@agfpd/iapeer-memory 0.1.12 → 0.2.0

package/src/commands/update.ts

@@ -12,29 +12,42 @@
  *   3. doctrines  — re-render every role from the roles manifest with the
  *                   fresh version marker; roles pick it up on their next
  *                   cold wake (ADR-007), no restarts;
- *   4. slot       — re-declare with the new version (contract obligation);
- *   5. launcher   — regenerate (in case the binary path moved);
- *   6. memoryd    — MANAGED restart: verified SIGTERM via the pid file →
+ *   4. fleet      — re-write the fleet map from `iapeer list --json`;
+ *   5. surfaces   — direct per-peer session surfaces sweep over the map
+ *                   (ADR-009 v1.2: the «всё на местах у подключённых пиров»
+ *                   duty — both runtimes, idempotent, repairs drift);
+ *   6. plugin-off — v1.1→v1.2 migration: when the on-disk slot still
+ *                   carries a plugin block, sweep the legacy plugin off the
+ *                   fleet (while the old declaration is STILL readable by
+ *                   the core verb) — only after surfaces landed cleanly;
+ *   7. slot       — re-declare in the v1.2 form (provision command blocks,
+ *                   new version — contract obligation);
+ *   8. launcher + triggers + guide — regenerate;
+ *   9. memoryd    — MANAGED restart: verified SIGTERM via the pid file →
  *                   the notifier watcher relaunches through the launcher
- *                   with the NEW binary (exit-detect is unconditional —
- *                   notifier fact). Not running → nothing to do;
- *   7. plugin     — the harness's native plugin update flow (printed hint;
- *                   the package never reaches into harness internals).
+ *                   with the NEW binary. Not running → nothing to do.
  *
  * Idempotent: same version re-run → identical/no-op on every surface.
  */
 
+import fs from "node:fs";
+import path from "node:path";
 import {
   configFromEnv,
   isLocaleId,
   renderDoctrine,
+  writeHostWideGuideFragment,
   type LocaleId,
 } from "@agfpd/iapeer-memory-core";
 import { installBinary } from "../binary.js";
+import { readFleetMap, writeFleetMap } from "../fleet.js";
 import { memoryPaths } from "../paths.js";
 import { readRolesManifest } from "../roles.js";
-import { writeSlot } from "../slot.js";
-import { materialiseTemplates } from "../templates/index.js";
+import { applyMemoryPlugin, readSlot, writeSlot, SLOT_PROVIDER } from "../slot.js";
+import { withProvisionLock } from "../surfaces/lock.js";
+import { sweepProvision } from "../surfaces/sweep.js";
+import { mcpPort } from "./provision-peer.js";
+import { guideText, materialiseTemplates } from "../templates/index.js";
 import { packageVersion } from "../version.js";
 import {
   dreamTimerMessage,
@@ -48,8 +61,11 @@ import { stopMemorydByPidFile } from "./uninstall.js";
 
 export function cmdUpdate(argv: string[]): number {
   let skipBinary = false;
-  for (const a of argv) {
+  let iapeerBin: string | undefined;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
     if (a === "--skip-binary") skipBinary = true;
+    else if (a === "--iapeer-bin") iapeerBin = argv[++i];
     else {
       console.error(`iapeer-memory update: unknown flag: ${a}`);
       return 2;
@@ -119,24 +135,103 @@ export function cmdUpdate(argv: string[]): number {
     );
   }
 
-  // 4. slot version (contract obligation)
-  const slot = writeSlot({
-    slotPath: paths.slotPath,
-    version,
-    heartbeat: paths.heartbeatPath,
-  });
-  step(
-    "slot",
-    slot.action === "refused-foreign"
-      ? `slot held by foreign provider "${slot.existing?.provider}" — not ours to update`
-      : `${slot.action} (v${version})`,
-    slot.action !== "refused-foreign",
-  );
+  // 4. fleet map — personality → cwd × runtimes (the joint of the surfaces
+  // sweep below AND memoryd's fragment renderer, docs/05). BEFORE surfaces
+  // and BEFORE the memoryd restart: both consume the fresh map.
+  {
+    const fleet = writeFleetMap({ fleetMapPath: paths.fleetMapPath, iapeerBin });
+    step(
+      "fleet",
+      fleet.action === "written"
+        ? fleet.detail
+        : `fleet map not written (${fleet.detail}) — surfaces sweep runs on the LAST map; fragments stay stale until verify --repair`,
+      fleet.action === "written",
+    );
+  }
+
+  // 5. direct session surfaces sweep (ADR-009 v1.2) — the update duty:
+  // «всё на местах у подключённых пиров, что codex, что claude».
+  const existingSlot = readSlot(paths.slotPath);
+  const slotForeign = existingSlot !== null && existingSlot.provider !== SLOT_PROVIDER;
+  let surfacesOk = false;
+  if (slotForeign) {
+    step("surfaces", "skipped (foreign slot — not our host)");
+  } else {
+    const fleet = readFleetMap(paths.fleetMapPath) ?? [];
+    const locked = withProvisionLock({
+      stateDir: paths.stateDir,
+      fn: () => sweepProvision({ fleet, hooksDir: paths.hooksDir, port: mcpPort() }),
+    });
+    if (!locked.acquired) {
+      step("surfaces", locked.detail, false);
+    } else {
+      const { results, skipped } = locked.result;
+      const failed = results.filter((r) => !r.ok);
+      surfacesOk = failed.length === 0;
+      step(
+        "surfaces",
+        `${results.length - failed.length}/${results.length} peer-runtime(s) in place` +
+          (skipped.length ? `, ${skipped.length} skipped` : "") +
+          " — live sessions pick changes up on next restart",
+        surfacesOk,
+      );
+      for (const f of failed) {
+        console.log(
+          `      surfaces    FAIL ${f.personality}:${f.runtime} — ${f.outcomes
+            .filter((o) => o.action === "failed")
+            .map((o) => `${o.surface}: ${o.detail ?? "failed"}`)
+            .join("; ")}`,
+        );
+      }
+    }
+  }
+
+  // 6. v1.1 → v1.2 migration (one-shot per host): the on-disk slot still
+  // carries a plugin block — sweep the legacy plugin off the fleet WHILE the
+  // old declaration is still readable (the core verb derives the identity
+  // from it), and ONLY after the direct surfaces landed cleanly.
+  let migrationBlocked = false;
+  if (!slotForeign && existingSlot?.plugin) {
+    if (!surfacesOk) {
+      migrationBlocked = true;
+      step(
+        "plugin-off",
+        "POSTPONED: direct surfaces did not land cleanly — legacy plugin and v1.1 slot kept (fix and re-run update)",
+        false,
+      );
+    } else {
+      const off = applyMemoryPlugin({ mode: "off" });
+      step(
+        "plugin-off",
+        off.suppressed
+          ? "skipped (test sandbox — core calls suppressed)"
+          : off.ok
+            ? "legacy v1.1 session plugin swept off the fleet (memory-plugin off --all)"
+            : `legacy plugin off failed (${off.detail.slice(0, 120)}) — manual: iapeer memory-plugin off --all`,
+      );
+    }
+  }
+
+  // 7. slot version + v1.2 form (contract obligation). Kept v1.1 while the
+  // migration is blocked — the legacy channel stays derivable.
+  if (slotForeign) {
+    step("slot", `slot held by foreign provider "${existingSlot?.provider}" — not ours to update`, false);
+  } else if (migrationBlocked) {
+    step("slot", "kept v1.1 declaration (migration postponed — see plugin-off)", false);
+  } else {
+    const slot = writeSlot({
+      slotPath: paths.slotPath,
+      version,
+      binaryPath: paths.binaryPath,
+      heartbeat: paths.heartbeatPath,
+    });
+    step("slot", `${slot.action} (v${version}, provision-command declared)`, slot.action !== "refused-foreign");
+  }
 
-  // 5. launcher
+  // 8. launcher
   step("launcher", writeLauncherScript({ launcherPath: paths.launcherPath, binaryPath: paths.binaryPath }));
 
-  // 5b. notifier wiring (ADR-015): same-id re-send REPLACES the trigger —
+  // 8b. notifier wiring (ADR-015): same-id re-send REPLACES the trigger —
   // the idempotent re-target path (old hosts with target=index migrate to
   // target=scriber by this very step).
   {
@@ -169,14 +264,25 @@ export function cmdUpdate(argv: string[]): number {
     );
   }
 
-  // 6. memoryd managed restart (the watcher relaunches with the new binary)
-  step("memoryd", `${stopMemorydByPidFile(paths.pidPath)} — the notifier watcher relaunches it with the new binary`);
+  // 8c. host-wide guide — update an ALREADY-ROLLED-OUT guide only
+  // (presence = the rollout sanction; init --skip-guide hosts stay
+  // untouched). Vault substituted into {{VAULT_PATH}} (дыра 10.06: the
+  // literal placeholder left peers without the write path).
+  {
+    const iapeerDir = path.dirname(paths.slotPath);
+    const guidePath = path.join(iapeerDir, "fragments", "iapeer-memory.md");
+    if (!fs.existsSync(guidePath)) {
+      step("guide", "not rolled out on this host — left untouched (roll out via init)");
+    } else if (!vaultPathForDoctrines) {
+      step("guide", "unprovisioned env — vault unknown, guide left as is", false);
+    } else {
+      writeHostWideGuideFragment(iapeerDir, guideText(locale, vaultPathForDoctrines));
+      step("guide", `${guidePath} re-written (v${version}, vault path substituted)`);
+    }
+  }
 
-  // 7. plugin — harness-owned surface
-  console.log(
-    "      plugin      update via the harness's native plugin flow " +
-      "(claude/codex plugin manager); the package never reaches into harness internals",
-  );
+  // 9. memoryd managed restart (the watcher relaunches with the new binary)
+  step("memoryd", `${stopMemorydByPidFile(paths.pidPath)} — the notifier watcher relaunches it with the new binary`);
 
   console.log(
     failures

package/src/commands/verify.ts

@@ -25,9 +25,13 @@ import {
   renderDoctrine,
   renderedVersion,
 } from "@agfpd/iapeer-memory-core";
+import { readFleetMap, writeFleetMap } from "../fleet.js";
 import { memoryPaths, type MemoryPaths } from "../paths.js";
 import { readRolesManifest } from "../roles.js";
-import { readSlot, writeSlot, SLOT_PROVIDER } from "../slot.js";
+import { readSlot, slotProvisionBlocks, writeSlot, SLOT_PROVIDER } from "../slot.js";
+import { withProvisionLock } from "../surfaces/lock.js";
+import { checkFleetSurfaces, sweepProvision } from "../surfaces/sweep.js";
+import { mcpPort } from "./provision-peer.js";
 import { packageVersion } from "../version.js";
 import {
   dreamTimerMessage,
@@ -94,6 +98,11 @@ export function runVerify(opts: VerifyOptions = {}): CheckResult[] {
 
   // 1b. memory-provider slot (iapeer memory-slot contract): a provisioned
   // host must declare the slot; a FOREIGN slot is never repaired over.
+  // A v1.1 slot (plugin block) is NEVER migrated here — the migration is
+  // update's job (plugin off --all must run while the old declaration is
+  // readable; a SessionStart-kicked repair racing ahead of update would
+  // strand the legacy plugin on the whole fleet).
+  let slotIsLegacyV11 = false;
   if (!configOk) {
     results.push({
       name: "memory-slot",
@@ -102,17 +111,37 @@ export function runVerify(opts: VerifyOptions = {}): CheckResult[] {
     });
   } else {
     const slot = readSlot(paths.slotPath);
+    const expectedBlocks = slotProvisionBlocks(paths.binaryPath);
+    const formOk =
+      slot !== null &&
+      slot.plugin === undefined &&
+      JSON.stringify(slot.provision) === JSON.stringify(expectedBlocks.provision) &&
+      JSON.stringify(slot.unprovision) === JSON.stringify(expectedBlocks.unprovision);
     if (slot && slot.provider !== SLOT_PROVIDER) {
       results.push({
         name: "memory-slot",
         status: "fail",
         detail: `slot held by foreign provider "${slot.provider}" — refusing to touch (uninstall it first)`,
       });
-    } else if (slot && slot.version === version) {
-      results.push({ name: "memory-slot", status: "ok", detail: `declared v${slot.version}` });
+    } else if (slot?.plugin) {
+      slotIsLegacyV11 = true;
+      results.push({
+        name: "memory-slot",
+        status: "fail",
+        detail:
+          "slot is the legacy v1.1 form (plugin block) — migrate via `iapeer-memory update` (verify never migrates: the plugin-off order is update's duty)",
+      });
+    } else if (slot && slot.version === version && formOk) {
+      results.push({
+        name: "memory-slot",
+        status: "ok",
+        detail: `declared v${slot.version}, provision-command in place`,
+      });
     } else {
       const problem = slot
-        ? `slot declares v${slot.version}, package is v${version}`
+        ? slot.version !== version
+          ? `slot declares v${slot.version}, package is v${version}`
+          : "provision-command block missing/drifted"
         : `slot declaration missing at ${paths.slotPath}`;
       if (!repair) {
         results.push({ name: "memory-slot", status: "fail", detail: problem });
@@ -120,6 +149,7 @@ export function runVerify(opts: VerifyOptions = {}): CheckResult[] {
         const w = writeSlot({
           slotPath: paths.slotPath,
           version,
+          binaryPath: paths.binaryPath,
           heartbeat: paths.heartbeatPath,
         });
         results.push(
@@ -131,6 +161,119 @@ export function runVerify(opts: VerifyOptions = {}): CheckResult[] {
     }
   }
 
+  // 1c. fleet map — memoryd's fragment renderer reads it (docs/05; дыра
+  // 10.06: без карты пиры не получали paths-блок и индекс автора). Repair
+  // re-writes from `iapeer list --json` — the self-healing loop for new
+  // peers (SessionStart kick → repair → map fresh → memoryd renders the
+  // newcomer on the next heartbeat tick).
+  if (!configOk) {
+    results.push({ name: "fleet-map", status: "skip", detail: "not provisioned (config check failed)" });
+  } else {
+    let mapPeers = -1; // -1 = unreadable/missing
+    try {
+      const raw = JSON.parse(fs.readFileSync(paths.fleetMapPath, "utf-8")) as {
+        peers?: unknown[];
+      };
+      mapPeers = Array.isArray(raw?.peers) ? raw.peers.length : -1;
+    } catch {
+      mapPeers = -1;
+    }
+    if (mapPeers > 0) {
+      results.push({ name: "fleet-map", status: "ok", detail: `${mapPeers} peer(s) in ${paths.fleetMapPath}` });
+    } else {
+      const problem =
+        mapPeers === 0
+          ? `fleet map is empty at ${paths.fleetMapPath}`
+          : `fleet map missing/unreadable at ${paths.fleetMapPath}`;
+      if (!repair) {
+        results.push({ name: "fleet-map", status: "fail", detail: problem });
+      } else {
+        const w = writeFleetMap({ fleetMapPath: paths.fleetMapPath, iapeerBin: opts.iapeerBin });
+        results.push(
+          w.action === "written"
+            ? { name: "fleet-map", status: "repaired", detail: `${problem} — ${w.detail}` }
+            : { name: "fleet-map", status: "fail", detail: `${problem}; repair failed — ${w.detail}` },
+        );
+      }
+    }
+  }
+
+  // 1d. direct per-peer session surfaces (ADR-009 v1.2) across the fleet
+  // map — the self-healing loop for newborns on hosts where the core's
+  // birth-hook lagged AND the drift-repair duty (требование №2). Skipped on
+  // a legacy v1.1 host: the plugin is still the live channel there, direct
+  // surfaces land via update's migration.
+  if (!configOk) {
+    results.push({ name: "peer-surfaces", status: "skip", detail: "not provisioned (config check failed)" });
+  } else if (slotIsLegacyV11) {
+    results.push({
+      name: "peer-surfaces",
+      status: "skip",
+      detail: "legacy v1.1 host (plugin channel) — direct surfaces land via `iapeer-memory update`",
+    });
+  } else {
+    const fleet = readFleetMap(paths.fleetMapPath);
+    if (!fleet) {
+      results.push({
+        name: "peer-surfaces",
+        status: "skip",
+        detail: "fleet map unreadable — see fleet-map check",
+      });
+    } else {
+      const { checks, skipped } = checkFleetSurfaces({
+        fleet,
+        hooksDir: paths.hooksDir,
+        port: mcpPort(),
+      });
+      const bad = checks.filter((c) => !c.ok);
+      if (bad.length === 0) {
+        results.push({
+          name: "peer-surfaces",
+          status: "ok",
+          detail:
+            `${checks.length} peer-runtime(s) in place` +
+            (skipped.length ? ` (${skipped.length} skipped: no session runtime / missing cwd)` : ""),
+        });
+      } else if (!repair) {
+        for (const b of bad) {
+          results.push({
+            name: `peer-surfaces[${b.personality}:${b.runtime}]`,
+            status: "fail",
+            detail: b.problems.join("; "),
+          });
+        }
+      } else {
+        const badPeers = fleet.filter((p) => bad.some((b) => b.cwd === p.cwd));
+        const locked = withProvisionLock({
+          stateDir: paths.stateDir,
+          fn: () => sweepProvision({ fleet: badPeers, hooksDir: paths.hooksDir, port: mcpPort() }),
+        });
+        if (!locked.acquired) {
+          results.push({ name: "peer-surfaces", status: "fail", detail: locked.detail });
+        } else {
+          const stillBad = locked.result.results.filter((r) => !r.ok);
+          results.push(
+            stillBad.length === 0
+              ? {
+                  name: "peer-surfaces",
+                  status: "repaired",
+                  detail: `${bad.length} drifted peer-runtime(s) re-provisioned (${bad
+                    .map((b) => `${b.personality}:${b.runtime}`)
+                    .join(", ")})`,
+                }
+              : {
+                  name: "peer-surfaces",
+                  status: "fail",
+                  detail: `repair failed for ${stillBad
+                    .map((r) => `${r.personality}:${r.runtime}`)
+                    .join(", ")}`,
+                },
+          );
+        }
+      }
+    }
+  }
+
   // 2. memoryd heartbeat
   try {
     const stat = fs.statSync(paths.heartbeatPath);

package/src/fleet.ts

@@ -0,0 +1,150 @@
+/**
+ * Fleet map — the personality → cwd joint between the package (ecosystem
+ * knowledge, ADR-009) and core memoryd's per-peer fragment renderer
+ * (docs/05). Written from `iapeer list --json` (the registry cwd is the
+ * FACT — iapeer 0.2.14); memoryd reads it fail-open and re-checks the
+ * mtime on every heartbeat tick, so the self-healing loop is:
+ * new peer wakes → SessionStart kick → `verify --repair` re-writes the
+ * map → memoryd renders the newcomer's fragment within a tick.
+ *
+ * TEST FUSE (incident 11.06, the FOURTH of its class — first FILE-path one):
+ * `iapeer list` is read-only, but its RESULT is the target list of the
+ * surfaces sweep — a sandboxed `verify --repair` with no fleet map repaired
+ * the map from the LIVE registry and then swept the LIVE peers' cwds with
+ * direct surfaces (the send-fuse never saw it: no IAP send involved).
+ * Querying the live registry from a test IS the leak — so the default
+ * binary is refused under the sandbox fuse; tests that need a fleet pass a
+ * fake `iapeerBin` (as before) or write the map file directly.
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+
+export type FleetMapResult = {
+  action: "written" | "failed";
+  count: number;
+  detail: string;
+};
+
+type ListedPeer = {
+  personality?: unknown;
+  cwd?: unknown;
+  /** iapeer registry: `[{runtime: "claude"|"codex"|…, status}]`. */
+  runtimes?: Array<{ runtime?: unknown }>;
+};
+
+/** Fleet-map entry. `runtimes` (ADR-009 v1.2) names the peer's session
+ *  runtimes from the registry — the surfaces sweep keys its per-runtime
+ *  forms on it (claude: hooks+mcp+skills; codex: project-local MCP).
+ *  Core's memoryd reader takes personality/cwd only — additive, fail-open. */
+export type FleetPeer = { personality: string; cwd: string; runtimes: string[] };
+
+/** Fail-open fleet-map reader (the package side: the surfaces sweep and
+ *  verify's per-peer checks). Missing/unreadable map → null — callers report
+ *  honestly instead of guessing the fleet. Entries without a runtimes array
+ *  (pre-v1.2 maps) read as `runtimes: []` — the sweep skips them until the
+ *  next map re-write (init/update/verify --repair). */
+export function readFleetMap(fleetMapPath: string): FleetPeer[] | null {
+  try {
+    const raw = JSON.parse(fs.readFileSync(fleetMapPath, "utf-8")) as {
+      peers?: Array<{ personality?: unknown; cwd?: unknown; runtimes?: unknown }>;
+    };
+    if (!Array.isArray(raw?.peers)) return null;
+    return raw.peers
+      .filter(
+        (p): p is { personality: string; cwd: string; runtimes?: unknown } =>
+          typeof p?.personality === "string" && typeof p?.cwd === "string",
+      )
+      .map((p) => ({
+        personality: p.personality,
+        cwd: p.cwd,
+        runtimes: Array.isArray(p.runtimes)
+          ? p.runtimes.filter((r): r is string => typeof r === "string")
+          : [],
+      }));
+  } catch {
+    return null;
+  }
+}
+
+export function writeFleetMap(opts: {
+  fleetMapPath: string;
+  iapeerBin?: string;
+  /** Injectable for tests. */
+  nowIso?: string;
+}): FleetMapResult {
+  if (
+    opts.iapeerBin === undefined &&
+    (process.env.IAPEER_MEMORY_SUPPRESS_IAP_SEND === "1" ||
+      process.env.IAPEER_TEST_SANDBOX === "1")
+  ) {
+    return {
+      action: "failed",
+      count: 0,
+      detail: "live-registry query suppressed (test sandbox) — pass a fake iapeerBin",
+    };
+  }
+  const bin = opts.iapeerBin ?? "iapeer";
+  let stdout: string;
+  try {
+    const proc = Bun.spawnSync([bin, "list", "--json"], {
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    if (proc.exitCode !== 0) {
+      return {
+        action: "failed",
+        count: 0,
+        detail:
+          (proc.stderr.toString().trim() || `iapeer list exited ${proc.exitCode}`).slice(0, 160),
+      };
+    }
+    stdout = proc.stdout.toString();
+  } catch (err) {
+    return { action: "failed", count: 0, detail: `${bin} unavailable: ${String(err)}` };
+  }
+
+  let listed: ListedPeer[];
+  try {
+    const raw = JSON.parse(stdout) as unknown;
+    listed = Array.isArray(raw) ? (raw as ListedPeer[]) : [];
+  } catch {
+    return { action: "failed", count: 0, detail: "iapeer list --json: unparsable output" };
+  }
+
+  const peers: FleetPeer[] = listed
+    .filter(
+      (p): p is ListedPeer & { personality: string; cwd: string } =>
+        typeof p.personality === "string" &&
+        p.personality.trim() !== "" &&
+        typeof p.cwd === "string" &&
+        p.cwd.trim() !== "",
+    )
+    .map((p) => ({
+      personality: p.personality.trim(),
+      cwd: p.cwd.trim(),
+      runtimes: [
+        ...new Set(
+          (Array.isArray(p.runtimes) ? p.runtimes : [])
+            .map((r) => (typeof r?.runtime === "string" ? r.runtime.trim() : ""))
+            .filter(Boolean),
+        ),
+      ],
+    }));
+
+  const body =
+    JSON.stringify(
+      { updatedAt: opts.nowIso ?? new Date().toISOString(), peers },
+      null,
+      2,
+    ) + "\n";
+  fs.mkdirSync(path.dirname(opts.fleetMapPath), { recursive: true });
+  const tmp = `${opts.fleetMapPath}.tmp`;
+  fs.writeFileSync(tmp, body, "utf-8");
+  fs.renameSync(tmp, opts.fleetMapPath); // atomic — memoryd may race a read
+  return {
+    action: "written",
+    count: peers.length,
+    detail: `${peers.length} peer(s) → ${opts.fleetMapPath}`,
+  };
+}

package/src/paths.ts

@@ -48,10 +48,18 @@ export type MemoryPaths = {
   binaryPath: string;
   /** Materialised package-owned templates (roles, guide) — see templates/index.ts. */
   templatesDir: string;
+  /** Materialised hook shims (fail-open bash, 3 lines) — the ABSOLUTE command
+   *  paths merged into peers' `.claude/settings.json` (ownership lives IN THE
+   *  DATA: the command path is the identity of our entries — ADR-009 v1.2). */
+  hooksDir: string;
   /** memoryd launcher — the notifier watcher's script (wraps the stable binary). */
   launcherPath: string;
   /** Sweep check-script — gates the fail-open inbox sweep (ADR-015). */
   checkScriptPath: string;
+  /** Fleet map (personality → cwd) — written by init/update/verify --repair
+   *  from `iapeer list --json`, consumed by memoryd's fragment renderer
+   *  (docs/05; дыра 10.06: без карты пиры не получали paths-блок и индекс). */
+  fleetMapPath: string;
 };
 
 export function memoryPaths(
@@ -88,8 +96,10 @@ export function memoryPaths(
     binaryPath:
       env.IAPEER_MEMORY_BINARY_PATH || path.join(home, ".local", "bin", "iapeer-memory"),
     templatesDir: path.join(path.dirname(configFile), "templates"),
+    hooksDir: path.join(path.dirname(configFile), "hooks"),
     launcherPath: path.join(path.dirname(configFile), "memoryd-launcher.sh"),
     checkScriptPath: path.join(path.dirname(configFile), "inbox-stale-check.sh"),
+    fleetMapPath: path.join(stateDir, "fleet.json"),
   };
 }