ruvnet-brain 4.7.21 → 4.7.22

package/README.md

@@ -9,7 +9,7 @@ Created: 2026-06-29 22:36:38 EDT
 
 ### Discover the stack. Read the source. Build with confidence.
 
-[![RuvNet Brain version 4.6.2 — README updated 2026-10-10 EDT](https://img.shields.io/badge/version_4.7.21-updated_2026--10--10_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](plugin/.claude-plugin/plugin.json)
+[![RuvNet Brain version 4.6.2 — README updated 2026-10-10 EDT](https://img.shields.io/badge/version_4.7.22-updated_2026--10--10_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](plugin/.claude-plugin/plugin.json)
 
 **A source-grounded companion for Claude Code and Codex that helps you find and use Reuven Cohen's (rUv's) RuvNet ecosystem.**
 
@@ -255,7 +255,7 @@ uses the protected release workflow; a consumer update downloads an available ge
 does not rebuild upstream knowledge. Check `--doctor`, `SOURCE.json` and refresh receipts
 before treating an installation as current.
 
-The **4.6.0 published-corpus baseline** is **205 public stores · 166,081 public source chunks**.
+The **4.6.0 published-corpus baseline** is **206 public stores · 171,869 public source chunks**.
 Those are bundle census values, not a claim that every upstream repository is fresh today.
 Later corpus publication may advance the knowledge generation independently of code changes.
 

package/bin/install.mjs

@@ -85,6 +85,7 @@ import {
 import { shellDiff as pluginShellDiff } from '../plugin/scripts/host-shell-boundary.mjs';
 import { codexPluginContentChanged, codexTrustChanges, codexUsesContentTrust, CODEX_TRUST_ACTION } from '../scripts/codex-hook-trust.mjs';
 import { probeFreshCodexDeclarations } from '../scripts/codex-fresh-host-proof.mjs';
+import { proveCodexBootSurface, parseChangedPaths } from '../scripts/codex-boot-surface-proof.mjs';
 import { refreshSharedCodexAppServer } from '../scripts/codex-hook-trust-reconcile.mjs';
 import { recordCodexOvernightNotice } from '../plugin/scripts/codex-overnight-notice.mjs';
 import { repairSecurityGuidance } from '../scripts/security-guidance-codex-compat.mjs';
@@ -3344,8 +3345,15 @@ async function doctorRun({ json }) {
         const binary = codexAdministrativeProbeBinary();
         const fresh = await probeFreshCodexDeclarations({ binary, codexHome: codexHomeDir(), cwd: process.cwd(),
           releasedPluginRoot: path.join(REPO_ROOT, 'plugin'), expectedVersion: PACKAGE_VERSION });
-        hostConvergence = reconcileFreshCodexDeclarations(recorded, fresh);
-        if (fresh.ok) info('Codex fresh-declarations-ready: current trusted hook declarations only; hook bodies and MCP execution were not tested. Existing open windows remain unproven.');
+        // Issue #391: a receipt that names the hook shim, MCP server or skills/ as changed is proven path by path
+        // (scripts/codex-boot-surface-proof.mjs). Doctor only READS: the receipt on disk is never rewritten here.
+        const changedPaths = parseChangedPaths(codex.sessionSafetyReason);
+        const needsBootProof = changedPaths.some((file) => !['hooks/codex-hooks.json', 'hooks/hooks.json'].includes(file));
+        const bootSurface = needsBootProof ? await proveCodexBootSurfaceHere(changedPaths, fresh) : null;
+        hostConvergence = reconcileFreshCodexDeclarations(recorded, fresh, PACKAGE_VERSION, bootSurface);
+        if (bootSurface?.ok) info(`Codex boot-surface-ready: ${bootSurface.proven.map((p) => p.path).join(', ')} proven for NEW sessions (real shim run, real MCP initialize + tools/list). Existing open windows remain unproven; a host relaunch was not observed.`);
+        else if (bootSurface) warn(`Codex boot surface remains unproven: ${bootSurface.reason}`);
+        else if (fresh.ok) info('Codex fresh-declarations-ready: current trusted hook declarations only; hook bodies and MCP execution were not tested. Existing open windows remain unproven.');
         else warn(`Codex fresh declarations remain unproven: ${fresh.reason}`);
       }
       if (hostConvergence.healthy) {
@@ -4241,9 +4249,15 @@ export function syncHostsAfterUpdate(cacheDir = resolvedKbDir(), {
  */
 export async function convergeHostsAfterUpdate(cacheDir = resolvedKbDir(), { refreshHost = refreshCodexSharedHost,
   unattended = process.env.RUVNET_NIGHTLY === '1', recordNotice = recordCodexOvernightNotice,
-  noticeHome = () => footprintRoots().brainHome, ...options } = {}) {
-  const convergence = syncHostsAfterUpdate(cacheDir, options);
+  noticeHome = () => footprintRoots().brainHome, proveBootSurface = proveCodexBootSurfaceDefault, ...options } = {}) {
+  const brainHome = options.brainHome || process.env.RUVNET_BRAIN_HOME || path.join(os.homedir(), '.cache', 'ruvnet-brain');
+  const receiptPath = path.join(brainHome, 'host-convergence.json');
+  const readReceipt = () => { try { return JSON.parse(fs.readFileSync(receiptPath, 'utf8')); } catch { return null; } };
+  const prior = readReceipt();
+  let convergence = syncHostsAfterUpdate(cacheDir, options);
   if (!convergence.results?.codex) return convergence;
+  convergence = await recordCodexBootSurface(convergence, { prior, receiptPath, readReceipt, proveBootSurface,
+    hostLockPath: options.hostLockPath || path.join(brainHome, 'host-convergence.lock') });
   // Owner decision (4.7.21 review r2): the unattended nightly never reloads the shared Codex app-server; a reload
   // pauses Brain hooks in sessions already open until someone re-reviews them in /hooks. It leaves a notice the next
   // SessionStart shows once instead. An interactive --update still reloads.
@@ -4260,6 +4274,57 @@ export async function convergeHostsAfterUpdate(cacheDir = resolvedKbDir(), { ref
   return { ...convergence, hostRefresh };
 }
 
+/**
+ * Issue #391: when Codex still carries a boot-level restart request (a fresh one from this sync, or the previous
+ * receipt's that a repeat sync would otherwise silently drop), prove each changed path and write a NEW receipt:
+ * restartScope 'open-sessions' only when every path is proven, otherwise the request stays 'unproven' with the reason.
+ * A historical receipt is never edited in place; the new one is the atomic replacement the sync itself writes.
+ */
+async function recordCodexBootSurface(convergence, { prior, receiptPath, readReceipt, proveBootSurface, hostLockPath }) {
+  if (!convergence.ok && convergence.restartOnly !== true) return convergence;
+  const current = readReceipt();
+  const codex = current?.hosts?.codex;
+  if (!current || current.desiredVersion !== PACKAGE_VERSION || codex?.state !== 'ready') return convergence;
+  const priorCodex = prior?.desiredVersion === PACKAGE_VERSION ? prior.hosts?.codex : null;
+  const fresh = codex.restartRequired === true && codex.restartScope === 'unproven';
+  const carried = codex.restartRequired !== true && priorCodex?.state === 'ready' && priorCodex.restartRequired === true
+    && priorCodex.restartScope === 'unproven' && convergence.results.codex.action === 'unchanged';
+  if (!fresh && !carried) return convergence;
+  const reason = fresh ? codex.sessionSafetyReason : priorCodex.sessionSafetyReason;
+  const changedPaths = parseChangedPaths(reason);
+  let proof;
+  try { proof = await proveBootSurface({ changedPaths }); }
+  catch (error) { proof = { ok: false, state: 'boot-surface-unproven', changed: changedPaths, proven: [], unproven: [], reason: error?.message || String(error),
+    existingWindows: 'unproven', hostRelaunch: 'not-observed' }; }
+  const ready = proof?.ok === true && proof.state === 'boot-surface-ready';
+  const next = { ...current, verifiedAt: new Date().toISOString(), hosts: { ...current.hosts, codex: { ...codex,
+    restartRequired: true, sessionSafety: 'restart-required', sessionSafetyReason: reason,
+    restartScope: ready ? 'open-sessions' : 'unproven',
+    bootSurface: { state: proof?.state || 'boot-surface-unproven', changed: proof?.changed || changedPaths,
+      proven: (proof?.proven || []).map((p) => p.path), unproven: proof?.unproven || [], reason: proof?.reason || null,
+      existingWindows: 'unproven', hostRelaunch: 'not-observed' } } } };
+  // The receipt is the sync's own file, so this read-modify-write takes the same lock the sync holds (the proof
+  // above can be slow, so the lock is held only for the write). A receipt that changed while we proved, or a lock
+  // we cannot take, means a newer sync owns it: record nothing and leave the prior, still-truthful receipt.
+  const writeLock = acquireHostConvergenceLock(hostLockPath);
+  if (!writeLock.acquired) return { ...convergence, bootSurface: proof, bootSurfaceNotRecorded: `host synchronization lock unavailable: ${writeLock.error}` };
+  try {
+    const latest = readReceipt();
+    if (latest?.verifiedAt !== current.verifiedAt || latest?.desiredVersion !== current.desiredVersion) {
+      return { ...convergence, bootSurface: proof, bootSurfaceNotRecorded: 'host-convergence receipt changed while the boot surface was proven' };
+    }
+    const tmp = `${receiptPath}.tmp-${process.pid}`;
+    fs.writeFileSync(tmp, JSON.stringify(next, null, '  ')); // two-space indent, same bytes as before
+    fs.renameSync(tmp, receiptPath);
+  } finally { writeLock.release(); }
+  const classified = classifyHostConvergence(next);
+  if (classified.healthy) classified.state = 'boot-surface-ready';
+  const { restartOnly, ...rest } = convergence;
+  return { ...rest, ok: classified.healthy === true, convergence: classified, bootSurface: proof,
+    ...(!classified.healthy && hostRestartIsOnlyGap(next) ? { restartOnly: true } : {}),
+    error: classified.healthy ? null : `host convergence is ${classified.state}: ${classified.action}` };
+}
+
 /**
  * True when a host restart is the ONLY gap in a convergence receipt: every restart-flagged host is ready at the
  * expected version, and with those hosts read as "already-open windows only" everything else (other hosts, the
@@ -4327,7 +4392,7 @@ export function hostSynchronizationFailureMessage(convergence, active, expectedV
 }
 
 /** Doctor projection only. Fresh hook metadata cannot clear an executable or MCP boot gap. */
-export function reconcileFreshCodexDeclarations(recorded, proof, expectedVersion = PACKAGE_VERSION) {
+export function reconcileFreshCodexDeclarations(recorded, proof, expectedVersion = PACKAGE_VERSION, bootSurface = null) {
   const original = classifyHostConvergence(recorded, expectedVersion);
   const codex = recorded?.hosts?.codex;
   if (!proof?.ok || proof.state !== 'fresh-declarations-ready' || proof.expectedVersion !== expectedVersion
@@ -4338,15 +4403,44 @@ export function reconcileFreshCodexDeclarations(recorded, proof, expectedVersion
   const prefix = 'boot-level declarations changed: ';
   const reason = codex.sessionSafetyReason;
   const changed = typeof reason === 'string' && reason.startsWith(prefix) ? reason.slice(prefix.length).split(', ') : [];
-  if (!changed.length || changed.some((file) => !['hooks/codex-hooks.json', 'hooks/hooks.json'].includes(file))) {
-    return { ...original, freshDeclarations: proof, notice: 'Fresh Codex hook declarations are ready; executable/MCP boot readiness and existing open windows remain unproven.' };
+  const hookFilesOnly = changed.length > 0 && changed.every((file) => ['hooks/codex-hooks.json', 'hooks/hooks.json'].includes(file));
+  // #391: every changed path proven by the boot-surface proof (same list as the receipt names) clears the unproven
+  // scope. The proof's own existingWindows:'unproven' and hostRelaunch:'not-observed' stay on the result.
+  const bootProven = !hookFilesOnly && bootSurface?.ok === true && bootSurface.state === 'boot-surface-ready'
+    && bootSurface.changed?.length === changed.length && changed.every((file) => bootSurface.changed.includes(file));
+  if (!hookFilesOnly && !bootProven) {
+    return { ...original, freshDeclarations: proof, ...(bootSurface ? { bootSurface } : {}),
+      notice: bootSurface?.reason ? `Fresh Codex hook declarations are ready; boot surface unproven — ${bootSurface.reason}. Existing open windows remain unproven.`
+        : 'Fresh Codex hook declarations are ready; executable/MCP boot readiness and existing open windows remain unproven.' };
   }
   const projected = classifyHostConvergence({ ...recorded, hosts: { ...recorded.hosts,
     codex: { ...codex, restartScope: 'open-sessions' } } }, expectedVersion);
+  if (bootProven) {
+    return { ...projected, ...(projected.healthy ? { state: 'boot-surface-ready' } : {}), freshDeclarations: proof, bootSurface,
+      notice: 'Fresh Codex boot surface is proven for new sessions (hook shim run, MCP initialize + tools/list); existing open windows remain unproven and a host relaunch was not observed.' };
+  }
   return { ...projected, ...(projected.healthy ? { state: 'fresh-declarations-ready' } : {}), freshDeclarations: proof,
     notice: 'Fresh Codex hook declarations are ready; hook bodies and MCP execution were not tested. Existing open windows remain unproven.' };
 }
 
+/** Prove the changed Codex boot paths against the plugin tree Codex loads. Read-only; `declarations` is a fresh-declarations probe. */
+async function proveCodexBootSurfaceHere(changedPaths, declarations) {
+  const codexHome = codexHomeDir();
+  let installedPluginRoot = declarations?.pluginRoot || null;
+  if (!installedPluginRoot) { try { installedPluginRoot = codexInstalledPluginRoot({ codexHome }); } catch { installedPluginRoot = null; } }
+  return await proveCodexBootSurface({ changedPaths, declarations, installedPluginRoot,
+    releasedPluginRoot: path.join(REPO_ROOT, 'plugin') });
+}
+
+async function proveCodexBootSurfaceDefault({ changedPaths }) {
+  let declarations;
+  try {
+    declarations = await probeFreshCodexDeclarations({ binary: codexAdministrativeProbeBinary(), codexHome: codexHomeDir(), cwd: process.cwd(),
+      releasedPluginRoot: path.join(REPO_ROOT, 'plugin'), expectedVersion: PACKAGE_VERSION });
+  } catch (error) { declarations = { ok: false, reason: error?.message || String(error) }; }
+  return await proveCodexBootSurfaceHere(changedPaths, declarations);
+}
+
 const HOST_LABELS = { claude: 'Claude Code', codex: 'Codex' };
 /** The one accurate line for converged hosts whose already-open windows booted the old declarations. */
 export function openSessionsNotice(hosts, version) {
@@ -6931,6 +7025,7 @@ the installer reports that boot-level declarations changed.
   let installedTag = null;
   let latestTag = null;
   let resolvedRelease = null;   // reused below so the release is resolved at most once
+  let namedTag = null, namedMove = false, namedDowngrade = false; // --version / --pin over an existing install (#504)
   if (alreadyInstalled && !FLAG_FORCE) {
     installedTag = installedBrainVersion(cacheDir); // 'unknown' when SOURCE.json has no releaseTag
     try {
@@ -6973,10 +7068,28 @@ the installer reports that boot-level declarations changed.
       ahead = Boolean(a && b && cmpTag(a, b) > 0);
       staleSkip = Boolean(b && (a === null || (a !== b && !ahead)));
     }
+    // A NAMED release (--version / --pin) runs no lookup, so latestTag stays null and the block below
+    // used to print "the release lookup failed" for a lookup that never happened, installing nothing
+    // (#504). The operator named the target: same tag = truthful skip; different or unknown = take the
+    // same signature-verified download path. Older than installed is allowed (explicit request), loudly.
+    const named = resolvedRelease && (resolvedRelease.source === 'pinned' || resolvedRelease.source === 'forced')
+      ? (resolvedRelease.tag_name || resolvedRelease.tag) : null;
+    if (named) {
+      const nrm = (v) => (v == null || v === 'unknown' ? null : String(v).replace(/^v/, ''));
+      namedTag = named;
+      if (isCorpusReleaseTag(named)) namedMove = installedCorpusTag(cacheDir) !== named;
+      else {
+        namedMove = nrm(installedTag) !== nrm(named);
+        namedDowngrade = Boolean(nrm(installedTag) && cmpTag(nrm(installedTag), nrm(named)) > 0);
+      }
+    }
   }
 
-  if (alreadyInstalled && !FLAG_FORCE && !staleSkip) {
-    if (latestTag && ahead) {
+  if (alreadyInstalled && !FLAG_FORCE && !staleSkip && !namedMove) {
+    if (namedTag) {
+      step('Brain already at the named release — skipping the download', `installed ${installedTag} matches ${namedTag}`);
+      ok(`found ${namedTag} at ${cacheDir} — nothing to download`);
+    } else if (latestTag && ahead) {
       // Never silently imply equality when the user is AHEAD — that would be a small lie, and it is
       // the one that hides a downgrade. Skipping is right; misdescribing why is not.
       step('Brain already current — skipping the download', `installed ${installedTag} is NEWER than the latest release (${latestTag})`);
@@ -6991,6 +7104,10 @@ the installer reports that boot-level declarations changed.
       info(`When you have a connection:  ${c.bold('npx ruvnet-brain --update')}   ${c.dim('(or --force to refetch now)')}`);
     }
   } else {
+    if (namedMove) {
+      if (namedDowngrade) warn(`${namedTag} is OLDER than the installed ${installedTag} — downgrading because you named it explicitly.`);
+      step('Moving to the named release', `installed ${installedTag || 'unknown'} → named ${namedTag}`);
+    }
     if (staleSkip) {
       step('Brain is out of date — fetching the current release', `installed ${installedTag || 'unknown'} → latest ${latestTag}`);
       info(`${c.dim('(the old installer skipped this whenever any brain was present, which is why stale installs never moved)')}`);

package/console/activity.js

@@ -10,6 +10,81 @@
 (function () {
   'use strict';
 
+  /* #499: every figure this card shows, as display text. A value that could not be read (null /
+     undefined / non-numeric) is the word "Unknown" — never 0, which would claim the store is empty.
+     Pure and published on the global before the DOM guard below so a test can load this file without a
+     page. nMem/nLes/nMachine are numeric (unknown -> 0) for the animation maths only; never display them. */
+  function activityFigures(d) {
+    function known(v) { return typeof v === 'number' && isFinite(v); }
+    function show(v) { return known(v) ? Number(v).toLocaleString('en-US') : 'Unknown'; }
+    function num(v) { return known(v) ? v : 0; }
+    d = d || {};
+    var t = d.totals || {};
+    var ag = known(t.agentdbLessons) ? t.agentdbLessons : t.lessons;
+    var ap = d.approvedLessons && d.approvedLessons.available === true ? d.approvedLessons.count : null;
+    var mach = d.machine && d.machine.totalMemories;
+    var apx = d.approvedLessons && d.approvedLessons.available === true ? d.approvedLessons.applicable : null;
+    return {
+      memories: show(t.memories), agentdbLessons: show(ag), lessons: show(ag),
+      approvedLessons: show(ap), approvedMachine: show(ap), approvedApplicable: show(apx), machine: show(mach),
+      observations: show(t.observations), patterns: show(t.patterns), episodes: show(t.episodes),
+      approvedAvailable: known(ap), agentdbKnown: known(ag),
+      nMem: num(t.memories), nLes: num(ag), nMachine: num(mach)
+    };
+  }
+  (typeof globalThis !== 'undefined' ? globalThis : this).activityFigures = activityFigures;
+
+  function escText(v) { return String(v == null ? '' : v).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;'); }
+
+  /* #499: the approved lessons that apply to this project, with the approval / scope / enforcement the owner
+     set — rendered from the server's own bounded list. Pure; an unreadable lesson store says Unknown. */
+  function approvedLessonsHTML(d) {
+    var a = d && d.approvedLessons;
+    if (!a || a.available !== true) return '<p class="ab-fallback">Approved lessons: Unknown (the lesson store could not be read).</p>';
+    var items = Array.isArray(a.items) ? a.items : [];
+    var F = activityFigures(d);
+    var head = '<div class="ab-dl-title"><span class="ab-g">✦</span>' + F.approvedApplicable + ' approved lessons apply to this project · ' + F.approvedMachine + ' approved machine-wide</div>';
+    if (!items.length) return head + '<p class="ab-fallback">None of your approved lessons are scoped to this project.</p>';
+    return head + items.map(function (l) {
+      return '<div class="ab-lrow"><b>' + escText(l.id) + '</b> ' + escText(l.title) +
+        ' <span class="ab-lmeta">scope: ' + escText(l.scope) + ' · enforcement: ' + escText(l.enforcement == null ? 'unknown' : l.enforcement) +
+        ' · ' + (l.ratified ? 'ratified by you' : escText(l.status || 'not ratified')) + '</span></div>';
+    }).join('') + (a.itemsTruncated ? '<p class="ab-fallback">…showing the first ' + items.length + ' of ' + F.approvedApplicable + '.</p>' : '');
+  }
+  (typeof globalThis !== 'undefined' ? globalThis : this).activityApprovedHTML = approvedLessonsHTML;
+
+  /* #500: which machine-wide row is "you". By STORE IDENTITY (the server's projectId against each fleet entry's
+     id), never by folder name — two unrelated repos can both be called "app". No identity on either side means
+     no match (the row is then synthesised from this project's own totals), not a guess from the name. */
+  function activityUniverse(d) {
+    d = d || {};
+    var machine = d.machine || {};
+    var projects = (Array.isArray(machine.projects) ? machine.projects.slice() : [])
+      .sort(function (a, b) { return (b.memories || 0) - (a.memories || 0); });
+    var isMe = function (p) { return !!d.projectId && p.id === d.projectId; };
+    var found = projects.filter(isMe)[0] || null;
+    var others = projects.filter(function (p) { return !isMe(p); });
+    return { projects: projects, me: found, others: others.slice(0, 12), more: Math.max(0, others.length - 12) };
+  }
+  (typeof globalThis !== 'undefined' ? globalThis : this).activityUniverse = activityUniverse;
+
+  /* #499: the rolling narration, from each pipeline stage's OWN measurement. Distillation turns observations
+     into patterns and episodes; it does not write lessons — lessons are ratified by the owner. */
+  function activityNarration(d) {
+    var F = activityFigures(d);
+    var lines = [
+      'Your AI captures everything as it works — ' + F.memories + ' memories in this project so far.',
+      'Learning pipeline in this project: ' + F.observations + ' workflow observations, ' + F.patterns + ' structural patterns, ' + F.episodes + ' episodes.',
+      'Observations are distilled in the background (session end or compaction, when learning is on) into patterns and episodes — not into lessons.',
+      F.approvedApplicable + ' approved lessons apply here (' + F.approvedMachine + ' machine-wide). You ratify lessons; nothing is auto-approved.'
+    ];
+    if (F.agentdbKnown) lines.push(F.agentdbLessons + ' AgentDB lesson records in this project.');
+    else lines.push('AgentDB lesson records: Unknown.');
+    lines.push('Click any number above to see exactly what it knows.');
+    return lines;
+  }
+  (typeof globalThis !== 'undefined' ? globalThis : this).activityNarration = activityNarration;
+
   var CARD = document.getElementById('card-activity');
   var BODY = document.getElementById('body-activity');
   if (!CARD || !BODY) return;
@@ -148,6 +223,8 @@
     '#card-activity .ab-glyph.ab-pulse{animation:ab-pulse-once 1.1s ease-out 1;display:inline-block}',
     '#card-activity .ab-caret{display:inline-block;width:7px;color:var(--amber-text)}',
     /* graceful degrade */
+    '#card-activity .ab-lrow{font-size:13px;color:var(--ink-2);margin:6px 2px;line-height:1.4}',
+    '#card-activity .ab-lmeta{display:block;font-size:12px;color:var(--muted)}',
     '#card-activity .ab-fallback{margin-top:16px;font-size:13.5px;color:var(--ink-2);font-style:italic}',
     '@media (prefers-reduced-motion:reduce){',
     '  #card-activity .ab-glyph.ab-pulse{animation:none}',
@@ -194,6 +271,14 @@
     setChips('<span class="chip tone-grey">unavailable</span>');
   }
 
+  /* #499: no readable project store, but the approved-lesson count is a separate, readable fact. */
+  function degradeWithApprovals(d) {
+    var F = activityFigures(d);
+    BODY.innerHTML = '<p class="ab-fallback">This project\'s memory store is not readable right now (memories: ' + F.memories + '). ' +
+      '<b>' + F.approvedMachine + '</b> approved lessons are in force on this machine' + (F.approvedApplicable !== 'Unknown' ? ' (<b>' + F.approvedApplicable + '</b> apply to this project)' : '') + '.</p>' + approvedLessonsHTML(d);
+    setChips('<span class="chip tone-grey">memories unknown</span><span class="chip tone-green">' + F.approvedMachine + ' approved lessons (machine-wide)</span>');
+  }
+
   /* ---------------- key → plain-English sentence mapper ---------------- */
   var TOOL_LABEL = { memory: 'AgentDB', autocapture: 'Autocapture', hooks: 'Hooks intel', metaharness: 'MetaHarness' };
   var LESSON_TITLES = {
@@ -267,6 +352,7 @@
   fetch('/api/activity', { headers: { Accept: 'application/json' } })
     .then(function (r) { if (!r.ok) throw new Error('http ' + r.status); return r.json(); })
     .then(function (d) {
+      if (d && d.hasStore === false && d.approvedLessons && d.approvedLessons.available === true) { degradeWithApprovals(d); return; }
       if (!d || d.hasStore === false || !d.totals) { degrade(); return; }
       render(d);
     })
@@ -282,8 +368,9 @@
     var projects = (Array.isArray(machine.projects) ? machine.projects.slice() : [])
       .sort(function (a, b) { return (b.memories || 0) - (a.memories || 0); });
     var projectName = d.project || 'this project';
-    var nMem = totals.memories || 0, nLes = totals.lessons || 0;
-    var nProj = projects.length, nMachine = machine.totalMemories || 0;
+    var F = activityFigures(d);
+    var nMem = F.nMem, nLes = F.nLes;
+    var nProj = projects.length;
 
     var LESSONS = lessonsRaw.map(function (l) {
       return { key: l.key, learned: l.learned, recalled: l.access_count || 0, segs: parseExcerpt(l.excerpt) };
@@ -293,8 +380,10 @@
 
     /* summary chips */
     setChips(
-      '<span class="chip tone-amber">' + fmt(nMem) + ' memories</span>' +
-      '<span class="chip tone-green">' + fmt(nLes) + ' lessons</span>'
+      '<span class="chip tone-amber">' + F.memories + ' memories</span>' +
+      '<span class="chip tone-green">' + F.approvedApplicable + ' approved lessons · this project</span>' +
+      '<span class="chip tone-grey">' + F.approvedMachine + ' approved machine-wide</span>' +
+      '<span class="chip tone-grey">' + F.agentdbLessons + ' AgentDB lesson records</span>'
     );
 
     /* ---------------- panel skeleton ---------------- */
@@ -302,16 +391,18 @@
       '<div class="ab-stats">' +
         '<div class="ab-stat ab-door" id="ab-stat-memories" role="button" tabindex="0" aria-expanded="false" aria-controls="ab-doors">' +
           '<span class="ab-hint"></span><span class="ab-tchev">▸</span>' +
-          '<div class="ab-n">' + fmt(nMem) + '</div><div class="ab-l">memories · this project</div></div>' +
+          '<div class="ab-n">' + F.memories + '</div><div class="ab-l">memories · this project</div></div>' +
         '<div class="ab-stat ab-door" id="ab-stat-lessons" role="button" tabindex="0" aria-expanded="false" aria-controls="ab-doors">' +
           '<span class="ab-hint"></span><span class="ab-tchev">▸</span>' +
-          '<div class="ab-n">' + fmt(nLes) + '</div><div class="ab-l">distilled lessons</div></div>' +
+          '<div class="ab-n">' + F.approvedApplicable + '</div><div class="ab-l">approved lessons · apply to this project</div>' +
+          '<div class="ab-l">' + F.approvedMachine + ' approved machine-wide</div>' +
+          '<div class="ab-l">' + F.agentdbLessons + ' AgentDB lesson records · this project</div></div>' +
         '<div class="ab-stat ab-door" id="ab-stat-projects" role="button" tabindex="0" aria-expanded="false" aria-controls="ab-doors">' +
           '<span class="ab-hint"></span><span class="ab-tchev">▸</span>' +
           '<div class="ab-n">' + fmt(nProj) + '</div><div class="ab-l">projects machine-wide</div></div>' +
         '<div class="ab-stat ab-door" id="ab-stat-machine" role="button" tabindex="0" aria-expanded="false" aria-controls="ab-doors">' +
           '<span class="ab-hint"></span><span class="ab-tchev">▸</span>' +
-          '<div class="ab-n">' + fmt(nMachine) + '</div><div class="ab-l">memories machine-wide</div></div>' +
+          '<div class="ab-n">' + F.machine + '</div><div class="ab-l">memories machine-wide</div></div>' +
       '</div>' +
       '<div class="ab-doors" id="ab-doors">' +
         '<div class="ab-doors-clip"><div class="ab-door-box">' +
@@ -324,17 +415,17 @@
           '<div class="ab-door-view" id="ab-view-universe"></div>' +
         '</div></div>' +
       '</div>' +
-      '<div class="ab-flow" id="ab-flow" aria-label="' + fmt(nMem) + ' captured memories distill down to ' + fmt(nLes) + ' kept lessons">' +
+      '<div class="ab-flow" id="ab-flow" aria-label="' + F.memories + ' captured memories, of which ' + F.lessons + ' are kept lesson records">' +
         '<canvas id="ab-flowCanvas"></canvas>' +
-        '<div class="ab-flow-hit ab-left" id="ab-flowHitLeft" role="button" tabindex="0" aria-label="see the ' + fmt(nMem) + ' memories by kind" title="see the ' + fmt(nMem) + ' memories by kind"></div>' +
-        '<div class="ab-flow-hit ab-right" id="ab-flowHitRight" role="button" tabindex="0" aria-label="open the ' + fmt(nLes) + ' distilled lessons" title="open the ' + fmt(nLes) + ' distilled lessons"></div>' +
-        '<div class="ab-flow-label ab-left"><span class="mono">' + fmt(nMem) + '</span> captured</div>' +
-        '<div class="ab-flow-label ab-gate">distill</div>' +
-        '<div class="ab-flow-label ab-right"><span class="mono">' + fmt(nLes) + '</span> lessons — the keepers</div>' +
+        '<div class="ab-flow-hit ab-left" id="ab-flowHitLeft" role="button" tabindex="0" aria-label="see the ' + F.memories + ' memories by kind" title="see the ' + F.memories + ' memories by kind"></div>' +
+        '<div class="ab-flow-hit ab-right" id="ab-flowHitRight" role="button" tabindex="0" aria-label="open the ' + F.lessons + ' lesson records" title="open the ' + F.lessons + ' lesson records"></div>' +
+        '<div class="ab-flow-label ab-left"><span class="mono">' + F.memories + '</span> captured</div>' +
+        '<div class="ab-flow-label ab-gate">curated</div>' +
+        '<div class="ab-flow-label ab-right"><span class="mono">' + F.lessons + '</span> lesson records — the keepers</div>' +
         '<div class="ab-flow-narr"><span class="ab-fn-text" id="ab-fnText"></span><span class="ab-fn-steps" id="ab-fnSteps" aria-hidden="true"></span></div>' +
       '</div>' +
-      '<div class="ab-vocab"><b>memories</b> = everything your AI captures automatically&ensp;·&ensp;<b>lessons</b> = what survives distillation (task → what failed → what works)</div>' +
-      (nLes ? '' : '<div class="ab-empty-note">0 lessons recorded yet. Lessons are captured manually: run <code>record-lesson</code> in this project to keep one. There is no automatic distillation into lessons yet.</div>') +
+      '<div class="ab-vocab"><b>memories</b> = everything your AI captures automatically&ensp;·&ensp;<b>lesson records</b> = the ones kept in the AgentDB lessons namespace (task → what failed → what works)&ensp;·&ensp;<b>approved lessons</b> = the ones you ratified. Background distillation makes patterns and episodes, not lessons.</div>' +
+      ((nLes || !F.agentdbKnown) ? '' : '<div class="ab-empty-note">No lesson records in this project\'s AgentDB yet. Lessons are ratified by you; background distillation (session end or compaction, when learning is on) produces patterns and episodes, not lesson records. <code>record-lesson</code> keeps one now. Approved lessons are counted separately above.</div>') +
       '<div class="ab-roster" id="ab-roster">' +
         '<span class="ab-who">written by</span>' +
         '<span class="ab-rchip" data-tool="memory">AgentDB<span class="ab-cs">via ruflo memory</span><span class="ab-k">✦</span></span>' +
@@ -404,11 +495,13 @@
     });
 
     /* ---------------- doors ---------------- */
-    document.getElementById('ab-view-lessons').innerHTML = LESSONS.length
+    document.getElementById('ab-view-lessons').innerHTML = approvedLessonsHTML(d) + (LESSONS.length
       ? LESSONS.map(function (L) {
           return '<div class="ab-dl-title"><span class="ab-g">✦</span>' + esc(lessonTitle(L.key)) + '</div>' + lessonCardHTML(L);
         }).join('')
-      : '<p class="ab-fallback">0 lessons recorded yet. Lessons are captured manually: run <code>record-lesson</code> in this project to keep one. There is no automatic distillation into lessons yet.</p>';
+      : (F.agentdbKnown
+        ? '<p class="ab-fallback">No lesson records in this project\'s AgentDB yet. Lessons are ratified by you; background distillation produces patterns and episodes, not lesson records. <code>record-lesson</code> keeps one now.</p>'
+        : '<p class="ab-fallback">AgentDB lesson records: Unknown (the store could not be read).</p>'));
 
     (function () {
       var GLOSS = {
@@ -418,7 +511,7 @@
         'adr-patterns': 'architecture decision patterns',
         'adr-edges': 'links between decisions',
         trajectories: 'reasoning paths kept for replay',
-        lessons: 'distilled lessons — the keepers',
+        lessons: 'lesson records — the keepers',
         'metaharness-audit': 'MetaHarness audit runs',
         feedback: 'edit verifications, scored',
         pattern: 'learned edit patterns',
@@ -436,7 +529,7 @@
           '<span class="ab-kc">' + fmt(b.n) + '</span>' +
           '<span class="ab-kg">' + esc(GLOSS[b.namespace] || '') + '</span></div>';
       }).join('') +
-      '<div class="ab-door-foot">' + breakdown.length + ' namespaces · <span class="mono">' + fmt(nMem) + '</span> rows — live from <span class="mono">.swarm/memory.db</span> · bars log-scaled</div>';
+      '<div class="ab-door-foot">' + breakdown.length + ' namespaces · <span class="mono">' + F.memories + '</span> rows — live from <span class="mono">.swarm/memory.db</span> · bars log-scaled</div>';
     })();
 
     (function () {
@@ -444,9 +537,12 @@
         document.getElementById('ab-view-universe').innerHTML = '<p class="ab-fallback">no machine-wide data available</p>';
         return;
       }
-      var others = projects.filter(function (p) { return p.name !== projectName; }).slice(0, 12);
-      var meRow = projects.filter(function (p) { return p.name === projectName; })[0] || { name: projectName, memories: nMem };
-      var more = Math.max(0, projects.length - others.length - 1);
+      /* #500: "you are here" is the project whose STORE IDENTITY matches, never whose folder name does —
+         two unrelated repos can share a name. No identity (older payload) means no match, not a name guess. */
+      var U = activityUniverse(d);
+      var others = U.others;
+      var meRow = U.me || { name: projectName, memories: nMem };
+      var more = U.more;
       var top = Math.log10(Math.max(projects[0].memories || 1, 10));
       var base = Math.min(2.7, top - 0.5);
       var wU = function (n) { return Math.round(100 * Math.max(0.10, (Math.log10(Math.max(n, 1)) - base) / (top - base))); };
@@ -459,12 +555,12 @@
         others.map(function (p) { return rowHTML(p.name, p.memories, false); }).join('') +
         rowHTML(meRow.name, meRow.memories, true) +
         (more ? '<div class="ab-umore">…and ' + more + ' more projects</div>' : '') +
-        '<div class="ab-door-foot"><span class="mono">' + fmt(nMachine) + '</span> memories machine-wide — every one persists across sessions and reboots</div>';
+        '<div class="ab-door-foot"><span class="mono">' + F.machine + '</span> memories machine-wide — every one persists across sessions and reboots</div>';
     })();
 
     var DOOR_META = {
-      lessons: [fmt(nLes) + ' distilled lessons', 'what survived distillation — every card is a real memory'],
-      memories: [fmt(nMem) + ' memories in this project', 'by namespace — what your AI writes down as you work'],
+      lessons: [F.lessons + ' lesson records', 'kept in this project\'s AgentDB lessons namespace — every card is a real memory'],
+      memories: [F.memories + ' memories in this project', 'by namespace — what your AI writes down as you work'],
       universe: [fmt(nProj) + ' projects machine-wide', "everywhere this machine's AI remembers"]
     };
     var VIEW_OF = { 'ab-stat-memories': 'memories', 'ab-stat-lessons': 'lessons', 'ab-stat-projects': 'universe', 'ab-stat-machine': 'universe' };
@@ -721,19 +817,7 @@
 
     /* ---------------- rolling narration — the takeaway in plain English ---------------- */
     (function () {
-      var LINES = nLes > 0 ? [
-        'Your AI captures everything as it works — ' + fmt(nMem) + ' memories in this project so far.',
-        "Most of that stays raw. Only what's proven survives distillation.",
-        fmt(nLes) + ' lessons have earned permanence — the task, what failed, what actually works.',
-        "These survive compaction, restarts, and reboots. Your AI doesn't start over tomorrow.",
-        'Click any number above to see exactly what it knows.'
-      ] : [
-        'Your AI captures everything as it works — ' + fmt(nMem) + ' memories in this project so far.',
-        "Most of that stays raw. Only what's proven survives distillation.",
-        '0 lessons distilled yet. Distillation is manual for now; there is no auto-distill.',
-        'Capture one any time: run record-lesson in this project.',
-        'Click any number above to see exactly what it knows.'
-      ];
+      var LINES = activityNarration(d);
       var txt = document.getElementById('ab-fnText');
       var steps = document.getElementById('ab-fnSteps');
       var idx = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.7.21",
+  "version": "4.7.22",
   "description": "One-command installer for RuvNet Brain — a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships a UserPromptSubmit retrieve-and-inject grounding hook and a PreToolUse write gate that refuses ungrounded rUv-product code until search_ruvnet has been consulted (ADR-0012 / ADR-067).",
-  "version": "4.7.21",
+  "version": "4.7.22",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.7.21",
+  "version": "4.7.22",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"