ruvnet-brain 4.0.8 → 4.0.12

package/plugin/scripts/session-start-core.mjs

@@ -472,11 +472,28 @@ export async function runSessionStart({
         emit(`[RuvNet Brain v${bannerVersion} — active this session, RETRIEVAL DOWN]`);
         emit(`The plugin and its hooks are running, but the brain itself is broken (see the alarm above). Do not claim grounding works. If you mention it at all: "🧠 RuvNet Brain active (v${bannerVersion}) — but its search is down right now."`);
       } else {
-        emit(`[RuvNet Brain v${bannerVersion} — active this session${updated ? ` · updated ${updated}` : ''}${kbVersion ? ` · knowledge bundle ${kbVersion}` : ''}]`);
+        // ONE VERSION, CUSTOMER-FACING (issue #77, restated from the customer's side).
+        //
+        // This printed the plugin version and the knowledge bundle's tag side by side —
+        // "RuvNet Brain active (v4.0.8, brain v4.0.7)". Those are two internal artefacts of ONE
+        // product. Showing both makes every user adjudicate whether their install is out of sync,
+        // a question they cannot answer and should never have been asked. Keeping the two in
+        // lockstep is this project's job; printing the seam is an admission leaking into the UI.
+        //
+        // The divergence is NOT hidden — when the tags differ it goes to the maintainer on the
+        // same private entitlement that gates open-issue alerts, because a bundle behind its
+        // plugin is a RELEASE defect to fix, not a banner to annotate.
+        emit(`[RuvNet Brain v${bannerVersion} — active this session${updated ? ` · updated ${updated}` : ''}]`);
+        const bundleTag = String(kbVersion).replace(/^v/, '');
+        if (bundleTag && bannerVersion !== 'unknown' && bundleTag !== bannerVersion
+            && maintainerIssueEntitlement(env, home, 'stuinfla/ruvnet-brain')) {
+          emit('[RuvNet Brain — MAINTAINER ONLY: the shipped generation is split. Do NOT surface this to the user.]');
+          emit(`Plugin is ${bannerVersion}; the knowledge bundle on this machine is ${kbVersion}. Per issue #77 these ship as ONE generation, so a split means a release published the plugin without its matching bundle asset. The user is correctly shown a single version (${bannerVersion}) — fix the release, never annotate the banner.`);
+        }
         let confidenceInstruction;
         if (readiness.state === 'ready') {
           emit('USER-LEVEL: one brain (~/.cache/ruvnet-brain/kb) shared by every project and window here — nothing to reinstall per project. search_ruvnet is ready and live; the grounding hooks are active.');
-          confidenceInstruction = `Open your FIRST response with ONE short, warm confirmation in your own words (2-3 lines, then move on; never repeat it this session). It must say "🧠 RuvNet Brain active (v${bannerVersion}${kbVersion ? `, brain ${kbVersion}` : ''})" — that version, in parentheses, always — and convey: it grounds rUv's stack (RVF, Ruflo, AgentDB, SPARC, agentic-flow…) in his real source rather than guessing; npx github:stuinfla/ruvnet-brain --doctor checks it; ${consoleInvoke} opens a visual settings page.`;
+          confidenceInstruction = `Open your FIRST response with ONE short, warm confirmation in your own words (2-3 lines, then move on; never repeat it this session). It must say "🧠 RuvNet Brain active (v${bannerVersion})" — ONE version, in parentheses, always; never a second number, never a bundle tag beside it — and convey: it grounds rUv's stack (RVF, Ruflo, AgentDB, SPARC, agentic-flow…) in his real source rather than guessing; npx github:stuinfla/ruvnet-brain --doctor checks it; ${consoleInvoke} opens a visual settings page.`;
         } else if (readiness.state === 'degraded') {
           const receipt = readiness.receipt || {};
           emit(`USER-LEVEL: one brain (~/.cache/ruvnet-brain/kb) shared by every project and window here — nothing to reinstall per project. search_ruvnet is registered but degraded (${receipt.phase || 'startup'}: ${receipt.error || 'readiness failed'}); the grounding hooks remain active.`);

package/scripts/console-runtime-identity.mjs

@@ -0,0 +1,74 @@
+// ONE definition of "what the persistent Console runtime is" and "which generation is running".
+//
+// #79 reported a Console that survived an update: the browser was served the new frontend from disk
+// while the Node process kept its pre-update router in memory, and every relaunch said "already
+// running". The reuse check compared a `sourceSha256` computed from a SINGLE file —
+// scripts/onboarding-console.mjs — while the runtime the server actually executes is this whole
+// surface: ~230 modules it imports plus the frontend it serves. Two genuinely different candidates
+// whose entrypoint bytes happened to match produced byte-identical identities, so an update that
+// changed console-engine.mjs, capability-registry.mjs or console/app.js was invisible to the
+// launcher. The identity has to derive from something an update cannot leave behind, which is the
+// installed bytes themselves — all of them.
+//
+// #76 reported the same disease at the asset boundary: the runtime copied plugin/scripts without
+// the sibling docs/ and manifest that plugin/scripts/whats-new.mjs reads, so the executable
+// travelled and its assets did not. The copy list and the identity list were two separate
+// enumerations of one payload; they are one list now, so an asset added to the runtime is part of
+// its generation by construction.
+//
+// The installer hashes the staged tree with this function and the running server hashes its own
+// root with this function, over this list. Neither side can define the fact differently.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+
+/**
+ * Every path the persistent Console runtime carries, relative to both the candidate source root and
+ * the installed runtime root (they are laid out identically). This is simultaneously the installer's
+ * copy list and the generation's digest input — one enumeration, so they cannot drift.
+ */
+export const CONSOLE_RUNTIME_SURFACE = Object.freeze([
+  'console',
+  'scripts',
+  'plugin/scripts',
+  // whats-new.mjs resolves its version manifest and curated notes relative to its own plugin root
+  // (#76). Shipping the executable without them is how the installed skill lost its release notes.
+  'plugin/docs',
+  'plugin/.claude-plugin',
+  'data/model-catalog.json',
+  'kb/brain-profile.mjs',
+  'bin/install.mjs',
+  'package.json',
+]);
+
+/** The runtime's own identity file, written by the installer INTO the tree — never part of its own digest. */
+export const CONSOLE_RUNTIME_IDENTITY_FILE = 'runtime-identity.json';
+
+/**
+ * Deterministic content digest of the runtime surface under `root`.
+ *
+ * A path that is absent is hashed as absent rather than skipped: a runtime that lost a file is a
+ * different generation, not the same one, and a launcher must be able to see that.
+ *
+ * @param {string} root runtime root (an installed `.console-runtime`, a marketplace clone, or a checkout)
+ * @returns {string} hex sha256
+ */
+export function consoleRuntimeDigest(root) {
+  const hash = crypto.createHash('sha256');
+  const visit = (absolute, relative) => {
+    let stat;
+    try { stat = fs.lstatSync(absolute); } catch { hash.update(`absent\0${relative}\0`); return; }
+    if (stat.isDirectory()) {
+      hash.update(`d\0${relative}\0`);
+      let entries = [];
+      try { entries = fs.readdirSync(absolute).sort(); } catch { hash.update(`unreadable\0${relative}\0`); return; }
+      for (const entry of entries) visit(path.join(absolute, entry), `${relative}/${entry}`);
+      return;
+    }
+    hash.update(`f\0${relative}\0`);
+    try { hash.update(fs.readFileSync(absolute)); } catch { hash.update(`unreadable\0${relative}\0`); }
+  };
+  for (const relative of CONSOLE_RUNTIME_SURFACE) visit(path.join(root, relative), relative);
+  return hash.digest('hex');
+}

package/scripts/distill-project.mjs

@@ -37,9 +37,13 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { execFileSync, spawnSync } from 'node:child_process';
+import { resolveRuflo, RUFLO_MISSING } from '../plugin/scripts/ruflo-bin.mjs';
 
 const HOME = os.homedir();
-const RUFLO = process.env.RUFLO_BIN || path.join(HOME, '.npm-global/bin/ruflo');
+// Issue #99: this was `process.env.RUFLO_BIN || path.join(HOME, '.npm-global/bin/ruflo')`, so every
+// install whose npm prefix is not the owner's (Homebrew, nvm, Volta, plain `npm -g`) was told its
+// tool was missing while ruflo sat on their PATH. One resolver, shared — see ruflo-bin.mjs.
+const RUFLO = resolveRuflo();
 const RUFLO_ENV = { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' };
 
 const argv = process.argv.slice(2);
@@ -126,6 +130,10 @@ if (has('--restore')) {
 }
 
 // ── PRE-FLIGHT ─────────────────────────────────────────────────────────────────────────────────────
+// Two different facts, so two different sentences. `null` means we looked everywhere and found
+// nothing; a path that does not exist means the user pointed RUFLO_BIN somewhere empty, and naming
+// that exact path back to them is the whole value of the message.
+if (!RUFLO) die(RUFLO_MISSING);
 if (!fs.existsSync(RUFLO)) die(`ruflo is not at ${RUFLO.replace(HOME, '~')} — install it with \`npm i -g ruflo@latest\``);
 if (!fs.existsSync(DB)) die(`no memory store at ${DB.replace(HOME, '~')} — nothing to distill for this project`);
 

package/scripts/doc-currency.mjs

@@ -408,6 +408,7 @@ export function evaluateDoc(root, rel, opts = {}) {
     status: k.status ?? null,
     date: k.date ?? null,
     updated: k.updated ?? null,
+    updatedPinned: k.updated_pinned === true || k.updated_pinned === 'true',
     implStored: k.impl ?? null,
     verifiedStamp: k.verified ?? null,
     verifiedDigestStored: k.verified_digest ?? null,
@@ -455,7 +456,19 @@ export function evaluateDoc(root, rel, opts = {}) {
     if (Number.isFinite(d) && Number.isFinite(g)) {
       const deltaDays = Math.round((g - d) / 86400000);
       if (deltaDays >= 1) {
-        add(BLOCK, 'stamp-lags-doc',
+        // `updated_pinned: true` — the date is a HISTORICAL RECORD, not a currency stamp.
+        //
+        // Some documents record WHEN SOMETHING HAPPENED, not when the file was last edited.
+        // ADR-050's `updated: 2026-08-02` is an incident cutoff and is asserted by
+        // tests/unit/fix-workstream-guidance. A blanket "make the stamp match the last commit"
+        // rule cannot tell those apart, so it silently rewrote the pinned date — putting two gates
+        // into direct contradiction, one demanding the pinned value and one demanding the commit
+        // date, with no way to satisfy both. The document itself is the only thing that knows
+        // which kind of date it carries, so it now says so, and --fix must never overwrite it.
+        if (doc.updatedPinned) {
+          add(WARN, 'stamp-pinned',
+            `updated: ${doc.updated} is PINNED (updated_pinned: true) and deliberately does not track the last commit ${docCommit.date} — it records an event, not the edit`);
+        } else add(BLOCK, 'stamp-lags-doc',
           `updated: ${doc.updated} but the document's own last commit is ${docCommit.date} (${docCommit.sha.slice(0, 8)}) — edited without touching its own stamp`);
       } else if (deltaDays <= -1) {
         // Typed ahead. WARN only: a stamp dated today on a change not yet committed is CORRECT, and
@@ -610,7 +623,7 @@ export function planFix(root, doc) {
     if (doc.dirty) blocked.push({ code: 'missing-updated', why: 'working tree is modified — the last commit date is not the date of the current contents' });
     else if (doc.docCommit) changes.push({ key: 'updated', value: doc.docCommit.date, source: 'derived-from-git', evidence: `git log -1 ${doc.file} → ${doc.docCommit.sha.slice(0, 8)}` });
     else blocked.push({ code: 'missing-updated', why: 'git reports no commit touching this path' });
-  } else if (doc.findings.some((f) => f.code === 'stamp-lags-doc') && doc.docCommit && !doc.dirty) {
+  } else if (!doc.updatedPinned && doc.findings.some((f) => f.code === 'stamp-lags-doc') && doc.docCommit && !doc.dirty) {
     changes.push({ key: 'updated', value: doc.docCommit.date, source: 'derived-from-git', replaces: doc.updated, evidence: `git log -1 ${doc.file} → ${doc.docCommit.sha.slice(0, 8)}` });
   }
   return { changes, blocked };

package/scripts/health-repair.mjs

@@ -24,8 +24,12 @@ import path from 'node:path';
 import os from 'node:os';
 import { execFileSync, spawnSync } from 'node:child_process';
 import { findStores, diagnose } from './memory-doctor.mjs';
+import { loadRuntimePreferences } from '../plugin/scripts/runtime-preferences.mjs';
 
 const HOME = os.homedir();
+// The SAME project root learn-flush.mjs computes, by the same rule — the two halves of the flush
+// have to agree about which project they mean or they address different queues (issue #104).
+const PROJECT = process.env.RUVNET_BRAIN_PROJECT_DIR || process.cwd();
 const argv = process.argv.slice(2);
 const has = (f) => argv.includes(f);
 
@@ -93,25 +97,98 @@ function repairMemory() {
   return { ok: true, log: `repaired — integrity ok, ${rowsAfter} entries intact (was ${rowsBefore}). Backup: ${backup.replace(HOME, '~')}`, backup };
 }
 
-/** Drain the capture queue into rUv's learner — his tool, not ours. */
+/**
+ * Drain the capture queue into rUv's learner — his tool, not ours.
+ *
+ * ISSUE #104: this measured one queue and drained another, so it could only ever report "fed 0".
+ * The flusher was spawned with NO environment, so inside learn-flush.mjs RUVNET_LEARNING_SCOPE was
+ * unset and defaulted to 'project' — it drained `<project>/.swarm/ruvnet-brain-learn/` while THIS
+ * function counted `<user>/.cache/ruvnet-brain/learn/`. `before - after` was structurally 0: it
+ * could not report truthfully in either direction even on a flush that worked, and the real queue
+ * grew forever. Two independent defaults are not an agreement.
+ *
+ * So: resolve the scope ONCE, from the same policy module learn-flush reads, derive the queue root
+ * FROM that scope, pass the scope (and the exact queue file) to the child explicitly, and measure
+ * the root that was actually drained.
+ *
+ * And LOOP. learn-flush feeds at most MAX_ACTIONS distinct actions per invocation and writes the
+ * remainder back on purpose (a SessionEnd hook must stay fast), so one call cannot drain a deep
+ * queue — the reporter needed 15 rounds for 293 entries. A single call would leave a queue that
+ * "flushes" every time and never empties, which is the same lie in slow motion.
+ */
 function flushLearning() {
   const flusher = path.join(HOME, '.claude', 'plugins', 'marketplaces', 'ruvnet-brain', 'plugin', 'scripts', 'learn-flush.mjs');
-  const local = path.join(process.cwd(), 'plugin', 'scripts', 'learn-flush.mjs');
+  const local = path.join(PROJECT, 'plugin', 'scripts', 'learn-flush.mjs');
   const script = fs.existsSync(flusher) ? flusher : (fs.existsSync(local) ? local : null);
   if (!script) return { ok: false, log: 'learn-flush.mjs not found — cannot drain the queue' };
 
-  const queueDir = path.join(HOME, '.cache', 'ruvnet-brain', 'learn');
-  const depth = () => {
-    try {
-      return fs.readdirSync(queueDir).filter((f) => f.endsWith('.jsonl'))
-        .reduce((n, f) => n + fs.readFileSync(path.join(queueDir, f), 'utf8').split('\n').filter(Boolean).length, 0);
-    } catch { return 0; }
+  const configured = process.env.RUVNET_LEARNING_SCOPE
+    || loadRuntimePreferences({ cwd: PROJECT }).values.learningScope;
+  const scope = ['off', 'project', 'user'].includes(configured) ? configured : 'project';
+  if (scope === 'off') {
+    return { ok: true, noop: true, log: 'learning is switched off for this project — nothing is being captured, so there is nothing to feed' };
+  }
+
+  // Derived from the scope, never assumed: this is the directory the child will actually read.
+  const queueDir = scope === 'user'
+    ? path.join(HOME, '.cache', 'ruvnet-brain', 'learn')
+    : path.join(PROJECT, '.swarm', 'ruvnet-brain-learn');
+  // Displayed to a human and matched by tests, so it is normalised to forward slashes on every
+  // platform. Without this, Windows reports `~\.cache\ruvnet-brain\learn` while macOS and Linux
+  // report `~/.cache/ruvnet-brain/learn` — the same location under two spellings, which is the
+  // exact defect class this branch has been closing (one fact, two representations).
+  const where = queueDir.replace(HOME, '~').split(path.sep).join('/');
+
+  const queueFiles = () => {
+    try { return fs.readdirSync(queueDir).filter((f) => f.endsWith('.jsonl')).map((f) => path.join(queueDir, f)); }
+    catch { return []; }
+  };
+  const depthOf = (f) => {
+    try { return fs.readFileSync(f, 'utf8').split('\n').filter(Boolean).length; } catch { return 0; }
   };
+  const depth = () => queueFiles().reduce((n, f) => n + depthOf(f), 0);
+
   const before = depth();
-  try { execFileSync(process.execPath, [script], { stdio: 'ignore', timeout: 600_000 }); }
-  catch (e) { return { ok: false, log: `flush failed: ${e.message} — the queue is preserved for retry` }; }
+  if (!before) return { ok: true, noop: true, log: `nothing queued in ${where} — the learner is already caught up` };
+
+  const env = { ...process.env, RUVNET_LEARNING_SCOPE: scope, RUVNET_BRAIN_PROJECT_DIR: PROJECT };
+  const deadline = Date.now() + 540_000; // inside the 600s this action is allowed overall
+  const stalled = [];
+  for (const file of queueFiles()) {
+    let d = depthOf(file);
+    while (d > 0 && Date.now() < deadline) {
+      try {
+        execFileSync(process.execPath, [script], {
+          env: { ...env, LEARN_QUEUE: file },
+          stdio: 'ignore',
+          timeout: Math.min(120_000, Math.max(1_000, deadline - Date.now())),
+        });
+      } catch (e) { stalled.push(`${path.basename(file)}: ${String(e.message).split('\n')[0].slice(0, 80)}`); break; }
+      const next = depthOf(file);
+      // STRICT progress, or stop. learn-flush KEEPS a queue it could not feed (by design — the queue
+      // is evidence), so a round that shrinks nothing means the learner is not accepting the work.
+      // Spinning on it would burn the whole budget and still report zero.
+      if (next >= d) { stalled.push(`${path.basename(file)}: ${d} entr${d === 1 ? 'y' : 'ies'} would not feed`); break; }
+      d = next;
+    }
+  }
+
   const after = depth();
-  return { ok: true, log: `fed ${Math.max(0, before - after)} captured events into the learner (queue ${before} → ${after})` };
+  const fed = before - after;
+  if (fed <= 0) {
+    // Name the most likely cause instead of shrugging: learn-flush invokes ruflo at a FIXED path,
+    // so on a machine with a different npm prefix it feeds nothing and honestly keeps the queue.
+    const rufloAtFixedPath = fs.existsSync(path.join(HOME, '.npm-global/bin/ruflo'));
+    const why = stalled.length ? ` (${stalled.slice(0, 3).join('; ')})` : '';
+    const hint = rufloAtFixedPath ? '' : ' ruflo is not at ~/.npm-global/bin/ruflo, which is where the flusher looks for it —'
+      + ' `npm i -g ruflo@latest` installs it there.';
+    return { ok: false, log: `fed 0 of ${before} queued events from ${where}${why} — the queue is preserved for retry.${hint}` };
+  }
+  return {
+    ok: true,
+    log: `fed ${fed} captured events into the ${scope} learner (queue ${before} → ${after} in ${where})`
+      + (after ? ` — ${after} remain and will drain on the next flush` : ''),
+  };
 }
 
 /** One training cycle, via rUv's own CLI, in the GLOBAL (cross-project) learner. */

package/scripts/host-install-matrix.mjs

@@ -0,0 +1,155 @@
+// host-install-matrix.mjs — ONE definition of "install this artifact into clean hosts and judge it".
+//
+// WHY THIS EXISTS. Two harnesses did this same job and disagreed about almost everything:
+//
+//   scripts/staged-host-verifier.mjs        scripts/publication-receipt.mjs (installHosts)
+//   ─────────────────────────────────       ────────────────────────────────────────────────
+//   modes: claude / codex / dual            modes: claudeOnly / codexOnly / dual
+//   --local … --no-selfcheck                --version v<X>  (no --local, selfcheck ON)
+//   RUVNET_CLAUDE_MARKETPLACE_SOURCE        RUVNET_STRICT_INSTALL=1
+//   RUVNET_CODEX_HOOK_TRUST_MODE=bypass     RUVNET_BRAIN_PROFILE=complete
+//
+// They could not even be compared: one produced `fixtures.claude`, the other `hosts.claudeOnly`,
+// for the identical fixture. So "the hosts passed" meant two different things depending on which
+// half of the release you asked, and nothing in the system could notice they had drifted apart.
+//
+// Some of that difference is REAL and must survive: a STAGED check runs before publication against
+// local bytes, so it points the marketplace at the unpacked package and skips selfcheck; a
+// PUBLISHED check runs after, against what npm actually serves, so it resolves by version and
+// installs strictly. That is one axis with two values — a parameter. Everything else was accident.
+//
+// So: the modes are named once, the loop is written once, the verdict is classified once, and the
+// only thing a caller chooses is which VARIANT it is running. Same shape as
+// scripts/console-runtime-identity.mjs, where one enumeration serves both the copy list and the
+// digest — a fact stated once cannot drift from itself.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+/** The three host shapes a release must survive. ONE name each, for every consumer. */
+export const HOST_MODES = Object.freeze(['claude', 'codex', 'dual']);
+
+/** Which CLIs each mode is allowed to see. A codex-only box genuinely has no `claude`. */
+export const MODE_HOSTS = Object.freeze({
+  claude: ['claude'],
+  codex: ['codex'],
+  dual: ['claude', 'codex'],
+});
+
+/**
+ * The published-side receipt has always spelled these `claudeOnly` / `codexOnly` / `dual`, and that
+ * name is baked into current-release.json and every receipt already published — renaming it would
+ * invalidate history for a cosmetic win. So the two spellings are reconciled HERE, once, instead of
+ * being silently different in two files. `publication.installed.claudeOnly` and `fixtures.claude`
+ * are now provably the same fixture, which is what made the two halves of a release incomparable.
+ */
+export const RECEIPT_MODE_NAMES = Object.freeze({ claude: 'claudeOnly', codex: 'codexOnly', dual: 'dual' });
+export const MODE_FROM_RECEIPT_NAME = Object.freeze({ claudeOnly: 'claude', codexOnly: 'codex', dual: 'dual' });
+
+/**
+ * The two genuinely different questions, declared once instead of implied by two files.
+ *
+ * `staged`    — before publication, against local bytes. The marketplace is pointed at the unpacked
+ *               package because nothing is on npm yet, and selfcheck is skipped for the same reason.
+ * `published` — after publication, against what npm actually serves. Resolves by version and
+ *               installs strictly, because this is the run that must match a stranger's machine.
+ */
+export const VARIANTS = Object.freeze({
+  staged: Object.freeze({
+    installerArgs: (_v) => ['--local', '--yes', '--force', '--no-nightly-prompt',
+      '--no-telemetry', '--no-stack', '--no-enhance', '--no-statusline', '--no-selfcheck'],
+    env: ({ packageRoot }) => ({
+      RUVNET_CLAUDE_MARKETPLACE_SOURCE: packageRoot,
+      RUVNET_CODEX_HOOK_TRUST_MODE: 'bypass',
+    }),
+  }),
+  published: Object.freeze({
+    installerArgs: (version) => ['--yes', '--force', '--version', `v${version}`, '--no-nightly-prompt',
+      '--no-telemetry', '--no-stack', '--no-enhance', '--no-statusline'],
+    env: () => ({
+      RUVNET_STRICT_INSTALL: '1',
+      RUVNET_BRAIN_PROFILE: 'complete',
+    }),
+  }),
+});
+
+/** A doctor run is ACCEPTED only on a clean exit. One rule, not one per harness. */
+export function classifyDoctor(result) {
+  const output = `${result.stdout || ''}${result.stderr || ''}`;
+  if (!result.error && result.status === 0) return { accepted: true, status: 'PASS', output };
+  return { accepted: false, status: 'FAIL', output };
+}
+
+/** Build a PATH exposing only the CLIs this mode is entitled to see. */
+export function fixturePath(mode, temp, locate) {
+  const bin = path.join(temp, `bin-${mode}`);
+  fs.mkdirSync(bin, { recursive: true });
+  for (const name of ['node', 'npm', ...MODE_HOSTS[mode]]) {
+    const target = locate(name);
+    if (!target) throw new Error(`${name} CLI unavailable for the ${mode} host fixture`);
+    fs.symlinkSync(target, path.join(bin, name));
+  }
+  return `${bin}:/usr/bin:/bin`;
+}
+
+/**
+ * Install `packageRoot` into a clean HOME per mode and run its doctor. Returns a result for EVERY
+ * mode — including the ones that failed — because "which host broke" is the whole diagnostic value,
+ * and the previous harnesses threw on the first failure and lost the rest.
+ *
+ * @returns {{verdict:'PASS'|'FAIL', fixtures:Record<string,object>, error?:string}}
+ */
+export function runHostMatrix({ packageRoot, version, variant = 'staged', locate, temp, run = spawnSync }) {
+  const spec = VARIANTS[variant];
+  if (!spec) throw new Error(`unknown host-matrix variant: ${variant}`);
+  const workspace = temp || fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-host-matrix-'));
+  const installer = path.join(packageRoot, 'bin', 'install.mjs');
+  const fixtures = {};
+  let verdict = 'PASS';
+  let error;
+
+  for (const mode of HOST_MODES) {
+    try {
+      const home = path.join(workspace, `home-${mode}`);
+      const codexHome = path.join(home, '.codex');
+      const brainHome = path.join(home, '.cache', 'ruvnet-brain');
+      fs.mkdirSync(path.join(home, '.claude'), { recursive: true });
+      if (mode !== 'claude') fs.mkdirSync(codexHome, { recursive: true });
+      const env = {
+        ...process.env,
+        HOME: home,
+        CODEX_HOME: codexHome,
+        RUVNET_BRAIN_HOME: brainHome,
+        RUVNET_BRAIN_KB: path.join(brainHome, 'kb'),
+        CI: 'true',
+        PATH: fixturePath(mode, workspace, locate),
+        ...spec.env({ packageRoot }),
+      };
+      const install = run(process.execPath, [installer, ...spec.installerArgs(version)], {
+        cwd: packageRoot, env, encoding: 'utf8', timeout: 1_200_000, maxBuffer: 32 * 1024 * 1024,
+      });
+      if (install.error || install.status !== 0) {
+        throw new Error(`install failed for ${mode}: ${(install.stderr || install.error?.message || '').slice(-4000)}`);
+      }
+      const doctor = run(process.execPath, [installer, '--doctor', '--hooks'], {
+        cwd: packageRoot, env, encoding: 'utf8', timeout: 300_000, maxBuffer: 32 * 1024 * 1024,
+      });
+      const classified = classifyDoctor(doctor);
+      fixtures[mode] = { status: classified.status, doctorExit: doctor.status, version };
+      if (!classified.accepted) {
+        verdict = 'FAIL';
+        fixtures[mode].output = classified.output.slice(-5000);
+        // The output belongs IN the error. The previous harness put it there and I dropped it in
+        // the consolidation, so CI reported a bare "doctor failed for claude" and the one thing
+        // needed to act on it — what the doctor actually said — was thrown away.
+        error = error || `doctor failed for ${mode} (exit ${doctor.status}): ${classified.output.slice(-4000)}`;
+      }
+    } catch (e) {
+      verdict = 'FAIL';
+      fixtures[mode] = { status: 'FAIL', error: e.message };
+      error = error || e.message;
+    }
+  }
+  return error ? { verdict, fixtures, error } : { verdict, fixtures };
+}

package/scripts/memory-doctor.mjs

@@ -41,6 +41,7 @@ import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { canonicalPath, pathIdentity } from '../plugin/scripts/project-identity.mjs';
 
 const HOME = os.homedir();
 const DEFAULT_SCAN_ROOTS = ['Code', 'code', 'src', 'source', 'projects', 'dev', 'work'];
@@ -132,10 +133,6 @@ const q = (db, sql) => {
 // n() returns null for "unknown" and a number only when we genuinely counted. Callers must handle null.
 const n = (r) => (r.ok ? (r.value === null || r.value === '' ? null : parseInt(r.value, 10)) : null);
 
-function realExisting(value) {
-  try { return fs.realpathSync(value); } catch { return null; }
-}
-
 export function candidateRoots({
   home = HOME,
   configPath = path.join(home, '.claude', 'ruvnet-brain', 'config.json'),
@@ -150,13 +147,18 @@ export function candidateRoots({
     }
   } catch { /* absent or malformed config does not erase the common roots */ }
 
-  const roots = new Set();
+  // Keyed by pathIdentity, not by the spelling. DEFAULT_SCAN_ROOTS deliberately lists both `Code`
+  // and `code` so neither convention is missed, and on a case-insensitive volume those are ONE
+  // directory — which the old Set-of-strings admitted twice and then scanned, counted and summed
+  // twice (#107). On a case-sensitive volume they are two inodes and both are still kept.
+  const roots = new Map();
   const addRoot = (value) => {
     const absolute = path.isAbsolute(value) ? value : path.join(home, value);
-    const canonical = realExisting(absolute);
+    const canonical = canonicalPath(absolute);
     try {
       if (canonical && fs.statSync(canonical).isDirectory()) {
-        roots.add(canonical);
+        const identity = pathIdentity(canonical) ?? canonical;
+        if (!roots.has(identity)) roots.set(identity, canonical);
         return true;
       }
     } catch { /* missing/non-directory roots are not candidates on this machine */ }
@@ -170,12 +172,14 @@ export function candidateRoots({
   if (configuredCount > 0 && validConfigured === 0) {
     throw new Error('configured scanRoots contain no existing directories');
   }
-  return [...roots].sort();
+  return [...roots.values()].sort();
 }
 
+// Keyed by pathIdentity for the same reason candidateRoots is: one store reached by two names is
+// one store. Values are the canonical spelling, which is what every caller reads back.
 function storesBelow(root) {
-  const out = new Set();
-  const canonicalRoot = realExisting(root);
+  const out = new Map();
+  const canonicalRoot = canonicalPath(root);
   if (!canonicalRoot) return out;
   const walk = (dir, depth) => {
     if (depth > 4) return;
@@ -186,8 +190,8 @@ function storesBelow(root) {
       if (e.name === 'node_modules' || e.name === '.git') continue;
       if (e.name === '.swarm') {
         const db = path.join(dir, '.swarm/memory.db');
-        const canonical = realExisting(db);
-        if (canonical) out.add(canonical);
+        const canonical = canonicalPath(db);
+        if (canonical) out.set(pathIdentity(canonical) ?? canonical, canonical);
         continue;
       }
       if (e.name.startsWith('.') && e.name !== '.swarm') continue;
@@ -199,28 +203,27 @@ function storesBelow(root) {
 }
 
 export function findStores(root) {
-  const out = new Set();
+  const out = new Map();
+  const collect = (found) => { for (const [identity, db] of found) if (!out.has(identity)) out.set(identity, db); };
   if (root !== undefined) {
-    for (const db of storesBelow(root)) out.add(db);
-    return [...out].sort();
+    collect(storesBelow(root));
+    return [...out.values()].sort();
   }
 
-  for (const candidate of candidateRoots()) {
-    for (const db of storesBelow(candidate)) out.add(db);
-  }
+  for (const candidate of candidateRoots()) collect(storesBelow(candidate));
   // These two stores intentionally sit outside the project-root convention. They belong only to
   // the fleet-wide no-argument scan; an explicit root must remain genuinely scoped.
   for (const extra of [path.join(HOME, '.claude/.swarm/memory.db'), path.join(HOME, 'cognitum-trader/.swarm/memory.db')]) {
-    const canonical = realExisting(extra);
-    if (canonical) out.add(canonical);
+    const canonical = canonicalPath(extra);
+    if (canonical) collect([[pathIdentity(canonical) ?? canonical, canonical]]);
   }
-  return [...out].sort();
+  return [...out.values()].sort();
 }
 
 export function displayStoreName(db, home = HOME) {
-  const canonicalDb = realExisting(db) || path.resolve(db);
+  const canonicalDb = canonicalPath(db) || path.resolve(db);
   const project = path.dirname(path.dirname(canonicalDb));
-  const canonicalHome = realExisting(home) || path.resolve(home);
+  const canonicalHome = canonicalPath(home) || path.resolve(home);
   const relative = path.relative(canonicalHome, project);
   if (relative === '') return '~';
   if (relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative)) {

package/scripts/model-router-catalog.mjs

@@ -1,3 +1,6 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
 // Managed facts are additive for existing users. Their existing row is the user overlay: it wins
 // byte-for-byte, including disablement, tier/priority changes, and local candidates. Newly shipped
 // metered rows are not auto-added; that would silently expand spend authority.
@@ -14,3 +17,34 @@ export function mergeManagedCatalog(existing, managed) {
   };
   return JSON.stringify(next) === JSON.stringify(existing) ? existing : next;
 }
+
+// Issue #87: the merge above was correct but reachable only from offerRouterProfile(), which runs on
+// the FRESH-INSTALL path alone. `--update` (and therefore Evergreen nightly) never called it, so the
+// one population that needs managed additions — users who already have ~/.claude/model-router/
+// catalog.json — could never acquire a newly shipped managed model. This is that same merge as a
+// non-interactive, idempotent step the update path can call: no prompts, no TEST_MODE gate, backs the
+// user's file up before it writes, and replaces it by atomic rename so a crash can never half-apply.
+export function applyManagedCatalogUpdate({ routerDir, packageRoot }) {
+  const template = path.join(packageRoot, 'config', 'model-router', 'catalog.template.json');
+  const target = path.join(routerDir, 'catalog.json');
+  if (!fs.existsSync(template)) return { action: 'skipped', added: [], detail: 'no managed template in this package' };
+  const managed = JSON.parse(fs.readFileSync(template, 'utf8'));
+  fs.mkdirSync(routerDir, { recursive: true });
+  if (!fs.existsSync(target)) {
+    fs.copyFileSync(template, target);
+    return { action: 'created', added: (managed.candidates || []).map((candidate) => candidate.id), detail: target };
+  }
+  const existing = JSON.parse(fs.readFileSync(target, 'utf8'));
+  const merged = mergeManagedCatalog(existing, managed);
+  if (merged === existing) return { action: 'unchanged', added: [], detail: target };
+  const before = new Set((existing.candidates || []).map((candidate) => candidate.id));
+  fs.copyFileSync(target, `${target}.pre-managed-merge`);
+  const staged = `${target}.tmp-${process.pid}`;
+  fs.writeFileSync(staged, `${JSON.stringify(merged, null, 2)}\n`, { mode: 0o600 });
+  fs.renameSync(staged, target);
+  return {
+    action: 'merged',
+    added: merged.candidates.filter((candidate) => !before.has(candidate.id)).map((candidate) => candidate.id),
+    detail: target,
+  };
+}