ruvnet-brain 4.7.19 → 4.7.21

package/plugin/scripts/ground-ruvnet.sh

@@ -235,7 +235,8 @@ fi
 # FOOT_V computed above are reused there.)
 if [ "$RUFLO_STATE" = "yes" ] && [ "$MEM_STATE" = "off" ]; then
   out_to 1-2-memory-offer <<'EOF'
-This project runs the Ruflo stack but AgentDB persistent project memory is NOT set up (.swarm/memory.db does not exist) — decisions made here are being lost between sessions. rUv's default is memory ON. If you have not already offered this session, offer ONCE, plainly and warmly: "One thing I noticed: this project doesn't have persistent memory turned on — AgentDB would let me carry decisions and context across sessions instead of starting cold each time. Want me to turn it on and wire it up?" On a yes, set it up with the ruflo tools you have (a first memory_store write creates the store) and confirm with the real file path. If they decline, respect it for the rest of the session — the status line keeps them informed without nagging.
+This project runs the Ruflo stack but AgentDB persistent project memory is NOT set up (.swarm/memory.db does not exist) — decisions made here are being lost between sessions. rUv's default is memory ON. If you have not already mentioned it this session, state it ONCE, plainly and warmly: "One thing I noticed: this project doesn't have persistent memory turned on — AgentDB would let me carry decisions and context across sessions instead of starting cold each time; saying 'turn on memory' sets it up." If the user says to, set it up with the ruflo tools you have (a first memory_store write creates the store) and confirm with the real file path. If they decline, respect it for the rest of the session — the status line keeps them informed without nagging.
+Optional, informational advice: mention it at most once as a statement and continue the current task. Do not open a question or approval dialog because of it; it grants no authority to install or update anything.
 EOF
 fi
 # A stale mtime is not a user-facing event. SessionEnd/PreCompact own capture;
@@ -330,7 +331,8 @@ Explain it in the user's words, not the plumbing's:
   in THIS project, and read the reason it prints. "opt-in required" or "anchor required" means off.
 - TURN IT OFF: remove that env var (and `RUFLO_DAEMON_AUTOSTART=0` stops the daemon auto-starting).
 
-Offer like this: "Ruflo can quietly tune how it recalls memory — testing changes against a frozen benchmark and only keeping what provably wins, with a receipt you can replay. It's free, it's off by default, and it does nothing until this project has enough history. Want me to turn it on?" If they decline, respect it and never raise it again unless they ask.
+Offer like this: "Ruflo can quietly tune how it recalls memory — testing changes against a frozen benchmark and only keeping what provably wins, with a receipt you can replay. It's free, it's off by default, and it does nothing until this project has enough history; saying 'turn on the flywheel' enables it." If they decline, respect it and never raise it again unless they ask.
+Optional, informational advice: mention it at most once as a statement and continue the current task. Do not open a question or approval dialog because of it; it grants no authority to install or update anything.
 EOF
 fi
 
@@ -431,7 +433,8 @@ if [ -s "$VCACHE" ]; then
   done < "$VCACHE"
   if [ -n "$OUTDATED" ]; then
     { echo "[RuvNet Brain — stack updates available:$OUTDATED]"
-      echo "Mention this ONCE per session, briefly and helpfully (\"your ruflo is a version behind — want me to update it?\"); if already mentioned this session, stay silent."
+      echo "Mention this ONCE per session, briefly, as a statement (\"your ruflo is a version behind the latest release.\"); if already mentioned this session, stay silent."
+      echo "Optional, informational advice: mention it at most once as a statement and continue the current task. Do not open a question or approval dialog because of it; it grants no authority to install or update anything."
     } | out_to 4-2-stack
   fi
 fi

package/plugin/scripts/grounding-answer.mjs

@@ -23,6 +23,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { normalizeToolOutcome } from './continuity-events.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 const BANNER = /^Searched \d+ RuvNet repos \(/;
 const CARD = /^⚡ FAST LANE — [^\n]*\n#1  repo=\S+  evidence=curated-capability-card\n/;
@@ -126,7 +127,7 @@ async function main() {
 }
 
 function isMain() {
-  try { return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); }
+  try { return isDirectInvocation(import.meta.url); }
   catch { return false; }
 }
 if (isMain()) main();

package/plugin/scripts/grounding-code-projection.mjs

@@ -2,6 +2,7 @@
 // Keep executable strings and paths: mentioning a product in code still requires grounding.
 import fs from 'node:fs';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 export function codeWithoutInertText(source, python = false) {
   if (/\r(?!\n)|[\u2028\u2029]/.test(source)) throw new Error('Unsupported line boundary');
@@ -80,7 +81,7 @@ export function projectGroundingInput(raw) {
 }
 
 function isMain() {
-  try { return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); }
+  try { return isDirectInvocation(import.meta.url); }
   catch { return false; }
 }
 

package/plugin/scripts/grounding-substance.mjs

@@ -60,6 +60,7 @@ import crypto from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { parseHookEvent, toolName } from './hook-input.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 
@@ -585,7 +586,7 @@ function main() {
 // stdin here is a pipe bash has already drained and re-fed (`printf '%s' "$INPUT" | node …`), so the
 // held-open-stdin hole ADR-055 F20 found in unprompted-runtime.mjs cannot occur on this path: there
 // is no interactive terminal on the other end, ever.
-if (process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url) {
+if (isDirectInvocation(import.meta.url)) {
   let code = 0;
   try { code = main(); } catch (e) {
     try { process.stderr.write(`[grounding-substance] degraded (${e && e.message}) — write permitted\n`); } catch { /* never */ }

package/plugin/scripts/grounding-turn-gate.mjs

@@ -88,6 +88,7 @@ import {
   architectureShadow, auditAssertions, correctionText, describeSources, loadVocabulary, logShadow,
   relayShadow, ruvCapabilityClaims, searchedThisTurn, turnSources,
 } from './grounding-turn-evidence.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 const HOME = os.homedir();
 const EXIT_ALLOW = 0;
@@ -238,8 +239,7 @@ async function main() {
  *  helpers — same guard decision-gate.mjs uses, for the same reason (entrypoint-guard-safety). */
 function isMain() {
   try {
-    if (!process.argv[1]) return false;
-    return fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
+    return isDirectInvocation(import.meta.url);
   } catch { return false; }
 }
 

package/plugin/scripts/grounding-turn-mark.mjs

@@ -58,6 +58,7 @@ import { loadSettings, writeAtomic } from './user-settings.mjs';
 import { classifyPrompt, loadVocabulary } from './grounding-turn-evidence.mjs';
 import { answerOf, brainAnsweredResponse } from './grounding-answer.mjs';
 import { RUVNET_GATE1_TERMS } from './ruvnet-gate1-pattern.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 const HOME = os.homedir();
 export const MARKER_DIR = process.env.RUVNET_GROUNDING_TURN_DIR
@@ -305,8 +306,7 @@ async function main() {
  *  helpers — same guard decision-gate.mjs uses, for the same reason (entrypoint-guard-safety). */
 function isMain() {
   try {
-    if (!process.argv[1]) return false;
-    return fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
+    return isDirectInvocation(import.meta.url);
   } catch { return false; }
 }
 

package/plugin/scripts/hook-context-budget.mjs

@@ -3,6 +3,7 @@ import path from 'node:path';
 import os from 'node:os';
 import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 export const FRAME_KIND = 'brain-owned-context-blocks';
 const digest = (value) => crypto.createHash('sha256').update(value).digest('hex');
@@ -73,7 +74,7 @@ export function emitOwnedContext(frame, { env = process.env, rawText = false } =
 }
 
 let direct = false;
-try { direct = fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url); } catch {}
+try { direct = isDirectInvocation(import.meta.url); } catch {}
 if (direct && process.argv[2] === '--ground-dir') {
   const directory = process.argv[3]; const blocks = [];
   for (const id of fs.readdirSync(directory).filter((id) => /^\d+-\d+-[\w-]+$/.test(id)).sort((a, b) => Number(a.split('-')[0]) - Number(b.split('-')[0]))) {

package/plugin/scripts/hook-input.mjs

@@ -28,6 +28,7 @@
 
 import fs from 'node:fs';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 // ── GROK CLI PAYLOADS (4.5) ──────────────────────────────────────────────────────────────────────
 //
@@ -677,8 +678,7 @@ export function invocationLines(cmd, tools) {
 // argv[1] pointing at some other file.
 function isMain() {
   try {
-    if (!process.argv[1]) return false;
-    return fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
+    return isDirectInvocation(import.meta.url);
   } catch {
     return false;
   }

package/plugin/scripts/hook-shim.mjs

@@ -215,8 +215,13 @@ if (BRAIN_OFF && entry.offBehavior === 'silence') process.exit(0);
 // prompt. They stay registered and run only when RUVNET_STOP_NUDGES=full, so nothing is deleted and the
 // tests still exercise them. The blocking hooks (decision-gate), the grounding directive and the silent
 // capture hooks are unaffected.
-const QUIET_BY_DEFAULT = new Set(['unprompted-speech', 'capacity-aware-parallel-work', 'grounding-turn-gate']);
-if (QUIET_BY_DEFAULT.has(hookId) && String(process.env.RUVNET_STOP_NUDGES || '').toLowerCase() !== 'full') process.exit(0);
+// unprompted-speech is not exited (2026-10-25): its lesson channel is the only route a recorded correction
+// takes to the next prompt, and exiting it whole silenced every learned lesson from 4.7.8 (D4 wire: 0 bytes).
+// Quiet runs only its lesson/alarm producers; advocacy, promotion and anticipate offers stay silent.
+const NUDGES_FULL = String(process.env.RUVNET_STOP_NUDGES || '').toLowerCase() === 'full';
+const QUIET_BY_DEFAULT = new Set(['capacity-aware-parallel-work', 'grounding-turn-gate']);
+if (QUIET_BY_DEFAULT.has(hookId) && !NUDGES_FULL) process.exit(0);
+const QUIET_SPEECH_CHANNELS = hookId === 'unprompted-speech' && !NUDGES_FULL ? 'lesson,alarm' : null;
 
 // Read a bounded payload before dispatch. The ground body owns the quiet-prompt
 // decision because it resolves canonical memory beyond the hook process's cwd.
@@ -370,6 +375,7 @@ function registeredTimeoutMs(extraArgs) {
 // chosen from the typed table — never from input.
 function runHook(file, activeVersion = '') {
   if (!fs.existsSync(file)) return 0; // nothing to run — never invent a failure
+  try { if (QUIET_SPEECH_CHANNELS && !fs.readFileSync(file, 'utf8').includes('RUVNET_UNPROMPTED_CHANNELS')) return 0; } catch { return 0; } // quiet + a <=4.7.20 spine body that ignores the narrowing (it would speak advocacy) → the old whole-hook quiet exit
   let cmd;
   if (entry.interpreter === 'node') {
     cmd = process.execPath;
@@ -395,6 +401,7 @@ function runHook(file, activeVersion = '') {
     // machine where `node` is not on the PATH the host hands its hooks. Additive: older bodies ignore it.
     RUVNET_NODE_BIN: process.execPath,
     ...(['unprompted-speech', 'ground-ruvnet', 'decision-gate'].includes(hookId) ? { RUVNET_HOOK_CONTEXT_BUDGET: '1' } : {}),
+    ...(QUIET_SPEECH_CHANNELS ? { RUVNET_UNPROMPTED_CHANNELS: QUIET_SPEECH_CHANNELS } : {}),
     ...(activeVersion ? { RUVNET_BRAIN_ACTIVE_VERSION: activeVersion } : {}),
     ...(BRAIN_OFF && entry.offBehavior === 'partial' ? { RUVNET_BRAIN_OFF: '1' } : {}),
   };

package/plugin/scripts/host-update.mjs

@@ -2,7 +2,7 @@
 // Host-neutral automatic updater. The published installer is the single coordinator for Claude
 // Code and Codex, so lifecycle updates cannot drift into host-specific shell pipelines again.
 import { spawnSync } from 'node:child_process';
-import { automaticInvocation, automaticPath, updateSource } from './automatic-update.mjs';
+import { automaticInvocation, automaticPath, installedUpdater, updateSource } from './automatic-update.mjs';
 import { developerCoordinatorOwner } from './developer-update-owner.mjs';
 
 const CHILD_ENV_KEYS = new Set([
@@ -92,7 +92,20 @@ if (knowledgeAt >= 0) {
       // Decide by the recorded IDENTITY verdict whenever this run wrote one; the exit code only when it did
       // not (a network failure or an incompatible release dies before recording). Measured against the real
       // API: an install whose profile selects no stores exits 0 on UPDATE_AVAILABLE ("All stores current").
-      const newer = verdict ? ['UPDATE_AVAILABLE', 'UNKNOWN'].includes(verdict) : check.status === 10;
+      let newer = verdict ? ['UPDATE_AVAILABLE', 'UNKNOWN'].includes(verdict) : check.status === 10;
+      // Exit 5 is a remembered rejection keyed to the KB's runtime stamp. Only the installer re-stamps it, so when the
+      // version that would run differs from the stamp, run the update anyway (AuditC #5; the coordinator does the same).
+      if (!newer && !verdict && check.status === 5) {
+        let stamped = null, target = null;
+        try { stamped = readJson(path.join(kbDir, 'RUNTIME-IDENTITY.json'))?.brainVersion || null; } catch { /* no stamp */ }
+        try {
+          if (source === 'latest') {
+            const response = await fetch('https://registry.npmjs.org/ruvnet-brain/latest', { signal: AbortSignal.timeout(5_000) });
+            target = response.ok ? (await response.json()).version || null : null;
+          } else target = installedUpdater().version || null;
+        } catch { /* unknown target: stays incompatible */ }
+        newer = Boolean(target && target !== stamped);
+      }
       if (!newer && (verdict || check.status === 0)) {
         note({ outcome: verdict === 'REFUSED' ? 'refused' : 'current', verdict: verdict || 'CURRENT', candidateTag, reason: '' });
         stop();
@@ -125,7 +138,9 @@ if (knowledgeAt >= 0) {
       const invocation = automaticInvocation(['--update', '--no-nightly-prompt'], { source });
       const run = spawnSync(invocation.executable, invocation.args, {
         env: childEnvironment(), encoding: 'utf8', maxBuffer: 64 * 1024 * 1024,
-        timeout: Number(process.env.RUVNET_KNOWLEDGE_UPDATE_TIMEOUT_MS || 25 * 60_000),
+        // Above the coordinator's installer limit (135 min: a 90-minute bundle deadline plus the apply), below the
+        // SessionStart TTL (session-start-update-plane.mjs AUTO_UPDATE_POLICY.ttlSec), so an outcome is always recorded.
+        timeout: Number(process.env.RUVNET_KNOWLEDGE_UPDATE_TIMEOUT_MS || 150 * 60_000),
       });
       process.stdout.write(run.stdout || '');
       process.stderr.write(run.stderr || '');
@@ -133,8 +148,11 @@ if (knowledgeAt >= 0) {
       const tail = `${run.stderr || ''}\n${run.stdout || ''}`.replace(/\u001b\[[0-9;]*m/g, '')
         .split('\n').map((line) => line.trim()).filter(Boolean);
       const code = run.error ? null : run.status;
-      record({ outcome: code === 0 ? 'succeeded' : 'failed', code,
-        reason: code === 0 ? '' : String(run.error?.message || tail.find((l) => /✗|error|fail/i.test(l)) || tail.at(-1) || 'no output').slice(0, 200) });
+      // Exit 12 is the installer's "knowledge applied, redundant rollback cleanup still pending"; the coordinator
+      // (developer-update.mjs) accepts it as success too. Recording it FAILED spoke a false failure line.
+      const succeeded = code === 0 || code === 12;
+      record({ outcome: succeeded ? 'succeeded' : 'failed', code,
+        reason: succeeded ? '' : String(run.error?.message || tail.find((l) => /✗|error|fail/i.test(l)) || tail.at(-1) || 'no output').slice(0, 200) });
     }
   } catch (error) {
     record({ outcome: 'failed', code: null, reason: error.message.slice(0, 200) });
@@ -147,6 +165,12 @@ if (knowledgeAt >= 0) {
 let invocation;
 try { invocation = automaticInvocation(['--update', '--host-sync-only', '--no-nightly-prompt']); }
 catch (error) { process.stderr.write(`[ruvnet-brain] automatic update refused: ${error.message}\n`); process.exit(1); }
+if (invocation.source === 'developer-suite') {
+  // The coordinator installs code packages only in its scheduled run, and its knowledge step belongs to the SessionStart
+  // self-heal (--knowledge, sized for the bundle download). Running it here under a 9-minute limit would kill it mid-apply.
+  process.stdout.write('[ruvnet-brain] coordinated updates own this machine: the scheduled nightly installs new code; knowledge updates run from the SessionStart self-heal\n');
+  process.exit(0);
+}
 const result = spawnSync(invocation.executable, invocation.args, {
   // The downloaded package must not inherit unrelated API keys, cloud credentials, or tokens from
   // the interactive host. npm's registry integrity protects the package bytes; this boundary

package/plugin/scripts/identifier-preflight.mjs

@@ -36,6 +36,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 /**
  * Each entry knows how to enumerate the identifiers its CLI actually accepts on THIS machine.
@@ -118,7 +119,7 @@ export function check(command, opts = {}) {
 }
 
 const isMain = (() => {
-  try { return process.argv[1] && fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url); }
+  try { return isDirectInvocation(import.meta.url); }
   catch { return false; }
 })();
 

package/plugin/scripts/kb-copy-proof.mjs

@@ -14,7 +14,18 @@
 //     listed with these exact bytes in the copy's own ARCHIVE-MANIFEST.json, or a public store family (named by either COVERAGE.json
 //     or the live SOURCE.json) that a newer release replaced or retired;
 //   * installer-written or reinstallable (node_modules/, the updater/validator files the installer places);
-//   * a symbolic link identical in the live brain (links are compared, never followed).
+//   * a symbolic link identical in the live brain (links are compared, never followed);
+//   * (#335) a regular file byte-identical at the same path in a KEPT sibling: another copy the caller has
+//     already decided to retain, or a `kb.archive/<stamp>/<copy>/` tree. The caller passes only copies that
+//     stay on disk, so duplicate preserved copies release down to one and no unique byte is lost.
+//   * an OPERATIONAL file the Brain's own processes (or a ruflo hook run with the KB as its cwd) wrote into
+//     the tree: a top-level update.log / forge-update.log / forge-guard-injection.log, or ruflo's
+//     .claude-flow/ scratch, each a regular file of at most RESCUE_CAP_BYTES (RESCUE_TOTAL_CAP_BYTES per
+//     copy). No bundle ships these and nothing reads them back, but a log can be the only trace of a failed
+//     night, so they are not just dropped: they are returned as `rescue` (with their bytes), and the caller
+//     copies them out with footprint-io.mjs rescueOperationalFiles BEFORE it removes the copy; a failed
+//     rescue keeps the copy. The rescued files are kept for the newest released copies (brain-footprint.mjs
+//     FOOTPRINT_POLICY.rescuedCopiesKept).
 // Anything else — a user's own file, an unfenced store, a link the live brain lacks — KEEPS the copy, and
 // is named. Paths are checked for symlink ancestors within both KB roots before any exemption; host
 // aliases above those roots (such as macOS /tmp) are not traversed as part of this check. Invalid metadata,
@@ -54,11 +65,25 @@ const stemOf = (file) => path.basename(String(file)).replace(/(?:\.big)?\.rvf$/i
 const storeStem = (file) => path.basename(String(file)).toLowerCase()
   .replace(/-primer\.md$/, '').replace(/(?:\.big)?\.rvf(?:\.[a-z]+\.json)?$/, '')
   .replace(/(?:\.big)?(?:\.(?:meta|symbols)\.json|\.passages\.jsonl)$/, '');
+// Operational files (see the header). Top-level logs by exact name: plugin/scripts/nightly-scheduler.mjs
+// installScheduler (update.log), kb/forge-guard-injection.mjs LOG_PATH, kb/forge-update.mjs's documented
+// cron line (forge-update.log). .claude-flow/ is ruflo's working state, the same debris brain-footprint.mjs
+// RUFLO_DEBRIS removes from ruflo-cwd. A larger file, a link, or anything else (.swarm/ included) stays unique,
+// and so does every operational file past RESCUE_TOTAL_CAP_BYTES per copy (the rescue itself is bounded).
+const OPERATIONAL_LOG = /^(?:update|forge-update|forge-guard-injection)\.log$/;
+export const RESCUE_CAP_BYTES = 2 * 1024 * 1024;
+export const RESCUE_TOTAL_CAP_BYTES = 16 * 1024 * 1024;
+const isOperational = (relative) => (!relative.includes(path.sep) && OPERATIONAL_LOG.test(relative))
+  || (relative.split(path.sep)[0] === '.claude-flow' && relative.includes(path.sep));
 // Files the installer/updater writes into a KB that no bundle ships (bin/install.mjs placeUpdater,
 // placeTrustedCoverageValidator, ensureVerifier; the updater's snapshot receipt). Re-created on every install.
-const INSTALLER_WRITTEN = new Set(['coverage-integrity.mjs', 'RUNTIME-IDENTITY.json', '.refresh-snapshot.json',
+// Every bin/install.mjs UPDATER_FILES name must be here (tests/unit/kb-copy-proof-unknown-content.test.mjs holds the
+// two lists together): download-retry.mjs and forge-guard-injection.mjs were placed but missing, so an old copy whose
+// placed version differed from both the live file and its own manifest was kept as "unique" (review round 2, Opus #5).
+export const INSTALLER_WRITTEN = new Set(['coverage-integrity.mjs', 'RUNTIME-IDENTITY.json', '.refresh-snapshot.json',
   'forge-update.mjs', 'zip-extract.mjs', 'brain-profile.mjs', 'refresh-run.mjs', 'update-storage-transaction.mjs',
-  'lifecycle-evidence-retention.mjs', 'corpus-release-identity.mjs', 'verify-citation.mjs', 'package-lock.json', '.DS_Store']);
+  'lifecycle-evidence-retention.mjs', 'corpus-release-identity.mjs', 'download-retry.mjs', 'forge-guard-injection.mjs',
+  'verify-citation.mjs', 'package-lock.json', '.DS_Store']);
 
 /** A directory that is a knowledge-base tree (SOURCE.json plus a store or the search entry point). */
 export const isKbTree = (dir) => Boolean(lstat(path.join(dir, 'SOURCE.json')))
@@ -140,10 +165,11 @@ function metadataFailure(root) {
 }
 
 /**
- * @returns {{disposable: boolean, unique: {file: string, why: string}[], reason: string}} — a kept copy
- * always names the files that keep it.
+ * @returns {{disposable: boolean, unique: {file: string, why: string}[], rescue?: {file: string, bytes: number,
+ * sha256: string}[], reason: string}} — a kept copy always names the files that keep it; a disposable copy
+ * lists the operational files that must be rescued before it is removed.
  */
-export function kbCopyProof({ copyDir, liveDir }) {
+export function kbCopyProof({ copyDir, liveDir, keptSiblings = [] }) {
   const copy = lstat(copyDir);
   if (!copy || copy.isSymbolicLink() || !copy.isDirectory()) return { disposable: false, unique: [], reason: 'not a real directory (a link is never entered)' };
   const live = lstat(liveDir);
@@ -172,7 +198,19 @@ export function kbCopyProof({ copyDir, liveDir }) {
   // it lists with these exact bytes is a public, re-downloadable release file.
   const shipped = new Map((readJson(path.join(copyDir, 'ARCHIVE-MANIFEST.json'))?.files || [])
     .filter((f) => typeof f?.path === 'string').map((f) => [path.normalize(f.path), f]));
-  const unique = [];
+  // #335: retained siblings that may account for a file. Only real directories, never the copy or live itself.
+  const siblings = (Array.isArray(keptSiblings) ? keptSiblings : []).filter((dir) => {
+    const st = lstat(dir);
+    return st && st.isDirectory() && !st.isSymbolicLink() && path.resolve(dir) !== path.resolve(copyDir)
+      && path.resolve(dir) !== path.resolve(liveDir);
+  });
+  let bySibling = 0;
+  const inKeptSibling = (relative) => {
+    const hit = siblings.some((dir) => safeAncestors(dir, relative) && sameBytes(path.join(copyDir, relative), path.join(dir, relative)));
+    if (hit) bySibling += 1;
+    return hit;
+  };
+  const unique = []; const rescue = []; let rescueBytes = 0;
   let files;
   try { files = walk(copyDir); } catch (error) { return { disposable: false, unique, reason: `unreadable copy: ${error.message}` }; }
   for (const { relative, link, size } of files) {
@@ -183,7 +221,7 @@ export function kbCopyProof({ copyDir, liveDir }) {
       continue;
     }
     if (isPrivate) {
-      if (!sameBytes(path.join(copyDir, relative), inLive)) {
+      if (!sameBytes(path.join(copyDir, relative), inLive) && !inKeptSibling(relative)) {
         unique.push({ file: relative, why: lstat(inLive) ? 'private file differs from the live brain' : 'private file absent from the live brain' });
       }
       continue;
@@ -202,9 +240,19 @@ export function kbCopyProof({ copyDir, liveDir }) {
     if (listed && listed.bytes === size && listed.sha256 === sha256File(path.join(copyDir, relative))) continue;
     if (sameBytes(path.join(copyDir, relative), inLive)) continue; // existence alone proves no ownership or redundancy
     if (publicNames.has(storeStem(relative))) continue; // a public store family a newer release replaced or retired
+    if (inKeptSibling(relative)) continue; // #335: these exact bytes stay in a retained sibling copy or the archive
+    if (isOperational(relative) && size <= RESCUE_CAP_BYTES && rescueBytes + size <= RESCUE_TOTAL_CAP_BYTES) {
+      rescue.push({ file: relative, bytes: size, sha256: sha256File(path.join(copyDir, relative)) });
+      rescueBytes += size;
+      continue;
+    }
+    if (isOperational(relative)) { unique.push({ file: relative, why: 'an operational file past the rescue cap (2 MiB each, 16 MiB per copy)' }); continue; }
     unique.push({ file: relative, why: 'not in the live brain, not in this copy\'s release manifest, not a public store' });
   }
   return unique.length
     ? { disposable: false, unique, reason: `holds ${unique.length} file(s) the live brain does not: ${unique.slice(0, 4).map((u) => u.file).join(', ')}${unique.length > 4 ? ', …' : ''}` }
-    : { disposable: true, unique, reason: 'every private file is byte-identical in the live brain; public bytes are re-downloadable' };
+    : { disposable: true, unique, rescue, reason: `${bySibling
+      ? `${bySibling} file(s) the live brain lacks are byte-identical in a kept copy or kb.archive; the rest is in the live brain or re-downloadable`
+      : 'every private file is byte-identical in the live brain; public bytes are re-downloadable'}${
+      rescue.length ? `; ${rescue.length} operational log/scratch file(s) are rescued to the brain home first` : ''}` };
 }

package/plugin/scripts/learn-capture.mjs

@@ -9,6 +9,7 @@ import { learningContext } from './runtime-preferences.mjs';
 import { recordLearningObservation, distillObservations, observationKey } from './learning-store.mjs';
 import { resolveRuflo } from './ruflo-bin.mjs';
 import { recordHookFailure } from './hook-failures.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 // LOAD BOUNDS (measured 2026-10-21: one busy session spawned hundreds of concurrent detached `ruflo memory store`
 // children, which timed out against each other and wrote 826 ledger rows in a day). Owner ruling 2026-10-12 stands:
@@ -148,7 +149,7 @@ function runDetached(mode) {
   } catch (error) { fail(error); } finally { if (process.env.RUVNET_LEARN_SLOT) releaseObserveSlot(process.env.RUVNET_LEARN_SLOT); }
 }
 
-const isMain = (() => { try { return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); } catch { return false; } })();
+const isMain = isDirectInvocation(import.meta.url);
 if (isMain && ['--observe', '--distill'].includes(process.argv[2])) {
   runDetached(process.argv[2]);
   process.exit(0);

package/plugin/scripts/learning-store.mjs

@@ -17,23 +17,29 @@ export function learningTarget(context, { env = process.env, explicitLegacyApply
   const root = path.join(context.home, '.claude', 'global-memory');
   const chosen = loadRuntimePreferences({ env, cwd: context.projectDir }).values.learningScope === 'user';
   if (!chosen && !explicitLegacyApply) throw new Error('user learning requires persisted user consent or explicit legacy Apply');
-  const rootStat = fs.lstatSync(root);
-  if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) throw new Error('user learning root is not a real directory');
+  // #377: the user store is a FIXED path, validated directly. It is not a project, so no Git root is
+  // resolved (a ~/.claude that is itself a Git checkout made every user write "foreign global learner
+  // root"), and a missing store says so instead of surfacing a raw lstat ENOENT.
   const db = path.join(root, '.swarm', 'memory.db');
-  if (!fs.lstatSync(db).isFile()) throw new Error('user store not adopted');
-  const resolved = resolveProjectStore({ projectDir: root, requestedStorePath: db, gitTimeoutMs: 1000 });
-  if (resolved.projectRoot !== root) throw new Error('foreign global learner root');
-  return resolved.canonicalAgentDbPath;
+  const entry = (file) => { try { return fs.lstatSync(file); } catch (error) { if (error.code === 'ENOENT') return null; throw error; } };
+  const [rootStat, swarmStat, dbStat] = [root, path.dirname(db), db].map(entry);
+  if (!rootStat || !swarmStat || !dbStat) throw new Error(`user store not adopted (no ${db})`);
+  if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) throw new Error('user learning root is not a real directory');
+  if (!swarmStat.isDirectory() || swarmStat.isSymbolicLink()) throw new Error('user learning .swarm is not a real directory');
+  if (!dbStat.isFile() || dbStat.isSymbolicLink() || dbStat.nlink !== 1) throw new Error('user store is not an exclusive regular file');
+  const canonicalRoot = path.join(fs.realpathSync.native(context.home), '.claude', 'global-memory');
+  if (fs.realpathSync.native(root) !== canonicalRoot) throw new Error('user learning root is reached through a link');
+  return path.join(canonicalRoot, '.swarm', 'memory.db');
 }
 
-export function runLearningRuflo(binary, args, db, { env = process.env, deadline = Date.now() + 18_000, maxStepMs = 6000 } = {}) {
+export function runLearningRuflo(binary, args, db, { env = process.env, deadline = Date.now() + 18_000, maxStepMs = 6000, maxBuffer = 65536 } = {}) {
   const remaining = deadline - Date.now();
   if (remaining <= 0) throw new Error('learning deadline exhausted');
   const cwd = rufloRunDir(db, { root: env.RUVNET_RUFLO_CWD_ROOT || path.join(env.HOME || env.USERPROFILE || os.homedir(), '.cache', 'ruvnet-brain', 'learning-ruflo') });
   try {
     const invocation = rufloInvocation(binary, args);
     return spawnSync(invocation.executable, invocation.args, { cwd, env: { ...env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_AUTO_UPDATE: 'false' },
-      encoding: 'utf8', shell: false, timeout: Math.min(maxStepMs, remaining), killSignal: 'SIGKILL', maxBuffer: 65536, windowsHide: true });
+      encoding: 'utf8', shell: false, timeout: Math.min(maxStepMs, remaining), killSignal: 'SIGKILL', maxBuffer, windowsHide: true });
   } finally { fs.rmSync(cwd, { force: true, recursive: true }); }
 }
 
@@ -73,15 +79,53 @@ export function recordLearningObservation(binary, context, { tool, action, sessi
   return { db, key, digest: createHash('sha256').update(value).digest('hex'), exactCli: true };
 }
 
-/** Observation count through `ruflo memory list` (no direct SQLite). Unknown stays unknown. */
-export function learningStoreStatus(db, { binary = resolveRuflo(), env = process.env } = {}) {
-  if (!binary) return { known: false, observations: 0, patterns: null, lastDistillAt: null };
+/**
+ * The namespace's last distillation from `ruflo memory distill status --db` (#377). That command has
+ * only a table output: the `distill_state cursor` table's Namespace column is 20 wide, so
+ * `learning-observations` prints as `learning-observat...`; a truncated cell matches by prefix, and
+ * an ambiguous or unreadable answer stays unknown. `null` with known=true means never distilled.
+ */
+export function parseDistillStatus(text, namespace = LEARNING_NAMESPACE) {
+  const lines = String(text || '').replace(/\u001b\[[0-9;]*m/g, '').split(/\r?\n/);
+  const start = lines.findIndex((line) => /distill_state cursor/.test(line));
+  if (start < 0) return /No distill_state cursor rows yet/.test(lines.join('\n')) ? { known: true, lastDistillAt: null } : { known: false, lastDistillAt: null };
+  const rows = [];
+  for (const line of lines.slice(start + 1)) {
+    const cells = line.split('|').map((cell) => cell.trim());
+    if (cells.length < 5 || cells[1] === 'Namespace') continue;
+    rows.push({ name: cells[1], lastRun: cells[3] });
+  }
+  const exact = rows.filter((row) => row.name === namespace);
+  const truncated = rows.filter((row) => row.name.endsWith('...') && namespace.startsWith(row.name.slice(0, -3)));
+  const matches = exact.length ? exact : truncated;
+  if (!matches.length) return { known: true, lastDistillAt: null };
+  if (matches.length > 1) return { known: false, lastDistillAt: null };
+  if (matches[0].lastRun === 'never') return { known: true, lastDistillAt: null };
+  const at = Date.parse(matches[0].lastRun);
+  return Number.isFinite(at) ? { known: true, lastDistillAt: new Date(at).toISOString() } : { known: false, lastDistillAt: null };
+}
+
+/** Observation count through `ruflo memory list` and the last distillation through `ruflo memory distill status` (no direct SQLite). Unknown stays unknown. */
+export function learningStoreStatus(db, { binary = resolveRuflo(), env = process.env, run = runLearningRuflo } = {}) {
+  const unknown = { known: false, observations: 0, patterns: null, lastDistillAt: null, distillKnown: false, pendingObservations: null, oldestPendingAt: null };
+  if (!binary) return unknown;
   try {
-    const listed = runLearningRuflo(binary, ['memory', 'list', '--namespace', LEARNING_NAMESPACE, '--limit', '100000', '--format', 'json', '--path', db], db, { env });
+    const listed = run(binary, ['memory', 'list', '--namespace', LEARNING_NAMESPACE, '--limit', '100000', '--format', 'json', '--path', db], db, { env, maxBuffer: 64 * 1024 * 1024 });
     const text = String(listed.stdout || ''); const at = text.indexOf('[');
-    if (listed.status !== 0 || at < 0) return { known: false, observations: 0, patterns: null, lastDistillAt: null };
-    return { known: true, observations: JSON.parse(text.slice(at)).length, patterns: null, lastDistillAt: null };
-  } catch { return { known: false, observations: 0, patterns: null, lastDistillAt: null }; }
+    if (listed.status !== 0 || at < 0) return unknown;
+    const rows = JSON.parse(text.slice(at));
+    let distill = { known: false, lastDistillAt: null };
+    try {
+      const status = run(binary, ['memory', 'distill', 'status', '--db', db], db, { env });
+      if (!status.error && status.status === 0) distill = parseDistillStatus(status.stdout);
+    } catch { /* distillation state stays unknown */ }
+    const since = distill.lastDistillAt ? Date.parse(distill.lastDistillAt) : -Infinity;
+    // Observations recorded after the last distillation are the ones still waiting for it.
+    const pending = distill.known ? rows.filter((row) => !(Number(row?.createdAt) <= since)) : null;
+    const oldest = pending ? Math.min(...pending.map((row) => Number(row?.createdAt)).filter(Number.isFinite)) : Infinity;
+    return { known: true, observations: rows.length, patterns: null, lastDistillAt: distill.lastDistillAt, distillKnown: distill.known,
+      pendingObservations: pending ? pending.length : null, oldestPendingAt: Number.isFinite(oldest) ? new Date(oldest).toISOString() : null };
+  } catch { return unknown; }
 }
 
 /** `ruflo memory backup` then `ruflo memory distill run`; both are rUv's own commands. */
@@ -118,9 +162,11 @@ export function observeLearning(options = {}) {
   if (!context.enabled) return result;
   try {
     result.learningDb = learningTarget(context, { env });
-    const state = learningStoreStatus(result.learningDb, { env });
+    const state = learningStoreStatus(result.learningDb, { env, ...(options.binary ? { binary: options.binary } : {}), ...(options.run ? { run: options.run } : {}) });
     result.statusKnown = state.known; result.trajectories = state.observations; result.observations = state.observations;
     result.patterns = state.patterns; result.lastDistillAt = state.lastDistillAt;
+    result.distillKnown = state.distillKnown; result.pendingObservations = state.pendingObservations; result.oldestPendingAt = state.oldestPendingAt;
+    if (state.lastDistillAt) result.lastTrainSeconds = Math.max(0, Math.round(((options.now ?? Date.now()) - Date.parse(state.lastDistillAt)) / 1000));
   } catch { /* Missing consent/store/readback remains unknown. */ }
   return result;
 }

package/plugin/scripts/lesson-bridge.mjs

@@ -24,6 +24,7 @@ import { execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { makeLesson, updateLessons, loadLessons, ENFORCEMENT, ORIGIN, STATUS, TRIGGERS } from './lesson-store.mjs';
 import { loadNodeSqlite } from './node-sqlite.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 /** Every bridged lesson id starts with this. It is how a merge knows which rows it owns. */
 export const BRIDGE_PREFIX = 'G-';
@@ -250,8 +251,7 @@ const argv = process.argv.slice(2);
  */
 function isMain() {
   try {
-    if (!process.argv[1]) return false;
-    return fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
+    return isDirectInvocation(import.meta.url);
   } catch { return false; }
 }
 if (isMain()) {