ruvnet-brain 4.7.17 → 4.7.19

package/README.md

@@ -9,7 +9,7 @@ Created: 2026-06-29 22:36:38 EDT
 
 ### Discover the stack. Read the source. Build with confidence.
 
-[![RuvNet Brain version 4.6.2 — README updated 2026-10-10 EDT](https://img.shields.io/badge/version_4.7.17-updated_2026--10--10_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](plugin/.claude-plugin/plugin.json)
+[![RuvNet Brain version 4.6.2 — README updated 2026-10-10 EDT](https://img.shields.io/badge/version_4.7.19-updated_2026--10--10_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](plugin/.claude-plugin/plugin.json)
 
 **A source-grounded companion for Claude Code and Codex that helps you find and use Reuven Cohen's (rUv's) RuvNet ecosystem.**
 
@@ -255,7 +255,7 @@ uses the protected release workflow; a consumer update downloads an available ge
 does not rebuild upstream knowledge. Check `--doctor`, `SOURCE.json` and refresh receipts
 before treating an installation as current.
 
-The **4.6.0 published-corpus baseline** is **205 public stores · 165,153 public source chunks**.
+The **4.6.0 published-corpus baseline** is **205 public stores · 165,488 public source chunks**.
 Those are bundle census values, not a claim that every upstream repository is fresh today.
 Later corpus publication may advance the knowledge generation independently of code changes.
 

package/bin/install.mjs

@@ -2028,25 +2028,53 @@ export function codexMarketplaceRows(value) {
   return Array.isArray(value) ? value : [];
 }
 
-function runCodexJson(args, {
+// Codex refuses EVERY plugin command while any configured marketplace snapshot fails to load, including one that is
+// not the Brain's. Measured 2026-10-23: a 7:21 p.m. ET update failed host convergence on "`claude-code-plugins` at
+// ~/.codex/.tmp/marketplaces/claude-code-plugins: marketplace root does not contain a supported manifest" while Codex
+// was refreshing that Git snapshot; the same step passed at 5 a.m. Reproduced with a snapshot missing its manifest:
+// `codex plugin list` exits 1, and `codex plugin marketplace upgrade <name>` repairs it (codex-cli 0.164.0).
+const CODEX_SNAPSHOT_FAILURE = /failed to load configured marketplace snapshot/i;
+export function codexBrokenMarketplaces(text) {
+  return [...String(text || '').matchAll(/^- `([^`]+)` at /gm)].map((m) => m[1]);
+}
+const sleepSync = (ms) => { if (ms > 0) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms); };
+
+export function runCodexJson(args, {
   codexBin = process.env.CODEX_BIN || 'codex',
   codexHome = codexHomeDir(),
   cwd = process.cwd(),
+  run = runHostCli,
+  waitMs = 5_000,
+  // Refreshing another tool's marketplace is a network write; only an install/update that is about to change the
+  // Brain's Codex plugin opts in. --doctor and listings report the broken snapshot and change nothing (review 2026-10-24).
+  repair = false,
 } = {}) {
-  const r = runHostCli(codexBin, args, {
-    stdio: 'pipe',
-    shell: false,
-    cwd,
-    env: { ...process.env, CODEX_HOME: codexHome },
-    encoding: 'utf8',
-    timeout: 30_000,
-    maxBuffer: 20 * 1024 * 1024,
-  });
+  const options = { stdio: 'pipe', shell: false, cwd, env: { ...process.env, CODEX_HOME: codexHome }, encoding: 'utf8',
+    timeout: 30_000, maxBuffer: 20 * 1024 * 1024 };
+  const snapshotFailure = (res) => !res.missingBinary && res.status !== 0 && CODEX_SNAPSHOT_FAILURE.test(String(res.stderr || res.stdout || ''));
+  let r = run(codexBin, args, options);
+  // One wait covers a refresh Codex is finishing; then refresh only the OTHER Git marketplaces it named (the Brain's
+  // own local snapshot is repaired by prepareCodexMarketplace), once, and ask again. Bounded: at most three asks.
+  const repaired = [];
+  if (snapshotFailure(r)) { sleepSync(waitMs); r = run(codexBin, args, options); }
+  if (repair && snapshotFailure(r)) {
+    for (const name of codexBrokenMarketplaces(r.stderr || r.stdout).filter((n) => n !== CODEX_MARKETPLACE)) {
+      const up = run(codexBin, ['plugin', 'marketplace', 'upgrade', name, '--json'], options);
+      repaired.push(`${name}: ${up.status === 0 ? 'refreshed' : `refresh failed (exit ${up.status})`}`);
+    }
+    if (repaired.length) r = run(codexBin, args, options);
+  }
   if (r.missingBinary) return { ok: false, error: r.message };
   if (r.error || r.status !== 0) {
-    const detail = String(r.stderr || r.stdout || r.error?.message || `exit ${r.status}`).trim();
-    return { ok: false, error: detail };
+    let detail = String(r.stderr || r.stdout || r.error?.message || `exit ${r.status}`).trim();
+    if (snapshotFailure(r)) {
+      const names = codexBrokenMarketplaces(r.stderr || r.stdout);
+      detail += ` — Codex cannot load its ${names.map((n) => `\`${n}\``).join(', ') || 'configured'} marketplace snapshot`
+        + `${repaired.length ? ` (tried: ${repaired.join('; ')})` : ''}; repair with: ${names.map((n) => `codex plugin marketplace upgrade ${n}`).join(' && ') || 'codex plugin marketplace upgrade'}`;
+    }
+    return { ok: false, error: detail, ...(repaired.length ? { repaired } : {}) };
   }
+  if (repaired.length && !TEST_MODE) info(`  Codex marketplace snapshot repaired before the Brain step (${repaired.join('; ')})`);
   try { return { ok: true, value: JSON.parse(r.stdout || 'null') }; }
   catch { return { ok: false, error: `Codex returned non-JSON output for ${args.join(' ')}` }; }
 }
@@ -2105,7 +2133,7 @@ export function wireCodexPlugin({
   aliasHome,
 } = {}) {
   if (!fs.existsSync(codexDir)) return { host: false, action: 'no-host' };
-  const options = { codexBin, codexHome, cwd };
+  const options = { codexBin, codexHome, cwd, repair: true };
   // Codex loads every configured marketplace before it can report plugin state. Repair only an
   // absent/malformed Brain-owned snapshot before that probe, or the probe can fail before its own
   // repair path is reachable. A healthy current cache stays byte-untouched, and plugin enablement
@@ -3874,7 +3902,9 @@ export function syncHostsAfterUpdate(cacheDir = resolvedKbDir(), {
   const fail = (detail = {}) => {
     runtimeTransaction.rollback();
     hostLock.release();
-    return { ok: false, results, ...detail };
+    // Three paths below returned no error at all, so the refresh receipt recorded `state: null, error: null` and the
+    // failure could not be diagnosed afterwards (2026-10-23 7:21 p.m. ET). Every failure now carries its reason.
+    return { ok: false, results, ...detail, error: detail.error || hostFailureReason(results) };
   };
 
   try {
@@ -4035,6 +4065,18 @@ export function classifyHostConvergence(receipt, expectedVersion = PACKAGE_VERSI
 }
 
 /** Activation and host readiness are independent; never claim a rollback from a host refusal. */
+/** Why host synchronization stopped, from the per-host results it had gathered; null when nothing says. */
+export function hostFailureReason(results = {}) {
+  const firstLines = (text) => String(text || '').trim().split('\n').slice(0, 3).join(' ');
+  if (results.claude?.host && !results.claude.wired) {
+    return `Claude Code plugin ${results.claude.action || 'wiring failed'}${results.claude.version ? ` (installed ${results.claude.version}, required ${results.claude.expectedVersion || PACKAGE_VERSION})` : ''}`;
+  }
+  if (results.codex && !['unchanged', 'installed', 'updated', 'disabled'].includes(results.codex.action)) {
+    return `Codex plugin ${results.codex.action || 'failed'}${results.codex.error ? `: ${firstLines(results.codex.error)}` : ''}`;
+  }
+  return null;
+}
+
 export function hostSynchronizationFailureMessage(convergence, active, expectedVersion = PACKAGE_VERSION) {
   const verified = active?.version === expectedVersion && Number.isSafeInteger(active.generation) && active.generation > 0
     && active.codeRoot === `versions/${expectedVersion}`;
@@ -4093,11 +4135,36 @@ function refuseOverSetAsideBrain() {
   return true;
 }
 
+/**
+ * A SOURCE CHECKOUT older than the runtime already installed cannot apply the current release: it downloads ~736 MB
+ * and then refuses on "staged ReleaseCoverage failed integrity — release version 4.7.17 differs from 4.5.2" (measured
+ * 2026-10-23: `npx ruvnet-brain --update` run inside a stale checkout resolves that checkout's own bin). Say so
+ * before the download, with the command that works. Only a checkout: a published installer can legitimately be
+ * older than active.json (a plugin seeded from main during a release window, a release candidate installed from a
+ * checkout), and the nightly and self-heal `@latest` updates must keep working then (review, 2026-10-24).
+ */
+export function olderInstallerRefusal({ brainHome, packageVersion = PACKAGE_VERSION, repoRoot = REPO_ROOT } = {}) {
+  let installed;
+  try { installed = JSON.parse(fs.readFileSync(path.join(brainHome, 'active.json'), 'utf8'))?.version; } catch { return null; }
+  if (!/^\d+\.\d+\.\d+$/.test(String(installed || ''))) return null;
+  try { if (cmpVersion(installed, packageVersion) <= 0) return null; } catch { return null; }
+  if (!fs.existsSync(path.join(repoRoot, '.git'))) return null;
+  return `this is ruvnet-brain ${packageVersion}, a source checkout at ${repoRoot}, older than the ${installed} already `
+    + 'installed here, and an older checkout cannot apply the current release. '
+    + 'Run  npx ruvnet-brain@latest --update  from any other folder, or bring this checkout up to date first (git pull).';
+}
+
 async function runUpdate() {
   printBanner('update');
   refuseUnmountedBrain();
   const kbDir = resolvedKbDir();
   const brainHome = process.env.RUVNET_BRAIN_HOME || path.dirname(kbDir);
+  const olderInstaller = olderInstallerRefusal({ brainHome });
+  if (olderInstaller) {
+    console.error(`\n${c.red('✗ update stopped before downloading:')} ${olderInstaller}\n`);
+    process.exitCode = 1;
+    return;
+  }
   if (FLAG_HOST_SYNC_ONLY) {
     info(c.dim('repairing host shells and managed model catalog without mutating KB bytes…\n'));
     const convergence = syncHostsAfterUpdate(kbDir);
@@ -5650,7 +5717,7 @@ const rufloProbeRun = (args, cli = 'ruflo', timeoutMs = 10_000) => {
   // (verified live: ~/.npm-global/lib/node_modules/ruflo/node_modules/@claude-flow/cli/dist/src/
   // services/daemon-autostart.js:85) — a read-only health probe must not leave one running.
   const result = spawnSync(cli, args, { cwd: process.cwd(), encoding: 'utf8', timeout: timeoutMs, shell: IS_WIN && /\.(?:cmd|bat)$/i.test(cli),
-    env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' } });
+    env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false' } });
   // A spawn failure or a timeout is marked, so it can never pass for an (empty, "healthy") answer.
   return `${result.stdout || ''}\n${result.stderr || ''}${result.error ? `\n[ruflo-probe-error] ${result.error.code || result.error.message}` : ''}`;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.7.17",
+  "version": "4.7.19",
   "description": "One-command installer for RuvNet Brain — a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships a UserPromptSubmit retrieve-and-inject grounding hook and a PreToolUse write gate that refuses ungrounded rUv-product code until search_ruvnet has been consulted (ADR-0012 / ADR-067).",
-  "version": "4.7.17",
+  "version": "4.7.19",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.7.17",
+  "version": "4.7.19",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/commands/configure.md

@@ -1,7 +1,7 @@
 ---
-description: Open the RuvNet Brain Console (/rnbc) — a local web page that mirrors YOUR machine's RuvNet setup, explains it in plain English, and lets you safely configure and fix it. Read-only until you click; every machine change is explained first and is reversible.
-updated: 2026-10-10 06:00:22 EDT
-version: 1.0.2
+description: "Open the RuvNet Brain Console (/rnbc) — a local web page that mirrors YOUR machine's RuvNet setup, explains it in plain English, and lets you safely configure and fix it. Read-only until you click; every machine change is explained first and is reversible."
+updated: 2026-10-24 18:00:00 EDT
+version: 1.0.3
 ---
 
 Launch the **RuvNet Brain Console** (RNBC) for the user. `/rnbc` is its name; `/rnb`, `/rvbc`,

package/plugin/scripts/agentdb-recall-process.mjs

@@ -33,7 +33,7 @@ export function searchOnce({ ruflo, store, args, deadline, env, scratch, operati
     catch { cleanup(); resolve({ rows: [], state: 'unavailable' }); return; }
     let child;
     try {
-      child = spawn(inv.executable, inv.args, { cwd, env: { ...env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_MEMORY_PATH: undefined },
+      child = spawn(inv.executable, inv.args, { cwd, env: { ...env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false', CLAUDE_FLOW_MEMORY_PATH: undefined },
         stdio: ['ignore', 'pipe', 'ignore'], detached: process.platform !== 'win32', windowsHide: true });
     } catch { cleanup(); resolve({ rows: [], state: 'unavailable' }); return; }
     let out = '', outputBytes = 0;

package/plugin/scripts/agentdb-recall-reader.mjs

@@ -8,7 +8,7 @@ import { resolveRuflo, rufloInvocationOrPlain } from './ruflo-bin.mjs';
 const call = (bin, args, deadline) => new Promise((resolve) => {
   const timeout = Math.max(1, deadline - Date.now());
   const inv = rufloInvocationOrPlain(bin, args, { env: process.env });
-  execFile(inv.executable, inv.args, { timeout, killSignal: 'SIGKILL', encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' } },
+  execFile(inv.executable, inv.args, { timeout, killSignal: 'SIGKILL', encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false' } },
     (error, stdout) => resolve(error ? null : String(stdout || '')));
 });
 

package/plugin/scripts/brain-confirmation.mjs

@@ -181,8 +181,15 @@ export function confirm({ footprint, env = process.env, home = os.homedir(), now
   // Footprint
   const parts = Object.entries(footprint.breakdown).sort((a, b) => b[1] - a[1]).map(([k, v]) => `${k} ${formatBytes(v)}`);
   const foreign = footprint.unowned.reduce((n, i) => n + (i.bytes || 0), 0);
+  // `--clean` is the fix only when it can remove something. Measured 2026-10-24: 3.01 GB of a 2.23 GB budget with
+  // zero cruft, the line said "fix: --clean", and --clean freed nothing — the bytes were a 1.3 GB npm install ruflo's
+  // self-update left in ruvnet-brain/ruflo-cwd, counted as Brain state. Name where the bytes are instead.
+  const reclaimable = footprint.cruft.some((i) => ['remove', 'remove-if-proven', 'rotate', 'truncate', 'collect', 'prune'].includes(i.action));
+  const largest = footprint.items.filter((i) => i.kind === 'state' && i.bytes).sort((a, b) => b.bytes - a.bytes).slice(0, 2);
+  const footprintFix = reclaimable || !largest.length ? CLEAN
+    : `${CLEAN} has nothing to remove; the largest Brain folders are ${largest.map((i) => `${i.path} (${formatBytes(i.bytes)})`).join(' and ')} — see what is filling them`;
   lines.push(line('footprint', 'Footprint', footprint.withinBudget ? 'ok' : 'fail',
-    `${formatBytes(footprint.totalBytes)} of ${formatBytes(footprint.budgetBytes)} budget (${parts.join(' · ')})${foreign ? `; not counted: ${formatBytes(foreign)} owned by other tools` : ''}`, CLEAN));
+    `${formatBytes(footprint.totalBytes)} of ${formatBytes(footprint.budgetBytes)} budget (${parts.join(' · ')})${foreign ? `; not counted: ${formatBytes(foreign)} owned by other tools` : ''}`, footprintFix));
 
   // No cruft
   const cruft = footprint.cruft;

package/plugin/scripts/brain-footprint.mjs

@@ -25,6 +25,7 @@ import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { isKbTree, kbCopyProof } from './kb-copy-proof.mjs';
 import { brainLocation } from './brain-location.mjs';
+import { RUFLO_CWD_ARTIFACTS } from './ruflo-bin.mjs';
 import { assessMoveLeftovers, cachedKept, cmpVersion, isVolumeMetadata, keptCopyFix, physical, pidAlive, readProofCache, rememberKept, removeWithin, rotate,
   treeBytes, truncateToTail } from './footprint-io.mjs';
 
@@ -59,7 +60,8 @@ export const LOG_FILES = Object.freeze(['evidence.jsonl', 'token-ledger.jsonl',
   'capability-live-evidence.jsonl', 'design-grades.jsonl', 'grounding-overrides.jsonl']);
 const TEXT_LOG = /^\.(?:last-[A-Za-z0-9-]+|seed)\.log$/;
 const RECOVERY_LEFTOVER = /(?:\.(?:bak|retired|dead)-\d{6,}|^bootstrap-backup-\d)/;
-const RUFLO_DEBRIS = new Set(['.swarm', '.claude', '.claude-flow', 'ruvector.db']);
+// One list with ruflo-bin.mjs, which clears the same names before each call (incl. a self-update's npm install, 1.3 GB on 2026-10-22).
+const RUFLO_DEBRIS = new Set(RUFLO_CWD_ARTIFACTS);
 // Directories in the brain home that hold data another tool owns: measured, shown, never budgeted or removed.
 const FOREIGN = { 'ruvector-mcp': 'RuVector MCP server working store (its own live memory)',
   'worktree-recovery': 'hand-made recovery archives, not created by the Brain' };

package/plugin/scripts/decision-record.mjs

@@ -138,7 +138,7 @@ function runRuflo(ruflo, db, args, { spawn = spawnSync } = {}) {
   try {
     const { executable, args: argv } = rufloInvocation(ruflo, args);
     const r = spawn(executable, argv, { cwd, encoding: 'utf8', timeout: 60_000, windowsHide: true,
-      env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_MEMORY_PATH: undefined } });
+      env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false', CLAUDE_FLOW_MEMORY_PATH: undefined } });
     return { status: Number.isInteger(r.status) ? r.status : 1, stdout: String(r.stdout || ''), output: `${r.stderr || ''}\n${r.stdout || ''}${r.error ? `\n${r.error.message}` : ''}` };
   } finally { fs.rmSync(cwd, { recursive: true, force: true }); }
 }

package/plugin/scripts/degradation-watch.mjs

@@ -52,6 +52,7 @@ import path from 'node:path';
 // is the exact defect class this file exists to close. Caught by counting occurrences, not by
 // reading the code and believing it.
 import { fileURLToPath } from 'node:url';
+import { rufloRunDir } from './ruflo-bin.mjs';
 
 /**
  * THE PROBE TARGET IS A SCRATCH DB, NOT THE PROJECT'S.
@@ -73,8 +74,19 @@ import { fileURLToPath } from 'node:url';
  */
 const defaultDb = () => path.join(os.tmpdir(), `ruvnet-durability-probe-${process.pid}.db`);
 
+// ruflo writes into its cwd on every call (.claude/, .claude-flow/, ruvector.db, agentdb.rvf) and its startup
+// self-update runs `npm install @claude-flow/cli --save-exact` there. This probe runs on every `git push`, so with the
+// caller's cwd it could leave those in the user's project (measured 2026-10-22: a 1.4 GB node_modules and a
+// package.json in a project). It now runs in a private scratch dir, removed after the call, with both switches off.
 function defaultRun(cmd, args) {
-  return execFileSync(cmd, args, { encoding: 'utf8', timeout: 30_000, stdio: ['ignore', 'pipe', 'pipe'] });
+  let cwd = null;
+  try { cwd = rufloRunDir(path.join(os.tmpdir(), 'ruvnet-durability-probe')); } catch { /* fall back to tmp below */ }
+  try {
+    return execFileSync(cmd, args, { cwd: cwd || os.tmpdir(), encoding: 'utf8', timeout: 30_000, stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false' } });
+  } finally {
+    if (cwd) { try { fs.rmSync(cwd, { recursive: true, force: true }); } catch { /* swept later as a stale run- dir */ } }
+  }
 }
 
 /**

package/plugin/scripts/developer-update-policy.mjs

@@ -32,17 +32,43 @@ export function normalizeNpmDistTags(value) {
   }
   return value;
 }
-export function pickTargetTag(tags, want = 'latest', defaultTag = 'latest') {
-  const candidates = [...new Set([want, defaultTag])].filter(tag => typeof tags?.[tag] === 'string');
+export function normalizeNpmTimes(value) {
+  // `npm view <pkg> time --json`: an object of version -> ISO time (npm 12 wraps it in a one-record array).
+  if (Array.isArray(value)) value = value.length === 1 ? value[0] : null;
+  return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+}
+/**
+ * The newer of {want, defaultTag} by version — EXCEPT a non-default tag whose version was published BEFORE the
+ * default tag's version. That is an abandoned pre-release line, not a newer build: measured 2026-10-23, agentic-flow
+ * `alpha` = 3.0.0-alpha.2 (published 2026-03-25) against `latest` = 2.1.4 (2026-10-09); by version alone the alpha
+ * channel would install seven-month-old code. `published` is `npm view <pkg> time`; without it, ordering is unchanged.
+ */
+export function pickTargetTag(tags, want = 'latest', defaultTag = 'latest', { published = null } = {}) {
+  const at = (version) => Date.parse(published?.[version] ?? '');
+  // `published` null: the caller did not ask, ordering is by version. An object: times were REQUIRED, so a missing or
+  // unreadable time makes the non-default tag unverifiable and it is skipped (cross-model review 2026-10-24: a failed
+  // lookup must not let a seven-month-old pre-release through).
+  const abandoned = (tag) => tag !== defaultTag && typeof tags?.[defaultTag] === 'string' && published !== null
+    && (!Number.isFinite(at(tags[tag])) || !Number.isFinite(at(tags[defaultTag])) || at(tags[tag]) < at(tags[defaultTag]));
+  const candidates = [...new Set([want, defaultTag])].filter(tag => typeof tags?.[tag] === 'string' && !abandoned(tag));
   candidates.sort((a, b) => cmpVersion(tags[b], tags[a]));
   return { tag: candidates[0] || null, target: tags?.[candidates[0]] || null };
 }
-export function selectTag(name, current, tags, channel = 'latest') {
+/** Whether choosing between `want` and `latest` needs publish times: only when the two tags name different versions. */
+export function needsPublishTimes(tags, want) {
+  return want !== 'latest' && typeof tags?.[want] === 'string' && typeof tags?.latest === 'string' && tags[want] !== tags.latest;
+}
+/** The ONE answer to "which tag does this package track": shared by the updater and the stack-sync notice. */
+export function wantedTag(name, channel = 'latest') {
   if (!['latest', 'alpha'].includes(channel)) throw Error('unsupported update channel');
   // Kit's installed release contract uses next; never convert it to an npm alpha alias.
+  return name === '@pacphi/agentic-kit' ? 'next' : FAMILY.test(name) && channel === 'alpha' ? 'alpha' : 'latest';
+}
+export function selectTag(name, current, tags, channel = 'latest', { published = null } = {}) {
+  const wanted = wantedTag(name, channel);
   tags = normalizeNpmDistTags(tags);
-  const wanted = name === '@pacphi/agentic-kit' ? 'next' : FAMILY.test(name) && channel === 'alpha' ? 'alpha' : 'latest';
-  const { tag, target: version } = pickTargetTag(tags, wanted);
+  const times = published === null || published === undefined ? null : (normalizeNpmTimes(published) || {});
+  const { tag, target: version } = pickTargetTag(tags, wanted, 'latest', { published: times });
   if (!tag) throw Error(`no allowed release tag: ${name}`);
   return { tag, version, upgrade: cmpVersion(version, current) > 0, ahead: cmpVersion(version, current) < 0 };
 }

package/plugin/scripts/developer-update.mjs

@@ -6,7 +6,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { pathToFileURL } from 'node:url';
-import { cmpVersion as compare, selectTag, FAMILY, PLUGIN_MARKETPLACES, REVIEWED_INSTALL_SCRIPTS, EXECUTION_MODULES } from './developer-update-policy.mjs';
+import { cmpVersion as compare, selectTag, needsPublishTimes, normalizeNpmDistTags, wantedTag, FAMILY, PLUGIN_MARKETPLACES, REVIEWED_INSTALL_SCRIPTS, EXECUTION_MODULES } from './developer-update-policy.mjs';
 import { acquireDeveloperLock, sharedLockStatus } from './developer-update-lock.mjs';
 import { maintenance } from './developer-update-maintenance.mjs';
 import { cleanupNpxDuplicates } from './developer-update-cleanup.mjs';
@@ -31,7 +31,7 @@ export function atomic(file, value) {
 function invoke(command, args, { cwd = HOME, timeout = 600_000, allowed = [0], env = process.env, capture = false } = {}) {
   const r = spawnSync(command, args, { cwd, encoding: 'utf8', timeout, maxBuffer: 16 * 1024 * 1024,
     env: { ...env, PATH: [...new Set([path.dirname(NODE), path.join(env.npm_config_prefix || PREFIX, process.platform === 'win32' ? '' : 'bin'), ...(env.PATH || '').split(path.delimiter)])].join(path.delimiter),
-      CI: '1', DISABLE_AUTOUPDATER: '1', GIT_TERMINAL_PROMPT: '0', GCM_INTERACTIVE: 'Never', GH_PROMPT_DISABLED: '1', HOMEBREW_NO_INSTALL_CLEANUP: '1', HOMEBREW_NO_AUTO_UPDATE: '1', RUVNET_BRAIN_HOME: env.RUVNET_BRAIN_HOME || CACHE } });
+      CI: '1', DISABLE_AUTOUPDATER: '1', CLAUDE_FLOW_AUTO_UPDATE: 'false', GIT_TERMINAL_PROMPT: '0', GCM_INTERACTIVE: 'Never', GH_PROMPT_DISABLED: '1', HOMEBREW_NO_INSTALL_CLEANUP: '1', HOMEBREW_NO_AUTO_UPDATE: '1', RUVNET_BRAIN_HOME: env.RUVNET_BRAIN_HOME || CACHE } });
   if (!capture && (r.error || !allowed.includes(r.status))) throw Error(`${path.basename(command)} ${args[0]}: ${r.error?.message || `exit ${r.status}`}: ${(r.stderr || r.stdout || '').trim().slice(-600)}`);
   return { stdout: (r.stdout || '').trim(), stderr: (r.stderr || '').trim(), exitCode: r.status, error: r.error?.message || null };
 }
@@ -120,7 +120,7 @@ function verifyPackage(before, expected, run) {
   }
   return after;
 }
-export function upgradePackage(before, tags, scripts = REVIEWED_INSTALL_SCRIPTS, { run = invokeText, dryRun = false, channel = 'latest', npm = NPM, preservePackages = [] } = {}) {
+export function upgradePackage(before, tags, scripts = REVIEWED_INSTALL_SCRIPTS, { run = invokeText, dryRun = false, channel = 'latest', npm = NPM, preservePackages = [], published = null } = {}) {
   // Snapshot identity must still exist and own the original paths before any installer runs.
   if (before.localSource && before.rawLink !== undefined) {
     if (!fs.lstatSync(before.location).isSymbolicLink() || fs.readlinkSync(before.location) !== before.rawLink) throw Error(`source link changed before preservation: ${before.name}`);
@@ -133,7 +133,7 @@ export function upgradePackage(before, tags, scripts = REVIEWED_INSTALL_SCRIPTS,
   if (live.localSource) return { name: before.name, state: 'local-source-preserved', before, after: live };
   if (live.launchers.some(b => !b.real)) throw Error(`absent launcher: ${before.name}`);
   if (live.launchers.some(b => !b.owned)) return { name: before.name, state: 'shadowed-preserved', before, after: live };
-  const target = selectTag(before.name, before.version, tags, channel);
+  const target = selectTag(before.name, before.version, tags, channel, { published });
   if (preservePackages.includes(before.name)) return { name: before.name, state: 'local-modification-preserved', reason: 'preservedLocalModification', target, before, after: live };
   if (!target.upgrade || dryRun) return { name: before.name, state: target.upgrade ? 'update-available' : target.ahead ? 'ahead-preserved' : 'current', target, before, after: live };
   const spec = `${before.name}@${target.tag}`;
@@ -422,7 +422,19 @@ export async function runDeveloperUpdate({ mode = 'check', home = os.homedir(),
     persistReceipt();
     for (const before of receipt.before) {
       const tags = before.localSource ? {} : JSON.parse(run(npm, ['view', before.name, 'dist-tags', '--json'], { timeout: 90_000 }));
-      receipt.steps.push(upgradePackage(before, tags, REVIEWED_INSTALL_SCRIPTS, { run, dryRun: mode === 'check', channel: config.channel, npm, preservePackages: config.preservePackages }));
+      // A tracked non-latest tag (alpha, Kit's next) needs publish times to tell a newer pre-release from an abandoned
+      // one (developer-update-policy pickTargetTag); fetched only when that tag and latest name different versions. A
+      // failed lookup is {} — required but unknown — so the pre-release is skipped, never installed blind.
+      let published = null;
+      if (!before.localSource) {
+        let needed = false;
+        try { needed = needsPublishTimes(normalizeNpmDistTags(tags), wantedTag(before.name, config.channel)); } catch { needed = false; }
+        if (needed) {
+          try { published = JSON.parse(run(npm, ['view', before.name, 'time', '--json'], { timeout: 90_000 })); }
+          catch { published = {}; }
+        }
+      }
+      receipt.steps.push(upgradePackage(before, tags, REVIEWED_INSTALL_SCRIPTS, { run, dryRun: mode === 'check', channel: config.channel, npm, preservePackages: config.preservePackages, published }));
       persistReceipt();
     }
     receipt.plugins = await synchronizePlugins(run, mode === 'check', receipt.notes, { home, prefix, scope: config.scope, locate, unattended: !!env.RUVNET_NIGHTLY_IDENTITY });

package/plugin/scripts/learning-store.mjs

@@ -32,7 +32,7 @@ export function runLearningRuflo(binary, args, db, { env = process.env, deadline
   const cwd = rufloRunDir(db, { root: env.RUVNET_RUFLO_CWD_ROOT || path.join(env.HOME || env.USERPROFILE || os.homedir(), '.cache', 'ruvnet-brain', 'learning-ruflo') });
   try {
     const invocation = rufloInvocation(binary, args);
-    return spawnSync(invocation.executable, invocation.args, { cwd, env: { ...env, RUFLO_DAEMON_AUTOSTART: '0' },
+    return spawnSync(invocation.executable, invocation.args, { cwd, env: { ...env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false' },
       encoding: 'utf8', shell: false, timeout: Math.min(maxStepMs, remaining), killSignal: 'SIGKILL', maxBuffer: 65536, windowsHide: true });
   } finally { fs.rmSync(cwd, { force: true, recursive: true }); }
 }

package/plugin/scripts/nightly-scheduler.mjs

@@ -186,7 +186,8 @@ function verifyUpdateModules(modules) {
  * the allowlisted values from env; an object is kept verbatim; null omits the field (an older registration without it).
  */
 export function installNightlyRunner({ brainHome, source, nodePath = process.execPath,
-  identity = NIGHTLY_LABEL, packageTarget, bundleTarget, env = {}, environment, moduleSource, developerSuite = !NIGHTLY_PROOF_LABEL.test(identity), dryRun = false } = {}) {
+  identity = NIGHTLY_LABEL, packageTarget, bundleTarget, env = {}, environment, moduleSource, developerSuite = !NIGHTLY_PROOF_LABEL.test(identity), dryRun = false,
+  replacedUpdateModules = null } = {}) {
   validateIdentity(identity);
   if (!source || !fs.existsSync(source)) throw new Error(`nightly runner source is missing: ${source || '(unset)'}`);
   const bytes = fs.readFileSync(source);
@@ -204,7 +205,8 @@ export function installNightlyRunner({ brainHome, source, nodePath = process.exe
   const record = { updateModules: modules, ...(developerSuite ? { mode: 'developer-suite' } : {}), schemaVersion: 2, kind: 'ruvnet-brain-nightly-scheduler', identity,
     nodePath: path.resolve(nodePath), runnerPath, runnerSha256: digest, argv: [],
     ...(environment === null ? {} : { environment: environment ?? Object.fromEntries(NIGHTLY_ENV_ALLOWLIST.filter(key => env[key] !== undefined).map(key => [key, key === 'PATH' ? automaticPath({ nodePath, home: homeOf(env), env }) : String(env[key])])) }),
-    packageTarget: normalizePackageTarget(packageTarget), bundleTarget: normalizeBundleTarget(bundleTarget, identity) };
+    packageTarget: normalizePackageTarget(packageTarget), bundleTarget: normalizeBundleTarget(bundleTarget, identity),
+    ...(Array.isArray(replacedUpdateModules) && replacedUpdateModules.length ? { replacedUpdateModules } : {}) };
   const recordPath = path.join(dir, registrationName(identity));
   if (dryRun) return { ...record, recordPath };
   const tmp = `${recordPath}.tmp-${process.pid}`;
@@ -239,6 +241,12 @@ export function nightlyModuleCurrency({ brainHome, identity = NIGHTLY_LABEL, mod
  * and the LaunchAgent command stays exactly what it was; anything else is refused and left as it was.
  */
 export const SCHEDULER_VISIBLE_FIELDS = Object.freeze(['identity', 'nodePath', 'runnerPath', 'runnerSha256', 'argv', 'environment', 'packageTarget', 'bundleTarget', 'mode']);
+/** The replaced-module history after replacing `record.updateModules` now: newest first, last 48 h, at most 20. */
+export function nextReplacedSets(record, now = Date.now()) {
+  return [{ updateModules: record.updateModules, replacedAt: new Date(now).toISOString() },
+    ...(Array.isArray(record.replacedUpdateModules) ? record.replacedUpdateModules : [])]
+    .filter((entry) => now - Date.parse(entry?.replacedAt || '') <= 48 * 3_600_000).slice(0, 20);
+}
 export function refreshNightlyModules(options = {}) {
   const currency = nightlyModuleCurrency(options);
   if (currency.state !== 'stale') return currency;
@@ -250,7 +258,11 @@ export function refreshNightlyModules(options = {}) {
   const candidate = (options.build || ((p) => installNightlyRunner({ ...p, dryRun: true })))(plan);
   const differs = SCHEDULER_VISIBLE_FIELDS.filter((key) => JSON.stringify(candidate[key] ?? null) !== JSON.stringify(record[key] ?? null));
   if (differs.length) return { ...currency, state: 'refused', reason: `refresh would change ${differs.join(', ')}; registration left as it was`, fix: NIGHTLY_ENABLE_FIX };
-  const refreshed = installNightlyRunner(plan);
+  // Remember the module set this replaces: the receipt of the night that ran on it stays valid evidence until the next
+  // night (2026-10-24: doctor said "nightly refresh FAILED" all day after a session-start update re-pointed the modules).
+  // Newest first, every set replaced in the last 48 h (a receipt older than the 30 h health window is stale anyway), at
+  // most 20: any number of refreshes before the next night keeps the set that night ran on (reviews 2026-10-24).
+  const refreshed = installNightlyRunner({ ...plan, replacedUpdateModules: nextReplacedSets(record) });
   return { ...currency, state: 'refreshed', registered: registeredModuleDigest(refreshed), fix: undefined };
 }
 
@@ -329,10 +341,19 @@ export function developerRunHealth({ brainHome, registration, now = Date.now(),
   } catch (error) { return { state: 'failed', evidence: `Coordinated update receipt unreadable or refused: ${error.message}`, receipt: null }; }
   if (!receipt) return { state: 'never-ran', evidence: 'No coordinated update receipt exists yet.', receipt: null };
   const validDigest = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
-  const bound = validDigest(receipt.sourceSha256) && receipt.kind === 'nightly-suite-update' && receipt.schemaVersion === 1
-    && receipt.sourceSha256 === registration.updateModules?.['developer-update.mjs']?.sha256
-    && Object.entries(receipt.sourceSnapshot || {}).every(([name, digest]) => validDigest(digest) && digest === registration.updateModules?.[name]?.sha256)
-    && EXECUTION_MODULES.filter(name => name !== 'plugin-artifact-proof.mjs' || registration.updateModules?.[name]).every(name => validDigest(receipt.sourceSnapshot?.[name]) && receipt.sourceSnapshot[name] === registration.updateModules?.[name]?.sha256);
+  const boundTo = modules => Boolean(modules) && validDigest(receipt.sourceSha256) && receipt.kind === 'nightly-suite-update' && receipt.schemaVersion === 1
+    && receipt.sourceSha256 === modules['developer-update.mjs']?.sha256
+    && Object.entries(receipt.sourceSnapshot || {}).every(([name, digest]) => validDigest(digest) && digest === modules[name]?.sha256)
+    && EXECUTION_MODULES.filter(name => name !== 'plugin-artifact-proof.mjs' || modules[name]).every(name => validDigest(receipt.sourceSnapshot?.[name]) && receipt.sourceSnapshot[name] === modules[name]?.sha256);
+  // A receipt from the module set an update just replaced is still the night's proof, but only one that FINISHED before
+  // the replacement: the next scheduled run must bind to the current set.
+  // Judged by LAUNCH time: a night's own knowledge step can install a release and re-point the modules before the run
+  // records finishedAt (cross-model review 2026-10-24). A run launched after its set was replaced must bind to the new one.
+  const launched = Date.parse(receipt.startedAt || receipt.finishedAt || '');
+  const ranOnPrevious = !boundTo(registration.updateModules) && Array.isArray(registration.replacedUpdateModules)
+    && registration.replacedUpdateModules.some((entry) => Number.isFinite(Date.parse(entry?.replacedAt || ''))
+      && launched <= Date.parse(entry.replacedAt) && boundTo(entry.updateModules));
+  const bound = boundTo(registration.updateModules) || ranOnPrevious;
   const ageHours = (now - Date.parse(receipt.finishedAt || receipt.startedAt || '')) / 3_600_000;
   const times = [receipt.startedAt, receipt.finishedAt].filter(value => value !== undefined).map(value => Date.parse(value));
   const timestampsValid = times.length > 0 && times.every(value => Number.isFinite(value) && value <= now)
@@ -349,7 +370,7 @@ export function developerRunHealth({ brainHome, registration, now = Date.now(),
   if (receipt.state !== 'completed') return { state: 'failed', ageHours, receipt, evidence: 'Coordinated update terminal state is unverified.' };
   if (ageHours > maxAgeHours) return { state: 'stale', ageHours, receipt, evidence: `Last coordinated update is ${ageHours.toFixed(1)}h old.` };
   const verification = { ok: bound && receipt.mode === 'apply' && receipt.schedulerIdentity === registration.identity && receipt.state === 'completed' && receipt.ok === true && ageHours >= 0 && ageHours <= maxAgeHours };
-  return { state: verification.ok ? 'ok' : 'failed', verification, ageHours, receipt, evidence: verification.ok ? `Coordinated updates completed ${ageHours.toFixed(1)}h ago; ${receipt.config?.scope || 'unknown'} scope.` : 'Coordinated update timestamp or terminal evidence is invalid.' };
+  return { state: verification.ok ? 'ok' : 'failed', verification, ageHours, receipt, evidence: verification.ok ? `Coordinated updates completed ${ageHours.toFixed(1)}h ago; ${receipt.config?.scope || 'unknown'} scope.${ranOnPrevious ? ' That run used the code an update replaced since; the next night runs the update.' : ''}` : 'Coordinated update timestamp or terminal evidence is invalid.' };
 }
 
 export function refreshRunHealth({ brainHome, identity = NIGHTLY_LABEL, now = Date.now(), maxAgeHours = 30,

package/plugin/scripts/ruflo-bin.mjs

@@ -245,7 +245,11 @@ export function rufloCwdFor(storePath, { root = rufloScratchRoot() } = {}) {
   return ensurePrivateDir(path.join(root, projectKey));
 }
 
-const RUFLO_CWD_ARTIFACTS = Object.freeze(['.swarm', '.claude', '.claude-flow', 'ruvector.db']);
+// node_modules / package.json / package-lock.json: ruflo's startup self-update runs `npm install @claude-flow/cli@X
+// --save-exact` in its cwd (ruflo v3 @claude-flow/cli dist/src/update/executor.js). Measured 2026-10-22: a 1.3 GB
+// install landed here. Every Brain spawn now sets CLAUDE_FLOW_AUTO_UPDATE=false (update/rate-limiter.js reads it);
+// these names are the backstop for a ruflo started without it.
+export const RUFLO_CWD_ARTIFACTS = Object.freeze(['.swarm', '.claude', '.claude-flow', 'ruvector.db', 'node_modules', 'package.json', 'package-lock.json']);
 const STALE_RUN_MS = 3_600_000;
 
 /**

package/plugin/scripts/ruflo-memory-hooks.mjs

@@ -48,7 +48,7 @@ export function projectStore(projectDir, { deadlineAt = Date.now() + 3000 } = {}
 export function rufloSpawnOptions(db, env = process.env) {
   let cwd;
   try { cwd = rufloRunDir(db, { root: rufloScratchRoot(env) }); } catch { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'ruvnet-ruflo-')); }
-  return { cwd, env: { ...env, RUFLO_DAEMON_AUTOSTART: '0' }, cleanup: () => { try { fs.rmSync(cwd, { recursive: true, force: true }); } catch { /* swept later as a stale run- dir */ } } };
+  return { cwd, env: { ...env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false' }, cleanup: () => { try { fs.rmSync(cwd, { recursive: true, force: true }); } catch { /* swept later as a stale run- dir */ } } };
 }
 
 /** One `ruflo memory <args>` call, bounded by the caller's deadline. Resolves, never rejects. */

package/plugin/scripts/turn-outcome-capture.mjs

@@ -60,7 +60,7 @@ const TRANSCRIPT_TAIL_BYTES = 2 * 1024 * 1024;
 const STEP_TIMEOUT_MS = 60_000;
 export const RECEIPTS_MAX_BYTES = 256 * 1024;
 export const TURN_STATUS_FRESH_MS /* ✓ only when the newest receipt is verified and younger */ = 24 * 3_600_000;
-const RUFLO_ENV = { RUFLO_DAEMON_AUTOSTART: '0' };
+const RUFLO_ENV = { RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false' };
 
 function textOf(content) {
   if (typeof content === 'string') return content;

package/scripts/agentdb-fleet-doctor.mjs

@@ -35,7 +35,7 @@ function ruflo(cwd, args) {
   // live: ~/.npm-global/lib/node_modules/ruflo/node_modules/@claude-flow/cli/dist/src/services/
   // daemon-autostart.js:85) — this doctor walks a whole fleet of project dirs and must not leave
   // one daemon running per project as a side effect of asking each one a question.
-  const r = spawnSync(RUFLO, args, { cwd, encoding: 'utf8', timeout: 120000, env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' } });
+  const r = spawnSync(RUFLO, args, { cwd, encoding: 'utf8', timeout: 120000, env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false' } });
   return { out: (r.stdout || '') + (r.stderr || ''), status: r.status };
 }
 

package/scripts/codex-hook-trust-reconcile.mjs

@@ -5,7 +5,103 @@ import path from 'node:path';
 import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { spawn, spawnSync } from 'node:child_process';
-import { codexHookIdentities } from './codex-hook-trust.mjs';
+import zlib from 'node:zlib';
+import { codexHookIdentities, codexPluginContentHash } from './codex-hook-trust.mjs';
+
+/**
+ * sha256 of every regular file under package/plugin/ in a verified npm tarball, read in memory (ustar with pax `path`
+ * records; nothing is extracted or written). Strict: a bad header checksum, a non-octal size, a body past the end, or
+ * any entry type other than file, directory or pax is refused rather than guessed (review 2026-10-24).
+ */
+export function publishedPluginFiles(archive) {
+  const tar = zlib.gunzipSync(archive);
+  const files = new Map();
+  const field = (b) => { const i = b.indexOf(0); return (i < 0 ? b : b.subarray(0, i)).toString('utf8'); };
+  const octal = (b, what) => { const t = field(b).trim(); if (!/^[0-7]+$/.test(t)) throw new Error(`Published archive has a non-octal ${what}`); return parseInt(t, 8); };
+  const paxRecords = (body) => {
+    const out = {}; let i = 0;
+    while (i < body.length) {
+      const space = body.indexOf(0x20, i);
+      if (space < 0) throw new Error('Published archive has a malformed pax record');
+      const len = Number(body.subarray(i, space).toString('ascii'));
+      if (!Number.isSafeInteger(len) || len <= space - i || i + len > body.length || body[i + len - 1] !== 0x0a) throw new Error('Published archive has a malformed pax record');
+      const rec = body.subarray(space + 1, i + len - 1).toString('utf8');
+      const eq = rec.indexOf('=');
+      if (eq < 1) throw new Error('Published archive has a malformed pax record');
+      out[rec.slice(0, eq)] = rec.slice(eq + 1);
+      i += len;
+    }
+    return out;
+  };
+  let pax = null; let off = 0;
+  for (; off + 512 <= tar.length;) {
+    const header = tar.subarray(off, off + 512);
+    if (header.every((b) => b === 0)) break;
+    const sum = header.reduce((n, b, i) => n + (i >= 148 && i < 156 ? 32 : b), 0);
+    if (octal(header.subarray(148, 156), 'checksum') !== sum) throw new Error('Published archive header checksum mismatch');
+    const size = octal(header.subarray(124, 136), 'size');
+    const type = header[156] === 0 ? '0' : String.fromCharCode(header[156]);
+    const prefix = field(header.subarray(345, 500));
+    const name = pax?.path ?? (prefix ? `${prefix}/${field(header.subarray(0, 100))}` : field(header.subarray(0, 100)));
+    if (off + 512 + size > tar.length) throw new Error('Published archive entry runs past the end');
+    const body = tar.subarray(off + 512, off + 512 + size);
+    off += 512 + Math.ceil(size / 512) * 512;
+    if (type === 'x') { pax = paxRecords(body); continue; }
+    if (type === 'g') { pax = null; continue; }
+    pax = null;
+    if (type === '5') continue;
+    if (type !== '0') throw new Error(`Published archive has an unsupported entry type ${JSON.stringify(type)}`);
+    if (name.startsWith('package/plugin/')) files.set(name.slice('package/plugin/'.length), digest(body));
+  }
+  if (!files.size) throw new Error('Published archive carries no plugin files');
+  return files;
+}
+
+// Codex writes this under the installed plugin itself: one SKILL.md per migrated slash command (openai/codex
+// rust-v0.164.0 codex-rs/core-plugins/src/command_migration.rs render_command_skill). It is not release bytes, so it is
+// accepted only when every byte is what that template renders from the release's own verified command file.
+const CODEX_GENERATED = 'migrated-command-skills';
+function commandParts(text) {
+  const m = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)([\s\S]*)$/.exec(text);
+  if (!m) return null;
+  const d = /^description:\s*"((?:[^"\\]|\\.)*)"\s*$/m.exec(m[1]);
+  return d ? { description: JSON.parse(`"${d[1]}"`).trim(), body: m[2] } : null;
+}
+function expectedGeneratedSkill(skillName, sourceName, commandText) {
+  const parts = commandParts(commandText);
+  if (!parts || !parts.description) return null;
+  const body = parts.body.trim() || 'No command template body was found.';
+  return `---\nname: ${JSON.stringify(skillName)}\ndescription: ${JSON.stringify(parts.description)}\n---\n\n# ${skillName}\n\n`
+    + `Use this skill when the user asks to run the migrated source command \`${sourceName}\`.\n\n## Command Template\n\n${body}\n`;
+}
+
+/**
+ * ONE pass over the installed plugin: each file's bytes are checked against the verified release (or, for Codex's own
+ * generated skills, against the template rendered from the verified command file) and the SAME bytes feed the content
+ * fingerprint returned. Throws on any changed, extra or missing file, link, or generated file that is not exactly
+ * Codex's rendering.
+ */
+export function verifiedPluginContentHash(root, pluginFiles, { platform = process.platform } = {}) {
+  const seen = new Set(); const commands = new Map(); const generated = new Map();
+  const genPrefix = `.codex-plugin/${CODEX_GENERATED}/`;
+  const hash = codexPluginContentHash(root, { platform, onFile: (rel, bytes) => {
+    if (rel.startsWith(genPrefix)) { generated.set(rel.slice(genPrefix.length), bytes); return; }
+    if (pluginFiles.get(rel) !== digest(bytes)) throw new Error(`Installed plugin file differs from the verified release: ${rel}`);
+    seen.add(rel);
+    if (/^commands\/[^/]+\.md$/.test(rel)) commands.set(rel.slice('commands/'.length, -3), bytes.toString('utf8'));
+  } });
+  const missing = [...pluginFiles.keys()].filter((k) => !seen.has(k));
+  if (missing.length) throw new Error(`Installed plugin lacks ${missing.length} released file(s), e.g. ${missing[0]}`);
+  for (const [rel, bytes] of generated) {
+    const m = /^source-command-([a-z0-9-]+)\/SKILL\.md$/.exec(rel);
+    const source = m && commands.get(m[1]);
+    const expected = source && expectedGeneratedSkill(`source-command-${m[1]}`, m[1], source);
+    if (!expected || bytes.toString('utf8') !== expected) throw new Error(`Codex-generated file is not the rendering of a verified release command: ${rel}`);
+  }
+  return hash;
+}
+/** Kept for callers that only need the yes/no: the installed plugin is the verified release. */
+export function installedPluginMatchesRelease(root, pluginFiles) { verifiedPluginContentHash(root, pluginFiles); return true; }
 
 /** Authenticate exact published package bytes before reading one archive member. No extraction/install. */
 export async function obtainVerifiedPublishedHookIdentity({ version, fetch: fetcher = globalThis.fetch,
@@ -43,7 +139,9 @@ export async function obtainVerifiedPublishedHookIdentity({ version, fetch: fetc
       { input: archive, timeout: Math.min(remaining, 3000), maxBuffer: 256 * 1024 });
     if (result.error || result.status !== 0 || !result.stdout?.length) throw new Error('Platform tar cannot read exact published hooks entry');
     if (!codexHookIdentities(JSON.parse(result.stdout)).size) throw new Error('Published native hooks are invalid');
-    return { state: 'verified', releaseIdentity: { version, integrity, hooksSha256: digest(result.stdout) },
+    let pluginFiles = null;
+    try { pluginFiles = publishedPluginFiles(archive); } catch { pluginFiles = null; /* content trust is then refused, never guessed */ }
+    return { state: 'verified', releaseIdentity: { version, integrity, hooksSha256: digest(result.stdout), pluginFiles },
       metadataUrl, tarballUrl, archiveBytes: archive.length };
   } catch (error) { return blocked(error.message); }
 }
@@ -142,9 +240,14 @@ const rowsFor = (response) => {
   if (!Array.isArray(response?.data)) throw new Error('Native hook registry unavailable');
   return response.data.flatMap((r) => r.hooks || []).filter((r) => r.pluginId === OWNER);
 };
-function assertRegistry(rows, identities) {
+// Codex <0.164: currentHash is the declaration hash. 0.164+: "<declaration hash>/<plugin content hash>" (discovery.rs).
+const splitHash = (current) => { const [declaration, content = null] = String(current || '').split('/'); return { declaration, content }; };
+function assertRegistry(rows, identities, contentHash = null) {
   if (rows.length !== identities.size || new Set(rows.map((r) => r.key)).size !== identities.size
-    || rows.some((row) => identities.get(row.key) !== row.currentHash)) throw new Error('Native registry differs from verified released artifact');
+    || rows.some((row) => identities.get(row.key) !== splitHash(row.currentHash).declaration)) throw new Error('Native registry differs from verified released artifact');
+  if (rows.some((row) => splitHash(row.currentHash).content !== null && splitHash(row.currentHash).content !== contentHash)) {
+    throw new Error('Native plugin content fingerprint differs from the verified installed plugin');
+  }
 }
 
 function otherSettings(config, keys) {
@@ -153,6 +256,7 @@ function otherSettings(config, keys) {
     const state = clone?.hooks?.state?.[key];
     if (state && typeof state === 'object') {
       delete state.trusted_hash;
+      delete state.trusted_content_hash;
       if (!Object.keys(state).length) delete clone.hooks.state[key];
     }
   }
@@ -170,7 +274,7 @@ function otherSettings(config, keys) {
 export async function reconcileVerifiedCodexHookTrust({ releaseIdentity, installedVersion, hooksPath,
   configPath, nativeBinary, cwd = process.cwd(), backupDir = path.join(path.dirname(configPath || ''), 'backups'),
   rpc: suppliedRpc, timeoutMs = 10000 } = {}) {
-  let client; let wrote = false; let writeAttempted = false; let backupPath;
+  let client; let wrote = false; let writeAttempted = false; let backupPath; let contentRefusal = 'Verified release plugin files unavailable';
   try {
     if (!releaseIdentity || !/^\d+\.\d+\.\d+$/.test(releaseIdentity.version || '')
       || installedVersion !== releaseIdentity.version || !/^[a-f0-9]{64}$/.test(releaseIdentity.hooksSha256 || '')
@@ -181,9 +285,19 @@ export async function reconcileVerifiedCodexHookTrust({ releaseIdentity, install
     if (digest(bytes) !== releaseIdentity.hooksSha256) return blocked('Installed hooks differ from verified release');
     const identities = codexHookIdentities(JSON.parse(bytes));
     if (!identities.size) return blocked('Verified artifact has no native hooks');
+    // Codex 0.164+ also pins the installed plugin folder. Approve that fingerprint only for a folder that holds exactly
+    // the verified release's plugin/ bytes (Codex's own generated migrations aside); otherwise refuse, never guess.
+    const pluginRoot = path.dirname(path.dirname(hooksPath));
+    let contentHash = null;
+    if (releaseIdentity.pluginFiles instanceof Map) {
+      try { contentHash = verifiedPluginContentHash(pluginRoot, releaseIdentity.pluginFiles); }
+      catch (error) { contentHash = null; contentRefusal = error.message; }
+    }
     if (!suppliedRpc) client = await nativeClient(nativeBinary, cwd, Date.now() + Math.min(timeoutMs, 20000), configPath);
     const rpc = suppliedRpc || client.rpc;
-    const before = rowsFor(await rpc('hooks/list', { cwds: [cwd] })); assertRegistry(before, identities);
+    const before = rowsFor(await rpc('hooks/list', { cwds: [cwd] }));
+    if (!contentHash && before.some((row) => splitHash(row.currentHash).content !== null)) return blocked(contentRefusal);
+    assertRegistry(before, identities, contentHash);
     const disabled = before.filter((r) => r.enabled === false).map((r) => r.key).sort();
     if (before.some((r) => !['trusted', 'modified', 'untrusted', 'managed'].includes(r.trustStatus))) return blocked('Unknown native trust state');
     const pending = before.filter((r) => r.enabled === true && ['modified', 'untrusted'].includes(r.trustStatus));
@@ -194,8 +308,11 @@ export async function reconcileVerifiedCodexHookTrust({ releaseIdentity, install
     // Config stays memory-only except the private backup. No logging of effective config values.
     const prior = fs.readFileSync(configPath);
     backupPath = privateBackup(configPath, prior, backupDir);
-    const edits = pending.map((r) => ({ keyPath: `hooks.state.${JSON.stringify(r.key)}.trusted_hash`,
-      value: identities.get(r.key), mergeStrategy: 'replace' }));
+    const edits = pending.flatMap((r) => [{ keyPath: `hooks.state.${JSON.stringify(r.key)}.trusted_hash`,
+      value: identities.get(r.key), mergeStrategy: 'replace' },
+      // The second approval Codex 0.164 stores separately (plugin_trust.rs matches_hash).
+      ...(splitHash(r.currentHash).content !== null ? [{ keyPath: `hooks.state.${JSON.stringify(r.key)}.trusted_content_hash`,
+        value: contentHash, mergeStrategy: 'replace' }] : [])]);
     writeAttempted = true;
     await rpc('config/batchWrite', { filePath: configPath, expectedVersion: users[0].version, reloadUserConfig: true, edits });
     wrote = true;
@@ -203,7 +320,7 @@ export async function reconcileVerifiedCodexHookTrust({ releaseIdentity, install
     const afterUsers = (afterRead.layers || []).filter((r) => r.name?.type === 'user' && r.name.file === configPath);
     if (afterUsers.length !== 1 || otherSettings(users[0].config, pending.map((r) => r.key))
       !== otherSettings(afterUsers[0].config, pending.map((r) => r.key))) throw new Error('Unrelated config changed; no whole-file rollback attempted');
-    const after = rowsFor(await rpc('hooks/list', { cwds: [cwd] })); assertRegistry(after, identities);
+    const after = rowsFor(await rpc('hooks/list', { cwds: [cwd] })); assertRegistry(after, identities, contentHash);
     if (JSON.stringify(after.filter((r) => r.enabled === false).map((r) => r.key).sort()) !== JSON.stringify(disabled)
       || after.some((r) => r.enabled === true && !['trusted', 'managed'].includes(r.trustStatus))) throw new Error('Native trust repair verification incomplete');
     return { state: 'registry-verified', changed: true, editedTrustHashes: edits.length,

package/scripts/codex-hook-trust.mjs

@@ -23,6 +23,7 @@
 // that one hook `modified`, the other ten still `trusted`. currentHash from `hooks/list` equals
 // codexHookHash() below for every hook (tests/unit/codex-hook-trust.test.mjs pins the real values).
 import crypto from 'node:crypto';
+import nodeFs from 'node:fs';
 
 const EVENT_LABEL = Object.freeze({
   PreToolUse: 'pre_tool_use', PermissionRequest: 'permission_request', PostToolUse: 'post_tool_use',
@@ -92,3 +93,47 @@ export function codexTrustChanges(prevHooksFile, nextHooksFile, keySource) {
 export const CODEX_TRUST_ACTION = 'Start Codex (interactive, in any project). At the "Hooks need review" prompt choose'
   + ' "Trust all and continue" — or type /hooks and trust each RuvNet Brain hook. Until then Codex skips them'
   + ' (codex exec never asks). Then re-run npx ruvnet-brain --doctor.';
+
+/**
+ * Codex's plugin bundle fingerprint, ported byte for byte from openai/codex rust-v0.164.0
+ * codex-rs/hooks/src/engine/plugin_fingerprint.rs plugin_content_hash(). Since 0.164 a plugin hook's
+ * `currentHash` is "<declaration hash>/<this hash>" and its approval stores the two separately
+ * (`trusted_hash` + `trusted_content_hash`, plugin_trust.rs matches_hash). Measured 2026-10-24: every Brain update
+ * left all 13 Codex hooks "modified" because the Brain wrote only the declaration hash.
+ * Walk: depth-first, entries sorted by file name (bytes), skipping __pycache__, .venv, *.pyc, *.egg-info; each entry
+ * hashes its root-relative path (u64 LE length + bytes), then "directory", or "file" + u64 LE size + contents.
+ * Anything that is neither (a symlink) throws, as it does in Codex.
+ */
+export function codexPluginContentHash(root, { fsImpl = null, onFile = null, platform = process.platform } = {}) {
+  const fs = fsImpl || nodeFs;
+  const u64 = (n) => { const b = Buffer.alloc(8); b.writeBigUInt64LE(BigInt(n)); return b; };
+  if (!fs.lstatSync(root).isDirectory()) throw new Error('plugin root is not a directory');
+  const hash = crypto.createHash('sha256').update('codex-plugin-bundle-v1');
+  // Rust hashes the OS-native relative path bytes: '\\' separators on Windows (review 2026-10-24).
+  const sep = platform === 'win32' ? '\\' : '/';
+  const pending = [''];
+  while (pending.length) {
+    const rel = pending.pop();
+    const base = rel.split('/').pop();
+    if (rel && (base === '__pycache__' || base === '.venv' || base.endsWith('.pyc') || base.endsWith('.egg-info'))) continue;
+    const name = Buffer.from(rel.split('/').join(sep));
+    hash.update(u64(name.length)).update(name);
+    const full = rel ? `${root}/${rel}` : root;
+    const st = fs.lstatSync(full);
+    if (st.isDirectory()) {
+      hash.update('directory');
+      const entries = fs.readdirSync(full).sort((a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)));
+      for (const entry of entries.reverse()) pending.push(rel ? `${rel}/${entry}` : entry);
+    } else if (st.isFile()) {
+      const bytes = fs.readFileSync(full);
+      if (bytes.length !== st.size) throw new Error('plugin file changed while fingerprinting');
+      // The caller sees exactly the bytes that enter the fingerprint: one read, so nothing can change between a check
+      // and the hash it approves (review 2026-10-24: a separate verification pass was a swap window).
+      onFile?.(rel, bytes);
+      hash.update('file').update(u64(st.size)).update(bytes);
+    } else {
+      throw new Error(`unsupported plugin entry type: ${full}`);
+    }
+  }
+  return `sha256:${hash.digest('hex')}`;
+}

package/scripts/corpus-dispatch-decision.mjs

@@ -21,7 +21,7 @@
 
 //
 // THE RETRY SLOT (2026-10-20). Measured on 38 nights: 24 failed, most on one transient blip, and nothing
-// retried until the next calendar day. The dispatcher now also fires at RETRY_CRON (11:17 UTC, four hours
+// retried until the next calendar day. The dispatcher now also fires at RETRY_CRON (09:17 UTC since 2026-10-24, four hours
 // after the night's first slot) and asks decideRetry(): re-dispatch ONLY when every corpus run of the
 // night so far ended `failed` (or reached no outcome), none is still running, none ended published /
 // no-change / superseded / canary-rejected (those are answers, not weather), and fewer than
@@ -37,9 +37,10 @@ import { pathToFileURL } from 'node:url';
 
 export const MIN_PIPELINE_VERSION = '4.3.38'; // sync-version-ignore: a fixed pipeline floor, not the current version
 /** The dispatcher's second schedule entry; corpus-nightly-dispatch.yml's `on.schedule` must carry exactly this line. */
-export const RETRY_CRON = '17 11 * * *';
-/** How far back the retry slot looks for the night's runs: past the 07:17 UTC first slot, never into yesterday. */
-export const RETRY_WINDOW_MS = 10 * 3_600_000;
+export const RETRY_CRON = '17 9 * * *';
+/** How far back the retry slot looks for the night's runs: past the 05:17 UTC first slot (with room for GitHub's late
+ * schedule starts), never into yesterday's slot or an evening manual dispatch. */
+export const RETRY_WINDOW_MS = 8 * 3_600_000;
 export const MAX_CORPUS_RUNS_PER_NIGHT = 2;
 // `unknown` (every job green, no outcome) is retried only when the run itself did NOT conclude success: a green
 // run that reached no outcome is a workflow defect the terminal-outcome job already fails loudly, not weather.

package/scripts/distill-project.mjs

@@ -48,7 +48,7 @@ const HOME = os.homedir();
 // install whose npm prefix is not the owner's (Homebrew, nvm, Volta, plain `npm -g`) was told its
 // tool was missing while ruflo sat on their PATH. One resolver, shared — see ruflo-bin.mjs.
 const RUFLO = resolveRuflo();
-const RUFLO_ENV = { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' };
+const RUFLO_ENV = { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false' };
 
 const argv = process.argv.slice(2);
 const arg = (f, d) => { const i = argv.indexOf(f); return i >= 0 && argv[i + 1] ? argv[i + 1] : d; };

package/scripts/falsify.mjs

@@ -179,7 +179,7 @@ export const CHECKS = [
       const rufloBin = resolveRuflo();
       const r = rufloBin
         ? spawnSync(rufloBin, ['memory', 'search', '-q', 'nightly job supervision heartbeat receipts'], {
-          cwd: ROOT, encoding: 'utf8', timeout: 120_000, env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' },
+          cwd: ROOT, encoding: 'utf8', timeout: 120_000, env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false' },
         })
         : { error: new Error(RUFLO_MISSING), stdout: '' };
       const recalled = /Found\s+\d+\s+results/.test(r.stdout || '') && !/Found\s+0\s+results/.test(r.stdout || '');

package/scripts/health-repair.mjs

@@ -54,7 +54,7 @@ const PROJECT = learningContext({ cwd: requestedProject || process.env.RUVNET_BR
  * that one global binary is rather than assuming a path.
  */
 const RUFLO = resolveRuflo();
-const RUFLO_ENV = { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' };
+const RUFLO_ENV = { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false' };
 
 const sqlite = (db, sql) => execFileSync('sqlite3', [db, sql], { encoding: 'utf8', timeout: 120_000 }).trim();
 

package/scripts/learning-replay-execution.mjs

@@ -32,7 +32,7 @@ const MUTATING_SUBCOMMANDS = new Set([
 // node_modules/@claude-flow/cli/dist/src/services/daemon-autostart.js:85). Applied here, once, so
 // every caller of spawnRuflo() gets it regardless of whether it passed its own `env`.
 function spawnRuflo(bin, args, options = {}) {
-  const opts = { ...options, env: { ...(options.env || process.env), RUFLO_DAEMON_AUTOSTART: '0' } };
+  const opts = { ...options, env: { ...(options.env || process.env), RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false' } };
   return /\.[cm]?js$/i.test(bin)
     ? spawnSync(process.execPath, [bin, ...args], opts)
     : spawnSync(bin, args, opts);
@@ -120,7 +120,7 @@ export function executeProducedCommand(cmd, {
     .find((value) => MUTATING_SUBCOMMANDS.has(value));
   if (mutating) return reject(`refused mutating subcommand "${mutating}"`, { argv: ['ruflo', ...args] });
 
-  const env = { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' };
+  const env = { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false' };
   delete env.CLAUDE_FLOW_DB_PATH;
   delete env.CLAUDE_FLOW_MEMORY_PATH;
   const result = spawnRuflo(ruflo, args, {
@@ -151,7 +151,7 @@ export function verifyRufloFlag(bin = RUFLO_BIN) {
   const result = spawnSync(bin, ['memory', 'search', '--help'], {
     encoding: 'utf8',
     timeout: 30_000,
-    env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' },
+    env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false' },
   });
   const output = `${result.stdout || ''}${result.stderr || ''}`;
   if (result.status !== 0 && !output) return { ok: false, why: `help exited ${result.status} empty` };

package/scripts/learning-replay-fixture.mjs

@@ -32,6 +32,9 @@ const sh = (cmd, args, options = {}) => {
     encoding: 'utf8',
     timeout: 120_000,
     ...options,
+    // A ruflo started here would auto-start a daemon and run its in-cwd self-update (`npm install @claude-flow/cli`,
+    // 1.3 GB measured 2026-10-22) in the fixture project; a caller's own env still wins.
+    env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false', ...(options.env || {}) },
   });
 };
 const remove = (target) => {

package/scripts/lesson-migrate-agentdb.mjs

@@ -96,7 +96,7 @@ function rufloJson(args) {
   const tmp = path.join(SCRATCH_DIR, `call-${callCounter++}.json`);
   const fd = fs.openSync(tmp, 'w');
   try {
-    execFileSync(RUFLO, args, { stdio: ['ignore', fd, 'ignore'], timeout: CLI_TIMEOUT_MS, env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' } });
+    execFileSync(RUFLO, args, { stdio: ['ignore', fd, 'ignore'], timeout: CLI_TIMEOUT_MS, env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false' } });
   } catch (e) {
     if (e.signal || e.code === 'ETIMEDOUT') {
       throw new Error(`ruflo ${args.join(' ')} did not finish within ${CLI_TIMEOUT_MS}ms (killed with ${e.signal || e.code}) — likely lock contention from a concurrent writer on this shared machine. Re-run.`);

package/scripts/nightly-wrapper.sh

@@ -150,10 +150,10 @@ fi
 # Memory distillation (ADR-174) had gone stale 3 days — same silent-death pattern as everything
 # else tonight. Independent of rebuild success/failure: mine raw memory_entries into structured
 # episodes/reasoning_patterns on every nightly run. Best-effort, never blocks the real job.
-RUFLO_DAEMON_AUTOSTART=0 ~/.npm-global/bin/ruflo memory distill run --path "$RUVNET_PROJECT_MEMORY_DB" >> "$LOG" 2>&1 || true
+RUFLO_DAEMON_AUTOSTART=0 CLAUDE_FLOW_AUTO_UPDATE=false ~/.npm-global/bin/ruflo memory distill run --path "$RUVNET_PROJECT_MEMORY_DB" >> "$LOG" 2>&1 || true
 # Durability: was a one-off manual snapshot before tonight. Now recurring — WAL-safe, rotates
 # automatically (keeps last 14), zero risk to the live DB (reads only).
-RUFLO_DAEMON_AUTOSTART=0 ~/.npm-global/bin/ruflo memory backup --db "$RUVNET_PROJECT_MEMORY_DB" --keep 14 >> "$LOG" 2>&1 || true
+RUFLO_DAEMON_AUTOSTART=0 CLAUDE_FLOW_AUTO_UPDATE=false ~/.npm-global/bin/ruflo memory backup --db "$RUVNET_PROJECT_MEMORY_DB" --keep 14 >> "$LOG" 2>&1 || true
 
 # LESSON BRIDGE (ADR-066, 2026-08-10) — carry newly-tagged machine-wide lessons into the store the
 # hooks actually read. Without this the bridge is a command someone has to remember, and a learning

package/scripts/proxy/claude-proxied.sh

@@ -26,6 +26,7 @@ set -euo pipefail
 # daemon-autostart.js:85). This script only checks/starts the proxy — it has no business leaving a
 # swarm daemon running as a side effect.
 export RUFLO_DAEMON_AUTOSTART=0
+export CLAUDE_FLOW_AUTO_UPDATE=false
 
 TOKEN_FILE="$HOME/.ruflo/proxy-token"
 

package/scripts/proxy/proxy-revert.sh

@@ -13,6 +13,7 @@ set -uo pipefail
 # live: ~/.npm-global/lib/node_modules/ruflo/node_modules/@claude-flow/cli/dist/src/services/
 # daemon-autostart.js:85). A teardown script has no business leaving one running.
 export RUFLO_DAEMON_AUTOSTART=0
+export CLAUDE_FLOW_AUTO_UPDATE=false
 
 echo "Reverting the Meta LLM Proxy trial..."
 echo

package/scripts/proxy/proxy-up.sh

@@ -11,6 +11,7 @@ set -uo pipefail
 # daemon-autostart.js:85). Installing/starting the proxy has no business leaving a swarm daemon
 # running as a side effect.
 export RUFLO_DAEMON_AUTOSTART=0
+export CLAUDE_FLOW_AUTO_UPDATE=false
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 

package/scripts/proxy/proxy-verify.mjs

@@ -60,7 +60,7 @@ try {
     // Every `ruflo` invocation auto-starts a project background daemon unless this is set
     // (verified live: ~/.npm-global/lib/node_modules/ruflo/node_modules/@claude-flow/cli/dist/src/
     // services/daemon-autostart.js:85) — a health-check probe must not leave one running.
-    env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' },
+    env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false' },
   });
   doctorOk = /Summary:.*passed/.test(doctorOut) && !/\b\d+ failed/.test(doctorOut);
 } catch (err) {

package/scripts/record-lesson.mjs

@@ -71,7 +71,7 @@ const ruflo = (args) => {
   const invocation = rufloInvocation(RUFLO, args);
   return execFileSync(invocation.executable, invocation.args, {
     cwd: dir, encoding: 'utf8', timeout: 60000, shell: false,
-    env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' },
+    env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false' },
   });
 };
 

package/scripts/selfcheck.mjs

@@ -613,7 +613,7 @@ export function runSecurityScan({ cwd = process.cwd(), timeoutMs = 20000, env =
   // Every `ruflo` invocation auto-starts a project background daemon unless this is set (verified
   // live against the installed CLI: ~/.npm-global/lib/node_modules/ruflo/node_modules/@claude-flow/cli/dist/src/services/daemon-autostart.js:85).
   // A read-only version probe + two scan subcommands have no business leaving a daemon running.
-  env = { ...env, RUFLO_DAEMON_AUTOSTART: '0' };
+  env = { ...env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false' };
   const probe = spawnSync('ruflo', ['--version'], { encoding: 'utf8', timeout: 5000, env });
   if (probe.error || probe.status !== 0) {
     return { available: false, reason: 'ruflo not found on PATH — MCP surface not scanned (install: npm i -g ruflo)' };

package/scripts/single-source-check.mjs

@@ -240,7 +240,7 @@ const checks = [
     run: () => { const s = readAbs(path.join(HOME, '.claude/settings.json')); return { ok: !/agentdb-autocapture/.test(s), detail: /agentdb-autocapture/.test(s) ? 'global agentdb-autocapture still registered alongside the plugin session-snapshot' : 'single writer' }; } },
 
   { id: 'E3', area: 'hooks', scope: 'machine', title: 'Lessons live in one store (no .swarm lesson-* rows outside the plugin lesson store)',
-    run: () => { const r = spawnSync('ruflo', ['memory', 'list', '--path', path.join(HOME, 'Code/ruvnet-brain/.swarm/memory.db'), '--limit', '500'], { encoding: 'utf8', timeout: 60000, env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' } });
+    run: () => { const r = spawnSync('ruflo', ['memory', 'list', '--path', path.join(HOME, 'Code/ruvnet-brain/.swarm/memory.db'), '--limit', '500'], { encoding: 'utf8', timeout: 60000, env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false' } });
       const n = (r.stdout.match(/lesson-/g) || []).length; return { ok: n === 0, detail: `${n} lesson-* rows in project .swarm (plugin store: ~/.config/ruvnet-brain/lessons.json)` }; } },
   { id: 'E4', area: 'hooks', scope: 'machine', title: 'One session-start continuity restorer (global hook stands down when the plugin is enabled)',
     run: () => { const s = readAbs(path.join(HOME, '.claude/hooks/agentdb-ensure.sh')); return { ok: s.includes('SINGLE CONTINUITY OWNER'), detail: 'agentdb-ensure.sh must stand down its project-state recall' }; } },

package/scripts/stack-sync.mjs

@@ -37,7 +37,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { runDeveloperUpdate, readDeveloperUpdateConfig } from '../plugin/scripts/developer-update.mjs';
-import { FAMILY, PLUGIN_MARKETPLACES, cmpVersion, pickTargetTag, normalizeNpmDistTags } from '../plugin/scripts/developer-update-policy.mjs';
+import { FAMILY, PLUGIN_MARKETPLACES, cmpVersion, pickTargetTag, normalizeNpmDistTags, normalizeNpmTimes, needsPublishTimes, wantedTag } from '../plugin/scripts/developer-update-policy.mjs';
 export { FAMILY, PLUGIN_MARKETPLACES, cmpVersion, pickTargetTag, normalizeNpmDistTags } from '../plugin/scripts/developer-update-policy.mjs';
 
 const HOME = os.homedir();
@@ -193,6 +193,13 @@ function registryTags(pkg) {
   try { return normalizeNpmDistTags(JSON.parse(r.stdout)); } catch { return null; }
 }
 
+// Publish times, so an abandoned pre-release tag is not reported as "behind" (same rule as the updater).
+function registryTimes(pkg) {
+  const r = spawnSync('npm', ['view', pkg, 'time', '--json'], { encoding: 'utf8', timeout: 30000 });
+  if (r.status !== 0 || !r.stdout) return null;
+  try { return normalizeNpmTimes(JSON.parse(r.stdout)); } catch { return null; }
+}
+
 // A second copy of a stack package in the npx cache can only ever SHADOW the global one.
 // It is never useful. This is how "two ruflos" happens.
 export function findShadows(npxCache = NPX_CACHE, lib = GLOBAL_LIB) {
@@ -228,11 +235,12 @@ export function classify(pkgs, { channel = readDeveloperUpdateConfig().channel }
     if (p.source === 'plugin') {
       return { ...p, tag: 'plugin', target: null, state: p.installed ? 'INSTALLED_UNVERIFIED' : 'BROKEN', evidence: 'local install record only; marketplace revision not checked' };
     }
-    const want = p.name === '@pacphi/agentic-kit' ? 'next' : channel === 'alpha' && FAMILY.test(p.name) ? 'alpha' : DEFAULT_TAG;
+    const want = wantedTag(p.name, channel);
     const tags = registryTags(p.name);
     // Newest of {policy tag, latest} — see pickTargetTag: "track @alpha" alone pinned the core behind
     // @latest on 2026-07-18. A package with no alpha tag falls through to latest.
-    const { tag, target } = pickTargetTag(tags, want);
+    const published = needsPublishTimes(tags, want) ? (registryTimes(p.name) || {}) : null;
+    const { tag, target } = pickTargetTag(tags, want, 'latest', { published });
     let state;
     if (!p.installed) state = 'BROKEN';
     else if (!target) state = 'UNRESOLVED';