nexo-brain 7.23.2 → 7.23.4

package/src/runtime_service.py

@@ -9,6 +9,7 @@ handlers.
 """
 
 import asyncio
+import hashlib
 import json
 import os
 import signal
@@ -135,11 +136,22 @@ def read_service_state() -> dict[str, Any]:
         return {}
 
 
+def _new_runtime_instance_id(payload: dict[str, Any]) -> str:
+    seed = "|".join(
+        str(payload.get(key) or "")
+        for key in ("server_path", "runtime_version", "runtime_fingerprint", "started_at", "pid")
+    )
+    if not seed.strip("|"):
+        seed = f"{current_server_path()}|{os.getpid()}|{time.time()}"
+    return "rt-" + hashlib.sha256(seed.encode("utf-8")).hexdigest()[:16]
+
+
 def write_service_state(state: dict[str, Any]) -> None:
     path = service_state_path()
     tmp = path.with_suffix(path.suffix + ".tmp")
     payload = dict(state)
     payload.update(current_runtime_identity())
+    payload["runtime_instance_id"] = str(payload.get("runtime_instance_id") or _new_runtime_instance_id(payload))
     payload["updated_at"] = time.time()
     tmp.write_text(json.dumps(payload, indent=2, sort_keys=True) + "\n", encoding="utf-8")
     os.replace(tmp, path)
@@ -242,17 +254,24 @@ def current_server_path() -> Path:
 
 def current_runtime_identity() -> dict[str, str]:
     try:
-        from runtime_versioning import compute_mcp_runtime_fingerprint, read_version_for_path
+        from runtime_versioning import compute_mcp_runtime_fingerprint, read_version_for_path, runtime_generation
 
         root = current_server_path().parent
         version = read_version_for_path(root) or read_version_for_path(root.parent)
+        fingerprint = compute_mcp_runtime_fingerprint(root, use_cache=True)
         return {
             "runtime_version": version,
-            "runtime_fingerprint": compute_mcp_runtime_fingerprint(root, use_cache=True),
+            "runtime_fingerprint": fingerprint,
+            "runtime_generation": runtime_generation(version, fingerprint, str(root)),
             "server_path": str(current_server_path()),
         }
     except Exception:
-        return {"runtime_version": "", "runtime_fingerprint": "", "server_path": str(current_server_path())}
+        return {
+            "runtime_version": "",
+            "runtime_fingerprint": "",
+            "runtime_generation": "unknown",
+            "server_path": str(current_server_path()),
+        }
 
 
 def state_matches_current_runtime(state: dict[str, Any]) -> bool:
@@ -268,6 +287,11 @@ def state_matches_current_runtime(state: dict[str, Any]) -> bool:
     if current_fp and state_fp and current_fp != state_fp:
         return False
 
+    current_generation = str(current.get("runtime_generation") or "").strip()
+    state_generation = str(state.get("runtime_generation") or "").strip()
+    if current_generation and state_generation and current_generation != state_generation:
+        return False
+
     current_version = str(current.get("runtime_version") or "").strip()
     state_version = str(state.get("runtime_version") or "").strip()
     if current_version and state_version and current_version != state_version:
@@ -410,8 +434,11 @@ def runtime_service_status() -> dict[str, Any]:
         "stale": bool(state and not state_matches_current_runtime(state)),
         "runtime_version": current.get("runtime_version", ""),
         "runtime_fingerprint": current.get("runtime_fingerprint", ""),
+        "runtime_generation": current.get("runtime_generation", "unknown"),
+        "runtime_instance_id": str(state.get("runtime_instance_id") or ""),
         "state_runtime_version": str(state.get("runtime_version") or ""),
         "state_runtime_fingerprint": str(state.get("runtime_fingerprint") or ""),
+        "state_runtime_generation": str(state.get("runtime_generation") or ""),
         "state_path": str(service_state_path()),
         "log_path": str(service_log_path()),
         "server_path": str(current_server_path()),

package/src/runtime_versioning.py

@@ -19,7 +19,8 @@ import paths
 
 
 CONTINUITY_API_LEVEL = 1
-MCP_STATUS_SCHEMA_VERSION = 2
+MCP_STATUS_SCHEMA_VERSION = 3
+CLIENT_STATE_SCHEMA_VERSION = 1
 PROCESS_VERSION = ""
 PROCESS_FINGERPRINT = ""
 
@@ -61,11 +62,11 @@ RESTART_ALLOWLIST = {
     "nexo_continuity_snapshot_read",
     "nexo_continuity_resume_bundle",
     "nexo_continuity_audit",
-    # v0.32.5 — añadidas las read-only tools que el protocolo CORE llama
-    # justo después de `nexo_startup` (memory recall, reminders, followups,
-    # context, doctor). Antes quedaban bloqueadas por mcp_restart_required
-    # tras `nexo update` con sesión activa → Nero parecía amnésico hasta
-    # que el cliente se cerraba/reabría.
+    # v0.32.5 — read-only tools called by the CORE protocol immediately after
+    # `nexo_startup` (memory recall, reminders, followups, context, doctor).
+    # Without this allowlist they were blocked by mcp_restart_required after
+    # `nexo update` while a session was active, making continuity appear lost
+    # until the client was closed and reopened.
     "nexo_smart_startup",
     "nexo_session_diary_read",
     "nexo_session_diary_write",
@@ -178,6 +179,135 @@ def restart_required_marker_path() -> Path:
     return paths.operations_dir() / "mcp-restart-required.json"
 
 
+def mcp_client_state_path() -> Path:
+    return paths.runtime_state_dir() / "mcp-client-state.json"
+
+
+def runtime_generation(version: str = "", fingerprint: str = "", root: str = "") -> str:
+    seed = "|".join(part for part in (version, fingerprint, root) if str(part or "").strip())
+    if not seed:
+        return "unknown"
+    return hashlib.sha256(seed.encode("utf-8")).hexdigest()[:16]
+
+
+def _read_mcp_client_state_file() -> dict:
+    path = mcp_client_state_path()
+    if not path.is_file():
+        return {
+            "schema_version": CLIENT_STATE_SCHEMA_VERSION,
+            "clients": {},
+        }
+    try:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+    except Exception:
+        return {
+            "schema_version": CLIENT_STATE_SCHEMA_VERSION,
+            "clients": {},
+            "corrupt": True,
+        }
+    if not isinstance(payload, dict):
+        return {
+            "schema_version": CLIENT_STATE_SCHEMA_VERSION,
+            "clients": {},
+            "corrupt": True,
+        }
+    clients = payload.get("clients")
+    if not isinstance(clients, dict):
+        payload["clients"] = {}
+    payload.setdefault("schema_version", CLIENT_STATE_SCHEMA_VERSION)
+    return payload
+
+
+def _write_mcp_client_state_file(payload: dict) -> None:
+    payload = dict(payload)
+    payload["schema_version"] = CLIENT_STATE_SCHEMA_VERSION
+    payload["updated_at"] = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+    _write_json_atomic(mcp_client_state_path(), payload)
+
+
+def read_mcp_client_states() -> dict:
+    """Return the persisted per-client MCP readiness registry."""
+    payload = _read_mcp_client_state_file()
+    clients = payload.get("clients")
+    if not isinstance(clients, dict):
+        clients = {}
+    return {
+        "schema_version": CLIENT_STATE_SCHEMA_VERSION,
+        "path": str(mcp_client_state_path()),
+        "clients": clients,
+        "corrupt": bool(payload.get("corrupt")),
+        "updated_at": str(payload.get("updated_at") or ""),
+    }
+
+
+def _probe_reason_code(probe: dict) -> str:
+    if not probe.get("probe_ok", probe.get("ok", False)):
+        return str(probe.get("error") or "mcp_probe_failed")
+    try:
+        tool_count = int(probe.get("tool_count") or 0)
+    except Exception:
+        tool_count = 0
+    if tool_count <= 0:
+        return "tools_missing"
+    missing = probe.get("missing_required_tools")
+    has_required_tools_contract = isinstance(
+        probe.get("required_tools_present"), bool
+    ) or isinstance(missing, list)
+    if not has_required_tools_contract:
+        return "required_tools_contract_missing"
+    if probe.get("required_tools_present") is False:
+        return "required_tools_missing"
+    if isinstance(missing, list) and missing:
+        return "required_tools_missing"
+    return "ready"
+
+
+def record_mcp_client_probe(*, client: str = "", probe: dict | None = None) -> dict:
+    """Persist the latest probe result for one MCP client."""
+    normalized = _normalize_restart_client(client or (probe or {}).get("client", ""))
+    if not normalized:
+        return {"ok": False, "error": "unknown_client"}
+    probe = dict(probe or {})
+    installed_version_value = str(probe.get("installed_version") or installed_runtime_version() or "").strip()
+    installed_fp = str(probe.get("installed_fingerprint") or installed_runtime_fingerprint() or "").strip()
+    root = str(active_runtime_root())
+    generation = str(probe.get("runtime_generation") or runtime_generation(installed_version_value, installed_fp, root))
+    reason_code = _probe_reason_code(probe)
+    probe_ok = reason_code == "ready"
+    try:
+        tool_count = int(probe.get("tool_count") or 0)
+    except Exception:
+        tool_count = 0
+    missing_required = probe.get("missing_required_tools")
+    if not isinstance(missing_required, list):
+        missing_required = []
+    required_tools_present_raw = probe.get("required_tools_present")
+    required_tools_present = (
+        required_tools_present_raw
+        if isinstance(required_tools_present_raw, bool)
+        else False
+    )
+
+    payload = _read_mcp_client_state_file()
+    clients = dict(payload.get("clients") or {})
+    row = {
+        "client": normalized,
+        "last_seen_generation": generation,
+        "last_tool_count": tool_count,
+        "last_probe_ok": probe_ok,
+        "last_fingerprint": installed_fp,
+        "last_probe_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+        "required_tools_present": required_tools_present,
+        "missing_required_tools": missing_required,
+        "reason_code": reason_code,
+        "client_action": "ready" if probe_ok else "reprobe",
+    }
+    clients[normalized] = row
+    payload["clients"] = clients
+    _write_mcp_client_state_file(payload)
+    return {"ok": True, **row}
+
+
 def fingerprint_cache_path() -> Path:
     """Where the runtime fingerprint cache lives.
 
@@ -634,8 +764,9 @@ def clear_restart_required_marker(
     pending_clients = {k: v for k, v in clients.items() if v != "ok"}
     effective_installed = str(installed_version or payload.get("to_version") or "").strip()
     effective_process = str(process_version or "").strip()
+    marker_to_fingerprint = str(payload.get("to_fingerprint") or "").strip()
     effective_installed_fp = str(
-        installed_fingerprint or payload.get("to_fingerprint") or ""
+        installed_fingerprint or marker_to_fingerprint or ""
     ).strip()
     effective_process_fp = str(
         process_fingerprint or PROCESS_FINGERPRINT or ""
@@ -643,8 +774,9 @@ def clear_restart_required_marker(
     if pending_clients:
         _write_json_atomic(path, payload)
         return {"ok": True, "cleared": False, "path": str(path), "pending_clients": pending_clients}
-    # Prefer fingerprint match when both sides have it; fall back to version
-    # comparison only when one side is missing or unknown.
+    # Prefer fingerprint match when both sides have it. For markers that were
+    # created with a target fingerprint, do not fall back to version-only
+    # clearing: matching versions can still be a stale in-place source update.
     if (
         effective_installed_fp
         and effective_process_fp
@@ -658,6 +790,14 @@ def clear_restart_required_marker(
                 "path": str(path),
                 "pending_reason": "process_fingerprint_mismatch",
             }
+    elif marker_to_fingerprint:
+        _write_json_atomic(path, payload)
+        return {
+            "ok": True,
+            "cleared": False,
+            "path": str(path),
+            "pending_reason": "process_fingerprint_missing",
+        }
     elif effective_installed and effective_process and effective_installed != effective_process:
         _write_json_atomic(path, payload)
         return {
@@ -687,6 +827,7 @@ def resolve_restart_required(
     process = str(process_version or PROCESS_VERSION or installed).strip()
     installed_fp = str(installed_fingerprint or installed_runtime_fingerprint() or "").strip()
     process_fp = str(process_fingerprint or PROCESS_FINGERPRINT or "").strip()
+    marker_fp = str(marker.get("to_fingerprint") or "").strip()
     restart_required = False
     reason = ""
     client_action = ""
@@ -706,6 +847,9 @@ def resolve_restart_required(
         # fingerprint change and therefore never reach this branch.
         restart_required = True
         reason = reason or "fingerprint_mismatch"
+    elif marker.get("required") and marker_fp and (not process_fp or process_fp == "unknown"):
+        restart_required = True
+        reason = reason or "process_fingerprint_missing"
     elif not fingerprint_usable and installed and process and installed != process:
         # Fallback: when fingerprint can't be computed (missing source tree,
         # unreadable files, fresh install), fall back to the legacy version
@@ -728,6 +872,105 @@ def resolve_restart_required(
     }
 
 
+def _mcp_client_readiness(
+    *,
+    client: str,
+    state: dict,
+    installed_version_value: str,
+    installed_fp: str,
+    service_status: dict,
+) -> dict:
+    generation = runtime_generation(installed_version_value, installed_fp, str(active_runtime_root()))
+    process_fp = str(state.get("process_fingerprint") or "").strip()
+    service_ok = bool(service_status.get("ok", True))
+    fingerprint_ready = (
+        bool(installed_fp)
+        and bool(process_fp)
+        and process_fp != "unknown"
+        and installed_fp == process_fp
+    )
+    global_ready = (
+        not bool(state.get("restart_required"))
+        and fingerprint_ready
+        and service_ok
+    )
+    if not service_ok:
+        global_reason = "runtime_service_unavailable"
+    elif not installed_fp:
+        global_reason = "installed_fingerprint_missing"
+    elif not process_fp or process_fp == "unknown":
+        global_reason = "process_fingerprint_missing"
+    elif installed_fp != process_fp:
+        global_reason = "process_fingerprint_mismatch"
+    else:
+        global_reason = "ready"
+    if state.get("restart_required"):
+        return {
+            "runtime_generation": generation,
+            "global_ready": False,
+            "client_ready": False,
+            "reason_code": str(state.get("reason") or "restart_required"),
+            "client_action": str(state.get("client_action") or "restart_client"),
+            "client_state": {},
+        }
+    if not client:
+        return {
+            "runtime_generation": generation,
+            "global_ready": global_ready,
+            "client_ready": global_ready,
+            "reason_code": "ready" if global_ready else global_reason,
+            "client_action": "ready" if global_ready else "reprobe",
+            "client_state": {},
+        }
+    if not global_ready:
+        return {
+            "runtime_generation": generation,
+            "global_ready": False,
+            "client_ready": False,
+            "reason_code": global_reason,
+            "client_action": "reprobe",
+            "client_state": {},
+        }
+
+    registry = read_mcp_client_states()
+    client_state = dict((registry.get("clients") or {}).get(client) or {})
+    if not client_state:
+        return {
+            "runtime_generation": generation,
+            "global_ready": global_ready,
+            "client_ready": False,
+            "reason_code": "client_probe_missing",
+            "client_action": "reprobe",
+            "client_state": {},
+        }
+    if str(client_state.get("last_seen_generation") or "") != generation:
+        return {
+            "runtime_generation": generation,
+            "global_ready": global_ready,
+            "client_ready": False,
+            "reason_code": "client_generation_stale",
+            "client_action": "reprobe",
+            "client_state": client_state,
+        }
+    if not client_state.get("last_probe_ok"):
+        return {
+            "runtime_generation": generation,
+            "global_ready": global_ready,
+            "client_ready": False,
+            "reason_code": str(client_state.get("reason_code") or "client_probe_failed"),
+            "client_action": str(client_state.get("client_action") or "reprobe"),
+            "client_state": client_state,
+        }
+    return {
+        "runtime_generation": generation,
+        "global_ready": global_ready,
+        "client_ready": bool(global_ready),
+        "reason_code": "ready" if global_ready else global_reason,
+        "client_action": "ready" if global_ready else "reprobe",
+        "client_state": client_state,
+    }
+
+
 def build_mcp_status(*, client: str = "") -> dict:
     client = _normalize_restart_client(client)
     state = resolve_restart_required(client=client)
@@ -744,6 +987,14 @@ def build_mcp_status(*, client: str = "") -> dict:
             "error": "runtime_service_status_unavailable",
             "message": str(exc)[:300],
         }
+    readiness = _mcp_client_readiness(
+        client=client,
+        state=state,
+        installed_version_value=state["installed_version"],
+        installed_fp=installed_fp,
+        service_status=service_status,
+    )
+    client_states = read_mcp_client_states()
     return {
         "ok": True,
         "schema_version": MCP_STATUS_SCHEMA_VERSION,
@@ -762,7 +1013,18 @@ def build_mcp_status(*, client: str = "") -> dict:
         "active_runtime_version": read_version_for_path(active_runtime_root()),
         "restart_required": bool(state["restart_required"]),
         "reason": state["reason"],
-        "client_action": state["client_action"],
+        "client_action": readiness["client_action"],
+        "reason_code": readiness["reason_code"],
+        "global_ready": bool(readiness["global_ready"]),
+        "client_ready": bool(readiness["client_ready"]),
+        "runtime_generation": readiness["runtime_generation"],
+        "client_state": readiness["client_state"],
+        "last_seen_generation": readiness["client_state"].get("last_seen_generation", ""),
+        "last_tool_count": readiness["client_state"].get("last_tool_count", 0),
+        "last_probe_ok": readiness["client_state"].get("last_probe_ok", False),
+        "last_fingerprint": readiness["client_state"].get("last_fingerprint", ""),
+        "client_states": client_states.get("clients", {}),
+        "client_state_path": client_states.get("path", str(mcp_client_state_path())),
         "marker_path": marker.get("path", str(restart_required_marker_path())),
         "marker_exists": bool(marker.get("exists")),
         "marker_corrupt": bool(marker.get("corrupt")),

package/src/script_registry.py

@@ -1886,8 +1886,7 @@ def retire_superseded_personal_scripts(*, dry_run: bool = False) -> dict:
             report["unscheduled"].append(removed)
 
         if backup_root is None:
-            backup_root = paths.backups_dir() / f"retired-personal-scripts-{time.strftime('%Y-%m-%d-%H%M%S')}"
-            backup_root.mkdir(parents=True, exist_ok=True)
+            backup_root = paths.create_backup_dir("retired-personal-scripts")
         target = backup_root / path.name
         suffix = 2
         while target.exists():
@@ -1902,6 +1901,8 @@ def retire_superseded_personal_scripts(*, dry_run: bool = False) -> dict:
             })
         except Exception as exc:
             report["errors"].append({"path": str(path), "error": str(exc)})
+    if backup_root is not None:
+        paths.finalize_backup_snapshot(backup_root)
     return report
 
 

package/src/scripts/backfill_task_owner.py

@@ -40,6 +40,12 @@ import sys
 import time
 from pathlib import Path
 
+SOURCE_ROOT = Path(__file__).resolve().parents[1]
+if str(SOURCE_ROOT) not in sys.path:
+    sys.path.insert(0, str(SOURCE_ROOT))
+
+import paths
+
 
 DEFAULT_DB_PATH = Path.home() / ".nexo" / "runtime" / "data" / "nexo.db"
 DEFAULT_CALIBRATION = Path.home() / ".nexo" / "brain" / "calibration.json"
@@ -253,11 +259,11 @@ def _has_column(conn: sqlite3.Connection, table: str, col: str) -> bool:
 
 
 def _backup_db(db_path: Path) -> Path:
-    ts = time.strftime("%Y-%m-%d-%H%M%S", time.gmtime())
-    backup = db_path.parent.parent / "backups" / f"pre-backfill-owner-{ts}" / db_path.name
-    backup.parent.mkdir(parents=True, exist_ok=True)
+    backup_dir = paths.create_backup_dir("pre-backfill-owner")
+    backup = backup_dir / db_path.name
     shutil.copy2(db_path, backup)
-    _rotate_backup_family(backup.parent.parent)
+    _rotate_backup_family(backup_dir.parent)
+    paths.finalize_backup_snapshot(backup_dir)
     return backup
 
 

package/src/scripts/deep-sleep/apply_findings.py

@@ -32,6 +32,7 @@ if str(NEXO_CODE) not in sys.path:
 
 import db as nexo_db
 import paths
+from cognitive_paths import resolve_cognitive_db
 
 def _resolve_nexo_db() -> Path:
     candidates = [
@@ -53,11 +54,7 @@ def _resolve_nexo_db() -> Path:
 
 
 def _resolve_cognitive_db() -> Path:
-    new = paths.data_dir() / "cognitive.db"
-    legacy = paths.legacy_data_dir() / "cognitive.db"
-    if not new.is_file() and legacy.is_file():
-        return legacy
-    return new
+    return resolve_cognitive_db(for_write=True)
 
 
 def _resolve_operations_dir() -> Path:

package/src/scripts/deep-sleep/collect.py

@@ -27,6 +27,7 @@ if str(NEXO_CODE) not in sys.path:
 
 import transcript_utils as _transcripts
 import paths
+from cognitive_paths import resolve_cognitive_db
 
 NEXO_HOME = Path(os.environ.get("NEXO_HOME", str(Path.home() / ".nexo")))
 
@@ -51,11 +52,7 @@ def _resolve_nexo_db() -> Path:
 
 
 def _resolve_cognitive_db() -> Path:
-    new = paths.data_dir() / "cognitive.db"
-    legacy = paths.legacy_data_dir() / "cognitive.db"
-    if not new.is_file() and legacy.is_file():
-        return legacy
-    return new
+    return resolve_cognitive_db(for_write=False)
 
 
 def _resolve_deep_sleep_dir() -> Path:

package/src/scripts/nexo-cognitive-decay.py

@@ -37,6 +37,7 @@ _repo_src = _script_dir.parent  # src/scripts/ -> src/
 NEXO_CODE = _bootstrap_nexo_code(_repo_src)
 from datetime import datetime, timedelta
 
+from cognitive_paths import resolve_cognitive_db
 from paths import data_dir, operations_dir
 import cognitive
 
@@ -87,7 +88,7 @@ def _open_correction_fatigue_followup(fatigued: list) -> str:
         lines.append(f"... and {len(fatigued) - 10} more")
     description = "\n".join(lines)
     verification = (
-        f"sqlite3 {str(data_dir() / 'cognitive.db')} \"SELECT id, content, strength, tags "
+        f"sqlite3 {str(resolve_cognitive_db(for_write=False))} \"SELECT id, content, strength, tags "
         "FROM ltm_memories WHERE tags LIKE '%under_review%' ORDER BY strength ASC LIMIT 50\""
     )
     now_epoch = datetime.now().timestamp()

package/src/scripts/nexo-daily-self-audit.py

@@ -73,6 +73,7 @@ from paths import (
 from agent_runner import AutomationBackendUnavailableError, run_automation_prompt
 from constants import AUTOMATION_SUBPROCESS_TIMEOUT
 from core_prompts import render_core_prompt
+from cognitive_paths import audit_cognitive_db_paths, resolve_cognitive_db
 import db as nexo_db
 from public_evolution_queue import queue_public_port_candidate
 
@@ -914,15 +915,34 @@ def check_evolution_health():
 
 
 def check_disk_space():
-    result = subprocess.run(["df", "-h", "/"], capture_output=True, text=True)
-    for line in result.stdout.strip().split("\n")[1:]:
-        parts = line.split()
-        if len(parts) >= 5:
-            usage_pct = int(parts[4].replace("%", ""))
-            if usage_pct > 90:
-                finding("ERROR", "disk", f"Root disk at {usage_pct}% capacity")
-            elif usage_pct > 80:
-                finding("WARN", "disk", f"Root disk at {usage_pct}% capacity")
+    import paths as paths_module
+
+    try:
+        floor = int(paths_module.backup_min_free_bytes())
+        usage_before = shutil.disk_usage(str(paths_module.home()))
+        if usage_before.free < floor:
+            paths_module.aggressive_runtime_backup_prune(
+                min_free_bytes=floor,
+                reason="daily_self_audit_disk_space",
+            )
+        usage = shutil.disk_usage(str(paths_module.home()))
+        if usage_before.free < floor <= usage.free:
+            script = NEXO_CODE / "scripts" / "post_disk_recovery_sweep.py"
+            if script.is_file():
+                subprocess.run(
+                    [sys.executable, str(script), "--reason", "daily_self_audit_disk_low_to_ok"],
+                    capture_output=True,
+                    text=True,
+                    timeout=60,
+                )
+        usage_pct = int(((usage.total - usage.free) / usage.total) * 100)
+        free_gb = usage.free / (1024 ** 3)
+        if usage.free < floor:
+            finding("ERROR", "disk", f"Root disk at {usage_pct}% capacity after NEXO self-cleanup ({free_gb:.1f} GB free)")
+        elif usage_pct > 80:
+            finding("WARN", "disk", f"Root disk at {usage_pct}% capacity ({free_gb:.1f} GB free)")
+    except Exception as exc:
+        finding("WARN", "disk", f"Could not check disk space: {exc}")
 
 
 def check_db_size():
@@ -1735,7 +1755,13 @@ def check_watchdog_smoke():
 
 
 def check_cognitive_health():
-    cognitive_db = data_dir() / "cognitive.db"
+    path_audit = audit_cognitive_db_paths()
+    if path_audit["status"] == "error":
+        finding("ERROR", "cognitive-paths", path_audit["reason"])
+        return
+    if path_audit["status"] == "warning":
+        finding("WARN", "cognitive-paths", path_audit["reason"])
+    cognitive_db = resolve_cognitive_db(for_write=False)
     if not cognitive_db.exists():
         finding("WARN", "cognitive", "cognitive.db not found")
         return

package/src/scripts/nexo-followup-runner.py

@@ -301,7 +301,7 @@ def get_all_active_followups(state: dict) -> dict:
         rows = conn.execute(
             "SELECT id, description, date, reasoning, verification, priority, recurrence, status, owner, updated_at "
             "FROM followups WHERE status NOT LIKE 'COMPLETED%' "
-            "AND UPPER(COALESCE(status, '')) NOT IN ('BLOCKED', 'ARCHIVED', 'DELETED', 'WAITING') "
+            "AND UPPER(COALESCE(status, '')) NOT IN ('BLOCKED', 'ARCHIVED', 'DELETED', 'WAITING', 'DONE') "
             "AND description NOT LIKE '[Abandoned]%' "
             "ORDER BY "
             "  CASE priority "

package/src/scripts/nexo-immune.py

@@ -40,6 +40,7 @@ if str(NEXO_CODE) not in sys.path:
 from agent_runner import AutomationBackendUnavailableError, run_automation_prompt
 from constants import AUTOMATION_SUBPROCESS_TIMEOUT
 from core_prompts import render_core_prompt
+from cognitive_paths import resolve_cognitive_db
 import paths
 
 from urllib.request import Request, urlopen
@@ -382,7 +383,7 @@ def check_databases():
 
     dbs = [
         ("nexo.db", paths.db_path()),
-        ("cognitive.db", paths.data_dir() / "cognitive.db"),
+        ("cognitive.db", resolve_cognitive_db(for_write=False)),
     ]
     if CLAUDE_MEM_DB.exists():
         dbs.append(("claude-mem.db", CLAUDE_MEM_DB))

package/src/scripts/nexo-migrate.py

@@ -103,9 +103,7 @@ def get_target_version() -> str:
 
 def backup_databases() -> str:
     """Backup all .db files before migration. Returns backup dir path."""
-    ts = datetime.now().strftime("%Y%m%d-%H%M%S")
-    backup_dir = paths.backups_dir() / f"pre-migrate-{ts}"
-    backup_dir.mkdir(parents=True, exist_ok=True)
+    backup_dir = paths.create_backup_dir("pre-migrate")
 
     data_dir = paths.data_dir()
     if data_dir.exists():
@@ -123,6 +121,7 @@ def backup_databases() -> str:
     if vfile.exists():
         shutil.copy2(vfile, backup_dir / "version.json")
 
+    paths.finalize_backup_snapshot(backup_dir)
     return str(backup_dir)