ruvnet-brain 4.7.20 → 4.7.21

package/plugin/scripts/lesson-promote.mjs

@@ -36,6 +36,8 @@
  *   node scripts/lesson-promote.mjs --json          # machine-readable, for the console
  *   node scripts/lesson-promote.mjs --apply         # write the promotion block (backs up first)
  *   node scripts/lesson-promote.mjs --min-projects 3
+ *   node scripts/lesson-promote.mjs --demote-theme <key>   # reject a theme — sticky, never re-proposed
+ *   node scripts/lesson-promote.mjs --restore-theme <key>  # undo a demotion
  */
 import fs from 'node:fs';
 import path from 'node:path';
@@ -124,34 +126,55 @@ export function collectLessons(root = PROJECTS) {
  * other project's context.
  */
 /**
- * Themes the user has explicitly rejected. Read from the lesson store's demoted rows.
+ * THE DEMOTED-THEMES FILE — where "reject this theme, permanently" is recorded, and why it is not a
+ * field on a lesson row.
  *
- * WITHOUT THIS, DEMOTION WAS THEATRE. `lesson-ratify.mjs --demote` set a flag the miner never
- * looked at, so the next mining run would re-propose the exact rule the user had just deleted.
- * ADR-030 §5 states the requirement plainly — "a one-click demote that the next nightly silently
- * undoes is worse than no demote at all, because the user stops trusting the control and, correctly,
- * stops using it" — and the code did not implement it. Verified 2026-07-22: zero references to
- * `demoted` in this file.
+ * The original design (2026-07-22) stored a `themeKey` on a demoted lesson inside `lessons.json` and
+ * read it back here. It never worked, and could not have: `makeLesson()` (`lesson-store.mjs`)
+ * destructures a FIXED field set and freezes the result, so an unknown key — `themeKey` included — is
+ * silently dropped the moment a row passes through it. Verified 2026-09-07 by construction: a
+ * hand-edited row carrying `themeKey` survives only until the very next legitimate write ANYWHERE in
+ * the store (`lesson-ratify.mjs --demote`, `updateLessons()`, any `loadLessons()` → `saveLessons()`
+ * round trip) — at that point every row, not just the one touched, has been re-serialized through
+ * `makeLesson()` and the field is gone. There was also no writer at all: `lesson-ratify.mjs --demote`
+ * only ever demotes by lesson `id`, never by theme. `demotedThemeKeys()` therefore always returned an
+ * empty set in every real invocation, and the sticky-demotion guard in `analyze()` below could never
+ * fire — the exact "demotion is theatre" failure ADR-030 §5 names, just for a different reason than
+ * the 2026-07-22 comment this replaces described.
  *
- * Read defensively: the store may be absent, locked, or from a newer schema. A miner that throws
- * because it could not read an optional file is worse than one that proposes a rejected theme.
+ * `lesson-gate.mjs`'s `OPTIN_PATH` documents the identical failure shape for a different field
+ * (`userOptedIntoBlocking`) and moved that consent to its own file for exactly this reason. That
+ * precedent was never applied here; it is now. Theme demotion gets its own small file, written only
+ * by `--demote-theme` / `--restore-theme` below, and never touched by the mining or lesson-store
+ * write paths — so no future lesson-store write can silently erase it.
  */
-function demotedThemeKeys() {
+export const DEMOTED_THEMES_PATH = process.env.RUVNET_DEMOTED_THEMES
+  || path.join(HOME, '.config', 'ruvnet-brain', 'demoted-themes.json');
+
+function demotedThemeKeys(file = DEMOTED_THEMES_PATH) {
   try {
-    const file = process.env.RUVNET_LESSON_STORE
-      || path.join(os.homedir(), '.config', 'ruvnet-brain', 'lessons.json');
     const raw = JSON.parse(fs.readFileSync(file, 'utf8'));
-    return new Set(
-      (raw.lessons || [])
-        .filter((l) => l && l.demoted === true && typeof l.themeKey === 'string')
-        .map((l) => l.themeKey),
-    );
-  } catch { return new Set(); }
+    // Tolerant of both shapes, same reasoning as OPTIN_PATH: this file is expected to be hand-edited.
+    const list = Array.isArray(raw) ? raw : Array.isArray(raw?.demoted) ? raw.demoted : [];
+    return new Set(list.filter((x) => typeof x === 'string' && x.length));
+  } catch { return new Set(); }   // absent or unparseable → nothing demoted. Never fail INTO hiding a theme.
+}
+
+/** The only writer of DEMOTED_THEMES_PATH. Demotes or restores one theme key. */
+export function setThemeDemoted(key, demoted, file = DEMOTED_THEMES_PATH) {
+  const current = demotedThemeKeys(file);
+  if (demoted) current.add(key); else current.delete(key);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify({ demoted: [...current].sort() }, null, 2) + '\n');
+  return current;
 }
 
-export function analyze(lessons, { minProjects = MIN_PROJECTS, rejected = null } = {}) {
-  // Injectable for tests; defaults to the real store so the CLI honours real demotions.
-  const demoted = rejected instanceof Set ? rejected : demotedThemeKeys();
+export function analyze(lessons, { minProjects = MIN_PROJECTS, rejected = null, demotedThemesFile } = {}) {
+  // `rejected` is a pre-built Set, injectable for pure clustering tests.
+  // `demotedThemesFile` redirects the REAL disk reader (`demotedThemeKeys()`) to a fixture path — for
+  // tests that must exercise the actual read/write round trip, not a Set built by hand. Neither
+  // option is used by the CLI, which always takes the real default file for a real process.
+  const demoted = rejected instanceof Set ? rejected : demotedThemeKeys(demotedThemesFile);
   const eligible = lessons.filter((l) => l.type === 'feedback');
   const themes = [];
   for (const t of THEMES) {
@@ -227,12 +250,50 @@ export function applyPromotion(result, { file, now }) {
     ? existing.replace(new RegExp(`${BEGIN}[\\s\\S]*?${END}`), block)   // replace ONLY our fence
     : `${existing.trimEnd()}\n\n${block}\n`;                            // first run: append
 
-  try { fs.writeFileSync(file, next); } catch (e) { return { ok: false, log: `write failed: ${e.message}; backup at ${backup}` }; }
+  // ATOMIC write — temp sibling then rename, never in place. The same discipline bin/install.mjs's
+  // offerClaudeMd() already applies to this exact file (ADR-063 lineage): an in-place writeFileSync
+  // leaves the real file truncated if the process dies mid-write (disk full, SIGKILL, power loss).
+  // A rename within the same directory is atomic on every OS this project ships to, so CLAUDE.md is
+  // always either fully the old content or fully the new content, never a torn hybrid.
+  const tmp = `${file}.ruvnet-tmp`;
+  try {
+    fs.writeFileSync(tmp, next);
+    fs.renameSync(tmp, file);
+  } catch (e) {
+    try { fs.unlinkSync(tmp); } catch { /* best effort — the real file is untouched either way */ }
+    return { ok: false, log: `write failed: ${e.message}; backup at ${backup}` };
+  }
+
+  // ROUND-TRIP PROOF, not an inferred success: a successful rename proves the bytes landed at
+  // `file`'s path, but not that they are the bytes this call intended — read the real path back
+  // and compare, the same discipline degradation-watch.mjs's proveMemoryDurable() applies to every
+  // other durable write in this repo.
+  let onDisk = '';
+  try { onDisk = fs.readFileSync(file, 'utf8'); } catch (e) {
+    return { ok: false, log: `wrote ${file.replace(HOME, '~')} but could not read it back to verify (${e.message}); backup at ${backup}` };
+  }
+  if (onDisk !== next) {
+    return { ok: false, log: `wrote ${file.replace(HOME, '~')} but the read-back did not match — refusing to report success; backup at ${backup}` };
+  }
+
   return { ok: true, backup, promoted: result.promotable.length, log: `promoted ${result.promotable.length} process(es) into ${file.replace(HOME, '~')}` };
 }
 
 // ── CLI ──────────────────────────────────────────────────────────────────────────────────────────
 const invokedDirectly = process.argv[1] && path.resolve(process.argv[1]).endsWith('lesson-promote.mjs');
+if (invokedDirectly && (has('--demote-theme') || has('--restore-theme'))) {
+  const demoting = has('--demote-theme');
+  const key = arg(demoting ? '--demote-theme' : '--restore-theme');
+  if (!THEMES.some((t) => t.key === key)) {
+    console.error(`\n  ✗ unknown theme "${key}". Known keys: ${THEMES.map((t) => t.key).join(', ')}\n`);
+    process.exit(1);
+  }
+  setThemeDemoted(key, demoting);
+  console.log(`\n  ${demoting ? '✓ demoted' : '✓ restored'} theme "${key}" — `
+    + `${demoting ? 'will never be re-proposed by a future scan' : 'eligible again on the next scan'} `
+    + `(${DEMOTED_THEMES_PATH.replace(HOME, '~')})\n`);
+  process.exit(0);
+}
 if (invokedDirectly) {
   const result = analyze(collectLessons());
   if (has('--json')) { console.log(JSON.stringify(result, null, 2)); process.exit(0); }

package/plugin/scripts/md-stamp.mjs

@@ -36,6 +36,7 @@ import { fileURLToPath } from 'node:url';
 import { createHash } from 'node:crypto';
 import { parseHookEvent, toolName, field, readStdinBounded } from './hook-input.mjs';
 import { contains, projectDirectory } from './project-identity.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 // ── date, from the system clock, formatted in the repo's standard timezone ─────────────────────────
 // Same idiom as scripts/self-update.mjs's README badge stamp: Intl.DateTimeFormat is a Node builtin
@@ -312,7 +313,7 @@ async function main() {
 }
 
 function isMain() {
-  try { return process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url); }
+  try { return isDirectInvocation(import.meta.url); }
   catch { return false; }
 }
 

package/plugin/scripts/native-turn-transcript.mjs

@@ -1,10 +1,75 @@
 /** Bounded, mechanical Codex JSONL normalization. No model inference or user-text persistence. */
 const LIMIT = 2 * 1024 * 1024;
 const text = content => typeof content === 'string' ? content : Array.isArray(content)
-  ? content.filter(part => ['text', 'input_text', 'output_text'].includes(part?.type)).map(part => part.text || '').join('\n') : '';
-const message = (role, content) => ({ message: { role, content } });
+  ? content.filter(part => ['text', 'Text', 'input_text', 'output_text'].includes(part?.type)).map(part => part.text || '').join('\n') : '';
+const message = (role, content) => ({ type: role, message: { role, content } });
 const parse = value => { try { return JSON.parse(value); } catch { return null; } };
 
+const TOOL_ITEMS = new Set(['CommandExecution', 'FileChange', 'McpToolCall']);
+const toolItem = record => record?.type === 'event_msg' && record.payload?.type === 'item_completed'
+  && TOOL_ITEMS.has(record.payload.item?.type) && typeof record.payload.item.id === 'string';
+const startOf = record => Number.isFinite(record.payload.started_at_ms) ? record.payload.started_at_ms : NaN;
+const endOf = record => Number.isFinite(record.payload.completed_at_ms) ? record.payload.completed_at_ms : NaN;
+
+/**
+ * Native item records (#423) are written at completion, so concurrent items arrive in completion order.
+ * Each contiguous run is put back in start order; an item without timings, or whose interval overlaps
+ * another item, keeps its record but its result becomes `unknown` and can never count as a passing check.
+ */
+function orderToolItems(records) {
+  const items = records.filter(toolItem);
+  const uncertain = new Set(items.filter((r, i) => !(startOf(r) <= endOf(r))
+    || items.some((o, j) => j !== i && startOf(o) < endOf(r) && startOf(r) < endOf(o))));
+  const out = [];
+  for (let i = 0; i < records.length;) {
+    if (!toolItem(records[i])) { out.push(records[i++]); continue; }
+    const run = [];
+    while (i < records.length && toolItem(records[i])) run.push(records[i++]);
+    out.push(...run.sort((a, b) => (startOf(a) || 0) - (startOf(b) || 0)));
+  }
+  return { ordered: out, uncertain, itemized: items.length > 0 };
+}
+
+function toolItemLines(record, uncertain) {
+  const item = record.payload.item;
+  const status = uncertain ? 'unknown' : item.status;
+  if (item.type === 'FileChange') {
+    return [message('assistant', [{ type: 'tool_use', id: item.id, name: 'apply_patch', input: { input: '' } }])];
+  }
+  if (item.type === 'McpToolCall') {
+    // A completed transport is not a successful tool: CallToolResult.isError:true (a failed run_tests) is a failure,
+    // and the field is kept on the result so no reader can mistake it for success (cross-vendor review D, 4.7.21).
+    const toolFailed = item.result?.isError === true;
+    return [message('assistant', [{ type: 'tool_use', id: item.id, name: `mcp__${item.server}__${item.tool}`, input: {} }]),
+      message('user', [{ type: 'tool_result', tool_use_id: item.id, status, ...(toolFailed ? { isError: true } : {}),
+        is_error: item.status !== 'completed' || Boolean(item.error) || toolFailed,
+        content: item.result === undefined ? '' : JSON.stringify(item.result) }])];
+  }
+  const argv = Array.isArray(item.command) ? item.command : [item.command];
+  // `[shell, -lc, script]` runs `script`; any other argv is the command line itself.
+  const command = argv.length === 3 && /^-l?c$/.test(String(argv[1])) ? String(argv[2]) : argv.map(String).join(' ');
+  return [message('assistant', [{ type: 'tool_use', id: item.id, name: 'Bash', input: { command } }]),
+    message('user', [{ type: 'tool_result', tool_use_id: item.id, status, ...(Number.isSafeInteger(item.exit_code) ? { exit_code: item.exit_code } : {}),
+      content: typeof item.aggregated_output === 'string' ? item.aggregated_output : '' }])];
+}
+
+/**
+ * Code-mode `exec` calls whose call record and output record bracket at least one native tool item: Codex records
+ * the items an exec script runs between that exec's call and its output (rollouts on the owner's Mac, codex-cli
+ * 0.164). An item carries no call id, so the bracket is the only pairing there is; anything else is opaque.
+ */
+function pairedExecCalls(ordered) {
+  const paired = new Set();
+  ordered.forEach((record, i) => {
+    const p = record?.payload;
+    if (record?.type !== 'response_item' || p?.type !== 'custom_tool_call' || p.name !== 'exec' || typeof p.call_id !== 'string') return;
+    const end = ordered.findIndex((r, j) => j > i && r?.type === 'response_item' && r.payload?.type === 'custom_tool_call_output'
+      && r.payload.call_id === p.call_id);
+    if (end > i && ordered.slice(i + 1, end).some(toolItem)) paired.add(p.call_id);
+  });
+  return paired;
+}
+
 /** Keep call IDs intact; torn/unknown records cannot manufacture successful tool evidence. */
 export function nativeTurnLines(lines, host) {
   if (host !== 'codex') return lines;
@@ -15,19 +80,46 @@ export function nativeTurnLines(lines, host) {
     const record = parse(lines[i]); if (record) records.push(record);
   }
   records.reverse();
+  const { ordered, uncertain, itemized } = orderToolItems(records);
+  const paired = pairedExecCalls(ordered);
   const out = []; const sessions = new Map(); const calls = new Map();
-  for (const record of records) {
+  // Codex writes the same answer up to three times (response_item, item_completed AgentMessage,
+  // task_complete.last_agent_message); any one of them may be the only copy that survived.
+  let said = new Set();
+  const say = (role, value) => {
+    if (role === 'user') said = new Set();
+    else if (said.has(value.trim())) return;
+    else said.add(value.trim());
+    out.push(message(role, value));
+  };
+  for (const record of ordered) {
     const p = record.payload;
+    if (toolItem(record)) {
+      if (!calls.has(p.item.id)) out.push(...toolItemLines(record, uncertain.has(record)));
+      continue;
+    }
     if (record.type === 'event_msg' && p?.type === 'user_message') {
-      out.push(message('user', p.message || '')); continue;
+      say('user', p.message || ''); continue;
     }
     if (record.type === 'event_msg' && p?.type === 'agent_message' && typeof p.message === 'string') {
-      out.push(message('assistant', p.message)); continue;
+      say('assistant', p.message); continue;
+    }
+    // Native turn end (rollout and `codex exec`): the closing answer, recorded once per turn.
+    if (record.type === 'event_msg' && p?.type === 'task_complete' && typeof p.last_agent_message === 'string') {
+      say('assistant', p.last_agent_message); continue;
+    }
+    if (record.type === 'event_msg' && p?.type === 'item_completed' && p.item?.type === 'AgentMessage') {
+      say('assistant', text(p.item.content)); continue;
     }
     if (record.type !== 'response_item' || !p) continue;
     if (p.type === 'message' && ['user', 'assistant'].includes(p.role)) {
-      out.push(message(p.role, text(p.content))); continue;
+      say(p.role, text(p.content)); continue;
     }
+    // A code-mode `exec` script's actions are the native items mapped above, but only an exec PROVABLY paired with
+    // them (review r2, 4.7.21) is dropped; an opaque one (no item inside its call/output bracket, or no output yet)
+    // stays a tool call named `exec`, which the audit counts as a possible change (fail toward asking).
+    if (itemized && paired.has(p.call_id) && ['custom_tool_call', 'custom_tool_call_output'].includes(p.type)) continue;
+    if (itemized && p.type === 'custom_tool_call_output' && !calls.has(p.call_id)) continue;
     if (['function_call', 'custom_tool_call'].includes(p.type) && typeof p.call_id === 'string') {
       const args = typeof p.arguments === 'string' ? parse(p.arguments) : p.arguments;
       let name = String(p.name || '').split('.').at(-1); let input = args || {};

package/plugin/scripts/nightly-scheduler.mjs

@@ -6,7 +6,7 @@ import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { automaticPath } from './automatic-update.mjs';
 import { sharedLockStatus } from './developer-update-lock.mjs';
-import { EXECUTION_MODULES } from './developer-update-policy.mjs';
+import { EXECUTION_MODULES, OPTIONAL_EXECUTION_MODULES } from './developer-update-policy.mjs';
 
 export const NIGHTLY_LABEL = 'com.ruvnet.brain-update';
 export const NIGHTLY_HOUR = 3;
@@ -145,8 +145,13 @@ function inspectRefreshOwner(owner) {
 const HISTORICAL_UPDATE_MODULES = ['automatic-update.mjs', 'user-settings.mjs', 'ruvnet-gate1-pattern.mjs'];
 const BRIDGED_UPDATE_MODULES = [...HISTORICAL_UPDATE_MODULES, 'developer-update-owner.mjs'];
 const LEGACY_UPDATE_MODULES = [...BRIDGED_UPDATE_MODULES, 'developer-update-policy.mjs'];
-const PREVIOUS_DEVELOPER_MODULES = [...BRIDGED_UPDATE_MODULES, ...EXECUTION_MODULES.filter(name => name !== 'plugin-artifact-proof.mjs')];
+const PREVIOUS_DEVELOPER_MODULES = [...BRIDGED_UPDATE_MODULES, ...EXECUTION_MODULES.filter(name => !OPTIONAL_EXECUTION_MODULES.includes(name))];
+// Registered by 4.7.20 and earlier (before developer-update.mjs imported ./entrypoint.mjs); still a valid closure.
+const PRE_ENTRYPOINT_DEVELOPER_MODULES = [...new Set([...LEGACY_UPDATE_MODULES, ...EXECUTION_MODULES.filter(name => name !== 'entrypoint.mjs')])];
 const DEVELOPER_UPDATE_MODULES = [...new Set([...LEGACY_UPDATE_MODULES, ...EXECUTION_MODULES])];
+/** A staged coordinator that imports an optional member must have it staged beside it (review B, 4.7.21). */
+const missingOptional = (modules) => OPTIONAL_EXECUTION_MODULES.find(name => modules['developer-update.mjs'] && !modules[name]
+  && fs.readFileSync(modules['developer-update.mjs'].path, 'utf8').includes(`./${name}`));
 /** The shipped module set and the content digest it is registered under (`update-modules-<digest>`); reads only. */
 function readModuleSet(sourceDir, developerSuite) {
   const files = developerSuite ? DEVELOPER_UPDATE_MODULES : LEGACY_UPDATE_MODULES;
@@ -170,8 +175,8 @@ function updateModules(directory, sourceDir = path.dirname(fileURLToPath(import.
 
 function verifyUpdateModules(modules) {
   if (!modules) return; // existing schema-2 registrations remain inspectable
-  if (![HISTORICAL_UPDATE_MODULES, BRIDGED_UPDATE_MODULES, LEGACY_UPDATE_MODULES, PREVIOUS_DEVELOPER_MODULES, DEVELOPER_UPDATE_MODULES].some(names => [...names].sort().join(',') === Object.keys(modules).sort().join(','))) throw new Error('invalid update module closure');
-  if (modules['developer-update.mjs'] && !modules['plugin-artifact-proof.mjs'] && fs.readFileSync(modules['developer-update.mjs'].path, 'utf8').includes('./plugin-artifact-proof.mjs')) throw new Error('new coordinator artifact closure is incomplete');
+  if (![HISTORICAL_UPDATE_MODULES, BRIDGED_UPDATE_MODULES, LEGACY_UPDATE_MODULES, PREVIOUS_DEVELOPER_MODULES, PRE_ENTRYPOINT_DEVELOPER_MODULES, DEVELOPER_UPDATE_MODULES].some(names => [...names].sort().join(',') === Object.keys(modules).sort().join(','))) throw new Error('invalid update module closure');
+  if (missingOptional(modules)) throw new Error(missingOptional(modules) === 'plugin-artifact-proof.mjs' ? 'new coordinator artifact closure is incomplete' : `coordinator closure is missing ${missingOptional(modules)}`);
   for (const [name, item] of Object.entries(modules)) {
     if (!path.isAbsolute(item.path) || path.basename(item.path) !== name
       || path.dirname(item.path) !== path.dirname(modules['automatic-update.mjs'].path)
@@ -344,7 +349,7 @@ export function developerRunHealth({ brainHome, registration, now = Date.now(),
   const boundTo = modules => Boolean(modules) && validDigest(receipt.sourceSha256) && receipt.kind === 'nightly-suite-update' && receipt.schemaVersion === 1
     && receipt.sourceSha256 === modules['developer-update.mjs']?.sha256
     && Object.entries(receipt.sourceSnapshot || {}).every(([name, digest]) => validDigest(digest) && digest === modules[name]?.sha256)
-    && EXECUTION_MODULES.filter(name => name !== 'plugin-artifact-proof.mjs' || modules[name]).every(name => validDigest(receipt.sourceSnapshot?.[name]) && receipt.sourceSnapshot[name] === modules[name]?.sha256);
+    && EXECUTION_MODULES.filter(name => !OPTIONAL_EXECUTION_MODULES.includes(name) || modules[name]).every(name => validDigest(receipt.sourceSnapshot?.[name]) && receipt.sourceSnapshot[name] === modules[name]?.sha256);
   // A receipt from the module set an update just replaced is still the night's proof, but only one that FINISHED before
   // the replacement: the next scheduled run must bind to the current set.
   // Judged by LAUNCH time: a night's own knowledge step can install a release and re-point the modules before the run

package/plugin/scripts/package-recommender.mjs

@@ -310,8 +310,8 @@ export function buildPackageCandidate({ prompt, pick, findingPrefix = 'recommend
     findingId: `${findingPrefix}${card.id}`,
     severity: 'normal',
     observationHash: stateHashOf([`package:${card.id}`]),
-    copy: `[RuvNet Brain — rUv already ships this] If it genuinely fits this request, tell the user in ONE `
-      + `sentence: "rUv ships ${card.id} — ${description} (source: ${card.source}). Say 'use ${name}' to proceed, or ignore this." `
+    copy: `[RuvNet Brain — rUv already ships this] If it genuinely fits this request, state it in ONE `
+      + `sentence: "rUv ships ${card.id} — ${description} (source: ${card.source}); 'use ${name}' adopts it." `
       + 'Install state unknown from here; confirm with search_ruvnet before building, say it once, then carry on.',
     capability: name,
     package: card.id,

package/plugin/scripts/project-store-resolver.mjs

@@ -4,6 +4,25 @@ import path from 'node:path';
 import os from 'node:os';
 import { execFileSync } from 'node:child_process';
 
+/**
+ * ruflo encryption at rest (ruflo ADR-096, CLAUDE_FLOW_ENCRYPT_AT_REST=1) rewrites `.swarm/memory.db` as an
+ * AES-GCM image that starts with the magic bytes `RFE1`. ruflo opens that image only through its sql.js
+ * path and keeps native better-sqlite3 on a separate plaintext file (ruflo #2786), so a write that
+ * demands the native writer (`--require-native`, `--append-only`) is refused on every attempt (#439).
+ * Reads (`memory retrieve|search|list`) are unaffected. Four bytes are read; a missing or short file is
+ * not encrypted.
+ */
+export const ENCRYPTED_STORE_MAGIC = 'RFE1';
+export const ENCRYPTED_STORE_REASON = 'store is encrypted at rest (ruflo RFE1); the native append-only writer cannot open it';
+export function storeEncryptedAtRest(file) {
+  let fd;
+  try {
+    fd = fs.openSync(file, 'r');
+    const head = Buffer.alloc(4);
+    return fs.readSync(fd, head, 0, 4, 0) === 4 && head.toString('latin1') === ENCRYPTED_STORE_MAGIC;
+  } catch { return false; } finally { if (fd !== undefined) try { fs.closeSync(fd); } catch { /* already closed */ } }
+}
+
 function sha256(value) {
   return crypto.createHash('sha256').update(value).digest('hex');
 }

package/plugin/scripts/routing-outcome-capture.mjs

@@ -13,6 +13,7 @@ import {
   readStdinBounded,
   toolName,
 } from './hook-input.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 const SUCCESS = new Set(['completed', 'success', 'succeeded']);
 const FAILURE = new Set(['failed', 'error', 'cancelled', 'canceled', 'timed_out', 'timeout']);
@@ -84,6 +85,6 @@ async function main() {
   appendObservation(observationFrom(event, new Date().toISOString(), decision));
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isDirectInvocation(import.meta.url)) {
   try { await main(); } catch { /* advisory observer: fail open */ }
 }

package/plugin/scripts/session-snapshot-hook.mjs

@@ -25,14 +25,28 @@ import { redactText } from './continuity-events.mjs';
 /** hooks.json gives this boundary 10 s; the shim's watchdog fires at 8.5 s. Plan inside it. */
 export const CAPTURE_BUDGET_MS = 8_000;
 
+/**
+ * Claude Code's SessionEnd budget: 1.5 s shared by every SessionEnd hook, and "Timeouts set on
+ * plugin-provided hooks don't raise the budget" (code.claude.com/docs/en/hooks.md, SessionEnd), so
+ * hooks.json's 10 s does not apply there. Only CLAUDE_CODE_SESSIONEND_HOOKS_TIMEOUT_MS overrides it.
+ */
+export const CLAUDE_SESSION_END_BUDGET_MS = 1_500;
+
 /**
  * The budget this invocation really has. The Codex wrapper hands its own kill deadline down as
  * RUVNET_CODEX_BUDGET_MS (2200 ms at SessionEnd, which Codex caps at 3 s); 300 ms is left for the
- * adapter → shim → body spawns.
+ * adapter → shim → body spawns. At SessionEnd under Claude Code the same 300 ms comes off Claude
+ * Code's own budget (issue #420 item 2: planning for 8 s ran the checkpoint inline and /exit printed
+ * "Hook cancelled"); with that budget the checkpoint is handed to the detached child below.
  */
-export function effectiveBudgetMs(env = process.env) {
+export function effectiveBudgetMs(env = process.env, event = null) {
   const handed = Number(env.RUVNET_CODEX_BUDGET_MS);
-  return Number.isFinite(handed) && handed > 0 ? Math.max(0, Math.min(CAPTURE_BUDGET_MS, handed - 300)) : CAPTURE_BUDGET_MS;
+  if (Number.isFinite(handed) && handed > 0) return Math.max(0, Math.min(CAPTURE_BUDGET_MS, handed - 300));
+  const claude = !env.RUVNET_HOOK_HOST || env.RUVNET_HOOK_HOST === 'claude';
+  if (event !== 'SessionEnd' || !claude) return CAPTURE_BUDGET_MS;
+  const configured = Number(env.CLAUDE_CODE_SESSIONEND_HOOKS_TIMEOUT_MS);
+  const budget = Number.isFinite(configured) && configured > 0 ? configured : CLAUDE_SESSION_END_BUDGET_MS;
+  return Math.max(0, Math.min(CAPTURE_BUDGET_MS, budget - 300));
 }
 
 /**
@@ -65,7 +79,7 @@ export function detachCheckpoint({ projectDir, event, payload, env, brainHome })
   return { detached: true, pid: child.pid };
 }
 
-export async function runLifecycleBoundary(event, payload, { env = process.env, deadlineAt = Date.now() + effectiveBudgetMs(env) } = {}) {
+export async function runLifecycleBoundary(event, payload, { env = process.env, deadlineAt = Date.now() + effectiveBudgetMs(env, event) } = {}) {
   const projectDir = typeof payload?.cwd === 'string' && path.isAbsolute(payload.cwd) ? payload.cwd : projectDirectory();
   const host = env.RUVNET_HOOK_HOST || 'claude';
   if (event === 'PostToolUse') {
@@ -82,6 +96,12 @@ export async function runLifecycleBoundary(event, payload, { env = process.env,
   if (String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() === 'off') return { turn, checkpoint: { stored: false, skipped: 'RUVNET_TURN_CAPTURE=off' } };
   const brainHome = env.RUVNET_BRAIN_HOME || path.join(os.homedir(), '.cache', 'ruvnet-brain');
   if (deadlineAt - Date.now() < CHECKPOINT_NEED_MS) {
+    // A persisted opt-out is answered here, so no detached child is started for a project that refused
+    // capture (the child re-checks consent anyway; a deadline throw here just leaves that check to it).
+    try {
+      const consent = resolveTurnDb({ projectDir, brainHome, deadlineAt });
+      if (consent.skipped) return { turn, checkpoint: { stored: false, skipped: consent.skipped } };
+    } catch { /* out of time: the detached child decides */ }
     try { return { turn, checkpoint: { stored: false, ...detachCheckpoint({ projectDir, event, payload, env, brainHome }) } }; } catch (error) {
       recordHookFailure({ hook: 'checkpoint', event, error: `skipped: hook budget too small and detach failed (${error.code || 'spawn'})` }, { brainHome });
       return { turn, checkpoint: { stored: false, skipped: 'hook budget too small; detach failed' } };

package/plugin/scripts/session-start-core.mjs

@@ -36,6 +36,7 @@ import { surfaceSignals } from './session-start-signals.mjs';
 import { failureLine, FAILURE_LINE_PREFIX } from './hook-failures.mjs';
 import { brainState, health, knowledgeCurrency, mcpReadiness, KNOWLEDGE_LINE_PREFIX } from './session-start-health.mjs';
 import { stableSpine, heartbeat, knowledgeAutoUpdate, footprintCheck } from './session-start-update-plane.mjs';
+import { CODEX_OVERNIGHT_PREFIX } from './codex-overnight-notice.mjs';
 import { FOOTPRINT_LINE_PREFIX } from './brain-confirmation.mjs';
 import { describeLifecycleHooks, readHookContracts } from './session-start-hook-description.mjs';
 import { createStageTracer } from './session-start-trace.mjs';
@@ -43,6 +44,7 @@ import { sessionStartDeadlineAt, STAGE_BUDGETS_MS } from './session-start-budget
 import { loadSettings } from './user-settings.mjs';
 import { sessionStartProofRecorder } from './session-start-proof.mjs';
 import { ALIAS_NOTICE, probeCodexConsoleAlias, readSessionSource } from './codex-console-alias.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 // Re-exported for callers/tests that import the entitlement check directly from this file's own
 // long-standing public surface (tests/unit/session-start-core-parity.test.mjs).
@@ -116,7 +118,9 @@ export async function runSessionStart({
       || s.startsWith(FOOTPRINT_LINE_PREFIX)
       || s.startsWith('[RuvNet Brain — OPEN ISSUES')
       || s.startsWith('[RuvNet Brain — NTFY:')
+      || s.startsWith('[RuvNet Brain — JOBS:')
       || s.startsWith('[RuvNet Brain — TURN CAPTURE]')
+      || s.startsWith(CODEX_OVERNIGHT_PREFIX)
       || /\bopen issue\(s\)/i.test(s)
       || /^\[RuvNet Brain — external signal/i.test(s)
       || (s.startsWith('Workflow ') && !/\b(Say it plainly|offer to look|ask only|run:|invoke)\b/i.test(s))
@@ -452,21 +456,7 @@ export async function runSessionStart({
   return { ok: true, outputBytes: Buffer.byteLength(output, 'utf8'), platform };
 }
 
-// Entry-point guard. Compares REALPATHS on both sides: path.resolve() normalizes a path but does
-// NOT follow symlinks, while import.meta.url IS symlink-resolved by Node. Through a symlink (npm bin
-// shims, wrapper scripts, and every os.tmpdir() path on macOS) the two sides disagree, so main()
-// never runs -- and because nothing throws, the process exits 0. A silent exit 0 is indistinguishable
-// from "ran, found nothing". Reproduced live 2026-07-27; pinned by tests/unit/entrypoint-symlink.test.mjs.
-function isDirectInvocation() {
-  try {
-    if (!process.argv[1]) return false;
-    return fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
-  } catch {
-    return false;
-  }
-}
-
-const direct = isDirectInvocation();
+const direct = isDirectInvocation(import.meta.url);
 if (direct) {
   const sessionSource = await readSessionSource();
   runSessionStart({ sessionSource, startedAt: performance.timeOrigin }).catch((error) => {