total-recall-brain 3.44.0 → 3.45.0

package/src/cli/plugin/create.mjs

@@ -1,9 +1,8 @@
 import fs from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
-import { validatePluginManifest } from "../../core/plugin-loader.mjs";
+import { validatePluginManifest, isCronExpression } from "../../core/plugin-loader.mjs";
 import { installPlugin } from "../../core/plugin-store.mjs";
-import { parseCron } from "../../core/plugin-cron.mjs";
 
 function toTitleCase(kebab) {
   return kebab
@@ -111,7 +110,7 @@ customElements.define('${id}-panel', ${panelClass});
 }
 
 export async function createPlugin(args = []) {
-  const isGlobal = args.includes("--global") || args.includes("-g");
+  // Every plugin is installed in the shared folder; --global is accepted and changes nothing.
   let withCli = args.includes("--with-cli");
   const withGenerator = args.includes("--with-generator");
   // A card face is bespoke owner code, authored by hand once the plugin's
@@ -212,7 +211,7 @@ export async function createPlugin(args = []) {
 
   if (!id) {
     console.error("❌ Error: Missing plugin id.");
-    console.error("   Usage: total-recall plugin create <id> [--from-skill <path>] [--capability] [--name <name>] [--description <desc>] [--category <cat>] [--global]\n");
+    console.error("   Usage: total-recall plugin create <id> [--from-skill <path>] [--capability] [--name <name>] [--description <desc>] [--category <cat>]\n");
     process.exit(1);
   }
 
@@ -226,7 +225,7 @@ export async function createPlugin(args = []) {
     if (!taskCommand || !/^[a-z][a-z0-9-]*$/.test(taskCommand) || !taskSchedule || !taskIntent) {
       throw new Error('--with-task requires --task-command <subcommand>, --task-schedule "<five-field cron>", and --task-intent <description>');
     }
-    parseCron(taskSchedule);
+    if (!isCronExpression(taskSchedule)) throw new Error(`--task-schedule must be a five-field cron expression, got "${taskSchedule}"`);
   } else if (taskCommand || taskSchedule || taskIntent) {
     throw new Error('--task-* options require --with-task');
   }
@@ -589,7 +588,7 @@ test('every file the manifest references exists', () => {
   // ── Install: a link to the repo, so the repo is what runs ───────────────
   let installed = false;
   if (!skipInstall) {
-    await installPlugin(pluginDir, { link: true, global: isGlobal, projectRoot: process.cwd() });
+    await installPlugin(pluginDir, { link: true, projectRoot: process.cwd() });
     installed = true;
   }
 
@@ -613,7 +612,7 @@ test('every file the manifest references exists', () => {
   if (withCli) {
     console.log(`   CLI Handler: \x1b[32m${path.join(pluginDir, "cli.mjs")}\x1b[0m`);
   }
-  console.log(`   Installed:  ${installed ? `linked into ${isGlobal ? 'the global' : 'this project\'s'} plugins` : 'no (--no-install)'}`);
+  console.log(`   Installed:  ${installed ? `linked into the shared plugin folder` : 'no (--no-install)'}`);
   console.log(`   GitHub:     ${githubUrl || (createGithub ? 'creation failed' : 'not created (re-run with --github, or: gh repo create tr-plugin-' + id + ' --private --source ' + pluginDir + ')')}`);
   console.log(`\nNext steps:`);
   console.log(`   Test:    \x1b[32mcd ${pluginDir} && npm test\x1b[0m`);

package/src/cli/plugin/index.mjs

@@ -27,8 +27,11 @@ Commands:
   list                      Installed plugins (project & global) with source and sharing
   library [--plugin ID]      Installed CLI operation library (--json for agents)
   refresh                   Rebuild installed command inventories and instruction surfaces
-  copies [dir] [--apply]    Audit repository copies of shared defaults. --apply deletes only
-                            bundled matches. Add --archive-stale to preserve older differing copies.
+  copies [dir] [--apply]    Audit repository copies of shared defaults and shadow links. --apply
+                            deletes bundled matches, unlinks shadows (on/off records are kept)
+                            and removes install records of plugins installed nowhere.
+                            Add --archive-stale to preserve older differing copies, and
+                            --drop-repo-only to delete plugins that exist only in the repository.
   replacements [--prune] [--keep N] [--project] [--json]
                             Copies kept by install --replace (default: shared folder). Reports
                             the space; --prune keeps the newest N per plugin (default 1) and
@@ -49,7 +52,8 @@ Commands:
                               <path>              a local directory
                               --link, -l    Symlink a local directory instead of copying
                               --replace     Replace an install, retain previous source and restore on failure
-                              --global, -g  Install for every project on this machine
+                            Every plugin installs into the shared folder for all repositories;
+                            a repository switches it with 'plugin on|off <id>'.
   update [--check] [--json]  Reinstall every plugin whose git repo, mesh peer or source
                             directory moved ahead (--check only reports; also runs hourly
                             in 'update --automatic')
@@ -57,7 +61,7 @@ Commands:
   unshare <id>              Stop offering it
   publish <id>              Publish plugin to the Store and lock release (--no-lock)
   monetize <id>             Configure plugin pricing, period, and payout recipient
-  remove <id>               Uninstall (--global for the machine-wide copy)
+  remove <id>               Uninstall from the shared folder
   license <id> [cmd]        Check or activate plugin license (status, activate, checkout, verify)
   info <id>                 Manifest, provenance, hash and task history
   vendor <source> [dir]     Add a plugin to this project as a brick (default bricks/<id>); the
@@ -80,10 +84,10 @@ Commands:
 
 Examples:
   npx total-recall plugin available --use-case software-development
-  npx total-recall plugin install git-sentinel
-  npx total-recall plugin share git-sentinel
+  npx total-recall plugin install git
+  npx total-recall plugin share git
   npx total-recall plugin peers
-  npx total-recall plugin install peer:mac-mini/git-sentinel
+  npx total-recall plugin install peer:mac-mini/git
   npx total-recall plugin create reading-list --use-case research --with-cli
 `);
 }

package/src/cli/plugin/install.mjs

@@ -2,18 +2,22 @@ import { installPlugin as install } from '../../core/plugin-distribution.mjs';
 import { syncPluginCommands } from '../command.mjs';
 
 export async function installPlugin(args = []) {
-  const isGlobal = args.includes('--global') || args.includes('-g');
+  // Every plugin installs into the shared folder; `--global` is accepted and changes nothing.
   const isLink = args.includes('--link') || args.includes('-l');
   const source = args.find(a => !a.startsWith('-'));
 
+  if (args.includes('--project')) {
+    console.error("❌ Plugins are installed only in the shared folder. In a repository, switch one with 'total-recall plugin on|off <id>'.");
+    process.exit(1);
+  }
   if (!source) {
     console.error('❌ Error: Missing plugin source.');
-    console.error('   Usage: total-recall plugin install <bundled-id | share-link | peer:<host>/<id> | git-url | path> [--link] [--global]\n');
+    console.error('   Usage: total-recall plugin install <bundled-id | share-link | peer:<host>/<id> | git-url | path> [--link]\n');
     process.exit(1);
   }
 
   try {
-    const result = await install(source, { projectRoot: process.cwd(), global: isGlobal, link: isLink, replace:args.includes('--replace') });
+    const result = await install(source, { projectRoot: process.cwd(), link: isLink, replace:args.includes('--replace') });
     const from = result.source.kind === 'peer' ? `peer ${result.source.peer_hostname}` : result.source.kind;
     console.log(`\n✅ Installed '${result.plugin.name}' (id: ${result.plugin.id}, v${result.plugin.version}) from ${from}`);
     console.log(`   Location: ${result.plugin.dir}`);
@@ -24,7 +28,7 @@ export async function installPlugin(args = []) {
     } else if (result.dependencies?.reason && !['no package.json', 'no dependencies declared'].includes(result.dependencies.reason)) {
       console.log(`   Dependencies: NOT installed (${result.dependencies.reason})`);
     }
-    const cmds = syncPluginCommands(result.plugin.dir, { global: isGlobal });
+    const cmds = syncPluginCommands(result.plugin.dir, { global: true });
     if (cmds.created.length) console.log(`   Commands: ${cmds.created.map((c) => `total-recall ${c}`).join(', ')}`);
     for (const c of cmds.skipped) console.log(`   Skipped command '${c.name}': ${c.reason}`);
     console.log('');
@@ -34,17 +38,8 @@ export async function installPlugin(args = []) {
       return;
     }
     const { autoCompileSurfaces } = await import('../../core/auto-compile.mjs');
-    // Compile the layer the plugin actually landed in. `scope` is not enough on
-    // its own: from a directory with no project brain, projectPluginsDir(cwd)
-    // resolves to the global plugins dir, so a plugin installed into the global
-    // brain still reports scope 'project'. Ask the resolver whether a project
-    // brain exists at all, and otherwise fall back to the global layer — the one
-    // that was really written. Assuming 'project' compiled nothing and printed
-    // "Auto-compile failed: No project brain found" after a successful install.
-    const { resolveBrainDir } = await import('../agent-dir.mjs');
-    let targetLayer = 'global';
-    try { resolveBrainDir('project'); targetLayer = 'project'; } catch { targetLayer = 'global'; }
-    if (!await autoCompileSurfaces({ layer: targetLayer, semantic: false, force: true })) process.exitCode = 1;
+    // The plugin landed in the shared folder, so the global layer is the one to compile.
+    if (!await autoCompileSurfaces({ layer: 'global', semantic: false, force: true })) process.exitCode = 1;
   } catch (err) {
     console.error(`❌ ${err.message}`);
     process.exit(1);

package/src/cli/plugin/remove.mjs

@@ -8,7 +8,7 @@ export async function removePlugin(args = []) {
 
   if (!id) {
     console.error('❌ Error: Missing plugin ID to remove.');
-    console.error('   Usage: total-recall plugin remove <id> [--global]\n');
+    console.error('   Usage: total-recall plugin remove <id>\n');
     process.exit(1);
   }
 

package/src/cli/plugin/search.mjs

@@ -22,7 +22,7 @@ function parseArgs(args) {
  * `includes` makes a short query match inside unrelated words: searching "git"
  * returned the signing plugin, whose description begins "Digital agreement…".
  * A hit inside a word is only accepted at a word start so that real substrings
- * still work ("sent" finds "git-sentinel") without matching "digital".
+ * still work ("qual" finds "code-quality") without matching "digital".
  */
 function matches(p, query, useCase) {
   if (useCase && !(p.use_cases || []).includes(useCase)) return false;
@@ -32,7 +32,7 @@ function matches(p, query, useCase) {
   const words = query.split(/\s+/).filter(Boolean);
   return words.every((word) => {
     const escaped = word.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    // Anchor at a word start so "sent" matches "git-sentinel" but "git" does
+    // Anchor at a word start so "qual" matches "code-quality" but "git" does
     // not match "digital".
     const bounded = new RegExp(`(^|[^a-z0-9])${escaped}`, 'i');
     return haystacks.some((h) => bounded.test(h) || h.startsWith(word));

package/src/cli/preflight.mjs

@@ -1,16 +1,18 @@
 import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
+import { ensureDependencies } from '../core/ensure-dependencies.mjs';
 import { detectProjectBrain } from '../core/brain-locate.mjs';
 import { globalBrainDirFor, isBrainEnabled } from '../core/brain-registry.mjs';
 import { GATE_MODES, gateConfigPath, projectBrainDir, readGateLayers, resolveGateMode, writeGateMode } from '../core/gate-mode.mjs';
 import { installHarnessHooks, loadGateAdapters } from '../core/harness-hooks.mjs';
-import { ackDirectory, capsuleVerb, decide, isAckCommand, isCheckCommand, isRouteCommand, isSubagentPayload, nativeToolOf, sessionOf, SWEEP_CONSULT_MS, whenGateFails } from '../core/preflight-gate.mjs';
+import { ackDirectory, capsuleVerb, decide, gatePackageBroken, isAckCommand, isCheckCommand, isRouteCommand, isSubagentPayload, nativeToolOf, sessionOf, SWEEP_CONSULT_MS, whenGateFails } from '../core/preflight-gate.mjs';
 import { ACK_COMMAND, acknowledge, checkAgentReceipt, checkAnyReceipt, findRoot, forgetCapsuleDeliveries, lastArrivalMs, lastCapsuleDelivery, lastConsultMs, lastRoutedMs, lastRouteWarnedMs, lastSessionAck, markArrival, markDelegated, markRouted, markRouteWarned, markSessionAck, noteCaller, recordDecision, sessionHasStanding, sessionKey, readDecisions, takeCaller } from '../core/preflight-receipt.mjs';
 
 const USAGE = `Usage: total-recall preflight <command>
   ack --task "<task>" [--action read,edit,test] [--json]   Record a receipt after context ready:true and rules verify, and print the capsule.
                                                             Prints one line instead when this session received the same rules and skills within 2 hours
+                                                            Restores missing or stale locked dependencies for edit/test actions
   check [--json]                                            Exit 1 unless a fresh receipt covers this agent, wherever it acknowledged.
                                                             Run by hand, it reports this directory's receipt
   gate [--harness <id>]                                     Hook entry: read a call on stdin, answer allow or deny (exit 2 on deny)
@@ -81,12 +83,23 @@ async function ack(args) {
   const task = flag(args, '--task') || '';
   const actions = flag(args, '--action') || 'read,edit,test';
   const result = acknowledge({ root, task, actions, maxAgeMs: await configuredMaxAgeMs(), session: takeCaller(root, 'ack', { task }) });
+  const needsDependencies = actions.split(',').some(action => ['edit', 'test'].includes(action.trim()));
+  const dependencies = result.ok && needsDependencies ? await ensureDependencies(root, { reason: `preflight:${actions}` }) : null;
+  const ok = result.ok && dependencies?.ok !== false;
   if (args.includes('--json')) {
-    console.log(JSON.stringify({ ok: result.ok, problems: result.problems, receipt: result.file || null, capsule: result.capsule ?? null, unchanged: Boolean(result.unchanged) }));
-    if (!result.ok) process.exitCode = 1;
+    console.log(JSON.stringify({ ok, problems: [...result.problems, ...(dependencies?.ok === false ? [`dependencies: ${dependencies.error}`] : [])], receipt: result.file || null, capsule: result.capsule ?? null, unchanged: Boolean(result.unchanged), dependencies }));
+    if (!ok) process.exitCode = 1;
     return;
   }
   if (!result.ok) return printFailure(result.problems);
+  if (dependencies) {
+    const detail = dependencies.ok ? (dependencies.command?.join(' ') || dependencies.trigger) : dependencies.error;
+    console.log(`  dependencies: ${dependencies.status} — ${detail}`);
+    if (!dependencies.ok) {
+      console.error('✖ Dependency install failed. Repair dependencies before edit or test work. The instruction receipt is recorded.');
+      process.exitCode = 1;
+    }
+  }
   if (result.unchanged) {
     const age = result.unchanged.ageMs < 60000 ? 'less than a minute ago' : `${Math.round(result.unchanged.ageMs / 60000)} minutes ago`;
     console.log(`✔ tr-preflight recorded: rules and skills are unchanged since this session received the capsule ${age}, so there is nothing new to read. If your task is new, or you no longer have the capsule, run: total-recall context "<task>" --action ${actions}`);
@@ -398,6 +411,8 @@ function evaluate(call, options = {}) {
 }
 
 function judge(call, { harness, readablePaths, session = null, subagent = false, nativeTool = null } = {}) {
+  const broken = gatePackageBroken();
+  if (broken) return whenGateFails(call, new Error(broken));
   const root = findRoot(call.cwd || process.cwd());
   const limit = envMaxAgeMs();
   const declared = readGateDeclarations();
@@ -584,12 +599,10 @@ async function mode(args) {
 
 export default async function preflight(args = []) {
   const [first = '--help'] = args;
-  if (first === '--help' || first === '-h' || first === 'help') return console.log(USAGE);
+  if (first === '--help' || first === '-h' || first === 'help' || args.includes('--help') || args.includes('-h')) return console.log(USAGE);
   // Original `tr-preflight` forms.
   if (first === '--ack' || first === 'ack') return ack(args);
   if (first === '--check' || first === 'check') return check(args);
-  // Help never performs the subcommand: `install --help` once rewrote the harness settings (C-019).
-  if (args.includes('--help') || args.includes('-h')) return console.log(USAGE);
   if (first === 'gate') return gate(args.slice(1));
   if (first === 'remind') return remind(args);
   if (first === 'session-start') return sessionStart();

package/src/cli/proposals.mjs

@@ -208,7 +208,7 @@ export default async function proposals(args) {
         console.log(`  ${String(days).padStart(4)}d  [i${n.importance}]  ${n.slug}`);
       }
       if (stale.length > 40) console.log(`\n  … and ${stale.length - 40} more.`);
-      console.log('\n  The dream cycle queues these for research automatically.\n');
+      console.log('\n  This query is read-only. Request research explicitly for a node that needs verification.\n');
       return;
     }
 

package/src/cli/recall.mjs

@@ -1,5 +1,22 @@
 import { resolveAgentDir, resolveBrainDir, parseLayerFlag, getBothBrains } from './agent-dir.mjs';
 import path from 'node:path';
+import fs from 'node:fs';
+
+/** One brain search shared by recall and paired evaluation. Does not record access. */
+export async function searchRecallBrain(query, { semantic = false, forceFast = false, field = false, ...options } = {}) {
+  let rankResults = null;
+  if (field) {
+    const { loadField, rankWithField } = await import('../core/vector-field.mjs');
+    const compiled = loadField(options.derivedDir);
+    if (!compiled) throw new Error('Vector field missing or corrupt. Run total-recall recall --compile-field first.');
+    rankResults = results => rankWithField(results, { field: compiled, derivedDir: options.derivedDir });
+  }
+  const { fastSearch } = await import('../core/fast-recall.mjs');
+  const fastResults = fastSearch(query, { ...options, fullText: !forceFast, rankResults });
+  if (!semantic || fastResults.some(result => (result.base_score ?? result.score) === 1) || forceFast) return fastResults;
+  const { semanticSearch } = await import('../core/search.mjs');
+  return semanticSearch(query, { ...options, rankResults });
+}
 
 function printHelp() {
   console.log(`
@@ -20,8 +37,18 @@ function printHelp() {
     --fast                     Force frontmatter-only search without semantic fallback
     --local                    Search indexed body text without a provider (default)
     --semantic                 Opt into semantic enrichment
+    --field                    Re-rank candidates with the compiled field (opt-in, local)
+    --compile-field            Compile existing embeddings into the selected brain's field
+    --evaluate-field <file>     Compare local recall with/without field on fixed JSON queries
     --timings                  Print local stage timings on stderr
 
+  Field operations (support --project/--global, --top-k, --format):
+    total-recall recall --compile-field --project
+    total-recall recall --evaluate-field queries.json --project --format json
+    Query file: [{ "query": "search terms", "relevant": ["expected-slug"] }]
+    Overlap@k = shared slugs / k. Hit rate@k = queries with a relevant slug / queries.
+    Evaluation does not record access. It uses local recall and requires a compiled field.
+
   Examples:
     npx total-recall recall "Never run tsc directly"
     npx total-recall recall "Express server port" --top-k 3
@@ -55,6 +82,7 @@ export default async function recall(args) {
   let forceFast = false;
   let semantic = false;
   let timings = false;
+  let field = false;
 
   for (let i = 1; i < remainingArgs.length; i++) {
     const arg = remainingArgs[i];
@@ -111,8 +139,11 @@ export default async function recall(args) {
       semantic = false;
     } else if (arg === '--timings') {
       timings = true;
+    } else if (arg === '--field') {
+      field = true;
     }
   }
+  top_k = Math.max(1, Math.min(20, top_k));
 
   // Determine which brains to search
   const brains = getBothBrains();
@@ -152,6 +183,26 @@ export default async function recall(args) {
   }
 
   try {
+    if (query === '--compile-field' || query === '--evaluate-field') {
+      const reports = [];
+      const cases = query === '--evaluate-field'
+        ? JSON.parse(fs.readFileSync(remainingArgs[1], 'utf8')) : null;
+      for (const target of searchTargets) {
+        const options = { vaultDir: path.join(target.brainDir, 'memory-vault'),
+          derivedDir: path.join(target.brainDir, 'memory-derived'), top_k, includeSessions: false };
+        if (query === '--evaluate-field') {
+          const { evaluateField } = await import('../core/field-evaluation.mjs');
+          reports.push({ brain: target.label, ...await evaluateField(cases, {
+            topK: top_k, search: (q, enabled) => searchRecallBrain(q, { ...options, field: enabled }),
+          }) });
+        } else {
+          const { compileField } = await import('../core/vector-field.mjs');
+          reports.push({ brain: target.label, ...(await compileField(options)).meta });
+        }
+      }
+      console.log(JSON.stringify(reports, null, 2));
+      return;
+    }
     // Search all target brains and merge results
     let allResults = [];
     let isDegraded = false;
@@ -164,8 +215,7 @@ export default async function recall(args) {
 
       try {
         let results = [];
-        const { fastSearch } = await import('../core/fast-recall.mjs');
-        const fastResults = fastSearch(query, {
+        results = await searchRecallBrain(query, {
           derivedDir,
           vaultDir,
           top_k,
@@ -174,28 +224,12 @@ export default async function recall(args) {
           modality,
           importance,
           priority,
-          fullText: !forceFast,
+          forceFast, semantic, field,
+          includeSessions: includeSessions && target.label !== 'global',
         });
-        if (timings) console.error(JSON.stringify({ brain: target.label, ...fastResults.stats }));
-        if (['missing', 'corrupt', 'metadata-only'].includes(fastResults.stats.index) && !forceFast) {
-          console.error(`Local full-text index for ${target.label}: ${fastResults.stats.index}. Run total-recall compile to rebuild; available metadata results may be incomplete.`);
-        }
-
-        if (!semantic || fastResults.some(result => result.score === 1) || forceFast) {
-          results = fastResults;
-        } else {
-          const { semanticSearch } = await import('../core/search.mjs');
-          results = await semanticSearch(query, {
-            vaultDir,
-            derivedDir,
-            top_k,
-            includeSessions: includeSessions && target.label !== 'global', // sessions only in project/local
-            category,
-            tags,
-            modality,
-            importance,
-            priority
-          });
+        if (timings) console.error(JSON.stringify({ brain: target.label, ...results.stats }));
+        if (['missing', 'corrupt', 'metadata-only'].includes(results.stats?.index) && !forceFast) {
+          console.error(`Local full-text index for ${target.label}: ${results.stats.index}. Run total-recall compile to rebuild; available metadata results may be incomplete.`);
         }
         if (results.degradedTextSearch) {
           isDegraded = true;
@@ -226,6 +260,15 @@ export default async function recall(args) {
     allResults.sort((a, b) => (b.score || 0) - (a.score || 0));
     allResults = allResults.slice(0, top_k);
 
+    // DECAY-01: a recalled memory is a used memory; record it in the brain it came from.
+    try {
+      const { recordAccess } = await import('../core/access-ledger.mjs');
+      for (const target of searchTargets) {
+        const slugs = allResults.filter(r => r._layer === target.label).map(r => r.slug || r.id).filter(Boolean);
+        recordAccess(path.join(target.brainDir, 'memory-derived'), slugs);
+      }
+    } catch { /* access accounting never breaks recall */ }
+
     if (format === 'json') {
       for (const error of searchErrors) console.error(`Search failed for ${error.label}: ${error.message.split('\n')[0]}`);
       if (searchErrors.length && !allResults.length) process.exitCode = 1;

package/src/cli/remember.mjs

@@ -37,6 +37,7 @@ function printHelp() {
     --object <string>         SPO Object (default: brain)
     --related <list>          Comma-separated list of related slugs
     --expires <duration>       TTL for temporary rules (e.g. "7d", "2w", "30d", "6h", "3m")
+    --allow-long              Permit a rule above 800 characters (context:policy also permits it)
     --confined-fact            Create a descriptive fact with generated identity; refresh local search without executable generators
 
   Examples:
@@ -74,9 +75,6 @@ function parseDuration(str) {
   return date;
 }
 
-const RULE_SOFT_LIMIT = 300;
-const RULE_HARD_LIMIT = 800;
-
 export default async function remember(args) {
   // Parse layer flag first
   const { layer: explicitLayer, remainingArgs: layerArgs } = parseLayerFlag(args);
@@ -244,16 +242,6 @@ export default async function remember(args) {
     }
   }
 
-  // Rules load into every task capsule, so they must be brief.
-  if (['invariants', 'preferences', 'anti-patterns'].includes(category) && !tags.includes('context:policy')) {
-    const n = bodyContent.trim().length;
-    if (n > RULE_HARD_LIMIT && !allowLong) {
-      console.error(`❌ Rule is ${n} characters (limit ${RULE_HARD_LIMIT}). Rules must be brief: one or two sentences, no history, dates, quotes or incident detail (save those as a fact). Shorten it, or pass --allow-long.`);
-      process.exit(1);
-    }
-    if (n > RULE_SOFT_LIMIT) console.error(`⚠️  Rule is ${n} characters. Keep rules brief (under ${RULE_SOFT_LIMIT}): state the constraint only, move history and examples to a fact. Shorten with: total-recall edit <slug> "<shorter>"`);
-  }
-
   const resolvedAgentDir = resolveAgentDir(layer);
   const resolvedBrainDir = resolveBrainDir(layer);
   const skillsDir = path.join(resolvedAgentDir, 'skills');
@@ -344,7 +332,7 @@ export default async function remember(args) {
 
   // Saving memory never optimizes or archives other canonical documents.
 
-  const vaultResult = await writeNodeValidatedAsync(node, vaultDir);
+  const vaultResult = await writeNodeValidatedAsync(node, vaultDir, { allowLong });
   if (!vaultResult.success) {
     console.error(`  ❌ Validation failed: ${vaultResult.validation.errors.join('; ')}`);
     if (vaultResult.repair) {
@@ -355,6 +343,7 @@ export default async function remember(args) {
     }
     process.exit(1);
   }
+  for (const warning of vaultResult.validation?.warnings || []) console.error(`  ⚠️  ${warning}`);
   console.log(`  ✅ Permanent SSSS memory node created ${layerLabel} in vault: memory-vault/${category}/${finalSlug}.md`);
 
   // Automatically recompile surfaces and local indexes

package/src/cli/server.mjs

@@ -0,0 +1,18 @@
+import { ensureServerService } from '../core/server-service.mjs';
+
+export default async function server(args = []) {
+  if (!args.length || args.includes('--help') || args.includes('-h')) {
+    console.log('Usage: total-recall server ensure [--dry-run]\nRepair this package\'s macOS LaunchAgent and verify its process. --dry-run prints the plist diff without changes. On systemd hosts, server-release owns the server.');
+    return;
+  }
+  if (args[0] !== 'ensure' || args.slice(1).some(arg => arg !== '--dry-run')) {
+    console.error('Usage: total-recall server ensure [--dry-run]');
+    process.exitCode = 2;
+    return;
+  }
+  try {
+    const result = await ensureServerService({ dryRun: args.includes('--dry-run') });
+    console.log(result.diff || result.reason || `Server verified: pid ${result.pid}, ${result.entry}`);
+    return result;
+  } catch (error) { console.error(error.message); process.exitCode = 1; }
+}

package/src/cli/startup.mjs

@@ -36,6 +36,7 @@ export default async function startup(args = []) {
   if (args.includes('--json')) console.log(JSON.stringify(report, null, 2));
   else {
     console.log(`Startup: required plugins ${report.required_plugins?.status || 'unknown'}; server ${report.server?.status || 'unknown'}; brain ${report.brain?.status || 'unknown'}; daemon ${report.daemon?.status || 'unknown'}; SSSS tooling ${report.ssss?.status || 'unknown'}; app ${report.app?.status || 'unknown'}`);
+    if (report.server?.reason) console.log(`Server: ${report.server.reason}`);
     if (report.server?.stale) console.log(`Server: running ${report.server.stale.running} with ${report.server.stale.on_disk} on disk; it has not been replaced.`);
     for (const error of report.required_plugins?.errors || []) console.log(`Required plugin: ${error}`);
     const harnesses = await queryHarnessUsage().catch(() => []);

package/src/cli/task.mjs

@@ -34,10 +34,11 @@ function printHelp() {
     show <slug>        Show one task
     cancel <slug>      Cancel a task, optionally with --expected-status pending
     executors          List registered executor ids
+    idle               Enqueue leader maintenance from an automations manifest task
 
   add options:
     --kind <k>         memory | research | maintenance | system | custom (default: custom)
-    --executor <id>    dream | custom | research | session-ingest | surface-compile | prune
+    --executor <id>    dream | custom | research | legacy
     --priority <p>     high | normal | low | absolute | 0-100 (default: normal)
     --cap <list>       Comma-separated capabilities (default: vault:read)
                        Use vault:write to draft results into memory-inbox
@@ -58,7 +59,7 @@ function printHelp() {
 
   Policy:
     shell / net:post capabilities are denied by default.
-    Proactive idle fill is off unless TR_IDLE_TASKS=1.
+    Empty queues stay empty. Automations owns the idle schedule.
 `);
 }
 
@@ -168,6 +169,12 @@ export default async function taskCli(argv) {
   const brainDir = resolveBrainDir(layer);
   const queueDir = resolveQueueDir(brainDir);
 
+  if (opts.command === 'idle') {
+    const { enqueueScheduledIdleTasks } = await import('../core/scheduler.mjs');
+    console.log(JSON.stringify(await enqueueScheduledIdleTasks({ queueDir, vaultDir: path.join(brainDir, 'memory-vault') })));
+    return;
+  }
+
   if (opts.command === 'executors') {
     console.log('\n  Registered executors:\n');
     for (const id of listExecutorIds()) {

package/src/cli/update.mjs

@@ -50,6 +50,7 @@ export function parseArgs(args) {
     else if (a === '--port' && args[i + 1]) opts.port = Number(args[++i]);
     else if (a === '--no-build') opts.noBuild = true;
     else if (a === '--all-brains') opts.allBrains = true;
+    else if (a === '--install-missing') opts.installMissing = true;
     else if (a === '--json') opts.json = true;
     else if (a === '--automatic') opts.automatic = true;
     else if (a === '--status') opts.status = true;
@@ -70,9 +71,11 @@ function printHelp() {
     total-recall update --apply --force Ignore throttle / disabled flag
     total-recall update --repo <path>   Include extra root (repeatable)
     total-recall update --all-brains    Plan SSSS + Total Recall updates, including plugins/nested packages
-    total-recall update --all-brains --apply [--json]
+    total-recall update --all-brains --apply [--install-missing] [--json]
         Pin the same published versions, use npm/pnpm, replace shared dependency
         links with independent local installs, and verify every resolved version.
+        A checkout with no node_modules keeps none: only its pin is updated.
+        --install-missing installs those trees too (never done automatically).
         A plugin checkout linked into a brain but not registered as a project is
         only installed here: its dev dependencies are skipped (it runs under the
         shared install) and its runtime ones update with --omit=dev, without
@@ -127,7 +130,7 @@ export default async function update(args = []) {
 
   if (opts.allBrains) {
     const summary = await updateAllBrains({ brainDir, roots: opts.repos,
-      dryRun: !opts.apply || opts.dryRun, ensureDefaults: true });
+      dryRun: !opts.apply || opts.dryRun, ensureDefaults: true, installMissing: opts.installMissing === true });
     if (summary.failed) process.exitCode = 1;
     if (opts.apply && !opts.dryRun) {
       const hooks = await installHarnessHooks({ log: (line) => { if (!opts.json) console.log(line); } });
@@ -137,6 +140,7 @@ export default async function update(args = []) {
     if (opts.json) console.log(JSON.stringify(summary, null, 2));
     else {
       console.log(`\n  Uniform brain updates: ${summary.consumer_count || 0} consumers`);
+      console.log(`  Missing: ${summary.not_installed || 0}; current: ${summary.up_to_date || 0}; would update: ${summary.would_update || 0}; updated: ${summary.updated || 0}; failed: ${summary.failed || 0}`);
       if (summary.reason) console.log(`  ${summary.reason}`);
       for (const row of summary.results) {
         console.log(`  ${row.root}: ${row.status}`);