ruvnet-brain 4.7.20 → 4.7.21

package/plugin/scripts/decision-outcomes.mjs

@@ -118,6 +118,42 @@ function appendLocked(record, file, owns) {
 export function append(record, file = LEDGER, budget = {}) {
   return locked([file], owns => { appendLocked(record, file, owns); return true; }, false, budget);
 }
+/**
+ * ── A BUDGET THAT CAN BE EXCEEDED SILENTLY FAILS OPEN WITHOUT SAYING SO (decision-gate.mjs) ──────
+ *
+ * The gate's old loop did `break` when the budget ran out: every remaining policy AND the speech
+ * chokepoint were skipped with no record anywhere, and nothing distinguished "five policies agreed"
+ * from "we ran out of time and stopped asking" — silence standing in for a measurement.
+ *
+ * TWO CHANNELS, because each fails differently:
+ *   · this ledger (survives `--update`), ALWAYS, so a trip COMPOUNDS into evidence. `budget-exceeded`
+ *     and `policy-skipped` are inert in report()'s buckets, so they cannot move the obedience rate.
+ *   · one stderr line, ONLY when the action was refused or under RUVNET_STOP_NUDGES=full (quiet by
+ *     default since 2026-10-15): on an ALLOW a stderr line only makes the host show a hook "error" for
+ *     a decision that was made. tests/unit/write-gate-policy.test.mjs pins both modes.
+ */
+const STOP_NUDGES_FULL = () => String(process.env.RUVNET_STOP_NUDGES || '').toLowerCase() === 'full';
+export function reportBudget({ event, session, unconsulted, trace, started, budgetMs, refused = false }) {
+  const elapsed = Date.now() - started;
+  if (process.env.RUVNET_DECISION_TRACE === '1') {
+    process.stderr.write(`[decision-gate] ${event} ${elapsed}ms budget=${budgetMs}ms ${JSON.stringify(trace)}\n`);
+  }
+  if (!unconsulted.length) return;
+  try {
+    append({ kind: 'budget-exceeded', event, session, unconsulted, elapsedMs: elapsed, budgetMs, ts: Date.now() });
+  } catch { /* a ledger must never break a tool call */ }
+  if (refused || STOP_NUDGES_FULL()) process.stderr.write(
+    `[decision-gate] ${budgetMs}ms budget exhausted after ${elapsed}ms — ${refused ? 'REFUSED; UNCONSULTED' : 'ALLOWED WITHOUT CONSULTING'}: `
+    + `${unconsulted.join(', ')}. These policies did not vote; ${refused ? 'another policy refused the action.' : 'this allow is a timeout, not a verdict.'}\n`,
+  );
+}
+/** Record each policy that skipped itself (exit 3) with its own one-line reason; print it only under full nudges. */
+export function reportSelfSkipped({ event, session, selfSkipped }) {
+  for (const r of selfSkipped) {
+    try { append({ kind: 'policy-skipped', event, session, policy: r.id, reason: r.reason, ts: Date.now() }); } catch { /* a ledger must never break a tool call */ }
+    if (STOP_NUDGES_FULL()) process.stderr.write(`[decision-gate] ${r.reason || `${r.id} skipped`} — ${r.id} did not vote; it supplied no authorization verdict.\n`);
+  }
+}
 const stateFiles = files => ({ pending: files.pending || PENDING, ledger: files.ledger || LEDGER });
 const debtId = debt => debt.refusalId || createHash('sha256').update(JSON.stringify([debt.session, debt.key, debt.ts, debt.host || null, debt.projectId || null])).digest('hex');
 const validDebt = value => value && typeof value.session === 'string' && typeof value.key === 'string'

package/plugin/scripts/decision-recall-gate.mjs

@@ -16,7 +16,8 @@
  * AT MOST ONE REFUSAL PER PATH PER SESSION (the duplicate-gate shape): the retry is allowed and
  * recorded. Only in an adopted project (canonical `.swarm/memory.db` exists). Opt-outs win
  * (ADR-105 §7): RUVNET_DECISION_RECALL_GATE=off, RUVNET_AGENTDB_FIRST=off, the brain-off sentinel.
- * Fails open on its own errors.
+ * Fails open on its own errors, except a Git identity timeout, which exits 3 (skipped, with the reason) so the
+ * gate's ledger records that this ADR decision was not checked (D8, 4.7.21).
  */
 import fs from 'node:fs';
 import os from 'node:os';
@@ -25,9 +26,13 @@ import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { resolveProjectStore } from './project-store-resolver.mjs';
 import { isAdrPath, freshConsultReceipt, brainHomeOf } from './decision-record.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 const ALLOW = 0;
 const REFUSE = 2;
+/** decision-gate.mjs's code for "this policy could not decide, and says why on stderr". */
+const SKIPPED_SELF = 3;
+const GIT_TIMEOUT_MS = 400;
 const STATUS_LINE = /^\s*(?:status:\s*\S.*|\*\*Status\*\*\s*:.*)$/im;
 /** The document's status line, ignoring fenced code (a YAML example is not the ADR's status). */
 const STATUS_LINES = new RegExp(STATUS_LINE.source, 'gim');
@@ -87,6 +92,29 @@ function brainOff(env) {
 const ackFile = (brainHome) => path.join(brainHome, 'decision-recall-acks.json');
 function readAcks(file) { try { const o = JSON.parse(fs.readFileSync(file, 'utf8')); return o && typeof o === 'object' ? o : {}; } catch { return {}; } }
 
+/**
+ * Publish the ledger the way decision-record.mjs's own sibling (writeConsultReceipt) already does:
+ * temp file in the same directory, fsync, then rename. fs.writeFileSync on the real path truncates
+ * before it writes — a process killed between those two steps leaves an empty ledger, discarding
+ * every acknowledgment ever recorded, not just the one being added. rename() is atomic on POSIX, so
+ * a reader (or a crash) only ever sees the old complete ledger or the new complete one.
+ */
+function writeAcksAtomic(file, acks) {
+  const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
+  let fd;
+  try {
+    fd = fs.openSync(tmp, 'wx', 0o600);
+    fs.writeSync(fd, JSON.stringify(acks));
+    try { fs.fsyncSync(fd); } catch { /* filesystem without fsync (some network mounts) — proceed */ }
+    fs.closeSync(fd);
+    fd = null;
+    fs.renameSync(tmp, file);
+  } finally {
+    if (fd !== null) { try { fs.closeSync(fd); } catch { /* nothing to close */ } }
+    try { if (fs.existsSync(tmp)) fs.unlinkSync(tmp); } catch { /* leave the temp rather than throw over it */ }
+  }
+}
+
 /** The verdict. Returns { code, stderr?, stdout? }. */
 export function evaluate(payload, { env = process.env, now = Date.now() } = {}) {
   if (['off'].includes(String(env.RUVNET_DECISION_RECALL_GATE || '').toLowerCase())
@@ -94,7 +122,14 @@ export function evaluate(payload, { env = process.env, now = Date.now() } = {})
   const decision = adrDecisionIn(payload);
   if (!decision) return { code: ALLOW };
   let resolution;
-  try { resolution = resolveProjectStore({ projectDir: payload.cwd || process.cwd(), gitTimeoutMs: 400 }); } catch { return { code: ALLOW }; }
+  try { resolution = resolveProjectStore({ projectDir: payload.cwd || process.cwd(), gitTimeoutMs: GIT_TIMEOUT_MS }); } catch (error) {
+    // D8 (4.7.21): a Git timeout is not a verdict. Exit SKIPPED_SELF with the reason, so decision-gate records a
+    // `policy-skipped` ledger row for this ADR decision instead of the silent allow it used to be.
+    if (/timed out/i.test(String(error?.message))) {
+      return { code: SKIPPED_SELF, stderr: `decision-recall: Git project identity timed out after ${GIT_TIMEOUT_MS}ms; the ${decision.kind} ${decision.path} was not checked for an AgentDB consult.` };
+    }
+    return { code: ALLOW };
+  }
   try { if (!fs.statSync(resolution.canonicalAgentDbPath).isFile()) return { code: ALLOW }; } catch { return { code: ALLOW }; }
   const brainHome = brainHomeOf(env);
   const receipt = freshConsultReceipt({ projectRoot: resolution.projectRoot, brainHome, now });
@@ -108,13 +143,13 @@ export function evaluate(payload, { env = process.env, now = Date.now() } = {})
   const acks = readAcks(file);
   if (acks[key]) {
     acks[key].retriedAt = new Date(now).toISOString();
-    try { fs.writeFileSync(file, JSON.stringify(acks)); } catch { /* the ledger never blocks a write */ }
+    try { writeAcksAtomic(file, acks); } catch { /* the ledger never blocks a write */ }
     return { code: ALLOW, stdout: `This ${decision.kind} was written without an AgentDB consult (retry after one refusal). Record it afterwards with decision-record.mjs --record.` };
   }
   // Keep the ledger bounded: drop acknowledgements older than a week.
   for (const [k, v] of Object.entries(acks)) if (now - Date.parse(v?.at) > 7 * 86_400_000) delete acks[k];
   acks[key] = { at: new Date(now).toISOString(), kind: decision.kind };
-  try { fs.mkdirSync(path.dirname(file), { recursive: true }); fs.writeFileSync(file, JSON.stringify(acks), { mode: 0o600 }); } catch { return { code: ALLOW }; }
+  try { fs.mkdirSync(path.dirname(file), { recursive: true }); writeAcksAtomic(file, acks); } catch { return { code: ALLOW }; }
   const script = path.join(path.dirname(fileURLToPath(import.meta.url)), 'decision-record.mjs');
   return { code: REFUSE, stderr: [
     `⛔ BLOCKED (once) — ${decision.kind} ${decision.path}: run decision-record.mjs --consult "<topic>" first (AgentDB decisions unread).`,
@@ -127,7 +162,7 @@ export function evaluate(payload, { env = process.env, now = Date.now() } = {})
 }
 
 function isMain() {
-  try { return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); } catch { return false; }
+  try { return isDirectInvocation(import.meta.url); } catch { return false; }
 }
 if (isMain()) {
   let verdict = { code: ALLOW };

package/plugin/scripts/decision-record.mjs

@@ -26,11 +26,12 @@ import { fileURLToPath } from 'node:url';
 import { redactText } from './continuity-events.mjs';
 import { maskExcludedPaths } from './turn-capture-privacy.mjs';
 import { resolveTurnDb, readSettledTranscript } from './turn-outcome-capture.mjs';
-import { resolveProjectStore } from './project-store-resolver.mjs';
+import { resolveProjectStore, storeEncryptedAtRest, ENCRYPTED_STORE_REASON } from './project-store-resolver.mjs';
 import { resolveRuflo, rufloInvocation } from './ruflo-bin.mjs';
 import { rufloRunDir } from './ruflo-bin.mjs';
 import { currentTurnRecords } from './completion-claim-evidence.mjs';
 import { recordHookFailure } from './hook-failures.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 export const DECISION_SCHEMA = 'ruvnet-brain.decision-record';
 export const STATUSES = Object.freeze(['ratified', 'detected-unconfirmed']);
@@ -160,6 +161,10 @@ export function storeDecision({ ruflo, db, namespace, key, value, store = defaul
   const prior = readBack({ ruflo, db, namespace, key });
   if (typeof prior.content === 'string' && prior.content === value) return { state: 'already-stored', key };
   if (typeof prior.content === 'string' && prior.content && prior.content !== value) return { state: 'quarantined', key, reason: 'a different stored row holds this key' };
+  if (storeEncryptedAtRest(db)) { // #439: the native-only store below is refused on every attempt; say why instead
+    recordHookFailure({ hook: 'decision-record', event: 'record', error: `not recorded: ${ENCRYPTED_STORE_REASON}`.slice(0, 160) });
+    return { state: 'refused', key, reason: ENCRYPTED_STORE_REASON };
+  }
   const result = store({ ruflo, db, namespace, key, value });
   const back = readBack({ ruflo, db, namespace, key });
   if (result.status === 0 && back.content === value) return { state: 'committed', key };
@@ -300,7 +305,7 @@ export async function main(argv = process.argv.slice(2), { env = process.env, ou
     out.write(`decision-record: supersedes ${key} — ${String(row.what).slice(0, 120)}\n`);
   }
   const r = storeDecision({ ruflo, db: target.db, namespace, key: built.key, value: built.value, ...(store ? { store } : {}), ...(readBack ? { readBack } : {}) });
-  out.write(`decision-record: ${r.state} ${r.key} (namespace ${namespace})${r.reason ? ` — ${r.reason}` : ''}${r.state === 'refused' ? ` — NOT recorded (logged to hook-failures). A store that committed but did not read back may still hold it: run \`ruflo memory retrieve -k ${r.key} -n ${namespace} --path ${target.db}\` before re-running --record` : ''}\n`);
+  out.write(`decision-record: ${r.state} ${r.key} (namespace ${namespace})${r.reason ? ` — ${r.reason}` : ''}${r.state === 'refused' && r.reason === ENCRYPTED_STORE_REASON ? ' — NOT recorded (logged to hook-failures). Keep this project\'s store unencrypted to record decisions here' : ''}${r.state === 'refused' && r.reason !== ENCRYPTED_STORE_REASON ? ` — NOT recorded (logged to hook-failures). A store that committed but did not read back may still hold it: run \`ruflo memory retrieve -k ${r.key} -n ${namespace} --path ${target.db}\` before re-running --record` : ''}\n`);
   if (!['committed', 'already-stored'].includes(r.state)) return 3;
   let ok = true;
   for (const oldKey of built.record.supersedes) {
@@ -319,6 +324,6 @@ export async function main(argv = process.argv.slice(2), { env = process.env, ou
 }
 
 function isMain() {
-  try { return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(SCRIPT); } catch { return false; }
+  try { return isDirectInvocation(import.meta.url); } catch { return false; }
 }
 if (isMain()) main().then((code) => { process.exitCode = code; }, (e) => { process.stderr.write(`decision-record: ${e.message}\n`); process.exitCode = 1; });

package/plugin/scripts/degradation-watch.mjs

@@ -53,6 +53,7 @@ import path from 'node:path';
 // reading the code and believing it.
 import { fileURLToPath } from 'node:url';
 import { rufloRunDir } from './ruflo-bin.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 /**
  * THE PROBE TARGET IS A SCRATCH DB, NOT THE PROJECT'S.
@@ -264,7 +265,7 @@ export function cachedDegradations(opts = {}) {
  * mechanism; the invariant this repo already paid for is that ONE process refuses a given tool call.
  */
 const isMain = (() => {
-  try { return process.argv[1] && fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url); }
+  try { return isDirectInvocation(import.meta.url); }
   catch { return false; }
 })();
 

package/plugin/scripts/developer-update-lock.mjs

@@ -3,41 +3,180 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import crypto from 'node:crypto';
+import { spawnSync } from 'node:child_process';
 const brainRoot = brainHome => brainHome || process.env.RUVNET_BRAIN_HOME || path.join(os.homedir(), '.cache/ruvnet-brain');
-export function sharedLockStatus({ brainHome, alive = pid => { try { process.kill(pid, 0); return true; } catch (e) { return e.code === 'EPERM'; } } } = {}) {
+const pidAlive = pid => { try { process.kill(pid, 0); return true; } catch (e) { return e.code === 'EPERM'; } };
+// A dead or reclaimable owner must have been gone this long; an unreadable owner is judged by the directory's age.
+export const STALE_RECLAIM_MS = 10 * 60 * 1000;
+// An owner-less lock younger than this is another process between creating the lock and writing its owner.
+export const OWNERLESS_GRACE_MS = 5 * 1000;
+/** The OS start time of `pid` (`ps -o lstart=`, as kb/refresh-run.mjs records it), or null when it cannot be read (Windows). */
+export function processStartOf(pid, { platform = process.platform } = {}) {
+  if (platform === 'win32' || !Number.isSafeInteger(pid) || pid < 1) return null;
+  try {
+    const r = spawnSync('ps', ['-p', String(pid), '-o', 'lstart='], { encoding: 'utf8', timeout: 5000, env: { ...process.env, TZ: 'UTC', LC_ALL: 'C', LANG: 'C' } });
+    const start = String(r.stdout || '').trim();
+    return r.status === 0 && start ? start : null;
+  } catch { return null; }
+}
+const removal = directory => process.platform === 'win32' ? `Remove-Item -Recurse -Force "${directory}"` : `rm -rf "${directory}"`;
+// ── takeover is serialized (4.7.21 review, Codex #1) ─────────────────────────────────────────────
+// Two contenders could judge the same abandoned lock: A moved it aside and acquired, then B moved A's FRESH lock
+// aside on its stale judgement and both ran. A takeover now (1) creates an exclusive claim file inside the judged
+// directory ('wx': one winner per directory instance), (2) re-checks, while holding the claim, that it is the same
+// directory (dev/ino) with byte-identical owner.json, and only then (3) moves it aside. A claim left by a crashed
+// reclaimer is superseded by the next numbered claim once CLAIM_STALE_MS old.
+// Round 4 (Codex #1): a lock that existed before its owner record (mkdir, then write) could be judged owner-less and old,
+// claimed, re-checked (still owner-less, so "the same") and moved aside together with the owner published in between:
+// two owners. The lock is now built complete in a staging sibling and published by ONE rename, so it never exists
+// without its owner; a rename onto an existing lock fails (ENOTEMPTY/EEXIST, EPERM/EACCES on Windows) and is re-judged.
+export const CLAIM_STALE_MS = 5 * 60 * 1000;
+const CLAIM_FILE = /^takeover(?:-(\d+))?\.json$/;
+function observeDirectory(directory) {
+  const stat = fs.lstatSync(directory, { bigint: true });
+  if (!stat.isDirectory() || stat.isSymbolicLink()) throw Error('not an owned directory');
+  let raw = null;
+  try { raw = fs.readFileSync(path.join(directory, 'owner.json'), 'utf8'); } catch (error) { if (error.code !== 'ENOENT') throw error; }
+  return { identity: `${stat.dev}:${stat.ino}`, raw };
+}
+const readRaw = file => { try { return fs.readFileSync(file, 'utf8'); } catch { return null; } };
+// A claim file must not restart the age an owner-less lock is judged by (Opus r2 #6): writing or removing one bumps the
+// directory's mtime, so the directory's own times are put back.
+function keepDirectoryTimes(directory, change) {
+  let before = null;
+  try { before = fs.lstatSync(directory); } catch { /* judged below */ }
+  try { return change(); } finally { if (before) try { fs.lutimesSync(directory, before.atime, before.mtime); } catch { /* gone */ } }
+}
+const GONE = Symbol('judged lock vanished');
+function claimTakeover(directory) {
+  let highest = -1, highestName = null, names;
+  // The judged lock vanished (another reclaimer moved it): re-judge rather than throw (Fable r2 P3-1).
+  try { names = fs.readdirSync(directory); } catch (error) { if (error.code === 'ENOENT' || error.code === 'ENOTDIR') return GONE; throw error; }
+  for (const name of names) {
+    const match = CLAIM_FILE.exec(name);
+    if (match && (match[1] ? Number(match[1]) : 0) > highest) { highest = match[1] ? Number(match[1]) : 0; highestName = name; }
+  }
+  if (highestName) {
+    let ageMs = 0;
+    try { ageMs = Date.now() - fs.lstatSync(path.join(directory, highestName)).mtimeMs; } catch { return null; }
+    if (!(ageMs > CLAIM_STALE_MS)) return null; // another reclaimer is mid-takeover
+  }
+  const level = highest + 1;
+  const file = path.join(directory, level ? `takeover-${level}.json` : 'takeover.json');
+  const token = crypto.randomUUID();
+  try { keepDirectoryTimes(directory, () => fs.writeFileSync(file, JSON.stringify({ token, pid: process.pid, claimedAt: new Date().toISOString() }), { flag: 'wx', mode: 0o600 })); }
+  catch (error) { if (error.code === 'EEXIST') return null; if (error.code === 'ENOENT') return GONE; throw error; }
+  return { file, token };
+}
+const dropClaim = claim => { try { if (readRaw(claim.file)?.includes(claim.token)) keepDirectoryTimes(path.dirname(claim.file), () => fs.unlinkSync(claim.file)); } catch { /* gone with its directory */ } };
+/** Move `directory` aside only if it is still exactly the one observed: 'removed' | 'changed' | 'busy'. */
+function removeObservedLock(directory, observed, { afterClaim = null } = {}) {
+  const claim = claimTakeover(directory);
+  if (claim === GONE) return 'changed';
+  if (!claim) return 'busy';
+  afterClaim?.({ directory, claim });
+  let same = false;
+  try {
+    const now = observeDirectory(directory);
+    same = now.identity === observed.identity && now.raw === observed.raw && Boolean(readRaw(claim.file)?.includes(claim.token));
+  } catch { same = false; }
+  if (!same) { dropClaim(claim); return 'changed'; }
+  const tomb = `${directory}.stale-${process.pid}-${crypto.randomBytes(6).toString('hex')}`;
+  try { fs.renameSync(directory, tomb); } catch (error) { if (error.code === 'ENOENT') return 'changed'; dropClaim(claim); throw error; }
+  if (!readRaw(path.join(tomb, path.basename(claim.file)))?.includes(claim.token)) {
+    try { if (!fs.existsSync(directory)) fs.renameSync(tomb, directory); } catch { /* keep it as evidence */ }
+    throw Error(`developer update lock takeover moved a directory it did not claim; ${directory}`);
+  }
+  fs.rmSync(tomb, { recursive: true, force: true });
+  return 'removed';
+}
+/** Publish the lock with its owner already inside: one rename, which fails when any populated lock is there. */
+const CONTENDED = new Set(['EEXIST', 'ENOTEMPTY', 'EPERM', 'EACCES']);
+function publishLock(directory, content) {
+  const staged = `${directory}.acquire-${process.pid}-${crypto.randomBytes(6).toString('hex')}`;
+  const dropStaged = () => { try { fs.rmSync(staged, { recursive: true, force: true }); } catch { /* best effort */ } };
+  try {
+    fs.mkdirSync(staged, { mode: 0o700 });
+    fs.writeFileSync(path.join(staged, 'owner.json'), content, { flag: 'wx', mode: 0o600 });
+  } catch (error) { dropStaged(); throw error; } // staging failures are real errors, never contention
+  try { fs.renameSync(staged, directory); return true; } catch (error) {
+    dropStaged();
+    // A refused publication is contention even if the lock is gone a moment later: its owner can release in between,
+    // and re-checking existsSync here threw a raw ENOTEMPTY at the caller (Opus r3 P2-1). Re-judge (bounded by the caller).
+    if (CONTENDED.has(error.code)) return false;
+    throw error;
+  }
+}
+export function sharedLockStatus({ brainHome, alive = pidAlive, startOf = processStartOf } = {}) {
   const directory = path.join(brainRoot(brainHome), 'developer-update.lock');
+  let status = judgeLock(directory, alive, startOf);
+  // An owner-less reading can be the instant between one owner's release and the next owner's publication: the lock was
+  // gone (or moved aside before owner.json was read) and a new owner's lock was there when existence was checked. That
+  // live lock was judged "unknown" and the refusal offered rm -rf (Opus r3 P2-2). Look again before calling it unknown.
+  for (let look = 0; look < 2 && status.state === 'unknown' && (status.observed === null || status.observed.raw === null); look++) {
+    let again = null;
+    try { again = observeDirectory(directory); } catch { /* vanished or unjudgeable: judged afresh */ }
+    if (again && status.observed && again.identity === status.observed.identity && again.raw === null) break; // the same owner-less directory
+    status = judgeLock(directory, alive, startOf);
+  }
+  return status;
+}
+function judgeLock(directory, alive, startOf) {
+  let observed = null;
   try {
-    if (!fs.lstatSync(directory).isDirectory() || fs.lstatSync(directory).isSymbolicLink()) throw Error('not an owned directory');
-    const owner = JSON.parse(fs.readFileSync(path.join(directory, 'owner.json'), 'utf8'));
+    observed = observeDirectory(directory);
+    if (observed.raw === null) throw Object.assign(Error('owner.json absent'), { code: 'ENOENT' });
+    const owner = JSON.parse(observed.raw);
     if (!Number.isInteger(owner.pid) || owner.pid < 1 || typeof owner.token !== 'string' || owner.token.length < 16) throw Error('invalid owner');
-    return { state: alive(owner.pid) ? 'running' : 'stale', directory, owner };
-  } catch (error) { return { state: error.code === 'ENOENT' && !fs.existsSync(directory) ? 'idle' : 'unknown', directory, error: error.message }; }
-}
-export function acquireDeveloperLock({ brainHome, token = process.env.RUVNET_DEVELOPER_UPDATE_TOKEN, pid = process.pid, alive } = {}) {
-  const status = sharedLockStatus({ brainHome, alive });
-  if (token && status.state === 'running' && status.owner.token === token) return { token, ownerPid: status.owner.pid, inherited: true, release() {} };
-  // A dead owner's lock (dead for 10+ minutes) must not wedge every future update (measured 2026-10-15: a coordinator killed mid-run
-  // left `stale` behind and the automatic updater refused with "developer update lock stale" until a person
-  // removed the directory). Reclaim it: move the directory aside atomically (so two reclaimers cannot both
-  // win), then fall through to the normal atomic mkdir claim. Only a PROVABLY dead pid qualifies; a live,
-  // unknown or malformed lock still refuses.
-  const STALE_RECLAIM_MS = 10 * 60 * 1000;
-  const ageMs = status.state === 'stale' ? Date.now() - Date.parse(status.owner?.startedAt || '') : NaN;
-  if (status.state === 'stale' && Number.isFinite(ageMs) && ageMs >= STALE_RECLAIM_MS) {
-    const tomb = `${status.directory}.stale-${process.pid}-${Date.now()}`;
-    try { fs.renameSync(status.directory, tomb); fs.rmSync(tomb, { recursive: true, force: true }); }
-    catch { /* another reclaimer won, or the owner came back: re-read below */ }
-    const after = sharedLockStatus({ brainHome, alive });
-    if (after.state !== 'idle') throw Error(`developer update lock ${after.state}; ${after.directory}`);
-  } else if (status.state !== 'idle') throw Error(`developer update lock ${status.state}; ${status.directory}`);
-  fs.mkdirSync(path.dirname(status.directory), { recursive: true });
-  fs.mkdirSync(status.directory, { mode: 0o700 }); // atomic claim; racing owners get EEXIST
-  const owner = { pid, token: crypto.randomUUID(), startedAt: new Date().toISOString() };
-  try { fs.writeFileSync(path.join(status.directory, 'owner.json'), JSON.stringify(owner), { flag: 'wx', mode: 0o600 }); }
-  catch (error) { fs.rmdirSync(status.directory); throw error; }
-  return { token: owner.token, ownerPid: pid, inherited: false, release() {
-    const current = sharedLockStatus({ brainHome, alive });
-    if (current.owner?.token !== owner.token || current.owner?.pid !== pid) throw Error('developer update lock ownership changed');
-    fs.unlinkSync(path.join(status.directory, 'owner.json')); fs.rmdirSync(status.directory);
-  } };
+    if (!alive(owner.pid)) return { state: 'stale', directory, owner, observed };
+    // A live pid is the owner only when the recorded process start matches: a reused pid is another process.
+    const seen = typeof owner.processStart === 'string' && owner.processStart ? startOf(owner.pid) : null;
+    if (seen && seen !== owner.processStart) return { state: 'stale', directory, owner, reusedPid: true, observed };
+    return { state: 'running', directory, owner, observed };
+  } catch (error) { return { state: error.code === 'ENOENT' && !fs.existsSync(directory) ? 'idle' : 'unknown', directory, error: error.message, observed }; }
+}
+export function acquireDeveloperLock({ brainHome, token = process.env.RUVNET_DEVELOPER_UPDATE_TOKEN, pid = process.pid, alive, startOf = processStartOf, now = Date.now(), afterTakeoverClaim = null } = {}) {
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const status = sharedLockStatus({ brainHome, alive, startOf });
+    if (token && status.state === 'running' && status.owner.token === token) return { token, ownerPid: status.owner.pid, inherited: true, release() {} };
+    // A dead owner's lock must not wedge every future update (measured 2026-10-15: a coordinator killed mid-run left `stale`
+    // behind and the automatic updater refused until a person removed the directory). Reclaimable: a provably dead or reused-pid
+    // owner, or a directory with no readable owner (a kill between mkdir and the owner write), once STALE_RECLAIM_MS old by its
+    // recorded start or, failing that, the directory's own mtime. The takeover is claimed and re-checked (above), then the
+    // normal atomic mkdir claim follows. A live owner, or anything younger, still refuses.
+    let ageMs = NaN;
+    if (status.state === 'stale' || status.state === 'unknown') {
+      ageMs = now - Date.parse(status.owner?.startedAt || '');
+      if (!Number.isFinite(ageMs)) try { ageMs = now - fs.lstatSync(status.directory).mtimeMs; } catch { ageMs = NaN; }
+    }
+    const refuse = state => Error(`developer update lock ${state}; ${status.directory}. If no update is running on this machine, remove it: ${removal(status.directory)}`);
+    // A lock with no owner yet that is seconds old is another process mid-creation (agentic-kit writes its owner after its
+    // mkdir), not debris: never offer to remove it (Opus r3 P2-2).
+    if (status.state === 'unknown' && status.observed?.raw === null && Number.isFinite(ageMs) && ageMs < OWNERLESS_GRACE_MS) {
+      throw Error(`developer update lock is being created by another process; ${status.directory}. Retry shortly.`);
+    }
+    if ((status.state === 'stale' || status.state === 'unknown') && Number.isFinite(ageMs) && ageMs >= STALE_RECLAIM_MS) {
+      if (!status.observed) throw refuse(status.state); // not a lock directory this protocol can judge (a symlink or a file)
+      const outcome = removeObservedLock(status.directory, status.observed, { afterClaim: afterTakeoverClaim });
+      if (outcome === 'busy') throw refuse('is being reclaimed by another process');
+      continue; // 'removed' or 'changed': judge the directory afresh
+    } else if (status.state !== 'idle') throw refuse(status.state);
+    fs.mkdirSync(path.dirname(status.directory), { recursive: true });
+    const owner = { pid, token: crypto.randomUUID(), startedAt: new Date().toISOString(), processStart: startOf(pid) };
+    if (!publishLock(status.directory, JSON.stringify(owner))) continue; // judge the lock that won
+    return { token: owner.token, ownerPid: pid, inherited: false, release() {
+      const current = sharedLockStatus({ brainHome, alive, startOf });
+      if (current.owner?.token !== owner.token || current.owner?.pid !== pid) throw Error('developer update lock ownership changed');
+      // Move the whole lock aside in one step, then confirm it was this owner's: removing owner.json first left an empty
+      // directory that a contender's publication rename could replace, and the follow-up removal deleted that live lock.
+      const tomb = `${status.directory}.released-${process.pid}-${crypto.randomBytes(6).toString('hex')}`;
+      fs.renameSync(status.directory, tomb);
+      if (!readRaw(path.join(tomb, 'owner.json'))?.includes(owner.token)) {
+        try { if (!fs.existsSync(status.directory)) fs.renameSync(tomb, status.directory); } catch { /* keep it as evidence */ }
+        throw Error('developer update lock ownership changed');
+      }
+      fs.rmSync(tomb, { recursive: true, force: true });
+    } };
+  }
+  throw Error(`developer update lock is contended; ${path.join(brainRoot(brainHome), 'developer-update.lock')}. Retry shortly.`);
 }

package/plugin/scripts/developer-update-owner.mjs

@@ -3,20 +3,23 @@ import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 import crypto from 'node:crypto';
-import { EXECUTION_MODULES } from './developer-update-policy.mjs';
+import { EXECUTION_MODULES, OPTIONAL_EXECUTION_MODULES } from './developer-update-policy.mjs';
 const hash = file => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
 export function developerCoordinatorOwner({ home = os.homedir(), brainHome = process.env.RUVNET_BRAIN_HOME || path.join(home, '.cache/ruvnet-brain') } = {}) {
   const config = path.join(brainHome, 'developer-update-config.json'), registration = path.join(brainHome, 'scheduler/registration.json');
-  let record;
-  try { record = JSON.parse(fs.readFileSync(registration, 'utf8')); } catch { /* handled below */ }
-  const configured = fs.existsSync(config) || record?.mode === 'developer-suite';
+  let record, registered = true;
+  try { record = JSON.parse(fs.readFileSync(registration, 'utf8')); } catch (error) { registered = error.code !== 'ENOENT'; }
+  // A config left behind by --disable-nightly (no registration at all) owns nothing: refusing every automatic update
+  // as "not ready" forever would wedge the machine (AuditC #11). An unreadable registration still refuses.
+  const configured = (fs.existsSync(config) && registered) || record?.mode === 'developer-suite';
   if (!configured) return { active: false, ready: false };
   const entry = record?.updateModules?.['developer-update.mjs'];
   try {
     if (record?.mode !== 'developer-suite' || !path.isAbsolute(entry?.path || '') || !/^[a-f0-9]{64}$/.test(entry?.sha256 || '')
       || hash(entry.path) !== entry.sha256 || hash(record.runnerPath) !== record.runnerSha256) throw Error('registered source is absent or changed');
     if (!record.updateModules?.['plugin-artifact-proof.mjs'] && fs.readFileSync(entry.path, 'utf8').includes('./plugin-artifact-proof.mjs')) throw Error('new coordinator artifact closure is incomplete');
-    const generation = EXECUTION_MODULES.filter(name => name !== 'plugin-artifact-proof.mjs' || record.updateModules?.[name]);
+    if (!record.updateModules?.['entrypoint.mjs'] && fs.readFileSync(entry.path, 'utf8').includes('./entrypoint.mjs')) throw Error('coordinator closure is missing entrypoint.mjs');
+    const generation = EXECUTION_MODULES.filter(name => !OPTIONAL_EXECUTION_MODULES.includes(name) || record.updateModules?.[name]);
     if (generation.some(name => !record.updateModules?.[name])) throw Error('coordinator execution closure is incomplete');
     for (const module of Object.values(record.updateModules)) if (hash(module.path) !== module.sha256) throw Error('registered module closure changed');
     return { active: true, ready: true, entry: entry.path, node: record.nodePath, registration, sourceSha256: entry.sha256 };

package/plugin/scripts/developer-update-policy.mjs

@@ -1,4 +1,7 @@
-export const EXECUTION_MODULES = Object.freeze(['developer-update.mjs', 'developer-update-policy.mjs', 'developer-update-lock.mjs', 'developer-update-maintenance.mjs', 'developer-update-cleanup.mjs', 'plugin-artifact-proof.mjs']);
+export const EXECUTION_MODULES = Object.freeze(['developer-update.mjs', 'developer-update-policy.mjs', 'developer-update-lock.mjs', 'developer-update-maintenance.mjs', 'developer-update-cleanup.mjs', 'plugin-artifact-proof.mjs', 'entrypoint.mjs']);
+// Members a coordinator generation may lack: each is required exactly when the staged developer-update.mjs imports it
+// (plugin-artifact-proof since 4.6, entrypoint since the 4.7.21 entry-point sweep), so older registrations stay valid.
+export const OPTIONAL_EXECUTION_MODULES = Object.freeze(['plugin-artifact-proof.mjs', 'entrypoint.mjs']);
 // Shared stack classification and ordering: installations are selected, never manufactured.
 export const FAMILY = /^(ruflo|ruvnet-brain|ruvector|ruvector-extensions|ruvi|ruvbot|qudag|flow-nexus|agent-browser|agent-browser-mcp|agentic-flow|agentic-qe|agentic-robotics|agentic-payments|agentdb|ruv-swarm|@pacphi\/agentic-kit$|@ruvector\/|@claude-flow\/|@metaharness\/|@agentic-robotics\/)/;
 export const PLUGIN_MARKETPLACES = new Set(['ruflo', 'ruview', 'ruvnet-brain', 'cognitum']);