total-recall-brain 3.41.2 → 3.41.3

package/src/cli/status.mjs

@@ -21,7 +21,7 @@ import fs from 'node:fs';
 import crypto from 'node:crypto';
 import { loadQueue } from '../core/research-queue.mjs';
 
-import { totalRecallToken } from '../core/config.mjs';
+import { totalRecallToken, globalBrainDir } from '../core/config.mjs';
 import { resolveBrainDir, resolveSurfaceDir } from './agent-dir.mjs';
 
 function parseArgs(args) {
@@ -82,6 +82,24 @@ function projectionsStatus(clients, instructionsMtime) {
   });
 }
 
+/**
+ * The brain id the server knows this brain by. Project brain.json files carry
+ * no layer/name, so the id comes from the global project registry. Without it
+ * every status run inside a project compared the project's INSTRUCTIONS.md with
+ * the server's GLOBAL copy and reported "In sync: no" for two healthy brains.
+ */
+export function serverBrainId(brainDir, brainConfig, registryPath = path.join(globalBrainDir, 'config', 'project-registry.json')) {
+  if (brainConfig?.layer === 'project' && brainConfig?.name) return `project:${brainConfig.name}`;
+  try {
+    const registry = JSON.parse(fs.readFileSync(registryPath, 'utf8'));
+    const own = path.resolve(brainDir);
+    const project = Array.isArray(registry) ? registry.find((p) => p?.brainDir && path.resolve(p.brainDir) === own) : null;
+    return project?.name ? `project:${project.name}` : null;
+  } catch {
+    return null;
+  }
+}
+
 function sha256(buf) {
   return crypto.createHash('sha256').update(buf).digest('hex');
 }
@@ -199,10 +217,7 @@ export default async function statusCmd(args) {
 
   let remote = null;
   if (brainUrl) {
-    const brainId = brainConfig?.layer === 'project' && brainConfig?.name
-      ? `project:${brainConfig.name}`
-      : null;
-    remote = await probeBrain(brainUrl, token, brainId);
+    remote = await probeBrain(brainUrl, token, serverBrainId(brainDir, brainConfig));
   }
 
   const inSync = !!(localInstructions && remote?.instructions_sha256 &&
@@ -250,7 +265,7 @@ export default async function statusCmd(args) {
   // Load ongoing research agenda
   let ongoingResearch = [];
   try {
-    ongoingResearch = loadQueue().filter(item => item.status === 'in_progress' || item.status === 'pending');
+    ongoingResearch = loadQueue(brainDir).filter(item => item.status === 'in_progress' || item.status === 'pending');
     report.research = ongoingResearch.map(item => ({
       id: item.id,
       topic: item.topic,
@@ -284,7 +299,10 @@ export default async function statusCmd(args) {
     console.log(`  Remote INSTR.:    ${remote.instructions_bytes} bytes, sha=${remote.instructions_sha256.slice(0, 12)}…`);
   }
   console.log(`  In sync:          ${inSync ? 'yes' : 'no'}`);
-  console.log(`  Last sync:        ${report.last_sync || 'never'}`);
+  // Push sync only exists for remote deploys; a local server serves this brain
+  // directly, so "never" there read as a fault that was not one.
+  const pushSync = deployMode !== 'local' || report.last_sync || report.targets.length;
+  console.log(`  Last sync:        ${report.last_sync || (pushSync ? 'never' : 'not used (local deploy serves this brain directly)')}`);
   console.log(`  Sync targets:     ${report.targets.length ? report.targets.join(', ') : '(none)'}`);
 
   if (clientProjections.length) {

package/src/core/automatic-brain-updates.mjs

@@ -1,3 +1,4 @@
+import { maintainPortableSkills } from './portable-skills-maintenance.mjs';
 /** The existing TR daemon maintains both published brain packages, not only TR. */
 import fs from 'node:fs';
 import path from 'node:path';
@@ -35,7 +36,7 @@ export function startAutomaticBrainUpdates({brainDir,intervalMs=60*60*1000,run=r
   return {tick,stop(){stopped=true;clearInterval(timer);}};
 }
 
-export async function runAutomaticBrainUpdates({brainDir,fleet=false,force=false,skipThrottle=false,intervalMs=60*60*1000,update=updateAllBrains,compile=maintainCliSurfaces,globalUpdate=updateGlobalBrainPackages,meshUpdate=updateMeshBrainPackages,sourceUpdate=updateSourceBrainPackages,pluginUpdate=updateInstalledPlugins,now=Date.now}={}) {
+export async function runAutomaticBrainUpdates({brainDir,fleet=false,force=false,skipThrottle=false,intervalMs=60*60*1000,update=updateAllBrains,compile=maintainCliSurfaces,globalUpdate=updateGlobalBrainPackages,meshUpdate=updateMeshBrainPackages,sourceUpdate=updateSourceBrainPackages,pluginUpdate=updateInstalledPlugins,skillMaintenance=maintainPortableSkills,now=Date.now}={}) {
   if(!force && !isPackageAutoUpdateEnabled())return {skipped:true,reason:'disabled',results:[]};
   const file=path.join(brainDir,'memory-derived/automatic-brain-updates.json');
   let saved;try{saved=JSON.parse(fs.readFileSync(file,'utf8'));}catch{}
@@ -61,8 +62,13 @@ export async function runAutomaticBrainUpdates({brainDir,fleet=false,force=false
       const plugins=await pluginUpdate({roots:[path.resolve(brainDir,'../../..')]});
       const mesh=fleet && summary.versions?await meshUpdate({versions:summary.versions,version:summary.versions['total-recall-brain']}):{failed:0,results:[],scope:'local-only'};
       const changed=summary.updated>0 || plugins.updated>0 || global.results.some(row=>row.status==='updated') || sources.results.some(row=>row.status==='updated') || JSON.stringify(saved?.versions)!==JSON.stringify(summary.versions);
-      const surfaces=await compile({brainDir,force:changed});
-      report={...summary,global,sources,plugins,mesh,surfaces,failed:(summary.failed || 0)+global.failed+sources.failed+plugins.failed+mesh.failed+(surfaces.ok?0:surfaces.results.filter(row=>row.status==='failed').length),checkedAt:now()};
+      const skills=await skillMaintenance({brainDir});
+      const surfaces=await compile({brainDir,force:changed || skills.updated > 0});
+      // local_failed is this node's own maintenance. Peers judge a node by it, not by
+      // `failed`, which also counts the node's view of its peers: judging by that made
+      // every fleet pass mark every peer failed forever, each because the others had.
+      const local_failed=(summary.failed || 0)+global.failed+sources.failed+plugins.failed+(skills.failed || 0)+(surfaces.ok?0:surfaces.results.filter(row=>row.status==='failed').length);
+      report={...summary,global,sources,plugins,mesh,skills,surfaces,local_failed,failed:local_failed+mesh.failed,checkedAt:now()};
     }catch(error){report={failed:1,error:error.message,checkedAt:now(),results:[]};}
     const temporary=`${file}.${process.pid}.tmp`;fs.writeFileSync(temporary,JSON.stringify(report,null,2));fs.renameSync(temporary,file);
     return report;

package/src/core/brain-updates.mjs

@@ -22,6 +22,47 @@ const isLink = file => { try { return fs.lstatSync(file).isSymbolicLink(); } cat
 export const brainUpdateLockPath = owner => path.join(os.tmpdir(),
   `total-recall-update-${createHash('sha256').update(owner).digest('hex')}.lock`);
 
+const pause = ms => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+const alive = pid => { try { process.kill(pid, 0); return true; } catch (error) { return error.code === 'EPERM'; } };
+
+/**
+ * Take a per-owner update lock. The daemon's hourly `update --automatic` and a
+ * manual `update --all-brains` take the same locks, and a plain exclusive create
+ * failed the manual run outright with EEXIST. A lock whose process is gone is
+ * reclaimed; a live holder is waited for, up to `waitMs`.
+ */
+export function acquireBrainUpdateLock(lock, { waitMs = 600000, pollMs = 1000, isAlive = alive, sleep = pause } = {}) {
+  const deadline = Date.now() + waitMs;
+  for (;;) {
+    try {
+      const fd = fs.openSync(lock, 'wx', 0o600);
+      fs.writeFileSync(fd, String(process.pid));
+      return fd;
+    } catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+    }
+    let holder, age;
+    try {
+      holder = Number.parseInt(fs.readFileSync(lock, 'utf8').trim(), 10);
+      age = Date.now() - fs.statSync(lock).mtimeMs;
+    } catch (error) {
+      if (error.code === 'ENOENT') continue; // released between the create and the read
+      throw error;
+    }
+    // A creator writes its pid right after the exclusive create; an empty lock
+    // younger than a few seconds is still being taken, not abandoned. Content
+    // that is not a pid names an unknown owner and is respected.
+    const content = holder ? 'pid' : fs.statSync(lock).size ? 'unknown' : 'empty';
+    const stale = content === 'pid' ? !isAlive(holder) : content === 'empty' && age > 5000;
+    if (stale) {
+      try { fs.unlinkSync(lock); } catch (error) { if (error.code !== 'ENOENT') throw error; }
+      continue;
+    }
+    if (Date.now() >= deadline) throw new Error(`Another update (${holder ? `pid ${holder}` : 'unknown owner'}) still holds ${lock}`);
+    sleep(pollMs);
+  }
+}
+
 export function installedBrainPackage(root, key) {
   try {
     const paths = createRequire(path.join(root, 'package.json')).resolve.paths(key) || [];
@@ -44,7 +85,14 @@ export function discoverBrainConsumers(roots, { onError } = {}) {
       let pkg;
       try { pkg = read(file); }
       catch (error) { if (onError) { onError(real, error); return; } throw error; }
-      const deps = sections.flatMap(section => Object.entries(pkg[section] || {})
+      // A plugin copied into a shared plugin folder is installed without its dev
+      // dependencies, on purpose: full dev trees there filled a disk. Counting its
+      // devDependencies made every such plugin a permanently failing consumer, and
+      // "fixing" it would mean installing exactly what must never be installed.
+      const sharedPluginCopy = fs.existsSync(path.join(real, 'plugin.json'))
+        && real.split(path.sep).join('/').includes('/skills/total-recall/plugins/');
+      const deps = sections.filter(section => !(sharedPluginCopy && section === 'devDependencies'))
+        .flatMap(section => Object.entries(pkg[section] || {})
         .filter(([key]) => BRAIN_PACKAGES.includes(canonical(key)) && canonical(key) !== pkg.name)
         .map(([key, declared]) => ({ section, key, package: canonical(key), declared,
           ...installedBrainPackage(real, key) })));
@@ -168,8 +216,7 @@ export async function updateAllBrains(opts = {}) {
       isLink(path.join(consumer.root, 'node_modules')) || consumer.deps.some(dep =>
         dep.version !== versions[dep.package] || !dep.file?.startsWith(path.join(group.owner, 'node_modules') + path.sep)));
     try {
-      lockFd = fs.openSync(lock, 'wx', 0o600);
-      fs.writeFileSync(lockFd, String(process.pid));
+      lockFd = acquireBrainUpdateLock(lock, opts.lockWaitMs === undefined ? {} : { waitMs: opts.lockWaitMs });
       for (const name of ['package-lock.json', 'npm-shrinkwrap.json', 'pnpm-lock.yaml']) {
         const file = path.join(group.owner, name);
         saved.set(file, fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : null);
@@ -198,11 +245,22 @@ export async function updateAllBrains(opts = {}) {
       if (install.status !== 0) throw new Error(install.error?.message || install.stderr?.trim().slice(-1500) || `Install exited ${install.status}`);
       for (const { consumer, row } of group.consumers) {
         row.packages = row.packages.map(dep => ({ ...dep, installed: installedBrainPackage(consumer.root, dep.key).version }));
+        // A consumer may legitimately resolve the package from its own node_modules — nested plugin
+        // directories do exactly that. Requiring the owner's hoisted copy reported a correct install
+        // as a failure and rolled the whole batch back, which is why 30 consumers never updated.
+        const allowedRoots = [
+          path.join(group.owner, 'node_modules') + path.sep,
+          path.join(consumer.root, 'node_modules') + path.sep,
+        ];
+        const placed = (file) => Boolean(file) && allowedRoots.some((root) => file.startsWith(root));
         const bad = consumer.deps.find(dep => {
           const actual = installedBrainPackage(consumer.root, dep.key);
-          return actual.version !== versions[dep.package] || !actual.file?.startsWith(path.join(group.owner, 'node_modules') + path.sep);
+          return actual.version !== versions[dep.package] || !placed(actual.file);
         });
-        if (bad || isLink(path.join(consumer.root, 'node_modules'))) throw new Error(`Installed release verification failed: ${consumer.root}${bad ? ` (${bad.key})` : ' (shared link)'}`);
+        // A link is only a fault when it escapes every legitimate root; a self-contained one is fine.
+        const linkPath = path.join(consumer.root, 'node_modules');
+        const linked = isLink(linkPath) && !placed(path.resolve(path.dirname(linkPath), fs.readlinkSync(linkPath)));
+        if (bad || linked) throw new Error(`Installed release verification failed: ${consumer.root}${bad ? ` (${bad.key})` : ' (shared link)'}`);
         row.status = 'updated';
       }
     } catch (error) {

package/src/core/global-brain-updates.mjs

@@ -6,6 +6,24 @@ import {BRAIN_PACKAGES} from './brain-updates.mjs';
 import {comparePackageVersions} from './package-version.mjs';
 import {updateSourceBrainPackage} from './source-brain-updates.mjs';
 
+/**
+ * A global link that points at a source checkout of `name` under another
+ * directory name (the package was once published as `total-recall`). Missing it
+ * made the update `npm install -g` over the bin and replace the operator's
+ * source checkout with a registry copy.
+ */
+export function findLinkedSourceCheckout(root,name){
+  let entries=[];try{entries=fs.readdirSync(root,{withFileTypes:true});}catch{return null;}
+  for(const entry of entries){
+    if(!entry.isSymbolicLink())continue;
+    try{
+      const dir=fs.realpathSync(path.join(root,entry.name));
+      if(JSON.parse(fs.readFileSync(path.join(dir,'package.json'),'utf8')).name===name&&fs.existsSync(path.join(dir,'.git')))return dir;
+    }catch{}
+  }
+  return null;
+}
+
 export function updateGlobalBrainPackages({versions,exec=spawnSync,sourceUpdate=updateSourceBrainPackage}={}) {
   const prefix=exec('npm',['root','--global'],{encoding:'utf8',timeout:15000});
   if(prefix.status!==0)return {failed:1,results:[{status:'failed',error:'Cannot resolve global npm root'}]};
@@ -13,7 +31,9 @@ export function updateGlobalBrainPackages({versions,exec=spawnSync,sourceUpdate=
   const results=[];
   const install=[];
   for(const name of BRAIN_PACKAGES){
-    const directory=path.join(root,name),file=path.join(directory,'package.json');
+    let directory=path.join(root,name);
+    if(!fs.existsSync(directory))directory=findLinkedSourceCheckout(root,name)||directory;
+    const file=path.join(directory,'package.json');
     let installed;try{installed=JSON.parse(fs.readFileSync(file,'utf8')).version;}catch{}
     const row={package:name,installed:installed || null,latest:versions[name],status:'up_to_date'};results.push(row);
     if(installed===versions[name])continue;

package/src/core/mesh-brain-updates.mjs

@@ -15,14 +15,17 @@ export async function updateMeshBrainPackages({version,versions,listNodes,exec,n
       // Read the durable report first, then launch only when stale or failed.
       const observed=await exec(node.ip,'cd "$HOME" && total-recall update --status --json',{timeoutMs:20000});
       let report;try{report=JSON.parse(observed.stdout).last;}catch{}
-      const current=observed.success && report && !report.failed && now()>=report.checkedAt && now()-report.checkedAt<2*60*60*1000 && report.versions?.['total-recall-brain']===version && (!versions?.['@gregiteen/ssss-cli'] || report.versions?.['@gregiteen/ssss-cli']===versions['@gregiteen/ssss-cli']);
+      const localFailed=report?(report.local_failed ?? Math.max(0,(report.failed || 0)-(report.mesh?.failed || 0))):null;
+      const current=observed.success && report && localFailed===0 && now()>=report.checkedAt && now()-report.checkedAt<2*60*60*1000 && report.versions?.['total-recall-brain']===version && (!versions?.['@gregiteen/ssss-cli'] || report.versions?.['@gregiteen/ssss-cli']===versions['@gregiteen/ssss-cli']);
       if(current){row.status='verified';row.report=report;continue;}
       // npm exec pins the verified release so an old installed CLI can bootstrap
       // this capability. The remote command owns its lock, verification and report.
       const command=`cd "$HOME" && nohup npm exec --yes --package=total-recall-brain@${version} -- total-recall update --automatic --local-only --json </dev/null >/tmp/total-recall-automatic-update.log 2>&1 &`;
       const launched=await exec(node.ip,command,{timeoutMs:20000});
       row.status=launched.success?'dispatched':'failed';
-      row.error=launched.success?'Awaiting independently verified remote report':launched.stderr || 'Mesh maintenance dispatch failed';
+      row.error=!launched.success?launched.stderr || 'Mesh maintenance dispatch failed'
+        :localFailed?`Peer reports ${localFailed} local maintenance failure(s); re-dispatched`
+        :'Awaiting independently verified remote report';
     }catch(error){row.status='failed';row.error=error.message;}
   }
   // A dispatched process is not a verified update. Keep it visible for retries.

package/src/core/meta-harness.mjs

@@ -593,9 +593,9 @@ export async function queryHarnessUsage() {
         status: 'not_installed',
         identity: '—',
         plan: '—',
-        rolling5hRemainingPct: '0%',
-        weeklyRemainingPct: '0%',
-        quotaRemaining: 'Not available'
+        rolling5hRemainingPct: '—',
+        weeklyRemainingPct: '—',
+        quotaRemaining: 'not installed'
       });
       continue;
     }
@@ -606,9 +606,13 @@ export async function queryHarnessUsage() {
 
     let identity = 'Detected local install';
     let plan = 'Standard';
-    let quotaRemaining = 'Active';
-    let rolling5hRemainingPct = '100%';
-    let weeklyRemainingPct = '100%';
+    // Never invent a quota. These fields held hardcoded literals ('100%', '98%', '85%') that read
+    // like measurements but came from no source at all — no provider usage endpoint was called, so
+    // the table reported fictional headroom for every harness. A figure appears here only when a
+    // real source produced it; otherwise the value is honestly unknown.
+    let quotaRemaining = 'unknown — no usage endpoint integrated';
+    let rolling5hRemainingPct = '—';
+    let weeklyRemainingPct = '—';
     let isAuthed = h.authed;
     let authRoute = h.authRoute;
 
@@ -620,9 +624,6 @@ export async function queryHarnessUsage() {
           if (acc.active) identity = acc.active;
         }
         plan = 'Google AI Ultra / Pro';
-        rolling5hRemainingPct = '100%';
-        weeklyRemainingPct = '98%';
-        quotaRemaining = '5h window: 100% | Weekly compute: 98%';
       } catch {}
     } else if (h.id === 'claude') {
       try {
@@ -632,9 +633,6 @@ export async function queryHarnessUsage() {
           if (cData.userID) identity = `User: ${cData.userID.slice(0, 8)}...`;
           plan = cData.opusProMigrationComplete ? 'Claude Pro / Max (Opus enabled)' : 'Claude Pro';
         }
-        rolling5hRemainingPct = '85%';
-        weeklyRemainingPct = '92%';
-        quotaRemaining = '5h window: 85% remaining | Weekly cap: 92% remaining';
       } catch {}
     } else if (h.id === 'codex') {
       try {
@@ -659,15 +657,7 @@ export async function queryHarnessUsage() {
           }
           plan = 'ChatGPT Subscription (GPT-4o/Codex)';
         }
-        if (isAuthed) {
-          rolling5hRemainingPct = '94%';
-          weeklyRemainingPct = '96%';
-          quotaRemaining = '5h reasoning: 94% remaining | Weekly quota: 96% remaining';
-        } else {
-          rolling5hRemainingPct = '0% (expired)';
-          weeklyRemainingPct = '0% (expired)';
-          quotaRemaining = 'Authentication expired';
-        }
+        if (!isAuthed) quotaRemaining = 'unavailable — authentication expired';
       } catch {}
     } else if (h.id === 'grok') {
       try {
@@ -685,15 +675,7 @@ export async function queryHarnessUsage() {
           }
           plan = 'Grok Build Tier';
         }
-        if (isAuthed) {
-          rolling5hRemainingPct = '100%';
-          weeklyRemainingPct = '100%';
-          quotaRemaining = '5h rate window: 100% | Weekly allowance: 100%';
-        } else {
-          rolling5hRemainingPct = '0% (expired)';
-          weeklyRemainingPct = '0% (expired)';
-          quotaRemaining = 'Token expired (refresh needed)';
-        }
+        if (!isAuthed) quotaRemaining = 'unavailable — token expired (refresh needed)';
       } catch {}
     } else if (h.id === 'gemini') {
       try {
@@ -703,9 +685,6 @@ export async function queryHarnessUsage() {
           if (acc.active) identity = acc.active;
         }
         plan = 'Google AI API / Subscription';
-        rolling5hRemainingPct = '100%';
-        weeklyRemainingPct = '100%';
-        quotaRemaining = 'Standard rate limits active';
       } catch {}
     } else if (h.id === 'ollama') {
       identity = 'Local Machine';
@@ -716,9 +695,7 @@ export async function queryHarnessUsage() {
     } else if (h.id === 'hermes') {
       identity = 'Hermes Supervisor';
       plan = 'Autonomous Agent Runtime';
-      rolling5hRemainingPct = '100%';
-      weeklyRemainingPct = '100%';
-      quotaRemaining = 'Active broker & gateway';
+      quotaRemaining = 'local runtime — no metered quota';
     } else if (h.id === 'dsh') {
       let model = 'deepseek/deepseek-v4.1-flash';
       try {
@@ -729,9 +706,9 @@ export async function queryHarnessUsage() {
       } catch {}
       identity = model;
       plan = 'DeepSeek Dedicated Harness';
-      rolling5hRemainingPct = '95%';
-      weeklyRemainingPct = '98%';
-      quotaRemaining = 'DeepSeek reasoning pool active';
+      // dsh bills through OpenRouter metered credit and publishes no quota figures of its own, so
+      // none are shown. Point the reader at the one place the real number exists.
+      quotaRemaining = 'metered — see OpenRouter credits';
     } else if (h.id === 'openclaw') {
       let channelsStr = 'telegram, qqbot';
       try {
@@ -745,8 +722,6 @@ export async function queryHarnessUsage() {
         }
       } catch {}
       plan = 'Multi-Channel Gateway';
-      rolling5hRemainingPct = '100%';
-      weeklyRemainingPct = '100%';
       quotaRemaining = `Channels: ${channelsStr}`;
     }
 

package/src/core/plugin-runner.mjs

@@ -56,7 +56,12 @@ export function runPluginCommand(plugin, options = {}) {
   if (!pluginExecutionEnabled(plugin, { projectRoot: cwd }) && !['status', 'health', 'jobs', '--help', '-h', 'help'].includes(operation)) {
     return Promise.reject(new Error(`Plugin ${plugin.id} is inactive; run total-recall plugin on ${plugin.id}`));
   }
-  const declaredTimeout = plugin?.manifest?.cli?.subcommands?.find(item => item.name === operation)?.timeout_ms;
+  // Manifests declare this as `timeoutMs`; the runner only read `timeout_ms`, so every declared
+  // timeout was ignored and each command fell back to DEFAULT_TIMEOUT_MS (30s). That killed work
+  // that legitimately takes longer — `mesh nodes` and `tr-transcribe transcribe` (model load) both
+  // died at 30s while their manifests asked for far more. Accept both spellings.
+  const declaration = plugin?.manifest?.cli?.subcommands?.find(item => item.name === operation);
+  const declaredTimeout = declaration?.timeout_ms ?? declaration?.timeoutMs;
   const timeoutMs = requestedTimeoutMs ?? declaredTimeout ?? DEFAULT_TIMEOUT_MS;
   if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 600000) return Promise.reject(new Error('Plugin timeout must be 1..600000 ms'));
   const handlerRel = plugin?.manifest?.cli?.handler;

package/src/core/plugin-store.mjs

@@ -417,6 +417,67 @@ export async function installPluginDependencies(dest, id) {
   return { installed: true, packages };
 }
 
+const REPLACEMENT_NAME = /^(.+)-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/;
+
+/** Where `install --replace` keeps the copy it replaced, beside a plugins directory. */
+export function replacementArchiveDir(pluginsDir) {
+  return path.join(path.dirname(pluginsDir), 'memory-derived', 'plugin-replacements');
+}
+
+function directoryBytes(dir) {
+  let total = 0;
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) total += directoryBytes(full);
+    else if (entry.isFile()) total += fs.statSync(full).size;
+  }
+  return total;
+}
+
+/**
+ * Bound the copies `install --replace` keeps. Every replacement archives the
+ * previous install, dependencies included, and nothing removed them, so the
+ * hourly automatic plugin update grew the archive without limit: 73 copies
+ * filled a laptop disk. Keep the newest `keep` copies of each plugin (or of
+ * `id` only), without node_modules, which a rollback reinstalls. A rename
+ * keeps a directory's old mtime, so the copy just archived is named in
+ * `prefer` and always counts as the newest.
+ *
+ * @param {string} archiveDir
+ * @param {{ id?: string, keep?: number, apply?: boolean, prefer?: string }} [opts]
+ */
+export function pruneReplacementArchives(archiveDir, { id, keep = 1, apply = true, prefer } = {}) {
+  if (!fs.existsSync(archiveDir)) return { archiveDir, kept: [], removed: [], stripped: [], bytesFreed: 0 };
+  const byId = new Map();
+  for (const name of fs.readdirSync(archiveDir)) {
+    const m = REPLACEMENT_NAME.exec(name);
+    const full = path.join(archiveDir, name);
+    if (!m || (id && m[1] !== id) || !fs.statSync(full).isDirectory()) continue;
+    (byId.get(m[1]) || byId.set(m[1], []).get(m[1])).push({ name, full, mtime: fs.statSync(full).mtimeMs });
+  }
+  const kept = [], removed = [], stripped = [];
+  let bytesFreed = 0;
+  for (const copies of byId.values()) {
+    copies.sort((a, b) => (b.name === prefer) - (a.name === prefer) || b.mtime - a.mtime);
+    copies.forEach((copy, index) => {
+      if (index >= keep) {
+        bytesFreed += directoryBytes(copy.full);
+        if (apply) fs.rmSync(copy.full, { recursive: true, force: true });
+        removed.push(copy.name);
+        return;
+      }
+      kept.push(copy.name);
+      const modules = path.join(copy.full, 'node_modules');
+      if (fs.existsSync(modules)) {
+        bytesFreed += directoryBytes(modules);
+        if (apply) fs.rmSync(modules, { recursive: true, force: true });
+        stripped.push(copy.name);
+      }
+    });
+  }
+  return { archiveDir, kept, removed, stripped, bytesFreed };
+}
+
 /**
  * Install a plugin.
  * @param {string} source  bundled id | public share URL | `peer:<host>/<id>` | git URL | local path
@@ -439,7 +500,7 @@ export async function installPlugin(source, options = {}) {
   const prepareDestination=id=>{
     const target=path.join(pluginsDir,id);
     if(!options.replace || !fs.existsSync(target))return assertNotInstalled(id,pluginsDir);
-    const archive=path.join(path.dirname(pluginsDir),'memory-derived/plugin-replacements',`${id}-${crypto.randomUUID()}`);
+    const archive=path.join(replacementArchiveDir(pluginsDir),`${id}-${crypto.randomUUID()}`);
     fs.mkdirSync(path.dirname(archive),{recursive:true});
     fs.renameSync(target,archive);previousDirectory={target,archive};
   };
@@ -524,6 +585,11 @@ export async function installPlugin(source, options = {}) {
     throw new Error(`Plugin files were written but its record could not be: ${err.message}`);
   }
 
+  // The install succeeded: keep only this replacement's copy of the plugin, without dependencies.
+  if (previousDirectory) {
+    pruneReplacementArchives(replacementArchiveDir(pluginsDir), { id: manifest.id, keep: 1, prefer: path.basename(previousDirectory.archive) });
+  }
+
   // A batch of installs (automatic updates) compiles once after the batch instead.
   const compilation = options.recompile === false ? { skipped: true } : await recompileAfterPluginMutation(projectRoot, isGlobal);
   return {

package/src/core/plugin-updates.mjs

@@ -50,7 +50,7 @@ export async function checkPlugin(plugin, { gitHead = remoteGitHead, peerHash =
       return { status: 'pinned', ref: source.ref };
     case 'bundled': {
       const shipped = bundled().find(p => p.id === id);
-      if (!shipped) return { status: 'failed', error: `Bundled plugin '${id}' is no longer shipped in this package` };
+      if (!shipped) return { status: 'failed', error: `Bundled plugin '${id}' is no longer shipped in this package; reinstall it from its git repository with: total-recall plugin install <git-url> --global --replace` };
       return hashPluginDir(shipped.dir).sha256 === plugin.installed_sha256 ? { status: 'current' } : { status: 'behind', install: id };
     }
     case 'git': {

package/src/core/portable-skills-maintenance.mjs

@@ -0,0 +1,19 @@
+/** Existing daemon maintenance verifies explicitly enrolled owner skill packages. */
+import fs from 'node:fs';
+import path from 'node:path';
+import { loadRegistry } from './skills-registry.mjs';
+import { runBounded } from './startup-health.mjs';
+
+export async function maintainPortableSkills({ brainDir, apply = true, run = runBounded } = {}) {
+  const entry = loadRegistry(brainDir).skills.ssss;
+  if (!entry || !entry.layered || entry.source_type !== 'portable-owner-package') return { skipped: true, reason: 'no-enrolled-portable-source', failed: 0, results: [] };
+  const script = path.join(entry.source_path, 'core/scripts/maintain.mjs');
+  if (!fs.existsSync(script)) return { failed: 1, results: [], error: 'Registered portable source maintenance helper is missing' };
+  const result = await run(process.execPath, [script, '--source', entry.source_path, ...(apply ? ['--apply'] : [])], { timeoutMs: 5 * 60 * 1000, maxBytes: 8 * 1024 * 1024 });
+  try {
+    const report = JSON.parse(result.output);
+    return { ...report, failed: Math.max(report.failed || 0, result.code === 0 ? 0 : 1) };
+  } catch {
+    return { failed: 1, results: [], error: result.reason || result.output || 'Portable skill verification returned no report' };
+  }
+}

package/src/core/required-plugins.mjs

@@ -152,6 +152,13 @@ export function auditProjectPluginCopies(projectRoot, { sharedDir = globalPlugin
     row.sourceVersion = row.sourceDir ? version(row.sourceDir) : null;
     row.sharedVersion = row.sharedDir ? version(row.sharedDir) : null;
     row.edited = row.sourceDir ? !sameTree(copyDir, row.sourceDir) : null;
+    // A copy declaring an older release than the shared install cannot be a deliberate local edit —
+    // it predates the shared plugin. It is a leftover from the release that vendored the defaults into
+    // every brain, and because discovery prefers a brain's own copy it SHADOWS the shared install and
+    // breaks the repository: a stale auth manifest fails validation, so every total-recall command in
+    // that repo dies with "Required plugin auth is missing or invalid". Same staleness rule the updater
+    // already applies when it refreshes a vendored copy.
+    row.stale = Boolean(row.version && row.sharedVersion && comparePackageVersions(row.version, row.sharedVersion) < 0);
     copies.push(row);
   }
   return { copies, count: copies.length, sourceDir };

package/src/core/skills-registry.mjs

@@ -456,6 +456,11 @@ export function deploySkill(brainDir, skillIdOrPath, opts = {}) {
   if (layered && fs.existsSync(destDir) && fs.lstatSync(destDir).isSymbolicLink()) {
     throw new Error(`Refusing layered deploy into symlink: ${destDir}`);
   }
+  if (opts.dryRun) return { success: true, dryRun: true, skillId: resolved.id, destDir,
+    sourcePath: resolved.sourcePath, layered, existed, routeCore: Boolean(opts.routeCore), actions: [
+      { op: 'replace-managed', from: layered && existed ? path.join(resolved.sourcePath, 'core') : resolved.sourcePath, to: layered && existed ? path.join(destDir, 'core') : destDir },
+      ...(opts.routeCore && layered ? [{ op: 'route-core', path: path.join(destDir, 'SKILL.md') }] : []),
+    ] };
   const replacement = layered && existed
     ? replaceSkillDir(path.join(resolved.sourcePath, 'core'), path.join(destDir, 'core'), {
         requiredFile: null,
@@ -463,6 +468,14 @@ export function deploySkill(brainDir, skillIdOrPath, opts = {}) {
       })
     : replaceSkillDir(resolved.sourcePath, destDir, { managedFiles: priorInstall?.managed_files || [] });
 
+  if (opts.routeCore && layered) {
+    const wrapper = path.join(destDir, 'SKILL.md');
+    const current = fs.readFileSync(wrapper, 'utf8');
+    const marker = '<!-- total-recall:managed-core-route:v1 -->';
+    if (!current.includes(marker)) fs.writeFileSync(wrapper, current.replace(/\s*$/, '') +
+      `\n\n${marker}\nRead the [maintained portable core](core/SKILL.md) for current protocol contracts; preserve repository-specific instructions above.\n`);
+  }
+
   let adaptResult = { adapted: false };
   if (opts.adapt && (!layered || !existed)) {
     const openwikiDir =
@@ -536,7 +549,7 @@ function installDetail(entry, inst) {
   const liveHash = exists ? hashSkillContent(inst.path) : null;
   const liveCoreHash = layered && exists ? hashSkillLayer(inst.path, 'core') : null;
   const liveRepoHash = layered && exists ? hashSkillLayer(inst.path, 'repo') : null;
-  const drift = layered
+  const drift = !exists ? true : layered
     ? liveCoreHash !== (entry?.core_hash || inst.core_hash)
     : legacyUnderLayered
       ? false
@@ -548,7 +561,9 @@ function installDetail(entry, inst) {
   return {
     ...inst,
     exists,
+    required: !inst.obsolete,
     live_hash: liveHash,
+    verification: !exists ? 'missing' : legacyUnderLayered ? 'not_adopted' : drift ? 'drifted' : 'verified',
     ...(layered ? {
       core_hash: liveCoreHash,
       repo_hash: liveRepoHash,
@@ -576,7 +591,7 @@ export function skillStatus(brainDir, skillId) {
     } catch (err) {
       // One unreadable install (a symlinked layer, a moved repo) must not hide
       // the status of every other install.
-      return { ...inst, exists: fs.existsSync(inst.path), error: err.message, drift: false };
+      return { ...inst, exists: fs.existsSync(inst.path), error: err.message, drift: true, verification: 'error' };
     }
   });
 
@@ -593,7 +608,11 @@ export function skillStatus(brainDir, skillId) {
     localPath,
     installs: installDetails,
     install_count: installDetails.length,
-    any_drift: installDetails.some((i) => i.drift),
+    any_drift: installDetails.some((i) => !i.obsolete && i.drift),
+    verified: Boolean(entry && localPath) && installDetails.every((i) => i.obsolete || (i.verification === 'verified' && (!i.contract || i.contract.ok))),
+    missing_count: installDetails.filter((i) => !i.obsolete && !i.exists).length,
+    obsolete_count: installDetails.filter((i) => i.obsolete).length,
+    error_count: installDetails.filter((i) => i.error).length,
     any_contract_failure: installDetails.some((i) => i.contract && !i.contract.ok),
   };
 }
@@ -1269,6 +1288,17 @@ export function syncSkillTwoWay(brainDir, skillId, opts = {}) {
   }
 
   const { entry, locations } = collectSkillLocations(brainDir, skillId);
+  const missingInstalls = loadRegistry(brainDir).installs.filter((inst) =>
+    inst.skill_id === skillId && !inst.obsolete && !fs.existsSync(path.join(inst.path, 'SKILL.md')),
+  );
+  if (missingInstalls.length) {
+    return {
+      skillId, in_sync: false, dryRun,
+      error: 'Recorded skill destinations are missing; reconcile existing repositories and deploy explicitly before synchronization',
+      missing: missingInstalls.map((inst) => ({ path: inst.path, repo: inst.repo, repository_exists: Boolean(inst.repo && fs.existsSync(inst.repo)) })),
+      locations: locations.length, actions: [],
+    };
+  }
   if (!locations.length) {
     return { skillId, skipped: true, reason: 'no live copies found' };
   }