ruvnet-brain 4.0.24 → 4.0.35

package/README.md

@@ -4,7 +4,7 @@
 
 # 🧠 RuvNet Brain
 
-### 🧠 RuvNet Brain — [![RuvNet Brain version 4.0.24 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.0.24-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
+### 🧠 RuvNet Brain — [![RuvNet Brain version 4.0.35 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.0.35-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
 
 **A portable, source-grounded brain over Reuven Cohen's (rUv's) RuvNet stack — delivered as a Claude Code plugin that makes Claude _use_ the stack instead of fighting it.**
 
@@ -30,7 +30,7 @@
 [![explainer](https://img.shields.io/badge/▶%20see%20it%20live-isovision.ai%2Fruvnet--brain-e8a13a?style=flat-square)](https://isovision.ai/ruvnet-brain/)
 [![license](https://img.shields.io/badge/license-MIT-8ecae6?style=flat-square)](LICENSE)
 [![grounded](https://img.shields.io/badge/answers-cited%20rUv%20source-333?style=flat-square)](#testing--proof)
-[![coverage](https://img.shields.io/badge/coverage-34%25%20of%20ALL%20source%20·%20honest-b58900?style=flat-square)](#testing--proof)
+[![coverage](https://img.shields.io/badge/coverage-36%25%20of%20ALL%20source%20·%20honest-b58900?style=flat-square)](#testing--proof)
 
 > **One Brain generation everywhere.** npm, the GitHub tag/release, bundle manifests, source metadata, and checksum-bound RVF generations must share the same product version. Headline claims are regenerated and checked by the claims ledger (`scripts/claims-verify.mjs`); other numbers below are hand-stamped and dated:
 > - **`plugin`** (badge above) — the Claude Code plugin itself: SKILL.md, the grounding hooks, the MCP server. Read live from [`plugin/.claude-plugin/plugin.json`](plugin/.claude-plugin/plugin.json). Updates often — this is where behavior fixes land.
@@ -485,7 +485,7 @@ node plugin/test/run-tests.mjs                    # full plugin QA over real JSO
 | **L4 "orchestrate"** | **downgraded — measures speech, not obedience** | L4 asserts the hook's own injected prose contains required words (`must: ['take the wheel','SPARC','swarm',…]`). That proves **the brain spoke**. It cannot fail when the advice is read and ignored — which is the failure this product exists to prevent. Counterfactual replay against a brain-off control (ADR-058 §D4) is what will earn this row back |
 | **Plugin QA** | **60 / 60** | manifests, hook firing, MCP `initialize`/`tools/list`, capability battery |
 | **Clean-room install** | **3 / 3** | download the published bundle fresh → unzip → query → grounded, cited answers |
-| **Unit tests** | **2,327 passing, 169 todo** · 34% of ALL source covered | `npm run test:cov` regenerates both — the coverage floor fails CI if it slips (`claims:verify` re-derives the %, it is not a hand-typed badge). 34% is the honest number over every shipped file; the previous "75%" measured a hand-picked 8-file subset |
+| **Unit tests** | **3,035 passing, 161 todo** · 36% of ALL source covered | `npm run test:cov` regenerates both — the coverage floor fails CI if it slips (`claims:verify` re-derives the %, it is not a hand-typed badge). 36% is the honest number over every shipped file; the previous "75%" measured a hand-picked 8-file subset |
 | **Grounding proof** | `npx ruvnet-brain --doctor` | asks a real question, then checks the cited path really exists in the on-disk store; a citation that doesn't resolve is reported as **NOT grounded** |
 | **Held-out eval** | **grounded 100/100** · routed 63/80 | `npm run eval` — 120 frozen, hash-pinned questions across 5 strata, never used for tuning, graded on ground truth, never by a model |
 

package/bin/install.mjs

@@ -25,6 +25,24 @@ import {
   missingEmbedderModels,
 } from '../kb/model-requirements.mjs';
 import { applyManagedCatalogUpdate } from '../scripts/model-router-catalog.mjs';
+import { cmpVersion } from '../scripts/stack-sync.mjs';
+
+// ISSUE #123 — AN INSTALL THAT IS AHEAD OF THE PUBLISHED RELEASE IS NOT A BROKEN INSTALL.
+// Host convergence compared installed === PACKAGE_VERSION, so 4.0.29-dev against a published
+// 4.0.28 read EXACTLY like being behind: --update exited 1 with 'host synchronization is
+// incomplete' and --doctor printed '✗ FAILING' while every displayed check was green (121 repos
+// indexed, grounding proven, Codex MCP live, 17 hooks enabled). The prescribed repair —
+// reinstalling the plugin extras — was a no-op, because the extras were present and firing.
+// Telling someone their working install is broken, then handing them a fix that changes nothing,
+// is the worst kind of false alarm: it burns trust AND time.
+// Convergence means NOT BEHIND. Ordering comes from cmpVersion, which is prerelease-aware and is
+// documented as the only place ordering is decided in this system.
+const versionSatisfies = (installed, expected) => {
+  if (!expected) return true;
+  if (!installed) return false;
+  if (installed === expected) return true;
+  try { return cmpVersion(installed, expected) >= 0; } catch { return installed === expected; }
+};
 import {
   CONSOLE_RUNTIME_SURFACE, CONSOLE_RUNTIME_IDENTITY_FILE, consoleRuntimeDigest,
 } from '../scripts/console-runtime-identity.mjs';
@@ -847,7 +865,7 @@ function wirePlugin({ expectedVersion = PACKAGE_VERSION, requireManaged = false
   // code says the command ran, not that the plugin is usable; the commands either exist on disk or
   // they do not. This is the difference between `/rvbc` working and "Unknown command: /rvbc".
   const installed = claudePluginStatus();
-  if (installed.installed && (!expectedVersion || installed.version === expectedVersion)) {
+  if (installed.installed && versionSatisfies(installed.version, expectedVersion)) {
     ok(`plugin installed at user scope (global, alongside Ruflo / RuVector) — exact version ${installed.version}`);
     info(`  commands available after a restart: ${c.bold('/rvbc')}, ${c.bold('/ruvnet-brain:configure')}`);
     return { host: true, wired: true, version: installed.version, manualMarketplace, manualInstall };
@@ -855,7 +873,7 @@ function wirePlugin({ expectedVersion = PACKAGE_VERSION, requireManaged = false
 
   // The honest failure. The brain still WORKS — this is the difference between a broken install and
   // a partial one, and the user is told exactly which they have instead of being congratulated.
-  const mismatch = installed.installed && expectedVersion && installed.version !== expectedVersion;
+  const mismatch = installed.installed && !versionSatisfies(installed.version, expectedVersion);
   warn(mismatch
     ? `Claude installed ${installed.version || 'an unknown version'}, not required ${expectedVersion}; refusing to call this host converged.`
     : `the plugin did NOT land — so slash commands like ${c.bold('/rvbc')} will not exist yet.`);
@@ -1259,7 +1277,7 @@ export function wireCodexPlugin({
     if (announce) warn(`Codex Brain plugin is installed but disabled by user or policy — left disabled (${CODEX_PLUGIN_ID}).`);
     return { host: true, action: 'disabled', ...before };
   }
-  if (before.installed && before.enabled && (!expectedVersion || before.version === expectedVersion)) {
+  if (before.installed && before.enabled && versionSatisfies(before.version, expectedVersion)) {
     if (announce) ok(`Codex Brain plugin already installed and enabled (${before.version || 'version unknown'}) — no changes.`);
     return { host: true, action: 'unchanged', ...before };
   }
@@ -1297,7 +1315,7 @@ export function wireCodexPlugin({
     return { host: true, action: 'plugin-failed', error: added.error };
   }
   const after = codexPluginStatus({ ...options, runJson });
-  if (!after.installed || !after.enabled || (expectedVersion && after.version !== expectedVersion)) {
+  if (!after.installed || !after.enabled || !versionSatisfies(after.version, expectedVersion)) {
     if (announce) warn('Codex accepted the install command but the Brain plugin is not installed and enabled.');
     return { host: true, action: 'verification-failed', expectedVersion, ...after };
   }
@@ -2363,12 +2381,15 @@ export function syncHostsAfterUpdate(cacheDir = resolvedKbDir(), {
 }
 
 export function classifyHostConvergence(receipt, expectedVersion = PACKAGE_VERSION) {
-  if (!receipt || receipt.desiredVersion !== expectedVersion) {
+  // Same 'ahead is not behind' rule as host convergence above (#123). A receipt written by a
+  // NEWER generation than the installer currently running is not a version mismatch — it is a
+  // machine that is further along. Only a receipt for an OLDER generation is stale.
+  if (!receipt || !versionSatisfies(receipt.desiredVersion, expectedVersion)) {
     return { healthy: false, state: 'version-mismatch', action: `required version ${expectedVersion}` };
   }
   const hostStates = Object.values(receipt.hosts || {});
   const badHost = hostStates.find((host) => !['ready', 'disabled', 'absent'].includes(host?.state)
-    || (host.state === 'ready' && host.version !== expectedVersion));
+    || (host.state === 'ready' && !versionSatisfies(host.version, expectedVersion)));
   if (badHost) return { healthy: false, state: 'host-pending', action: 're-run host synchronization' };
   if (receipt.consoleRuntime?.state !== 'ready') {
     return { healthy: false, state: receipt.consoleRuntime?.state || 'console-unproven', action: 'restart Console, then re-run --doctor' };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.0.24",
+  "version": "4.0.35",
   "description": "One-command installer for RuvNet Brain — a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 71 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships an enforced UserPromptSubmit retrieve-and-inject grounding hook that sharply reduces drift.",
-  "version": "4.0.24",
+  "version": "4.0.35",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.0.24",
+  "version": "4.0.35",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/scripts/capability-registry.mjs

@@ -709,11 +709,27 @@ export const CAPABILITIES = [
 
       const S = helpers.lessonStore.STATUS || {};
       const inForce = lessons.filter((l) => l?.status === S.RATIFIED || l?.status === S.ACTIVE).length;
-      const candidates = lessons.filter((l) => l?.status === S.CANDIDATE).length;
-      // A candidate can never block (lesson-store.mjs). Counting all 12 as "your lessons" would be
-      // the flattering number; the honest one is how many can actually affect a decision.
+      // AWAITING YOU means RATIFIABLE BY YOU (issue #125). This counted every CANDIDATE, including
+      // the seeded imported-owner lessons — which `ratify()` refuses by design and `pending()`
+      // excludes, so `lesson-ratify --list` correctly reported "0 awaiting your decision" while this
+      // card said 12 were awaiting ratification. Two surfaces, two answers, and the card's was the
+      // one asking the user to act on something that cannot be acted on. The quarantine is right;
+      // describing it as a pending decision is not.
+      //
+      // Delegated to the store's own pending(), rather than re-deriving the predicate here — a
+      // second copy is exactly how these two numbers drifted apart in the first place.
+      const ratifiable = typeof helpers.lessonStore.pending === 'function'
+        ? helpers.lessonStore.pending(lessons).length
+        : lessons.filter((l) => l?.status === S.CANDIDATE && !l?.demoted).length;
+      const quarantined = lessons.filter((l) => l?.status === S.CANDIDATE).length - ratifiable;
       if (inForce > 0) return row(STATE.ON, `${inForce} of ${lessons.length} lessons are ratified and can affect what your AI does`);
-      return row(STATE.OFF, `all ${candidates} recorded lessons are still candidates awaiting your ratification — none of them can influence anything yet`);
+      if (ratifiable > 0) {
+        return row(STATE.OFF, `${ratifiable} recorded lesson(s) are candidates awaiting your ratification — none of them can influence anything yet`);
+      }
+      // Nothing is actually waiting on the user. Say what IS true instead of inventing a decision.
+      return row(STATE.OFF, quarantined > 0
+        ? `${quarantined} bundled maintainer lesson(s) are quarantined and cannot be ratified — nothing is awaiting your decision`
+        : 'no lessons are in force yet, and none are awaiting your decision');
     },
   },
 

package/plugin/scripts/session-start-core.mjs

@@ -492,14 +492,14 @@ export async function runSessionStart({
         }
         let confidenceInstruction;
         if (readiness.state === 'ready') {
-          emit('USER-LEVEL: one brain (~/.cache/ruvnet-brain/kb) shared by every project and window here — nothing to reinstall per project. search_ruvnet is ready and live; the grounding hooks are active.');
+          emit('USER-LEVEL: one brain ON DISK (~/.cache/ruvnet-brain/kb) shared by every project and window here — nothing to reinstall per project (each window still runs its own worker process, which now exits when idle). search_ruvnet is ready and live; the grounding hooks are active.');
           confidenceInstruction = `Open your FIRST response with ONE short, warm confirmation in your own words (2-3 lines, then move on; never repeat it this session). It must say "🧠 RuvNet Brain active (v${bannerVersion})" — ONE version, in parentheses, always; never a second number, never a bundle tag beside it — and convey: it grounds rUv's stack (RVF, Ruflo, AgentDB, SPARC, agentic-flow…) in his real source rather than guessing; npx github:stuinfla/ruvnet-brain --doctor checks it; ${consoleInvoke} opens a visual settings page.`;
         } else if (readiness.state === 'degraded') {
           const receipt = readiness.receipt || {};
-          emit(`USER-LEVEL: one brain (~/.cache/ruvnet-brain/kb) shared by every project and window here — nothing to reinstall per project. search_ruvnet is registered but degraded (${receipt.phase || 'startup'}: ${receipt.error || 'readiness failed'}); the grounding hooks remain active.`);
+          emit(`USER-LEVEL: one brain ON DISK (~/.cache/ruvnet-brain/kb) shared by every project and window here — nothing to reinstall per project (each window still runs its own worker process, which now exits when idle). search_ruvnet is registered but degraded (${receipt.phase || 'startup'}: ${receipt.error || 'readiness failed'}); the grounding hooks remain active.`);
           confidenceInstruction = `Open your FIRST response with ONE short line: "🧠 RuvNet Brain active (v${bannerVersion}) — search is degraded right now." Do not claim source grounding until a real search succeeds. npx github:stuinfla/ruvnet-brain --doctor shows the current verdict; ${consoleInvoke} opens the Console.`;
         } else {
-          emit('USER-LEVEL: one brain (~/.cache/ruvnet-brain/kb) shared by every project and window here — nothing to reinstall per project. search_ruvnet is registered; live readiness is not yet proven. The grounding hooks are active.');
+          emit('USER-LEVEL: one brain ON DISK (~/.cache/ruvnet-brain/kb) shared by every project and window here — nothing to reinstall per project (each window still runs its own worker process, which now exits when idle). search_ruvnet is registered; live readiness is not yet proven. The grounding hooks are active.');
           confidenceInstruction = `Open your FIRST response with ONE short line: "🧠 RuvNet Brain active (v${bannerVersion}) — search is registered and will prove readiness on first use." Do not claim source grounding until a real search returns a citation. npx github:stuinfla/ruvnet-brain --doctor shows the current verdict; ${consoleInvoke} opens the Console.`;
         }
         emit(confidenceInstruction);

package/plugin/scripts/update-apply.mjs

@@ -316,10 +316,14 @@ function gc() {
   console.log(`gc: kept ${[...keep].join(', ') || '(none)'} · removed ${removed}`);
 }
 
+// Version ordering, hoisted to module scope so BOTH the exact payload selector and the
+// already-converged check below can use one comparator (#126). Two copies is how the
+// selection rule and the convergence rule would drift apart.
+const semverish = (v) => String(v).split(/[.-]/).map((x) => (Number.isFinite(+x) ? +x : x));
+const cmp = (a, b) => { const A = semverish(a), B = semverish(b); for (let i = 0; i < Math.max(A.length, B.length); i++) { if ((A[i] ?? 0) === (B[i] ?? 0)) continue; if (typeof A[i] === 'number' && typeof B[i] === 'number') return A[i] - B[i]; return String(A[i] ?? '') < String(B[i] ?? '') ? -1 : 1; } return 0; };
+
 // ── sources ─────────────────────────────────────────────────────────────────────────────────────
 function newestStagedCC(expectedVersion = null) {
-  const semverish = (v) => v.split(/[.-]/).map((x) => (Number.isFinite(+x) ? +x : x));
-  const cmp = (a, b) => { const A = semverish(a), B = semverish(b); for (let i = 0; i < Math.max(A.length, B.length); i++) { if ((A[i] ?? 0) === (B[i] ?? 0)) continue; if (typeof A[i] === 'number' && typeof B[i] === 'number') return A[i] - B[i]; return String(A[i] ?? '') < String(B[i] ?? '') ? -1 : 1; } return 0; };
   const candidates = [];
   for (const cache of PLUGIN_CACHES) {
     if (!fs.existsSync(cache)) continue;
@@ -400,6 +404,27 @@ function main() {
     const active = readJSON(ACTIVE);
     if (!staged) {
       if (expectedVersion) {
+        // ALREADY AHEAD IS ALREADY CONVERGED (issue #126) — but the SELECTION above stays exact.
+        //
+        // Issue #64 requires that we never apply "a different newer payload in another host cache",
+        // and that requirement is right: the caches are per-host, so grabbing a newer payload from
+        // .codex to satisfy a .claude request installs something nobody asked for. My first attempt
+        // at #126 loosened newestStagedCC() to "newest >= expected" and reintroduced exactly that
+        // bug — tests/qe/release/issue-64-host-convergence.test.mjs caught it.
+        //
+        // The real defect is one layer up: after a release the plugin is bumped to the next -dev
+        // generation, so the ACTIVE host is routinely ahead of the published version the updater
+        // requests. No payload matched, this returned 1, host sync reported incomplete, and the
+        // Console runtime refresh inside that sync was rolled back — so the header's
+        // "⟳ update available — click to update" ran clean and changed nothing, forever.
+        //
+        // Nothing to apply because you are already past it is SUCCESS, not failure. This asserts
+        // that about the ACTIVE spine only; it never selects an unrequested payload.
+        const activeNow = readJSON(ACTIVE);
+        if (activeNow?.version && cmp(activeNow.version, expectedVersion) >= 0) {
+          console.log(`already on ${activeNow.version}, at or above requested ${expectedVersion} — nothing to apply.`);
+          return 0;
+        }
         console.error(`✗ no staged host payload exactly matches expected version ${expectedVersion} — spine unchanged`);
         return 1;
       }

package/scripts/github-health-watch.mjs

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+/**
+ * GITHUB HEALTH WATCH — one place that notices GitHub is unhappy, before the maintainer does.
+ *
+ * WHY THIS EXISTS. On 2026-08-08 the maintainer said: "You should never ever let it be in a
+ * situation where it's got failed pushes. Your job is to always be looking out for GitHub to make
+ * sure if there's any problem that you're on it immediately." They were right, and the reason it
+ * kept happening is structural, not attentional: every existing signal watched ONE thing.
+ *
+ *   · signal-watch      — CI verdicts, per push
+ *   · issue-watch       — open issues and their SLA
+ *   · published-surface — npm vs GitHub, nightly
+ *
+ * Nothing watched the states that actually stall work: a red default branch, a PR that has silently
+ * gone CONFLICTING, a branch left behind after a merge, a stuck queue, or a release that published
+ * and then failed its own bookkeeping. Each was found by a human noticing something felt wrong.
+ *
+ * WHAT IT DOES NOT DO. It does not push, merge, close, publish, or edit anything. It REPORTS. A
+ * watcher that also acts is a watcher whose failures are hard to reason about, and this repo has
+ * already been bitten by automation that satisfied its own success predicate (ADR-050). Exit code
+ * is the contract: 0 = healthy, 1 = something needs attention, and the reasons print in full.
+ *
+ *   node scripts/github-health-watch.mjs            # human-readable
+ *   node scripts/github-health-watch.mjs --json     # machine-readable, for hooks/CI
+ */
+import { execFileSync } from 'node:child_process';
+
+const REPO = 'stuinfla/ruvnet-brain';
+const JSON_OUT = process.argv.includes('--json');
+const findings = [];
+const note = (level, area, detail, action) => findings.push({ level, area, detail, action });
+
+const gh = (args) => {
+  try { return execFileSync('gh', args, { encoding: 'utf8', timeout: 60_000 }).trim(); }
+  catch (error) { return { __error: String(error.stderr || error.message).slice(0, 200) }; }
+};
+const ghJson = (args) => {
+  const out = gh(args);
+  if (out && out.__error) return out;
+  try { return JSON.parse(out); } catch { return { __error: 'unparseable gh output' }; }
+};
+
+// ── 1. Is the default branch green? A red main blocks every release and every merge. ─────────────
+const runs = ghJson(['run', 'list', '--repo', REPO, '--branch', 'main', '--workflow', 'ci',
+  '--limit', '1', '--json', 'status,conclusion,headSha,url']);
+if (runs.__error) note('warn', 'ci', `could not read CI status: ${runs.__error}`, 'check gh auth');
+else if (!runs.length) note('warn', 'ci', 'no CI runs found on main', 'verify the workflow is enabled');
+else {
+  const [run] = runs;
+  if (run.status === 'completed' && run.conclusion !== 'success') {
+    note('fail', 'ci', `main is RED at ${run.headSha.slice(0, 7)} (${run.conclusion})`, `read ${run.url}`);
+  }
+}
+
+// ── 2. Queue health. A stalled queue looks identical to slow CI until someone waits an hour. ─────
+const queued = ghJson(['run', 'list', '--repo', REPO, '--limit', '60', '--json', 'status']);
+if (!queued.__error && Array.isArray(queued)) {
+  const q = queued.filter((r) => r.status === 'queued').length;
+  const running = queued.filter((r) => r.status === 'in_progress').length;
+  // Many queued with NOTHING executing is the shape of a stuck plane or an exhausted runner pool —
+  // measured on 2026-08-06, when two hung notifier runs held both slots and starved 21 real runs.
+  if (running === 0 && q >= 5) {
+    note('fail', 'queue', `${q} runs queued, 0 executing — the Actions plane may be stalled`,
+      'check githubstatus.com, then cancel any hung run holding a concurrency slot');
+  }
+}
+
+// ── 3. PRs that have gone unmergeable. These rot silently; nobody is notified when main moves. ───
+const prs = ghJson(['pr', 'list', '--repo', REPO, '--state', 'open', '--json',
+  'number,title,mergeable,isDraft,updatedAt']);
+if (!prs.__error && Array.isArray(prs)) {
+  for (const pr of prs) {
+    if (pr.mergeable === 'CONFLICTING') {
+      note('fail', 'pr', `#${pr.number} is CONFLICTING — "${pr.title.slice(0, 60)}"`,
+        'rebase or resolve against main; a conflicting PR is invisible work');
+    }
+  }
+}
+
+// ── 4. Branches left behind after a merge. The maintainer's standing rule is a few, resolved fast.
+const branches = gh(['api', `repos/${REPO}/branches?per_page=100`, '--jq', '.[].name']);
+if (typeof branches === 'string') {
+  const list = branches.split('\n').filter(Boolean).filter((b) => b !== 'main');
+  if (list.length > 3) {
+    note('warn', 'branches', `${list.length} non-main branches: ${list.slice(0, 6).join(', ')}`,
+      'delete merged branches; resolve the rest back to main');
+  }
+}
+
+// ── 5. Published surfaces naming different generations — the whole of issue #77. ─────────────────
+const npmLatest = (() => {
+  try { return execFileSync('npm', ['view', 'ruvnet-brain', 'dist-tags.latest'], { encoding: 'utf8', timeout: 60_000 }).trim(); }
+  catch { return null; }
+})();
+const release = ghJson(['api', `repos/${REPO}/releases/latest`, '--jq', '.tag_name']);
+if (npmLatest && typeof release === 'string' && release) {
+  if (npmLatest !== release.replace(/^v/, '')) {
+    note('fail', 'surfaces', `npm ${npmLatest} != GitHub ${release}`,
+      'run scripts/published-surface-probe.mjs; this is issue #77 recurring');
+  }
+}
+
+// ── 6. Issues past their response SLA. ──────────────────────────────────────────────────────────
+const issues = ghJson(['issue', 'list', '--repo', REPO, '--state', 'open', '--json',
+  'number,title,createdAt,comments']);
+if (!issues.__error && Array.isArray(issues)) {
+  for (const issue of issues) {
+    const ageH = (Date.now() - Date.parse(issue.createdAt)) / 3_600_000;
+    if (ageH > 4 && (issue.comments ?? 0) === 0) {
+      note('fail', 'issues', `#${issue.number} is ${Math.round(ageH)}h old with NO response`,
+        'respond; the 4h SLA is the promise, not the target');
+    }
+  }
+}
+
+const failed = findings.filter((f) => f.level === 'fail');
+if (JSON_OUT) {
+  process.stdout.write(`${JSON.stringify({ healthy: failed.length === 0, findings }, null, 2)}\n`);
+} else if (!findings.length) {
+  process.stdout.write('[github-health] ✓ clean — main green, no conflicting PRs, surfaces coherent, no unanswered issues.\n');
+} else {
+  for (const f of findings) {
+    process.stdout.write(`[github-health] ${f.level === 'fail' ? '✗' : '⚠'} ${f.area}: ${f.detail}\n      → ${f.action}\n`);
+  }
+}
+process.exit(failed.length ? 1 : 0);

package/scripts/metaharness-receipts.mjs

@@ -105,8 +105,34 @@ export function formatTable(rows) {
   const withBar = totalFrontier > 0 ? Math.min(BAR, Math.max(1, Math.round(BAR * (totalCost / totalFrontier)))) : BAR;
   const drawBar = (n) => '█'.repeat(n) + '░'.repeat(BAR - n);
   const rule = '─'.repeat(70);
+  // ── IS THIS STILL HAPPENING, OR IS IT A SOUVENIR? (added 2026-08-08) ──────────────────────────
+  //
+  // This card reported "SAVED ~61% · 43 routed tasks" for FOURTEEN DAYS after routing had entirely
+  // stopped. Every number was true and every number was history: the newest receipt was 2026-07-24,
+  // and in the fortnight since — including three days of heavy work — not one task was routed. The
+  // card looked like a live dashboard and was actually a museum plaque.
+  //
+  // SKILL.md already records this exact failure once ("after two days, the receipts log held 3
+  // entries, all test pings, $0.018 saved — while real work was done inline in the most expensive
+  // model") and answered it by making the routing rule a floor rather than advice. That did not
+  // help, because nothing MEASURED whether the floor was being honoured. A silent zero reads
+  // identically to a healthy system, which is the same disease as every other defect fixed this
+  // week: a surface reporting something other than what it measured.
+  //
+  // So the card now leads with recency. Savings you earned last month are not savings you are
+  // earning, and a stale ledger must say so before it says anything else.
+  const newest = rows.map((r) => Date.parse(r.ts || r.date || r.at || 0)).filter(Boolean).sort().at(-1);
+  const idleDays = newest ? (Date.now() - newest) / 86_400_000 : Infinity;
+  const staleness = !Number.isFinite(idleDays)
+    ? '  ⚠ NO ROUTING RECEIPTS AT ALL — these numbers describe nothing that has happened.'
+    : idleDays >= 3
+      ? `  ⚠ STALE: nothing has been routed in ${Math.floor(idleDays)} days (newest receipt ${new Date(newest).toISOString().slice(0, 10)}).\n`
+        + '     The figures below are HISTORY, not current performance — mechanical work is running unrouted.'
+      : null;
+
   return [
     rule,
+    ...(staleness ? [staleness, ''] : []),
     `  💰 SAVED ~${pct}%${speedBadge}  ·  ~${ratio}× cheaper  ·  ${rows.length} routed task(s) (${subagents} subagent, ${rows.length - subagents} openrouter/calibration)`,
     '',
     `  without routing    ${drawBar(BAR)}  ${fmt$(totalFrontier)}`,

package/scripts/nightly-wrapper.sh

@@ -119,6 +119,18 @@ sh scripts/memdb-health.sh .swarm/memory.db >> "$LOG" 2>&1 \
 # host verification, post-publication seal) still runs exactly as designed. It stands down on any
 # unexpected state — dirty tree, open PRs, no green exact-SHA evidence, a -dev version, a stalled
 # Actions plane — because a watchdog acting on a partial picture is worse than no watchdog.
+# ── GITHUB HEALTH (2026-08-08). Stuart: "You should never ever let it be in a situation where
+# it's got failed pushes. Your job is to always be looking out for GitHub." Every prior signal
+# watched exactly ONE thing — signal-watch CI verdicts, issue-watch the SLA, published-surface
+# npm-vs-GitHub — and nothing watched the states that actually stall work: a red main, a PR that
+# silently went CONFLICTING, a stalled Actions queue, branches left behind after a merge.
+#
+# REPORTS ONLY. It cannot push, merge, close or publish (asserted by test). Exit 1 means a human
+# needs to look, and the reasons print in full rather than as a count.
+echo "===== GITHUB-HEALTH watch — $(date -u +%FT%TZ) =====" >> "$LOG"
+/usr/local/bin/node scripts/github-health-watch.mjs >> "$LOG" 2>&1 \
+  || echo "[github-health] findings above need attention" >> "$LOG"
+
 echo "===== RELEASE-CONVERGENCE watchdog — $(date -u +%FT%TZ) =====" >> "$LOG"
 /usr/local/bin/node scripts/release-convergence-watchdog.mjs --dispatch >> "$LOG" 2>&1 \
   || echo "[release-watchdog] exited non-zero — see above; nightly continues" >> "$LOG"

package/scripts/onboarding-console.mjs

@@ -428,8 +428,39 @@ function wiringSurvey() {
 function sessionHookExists() {
   return fs.existsSync(path.join(CONSOLE_ROOT, '.claude/hooks/agentdb-ensure.sh')) || fs.existsSync(path.join(CONSOLE_ROOT, '.claude/hooks'));
 }
+// WHICH FILE IS THE PROJECT'S MEMORY STORE IS NOT A CONSTANT (issue #127).
+//
+// This probed only `.swarm/memory.db`. A reporter on ruflo 3.34.0 measured their live store — 31MB
+// with a fresh project-state checkpoint — sitting in `.swarm/agentdb-memory.db`, so the card scored
+// the project on an empty file and reported "no project-state checkpoint found" and "liveness: 1
+// entries" about a store that had neither problem. The card's own remedy could not fix it, because
+// the data was never missing; the probe was looking elsewhere.
+//
+// I could NOT reproduce their attribution on this machine: same ruflo 3.34.0, both with and without
+// an explicit --path, a fresh `ruflo memory store` lands in `.swarm/memory.db` (proven by exact-key
+// SQL against both files). So which name the CLI picks is evidently config- or environment-
+// dependent, and hard-coding EITHER name is how this breaks again on the next machine.
+//
+// So the probe stops guessing and asks the filesystem: consider both known names, and use whichever
+// actually holds rows. That is correct on their machine and on mine without knowing why they differ.
+const MEMORY_DB_NAMES = ['memory.db', 'agentdb-memory.db'];
+export function resolveMemoryDb(projectDir) {
+  const candidates = MEMORY_DB_NAMES
+    .map((name) => path.join(projectDir, '.swarm', name))
+    .filter((file) => fs.existsSync(file));
+  if (!candidates.length) return path.join(projectDir, '.swarm/memory.db'); // canonical name for the "absent" message
+  if (candidates.length === 1) return candidates[0];
+  // Both present: prefer the one with real content. Size is a proxy for rows that costs no query and
+  // cannot throw on a locked or WAL-mode database — this runs inside a UI probe that must never hang.
+  return candidates.sort((a, b) => {
+    const sa = (() => { try { return fs.statSync(a).size; } catch { return 0; } })();
+    const sb = (() => { try { return fs.statSync(b).size; } catch { return 0; } })();
+    return sb - sa;
+  })[0];
+}
+
 function probeMemory(projectDir) {
-  const db = path.join(projectDir, '.swarm/memory.db');
+  const db = resolveMemoryDb(projectDir);
   const probes = {};
   // compaction survival + session surfacing are filesystem facts, always checkable
   const snapshot = inspectSessionSnapshots(projectDir);
@@ -1633,7 +1664,10 @@ function findMemoryStores(root) {
       const p = path.join(dir, e.name);
       if (VENDOR.some((m) => (p + '/').includes(m))) continue;
       if (e.name === '.swarm') {
-        if (fs.existsSync(path.join(p, 'memory.db'))) out.push({ project: dir, db: path.join(p, 'memory.db') });
+        // Same resolution as probeMemory — the fleet walk had the identical hardcoded assumption (#127).
+        const resolved = ['memory.db', 'agentdb-memory.db'].map((n) => path.join(p, n)).filter((f) => fs.existsSync(f))
+          .sort((a, b) => { const sz = (f) => { try { return fs.statSync(f).size; } catch { return 0; } }; return sz(b) - sz(a); })[0];
+        if (resolved) out.push({ project: dir, db: resolved });
         continue;
       }
       if (e.name.startsWith('.') || e.name === 'node_modules') continue;

package/scripts/release-transaction-provider.mjs

@@ -216,7 +216,21 @@ export function liveReleaseProvider({
       const pending = [];
       for (const { receipt, release } of latestByTransaction.values()) {
         if (TERMINAL_STATES.has(receipt.state)) continue;
-        const settled = receipt.schemaVersion === 1 && release.draft === false
+        // CONVERGENCE IS A FACT ABOUT THE CHANNELS, NOT ABOUT THE RECEIPT FORMAT (fixed 2026-08-07).
+        //
+        // This required `receipt.schemaVersion === 1`. Receipts are written as schemaVersion 2
+        // (release-transaction.mjs stateReceipt), so NO current transaction could ever be recognised
+        // as settled — it stayed `pending` forever and blocked every later release, which is the
+        // same deadlock shape as `aborted` being unreachable. It bit immediately: 4.0.24 published
+        // successfully to both channels, failed only on its final ledger entry, and then blocked
+        // 4.0.27 with `pending release 064b6b4e… blocks …`.
+        //
+        // The three conditions below are what actually prove convergence: the release is published,
+        // and this transaction's exact version and tag are what npm and GitHub currently serve. If
+        // all three hold, the transaction reached its goal whatever schema its receipts use. The
+        // check is not weakened — the schema clause was never load-bearing for that question, it
+        // just silently expired when the schema moved on.
+        const settled = release.draft === false
           && receipt.identity?.version === npmLatest && receipt.identity?.tag === githubLatest;
         if (settled) legacySettled.push(receipt.transactionId);
         else pending.push(receipt);

package/scripts/release-transaction.mjs

@@ -36,7 +36,15 @@ export const ALLOWED_TRANSITIONS = Object.freeze({
   'github-promote-intent': ['github-promoted-nonlatest', 'manual-intervention-required', ...ABORTABLE],
   'github-promoted-nonlatest': ['npm-promote-intent', 'manual-intervention-required', ...ABORTABLE],
   'npm-promote-intent': ['npm-promoted', 'compensation-intent', 'manual-intervention-required', ...ABORTABLE],
-  'npm-promoted': ['github-latest-intent', 'compensation-intent', 'manual-intervention-required', ...ABORTABLE],
+  // `defaults-promoted` added 2026-08-07: when GitHub is ALREADY latest at the moment npm is
+  // promoted, the reducer correctly chooses `finalize` and the finalize path moves straight to
+  // `defaults-promoted` (release-transaction.mjs:406) — there is no `github-latest-intent` to pass
+  // through, because there is nothing left to intend. The table assumed that hop was mandatory, so
+  // the 4.0.24 publish promoted BOTH channels successfully and then died on its own bookkeeping
+  // with `illegal release transition npm-promoted -> defaults-promoted`. The publication was real;
+  // only the ledger entry was refused. Both defaults genuinely are promoted in that state, so this
+  // records what happened rather than permitting anything new.
+  'npm-promoted': ['github-latest-intent', 'defaults-promoted', 'compensation-intent', 'manual-intervention-required', ...ABORTABLE],
   'github-latest-intent': ['defaults-promoted', 'compensation-intent', 'manual-intervention-required', ...ABORTABLE],
   'compensation-intent': ['compensated', 'manual-intervention-required', ...ABORTABLE],
   compensated: ['github-promote-intent', 'npm-promote-intent', 'manual-intervention-required', ...ABORTABLE],
@@ -408,7 +416,23 @@ export async function runReleaseTransaction({ identity, assets, adapter, private
       }
       await transition('finalize-intent');
       const final = await adapter.finalize(identity, current, hostVerifier);
-      if (final.verdict !== 'PASS') throw new Error('final release convergence failed');
+      // SAY WHICH CONVERGENCE FAILED, AND WHY (2026-08-07). This threw the bare sentence
+      // `final release convergence failed` while `finalize` had already returned exactly the reason
+      // — hostVerifierError, hosts.verifier.error, publicationError or sealError — and the throw
+      // discarded every one of them. That is the same defect that let `spawnSync ENOBUFS` masquerade
+      // as `staged GitHub payload mismatch` for three days: an error that reports its category and
+      // withholds its evidence. Publication had ALREADY succeeded on both channels here, so the
+      // operator is reading this line while npm and GitHub are correct, with nothing to act on.
+      if (final.verdict !== 'PASS') {
+        const why = final.hostVerifierError
+          || final.hosts?.verifier?.error
+          || final.publicationError
+          || final.sealError
+          || `verdict=${final.verdict ?? '(none)'}`;
+        const fixtures = final.hosts?.verifier?.fixtures;
+        const detail = fixtures ? ` | fixtures: ${JSON.stringify(fixtures).slice(0, 400)}` : '';
+        throw new Error(`final release convergence failed: ${why}${detail}`);
+      }
       const reobserved = await adapter.observeSnapshot(identity, draft, { forceAssets: true });
       if (!(npmLatestIsB(reobserved, identity) && reobserved.github?.latest && githubIsB(reobserved, identity))) {
         throw new Error('provider defaults drifted during finalization');

package/scripts/route-cheap.mjs

@@ -55,6 +55,20 @@ export const CLAUDE_TIERS = {
   'claude-sonnet-5': { in: 2.0, out: 10.0 },
   'claude-opus-4.8': { in: 5.0, out: 25.0 },
   'claude-fable-5': { in: 10.0, out: 50.0 },
+  // OPUS 5 ADDED 2026-08-08, and its absence was silently costing every receipt.
+  //
+  // dispatch-receipt refuses to price an unknown model ("refusing to invent savings"), which is the
+  // right call — but it means a session running on a model this table does not know can NEVER record
+  // a dispatch. Opus 5 is the current main-loop model, so every subagent routed from one of those
+  // sessions produced no receipt at all, and `/savings` read as "routing stopped" when what actually
+  // stopped was RECORDING. That is why the ledger sat unchanged for 14 days.
+  //
+  // Prices verified LIVE against the OpenRouter /models API on 2026-08-08, per this file's own
+  // standing rule — never recalled, never inferred from the 4.8 row:
+  //     anthropic/claude-opus-5        in $5.00/Mtok  out $25.00/Mtok
+  //     anthropic/claude-opus-5-fast   in $10.00/Mtok out $50.00/Mtok
+  'claude-opus-5': { in: 5.0, out: 25.0 },
+  'claude-opus-5-fast': { in: 10.0, out: 50.0 },
 };
 
 /** Price lookup across both tables. Unknown model → null (never invent a savings number). */