mirror-mind 0.38.1 → 0.39.1

package/.pi/extensions/mirror-logger.ts

@@ -43,6 +43,14 @@
  * it supplies the Operating Instructions (`AGENTS.md`) itself (D13), and says
  * so once when `mirror` is not on the PATH.
  *
+ * The `node` it runs the core on is resolved as the hook wrappers resolve
+ * theirs (CR191): `MIRROR_NODE`, the PATH, the Node that installed the
+ * package, then nvm, Homebrew, and `/usr/local`. A GUI-launched Pi, or one from
+ * a window older than the Node install, has none on its PATH. When nothing
+ * resolves the session says so once, names the fix, and writes one line to
+ * `<mirror home>/hooks.log`, where `runtime diagnose` reads it; it spawns
+ * nothing, and Pi stays up.
+ *
  * External skill prep note:
  * Pi reads installed external skills from
  *   ~/.mirror-minds/<user>/runtime/skills/pi/extensions.json
@@ -52,7 +60,7 @@
 import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
 import { accessSync, appendFileSync, closeSync, constants, existsSync, mkdirSync, openSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { delimiter, dirname, join } from "node:path";
+import { delimiter, dirname, join, posix, win32 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
@@ -180,6 +188,95 @@ function _mirrorOnPath(): string | null {
 	return null;
 }
 
+/**
+ * Where a hook wrapper looks for Node after `MIRROR_NODE`, the PATH, and the
+ * Node beside the entry it runs (CR191). The same list as the core's
+ * `HOOK_NODE_CANDIDATES` (`ts/src/runtime/diagnose.ts`), which this file
+ * cannot import: it is a thin dispatcher and duplicates the contracts it
+ * needs, as it does the homes-root names above. `mirrorLoggerExtension.test.ts`
+ * fails if the two lists differ, as `hooks.test.ts` does for the wrappers.
+ */
+export const NODE_CANDIDATES: readonly string[] = [
+	"$HOME/.nvm/current/bin/node",
+	"/opt/homebrew/bin/node",
+	"/usr/local/bin/node",
+];
+
+/** What `resolveNode` found at a path it probed. */
+export type PathKind = "executable" | "directory" | "not executable" | "missing";
+
+/** An executable FILE: a directory passes `X_OK` on its own. */
+function pathKind(path: string): PathKind {
+	try {
+		if (statSync(path).isDirectory()) return "directory";
+	} catch {
+		return "missing";
+	}
+	try {
+		accessSync(path, constants.X_OK);
+		return "executable";
+	} catch {
+		return "not executable";
+	}
+}
+
+export interface NodeResolution {
+	/** The Node to run the core on, by its path; null when none resolves. */
+	node: string | null;
+	/** A `MIRROR_NODE` the search would not use, and why: the caller says so once. */
+	rejected: { value: string; reason: string } | null;
+}
+
+/**
+ * The Node the core runs on, in the hook wrappers' order (CR191): `MIRROR_NODE`
+ * when it is an absolute path to an executable file; `node` on the PATH; the
+ * Node beside the tree this file ships in, which for a global install is the
+ * `<prefix>/bin/node` that installed the package (and nothing for a checkout);
+ * then `NODE_CANDIDATES`. Not `process.execPath`: Pi may run on a Node older
+ * than the core needs. On Windows the PATH is the last place looked.
+ *
+ * A relative `MIRROR_NODE` is refused here, though the wrappers accept one: it
+ * would resolve against whatever project Pi was opened in.
+ *
+ * The absolute candidates make "nothing anywhere" a fact about the host, so
+ * under `MEMORY_ENV=test` only, `MIRROR_TEST_NODE_SEARCH_ROOT` re-roots them
+ * and the prefix candidate. A production session never reads it.
+ */
+export function resolveNode(
+	env: Record<string, string | undefined>,
+	treeRoot: string,
+	kindOf: (path: string) => PathKind = pathKind,
+	platform: NodeJS.Platform = process.platform,
+): NodeResolution {
+	const paths = platform === "win32" ? win32 : posix;
+	let rejected: NodeResolution["rejected"] = null;
+	const explicit = (env.MIRROR_NODE ?? "").trim();
+	if (explicit !== "") {
+		if (!paths.isAbsolute(explicit)) rejected = { value: explicit, reason: "relative" };
+		else {
+			const kind = kindOf(explicit);
+			if (kind === "executable") return { node: explicit, rejected: null };
+			rejected = { value: explicit, reason: kind === "directory" ? "a directory" : kind };
+		}
+	}
+	const name = platform === "win32" ? "node.exe" : "node";
+	for (const dir of (env.PATH ?? "").split(paths.delimiter).filter(Boolean)) {
+		const candidate = paths.join(dir, name);
+		if (kindOf(candidate) === "executable") return { node: candidate, rejected };
+	}
+	if (platform === "win32") return { node: null, rejected };
+	const searchRoot = env.MEMORY_ENV === "test" ? (env.MIRROR_TEST_NODE_SEARCH_ROOT ?? "") : "";
+	const home = env.HOME ?? homedir();
+	const candidates = [
+		paths.resolve(treeRoot, "..", "..", "..", "bin", "node"),
+		...NODE_CANDIDATES.map((candidate) => candidate.replace("$HOME", home)),
+	].map((candidate) => (searchRoot ? paths.join(searchRoot, candidate) : candidate));
+	for (const candidate of candidates) {
+		if (kindOf(candidate) === "executable") return { node: candidate, rejected };
+	}
+	return { node: null, rejected };
+}
+
 /** True when `path` is the same file as this tree's AGENTS.md (symlinks resolved). */
 function _isOurAgentsFile(path: string): boolean {
 	try {
@@ -277,6 +374,41 @@ export default function (pi: ExtensionAPI) {
 	 */
 	const FRONT_DOOR_ARGV = [MIRROR_BIN];
 
+	/**
+	 * The Node every front-door process runs on (CR191), or null when none
+	 * resolves: the caller spawns nothing and logs why. A `MIRROR_NODE` the search
+	 * refused is said once per registration, with the reason, so the log is
+	 * enough to fix it; the search went on without it, as the wrappers' does.
+	 */
+	let mirrorNodeWarned = false;
+	function nodeFor(): string | null {
+		const found = resolveNode(process.env, TREE_ROOT);
+		if (found.rejected && !mirrorNodeWarned) {
+			mirrorNodeWarned = true;
+			log("WARN", `MIRROR_NODE=${found.rejected.value} is ${found.rejected.reason}; searching the PATH and the usual places instead`);
+		}
+		return found.node;
+	}
+
+	/** The line said once at session start when no Node resolves; also the log's and, in short, hooks.log's. */
+	const NO_NODE_NOTICE =
+		"Mirror: `node` is not on the PATH Pi inherited, nor in the usual places — set MIRROR_NODE=/path/to/node (Node 24 or later) where Pi is launched. Mirror will not log this session.";
+
+	/**
+	 * One line in `<mirror home>/hooks.log`, in the format the wrappers write and
+	 * `hookFailureFindings` parses (`<stamp> <runtime>:<hook>: <reason>`), so
+	 * `runtime diagnose` reports it for seven days. Same directory as this log,
+	 * mode 0600 as `noteHookFailure` writes it.
+	 */
+	function noteHookFailure(hook: string, reason: string): void {
+		try {
+			mkdirSync(MIRROR_DIR, { recursive: true });
+			appendFileSync(join(MIRROR_DIR, "hooks.log"), `${new Date().toISOString()} pi:${hook}: ${reason}\n`, { mode: 0o600 });
+		} catch {
+			// A hook cannot report that it could not report.
+		}
+	}
+
 	function log(level: string, msg: string): void {
 		try {
 			const ts = new Date().toISOString();
@@ -288,11 +420,16 @@ export default function (pi: ExtensionAPI) {
 	}
 
 	function runMirrorBackground(args: string[], label: string): void {
+		const node = nodeFor();
+		if (node === null) {
+			log("ERROR", `${label} skipped: no node (see the session's notice)`);
+			return;
+		}
 		let logFd: number | undefined;
 		try {
 			mkdirSync(MIRROR_DIR, { recursive: true });
 			logFd = openSync(LOG_FILE, "a");
-			const child = spawn("node", [...FRONT_DOOR_ARGV, ...args], {
+			const child = spawn(node, [...FRONT_DOOR_ARGV, ...args], {
 				cwd: process.cwd(),
 				stdio: ["ignore", logFd, logFd],
 				// Windows: a detached console child materializes as a visible
@@ -303,8 +440,24 @@ export default function (pi: ExtensionAPI) {
 				detached: process.platform !== "win32",
 				windowsHide: true,
 			});
+			// A child that cannot start reports through 'error', not by throwing,
+			// so the catch below never sees it; without a listener the event is an
+			// uncaught exception and Pi exits ("pi exiting due to uncaughtException:
+			// Error: spawn node ENOENT", PR #47). The path was an executable file a
+			// moment ago (`resolveNode`), so this is the record of one that vanished
+			// in between, or of any other start failure. A logging failure must never
+			// break anything: log it and move on.
+			child.on("error", (error) => {
+				log("ERROR", `${label} failed to start: ${error.message.slice(0, 500)}`);
+			});
+			// Its stdout and stderr are in this log already; the exit code says
+			// whether to read them (a Node too old for the core exits before it runs).
+			child.on("exit", (code, signal) => {
+				if (code !== 0) log("ERROR", `${label} exited ${code ?? `on ${signal}`}`);
+			});
 			child.unref();
-			log("INFO", `${label} started in detached background process ${child.pid ?? "(unknown pid)"}`);
+			// No pid, no process: the 'error' above is on its way.
+			if (child.pid !== undefined) log("INFO", `${label} started in detached background process ${child.pid}`);
 		} catch (err: unknown) {
 			const message = err instanceof Error ? err.message : String(err);
 			log("ERROR", `${label} failed: ${message.slice(0, 500)}`);
@@ -331,10 +484,15 @@ export default function (pi: ExtensionAPI) {
 	}
 
 	async function runMirror(args: string[]): Promise<string> {
+		const node = nodeFor();
+		if (node === null) {
+			log("ERROR", `runMirror skipped [${args.slice(0, 2).join(" ")}]: no node (see the session's notice)`);
+			return "";
+		}
 		try {
 			const delay = testFrontDoorDelayMs();
 			if (delay > 0) await new Promise((resolve) => setTimeout(resolve, delay));
-			const result = await pi.exec("node", [...FRONT_DOOR_ARGV, ...args], {
+			const result = await pi.exec(node, [...FRONT_DOOR_ARGV, ...args], {
 				timeout: 30_000,
 			});
 			const stderr = (result?.stderr ?? "").trim();
@@ -682,6 +840,14 @@ export default function (pi: ExtensionAPI) {
 			log("WARN", line);
 			if (ctx.hasUI) ctx.ui.notify(line, "warning");
 		}
+		// Likewise when no Node resolves (CR191): once, visibly, naming the fix,
+		// and one line where `runtime diagnose` reads. The calls below then skip
+		// themselves; a later one that finds nothing logs only.
+		if (nodeFor() === null) {
+			log("WARN", NO_NODE_NOTICE);
+			if (ctx.hasUI) ctx.ui.notify(NO_NODE_NOTICE, "warning");
+			noteHookFailure("session-start", "node not found on PATH or in the usual places; Mirror is off for this session. Set MIRROR_NODE.");
+		}
 		const sessionId = ctx.sessionManager.getSessionFile() ?? null;
 		const openArgs = ["conversation-logger", "session-start", "--fast", "--welcome", "--format", "json"];
 		if (sessionId) openArgs.push("--session-id", sessionId);

package/bin/loader.js

@@ -24,34 +24,52 @@
 // stands on; `scripts/smoke_npm_package.sh` runs both bins from a real global
 // install on CI's Node 24.
 //
-// The warning filter below is the shim's own copy, because the hook emits its
+// The warning filter is the shim's own copy, because the hook emits its
 // ExperimentalWarning before the core's filter can be imported through it.
+// `boot` installs it; `registerTypeStripping` alone does not (CV24.DS1).
 
 import { readFileSync } from "node:fs";
 import { registerHooks, stripTypeScriptTypes } from "node:module";
 import { fileURLToPath } from "node:url";
 
-process.removeAllListeners("warning");
-process.on("warning", (warning) => {
-  if (warning.name === "ExperimentalWarning") return;
-  process.stderr.write(`${warning.name}: ${warning.message}\n`);
-});
-
 const packageRoot = new URL("../", import.meta.url).href;
+const REGISTERED = Symbol.for("mirror-mind.typeStripping");
 
-registerHooks({
-  load(url, context, nextLoad) {
-    if (url.startsWith(packageRoot) && url.endsWith(".ts")) {
-      const source = readFileSync(fileURLToPath(url), "utf8");
-      return {
-        format: "module",
-        source: stripTypeScriptTypes(source, { mode: "strip" }),
-        shortCircuit: true,
-      };
-    }
-    return nextLoad(url, context);
-  },
-});
+/**
+ * Register the load hook that strips types for `.ts` files under this package
+ * root. Idempotent per package root, so the bins and the library entry
+ * (`lib/desktop.js`, CV24.DS1) can both call it in one process.
+ *
+ * It does nothing to the process's warnings: a library entry runs inside a
+ * host that owns them. Only `boot`, which owns its process, filters them.
+ */
+export function registerTypeStripping() {
+  if (!globalThis[REGISTERED]) globalThis[REGISTERED] = new Set();
+  const roots = globalThis[REGISTERED];
+  if (roots.has(packageRoot)) return;
+  roots.add(packageRoot);
+  registerHooks({
+    load(url, context, nextLoad) {
+      if (url.startsWith(packageRoot) && url.endsWith(".ts")) {
+        const source = readFileSync(fileURLToPath(url), "utf8");
+        return {
+          format: "module",
+          source: stripTypeScriptTypes(source, { mode: "strip" }),
+          shortCircuit: true,
+        };
+      }
+      return nextLoad(url, context);
+    },
+  });
+}
+
+function filterExperimentalWarnings() {
+  process.removeAllListeners("warning");
+  process.on("warning", (warning) => {
+    if (warning.name === "ExperimentalWarning") return;
+    process.stderr.write(`${warning.name}: ${warning.message}\n`);
+  });
+}
 
 /**
  * Import the entry at `entryPath` (relative to the package root) and run its
@@ -62,6 +80,9 @@ registerHooks({
  * @returns {Promise<number>}
  */
 export async function boot(entryPath) {
+  // The filter first: registering the hook emits its own ExperimentalWarning.
+  filterExperimentalWarnings();
+  registerTypeStripping();
   const { runAsEntry } = await import(new URL(entryPath, packageRoot).href);
   return runAsEntry();
 }

package/docs/releases/index.md

@@ -12,6 +12,8 @@ Future release notes should use the structure defined in [Release Notes](../proc
 
 ## Releases
 
+- [v0.39.1 — Pi Finds Its Node, or Says So](v0.39.1.md) — patch release of PR #47 (@rodrigoimmaginario) and CR191: a Pi opened where `node` is not on the PATH no longer exits; the Pi extension resolves Node where the hook wrappers look, so a global install needs nothing configured; when no Node resolves, one warning names the fix and `runtime diagnose` reports the `hooks.log` line. No migration.
+- [v0.39.0 — The Core as a Library](v0.39.0.md) — minor release of CV24's first eight Delivery Stories: `mirror-mind/desktop`, a library entry through which a host such as Mirror Desktop 0.3 embeds this core; calls for a home's migration state, Conversations, sidebar reads, home creation, migration on request, Mirror's context, learning from open Conversations, and Journey administration, each with an explicit path and no environment. The new `exports` field closes every other deep import. No migration.
 - [v0.38.1 — The Refusal Names the Way Out](v0.38.1.md) — patch release of three Change Requests, CR185, CR186, and CR187: a package with no home configured names the homes it finds and the `mirror init <name>` that selects one, and `init` adopts a home that already exists; a missing or refused OpenRouter key is one line that names the file, before anything is touched; a `stable` clone ahead only by `main`'s commits is told that `stable` is behind it, not to push or reset. No migration.
 - [v0.38.0 — The Model Behind the Memories, Chosen by Measurement](v0.38.0.md) — minor release closing CV9.DS9: the model behind memories, tasks, titles, summaries, tags, reception, journal, shadow, and consolidation is Claude Haiku 5.5 at reasoning off, chosen on the eval suite with reasoning on and off and on 24 of the owner's own conversations ranked blind, where it came first on 16 of 26 surfaces. Every extraction-pin call can carry a reasoning effort, and a pin carries its own default. With CR180, summaries open with their subject, every lifecycle prompt sees the owner's name, and a framed opening is written once more. Release gate 70 of 70 probes. Rollback is one env line. No migration.
 - [v0.37.0 — The Mirror Stays in the Conversation](v0.37.0.md) — minor release closing CV9.DS8 and, with CV21.DS11, CV21: on Pi, Claude Code, Codex, and Antigravity one doorman in the core puts Mirror's context before the model on every turn of Mirror Mode, all of it on the turn Mirror Mode starts and then the persona and memories each question calls for; an explicit turn loads once; one signature, `◇ persona-name`; Pi reaches L4, measured live. One parity matrix in the runtime interface contract, sourced and held by a test. Codex, Antigravity, and Grok Build need their plugin copy brought level. Migration 018, applied on its own.

package/docs/releases/v0.39.0.md

@@ -0,0 +1,138 @@
+---
+digest: >
+  v0.39.0 is a minor release that ships CV24's first eight Delivery Stories: a library
+  entry, `mirror-mind/desktop`, through which a host such as Mirror Desktop 0.3 embeds
+  this core in its own Node process instead of spawning a CLI. Twenty-five calls and refusal
+  classes, beside `DESKTOP_API_VERSION`, cover a
+  home's migration state, Conversations, sidebar reads, home creation, migration on
+  request, Mirror's context for a turn, learning from open Conversations, and Journey
+  administration, each taking an explicit path and reading no environment. The package
+  gains an `exports` field, which closes every deep import other than the new entry. The
+  terminal, the bins and the hooks behave as before. No migration, and no model or prompt
+  change.
+---
+
+# v0.39.0 — The Core as a Library
+
+**Date:** 2026-10-31
+
+## Highlights
+
+- **`mirror-mind/desktop`, a library entry for a host**
+  ([CV24](../project/roadmap/cv24-embeddable-core-for-mirror-desktop/index.md)). Imported by
+  package name from a host's `node_modules`, with no flags: the entry registers the bins'
+  type-stripping hook itself. Everything a host may call is re-exported there by name, with
+  `DESKTOP_API_VERSION = 1`; a name not in that file is not part of the contract.
+- **Eight stories, one rule.** Every call takes an explicit database or home path, never reads
+  `MIRROR_HOME`, `MIRROR_USER`, `DB_PATH` or a key from the environment, never migrates as a side
+  effect, and refuses a database that is not `current` before opening it for writing.
+- **Custody chosen per write, with a decision for each.** Conversation writes go through a
+  narrowed handle instead of a per-write snapshot; a home is created beside its target and renamed
+  into place; a home migrates only behind a uniquely named, verified backup the core never deletes.
+- **Breaking for deep imports only.** The package now declares `exports` with `./desktop` and
+  `./package.json`. Any other `import "mirror-mind/…"` path that resolved before no longer does.
+  The `mirror` and `mirror-hook` bins are unaffected.
+- **A Windows package install can update itself** (PR #46 by @rodrigoimmaginario, CR189;
+  *added on 2026-10-31*). An earlier version needs one manual install to get here; see Upgrading.
+- No migration, and no model or prompt change, so the model-behavior release gate does not apply.
+
+## Where We Started
+
+Decision CV22.DS10.TS1 left Mirror Desktop outside the TypeScript migration: it kept calling the
+Python core through the retired Journey administration and a catalog script. On 2026-10-28 Mirror
+Desktop decided to follow this core instead. It froze its 0.2 line on Python and opened a 0.3 line
+that hosts the core in its own Node process, on its own home.
+
+That host could not use the CLI's way in. It runs from `node_modules`, where Node refuses to strip
+TypeScript types. A shell that starts it may export another home's `MIRROR_HOME`. It writes on every
+turn of a Conversation that never ends. And it has to ask the person before a home is migrated,
+while every open through the front door migrates first.
+
+## What Changed
+
+The contract grew one story at a time on `desktop/library-seam-1a`, each with its spec first, and
+merged as PR #52.
+
+- **DS1, inspect a home without migrating.** `inspectMigrationState` reports `missing`,
+  `not_mirror`, `current`, `pending` or `ahead`, with the pending list. It shares its three
+  ledger readers with `ensureMigratedOnOpen`, so what it calls pending is exactly what an open
+  would apply. The loader became `boot` plus an idempotent `registerTypeStripping`; only `boot`,
+  which owns its process, filters warnings.
+- **DS2, Conversations as calls.** `ensureConversation`, `appendConversationMessages` (the
+  `conversations append` contract, byte for byte), `renameConversation` and
+  `rebindConversationJourney`, written through `openDatabaseForConversationWrites`. That handle
+  prepares only a single SELECT, INSERT … VALUES into three tables, and an UPDATE of four
+  `conversations` columns by id. The per-write `VACUUM INTO` measured about 0.9 s on a 108 MB
+  home, too much for every turn.
+- **DS3, Journey reads.** `readJourneyTree` (a new contract in the stored sibling order, not a
+  revival of the retired registry dump), `listJourneyConversations` and `inspectConversation`,
+  read-only.
+- **DS4, create a home.** `createHome` copies the templates with the person's name, bootstraps,
+  and seeds in a staging directory, renaming it into place only when the home reads `current`.
+  It never writes `~/.config/mirror/env`.
+- **DS5, migrate on request.** `migrateHome` applies exactly the pending list the person was
+  shown, under the bootstrap lock, behind a backup that is quick-checked, hashed, and read back as
+  the same pre-image.
+- **DS6, Mirror's context as a call.** `deliverMirrorContext` is the doorman for a host's turn,
+  with the key as an argument and Mirror Mode from the first turn; each provider call is tried
+  once within its own bound. Its write is `mirror doorman`'s, behind the front door's snapshot.
+- **DS7, learning from an open Conversation.** `learnFromConversations` extracts the stretch an
+  idle, unended Conversation gained since its `learned_through` watermark, in bounded pieces,
+  with the terminal's prompts, and never ends it.
+- **DS8, Journey administration as calls.** `addJourney`, `setJourneyProjectPath`, `moveJourney`
+  and `deleteJourney` port Python 0.31.14's administration, so the requests Desktop 0.2 sent keep
+  their meaning. `updateJourney` is new: it edits a Journey's name, description and status, and
+  refuses `journey_changed` when the row changed since the host read it.
+
+Existing code changed only where the entry needed it: the loader, three exported readers, two
+`export` keywords in `extraction.ts`, the tarball guard (`lib/` allowed, `lib/desktop.js`
+required), and `package.json`. No existing test changed. The npm smoke installs the package and
+imports the entry from a host project for DS1 to DS5.
+
+*Added on 2026-10-31:* this release also carries one change outside CV24, merged to `main` the
+day before and missing from this note when it was published, so the paragraph above covers CV24
+only. PR #46 (CR189, by @rodrigoimmaginario) runs the package update's `npm install -g` from the
+parent of `node_modules` instead of from inside the package. npm renames the package's directory
+aside before it lays down the new version, and Windows refuses to rename a directory a process is
+running in, so on Windows `runtime update` failed at apply with `EBUSY` every time. Nothing
+changes on macOS or Linux. See Upgrading.
+
+## Upgrading
+
+*Added on 2026-10-31.* Everyone updates as usual:
+
+```bash
+mirror runtime update          # or: npm install -g mirror-mind
+```
+
+On Windows, a package install of an earlier version cannot install this one itself: its
+`runtime update` fails at apply with `EBUSY`. Once, by hand, from any directory other than the
+package's own:
+
+```bash
+npm install -g mirror-mind@latest
+```
+
+From then on `mirror runtime update` works.
+
+## Conscious Exclusions
+
+- **Renaming a Journey's slug.** The slug keys Conversations, memories and tasks; renaming it is a
+  migration, not a call.
+- **A Journey's icon and color, and a receipt ledger for Journey calls.**
+- **The front door's own migration custody.** `ensureMigratedOnOpen` still overwrites one fixed
+  backup; giving it DS5's custody is a separate decision.
+- **Installed-package smoke for DS6 to DS8.** DS6 and DS7 need a provider key. DS8 is exercised
+  end to end by Mirror Desktop's real-host test; a keyless smoke probe is a cheap follow-up.
+
+## What We Learned
+
+A library entry is a stricter consumer than a CLI. Every assumption the bins could make about
+their own process — environment, warnings, migrate-on-open, a snapshot per write — had to become
+an explicit argument or a decision. The retired-surfaces sweep also caught the port twice naming a
+retired verb in comments, which says the sweep is doing its job on new files.
+
+## Next Horizon
+
+Mirror Desktop moves its pin from a branch tarball to this release, then its first 0.3 alpha. CV24
+stays open for the pieces that alpha's use asks for.

package/docs/releases/v0.39.1.md

@@ -0,0 +1,109 @@
+---
+digest: >
+  v0.39.1 is a patch release about one failure: a Pi opened where `node` is not on the
+  PATH, which a desktop launch or a window older than the Node install gives it. Through
+  v0.39.0 that Pi exited at startup with `spawn node ENOENT`. PR #47 (Rodrigo Immaginario)
+  keeps it up, and CR191 makes the Pi extension find Node where the hook wrappers already
+  look, so a machine with a global install needs nothing configured; when no Node resolves,
+  the session says so once, with the fix, and `runtime diagnose` can see it. No migration,
+  and no model or prompt change.
+---
+
+# v0.39.1 — Pi Finds Its Node, or Says So
+
+**Date:** 2026-11-02
+
+## Highlights
+
+- **A Pi opened without `node` on its PATH no longer exits**
+  ([PR #47](https://github.com/mirror-mind-ai/mirror/pull/47), by @rodrigoimmaginario). The
+  extension's detached maintenance process had no `'error'` listener, so a `node` that
+  could not start was an uncaught exception and Pi went down with it. It is now logged.
+- **The Pi extension resolves Node the way the hook wrappers do**
+  ([CR191](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr191-the-pi-extension-cannot-find-node-where-the-hook-wrappers-can.md)):
+  `MIRROR_NODE`, the PATH, the Node that installed the package (`<prefix>/bin/node`), then
+  `~/.nvm/current/bin`, `/opt/homebrew/bin`, `/usr/local/bin`. On a machine with a global
+  install this needs no configuration: the session that used to crash opens as usual.
+- **When no Node resolves, the failure reaches someone.** Pi stays up, shows one warning at
+  session start that names the fix (`MIRROR_NODE=/path/to/node`, Node 24 or later), and
+  writes one line to `<mirror home>/hooks.log`, where `mirror runtime diagnose` reports it
+  for seven days as `hook_failures_recorded`, as it does for the other runtimes' hooks.
+- **A `MIRROR_NODE` the extension will not use is warned once, with the reason**: missing, a
+  directory, not executable, or relative. The search goes on without it.
+- No migration, and no model or prompt change.
+
+## Where We Started
+
+On 2026-10-16 a Pi opened from a terminal window whose PATH predated the Node install
+exited at once:
+
+```text
+pi exiting due to uncaughtException:
+Error: spawn node ENOENT
+  spawnargs: [ '…/node_modules/mirror-mind/bin/mirror.js', 'conversation-logger', 'session-maintenance' ]
+```
+
+The same happens wherever `node` is not on the PATH Pi inherited, and `runtime diagnose`
+had long named that the usual case for a runtime launched from the desktop: `node` lives
+under nvm or Homebrew, not where a GUI looks. The hook wrappers the other runtimes use
+were built for exactly this. They search the usual places and record a failure in
+`hooks.log`. The Pi extension, which runs no wrapper, knew only the bare name `node`.
+
+Rodrigo Immaginario's PR #47 fixed the crash: the listener, and `MIRROR_NODE` honored by
+the extension as the wrappers honor it. Reviewed through four lenses on 2026-11-01, it was
+merged as it was. The review also showed what it left: without `MIRROR_NODE`, that Pi now
+ran with Mirror silently absent, no welcome card, no logging, no context, and a line in a
+file no one is pointed at. That is the failure the wrappers' silence-is-forbidden rule was
+written against, and CR191 is its answer for Pi.
+
+## What Changed
+
+**One resolver, the wrappers' order (CR191).** The extension resolves Node itself, in the
+same order the wrappers use, taking only an executable file: `MIRROR_NODE`, then `node` on
+each PATH entry, then the `bin/` of the prefix the package is installed under, three
+directories up from the tree the extension ships in, which is the Node that installed the
+package, then nvm, Homebrew, `/usr/local`. The candidate list is the core's
+`HOOK_NODE_CANDIDATES`, duplicated in the extension because it imports no core module, and a
+test fails if the two ever differ, as one already did for the wrappers. On Windows the
+search stops after the PATH, as before.
+
+**Nothing found: no spawn, one notice, one line.** When no Node resolves, no front-door
+process is attempted: each call logs that it was skipped. At session start, the extension
+says so once, the way it already says `mirror` is not on the PATH:
+
+```text
+Mirror: `node` is not on the PATH Pi inherited, nor in the usual places — set MIRROR_NODE=/path/to/node (Node 24 or later) where Pi is launched. Mirror will not log this session.
+```
+
+and writes one line to `hooks.log` in the wrappers' format, `pi:session-start: node not
+found on PATH or in the usual places; …`, which `runtime diagnose` counts.
+
+**The log tells one story.** A child that did not start is not logged as started; one that
+exits non-zero leaves its code beside its own output. PR #47's listener stays as the record
+of a file that vanished between the check and the spawn.
+
+Validated against Pi 1.5.0 with `PATH=/usr/bin:/bin`, the incident's configuration: the
+session opened through `/opt/homebrew/bin/node` with nothing configured; a bad
+`MIRROR_NODE` was warned once; with no Node anywhere, Pi stayed up, the warning was on
+screen, and `runtime diagnose` reported the `hooks.log` line.
+
+## Conscious Exclusions
+
+- The hook wrappers and the MCP locator still accept a relative `MIRROR_NODE`; the Pi
+  extension refuses one, since it would resolve against whatever project Pi was opened in.
+  Whether the family follows is a separate decision.
+- A "Node too old" message with the version, as the wrappers print: the exit code and the
+  loader's own output are in the log.
+- Windows candidates beyond `MIRROR_NODE` and the PATH.
+
+## Upgrading
+
+```bash
+mirror runtime update
+```
+
+A Pi session running the previous extension keeps it until Pi restarts.
+
+## Next Horizon
+
+CR190, captured this week, and the open RS010 backlog. CV24 continues on its branch.

package/lib/desktop.js

@@ -0,0 +1,72 @@
+// `mirror-mind/desktop` — the core's library entry for Mirror Desktop. CV24.DS1.
+//
+// Mirror Desktop hosts this core in its own Node process and imports it from
+// `node_modules`, where Node refuses to strip TypeScript types. So this entry
+// registers the same type-stripping hook the bins use, and only then imports
+// the TypeScript modules -- dynamically, because a static `export ... from
+// "./x.ts"` would be loaded before the hook exists.
+//
+// Everything Desktop may call is re-exported here BY NAME. A name missing from
+// this file is not part of the contract, whatever the TypeScript tree holds.
+// `DESKTOP_API_VERSION` changes when a name is removed or changes meaning.
+
+import { registerTypeStripping } from "../bin/loader.js";
+
+registerTypeStripping();
+
+const migrationReport = await import("../ts/src/db/migrationReport.ts");
+const conversations = await import("../ts/src/conversation/hostCalls.ts");
+const reads = await import("../ts/src/conversation/hostReads.ts");
+const homes = await import("../ts/src/init/createHome.ts");
+const migration = await import("../ts/src/db/migrateHome.ts");
+const context = await import("../ts/src/mirror/deliverContext.ts");
+const learning = await import("../ts/src/conversation/learnFromConversations.ts");
+const journeys = await import("../ts/src/journey/journeyCalls.ts");
+
+export const DESKTOP_API_VERSION = 1;
+export const inspectMigrationState = migrationReport.inspectMigrationState;
+
+// CV24.DS2: Conversations as calls. Each opens only a `current` database,
+// never migrates, and writes through the narrowed Conversation handle.
+export const ensureConversation = conversations.ensureConversation;
+export const appendConversationMessages = conversations.appendConversationMessages;
+export const renameConversation = conversations.renameConversation;
+export const rebindConversationJourney = conversations.rebindConversationJourney;
+export const DatabaseNotCurrentError = conversations.DatabaseNotCurrentError;
+export const ConversationCallRejectedError = conversations.ConversationCallRejectedError;
+
+// CV24.DS3: the reads a sidebar is built from. Read-only, `current` homes only.
+export const readJourneyTree = reads.readJourneyTree;
+export const listJourneyConversations = reads.listJourneyConversations;
+export const inspectConversation = reads.inspectConversation;
+
+// CV24.DS4: create a complete, seeded home at an explicit path, all or nothing.
+// Writes nothing outside it, never the machine-wide ~/.config/mirror/env.
+export const createHome = homes.createHome;
+export const CreateHomeRejectedError = homes.CreateHomeRejectedError;
+
+// CV24.DS5: migrate a home on request, applying exactly the pending list the
+// person was shown, behind a uniquely named, verified, retained backup.
+export const migrateHome = migration.migrateHome;
+export const MigrateHomeRejectedError = migration.MigrateHomeRejectedError;
+
+// CV24.DS6: Mirror's context for a host's turn -- the doorman as a call. The
+// key is an argument; nothing is read from the environment. A Conversation is
+// in Mirror Mode from its first turn.
+export const deliverMirrorContext = context.deliverMirrorContext;
+export const forgetMirrorContext = context.forgetMirrorContext;
+export const MirrorContextRejectedError = context.MirrorContextRejectedError;
+
+// CV24.DS7: learn from a host's idle Conversations without ending them -- the
+// stretch each gained since it was last learned from. The key is an argument.
+export const learnFromConversations = learning.learnFromConversations;
+export const LearningRejectedError = learning.LearningRejectedError;
+
+// CV24.DS8: Journeys as calls -- create, edit, move, set a project path,
+// delete -- each answering with the tree `readJourneyTree` reads.
+export const addJourney = journeys.addJourney;
+export const updateJourney = journeys.updateJourney;
+export const setJourneyProjectPath = journeys.setJourneyProjectPath;
+export const moveJourney = journeys.moveJourney;
+export const deleteJourney = journeys.deleteJourney;
+export const JourneyCallRejectedError = journeys.JourneyCallRejectedError;