ruvnet-brain 4.3.21 → 4.3.25

package/scripts/nightly-watchdog.mjs

@@ -39,6 +39,7 @@ import os from 'node:os';
 import { spawnSync, execFileSync } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { NIGHTLY_LABEL, schedulerStatus } from '../plugin/scripts/nightly-scheduler.mjs';
+import { oldestIncompleteProgress } from '../kb/shard-progress.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const REGISTRY = process.env.WATCHDOG_REGISTRY || path.join(ROOT, 'config', 'scheduled-jobs.json');
@@ -51,6 +52,28 @@ export const MISSING = 'MISSING';
 export const NEVER_RAN = 'NEVER-RAN';
 export const STALE = 'STALE';
 export const FAILING = 'FAILING';
+export const STALLED = 'STALLED';
+
+/**
+ * Per-shard progress evidence for a job that declares `progressGlob` + `stallMinutes` in the
+ * registry (see kb/shard-progress.mjs, written by kb/forge-big.mjs's `embed`/`shard-all` modes).
+ *
+ * WHY THIS EXISTS (2026-09-11): a live wrapper pid proves the WRAPPER survived a run; it proves
+ * NOTHING about whether the work inside it is still moving — an 8-shard gists embed once sat at 0%
+ * CPU for six hours with `judge()`'s existing pid-liveness check reporting it OK the entire time
+ * (the pid genuinely was alive; it just was not doing anything). `job.stallMinutes` is deliberately
+ * independent of `job.maxAgeHours`/the 6h long-run branch below — a job stuck at 0% progress for 20
+ * minutes must be flagged well before its overall schedule budget or the long-run grace period would
+ * ever trip.
+ */
+export function readJobProgress(job, { root = ROOT } = {}) {
+  if (!job.progressGlob) return null;
+  const full = path.join(root, job.progressGlob);
+  const dir = path.dirname(full);
+  const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const pattern = new RegExp(`^${path.basename(full).split('*').map(escapeRegExp).join('.*')}$`);
+  return oldestIncompleteProgress(dir, pattern);
+}
 
 /** Labels currently loaded in launchd. A job that isn't here CANNOT fire, whatever its plist says. */
 export function loadedLabels(run = () => spawnSync('launchctl', ['list'], { encoding: 'utf8' }).stdout || '') {
@@ -67,7 +90,7 @@ export function loadedLabels(run = () => spawnSync('launchctl', ['list'], { enco
  * Judge one job from its receipt. `hb === null` means NO RECEIPT EXISTS — which is NEVER-RAN, never OK.
  * This single line is the whole lesson of 2026-07-13: absence of evidence is not evidence of health.
  */
-export function judge(job, hb, loaded, now) {
+export function judge(job, hb, loaded, now, { root = ROOT } = {}) {
   if (!loaded) {
     return { state: MISSING, detail: 'declared in the registry but NOT LOADED in launchd — it can never fire' };
   }
@@ -80,6 +103,20 @@ export function judge(job, hb, loaded, now) {
   }
   const ageHours = (now - stamp) / HOUR;
 
+  // STALLED: checked BEFORE the long-run pid-liveness branch below, and independent of it — a live
+  // pid is not proof of progress. Only applies when the job declares a stall budget; absence of a
+  // progress file is never treated as a stall (the job may not have reached embedding yet).
+  if (hb.state === 'running' && job.stallMinutes) {
+    const progress = readJobProgress(job, { root });
+    if (progress) {
+      const staleMinutes = (now - progress.updatedAt) / 60_000;
+      if (staleMinutes > job.stallMinutes) {
+        return { state: STALLED, ageHours,
+          detail: `${progress.detail} has not advanced in ${staleMinutes.toFixed(0)}m — its stall budget is ${job.stallMinutes}m. The wrapper pid may be alive; the work is not.` };
+      }
+    }
+  }
+
   // Started and never finished? DERIVE it from process liveness, not wall-clock alone (2026-07-19):
   // a full corpus rebuild legitimately runs 12h+ (five changed repos = a long day), and the old
   // ">6h running ⇒ FAILING" rule false-alarmed on exactly that — a 13.5h nightly whose worker was
@@ -110,8 +147,12 @@ export function judge(job, hb, loaded, now) {
   if (hb.state === 'skipped') {
     return { state: NEVER_RAN, ageHours, detail: 'only a lock-skip receipt exists — no real run has ever recorded a result' };
   }
-  if (hb.state === 'failed' || (typeof hb.exit_code === 'number' && hb.exit_code !== 0)) {
-    return { state: FAILING, ageHours, detail: `last run FAILED with exit ${hb.exit_code} (${ageHours.toFixed(1)}h ago)` };
+  if (hb.state === 'failed' || hb.state === 'killed' || (typeof hb.exit_code === 'number' && hb.exit_code !== 0)) {
+    // job-heartbeat.sh distinguishes "failed" (plain non-zero exit) from "killed" (died to a
+    // signal — the wrapper's own trap, or a direct kill of the child; POSIX 128+signal) — surface
+    // which one it was rather than collapsing both into one undifferentiated exit code.
+    const how = hb.state === 'killed' ? `KILLED by signal ${hb.signal ?? '?'}` : `FAILED with exit ${hb.exit_code}`;
+    return { state: FAILING, ageHours, detail: `last run ${how} (${ageHours.toFixed(1)}h ago)` };
   }
   if (hb.state === 'running') {
     return { state: OK, ageHours, detail: `running right now (started ${ageHours.toFixed(1)}h ago)` };
@@ -153,7 +194,7 @@ export function checkAll(now, { registry = REGISTRY, loaded = loadedLabels(), hb
   const { jobs } = JSON.parse(fs.readFileSync(registry, 'utf8'));
   return jobs.map((job) => {
     const hb = readHeartbeat(job.label, hbDir) || readLegacyLog(job, root);
-    const verdict = judge(job, hb, loaded.has(job.label), now);
+    const verdict = judge(job, hb, loaded.has(job.label), now, { root });
     if (hb?._tier2 && verdict.state === OK) verdict.detail += ' (via its log — no receipt yet; the next run writes one)';
     return { ...job, ...verdict };
   });
@@ -162,6 +203,22 @@ export function checkAll(now, { registry = REGISTRY, loaded = loadedLabels(), hb
 export function productSchedulerVerdict(status) {
   const base = { label: NIGHTLY_LABEL, what: 'Refreshes the installed Brain corpus and converges every detected host',
     schedule: 'daily 03:47', maxAgeHours: 30, required: true };
+  // A 'degraded' adapter whose only defect is a NON-ZERO LAST EXIT is a job that is loaded, verified
+  // and FIRED — the exact opposite of MISSING ("not loaded — it can never fire", top of this file).
+  // Its truth is the receipt. Measured 2026-09-12 against two FAILED receipts: this projected as
+  // MISSING with the detail "LaunchAgent is loaded and runner digest verified, but last exited 1" —
+  // a contradiction in one line, and the receipt's reason never surfaced.
+  if (status?.state === 'degraded' && Number.isInteger(status.lastExitCode) && status.lastExitCode !== 0) {
+    const run = status.runHealth || null;
+    if (run?.state === 'stale') return { ...base, state: STALE, detail: run.evidence };
+    if (!run || run.state === 'never-ran') {
+      return { ...base, state: FAILING, detail: `runner last exited ${status.lastExitCode} and left no receipt — it fired and died before recording a run` };
+    }
+    if (run.state === 'ok' || run.state === 'running') {
+      return { ...base, state: FAILING, detail: `runner last exited ${status.lastExitCode} although its latest receipt reads ${run.state} — the run after that receipt died without recording one (${run.evidence})` };
+    }
+    return { ...base, state: FAILING, detail: run.evidence };
+  }
   if (status?.state !== 'on') return { ...base, state: MISSING, detail: status?.evidence || 'scheduler is not registered' };
   const run = status.runHealth || { state: 'never-ran', evidence: 'No nightly refresh receipt exists yet.' };
   const mapped = run.state === 'ok' || run.state === 'running' ? OK

package/scripts/onboarding-console.mjs

@@ -33,6 +33,7 @@ import { planFor } from './remedy-registry.mjs';
 import { auditAll as capabilityAuditAll } from './capability-registry.mjs';
 import { getVersion } from './version.mjs';
 import { consoleRuntimeDigest } from './console-runtime-identity.mjs';
+import { isCorpusReleaseTag } from '../kb/corpus-release-identity.mjs';
 // L5 (ADR-028): the audit is the one place that observes live capability state, so it is where an
 // OFFERED-then-now-`on` transition becomes an APPLIED — the numerator of the precision metric that
 // tells the owner whether advocacy is landing or nagging. Both are pure reads/appends and never throw.
@@ -422,6 +423,27 @@ function wiringSurvey() {
       if (mech) sites.push({ scope: 'project', project: projName, file: '.mcp.json', event: 'MCP', matcher: name, spec: full.slice(0, 160), mechanism: mech });
     }
   }
+  // THE MACHINE-WIDE FILE (console audit 2026-09-11). Plugins are switched on in ~/.claude/settings.json
+  // and nowhere else, and this survey never read that file — so the card said `plugin: 0` on a machine
+  // with 14 enabled, ruvnet-brain among them. Each enabled plugin is one global PLUGIN site. The file's
+  // own hooks go through the same classifier the project scan uses, so a machine-wide npx or
+  // global-binary hook is counted in the same words as a project one.
+  const machine = readJSON(path.join(CONSOLE_ROOT, '.claude', 'settings.json'));
+  if (machine) {
+    for (const [event, groups] of Object.entries(machine.hooks || {})) {
+      const list = Array.isArray(groups) ? groups : [groups];
+      for (const g of list) {
+        const hookArr = Array.isArray(g?.hooks) ? g.hooks : (g?.command ? [g] : []);
+        for (const h of hookArr) {
+          const mech = classifyCommand(h?.command);
+          if (mech) sites.push({ scope: 'global', file: '~/.claude/settings.json', event, matcher: g?.matcher ?? '*', spec: String(h.command).slice(0, 160), mechanism: mech });
+        }
+      }
+    }
+    for (const [name, on] of Object.entries(machine.enabledPlugins || {})) {
+      if (on === true) sites.push({ scope: 'global', file: '~/.claude/settings.json', event: 'plugin', matcher: name, spec: name, mechanism: 'PLUGIN' });
+    }
+  }
   return { sites, summary: summarizeWiring(sites) };
 }
 
@@ -444,25 +466,41 @@ function sessionHookExists() {
 //
 // So the probe stops guessing and asks the filesystem: consider both known names, and use whichever
 // actually holds rows. That is correct on their machine and on mine without knowing why they differ.
+//
+// THE SECOND HALF OF THAT LESSON (console audit 2026-09-11). "Whichever holds rows" was implemented
+// as "whichever is LARGER", and on a machine where BOTH hold rows that picked the wrong one: the
+// card scored ruvnet-brain on `.swarm/agentdb-memory.db` — 15,824 rows, the MCP coordination store
+// the global CLAUDE.md warns is a DIFFERENT container — and rendered "15824 entries, 100% embedded"
+// while the canonical `.swarm/memory.db`, the file `ruflo memory store` writes, held 5. The #127
+// reporter's cases (canonical absent, or present but empty) still resolve to the coordination store;
+// a canonical store that holds rows is now always the one scored, and BOTH files are reported so the
+// page can say which it scored and which it did not.
 const MEMORY_DB_NAMES = ['memory.db', 'agentdb-memory.db'];
+// Row count that never throws and never hangs on a live store: null means "unreadable this instant".
+function memoryRows(file) {
+  if (!fs.existsSync(file)) return null;
+  const r = robustRead(file, 'SELECT count(*) FROM memory_entries;');
+  return r.ok ? (r.value === null ? 0 : parseInt(r.value, 10)) : null;
+}
+export function memoryStores(projectDir) {
+  const [canonicalPath, coordinationPath] = MEMORY_DB_NAMES.map((name) => path.join(projectDir, '.swarm', name));
+  const canonical = { path: canonicalPath, exists: fs.existsSync(canonicalPath), rows: memoryRows(canonicalPath) };
+  const coordination = { path: coordinationPath, exists: fs.existsSync(coordinationPath), rows: memoryRows(coordinationPath) };
+  // A canonical store that holds rows — or is busy being written this instant (rows null) — is the
+  // one scored. Only an absent or EMPTY canonical store hands the score to the coordination file.
+  const scored = canonical.exists && (canonical.rows === null || canonical.rows > 0) ? canonical.path
+    : coordination.exists ? coordination.path
+      : canonical.path; // canonical name for the "absent" message
+  return { canonical, coordination, scored };
+}
 export function resolveMemoryDb(projectDir) {
-  const candidates = MEMORY_DB_NAMES
-    .map((name) => path.join(projectDir, '.swarm', name))
-    .filter((file) => fs.existsSync(file));
-  if (!candidates.length) return path.join(projectDir, '.swarm/memory.db'); // canonical name for the "absent" message
-  if (candidates.length === 1) return candidates[0];
-  // Both present: prefer the one with real content. Size is a proxy for rows that costs no query and
-  // cannot throw on a locked or WAL-mode database — this runs inside a UI probe that must never hang.
-  return candidates.sort((a, b) => {
-    const sa = (() => { try { return fs.statSync(a).size; } catch { return 0; } })();
-    const sb = (() => { try { return fs.statSync(b).size; } catch { return 0; } })();
-    return sb - sa;
-  })[0];
+  return memoryStores(projectDir).scored;
 }
 
 function probeMemory(projectDir, { now = Date.now() } = {}) {
-  const db = resolveMemoryDb(projectDir);
-  const probes = {};
+  const stores = memoryStores(projectDir);
+  const db = stores.scored;
+  const probes = { stores };
   // compaction survival + session surfacing are filesystem facts, always checkable
   const snapshot = inspectSessionSnapshots(projectDir, { now });
   const snapshotDetail = snapshot.kind === 'canonical'
@@ -503,8 +541,10 @@ function probeMemory(projectDir, { now = Date.now() } = {}) {
   const liveNote = integ.mode === 'immutable=1' ? ' and in active use' : '';
   if (integrity !== 'ok') probes.liveness = { status: 'fail', detail: `store is corrupt (integrity_check: ${integrity})` };
   else if (total === null) probes.liveness = { status: 'notTested', detail: 'store opened but counts were unavailable this instant' };
-  else if (total > 0) probes.liveness = { status: 'ok', detail: `store is live${liveNote}, integrity ok, ${total} entries${embedded != null && total ? `, ${Math.round((embedded / total) * 100)}% embedded` : ''} (read-only)` };
-  else probes.liveness = { status: 'warn', detail: 'store exists but is empty' };
+  // The file is NAMED in the sentence, so "15824 entries" can never again be read as the canonical
+  // store's count when it was the coordination store's.
+  else if (total > 0) probes.liveness = { status: 'ok', detail: `${path.basename(db)} is live${liveNote}, integrity ok, ${total} entries${embedded != null && total ? `, ${Math.round((embedded / total) * 100)}% embedded` : ''} (read-only)` };
+  else probes.liveness = { status: 'warn', detail: `${path.basename(db)} exists but is empty` };
 
   const cp = robustRead(db, "SELECT max(updated_at) FROM memory_entries WHERE key LIKE 'project-state-current%';");
   if (cp.ok && cp.value) {
@@ -542,12 +582,20 @@ function gatherMemory(cwd, { fleet = true } = {}) {
   const scope = projectDirectory({ cwd });
   const project = fs.existsSync(path.join(scope, '.swarm/memory.db')) ? scope : REPO;
   const projName = project.replace(CONSOLE_ROOT + '/Code/', '').replace(CONSOLE_ROOT + '/', '~/');
-  const health = scoreMemoryHealth({ project: projName, probes: probeMemory(project) });
+  const probes = probeMemory(project);
+  const health = scoreMemoryHealth({ project: projName, probes });
+  // Which file the score is about, and which file it deliberately is not — both with row counts.
+  const short = (p) => String(p).replace(CONSOLE_ROOT, '~');
+  health.stores = probes.stores ? {
+    scored: short(probes.stores.scored),
+    canonical: { ...probes.stores.canonical, path: short(probes.stores.canonical.path) },
+    coordination: { ...probes.stores.coordination, path: short(probes.stores.coordination.path) },
+  } : null;
   return { fleet: fleet ? scanFleet() : null, health };
 }
 
 // ── Savings ledger (receipts only) ────────────────────────────────────────────────────────────────
-function gatherSavings() {
+function gatherSavings({ repo = REPO } = {}) {
   // Primary source is the real routing-receipts ledger written by scripts/route-cheap.mjs.
   const files = [
     path.join(SYSTEM_HOME, '.claude/metaharness/routing-receipts.jsonl'),
@@ -555,7 +603,9 @@ function gatherSavings() {
     // Canonical user-level ledger (issue #36 — the hooks no longer scatter per-CWD copies).
     path.join(SYSTEM_HOME, '.cache/ruvnet-brain/token-ledger.jsonl'),
     // Legacy location, still read so an existing user's history is not orphaned by the move.
-    path.join(REPO, 'plugin/scripts/.ruvnet-brain/token-ledger.jsonl'),
+    // `repo` is injectable because on a developer checkout this file is REAL history (2 rows from
+    // 2026-07-14 on the owner's machine) and HOME isolation alone cannot keep it out of a fixture.
+    path.join(repo, 'plugin/scripts/.ruvnet-brain/token-ledger.jsonl'),
   ];
   const receipts = [];
   let baselineUsd = 0;
@@ -591,10 +641,16 @@ function gatherSavings() {
     }
   }
   const usdSaved = +receipts.reduce((a, r) => a + (r.measuredUsd || 0), 0).toFixed(4);
+  const timed = receipts.filter((r) => r.measuredMs !== null);
   const totals = receipts.length ? {
     count: receipts.length,
     usdSaved,
+    // SIGNED, and it stays signed. A net-slower ledger sums negative and is REPORTED negative — the
+    // page once turned that into a dash (console audit 2026-09-11: −46,737 ms across 25 timed
+    // routes, 23 of them slower than baseline, rendered as "—"). A loss is a finding about the
+    // router; `timedCount` says how many routes the number is even about.
     msSaved: receipts.reduce((a, r) => a + (r.measuredMs || 0), 0),
+    timedCount: timed.length,
     baselineUsd: +baselineUsd.toFixed(4),
     pctSaved: baselineUsd > 0 ? Math.round((usdSaved / baselineUsd) * 100) : null,
   } : null;
@@ -643,11 +699,42 @@ function unsupportedConfigControls() {
  * off, and the Settings form shows the shipped default beside it as a recommendation rather than as
  * a fact about their machine.
  */
+/**
+ * NIGHTLY REFRESH IS THREE FACTS, NOT ONE BOOLEAN (console audit 2026-09-11). The toggle rendered
+ * `nightly: true` because the LaunchAgent was loaded, while ~/.claude/ruvnet-brain/config.json said
+ * `nightly: false` and the job had never completed a run. Three independently measured things —
+ * the CHOICE the user saved (config.json), the ENFORCEMENT the scheduler adapter reports (loaded,
+ * off, degraded), and the OUTCOME of the last completed run (its receipt) — had been collapsed into
+ * the one the user did not set. A single boolean is emitted only when choice and enforcement agree;
+ * otherwise the field is null (never chosen, or in disagreement) and `facts` carries all three so
+ * the page can print them side by side. Pure, so the rule is testable without a scheduler.
+ */
+export function reconcileNightly({ choice, schedule }) {
+  const enforcement = schedule?.state ?? 'unknown';
+  const run = schedule?.runHealth ?? null;
+  const enforced = enforcement === 'on' ? true : enforcement === 'off' ? false : null;
+  const chosen = choice === true || choice === false ? choice : null;
+  const agree = chosen === null ? null : (enforced !== null && chosen === enforced);
+  return {
+    value: agree === true ? chosen : null,
+    facts: {
+      choice: chosen,
+      enforcement,
+      enforcementEvidence: schedule?.evidence ?? null,
+      lastRun: run?.state ?? 'unknown',
+      lastRunEvidence: run?.evidence ?? null,
+      lastRunAt: run?.receipt?.finishedAt ?? run?.receipt?.startedAt ?? null,
+      agree,
+    },
+  };
+}
+
 function gatherConfig() {
   const cfg = readJSON(CONFIG_PATH) || {};
   const credential = openRouterCredentialStatus({ cwd: process.cwd() });
   const schedule = nightlyStatus();
   const bool = (v) => (v === true ? true : v === false ? false : null);
+  const nightly = reconcileNightly({ choice: bool(cfg.nightly), schedule });
   const unavailable = unsupportedConfigControls();
   if (!schedule.artifact.supported) {
     unavailable.push({
@@ -662,7 +749,7 @@ function gatherConfig() {
     values: {
       openrouterKey: credential.configured,                // boolean only — never the secret itself
       provider: typeof cfg.provider === 'string' && cfg.provider ? cfg.provider : null,
-      nightly: schedule.state === 'on' ? true : schedule.state === 'off' ? false : null,
+      nightly: nightly.value,
       routing: cfg.routing === 'off' ? 'off' : cfg.routing === 'auto' ? 'auto' : null,
       qeFleet: bool(cfg.qeFleet),
     },
@@ -675,7 +762,7 @@ function gatherConfig() {
     unavailable,
     runtime: {
       openrouterKey: credential,
-      nightly: schedule,
+      nightly: { ...schedule, facts: nightly.facts },
     },
   };
 }
@@ -791,8 +878,21 @@ function gatherBrainProfile() {
     : installed.stores.length === 1
       ? PROFILE_RUVECTOR
       : PROFILE_COMPLETE;
+  // THE "— stores · 0 MB" LIE (console audit 2026-09-11). `choices.complete` was rendered from
+  // `source` — the restore BUNDLE at COMPLETE_BRAIN_SOURCE, which on an installed host resolves to
+  // <runtime>/dist/ruvnet-brain and never exists after install — while `installed`, measured three
+  // lines up (184 stores, 979 MB on the owner's machine), went unused. discoverStoreFamilies()
+  // swallows ENOENT into [], so a complete brain rendered as zero and wore an `active` badge over it.
+  // Two different questions are now answered separately: what is INSTALLED here, and by which path
+  // Apply→complete could RESTORE it here. The path order mirrors saveBrainProfile()'s own branches
+  // (local bundle, then the signed forge-update download, then nothing), so the card describes the
+  // exact mechanism Apply would take — never a hopeful one, never a number nobody measured.
   const source = measureBrainProfile(COMPLETE_BRAIN_SOURCE);
+  const bundlePresent = source.stores.includes(PROFILE_RUVECTOR) && source.storeCount > 1;
   const updaterAvailable = fs.existsSync(path.join(INSTALLED_KB, 'forge-update.mjs'));
+  const restoreVia = bundlePresent ? 'local-bundle' : updaterAvailable ? 'signed-download' : null;
+  const completeInstalled = actual === PROFILE_COMPLETE;
+  const restorePath = COMPLETE_BRAIN_SOURCE.replace(CONSOLE_ROOT, '~');
   return {
     path: INSTALLED_KB.replace(CONSOLE_ROOT, '~'),
     values: { brainProfile: actual },
@@ -803,10 +903,20 @@ function gatherBrainProfile() {
     installed,
     choices: {
       complete: {
-        available: (source.stores.includes(PROFILE_RUVECTOR) && source.storeCount > 1)
-          || updaterAvailable,
-        storeCount: source.storeCount,
-        bytes: source.bytes,
+        available: restoreVia !== null,
+        // From the INSTALLED brain when complete is what is installed; from the local bundle when one
+        // exists to restore from; otherwise null — never a 0 that nothing measured.
+        storeCount: completeInstalled ? installed.storeCount : bundlePresent ? source.storeCount : null,
+        bytes: completeInstalled ? installed.bytes : bundlePresent ? source.bytes : null,
+        installed: completeInstalled ? { storeCount: installed.storeCount, bytes: installed.bytes } : null,
+        restoreBundle: {
+          present: bundlePresent,
+          path: restorePath,
+          storeCount: bundlePresent ? source.storeCount : null,
+          bytes: bundlePresent ? source.bytes : null,
+        },
+        updaterAvailable,
+        restoreVia,
       },
       ruvector: {
         available: installed.stores.includes(PROFILE_RUVECTOR)
@@ -1960,6 +2070,34 @@ function readInstallChannel() {
  * practice, because the check that did exist only ever triggered a blocking recompute rather than an
  * honest stale-serve.
  */
+/**
+ * THREE VERSIONS ON ONE PAGE (console audit 2026-09-11): the header chip said v4.3.21 (running
+ * brain), the Install-channel row said v4.3.22 (plugin cache), the installed KB's RVF-GENERATIONS.json
+ * said 4.3.10 — and nothing said they differed. Each is read from its own file and LABELED. `agree`
+ * is true only when every measured one is identical, null when fewer than two could be read. A
+ * version that cannot be read is null, never guessed.
+ */
+export function versionFacts({ release = null } = {}) {
+  const gen = readJSON(path.join(INSTALLED_KB, 'RVF-GENERATIONS.json'));
+  const kbGeneration = typeof gen?.brainVersion === 'string' && gen.brainVersion ? gen.brainVersion.replace(/^v/, '') : null;
+  const runningBrain = brainVersionOnDisk();
+  let installedPlugin = null;
+  try { installedPlugin = readInstallChannel().version || null; } catch { installedPlugin = null; }
+  // A CORPUS RELEASE IS NOT A VERSION (ADR-086 step 16). `releases/latest` can now carry a
+  // `corpus-sha256-<64 hex>` content address, and stripping a leading "v" off one yields a 78-char
+  // string that this panel would have printed in the "latest release" slot beside `4.3.22`-shaped
+  // numbers — in the one panel whose whole job is to make version disagreement visible. That is not
+  // a version disagreement; it is a category error, and showing it as one would be the panel lying.
+  // So the two identities are reported in two fields, each labeled for what it actually is.
+  const rawTag = typeof release?.tag === 'string' && release.tag ? release.tag : null;
+  const corpusTag = isCorpusReleaseTag(rawTag) ? rawTag : null;
+  const latestRelease = rawTag && !corpusTag ? rawTag.replace(/^v/, '') : null;
+  const known = [kbGeneration, runningBrain, installedPlugin].filter(Boolean);
+  const agree = known.length < 2 ? null : known.every((x) => x === known[0]);
+  return { kbGeneration, runningBrain, installedPlugin, latestRelease, latestCorpusRelease: corpusTag,
+    agree, known: known.length };
+}
+
 async function gatherTrust() {
   // COLD ONLY: no successful release read has ever landed, so there is nothing to withhold or serve
   // stale — the one exception serveCached() itself carves out for its own caches.
@@ -1971,7 +2109,7 @@ async function gatherTrust() {
     const generatedAt = new Date().toISOString();
     const data = { generatedAt, release };
     if (release.ok) { TRUST_CACHE = { at: Date.parse(generatedAt), data }; saveConsoleCache(); }
-    return { ...data, channel: readInstallChannel(), sbom: readSbom(), ...freshnessOf(generatedAt) };
+    return { ...data, channel: readInstallChannel(), sbom: readSbom(), versions: versionFacts({ release }), ...freshnessOf(generatedAt) };
   }
 
   // WARM — including over-ceiling. Never await the network here; hand back what we measured, say
@@ -1980,7 +2118,7 @@ async function gatherTrust() {
   if (fresh.stale) kickTrustRefresh();
   // Disk facts stay live even when the release read is served from cache — the SBOM file and install
   // channel can change (a fresh `npm run sbom`, a plugin update) between two calls inside the ceiling.
-  return { ...TRUST_CACHE.data, channel: readInstallChannel(), sbom: readSbom(), ...fresh };
+  return { ...TRUST_CACHE.data, channel: readInstallChannel(), sbom: readSbom(), versions: versionFacts({ release: TRUST_CACHE.data.release }), ...fresh };
 }
 
 // ── Assemble the read-models ─────────────────────────────────────────────────────────────────────
@@ -2864,6 +3002,10 @@ function startServer({ port = Number(process.env.CONSOLE_PORT) || 7411, open = f
       if (req.method === 'GET' && url === '/api/lessons') return sendJSON(res, 200, gatherLessons());
       if (req.method === 'GET' && url === '/api/trust') return sendJSON(res, 200, await gatherTrust());
       if (req.method === 'GET' && url === '/tips') { req.url = '/tips.html'; return serveStatic(req, res); }
+      // What's in the brain: derived from the installed root's own receipts on every request (read-only,
+      // no network, ~ms) — a coverage listing served from a stale cache would defeat its one purpose.
+      if (req.method === 'GET' && url === '/api/scope') return sendJSON(res, 200, gatherScope());
+      if (req.method === 'GET' && url === '/scope') { req.url = '/scope.html'; return serveStatic(req, res); }
       if (req.method === 'POST') {
         const body = await readBody(req);
         if (body.token !== TOKEN) return sendJSON(res, 403, { error: 'bad or missing token' });
@@ -3046,7 +3188,155 @@ if (process.argv[1] && path.resolve(process.argv[1]).endsWith('onboarding-consol
   else { console.log(`\n  onboarding-console — the RuvNet Brain configure page\n\n    --serve [--open]   start or safely replace the scoped local server\n    --runtime-status   print candidate, receipt, and live runtime status\n    --print-state      print the read-only state JSON and exit (for tests)\n    --print-stack      print the stack audit JSON and exit\n`); }
 }
 
+// ── "What's in the brain" (the scope page) ─────────────────────────────────────────────────────────
+// Every verdict comes from the installed brain's OWN receipts, never from the shipped `status` word.
+// Measured 2026-09-11 (KB audit): release-projection.mjs:80 stamps every seeded row CURRENT — 63 real
+// rows had sourceCommit ≠ upstream.sha. GitHub `updatedAt` is metadata (222/227 repos moved on it in
+// one week) and `pushedAt` leads the default-branch HEAD on 39/227; only `committedAt` dates the commit
+// the brain ingests. Gists have no branches, so their `updatedAt` IS the content date — and the shipped
+// COVERAGE row carries no sourceCommit for them (479/479 null); the gist receipt set
+// (ruv-gists.sources.json → versionSha) is the brain's record of which revision it holds.
+//
+// The truth per row is `brainSha === upstreamSha`. A store with no recorded source commit is
+// "unverified" — never promoted to current on the strength of a date or a label. A store whose
+// .big.rvf is not at the installed root is "not in the brain", whatever the record says.
+const SCOPE_SENTENCE = "If rUv's last change to a repo is on or before the date the brain read it, everything in that repo is in the brain. If it's after, the brain is behind on that repo by the difference.";
+const SCOPE_DAY_MS = 86_400_000;
+const SCOPE_STALE_DAYS = 7;
+// A row's `desc` is what the thing DOES, so the page's search answers "is the stuff on Federation in
+// Ruflo?" — a description question — not only name lookups. Bounded so a README pasted into a card
+// cannot bloat 700 rows.
+const SCOPE_DESC_MAX = 200;
+const scopeBounded = (s) => (s.length > SCOPE_DESC_MAX ? `${s.slice(0, SCOPE_DESC_MAX - 1)}…` : s);
+
+/**
+ * Pure: the installed brain's capability-cards.md → Map(lowercased repo/store name → first line of
+ * its card, bounded). The card file is the ONLY per-repo description that ships to a customer
+ * machine (data/ruvnet-registry.json is repo-side and never installs — measured 2026-09-12). Format,
+ * measured on 182 sections: `## <name>`, one line saying what it does, one auto-derivation note.
+ */
+function parseCapabilityCards(text) {
+  const cards = new Map();
+  if (typeof text !== 'string') return cards;
+  const lines = text.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const h = /^##\s+(\S.*?)\s*$/.exec(lines[i]);
+    if (!h) continue;
+    let j = i + 1;
+    while (j < lines.length && !lines[j].trim()) j += 1;
+    const first = j < lines.length && !lines[j].startsWith('#') ? lines[j].trim() : '';
+    if (first) cards.set(h[1].toLowerCase(), scopeBounded(first));
+  }
+  return cards;
+}
+
+function scopeDesc(row, { isGist, store, gistId, gistSources, cards }) {
+  if (isGist) {
+    // A gist's only words are its file names (COVERAGE upstream.files; the receipt's files as fallback).
+    const files = row.upstream?.files ?? gistSources?.gists?.[gistId]?.files ?? null;
+    const names = Array.isArray(files) ? files.map((f) => (typeof f === 'string' ? f : f?.filename)).filter(Boolean) : [];
+    return names.length ? scopeBounded(names.join(' · ')) : null;
+  }
+  const byName = cards?.get(String(row.name ?? '').toLowerCase());
+  if (byName) return byName;
+  return (store && cards?.get(String(store).toLowerCase())) || null;
+}
+
+function scopeRow(row, { generations, gistSources, installedStores, cards }) {
+  const isGist = row.kind === 'gist';
+  const store = row.artifact?.store ?? null;
+  const ledger = store ? (generations?.stores?.[store] ?? null) : null;
+  const gistId = isGist ? String(row.key ?? '').replace(/^gist:/, '') : null;
+  const upstreamSha = row.upstream?.sha ?? null;
+  const desc = scopeDesc(row, { isGist, store, gistId, gistSources, cards });
+
+  let brainSha = row.artifact?.sourceCommit ?? null;
+  if (brainSha == null) brainSha = isGist ? (gistSources?.gists?.[gistId]?.versionSha ?? null) : (ledger?.sourceCommit ?? null);
+
+  const ruvChangedAt = (isGist ? row.upstream?.updatedAt : row.upstream?.committedAt) ?? null;
+  const brainReadAt = row.artifact?.ingestedAt ?? ledger?.builtUtc ?? null;
+
+  let installed = Boolean(store) && installedStores.has(store);
+  // With a gist receipt set present, a gist the set does not enumerate is not in the store.
+  if (installed && isGist && gistSources?.gists && !(gistId in gistSources.gists)) installed = false;
+
+  let bucket;
+  if (!installed) bucket = 'not-in-brain';
+  else if (brainSha && upstreamSha) bucket = brainSha === upstreamSha ? 'current' : 'behind';
+  else bucket = 'unverified';
+
+  let behindDays = null;
+  if (bucket === 'behind' && ruvChangedAt && brainReadAt) {
+    const d = (Date.parse(ruvChangedAt) - Date.parse(brainReadAt)) / SCOPE_DAY_MS;
+    behindDays = Number.isFinite(d) ? Math.max(0, Math.round(d)) : null;
+  }
+  return { kind: row.kind, name: row.name, url: row.url ?? null, store, desc, bucket, ruvChangedAt, brainReadAt, behindDays, brainSha, upstreamSha };
+}
+
+const scopeNewestFirst = (a, b) => {
+  if (a.ruvChangedAt == null && b.ruvChangedAt == null) return String(a.name).localeCompare(String(b.name));
+  if (a.ruvChangedAt == null) return 1;
+  if (b.ruvChangedAt == null) return -1;
+  return a.ruvChangedAt < b.ruvChangedAt ? 1 : a.ruvChangedAt > b.ruvChangedAt ? -1 : String(a.name).localeCompare(String(b.name));
+};
+
+/** Pure: coverage + ledger + gist receipts + the set of installed store names → the page's payload. */
+function computeScope({ coverage, generations, gistSources, installedStores, root, cards = new Map(), now = Date.now() }) {
+  const empty = () => ({ total: 0, current: 0, behind: 0, unverified: 0, notInBrain: 0, ineligible: 0 });
+  const counts = { repos: empty(), gists: empty() };
+  const out = { repos: [], gists: [] };
+  const covered = new Set();
+  for (const row of coverage.rows ?? []) {
+    const kind = row.kind === 'gist' ? 'gists' : 'repos';
+    if (row.artifact?.store) covered.add(row.artifact.store);
+    counts[kind].total += 1;
+    if (row.disposition !== 'eligible') { counts[kind].ineligible += 1; continue; }
+    const r = scopeRow(row, { generations, gistSources, installedStores, cards });
+    counts[kind][r.bucket === 'not-in-brain' ? 'notInBrain' : r.bucket] += 1;
+    out[kind].push(r);
+  }
+  out.repos.sort(scopeNewestFirst);
+  out.gists.sort(scopeNewestFirst);
+  const observedAt = typeof coverage.observedAt === 'string' ? coverage.observedAt : null;
+  const ageMs = observedAt ? now - Date.parse(observedAt) : NaN;
+  const ageDays = Number.isFinite(ageMs) ? Math.round((ageMs / SCOPE_DAY_MS) * 10) / 10 : null;
+  return {
+    available: true,
+    root,
+    observedAt,
+    ageDays,
+    stale: ageDays == null || ageDays > SCOPE_STALE_DAYS,
+    brainVersion: generations?.brainVersion ?? null,
+    releaseTag: generations?.releaseTag ?? null,
+    sentence: SCOPE_SENTENCE,
+    counts,
+    repos: out.repos,
+    gists: out.gists,
+    installedStoreCount: installedStores.size,
+    installedOutsideCoverage: [...installedStores].filter((s) => !covered.has(s)).sort(),
+  };
+}
+
+/** Read the installed root and compute. Read-only; no network; returns `available: false` rather than a guess. */
+function gatherScope() {
+  const readJson = (rel) => { try { return JSON.parse(fs.readFileSync(path.join(INSTALLED_KB, rel), 'utf8')); } catch { return null; } };
+  const coverage = readJson('COVERAGE.json');
+  if (!coverage || !Array.isArray(coverage.rows)) {
+    return { available: false, reason: `no readable COVERAGE.json at ${INSTALLED_KB}`, root: INSTALLED_KB, sentence: SCOPE_SENTENCE, repos: [], gists: [], counts: {}, installedOutsideCoverage: [], installedStoreCount: 0 };
+  }
+  let installedStores = new Set();
+  try { installedStores = new Set(fs.readdirSync(INSTALLED_KB).filter((f) => f.endsWith('.big.rvf')).map((f) => f.slice(0, -'.big.rvf'.length))); }
+  catch { /* unreadable root reads as nothing installed — every row then says "not in the brain" */ }
+  let cardsText = null;
+  try { cardsText = fs.readFileSync(path.join(INSTALLED_KB, 'capability-cards.md'), 'utf8'); } catch { /* no cards → every desc is null, never invented */ }
+  return computeScope({ coverage, generations: readJson('RVF-GENERATIONS.json'), gistSources: readJson('ruv-gists.sources.json'),
+    installedStores, root: INSTALLED_KB, cards: parseCapabilityCards(cardsText) });
+}
+
 export {
+  gatherScope,
+  computeScope,
+  parseCapabilityCards,
   gatherState,
   gatherStack,
   gatherTrust,
@@ -3063,6 +3353,8 @@ export {
   saveBrainProfile,
   gatherRouterEngine,
   autoEligibleIds,
+  gatherConfig,
+  gatherSavings,
 };
 // Exported for the cross-project cache-isolation test (console-cache-scope.test.mjs). serveCached's
 // scopeKey is the guard that stops one project's cached state being served for another.