mirror-mind 0.39.4 → 0.40.0-next.1

package/.claude/hooks/log-assistant-reply.sh

@@ -31,8 +31,13 @@ env_value() {
   [ -n "$value" ] || value="$(env_file_value "$1" "${XDG_CONFIG_HOME:-$HOME/.config}/mirror/env")"
   printf '%s' "$value"
 }
+# `note <line> daily` writes at most once a day (UTC): for a setting to fix
+# rather than a hook that failed, so the line stays inside diagnose's seven-day
+# window while the setting stays wrong, without one per hook per turn (CR192).
+# The log is read into a variable, not piped to `grep -q`: under pipefail, a
+# reader that stops early can fail the pipeline and the line be written twice.
 note() {
-  local home user
+  local home user seen today
   home="$(env_value MIRROR_HOME)"
   user="$(env_value MIRROR_USER)"
   if [ -n "$home" ]; then
@@ -43,6 +48,11 @@ note() {
   else
     return 0
   fi
+  if [ "${2:-}" = daily ]; then
+    today="$(date -u +%Y-%m-%d)"
+    seen="$(grep -F -- ": $1" "$home/hooks.log" 2>/dev/null)"
+    case "$seen" in "$today"T*|*$'\n'"$today"T*) return 0 ;; esac
+  fi
   mkdir -p "$home" 2>/dev/null \
     && printf '%s %s: %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$HOOK" "$1" >> "$home/hooks.log" 2>/dev/null
 }
@@ -58,10 +68,33 @@ ENTRY="$REPO_ROOT/bin/mirror-hook.js"
 # directory the entry was found in is searched first: an npm global bin holds
 # the `node` that installed the package beside `mirror-hook`, while a system
 # `/usr/local/bin/node` can be years older (CI's Ubuntu runner has one).
-NODE="${MIRROR_NODE:-}"
-if [ -z "$NODE" ] || [ ! -x "$NODE" ]; then
-  NODE="$(command -v node 2>/dev/null || true)"
+#
+# MIRROR_NODE is used only as an absolute path to an executable file, as every
+# reader uses it (CR192): a relative one would resolve against the project the
+# runtime spawned this hook from. Anything else is noted with its reason, in
+# the Pi extension's words, once a day, and the search goes on without it.
+# "Absolute" is the MCP locator's pattern too, and it classifies exactly as
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
+NODE=""
+if [ -n "${MIRROR_NODE:-}" ]; then
+  refused=""
+  case "$MIRROR_NODE" in
+    /*|\\*|[A-Za-z]:[\\/]*)
+      if [ -d "$MIRROR_NODE" ]; then refused="a directory"
+      elif [ ! -e "$MIRROR_NODE" ]; then refused="missing"
+      elif [ ! -f "$MIRROR_NODE" ] || [ ! -x "$MIRROR_NODE" ]; then refused="not executable"
+      else NODE="$MIRROR_NODE"
+      fi
+      ;;
+    *) refused="relative" ;;
+  esac
+  if [ -n "$refused" ]; then
+    note "MIRROR_NODE=${MIRROR_NODE//[$'\r\n']/} is $refused; searching the PATH and the usual places instead" daily
+  fi
 fi
+[ -n "$NODE" ] || NODE="$(command -v node 2>/dev/null || true)"
 for candidate in "$(dirname "$ENTRY")/node" "$HOME/.nvm/current/bin/node" /opt/homebrew/bin/node /usr/local/bin/node; do
   [ -n "$NODE" ] && break
   [ -x "$candidate" ] && NODE="$candidate"

package/.claude/hooks/log-session-end.sh

@@ -31,8 +31,13 @@ env_value() {
   [ -n "$value" ] || value="$(env_file_value "$1" "${XDG_CONFIG_HOME:-$HOME/.config}/mirror/env")"
   printf '%s' "$value"
 }
+# `note <line> daily` writes at most once a day (UTC): for a setting to fix
+# rather than a hook that failed, so the line stays inside diagnose's seven-day
+# window while the setting stays wrong, without one per hook per turn (CR192).
+# The log is read into a variable, not piped to `grep -q`: under pipefail, a
+# reader that stops early can fail the pipeline and the line be written twice.
 note() {
-  local home user
+  local home user seen today
   home="$(env_value MIRROR_HOME)"
   user="$(env_value MIRROR_USER)"
   if [ -n "$home" ]; then
@@ -43,6 +48,11 @@ note() {
   else
     return 0
   fi
+  if [ "${2:-}" = daily ]; then
+    today="$(date -u +%Y-%m-%d)"
+    seen="$(grep -F -- ": $1" "$home/hooks.log" 2>/dev/null)"
+    case "$seen" in "$today"T*|*$'\n'"$today"T*) return 0 ;; esac
+  fi
   mkdir -p "$home" 2>/dev/null \
     && printf '%s %s: %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$HOOK" "$1" >> "$home/hooks.log" 2>/dev/null
 }
@@ -58,10 +68,33 @@ ENTRY="$REPO_ROOT/bin/mirror-hook.js"
 # directory the entry was found in is searched first: an npm global bin holds
 # the `node` that installed the package beside `mirror-hook`, while a system
 # `/usr/local/bin/node` can be years older (CI's Ubuntu runner has one).
-NODE="${MIRROR_NODE:-}"
-if [ -z "$NODE" ] || [ ! -x "$NODE" ]; then
-  NODE="$(command -v node 2>/dev/null || true)"
+#
+# MIRROR_NODE is used only as an absolute path to an executable file, as every
+# reader uses it (CR192): a relative one would resolve against the project the
+# runtime spawned this hook from. Anything else is noted with its reason, in
+# the Pi extension's words, once a day, and the search goes on without it.
+# "Absolute" is the MCP locator's pattern too, and it classifies exactly as
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
+NODE=""
+if [ -n "${MIRROR_NODE:-}" ]; then
+  refused=""
+  case "$MIRROR_NODE" in
+    /*|\\*|[A-Za-z]:[\\/]*)
+      if [ -d "$MIRROR_NODE" ]; then refused="a directory"
+      elif [ ! -e "$MIRROR_NODE" ]; then refused="missing"
+      elif [ ! -f "$MIRROR_NODE" ] || [ ! -x "$MIRROR_NODE" ]; then refused="not executable"
+      else NODE="$MIRROR_NODE"
+      fi
+      ;;
+    *) refused="relative" ;;
+  esac
+  if [ -n "$refused" ]; then
+    note "MIRROR_NODE=${MIRROR_NODE//[$'\r\n']/} is $refused; searching the PATH and the usual places instead" daily
+  fi
 fi
+[ -n "$NODE" ] || NODE="$(command -v node 2>/dev/null || true)"
 for candidate in "$(dirname "$ENTRY")/node" "$HOME/.nvm/current/bin/node" /opt/homebrew/bin/node /usr/local/bin/node; do
   [ -n "$NODE" ] && break
   [ -x "$candidate" ] && NODE="$candidate"

package/.claude/hooks/log-user-prompt.sh

@@ -31,8 +31,13 @@ env_value() {
   [ -n "$value" ] || value="$(env_file_value "$1" "${XDG_CONFIG_HOME:-$HOME/.config}/mirror/env")"
   printf '%s' "$value"
 }
+# `note <line> daily` writes at most once a day (UTC): for a setting to fix
+# rather than a hook that failed, so the line stays inside diagnose's seven-day
+# window while the setting stays wrong, without one per hook per turn (CR192).
+# The log is read into a variable, not piped to `grep -q`: under pipefail, a
+# reader that stops early can fail the pipeline and the line be written twice.
 note() {
-  local home user
+  local home user seen today
   home="$(env_value MIRROR_HOME)"
   user="$(env_value MIRROR_USER)"
   if [ -n "$home" ]; then
@@ -43,6 +48,11 @@ note() {
   else
     return 0
   fi
+  if [ "${2:-}" = daily ]; then
+    today="$(date -u +%Y-%m-%d)"
+    seen="$(grep -F -- ": $1" "$home/hooks.log" 2>/dev/null)"
+    case "$seen" in "$today"T*|*$'\n'"$today"T*) return 0 ;; esac
+  fi
   mkdir -p "$home" 2>/dev/null \
     && printf '%s %s: %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$HOOK" "$1" >> "$home/hooks.log" 2>/dev/null
 }
@@ -58,10 +68,33 @@ ENTRY="$REPO_ROOT/bin/mirror-hook.js"
 # directory the entry was found in is searched first: an npm global bin holds
 # the `node` that installed the package beside `mirror-hook`, while a system
 # `/usr/local/bin/node` can be years older (CI's Ubuntu runner has one).
-NODE="${MIRROR_NODE:-}"
-if [ -z "$NODE" ] || [ ! -x "$NODE" ]; then
-  NODE="$(command -v node 2>/dev/null || true)"
+#
+# MIRROR_NODE is used only as an absolute path to an executable file, as every
+# reader uses it (CR192): a relative one would resolve against the project the
+# runtime spawned this hook from. Anything else is noted with its reason, in
+# the Pi extension's words, once a day, and the search goes on without it.
+# "Absolute" is the MCP locator's pattern too, and it classifies exactly as
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
+NODE=""
+if [ -n "${MIRROR_NODE:-}" ]; then
+  refused=""
+  case "$MIRROR_NODE" in
+    /*|\\*|[A-Za-z]:[\\/]*)
+      if [ -d "$MIRROR_NODE" ]; then refused="a directory"
+      elif [ ! -e "$MIRROR_NODE" ]; then refused="missing"
+      elif [ ! -f "$MIRROR_NODE" ] || [ ! -x "$MIRROR_NODE" ]; then refused="not executable"
+      else NODE="$MIRROR_NODE"
+      fi
+      ;;
+    *) refused="relative" ;;
+  esac
+  if [ -n "$refused" ]; then
+    note "MIRROR_NODE=${MIRROR_NODE//[$'\r\n']/} is $refused; searching the PATH and the usual places instead" daily
+  fi
 fi
+[ -n "$NODE" ] || NODE="$(command -v node 2>/dev/null || true)"
 for candidate in "$(dirname "$ENTRY")/node" "$HOME/.nvm/current/bin/node" /opt/homebrew/bin/node /usr/local/bin/node; do
   [ -n "$NODE" ] && break
   [ -x "$candidate" ] && NODE="$candidate"

package/.claude/hooks/mirror-inject.sh

@@ -31,8 +31,13 @@ env_value() {
   [ -n "$value" ] || value="$(env_file_value "$1" "${XDG_CONFIG_HOME:-$HOME/.config}/mirror/env")"
   printf '%s' "$value"
 }
+# `note <line> daily` writes at most once a day (UTC): for a setting to fix
+# rather than a hook that failed, so the line stays inside diagnose's seven-day
+# window while the setting stays wrong, without one per hook per turn (CR192).
+# The log is read into a variable, not piped to `grep -q`: under pipefail, a
+# reader that stops early can fail the pipeline and the line be written twice.
 note() {
-  local home user
+  local home user seen today
   home="$(env_value MIRROR_HOME)"
   user="$(env_value MIRROR_USER)"
   if [ -n "$home" ]; then
@@ -43,6 +48,11 @@ note() {
   else
     return 0
   fi
+  if [ "${2:-}" = daily ]; then
+    today="$(date -u +%Y-%m-%d)"
+    seen="$(grep -F -- ": $1" "$home/hooks.log" 2>/dev/null)"
+    case "$seen" in "$today"T*|*$'\n'"$today"T*) return 0 ;; esac
+  fi
   mkdir -p "$home" 2>/dev/null \
     && printf '%s %s: %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$HOOK" "$1" >> "$home/hooks.log" 2>/dev/null
 }
@@ -58,10 +68,33 @@ ENTRY="$REPO_ROOT/bin/mirror-hook.js"
 # directory the entry was found in is searched first: an npm global bin holds
 # the `node` that installed the package beside `mirror-hook`, while a system
 # `/usr/local/bin/node` can be years older (CI's Ubuntu runner has one).
-NODE="${MIRROR_NODE:-}"
-if [ -z "$NODE" ] || [ ! -x "$NODE" ]; then
-  NODE="$(command -v node 2>/dev/null || true)"
+#
+# MIRROR_NODE is used only as an absolute path to an executable file, as every
+# reader uses it (CR192): a relative one would resolve against the project the
+# runtime spawned this hook from. Anything else is noted with its reason, in
+# the Pi extension's words, once a day, and the search goes on without it.
+# "Absolute" is the MCP locator's pattern too, and it classifies exactly as
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
+NODE=""
+if [ -n "${MIRROR_NODE:-}" ]; then
+  refused=""
+  case "$MIRROR_NODE" in
+    /*|\\*|[A-Za-z]:[\\/]*)
+      if [ -d "$MIRROR_NODE" ]; then refused="a directory"
+      elif [ ! -e "$MIRROR_NODE" ]; then refused="missing"
+      elif [ ! -f "$MIRROR_NODE" ] || [ ! -x "$MIRROR_NODE" ]; then refused="not executable"
+      else NODE="$MIRROR_NODE"
+      fi
+      ;;
+    *) refused="relative" ;;
+  esac
+  if [ -n "$refused" ]; then
+    note "MIRROR_NODE=${MIRROR_NODE//[$'\r\n']/} is $refused; searching the PATH and the usual places instead" daily
+  fi
 fi
+[ -n "$NODE" ] || NODE="$(command -v node 2>/dev/null || true)"
 for candidate in "$(dirname "$ENTRY")/node" "$HOME/.nvm/current/bin/node" /opt/homebrew/bin/node /usr/local/bin/node; do
   [ -n "$NODE" ] && break
   [ -x "$candidate" ] && NODE="$candidate"

package/.claude/hooks/session-start.sh

@@ -31,8 +31,13 @@ env_value() {
   [ -n "$value" ] || value="$(env_file_value "$1" "${XDG_CONFIG_HOME:-$HOME/.config}/mirror/env")"
   printf '%s' "$value"
 }
+# `note <line> daily` writes at most once a day (UTC): for a setting to fix
+# rather than a hook that failed, so the line stays inside diagnose's seven-day
+# window while the setting stays wrong, without one per hook per turn (CR192).
+# The log is read into a variable, not piped to `grep -q`: under pipefail, a
+# reader that stops early can fail the pipeline and the line be written twice.
 note() {
-  local home user
+  local home user seen today
   home="$(env_value MIRROR_HOME)"
   user="$(env_value MIRROR_USER)"
   if [ -n "$home" ]; then
@@ -43,6 +48,11 @@ note() {
   else
     return 0
   fi
+  if [ "${2:-}" = daily ]; then
+    today="$(date -u +%Y-%m-%d)"
+    seen="$(grep -F -- ": $1" "$home/hooks.log" 2>/dev/null)"
+    case "$seen" in "$today"T*|*$'\n'"$today"T*) return 0 ;; esac
+  fi
   mkdir -p "$home" 2>/dev/null \
     && printf '%s %s: %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$HOOK" "$1" >> "$home/hooks.log" 2>/dev/null
 }
@@ -58,10 +68,33 @@ ENTRY="$REPO_ROOT/bin/mirror-hook.js"
 # directory the entry was found in is searched first: an npm global bin holds
 # the `node` that installed the package beside `mirror-hook`, while a system
 # `/usr/local/bin/node` can be years older (CI's Ubuntu runner has one).
-NODE="${MIRROR_NODE:-}"
-if [ -z "$NODE" ] || [ ! -x "$NODE" ]; then
-  NODE="$(command -v node 2>/dev/null || true)"
+#
+# MIRROR_NODE is used only as an absolute path to an executable file, as every
+# reader uses it (CR192): a relative one would resolve against the project the
+# runtime spawned this hook from. Anything else is noted with its reason, in
+# the Pi extension's words, once a day, and the search goes on without it.
+# "Absolute" is the MCP locator's pattern too, and it classifies exactly as
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
+NODE=""
+if [ -n "${MIRROR_NODE:-}" ]; then
+  refused=""
+  case "$MIRROR_NODE" in
+    /*|\\*|[A-Za-z]:[\\/]*)
+      if [ -d "$MIRROR_NODE" ]; then refused="a directory"
+      elif [ ! -e "$MIRROR_NODE" ]; then refused="missing"
+      elif [ ! -f "$MIRROR_NODE" ] || [ ! -x "$MIRROR_NODE" ]; then refused="not executable"
+      else NODE="$MIRROR_NODE"
+      fi
+      ;;
+    *) refused="relative" ;;
+  esac
+  if [ -n "$refused" ]; then
+    note "MIRROR_NODE=${MIRROR_NODE//[$'\r\n']/} is $refused; searching the PATH and the usual places instead" daily
+  fi
 fi
+[ -n "$NODE" ] || NODE="$(command -v node 2>/dev/null || true)"
 for candidate in "$(dirname "$ENTRY")/node" "$HOME/.nvm/current/bin/node" /opt/homebrew/bin/node /usr/local/bin/node; do
   [ -n "$NODE" ] && break
   [ -x "$candidate" ] && NODE="$candidate"

package/.pi/extensions/mirror-logger.ts

@@ -235,7 +235,7 @@ export interface NodeResolution {
  * then `NODE_CANDIDATES`. Not `process.execPath`: Pi may run on a Node older
  * than the core needs. On Windows the PATH is the last place looked.
  *
- * A relative `MIRROR_NODE` is refused here, though the wrappers accept one: it
+ * A relative `MIRROR_NODE` is refused, as every reader refuses one (CR192): it
  * would resolve against whatever project Pi was opened in.
  *
  * The absolute candidates make "nothing anywhere" a fact about the host, so

package/docs/releases/index.md

@@ -12,6 +12,8 @@ Future release notes should use the structure defined in [Release Notes](../proc
 
 ## Releases
 
+- [v0.40.0-next.1 — A Journey Can Go, Showing What Goes With It](v0.40.0-next.1.md) — preview under npm's `next`, read by no updater, for Nautilus for Mirror (the release train): CR200, `mirror-mind/desktop` gains `previewJourneyDeletion` and `deleteJourneyWithRecords`, deleting a Journey with every record that belongs to it after a preview that counts it, by digest, behind a verified backup; child Journeys refuse. Terminal users receive it with v0.40.0. No migration.
+- [v0.39.5 — The Node You Named, or Why Not](v0.39.5.md) — patch release of CR192, from PR #47's thread (@rodrigoimmaginario): the hook wrappers, the plugin's MCP entry, and `runtime diagnose` use `MIRROR_NODE` only as an absolute path to an executable file, as the Pi extension does; a relative value is never run, and a refused one is named with its reason, once a day in `hooks.log` and on the MCP entry's stderr; the Windows installer's drive-letter path counts as absolute, in CI under Git Bash and on the installer. No migration.
 - [v0.39.4 — The Reply Finds Its Prompt](v0.39.4.md) — patch release of PR #51 (@alannascimento1), CR166 and CR196: on Claude Code, a prompt typed while a turn runs and a journey entered in plain words no longer lose the reply; `nothing_waiting` in `hooks.log` means a lost reply again. No schema change, no migration.
 - [v0.39.3 — Windows Gets Its Hooks](v0.39.3.md) — patch release of PR #53, PR #50, and PR #54 (@rodrigoimmaginario): the plugin's hook wrappers and MCP locator run the package's own bin when npm's global entry is a shell shim, so Claude Code hooks and the MCP server work on a Windows package install; `runtime diagnose` no longer counts its own verdict as a front-door error (CR139); the docs point a Windows reader to the installer in its own repository. No migration.
 - [v0.39.2 — Input, Read the Platform's Way](v0.39.2.md) — patch release of PR #49 and PR #48 (@rodrigoimmaginario), CR194, and CR193: `runtime diagnose` stops warning every Windows install about Node; a PowerShell byte-order mark is not stored; stdin is decoded by its mark, UTF-8 or UTF-16, and `identity set` and `journey update` gain `--file`, the route around PowerShell 5.1's ASCII pipe; `package-lock.json` names the package at its version, and the release doctor checks it. No migration.

package/docs/releases/v0.39.2.md

@@ -89,11 +89,18 @@ Validated on 2026-11-03 against a scratch copy of the maintainer's database: UTF
 with a mark, and UTF-16LE as PowerShell 5.1 writes it, through `--file` and through stdin;
 the refusals writing nothing; the one-liner pipe unchanged.
 
+**Post-release Windows validation, 2026-11-03.** Rodrigo Immaginario ran v0.39.2 through
+npm's `mirror.ps1` shim on Windows PowerShell 5.1.26100. `--file` preserved both unmarked
+UTF-8 and UTF-16LE. The measurement also corrected the pipe documentation: for an
+editor-saved unmarked UTF-8 file, UTF-8 `$OutputEncoding` is not enough because
+`Get-Content` has already decoded the file through the ANSI code page. The complete pipe
+route is `Get-Content -Encoding UTF8` plus UTF-8 `$OutputEncoding`. Evidence:
+[PR #49](https://github.com/mirror-mind-ai/mirror/pull/49#issuecomment-6610137363).
+
 ## Conscious Exclusions
 
-- Windows PowerShell 5.1 itself was not run: there is no Windows machine on the maintainer's
-  side. The decoder's cases are pinned byte for byte; a measurement on the OS is asked of
-  the reporter.
+- At publication, Windows PowerShell 5.1 itself had not been run on the maintainer's side;
+  the post-release validation above closed that measurement gap.
 - Detecting text the ASCII pipe damaged: not possible without guessing.
 - The hook wrappers and the MCP locator still accept a relative `MIRROR_NODE`
   ([CR192](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr192-the-hook-wrappers-and-the-mcp-locator-accept-a-relative-mirror-node.md),

package/docs/releases/v0.39.5.md

@@ -0,0 +1,146 @@
+---
+digest: >
+  v0.39.5 is a patch release of one Change Request, CR192, from PR #47's thread with
+  Rodrigo Immaginario. The hook wrappers, the plugin's MCP entry, and `runtime diagnose`
+  now use `MIRROR_NODE` only when it is an absolute path to an executable file, the rule
+  the Pi extension has followed since v0.39.1. A relative value could make a hook run a
+  file from the project the runtime was opened in, and a value that no longer pointed at
+  Node was dropped without a word. Now neither is used, and the hooks and the MCP entry
+  name the refused value with its reason. The Windows installer's drive-letter path counts
+  as absolute, proven in CI under Git Bash and on the installer itself. No schema change,
+  no migration, and no model or prompt change.
+---
+
+# v0.39.5 — The Node You Named, or Why Not
+
+**Date:** 2026-11-05
+
+## Highlights
+
+- **A relative `MIRROR_NODE` is never run**
+  ([CR192](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr192-the-hook-wrappers-and-the-mcp-locator-accept-a-relative-mirror-node.md)).
+  A runtime starts its hooks and its MCP server from the project it was opened in, and the
+  hook wrappers and the MCP entry kept any `MIRROR_NODE` that passed `[ -x ]` there: with
+  `MIRROR_NODE=bin/node`, the project's own `bin/node` ran on every hook. Every reader now
+  follows the Pi extension's rule: an absolute path to an executable file, or nothing.
+- **A value that is not used is named, with its reason.** A value that named no usable
+  Node used to be dropped without a word. Now the hook wrappers write
+  `MIRROR_NODE=bin/node is relative; searching the PATH and the usual places instead` to
+  `<mirror home>/hooks.log`, once a UTC day for the same value, and the MCP entry writes
+  the same message to its stderr. The reasons are the Pi extension's: `relative`,
+  `a directory`, `missing`, and `not executable`. The search then goes on through the
+  PATH and the usual places, as before.
+- **The Windows installer's form counts as absolute.** Under Git Bash the installer's
+  `MIRROR_NODE` is a drive-letter path with backslashes, and a POSIX-only test would have
+  refused it on every Windows hook; @rodrigoimmaginario named that trap before the plan
+  was written. One shell pattern now classifies exactly as Node's `path.win32.isAbsolute`:
+  `C:\…`, `C:/…`, and `\\server\share\…` are absolute, and a drive-relative `C:node.exe`
+  is refused as `relative`.
+- **Proven on Windows twice.** The Windows CI job runs a real wrapper under Git Bash, with
+  a Node under `Program Files\nodejs` named in its Windows form. And before this tag,
+  Rodrigo ran the installer against `main`: its `MIRROR_NODE`, under a user folder with a
+  space and accents, ran the hooks and the MCP server with no refusal line, and
+  `C:node.exe` gave exactly one.
+- No schema change, no migration, and no model or prompt change.
+
+## Where We Started
+
+v0.39.1 made the Pi extension strict about `MIRROR_NODE`
+([CR191](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr191-the-pi-extension-cannot-find-node-where-the-hook-wrappers-can.md)):
+an absolute path to an executable file, or a warning with the reason and a search without
+it. The rest of the family was not strict. The hook wrappers and the plugin's MCP locator
+kept any value that passed `[ -x ]`, a test a relative path passes against the project a
+hook was started in; a value that failed it was dropped, and whoever had set it to pin a
+Node learned nothing. `REFERENCE.md` described one trust class for every reader, and only
+one reader held to it. CR191's debt review left the family's rule as its own decision,
+captured as CR192 on 2026-11-02.
+
+On PR #47 the next day, Rodrigo Immaginario named the trap in the obvious fix: under Git
+Bash the Windows installer's `MIRROR_NODE` is a drive-letter path, it passes `[ -x ]`
+today, and a `/*` test for "absolute" would refuse it, so every hook on a Windows install
+would log a refusal. He also asked that PR #53, which changed the same generator, locator,
+and tests, merge first. It did, in v0.39.3, and the plan started from its blocks.
+
+## What Changed
+
+**One rule, one pattern.** For the shell readers, "absolute" is one `case` pattern,
+`/*|\\*|[A-Za-z]:[\\/]*`, which matched `path.win32.isAbsolute` on 15 values in bash,
+dash, ksh, `/bin/sh`, and zsh as `sh`. `scripts/generate_hook_wrappers.sh` gives it, with
+the logging helpers and the Node search, to all three wrapper forms as shared fragments,
+and the 13 wrappers are regenerated. The MCP locator in `ts/src/guards/claudePlugin.ts`
+carries the same text as `ABSOLUTE_PATH_CASE`, and a test fails if the two drift. The Node
+readers keep their platform's `path.isAbsolute`, so on Windows every reader draws the same
+line.
+
+**A refusal that cannot forge a line.** Line breaks are removed from a value before it is
+logged: in review, a value with a line break in it wrote a second `hooks.log` line, as
+`claude:stop`, that `runtime diagnose` counted. The locator prints with `printf`, because
+dash's `echo` turns the `\n` of a Windows path into a newline, and names `$MIRROR_NODE`
+once, because Grok pastes a set variable's value into the MCP arguments it loads.
+
+**`runtime diagnose`.** Its Node check counts `MIRROR_NODE` only under the rule, through
+`isExecutableFile()`, which the front door's runtime route now shares. It adds no finding
+of its own: the hooks' refusal line reaches it as `hook_failures_recorded`, for seven
+days.
+
+**Tests and CI.** `mirrorNodeRule.test.ts` holds the pattern equal across the three
+wrapper forms and the locator, runs the classification table through bash and, where
+installed, dash, and runs a real wrapper with a Node under `Program Files/nodejs` and
+with `C:node.exe`; the Windows job runs it under Git Bash. `hooks.test.ts` and
+`mcpEntry.test.ts` cover each reason, a planted `bin/node` that never runs, the daily
+rule across two fixed days, a forged line break, and a server that starts past a
+relative value.
+
+**Docs.** The rule is stated once, in full, in the
+[configuration reference](../reference/configuration.md#hook-node-resolution);
+`REFERENCE.md`'s row points there. Troubleshooting shows the refusal line and the fix, and
+says `runtime diagnose` keeps counting old lines for seven days after the fix.
+
+Validated by the Navigator in a scratch home: two runs of the plugin's prompt hook with
+`MIRROR_NODE=bin/node` wrote one line,
+
+```text
+2026-11-04T21:40:16Z claude:user-prompt: MIRROR_NODE=bin/node is relative; searching the PATH and the usual places instead
+```
+
+the project's `bin/node` never ran, the prompt was logged, and `runtime diagnose`
+reported `hook_failures_recorded`. CI passed on every job, the Git Bash step included,
+and Rodrigo's installer run, 21 of 21 on the installer's contract, was the gate before
+the tag.
+
+**Also in this release.** Troubleshooting's PowerShell 5.1 section, from Rodrigo's PR #49
+run: `Get-Content` decodes an editor-saved UTF-8 file without a mark through the ANSI code
+page before the pipe runs, so a UTF-8 `$OutputEncoding` alone does not save it. The pipe
+route now adds `Get-Content -Encoding UTF8`, and `--file` stays the safe one.
+
+## Conscious Exclusions
+
+- `MIRROR_BIN` keeps its behavior: a relative value is still honored, and one that names
+  nothing is still dropped without a word.
+  [CR197](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr197-the-hook-wrappers-and-the-mcp-locator-accept-a-relative-mirror-bin.md)
+  (captured) would give it this rule, keeping accepted the forward-slash `C:/…` form a
+  Windows machine sets for the Claude Code forwarders.
+- `runtime diagnose` does not name a refused value. It counts the hooks' line under
+  `hook_failures_recorded`, and the value and its reason are in `hooks.log`; Rodrigo
+  suggests saying it in diagnose too. A finding of its own was left out at planning.
+- Whitespace: the Pi extension trims the value and the shell readers do not, so
+  ` /opt/node` is accepted by Pi and refused as `relative` by the hooks. Nothing writes
+  such a value.
+- Converting MSYS `/c/…` values, and rotating `hooks.log`.
+- Where Codex and Antigravity show an MCP server's stderr is not verified; the docs say
+  only what each CLI's own help shows.
+
+## Upgrading
+
+```bash
+mirror runtime update
+```
+
+If you set `MIRROR_NODE` by hand, make it the absolute path of the `node` binary: a
+relative one is now refused, with one line a day in `hooks.log`.
+
+## Next Horizon
+
+CR197, which would bring `MIRROR_BIN` under this rule with its pattern; Rodrigo's
+suggestion that `runtime diagnose` name a refused value, not yet decided; and the open
+RS010 backlog.

package/docs/releases/v0.40.0-next.1.md

@@ -0,0 +1,103 @@
+---
+digest: >
+  v0.40.0-next.1 is the first preview of the release train: published under npm's `next`
+  dist-tag, read by no updater, for Nautilus for Mirror, which embeds this Core. It carries
+  CR200: a host can delete a Journey together with every record that belongs to it, after
+  a preview that counts what will go, what other Journeys keep with a link cleared, and
+  which extension tables lose rows. The deletion acts only on the preview the person saw,
+  in one transaction, behind a named backup verified before any write. Terminal users
+  receive it with v0.40.0, when the train leaves. No schema change, no migration, and no
+  model or prompt change.
+---
+
+# v0.40.0-next.1 — A Journey Can Go, Showing What Goes With It
+
+**Date:** 2026-11-06
+
+**A preview, not a release users receive.** It is staged under `next`, its GitHub Release is
+a prerelease, and `stable`, `latest`, `mirror update` and the release-notes reader all stay
+on v0.39.5. It exists so Nautilus for Mirror can ship the change below before the train
+leaves ([the release train](../process/versioning.md#the-release-train)).
+
+## Highlights
+
+- **A Journey and its records, deleted in one act**
+  ([CR200](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr200-delete-a-journey-with-its-records-after-showing-what-will-go.md)).
+  `mirror-mind/desktop` gains `previewJourneyDeletion` and `deleteJourneyWithRecords`.
+  `deleteJourney` still deletes only an empty leaf.
+- **The preview is the contract.** It counts the Journey's own records, its Conversations'
+  contents, other Journeys' records that only lose a link, and the `ext_*` rows that name
+  the Journey, by owning extension, and hashes all of it. The deletion takes that digest
+  and refuses any other.
+- **A backup first, verified.** `backups/pre-journey-deletion-<id>-<stamp>-<random>.db`,
+  owner-only, taken under the write lock and read back as the same digest before anything
+  is deleted. A refused deletion removes it; a committed one keeps it.
+- **One friction kept:** a Journey with child Journeys is refused, naming them.
+- No schema change, no migration, and no model or prompt change.
+
+## Where We Started
+
+CV24.DS8 gave a host five Journey calls, and its `deleteJourney` refuses a Journey that
+holds anything: conversations, memories, tasks, attachments, stories, change requests,
+cursors. Nautilus for Mirror's Journey management (its RS028) asked for the act a person
+means by "delete this Journey". Its Navigator decided on 2026-11-05 and 2026-11-06 that
+everything that belongs to the Journey goes, that the confirmation shows it first, and,
+where the Core cannot judge data it does not own, to trade refusal for transparency.
+
+A long-lived home showed why "belongs" needed rules: 956 memories sit under a Journey other
+than their conversation's, and 101 runtime sessions likewise. Deleting by reach would have
+erased other Journeys' history.
+
+## What Changed
+
+**Four rules.** A record that belongs to the Journey goes. What belongs to a deleted
+conversation or memory goes with it: messages, embeddings, provider call records, memory
+access records. A record of another Journey that only points at something deleted stays,
+with that link cleared. And an `ext_*` row goes when the table's `journey_id` or `journey`
+column names the Journey exactly; the preview names the extension from `_ext_migrations`,
+and a row an extension's own foreign key holds refuses the deletion as
+`extension_rows_held`, naming the table.
+
+**A closed inventory.** `JOURNEY_DELETION_INVENTORY` names every core table the deletion
+touches, keeps or detaches, and a test reads the schema against it: a table that names a
+Journey, or references a row the deletion removes, without a decision fails. Its first
+run found `journey_mutation_receipts`, kept as the audit trail.
+
+**Refusals.** `journey_changed` for a digest that no longer matches, `journey_has_children`,
+`extension_rows_held`, `backup_failed`, and as before an unknown Journey, a malformed
+request and a database that is not current. Every refusal writes nothing.
+
+**Validated** in `journeyDeletion.test.ts` (11 tests, ten mutations each caught), in CI on
+Ubuntu and macOS (PR #55), and end to end by Nautilus: its host drives both calls
+against a scratch home, and its Navigator deleted Journeys in the app on 2026-11-06.
+
+**Also in this preview.** [CR199](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr199-deliver-mirror-context-takes-three-to-seven-seconds-before-every-desktop-turn.md)
+is captured: `deliverMirrorContext` takes three to seven seconds before every Desktop
+turn, measured. And the release train itself (PR #56) is in
+[versioning](../process/versioning.md#the-release-train).
+
+## Conscious Exclusions
+
+- No CLI command deletes a Journey with its records; a host is the only caller.
+- No cascade through child Journeys: they are refused, by the Navigator's decision.
+- Files on disk are the host's to decide; the Core touches only the database.
+- An extension cannot yet take over its own cleanup; recorded for when the extension
+  mechanism exists (CV24.DS8).
+- The test suite, run with `MIRROR_HOME` or `DB_PATH` inherited from a real home, writes
+  into that home. Found while validating this change; worth its own Change Request.
+
+## What We Learned
+
+A preview that is also the contract keeps both honest: the person confirms a list, the
+digest makes the deletion that list and nothing more, and a home that changed in between
+is told so instead of deleted differently.
+
+## Upgrading
+
+Nothing to do in the terminal: this preview is not offered by `mirror update`. A host that
+embeds the Core pins `mirror-mind@0.40.0-next.1` from the registry.
+
+## Next Horizon
+
+v0.40.0 leaves with the next train, carrying this change to every install, with whatever
+else merges before it.

package/lib/desktop.js

@@ -22,6 +22,7 @@ const migration = await import("../ts/src/db/migrateHome.ts");
 const context = await import("../ts/src/mirror/deliverContext.ts");
 const learning = await import("../ts/src/conversation/learnFromConversations.ts");
 const journeys = await import("../ts/src/journey/journeyCalls.ts");
+const journeyDeletion = await import("../ts/src/journey/journeyDeletion.ts");
 
 export const DESKTOP_API_VERSION = 1;
 export const inspectMigrationState = migrationReport.inspectMigrationState;
@@ -70,3 +71,10 @@ export const setJourneyProjectPath = journeys.setJourneyProjectPath;
 export const moveJourney = journeys.moveJourney;
 export const deleteJourney = journeys.deleteJourney;
 export const JourneyCallRejectedError = journeys.JourneyCallRejectedError;
+
+// Delete a Journey with its records, after showing what will go: the preview
+// counts every record by rule and answers a digest; the deletion takes that
+// digest back, refuses a home that no longer matches it, and runs behind a
+// retained, verified backup it names. Rejections are `JourneyCallRejectedError`s.
+export const previewJourneyDeletion = journeyDeletion.previewJourneyDeletion;
+export const deleteJourneyWithRecords = journeyDeletion.deleteJourneyWithRecords;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mirror-mind",
-  "version": "0.39.4",
+  "version": "0.40.0-next.1",
   "description": "Mirror Mind: a local-first memory and identity framework for agentic AI runtimes (Pi, Claude Code, Codex, Antigravity)",
   "license": "MIT",
   "repository": {