ruvnet-brain 4.4.0 → 4.5.0

package/scripts/move-brain.mjs

@@ -0,0 +1,310 @@
+// move-brain.mjs — `npx ruvnet-brain --move-brain <dir>`: put the whole Brain on another disk with one
+// command, and `--move-brain --back` to bring it home.
+//
+// Design (decided 2026-10-01): the Brain stays addressed by its default path, ~/.cache/ruvnet-brain, which
+// becomes a symlink (a junction on Windows) to the new location. Every reader, hook, the MCP server and the
+// nightly keep their path and follow the link, so nothing else needs configuring (an env var would not reach
+// GUI-launched hosts or launchd). The move is: take the refresh lock the updater takes, preflight space, copy,
+// PROVE every source file arrived byte-identical, swap the link, then remove the old copy. Any failure before
+// the swap leaves the Brain exactly where it was and removes the copy; a failure DURING the swap is rolled
+// back step by step, and the message says plainly where the Brain is.
+//
+// What the proof ignores, and why (review S1/S2, reproduced on a real exFAT image 2026-10-01):
+//   - VOLUME METADATA, on either side. macOS writes an AppleDouble `._<name>` beside every copied file that
+//     has extended attributes on exFAT/FAT/NTFS/SMB, and volumes grow .DS_Store/.Spotlight-V100/.fseventsd/
+//     .Trashes. They are the filesystem's, not the Brain's (no release ships one; coverage-integrity skips
+//     `._*` too). So they are never copied — `--back` from exFAT used to bring `._ruvector.rvf` home, where
+//     every reader saw a fake `._ruvector` store — and never compared or required on either side.
+//   - TRANSIENT IPC in run/. A search worker's recommender socket (run/recommend-<pid>.sock) is a live
+//     endpoint, not data; a SIGKILLed worker leaves it behind. Stale ones are swept exactly as the endpoint
+//     sweeps them on start (kb/recommend-endpoint.mjs sweepStale — not shipped in the npm package, so the
+//     rule is repeated here and held equal by tests/unit/move-brain.test.mjs); live ones are not copied.
+//   Any other socket, FIFO or device anywhere in the Brain refuses the move by name, before anything is copied.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { brainLocation, defaultBrainHome } from '../plugin/scripts/brain-location.mjs';
+import { checkDiskSpace, directoryBytes } from '../kb/update-storage-transaction.mjs';
+import { acquireRefreshLock, releaseRefreshLock } from '../kb/refresh-run.mjs';
+
+// The plugin updater's own locks (plugin/scripts/update-apply.mjs, session-start-health.mjs). The refresh
+// lock (kb/refresh-run.mjs) is not merely checked: the move HOLDS it, so no update can start mid-move.
+const PLUGIN_LOCK_NAMES = ['.update.lock', 'auto-update.lock'];
+const linkType = process.platform === 'win32' ? 'junction' : 'dir';
+const VOLUME_METADATA = /^(?:\._.+|\.DS_Store|\.Spotlight-V100|\.fseventsd|\.Trashes|\.TemporaryItems|\.apdisk|System Volume Information|\$RECYCLE\.BIN)$/;
+const STALE_ENDPOINT = /^recommend-(\d+)\.(json|sock)$/;
+
+class MoveRefused extends Error {}
+export { MoveRefused };
+
+const refuse = (message) => { throw new MoveRefused(message); };
+const describe = (error) => (error?.code ? `${error.code}: ${error.message}` : String(error?.message || error));
+
+function isEmptyDir(dir) {
+  try { return fs.lstatSync(dir).isDirectory() && fs.readdirSync(dir).length === 0; } catch { return false; }
+}
+
+const pidAlive = (pid) => { try { process.kill(pid, 0); return true; } catch (e) { return e?.code === 'EPERM'; } };
+
+/** The endpoint's own stale rule (kb/recommend-endpoint.mjs sweepStale): a descriptor or socket whose pid is dead. */
+export function sweepStaleEndpoints(dir) {
+  let names = [];
+  try { names = fs.readdirSync(dir); } catch { return 0; }
+  let removed = 0;
+  for (const n of names) {
+    const m = n.match(STALE_ENDPOINT);
+    if (!m || pidAlive(Number(m[1]))) continue;
+    try { fs.rmSync(path.join(dir, n), { force: true }); removed++; } catch { /* raced */ }
+  }
+  return removed;
+}
+
+/**
+ * Walk a Brain tree without following links. Returns Map<relative, {type, size?, target?}> and the list of
+ * transient run/ entries (sockets/FIFOs) that are left behind. Any other special file refuses by name.
+ */
+function inventory(root, { strict = true } = {}) {
+  const entries = new Map();
+  const transient = [];
+  const walk = (rel) => {
+    for (const name of fs.readdirSync(path.join(root, rel)).sort()) {
+      const relative = rel ? path.join(rel, name) : name;
+      if (VOLUME_METADATA.test(name)) continue; // the volume's, not the Brain's (header)
+      const stat = fs.lstatSync(path.join(root, relative));
+      if (stat.isSymbolicLink()) entries.set(relative, { type: 'symlink', target: fs.readlinkSync(path.join(root, relative)) });
+      else if (stat.isDirectory()) { entries.set(relative, { type: 'dir' }); walk(relative); }
+      else if (stat.isFile()) entries.set(relative, { type: 'file', size: stat.size });
+      else if ((stat.isSocket() || stat.isFIFO()) && path.dirname(relative) === 'run') transient.push(relative);
+      else if (strict) refuse(`${path.join(root, relative)} is a ${stat.isSocket() ? 'socket' : stat.isFIFO() ? 'named pipe' : 'device or special file'}, `
+        + 'which cannot be copied to another disk. Stop whatever created it (or remove it if nothing is using it), then retry. Nothing was moved.');
+      else entries.set(relative, { type: 'special' });
+    }
+  };
+  walk('');
+  return { entries, transient };
+}
+
+function fileSha256(file) {
+  const hash = crypto.createHash('sha256');
+  const fd = fs.openSync(file, 'r');
+  try {
+    const buffer = Buffer.allocUnsafe(1 << 20);
+    for (let n; (n = fs.readSync(fd, buffer, 0, buffer.length, null)) > 0;) hash.update(buffer.subarray(0, n));
+  } finally { fs.closeSync(fd); }
+  return hash.digest('hex');
+}
+
+/**
+ * Every source entry must exist at the copy with the same type, and every file the same bytes; the copy may
+ * carry nothing else. Volume metadata is invisible to both inventories. Returns null, or what differs.
+ */
+export function verifyCopy(src, copy, { transient = [] } = {}) {
+  const skipped = new Set(transient);
+  const source = inventory(src, { strict: false }).entries;
+  const landed = inventory(copy, { strict: false }).entries;
+  const problems = [];
+  for (const [relative, entry] of source) {
+    if (skipped.has(relative)) continue;
+    const other = landed.get(relative);
+    if (!other) problems.push(`${relative} is missing from the copy`);
+    else if (other.type !== entry.type) problems.push(`${relative} is a ${other.type} in the copy but a ${entry.type} in the original`);
+    else if (entry.type === 'symlink' && other.target !== entry.target) problems.push(`link ${relative} points elsewhere in the copy`);
+    else if (entry.type === 'file' && (other.size !== entry.size || fileSha256(path.join(copy, relative)) !== fileSha256(path.join(src, relative)))) {
+      problems.push(`${relative} differs (${entry.size} bytes in the original, ${other.size} in the copy)`);
+    }
+  }
+  for (const relative of landed.keys()) {
+    if (!source.has(relative)) problems.push(`${relative} is in the copy but not in the original`);
+  }
+  return problems.length ? `${problems.slice(0, 3).join('; ')}${problems.length > 3 ? `; and ${problems.length - 3} more` : ''}` : null;
+}
+
+/** The default fs operations the swap uses — a seam so a test can make any one step fail. */
+export const defaultOps = Object.freeze({
+  renameSync: (a, b) => fs.renameSync(a, b),
+  symlinkSync: (target, link, type) => fs.symlinkSync(target, link, type),
+  rmdirSync: (dir) => fs.rmdirSync(dir),
+  mkdirSync: (dir) => fs.mkdirSync(dir),
+  rmSync: (dir) => fs.rmSync(dir, { recursive: true, force: true }),
+  copyTree: (src, dest, filter) => fs.cpSync(src, dest, { recursive: true, verbatimSymlinks: true, preserveTimestamps: true,
+    errorOnExist: true, force: false, filter }),
+});
+
+/**
+ * @param {{ home?: string, to?: string, back?: boolean, available?: Function, log?: Function, ops?: object,
+ *   lock?: Function }} options
+ * @returns {{ from: string, to: string, bytes: number, link: string, warnings: string[] }}
+ */
+export function moveBrain({ home = os.homedir(), to, back = false, available, log = () => {}, ops: opsOverride = {},
+  lock = (brainHome) => acquireRefreshLock({ kbDir: path.join(brainHome, 'kb'), brainHome, action: 'move-brain' }) } = {}) {
+  const ops = { ...defaultOps, ...opsOverride };
+  const brainHome = defaultBrainHome(home);
+  const where = brainLocation({ home });
+  if (where.state === 'unmounted') refuse(where.message);
+  if (where.state === 'absent') refuse(`no RuvNet Brain is installed at ${brainHome}; nothing to move.`);
+  const src = where.real;
+  for (const name of PLUGIN_LOCK_NAMES) {
+    if (fs.existsSync(path.join(src, name))) refuse(`an update is running (${path.join(src, name)}); retry when it finishes. Nothing was moved.`);
+  }
+
+  let dest;
+  if (back) {
+    if (where.state === 'local') refuse(`the Brain is already at its default location, ${brainHome}.`);
+    dest = brainHome;
+  } else {
+    if (!to || !path.isAbsolute(to)) refuse('--move-brain needs an absolute directory, e.g.  --move-brain /Volumes/SanDisk/ruvnet-brain');
+    dest = path.resolve(to);
+    if (dest === path.resolve(brainHome)) refuse('that is the default location; use  --move-brain --back  to return there.');
+    if (!fs.existsSync(path.dirname(dest))) refuse(`the target's parent ${path.dirname(dest)} does not exist (is the disk mounted?). Nothing was moved.`);
+    if (fs.existsSync(dest) && fs.realpathSync(dest) === src) refuse(`the Brain is already at ${dest}.`);
+    const rel = path.relative(src, dest);
+    if (!rel || (!rel.startsWith('..') && !path.isAbsolute(rel))) refuse('the target is inside the Brain itself.');
+    if (fs.existsSync(dest) && !isEmptyDir(dest)) refuse(`the target ${dest} exists and is not empty; choose a new or empty directory.`);
+    // The copy is staged beside the target and renamed into place, so the target must be a folder ON the disk,
+    // never the disk's own root: staging would land on the parent's filesystem (measured there, copied there).
+    if (fs.existsSync(dest) && fs.statSync(dest).dev !== fs.statSync(path.dirname(dest)).dev) {
+      refuse(`${dest} is the top of a disk; choose a folder on it, e.g.  --move-brain ${path.join(dest, 'ruvnet-brain')}`);
+    }
+  }
+
+  let held;
+  try { held = lock(brainHome); } catch (error) {
+    refuse(`an update is running or its lock is unclear (${describe(error)}); retry when it finishes. Nothing was moved.`);
+  }
+  try {
+    return moveLocked({ where, brainHome, src, dest, back, available, log, ops });
+  } finally {
+    // Through the default path: after a successful swap the held lock directory lives in the new copy.
+    if (held) releaseRefreshLock(held);
+  }
+}
+
+function moveLocked({ where, brainHome, src, dest, back, available, log, ops }) {
+  const warnings = [];
+  sweepStaleEndpoints(path.join(src, 'run'));
+  const { transient } = inventory(src); // refuses, by name, on any socket/FIFO/device outside run/
+  const bytes = directoryBytes(src);
+  const stagingDir = path.dirname(dest);
+  try {
+    const space = checkDiskSpace([{ dir: stagingDir, bytes, purpose: 'Brain copy' }],
+      { what: 'move the Brain', bigger: 'choose a folder on a bigger disk', ...(available ? { available } : {}) });
+    if (!space.ok) refuse(space.message);
+  } catch (error) {
+    if (error instanceof MoveRefused) throw error;
+    // Node < 18.15 has no fs.statfsSync; an unmeasurable disk is not a refusal. The copy is still verified,
+    // and running out of space part-way removes the copy and leaves the Brain where it was.
+    const line = `could not measure free space on ${stagingDir} (${describe(error)}); copying anyway — a full disk stops the move safely`;
+    warnings.push(line);
+    log(line);
+  }
+
+  const staging = path.join(stagingDir, `.${path.basename(dest)}.moving-${process.pid}`);
+  fs.rmSync(staging, { recursive: true, force: true });
+  const skip = new Set(transient.map((relative) => path.join(src, relative)));
+  log(`copying ${src} -> ${dest} …`);
+  try {
+    try { ops.copyTree(src, staging, (from) => !skip.has(from) && (from === src || !VOLUME_METADATA.test(path.basename(from)))); } catch (error) {
+      refuse(error?.code === 'ENOSPC'
+        ? `${stagingDir} ran out of space while copying. The partial copy was removed and the Brain is unchanged at ${src}.`
+        : `copying to ${stagingDir} failed (${describe(error)}). The partial copy was removed and the Brain is unchanged at ${src}.`);
+    }
+    const drift = verifyCopy(src, staging, { transient });
+    if (drift) {
+      refuse(`the copy does not match the original: ${drift}. Either a file changed while it was being copied (retry when no `
+        + `search or update is running) or ${stagingDir} did not store it faithfully. The copy was removed and the Brain is unchanged at ${src}.`);
+    }
+  } catch (error) {
+    fs.rmSync(staging, { recursive: true, force: true });
+    throw error;
+  }
+
+  swap({ where, brainHome, src, dest, staging, back, ops });
+  const landed = fs.realpathSync(brainHome);
+  // The previous copy goes only once the default path is proven to resolve to the new one.
+  const previous = back || where.state === 'linked' ? src : `${brainHome}.old-${process.pid}`;
+  try { if (fs.existsSync(previous)) ops.rmSync(previous); } catch (error) {
+    const line = `the previous copy at ${previous} could not be removed (${describe(error)}); it is no longer used — delete it by hand.`;
+    warnings.push(line);
+    log(line);
+  }
+  log(`the Brain now lives at ${landed}${back ? '' : ` (${brainHome} links to it)`}`);
+  return { from: src, to: landed, bytes, link: brainHome, warnings };
+}
+
+/**
+ * Point the default path at the verified copy. Every step is recorded and undone in reverse on failure, so
+ * the only outcomes are "moved" or "unchanged" — and the message says which, and what is left where.
+ */
+function swap({ where, brainHome, src, dest, staging, back, ops }) {
+  const undo = [];
+  const step = (name, run, revert) => { run(); undo.push({ name, revert }); };
+  const asideLink = `${brainHome}.link-old-${process.pid}`;
+  const tmpLink = `${brainHome}.link-${process.pid}`;
+  let failedAt = null;
+  let originalAt = src; // where the original Brain's bytes are right now (a local brain home is set aside mid-swap)
+  try {
+    if (back) {
+      failedAt = 'set the old link aside';
+      step(failedAt, () => ops.renameSync(brainHome, asideLink), () => ops.renameSync(asideLink, brainHome));
+      failedAt = `move the copy into ${brainHome}`;
+      step(failedAt, () => ops.renameSync(staging, brainHome), () => ops.renameSync(brainHome, staging));
+    } else {
+      if (isEmptyDir(dest)) {
+        failedAt = `replace the empty folder ${dest}`;
+        step(failedAt, () => ops.rmdirSync(dest), () => ops.mkdirSync(dest));
+      }
+      failedAt = `move the copy into ${dest}`;
+      step(failedAt, () => ops.renameSync(staging, dest), () => ops.renameSync(dest, staging));
+      failedAt = `create the link ${tmpLink}`;
+      fs.rmSync(tmpLink, { force: true });
+      step(failedAt, () => ops.symlinkSync(dest, tmpLink, linkType), () => fs.rmSync(tmpLink, { force: true }));
+      if (where.state === 'local') {
+        const old = `${brainHome}.old-${process.pid}`;
+        failedAt = `set ${brainHome} aside`;
+        step(failedAt, () => { ops.renameSync(brainHome, old); originalAt = old; },
+          () => { ops.renameSync(old, brainHome); originalAt = src; });
+        failedAt = `put the link at ${brainHome}`;
+        step(failedAt, () => ops.renameSync(tmpLink, brainHome), () => ops.renameSync(brainHome, tmpLink));
+      } else {
+        failedAt = `replace the link at ${brainHome}`;
+        try {
+          step(failedAt, () => ops.renameSync(tmpLink, brainHome), () => ops.renameSync(brainHome, tmpLink)); // atomic on POSIX
+        } catch (error) {
+          // Windows will not rename over an existing junction (EPERM/EEXIST): set the old link aside, then rename.
+          if (!['EPERM', 'EEXIST', 'EACCES', 'ENOTEMPTY', 'EISDIR'].includes(error?.code)) throw error;
+          failedAt = 'set the old link aside';
+          step(failedAt, () => ops.renameSync(brainHome, asideLink), () => ops.renameSync(asideLink, brainHome));
+          failedAt = `put the link at ${brainHome}`;
+          step(failedAt, () => ops.renameSync(tmpLink, brainHome), () => ops.renameSync(brainHome, tmpLink));
+        }
+      }
+    }
+    failedAt = `prove ${brainHome} resolves to ${dest}`;
+    const landed = fs.realpathSync(brainHome);
+    if (landed !== fs.realpathSync(dest)) throw new Error(`${brainHome} resolves to ${landed}`);
+  } catch (error) {
+    const unrestored = [];
+    for (const { name, revert } of undo.reverse()) {
+      try { revert(); } catch (revertError) { unrestored.push(`${name} (${describe(revertError)})`); }
+    }
+    // The staged copy is a verified duplicate; the original is intact either way, so it can always go.
+    let leftover = '';
+    try { fs.rmSync(staging, { recursive: true, force: true }); } catch { leftover = staging; }
+    try {
+      if (!leftover && !back && !isEmptyDir(dest) && fs.realpathSync(dest) !== fs.realpathSync(originalAt)) leftover = dest;
+    } catch { /* dest absent: nothing left there */ }
+    if (unrestored.length) {
+      refuse(`moving the Brain failed while trying to ${failedAt} (${describe(error)}), and undoing it also failed at: `
+        + `${unrestored.join('; ')}. The original Brain is intact at ${originalAt}; ${brainHome} must point to it again `
+        + '(make it a link to that folder, or move that folder back to it) before the Brain is used.'
+        + (leftover ? ` The unused copy at ${leftover} can be removed.` : ''));
+    }
+    // Undone: the default path is exactly as it was.
+    try { fs.rmSync(asideLink, { force: true }); } catch { /* only exists if a revert failed, reported above */ }
+    refuse(`moving the Brain failed while trying to ${failedAt} (${describe(error)}). Everything was put back: the Brain is `
+      + `unchanged at ${src}${where.state === 'linked' ? ` (${brainHome} links to it)` : ''}.`
+      + (leftover ? ` A copy at ${leftover} is not used and can be removed.` : ''));
+  }
+  try { fs.rmSync(asideLink, { force: true }); } catch { /* an unused old link; harmless */ }
+}

package/scripts/onboarding-console.mjs

@@ -48,7 +48,7 @@ import { inspectSessionSnapshots } from './session-snapshot-contract.mjs';
 import { learnings } from './learnings.mjs';
 import { gatesSurvey } from './gates.mjs';
 // The write-safety primitives, borrowed rather than re-implemented. See saveConfig for why.
-import { withLock, writeAtomic, LOCK_WAIT_MS, loadSettings, saveSettings, SETTINGS_SCHEMA as USER_SETTINGS_SCHEMA } from './user-settings.mjs';
+import { withLock, writeAtomic, LOCK_WAIT_MS, loadSettings, saveSettings, revertSettings, SETTINGS_SCHEMA as USER_SETTINGS_SCHEMA } from './user-settings.mjs';
 // The brain on/off switch (ADR-054). The sentinel is the enforcement artifact; settings.json holds
 // only a mirror. The console is the ONE surface allowed to flip it — protect-brain-state.sh walls
 // the file off from agent edits — so both halves of the write live here, in saveBrainPower().
@@ -68,6 +68,7 @@ import {
   openRouterCredentialStatus,
   saveOpenRouterCredential,
   learnerCwd,
+  loadRuntimePreferences,
 } from '../plugin/scripts/runtime-preferences.mjs';
 import { applyNightlyChoice, nightlyStatus } from './nightly-controller.mjs';
 // One canonical answer to "which directory is this, and have I counted it already?" — shared with
@@ -770,6 +771,30 @@ function gatherInventory() {
   };
 }
 
+/**
+ * Keys a project-level <project>/.swarm/ruvnet-brain-settings.json overrides FOR THE RUNTIME THAT
+ * READS IT. runtime-preferences merges that file over the user-level choices, and route-cheap, the
+ * managed-CLI gate (routing, qeFleet) and learn-capture/learn-flush (learningScope) obey the merge.
+ * The console saves user-level values only, so without this a project seeded by "Apply these choices
+ * to new projects" silently ignored every later change made here (RNBC QA 2026-10-01). Only keys whose
+ * consumer honours the project file are reported — advocacy, autoApply and provider are read at user
+ * level by their consumers, so a project value for them changes nothing and is not claimed to.
+ */
+const PROJECT_HONOURED_KEYS = Object.freeze(['routing', 'qeFleet', 'learningScope']);
+function projectOverrides(keys) {
+  try {
+    const prefs = loadRuntimePreferences({ cwd: process.cwd() });
+    if (!prefs.projectInherited) return null;
+    const raw = readJSON(prefs.paths.project) || {};
+    const values = raw.values && typeof raw.values === 'object' ? raw.values : raw;
+    const out = {};
+    for (const key of keys) {
+      if (PROJECT_HONOURED_KEYS.includes(key) && Object.hasOwn(values, key) && prefs.values[key] === values[key]) out[key] = values[key];
+    }
+    return Object.keys(out).length ? { path: prefs.paths.project.replace(CONSOLE_ROOT, '~'), values: out } : null;
+  } catch { return null; }
+}
+
 function gatherConfig() {
   const cfg = readJSON(CONFIG_PATH) || {};
   const credential = openRouterCredentialStatus({ cwd: process.cwd() });
@@ -797,6 +822,7 @@ function gatherConfig() {
     // What the project would pick FOR you, kept separate from what you actually picked. The form can
     // then say "recommended: on" without ever claiming that is the current state.
     defaults: { provider: 'auto', nightly: true, routing: 'auto', qeFleet: false },
+    projectOverrides: projectOverrides(CONFIG_SCHEMA.map((field) => field.key)),
     schema: CONFIG_SCHEMA.filter((field) =>
       !Object.hasOwn(CONFIG_CONTROL_SUPPORT, field.key)
       && (field.key !== 'nightly' || schedule.artifact.supported)),
@@ -841,6 +867,7 @@ function gatherAdvocacy() {
       Object.hasOwn(chosen, field.key) ? state.values[field.key] : null,
     ])),
     defaults: Object.fromEntries(LIVE_USER_FIELDS.map((field) => [field.key, field.default])),
+    projectOverrides: projectOverrides(LIVE_USER_SETTING_KEYS),
     schema: LIVE_USER_FIELDS,
     unavailable: [],
   };
@@ -880,8 +907,19 @@ function saveAdvocacy(values) {
   const result = saveSettings(supplied);
   if (!result.ok) return { ok: false, rejected: result.errors || [], log: result.log };
   publishSettingsToCache();
+  // THE SAVE IS REVERSIBLE FROM WHERE IT WAS MADE. The Settings card promises "every save is
+  // reversible", and saveSettings already writes the backup and the existedBefore flag its own
+  // revertSettings() consumes — but this form returned no undo token, so the console showed an Undo
+  // button for config.json and none here (RNBC QA 2026-10-01). Journalled only after the write.
+  const undoToken = journalUndo({
+    kind: 'restore-user-settings',
+    file: result.file,
+    backup: result.backup,
+    existedBefore: result.existedBefore,
+  });
   return {
     ok: true,
+    undoToken,
     backup: result.backup ? result.backup.replace(CONSOLE_ROOT, '~') : null,
     values: Object.fromEntries(LIVE_USER_SETTING_KEYS.map((key) => [key, result.values[key]])),
     log: result.log,
@@ -1113,6 +1151,14 @@ function publishSettingsToCache() {
     if (!c || !c.data || !c.data.sections) return;
     c.data.sections.config = gatherConfig();
     c.data.sections.userSettings = gatherAdvocacy();
+    // The Savings card reads two of the same choices (routing, and whether an OpenRouter key exists).
+    // Patching only Settings left the Savings card saying "No key added" / the old routing state on
+    // the next reload, beside a Settings card saying the opposite (RNBC QA 2026-10-01).
+    if (c.data.sections.savings) {
+      const cfgNow = readJSON(CONFIG_PATH) || {};
+      c.data.sections.savings.routing = cfgNow.routing === 'off' ? 'off' : cfgNow.routing === 'auto' ? 'auto' : null;
+      try { c.data.sections.savings.routerEngine = gatherRouterEngine(); } catch { /* the refresh replaces it */ }
+    }
     writeCache(STATE_CACHE, new Date(0).toISOString(), c.data, c.scope ?? null);
   } catch { /* the authoritative stores are already correct; refresh will replace an unreadable cache */ }
 }
@@ -1199,7 +1245,13 @@ function gatherLessons() {
     const trig = TRIGGER_BY_KEY.get(l.trigger);
     const meaning = ENFORCEMENT_MEANING[l.enforcement] || { label: l.enforcement, detail: '' };
     const userStated = l.origin === ORIGIN.USER_STATED && l.sourceClass === SOURCE_CLASS.CURRENT_USER;
-    const quarantined = l.sourceClass === SOURCE_CLASS.IMPORTED_OWNER || l.sourceClass === SOURCE_CLASS.DEMONSTRATION;
+    // Quarantine is about whether history can BECOME policy, so it applies to an imported row that
+    // was never ratified. A row that WAS ratified is delivered by lessonsFor() today whatever its
+    // source class — RNBC QA 2026-10-01 measured 12 such rows filed here as "quarantined, cannot be
+    // switched on" behind a checked, disabled box while the gate enforced every one of them. A rule in
+    // force must be reported in force and must keep a working off switch.
+    const importedClass = l.sourceClass === SOURCE_CLASS.IMPORTED_OWNER || l.sourceClass === SOURCE_CLASS.DEMONSTRATION;
+    const quarantined = importedClass && l.status !== STATUS.RATIFIED && l.status !== STATUS.ACTIVE;
     const origin = l.sourceClass === SOURCE_CLASS.CURRENT_USER
       ? 'you taught me this'
       : l.sourceClass === SOURCE_CLASS.IMPORTED_OWNER
@@ -1234,7 +1286,7 @@ function gatherLessons() {
       // Honest ceiling: ratifying a model-inferred lesson can NOT raise it to block
       // (lesson-store.mjs:380). Say so before they click, not after.
       canReachBlock: userStated,
-      canRatify: !quarantined,
+      canRatify: !importedClass,
       intendedEnforcement: l.intendedEnforcement || null,
     };
   });
@@ -1969,8 +2021,12 @@ function gatherRouterEngine() {
   const cfg = readJSON(CONFIG_PATH) || {};
   // User-constraint detection (Brain-side by design — a fact about THIS user, not routing logic):
   // an OpenRouter key decides whether metered cross-provider candidates are even reachable.
-  let openrouterKey = !!process.env.OPENROUTER_API_KEY;
-  if (!openrouterKey) openrouterKey = !!(cfg.openrouterKey && String(cfg.openrouterKey).length > 8);
+  // The SAME reader the Settings card uses (env → SOPS+age store → legacy plaintext). This read only
+  // env + plaintext, so a key saved through Settings (encrypted, plaintext retired) showed "No key
+  // added" here under a Settings row saying "•••• set" (RNBC QA 2026-10-01).
+  let openrouterKey = false;
+  try { openrouterKey = openRouterCredentialStatus({ cwd: process.cwd() }).configured === true; }
+  catch { openrouterKey = !!process.env.OPENROUTER_API_KEY || !!(cfg.openrouterKey && String(cfg.openrouterKey).length > 8); }
   // House (issue #21): three mechanisms used to disagree — Settings wrote config.json's `provider`,
   // but the chip strip derived "yours" from whichever pool candidate happened to be
   // subscriptionCovered first, sourced from profile.json (a file nothing in the console writes). The
@@ -2383,7 +2439,7 @@ function gatherStack() {
   const rows = a.rows.map((r) => ({ name: r.name, installed: r.installed, target: r.target, tag: r.tag, state: r.state, source: r.source ?? 'npm-global', marketplace: r.marketplace ?? null }));
   const shadows = a.shadows.map((s) => ({ name: s.name, version: s.version, global: s.global, dir: String(s.dir).replace(SYSTEM_HOME, '~'), stale: !!(s.global && s.version !== s.global) }));
   const by = (st) => rows.filter((r) => r.state === st).length;
-  const summary = { total: rows.length, behind: by('BEHIND'), broken: by('BROKEN'), ahead: by('AHEAD'), current: by('CURRENT'), unresolved: by('UNRESOLVED'), shadows: shadows.length, stale: a.stale.length };
+  const summary = { total: rows.length, behind: by('BEHIND'), broken: by('BROKEN'), ahead: by('AHEAD'), current: by('CURRENT'), unresolved: by('UNRESOLVED'), unverified: by('INSTALLED_UNVERIFIED'), shadows: shadows.length, stale: a.stale.length };
   const recommendations = buildStackRecommendations({ rows: a.rows, stale: a.stale });
   const result = { error: a.error, packages: rows, shadows, summary, recommendations };
   // Cache the last good audit so repeat page-loads render instantly ("as of HH:MM — re-checking").
@@ -2708,7 +2764,12 @@ function saveConfig(values) {
     credentialChange = saveOpenRouterCredential(requestedSecret, { cwd: process.cwd() });
     if (!credentialChange.ok) return { ok: false, rejected, log: credentialChange.log };
   }
-  if (requestedNightly !== undefined) {
+  // The page sends every field the person has ever chosen, so changing only the model house carries the
+  // already-saved nightly value with it. Re-running the installer for a choice the scheduler already
+  // satisfies rewrote the plist and re-registered the runner on every unrelated save (RNBC review
+  // 2026-10-01). Only a request that differs from the measured scheduler state is a scheduler change; a
+  // degraded or unknown state still goes to the installer, which is how it gets repaired.
+  if (requestedNightly !== undefined && nightlyStatus().state !== (requestedNightly ? 'on' : 'off')) {
     nightlyChange = applyNightlyChoice(requestedNightly);
     if (!nightlyChange.ok) {
       rollbackCredential();
@@ -2809,6 +2870,10 @@ function undo(undoToken) {
   if (!fs.existsSync(UNDO_JOURNAL)) return { ok: false, log: 'no undo history' };
   const journal = readUndoJournal();
   const entry = journal.find((e) => e.token === undoToken);
+  // "Saved again after this point" is decided by POSITION in the append-only journal, never by the `at`
+  // stamp: it has millisecond resolution and two saves do land in the same millisecond (a Linux runner,
+  // 2026-10-01), which made the later save invisible and let a stale undo wipe it.
+  const savedLater = (kind) => journal.slice(journal.indexOf(entry) + 1).some((e) => e.kind === kind && e.token && e.token !== undoToken);
   if (!entry) return { ok: false, log: 'that undo token was not found' };
 
   // ONE UNDO, ONCE. The token was never consumed, so the same button replayed forever: clicking it
@@ -2829,7 +2894,7 @@ function undo(undoToken) {
     // An undo can only speak for the last write. If something was written after it, the honest answer
     // is to refuse and say so — restoring anyway would be destroying newer data while claiming to
     // protect older data.
-    const laterSave = journal.some((e) => e.kind === 'restore-config' && e.at > entry.at && e.token !== undoToken);
+    const laterSave = savedLater('restore-config');
     if (laterSave) {
       return { ok: false, log: 'your settings were saved again after this point, so this undo would wipe out that newer save — nothing was changed. Use the undo from the most recent save, or restore a backup by hand.' };
     }
@@ -2869,6 +2934,19 @@ function undo(undoToken) {
     }
     return { ok: false, log: 'no backup available to restore' };
   }
+  if (entry.kind === 'restore-user-settings') {
+    // Same "an undo speaks only for the last write" rule as restore-config: a later save through this
+    // form would be wiped out by restoring an older backup.
+    const laterSave = savedLater('restore-user-settings');
+    if (laterSave) {
+      return { ok: false, log: 'your settings were saved again after this point, so this undo would wipe out that newer save — nothing was changed. Use the undo from the most recent save.' };
+    }
+    const r = revertSettings({ file: entry.file, backup: entry.backup || undefined, existedBefore: entry.existedBefore });
+    if (!r.ok) return { ok: false, log: r.log };
+    markUndoConsumed(undoToken);
+    publishSettingsToCache();
+    return { ok: true, log: entry.backup ? 'restored your previous settings' : 'removed the settings file (there was none before this save)' };
+  }
   // EVERY branch below marks its token consumed on success, for the reason spelled out on the
   // restore-config branch above: these all copy a saved snapshot over a live file, so replaying one
   // re-applies an old state over whatever the user has done since. The replay guard at the top of
@@ -2953,7 +3031,7 @@ function undo(undoToken) {
 // The undo kinds this function actually implements. Exported so the closure test can check the
 // registry against the REAL handler set rather than a hand-copied list that would drift from it.
 export const HANDLED_UNDO_KINDS = Object.freeze([
-  'restore-config', 'reinstall-version', 'restore-backup',
+  'restore-config', 'restore-user-settings', 'reinstall-version', 'restore-backup',
   'restore-memory-backup', 'restore-store-backups', 'restore-project-distill', 'auto-rebuild', 'none',
 ]);
 
@@ -2962,7 +3040,10 @@ const MIME = { '.html': 'text/html; charset=utf-8', '.js': 'text/javascript; cha
 function serveStatic(req, res) {
   const rel = decodeURIComponent(req.url.split('?')[0]).replace(/^\/+/, '') || 'index.html';
   const file = path.join(CONSOLE_DIR, rel);
-  if (!file.startsWith(CONSOLE_DIR) || !fs.existsSync(file) || fs.statSync(file).isDirectory()) return send(res, 404, 'text/plain', 'not found');
+  // Containment by path, not by string prefix: `startsWith(CONSOLE_DIR)` also accepted a sibling such
+  // as `<root>/console-anything/…` reached with an encoded `..` (RNBC review 2026-10-01).
+  const inside = path.relative(CONSOLE_DIR, file);
+  if (!inside || inside === '..' || inside.startsWith(`..${path.sep}`) || path.isAbsolute(inside) || !fs.existsSync(file) || fs.statSync(file).isDirectory()) return send(res, 404, 'text/plain', 'not found');
   let body = fs.readFileSync(file);
   const ext = path.extname(file);
   if (ext === '.html') body = Buffer.from(String(body).replace('</head>', `<script>window.__CONSOLE_TOKEN__=${JSON.stringify(TOKEN)}</script></head>`));
@@ -3444,6 +3525,8 @@ export {
   saveBrainPower,
   gatherBrainProfile,
   saveBrainProfile,
+  setLesson,
+  gatherLessons,
   gatherRouterEngine,
   autoEligibleIds,
   gatherConfig,

package/scripts/oracle/abstain-threshold-sweep.mjs

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+/**
+ * scripts/oracle/abstain-threshold-sweep.mjs — what would moving the abstain threshold do?
+ *
+ * The product abstains when the top cross-encoder logit is below 0. The threshold is applied AFTER
+ * scoring, so replaying a measured run at another threshold t is exact for the top citation: no
+ * model is re-run. For each t it reports, with 95% Wilson intervals:
+ *   (abstained = no citation, or a numeric top logit < t -- the rule both harnesses apply)
+ *   needs        confident hits (gold or pre-registered alternative within 5 AND top logit >= t),
+ *                confident misses (top logit >= t but neither within 5), their precision, and how
+ *                many confident answers at least cite the gold repository first
+ *   offTopic     adversarial questions still abstained (no citation, or top logit < t)
+ *   heldOut      routed passes of the named/described/scenario strata (grounded AND routed AND
+ *                a citation with logit >= t), the gated eval-brain metric
+ *
+ *   node scripts/oracle/abstain-threshold-sweep.mjs --needs <needs.json> --adversarial <adversarial.json>
+ *     --heldout <heldout.json> [--thresholds 0,-1,-2,-3,-4] [--out <file>]
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { wilson } from '../eval-brain.mjs';
+
+const rate = (k, n) => { const w = wilson(k, n); return { k, n, p: +w.p.toFixed(4), lo: +w.lo.toFixed(4), hi: +w.hi.toFixed(4) }; };
+const within5 = (r) => (r.fileRank != null && r.fileRank <= 5) || (r.altFileRank != null && r.altFileRank <= 5);
+
+export function sweep({ needs = [], adversarial = [], heldout = [] }, thresholds) {
+  return thresholds.map((t) => {
+    // The abstain rule both harnesses apply (measure-need-set scoreRow, eval-brain gradeQuestion): no
+    // citation, or a NUMERIC top logit below the threshold. A citation without a logit (a card answer)
+    // is not an abstention.
+    const answered = (cited, ce) => Boolean(cited) && !(typeof ce === 'number' && ce < t);
+    const confident = needs.filter((r) => answered(r.cited, r.topCe));
+    const hits = confident.filter(within5).length;
+    const routedRows = heldout.filter((r) => ['named', 'described', 'scenario'].includes(r.stratum));
+    return {
+      threshold: t,
+      needs: { confidentHit: rate(hits, needs.length), confidentMiss: rate(confident.length - hits, needs.length),
+        precision: rate(hits, confident.length),
+        // Weaker than a file hit: the top citation is at least from the gold repository.
+        confidentRightRepo: rate(confident.filter((r) => r.repoRank === 1).length, confident.length) },
+      offTopicAbstain: rate(adversarial.filter((r) => !answered(r.citedPath, r.ce)).length, adversarial.length),
+      heldOutRouted: rate(routedRows.filter((r) => r.grounded && r.routed && answered(r.citedPath, r.ce)).length, routedRows.length),
+    };
+  });
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  const arg = (n) => { const i = args.indexOf(n); return i >= 0 ? args[i + 1] : undefined; };
+  const read = (f) => (f ? JSON.parse(fs.readFileSync(f, 'utf8')).rows : []);
+  const thresholds = String(arg('--thresholds') || '0,-0.5,-1,-1.5,-2,-3,-4').split(',').map(Number);
+  const out = { kind: 'ruvnet-brain-abstain-threshold-sweep',
+    rows: sweep({ needs: read(arg('--needs')), adversarial: read(arg('--adversarial')), heldout: read(arg('--heldout')) }, thresholds) };
+  if (arg('--out')) fs.writeFileSync(arg('--out'), `${JSON.stringify(out, null, 1)}\n`);
+  const f = (m) => `${m.k}/${m.n} [${(100 * m.lo).toFixed(1)}-${(100 * m.hi).toFixed(1)}]`;
+  for (const r of out.rows) {
+    console.log(`t=${r.threshold}: needs hit ${f(r.needs.confidentHit)} miss ${f(r.needs.confidentMiss)} precision ${f(r.needs.precision)} right-repo ${f(r.needs.confidentRightRepo)} | off-topic abstain ${f(r.offTopicAbstain)} | held-out routed ${f(r.heldOutRouted)}`);
+  }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) await main();