ruvnet-brain 4.3.39 → 4.4.0

package/README.md

@@ -7,7 +7,7 @@ Created: 2026-06-29 22:36:38 EDT
 
 # 🧠 RuvNet Brain
 
-### 🧠 RuvNet Brain — [![RuvNet Brain version 4.3.39 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.3.39-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
+### 🧠 RuvNet Brain — [![RuvNet Brain version 4.4.0 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.4.0-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
 
 **A portable, source-grounded brain over Reuven Cohen's (rUv's) RuvNet stack — delivered as a Claude Code plugin that makes Claude _use_ the stack instead of fighting it.**
 
@@ -562,7 +562,7 @@ node forge-ask-all.mjs --dir . --q "How does RuVector implement HNSW vector sear
 
 This project versions in the open (see the live badge up top for the exact plugin version; the downloadable knowledge bundle is a separate track) — we don't claim “done,” “complete,” or “zero hallucinations.” Where it stands:
 
-- ✅ **The grounding brain is real and proven** — 199 public stores · 161,322 public source chunks, dual embeddings, cross-encoder rerank, plugin (MCP tool + explicit skills; automatic hooks retired), all re-runnable.
+- ✅ **The grounding brain is real and proven** — 199 public stores · 161,371 public source chunks, dual embeddings, cross-encoder rerank, plugin (MCP tool + explicit skills; automatic hooks retired), all re-runnable.
 - ✅ **Code-level depth** — the code-rich repos are indexed to full function bodies; “how is it implemented?” returns the implementation. Verified in the shipped bundle (clean-room 3/3).
 - ✅ **Routing holds** — named 47/48, described 26/28, scenario 7/8; behavioral L1–L3 all pass (**L4 downgraded — it measures that the brain spoke, not that anything listened**); private stores fenced out of the public bundle (zero-leak verified).
 - ⚠️ **Two routing residuals** (above) — surfaced, not hidden.

package/bin/install.mjs

@@ -21,9 +21,10 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import readline from 'node:readline';
 import crypto from 'node:crypto';
 import { applyBrainProfile, readBrainProfile } from '../kb/brain-profile.mjs';
-import { acquireRefreshLock, finishRefreshReceipt, openRefreshReceipt, recordRefreshAdvisory,
+import { acquireRefreshLock, finishRefreshReceipt, openRefreshReceipt, physicalPath, recordRefreshAdvisory,
   recordRefreshPhase, settleRefreshRun, UPDATE_REFRESH_PHASES } from '../kb/refresh-run.mjs';
 import { pruneLifecycleEvidence } from '../kb/lifecycle-evidence-retention.mjs';
+import { recoverIncompleteStorageTransactions } from '../kb/update-storage-transaction.mjs';
 import {
   requiredEmbedderModels,
   missingEmbedderModels,
@@ -70,6 +71,8 @@ import {
   CONSOLE_RUNTIME_SURFACE, CONSOLE_RUNTIME_IDENTITY_FILE, consoleRuntimeDigest,
 } from '../scripts/console-runtime-identity.mjs';
 import { shellDiff as pluginShellDiff } from '../plugin/scripts/host-shell-boundary.mjs';
+import { readConsoleReceipts, replaceStaleConsoles } from '../scripts/console-instances.mjs';
+import { runHostCli, waitForHostCli } from '../scripts/host-cli.mjs';
 import {
   writeInstalledRuntimeIdentity, recordCorpusTransportIdentity, isCorpusReleaseTag, rejectedReleasePath,
 } from '../kb/corpus-release-identity.mjs';
@@ -102,8 +105,9 @@ const PACKAGE_VERSION = (() => {
 const REPO = 'stuinfla/ruvnet-brain';
 const RELEASE_API = `https://api.github.com/repos/${REPO}/releases/latest`;
 const ASSET_NAME = 'ruvnet-brain.zip';
-// Known-good BUNDLE tag, used when we can't reach GitHub (offline / rate-limited / no releases),
-// and by --pin. Default behavior is "get the latest Release"; this is only the safety net.
+// Known-good BUNDLE tag, used ONLY by --pin. It is no longer a silent fallback for a failed
+// latest-release lookup: that bundle predates ReleaseCoverage and cannot pass validation, so a lookup
+// failure now stops with its real cause (resolveRelease / releaseLookupFailure).
 //
 // This MUST NOT be derived from this package's own version. The installer and the brain bundle are
 // two independent version streams (README: "Three independent things version separately here — by
@@ -227,6 +231,13 @@ function tryRun(cmd, args, opts = {}) {
   const r = spawnSync(cmd, args, { stdio: 'inherit', shell: IS_WIN, ...opts });
   return !r.error && r.status === 0;
 }
+// The claude/codex CLIs update themselves and can be absent for seconds (scripts/host-cli.mjs):
+// retried with a bounded backoff, then ONE clear line instead of raw shell errors.
+function tryHostCli(cmd, args, opts = {}) {
+  const r = runHostCli(cmd, args, opts);
+  if (r.missingBinary) warn(r.message);
+  return !r.missingBinary && !r.error && r.status === 0;
+}
 
 // ── download with redirect-following + progress ──────────────────────────────────────────────────
 function download(url, dest, redirects = 0) {
@@ -299,7 +310,9 @@ function fetchJson(url, redirects = 0) {
         }
         if (statusCode !== 200) {
           res.resume();
-          return reject(new Error(`GitHub API returned HTTP ${statusCode}`));
+          const reset = headers['x-ratelimit-remaining'] === '0' && Number(headers['x-ratelimit-reset']);
+          return reject(new Error(`GitHub API returned HTTP ${statusCode}${reset
+            ? ` (anonymous rate limit used up; it resets at ${new Date(reset * 1000).toISOString()})` : ''}`));
         }
         let body = '';
         res.setEncoding('utf8');
@@ -321,8 +334,8 @@ function fetchJson(url, redirects = 0) {
 // ── step: resolve which Release to download (latest by default; safe fallback) ───────────────────
 // Default behavior: ask GitHub for the LATEST Release and use its ruvnet-brain.zip asset.
 // --version <tag> forces a tag; --pin skips the network check and uses the bundled known-good tag.
-// Any failure (offline / rate-limited / no releases) FALLS BACK to the pinned known-good Release,
-// narrated clearly so the user knows exactly what happened.
+// Any failure (offline / rate-limited / no releases) THROWS with the HTTP status or network error and
+// a retry hint; callers that must download stop on it, the staleness check reports "could not check".
 /**
  * Which asset of a Release actually holds the brain bundle.
  *
@@ -387,12 +400,31 @@ async function resolveRelease() {
     ok(`latest Release is ${c.bold(tag)}`);
     return { tag, url, source: 'latest' };
   } catch (e) {
-    warn(`couldn't check for the latest version (${e.message})`);
-    info(`using the known-good ${c.bold(RELEASE_VERSION)} instead — the install is still safe and complete`);
-    return { tag: RELEASE_VERSION, url: fallbackUrl(RELEASE_VERSION), source: 'fallback' };
+    // FAIL LOUD. This used to return the hardcoded RELEASE_VERSION and promise "the install is still
+    // safe and complete" — but that bundle predates ReleaseCoverage, so two steps later it failed
+    // validation with "COVERAGE.json is missing", and the reason (a rate limit, a network blip) was
+    // gone from the screen. Measured 2026-09-30 on the owner's recovery rail. Only --pin and
+    // --version choose a tag the lookup did not return.
+    const failure = releaseLookupFailure(e);
+    throw Object.assign(new Error(failure.message), { hint: failure.hint });
   }
 }
 
+/** Why the latest-release lookup failed, and what to do about it. Pure, for testing. */
+export function releaseLookupFailure(error) {
+  const detail = (error && error.message) || String(error);
+  const limited = /HTTP (?:403|429)\b/.test(detail);
+  return {
+    message: `couldn't look up the latest RuvNet Brain release (${detail}).`,
+    hint: [
+      limited
+        ? 'GitHub allows a limited number of anonymous release checks per hour from one network address. Wait until the reset time above, then re-run the same command.'
+        : 'Check your connection, then re-run the same command in a minute.',
+      `Nothing was downloaded or installed. To install one specific release instead: add  --version <tag>  (tags: https://github.com/${REPO}/releases).`,
+    ].join('\n'),
+  };
+}
+
 // ── step: resolve the cache dir ──────────────────────────────────────────────────────────────────
 function resolveCacheDir() {
   const custom = process.env.RUVNET_BRAIN_KB;
@@ -1249,24 +1281,33 @@ export function installConsoleRuntime(cacheDir, sourceRoot = REPO_ROOT) {
   }
 }
 
+// Receipts of Consoles that died (pid gone, port silent) are pruned, not counted: the owner's Mac
+// reported pending-console-restart forever from two receipts left on 2026-09-16/17
+// (scripts/console-instances.mjs).
+/**
+ * --doctor's view of a recorded convergence receipt. Its Console state is a snapshot from the last sync;
+ * a recorded pending-console-restart is re-read against the LIVE receipts, so a Console that has since
+ * exited (or a receipt it left when it died) stops failing --doctor. Returns a new object.
+ */
+export function withLiveConsoleState(recorded, { receiptDir, alive, probe } = {}) {
+  if (recorded?.consoleRuntime?.state !== 'pending-console-restart' || !recorded.consoleRuntime.sourceSha256) return recorded;
+  const { replacementFailures, ...kept } = recorded.consoleRuntime;
+  const live = { ...kept, ...consoleRestartState(recorded.consoleRuntime, { receiptDir, alive, probe }) };
+  if (live.state !== 'ready' && replacementFailures) live.replacementFailures = replacementFailures;
+  return { ...recorded, consoleRuntime: live };
+}
+
 export function consoleRestartState(identity, {
   receiptDir = path.join(process.env.RUVNET_BRAIN_HOME || path.join(os.homedir(), '.cache', 'ruvnet-brain'), 'console-instances'),
+  alive, probe,
 } = {}) {
-  let receipts = [];
-  try {
-    receipts = fs.readdirSync(receiptDir)
-      .filter((name) => name.endsWith('.json'))
-      .map((name) => {
-        try { return JSON.parse(fs.readFileSync(path.join(receiptDir, name), 'utf8')); }
-        catch { return null; }
-      })
-      .filter((receipt) => receipt?.product === 'ruvnet-brain-console' && receipt.schema === 1);
-  } catch { /* no running Console receipts is the ordinary ready state */ }
-  const staleInstances = receipts.filter((receipt) => receipt.sourceSha256 !== identity.sourceSha256).length;
+  const { live, pruned } = readConsoleReceipts(receiptDir, { ...(alive ? { alive } : {}), ...(probe ? { probe } : {}) });
+  const staleInstances = live.filter(({ receipt }) => receipt.sourceSha256 !== identity.sourceSha256).length;
   return {
     state: staleInstances > 0 ? 'pending-console-restart' : 'ready',
-    instanceReceipts: receipts.length,
+    instanceReceipts: live.length,
     staleInstances,
+    ...(pruned.length ? { prunedDeadReceipts: pruned.length } : {}),
   };
 }
 
@@ -1384,7 +1425,9 @@ function wirePlugin({ expectedVersion = PACKAGE_VERSION, requireManaged = false
   const manualMarketplace = `claude plugin marketplace add ${marketplaceSource}`;
   const manualInstall = 'claude plugin install ruvnet-brain@ruvnet-brain --scope user';
 
-  if (!have('claude')) {
+  const claudeCli = waitForHostCli('claude');
+  if (!claudeCli.present) {
+    if (claudeCli.message) warn(claudeCli.message);
     warn(`I couldn't run the \`claude\` command from this shell.`);
     info(`That's normal if you use Claude Code as the ${c.bold('VS Code extension')} or ${c.bold('desktop app')} — the`);
     info(`command just isn't on your terminal's PATH. ${c.green('The brain itself is fully downloaded.')}`);
@@ -1401,15 +1444,15 @@ function wirePlugin({ expectedVersion = PACKAGE_VERSION, requireManaged = false
     ? inspectPluginShellBoundary(before.installPath)
     : { known: true, changed: false, paths: [], restartRequired: false, reason: 'new host installation' };
   const addedMarket = before.managed
-    ? tryRun('claude', ['plugin', 'marketplace', 'update', 'ruvnet-brain'])
-    : tryRun('claude', ['plugin', 'marketplace', 'add', marketplaceSource]);
+    ? tryHostCli('claude', ['plugin', 'marketplace', 'update', 'ruvnet-brain'])
+    : tryHostCli('claude', ['plugin', 'marketplace', 'add', marketplaceSource]);
   // Deliberately NOT reassuring here. This used to say "it may already be added — that's fine",
   // which is a GUESS about someone else's machine, and when it was wrong the user finished the
   // install with a working search_ruvnet, no slash commands, and a message telling them all was
   // well. The real state is checked below; nothing is declared fine until it has been looked at.
   if (!addedMarket) info(`marketplace add didn't report success — checking what actually landed…`);
 
-  tryRun('claude', before.installed
+  tryHostCli('claude', before.installed
     ? ['plugin', 'update', 'ruvnet-brain@ruvnet-brain', '--scope', 'user']
     : ['plugin', 'install', 'ruvnet-brain@ruvnet-brain', '--scope', 'user']);
 
@@ -1834,13 +1877,16 @@ function runCodexJson(args, {
   codexHome = codexHomeDir(),
   cwd = process.cwd(),
 } = {}) {
-  const r = spawnSync(codexBin, args, {
+  const r = runHostCli(codexBin, args, {
+    stdio: 'pipe',
+    shell: false,
     cwd,
     env: { ...process.env, CODEX_HOME: codexHome },
     encoding: 'utf8',
     timeout: 30_000,
     maxBuffer: 20 * 1024 * 1024,
   });
+  if (r.missingBinary) return { ok: false, error: r.message };
   if (r.error || r.status !== 0) {
     const detail = String(r.stderr || r.stdout || r.error?.message || `exit ${r.status}`).trim();
     return { ok: false, error: detail };
@@ -2732,7 +2778,9 @@ async function doctor() {
   let hostConvergence = { healthy: true, state: 'not-recorded' };
   if (fs.existsSync(convergencePath)) {
     try {
-      hostConvergence = classifyHostConvergence(JSON.parse(fs.readFileSync(convergencePath, 'utf8')));
+      const recorded = withLiveConsoleState(JSON.parse(fs.readFileSync(convergencePath, 'utf8')),
+        { receiptDir: path.join(path.dirname(convergencePath), 'console-instances') });
+      hostConvergence = classifyHostConvergence(recorded);
       if (hostConvergence.healthy) ok(`host convergence receipt: ${hostConvergence.state}`);
       else {
         warn(`host convergence incomplete: ${hostConvergence.state}`);
@@ -3252,6 +3300,18 @@ export function classifyUpdaterExit(status, { fallbackAllowed = true, result = n
     if (!requireResult) return { verdict: 'legacy-success', fallback: false, exitCode: 0 };
     return { verdict: 'invalid-result', fallback: false, exitCode: 1 };
   }
+  // The updater refused BECAUSE full-KB copies already sit beside the brain ("refusing to create another
+  // full-KB copy"). A fresh install is exactly another full copy (it preserves the prior generation), so
+  // the fallback would turn the refusal into +1 copy per run (measured: 2 -> 3, +1.3 GB). Report instead.
+  if (/^unresolved rollback state exists/.test(String(result?.reason || ''))) {
+    return { verdict: 'refused-retained-copies', fallback: false, exitCode: status || 1 };
+  }
+  // Exit 2 is "manifest unreachable, nothing touched". The fallback exists for a DEAD manifest URL (an old
+  // bundle polling a path that 404s); a rate limit, a 5xx or no network is transient, and a full fresh
+  // reinstall over it re-downloads the brain and preserves another full copy each time. Retry later instead.
+  if (status === 2 && /returned HTTP (?:403|408|429|5\d\d)\b|network failure/.test(String(result?.reason || ''))) {
+    return { verdict: 'transient-network', fallback: false, exitCode: 2 };
+  }
   return { verdict: 'failed', fallback: fallbackAllowed, exitCode: status || 1 };
 }
 
@@ -3348,6 +3408,7 @@ export function syncHostsAfterUpdate(cacheDir = resolvedKbDir(), {
   wireCodexHost: detectCodexHost = wireCodexHost,
   wireCodexPlugin: installCodexPlugin = wireCodexPlugin,
   hostLockPath = path.join(brainHome, 'host-convergence.lock'),
+  replaceConsoles = null, // test seam; production runs replaceStaleConsoles
   runStableSpine = (apply) => spawnSync(
     process.execPath,
     [apply, '--auto', '--expected-version', PACKAGE_VERSION],
@@ -3433,12 +3494,7 @@ export function syncHostsAfterUpdate(cacheDir = resolvedKbDir(), {
       warn(`stale plugin generations were not pruned (${e.message}); nothing was removed`);
     }
     const receiptPath = path.join(brainHome, 'host-convergence.json');
-    try {
-      runtimeTransaction.activate();
-      results.consoleRuntime = {
-        ...runtimeTransaction.identity,
-        ...consoleRestartState(runtimeTransaction.identity, { receiptDir: consoleReceiptDir }),
-      };
+    const writeConvergenceReceipt = () => {
       fs.mkdirSync(brainHome, { recursive: true });
       const tmp = `${receiptPath}.tmp-${process.pid}`;
       fs.writeFileSync(tmp, JSON.stringify({
@@ -3451,10 +3507,39 @@ export function syncHostsAfterUpdate(cacheDir = resolvedKbDir(), {
         consoleRuntime: results.consoleRuntime,
       }, null, 2));
       fs.renameSync(tmp, receiptPath);
+    };
+    try {
+      runtimeTransaction.activate();
+      results.consoleRuntime = {
+        ...runtimeTransaction.identity,
+        ...consoleRestartState(runtimeTransaction.identity, { receiptDir: consoleReceiptDir }),
+      };
+      writeConvergenceReceipt();
       runtimeTransaction.commit();
     } catch (error) {
       return fail({ applyStatus: applied.status, error: `Console runtime convergence failed: ${error.message}` });
     }
+    // A Console still serving the previous runtime is replaced here, by the activated runtime's own
+    // launcher (the 'stale-running' path of scripts/onboarding-console.mjs, without --open), so an
+    // update never ends with "restart Console". Anything it could not replace is recorded with why.
+    if (results.consoleRuntime.state === 'pending-console-restart') {
+      try {
+        const replaceArgs = { entry: runtimeTransaction.entry, identity: runtimeTransaction.identity, receiptDir: consoleReceiptDir };
+        results.consoleReplacement = replaceConsoles ? replaceConsoles(replaceArgs) : replaceStaleConsoles(replaceArgs);
+        const failures = results.consoleReplacement.filter((item) => !item.replaced);
+        for (const item of results.consoleReplacement) {
+          if (item.replaced) ok(`Console on port ${item.port} replaced with the current runtime (pid ${item.newPid})`);
+        }
+        results.consoleRuntime = {
+          ...runtimeTransaction.identity,
+          ...consoleRestartState(runtimeTransaction.identity, { receiptDir: consoleReceiptDir }),
+          ...(failures.length ? { replacementFailures: failures.map((item) => `port ${item.port ?? '?'}: ${item.reason}`) } : {}),
+        };
+        writeConvergenceReceipt();
+      } catch (error) {
+        warn(`could not replace the running Console automatically (${error.message})`);
+      }
+    }
   }
   if (!okApplied) return fail({ applyStatus: applied.status, error: applied.error?.message || 'Stable Spine activation failed' });
   const convergence = classifyHostConvergence({
@@ -3486,7 +3571,9 @@ export function classifyHostConvergence(receipt, expectedVersion = PACKAGE_VERSI
   }
   if (badHost) return { healthy: false, state: 'host-pending', action: 're-run host synchronization' };
   if (receipt.consoleRuntime?.state !== 'ready') {
-    return { healthy: false, state: receipt.consoleRuntime?.state || 'console-unproven', action: 'restart Console, then re-run --doctor' };
+    const why = Array.isArray(receipt.consoleRuntime?.replacementFailures) && receipt.consoleRuntime.replacementFailures.length
+      ? `the installer could not replace the running Console (${receipt.consoleRuntime.replacementFailures.join('; ')}); ` : '';
+    return { healthy: false, state: receipt.consoleRuntime?.state || 'console-unproven', action: `${why}restart Console, then re-run --doctor` };
   }
   return { healthy: true, state: 'channels-converged' };
 }
@@ -3565,6 +3652,21 @@ async function runUpdate() {
   };
   process.once('exit', exitGuard);
   info(`brain dir: ${c.bold(kbDir)}`);
+  // RECOVER AN INTERRUPTED UPDATE FIRST, before anything below writes into the brain. Two measured
+  // reasons: (1) a kill between the two directory renames leaves no usable kb/ — the brain sits in a
+  // receipted kb.rollback-<id>, and the recovery that renames it back lives inside the updater that is
+  // now missing; (2) the preflight below re-stamps RUNTIME-IDENTITY.json into kb/, after which recovery
+  // can never prove kb/ still equals the identity sealed at LOCKED, so any pre-activation kill wedged
+  // every later update at RECOVERY_REQUIRED. Same function the updater runs, under this refresh lock.
+  // Receipts hold the REAL paths the updater knew, so recovery is addressed by the physical path.
+  if (fs.existsSync(path.join(path.dirname(kbDir), `.${path.basename(kbDir)}.update-transactions`))) {
+    try {
+      const recovered = recoverIncompleteStorageTransactions(physicalPath(kbDir));
+      if (recovered.length) ok(`restored the brain from an interrupted update (${recovered.map((r) => `${r.transactionId}: ${r.from}`).join(', ')})`);
+    } catch (error) {
+      warn(`an interrupted update could not be recovered automatically: ${error.message}`);
+    }
+  }
   let updateStatus = 1;
   // NO updater at all = no brain installed here (or a pre-self-updater bundle). That is a USER
   // message, not a fallback trigger: fail LOUD with the re-run-installer help and exit — never
@@ -3623,6 +3725,10 @@ async function runUpdate() {
     result: updaterResult,
     requireResult: supportsResultReceipt,
   });
+  if (outcome.verdict === 'refused-retained-copies') {
+    warn('nothing was changed: full copies of earlier brain generations already sit beside this one (listed above).');
+    info('Check that you no longer need them, remove them, then re-run  npx ruvnet-brain --update');
+  }
   if (outcome.fallback && FLAG_HOST_SYNC_ONLY) {
     // Host synchronization has a narrower contract than a full update: it must converge the
     // executable plugin/spine to the published package even when an optional large KB asset is
@@ -3650,7 +3756,7 @@ async function runUpdate() {
     let fr;
     if (hasPrivateOverlay) {
       warn("\nthe installed updater failed; using authenticated staged recovery to preserve private stores…\n");
-      const release = await resolveRelease();
+      const release = await resolveRelease().catch((error) => die(error.message, error.hint));
       const bundle = await obtainBundle(release);
       if (!bundle.zipPath) throw new Error('private-overlay recovery requires a downloadable signed bundle');
       const sigPath = `${bundle.zipPath}.sig`;
@@ -4929,7 +5035,7 @@ async function offerStack(env) {
   for (const m of missing) {
     if (m.shell) {
       info(`installing ${m.what} … ${c.dim(m.say)}`);
-      const ran = tryRun(m.shell[0], m.shell[1]);
+      const ran = ['claude', 'codex'].includes(m.shell[0]) ? tryHostCli(m.shell[0], m.shell[1]) : tryRun(m.shell[0], m.shell[1]);
       // Don't trust the exit code alone — e.g. `claude mcp add` exits non-zero on "already exists",
       // which is functionally success. Re-check the real state (m.verify) before warning.
       if (ran || (m.verify && m.verify())) ok(`${m.what} added`);
@@ -5333,8 +5439,9 @@ function showHelp() {
   console.log(`
 RuvNet Brain installer
 
-By default this installs the LATEST published Release (it asks GitHub which one that is),
-and falls back to a known-good version if GitHub can't be reached.
+By default this installs the LATEST published Release (it asks GitHub which one that is).
+If GitHub can't be reached or rate-limits the check, it STOPS with the reason and downloads
+nothing; re-run later, or pick a release yourself with  --version <tag>.
 
 Usage:
   npx ruvnet-brain                         Install the brain + Claude Code plugin (recommended, npm)
@@ -5476,9 +5583,9 @@ the installer reports that boot-level declarations changed.
     installedTag = installedBrainVersion(cacheDir); // 'unknown' when SOURCE.json has no releaseTag
     try {
       resolvedRelease = await resolveRelease();
-      // ONLY a genuine `latest` lookup counts as "what current means". resolveRelease() does NOT
-      // throw when the GitHub API fails — it returns the hardcoded known-good pin with
-      // source:'fallback'. Treating that as latest inverts this whole fix: a rate-limited lookup
+      // ONLY a genuine `latest` lookup counts as "what current means". A failed lookup now THROWS
+      // (caught below: "could not check"); it used to return the hardcoded known-good pin with
+      // source:'fallback'. Treating that as latest inverted this whole fix: a rate-limited lookup
       // would report installed v3.4.21-dev "→ latest v2.9.0" and DOWNGRADE a perfectly current
       // machine. (Caught by exercising the failure path against a 404 repo — the first version of
       // this fix did exactly that.) A pinned/forced resolution is likewise the operator's explicit
@@ -5541,7 +5648,8 @@ the installer reports that boot-level declarations changed.
     const localZipPresent =
       FLAG_LOCAL || fs.existsSync(path.join(REPO_ROOT, 'dist', 'ruvnet-brain.zip'));
     // Reuse the staleness check's resolution when it already ran — one network round-trip, not two.
-    const release = localZipPresent ? null : (resolvedRelease || await resolveRelease());
+    const release = localZipPresent ? null
+      : (resolvedRelease || await resolveRelease().catch((error) => die(error.message, error.hint)));
     const { zipPath, sourceDir, tmpDir, downloaded, sigError } = await obtainBundle(release);
     // Verify the Ed25519 signature BEFORE extracting a downloaded bundle into the user's config
     // (SEC-0010 #6 — trust root = the pubkey EMBEDDED in this file, so an attacker who swaps the

package/kb/brain-profile.mjs

@@ -61,16 +61,31 @@ function profileOwnership(dir) {
       ? Object.entries(source.stores) : null;
   if (!entries) throw new Error('invalid SOURCE ownership policy');
   const privateNames = new Set(fence.privateStores.map((s) => s.toLowerCase()));
+  // Published store names include dots (`dspy.ts`, `ruv.io`). A name may not start with a dot, hold `..`
+  // or a separator, or end in an artifact suffix (`x.big` would collide with store x's `x.big.rvf`).
+  const safeName = (name) => typeof name === 'string' && /^[a-z0-9][a-z0-9._-]*$/i.test(name) && !name.includes('..')
+    && !/\.(?:big|rvf)$/i.test(name);
   const managed = new Set();
+  const optedOut = new Set();
   const seen = new Set();
   for (const [name, value] of entries) {
-    if (typeof name !== 'string' || !/^[a-z0-9][a-z0-9_-]*$/i.test(name)
+    if (!safeName(name)
       || !value || typeof value !== 'object' || Array.isArray(value)
       || (value.kbName != null && value.kbName !== name)
       || (value.updateManaged != null && typeof value.updateManaged !== 'boolean')
       || seen.has(name.toLowerCase())) throw new Error('invalid SOURCE store ownership');
     seen.add(name.toLowerCase());
-    if (value.updateManaged !== false && !privateNames.has(name.toLowerCase())) managed.add(name);
+    if (value.updateManaged === false) optedOut.add(name.toLowerCase());
+    else if (!privateNames.has(name.toLowerCase())) managed.add(name);
+  }
+  // The release's PUBLIC ledger is the other ownership record: stores it publishes but SOURCE does not list
+  // (concepts, ruv-gists) are still release-owned, and forge-update's profiled check expects them gone.
+  const publicFile = path.join(dir, 'PUBLIC-RVF-GENERATIONS.json');
+  if (fs.existsSync(publicFile)) {
+    for (const name of Object.keys(read('PUBLIC-RVF-GENERATIONS.json').stores || {})) {
+      const key = String(name).toLowerCase();
+      if (safeName(name) && !privateNames.has(key) && !optedOut.has(key)) managed.add(name);
+    }
   }
   return { managed, read };
 }