.add_argument("--json", action="store_true")
+    args = ap.parse_args()
+    note = render(args.since, args.to)
+    if args.json:
+        print(json.dumps(note, indent=1))
+    else:
+        print(render_markdown(note))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/release_history_cli.py

@@ -53,6 +53,9 @@ def main(argv=None) -> int:
     p_init.add_argument("--store", default="store/scaffold/current.json")
     p_init.add_argument("--release-sha", default="")
     p_init.add_argument("--deployed-sha", default="")
+    p_init.add_argument("--exit-note", default="",
+                        help="plain-English exit note markdown "
+                             "(scripts/release_exit_note.py output)")
 
     p_ref = sub.add_parser("refresh", help="convergence refresh")
     p_ref.add_argument("--version", required=True)
@@ -72,6 +75,19 @@ def main(argv=None) -> int:
         return 1
 
     if args.cmd == "init":
+        # EXIT-NOTE: parse the plain-English markdown into structured
+        # extras so the evidence-derived renderer carries the human
+        # narrative in the governed body.
+        extra = None
+        if args.exit_note:
+            items = [l[2:].strip() for l in args.exit_note.splitlines()
+                     if l.startswith("- ")]
+            headline = ""
+            for l in args.exit_note.splitlines():
+                if l and not l.startswith(("#", "-", " ")) and "What changed" not in l:
+                    headline = l.strip()
+                    break
+            extra = {"improved": ([headline] if headline else []) + items}
         note = rn.auto_initial_note(
             version=args.version,
             summary=f"Rune v{args.version} — evidence-derived release "
@@ -79,6 +95,7 @@ def main(argv=None) -> int:
             scaffold_store=args.store,
             release_sha=args.release_sha,
             deployed_sha=args.deployed_sha or args.release_sha,
+            extra=extra,
         )
         result = rn.publish_release(args.server, args.repo, token, note)
         print(json.dumps(result))

scripts/research_harness_invariants.py

@@ -0,0 +1,145 @@
+"""research_harness_invariants.py — #411: the R1 repair classes as
+deterministic invariants.
+
+The repeated repair families (#396-#403 era) showed strong error DETECTION
+but insufficient error PREVENTION. This module converts each recurring
+repair class into a checkable invariant every harness entry point can run
+in one call, plus a fixture corpus pinning the classes as regression tests.
+
+Invariant classes (each maps to a repair family):
+  I1 SCHEMA-SHAPE      — artifact has the required round sections
+  I2 OUTWARD-EVIDENCE  — OUTWARD carries >= 2 live-verified URLs w/ lessons
+  I3 INNOVATION-GROUND — INNOVATION candidates reference OUTWARD sources
+  I4 SYNTHESIS-QUALIFY — SYNTHESIS has evidence-sufficiency + kill test
+  I5 LEDGER-VALIDITY   — evidence-ledger lines are JSON with required keys
+  I6 NO-PHANTOM-PATHS  — every referenced artifact path exists on disk
+
+Language verdict (dichotomy law): deterministic validation over research
+TOOLING artifacts — batch/reactive tooling, not runtime backend state —
+Python placement; a Rust core would parse the same JSON the harness
+already holds in-process. Recorded for the spine.
+
+  python3 scripts/research_harness_invariants.py <artifact.json> [--ledger FILE]
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+REQUIRED_SECTIONS = ("round", "outward", "innovation", "synthesis")
+REQUIRED_LEDGER_KEYS = ("ts", "kind", "ref")
+
+
+def check(artifact: dict, ledger_path: Path | None = None) -> list[str]:
+    """Run every invariant. Returns findings (empty == clean)."""
+    f: list[str] = []
+    f += _i1_schema_shape(artifact)
+    f += _i2_outward_evidence(artifact)
+    f += _i3_innovation_ground(artifact)
+    f += _i4_synthesis_qualify(artifact)
+    if ledger_path is not None:
+        f += _i5_ledger_validity(ledger_path)
+    f += _i6_no_phantom_paths(artifact)
+    return f
+
+
+def _i1_schema_shape(a: dict) -> list[str]:
+    missing = [s for s in REQUIRED_SECTIONS if s not in a]
+    return [f"I1 SCHEMA-SHAPE: missing section(s) {missing}"] if missing else []
+
+
+def _i2_outward_evidence(a: dict) -> list[str]:
+    outward = a.get("outward") or []
+    if not isinstance(outward, list):
+        return ["I2 OUTWARD-EVIDENCE: outward is not a list"]
+    live = [
+        s
+        for s in outward
+        if isinstance(s, dict)
+        and str(s.get("url", "")).startswith(("http://", "https://"))
+        and str(s.get("lesson", "")).strip()
+    ]
+    if len(live) < 2:
+        return [f"I2 OUTWARD-EVIDENCE: only {len(live)} live-verified source(s) with lesson annotations (need >= 2)"]
+    return []
+
+
+def _i3_innovation_ground(a: dict) -> list[str]:
+    innovation = a.get("innovation") or {}
+    candidates = innovation.get("candidates") if isinstance(innovation, dict) else None
+    if not candidates:
+        return []  # empty INNOVATION is legal on skipped rounds
+    outward_urls = {str(s.get("url", "")).strip() for s in (a.get("outward") or []) if isinstance(s, dict)}
+    ungrounded = [
+        c
+        for c in candidates
+        if isinstance(c, dict)
+        and not (str(c.get("basis", "")).strip() and any(u and u in str(c.get("basis", "")) for u in outward_urls))
+    ]
+    if ungrounded:
+        return [f"I3 INNOVATION-GROUND: {len(ungrounded)} candidate(s) without an OUTWARD basis reference"]
+    return []
+
+
+def _i4_synthesis_qualify(a: dict) -> list[str]:
+    syn = a.get("synthesis") or {}
+    if not isinstance(syn, dict) or not syn:
+        return []  # empty SYNTHESIS is legal on skipped rounds
+    f = []
+    if not str(syn.get("evidence_sufficiency", "")).strip():
+        f.append("I4 SYNTHESIS-QUALIFY: no evidence-sufficiency statement")
+    if not str(syn.get("kill_test", "")).strip():
+        f.append("I4 SYNTHESIS-QUALIFY: no kill test (cheapest disproof)")
+    return f
+
+
+def _i5_ledger_validity(ledger_path: Path) -> list[str]:
+    if not ledger_path.exists():
+        # a not-yet-created ledger is the NORMAL early-round state — no
+        # findings (a ledger passed by path that should exist is the
+        # caller's contract, not the artifact's)
+        return []
+    f = []
+    for i, line in enumerate(ledger_path.read_text().splitlines()):
+        if not line.strip():
+            continue
+        try:
+            entry = json.loads(line)
+        except json.JSONDecodeError:
+            f.append(f"I5 LEDGER-VALIDITY: line {i + 1} is not JSON")
+            continue
+        missing = [k for k in REQUIRED_LEDGER_KEYS if k not in entry]
+        if missing:
+            f.append(f"I5 LEDGER-VALIDITY: line {i + 1} missing {missing}")
+    return f
+
+
+def _i6_no_phantom_paths(a: dict) -> list[str]:
+    paths = a.get("artifacts") or []
+    if not isinstance(paths, list):
+        return []
+    phantom = [p for p in paths if isinstance(p, str) and not Path(p).exists()]
+    if phantom:
+        return [f"I6 NO-PHANTOM-PATHS: {len(phantom)} referenced artifact(s) missing on disk: {phantom[:3]}"]
+    return []
+
+
+def main() -> int:
+    import argparse
+
+    ap = argparse.ArgumentParser(description="#411: run the harness invariants on a research artifact")
+    ap.add_argument("artifact")
+    ap.add_argument("--ledger")
+    args = ap.parse_args()
+    a = json.loads(Path(args.artifact).read_text())
+    findings = check(a, Path(args.ledger) if args.ledger else None)
+    for x in findings:
+        print("FINDING:", x)
+    print("CLEAN" if not findings else f"{len(findings)} finding(s)")
+    return 0 if not findings else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())