@geraldmaron/construct 1.0.0 → 1.0.2

package/lib/hooks/pre-push-gate.mjs

@@ -2,28 +2,163 @@
 /**
  * pre-push-gate.mjs — PreToolUse / Bash
  *
- * Intercepts `git push` commands. Detects available test and build scripts
- * in the project, runs them in parallel, and blocks the push if either fails.
+ * Intercepts three command shapes:
+ *   git push                refuses claude/* branches, refuses on red remote CI,
+ *                           runs project test/build/evals/docs in parallel
+ *   gh pr create            lints the --body / --body-file against the PR
+ *                           template policy before the PR is opened
+ *   gh pr edit              same body lint when --body / --body-file is changed
+ *
  * Silent and instant when there's nothing to run.
+ *
+ * Bypasses (env vars):
+ *   CONSTRUCT_SKIP_PREPUSH=1        skip the entire push gate
+ *   CONSTRUCT_ALLOW_CLAUDE_PUSH=1   allow pushing a claude/* branch
+ *   CONSTRUCT_SKIP_PR_LINT=1        skip the gh pr body lint
+ *
+ * @p95ms 30000
+ * @maxBlockingScope PreToolUse
  */
-import { readFileSync, existsSync } from 'fs';
-import { execSync, spawnSync } from 'child_process';
-import { dirname, join } from 'path';
+import { readFileSync, existsSync, writeFileSync, mkdtempSync, rmSync } from 'fs';
+import { execSync, spawn, spawnSync } from 'child_process';
+import { dirname, join, resolve } from 'path';
+import { tmpdir } from 'os';
+import { logHookFailure } from './_lib/log.mjs';
+import { emitRoleEvent } from '../roles/hook-emit.mjs';
 
 let input = {};
-try { input = JSON.parse(readFileSync(0, 'utf8')); } catch { /* no stdin */ }
+try { input = JSON.parse(readFileSync(0, 'utf8')); }
+catch (err) { logHookFailure({ hook: 'pre-push-gate', err, phase: 'parse' }); }
 
-// Must always echo stdin for PreToolUse chaining
 const echo = () => { process.stdout.write(JSON.stringify(input) + '\n'); process.exit(0); };
 
 const command = input?.tool_input?.command || input?.command || '';
+const isGitPush = /\bgit\s+push\b/.test(command);
+const isGhPrCreate = /\bgh\s+pr\s+create\b/.test(command);
+const isGhPrEdit = /\bgh\s+pr\s+edit\b/.test(command);
 
-// Only act on git push
-if (!/\bgit\s+push\b/.test(command)) { echo(); }
+if (!isGitPush && !isGhPrCreate && !isGhPrEdit) { echo(); }
 
-// Find nearest package.json / Cargo.toml / pyproject.toml from cwd
 const cwd = input?.cwd || process.cwd();
 
+if ((isGhPrCreate || isGhPrEdit) && process.env.CONSTRUCT_SKIP_PR_LINT !== '1') {
+  const { body, bodyFile } = extractGhPrBody(command);
+  const hasArgs = body != null || bodyFile != null;
+
+  if (!hasArgs) {
+    process.stderr.write(
+      `[pre-push-gate] ${isGhPrCreate ? 'gh pr create' : 'gh pr edit'} without --body/--body-file/-F — cannot lint PR body locally.\n` +
+      `  CI will still enforce the template policy. To lint manually:\n` +
+      `    construct lint:templates --body-file=<path>\n`,
+    );
+  } else {
+    const scriptPath = findRepoFile(cwd, 'scripts/lint-commits-pr.mjs');
+    if (!scriptPath) {
+      process.stderr.write(`[pre-push-gate] could not locate scripts/lint-commits-pr.mjs from ${cwd}; skipping PR body lint\n`);
+    } else {
+      const env = { ...process.env };
+      let tmpFile = null;
+      try {
+        if (bodyFile) {
+          env.PR_BODY_FILE = resolve(cwd, bodyFile);
+        } else if (body != null) {
+          const dir = mkdtempSync(join(tmpdir(), 'construct-pr-lint-'));
+          tmpFile = join(dir, 'body.md');
+          writeFileSync(tmpFile, body);
+          env.PR_BODY_FILE = tmpFile;
+        }
+        const result = spawnSync(process.execPath, [scriptPath], {
+          cwd, env, stdio: ['ignore', 'pipe', 'pipe'], timeout: 15_000,
+        });
+        const out = (result.stdout?.toString() || '') + (result.stderr?.toString() || '');
+        if (result.status !== 0) {
+          process.stderr.write(`[pre-push-gate] PR body fails template policy:\n${out}\n`);
+          process.stderr.write(`Override: CONSTRUCT_SKIP_PR_LINT=1 <command>\n`);
+          emitRoleEvent({
+            type: 'push_gate.fail',
+            summary: 'PR body fails template policy',
+            hookInput: input,
+            context: { command: isGhPrCreate ? 'gh pr create' : 'gh pr edit', detail: out.slice(0, 800) },
+          });
+          if (tmpFile) try { rmSync(dirname(tmpFile), { recursive: true, force: true }); } catch {}
+          process.exit(2);
+        }
+      } finally {
+        if (tmpFile) try { rmSync(dirname(tmpFile), { recursive: true, force: true }); } catch {}
+      }
+    }
+  }
+  echo();
+}
+
+if (process.env.CONSTRUCT_SKIP_PREPUSH === '1') { echo(); }
+
+function extractGhPrBody(cmd) {
+  let m = cmd.match(/--body-file[\s=]+(["']?)(\S+?)\1(?=\s|$)/);
+  if (m) return { bodyFile: m[2] };
+  m = cmd.match(/(?:^|\s)-F[\s=]+(["']?)(\S+?)\1(?=\s|$)/);
+  if (m) return { bodyFile: m[2] };
+  m = cmd.match(/--body[\s=]+"((?:\\.|[^"\\])*)"/s);
+  if (m) return { body: m[1].replace(/\\(["\\])/g, '$1') };
+  m = cmd.match(/--body[\s=]+'([^']*)'/s);
+  if (m) return { body: m[1] };
+  return {};
+}
+
+function findRepoFile(startDir, relPath) {
+  let dir = startDir;
+  for (let i = 0; i < 10; i++) {
+    const candidate = join(dir, relPath);
+    if (existsSync(candidate)) return candidate;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+
+if (/\bclaude\//.test(command) && process.env.CONSTRUCT_ALLOW_CLAUDE_PUSH !== '1') {
+  process.stderr.write(
+    `[pre-push-gate] Refusing to push a claude/* branch to remote (user policy).\n` +
+    `  Use a non-agent branch name, or override with CONSTRUCT_ALLOW_CLAUDE_PUSH=1 git push ...\n`,
+  );
+  emitRoleEvent({
+    type: 'push_gate.fail',
+    summary: 'claude/* branch push refused',
+    hookInput: input,
+    context: { command },
+  });
+  process.exit(2);
+}
+
+try {
+  const branch = execSync('git branch --show-current', { cwd, timeout: 1000, stdio: ['ignore', 'pipe', 'ignore'] })
+    .toString().trim();
+  if (branch && branch !== 'main' && branch !== 'dev' && branch !== 'master') {
+    const json = execSync(
+      `gh run list --branch=${JSON.stringify(branch)} --limit=1 --json conclusion,databaseId,url`,
+      { cwd, timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'] },
+    ).toString().trim();
+    if (json) {
+      const [run] = JSON.parse(json);
+      if (run?.conclusion === 'failure') {
+        process.stderr.write(
+          `[pre-push-gate] Last CI run on '${branch}' FAILED — fix it before pushing more.\n` +
+          `  Run: ${run.url || `gh run view ${run.databaseId}`}\n` +
+          `  Override: CONSTRUCT_SKIP_PREPUSH=1 git push ...\n`,
+        );
+        emitRoleEvent({
+          type: 'push_gate.fail',
+          summary: 'remote CI red — push blocked',
+          hookInput: input,
+          context: { branch, runId: run.databaseId, runUrl: run.url },
+        });
+        process.exit(2);
+      }
+    }
+  }
+} catch {}
+
 function findUp(filename, from) {
   let dir = from;
   for (let i = 0; i < 8; i++) {
@@ -52,8 +187,14 @@ function runNpmGate(projectDir) {
                : 'npm';
 
   const jobs = [];
-  if (hasTest || hasCi) jobs.push({ label: 'tests',  cmd: runner, args: ['run', testScript], timeout: 90_000 });
-  if (hasBuild)         jobs.push({ label: 'build',  cmd: runner, args: ['run', 'build'],    timeout: 120_000 });
+  if (hasTest || hasCi) jobs.push({ label: 'tests', cmd: runner, args: ['run', testScript],                  timeout: 90_000 });
+  if (hasBuild)         jobs.push({ label: 'build', cmd: runner, args: ['run', 'build'],                     timeout: 120_000 });
+  jobs.push({                       label: 'audit', cmd: 'npm',  args: ['audit', '--omit=dev', '--audit-level=high'], timeout: 30_000 });
+
+  if (existsSync(join(projectDir, 'bin/construct'))) {
+    jobs.push({ label: 'evals', cmd: 'node', args: ['bin/construct', 'evals', 'retrieval'], timeout: 60_000 });
+    jobs.push({ label: 'docs',  cmd: 'node', args: ['bin/construct', 'docs:verify'],        timeout: 15_000 });
+  }
 
   return { projectDir, jobs };
 }
@@ -88,42 +229,64 @@ else if (pyproj) gate = runPythonGate(pyproj.dir);
 // Nothing to check
 if (!gate || gate.jobs.length === 0) { echo(); }
 
-// Run jobs in parallel via Promise.all simulation (spawnSync is synchronous — run sequentially)
-// For true parallel, we use spawnSync with a short timeout and report errors
-const failures = [];
+// Jobs run concurrently. Wall-clock = max(test, build) instead of sum, so the
+// gate fits inside the harness's 180s timeout even when both jobs near their
+// individual limits.
+function runJob(job) {
+  return new Promise((resolve) => {
+    let stdoutBuf = '';
+    let stderrBuf = '';
+    const child = spawn(job.cmd, job.args, {
+      cwd: gate.projectDir,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, CI: '1', FORCE_COLOR: '0' },
+    });
+
+    const timer = setTimeout(() => {
+      try { child.kill('SIGKILL'); } catch { /* already gone */ }
+    }, job.timeout);
 
-for (const job of gate.jobs) {
-  const result = spawnSync(job.cmd, job.args, {
-    cwd: gate.projectDir,
-    encoding: 'utf8',
-    timeout: job.timeout,
-    stdio: 'pipe',
-    env: { ...process.env, CI: '1', FORCE_COLOR: '0' },
+    child.stdout?.on('data', (chunk) => { stdoutBuf += chunk.toString(); });
+    child.stderr?.on('data', (chunk) => { stderrBuf += chunk.toString(); });
+    child.on('error', (err) => {
+      clearTimeout(timer);
+      resolve({ label: job.label, status: -1, stdout: stdoutBuf, stderr: stderrBuf || err.message, error: err });
+    });
+    child.on('close', (code) => {
+      clearTimeout(timer);
+      resolve({ label: job.label, status: code ?? -1, stdout: stdoutBuf, stderr: stderrBuf });
+    });
   });
+}
 
-  if (result.status !== 0 || result.error) {
-    const stderr = (result.stderr || '').trim();
-    const stdout = (result.stdout || '').trim();
-    const detail = stderr || stdout;
-    // Extract first meaningful error line (skip blank, generic lines)
-    const firstError = detail.split('\n')
-      .map(l => l.trim())
-      .filter(l => l && !/^>/.test(l) && !/^\s*at /.test(l))
-      .slice(0, 3)
-      .join(' · ');
-
-    failures.push({ label: job.label, detail: firstError || `exited ${result.status}` });
-  }
+const results = await Promise.all(gate.jobs.map(runJob));
+const failures = [];
+for (const result of results) {
+  if (result.status === 0) continue;
+  const detail = (result.stderr || result.stdout || '').trim();
+  const firstError = detail.split('\n')
+    .map((l) => l.trim())
+    .filter((l) => l && !/^>/.test(l) && !/^\s*at /.test(l))
+    .slice(0, 3)
+    .join(' · ');
+  failures.push({ label: result.label, detail: firstError || `exited ${result.status}` });
 }
 
 if (failures.length === 0) { echo(); }
 
-// Block the push
 const summary = failures
-  .map(f => `${f.label} failed — ${f.detail}`)
+  .map((f) => `${f.label} failed — ${f.detail}`)
   .join('\n');
 
 process.stderr.write(
   `[pre-push-gate] Push blocked — fix these before pushing:\n${summary}\n\nRun the failing checks locally, then push again.\n`
 );
+
+emitRoleEvent({
+  type: 'push_gate.fail',
+  summary,
+  hookInput: input,
+  context: { failures },
+});
+
 process.exit(2);

package/lib/hooks/proactive-activation.mjs

@@ -0,0 +1,284 @@
+/**
+ * lib/hooks/proactive-activation.mjs — Event-driven specialist activation.
+ *
+ * Instead of waiting for user input, specialists can activate proactively
+ * based on:
+ * - File changes (security on auth code, docs-keeper on README changes)
+ * - CI failures (debugger on test fails, qa on coverage drops)
+ * - Schedule (docs-keeper on stale READMEs, sre on SLO reviews)
+ * - Intake signals (automatic classification → assignment)
+ *
+ * Each specialist defines triggers in agents/role-manifests.json:
+ *   {
+ *     "events": ["test.fail", "secrets.detected"],
+ *     "severityImmediate": ["secrets.detected"],
+ *     "fence": { ... },
+ *     ...
+ *   }
+ *
+ * The gateway routes events to owning specialists with rate limiting.
+ *
+ * @p95ms 5
+ * @maxBlockingScope none
+ */
+
+import { EVENT_OWNERSHIP } from '../orchestration-policy.mjs';
+import { loadProjectConfig } from '../config/project-config.mjs';
+
+// Rate limiting: max activations per specialist per hour
+const DEFAULT_RATE_LIMIT = 5;
+const RATE_WINDOW_MS = 60 * 60 * 1000; // 1 hour
+
+// Cooldown: minimum time between activations for same specialist
+const DEFAULT_COOLDOWN_MS = 5 * 60 * 1000; // 5 minutes
+
+// Activation state tracking
+const activationState = new Map();
+
+function getActivationState(specialist) {
+  if (!activationState.has(specialist)) {
+    activationState.set(specialist, {
+      activations: [],
+      lastActivation: null,
+      totalActivations: 0,
+    });
+  }
+  return activationState.get(specialist);
+}
+
+function pruneOldActivations(state, windowMs) {
+  const now = Date.now();
+  state.activations = state.activations.filter(ts => now - ts < windowMs);
+}
+
+/**
+ * Check if a specialist can be activated (rate limit + cooldown).
+ */
+export function canActivate(specialist, options = {}) {
+  const {
+    rateLimit = DEFAULT_RATE_LIMIT,
+    cooldownMs = DEFAULT_COOLDOWN_MS,
+    windowMs = RATE_WINDOW_MS,
+  } = options;
+  
+  const state = getActivationState(specialist);
+  const now = Date.now();
+  
+  // Check cooldown
+  if (state.lastActivation && now - state.lastActivation < cooldownMs) {
+    return {
+      allowed: false,
+      reason: 'cooldown',
+      retryAfter: cooldownMs - (now - state.lastActivation),
+    };
+  }
+  
+  // Check rate limit
+  pruneOldActivations(state, windowMs);
+  if (state.activations.length >= rateLimit) {
+    return {
+      allowed: false,
+      reason: 'rate-limit',
+      retryAfter: windowMs - (now - state.activations[0]),
+    };
+  }
+  
+  return { allowed: true };
+}
+
+/**
+ * Record an activation for rate limiting.
+ */
+export function recordActivation(specialist) {
+  const state = getActivationState(specialist);
+  state.activations.push(Date.now());
+  state.lastActivation = Date.now();
+  state.totalActivations++;
+}
+
+/**
+ * Get activation stats for a specialist.
+ */
+export function getActivationStats(specialist) {
+  const state = getActivationState(specialist);
+  pruneOldActivations(state, RATE_WINDOW_MS);
+  
+  return {
+    recentActivations: state.activations.length,
+    lastActivation: state.lastActivation,
+    totalActivations: state.totalActivations,
+    rateLimit: DEFAULT_RATE_LIMIT,
+    rateWindowMs: RATE_WINDOW_MS,
+  };
+}
+
+/**
+ * Route an event to the owning specialist.
+ */
+export function routeEvent(eventType, eventData = {}) {
+  const owner = EVENT_OWNERSHIP[eventType];
+  
+  if (!owner) {
+    return {
+      routed: false,
+      reason: 'no-owner',
+      eventType,
+      message: `No specialist owns event type: ${eventType}`,
+    };
+  }
+  
+  // Check if specialist can activate
+  const canActivateResult = canActivate(owner);
+  
+  if (!canActivateResult.allowed) {
+    return {
+      routed: false,
+      reason: canActivateResult.reason,
+      eventType,
+      owner,
+      retryAfter: canActivateResult.retryAfter,
+      queued: true,
+    };
+  }
+  
+  // Record activation
+  recordActivation(owner);
+  
+  return {
+    routed: true,
+    owner,
+    eventType,
+    eventData,
+    activationNumber: getActivationState(owner).totalActivations,
+  };
+}
+
+/**
+ * File change watcher callback.
+ * Triggers specialists based on file paths and content patterns.
+ */
+export function onFileChange(filePath, changeType, content = '') {
+  const events = [];
+  
+  // Security: auth-related files
+  if (filePath.includes('auth') || filePath.includes('security') || filePath.includes('permission')) {
+    events.push({ type: 'file.change.auth', data: { filePath, changeType } });
+  }
+  
+  // Docs-keeper: README, docs changes
+  if (filePath.includes('README') || filePath.startsWith('docs/')) {
+    events.push({ type: 'file.change.docs', data: { filePath, changeType } });
+  }
+  
+  // SRE: infra, config, deployment files
+  if (filePath.includes('infra') || filePath.includes('deploy') || filePath.endsWith('.yaml') || filePath.endsWith('.yml')) {
+    events.push({ type: 'file.change.infra', data: { filePath, changeType } });
+  }
+  
+  // Debugger: test files
+  if (filePath.includes('.test.') || filePath.includes('.spec.') || filePath.startsWith('tests/')) {
+    events.push({ type: 'file.change.tests', data: { filePath, changeType } });
+  }
+  
+  return events;
+}
+
+/**
+ * CI failure watcher callback.
+ * Triggers specialists based on failure type.
+ */
+export function onCIFailure(failureType, details = {}) {
+  const events = [];
+  
+  if (failureType === 'test.fail') {
+    events.push({ type: 'test.fail', data: details });
+  }
+  
+  if (failureType === 'test.flake') {
+    events.push({ type: 'test.flake', data: details });
+  }
+  
+  if (failureType === 'coverage.drop') {
+    events.push({ type: 'coverage.drop', data: details });
+  }
+  
+  if (failureType === 'build.fail') {
+    events.push({ type: 'build.fail', data: details });
+  }
+  
+  if (failureType === 'lint.fail') {
+    events.push({ type: 'lint.fail', data: details });
+  }
+  
+  return events;
+}
+
+/**
+ * Scheduled activation check.
+ * Runs periodically to trigger time-based activations.
+ */
+export function onScheduleCheck() {
+  const events = [];
+  const now = new Date();
+  
+  // Monday 9am: SRE SLO review
+  if (now.getDay() === 1 && now.getHours() === 9) {
+    events.push({ type: 'schedule.slo-review', data: { day: 'monday' } });
+  }
+  
+  // Daily 6pm: Docs-keeper stale doc check
+  if (now.getHours() === 18) {
+    events.push({ type: 'schedule.stale-docs', data: { time: 'daily' } });
+  }
+  
+  // First of month: Security CVE review
+  if (now.getDate() === 1) {
+    events.push({ type: 'schedule.cve-review', data: { frequency: 'monthly' } });
+  }
+  
+  return events;
+}
+
+/**
+ * Get all pending activations for a specialist.
+ */
+export function getPendingActivations(specialist) {
+  // In a full implementation, this would query a pending queue
+  // For now, return recent activation history
+  const state = getActivationState(specialist);
+  return {
+    pending: 0,
+    recent: state.activations.length,
+    total: state.totalActivations,
+  };
+}
+
+/**
+ * Clear activation state (for testing or manual reset).
+ */
+export function clearActivationState(specialist) {
+  if (specialist) {
+    activationState.delete(specialist);
+  } else {
+    activationState.clear();
+  }
+}
+
+/**
+ * Get activation summary for dashboard.
+ */
+export function getActivationSummary() {
+  const summary = {};
+  
+  for (const [specialist, state] of activationState.entries()) {
+    pruneOldActivations(state, RATE_WINDOW_MS);
+    summary[specialist] = {
+      recentActivations: state.activations.length,
+      totalActivations: state.totalActivations,
+      lastActivation: state.lastActivation,
+      rateLimitRemaining: DEFAULT_RATE_LIMIT - state.activations.length,
+    };
+  }
+  
+  return summary;
+}

package/lib/hooks/read-tracker.mjs

@@ -3,9 +3,10 @@
  * lib/hooks/read-tracker.mjs — Read tracker hook — tracks file reads for efficiency analysis.
  *
  * Runs as PostToolUse after Read tool calls. Logs each read to ~/.cx/read-log.json including file path, line count, and session timestamp for efficiency reporting.
+ *
+ * @p95ms 10
+ * @maxBlockingScope none (PostToolUse, non-blocking)
  */
-// PostToolUse(Read) — records file content hash after each Read call
-// Powers hash-staleness check in edit-guard.mjs
 import { readFileSync, writeFileSync, mkdirSync, existsSync, appendFileSync } from 'fs';
 import { createHash } from 'crypto';
 import { join, resolve } from 'path';
@@ -17,9 +18,18 @@ const EFFICIENCY_STORE = join(CX_DIR, 'session-efficiency.json');
 const WARN_FLAGS = join(CX_DIR, 'warn-flags.txt');
 const SESSION_IDLE_RESET_MS = 2 * 60 * 60 * 1000;
 const REPEATED_READ_WARNING_THRESHOLD = 5;
+const REPEATED_READ_TIER2_THRESHOLD = 8;
 const LARGE_READ_WARNING_THRESHOLD = 3;
 const TOTAL_BYTES_WARNING_THRESHOLD = 750_000;
 
+// Bound per-session `stats.files` so the read-tracking map cannot grow
+// without limit across long sessions. The hook is a fresh node process per
+// Read, so every invocation must read-mutate-write the full state — there
+// is no in-memory accumulator that would survive between calls. The LRU cap
+// drops the oldest entries by `lastReadAt`.
+
+const FILES_LRU_CAP = 200;
+
 function loadEfficiencyStats(nowIso) {
   const fresh = {
     sessionStartedAt: nowIso,
@@ -85,8 +95,6 @@ try {
     if (new Date(v.ts).getTime() < cutoff) delete store[k];
   }
 
-  writeFileSync(HASH_STORE, JSON.stringify(store, null, 2));
-
   const stats = loadEfficiencyStats(nowIso);
   const existingFile = stats.files[absPath];
   stats.readCount += 1;
@@ -104,11 +112,25 @@ try {
     lastRequestedLimit: effectiveLimit,
   };
 
+  // LRU cap: bound stats.files to FILES_LRU_CAP entries by lastReadAt so the
+  // structure does not grow without limit across long sessions.
+  const fileEntries = Object.entries(stats.files);
+  if (fileEntries.length > FILES_LRU_CAP) {
+    fileEntries.sort((a, b) => (a[1]?.lastReadAt || '').localeCompare(b[1]?.lastReadAt || ''));
+    const drop = fileEntries.length - FILES_LRU_CAP;
+    for (let i = 0; i < drop; i++) delete stats.files[fileEntries[i][0]];
+  }
+
   if (stats.repeatedReadCount >= REPEATED_READ_WARNING_THRESHOLD && !stats.warnings.repeatedReads) {
     const top = topRepeatedPath(stats.files);
     const topNote = top ? ` Top repeat: ${top.filePath} (${top.count}x).` : '';
     appendWarning(`Efficiency: ${stats.repeatedReadCount} repeated reads this session.${topNote} Use rg or construct distill before re-reading more files.`);
     stats.warnings.repeatedReads = nowIso;
+
+    if (stats.repeatedReadCount >= REPEATED_READ_TIER2_THRESHOLD && !stats.warnings.repeatedReadsTier2) {
+      appendWarning(`Efficiency: ${stats.repeatedReadCount} repeated reads this session — consider using construct distill or rg before re-reading entire files.`);
+      stats.warnings.repeatedReadsTier2 = nowIso;
+    }
   }
 
   if (stats.largeReadCount >= LARGE_READ_WARNING_THRESHOLD && !stats.warnings.largeReads) {
@@ -123,6 +145,7 @@ try {
 
   stats.lastUpdatedAt = nowIso;
 
+  writeFileSync(HASH_STORE, JSON.stringify(store, null, 2));
   writeFileSync(EFFICIENCY_STORE, JSON.stringify(stats, null, 2));
 } catch { /* best effort */ }