total-recall-brain 3.43.2 → 3.44.0

package/scaffold/.agent/skills/total-recall/plugins/openwiki/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "openwiki",
   "name": "OpenWiki",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Multi-repo knowledge graph and documentation wiki engine for Total Recall.",
   "license": "MIT",
   "runtime": {

package/scaffold/.agent/skills/total-recall/plugins/security/package-lock.json

@@ -1,19 +1,19 @@
 {
   "name": "tr-plugin-security",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-security",
-      "version": "0.3.5",
+      "version": "0.3.6",
       "license": "MIT",
       "dependencies": {
-        "@gregiteen/ssss-cli": "0.14.4"
+        "@gregiteen/ssss-cli": "0.14.5"
       },
       "devDependencies": {
         "jsdom": "^26.1.0",
-        "total-recall-brain": "3.42.1"
+        "total-recall-brain": "3.43.3"
       }
     },
     "node_modules/@alcalzone/ansi-tokenize": {
@@ -845,9 +845,9 @@
       }
     },
     "node_modules/@gregiteen/ssss-cli": {
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.4.tgz",
-      "integrity": "sha512-R6JIgPRvS9xXp0xb6BYO3rauv+72r35GIiDrJcvbjPdTSHFZXr8/jRxFOgoF8yTed/5xyGFF3ey3DI9bOjmHVA==",
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.5.tgz",
+      "integrity": "sha512-qVEYOocnwn97uJ0eDzmuwN06CYsYWr2t3+iKylpisBHX4wlLWk7P8EmFFdBlx7NyKVIZDDeYT164Gd7/T8UGgw==",
       "license": "ISC",
       "bin": {
         "ssss": "scripts/ssss.mjs"
@@ -1686,9 +1686,9 @@
     },
     "node_modules/@ssss/cli": {
       "name": "@gregiteen/ssss-cli",
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.4.tgz",
-      "integrity": "sha512-R6JIgPRvS9xXp0xb6BYO3rauv+72r35GIiDrJcvbjPdTSHFZXr8/jRxFOgoF8yTed/5xyGFF3ey3DI9bOjmHVA==",
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.5.tgz",
+      "integrity": "sha512-qVEYOocnwn97uJ0eDzmuwN06CYsYWr2t3+iKylpisBHX4wlLWk7P8EmFFdBlx7NyKVIZDDeYT164Gd7/T8UGgw==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -5698,9 +5698,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.42.1",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.42.1.tgz",
-      "integrity": "sha512-woH7mdkGwPFYlKPZurhE8L3BPe+cSeIruNGaPOjGZJm/O8C92Bbr1gsdOY0tTLg5QHlgPHcXG1GMtsm9lPDz8w==",
+      "version": "3.43.3",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.43.3.tgz",
+      "integrity": "sha512-yjfPN/BQxEEa+iodyFXQov/6fRt1pZg/7RcmgsbpALwBt6Ki3JJjT3tzArBC7NxHQmXgGYyKnCYId6xe/W2rPg==",
       "dev": true,
       "license": "MIT",
       "workspaces": [
@@ -5731,6 +5731,7 @@
         "antigravity": "bin/antigravity.mjs",
         "total-recall": "bin/total-recall.mjs",
         "total-recall-memory": "bin/total-recall-memory.mjs",
+        "total-recall-server-release": "bin/total-recall-server-release.mjs",
         "vibebrain": "bin/total-recall.mjs"
       },
       "optionalDependencies": {

package/scaffold/.agent/skills/total-recall/plugins/security/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-security",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "type": "module",
   "description": "Standalone security suite for Total Recall: static analysis, file and permission hardening schemes, AES-256-GCM encryption tools, and egress audit controls",
   "scripts": {
@@ -24,9 +24,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@gregiteen/ssss-cli": "0.14.4"
+    "@gregiteen/ssss-cli": "0.14.5"
   },
   "overrides": {
-    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.4"
+    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.5"
   }
 }

package/scaffold/.agent/skills/total-recall/plugins/security/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "security",
   "name": "Security Assessments",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "Machine and device security assessments for macOS, Linux, Windows, Android, Chromebook, iPhone and iPad, with explicit measured and manual coverage.",
   "license": "MIT",
   "requires": [{ "id": "auth", "range": ">=1.2.1" }],

package/scaffold/.agent/skills/total-recall/plugins/ssss/assets/scaffold.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.14.4",
+  "version": "0.14.5",
   "files": {
     ".gitignore": {
       "sha256": "0d6c69a5cbd2270c9163d8e1563976b6d15131d0ef599e6fbc413ee287a86da0",
@@ -18,8 +18,8 @@
       "content": "# ssss-project — System Architecture & Design\n\n> Technical design and architecture specification for ssss-project.\n\n## Overview\n\n<High-level summary of the system and its primary goals.>\n\n## Component Architecture\n\n- **Vault Structure**: Typed Markdown documents under `vault/` serving as the source of truth.\n- **Workflows & Execution**: Automated procedures defined in `vault/workflows/` triggered by operational events.\n- **Capabilities & Resources**: Tools and external service integrations required for execution.\n\n## Data & Schema Contracts\n\n<Core entities, external dependencies, and integration interfaces.>\n\n## Open Decisions & Invariants\n\n- SSSS VFS is the single source of truth for application state.\n- Structural business logic is strictly decoupled from private tenant operational data.\n- App-specific primitives reside in `registry/extensions/` within this repository and extend `core`.\n- Core SSSS library (`@gregiteen/ssss-cli`) remains vendor-neutral and dependency-free.\n"
     },
     "package.json": {
-      "sha256": "18389bfc91857c6d5917a3ac1af9da8a992c99b013f42f2843921cdc7b41bdfe",
-      "content": "{\n  \"name\": \"ssss-project\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"description\": \"An SSSS-native project — Markdown vault as source of truth.\",\n  \"scripts\": {\n    \"ssss\": \"ssss\",\n    \"test\": \"node --test\",\n    \"export\": \"ssss export vault --profile sale --out dist/bundle.ucw.json\",\n    \"validate\": \"ssss conformance --engine\"\n  },\n  \"dependencies\": {\n    \"@gregiteen/ssss-cli\": \"github:gregiteen/ssss#v0.14.4\"\n  }\n}\n"
+      "sha256": "ea77c2944b853999741a8e603de257604048c63b5db8754a0e8b92f383ff973b",
+      "content": "{\n  \"name\": \"ssss-project\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"description\": \"An SSSS-native project — Markdown vault as source of truth.\",\n  \"scripts\": {\n    \"ssss\": \"ssss\",\n    \"test\": \"node --test\",\n    \"export\": \"ssss export vault --profile sale --out dist/bundle.ucw.json\",\n    \"validate\": \"ssss conformance --engine\"\n  },\n  \"dependencies\": {\n    \"@gregiteen/ssss-cli\": \"github:gregiteen/ssss#v0.14.5\"\n  }\n}\n"
     },
     "test/ssss-conformance.test.mjs": {
       "sha256": "f626d2f56799fcfda74375d3ddf546cc181a10caf2df08b72b7f2e36782c9bc1",
@@ -43,8 +43,8 @@
     }
   },
   "skill": {
-    "SKILL.md": "4976c9615482f257fd023761dd3ef36b5aa278305ff22ae110295fe4945f5d4c",
-    "core/SKILL.md": "96c6479ad06b84c5f7ffd8bb05bff414dbb8c22a040ec1f1c05d8fa4fdbd976e",
+    "SKILL.md": "e5c2c0aa2c0fb5480c1f7bdb37928f935e1160bff18fd6b63366a04f3e281938",
+    "core/SKILL.md": "12543720135f13650efcd7afd751e3253996692c6ab805fd7da99788b6fc4af9",
     "core/references/core-registry.json": "16831aa3b6be3f561a9ca7abdc36065a4843ff595aa3acf5c3fb8af2d733b7e3",
     "core/references/ssss-spec.md": "cc319e78b1b568651d5717695348363349d502c0e20663da9858369022ddfc3b",
     "core/scripts/maintain.mjs": "eebcae898f2ce0cf3f0059c6f6737bee8877409de2d370d54a4015a9a82414e9",

package/scaffold/.agent/skills/total-recall/plugins/ssss/package-lock.json

@@ -1,21 +1,21 @@
 {
   "name": "tr-plugin-ssss",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-ssss",
-      "version": "0.1.2",
+      "version": "0.1.3",
       "license": "MIT",
       "dependencies": {
-        "@gregiteen/ssss-cli": "0.14.4"
+        "@gregiteen/ssss-cli": "0.14.5"
       }
     },
     "node_modules/@gregiteen/ssss-cli": {
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.4.tgz",
-      "integrity": "sha512-R6JIgPRvS9xXp0xb6BYO3rauv+72r35GIiDrJcvbjPdTSHFZXr8/jRxFOgoF8yTed/5xyGFF3ey3DI9bOjmHVA==",
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.5.tgz",
+      "integrity": "sha512-qVEYOocnwn97uJ0eDzmuwN06CYsYWr2t3+iKylpisBHX4wlLWk7P8EmFFdBlx7NyKVIZDDeYT164Gd7/T8UGgw==",
       "license": "ISC",
       "bin": {
         "ssss": "scripts/ssss.mjs"

package/scaffold/.agent/skills/total-recall/plugins/ssss/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-ssss",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "private": true,
   "type": "module",
   "description": "Canonical SSSS distribution, scaffolding and validation for Total Recall installations.",
@@ -19,7 +19,7 @@
     "check:ssss-conformance": "node cli.mjs conformance"
   },
   "dependencies": {
-    "@gregiteen/ssss-cli": "0.14.4"
+    "@gregiteen/ssss-cli": "0.14.5"
   },
   "license": "MIT"
 }

package/scaffold/.agent/skills/total-recall/plugins/ssss/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "ssss",
   "name": "SSSS",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Canonical SSSS distribution, scaffolding and validation for Total Recall installations.",
   "license": "MIT",
   "use_cases": ["software-development", "state-conformance"],

package/src/cli/connect.mjs

@@ -80,11 +80,10 @@ export const CLIENTS = {
   },
   openclaw: {
     label: 'OpenClaw',
-    mode: 'openclaw',
+    mode: 'symlink',
     enforcement: 'enforced',
     enforcementReason: 'before_tool_call hook denies unreceipted tool calls with exit 2',
-    memoryTarget: 'MEMORY.md',
-    agentsTarget: 'AGENTS.md',
+    target: 'AGENTS.md',
   },
   cursor: {
     label: 'Cursor',
@@ -880,32 +879,6 @@ export default async function connect(args) {
       result.notes.push(`  DeepSeek Harness MEMORY.md → ${globalMemPath}`);
     }
     result.notes.push(`  DeepSeek Harness AGENTS.md → INSTRUCTIONS.md`);
-  } else if (preset.mode === 'openclaw') {
-    // OpenClaw: write MEMORY.md + symlink AGENTS.md in cwd
-    const instructions = readInstructions(cwd, agentDir);
-    if (!instructions) throw new Error('No INSTRUCTIONS.md found. Run npx total-recall init or compile first.');
-    // MEMORY.md — curated facts extracted from instructions
-    const memPath = path.join(cwd, preset.memoryTarget);
-    if (!fs.existsSync(memPath) || opts.force) {
-      fs.writeFileSync(memPath, instructions, 'utf8');
-    }
-    // AGENTS.md — symlink to INSTRUCTIONS.md
-    const agentsPath = path.join(cwd, preset.agentsTarget);
-    if (pathExists(agentsPath)) {
-      if (opts.force) {
-        try {
-          fs.unlinkSync(agentsPath);
-        } catch {
-          fs.rmSync(agentsPath, { force: true, recursive: true });
-        }
-        fs.symlinkSync('INSTRUCTIONS.md', agentsPath);
-      }
-    } else {
-      fs.symlinkSync('INSTRUCTIONS.md', agentsPath);
-    }
-    result.projection = { targetPath: memPath, action: 'written' };
-    result.notes.push(`  OpenClaw MEMORY.md written to ${memPath}`);
-    result.notes.push(`  OpenClaw AGENTS.md → INSTRUCTIONS.md`);
   } else if (preset.mode === 'vault') {
     result.projection = writeVaultProjection(agentDir, preset, opts);
     const folderName = result.projection.folderName || preset.folderName;

package/src/cli/context.mjs

@@ -61,6 +61,7 @@ async function printCompacted({ query, actions, budget, format, version, rulesHa
     if (format !== 'json') return result.context;
     const payload = { ready: true, compacted: true, ranking: result.ranking, context: result.context, counts: result.counts,
       stats: { version, rules_hash: rulesHash, budget, retrieval: summarizeRetrieval(knowledge?.summary), token_measurement: 'estimated_chars_divided_by_four' } };
+    if (result.evidenceStart !== undefined) payload.evidence_start = result.evidenceStart;
     for (let index = 0; index < 10; index++) {
       const tokens = estimateTokens(`${JSON.stringify(payload)}\n`);
       if (tokens === payload.stats.total_tokens) break;

package/src/cli/ingest-okf.mjs

@@ -11,7 +11,7 @@ export async function runOkfIngest(args) {
     dryRun: false,
     category: null,
     importance: null,
-    onConflict: 'warn',
+    onConflict: 'skip',
     typeMap: null,
     help: false
   };
@@ -118,10 +118,10 @@ function printIngestOkfHelp() {
 
   Options:
     --dry-run                 Validate concepts and preview import without writing
-    --category <name>         Override and force category for all imported concepts
+    --category <name>         Choose a descriptive category for imported concepts
     --importance <1-5>        Override default importance (default: 3)
-    --on-conflict <strategy>  Strategy for duplicate slugs: 'skip' | 'warn' | 'overwrite' (default: warn)
-    --type-map <mapping>      Custom type mappings. Format: "Type A=facts,Type B=concepts"
+    --on-conflict <strategy>  'skip' (default), 'warn' (report and skip), or 'overwrite' (same imported concept)
+    --type-map <mapping>      Map types to descriptive categories, e.g. "Type A=facts,Type B=concepts"
     --global                  Target the global brain
     --project                 Target the project brain (default)
     --help, -h                Show this help

package/src/cli/release.mjs

@@ -73,7 +73,8 @@ function printHelp() {
     plan        Resolve the release version and report gate/consumer readiness. No writes.
     publish     Run the package's prepublish gate, then npm publish. Requires --apply.
     propagate   Pin the published version across every registered consumer (update --all-brains).
-    verify      Independently confirm the registry artifact and each consumer's resolved install.
+    verify      Independently confirm the registry artifact, each consumer's resolved install,
+                and that the server on this host runs the release.
     all         plan → publish → propagate → verify, stopping at the first failure.
 
   Rules enforced here:
@@ -140,7 +141,10 @@ export async function tarballServed(pkg, version, { exec = spawnSync, fetchImpl
  * Wait until a just-published version can be installed: listed as latest, and its tarball served.
  * 3.42.0 took about six minutes and 3.42.1 about eight, its listing four minutes ahead of its tarball.
  */
-export async function awaitPublished(pkg, version, { attempts = 45, delayMs = 20000, exec = spawnSync, sleep, tarball = tarballServed } = {}) {
+/** npm has taken 8 and then 23 minutes to serve an accepted publish, so a shorter wait reports failure on a good release. */
+export const REGISTRY_WAIT = Object.freeze({ attempts: 120, delayMs: 20000 });
+
+export async function awaitPublished(pkg, version, { attempts = REGISTRY_WAIT.attempts, delayMs = REGISTRY_WAIT.delayMs, exec = spawnSync, sleep, tarball = tarballServed } = {}) {
   const pause = sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
   let last = null;
   for (let i = 0; i < attempts; i++) {
@@ -295,6 +299,20 @@ export function verifyConsumers(pkg, version, opts = {}) {
   };
 }
 
+/**
+ * What the server on this host runs. Files moving does not replace a running process, so a
+ * release is not verified here until the process is on it. Packages other than the brain and
+ * explicit --root runs have no server to ask about.
+ */
+export async function verifyRunningServer(pkg, version, { check, explicitRoot = false } = {}) {
+  if (pkg !== 'total-recall-brain' || explicitRoot) return { checked: false, ok: true };
+  const server = await (check || (async (args) => {
+    const [{ runningServerStatus }, { brainDir }] = await Promise.all([import('../core/running-server.mjs'), import('../core/config.mjs')]);
+    return runningServerStatus({ brainDir, ...args });
+  }))({ latest: version });
+  return { checked: true, ok: !['stale', 'down'].includes(server.status), server };
+}
+
 function runPrepublish(dir, pkgJson, { exec = spawnSync, timeoutMs } = {}) {
   if (!pkgJson?.scripts?.prepublishOnly) return { ok: true, skipped: true };
   const manager = fs.existsSync(path.join(dir, 'pnpm-lock.yaml')) ? 'pnpm' : 'npm';
@@ -374,6 +392,13 @@ export async function run(argv = process.argv, deps = {}) {
       if (consumers.failing > 0) {
         return fail(`${pkg}@${version}: ${consumers.failing}/${consumers.consumers} consumers not satisfied. First: ${consumers.failures[0].root} (${consumers.failures[0].installed ?? 'not installed'}).`);
       }
+      const running = await verifyRunningServer(pkg, version, { check: deps.runningServerStatus, explicitRoot: Boolean(opts.root) });
+      entry.running_server = running.server || null;
+      if (!running.ok) {
+        return fail(`${pkg}@${version}: ${running.server.reason} Replace it with: total-recall deploy release ${version} --adapter-secret <DEPLOY_MESH_REFERENCE>, or restart it on a host that is not production.`);
+      }
+      if (running.server?.status === 'current') log(`  ✓ the server on this host runs ${version}`);
+      else if (running.server?.status === 'unknown') log(`    The server on this host could not be read: ${running.server.reason}`);
       log(`  ✓ ${pkg}@${version} verified: registry + ${consumers.consumers}/${consumers.consumers} consumers`);
       if (consumers.pin_behind.length) log(`    ${consumers.pin_behind.length} run it with an older pin in package.json, such as ${consumers.pin_behind[0].root}`);
       if (consumers.dev_not_installed.length) log(`    ${consumers.dev_not_installed.length} keep no dev copy of it and run under the shared install`);

package/src/cli/startup.mjs

@@ -36,6 +36,7 @@ export default async function startup(args = []) {
   if (args.includes('--json')) console.log(JSON.stringify(report, null, 2));
   else {
     console.log(`Startup: required plugins ${report.required_plugins?.status || 'unknown'}; server ${report.server?.status || 'unknown'}; brain ${report.brain?.status || 'unknown'}; daemon ${report.daemon?.status || 'unknown'}; SSSS tooling ${report.ssss?.status || 'unknown'}; app ${report.app?.status || 'unknown'}`);
+    if (report.server?.stale) console.log(`Server: running ${report.server.stale.running} with ${report.server.stale.on_disk} on disk; it has not been replaced.`);
     for (const error of report.required_plugins?.errors || []) console.log(`Required plugin: ${error}`);
     const harnesses = await queryHarnessUsage().catch(() => []);
     const availH = harnesses.filter(h => h.available);

package/src/cli/update.mjs

@@ -20,6 +20,7 @@ import { installAutoPull } from '../core/autopull-install.mjs';
 import { updateAllBrains } from '../core/brain-updates.mjs';
 import { installHarnessHooks } from '../core/harness-hooks.mjs';
 import { automaticUpdateStatus, runAutomaticBrainUpdates } from '../core/automatic-brain-updates.mjs';
+import { runningServerStatus } from '../core/running-server.mjs';
 
 /** @param {string[]} args */
 export function parseArgs(args) {
@@ -78,21 +79,26 @@ function printHelp() {
         writing package.json or the lockfile. Register it to develop it here.
     total-recall update --automatic [--json]
         Daemon maintenance: update both packages, ensure defaults, update every
-        installed plugin from its recorded source and refresh surfaces.
+        installed plugin from its recorded source and refresh surfaces. Where a
+        per-user service (LaunchAgent, systemd user unit) runs the server from
+        the global install, also restart a stale server and verify /health.
     total-recall update --status [--json]
         Read the actual last automatic maintenance report without starting work.
+        Also reports what the server on this host runs against the release.
 
   This brain's own checkout (git):
     total-recall update --install-autopull [--port N] [--no-build] [--dry-run]
         Every 5 minutes fast-forward this checkout to origin/main, install and
         rebuild what changed, restart the brain and verify /health reports the
-        new version (scripts/auto-pull.sh). macOS: LaunchAgent
+        new version (scripts/auto-pull.sh). Refused where systemd serves the
+        checkout, because a restart there has a gap: use total-recall deploy. macOS: LaunchAgent
         com.totalrecall.autopull; Linux: crontab. A dev checkout (other branch,
         uncommitted or unpushed work) is never touched. --no-build: never build
         the dashboard on this host (laptops).
 
   Env:
     TR_AUTO_UPDATE_PACKAGE=0   Disable daemon cron auto-update (default: on)
+    TR_SERVER_AUTO_RESTART=0   Report a stale server instead of restarting it (default: on)
     TR_SYNC_REPOS=/a:/b       Extra project roots
 
   Source monorepos named ${PACKAGE_NAME} are skipped (use git, not npm into self).
@@ -106,7 +112,12 @@ export default async function update(args = []) {
     return;
   }
 
-  if(opts.status){const status=automaticUpdateStatus(brainDir);console.log(JSON.stringify(status,null,2));return status;}
+  if(opts.status){
+    const status=automaticUpdateStatus(brainDir);
+    status.server=await runningServerStatus({brainDir,latest:status.last?.versions?.['total-recall-brain']});
+    console.log(JSON.stringify(status,null,2));
+    return status;
+  }
   if(opts.automatic){
     const report=await runAutomaticBrainUpdates({brainDir,force:opts.force,fleet:!opts.localOnly});
     console.log(JSON.stringify(report,null,2));

package/src/core/automatic-brain-updates.mjs

@@ -12,6 +12,8 @@ import { updateGlobalBrainPackages } from './global-brain-updates.mjs';
 import { updateMeshBrainPackages } from './mesh-brain-updates.mjs';
 import { updateSourceBrainPackages } from './source-brain-updates.mjs';
 import { updateInstalledPlugins } from './plugin-updates.mjs';
+import { runningServerStatus } from './running-server.mjs';
+import { replaceStaleServer } from './server-restart.mjs';
 
 export function automaticUpdateStatus(brainDir) {
   let last;
@@ -36,7 +38,7 @@ export function startAutomaticBrainUpdates({brainDir,intervalMs=60*60*1000,run=r
   return {tick,stop(){stopped=true;clearInterval(timer);}};
 }
 
-export async function runAutomaticBrainUpdates({brainDir,fleet=false,force=false,skipThrottle=false,intervalMs=60*60*1000,update=updateAllBrains,compile=maintainCliSurfaces,globalUpdate=updateGlobalBrainPackages,meshUpdate=updateMeshBrainPackages,sourceUpdate=updateSourceBrainPackages,pluginUpdate=updateInstalledPlugins,skillMaintenance=maintainPortableSkills,now=Date.now}={}) {
+export async function runAutomaticBrainUpdates({brainDir,fleet=false,force=false,skipThrottle=false,intervalMs=60*60*1000,update=updateAllBrains,compile=maintainCliSurfaces,globalUpdate=updateGlobalBrainPackages,meshUpdate=updateMeshBrainPackages,sourceUpdate=updateSourceBrainPackages,pluginUpdate=updateInstalledPlugins,skillMaintenance=maintainPortableSkills,serverCheck=runningServerStatus,replaceServer=replaceStaleServer,now=Date.now}={}) {
   if(!force && !isPackageAutoUpdateEnabled())return {skipped:true,reason:'disabled',results:[]};
   const file=path.join(brainDir,'memory-derived/automatic-brain-updates.json');
   let saved;try{saved=JSON.parse(fs.readFileSync(file,'utf8'));}catch{}
@@ -66,11 +68,19 @@ export async function runAutomaticBrainUpdates({brainDir,fleet=false,force=false
       const changed=summary.updated>0 || plugins.updated>0 || global.results.some(row=>row.status==='updated') || sources.results.some(row=>row.status==='updated') || JSON.stringify(saved?.versions)!==JSON.stringify(summary.versions);
       const skills=await skillMaintenance({brainDir});
       const surfaces=await compile({brainDir,force:changed || skills.updated > 0});
+      // Last, so a replaced server starts on everything this run moved. Where maintenance cannot
+      // replace it, a lagging server is reported and not counted as a failure, which would retry
+      // every five minutes for nothing: in production that is a deploy decision. Where it can, a
+      // hold or a failed attempt is this machine's own failure, which is what makes a peer dispatch it again.
+      let server=await serverCheck({brainDir,latest:summary.versions?.['total-recall-brain']});
+      if(server.status==='stale')server=await replaceServer({brainDir,server,globalRoot:global.root,previous:saved?.server});
+      if(server.status==='stale' || server.status==='down')logger.error('automatic-brain-updates',`Running server: ${server.replacement?.reason || server.reason}`);
+      const serverFailed=['held','failed'].includes(server.replacement?.state)?1:0;
       // local_failed is this node's own maintenance. Peers judge a node by it, not by
       // `failed`, which also counts the node's view of its peers: judging by that made
       // every fleet pass mark every peer failed forever, each because the others had.
-      const local_failed=(summary.failed || 0)+global.failed+sources.failed+plugins.failed+(skills.failed || 0)+(surfaces.ok?0:surfaces.results.filter(row=>row.status==='failed').length);
-      report={...summary,global,sources,plugins,mesh,skills,surfaces,local_failed,failed:local_failed+mesh.failed,checkedAt:now()};
+      const local_failed=(summary.failed || 0)+global.failed+sources.failed+plugins.failed+(skills.failed || 0)+(surfaces.ok?0:surfaces.results.filter(row=>row.status==='failed').length)+serverFailed;
+      report={...summary,global,sources,plugins,mesh,server,skills,surfaces,local_failed,failed:local_failed+mesh.failed,checkedAt:now()};
     }catch(error){report={failed:1,error:error.message,checkedAt:now(),results:[]};}
     const temporary=`${file}.${process.pid}.tmp`;fs.writeFileSync(temporary,JSON.stringify(report,null,2));fs.renameSync(temporary,file);
     return report;

package/src/core/autopull-install.mjs

@@ -122,6 +122,16 @@ function readPlistValue(file, key) {
   }
 }
 
+/**
+ * Whether systemd serves this checkout. auto-pull stops the brain and starts another with
+ * nohup, so on such a host it would cause an outage and leave a process outside the unit.
+ */
+export function systemdServesCheckout(repoDir, { exec = spawnSync } = {}) {
+  const shown = exec('systemctl', ['show', 'total-recall-server.service', '-p', 'LoadState', '-p', 'ExecStart'], { encoding: 'utf8', timeout: 5000 });
+  if (shown.status !== 0) return false;
+  return /^LoadState=loaded$/m.test(shown.stdout || '') && (shown.stdout || '').includes(`${repoDir}/`);
+}
+
 /**
  * Install (or refresh) the timer. Returns what it did; `dryRun` returns the
  * plan without writing.
@@ -133,12 +143,16 @@ export function installAutoPull({
   platform = process.platform,
   home = os.homedir(),
   dryRun = false,
+  exec = spawnSync,
 } = {}) {
   const script = path.join(repoDir, 'scripts', 'auto-pull.sh');
   if (!fs.existsSync(path.join(repoDir, '.git'))) {
     throw new Error(`${repoDir} is not a git checkout; npm installs update through the daemon (total-recall update --apply).`);
   }
   if (!fs.existsSync(script)) throw new Error(`Missing ${script}`);
+  if (platform === 'linux' && systemdServesCheckout(repoDir, { exec })) {
+    throw new Error(`systemd serves ${repoDir}, and a restart there has a gap. Replace it with: total-recall deploy release <version> --adapter-secret <DEPLOY_MESH_REFERENCE>`);
+  }
 
   const resolvedPort =
     port || Number(process.env.TR_PORT) || (platform === 'darwin' ? detectLaunchAgentPort(repoDir, { home }) : null) || 3000;

package/src/core/brain-updates.mjs

@@ -19,6 +19,13 @@ const sections = ['dependencies', 'devDependencies', 'optionalDependencies', 'pe
 const ignored = new Set(['node_modules', 'vendor', 'dist', 'build', 'coverage', 'venv',
   'test', 'tests', '__tests__', 'fixtures', 'tmp', 'scratch', 'scaffold', 'memory-derived']);
 const canonical = key => key === '@ssss/cli' ? '@gregiteen/ssss-cli' : key;
+// Plugins also force the engine alias through `overrides`. Those pins move with the dependency,
+// or a consumer ends up asking for two versions of the same package.
+const overrideKeys = pkg => Object.entries(pkg.overrides || {})
+  .filter(([key, spec]) => typeof spec === 'string' && BRAIN_PACKAGES.includes(canonical(key)) && canonical(key) !== pkg.name)
+  .map(([key]) => key);
+const overridesLag = (pkg, versions) => overrideKeys(pkg)
+  .some(key => versions[canonical(key)] && pkg.overrides[key] !== targetSpec(key, versions[canonical(key)]));
 const read = file => JSON.parse(fs.readFileSync(file, 'utf8'));
 const isLink = file => { try { return fs.lstatSync(file).isSymbolicLink(); } catch { return false; } };
 export const brainUpdateLockPath = owner => path.join(os.tmpdir(),
@@ -196,7 +203,7 @@ const absentDevDep = (dep) => dep.section === 'devDependencies' && !dep.file;
  * The daemon runs with NODE_ENV=production, and under that npm and pnpm remove dev dependencies
  * from whatever they install in. An install that wants a runtime tree says so with a flag.
  */
-function installEnv(env = process.env) {
+export function installEnv(env = process.env) {
   const { NODE_ENV, npm_config_omit, NPM_CONFIG_OMIT, npm_config_production, NPM_CONFIG_PRODUCTION, ...kept } = env;
   return kept;
 }
@@ -261,7 +268,7 @@ export async function updateAllBrains(opts = {}) {
       row.status = 'failed'; row.error = 'Newer local/preview package; refusing an implicit downgrade'; continue;
     }
     const shared = isLink(path.join(owner.owner, 'node_modules')) || isLink(path.join(consumer.root, 'node_modules'));
-    const needsChange = shared || consumer.deps.some(dep => {
+    const needsChange = shared || (!consumer.runtimeOnly && overridesLag(consumer.pkg, versions)) || consumer.deps.some(dep => {
       const pinLags = !consumer.runtimeOnly && dep.declared !== targetSpec(dep.key, versions[dep.package]);
       if (absentDevDep(dep)) return pinLags;
       return pinLags || dep.version !== versions[dep.package]
@@ -296,6 +303,9 @@ export async function updateAllBrains(opts = {}) {
         saved.set(consumer.file, text);
         const pkg = read(consumer.file);
         for (const dep of consumer.deps) pkg[dep.section][dep.key] = targetSpec(dep.key, versions[dep.package]);
+        for (const key of overrideKeys(pkg)) {
+          if (versions[canonical(key)]) pkg.overrides[key] = targetSpec(key, versions[canonical(key)]);
+        }
         const indent = /\n([ \t]+)"/.exec(text)?.[1] || 2;
         fs.writeFileSync(consumer.file, JSON.stringify(pkg, null, indent) + '\n');
       }

package/src/core/context-compactor.mjs

@@ -62,6 +62,9 @@ export function compactRules(items, { budget, expand = [], header, complete = fa
   if (unknown.length) throw new Error(`Cannot expand rules not in this capsule: ${unknown.join(', ')}`);
   const duplicateOf = findDuplicates(ranked.filter(item => !expand.includes(item.slug)));
   const tiers = new Map(ranked.map(item => [item.slug, 'omitted']));
+  const isEvidence = item => item.taskEvidence && !item.required;
+  const supplement = supplemental.filter(item => item.text && !isEvidence(item)).map(item => item.text.trim());
+  const evidence = supplemental.filter(item => item.text && isEvidence(item)).map(item => item.text.trim()).join('\n\n---\n\n');
 
   const render = () => {
     const of = tier => ranked.filter(item => tiers.get(item.slug) === tier);
@@ -71,10 +74,11 @@ export function compactRules(items, { budget, expand = [], header, complete = fa
     const blocks = [
       ...full.map(item => item.text.trim()),
       ...summary.map(item => `[${item.slug}] ${summarizeRule(item.body)}`),
-      ...supplemental.filter(item => item.text).map(item => item.text.trim()),
+      ...supplement,
     ];
     if (reference.length) blocks.push(`Referenced: ${reference.map(item => item.slug).join(', ')}`);
     if (duplicate.length) blocks.push(`Duplicates: ${duplicate.map(item => `${item.slug} (of ${duplicateOf.get(item.slug)})`).join(', ')}`);
+    if (evidence) blocks.push(evidence);
     const body = blocks.join('\n\n---\n\n');
     // The token count sits inside the text it counts, so iterate to a stable value.
     let tokens = estimateTokens(body);
@@ -142,5 +146,6 @@ export function compactRules(items, { budget, expand = [], header, complete = fa
   for (const slug of duplicateOf.keys()) tryTier(ranked.find(item => item.slug === slug), 'duplicate');
 
   const { context, counts, tokens } = render();
-  return { context, counts, tokens, tiers: Object.fromEntries(tiers) };
+  return { context, counts, tokens, tiers: Object.fromEntries(tiers),
+    ...(evidence && { evidenceStart: context.length - evidence.length }) };
 }

package/src/core/context-compiler.mjs

@@ -109,7 +109,10 @@ export async function compileContext({
   }
 
   const cliContributions = cliVerbContribution ? [cliVerbContribution] : [];
-  const supporting = [...knowledge.contributions, ...cliContributions];
+  const evidence = knowledge.summary.selected
+    ? knowledge.contributions.map(item => ({ ...item, taskEvidence: true }))
+    : knowledge.contributions;
+  const supporting = [...evidence, ...cliContributions];
   const result = assembleContext([...required, ...supporting, ...contributions], { total: b.total });
   const evidenceMissing = supporting.some(item => !result.stats.contributions.some(placed => placed.id === item.id));
   // Compaction may reclaim rule explanation space; never claim readiness after losing selected task evidence.
@@ -163,6 +166,8 @@ export function capsuleResponse(result, { total = 4000, debug = false, format =
     retrieval: summarizeRetrieval(result.stats.retrieval),
   };
   const response = { ready: result.ready, context: result.context, stats };
+  // This offset refers to the decoded context string, not the escaped JSON bytes.
+  if (result.evidenceStart !== undefined) response.evidence_start = result.evidenceStart;
   stats.budget = total;
   // Counts affect serialization themselves. Iterate to a stable representation.
   for (let i = 0; i < 20; i++) {

package/src/core/context-policy.mjs

@@ -100,14 +100,18 @@ export function assembleContext(contributions, { total = 4000 } = {}) {
     if (estimateTokens(render([...selected, item])) <= total) selected.push(item);
     else excluded.push(item.id);
   }
-  const context = render(selected);
+  const isEvidence = item => item.taskEvidence && !item.required;
+  const evidence = selected.filter(isEvidence);
+  const ordered = [...selected.filter(item => !isEvidence(item)), ...evidence];
+  const context = render(ordered);
+  const evidenceText = render(evidence);
   const totalTokens = estimateTokens(context);
-  return { context, ready: requiredTokens <= total, stats: {
+  return { context, ...(evidenceText && { evidenceStart: context.length - evidenceText.length }), ready: requiredTokens <= total, stats: {
     token_measurement: 'estimated_chars_divided_by_four', total_tokens: totalTokens,
     budget_used: totalTokens, budget_remaining: Math.max(0, total - totalTokens),
     required_tokens: requiredTokens, overflow_tokens: Math.max(0, requiredTokens - total),
     required_ids: required.map(c => c.id), excluded_ids: excluded,
-    contributions: selected.map(c => ({ id: c.id, required: Boolean(c.required), chars: c.text.length, estimated_tokens: estimateTokens(c.text) })),
+    contributions: ordered.map(c => ({ id: c.id, required: Boolean(c.required), chars: c.text.length, estimated_tokens: estimateTokens(c.text) })),
     version: crypto.createHash('sha256').update(JSON.stringify({ total, contributions })).digest('hex'),
   } };
 }

package/src/core/daemon-control.mjs

@@ -37,6 +37,28 @@ export function getDaemonStatus() {
   return status === 'not-started' ? 'not_started' : status === 'stopped' ? 'dead' : status;
 }
 
+/**
+ * Remove the lock of a daemon that is gone, for a server told to run none.
+ *
+ * startDaemon is the only other thing that recovers this lock, and such a server never
+ * calls it. A daemon that went down with the machine left a lock nothing would ever
+ * clear, so the server reported `dead` and `degraded` for good. Only a lock whose process
+ * is verified gone is removed: a live process or one that cannot be identified keeps it.
+ * @returns {boolean} True if a lock was removed.
+ */
+export function clearStaleDaemonLock({ observe = getDaemonObservation } = {}) {
+  try {
+    const before = fs.readFileSync(PID_FILE, 'utf8');
+    if (observe().status !== 'stopped') return false;
+    if (fs.readFileSync(PID_FILE, 'utf8') !== before) return false;
+    fs.unlinkSync(PID_FILE);
+    logger.info('daemon-control', `Removed the lock of daemon PID ${before.trim()}, which is gone. This server runs no daemon.`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Detaches the daemon script in the background and writes its PID to file.
  * @returns {number} The PID of the newly spawned daemon.