diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bbf4805..0a02a7e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -122,6 +122,12 @@ jobs:
   audit:
     name: cargo-audit (RUSTSEC)
     runs-on: ubuntu-latest
+    # audit-check reports advisories by creating a check run; without
+    # checks: write the reporting API call 403s ("Resource not accessible
+    # by integration") even when the audit itself passes.
+    permissions:
+      contents: read
+      checks: write
     steps:
       - uses: actions/checkout@v4
       - uses: rustsec/audit-check@v2
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9981dc9..fb9d2fb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,61 @@ onward the project follows SemVer normally: patch releases are
 bug-fix-only, minor releases are backward-compatible additions, and
 breaking changes require a major bump.
 
+## v2.5.2: The brain that learns from its own outcomes
+
+Consolidation v1: the first release where citation outcomes reshape the brain
+itself, with every mechanism model-free and every constant documented on one
+page. Backward-compatible (schema v9 → v10, automatic on open).
+
+### Consolidation v1 (new)
+
+- `kimetsu brain reinforce`: offline consolidation pass. `--staple` merges
+  memories that were repeatedly cited together into single fact memories
+  (precomputed multi-hop joins; originals kept; provenance carries part ids).
+  `--routes` builds a query-routing index from citation history: memories that
+  answered similar questions before get a bounded retrieval boost.
+- `kimetsu brain cite` accepts repeated `--memory-id` (citing a GROUP — the
+  co-citation signal stapling consumes) and `--query` (linking citations to
+  the question they answered, feeding the routing index).
+- Retrieval-time routing boost with a fixed per-retrieval budget, per-candidate
+  cap, minimum support, and power-law decay.
+
+### Learning-loop guardrails
+
+- The usefulness boost's relevance gain is capped: a heavily-cited memory can
+  win ties but can never outrank a genuinely more relevant one (fixes a
+  measured retrieval-flooding failure mode under sustained citation feedback).
+- Cited-in-failure penalty now scales with citation history
+  (`-1.0 / (1 + prior citations / 3)`): a proven memory absorbs occasional
+  flaky-run hits; an unproven one takes the full penalty.
+- All scoring constants (deltas, caps, envelopes, decay) now live in one
+  documented module, `scoring.rs`.
+
+### Quality of life
+
+- Schema-mismatch errors name the offending `project.toml` and hint at the
+  fix (project discovery climbs to the enclosing git root, so the file is
+  often far from where you ran the command).
+- npm packages ship with provenance attestations (Sigstore): every published
+  package is publicly verifiable as built by CI from this repo.
+- Internal: `project.rs` and the CLI `main.rs` split into focused modules.
+
+### Benchmarks
+
+- LoCoMo: 89.4% on the standard 1,540-question set (LLM-judged accuracy).
+- Learning-curve harness validated: citation feedback never degrades
+  retrieval across repeated iterations, with a train/holdout split proving
+  generalization.
+
+## v2.5.0: Ship the brain to your team
+
+Flagships: retrieval level presets (`basic`/`flexible`/`deep`/`advanced`),
+temporal validity and date-aware ingestion, fleet write-safety (concurrent
+writers, per-event origin), convergent team sync (HLC replay + conflict
+surfacing), Kimetsu Remote GA with per-user attribution, and shareable brain
+packs (gzip + security-scrubbed export, merge/replace import from file or
+URL). Docs site moved to kimetsu.dev.
+
 ## v2.0.0: Never explore twice
 
 The biggest token sink is RE-EXPLORATION: the agent re-deriving what the brain
diff --git a/Cargo.lock b/Cargo.lock
index ea62932..4c9f26d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -91,7 +91,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -102,7 +102,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -876,9 +876,9 @@ dependencies = [
 
 [[package]]
 name = "cxx"
-version = "1.0.194"
+version = "1.0.196"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "747d8437319e3a2f43d93b341c137927ca70c0f5dabeea7a005a73665e247c7e"
+checksum = "ac6f8908ed0826ab0aec7c8358a4de3a9b26c5ed391a5dc5135765d2fd1aa8fb"
 dependencies = [
  "cc",
  "cxx-build",
@@ -891,9 +891,9 @@ dependencies = [
 
 [[package]]
 name = "cxx-build"
-version = "1.0.194"
+version = "1.0.196"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0f4697d190a142477b16aef7da8a99bfdc41e7e8b1687583c0d23a79c7afc1e"
+checksum = "6d8ae25c0ce72ac21a77b5deec4f49b452238ef97072f697dd6fd752b1355ecd"
 dependencies = [
  "cc",
  "codespan-reporting",
@@ -906,9 +906,9 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-cmd"
-version = "1.0.194"
+version = "1.0.196"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0956799fa8678d4c50eed028f2de1c0552ae183c76e976cf7ca8c4e36a7c328"
+checksum = "27d53791812143bd27f74ab6055f22e875f04c59bbef0ca03d714ebec6f6f484"
 dependencies = [
  "clap",
  "codespan-reporting",
@@ -920,15 +920,15 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.194"
+version = "1.0.196"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23384a836ab4f0ad98ace7e3955ad2de39de42378ab487dc28d3990392cb283a"
+checksum = "fd557619f7dc2252bf7373f6bec5600ce60a2b477e5b3b84eb4e074bb297795e"
 
 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.194"
+version = "1.0.196"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6acc6b5822b9526adfb4fc377b67128fdd60aac757cc4a741a6278603f763cf"
+checksum = "7fe465fc5b9d0231ea141c4fae714a08f4f907855e1a7ca10cc90ab6c8b12ece"
 dependencies = [
  "indexmap",
  "proc-macro2",
@@ -1093,7 +1093,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -1176,7 +1176,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1989,7 +1989,7 @@ dependencies = [
 
 [[package]]
 name = "kimetsu-agent"
-version = "2.5.1"
+version = "2.5.2"
 dependencies = [
  "aws-credential-types",
  "aws-sigv4",
@@ -2009,7 +2009,7 @@ dependencies = [
 
 [[package]]
 name = "kimetsu-brain"
-version = "2.5.1"
+version = "2.5.2"
 dependencies = [
  "blake3",
  "fastembed",
@@ -2030,7 +2030,7 @@ dependencies = [
 
 [[package]]
 name = "kimetsu-chat"
-version = "2.5.1"
+version = "2.5.2"
 dependencies = [
  "base64 0.22.1",
  "crossterm",
@@ -2046,7 +2046,7 @@ dependencies = [
 
 [[package]]
 name = "kimetsu-cli"
-version = "2.5.1"
+version = "2.5.2"
 dependencies = [
  "clap",
  "flate2",
@@ -2071,7 +2071,7 @@ dependencies = [
 
 [[package]]
 name = "kimetsu-core"
-version = "2.5.1"
+version = "2.5.2"
 dependencies = [
  "serde",
  "serde_json",
@@ -2082,7 +2082,7 @@ dependencies = [
 
 [[package]]
 name = "kimetsu-e2e"
-version = "2.5.1"
+version = "2.5.2"
 dependencies = [
  "kimetsu-agent",
  "kimetsu-brain",
@@ -2095,7 +2095,7 @@ dependencies = [
 
 [[package]]
 name = "kimetsu-remote"
-version = "2.5.1"
+version = "2.5.2"
 dependencies = [
  "axum",
  "axum-server",
@@ -2428,7 +2428,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -3188,7 +3188,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3501,7 +3501,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -3613,7 +3613,7 @@ dependencies = [
  "getrandom 0.3.4",
  "once_cell",
  "rustix",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -4348,7 +4348,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 8597e01..6480c74 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -15,7 +15,7 @@ resolver = "3"
 # everything below except the per-crate `description`, `keywords`,
 # and `categories` which live in each `[package]` block since
 # crates.io enforces them per crate.
-version = "2.5.1"
+version = "2.5.2"
 edition = "2024"
 # Rust ecosystem dual-license (matches tokio, serde, fastembed-rs,
 # etc.). UNLICENSED would block crates.io entirely.
diff --git a/crates/kimetsu-agent/Cargo.toml b/crates/kimetsu-agent/Cargo.toml
index 5c58981..f91b2ce 100644
--- a/crates/kimetsu-agent/Cargo.toml
+++ b/crates/kimetsu-agent/Cargo.toml
@@ -27,8 +27,8 @@ aws-sigv4.workspace = true
 aws-smithy-runtime-api.workspace = true
 blake3.workspace = true
 http.workspace = true
-kimetsu-brain = { path = "../kimetsu-brain", version = "2.5.1" }
-kimetsu-core = { path = "../kimetsu-core", version = "2.5.1" }
+kimetsu-brain = { path = "../kimetsu-brain", version = "2.5.2" }
+kimetsu-core = { path = "../kimetsu-core", version = "2.5.2" }
 regex.workspace = true
 reqwest.workspace = true
 rusqlite.workspace = true
diff --git a/crates/kimetsu-brain/Cargo.toml b/crates/kimetsu-brain/Cargo.toml
index a20d3cc..12a4aad 100644
--- a/crates/kimetsu-brain/Cargo.toml
+++ b/crates/kimetsu-brain/Cargo.toml
@@ -50,7 +50,7 @@ hf-hub = { version = "0.5", optional = true, default-features = false, features
 # already native (ort). The lean build never links it.
 usearch = { version = "2", optional = true }
 ignore.workspace = true
-kimetsu-core = { path = "../kimetsu-core", version = "2.5.1" }
+kimetsu-core = { path = "../kimetsu-core", version = "2.5.2" }
 # v0.4.5: regex backs the secret-redaction patterns in
 # `kimetsu_brain::redact`. The crate is already a workspace pin
 # elsewhere; we just opt this crate into it now.
diff --git a/crates/kimetsu-chat/Cargo.toml b/crates/kimetsu-chat/Cargo.toml
index cbd5d30..efcaaf7 100644
--- a/crates/kimetsu-chat/Cargo.toml
+++ b/crates/kimetsu-chat/Cargo.toml
@@ -38,9 +38,9 @@ openclaw = ["dep:json5"]
 # surface, not a benchmark harness.
 
 [dependencies]
-kimetsu-agent = { path = "../kimetsu-agent", version = "2.5.1" }
-kimetsu-brain = { path = "../kimetsu-brain", version = "2.5.1" }
-kimetsu-core = { path = "../kimetsu-core", version = "2.5.1" }
+kimetsu-agent = { path = "../kimetsu-agent", version = "2.5.2" }
+kimetsu-brain = { path = "../kimetsu-brain", version = "2.5.2" }
+kimetsu-core = { path = "../kimetsu-core", version = "2.5.2" }
 base64.workspace = true
 crossterm.workspace = true
 json5 = { workspace = true, optional = true }
diff --git a/crates/kimetsu-cli/Cargo.toml b/crates/kimetsu-cli/Cargo.toml
index 6adcdf2..1a16deb 100644
--- a/crates/kimetsu-cli/Cargo.toml
+++ b/crates/kimetsu-cli/Cargo.toml
@@ -43,10 +43,10 @@ path = "src/main.rs"
 
 [dependencies]
 clap.workspace = true
-kimetsu-agent = { path = "../kimetsu-agent", version = "2.5.1" }
-kimetsu-brain = { path = "../kimetsu-brain", version = "2.5.1" }
-kimetsu-chat = { path = "../kimetsu-chat", version = "2.5.1" }
-kimetsu-core = { path = "../kimetsu-core", version = "2.5.1" }
+kimetsu-agent = { path = "../kimetsu-agent", version = "2.5.2" }
+kimetsu-brain = { path = "../kimetsu-brain", version = "2.5.2" }
+kimetsu-chat = { path = "../kimetsu-chat", version = "2.5.2" }
+kimetsu-core = { path = "../kimetsu-core", version = "2.5.2" }
 # v0.4.6: `kimetsu doctor` serializes its report struct so --json
 # output can be piped into CI / hooks.
 flate2 = "1"
diff --git a/crates/kimetsu-e2e/Cargo.toml b/crates/kimetsu-e2e/Cargo.toml
index 82f2ed8..0f99b4d 100644
--- a/crates/kimetsu-e2e/Cargo.toml
+++ b/crates/kimetsu-e2e/Cargo.toml
@@ -20,9 +20,9 @@ publish = false
 # Real (non-dev) deps so the test fixtures + scripted provider can be
 # re-exported from `kimetsu_e2e::prelude` to the integration tests in
 # `tests/`. Integration tests treat this crate as a normal library.
-kimetsu-agent = { path = "../kimetsu-agent", version = "2.5.1" }
-kimetsu-brain = { path = "../kimetsu-brain", version = "2.5.1" }
-kimetsu-core = { path = "../kimetsu-core", version = "2.5.1" }
+kimetsu-agent = { path = "../kimetsu-agent", version = "2.5.2" }
+kimetsu-brain = { path = "../kimetsu-brain", version = "2.5.2" }
+kimetsu-core = { path = "../kimetsu-core", version = "2.5.2" }
 rusqlite.workspace = true
 serde_json.workspace = true
 time.workspace = true