total-recall-brain 3.43.3 → 3.44.0

package/scaffold/.agent/skills/total-recall/plugins/openwiki/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "openwiki",
   "name": "OpenWiki",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Multi-repo knowledge graph and documentation wiki engine for Total Recall.",
   "license": "MIT",
   "runtime": {

package/scaffold/.agent/skills/total-recall/plugins/security/package-lock.json

@@ -1,19 +1,19 @@
 {
   "name": "tr-plugin-security",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-security",
-      "version": "0.3.5",
+      "version": "0.3.6",
       "license": "MIT",
       "dependencies": {
-        "@gregiteen/ssss-cli": "0.14.4"
+        "@gregiteen/ssss-cli": "0.14.5"
       },
       "devDependencies": {
         "jsdom": "^26.1.0",
-        "total-recall-brain": "3.42.1"
+        "total-recall-brain": "3.43.3"
       }
     },
     "node_modules/@alcalzone/ansi-tokenize": {
@@ -845,9 +845,9 @@
       }
     },
     "node_modules/@gregiteen/ssss-cli": {
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.4.tgz",
-      "integrity": "sha512-R6JIgPRvS9xXp0xb6BYO3rauv+72r35GIiDrJcvbjPdTSHFZXr8/jRxFOgoF8yTed/5xyGFF3ey3DI9bOjmHVA==",
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.5.tgz",
+      "integrity": "sha512-qVEYOocnwn97uJ0eDzmuwN06CYsYWr2t3+iKylpisBHX4wlLWk7P8EmFFdBlx7NyKVIZDDeYT164Gd7/T8UGgw==",
       "license": "ISC",
       "bin": {
         "ssss": "scripts/ssss.mjs"
@@ -1686,9 +1686,9 @@
     },
     "node_modules/@ssss/cli": {
       "name": "@gregiteen/ssss-cli",
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.4.tgz",
-      "integrity": "sha512-R6JIgPRvS9xXp0xb6BYO3rauv+72r35GIiDrJcvbjPdTSHFZXr8/jRxFOgoF8yTed/5xyGFF3ey3DI9bOjmHVA==",
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.5.tgz",
+      "integrity": "sha512-qVEYOocnwn97uJ0eDzmuwN06CYsYWr2t3+iKylpisBHX4wlLWk7P8EmFFdBlx7NyKVIZDDeYT164Gd7/T8UGgw==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -5698,9 +5698,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.42.1",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.42.1.tgz",
-      "integrity": "sha512-woH7mdkGwPFYlKPZurhE8L3BPe+cSeIruNGaPOjGZJm/O8C92Bbr1gsdOY0tTLg5QHlgPHcXG1GMtsm9lPDz8w==",
+      "version": "3.43.3",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.43.3.tgz",
+      "integrity": "sha512-yjfPN/BQxEEa+iodyFXQov/6fRt1pZg/7RcmgsbpALwBt6Ki3JJjT3tzArBC7NxHQmXgGYyKnCYId6xe/W2rPg==",
       "dev": true,
       "license": "MIT",
       "workspaces": [
@@ -5731,6 +5731,7 @@
         "antigravity": "bin/antigravity.mjs",
         "total-recall": "bin/total-recall.mjs",
         "total-recall-memory": "bin/total-recall-memory.mjs",
+        "total-recall-server-release": "bin/total-recall-server-release.mjs",
         "vibebrain": "bin/total-recall.mjs"
       },
       "optionalDependencies": {

package/scaffold/.agent/skills/total-recall/plugins/security/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-security",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "type": "module",
   "description": "Standalone security suite for Total Recall: static analysis, file and permission hardening schemes, AES-256-GCM encryption tools, and egress audit controls",
   "scripts": {
@@ -24,9 +24,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@gregiteen/ssss-cli": "0.14.4"
+    "@gregiteen/ssss-cli": "0.14.5"
   },
   "overrides": {
-    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.4"
+    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.5"
   }
 }

package/scaffold/.agent/skills/total-recall/plugins/security/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "security",
   "name": "Security Assessments",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "Machine and device security assessments for macOS, Linux, Windows, Android, Chromebook, iPhone and iPad, with explicit measured and manual coverage.",
   "license": "MIT",
   "requires": [{ "id": "auth", "range": ">=1.2.1" }],

package/scaffold/.agent/skills/total-recall/plugins/ssss/assets/scaffold.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.14.4",
+  "version": "0.14.5",
   "files": {
     ".gitignore": {
       "sha256": "0d6c69a5cbd2270c9163d8e1563976b6d15131d0ef599e6fbc413ee287a86da0",
@@ -18,8 +18,8 @@
       "content": "# ssss-project — System Architecture & Design\n\n> Technical design and architecture specification for ssss-project.\n\n## Overview\n\n<High-level summary of the system and its primary goals.>\n\n## Component Architecture\n\n- **Vault Structure**: Typed Markdown documents under `vault/` serving as the source of truth.\n- **Workflows & Execution**: Automated procedures defined in `vault/workflows/` triggered by operational events.\n- **Capabilities & Resources**: Tools and external service integrations required for execution.\n\n## Data & Schema Contracts\n\n<Core entities, external dependencies, and integration interfaces.>\n\n## Open Decisions & Invariants\n\n- SSSS VFS is the single source of truth for application state.\n- Structural business logic is strictly decoupled from private tenant operational data.\n- App-specific primitives reside in `registry/extensions/` within this repository and extend `core`.\n- Core SSSS library (`@gregiteen/ssss-cli`) remains vendor-neutral and dependency-free.\n"
     },
     "package.json": {
-      "sha256": "18389bfc91857c6d5917a3ac1af9da8a992c99b013f42f2843921cdc7b41bdfe",
-      "content": "{\n  \"name\": \"ssss-project\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"description\": \"An SSSS-native project — Markdown vault as source of truth.\",\n  \"scripts\": {\n    \"ssss\": \"ssss\",\n    \"test\": \"node --test\",\n    \"export\": \"ssss export vault --profile sale --out dist/bundle.ucw.json\",\n    \"validate\": \"ssss conformance --engine\"\n  },\n  \"dependencies\": {\n    \"@gregiteen/ssss-cli\": \"github:gregiteen/ssss#v0.14.4\"\n  }\n}\n"
+      "sha256": "ea77c2944b853999741a8e603de257604048c63b5db8754a0e8b92f383ff973b",
+      "content": "{\n  \"name\": \"ssss-project\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"description\": \"An SSSS-native project — Markdown vault as source of truth.\",\n  \"scripts\": {\n    \"ssss\": \"ssss\",\n    \"test\": \"node --test\",\n    \"export\": \"ssss export vault --profile sale --out dist/bundle.ucw.json\",\n    \"validate\": \"ssss conformance --engine\"\n  },\n  \"dependencies\": {\n    \"@gregiteen/ssss-cli\": \"github:gregiteen/ssss#v0.14.5\"\n  }\n}\n"
     },
     "test/ssss-conformance.test.mjs": {
       "sha256": "f626d2f56799fcfda74375d3ddf546cc181a10caf2df08b72b7f2e36782c9bc1",
@@ -43,8 +43,8 @@
     }
   },
   "skill": {
-    "SKILL.md": "4976c9615482f257fd023761dd3ef36b5aa278305ff22ae110295fe4945f5d4c",
-    "core/SKILL.md": "96c6479ad06b84c5f7ffd8bb05bff414dbb8c22a040ec1f1c05d8fa4fdbd976e",
+    "SKILL.md": "e5c2c0aa2c0fb5480c1f7bdb37928f935e1160bff18fd6b63366a04f3e281938",
+    "core/SKILL.md": "12543720135f13650efcd7afd751e3253996692c6ab805fd7da99788b6fc4af9",
     "core/references/core-registry.json": "16831aa3b6be3f561a9ca7abdc36065a4843ff595aa3acf5c3fb8af2d733b7e3",
     "core/references/ssss-spec.md": "cc319e78b1b568651d5717695348363349d502c0e20663da9858369022ddfc3b",
     "core/scripts/maintain.mjs": "eebcae898f2ce0cf3f0059c6f6737bee8877409de2d370d54a4015a9a82414e9",

package/scaffold/.agent/skills/total-recall/plugins/ssss/package-lock.json

@@ -1,21 +1,21 @@
 {
   "name": "tr-plugin-ssss",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-ssss",
-      "version": "0.1.2",
+      "version": "0.1.3",
       "license": "MIT",
       "dependencies": {
-        "@gregiteen/ssss-cli": "0.14.4"
+        "@gregiteen/ssss-cli": "0.14.5"
       }
     },
     "node_modules/@gregiteen/ssss-cli": {
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.4.tgz",
-      "integrity": "sha512-R6JIgPRvS9xXp0xb6BYO3rauv+72r35GIiDrJcvbjPdTSHFZXr8/jRxFOgoF8yTed/5xyGFF3ey3DI9bOjmHVA==",
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.5.tgz",
+      "integrity": "sha512-qVEYOocnwn97uJ0eDzmuwN06CYsYWr2t3+iKylpisBHX4wlLWk7P8EmFFdBlx7NyKVIZDDeYT164Gd7/T8UGgw==",
       "license": "ISC",
       "bin": {
         "ssss": "scripts/ssss.mjs"

package/scaffold/.agent/skills/total-recall/plugins/ssss/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-ssss",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "private": true,
   "type": "module",
   "description": "Canonical SSSS distribution, scaffolding and validation for Total Recall installations.",
@@ -19,7 +19,7 @@
     "check:ssss-conformance": "node cli.mjs conformance"
   },
   "dependencies": {
-    "@gregiteen/ssss-cli": "0.14.4"
+    "@gregiteen/ssss-cli": "0.14.5"
   },
   "license": "MIT"
 }

package/scaffold/.agent/skills/total-recall/plugins/ssss/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "ssss",
   "name": "SSSS",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Canonical SSSS distribution, scaffolding and validation for Total Recall installations.",
   "license": "MIT",
   "use_cases": ["software-development", "state-conformance"],

package/src/cli/connect.mjs

@@ -80,11 +80,10 @@ export const CLIENTS = {
   },
   openclaw: {
     label: 'OpenClaw',
-    mode: 'openclaw',
+    mode: 'symlink',
     enforcement: 'enforced',
     enforcementReason: 'before_tool_call hook denies unreceipted tool calls with exit 2',
-    memoryTarget: 'MEMORY.md',
-    agentsTarget: 'AGENTS.md',
+    target: 'AGENTS.md',
   },
   cursor: {
     label: 'Cursor',
@@ -880,32 +879,6 @@ export default async function connect(args) {
       result.notes.push(`  DeepSeek Harness MEMORY.md → ${globalMemPath}`);
     }
     result.notes.push(`  DeepSeek Harness AGENTS.md → INSTRUCTIONS.md`);
-  } else if (preset.mode === 'openclaw') {
-    // OpenClaw: write MEMORY.md + symlink AGENTS.md in cwd
-    const instructions = readInstructions(cwd, agentDir);
-    if (!instructions) throw new Error('No INSTRUCTIONS.md found. Run npx total-recall init or compile first.');
-    // MEMORY.md — curated facts extracted from instructions
-    const memPath = path.join(cwd, preset.memoryTarget);
-    if (!fs.existsSync(memPath) || opts.force) {
-      fs.writeFileSync(memPath, instructions, 'utf8');
-    }
-    // AGENTS.md — symlink to INSTRUCTIONS.md
-    const agentsPath = path.join(cwd, preset.agentsTarget);
-    if (pathExists(agentsPath)) {
-      if (opts.force) {
-        try {
-          fs.unlinkSync(agentsPath);
-        } catch {
-          fs.rmSync(agentsPath, { force: true, recursive: true });
-        }
-        fs.symlinkSync('INSTRUCTIONS.md', agentsPath);
-      }
-    } else {
-      fs.symlinkSync('INSTRUCTIONS.md', agentsPath);
-    }
-    result.projection = { targetPath: memPath, action: 'written' };
-    result.notes.push(`  OpenClaw MEMORY.md written to ${memPath}`);
-    result.notes.push(`  OpenClaw AGENTS.md → INSTRUCTIONS.md`);
   } else if (preset.mode === 'vault') {
     result.projection = writeVaultProjection(agentDir, preset, opts);
     const folderName = result.projection.folderName || preset.folderName;

package/src/cli/context.mjs

@@ -61,6 +61,7 @@ async function printCompacted({ query, actions, budget, format, version, rulesHa
     if (format !== 'json') return result.context;
     const payload = { ready: true, compacted: true, ranking: result.ranking, context: result.context, counts: result.counts,
       stats: { version, rules_hash: rulesHash, budget, retrieval: summarizeRetrieval(knowledge?.summary), token_measurement: 'estimated_chars_divided_by_four' } };
+    if (result.evidenceStart !== undefined) payload.evidence_start = result.evidenceStart;
     for (let index = 0; index < 10; index++) {
       const tokens = estimateTokens(`${JSON.stringify(payload)}\n`);
       if (tokens === payload.stats.total_tokens) break;

package/src/cli/ingest-okf.mjs

@@ -11,7 +11,7 @@ export async function runOkfIngest(args) {
     dryRun: false,
     category: null,
     importance: null,
-    onConflict: 'warn',
+    onConflict: 'skip',
     typeMap: null,
     help: false
   };
@@ -118,10 +118,10 @@ function printIngestOkfHelp() {
 
   Options:
     --dry-run                 Validate concepts and preview import without writing
-    --category <name>         Override and force category for all imported concepts
+    --category <name>         Choose a descriptive category for imported concepts
     --importance <1-5>        Override default importance (default: 3)
-    --on-conflict <strategy>  Strategy for duplicate slugs: 'skip' | 'warn' | 'overwrite' (default: warn)
-    --type-map <mapping>      Custom type mappings. Format: "Type A=facts,Type B=concepts"
+    --on-conflict <strategy>  'skip' (default), 'warn' (report and skip), or 'overwrite' (same imported concept)
+    --type-map <mapping>      Map types to descriptive categories, e.g. "Type A=facts,Type B=concepts"
     --global                  Target the global brain
     --project                 Target the project brain (default)
     --help, -h                Show this help

package/src/cli/release.mjs

@@ -141,7 +141,10 @@ export async function tarballServed(pkg, version, { exec = spawnSync, fetchImpl
  * Wait until a just-published version can be installed: listed as latest, and its tarball served.
  * 3.42.0 took about six minutes and 3.42.1 about eight, its listing four minutes ahead of its tarball.
  */
-export async function awaitPublished(pkg, version, { attempts = 45, delayMs = 20000, exec = spawnSync, sleep, tarball = tarballServed } = {}) {
+/** npm has taken 8 and then 23 minutes to serve an accepted publish, so a shorter wait reports failure on a good release. */
+export const REGISTRY_WAIT = Object.freeze({ attempts: 120, delayMs: 20000 });
+
+export async function awaitPublished(pkg, version, { attempts = REGISTRY_WAIT.attempts, delayMs = REGISTRY_WAIT.delayMs, exec = spawnSync, sleep, tarball = tarballServed } = {}) {
   const pause = sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
   let last = null;
   for (let i = 0; i < attempts; i++) {

package/src/cli/update.mjs

@@ -79,7 +79,9 @@ function printHelp() {
         writing package.json or the lockfile. Register it to develop it here.
     total-recall update --automatic [--json]
         Daemon maintenance: update both packages, ensure defaults, update every
-        installed plugin from its recorded source and refresh surfaces.
+        installed plugin from its recorded source and refresh surfaces. Where a
+        per-user service (LaunchAgent, systemd user unit) runs the server from
+        the global install, also restart a stale server and verify /health.
     total-recall update --status [--json]
         Read the actual last automatic maintenance report without starting work.
         Also reports what the server on this host runs against the release.
@@ -96,6 +98,7 @@ function printHelp() {
 
   Env:
     TR_AUTO_UPDATE_PACKAGE=0   Disable daemon cron auto-update (default: on)
+    TR_SERVER_AUTO_RESTART=0   Report a stale server instead of restarting it (default: on)
     TR_SYNC_REPOS=/a:/b       Extra project roots
 
   Source monorepos named ${PACKAGE_NAME} are skipped (use git, not npm into self).

package/src/core/automatic-brain-updates.mjs

@@ -13,6 +13,7 @@ import { updateMeshBrainPackages } from './mesh-brain-updates.mjs';
 import { updateSourceBrainPackages } from './source-brain-updates.mjs';
 import { updateInstalledPlugins } from './plugin-updates.mjs';
 import { runningServerStatus } from './running-server.mjs';
+import { replaceStaleServer } from './server-restart.mjs';
 
 export function automaticUpdateStatus(brainDir) {
   let last;
@@ -37,7 +38,7 @@ export function startAutomaticBrainUpdates({brainDir,intervalMs=60*60*1000,run=r
   return {tick,stop(){stopped=true;clearInterval(timer);}};
 }
 
-export async function runAutomaticBrainUpdates({brainDir,fleet=false,force=false,skipThrottle=false,intervalMs=60*60*1000,update=updateAllBrains,compile=maintainCliSurfaces,globalUpdate=updateGlobalBrainPackages,meshUpdate=updateMeshBrainPackages,sourceUpdate=updateSourceBrainPackages,pluginUpdate=updateInstalledPlugins,skillMaintenance=maintainPortableSkills,serverCheck=runningServerStatus,now=Date.now}={}) {
+export async function runAutomaticBrainUpdates({brainDir,fleet=false,force=false,skipThrottle=false,intervalMs=60*60*1000,update=updateAllBrains,compile=maintainCliSurfaces,globalUpdate=updateGlobalBrainPackages,meshUpdate=updateMeshBrainPackages,sourceUpdate=updateSourceBrainPackages,pluginUpdate=updateInstalledPlugins,skillMaintenance=maintainPortableSkills,serverCheck=runningServerStatus,replaceServer=replaceStaleServer,now=Date.now}={}) {
   if(!force && !isPackageAutoUpdateEnabled())return {skipped:true,reason:'disabled',results:[]};
   const file=path.join(brainDir,'memory-derived/automatic-brain-updates.json');
   let saved;try{saved=JSON.parse(fs.readFileSync(file,'utf8'));}catch{}
@@ -65,16 +66,20 @@ export async function runAutomaticBrainUpdates({brainDir,fleet=false,force=false
       const plugins=await pluginUpdate({roots:[path.resolve(brainDir,'../../..')]});
       const mesh=fleet && summary.versions?await meshUpdate({versions:summary.versions,version:summary.versions['total-recall-brain']}):{failed:0,results:[],scope:'local-only'};
       const changed=summary.updated>0 || plugins.updated>0 || global.results.some(row=>row.status==='updated') || sources.results.some(row=>row.status==='updated') || JSON.stringify(saved?.versions)!==JSON.stringify(summary.versions);
-      // A lagging server is reported and not counted as a failure: maintenance cannot fix it, and
-      // a failure would retry every five minutes. Replacing one in production is a deploy decision.
-      const server=await serverCheck({brainDir,latest:summary.versions?.['total-recall-brain']});
-      if(server.status==='stale' || server.status==='down')logger.error('automatic-brain-updates',`Running server: ${server.reason}`);
       const skills=await skillMaintenance({brainDir});
       const surfaces=await compile({brainDir,force:changed || skills.updated > 0});
+      // Last, so a replaced server starts on everything this run moved. Where maintenance cannot
+      // replace it, a lagging server is reported and not counted as a failure, which would retry
+      // every five minutes for nothing: in production that is a deploy decision. Where it can, a
+      // hold or a failed attempt is this machine's own failure, which is what makes a peer dispatch it again.
+      let server=await serverCheck({brainDir,latest:summary.versions?.['total-recall-brain']});
+      if(server.status==='stale')server=await replaceServer({brainDir,server,globalRoot:global.root,previous:saved?.server});
+      if(server.status==='stale' || server.status==='down')logger.error('automatic-brain-updates',`Running server: ${server.replacement?.reason || server.reason}`);
+      const serverFailed=['held','failed'].includes(server.replacement?.state)?1:0;
       // local_failed is this node's own maintenance. Peers judge a node by it, not by
       // `failed`, which also counts the node's view of its peers: judging by that made
       // every fleet pass mark every peer failed forever, each because the others had.
-      const local_failed=(summary.failed || 0)+global.failed+sources.failed+plugins.failed+(skills.failed || 0)+(surfaces.ok?0:surfaces.results.filter(row=>row.status==='failed').length);
+      const local_failed=(summary.failed || 0)+global.failed+sources.failed+plugins.failed+(skills.failed || 0)+(surfaces.ok?0:surfaces.results.filter(row=>row.status==='failed').length)+serverFailed;
       report={...summary,global,sources,plugins,mesh,server,skills,surfaces,local_failed,failed:local_failed+mesh.failed,checkedAt:now()};
     }catch(error){report={failed:1,error:error.message,checkedAt:now(),results:[]};}
     const temporary=`${file}.${process.pid}.tmp`;fs.writeFileSync(temporary,JSON.stringify(report,null,2));fs.renameSync(temporary,file);

package/src/core/brain-updates.mjs

@@ -19,6 +19,13 @@ const sections = ['dependencies', 'devDependencies', 'optionalDependencies', 'pe
 const ignored = new Set(['node_modules', 'vendor', 'dist', 'build', 'coverage', 'venv',
   'test', 'tests', '__tests__', 'fixtures', 'tmp', 'scratch', 'scaffold', 'memory-derived']);
 const canonical = key => key === '@ssss/cli' ? '@gregiteen/ssss-cli' : key;
+// Plugins also force the engine alias through `overrides`. Those pins move with the dependency,
+// or a consumer ends up asking for two versions of the same package.
+const overrideKeys = pkg => Object.entries(pkg.overrides || {})
+  .filter(([key, spec]) => typeof spec === 'string' && BRAIN_PACKAGES.includes(canonical(key)) && canonical(key) !== pkg.name)
+  .map(([key]) => key);
+const overridesLag = (pkg, versions) => overrideKeys(pkg)
+  .some(key => versions[canonical(key)] && pkg.overrides[key] !== targetSpec(key, versions[canonical(key)]));
 const read = file => JSON.parse(fs.readFileSync(file, 'utf8'));
 const isLink = file => { try { return fs.lstatSync(file).isSymbolicLink(); } catch { return false; } };
 export const brainUpdateLockPath = owner => path.join(os.tmpdir(),
@@ -261,7 +268,7 @@ export async function updateAllBrains(opts = {}) {
       row.status = 'failed'; row.error = 'Newer local/preview package; refusing an implicit downgrade'; continue;
     }
     const shared = isLink(path.join(owner.owner, 'node_modules')) || isLink(path.join(consumer.root, 'node_modules'));
-    const needsChange = shared || consumer.deps.some(dep => {
+    const needsChange = shared || (!consumer.runtimeOnly && overridesLag(consumer.pkg, versions)) || consumer.deps.some(dep => {
       const pinLags = !consumer.runtimeOnly && dep.declared !== targetSpec(dep.key, versions[dep.package]);
       if (absentDevDep(dep)) return pinLags;
       return pinLags || dep.version !== versions[dep.package]
@@ -296,6 +303,9 @@ export async function updateAllBrains(opts = {}) {
         saved.set(consumer.file, text);
         const pkg = read(consumer.file);
         for (const dep of consumer.deps) pkg[dep.section][dep.key] = targetSpec(dep.key, versions[dep.package]);
+        for (const key of overrideKeys(pkg)) {
+          if (versions[canonical(key)]) pkg.overrides[key] = targetSpec(key, versions[canonical(key)]);
+        }
         const indent = /\n([ \t]+)"/.exec(text)?.[1] || 2;
         fs.writeFileSync(consumer.file, JSON.stringify(pkg, null, indent) + '\n');
       }

package/src/core/context-compactor.mjs

@@ -62,6 +62,9 @@ export function compactRules(items, { budget, expand = [], header, complete = fa
   if (unknown.length) throw new Error(`Cannot expand rules not in this capsule: ${unknown.join(', ')}`);
   const duplicateOf = findDuplicates(ranked.filter(item => !expand.includes(item.slug)));
   const tiers = new Map(ranked.map(item => [item.slug, 'omitted']));
+  const isEvidence = item => item.taskEvidence && !item.required;
+  const supplement = supplemental.filter(item => item.text && !isEvidence(item)).map(item => item.text.trim());
+  const evidence = supplemental.filter(item => item.text && isEvidence(item)).map(item => item.text.trim()).join('\n\n---\n\n');
 
   const render = () => {
     const of = tier => ranked.filter(item => tiers.get(item.slug) === tier);
@@ -71,10 +74,11 @@ export function compactRules(items, { budget, expand = [], header, complete = fa
     const blocks = [
       ...full.map(item => item.text.trim()),
       ...summary.map(item => `[${item.slug}] ${summarizeRule(item.body)}`),
-      ...supplemental.filter(item => item.text).map(item => item.text.trim()),
+      ...supplement,
     ];
     if (reference.length) blocks.push(`Referenced: ${reference.map(item => item.slug).join(', ')}`);
     if (duplicate.length) blocks.push(`Duplicates: ${duplicate.map(item => `${item.slug} (of ${duplicateOf.get(item.slug)})`).join(', ')}`);
+    if (evidence) blocks.push(evidence);
     const body = blocks.join('\n\n---\n\n');
     // The token count sits inside the text it counts, so iterate to a stable value.
     let tokens = estimateTokens(body);
@@ -142,5 +146,6 @@ export function compactRules(items, { budget, expand = [], header, complete = fa
   for (const slug of duplicateOf.keys()) tryTier(ranked.find(item => item.slug === slug), 'duplicate');
 
   const { context, counts, tokens } = render();
-  return { context, counts, tokens, tiers: Object.fromEntries(tiers) };
+  return { context, counts, tokens, tiers: Object.fromEntries(tiers),
+    ...(evidence && { evidenceStart: context.length - evidence.length }) };
 }

package/src/core/context-compiler.mjs

@@ -109,7 +109,10 @@ export async function compileContext({
   }
 
   const cliContributions = cliVerbContribution ? [cliVerbContribution] : [];
-  const supporting = [...knowledge.contributions, ...cliContributions];
+  const evidence = knowledge.summary.selected
+    ? knowledge.contributions.map(item => ({ ...item, taskEvidence: true }))
+    : knowledge.contributions;
+  const supporting = [...evidence, ...cliContributions];
   const result = assembleContext([...required, ...supporting, ...contributions], { total: b.total });
   const evidenceMissing = supporting.some(item => !result.stats.contributions.some(placed => placed.id === item.id));
   // Compaction may reclaim rule explanation space; never claim readiness after losing selected task evidence.
@@ -163,6 +166,8 @@ export function capsuleResponse(result, { total = 4000, debug = false, format =
     retrieval: summarizeRetrieval(result.stats.retrieval),
   };
   const response = { ready: result.ready, context: result.context, stats };
+  // This offset refers to the decoded context string, not the escaped JSON bytes.
+  if (result.evidenceStart !== undefined) response.evidence_start = result.evidenceStart;
   stats.budget = total;
   // Counts affect serialization themselves. Iterate to a stable representation.
   for (let i = 0; i < 20; i++) {

package/src/core/context-policy.mjs

@@ -100,14 +100,18 @@ export function assembleContext(contributions, { total = 4000 } = {}) {
     if (estimateTokens(render([...selected, item])) <= total) selected.push(item);
     else excluded.push(item.id);
   }
-  const context = render(selected);
+  const isEvidence = item => item.taskEvidence && !item.required;
+  const evidence = selected.filter(isEvidence);
+  const ordered = [...selected.filter(item => !isEvidence(item)), ...evidence];
+  const context = render(ordered);
+  const evidenceText = render(evidence);
   const totalTokens = estimateTokens(context);
-  return { context, ready: requiredTokens <= total, stats: {
+  return { context, ...(evidenceText && { evidenceStart: context.length - evidenceText.length }), ready: requiredTokens <= total, stats: {
     token_measurement: 'estimated_chars_divided_by_four', total_tokens: totalTokens,
     budget_used: totalTokens, budget_remaining: Math.max(0, total - totalTokens),
     required_tokens: requiredTokens, overflow_tokens: Math.max(0, requiredTokens - total),
     required_ids: required.map(c => c.id), excluded_ids: excluded,
-    contributions: selected.map(c => ({ id: c.id, required: Boolean(c.required), chars: c.text.length, estimated_tokens: estimateTokens(c.text) })),
+    contributions: ordered.map(c => ({ id: c.id, required: Boolean(c.required), chars: c.text.length, estimated_tokens: estimateTokens(c.text) })),
     version: crypto.createHash('sha256').update(JSON.stringify({ total, contributions })).digest('hex'),
   } };
 }

package/src/core/daemon-control.mjs

@@ -37,6 +37,28 @@ export function getDaemonStatus() {
   return status === 'not-started' ? 'not_started' : status === 'stopped' ? 'dead' : status;
 }
 
+/**
+ * Remove the lock of a daemon that is gone, for a server told to run none.
+ *
+ * startDaemon is the only other thing that recovers this lock, and such a server never
+ * calls it. A daemon that went down with the machine left a lock nothing would ever
+ * clear, so the server reported `dead` and `degraded` for good. Only a lock whose process
+ * is verified gone is removed: a live process or one that cannot be identified keeps it.
+ * @returns {boolean} True if a lock was removed.
+ */
+export function clearStaleDaemonLock({ observe = getDaemonObservation } = {}) {
+  try {
+    const before = fs.readFileSync(PID_FILE, 'utf8');
+    if (observe().status !== 'stopped') return false;
+    if (fs.readFileSync(PID_FILE, 'utf8') !== before) return false;
+    fs.unlinkSync(PID_FILE);
+    logger.info('daemon-control', `Removed the lock of daemon PID ${before.trim()}, which is gone. This server runs no daemon.`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Detaches the daemon script in the background and writes its PID to file.
  * @returns {number} The PID of the newly spawned daemon.

package/src/core/global-brain-updates.mjs

@@ -55,5 +55,5 @@ export function updateGlobalBrainPackages({versions,exec=spawnSync,sourceUpdate=
       if(row.status==='failed')row.error=result.error?.message || result.stderr?.slice(-1000) || 'Global version verification failed';
     }
   }
-  return {failed:results.filter(row=>row.status==='failed').length,results};
+  return {failed:results.filter(row=>row.status==='failed').length,results,root};
 }

package/src/core/mesh-brain-updates.mjs

@@ -30,7 +30,8 @@ export async function updateMeshBrainPackages({version,versions,listNodes,exec,n
       let report,serving;try{const status=JSON.parse(observed.stdout);report=status.last;serving=status.server;}catch{}
       const localFailed=report?(report.local_failed ?? Math.max(0,(report.failed || 0)-(report.mesh?.failed || 0))):null;
       const current=observed.success && report && localFailed===0 && now()>=report.checkedAt && now()-report.checkedAt<2*60*60*1000 && report.versions?.['total-recall-brain']===version && (!versions?.['@gregiteen/ssss-cli'] || report.versions?.['@gregiteen/ssss-cli']===versions['@gregiteen/ssss-cli']);
-      // Maintenance cannot fix a lagging server, so this is reported and not dispatched again.
+      // Maintenance could not fix this server, or it would have reported a local failure above and
+      // been dispatched again, so this is reported. One that lags since the last run waits for that run's report to age.
       if(current && serving?.status==='stale'){row.status='failed';row.report=report;row.server=serving;row.error=serving.reason;continue;}
       if(current){row.status='verified';row.report=report;continue;}
       // npm exec pins the verified release so an old installed CLI can bootstrap