fix: remediate CLI, memory and upstream integration follow-ups

.github/workflows/ci.yml

@@ -60,7 +60,7 @@ jobs:
           # The smoke test proves local CLI behavior, not npm reachability.
           # Seed a fresh empty drift cache so an offline Windows runner does
           # not pay four sequential 20s `npm view` timeouts inside status.
-          node -e 'const fs=require("node:fs"),p=require("node:path"),base=process.platform==="win32"?process.env.APPDATA:process.env.XDG_CONFIG_HOME,dir=p.join(base,"agentic-kit"),last=Date.now();fs.mkdirSync(dir,{recursive:true});fs.writeFileSync(p.join(dir,"kit.json"),JSON.stringify({versionCheck:{last,seen:{},self:{last,best:null}}}))'
+          node -e 'const fs=require("node:fs"),p=require("node:path"),base=process.platform==="win32"?process.env.APPDATA:process.env.XDG_CONFIG_HOME,dir=p.join(base,"agentic-kit"),last=Date.now();fs.mkdirSync(dir,{recursive:true});fs.writeFileSync(p.join(dir,"kit.json"),JSON.stringify({versionCheck:{last,seen:{},self:{last,best:null,lastTags:["latest","next"]}}}))'
           node bin/agentic-kit.mjs --version
           node bin/agentic-kit.mjs --help --all > /dev/null
           # status must emit valid JSON and exit deterministically even on a

bin/agentic-kit.mjs

@@ -127,7 +127,7 @@
  *  reported after that point still answers with one JSON object. */
 let jsonRequested = false;
 
 async function main() {
   const argv = process.argv.slice(2);
   let cmd = argv[0];
   let rest = argv.slice(1);
@@ -194,7 +194,9 @@
   } catch (err) {
     if (!String(err?.code ?? '').startsWith('ERR_PARSE_ARGS_')) throw err;
     if (cmd === 'telemetry') {
-      console.error('Telemetry failed: invalid command options.');
+      const error = 'Telemetry failed: invalid command options.';
+      console.error(error);
+      console.log(JSON.stringify({ error, exitCode: 2 }));
       return 2;
     }
     // Under --json a rejected option still answers with one JSON object (the

docs/adr/0055-aqe-embedding-lifecycle.md

@@ -14,16 +14,17 @@
 - **Updated:** 2026-09-27 — the recognizer accepts every plain npx spelling of AQE's server (optional `-y`/`--yes`; unversioned, `@latest` or an exact version), audit item 5 choice A
 - **Updated:** 2026-09-27 — a passing embedding check reads "embedder verified"; status, `ak x verify aqe` and setup say AQE's pattern index binding stays unverified (agentic-qe#754) and corpus compatibility stays separate
 - **Updated:** 2026-09-27 — the busy rule's removal condition is agentic-qe#574 fixed in a released agentic-qe that is the kit floor; agentic-qe#719 (carried by 3.14.4) is only a partial fix
+- **Updated:** 2026-09-29 — the later approved N-1 criterion supersedes that floor condition: released AQE 3.14.4 passed native macOS and Linux live-owner probes without `FsyncFailed`, so ak removed the exact 3.14.3 `FsyncFailed`-as-busy exception. Any `FsyncFailed`/`0x0303` now fails, including the old sequence. Ordinary `LockHeld` SQLite fallback remains busy with owner health and RVF integrity unknown. AQE 3.14.4 is the verified baseline for this decision, not a universal minimum; native Windows AQE conformance was not run
 - **Updated:** 2026-09-27 — beside these projections, `ak sync` and `ak setup` pin AQE to the project root (absolute `AQE_PROJECT_ROOT`, `AQE_MEMORY_PATH`, `AQE_STORAGE_PATH`) in `.claude/settings.local.json`, the recognized `.mcp.json` entry and both AQE tables of the project `.codex/config.toml`, under receipts from the same owned-env engine; a file git tracks is not pinned, and AQE's own relative `AQE_MEMORY_PATH` is taken back even after an AQE re-init. Stray AQE stores are merged and archived by `ak x aqe-store merge`. See [ADR-0062](0062-aqe-project-store-integrity.md) (remediation Branch 5, B5-D1 to B5-D5, B5-M5)
 - **Updated:** 2026-09-28 — live-check evidence storage relocated from `<stateBase>/agentic-kit/live-checks/<id>.json` to the shared `<stateBase>/agentic-kit/evidence/live-check/<id>.json` layout; this ADR's own live-check BEHAVIOR (TTL, statuses, remembered-check display) is unchanged, only where the evidence file lives. `ak x aqe-embedding verify` (distinct from `ak x verify`'s `aqe-embedding` row) does not persist evidence either way — it is a one-shot, unpersisted synthetic-backend proof. See [ADR-0063](0063-evidence-store-and-refresh-vocabulary.md) (remediation program, branch 6a task 2)
 - **Updated:** 2026-09-28 — `ak x verify` is retired; its live checks (this ADR's own quick
   `aqe-embedding` check among them) run only as `ak status --refresh=live`'s live stage, and the
   full `aqe` proof runs with `--only aqe`. A live-check evidence row now carries the source id
   `status-refresh-live`, labelled "ak status --refresh=live"; a row recorded before this rename
   under the retired `verify`/`status-live` source ids still reads back, labelled "an earlier live
-  check" — the label never names a retired command. Evidence ids are unchanged: `memory-routes`
-  still records under the `memory` id, and the full `aqe` proof still records only its embedding
-  request under `aqe-embedding` (remediation program, branch 6b; see
+  check" — the label never names a retired command. `memory-routes` records its CLI round trip
+  under `memory` and its routing observation under `memory-routes`; the full `aqe` proof still
+  records only its embedding request under `aqe-embedding` (remediation program, branch 6b; see
   [ADR-0063](0063-evidence-store-and-refresh-vocabulary.md))
 - **Related:** [ADR-0023](0023-fail-closed-operations-and-explicit-degradation.md),
   [September repair](https://github.com/pacphi/agentic-kit/blob/main/docs/archive/2026-09-09-audit-aqe-integration-repair.md)

docs/adr/0062-aqe-project-store-integrity.md

@@ -6,6 +6,7 @@
   re-init value taken back, clean release; holder checks that time out refuse; nested repositories
   are not strays; stores fingerprinted at copy time; root checked before backup; applying receipt;
   starter patterns the root holds keep their usage
+- **Updated:** 2026-09-29 — released AQE 3.14.4 passed native macOS and Linux live-owner conformance with `LockHeld` and no `FsyncFailed`; ak retired only the old exact `FsyncFailed`-as-busy exception in AQE startup classification. This is a verified baseline for that rule, not a universal AQE minimum. The 3.14.4 minimum below applies only to store merge. Native Windows AQE conformance remains unverified
 - **Deciders:** agentic-kit maintainers
 - **Related:** [ADR-0016](0016-capability-driven-integration-adapters.md) (project memory status and
   stray stores), [ADR-0055](0055-aqe-embedding-lifecycle.md) (the AQE embedding projections this

docs/adr/0063-evidence-store-and-refresh-vocabulary.md

@@ -1,7 +1,7 @@
 # ADR-0063 — One evidence store and the refresh vocabulary
 
 - **Status:** Accepted
-- **Updated:** 2026-09-29 — Branch 6c delivered the dashboard refresh operation and retired GET-started scans
+- **Updated:** 2026-09-29 — Branch 6c delivered the dashboard refresh operation and retired GET-started scans; 2026-09-29 V4 A3: self-version retry attempts and last freshness are scoped to checked channels
 - **Earlier update:** 2026-09-28 — Branch 6b delivered the CLI refresh vocabulary
 - **Date:** 2026-09-28
 - **Deciders:** agentic-kit maintainers
@@ -430,9 +430,9 @@ this branch" section and "Delivered in 6c" below.
   `learning`, `harvest`, `aqe`, `memory-routes` — slow, `--only`-only) now live in
   `src/lib/live-checks.mjs` and run as `--refresh=live`'s `live` stage. `memory` is the quick
   store/retrieve/purge round trip; `memory-routes` additionally observes whether the CLI and MCP
-  see each other's writes, and its result is remembered under the `memory` evidence id, not its
-  own. A live-check evidence row now carries the source id `status-refresh-live`, labelled "ak
-  status --refresh=live"; a row recorded before this branch under the retired `verify` or
+  see each other's writes. Its CLI result is remembered under `memory` and its routing result
+  under `memory-routes`. A live-check evidence row carries the source id
+  `status-refresh-live`, labelled "ak status --refresh=live"; a row recorded before this branch under the retired `verify` or
   `status-live` source ids still reads back, labelled "an earlier live check" — the label never
   names a retired command (`live-check-evidence.mjs`'s `SOURCE_LABEL`).
 - **The Codex quota presence gate.** `/api/limits` asks `codex app-server` for its
@@ -539,25 +539,7 @@ shared evidence envelope.
 
 ## Known limitations (recorded, not fixed, by this branch)
 
-1. **Resolved in Branch 6b: the failed-lookup rule is now the same in all four version-drift
-   functions.** This item originally recorded that `ruvector.mjs`/`ruvnet-brain.mjs`'s `drift()`
-   could silently drop a known update on a failed forced fetch, unlike `versions.mjs`'s
-   `driftReport()`/`selfDrift()`. Branch 6b fixed both (`fix(versions): a failed lookup keeps the
-   cached version and waits one TTL window before retrying`, and its follow-ups), so all four now
-   share one rule: on a total lookup failure, the cached `latest`/`best`/`installedRelease` value
-   is kept — never overwritten with `null` — and the TTL stamp (`last`) is restamped, so the next
-   unforced call waits one more TTL window before retrying (`force` bypasses this and retries
-   immediately). `observedAt` records the real time a value was last actually observed, not the
-   time of a failed retry: `ruvector.mjs`'s `drift()` keeps `observedAt: cached.observedAt ??
-   cached.last` on failure (`:70`); `ruvnet-brain.mjs`'s `drift()` does the same
-   (`:288`, `recordedRelease()`); `versions.mjs`'s `driftReport()`'s `lookUpLatest()` restamps
-   `observedAt` from the prior `last` only for packages that were never individually observed
-   (`:82`); its `selfDrift()`'s `selfRecord()` restamps on a *total* failure, including one with no
-   cached candidate at all — only a partial answer (something answered live but did not win), or a
-   total failure whose cached candidate is unusable (a `next` candidate on a stable install), saves
-   nothing (`:172-176`). None of the four applies this rule under `record: false` (`ak sync
-   --dry-run`, ADR-0063's own `record` parameter) or a cache-only read (`cacheOnly: true`, `ak
-   sync --skip <part>`): both skip the network and the write entirely, by design.
+1. **Resolved in Branch 6b, refined in V4 A3: failed version lookups retain recorded evidence without claiming a new observation.** A total failed lookup of managed packages, Brain, or ruvector keeps its cached candidate and restamps `last` for one retry per configured TTL; `observedAt` remains the time that candidate was actually seen. The kit follows that rule when its cached candidate is usable. A partial answer that leaves the kit's cached candidate winning, or a stable install whose cached `next` candidate is unusable, keeps `last`, `observedAt`, and `best` unchanged and separately records `versionCheck.self.attempt` with its time and exact channel tags. Successful and total-failure kit lookups record `lastTags`, the channel scope of `last`; changing from stable to prerelease therefore probes an untried `next` channel even within the prior TTL. Legacy records without `lastTags` are reused for the single `latest` channel or where a `next` winner proves it was checked; a legacy `latest` winner cannot suppress an untried `next`. Malformed or future attempt metadata cannot suppress retries. `force` bypasses freshness. `record: false` permits a lookup without saving its result or attempt, while `cacheOnly: true` performs neither a lookup nor a write.
 2. **`globalRoot()`'s `record`-persistence structural fragility** — see "The `npm-global-root`
    exception" above.
 3. **Task 9's dashboard timeout bounds async hangs only** — see "The dashboard poll's two cost