ruvnet-brain 4.7.20 → 4.7.22

package/plugin/scripts/doc-currency.mjs

@@ -58,6 +58,7 @@ import path from 'node:path';
 import crypto from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 export const REPO_ROOT = path.resolve(HERE, '..', '..');
@@ -974,20 +975,5 @@ export function main(argv = process.argv.slice(2)) {
   return 1;
 }
 
-// Entry-point guard. Compares REALPATHS on both sides: path.resolve() normalizes a path but does
-// NOT follow symlinks, while import.meta.url IS symlink-resolved by Node. Through a symlink (npm bin
-// shims, wrapper scripts, and every os.tmpdir() path on macOS) the two sides disagree, so main()
-// never runs -- and because nothing throws, the process exits 0. A silent exit 0 is indistinguishable
-// from "ran, found nothing", which is how prepareCorpusCandidate once reported SUCCESS with no
-// archive on disk. Reproduced live 2026-07-27; pinned by tests/unit/entrypoint-symlink.test.mjs.
-function isDirectInvocation() {
-  try {
-    if (!process.argv[1]) return false;
-    return fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
-  } catch {
-    return false;
-  }
-}
-
-const invokedDirectly = isDirectInvocation();
+const invokedDirectly = isDirectInvocation(import.meta.url);
 if (invokedDirectly) process.exit(main());

package/plugin/scripts/duplicate-gate.mjs

@@ -45,6 +45,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 export const SCOPE = ['scripts/', 'kb/', 'plugin/scripts/', 'tests/', 'bin/'];
 export const THRESHOLD = 0.5;
@@ -485,7 +486,7 @@ export function evaluate(payload, { env = process.env, now = Date.now(), deadlin
 }
 
 const isMain = (() => {
-  try { return process.argv[1] && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); }
+  try { return isDirectInvocation(import.meta.url); }
   catch { return false; }
 })();
 

package/plugin/scripts/entrypoint.mjs

@@ -0,0 +1,34 @@
+// plugin/scripts/entrypoint.mjs — the ONE answer to "was this module run as the program, or imported?"
+//
+// Every dual-purpose file in this repo (a library when imported, a CLI when run) asks that question.
+// The copy-pasted answer compared `process.argv[1]` with `import.meta.url` directly, e.g.
+//     path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)
+//     import.meta.url === pathToFileURL(process.argv[1]).href
+// argv[1] is the path as the caller typed it, symlinks included; Node resolves symlinks before it sets
+// import.meta.url. Run through a symlink (npm bin shims, wrapper scripts, a symlinked checkout, every
+// os.tmpdir() path on macOS) the two sides differ, main() never runs, and the process exits 0 having
+// done nothing. A release gate that exits 0 without checking anything passes. Dream Cycle PRs #295,
+// #317, #333, #367, #412 and #484 each found one more copy by hand.
+//
+// Usage:
+//     import { isDirectInvocation } from './entrypoint.mjs';   // path relative to this file
+//     if (isDirectInvocation(import.meta.url)) main();
+//
+// tests/unit/entrypoint-guard-sweep.test.mjs fails when a raw comparison reappears outside this file,
+// and runs a script through a symlink to prove this helper makes it execute.
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+/**
+ * True when `moduleUrl` (pass `import.meta.url`) is the file Node was asked to run. Both sides are
+ * compared as real paths. Never throws: `realpathSync` throws on a path that does not resolve (under
+ * a test runner argv[1] need not be a real file), and an imported module must not crash its importer.
+ */
+export function isDirectInvocation(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1 || !moduleUrl) return false;
+  try {
+    return fs.realpathSync(argv1) === fs.realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}

package/plugin/scripts/footprint-io.mjs

@@ -1,5 +1,6 @@
 // footprint-io.mjs — the footprint sweep's disk operations (ADR-0098), kept apart from the classifier in
-// brain-footprint.mjs: byte counts, log rotation, the guarded removal, and the KEPT-proof cache.
+// brain-footprint.mjs: byte counts, log rotation, the guarded removal, the rescue of a released copy's
+// operational files, and the KEPT-proof cache.
 //
 // THE KEPT-PROOF CACHE (independent review S7).
 // kbCopyProof hashes every file of a GB-sized copy. A copy kept because it holds data the live brain lacks
@@ -7,6 +8,7 @@
 // which can only keep it again. Only KEPT results are cached, keyed by a cheap stat fingerprint of the copy
 // and of the live brain (no hashing, no tree walk); a stale entry can only KEEP a copy, never remove one, and
 // any change to the live brain's identity files (a restore, an update) invalidates it.
+import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 
@@ -157,7 +159,43 @@ export function removeWithin(target, expectedParent, owned) {
   return size;
 }
 
+/**
+ * RESCUE BEFORE RELEASE. kbCopyProof lists a disposable copy's operational files (logs, ruflo scratch) as
+ * `rescue`, each with the bytes it was proven with. They are copied to <brainHome>/kb-copy-rescued/<copy
+ * name>/<path> and verified there BEFORE the copy is removed. Any mismatch (the source changed since the
+ * proof, a different file already at the destination, a link in the way) throws, and the caller keeps the
+ * copy. Retention of the rescued directories is brain-footprint.mjs's (FOOTPRINT_POLICY.rescuedCopiesKept).
+ */
+export const RESCUE_DIR = 'kb-copy-rescued';
+const sha256Of = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+const regular = (file) => { const st = lstat(file); return Boolean(st && st.isFile() && !st.isSymbolicLink()); };
+export function rescueOperationalFiles(copyDir, rescue, brainHome, name = path.basename(copyDir)) {
+  if (!rescue?.length) return null;
+  const root = path.join(brainHome, RESCUE_DIR); const dest = path.join(root, name);
+  for (const dir of [brainHome, root, dest]) {
+    if (lstat(dir)?.isSymbolicLink()) throw new Error(`refusing to rescue into ${dir}: it is a link`);
+  }
+  for (const { file, sha256 } of rescue) {
+    const from = path.join(copyDir, file); const to = path.join(dest, file);
+    if (!regular(from) || sha256Of(from) !== sha256) throw new Error(`${file} changed after the copy was proven; the copy is kept`);
+    fs.mkdirSync(path.dirname(to), { recursive: true });
+    if (!lstat(to)) fs.copyFileSync(from, to, fs.constants.COPYFILE_EXCL);
+    if (!regular(to) || sha256Of(to) !== sha256) throw new Error(`could not rescue ${file} to ${to} (a different file is there); the copy is kept`);
+  }
+  // A reused rescue folder (an earlier sweep rescued, then could not release, this copy) holds the only copy of these
+  // logs once the copy goes: make it the newest, so retention keeps it among the newest five (review r2). A failure
+  // throws, and the caller keeps the copy.
+  const touched = new Date(); fs.utimesSync(dest, touched, touched);
+  return dest;
+}
+
 const PROOF_CACHE = '.footprint-proof-cache.json';
+// #335: schema 1 KEPT proofs predate kept-sibling accounting (two identical preserved copies each kept the
+// other forever); they are proven once more. A dropped cache entry can only cost a re-hash, never a byte.
+const PROOF_CACHE_SCHEMA = 2;
+// The proof rule a cached KEPT verdict was reached under. A verdict from an older rule (one that kept copies
+// the current rule releases, e.g. for a log file before rescue existed) is not reused; that copy is proven again.
+const PROOF_RULE = 2;
 const IDENTITY_FILES = ['SOURCE.json', 'PRIVATE-STORES.json', 'COVERAGE.json', 'RVF-GENERATIONS.json'];
 const statKey = (file) => { try { const st = fs.lstatSync(file); return `${st.size}:${Math.floor(st.mtimeMs)}`; } catch { return '-'; } };
 const fingerprint = (dir) => [statKey(dir), ...IDENTITY_FILES.map((f) => statKey(path.join(dir, f)))].join('|');
@@ -165,21 +203,21 @@ const fingerprint = (dir) => [statKey(dir), ...IDENTITY_FILES.map((f) => statKey
 export function readProofCache(brainHome) {
   try {
     const doc = JSON.parse(fs.readFileSync(path.join(brainHome, PROOF_CACHE), 'utf8'));
-    if (doc && typeof doc.entries === 'object' && doc.entries) return doc;
+    if (doc && doc.schemaVersion === PROOF_CACHE_SCHEMA && typeof doc.entries === 'object' && doc.entries) return doc;
   } catch { /* none yet */ }
-  return { schemaVersion: 1, entries: {} };
+  return { schemaVersion: PROOF_CACHE_SCHEMA, entries: {} };
 }
 
 /** The cached KEPT proof for this copy, if neither the copy nor the live brain changed since. */
 export function cachedKept(cache, copyDir, liveDir) {
   const hit = cache.entries[copyDir];
-  return hit && hit.copy === fingerprint(copyDir) && hit.live === fingerprint(liveDir) ? hit : null;
+  return hit && hit.rule === PROOF_RULE && hit.copy === fingerprint(copyDir) && hit.live === fingerprint(liveDir) ? hit : null;
 }
 
 export function rememberKept(brainHome, copyDir, liveDir, proof) {
   try {
     const cache = readProofCache(brainHome);
-    cache.entries[copyDir] = { copy: fingerprint(copyDir), live: fingerprint(liveDir), reason: proof.reason,
+    cache.entries[copyDir] = { rule: PROOF_RULE, copy: fingerprint(copyDir), live: fingerprint(liveDir), reason: proof.reason,
       unique: (proof.unique || []).slice(0, 10), at: new Date().toISOString() };
     const file = path.join(brainHome, PROOF_CACHE);
     fs.writeFileSync(`${file}.tmp-${process.pid}`, JSON.stringify(cache));
@@ -187,7 +225,96 @@ export function rememberKept(brainHome, copyDir, liveDir, proof) {
   } catch { /* uncached: the next sweep proves it again, which is only slower */ }
 }
 
-/** The honest remedy for a copy no command can remove: what it holds, and that the owner decides. */
-export const keptCopyFix = (copyDir, hit) => `nothing to run: ${copyDir} is kept because it holds ${
+/** The honest remedy for a kept copy: what it holds, and the explicit archive command that releases it (#335). */
+export const keptCopyFix = (copyDir, hit) => `npx ruvnet-brain --clean --archive — ${copyDir} is kept because it holds ${
   (hit.unique || []).some((u) => /private/i.test(u.why || '')) ? 'private ' : ''}data the live brain lacks (${
-  (hit.unique || []).slice(0, 3).map((u) => u.file).join(', ') || hit.reason}); restore that into the live brain, or delete the copy yourself once inspected`;
+  (hit.unique || []).slice(0, 3).map((u) => u.file).join(', ') || hit.reason}); that copies only those files into kb.archive/ and releases the copy (or restore them into the live brain yourself)`;
+
+const sha256File = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+/**
+ * Every `<archiveDir>/<stamp>/<label>` tree `--clean --archive` wrote: real directories only, links never entered.
+ * A dot-named entry is an archive still being written (or one a killed sweep left half-written); it is never
+ * a reference, so a partial archive can never account for a copy's bytes.
+ */
+export function archiveRoots(archiveDir) {
+  const real = (p) => { const st = lstat(p); return Boolean(st && st.isDirectory() && !st.isSymbolicLink()); };
+  if (!real(archiveDir)) return [];
+  return names(archiveDir).map((s) => path.join(archiveDir, s)).filter(real)
+    .flatMap((stampDir) => names(stampDir).filter((n) => !n.startsWith('.')).map((n) => path.join(stampDir, n)).filter(real));
+}
+
+/** Undo an archive this sweep wrote (the copy it came from is being kept, so the archive holds nothing unique). */
+export function discardArchive(root) {
+  fs.rmSync(root, { recursive: true, force: true });
+  fs.rmSync(`${root}.json`, { force: true });
+}
+
+/**
+ * Discard an archive ONLY while the copy it came from still holds every archived byte (review 4.7.21 r2). Between
+ * the archive and the re-proof another process (an updater's reclaimBackups, which counts this archive as
+ * evidence) may have removed the copy; a re-proof of a missing directory still says "keep", so an unconditional
+ * discard would lose the bytes in both places. The copy must still be a real directory and each archived file a
+ * regular file there with the same SHA-256; otherwise the archive is kept and the reason is returned.
+ */
+export function discardArchiveIfMirrored({ root, copyDir, files }) {
+  const dir = lstat(copyDir);
+  if (!dir || dir.isSymbolicLink() || !dir.isDirectory()) return { discarded: false, reason: `${copyDir} is no longer a real directory` };
+  for (const { file, sha256 } of files || []) {
+    const held = path.join(copyDir, file);
+    let same = false;
+    try { same = regular(held) && sha256File(held) === sha256; } catch { same = false; }
+    if (!same) return { discarded: false, reason: `${file} is no longer identical in ${copyDir}` };
+  }
+  discardArchive(root);
+  return { discarded: true };
+}
+
+/**
+ * #335 `--clean --archive` (explicit, never automatic): COPY exactly the files a KEPT proof named unique into
+ * `<stampDir>/<label>/<same relative path>`, verify each byte-for-byte, and write `<stampDir>/<label>.json`.
+ * Moves and deletes nothing: the caller re-proves the copy against this archive before releasing it. A link,
+ * an unsafe ancestor, a non-regular file, too little free space or any copy error archives nothing usable.
+ * ALL OR NOTHING: the files go to a dot-named temp sibling and are renamed to `<label>` only after every one
+ * verifies (the receipt likewise); a failure removes the temp, so no half-written `<label>` is ever left for a
+ * later sweep to compare against.
+ */
+export function archiveUniqueFiles({ copyDir, unique, stampDir, label, now = Date.now() }) {
+  if (!Array.isArray(unique) || !unique.length) return { ok: false, reason: 'no file is named unique; the copy is kept for another reason' };
+  const root = path.join(stampDir, label);
+  if (lstat(root)) return { ok: false, reason: `${root} already exists` };
+  let need = 0;
+  for (const { file, why } of unique) {
+    const st = lstat(path.join(copyDir, file));
+    if (/link|ancestor/i.test(String(why)) || !st || !st.isFile() || st.isSymbolicLink()) return { ok: false, reason: `${file} is not a regular file that can be archived (${why})` };
+    need += st.size;
+  }
+  const temp = path.join(stampDir, `.${label}.partial-${process.pid}-${crypto.randomBytes(4).toString('hex')}`);
+  const receipt = path.join(stampDir, `${label}.json`); const receiptTemp = `${temp}.json`;
+  let renamed = false;
+  try {
+    fs.mkdirSync(stampDir, { recursive: true });
+    const free = typeof fs.statfsSync === 'function' ? fs.statfsSync(stampDir) : null;
+    if (free && Number(free.bavail) * Number(free.bsize) < need + 64 * 1024 * 1024) {
+      return { ok: false, reason: `not enough free space to archive ${need} bytes` };
+    }
+    const files = [];
+    for (const { file } of unique) {
+      const src = path.join(copyDir, file); const dst = path.join(temp, file);
+      fs.mkdirSync(path.dirname(dst), { recursive: true });
+      fs.copyFileSync(src, dst, fs.constants.COPYFILE_EXCL);
+      const sha256 = sha256File(src);
+      if (sha256File(dst) !== sha256) throw new Error(`archived bytes of ${file} differ from the source`);
+      files.push({ file, bytes: fs.lstatSync(dst).size, sha256 });
+    }
+    fs.writeFileSync(receiptTemp, `${JSON.stringify({ schemaVersion: 1, kind: 'ruvnet-brain-kb-archive',
+      source: copyDir, archivedAt: new Date(now).toISOString(), files }, null, 2)}\n`, { flag: 'wx' });
+    if (lstat(root) || lstat(receipt)) throw new Error(`${root} appeared while archiving`);
+    fs.renameSync(temp, root); renamed = true;
+    fs.renameSync(receiptTemp, receipt);
+    return { ok: true, root, files, bytes: need };
+  } catch (error) {
+    fs.rmSync(temp, { recursive: true, force: true }); fs.rmSync(receiptTemp, { force: true });
+    if (renamed) fs.rmSync(root, { recursive: true, force: true });
+    return { ok: false, reason: `archive failed: ${error.message}` };
+  }
+}

package/plugin/scripts/grok-hook-adapter.mjs

@@ -36,6 +36,7 @@ import { spawnSync } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { normalizeHostEvent } from './hook-input.mjs';
 import { developmentHooksSuspended } from './development-maintenance.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const PLUGIN_ROOT = path.resolve(HERE, '..');
@@ -155,5 +156,5 @@ async function main() {
   return out.code;
 }
 
-const isMain = (() => { try { return fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); } catch { return false; } })();
+const isMain = isDirectInvocation(import.meta.url);
 if (isMain) process.exit(await main().catch(() => 0));

package/plugin/scripts/ground-ruvnet.sh

@@ -235,7 +235,8 @@ fi
 # FOOT_V computed above are reused there.)
 if [ "$RUFLO_STATE" = "yes" ] && [ "$MEM_STATE" = "off" ]; then
   out_to 1-2-memory-offer <<'EOF'
-This project runs the Ruflo stack but AgentDB persistent project memory is NOT set up (.swarm/memory.db does not exist) — decisions made here are being lost between sessions. rUv's default is memory ON. If you have not already offered this session, offer ONCE, plainly and warmly: "One thing I noticed: this project doesn't have persistent memory turned on — AgentDB would let me carry decisions and context across sessions instead of starting cold each time. Want me to turn it on and wire it up?" On a yes, set it up with the ruflo tools you have (a first memory_store write creates the store) and confirm with the real file path. If they decline, respect it for the rest of the session — the status line keeps them informed without nagging.
+This project runs the Ruflo stack but AgentDB persistent project memory is NOT set up (.swarm/memory.db does not exist) — decisions made here are being lost between sessions. rUv's default is memory ON. If you have not already mentioned it this session, state it ONCE, plainly and warmly: "One thing I noticed: this project doesn't have persistent memory turned on — AgentDB would let me carry decisions and context across sessions instead of starting cold each time; saying 'turn on memory' sets it up." If the user says to, set it up with the ruflo tools you have (a first memory_store write creates the store) and confirm with the real file path. If they decline, respect it for the rest of the session — the status line keeps them informed without nagging.
+Optional, informational advice: mention it at most once as a statement and continue the current task. Do not open a question or approval dialog because of it; it grants no authority to install or update anything.
 EOF
 fi
 # A stale mtime is not a user-facing event. SessionEnd/PreCompact own capture;
@@ -330,7 +331,8 @@ Explain it in the user's words, not the plumbing's:
   in THIS project, and read the reason it prints. "opt-in required" or "anchor required" means off.
 - TURN IT OFF: remove that env var (and `RUFLO_DAEMON_AUTOSTART=0` stops the daemon auto-starting).
 
-Offer like this: "Ruflo can quietly tune how it recalls memory — testing changes against a frozen benchmark and only keeping what provably wins, with a receipt you can replay. It's free, it's off by default, and it does nothing until this project has enough history. Want me to turn it on?" If they decline, respect it and never raise it again unless they ask.
+Offer like this: "Ruflo can quietly tune how it recalls memory — testing changes against a frozen benchmark and only keeping what provably wins, with a receipt you can replay. It's free, it's off by default, and it does nothing until this project has enough history; saying 'turn on the flywheel' enables it." If they decline, respect it and never raise it again unless they ask.
+Optional, informational advice: mention it at most once as a statement and continue the current task. Do not open a question or approval dialog because of it; it grants no authority to install or update anything.
 EOF
 fi
 
@@ -431,7 +433,8 @@ if [ -s "$VCACHE" ]; then
   done < "$VCACHE"
   if [ -n "$OUTDATED" ]; then
     { echo "[RuvNet Brain — stack updates available:$OUTDATED]"
-      echo "Mention this ONCE per session, briefly and helpfully (\"your ruflo is a version behind — want me to update it?\"); if already mentioned this session, stay silent."
+      echo "Mention this ONCE per session, briefly, as a statement (\"your ruflo is a version behind the latest release.\"); if already mentioned this session, stay silent."
+      echo "Optional, informational advice: mention it at most once as a statement and continue the current task. Do not open a question or approval dialog because of it; it grants no authority to install or update anything."
     } | out_to 4-2-stack
   fi
 fi

package/plugin/scripts/grounding-answer.mjs

@@ -23,6 +23,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { normalizeToolOutcome } from './continuity-events.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 const BANNER = /^Searched \d+ RuvNet repos \(/;
 const CARD = /^⚡ FAST LANE — [^\n]*\n#1  repo=\S+  evidence=curated-capability-card\n/;
@@ -126,7 +127,7 @@ async function main() {
 }
 
 function isMain() {
-  try { return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); }
+  try { return isDirectInvocation(import.meta.url); }
   catch { return false; }
 }
 if (isMain()) main();

package/plugin/scripts/grounding-code-projection.mjs

@@ -2,6 +2,7 @@
 // Keep executable strings and paths: mentioning a product in code still requires grounding.
 import fs from 'node:fs';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 export function codeWithoutInertText(source, python = false) {
   if (/\r(?!\n)|[\u2028\u2029]/.test(source)) throw new Error('Unsupported line boundary');
@@ -80,7 +81,7 @@ export function projectGroundingInput(raw) {
 }
 
 function isMain() {
-  try { return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); }
+  try { return isDirectInvocation(import.meta.url); }
   catch { return false; }
 }
 

package/plugin/scripts/grounding-substance.mjs

@@ -60,6 +60,7 @@ import crypto from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { parseHookEvent, toolName } from './hook-input.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 
@@ -585,7 +586,7 @@ function main() {
 // stdin here is a pipe bash has already drained and re-fed (`printf '%s' "$INPUT" | node …`), so the
 // held-open-stdin hole ADR-055 F20 found in unprompted-runtime.mjs cannot occur on this path: there
 // is no interactive terminal on the other end, ever.
-if (process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url) {
+if (isDirectInvocation(import.meta.url)) {
   let code = 0;
   try { code = main(); } catch (e) {
     try { process.stderr.write(`[grounding-substance] degraded (${e && e.message}) — write permitted\n`); } catch { /* never */ }

package/plugin/scripts/grounding-turn-gate.mjs

@@ -88,6 +88,7 @@ import {
   architectureShadow, auditAssertions, correctionText, describeSources, loadVocabulary, logShadow,
   relayShadow, ruvCapabilityClaims, searchedThisTurn, turnSources,
 } from './grounding-turn-evidence.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 const HOME = os.homedir();
 const EXIT_ALLOW = 0;
@@ -238,8 +239,7 @@ async function main() {
  *  helpers — same guard decision-gate.mjs uses, for the same reason (entrypoint-guard-safety). */
 function isMain() {
   try {
-    if (!process.argv[1]) return false;
-    return fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
+    return isDirectInvocation(import.meta.url);
   } catch { return false; }
 }
 

package/plugin/scripts/grounding-turn-mark.mjs

@@ -58,6 +58,7 @@ import { loadSettings, writeAtomic } from './user-settings.mjs';
 import { classifyPrompt, loadVocabulary } from './grounding-turn-evidence.mjs';
 import { answerOf, brainAnsweredResponse } from './grounding-answer.mjs';
 import { RUVNET_GATE1_TERMS } from './ruvnet-gate1-pattern.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 const HOME = os.homedir();
 export const MARKER_DIR = process.env.RUVNET_GROUNDING_TURN_DIR
@@ -305,8 +306,7 @@ async function main() {
  *  helpers — same guard decision-gate.mjs uses, for the same reason (entrypoint-guard-safety). */
 function isMain() {
   try {
-    if (!process.argv[1]) return false;
-    return fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
+    return isDirectInvocation(import.meta.url);
   } catch { return false; }
 }
 

package/plugin/scripts/hook-context-budget.mjs

@@ -3,6 +3,7 @@ import path from 'node:path';
 import os from 'node:os';
 import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 export const FRAME_KIND = 'brain-owned-context-blocks';
 const digest = (value) => crypto.createHash('sha256').update(value).digest('hex');
@@ -73,7 +74,7 @@ export function emitOwnedContext(frame, { env = process.env, rawText = false } =
 }
 
 let direct = false;
-try { direct = fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url); } catch {}
+try { direct = isDirectInvocation(import.meta.url); } catch {}
 if (direct && process.argv[2] === '--ground-dir') {
   const directory = process.argv[3]; const blocks = [];
   for (const id of fs.readdirSync(directory).filter((id) => /^\d+-\d+-[\w-]+$/.test(id)).sort((a, b) => Number(a.split('-')[0]) - Number(b.split('-')[0]))) {

package/plugin/scripts/hook-input.mjs

@@ -28,6 +28,7 @@
 
 import fs from 'node:fs';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 // ── GROK CLI PAYLOADS (4.5) ──────────────────────────────────────────────────────────────────────
 //
@@ -677,8 +678,7 @@ export function invocationLines(cmd, tools) {
 // argv[1] pointing at some other file.
 function isMain() {
   try {
-    if (!process.argv[1]) return false;
-    return fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
+    return isDirectInvocation(import.meta.url);
   } catch {
     return false;
   }

package/plugin/scripts/hook-shim.mjs

@@ -215,8 +215,13 @@ if (BRAIN_OFF && entry.offBehavior === 'silence') process.exit(0);
 // prompt. They stay registered and run only when RUVNET_STOP_NUDGES=full, so nothing is deleted and the
 // tests still exercise them. The blocking hooks (decision-gate), the grounding directive and the silent
 // capture hooks are unaffected.
-const QUIET_BY_DEFAULT = new Set(['unprompted-speech', 'capacity-aware-parallel-work', 'grounding-turn-gate']);
-if (QUIET_BY_DEFAULT.has(hookId) && String(process.env.RUVNET_STOP_NUDGES || '').toLowerCase() !== 'full') process.exit(0);
+// unprompted-speech is not exited (2026-10-25): its lesson channel is the only route a recorded correction
+// takes to the next prompt, and exiting it whole silenced every learned lesson from 4.7.8 (D4 wire: 0 bytes).
+// Quiet runs only its lesson/alarm producers; advocacy, promotion and anticipate offers stay silent.
+const NUDGES_FULL = String(process.env.RUVNET_STOP_NUDGES || '').toLowerCase() === 'full';
+const QUIET_BY_DEFAULT = new Set(['capacity-aware-parallel-work', 'grounding-turn-gate']);
+if (QUIET_BY_DEFAULT.has(hookId) && !NUDGES_FULL) process.exit(0);
+const QUIET_SPEECH_CHANNELS = hookId === 'unprompted-speech' && !NUDGES_FULL ? 'lesson,alarm' : null;
 
 // Read a bounded payload before dispatch. The ground body owns the quiet-prompt
 // decision because it resolves canonical memory beyond the hook process's cwd.
@@ -370,6 +375,7 @@ function registeredTimeoutMs(extraArgs) {
 // chosen from the typed table — never from input.
 function runHook(file, activeVersion = '') {
   if (!fs.existsSync(file)) return 0; // nothing to run — never invent a failure
+  try { if (QUIET_SPEECH_CHANNELS && !fs.readFileSync(file, 'utf8').includes('RUVNET_UNPROMPTED_CHANNELS')) return 0; } catch { return 0; } // quiet + a <=4.7.20 spine body that ignores the narrowing (it would speak advocacy) → the old whole-hook quiet exit
   let cmd;
   if (entry.interpreter === 'node') {
     cmd = process.execPath;
@@ -395,6 +401,7 @@ function runHook(file, activeVersion = '') {
     // machine where `node` is not on the PATH the host hands its hooks. Additive: older bodies ignore it.
     RUVNET_NODE_BIN: process.execPath,
     ...(['unprompted-speech', 'ground-ruvnet', 'decision-gate'].includes(hookId) ? { RUVNET_HOOK_CONTEXT_BUDGET: '1' } : {}),
+    ...(QUIET_SPEECH_CHANNELS ? { RUVNET_UNPROMPTED_CHANNELS: QUIET_SPEECH_CHANNELS } : {}),
     ...(activeVersion ? { RUVNET_BRAIN_ACTIVE_VERSION: activeVersion } : {}),
     ...(BRAIN_OFF && entry.offBehavior === 'partial' ? { RUVNET_BRAIN_OFF: '1' } : {}),
   };

package/plugin/scripts/host-update.mjs

@@ -2,7 +2,7 @@
 // Host-neutral automatic updater. The published installer is the single coordinator for Claude
 // Code and Codex, so lifecycle updates cannot drift into host-specific shell pipelines again.
 import { spawnSync } from 'node:child_process';
-import { automaticInvocation, automaticPath, updateSource } from './automatic-update.mjs';
+import { automaticInvocation, automaticPath, installedUpdater, updateSource } from './automatic-update.mjs';
 import { developerCoordinatorOwner } from './developer-update-owner.mjs';
 
 const CHILD_ENV_KEYS = new Set([
@@ -92,7 +92,20 @@ if (knowledgeAt >= 0) {
       // Decide by the recorded IDENTITY verdict whenever this run wrote one; the exit code only when it did
       // not (a network failure or an incompatible release dies before recording). Measured against the real
       // API: an install whose profile selects no stores exits 0 on UPDATE_AVAILABLE ("All stores current").
-      const newer = verdict ? ['UPDATE_AVAILABLE', 'UNKNOWN'].includes(verdict) : check.status === 10;
+      let newer = verdict ? ['UPDATE_AVAILABLE', 'UNKNOWN'].includes(verdict) : check.status === 10;
+      // Exit 5 is a remembered rejection keyed to the KB's runtime stamp. Only the installer re-stamps it, so when the
+      // version that would run differs from the stamp, run the update anyway (AuditC #5; the coordinator does the same).
+      if (!newer && !verdict && check.status === 5) {
+        let stamped = null, target = null;
+        try { stamped = readJson(path.join(kbDir, 'RUNTIME-IDENTITY.json'))?.brainVersion || null; } catch { /* no stamp */ }
+        try {
+          if (source === 'latest') {
+            const response = await fetch('https://registry.npmjs.org/ruvnet-brain/latest', { signal: AbortSignal.timeout(5_000) });
+            target = response.ok ? (await response.json()).version || null : null;
+          } else target = installedUpdater().version || null;
+        } catch { /* unknown target: stays incompatible */ }
+        newer = Boolean(target && target !== stamped);
+      }
       if (!newer && (verdict || check.status === 0)) {
         note({ outcome: verdict === 'REFUSED' ? 'refused' : 'current', verdict: verdict || 'CURRENT', candidateTag, reason: '' });
         stop();
@@ -125,7 +138,9 @@ if (knowledgeAt >= 0) {
       const invocation = automaticInvocation(['--update', '--no-nightly-prompt'], { source });
       const run = spawnSync(invocation.executable, invocation.args, {
         env: childEnvironment(), encoding: 'utf8', maxBuffer: 64 * 1024 * 1024,
-        timeout: Number(process.env.RUVNET_KNOWLEDGE_UPDATE_TIMEOUT_MS || 25 * 60_000),
+        // Above the coordinator's installer limit (135 min: a 90-minute bundle deadline plus the apply), below the
+        // SessionStart TTL (session-start-update-plane.mjs AUTO_UPDATE_POLICY.ttlSec), so an outcome is always recorded.
+        timeout: Number(process.env.RUVNET_KNOWLEDGE_UPDATE_TIMEOUT_MS || 150 * 60_000),
       });
       process.stdout.write(run.stdout || '');
       process.stderr.write(run.stderr || '');
@@ -133,8 +148,11 @@ if (knowledgeAt >= 0) {
       const tail = `${run.stderr || ''}\n${run.stdout || ''}`.replace(/\u001b\[[0-9;]*m/g, '')
         .split('\n').map((line) => line.trim()).filter(Boolean);
       const code = run.error ? null : run.status;
-      record({ outcome: code === 0 ? 'succeeded' : 'failed', code,
-        reason: code === 0 ? '' : String(run.error?.message || tail.find((l) => /✗|error|fail/i.test(l)) || tail.at(-1) || 'no output').slice(0, 200) });
+      // Exit 12 is the installer's "knowledge applied, redundant rollback cleanup still pending"; the coordinator
+      // (developer-update.mjs) accepts it as success too. Recording it FAILED spoke a false failure line.
+      const succeeded = code === 0 || code === 12;
+      record({ outcome: succeeded ? 'succeeded' : 'failed', code,
+        reason: succeeded ? '' : String(run.error?.message || tail.find((l) => /✗|error|fail/i.test(l)) || tail.at(-1) || 'no output').slice(0, 200) });
     }
   } catch (error) {
     record({ outcome: 'failed', code: null, reason: error.message.slice(0, 200) });
@@ -147,6 +165,12 @@ if (knowledgeAt >= 0) {
 let invocation;
 try { invocation = automaticInvocation(['--update', '--host-sync-only', '--no-nightly-prompt']); }
 catch (error) { process.stderr.write(`[ruvnet-brain] automatic update refused: ${error.message}\n`); process.exit(1); }
+if (invocation.source === 'developer-suite') {
+  // The coordinator installs code packages only in its scheduled run, and its knowledge step belongs to the SessionStart
+  // self-heal (--knowledge, sized for the bundle download). Running it here under a 9-minute limit would kill it mid-apply.
+  process.stdout.write('[ruvnet-brain] coordinated updates own this machine: the scheduled nightly installs new code; knowledge updates run from the SessionStart self-heal\n');
+  process.exit(0);
+}
 const result = spawnSync(invocation.executable, invocation.args, {
   // The downloaded package must not inherit unrelated API keys, cloud credentials, or tokens from
   // the interactive host. npm's registry integrity protects the package bytes; this boundary

package/plugin/scripts/identifier-preflight.mjs

@@ -36,6 +36,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 /**
  * Each entry knows how to enumerate the identifiers its CLI actually accepts on THIS machine.
@@ -118,7 +119,7 @@ export function check(command, opts = {}) {
 }
 
 const isMain = (() => {
-  try { return process.argv[1] && fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url); }
+  try { return isDirectInvocation(import.meta.url); }
   catch { return false; }
 })();