ruvnet-brain 4.3.9 → 4.3.10

package/plugin/scripts/capability-registry.mjs

@@ -79,7 +79,7 @@ import { fileURLToPath } from 'node:url';
 // (issues #112, #113): the name of the nightly job the installer loads, and which hooks a session
 // really has wired. Both are imported from the modules that own them, statically — a missing sibling
 // here is a broken build caught by tests, not a runtime degradation to paper over.
-import { NIGHTLY_LABEL } from './nightly-controller.mjs';
+import { nightlyStatus } from './nightly-controller.mjs';
 import { buildRegistry, REPO } from './hook-registry.mjs';
 
 const HOME = os.homedir();
@@ -419,29 +419,11 @@ export const CAPABILITIES = [
   {
     key: 'memory-distillation',
     label: 'Memory distillation',
-    whatItBuysYou: 'Loose notes from past sessions get mined into reusable patterns, so your AI recalls the lesson instead of re-reading every old note to find it.',
+    whatItBuysYou: 'Loose notes from past sessions can be mined into reusable patterns. Automatic undo is unavailable, so the Console does not offer a one-click change.',
     scope: SCOPE.PROJECT,
-    // The offer points at scripts/distill-project.mjs, NOT at bare `ruflo memory distill run`, and the
-    // difference is the whole reason ADR-047 was rejected. Both duelists found the same hole: the
-    // registry offers `turnOn` commands whose promised undo lives on a DIFFERENT execution path than
-    // the action actually handed to the user. Here that was literal — the inverse advertised for
-    // distillation restores snapshots that `health-repair.mjs --distill-fleet` takes, while this line
-    // used to hand over the raw command, which (verified against `--help`) takes no snapshot at all.
-    // Run it, dislike the result, and there was nothing to go back to.
-    //
-    // The wrapper sequences rUv's own commands so the operation is reversible: WAL-safe
-    // `ruflo memory backup` FIRST (cp on a live WAL DB silently amputates the newest transactions —
-    // this project has lost data that way), a durable fsync'd receipt fail-closed BEFORE any mutation,
-    // `distill run --db` scoped to THIS project rather than whatever the cwd implies, and a verified
-    // pattern delta reported as a measurement. `--restore` is the tested inverse.
-    //
-    // PROVEN end to end against the real store, 2026-07-24: 644 → 648 patterns (+4), restore → 644,
-    // re-run → 648, five durable receipts, $0.0000. This is the ONE capability whose undo has actually
-    // been run rather than merely promised — which is precisely what makes it the only one offerable.
-    turnOn: selfTurnOn(
-      'Mine this project\'s stored memories into reusable patterns (snapshots first; reversible)',
-      'distill-project.mjs',
-    ),
+    // The explicit distill-project command snapshots first, but --restore refuses unsafe
+    // database replacement. Keep diagnosis visible without promising an available inverse.
+    turnOn: null,
     detect({ project = process.cwd() } = {}) {
       const db = path.join(project, '.swarm/memory.db');
       if (!fs.existsSync(db)) return row(STATE.ABSENT, `no memory store exists for this project yet (${path.join(path.basename(project), '.swarm/memory.db')} is not present)`);
@@ -893,66 +875,11 @@ export const CAPABILITIES = [
     // Loading a launchd job is machine mutation with no single verified command; global Rule 10.
     turnOn: null,
     detect() {
-      // launchd is macOS-only. On any other platform this is UNCHECKABLE, not off — this repo has
-      // already shipped a macOS-only assumption that went red the moment it met the Linux CI runner,
-      // and reporting "your nightly job is off" to a Linux user would be that same bug with worse
-      // consequences, because it reads as an actionable fault rather than a test failure.
-      if (process.platform !== 'darwin') return row(STATE.UNKNOWN, `scheduled jobs are managed by launchd, which does not exist on ${process.platform} — this cannot be checked here`);
-      let out;
-      try { out = execFileSync('launchctl', ['list'], { encoding: 'utf8', timeout: 15_000 }); }
-      catch (e) { return row(STATE.UNKNOWN, `could not list scheduled jobs (${String(e?.message || e).split('\n')[0].slice(0, 60)}) — nightly state not checked`); }
-
-      // THIS ROW IS ABOUT THE NIGHTLY KNOWLEDGE-BASE REFRESH, so it counts the nightly refresh — not
-      // every launchd job whose label happens to start com.ruvnet. MEASURED on this machine: that
-      // prefix match reported "11 refresh jobs are loaded and every one last exited cleanly" while
-      // sweeping in goldie-weekly, npx-witness, issue-fix, npm-token-renew, issue-watch,
-      // routing-flywheel, brain-gists, npx-72h-verdict and nightly-watchdog. Exactly ONE of the
-      // eleven (brain-nightly) was the thing the sentence claimed to describe. Ten unrelated jobs
-      // were being offered as evidence for a capability none of them implements.
-      //
-      // AND THE UNDER-COUNTING TWIN, which cost more (issue #113). The pattern below is a guess at
-      // what a refresh job is CALLED, and the one job this row is actually about is not called that:
-      // the installer loads `com.ruvnet.brain-update`, which contains neither "nightly" nor
-      // "refresh". So the console reported "no nightly refresh job is loaded" about a job that was
-      // loaded, scheduled for 03:47 and running nightly — a detector blind to its own installer.
-      // The label is now taken from nightly-controller.mjs, the module the console already uses to
-      // turn this job on and off, instead of being described a second time as a pattern here.
-      const NIGHTLY = /^com\.ruvnet\.[\w.-]*(nightly|refresh)/i;
-      const all = out.split('\n')
-        .map((l) => l.split('\t'))
-        .filter((c) => c.length >= 3 && /^com\.ruvnet\./.test(c[2] || ''))
-        .map((c) => ({ label: c[2].trim(), exit: c[1] }));
-      // The watchdog watches the refresh; it is not the refresh, and counting it inflates the answer.
-      const jobs = all.filter((j) => j.label === NIGHTLY_LABEL
-        || (NIGHTLY.test(j.label) && !/watchdog/i.test(j.label)));
-      if (!jobs.length) {
-        return row(STATE.ABSENT, all.length
-          ? `no nightly refresh job is loaded on this machine (${all.length} other RuvNet job${all.length === 1 ? '' : 's'} are scheduled, but none of them is the knowledge-base refresh)`
-          : 'no scheduled refresh jobs are loaded on this machine');
-      }
-
-      const name = (j) => j.label.replace('com.ruvnet.', '');
-      // FAILING IS NOT DORMANT. REJECTED by both duelists 2026-07-24: a job that is loaded, scheduled and
-      // has RUN is installed and IN USE — a non-zero exit is a HEALTH problem belonging to the alarm
-      // channel, never a "you should switch this on" offer. Reporting it OFF is a category error, and it
-      // fired here for the worst possible reason: brain-nightly exited non-zero because the publish guard
-      // CORRECTLY refused to release from a non-main branch. A working safety guard was being reported as
-      // a dormant capability the user should go turn on.
-      const failing = jobs.filter((j) => j.exit !== '0' && j.exit !== '-');
-      if (failing.length) return row(STATE.ON, `${jobs.length} nightly refresh job${jobs.length === 1 ? '' : 's'} loaded and running, but ${failing.length} last exited non-zero (${failing.slice(0, 3).map((j) => `${name(j)}=${j.exit}`).join(', ')}) — installed and in use, so this is a health problem to look into, not a capability to switch on`);
-
-      // "-" IS NOT "0". launchd prints "-" for a job that has never run in this boot, and the old
-      // check lumped it in with success — so "every one last exited cleanly" could describe a job
-      // that has never executed once. That is the silence-reads-as-health failure the positive-
-      // confirmation standing order exists to kill, stated on the surface that is supposed to enforce it.
-      const neverRan = jobs.filter((j) => j.exit === '-');
-      if (neverRan.length === jobs.length) {
-        return row(STATE.UNKNOWN, `${jobs.length} nightly refresh job${jobs.length === 1 ? ' is' : 's are'} loaded (${jobs.map(name).slice(0, 3).join(', ')}) but ${jobs.length === 1 ? 'it has' : 'none has'} run since this machine last booted, so whether the refresh actually works here has not been demonstrated`);
-      }
-      if (neverRan.length) {
-        return row(STATE.ON, `${jobs.length} nightly refresh jobs are loaded; ${jobs.length - neverRan.length} last exited cleanly and ${neverRan.length} (${neverRan.map(name).slice(0, 3).join(', ')}) have not run since boot`);
-      }
-      return row(STATE.ON, `${jobs.length} nightly refresh job${jobs.length === 1 ? '' : 's'} loaded (${jobs.map(name).slice(0, 3).join(', ')}), and every one last exited cleanly`);
+      const status = nightlyStatus();
+      if (status.state === 'on') return row(STATE.ON, status.evidence);
+      if (status.state === 'degraded') return row(STATE.ON, `${status.evidence} — installed, but operationally degraded`);
+      if (status.state === 'off') return row(STATE.ABSENT, status.evidence);
+      return row(STATE.UNKNOWN, status.evidence);
     },
   },
 ];

package/plugin/scripts/codex-hook-adapter.mjs

@@ -32,10 +32,14 @@ import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { CONTEXT_EVENTS } from './codex-hook-events.mjs';
+import { developmentHooksSuspended } from './development-maintenance.mjs';
+
+if (developmentHooksSuspended()) process.exit(0);
 
 const raw = fs.readFileSync(0, 'utf8');
 let input = {};
 try { input = raw ? JSON.parse(raw) : {}; } catch { /* the shared hook bodies already fail soft */ }
+if (typeof input.cwd === 'string' && developmentHooksSuspended(input.cwd)) process.exit(0);
 
 const hookId = process.argv[2] || '';
 const event = String(input.hook_event_name || '');
@@ -49,10 +53,18 @@ const codexToolName = String(input.tool_name).toLowerCase();
 
 /** Every file an apply_patch touches, in patch order. Codex patches are routinely multi-file. */
 export function patchFiles(patch) {
+  return [...new Set(patchOperations(patch).flatMap((op) => op.move ? [op.file, op.move] : [op.file]))];
+}
+
+function patchOperations(patch) {
   const out = [];
-  for (const m of String(patch || '').matchAll(/^\*\*\* (?:Add|Update|Delete) File: (.+)$/gm)) {
-    const f = m[1].trim();
-    if (f && !out.includes(f)) out.push(f);
+  for (const line of String(patch || '').split(/\r?\n/)) {
+    const header = /^\*\*\* (Add|Update|Delete) File: (.+)$/.exec(line);
+    if (header) out.push({ operation: header[1], file: header[2].trim() });
+    else {
+      const move = /^\*\*\* Move to: (.+)$/.exec(line);
+      if (move && out.at(-1)?.operation === 'Update') out.at(-1).move = move[1].trim();
+    }
   }
   return out;
 }
@@ -60,6 +72,8 @@ export function patchFiles(patch) {
 // Codex names these tools differently from the shared Claude hook contracts. Normalize at the
 // host boundary once so every existing safety/learning body sees the same typed event.
 let files = [];
+let operations = [];
+const patchTool = ['apply_patch', 'functions.apply_patch', 'functions__apply_patch'].includes(codexToolName);
 if (['exec_command', 'functions.exec_command', 'functions__exec_command'].includes(codexToolName)) {
   input.tool_name = 'Bash';
   input.tool_input = {
@@ -67,12 +81,17 @@ if (['exec_command', 'functions.exec_command', 'functions__exec_command'].includ
     command: input.tool_input?.command || input.tool_input?.cmd || '',
   };
   adapted = true;
-} else if (codexToolName === 'apply_patch') {
-  const patch = typeof input.tool_input?.command === 'string' ? input.tool_input.command : '';
+} else if (patchTool) {
+  // Codex 0.153.4's installed hook schema declares tool_input as arbitrary JSON. Its installed
+  // apply_patch grammar is FREEFORM (raw string); object.command is the existing compatibility
+  // contract. Do not spread a raw string into numbered object properties or guess other fields.
+  const patch = typeof input.tool_input === 'string' ? input.tool_input
+    : typeof input.tool_input?.command === 'string' ? input.tool_input.command : '';
+  operations = patchOperations(patch);
   files = patchFiles(patch);
   input.tool_name = 'Edit';
   input.tool_input = {
-    ...(input.tool_input || {}),
+    ...(input.tool_input && typeof input.tool_input === 'object' ? input.tool_input : {}),
     ...(files[0] ? { file_path: files[0] } : {}),
     new_string: patch,
   };
@@ -89,16 +108,30 @@ if (['exec_command', 'functions.exec_command', 'functions__exec_command'].includ
 
 const hookInput = adapted ? JSON.stringify(input) : raw;
 const shim = path.join(path.dirname(fileURLToPath(import.meta.url)), 'hook-shim.mjs');
+const projectDir = String(input.cwd || process.env.CLAUDE_PROJECT_DIR || process.cwd());
 const env = {
   ...process.env,
   CLAUDE_SESSION_ID: String(input.session_id || process.env.CLAUDE_SESSION_ID || ''),
   CLAUDE_PLUGIN_ROOT: String(process.env.PLUGIN_ROOT || process.env.CLAUDE_PLUGIN_ROOT || ''),
-  CLAUDE_PROJECT_DIR: String(input.cwd || process.env.CLAUDE_PROJECT_DIR || process.cwd()),
+  CLAUDE_PROJECT_DIR: projectDir,
   RUVNET_HOOK_HOST: 'codex',
 };
 
+// Dream Cycle 2026-09-05. Codex's own dispatch trampoline (codex-hooks.json) never passes `cwd:`
+// when it spawns codex-hook.mjs, and codex-hook-wrapper.mjs never passes it when it spawns THIS
+// process either — so the real OS $PWD this process (and every child below it) inherits is wherever
+// Codex happened to launch the trampoline from, architecturally independent of the payload's own
+// `cwd` field used for CLAUDE_PROJECT_DIR above. project-identity.mjs's projectDirectory() and
+// learn-capture.sh's containment check both trust CLAUDE_PROJECT_DIR only when $PWD actually lies
+// inside it (#85/#107) — so whenever the dispatcher's real cwd and the payload's declared cwd
+// diverge, that check silently REJECTS the correct root and falls back to the dispatcher's own
+// directory, which this plugin does not own (ADR-058 D5). Fall back to the current cwd if the
+// declared one no longer exists, rather than handing spawnSync a cwd it will ENOENT on.
+let shimCwd = process.cwd();
+try { if (fs.statSync(projectDir).isDirectory()) shimCwd = projectDir; } catch { /* keep the default */ }
+
 const runShim = (payload) => spawnSync(process.execPath, [shim, hookId, ...process.argv.slice(3)], {
-  input: payload, encoding: 'utf8', env,
+  input: payload, encoding: 'utf8', env, cwd: shimCwd,
 });
 
 /**
@@ -119,13 +152,33 @@ const BUDGET_MS = Number(process.env.RUVNET_CODEX_BUDGET_MS) || 0;
 const started = Date.now();
 const spent = () => Date.now() - started;
 
-const payloads = files.length > 1
+let payloads = files.length > 1
   ? files.map((file) => JSON.stringify({
     ...input,
     tool_input: { ...input.tool_input, file_path: file },
   }))
   : [hookInput];
 
+if (patchTool && hookId === 'md-stamp') {
+  // Installed apply_patch reports this exact success banner plus A/M/D path records. A raw patch
+  // describes intent; only the successful result authorizes stamping or supplies Add provenance.
+  const response = input.tool_response;
+  if (event !== 'PostToolUse' || typeof response !== 'string'
+    || !/^Success\. Updated the following files:\r?\n/.test(response)) process.exit(0);
+  const succeeded = new Map([...response.matchAll(/^([AMD]) (.+)$/gm)]
+    .map((m) => [path.resolve(projectDir, m[2].trim()), m[1]]));
+  payloads = operations.filter((op) => op.operation !== 'Delete').flatMap((op) => {
+    const file = op.move || op.file;
+    const status = succeeded.get(path.resolve(projectDir, file));
+    if (status !== 'A' && status !== 'M') return [];
+    return [JSON.stringify({
+      ...input,
+      tool_input: { ...input.tool_input, file_path: file },
+      tool_response: op.operation === 'Add' && status === 'A' ? { type: 'create' } : response,
+    })];
+  });
+}
+
 const stdouts = [];
 for (const payload of payloads) {
   const r = runShim(payload);

package/plugin/scripts/codex-hook-wrapper.mjs

@@ -4,6 +4,13 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
 
+// New installs colocate the helper. Older standalone fixtures/installations can omit it;
+// they retain their prior behavior until the installer upgrades both files.
+let developmentHooksSuspended = () => false;
+try { ({ developmentHooksSuspended } = await import('./development-maintenance.mjs')); }
+catch (error) { if (error.code !== 'ERR_MODULE_NOT_FOUND') throw error; }
+if (developmentHooksSuspended()) process.exit(0);
+
 const codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex');
 const brainHome = process.env.RUVNET_BRAIN_HOME
   || path.join(path.dirname(codexHome), '.cache', 'ruvnet-brain');
@@ -14,7 +21,15 @@ const blockingHooks = new Set([
   // blocking reason to stderr"). Absent from this set it would be wired and toothless: the exit 2
   // would be swallowed here and every refusal would silently become an allow.
   'decision-gate',
-  'route-dispatch',
+  // NOT 'route-dispatch' (removed Dream Cycle 2026-09-05, MEASURED drift): hook-shim.mjs's own
+  // TABLE has declared it `mode: 'advisory'` since issue #84 — Claude Code consumes its
+  // PreToolUse:Agent/Task result ~140ms after tool_dispatch_end, so a refusal there would arrive
+  // too late to be enforcement (hook-shim.mjs's own comment, in the past tense, about this exact
+  // membership: "This comment used to cite 'route-dispatch's exit-2 wall' as the example. That was
+  // FALSE and had to go"). hook-shim.mjs's own dispatch already coerces its exit code to 0
+  // unconditionally, so this membership could never fire — harmless today, but exactly the
+  // false-confidence gap tests/unit/codex-blocking-hooks-parity.test.mjs now holds closed: this
+  // Set must name only ids hook-shim.mjs's TABLE actually calls 'blocking'.
   'hijack-ruvnet',   // ADR-063: opt-in managed-memory refusal; exits 0 at the default
   'ground-before-write',
   'protect-state',
@@ -147,6 +162,9 @@ function readHookInput(limit = 1024 * 1024) {
 }
 
 const input = await readHookInput();
+let projectCwd;
+try { projectCwd = JSON.parse(input.toString('utf8')).cwd; } catch { /* malformed host payload */ }
+if (typeof projectCwd === 'string' && developmentHooksSuspended(projectCwd)) process.exit(0);
 const root = activeRoot();
 const adapter = root && path.join(root, 'scripts', 'codex-hook-adapter.mjs');
 if (!adapter || !fs.existsSync(adapter)) process.exit(0);

package/plugin/scripts/continuation-gate.mjs

@@ -25,11 +25,14 @@
  * committed-to items with a done state — and if authorized work remains unfinished, it says so, in
  * the last place the model looks before going quiet.
  *
- * WHAT IT DOES, verified against code.claude.com/docs/en/hooks.md (2026-07-23, not recalled, ADR-043):
- * a Stop hook's `additionalContext` at exit 0 DOES force a continuation — under the same loop
- * protections as decision:block (the `stop_hook_active` input + the 8-consecutive-continuation cap). An
- * earlier version of this header claimed "a Stop hook cannot force another turn"; that was wrong. The
- * gate still exits 0 always — continuation is driven by the envelope, never by a non-zero exit code.
+ * CURRENT AUTHORITY: only explicitly scoped nonauthoritative continuation preferences request
+ * objective work. Historical incident notes below describe the former backlog-forcing behavior;
+ * repository observations are now stderr advisories, never permission to act. Answer-integrity
+ * correction remains independent, but cancellation/interruption and the host loop guard win.
+ *
+ * This file emits a Stop request envelope. Unit/subprocess tests prove that output, NOT native host
+ * continuation. No daemon, automatic preference writer, completion authority, or re-engagement
+ * bridge exists here. The existing stop_hook_active guard remains unchanged.
  *
  * FAILS OPEN ALWAYS. Exit 0 unconditionally. A gate that breaks a turn's completion because it
  * could not read a JSON file would be disabled within a day, and a disabled gate protects nothing.
@@ -43,11 +46,11 @@ import {
   buildCapabilityInventoryReceipt,
 } from './capability-inventory-receipt.mjs';
 import { auditCurrentCapabilityEvidence } from './capability-claim-evidence.mjs';
+import { continuationProjectIdentity, authorizedContinuationObjective } from './continuation-objective.mjs';
 
 const HOME = os.homedir();
 
-// The only exit code this file may ever use. A Stop hook that exits non-zero refuses to let the turn
-// end; this gate informs and never refuses, so every path below returns exactly this.
+// Always exit zero. Any host continuation request is expressed in the envelope, not exit status.
 const EXIT_ALLOW = 0;
 /**
  * PROJECT-SCOPED, because this runs machine-wide.
@@ -59,20 +62,10 @@ const EXIT_ALLOW = 0;
  * project so the three never see each other's work.
  */
 function projectKey() {
-  let dir = process.cwd();
-  // Walk up to the git root — the stable identity of a project, regardless of which subdirectory
-  // a hook happens to fire from. (A CWD-derived key was exactly the bug that scattered ledgers
-  // through users' project trees in issue #36.)
-  for (let i = 0; i < 12; i++) {
-    if (fs.existsSync(path.join(dir, '.git'))) break;
-    const up = path.dirname(dir);
-    if (up === dir) { dir = process.cwd(); break; }
-    dir = up;
-  }
-  return path.basename(dir).replace(/[^a-zA-Z0-9._-]/g, '_');
+  return continuationProjectIdentity(process.cwd())?.projectId.replace(':', '-') || 'unknown-project';
 }
 
-const LEDGER = process.env.RUVNET_WORK_LEDGER
+let LEDGER = process.env.RUVNET_WORK_LEDGER
   || path.join(HOME, '.config', 'ruvnet-brain', 'work-ledgers', `${projectKey()}.json`);
 
 /**
@@ -248,8 +241,16 @@ if (hookInput.__source !== 'stdin') process.exit(EXIT_ALLOW);
  */
 if (hookInput.stop_hook_active) process.exit(EXIT_ALLOW);
 
+if (hookInput.hook_event_name !== 'Stop' || hookInput.interrupted || hookInput.cancelled) process.exit(EXIT_ALLOW);
+const projectIdentity = continuationProjectIdentity(hookInput.cwd);
+if (!projectIdentity) process.exit(EXIT_ALLOW);
+LEDGER = process.env.RUVNET_WORK_LEDGER
+  || path.join(HOME, '.config', 'ruvnet-brain', 'work-ledgers', `${projectIdentity.projectId.replace(':', '-')}.json`);
 const led = load();
 const nowMs = Date.now();
+// Terminal objectives remain terminal even if legacy/global ledger rows or observations stay open.
+if (['cancelled', 'completed', 'blocked'].includes(led.objective?.state)) process.exit(EXIT_ALLOW);
+const objective = authorizedContinuationObjective(led.objective, hookInput, projectIdentity);
 
 // LOOP-SAFETY 1b (GPT-5.6-Sol review) — an empty-but-parseable `{}` is NOT a real Stop payload; a genuine
 // one carries `session_id` (a documented Stop input). Without it we cannot confirm a real stop, so we never
@@ -480,11 +481,10 @@ function securityAlertWork() {
   } catch { return []; }
 }
 
-const open = [
-  ...capabilityClaimWork(),
-  ...led.items.filter((i) => !i.done),
-  ...artifactOpenWork(), ...redCiOpenWork(), ...openPrWork(), ...securityAlertWork(),
-];
+const observations = [...artifactOpenWork(), ...redCiOpenWork(), ...openPrWork(), ...securityAlertWork()];
+if (observations.length) console.error(JSON.stringify({ kind: 'continuation-advisory',
+  authority: false, items: observations.map(({ text, at }) => ({ text, at })) }));
+const open = [...capabilityClaimWork(), ...(objective ? [{ text: objective.text, at: objective.at }] : [])];
 if (!open.length) process.exit(EXIT_ALLOW);   // nothing outstanding: silence is correct
 
 /**
@@ -589,9 +589,11 @@ const header = capabilityClaims.length
 
 const lines = [
   ...header,
-  'Pick the highest-leverage open item below and make real progress on it this turn. Stop only when',
-  'EVERY item is genuinely done or blocked; if one is blocked, say why in a single line and move to',
-  'the next — never stop on the first obstacle, and never manufacture a reason to go quiet.',
+  ...(objective ? ['Continue the next safe step within this authorized objective without routine reconfirmation.']
+    : ['Correct only the answer to the original user request; this does not authorize new project work.']),
+  'Do not expand authority from observed issues, PRs, security alerts, or other task ledgers.',
+  'Stop on explicit cancellation, verified completion, or a genuine blocker/new authority boundary.',
+  'Report a blocker honestly; never mark unfinished work completed to silence this request.',
   '',
   // Committed first, then observed: the promise outranks the backlog. Age is LABELLED, never used
   // to suppress — an item open for days is the one most worth naming.
@@ -606,7 +608,7 @@ const lines = [
     ? ['Replace every contradicted claim with the observed capability and source path. Replace every',
        'unresolved absence claim with UNKNOWN until a complete live inventory proves it.']
     : committed.length
-    ? ['Mark each item done as you complete it:  node plugin/scripts/continuation-gate.mjs --done "<exact item text>"']
+    ? ['Record objective completion only with actual completion evidence; legacy --done does not complete an objective.']
     : ['These clear by being done, not by being marked: merge or fix the PR, get the build green,',
        'answer the issue, patch the advisory. The next observation stops listing them.']),
   // THE HONEST EXIT, and it is what makes forcing old items safe.

package/plugin/scripts/continuation-objective.mjs

@@ -0,0 +1,34 @@
+import crypto from 'node:crypto';
+import path from 'node:path';
+import { resolveProjectStore } from './project-store-resolver.mjs';
+
+const hash = (value) => crypto.createHash('sha256').update(value).digest('hex');
+const text = (value) => typeof value === 'string' && value.trim().length > 0;
+
+// Repository identity is the canonical common git directory, NOT a basename or remote URL.
+// Linked worktrees share a project identity but require their own explicit worktree authorization.
+export function continuationProjectIdentity(cwd) {
+  if (!text(cwd) || !path.isAbsolute(cwd)) return null;
+  try {
+    const resolved = resolveProjectStore({ projectDir: cwd });
+    return { projectId: resolved.projectIdentity.id, worktreeId: hash(resolved.checkoutRoot),
+      root: resolved.checkoutRoot };
+  } catch { return null; }
+}
+
+// Non-authoritative continuation preferences in the EXISTING ledger, not a second task store.
+// These request/suppress a hook nudge only; they neither prove user provenance nor establish task
+// completion. Canonical project progression remains in AgentDB. No automatic writer or native
+// continuation bridge is supplied here. Configuration must cite an actual user authorization.
+export function authorizedContinuationObjective(objective, input, identity) {
+  if (!identity || input?.hook_event_name !== 'Stop' || !text(input.session_id)
+    || input.interrupted || input.cancelled || input.stop_hook_active) return null;
+  if (objective?.schemaVersion !== 1 || objective.kind !== 'continuation-preferences'
+    || objective.authoritative !== false || objective.state !== 'active'
+    || !text(objective.id) || !text(objective.text) || !Number.isFinite(Date.parse(objective.at))
+    || objective.authorization?.kind !== 'user' || !text(objective.authorization.reference)
+    || objective.projectId !== identity.projectId
+    || !Array.isArray(objective.sessionIds) || !objective.sessionIds.includes(input.session_id)
+    || !Array.isArray(objective.worktreeIds) || !objective.worktreeIds.includes(identity.worktreeId)) return null;
+  return objective;
+}

package/plugin/scripts/development-maintenance.mjs

@@ -0,0 +1,49 @@
+// Local configuration only: no Git subprocess, network, hook bodies, or writes on the read path.
+import fs from 'node:fs';
+import path from 'node:path';
+
+export function repositoryScope(cwd = process.cwd()) {
+  let dir = fs.realpathSync(cwd);
+  for (;;) {
+    const dotgit = path.join(dir, '.git');
+    let stat;
+    try { stat = fs.lstatSync(dotgit); } catch (error) { if (error.code !== 'ENOENT') throw error; }
+    if (stat) {
+      if (stat.isSymbolicLink()) throw new Error('Refusing symlink .git');
+      let gitdir = dotgit;
+      if (stat.isFile()) {
+        const match = /^gitdir: (.+)\r?\n?$/.exec(fs.readFileSync(dotgit, 'utf8'));
+        if (!match) throw new Error('Invalid worktree .git file');
+        gitdir = path.resolve(dir, match[1].trim());
+      } else if (!stat.isDirectory()) throw new Error('Invalid .git metadata');
+      let common = gitdir;
+      try { common = path.resolve(gitdir, fs.readFileSync(path.join(gitdir, 'commondir'), 'utf8').trim()); }
+      catch (error) { if (error.code !== 'ENOENT') throw error; }
+      common = fs.realpathSync(common);
+      const owner = fs.statSync(common);
+      if (!owner.isDirectory() || (process.getuid && owner.uid !== process.getuid())) throw new Error('Repository metadata is not owned by this user');
+      return { project: dir, commonDir: common, statePath: path.join(common, 'ruvnet-brain-maintenance.json') };
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+export function maintenanceStatus(cwd = process.cwd()) {
+  const scope = repositoryScope(cwd);
+  if (!scope) return { project: null, suspended: false };
+  let stat;
+  try { stat = fs.lstatSync(scope.statePath); }
+  catch (error) { if (error.code === 'ENOENT') return { ...scope, suspended: false }; throw error; }
+  if (!stat.isFile() || stat.isSymbolicLink() || (process.getuid && stat.uid !== process.getuid())) throw new Error('Maintenance state must be a user-owned regular file');
+  if (process.platform !== 'win32' && (stat.mode & 0o022)) throw new Error('Maintenance state is writable by other users');
+  const state = JSON.parse(fs.readFileSync(scope.statePath, 'utf8'));
+  if (state.schema !== 1 || state.commonDir !== scope.commonDir || state.suspended !== true) throw new Error('Invalid maintenance state for this repository');
+  return { ...scope, ...state };
+}
+
+export function developmentHooksSuspended(cwd = process.cwd()) {
+  // A malformed local configuration is not authority to bypass a hook.
+  try { return maintenanceStatus(cwd).suspended; } catch { return false; }
+}

package/plugin/scripts/hook-shim.mjs

@@ -33,6 +33,9 @@ import os from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { resolveBash, skipNoBash } from './hook-shim-bash.mjs';
+import { developmentHooksSuspended } from './development-maintenance.mjs';
+
+if (developmentHooksSuspended()) process.exit(0);
 
 const BRAIN_HOME = process.env.RUVNET_BRAIN_HOME || path.join(os.homedir(), '.cache', 'ruvnet-brain');
 const ACTIVE = path.join(BRAIN_HOME, 'active.json');

package/plugin/scripts/learn-flush.mjs

@@ -161,7 +161,12 @@ if (failures.length) {
   const distinct = [...new Set(failures)];
   warn(`${failures.length}/${actions.length} feed call(s) FAILED via ${RUFLO}`
     + ` — ${distinct.slice(0, 2).join(' | ')}${distinct.length > 2 ? ` (+${distinct.length - 2} more kind(s))` : ''}`
-    + (fed === 0 ? '. Nothing was learned; the queue is KEPT for retry.' : `. ${fed} succeeded.`));
+    + (fed === 0 ? '. Nothing was learned; the queue is KEPT for retry.'
+      : `. ${fed} succeeded; the entire queue is KEPT for retry (successful actions may replay).`));
+  // Preserve the original bytes on ANY failed attempt. Rewriting only the deferred tail would
+  // discard failed actions whenever a sibling succeeded. This is at-least-once retry, not an
+  // exactly-once or concurrent-capture protocol; successful actions may be fed again.
+  process.exit(0);
 }
 // Whatever the deadline cut off is WORK, not waste: it goes back on the front of the queue so the
 // next flush continues from there. Dropping it would turn a time limit into the same silent data

package/plugin/scripts/lesson-gate.mjs

@@ -329,7 +329,7 @@ const presentation = buildLessonPresentation({
   maxShows: MAX_SHOWS,
   nudgeBudget: NUDGE_CHAR_BUDGET,
 });
-const { inForce, blocking, blockCapable, body: renderedBody, advisoryContext } = presentation;
+const { inForce, blocking, blockCapable, shown: shownThisCall, body: renderedBody, advisoryContext } = presentation;
 const renderBody = () => renderedBody;
 
 // ── Emit ─────────────────────────────────────────────────────────────────────────────────────────
@@ -356,7 +356,10 @@ if (event) {
     st.sessions = st.sessions && typeof st.sessions === 'object' ? st.sessions : {};
     const prev = st.sessions[SID] && typeof st.sessions[SID] === 'object' ? st.sessions[SID] : {};
     const shown = prev.shown && typeof prev.shown === 'object' ? { ...prev.shown } : {};
-    for (const l of inForce) {
+    // Charge every lesson actually rendered — full (inForce) or compact (compactExtras, folded into
+    // `shownThisCall` by buildLessonPresentation) — or a lesson permanently trimmed to the compact
+    // line by budget competition nags every qualifying event forever, uncounted.
+    for (const l of shownThisCall) {
       if (capExempt(l)) continue;
       shown[l.id] = (Number.isInteger(shown[l.id]) && shown[l.id] > 0 ? shown[l.id] : 0) + 1;
     }

package/plugin/scripts/lesson-presentation.mjs

@@ -93,6 +93,11 @@ export function buildLessonPresentation({
     inForce,
     blocking,
     blockCapable,
+    // Every lesson actually rendered to the user/model this call, full or compact — the frequency
+    // cap must charge both, or a lesson permanently trimmed to the compact line (e.g. it never wins
+    // the nudge budget against a higher-priority or cap-exempt lesson) nags on every qualifying event
+    // forever, uncounted, defeating RUVNET_LESSON_MAX_SHOWS the same way an uncapped full render would.
+    shown: [...inForce, ...compactExtras],
     body,
     advisoryContext: [...ADVISORY_APPLICATION_CONTRACT, body].join('\n'),
   };