open-loam 0.1.1 → 0.3.0

data/lib/{loam → open_loam}/configs.rb

@@ -1,18 +1,18 @@
-module Loam
+module OpenLoam
   # The one way to read and write per-tenant settings.
   #
-  #   Loam::Configs.get("rental.late_fee_per_day")          # resolved for the current tenant
-  #   Loam::Configs.set("rental.late_fee_per_day", 45)      # this tenant's override
-  #   Loam::Configs.set("rental.currency", "PLN", scope: :global)
-  #   Loam::Configs.reset("rental.late_fee_per_day")        # drop the override → fall back
+  #   OpenLoam::Configs.get("rental.late_fee_per_day")          # resolved for the current tenant
+  #   OpenLoam::Configs.set("rental.late_fee_per_day", 45)      # this tenant's override
+  #   OpenLoam::Configs.set("rental.currency", "PLN", scope: :global)
+  #   OpenLoam::Configs.reset("rental.late_fee_per_day")        # drop the override → fall back
   #
   # Resolution order, most specific first:
   #   1. the current tenant's OVERRIDE row (tenant_id = current tenant)
   #   2. the GLOBAL row (tenant_id NULL)
-  #   3. the declared default in Loam.config_defaults[key]
+  #   3. the declared default in OpenLoam.config_defaults[key]
   #   4. the `default:` argument (nil)
   #
-  # Reads are memoized per request in Loam::Current.config_cache, keyed by
+  # Reads are memoized per request in OpenLoam::Current.config_cache, keyed by
   # [key, tenant_id], and the whole cache is dropped on any write. That is the
   # deliberately-simple prototype cache; a Rails.cache-backed layer shared across
   # requests is the scaling path, and it would slot in behind this same API.
@@ -36,7 +36,7 @@ module Loam
       end
 
       # Write a setting. scope: :tenant writes the current tenant's override and
-      # requires a tenant in context (a missing one raises, like every Loam
+      # requires a tenant in context (a missing one raises, like every OpenLoam
       # write); scope: :global writes the app-wide row (tenant_id NULL). Upsert.
       def set(key, value, scope: :tenant)
         key = key.to_s
@@ -66,8 +66,8 @@ module Loam
       # defaults, plus any global or current-tenant rows already written. Sorted
       # and de-duplicated, for the settings screen.
       def defined_keys
-        rows = Loam::Config.where(tenant_id: [nil, Loam.tenant&.id]).distinct.pluck(:key)
-        (Loam.config_defaults.keys + rows).map(&:to_s).uniq.sort
+        rows = OpenLoam::Config.where(tenant_id: [nil, OpenLoam.tenant&.id]).distinct.pluck(:key)
+        (OpenLoam.config_defaults.keys + rows).map(&:to_s).uniq.sort
       end
 
       private
@@ -76,39 +76,39 @@ module Loam
       # the caller then applies its own `default:` without caching it.
       def resolve(key)
         if (tenant_id = current_tenant_id)
-          override = Loam::Config.find_by(key: key, tenant_id: tenant_id)
+          override = OpenLoam::Config.find_by(key: key, tenant_id: tenant_id)
           return [true, override.value_json] if override
         end
 
-        global = Loam::Config.find_by(key: key, tenant_id: nil)
+        global = OpenLoam::Config.find_by(key: key, tenant_id: nil)
         return [true, global.value_json] if global
 
-        return [true, Loam.config_defaults[key]] if Loam.config_defaults.key?(key)
+        return [true, OpenLoam.config_defaults[key]] if OpenLoam.config_defaults.key?(key)
 
         [false, nil]
       end
 
       # The row(s) a write/read targets. :global is the tenant_id NULL row;
       # :tenant is the current tenant's — which requires a tenant in context,
-      # so Loam.tenant! raises MissingTenantError when there is none.
+      # so OpenLoam.tenant! raises MissingTenantError when there is none.
       def row_for(key, scope)
         case scope
-        when :global then Loam::Config.where(key: key, tenant_id: nil)
-        when :tenant then Loam::Config.where(key: key, tenant_id: Loam.tenant!.id)
+        when :global then OpenLoam::Config.where(key: key, tenant_id: nil)
+        when :tenant then OpenLoam::Config.where(key: key, tenant_id: OpenLoam.tenant!.id)
         else raise ArgumentError, "unknown config scope #{scope.inspect} (use :tenant or :global)"
         end
       end
 
       def current_tenant_id
-        Loam.tenant&.id
+        OpenLoam.tenant&.id
       end
 
       def cache
-        Loam::Current.config_cache ||= {}
+        OpenLoam::Current.config_cache ||= {}
       end
 
       def clear_cache
-        Loam::Current.config_cache = {}
+        OpenLoam::Current.config_cache = {}
       end
     end
   end

data/lib/{loam → open_loam}/cron.rb

@@ -1,9 +1,9 @@
 require "set"
 
-module Loam
+module OpenLoam
   # A small, dependency-free "next run" calculator for a standard 5-field cron
   # expression ("min hour dom month dow") plus an "interval:N" (every N seconds)
-  # form — same stdlib-only spirit as Loam::Totp / Loam::Base32. Timezone-aware;
+  # form — same stdlib-only spirit as OpenLoam::Totp / OpenLoam::Base32. Timezone-aware;
   # always returns UTC. Supports `*`, lists (`1,15`), ranges (`1-5`), and steps
   # (`*/15`, `0-30/10`), and the classic cron day-of-month / day-of-week OR quirk
   # (when BOTH are restricted, a match on either fires).

data/lib/{loam → open_loam}/csv.rb

@@ -1,9 +1,9 @@
-module Loam
+module OpenLoam
   # CSV formula-injection defense. A cell whose value starts with =, +, -, @, or
   # a tab/CR is treated as a FORMULA by Excel/Google Sheets when the file is
   # opened — so `=cmd|...` or `=HYPERLINK(...)` in imported/exported data can run.
   # Prefixing such a value with a single quote neutralizes it while leaving the
-  # visible text intact. Applied on every CSV cell Loam writes (export + the
+  # visible text intact. Applied on every CSV cell OpenLoam writes (export + the
   # import error file).
   module Csv
     DANGEROUS = /\A[=+\-@\t\r]/

data/lib/{loam → open_loam}/current.rb

@@ -1,20 +1,20 @@
 require "active_support/current_attributes"
 
-module Loam
+module OpenLoam
   # Per-request (and per-job) execution context. Every tenant-scoped query,
   # audit record, and published event reads from here.
   class Current < ActiveSupport::CurrentAttributes
-    # config_cache memoizes resolved Loam::Configs values for the duration of
+    # config_cache memoizes resolved OpenLoam::Configs values for the duration of
     # one request/job, keyed by [key, tenant_id]. It resets with everything else
     # here, so a value can never be read stale across requests.
     #
-    # mutation_mode is the approval-gate seam (Loam::PendingActions): nil/:direct
+    # mutation_mode is the approval-gate seam (OpenLoam::PendingActions): nil/:direct
     # means writes commit normally; :confirm means a caller (an MCP tool acting
     # for an AI agent) stages writes for human approval instead. It lives here so
     # it is per-request and resets automatically.
-    # dictionary_cache memoizes resolved Loam::Dictionaries lookups for one
+    # dictionary_cache memoizes resolved OpenLoam::Dictionaries lookups for one
     # request/job, keyed by [kind, key, tenant_id] — same posture as config_cache.
-    # locale is the current content-translation language (Loam::Translatable) —
+    # locale is the current content-translation language (OpenLoam::Translatable) —
     # request state like tenant/actor, set in a before_action and reset here.
     attribute :tenant, :actor, :config_cache, :mutation_mode, :dictionary_cache, :locale
   end

data/lib/{loam → open_loam}/custom_field_index.rb

@@ -1,12 +1,12 @@
-module Loam
-  # The read-model index for custom fields (Loam::CustomFieldValue) — a typed-EAV
+module OpenLoam
+  # The read-model index for custom fields (OpenLoam::CustomFieldValue) — a typed-EAV
   # projection that makes custom-field filter/sort/search index-backed.
   #
-  #   Loam::CustomFieldIndex.filter(DamageReport, "severity", "eq", "critical")  # a relation
-  #   Loam::CustomFieldIndex.order(DamageReport, "severity", :asc)
-  #   Loam::CustomFieldIndex.reindex(DamageReport)                               # rebuild
+  #   OpenLoam::CustomFieldIndex.filter(DamageReport, "severity", "eq", "critical")  # a relation
+  #   OpenLoam::CustomFieldIndex.order(DamageReport, "severity", :asc)
+  #   OpenLoam::CustomFieldIndex.reindex(DamageReport)                               # rebuild
   #
-  # SAFETY: `field_key` must name a real Loam::FieldDefinition (no arbitrary
+  # SAFETY: `field_key` must name a real OpenLoam::FieldDefinition (no arbitrary
   # keys); values are cast to the declared type; queries are tenant-scoped
   # throughout (index rows carry tenant_id, the model relation is default-scoped),
   # so a filter can't reach across tenants. Encrypted data lives in real columns,
@@ -16,7 +16,7 @@ module Loam
 
     module_function
 
-    # --- maintenance (called from Loam::CustomFields) ---
+    # --- maintenance (called from OpenLoam::CustomFields) ---
 
     # Re-project one record's custom fields (delete + insert). Soft-delete keeps
     # the rows (the filter's base scope hides the record anyway — the same
@@ -26,18 +26,18 @@ module Loam
       return unless model.respond_to?(:custom_field_definitions)
 
       type = index_type(model)
-      Loam::CustomFieldValue.where(indexable_type: type, indexable_id: record.id).delete_all
+      OpenLoam::CustomFieldValue.where(indexable_type: type, indexable_id: record.id).delete_all
 
       rows = model.custom_field_definitions.filter_map { |definition| row_for(record, definition, type) }
-      Loam::CustomFieldValue.insert_all(rows) if rows.any?
+      OpenLoam::CustomFieldValue.insert_all(rows) if rows.any?
     end
 
     def remove(record)
-      Loam::CustomFieldValue.where(indexable_type: index_type(record.class), indexable_id: record.id).delete_all
+      OpenLoam::CustomFieldValue.where(indexable_type: index_type(record.class), indexable_id: record.id).delete_all
     end
 
     def reindex(model)
-      Loam::CustomFieldValue.where(indexable_type: index_type(model)).delete_all
+      OpenLoam::CustomFieldValue.where(indexable_type: index_type(model)).delete_all
       model.find_each { |record| project(record) }
     end
 
@@ -47,7 +47,7 @@ module Loam
       field_key = field_key.to_s
       refuse_unknown_field!(model, field_key)
       refuse_unreadable_field!(model, field_key)
-      raise Loam::Error, "unknown custom-field op #{op.inspect}" unless OPS.include?(op.to_s)
+      raise OpenLoam::Error, "unknown custom-field op #{op.inspect}" unless OPS.include?(op.to_s)
 
       if covered?(model, field_key)
         self.partial = false
@@ -89,12 +89,12 @@ module Loam
         self.partial = true
         schedule_reindex(model)
       end
-      table = Loam::CustomFieldValue.table_name
+      table = OpenLoam::CustomFieldValue.table_name
       conn = model.connection
       join = "LEFT JOIN #{table} ON #{table}.indexable_type = #{conn.quote(index_type(model))} " \
              "AND #{table}.indexable_id = #{model.table_name}.id " \
              "AND #{table}.field_key = #{conn.quote(field_key.to_s)} " \
-             "AND #{table}.tenant_id = #{Loam.tenant!.id}"
+             "AND #{table}.tenant_id = #{conn.quote(OpenLoam.tenant!.id)}"
       model.joins(join).order(Arel.sql("#{table}.value_text #{dir.to_s.casecmp('desc').zero? ? 'DESC' : 'ASC'}"))
     end
 
@@ -132,22 +132,22 @@ module Loam
     # Was the last filter/order served over an incomplete index? The admin surfaces
     # this as an honest "results may be incomplete, reindexing…".
     def partial?
-      Thread.current[:loam_index_partial] == true
+      Thread.current[:open_loam_index_partial] == true
     end
 
     def partial=(value)
-      Thread.current[:loam_index_partial] = value
+      Thread.current[:open_loam_index_partial] = value
     end
 
     # Enqueue a background reindex to heal a gap — DEDUPED so a hot gappy field
     # doesn't enqueue one per request. In-process dedup here (single-process
     # prototype); a DB/cache marker is the multi-process path.
     def schedule_reindex(model)
-      key = [ Loam.tenant!.id, model.base_class.name ]
+      key = [ OpenLoam.tenant!.id, model.base_class.name ]
       return if pending_reindex.include?(key)
 
       pending_reindex << key
-      Loam::CustomFieldReindexJob.perform_later(Loam.tenant!.id, model.base_class.name)
+      OpenLoam::CustomFieldReindexJob.perform_later(OpenLoam.tenant!.id, model.base_class.name)
     end
 
     def clear_pending(tenant_id, model_name)
@@ -188,7 +188,7 @@ module Loam
     # --- internals ---
 
     def base(model)
-      Loam::CustomFieldValue.where(indexable_type: index_type(model)) # tenant-scoped by default_scope
+      OpenLoam::CustomFieldValue.where(indexable_type: index_type(model)) # tenant-scoped by default_scope
     end
 
     def index_type(model_or_class)
@@ -202,16 +202,19 @@ module Loam
       when "neq"      then rows.where.not(value_text: value.to_s)
       when "contains" then rows.where("value_text LIKE ?", "%#{sanitize_like(value)}%")
       when "present"  then rows.where.not(value_text: [ nil, "" ])
-      when "gt"       then numeric(rows, value, ">")
-      when "gte"      then numeric(rows, value, ">=")
-      when "lt"       then numeric(rows, value, "<")
-      when "lte"      then numeric(rows, value, "<=")
+      when "gt", "gte", "lt", "lte" then numeric(rows, value, op)
       end
     end
 
-    # Numeric comparisons hit the indexed value_number column.
-    def numeric(rows, value, operator)
-      rows.where("value_number #{operator} ?", value.to_f)
+    # Numeric comparisons hit the indexed value_number column. Built through
+    # Arel rather than an interpolated fragment: `op` reaches here from
+    # params[:cf_op], and a comparison operator cannot be a bound parameter, so
+    # the only safe form is one that never becomes a string.
+    NUMERIC_PREDICATES = { "gt" => :gt, "gte" => :gteq, "lt" => :lt, "lte" => :lteq }.freeze
+
+    def numeric(rows, value, op)
+      column = OpenLoam::CustomFieldValue.arel_table[:value_number]
+      rows.where(column.public_send(NUMERIC_PREDICATES.fetch(op), value.to_f))
     end
 
     def row_for(record, definition, type)
@@ -235,7 +238,7 @@ module Loam
 
     def refuse_unknown_field!(model, field_key)
       known = model.respond_to?(:custom_field_definitions) && model.custom_field_definitions.exists?(name: field_key)
-      raise Loam::Error, "no custom field #{field_key.inspect} on #{model.name}" unless known
+      raise OpenLoam::Error, "no custom field #{field_key.inspect} on #{model.name}" unless known
     end
 
     # THE oracle guard: filtering or sorting on a custom field the current role
@@ -243,16 +246,16 @@ module Loam
     # records match. Enforced against the current actor's role; a system/background
     # context (no actor — reindex, a business rule) is trusted and not gated.
     def refuse_unreadable_field!(model, field_key)
-      actor = Loam::Current.actor
+      actor = OpenLoam::Current.actor
       return if actor.nil?
 
       definition = model.custom_field_definitions.find_by(name: field_key.to_s)
       return if definition.nil? # unknown field is refuse_unknown_field!'s job
 
-      role = Loam::Membership.find_by(user_id: actor.id)&.role
+      role = OpenLoam::Membership.find_by(user_id: actor.id)&.role
       return if definition.readable_by?(role)
 
-      raise Loam::FieldAccessError, "custom field #{field_key.inspect} is not readable by #{role.inspect}"
+      raise OpenLoam::FieldAccessError, "custom field #{field_key.inspect} is not readable by #{role.inspect}"
     end
 
     def sanitize_like(value)

data/lib/{loam → open_loam}/custom_fields.rb

@@ -1,35 +1,35 @@
-module Loam
+module OpenLoam
   # Runtime, migration-free fields — stored in the `custom_fields` json
   # column every generated entity table carries. Included automatically by
-  # `rails g loam:entity`. Shape is declared at runtime via a
-  # Loam::FieldDefinition (typically through the admin "Field definitions"
+  # `rails g open_loam:entity`. Shape is declared at runtime via a
+  # OpenLoam::FieldDefinition (typically through the admin "Field definitions"
   # screen), not in code — that's what makes it migration-free.
   #
   #   equipment.custom_field(:serial_number)                # => "SN-123" (cast)
   #   equipment.set_custom_field(:serial_number, "SN-123")
   #
-  # Reading/writing a name with no matching Loam::FieldDefinition for this
-  # tenant + entity raises Loam::UnknownCustomFieldError immediately — the
-  # same "fail loudly at the access site" philosophy as Loam.tenant!.
+  # Reading/writing a name with no matching OpenLoam::FieldDefinition for this
+  # tenant + entity raises OpenLoam::UnknownCustomFieldError immediately — the
+  # same "fail loudly at the access site" philosophy as OpenLoam.tenant!.
   module CustomFields
     extend ActiveSupport::Concern
 
     included do
-      # Keep the read-model index (Loam::CustomFieldIndex) current so custom-field
+      # Keep the read-model index (OpenLoam::CustomFieldIndex) current so custom-field
       # filter/sort is index-backed. Re-project only when the custom_fields column
       # actually changed (a soft-delete touches only deleted_at, so the rows stay
       # and the base scope hides the record — the L-912 posture). A no-op for a
-      # model with no custom_fields column. Guarded by respond_to? so Loam::
+      # model with no custom_fields column. Guarded by respond_to? so OpenLoam::
       # CustomFields stays includable in a plain class for a DSL-only test.
       if respond_to?(:after_save)
-        after_save    :loam_reindex_custom_fields, if: :loam_custom_fields_dirty?
-        after_destroy :loam_deindex_custom_fields
+        after_save    :open_loam_reindex_custom_fields, if: :open_loam_custom_fields_dirty?
+        after_destroy :open_loam_deindex_custom_fields
       end
     end
 
     class_methods do
       def custom_field_definitions
-        Loam::FieldDefinition.where(entity_type: name)
+        OpenLoam::FieldDefinition.where(entity_type: name)
       end
     end
 
@@ -53,15 +53,15 @@ module Loam
       value = custom_field(name)
       return value unless definition.field_type == "dictionary"
 
-      Loam::Dictionaries.label_for(definition.dictionary_key, value)
+      OpenLoam::Dictionaries.label_for(definition.dictionary_key, value)
     end
 
     private
 
-    def loam_reindex_custom_fields = Loam::CustomFieldIndex.project(self)
-    def loam_deindex_custom_fields = Loam::CustomFieldIndex.remove(self)
+    def open_loam_reindex_custom_fields = OpenLoam::CustomFieldIndex.project(self)
+    def open_loam_deindex_custom_fields = OpenLoam::CustomFieldIndex.remove(self)
 
-    def loam_custom_fields_dirty?
+    def open_loam_custom_fields_dirty?
       return false unless self.class.respond_to?(:custom_field_definitions)
 
       # On create every column counts as changed; on update, only re-project when
@@ -71,8 +71,8 @@ module Loam
 
     def custom_field_definition!(name)
       custom_field_definitions_by_name.fetch(name.to_s) do
-        raise UnknownCustomFieldError, "No Loam::FieldDefinition named #{name.inspect} for #{self.class.name} " \
-                                       "(tenant #{Loam.tenant&.id.inspect})"
+        raise UnknownCustomFieldError, "No OpenLoam::FieldDefinition named #{name.inspect} for #{self.class.name} " \
+                                       "(tenant #{OpenLoam.tenant&.id.inspect})"
       end
     end
 

data/lib/{loam → open_loam}/dashboard.rb

@@ -1,17 +1,17 @@
-module Loam
+module OpenLoam
   # Resolves the admin dashboard for the current tenant/actor: the ordered,
   # role-visible, computed widgets to show. Uses the tenant's configured
-  # Loam::DashboardWidget rows (a manager arranges them); falls back to every
+  # OpenLoam::DashboardWidget rows (a manager arranges them); falls back to every
   # registered widget in registration order when the tenant has configured none,
   # so the dashboard is useful out of the box.
   module Dashboard
     module_function
 
     def for(actor:, role:)
-      configured = Loam::DashboardWidget.active.ordered.pluck(:widget_key)
-      keys = configured.presence || Loam::Widgets.keys
+      configured = OpenLoam::DashboardWidget.active.ordered.pluck(:widget_key)
+      keys = configured.presence || OpenLoam::Widgets.keys
 
-      keys.filter_map { |key| Loam::Widgets.resolve(key, actor: actor, role: role) }
+      keys.filter_map { |key| OpenLoam::Widgets.resolve(key, actor: actor, role: role) }
     end
   end
 end

data/lib/{loam → open_loam}/dictionaries.rb

@@ -1,18 +1,18 @@
-module Loam
-  # Read API for per-tenant managed lookup lists (Loam::Dictionary /
-  # Loam::DictionaryEntry). Everything is tenant-scoped automatically and
-  # memoized per request in Loam::Current.dictionary_cache (keyed with the tenant
+module OpenLoam
+  # Read API for per-tenant managed lookup lists (OpenLoam::Dictionary /
+  # OpenLoam::DictionaryEntry). Everything is tenant-scoped automatically and
+  # memoized per request in OpenLoam::Current.dictionary_cache (keyed with the tenant
   # id, so an as_tenant switch mid-request can't read another tenant's list) —
-  # the same simple prototype cache as Loam::Configs.
+  # the same simple prototype cache as OpenLoam::Configs.
   #
-  #   Loam::Dictionaries.entries("damage_severity")        # active, ordered
-  #   Loam::Dictionaries.default("damage_severity")        # the default entry
-  #   Loam::Dictionaries.label_for("damage_severity", "critical")  # => "Critical"
+  #   OpenLoam::Dictionaries.entries("damage_severity")        # active, ordered
+  #   OpenLoam::Dictionaries.default("damage_severity")        # the default entry
+  #   OpenLoam::Dictionaries.label_for("damage_severity", "critical")  # => "Critical"
   module Dictionaries
     class << self
       # The dictionary for the current tenant, or nil.
       def get(key)
-        memo([:dict, key.to_s]) { Loam::Dictionary.find_by(key: key.to_s) }
+        memo([:dict, key.to_s]) { OpenLoam::Dictionary.find_by(key: key.to_s) }
       end
 
       # Active entries, ordered by position. Empty for an unknown key.
@@ -38,14 +38,14 @@ module Loam
       end
 
       def clear_cache
-        Loam::Current.dictionary_cache = {}
+        OpenLoam::Current.dictionary_cache = {}
       end
 
       private
 
       def memo(subkey)
-        store = (Loam::Current.dictionary_cache ||= {})
-        cache_key = subkey + [ Loam.tenant&.id ]
+        store = (OpenLoam::Current.dictionary_cache ||= {})
+        cache_key = subkey + [ OpenLoam.tenant&.id ]
         return store[cache_key] if store.key?(cache_key)
 
         store[cache_key] = yield

data/lib/{loam → open_loam}/durable_events.rb

@@ -1,15 +1,15 @@
-module Loam
-  # Durable (persistent) event subscribers — the twin of Loam::Events.subscribe,
+module OpenLoam
+  # Durable (persistent) event subscribers — the twin of OpenLoam::Events.subscribe,
   # and the formal contract L-706 pins down.
   #
   # THE CONTRACT
-  #   * Ephemeral — Loam::Events.subscribe(&block): runs INLINE in the publisher's
+  #   * Ephemeral — OpenLoam::Events.subscribe(&block): runs INLINE in the publisher's
   #     thread, synchronously, best-effort. An exception in the block PROPAGATES
   #     into whatever published the event. No persistence, no retry. Right for
   #     cheap in-process fan-out (the webhook dispatcher enqueues its own jobs
   #     this way).
-  #   * Persistent — Loam::DurableEvents.register(...): publishing commits a
-  #     Loam::EventDelivery row in the event's tenant, then hands the handler to a
+  #   * Persistent — OpenLoam::DurableEvents.register(...): publishing commits a
+  #     OpenLoam::EventDelivery row in the event's tenant, then hands the handler to a
   #     background job. The handler's exception is CONTAINED in the job; delivery
   #     is retried with backoff and, past MAX_ATTEMPTS, parked as `dead` for an
   #     operator (Admin::EventDeliveriesController).
@@ -29,10 +29,10 @@ module Loam
     MAX_ATTEMPTS = 5
     # Backoff (seconds) indexed by attempt number; the last value is the cap.
     BACKOFF = [ 0, 60, 300, 1800, 7200 ].freeze
-    SWEEP_KEY = "loam_event_redelivery_sweep".freeze
+    SWEEP_KEY = "open_loam_event_redelivery_sweep".freeze
 
     class << self
-      # --- declarative registry (mirrors Loam::Scheduler.register) ---
+      # --- declarative registry (mirrors OpenLoam::Scheduler.register) ---
 
       # key:  a stable identifier stored on every delivery row it produces.
       # to:   an event name ("billing.invoice.paid") or a domain prefix
@@ -51,7 +51,7 @@ module Loam
       end
 
       def subscribers_for(event_name)
-        registered.select { |entry| Loam::Events.pattern_matches?(entry[:pattern], event_name) }
+        registered.select { |entry| OpenLoam::Events.pattern_matches?(entry[:pattern], event_name) }
       end
 
       def handler_for(key)
@@ -59,19 +59,19 @@ module Loam
         entry && resolve(entry[:handler])
       end
 
-      # --- wiring (mirrors Loam::Webhooks.subscribe!) ---
+      # --- wiring (mirrors OpenLoam::Webhooks.subscribe!) ---
 
-      # Wired once from Loam::Engine. Idempotent: subscribing twice would persist
+      # Wired once from OpenLoam::Engine. Idempotent: subscribing twice would persist
       # every event twice.
       def subscribe!
-        @subscription ||= Loam::Events.subscribe_all { |event_name, payload| capture(event_name, payload) }
+        @subscription ||= OpenLoam::Events.subscribe_all { |event_name, payload| capture(event_name, payload) }
       end
 
       # Persist a delivery row per matching durable subscriber, in the event's
       # tenant, then nudge a job per row. The ROW is the durable record; the job
       # is only the accelerator (the sweep redelivers rows whose job was lost).
       def capture(event_name, payload)
-        tenant = Loam::Tenant.find_by(id: payload[:tenant_id])
+        tenant = OpenLoam::Tenant.find_by(id: payload[:tenant_id])
         return if tenant.nil? # nil-tenant events are not durably delivered (as Webhooks.dispatch)
 
         matches = subscribers_for(event_name)
@@ -81,18 +81,18 @@ module Loam
         # scalars by convention, never records (same rule as the webhook path).
         deliverable = payload.transform_keys(&:to_s)
 
-        Loam.as_tenant(tenant) do
+        OpenLoam.as_tenant(tenant) do
           matches.each do |sub|
-            delivery = Loam::EventDelivery.create!(
+            delivery = OpenLoam::EventDelivery.create!(
               subscriber_key: sub[:key], event_name: event_name.to_s,
               payload: deliverable, status: "pending", attempts: 0
             )
-            Loam::EventDeliveryJob.perform_later(tenant.id, delivery.id)
+            OpenLoam::EventDeliveryJob.perform_later(tenant.id, delivery.id)
           end
         end
       end
 
-      # --- delivery (called by Loam::EventDeliveryJob) ---
+      # --- delivery (called by OpenLoam::EventDeliveryJob) ---
 
       # Run one delivery and advance the row's state. Manual, ROW-STATE retries —
       # deliberately NOT ActiveJob retry_on, which keeps retry state in the queue
@@ -102,7 +102,7 @@ module Loam
         return unless delivery.status == "pending"
         return if delivery.next_attempt_at && delivery.next_attempt_at > now # duplicate nudge, backoff not elapsed
 
-        Loam::Telemetry.span("durable_event_delivery",
+        OpenLoam::Telemetry.span("durable_event_delivery",
                              subscriber_key: delivery.subscriber_key, event_name: delivery.event_name) do
           run_delivery(delivery, now)
         end
@@ -136,8 +136,8 @@ module Loam
       # no cross-tenant scan is needed.
       def redeliver_stuck(now: Time.current, limit: 500)
         count = 0
-        Loam::EventDelivery.due(now).limit(limit).find_each do |delivery|
-          Loam::EventDeliveryJob.perform_later(delivery.tenant_id, delivery.id)
+        OpenLoam::EventDelivery.due(now).limit(limit).find_each do |delivery|
+          OpenLoam::EventDeliveryJob.perform_later(delivery.tenant_id, delivery.id)
           count += 1
         end
         count