ruvnet-brain 4.0.7 → 4.0.12

package/scripts/health-repair.mjs

@@ -24,8 +24,12 @@ import path from 'node:path';
 import os from 'node:os';
 import { execFileSync, spawnSync } from 'node:child_process';
 import { findStores, diagnose } from './memory-doctor.mjs';
+import { loadRuntimePreferences } from '../plugin/scripts/runtime-preferences.mjs';
 
 const HOME = os.homedir();
+// The SAME project root learn-flush.mjs computes, by the same rule — the two halves of the flush
+// have to agree about which project they mean or they address different queues (issue #104).
+const PROJECT = process.env.RUVNET_BRAIN_PROJECT_DIR || process.cwd();
 const argv = process.argv.slice(2);
 const has = (f) => argv.includes(f);
 
@@ -93,25 +97,98 @@ function repairMemory() {
   return { ok: true, log: `repaired — integrity ok, ${rowsAfter} entries intact (was ${rowsBefore}). Backup: ${backup.replace(HOME, '~')}`, backup };
 }
 
-/** Drain the capture queue into rUv's learner — his tool, not ours. */
+/**
+ * Drain the capture queue into rUv's learner — his tool, not ours.
+ *
+ * ISSUE #104: this measured one queue and drained another, so it could only ever report "fed 0".
+ * The flusher was spawned with NO environment, so inside learn-flush.mjs RUVNET_LEARNING_SCOPE was
+ * unset and defaulted to 'project' — it drained `<project>/.swarm/ruvnet-brain-learn/` while THIS
+ * function counted `<user>/.cache/ruvnet-brain/learn/`. `before - after` was structurally 0: it
+ * could not report truthfully in either direction even on a flush that worked, and the real queue
+ * grew forever. Two independent defaults are not an agreement.
+ *
+ * So: resolve the scope ONCE, from the same policy module learn-flush reads, derive the queue root
+ * FROM that scope, pass the scope (and the exact queue file) to the child explicitly, and measure
+ * the root that was actually drained.
+ *
+ * And LOOP. learn-flush feeds at most MAX_ACTIONS distinct actions per invocation and writes the
+ * remainder back on purpose (a SessionEnd hook must stay fast), so one call cannot drain a deep
+ * queue — the reporter needed 15 rounds for 293 entries. A single call would leave a queue that
+ * "flushes" every time and never empties, which is the same lie in slow motion.
+ */
 function flushLearning() {
   const flusher = path.join(HOME, '.claude', 'plugins', 'marketplaces', 'ruvnet-brain', 'plugin', 'scripts', 'learn-flush.mjs');
-  const local = path.join(process.cwd(), 'plugin', 'scripts', 'learn-flush.mjs');
+  const local = path.join(PROJECT, 'plugin', 'scripts', 'learn-flush.mjs');
   const script = fs.existsSync(flusher) ? flusher : (fs.existsSync(local) ? local : null);
   if (!script) return { ok: false, log: 'learn-flush.mjs not found — cannot drain the queue' };
 
-  const queueDir = path.join(HOME, '.cache', 'ruvnet-brain', 'learn');
-  const depth = () => {
-    try {
-      return fs.readdirSync(queueDir).filter((f) => f.endsWith('.jsonl'))
-        .reduce((n, f) => n + fs.readFileSync(path.join(queueDir, f), 'utf8').split('\n').filter(Boolean).length, 0);
-    } catch { return 0; }
+  const configured = process.env.RUVNET_LEARNING_SCOPE
+    || loadRuntimePreferences({ cwd: PROJECT }).values.learningScope;
+  const scope = ['off', 'project', 'user'].includes(configured) ? configured : 'project';
+  if (scope === 'off') {
+    return { ok: true, noop: true, log: 'learning is switched off for this project — nothing is being captured, so there is nothing to feed' };
+  }
+
+  // Derived from the scope, never assumed: this is the directory the child will actually read.
+  const queueDir = scope === 'user'
+    ? path.join(HOME, '.cache', 'ruvnet-brain', 'learn')
+    : path.join(PROJECT, '.swarm', 'ruvnet-brain-learn');
+  // Displayed to a human and matched by tests, so it is normalised to forward slashes on every
+  // platform. Without this, Windows reports `~\.cache\ruvnet-brain\learn` while macOS and Linux
+  // report `~/.cache/ruvnet-brain/learn` — the same location under two spellings, which is the
+  // exact defect class this branch has been closing (one fact, two representations).
+  const where = queueDir.replace(HOME, '~').split(path.sep).join('/');
+
+  const queueFiles = () => {
+    try { return fs.readdirSync(queueDir).filter((f) => f.endsWith('.jsonl')).map((f) => path.join(queueDir, f)); }
+    catch { return []; }
+  };
+  const depthOf = (f) => {
+    try { return fs.readFileSync(f, 'utf8').split('\n').filter(Boolean).length; } catch { return 0; }
   };
+  const depth = () => queueFiles().reduce((n, f) => n + depthOf(f), 0);
+
   const before = depth();
-  try { execFileSync(process.execPath, [script], { stdio: 'ignore', timeout: 600_000 }); }
-  catch (e) { return { ok: false, log: `flush failed: ${e.message} — the queue is preserved for retry` }; }
+  if (!before) return { ok: true, noop: true, log: `nothing queued in ${where} — the learner is already caught up` };
+
+  const env = { ...process.env, RUVNET_LEARNING_SCOPE: scope, RUVNET_BRAIN_PROJECT_DIR: PROJECT };
+  const deadline = Date.now() + 540_000; // inside the 600s this action is allowed overall
+  const stalled = [];
+  for (const file of queueFiles()) {
+    let d = depthOf(file);
+    while (d > 0 && Date.now() < deadline) {
+      try {
+        execFileSync(process.execPath, [script], {
+          env: { ...env, LEARN_QUEUE: file },
+          stdio: 'ignore',
+          timeout: Math.min(120_000, Math.max(1_000, deadline - Date.now())),
+        });
+      } catch (e) { stalled.push(`${path.basename(file)}: ${String(e.message).split('\n')[0].slice(0, 80)}`); break; }
+      const next = depthOf(file);
+      // STRICT progress, or stop. learn-flush KEEPS a queue it could not feed (by design — the queue
+      // is evidence), so a round that shrinks nothing means the learner is not accepting the work.
+      // Spinning on it would burn the whole budget and still report zero.
+      if (next >= d) { stalled.push(`${path.basename(file)}: ${d} entr${d === 1 ? 'y' : 'ies'} would not feed`); break; }
+      d = next;
+    }
+  }
+
   const after = depth();
-  return { ok: true, log: `fed ${Math.max(0, before - after)} captured events into the learner (queue ${before} → ${after})` };
+  const fed = before - after;
+  if (fed <= 0) {
+    // Name the most likely cause instead of shrugging: learn-flush invokes ruflo at a FIXED path,
+    // so on a machine with a different npm prefix it feeds nothing and honestly keeps the queue.
+    const rufloAtFixedPath = fs.existsSync(path.join(HOME, '.npm-global/bin/ruflo'));
+    const why = stalled.length ? ` (${stalled.slice(0, 3).join('; ')})` : '';
+    const hint = rufloAtFixedPath ? '' : ' ruflo is not at ~/.npm-global/bin/ruflo, which is where the flusher looks for it —'
+      + ' `npm i -g ruflo@latest` installs it there.';
+    return { ok: false, log: `fed 0 of ${before} queued events from ${where}${why} — the queue is preserved for retry.${hint}` };
+  }
+  return {
+    ok: true,
+    log: `fed ${fed} captured events into the ${scope} learner (queue ${before} → ${after} in ${where})`
+      + (after ? ` — ${after} remain and will drain on the next flush` : ''),
+  };
 }
 
 /** One training cycle, via rUv's own CLI, in the GLOBAL (cross-project) learner. */

package/scripts/host-install-matrix.mjs

@@ -0,0 +1,155 @@
+// host-install-matrix.mjs — ONE definition of "install this artifact into clean hosts and judge it".
+//
+// WHY THIS EXISTS. Two harnesses did this same job and disagreed about almost everything:
+//
+//   scripts/staged-host-verifier.mjs        scripts/publication-receipt.mjs (installHosts)
+//   ─────────────────────────────────       ────────────────────────────────────────────────
+//   modes: claude / codex / dual            modes: claudeOnly / codexOnly / dual
+//   --local … --no-selfcheck                --version v<X>  (no --local, selfcheck ON)
+//   RUVNET_CLAUDE_MARKETPLACE_SOURCE        RUVNET_STRICT_INSTALL=1
+//   RUVNET_CODEX_HOOK_TRUST_MODE=bypass     RUVNET_BRAIN_PROFILE=complete
+//
+// They could not even be compared: one produced `fixtures.claude`, the other `hosts.claudeOnly`,
+// for the identical fixture. So "the hosts passed" meant two different things depending on which
+// half of the release you asked, and nothing in the system could notice they had drifted apart.
+//
+// Some of that difference is REAL and must survive: a STAGED check runs before publication against
+// local bytes, so it points the marketplace at the unpacked package and skips selfcheck; a
+// PUBLISHED check runs after, against what npm actually serves, so it resolves by version and
+// installs strictly. That is one axis with two values — a parameter. Everything else was accident.
+//
+// So: the modes are named once, the loop is written once, the verdict is classified once, and the
+// only thing a caller chooses is which VARIANT it is running. Same shape as
+// scripts/console-runtime-identity.mjs, where one enumeration serves both the copy list and the
+// digest — a fact stated once cannot drift from itself.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+/** The three host shapes a release must survive. ONE name each, for every consumer. */
+export const HOST_MODES = Object.freeze(['claude', 'codex', 'dual']);
+
+/** Which CLIs each mode is allowed to see. A codex-only box genuinely has no `claude`. */
+export const MODE_HOSTS = Object.freeze({
+  claude: ['claude'],
+  codex: ['codex'],
+  dual: ['claude', 'codex'],
+});
+
+/**
+ * The published-side receipt has always spelled these `claudeOnly` / `codexOnly` / `dual`, and that
+ * name is baked into current-release.json and every receipt already published — renaming it would
+ * invalidate history for a cosmetic win. So the two spellings are reconciled HERE, once, instead of
+ * being silently different in two files. `publication.installed.claudeOnly` and `fixtures.claude`
+ * are now provably the same fixture, which is what made the two halves of a release incomparable.
+ */
+export const RECEIPT_MODE_NAMES = Object.freeze({ claude: 'claudeOnly', codex: 'codexOnly', dual: 'dual' });
+export const MODE_FROM_RECEIPT_NAME = Object.freeze({ claudeOnly: 'claude', codexOnly: 'codex', dual: 'dual' });
+
+/**
+ * The two genuinely different questions, declared once instead of implied by two files.
+ *
+ * `staged`    — before publication, against local bytes. The marketplace is pointed at the unpacked
+ *               package because nothing is on npm yet, and selfcheck is skipped for the same reason.
+ * `published` — after publication, against what npm actually serves. Resolves by version and
+ *               installs strictly, because this is the run that must match a stranger's machine.
+ */
+export const VARIANTS = Object.freeze({
+  staged: Object.freeze({
+    installerArgs: (_v) => ['--local', '--yes', '--force', '--no-nightly-prompt',
+      '--no-telemetry', '--no-stack', '--no-enhance', '--no-statusline', '--no-selfcheck'],
+    env: ({ packageRoot }) => ({
+      RUVNET_CLAUDE_MARKETPLACE_SOURCE: packageRoot,
+      RUVNET_CODEX_HOOK_TRUST_MODE: 'bypass',
+    }),
+  }),
+  published: Object.freeze({
+    installerArgs: (version) => ['--yes', '--force', '--version', `v${version}`, '--no-nightly-prompt',
+      '--no-telemetry', '--no-stack', '--no-enhance', '--no-statusline'],
+    env: () => ({
+      RUVNET_STRICT_INSTALL: '1',
+      RUVNET_BRAIN_PROFILE: 'complete',
+    }),
+  }),
+});
+
+/** A doctor run is ACCEPTED only on a clean exit. One rule, not one per harness. */
+export function classifyDoctor(result) {
+  const output = `${result.stdout || ''}${result.stderr || ''}`;
+  if (!result.error && result.status === 0) return { accepted: true, status: 'PASS', output };
+  return { accepted: false, status: 'FAIL', output };
+}
+
+/** Build a PATH exposing only the CLIs this mode is entitled to see. */
+export function fixturePath(mode, temp, locate) {
+  const bin = path.join(temp, `bin-${mode}`);
+  fs.mkdirSync(bin, { recursive: true });
+  for (const name of ['node', 'npm', ...MODE_HOSTS[mode]]) {
+    const target = locate(name);
+    if (!target) throw new Error(`${name} CLI unavailable for the ${mode} host fixture`);
+    fs.symlinkSync(target, path.join(bin, name));
+  }
+  return `${bin}:/usr/bin:/bin`;
+}
+
+/**
+ * Install `packageRoot` into a clean HOME per mode and run its doctor. Returns a result for EVERY
+ * mode — including the ones that failed — because "which host broke" is the whole diagnostic value,
+ * and the previous harnesses threw on the first failure and lost the rest.
+ *
+ * @returns {{verdict:'PASS'|'FAIL', fixtures:Record<string,object>, error?:string}}
+ */
+export function runHostMatrix({ packageRoot, version, variant = 'staged', locate, temp, run = spawnSync }) {
+  const spec = VARIANTS[variant];
+  if (!spec) throw new Error(`unknown host-matrix variant: ${variant}`);
+  const workspace = temp || fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-host-matrix-'));
+  const installer = path.join(packageRoot, 'bin', 'install.mjs');
+  const fixtures = {};
+  let verdict = 'PASS';
+  let error;
+
+  for (const mode of HOST_MODES) {
+    try {
+      const home = path.join(workspace, `home-${mode}`);
+      const codexHome = path.join(home, '.codex');
+      const brainHome = path.join(home, '.cache', 'ruvnet-brain');
+      fs.mkdirSync(path.join(home, '.claude'), { recursive: true });
+      if (mode !== 'claude') fs.mkdirSync(codexHome, { recursive: true });
+      const env = {
+        ...process.env,
+        HOME: home,
+        CODEX_HOME: codexHome,
+        RUVNET_BRAIN_HOME: brainHome,
+        RUVNET_BRAIN_KB: path.join(brainHome, 'kb'),
+        CI: 'true',
+        PATH: fixturePath(mode, workspace, locate),
+        ...spec.env({ packageRoot }),
+      };
+      const install = run(process.execPath, [installer, ...spec.installerArgs(version)], {
+        cwd: packageRoot, env, encoding: 'utf8', timeout: 1_200_000, maxBuffer: 32 * 1024 * 1024,
+      });
+      if (install.error || install.status !== 0) {
+        throw new Error(`install failed for ${mode}: ${(install.stderr || install.error?.message || '').slice(-4000)}`);
+      }
+      const doctor = run(process.execPath, [installer, '--doctor', '--hooks'], {
+        cwd: packageRoot, env, encoding: 'utf8', timeout: 300_000, maxBuffer: 32 * 1024 * 1024,
+      });
+      const classified = classifyDoctor(doctor);
+      fixtures[mode] = { status: classified.status, doctorExit: doctor.status, version };
+      if (!classified.accepted) {
+        verdict = 'FAIL';
+        fixtures[mode].output = classified.output.slice(-5000);
+        // The output belongs IN the error. The previous harness put it there and I dropped it in
+        // the consolidation, so CI reported a bare "doctor failed for claude" and the one thing
+        // needed to act on it — what the doctor actually said — was thrown away.
+        error = error || `doctor failed for ${mode} (exit ${doctor.status}): ${classified.output.slice(-4000)}`;
+      }
+    } catch (e) {
+      verdict = 'FAIL';
+      fixtures[mode] = { status: 'FAIL', error: e.message };
+      error = error || e.message;
+    }
+  }
+  return error ? { verdict, fixtures, error } : { verdict, fixtures };
+}

package/scripts/learning-replay-contract.mjs

@@ -59,6 +59,16 @@ export function trapSpec(id = TRAP.MEMORY_SEARCH) {
   };
 }
 
+// Codex commonly prints the global binary as $HOME/.npm-global/bin/ruflo. That is a real shell
+// executable path, not prose, but the shared command parser intentionally does not expand shell
+// variables. Canonicalize only an executable-position prefix; never rewrite quoted mentions.
+export function normalizeRufloExecutable(command) {
+  return String(command || '').replace(
+    /(^|(?:&&|\|\||[;|()\n])\s*)\$(?:HOME|\{HOME\})\/\.npm-global\/bin\/(ruflo|claude-flow)(?=\s|$)/g,
+    '$1$2',
+  );
+}
+
 export const LOAD_BEARING = Object.freeze([
   'scripts/learning-replay.mjs',
   'scripts/learning-replay-contract.mjs',
@@ -80,7 +90,7 @@ export const LOAD_BEARING = Object.freeze([
 ]);
 
 export function classifyCommand(cmd) {
-  const invocations = findInvocations(String(cmd || ''), ['ruflo', 'claude-flow']);
+  const invocations = findInvocations(normalizeRufloExecutable(cmd), ['ruflo', 'claude-flow']);
   if (!invocations.length) return 'none';
   let sawPositional = false;
   for (const inv of invocations) {
@@ -102,7 +112,7 @@ export function classifyCommand(cmd) {
 }
 
 export function subcommandCorrect(cmd) {
-  for (const inv of findInvocations(String(cmd || ''), ['ruflo', 'claude-flow'])) {
+  for (const inv of findInvocations(normalizeRufloExecutable(cmd), ['ruflo', 'claude-flow'])) {
     const words = inv.args.filter((a) => a !== '' && !a.startsWith('-'));
     const memory = words.indexOf('memory');
     if (memory !== -1 && words[memory + 1] === 'search') return true;
@@ -124,7 +134,7 @@ export function optionValue(args, short, long) {
 }
 
 export function classifyPostTaskCommand(cmd) {
-  const invocations = findInvocations(String(cmd || ''), ['ruflo', 'claude-flow']);
+  const invocations = findInvocations(normalizeRufloExecutable(cmd), ['ruflo', 'claude-flow']);
   if (!invocations.length) return 'none';
   let sawPostTask = false;
   for (const inv of invocations) {
@@ -142,7 +152,7 @@ export function classifyPostTaskCommand(cmd) {
 }
 
 export function postTaskSubcommandCorrect(cmd) {
-  return findInvocations(String(cmd || ''), ['ruflo', 'claude-flow']).some((inv) => {
+  return findInvocations(normalizeRufloExecutable(cmd), ['ruflo', 'claude-flow']).some((inv) => {
     const words = inv.args.filter((a) => a !== '' && !a.startsWith('-'));
     const hooks = words.indexOf('hooks');
     return hooks !== -1 && words[hooks + 1] === 'post-task';

package/scripts/learning-replay-execution.mjs

@@ -3,7 +3,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { commandNodes, findInvocations } from '../plugin/scripts/hook-input.mjs';
-import { optionValue, TRAP } from './learning-replay-contract.mjs';
+import { normalizeRufloExecutable, optionValue, TRAP } from './learning-replay-contract.mjs';
 
 export const PROJECT_B_MEMORY_KEY = 'note-caching-strategy';
 export const PROJECT_B_MEMORY_VALUE =
@@ -90,9 +90,10 @@ export function executeProducedCommand(cmd, {
     output: '',
     ...extra,
   });
-  const invocations = findInvocations(String(cmd || ''), ['ruflo', 'claude-flow']);
+  const normalized = normalizeRufloExecutable(cmd);
+  const invocations = findInvocations(normalized, ['ruflo', 'claude-flow']);
   if (!invocations.length) return reject('no Ruflo invocation to execute');
-  const firstExecutable = path.basename(commandNodes(String(cmd || ''))[0]?.exe || '').split('@')[0];
+  const firstExecutable = path.basename(commandNodes(normalized)[0]?.exe || '').split('@')[0];
   if (invocations.length !== 1 || firstExecutable !== 'ruflo') {
     return reject('corrective command was not the first and only Ruflo invocation');
   }

package/scripts/learning-replay-fixture.mjs

@@ -48,6 +48,16 @@ function initMemoryDb(ruflo, db, cwd) {
   return sh(ruflo, ['memory', 'init', '--path', db, '--backend', 'hybrid'], { cwd });
 }
 
+function retrieveExact(ruflo, db, cwd, key, expected) {
+  const result = sh(ruflo, [
+    'memory', 'retrieve', '-k', key, '-n', 'default', '--value-only', '--path', db,
+  ], { cwd });
+  return {
+    exit: result.status,
+    matched: result.status === 0 && String(result.stdout || '').includes(expected),
+  };
+}
+
 export function buildFixtures(baseDir) {
   fs.mkdirSync(baseDir, { recursive: true });
   const dirs = {
@@ -90,6 +100,7 @@ export function recordInProjectA(dirs, {
       'memory', 'search', '-q', spec.recordQuery,
       '-n', 'default', '--path', db, '-t', 'keyword',
     ], { cwd: project });
+    const exact = retrieveExact(ruflo, db, project, key, spec.lesson);
     return {
       project: path.basename(project),
       db,
@@ -97,7 +108,8 @@ export function recordInProjectA(dirs, {
       initExit: init.status,
       storeExit: store.status,
       readBackExit: readBack.status,
-      recorded: fs.existsSync(db),
+      exactReadExit: exact.exit,
+      recorded: exact.matched,
     };
   });
   const lesson = makeLesson({
@@ -138,12 +150,14 @@ export function seedProjectBMemory(dirs, { ruflo = RUFLO_BIN } = {}) {
     'memory', 'store', '-k', PROJECT_B_MEMORY_KEY,
     '--value', PROJECT_B_MEMORY_VALUE, '-n', 'default', '--path', db,
   ], { cwd: dirs.projectB });
+  const exact = retrieveExact(ruflo, db, dirs.projectB, PROJECT_B_MEMORY_KEY, PROJECT_B_MEMORY_VALUE);
   return {
     db,
     key: PROJECT_B_MEMORY_KEY,
     initExit: init.status,
     storeExit: store.status,
-    ok: init.status === 0 && store.status === 0 && fs.existsSync(db),
+    exactReadExit: exact.exit,
+    ok: init.status === 0 && store.status === 0 && exact.matched,
   };
 }
 
@@ -156,6 +170,13 @@ export function nightlyRefresh(dirs, { ruflo = RUFLO_BIN } = {}) {
     path.join(ROOT, 'scripts', 'ci', 'learning-replay-codex-adapter.mjs'),
     path.join(versionDir, 'scripts', 'codex-hook-adapter.mjs'),
   );
+  // Codex registrations call this stable, generation-independent wrapper. A fixture that only
+  // creates active.json silently falls back to the user's real Brain home and never records the
+  // trap's PreToolUse command, making an expensive replay unmeasurable.
+  fs.copyFileSync(
+    path.join(ROOT, 'plugin', 'scripts', 'codex-hook-wrapper.mjs'),
+    path.join(dirs.brainHome, 'codex-hook.mjs'),
+  );
   fs.writeFileSync(path.join(dirs.brainHome, 'active.json'), JSON.stringify({
     codeRoot: versionDir,
     generation,

package/scripts/memory-doctor.mjs

@@ -41,6 +41,7 @@ import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { canonicalPath, pathIdentity } from '../plugin/scripts/project-identity.mjs';
 
 const HOME = os.homedir();
 const DEFAULT_SCAN_ROOTS = ['Code', 'code', 'src', 'source', 'projects', 'dev', 'work'];
@@ -132,10 +133,6 @@ const q = (db, sql) => {
 // n() returns null for "unknown" and a number only when we genuinely counted. Callers must handle null.
 const n = (r) => (r.ok ? (r.value === null || r.value === '' ? null : parseInt(r.value, 10)) : null);
 
-function realExisting(value) {
-  try { return fs.realpathSync(value); } catch { return null; }
-}
-
 export function candidateRoots({
   home = HOME,
   configPath = path.join(home, '.claude', 'ruvnet-brain', 'config.json'),
@@ -150,13 +147,18 @@ export function candidateRoots({
     }
   } catch { /* absent or malformed config does not erase the common roots */ }
 
-  const roots = new Set();
+  // Keyed by pathIdentity, not by the spelling. DEFAULT_SCAN_ROOTS deliberately lists both `Code`
+  // and `code` so neither convention is missed, and on a case-insensitive volume those are ONE
+  // directory — which the old Set-of-strings admitted twice and then scanned, counted and summed
+  // twice (#107). On a case-sensitive volume they are two inodes and both are still kept.
+  const roots = new Map();
   const addRoot = (value) => {
     const absolute = path.isAbsolute(value) ? value : path.join(home, value);
-    const canonical = realExisting(absolute);
+    const canonical = canonicalPath(absolute);
     try {
       if (canonical && fs.statSync(canonical).isDirectory()) {
-        roots.add(canonical);
+        const identity = pathIdentity(canonical) ?? canonical;
+        if (!roots.has(identity)) roots.set(identity, canonical);
         return true;
       }
     } catch { /* missing/non-directory roots are not candidates on this machine */ }
@@ -170,12 +172,14 @@ export function candidateRoots({
   if (configuredCount > 0 && validConfigured === 0) {
     throw new Error('configured scanRoots contain no existing directories');
   }
-  return [...roots].sort();
+  return [...roots.values()].sort();
 }
 
+// Keyed by pathIdentity for the same reason candidateRoots is: one store reached by two names is
+// one store. Values are the canonical spelling, which is what every caller reads back.
 function storesBelow(root) {
-  const out = new Set();
-  const canonicalRoot = realExisting(root);
+  const out = new Map();
+  const canonicalRoot = canonicalPath(root);
   if (!canonicalRoot) return out;
   const walk = (dir, depth) => {
     if (depth > 4) return;
@@ -186,8 +190,8 @@ function storesBelow(root) {
       if (e.name === 'node_modules' || e.name === '.git') continue;
       if (e.name === '.swarm') {
         const db = path.join(dir, '.swarm/memory.db');
-        const canonical = realExisting(db);
-        if (canonical) out.add(canonical);
+        const canonical = canonicalPath(db);
+        if (canonical) out.set(pathIdentity(canonical) ?? canonical, canonical);
         continue;
       }
       if (e.name.startsWith('.') && e.name !== '.swarm') continue;
@@ -199,28 +203,27 @@ function storesBelow(root) {
 }
 
 export function findStores(root) {
-  const out = new Set();
+  const out = new Map();
+  const collect = (found) => { for (const [identity, db] of found) if (!out.has(identity)) out.set(identity, db); };
   if (root !== undefined) {
-    for (const db of storesBelow(root)) out.add(db);
-    return [...out].sort();
+    collect(storesBelow(root));
+    return [...out.values()].sort();
   }
 
-  for (const candidate of candidateRoots()) {
-    for (const db of storesBelow(candidate)) out.add(db);
-  }
+  for (const candidate of candidateRoots()) collect(storesBelow(candidate));
   // These two stores intentionally sit outside the project-root convention. They belong only to
   // the fleet-wide no-argument scan; an explicit root must remain genuinely scoped.
   for (const extra of [path.join(HOME, '.claude/.swarm/memory.db'), path.join(HOME, 'cognitum-trader/.swarm/memory.db')]) {
-    const canonical = realExisting(extra);
-    if (canonical) out.add(canonical);
+    const canonical = canonicalPath(extra);
+    if (canonical) collect([[pathIdentity(canonical) ?? canonical, canonical]]);
   }
-  return [...out].sort();
+  return [...out.values()].sort();
 }
 
 export function displayStoreName(db, home = HOME) {
-  const canonicalDb = realExisting(db) || path.resolve(db);
+  const canonicalDb = canonicalPath(db) || path.resolve(db);
   const project = path.dirname(path.dirname(canonicalDb));
-  const canonicalHome = realExisting(home) || path.resolve(home);
+  const canonicalHome = canonicalPath(home) || path.resolve(home);
   const relative = path.relative(canonicalHome, project);
   if (relative === '') return '~';
   if (relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative)) {

package/scripts/model-router-catalog.mjs

@@ -1,3 +1,6 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
 // Managed facts are additive for existing users. Their existing row is the user overlay: it wins
 // byte-for-byte, including disablement, tier/priority changes, and local candidates. Newly shipped
 // metered rows are not auto-added; that would silently expand spend authority.
@@ -14,3 +17,34 @@ export function mergeManagedCatalog(existing, managed) {
   };
   return JSON.stringify(next) === JSON.stringify(existing) ? existing : next;
 }
+
+// Issue #87: the merge above was correct but reachable only from offerRouterProfile(), which runs on
+// the FRESH-INSTALL path alone. `--update` (and therefore Evergreen nightly) never called it, so the
+// one population that needs managed additions — users who already have ~/.claude/model-router/
+// catalog.json — could never acquire a newly shipped managed model. This is that same merge as a
+// non-interactive, idempotent step the update path can call: no prompts, no TEST_MODE gate, backs the
+// user's file up before it writes, and replaces it by atomic rename so a crash can never half-apply.
+export function applyManagedCatalogUpdate({ routerDir, packageRoot }) {
+  const template = path.join(packageRoot, 'config', 'model-router', 'catalog.template.json');
+  const target = path.join(routerDir, 'catalog.json');
+  if (!fs.existsSync(template)) return { action: 'skipped', added: [], detail: 'no managed template in this package' };
+  const managed = JSON.parse(fs.readFileSync(template, 'utf8'));
+  fs.mkdirSync(routerDir, { recursive: true });
+  if (!fs.existsSync(target)) {
+    fs.copyFileSync(template, target);
+    return { action: 'created', added: (managed.candidates || []).map((candidate) => candidate.id), detail: target };
+  }
+  const existing = JSON.parse(fs.readFileSync(target, 'utf8'));
+  const merged = mergeManagedCatalog(existing, managed);
+  if (merged === existing) return { action: 'unchanged', added: [], detail: target };
+  const before = new Set((existing.candidates || []).map((candidate) => candidate.id));
+  fs.copyFileSync(target, `${target}.pre-managed-merge`);
+  const staged = `${target}.tmp-${process.pid}`;
+  fs.writeFileSync(staged, `${JSON.stringify(merged, null, 2)}\n`, { mode: 0o600 });
+  fs.renameSync(staged, target);
+  return {
+    action: 'merged',
+    added: merged.candidates.filter((candidate) => !before.has(candidate.id)).map((candidate) => candidate.id),
+    detail: target,
+  };
+}