ruvnet-brain 4.4.0 → 4.4.1

package/README.md

@@ -7,7 +7,7 @@ Created: 2026-06-29 22:36:38 EDT
 
 # 🧠 RuvNet Brain
 
-### 🧠 RuvNet Brain — [![RuvNet Brain version 4.4.0 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.4.0-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
+### 🧠 RuvNet Brain — [![RuvNet Brain version 4.4.1 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.4.1-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
 
 **A portable, source-grounded brain over Reuven Cohen's (rUv's) RuvNet stack — delivered as a Claude Code plugin that makes Claude _use_ the stack instead of fighting it.**
 

package/bin/install.mjs

@@ -72,6 +72,8 @@ import {
 } from '../scripts/console-runtime-identity.mjs';
 import { shellDiff as pluginShellDiff } from '../plugin/scripts/host-shell-boundary.mjs';
 import { readConsoleReceipts, replaceStaleConsoles } from '../scripts/console-instances.mjs';
+import { cleanLegacyRufloDebris } from '../plugin/scripts/project-progression-store.mjs';
+import { resolveProjectStore } from '../plugin/scripts/project-store-resolver.mjs';
 import { runHostCli, waitForHostCli } from '../scripts/host-cli.mjs';
 import {
   writeInstalledRuntimeIdentity, recordCorpusTransportIdentity, isCorpusReleaseTag, rejectedReleasePath,
@@ -1297,6 +1299,30 @@ export function withLiveConsoleState(recorded, { receiptDir, alive, probe } = {}
   return { ...recorded, consoleRuntime: live };
 }
 
+/**
+ * 4.3.40's ruflo leftovers inside this project's `.swarm` (cleanLegacyRufloDebris). --update removes
+ * them; --doctor only reports (dryRun). Either way a REFUSED artifact (unexpected contents, a symlink) is
+ * printed, never dropped silently. Not a project (or no .swarm): nothing to say.
+ */
+export function reportLegacyRufloDebris({ projectDir = process.cwd(), dryRun = false } = {}) {
+  let storeDir;
+  try { storeDir = path.dirname(resolveProjectStore({ projectDir }).canonicalAgentDbPath); } catch { return null; }
+  if (!fs.existsSync(storeDir)) return null;
+  const result = cleanLegacyRufloDebris(storeDir, { dryRun });
+  for (const entry of result.removed) {
+    // Dry run applies the same checks (allowlist, mirror proof, in-use window); only the final
+    // unchanged-since-proof comparison can still keep it at --update time.
+    if (dryRun) info(`legacy ruflo debris from 4.3.40 in ${entry}: passes every check; --update removes it unless it is written to before then`);
+    else ok(`removed legacy ruflo debris from 4.3.40: ${entry}`);
+  }
+  for (const { path: entry, reason, kept } of result.refused) {
+    // A KEPT nested AgentDB holds rows (or may still be written): never suggest deleting it by hand.
+    if (kept) warn(`left 4.3.40's nested ruflo store in place — ${entry}: ${reason}. It is checked again on every update.`);
+    else warn(`left legacy ruflo debris in place — ${entry}: ${reason}. Inspect it; remove it yourself if it is ruflo's.`);
+  }
+  return result;
+}
+
 export function consoleRestartState(identity, {
   receiptDir = path.join(process.env.RUVNET_BRAIN_HOME || path.join(os.homedir(), '.cache', 'ruvnet-brain'), 'console-instances'),
   alive, probe,
@@ -1463,17 +1489,22 @@ function wirePlugin({ expectedVersion = PACKAGE_VERSION, requireManaged = false
   const installedHookRetirement = claudeInstalledHookRetirementStatus({ plugin: installed });
   if (installed.installed && versionSatisfies(installed.version, expectedVersion) && installedHookRetirement.ok) {
     ok(`plugin installed at user scope (global, alongside Ruflo / RuVector) — exact version ${installed.version}`);
-    if (shellBoundary.restartRequired) {
-      warn(`boot-level plugin declarations changed; restart Claude Code once to load them (${shellBoundary.paths.join(', ') || shellBoundary.reason}).`);
+    if (shellBoundary.restartRequired && shellBoundary.known) {
+      info(`  boot-level plugin declarations changed (${shellBoundary.paths.join(', ')}): new Claude Code sessions load them; already-open windows keep the old hook definitions until they are reopened.`);
+    } else if (shellBoundary.restartRequired) {
+      warn(`could not verify the plugin's boot-level declarations (${shellBoundary.reason}); restart Claude Code once to be sure they are loaded.`);
     } else if (before.installed && before.version !== installed.version) {
       info('  body-only update: the Stable Spine is live on the next hook/MCP call; no restart is required.');
     }
-    info(`  commands available${shellBoundary.restartRequired ? ' after a restart' : ' immediately'}: ${c.bold('/rvbc')}, ${c.bold('/ruvnet-brain:configure')}`);
+    info(`  commands available${shellBoundary.restartRequired ? ' in new sessions' : ' immediately'}: ${c.bold('/rvbc')}, ${c.bold('/ruvnet-brain:configure')}`);
     return {
       host: true, wired: true, version: installed.version, manualMarketplace, manualInstall,
       shellChanged: shellBoundary.changed, shellChangedPaths: shellBoundary.paths,
       restartRequired: shellBoundary.restartRequired,
-      ...(shellBoundary.restartRequired ? { sessionSafety: 'restart-required', sessionSafetyReason: shellBoundary.reason } : {}),
+      // 'open-sessions': the new declarations are installed and PROVEN changed — only sessions already
+      // open booted the old ones. 'unproven': the boot surface could not be compared at all.
+      ...(shellBoundary.restartRequired ? { sessionSafety: 'restart-required', sessionSafetyReason: shellBoundary.reason,
+        restartScope: shellBoundary.known ? 'open-sessions' : 'unproven' } : {}),
     };
   }
 
@@ -2002,7 +2033,7 @@ export function wireCodexPlugin({
   if (announce) {
     ok(`Codex Brain plugin installed and enabled (${after.version || 'version unknown'}).`);
     if (shellBoundary.restartRequired) {
-      warn(`boot-level plugin declarations changed; restart Codex once to load them (${shellBoundary.paths.join(', ') || shellBoundary.reason}).`);
+      warn(`boot-level plugin declarations changed; restart Codex, then review them in /hooks (${shellBoundary.paths.join(', ') || shellBoundary.reason}).`);
     } else if (before.installed && before.version !== after.version) {
       info('  body-only update: the Stable Spine is live on the next hook/MCP call; no restart is required.');
     }
@@ -2017,6 +2048,10 @@ export function wireCodexPlugin({
     ...(shellBoundary.restartRequired ? {
       sessionSafety: 'restart-required',
       sessionSafetyReason: shellBoundary.reason,
+      // Never 'open-sessions' for Codex: changed hook definitions show as PENDING until reviewed in
+      // /hooks (doctor fails closed on pending trust; the SessionStart notice says to trust them), and no
+      // measurement shows a fresh Codex session running them without that step. Unproven = restart.
+      restartScope: 'unproven',
     } : {}),
   };
 }
@@ -2781,7 +2816,10 @@ async function doctor() {
       const recorded = withLiveConsoleState(JSON.parse(fs.readFileSync(convergencePath, 'utf8')),
         { receiptDir: path.join(path.dirname(convergencePath), 'console-instances') });
       hostConvergence = classifyHostConvergence(recorded);
-      if (hostConvergence.healthy) ok(`host convergence receipt: ${hostConvergence.state}`);
+      if (hostConvergence.healthy) {
+        ok(`host convergence receipt: ${hostConvergence.state}`);
+        if (hostConvergence.notice) info(hostConvergence.notice);
+      }
       else {
         warn(`host convergence incomplete: ${hostConvergence.state}`);
         info(`Retry the same generation: ${c.bold('npx ruvnet-brain --update')}${hostConvergence.action ? `; ${hostConvergence.action}` : ''}`);
@@ -2791,6 +2829,7 @@ async function doctor() {
       warn(`host convergence receipt is invalid: ${error.message}`);
     }
   }
+  try { reportLegacyRufloDebris({ dryRun: true }); } catch (error) { warn(`legacy ruflo debris check failed: ${error.message}`); }
   const brainHome = process.env.RUVNET_BRAIN_HOME || path.dirname(cacheDir);
   const nightlyHealth = schedulerStatus({ platform: process.platform, env: process.env,
     brainHome, kbDir: cacheDir });
@@ -3464,6 +3503,7 @@ export function syncHostsAfterUpdate(cacheDir = resolvedKbDir(), {
     codexReceipt.restartRequired = true;
     codexReceipt.sessionSafety = results.codex.sessionSafety || null;
     codexReceipt.sessionSafetyReason = results.codex.sessionSafetyReason || null;
+    codexReceipt.restartScope = results.codex.restartScope || 'unproven';
   }
   const claudeReceipt = {
     state: results.claude.host ? 'ready' : 'absent',
@@ -3473,6 +3513,7 @@ export function syncHostsAfterUpdate(cacheDir = resolvedKbDir(), {
     claudeReceipt.restartRequired = true;
     claudeReceipt.sessionSafety = results.claude.sessionSafety || null;
     claudeReceipt.sessionSafetyReason = results.claude.sessionSafetyReason || null;
+    claudeReceipt.restartScope = results.claude.restartScope || 'unproven';
   }
   if (okApplied) {
     // ISSUE #153 — a running host may freeze an old plugin root. Reclaim only generations whose
@@ -3563,9 +3604,16 @@ export function classifyHostConvergence(receipt, expectedVersion = PACKAGE_VERSI
     return { healthy: false, state: 'version-mismatch', action: `required version ${expectedVersion}` };
   }
   const hostStates = Object.values(receipt.hosts || {});
-  const badHost = hostStates.find((host) => !['ready', 'disabled', 'absent'].includes(host?.state)
+  // A host that is ready at the expected version and whose ONLY gap is PROVEN changed boot-level
+  // declarations is converged: new sessions load the new hooks; only windows already open booted the
+  // old ones (owner's Mac, 4.3.40 -> 4.4.0: a fresh `claude -p` loaded 4.4.0 and ran its hooks). That is
+  // reported, not failed. An UNPROVEN boot surface (it could not be compared) still requires a restart.
+  const openSessionsOnly = (host) => host?.state === 'ready' && versionSatisfies(host.version, expectedVersion)
+    && host.restartRequired === true && host.restartScope === 'open-sessions';
+  const openSessions = Object.entries(receipt.hosts || {}).filter(([, host]) => openSessionsOnly(host)).map(([name]) => name);
+  const badHost = hostStates.find((host) => !openSessionsOnly(host) && (!['ready', 'disabled', 'absent'].includes(host?.state)
     || (host.state === 'ready' && !versionSatisfies(host.version, expectedVersion))
-    || (host.state === 'ready' && host.restartRequired === true));
+    || (host.state === 'ready' && host.restartRequired === true)));
   if (badHost?.restartRequired === true) {
     return { healthy: false, state: 'host-restart-required', action: badHost.sessionSafetyReason || 'restart the host, then re-run --doctor' };
   }
@@ -3575,9 +3623,17 @@ export function classifyHostConvergence(receipt, expectedVersion = PACKAGE_VERSI
       ? `the installer could not replace the running Console (${receipt.consoleRuntime.replacementFailures.join('; ')}); ` : '';
     return { healthy: false, state: receipt.consoleRuntime?.state || 'console-unproven', action: `${why}restart Console, then re-run --doctor` };
   }
+  if (openSessions.length) return { healthy: true, state: 'channels-converged', openSessions, notice: openSessionsNotice(openSessions, receipt.desiredVersion) };
   return { healthy: true, state: 'channels-converged' };
 }
 
+const HOST_LABELS = { claude: 'Claude Code', codex: 'Codex' };
+/** The one accurate line for converged hosts whose already-open windows booted the old declarations. */
+export function openSessionsNotice(hosts, version) {
+  const names = hosts.map((host) => HOST_LABELS[host] || host).join('/');
+  return `new ${names} sessions use ${version}; already-open windows keep the old hook definitions until they are reopened`;
+}
+
 async function runUpdate() {
   printBanner('update');
   const kbDir = resolvedKbDir();
@@ -3590,6 +3646,7 @@ async function runUpdate() {
       process.exitCode = 1;
       return;
     }
+    if (convergence.convergence?.notice) info(convergence.convergence.notice);
     try {
       const managed = applyManagedCatalogUpdate({
         routerDir: path.join(os.homedir(), '.claude', 'model-router'),
@@ -3826,9 +3883,11 @@ async function runUpdate() {
     if (!convergence.ok) {
       warn(`host synchronization is incomplete — runtime stays on the prior verified generation${convergence.error ? ` (${convergence.error})` : ''}`);
       updateStatus = 1;
-    }
+    } else if (convergence.convergence?.notice) info(convergence.convergence.notice);
+    try { reportLegacyRufloDebris(); } catch (error) { warn(`legacy ruflo debris cleanup failed: ${error.message}`); }
     recordRefreshPhase(refreshReceipt, 'host-convergence', convergence.ok && convergence.convergence?.healthy === true ? 'PASS' : 'FAIL', {
       state: convergence.convergence?.state || null, error: convergence.error || null,
+      ...(convergence.convergence?.openSessions ? { openSessions: convergence.convergence.openSessions } : {}),
       execution: { kind: 'executed', runId: refreshReceipt.runId },
     });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.4.0",
+  "version": "4.4.1",
   "description": "One-command installer for RuvNet Brain \u2014 a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships a UserPromptSubmit retrieve-and-inject grounding hook and a PreToolUse write gate that refuses ungrounded rUv-product code until search_ruvnet has been consulted (ADR-0012 / ADR-067).",
-  "version": "4.4.0",
+  "version": "4.4.1",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.4.0",
+  "version": "4.4.1",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/scripts/grounding-turn-evidence.mjs

@@ -221,7 +221,7 @@ const RUV_SUBJECT = String.raw`(?<![\w/.@-])${RUV_PRODUCT}(?![\w-]|[./][\w])(?:(
 // ("rUv's tools turn …") — a lookbehind, so a rejected noun never consumes the real verb after it.
 // Not \b at the end: `support-ticket` is no verb.
 const PLURAL_NOUN = 'tools|packages|crates|plugins|libraries|hooks|agents|skills|servers|workers|daemons|commands|apis|clis|sdks|bindings|routers|gates|controllers';
-const VERBS = 'support|provide|expose|ship|offer|export|implement|include|allow|enable|accept|return|store|require|need|handle|route|record|persist|index|cache|spawn|create|generate|compute|sort|classif|scan|detect|block|prevent|replace|wrap|call|launch|keep|clamp|turn|give|make|run|use|take|let|write';
+const VERBS = 'support|provide|expose|ship|offer|export|implement|include|allow|enable|accept|return|store|require|need|handle|route|record|persist|index|cache|spawn|create|generate|compute|sort|classif|scan|detect|block|prevent|replace|wrap|call|launch|keep|clamp|turn|give|make|run|use|take|let|write|default';
 // "will not" is a capability claim only with a capability verb: "AgentDB will not open X" is, while
 // "Ruflo will not be touched by this patch" / "will not need a rebuild" report OUR change (4.4.0 nit).
 const WILL_NOT_VERBS = 'run|work|support|open|load|accept|start|install|handle|read|write|store|return|expose|allow|connect|recogni[sz]e|parse|build|compile|sync|scale|persist|import|export';
@@ -237,7 +237,20 @@ const RUV_DOC_CLAIM = new RegExp(`(?<![\\w/.@-])${RUV_PRODUCT}(?:(?:'|’)s)?(?:
 // "Ruflo is the orchestration layer and it has no hooks API": the pronoun refers back, in the same
 // sentence — only to a product that OPENS the sentence as its subject (a product inside a list or a
 // parenthetical is not what "they" means: "N-API builds (ruvector, rvf, …), so they don't depend…").
-const RUV_COREF_CLAIM = new RegExp(`^(?:the\\s+)?(${RUV_PRODUCT})(?![\\w-]|[./][\\w])(?:(?:'|’)s)?\\s+(?:(?:is|are)\\s+(?:a|an|the)\\b|has\\b|provides?\\b|ships?\\b)[^.;!?()]{0,80}?\\b(?:and|but|so|which|because)\\s+(?:it|they)\\s+(?:also\\s+|now\\s+|still\\s+|only\\s+)?${CAPABILITY_VERB}`, 'gi');
+// The opening subject phrase of a sentence: "The RuVector router package (`ruvector-router`)",
+// "RuVector's router", "Ruflo". Words stop at a copula; a parenthetical right after it is allowed.
+// OUR change to a product ("the ruflo upgrade", "the AgentDB write", "the ruflo fix") is not the product.
+const CHANGE_NOUN = 'upgrade|update|fix|change|patch|install|installation|write|read|call|run|release|build|migration|restart|bump|version|commit|test|tests|check|ci|job|workflow|step|lock|config|setting|settings|issue|bug|error|failure|outage|incident|pr|branch|diff|rollout|deploy|deployment';
+const OPENING_SUBJECT = String.raw`^(?:the\s+)?(${RUV_PRODUCT})(?![\w-]|[./][\w])(?:(?:'|’)s)?(?:\s+(?!(?:is|are|was|were|has|and|or|but|it|they|${CHANGE_NOUN})\b)[\w.@/-]+){0,4}?\s+(?:\([^)]{0,80}\)\s+)?`;
+const RUV_COREF_CLAIM = new RegExp(`${OPENING_SUBJECT}(?:(?:is|are)\\s+(?:a|an|the)\\b|has\\b|provides?\\b|ships?\\b|${CAPABILITY_VERB})[^.;!?]{0,200}?\\b(?:and|but|so|which|because)\\s+(?:it|they)\\s+(?:also\\s+|now\\s+|still\\s+|only\\s+)?${CAPABILITY_VERB}`, 'gi');
+// A DEFINITION is a capability claim too: "The RuVector router package (…) is a vector database …"
+// asserts what the product is and does (4.4.1, a live miss). Only as the sentence's opening subject,
+// and only "is a/an": "your ruflo is a version behind" (a status) does not open the sentence.
+const RUV_DEFINE_CLAIM = new RegExp(`${OPENING_SUBJECT}(?:is|are)\\s+(?:a|an)\\s+(?!(?:version|bit|few|lot|little|couple|day|week|month|commit|no-op|success|failure|regression|bug|fix|one-line|change|problem|mistake|non-issue|win|loss)s?\\b)\\w`, 'gi');
+// "this is agentic-qe's own static/heuristic estimate": a copula naming what the PRODUCT's output is.
+const RUV_COPULA_OWN_CLAIM = new RegExp(`\\b(?:this|that|it)\\s+is\\s+(${RUV_PRODUCT})(?![\\w-]|[./][\\w])(?:'|’)s\\s+own\\s+(?!(?:ci|tests?|build|pipeline|run|job|workflow|checks?|bug|failure|issue|repo|release|fault|problem|mistake|error)\\b)[\\w/-]+`, 'gi');
+// "is confirmed honored by the installed ruflo": the product as the passive AGENT of a behaviour.
+const RUV_PASSIVE_CLAIM = new RegExp(`\\b(?:is|are)\\s+(?:\\w+\\s+){0,2}?(?:honou?red|supported|handled|enforced|rejected|ignored|accepted|respected|read|parsed)\\s+by\\s+(?:the\\s+)?(?:installed\\s+|global\\s+|current\\s+)?(${RUV_PRODUCT})(?![\\w-]|[./][\\w])`, 'gi');
 // Not an assertion: a question, a hedge, a plan or hypothetical. Narrower than HEDGE above on purpose,
 // and narrower still since the 4.4.0 review (S2): "now", "if" and "will not" no longer silence a whole
 // sentence — "Ruflo now supports Windows natively", "RuVector cannot run on Windows, so if you need it
@@ -262,9 +275,40 @@ function isAssertion(s, m) {
   return !/^\s*(?:about\s+|around\s+|only\s+|~|≈)?\d/.test(s.slice(m.index + m[0].length));
 }
 
+// "## What AgentDB actually is" followed by "It's a SQLite database file …": the heading names the subject
+// and the section's sentence-initial "It" refers to it (4.4.1, a measured known miss).
+const DEFINING_HEADING = new RegExp(`^\\s*#{1,6}\\s+(?:what|how)\\s+(?:the\\s+)?(${RUV_PRODUCT})(?![\\w-])\\s+(?:(?:actually|really|even)\\s+)?(?:is|are|does|works?)\\b`, 'i');   // the product ITSELF, not "the ruflo fix"
+function bindHeadingPronouns(message) {
+  let subject = null;
+  return String(message || '').split('\n').map((line) => {
+    if (/^\s*#{1,6}\s/.test(line)) { subject = DEFINING_HEADING.exec(line)?.[1] ?? null; return line; }
+    if (!subject) return line;
+    return line.replace(/(^|[.!?]\s+)(?:\*\*)?It(?:'|’)s\b/g, `$1${subject} is`)
+      .replace(/(^|[.!?]\s+)(?:\*\*)?It\s+(?=(?:is|has|does|can|stores|runs|uses|keeps)\b)/g, `$1${subject} `);
+  }).join('\n');
+}
+// A table row whose FIRST cell is a product and whose other cells DESCRIBE it ("| AgentDB | Append-only
+// audit trail | Concurrent-write safe KB |") asserts what the product is. Only descriptive cells count:
+// letters only (no digits, hashes, dates or versions) and no status vocabulary — a status table about a
+// product ("| ruflo | 3.41.2 | PASS |", "| ruflo | No version at all … |") never qualifies.
+const STATUS_WORD = /\b(?:no|not|none|n\/a|missing|stale|behind|current|unverified|verified|pass(?:ed)?|fail(?:ed)?|yes|done|version|commit|ok|error|broken|pending|todo|skipped|live|shipped|absent|present|installed|upgraded|restarted|healthy|unhealthy|running|reachable|unreachable|updated|configured|enabled|disabled|failing|passing|green|red|removed|added|fixed|deployed|published|merged|stopped|started|restored|reset|rebuilt)\b/i;
+function productRowClaims(message) {
+  const claims = [];
+  for (const line of String(message || '').split('\n')) {
+    if (!/^\s*\|/.test(line) || /^\s*\|[\s:|-]+\|\s*$/.test(line)) continue;
+    const cells = line.split('|').slice(1, -1).map((c) => c.replace(/\*\*|__|`/g, '').trim());
+    const first = new RegExp(`^(${RUV_PRODUCT})$`, 'i').exec(cells[0] || '');
+    if (!first || cells.length < 2) continue;
+    const described = cells.slice(1).filter((c) => /^[A-Za-z][A-Za-z +/-]{3,80}$/.test(c) && c.split(/\s+/).length >= 2 && !STATUS_WORD.test(c));
+    if (described.length === cells.length - 1) claims.push({ text: line.trim(), match: `${first[1]} | ${described[0]}`, subject: first[1].toLowerCase() });
+  }
+  return claims;
+}
+
 /** The final answer's sentences (and table cells) that assert what a rUv product does. Never throws. */
 export function ruvCapabilityClaims(rawMessage) {
-  const text = String(rawMessage || '')
+  const rows = productRowClaims(String(rawMessage || '').replace(/```[\s\S]*?```/g, '\n'));
+  const text = bindHeadingPronouns(rawMessage)
     .replace(/```[\s\S]*?```/g, '\n')                    // command output and code are not prose claims
     .replace(/^\s*>.*$/gm, ' ')                          // quoted material
     .replace(/"[^"\n]{0,300}"|“[^”\n]{0,300}”/g, '\n')    // quoted speech: someone else's words (a break: it may carry the full stop)
@@ -272,11 +316,14 @@ export function ruvCapabilityClaims(rawMessage) {
     .replace(/^\s*#{1,6}\s.*$/gm, ' ')                   // headings name a topic
     .replace(/\*\*|__/g, '')
     .replace(/\|/g, '\n');                               // table cells judged one by one
-  const out = [];
+  const out = rows.slice(0, 8);
   for (const raw of text.split(/(?<=[.!?;])\s+|\n+|\s+[—–]\s+/)) {
+    if (out.length >= 8) break;
     const s = raw.replace(/^[\s\-*•#>\d.)]+/, '').trim();
     if (!s || s.length > 400 || NOT_RUV_ASSERTION.test(s)) continue;
-    const m = [...s.matchAll(RUV_CLAIM), ...s.matchAll(RUV_DOC_CLAIM), ...s.matchAll(RUV_COREF_CLAIM)].find((x) => isAssertion(s, x));
+    const m = [...s.matchAll(RUV_CLAIM), ...s.matchAll(RUV_DOC_CLAIM), ...s.matchAll(RUV_COREF_CLAIM), ...s.matchAll(RUV_DEFINE_CLAIM),
+      ...s.matchAll(RUV_COPULA_OWN_CLAIM), ...s.matchAll(RUV_PASSIVE_CLAIM)]
+      .find((x) => isAssertion(s, x));
     if (m) out.push({ text: s, match: m[0], subject: (m[1] || m[0]).trim().split(/\s+/)[0].replace(/(?:'|’)s$/, '').toLowerCase() });
     if (out.length >= 8) break;
   }

package/plugin/scripts/project-progression-reader.mjs

@@ -207,11 +207,13 @@ export function openProgressionReader(dbPath) {
   };
   let listStatement;
   let readStatement;
+  let allStatement;
   try {
     // Prepared eagerly so an unexpected schema (or a WAL image this process cannot read) is
     // reported as UNAVAILABLE now, before the caller has committed to the fast path.
     listStatement = prepare(`SELECT key FROM memory_entries WHERE ${ACTIVE_ROW_SQL} AND namespace = ? ORDER BY key`);
     readStatement = prepare(`SELECT content FROM memory_entries WHERE ${ACTIVE_ROW_SQL} AND namespace = ? AND key = ?`);
+    allStatement = prepare(`SELECT namespace, key, content FROM memory_entries WHERE ${ACTIVE_ROW_SQL} ORDER BY namespace, key`);
   } catch (error) {
     try { database.close(); } catch { /* the open failure is the news */ }
     throw error;
@@ -252,6 +254,14 @@ export function openProgressionReader(dbPath) {
       return content;
     },
 
+    /** Every active (namespace, key, content) row — bounded, never truncated (past the bound is an error). */
+    allRows({ maxRows = 100_000 } = {}) {
+      const rows = query(allStatement, []);
+      if (rows.length > maxRows) throw new ProgressionReaderUnavailable(`store holds more than ${maxRows} active rows`);
+      return rows.map((row) => ({ namespace: String(row.namespace ?? ''), key: String(row.key ?? ''),
+        content: typeof row.content === 'string' ? row.content : null }));
+    },
+
     close() {
       try { database.close(); } catch { /* closing a spent read handle is never news */ }
     },

package/plugin/scripts/project-progression-store.mjs

@@ -180,6 +180,145 @@ export function rufloCwdFor(storePath, { root = rufloScratchRoot() } = {}) {
   return ensurePrivateDir(path.join(root, projectKey));
 }
 
+/**
+ * 4.3.40 ran ruflo with cwd `<project>/.swarm`, so upgraded projects still hold ruflo's cwd artifacts
+ * INSIDE the store directory — including `.swarm/.swarm/hnsw.metadata.json`, a copy of snapshot content.
+ * Removes exactly those, and only when every path in them is one ruflo is known to write there; anything
+ * unexpected (or any symlink) leaves that artifact untouched and is REPORTED. The store itself
+ * (memory.db, -wal/-shm, schema.sql), the outbox and queue files are never candidates.
+ *
+ * The allowlist is measured, not guessed: real ruflo 3.49.0 run with cwd=<dir> and --path elsewhere
+ * writes .claude/{memory.db,.proven-config-version,proven-config.json} (init/store),
+ * .claude-flow/harness-active-policy.json and .swarm/{hnsw.index,hnsw.metadata.json} and ruvector.db
+ * (store), .claude-flow/policy/state.json (retrieve). The owner's real 4.3.40 projects also hold
+ * .swarm/.swarm/agentdb-memory.db(-wal,-shm): ruflo's AgentDB bridge opens <cwd>/.swarm/agentdb-memory.db
+ * (ruflo/v3/@claude-flow/cli/src/memory/memory-bridge.ts getAgentDbPath), and the native bindings drop
+ * ruvector.db into whatever cwd they run in (ruflo/scripts/smoke-memory-no-stray-db.mjs, ADR-125 Phase 7).
+ */
+const SQLITE = (name) => [name, `${name}-wal`, `${name}-shm`, `${name}-journal`];
+const LEGACY_CWD_ARTIFACTS = Object.freeze({
+  '.swarm': new Set(['hnsw.index', 'hnsw.metadata.json', ...SQLITE('agentdb-memory.db')]),
+  '.claude': new Set(['.proven-config-version', 'proven-config.json', ...SQLITE('memory.db')]),
+  '.claude-flow': new Set(['harness-active-policy.json', 'policy/', 'policy/state.json']),
+  'ruvector.db': null, // a regular file
+});
+
+/** Every path under `dir`, relative, directories with a trailing slash; symlinks reported, never followed. */
+function relativeEntries(dir) {
+  const out = [];
+  const walk = (current, prefix) => {
+    for (const name of fs.readdirSync(current)) {
+      const full = path.join(current, name);
+      const stat = fs.lstatSync(full);
+      const rel = prefix + name;
+      if (stat.isSymbolicLink()) out.push({ rel, link: true });
+      else if (stat.isDirectory()) { out.push({ rel: `${rel}/` }); walk(full, `${rel}/`); }
+      else out.push({ rel, file: stat.isFile() });
+    }
+  };
+  walk(dir, '');
+  return out;
+}
+
+/**
+ * With `dryRun`, reports what WOULD be removed and touches nothing (--doctor). Returns
+ * { removed: [paths], refused: [{ path, reason }] }; a refusal must be shown to the user, never dropped.
+ */
+const IN_USE_MS = 10 * 60_000;
+// The files that carry DATA: the database, its WAL and its rollback journal. Never -shm: it is the WAL
+// index, and every reader — including this proof's own read-only open — rewrites it. Counting it made
+// every real 4.3.40 store look "changed while it was being checked" (and "in use" on the next run).
+const dataFiles = (dbPath) => {
+  const base = path.basename(dbPath);
+  return [base, `${base}-wal`, `${base}-journal`];
+};
+const sqliteFingerprint = (dbPath) => dataFiles(dbPath).map((name) => {
+  try { const st = fs.statSync(path.join(path.dirname(dbPath), name)); return `${name}:${st.size}:${st.mtimeMs}`; }
+  catch { return `${name}:absent`; }
+});
+const sameFiles = (a, b) => a.join('|') === b.join('|');
+
+/**
+ * Is every active (namespace, key, content) row of a stray nested AgentDB present, byte-identical, in
+ * the canonical store? Read-only through the progression reader (node:sqlite, readOnly — no write, no
+ * checkpoint). Anything it cannot prove — recently written (in use), unreadable, a row missing or
+ * different — keeps the file and says why.
+ */
+export function proveMirrored(nestedDb, canonicalDb, { now = Date.now(), maxRows = 100_000 } = {}) {
+  const fingerprint = sqliteFingerprint(nestedDb);
+  const newest = Math.max(...dataFiles(nestedDb).map((name) => {
+    try { return fs.statSync(path.join(path.dirname(nestedDb), name)).mtimeMs; } catch { return 0; }
+  }));
+  if (now - newest < IN_USE_MS) return { ok: false, reason: `kept: agentdb-memory.db was written ${Math.round((now - newest) / 1000)}s ago (in use)` };
+  const nested = withProgressionReader(nestedDb, (reader) => reader.allRows({ maxRows }));
+  if (!nested.ok) return { ok: false, reason: `kept: agentdb-memory.db could not be read to prove it is mirrored (${nested.reason})` };
+  const canonical = withProgressionReader(canonicalDb, (reader) => reader.allRows({ maxRows }));
+  if (!canonical.ok) return { ok: false, reason: `kept: memory.db could not be read to prove agentdb-memory.db is mirrored (${canonical.reason})` };
+  const have = new Map(canonical.value.map((row) => [`${row.namespace}\u0000${row.key}`, row.content]));
+  const missing = nested.value.filter((row) => row.content === null || have.get(`${row.namespace}\u0000${row.key}`) !== row.content);
+  if (missing.length) return { ok: false, reason: `kept: ${missing.length} of ${nested.value.length} rows not in memory.db`, missing: missing.length };
+  return { ok: true, rows: nested.value.length, fingerprint };
+}
+
+export function cleanLegacyRufloDebris(storeDir, { dryRun = false, now = Date.now() } = {}) {
+  const removed = [];
+  const refused = [];
+  for (const [name, allowed] of Object.entries(LEGACY_CWD_ARTIFACTS)) {
+    const entry = path.join(storeDir, name);
+    let stat;
+    try { stat = fs.lstatSync(entry); } catch { continue; } // absent: nothing to do
+    if (stat.isSymbolicLink()) { refused.push({ path: entry, reason: 'symbolic link' }); continue; }
+    if (allowed === null) {
+      if (!stat.isFile()) { refused.push({ path: entry, reason: 'not a regular file' }); continue; }
+    } else {
+      if (!stat.isDirectory()) { refused.push({ path: entry, reason: 'not a directory' }); continue; }
+      const unknown = relativeEntries(entry).filter((item) => item.link || item.file === false || !allowed.has(item.rel))
+        .map((item) => (item.link ? `${item.rel} (symbolic link)` : item.rel));
+      if (unknown.length) { refused.push({ path: entry, reason: `unexpected entries: ${unknown.join(', ')}` }); continue; }
+    }
+    // A nested AgentDB is a real store (owner's projects: 1-41 rows, still written by open 4.3.40
+    // sessions). It goes only when every row is PROVEN present, identically, in the canonical memory.db.
+    const nestedDb = path.join(entry, 'agentdb-memory.db');
+    const mirror = name === '.swarm' && fs.existsSync(nestedDb) ? proveMirrored(nestedDb, path.join(storeDir, 'memory.db'), { now }) : null;
+    if (mirror && !mirror.ok) { refused.push({ path: entry, reason: mirror.reason, kept: true }); continue; }
+    if (!dryRun) {
+      // The proof is only valid for the bytes it read: anything written since means the file is in use.
+      if (mirror && !sameFiles(mirror.fingerprint, sqliteFingerprint(nestedDb))) {
+        refused.push({ path: entry, reason: 'kept: agentdb-memory.db changed while it was being checked (in use)', kept: true });
+        continue;
+      }
+      fs.rmSync(entry, { recursive: true, force: true });
+    }
+    removed.push(entry);
+  }
+  return { removed, refused };
+}
+
+// What ruflo leaves in a cwd (measured, ruflo 3.49.0): `.swarm/` (hnsw.index, hnsw.metadata.json — a
+// copy of every stored value), `.claude/`, `.claude-flow/`, `ruvector.db`. None of it is read back by the
+// product: every call carries --path, and the store of record is that file.
+const RUFLO_CWD_ARTIFACTS = Object.freeze(['.swarm', '.claude', '.claude-flow', 'ruvector.db']);
+const STALE_RUN_MS = 3_600_000;
+
+/**
+ * One ruflo invocation's working directory: a fresh private `run-*` directory inside the project's
+ * scratch dir, removed again by the caller after the call. ruflo copies every snapshot it touches into
+ * `<cwd>/.swarm/hnsw.metadata.json`; with one cwd per call that copy never accumulates (4.4.0 kept one
+ * per project that grew without bound and outlived the project). Also clears what 4.4.0 left directly
+ * in the project scratch dir and any `run-*` older than an hour (a call killed before its cleanup).
+ */
+export function rufloRunDir(storePath, { root = rufloScratchRoot(), now = Date.now() } = {}) {
+  const projectScratch = rufloCwdFor(storePath, { root });
+  for (const name of fs.readdirSync(projectScratch)) {
+    const entry = path.join(projectScratch, name);
+    let stat;
+    try { stat = fs.lstatSync(entry); } catch { continue; }
+    const stale = name.startsWith('run-') && stat.isDirectory() && now - stat.mtimeMs > STALE_RUN_MS;
+    if (RUFLO_CWD_ARTIFACTS.includes(name) || stale) fs.rmSync(entry, { recursive: true, force: true });
+  }
+  return fs.mkdtempSync(path.join(projectScratch, 'run-'));
+}
+
 export class ProjectProgressionStore {
   constructor({
     projectDir,
@@ -194,6 +333,9 @@ export class ProjectProgressionStore {
   } = {}) {
     if (!rufloBinary) throw new Error(RUFLO_MISSING);
     this.resolution = resolveProjectStore({ projectDir, requestedStorePath });
+    // Best effort: a cleanup that cannot run must never stop a capture or a restore.
+    try { this.legacyDebris = cleanLegacyRufloDebris(path.dirname(this.resolution.canonicalAgentDbPath)); }
+    catch (error) { this.legacyDebris = { removed: [], refused: [{ path: null, reason: error.message }] }; }
     this.rufloBinary = rufloBinary;
     this.runner = runner;
     this.clock = clock;
@@ -212,12 +354,17 @@ export class ProjectProgressionStore {
   }
 
   run(args) {
-    return this.runner(this.rufloBinary, args, {
-      cwd: rufloCwdFor(this.resolution.canonicalAgentDbPath),
-      encoding: 'utf8',
-      timeout: 120_000,
-      env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' },
-    });
+    const cwd = rufloRunDir(this.resolution.canonicalAgentDbPath);
+    try {
+      return this.runner(this.rufloBinary, args, {
+        cwd,
+        encoding: 'utf8',
+        timeout: 120_000,
+        env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' },
+      });
+    } finally {
+      fs.rmSync(cwd, { recursive: true, force: true });
+    }
   }
 
   validateSnapshot(snapshot) {

package/plugin/scripts/session-snapshot-hook.mjs

@@ -183,12 +183,12 @@ export function runSessionSnapshotHook(projectDir, event, {
     if (!handed && token && token !== ordered) releaseReplayLock(root, token);
     return { ...idle, replayed: 0, progressionCaptured: false, deferredToReplayer: Boolean(queued),
       replaySkipped: `${why}; this capture ${queued ? 'queued behind it' : 'NOT queued (queue unwritable)'}`
-        + `${queued ? (handed ? ', handed to a detached worker' : ' (a live worker holds the lock and drains the queue)') : ''}` };
+        + `${queued ? (handed ? ', handed to a detached worker' : ' (the current lock holder hands the queue to a worker when it releases)') : ''}` };
   };
   if (!ordered) {
     token = takeReplayLock(root);
     if (!token) return handOff('a worker is committing older work');
-    const queuedAhead = queuedCaptures(root).length;
+    const queuedAhead = queuedWork(root);
     if (queuedAhead) return handOff(`${queuedAhead} older capture(s) queued`);
     if (budgetMs < REPLAY_MIN_BUDGET_MS) {
       const pending = pendingCount();
@@ -207,6 +207,14 @@ export function runSessionSnapshotHook(projectDir, event, {
       } catch { /* the debt stays durable in the outbox; this capture is still worth attempting */ }
     }
 
+    // Before COMMITTING anything, re-check the lock is still ours: with three racers, a stale-lock
+    // put-back can leave a holder that no longer owns it. One that lost it queues itself instead.
+    if (!ordered && !refreshReplayLock(root, token)) {
+      token = null;
+      handedLock = true;   // nothing of ours to release
+      return handOff('the lock was taken over before this capture committed');
+    }
+
     let produced;
     try {
       produced = produce({ resolution, payload, host, trigger: event });
@@ -240,7 +248,16 @@ export function runSessionSnapshotHook(projectDir, event, {
       provenance: produced.provenance,
     };
   } finally {
-    if (!ordered && !handedLock) releaseReplayLock(root, token);
+    // A boundary that fired while this one held the lock queued itself and could not start a worker
+    // (this lock was in the way). Releasing without looking stranded it until the next boundary — two
+    // simultaneous SessionEnds lost the second one's final state (4.4.1). So: queued work → hand THIS
+    // lock to a worker; and re-check after releasing, for a boundary that queued in between.
+    if (!ordered && !handedLock) {
+      if (!(queuedWork(root) && spawnReplay({ projectDir: root, token }))) {
+        releaseReplayLock(root, token);
+        if (queuedWork(root)) spawnReplay({ projectDir: root });
+      }
+    }
   }
 }
 
@@ -253,44 +270,171 @@ export const REPLAY_LOCK_STALE_MS = 120_000;
 const REPLAY_LOCK = '.progression-replay.lock';
 const QUEUE_PREFIX = '.progression-capture-queue-';
 const lockPath = (projectDir) => path.join(projectDir, '.swarm', REPLAY_LOCK);
-const readLock = (projectDir) => { try { return fs.readFileSync(lockPath(projectDir), 'utf8').trim(); } catch { return null; } };
-let queueSeq = 0;
+// The lock's FIRST line is the owner token; a second `pid <n>` line names the process holding it.
+const readLock = (projectDir) => { try { return fs.readFileSync(lockPath(projectDir), 'utf8').split('\n')[0].trim(); } catch { return null; } };
+const CLAIM_PREFIX = '.progression-capture-claimed-';
+/** After this long a stale lock is taken over even if its holder pid looks alive (pid reuse, a wedged process). */
+export const REPLAY_LOCK_ABANDON_MS = 30 * 60_000;
 
-/** Queue one boundary's capture for the worker (0600, inside the project's own .swarm), in arrival order. */
-export function queueCapture({ projectDir, event, host, payload, now = Date.now() }) {
-  try {
-    queueSeq += 1;
-    const name = `${QUEUE_PREFIX}${String(now).padStart(15, '0')}-${String(process.hrtime.bigint() % 1_000_000_000n).padStart(9, '0')}-${process.pid}-${queueSeq}.json`;
-    const file = path.join(projectDir, '.swarm', name);
-    fs.writeFileSync(file, JSON.stringify({ event, host, payload }), { flag: 'wx', mode: 0o600 });
-    return file;
-  } catch { return null; }
+/** Is a process with this pid alive? EPERM means alive but not ours. Never throws. */
+export function pidAlive(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  try { process.kill(pid, 0); return true; } catch (error) { return error?.code === 'EPERM'; }
+}
+const seqOf = (name) => Number((/(\d{12})\.json$/.exec(name) || [])[1] ?? 0);
+const swarmEntries = (projectDir) => { try { return fs.readdirSync(path.join(projectDir, '.swarm')); } catch { return []; } };
+// 4.4.0 named queue files by wall clock: `<prefix><15-digit ms>-<hrtime>-<pid>-<n>.json`. Open 4.4.0
+// sessions keep queuing in that format after the update, so the two formats coexist for a while.
+const LEGACY_QUEUE = /^\d{15}-/;
+const queueTail = (name) => (name.startsWith(QUEUE_PREFIX) ? name.slice(QUEUE_PREFIX.length) : name.slice(CLAIM_PREFIX.length).replace(/^\d+-[A-Za-z0-9]*-\d+-/, ''));   // <pid>-<start>-<queuedAt>-
+const mtimeOf = (projectDir, name) => { try { return fs.statSync(path.join(projectDir, '.swarm', name)).mtimeMs; } catch { return Infinity; } };
+
+/**
+ * Queue one boundary's capture for the worker (0600, inside the project's own .swarm). ORDER IS THE
+ * ORDER OF EXCLUSIVE CREATION: the name is the next sequence number after every queued or claimed one,
+ * created with O_EXCL and retried on collision — never a clock, which can step backwards or wrap.
+ */
+export function queueCapture({ projectDir, event, host, payload }) {
+  const body = JSON.stringify({ event, host, payload });
+  for (let attempt = 0; attempt < 64; attempt += 1) {
+    const seq = Math.max(0, ...swarmEntries(projectDir).filter((n) => n.startsWith(QUEUE_PREFIX) || n.startsWith(CLAIM_PREFIX)).map(seqOf)) + 1;
+    const file = path.join(projectDir, '.swarm', `${QUEUE_PREFIX}${String(seq).padStart(12, '0')}.json`);
+    try { fs.writeFileSync(file, body, { flag: 'wx', mode: 0o600 }); return file; } catch (error) {
+      if (error?.code !== 'EEXIST') return null;
+    }
+  }
+  return null;
 }
 
+/**
+ * Unclaimed queued captures, in queue order. While any 4.4.0 (timestamp-named) entry is present the
+ * order is creation time (mtime, then name) — by NAME every 4.4.1 sequence file would sort before every
+ * 4.4.0 one, replaying newer captures before older ones across the upgrade window. Once the legacy
+ * entries are gone the order is the sequence alone, independent of any clock.
+ */
 export function queuedCaptures(projectDir) {
+  const all = swarmEntries(projectDir).filter((n) => (n.startsWith(QUEUE_PREFIX) || n.startsWith(CLAIM_PREFIX)) && n.endsWith('.json'));
+  const queued = all.filter((n) => n.startsWith(QUEUE_PREFIX));
+  const mixed = all.some((n) => LEGACY_QUEUE.test(queueTail(n)));
+  const ordered = mixed
+    ? queued.map((n) => [mtimeOf(projectDir, n), n]).sort((a, b) => a[0] - b[0] || (a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0)).map(([, n]) => n)
+    : queued.sort();
+  return ordered.map((n) => path.join(projectDir, '.swarm', n));
+}
+
+/** All older work a boundary must wait behind: unclaimed captures plus captures a worker has claimed. */
+export function queuedWork(projectDir) {
+  return swarmEntries(projectDir).filter((n) => (n.startsWith(QUEUE_PREFIX) || n.startsWith(CLAIM_PREFIX)) && n.endsWith('.json')).length;
+}
+
+/**
+ * A process's START TIME, as a filename-safe token, or null where it cannot be read (no `ps`, e.g.
+ * Windows). With the pid it identifies the process: a reused pid has a different start time.
+ */
+export function processStart(pid) {
   try {
-    return fs.readdirSync(path.join(projectDir, '.swarm')).filter((n) => n.startsWith(QUEUE_PREFIX) && n.endsWith('.json'))
-      .sort().map((n) => path.join(projectDir, '.swarm', n));
-  } catch { return []; }
+    // TZ and locale PINNED: `lstart` prints local time in the locale's format, so two workers with
+    // different settings would record the same live process differently and read it as pid reuse.
+    const r = spawnSync('ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8', timeout: 2000, windowsHide: true,
+      env: { ...process.env, TZ: 'UTC', LC_ALL: 'C', LANG: 'C' } });
+    const s = String(r.stdout || '').replace(/[^A-Za-z0-9]/g, '');
+    return r.status === 0 && s ? s : null;
+  } catch { return null; }
+}
+let selfStart;
+const ownStart = () => (selfStart === undefined ? (selfStart = processStart(process.pid)) : selfStart);
+
+/**
+ * Claim a queued capture by atomic rename; null if taken. The claim's name records pid, start time and
+ * the queue file's ORIGINAL mtime (its creation order, which the mixed upgrade window sorts by); the
+ * claim file's own mtime is then set to the claim time, from which the orphan ceiling counts.
+ */
+function claimQueued(file) {
+  let queuedAt = 0;
+  try { queuedAt = Math.floor(fs.statSync(file).mtimeMs); } catch { return null; }
+  const claimed = path.join(path.dirname(file), `${CLAIM_PREFIX}${process.pid}-${ownStart() || 'na'}-${queuedAt}-${path.basename(file).slice(QUEUE_PREFIX.length)}`);
+  try { fs.renameSync(file, claimed); } catch { return null; }
+  try { const t = new Date(); fs.utimesSync(claimed, t, t); } catch { /* the ceiling then counts from queue time: earlier, never later */ }
+  return claimed;
 }
+const unclaimedName = (claimed) => path.join(path.dirname(claimed), `${QUEUE_PREFIX}${queueTail(path.basename(claimed))}`);
+/** Put a claim back in the queue: rename (atomic, needs no hard links), restoring its creation order. */
+const returnClaim = (claimed) => {
+  const queuedAt = Number(path.basename(claimed).slice(CLAIM_PREFIX.length).split('-')[2]);
+  const back = unclaimedName(claimed);
+  try { fs.renameSync(claimed, back); } catch { return false; }
+  if (Number.isFinite(queuedAt) && queuedAt > 0) { try { const t = new Date(queuedAt); fs.utimesSync(back, t, t); } catch { /* best effort */ } }
+  return true;
+};
 
 /**
- * Take the lock. Returns this holder's TOKEN, or null when a live holder has it. A lock not refreshed
- * for REPLAY_LOCK_STALE_MS belongs to a dead worker and is taken over: renamed aside first, so two
- * would-be successors cannot both win the exclusive create.
+ * Return to the queue every claim whose worker is gone: its pid is dead, OR the pid now belongs to a
+ * different process (start time differs — pid reuse), OR the claim is older than REPLAY_LOCK_ABANDON_MS
+ * whatever the pid says (a reused pid where no start time can be read, a wedged worker). Without the
+ * last two a reused pid stranded a claim forever and every Stop spawned a worker that could not run it.
  */
-export function takeReplayLock(projectDir, now = Date.now()) {
+export function reclaimOrphans(projectDir, { isAlive = pidAlive, startOf = processStart, now = Date.now() } = {}) {
+  let n = 0;
+  for (const name of swarmEntries(projectDir).filter((x) => x.startsWith(CLAIM_PREFIX))) {
+    const [pidText, start] = name.slice(CLAIM_PREFIX.length).split('-');
+    const pid = Number(pidText);
+    const claimed = path.join(projectDir, '.swarm', name);
+    const abandoned = now - mtimeOf(projectDir, name) > REPLAY_LOCK_ABANDON_MS;
+    let gone = abandoned || !isAlive(pid);
+    if (!gone && start && start !== 'na') {
+      const current = startOf(pid);
+      gone = Boolean(current) && current !== start;
+    }
+    if (gone && returnClaim(claimed)) n += 1;
+  }
+  return n;
+}
+
+const lockFacts = (file) => { const st = fs.statSync(file); return { content: fs.readFileSync(file, 'utf8'), mtimeMs: st.mtimeMs, ino: st.ino }; };
+const sameFacts = (a, b) => a.content === b.content && a.mtimeMs === b.mtimeMs && a.ino === b.ino;
+/** The pid ACTUALLY holding a lock: the `pid <n>` line a worker writes for itself, else the token's pid. */
+const holderPid = (content) => {
+  const line = /^pid (\d+)$/m.exec(String(content));
+  return Number(line ? line[1] : String(content).trim().split('-')[0]);
+};
+
+/**
+ * Take the lock. Returns this holder's TOKEN (`<pid>-<time>-<random>`), or null.
+ *  • Free → exclusive create.
+ *  • Fresh (refreshed within REPLAY_LOCK_STALE_MS) → null.
+ *  • Stale but its holder pid is ALIVE → null until REPLAY_LOCK_ABANDON_MS: a laptop asleep mid-step,
+ *    or a long step, is not a dead worker, and taking over would put two workers on one job. The holder
+ *    pid is the WORKER's own (it rewrites the lock on start), not the hook that spawned it and exited.
+ *  • Otherwise taken over: the stale file is renamed aside and VERIFIED to be the very file judged
+ *    stale (content, mtime, inode). If a successor's fresh lock was moved instead (it took over between
+ *    our check and our rename), it is put back — never over a third lock — and we back off. One winner.
+ */
+export function takeReplayLock(projectDir, now = Date.now(), { isAlive = pidAlive, beforeRename = null } = {}) {
   const lock = lockPath(projectDir);
   const token = `${process.pid}-${now}-${Math.random().toString(36).slice(2, 10)}`;
-  const create = () => { fs.writeFileSync(lock, `${token}\n`, { flag: 'wx', mode: 0o600 }); return token; };
+  const create = () => { fs.writeFileSync(lock, `${token}\npid ${process.pid}\n`, { flag: 'wx', mode: 0o600 }); return token; };
   try { return create(); } catch { /* held, or stale */ }
-  try {
-    if (now - fs.statSync(lock).mtimeMs <= REPLAY_LOCK_STALE_MS) return null;
-    const aside = `${lock}.stale-${process.pid}-${now}`;
-    fs.renameSync(lock, aside);
-    fs.rmSync(aside, { force: true });
-    return create();
-  } catch { return null; }
+  let seen;
+  try { seen = lockFacts(lock); } catch { try { return create(); } catch { return null; } }
+  const age = now - seen.mtimeMs;
+  if (age <= REPLAY_LOCK_STALE_MS) return null;
+  if (age <= REPLAY_LOCK_ABANDON_MS && isAlive(holderPid(seen.content))) return null;
+  beforeRename?.();
+  const aside = `${lock}.stale-${token}`;
+  try { fs.renameSync(lock, aside); } catch { return null; }
+  let moved = null;
+  try { moved = lockFacts(aside); } catch { /* vanished */ }
+  if (!moved || !sameFacts(moved, seen)) {
+    // Put the successor's lock back without ever overwriting a third holder's: a hard link where the
+    // filesystem has them, else an exclusive copy.
+    try { fs.linkSync(aside, lock); } catch {
+      try { fs.copyFileSync(aside, lock, fs.constants.COPYFILE_EXCL); } catch { /* a third holder exists; the successor sees it lost the lock and stops */ }
+    }
+    try { fs.rmSync(aside, { force: true }); } catch { /* best effort */ }
+    return null;
+  }
+  try { fs.rmSync(aside, { force: true }); } catch { /* best effort */ }
+  try { return create(); } catch { return null; }
 }
 
 /** Heartbeat: refresh the lock's mtime if (and only if) this holder still owns it. */
@@ -299,6 +443,12 @@ export function refreshReplayLock(projectDir, token) {
   try { const t = new Date(); fs.utimesSync(lockPath(projectDir), t, t); return true; } catch { return false; }
 }
 
+/** A worker that inherited the lock records ITS OWN pid on it, keeping the owner token. */
+export function adoptReplayLock(projectDir, token) {
+  if (!token || readLock(projectDir) !== token) return false;
+  try { fs.writeFileSync(lockPath(projectDir), `${token}\npid ${process.pid}\n`, { mode: 0o600 }); return true; } catch { return false; }
+}
+
 /** Release ONLY a lock this holder owns; a successor's lock is never deleted. */
 export function releaseReplayLock(projectDir, token) {
   if (!token || readLock(projectDir) !== token) return false;
@@ -323,19 +473,22 @@ export function replayOutboxDetached({ projectDir, token = null, spawnFn = spawn
 }
 
 /**
- * The detached worker's body, holding the lock `token`: replay the outbox, then run every queued capture
- * IN ORDER — each re-entering the boundary as `ordered`, so it replays before it produces — refreshing
- * the lock between steps and STOPPING the moment the lock is no longer its own (a successor took it
- * over: running on would duplicate its work). Releases only its own lock, then re-checks for captures
+ * The detached worker's body, holding the lock `token`: record its own pid on the lock, return orphaned
+ * claims to the queue, replay the outbox, then run every queued capture IN ORDER — each CLAIMED by
+ * atomic rename first, so no other worker can run it too, and each re-entering the boundary as
+ * `ordered`, so it replays before it produces. Ownership is re-checked before every step and right
+ * after each claim; a worker that lost the lock puts an unstarted claim back and stops. A finished
+ * claim is the claimer's own and is deleted. Releases only its own lock, then re-checks for captures
  * queued while it held it.
  */
 export function runOutboxReplay({ projectDir, token = process.env.RUVNET_REPLAY_LOCK_TOKEN || null, budgetMs = DETACHED_REPLAY_BUDGET_MS,
-  makeStoreFactory = boundedStoreFactory, now = Date.now, runCapture = runSessionSnapshotHook } = {}) {
+  makeStoreFactory = boundedStoreFactory, now = Date.now, runCapture = runSessionSnapshotHook, onClaim = null } = {}) {
   let held = token || takeReplayLock(projectDir);
   let replayed = 0;
   for (let round = 0; held && round < 8; round += 1) {
     try {
-      if (!refreshReplayLock(projectDir, held)) return replayed;
+      if (!adoptReplayLock(projectDir, held)) return replayed;
+      reclaimOrphans(projectDir);
       const resolution = resolveProjectStore({ projectDir });
       const store = makeStoreFactory(now() + budgetMs)({ projectDir, requestedStorePath: resolution.canonicalAgentDbPath });
       for (const snapshot of store.outbox.pendingSnapshots()) {
@@ -345,19 +498,26 @@ export function runOutboxReplay({ projectDir, token = process.env.RUVNET_REPLAY_
       }
       for (const file of queuedCaptures(projectDir)) {
         if (!refreshReplayLock(projectDir, held)) return replayed;
+        const claimed = claimQueued(file);
+        if (!claimed) continue;
+        onClaim?.(claimed);
+        if (!refreshReplayLock(projectDir, held)) {
+          returnClaim(claimed);
+          return replayed;
+        }
         let job = null;
-        try { job = JSON.parse(fs.readFileSync(file, 'utf8')); } catch { /* torn: dropped below */ }
+        try { job = JSON.parse(fs.readFileSync(claimed, 'utf8')); } catch { /* torn: dropped below */ }
         try {
           if (job) runCapture(projectDir, job.event, { rawInput: JSON.stringify(job.payload), host: job.host,
             budgetMs, makeStoreFactory, now, ordered: held, writeMetadata: false,
             captureTurn: () => ({ recorded: false, skipped: 'detached replay' }) });
         } catch { /* a failed capture leaves its own snapshot durable in the outbox */ }
-        try { fs.rmSync(file, { force: true }); } catch { /* best effort */ }
+        try { fs.rmSync(claimed, { force: true }); } catch { /* best effort */ }
       }
     } catch { /* the debt stays durable; the next boundary hands it on again */ } finally {
       releaseReplayLock(projectDir, held);
     }
-    held = queuedCaptures(projectDir).length ? takeReplayLock(projectDir) : null;
+    held = queuedWork(projectDir) ? takeReplayLock(projectDir) : null;
   }
   return replayed;
 }

package/scripts/console-instances.mjs

@@ -37,12 +37,60 @@ export function probeRuntimeSync(port, timeoutMs = 1500) {
 
 export const sameIdentity = (left, right) => IDENTITY_KEYS.every((key) => left?.[key] === right?.[key]);
 
+const MONTHS = 'JanFebMarAprMayJunJulAugSepOctNovDec';
+/** When process `pid` started (epoch ms, UTC, 1 s resolution), or null when it cannot be read. */
+let clockTicks = null;
 /**
- * Console receipts in `receiptDir`, with dead ones pruned. A receipt is dead only when BOTH hold:
- * its pid is not alive, and its port does not answer /api/runtime with the receipt's identity.
- * A receipt with no integer pid cannot be proven dead and is kept (counted as before).
+ * Linux: boot-relative start (/proc/<pid>/stat field 22, clock ticks since boot) anchored at the kernel's
+ * boot time (/proc/stat btime) — not `ps lstart`, which a forward wall-clock jump would push later.
  */
-export function readConsoleReceipts(receiptDir, { alive = pidAlive, probe = probeRuntimeSync } = {}) {
+export function linuxProcessStartMs(pid, { readFile = fs.readFileSync, spawn = spawnSync } = {}) {
+  try {
+    const stat = String(readFile(`/proc/${pid}/stat`, 'utf8'));
+    const fields = stat.slice(stat.lastIndexOf(')') + 2).split(' '); // field 3 onward (comm may hold spaces)
+    const startTicks = Number(fields[22 - 3]);
+    const btime = Number(String(readFile('/proc/stat', 'utf8')).match(/^btime\s+(\d+)/m)?.[1]);
+    if (clockTicks === null) clockTicks = Number(String(spawn('getconf', ['CLK_TCK'], { encoding: 'utf8' })?.stdout || '').trim()) || 100;
+    if (!Number.isFinite(startTicks) || !Number.isFinite(btime)) return null;
+    return btime * 1000 + Math.round((startTicks * 1000) / clockTicks);
+  } catch { return null; }
+}
+
+export function processStartMs(pid, { spawn = spawnSync, platform = process.platform, readFile } = {}) {
+  if (!Number.isInteger(pid) || pid <= 0) return null;
+  if (platform === 'linux') {
+    const linux = linuxProcessStartMs(pid, { spawn, ...(readFile ? { readFile } : {}) });
+    if (linux !== null) return linux;
+  }
+  const run = process.platform === 'win32'
+    ? spawn('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command',
+      `$p=Get-Process -Id ${pid} -ErrorAction Stop; $p.StartTime.ToUniversalTime().ToString('ddd MMM d HH:mm:ss yyyy',[Globalization.CultureInfo]::InvariantCulture)`],
+    { encoding: 'utf8', windowsHide: true })
+    : spawn('ps', ['-p', String(pid), '-o', 'lstart='], { encoding: 'utf8', env: { ...process.env, TZ: 'UTC', LC_ALL: 'C', LANG: 'C' } });
+  if (run?.status !== 0) return null;
+  const m = String(run.stdout || '').trim().match(/^\w{3}\s+(\w{3})\s+(\d{1,2})\s+(\d{2}):(\d{2}):(\d{2})\s+(\d{4})$/);
+  if (!m || MONTHS.indexOf(m[1]) % 3 !== 0) return null;
+  return Date.UTC(+m[6], MONTHS.indexOf(m[1]) / 3, +m[2], +m[3], +m[4], +m[5]);
+}
+
+/**
+ * A live pid that is NOT the receipt's Console: the process now holding that pid started after the
+ * Console wrote its receipt (a Console's process always starts before it records startedAt). Two seconds
+ * of slack cover the 1 s resolution of the start time. Unreadable start time = not provably reused.
+ */
+export function pidReused(receipt, { startMs = processStartMs } = {}) {
+  const recorded = Date.parse(receipt?.startedAt || '');
+  const started = startMs(receipt?.pid);
+  return Number.isFinite(recorded) && Number.isFinite(started) && started > recorded + 2_000;
+}
+
+/**
+ * Console receipts in `receiptDir`, with dead ones pruned. A receipt is dead when its port does not
+ * answer /api/runtime with the receipt's identity AND either its pid is not alive or that pid now
+ * belongs to a process that started after the receipt was written (pid reuse). A busy live Console
+ * (pid alive, same process) is never pruned. A receipt with no integer pid cannot be proven dead.
+ */
+export function readConsoleReceipts(receiptDir, { alive = pidAlive, probe = probeRuntimeSync, startMs = processStartMs } = {}) {
   const live = [];
   const pruned = [];
   let names = [];
@@ -53,12 +101,17 @@ export function readConsoleReceipts(receiptDir, { alive = pidAlive, probe = prob
     let receipt;
     try { receipt = JSON.parse(fs.readFileSync(file, 'utf8')); } catch { continue; }
     if (receipt?.product !== PRODUCT || receipt.schema !== 1) continue;
-    if (Number.isInteger(receipt.pid) && receipt.pid > 0 && !alive(receipt.pid)) {
-      const answer = probe(receipt.port);
-      if (!answer || !sameIdentity(answer, receipt)) {
-        try { fs.unlinkSync(file); } catch { /* raced or read-only: still not a running Console */ }
-        pruned.push({ file, pid: receipt.pid, port: receipt.port ?? null, startedAt: receipt.startedAt ?? null });
-        continue;
+    if (Number.isInteger(receipt.pid) && receipt.pid > 0) {
+      const dead = !alive(receipt.pid);
+      const reused = !dead && pidReused(receipt, { startMs });
+      if (dead || reused) {
+        const answer = probe(receipt.port);
+        if (!answer || !sameIdentity(answer, receipt)) {
+          try { fs.unlinkSync(file); } catch { /* raced or read-only: still not a running Console */ }
+          pruned.push({ file, pid: receipt.pid, port: receipt.port ?? null, startedAt: receipt.startedAt ?? null,
+            reason: dead ? 'pid not alive' : 'pid reused by a process started after the receipt' });
+          continue;
+        }
       }
     }
     live.push({ file, receipt });
@@ -73,8 +126,13 @@ export function readConsoleReceipts(receiptDir, { alive = pidAlive, probe = prob
 // process plumbing. A denylist, so nothing the Console legitimately reads is silently lost.
 const CONSOLE_ENV_DENY = new Set(['RUVNET_NIGHTLY', 'RUVNET_BRAIN_TEST', 'RUVNET_BRAIN_TEST_LATEST_TAG', 'RUVNET_BRAIN_SCHEDULER_TEST',
   'RUVNET_BRAIN_IMPORT_ONLY', 'RUVNET_BRAIN_NO_UPDATE_FALLBACK', 'RUVNET_STRICT_INSTALL', 'RUVNET_REFRESH_RUN_TOKEN',
-  'RUVNET_REFRESH_RECEIPT', 'RUVNET_UPGRADE_NOTICE_FILE', 'NODE_OPTIONS', 'NODE_TEST_CONTEXT', 'INIT_CWD', 'CONSOLE_PORT']);
-const CONSOLE_ENV_DENY_PREFIX = /^(?:RUVNET_NIGHTLY_|npm_|VITEST)/;
+  'RUVNET_REFRESH_RECEIPT', 'RUVNET_UPGRADE_NOTICE_FILE', 'NODE_OPTIONS', 'NODE_TEST_CONTEXT', 'INIT_CWD', 'CONSOLE_PORT',
+  // The launching host session's own identity (the spine version it booted, the hook host, its Node).
+  'RUVNET_BRAIN_ACTIVE_VERSION', 'RUVNET_HOOK_HOST', 'RUVNET_NODE_BIN']);
+// CLAUDE* describes the Claude Code SESSION that ran the installer (CLAUDECODE, CLAUDE_PROJECT_DIR,
+// CLAUDE_PLUGIN_ROOT, CLAUDE_SESSION_ID, CLAUDE_CODE_*): stale for a long-lived Console. CLAUDE_CONFIG_DIR
+// is the user's configuration location, not session state, and is kept (host-update.mjs forwards it too).
+const CONSOLE_ENV_DENY_PREFIX = /^(?:RUVNET_NIGHTLY_|npm_|VITEST|CLAUDE(?!_CONFIG_DIR$))/;
 export function consoleEnv(env = process.env, port) {
   const clean = Object.fromEntries(Object.entries(env).filter(([key, value]) => value != null
     && !CONSOLE_ENV_DENY.has(key) && !CONSOLE_ENV_DENY_PREFIX.test(key)));

package/scripts/full-suite-gate.mjs

@@ -50,10 +50,17 @@ export function redFiles(report, quarantine, root = ROOT) {
  * assertion and stays RED. Matched on the failure text only, never the test title. */
 const VITEST_TIMEOUT = /\b(?:Test|Hook) timed out in \d+ ?ms\b/;
 const NUMERIC_BOUND = /\bexpected -?\d+(?:\.\d+)? to be (?:less|greater) than (?:or equal to )?-?\d+(?:\.\d+)?/;
-const DURATION_CUE = /\d ?ms\b|\bp9[59]\b|\btook\b|\belapsed\b|\bduration\b|\blatency\b|\bbudget\b|\bceiling\b|\btimeout\b/i;
+// A DURATION, stated: a number with a time unit, or a percentile. This alone binds a bound to time.
+const UNIT_CUE = /\d ?(?:ms|s|sec|seconds?)\b|\bp9[59]\b/i;
+// A duration WORD is weaker: "retries before timeout: expected 5 to be less than 3" is a count. A word
+// cue binds only a MEASURED value — a fractional left-hand number, which is what performance.now()-based
+// timings produce ("…the ceiling: expected 337.294918 to be less than 300"); integer counts stay RED.
+const WORD_CUE = /\b(?:took|elapsed|duration|latency|budget|ceiling|timeout)\b/i;
+const MEASURED = /\bexpected -?\d+\.\d+ to be (?:less|greater) than/;
 export const isTimingFailure = (message) => {
   const text = String(message || '').slice(0, 2000);
-  return VITEST_TIMEOUT.test(text) || (NUMERIC_BOUND.test(text) && DURATION_CUE.test(text));
+  return VITEST_TIMEOUT.test(text)
+    || (NUMERIC_BOUND.test(text) && (UNIT_CUE.test(text) || (WORD_CUE.test(text) && MEASURED.test(text))));
 };
 /** More flaky tests than this in one run fails the gate: load-sensitivity that wide is itself a defect. */
 export const MAX_FLAKY = 3;