@massu/core 2.4.0 → 2.5.1

package/dist/cli.js

@@ -1548,6 +1548,16 @@ var init_memory_vector = __esm({
   }
 });
 
+// src/lib/timestamps.ts
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+var init_timestamps = __esm({
+  "src/lib/timestamps.ts"() {
+    "use strict";
+  }
+});
+
 // src/db-backup.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync4, readdirSync as readdirSync2, statSync as statSync2, unlinkSync, copyFileSync, rmSync as rmSync4 } from "fs";
 import { resolve as resolve3, join as join3, basename, dirname as dirname4 } from "path";
@@ -3972,8 +3982,8 @@ function linkSessionToTask(db, sessionId, taskId) {
 }
 function addConversationTurn(db, sessionId, turnNumber, userPrompt, assistantResponse, toolCallsJson, toolCallCount, promptTokens, responseTokens) {
   const result = db.prepare(`
-    INSERT INTO conversation_turns (session_id, turn_number, user_prompt, assistant_response, tool_calls_json, tool_call_count, prompt_tokens, response_tokens)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    INSERT INTO conversation_turns (session_id, turn_number, user_prompt, assistant_response, tool_calls_json, tool_call_count, prompt_tokens, response_tokens, created_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(
     sessionId,
     turnNumber,
@@ -3982,14 +3992,15 @@ function addConversationTurn(db, sessionId, turnNumber, userPrompt, assistantRes
     toolCallsJson,
     toolCallCount,
     promptTokens,
-    responseTokens
+    responseTokens,
+    nowIso()
   );
   return Number(result.lastInsertRowid);
 }
 function addToolCallDetail(db, sessionId, turnNumber, toolName, inputSummary, inputSize, outputSize, success, filesInvolved) {
   db.prepare(`
-    INSERT INTO tool_call_details (session_id, turn_number, tool_name, tool_input_summary, tool_input_size, tool_output_size, tool_success, files_involved)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    INSERT INTO tool_call_details (session_id, turn_number, tool_name, tool_input_summary, tool_input_size, tool_output_size, tool_success, files_involved, created_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(
     sessionId,
     turnNumber,
@@ -3998,7 +4009,8 @@ function addToolCallDetail(db, sessionId, turnNumber, toolName, inputSummary, in
     inputSize,
     outputSize,
     success ? 1 : 0,
-    filesInvolved ? JSON.stringify(filesInvolved) : null
+    filesInvolved ? JSON.stringify(filesInvolved) : null,
+    nowIso()
   );
 }
 function getLastProcessedLine(db, sessionId) {
@@ -4257,6 +4269,7 @@ var init_memory_db = __esm({
     init_db_driver();
     init_config();
     init_memory_vector();
+    init_timestamps();
     init_db_backup();
     init_rule_delivery();
     init_rule_candidate_store();
@@ -15980,14 +15993,23 @@ __export(init_exports, {
   getInstallerVersion: () => getInstallerVersion,
   initMemoryDir: () => initMemoryDir,
   installHooks: () => installHooks,
+  installMassuShim: () => installMassuShim,
   isTemplateName: () => isTemplateName,
   listTemplates: () => listTemplates,
+  massuHookIdentity: () => massuHookIdentity,
+  massuRuntimeCliPath: () => massuRuntimeCliPath,
+  massuRuntimeDir: () => massuRuntimeDir,
+  massuShimBody: () => massuShimBody,
+  massuShimPath: () => massuShimPath,
+  materializeMassuRuntime: () => materializeMassuRuntime,
   mergeHooksConfig: () => mergeHooksConfig,
   parseInitArgs: () => parseInitArgs,
   printInitHelp: () => printInitHelp,
   registerMcpServer: () => registerMcpServer,
   renderConfigYaml: () => renderConfigYaml,
   resolveHooksDir: () => resolveHooksDir,
+  resolveMassuRuntimeCli: () => resolveMassuRuntimeCli,
+  resolveMassuShim: () => resolveMassuShim,
   resolveTemplatesDir: () => resolveTemplatesDir,
   runInit: () => runInit,
   validateWrittenConfig: () => validateWrittenConfig,
@@ -15997,6 +16019,7 @@ import { closeSync as closeSync4, existsSync as existsSync19, fsyncSync as fsync
 import { resolve as resolve9, basename as basename6, dirname as dirname12 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { homedir as homedir7 } from "os";
+import { execFileSync as execFileSync2 } from "child_process";
 import { stringify as yamlStringify, parse as yamlParse } from "yaml";
 function detectFramework(projectRoot) {
   const result = {
@@ -16570,11 +16593,8 @@ function registerMcpServer(projectRoot) {
     return false;
   }
   const version = getInstallerVersion();
-  servers.massu = {
-    type: "stdio",
-    command: "npx",
-    args: ["-y", `@massu/core@${version}`]
-  };
+  const shim = resolveMassuShim();
+  servers.massu = shim !== null ? { type: "stdio", command: shim, args: [version] } : { type: "stdio", command: "npx", args: ["-y", `@massu/core@${version}`] };
   existing.mcpServers = servers;
   writeFileSync5(mcpPath, JSON.stringify(existing, null, 2) + "\n", "utf-8");
   return true;
@@ -16591,7 +16611,98 @@ function resolveHooksDir() {
   }
   return "node_modules/@massu/core/dist/hooks";
 }
-function hookCmd(version, hookName) {
+function massuRuntimeDir(version) {
+  return resolve9(homedir7(), ".massu", "runtime", version);
+}
+function massuRuntimeCliPath(version) {
+  return resolve9(massuRuntimeDir(version), "node_modules", "@massu", "core", "dist", "cli.js");
+}
+function resolveMassuRuntimeCli(version) {
+  if (process.env.MASSU_NO_NODE_DIRECT === "1") return null;
+  const cli = massuRuntimeCliPath(version);
+  if (!existsSync19(cli)) return null;
+  try {
+    execFileSync2(process.execPath, [cli, "--version"], { stdio: "ignore", timeout: 2e4 });
+    return cli;
+  } catch {
+    return null;
+  }
+}
+function materializeMassuRuntime(version) {
+  if (process.env.MASSU_NO_NODE_DIRECT === "1") return false;
+  if (resolveMassuRuntimeCli(version) !== null) return true;
+  const dir = massuRuntimeDir(version);
+  try {
+    mkdirSync10(dir, { recursive: true });
+    execFileSync2(
+      "npm",
+      ["install", "--prefix", dir, `@massu/core@${version}`, "--no-audit", "--no-fund", "--loglevel=error"],
+      { stdio: "ignore", timeout: 3e5 }
+    );
+  } catch {
+    return false;
+  }
+  return resolveMassuRuntimeCli(version) !== null;
+}
+function massuShimPath() {
+  return resolve9(homedir7(), ".massu", "bin", "massu-hook");
+}
+function massuShimBody() {
+  return `#!/bin/sh
+# massu launcher shim \u2014 GENERATED, do not edit. Recreated by \`massu install-hooks\`.
+#
+# usage: massu-hook <version> <subcommand...>
+#
+# Resolves the massu runtime AT FIRE TIME so a deleted/moved runtime degrades to npx
+# instead of silently 404-ing the hook (the P-003 failure class). exec preserves stdin,
+# stdout, stderr and the exit code.
+set -u
+if [ "$#" -lt 1 ]; then
+  echo "massu-hook: missing <version> argument" >&2
+  exit 2
+fi
+MASSU_VERSION="$1"
+shift
+MASSU_CLI="\${HOME}/.massu/runtime/\${MASSU_VERSION}/node_modules/@massu/core/dist/cli.js"
+if [ -f "$MASSU_CLI" ]; then
+  exec node "$MASSU_CLI" "$@"
+fi
+exec npx -y "@massu/core@\${MASSU_VERSION}" "$@"
+`;
+}
+function installMassuShim() {
+  if (process.env.MASSU_NO_NODE_DIRECT === "1") return false;
+  if (process.platform === "win32") return false;
+  const shim = massuShimPath();
+  try {
+    mkdirSync10(dirname12(shim), { recursive: true });
+    writeFileSync5(shim, massuShimBody(), "utf-8");
+    chmodSync5(shim, 493);
+  } catch {
+    return false;
+  }
+  try {
+    execFileSync2(shim, [], { stdio: "ignore", timeout: 1e4 });
+    return false;
+  } catch (e2) {
+    const status = e2.status;
+    return status === 2;
+  }
+}
+function resolveMassuShim() {
+  if (process.env.MASSU_NO_NODE_DIRECT === "1") return null;
+  if (process.platform === "win32") return null;
+  const shim = massuShimPath();
+  if (!existsSync19(shim)) return null;
+  try {
+    execFileSync2(shim, [], { stdio: "ignore", timeout: 1e4 });
+    return null;
+  } catch (e2) {
+    return e2.status === 2 ? shim : null;
+  }
+}
+function hookCmd(version, hookName, shim) {
+  if (shim !== null) return `"${shim}" ${version} hook-runner ${hookName}`;
   return `npx -y @massu/core@${version} hook-runner ${hookName}`;
 }
 function getHookTimeout(name) {
@@ -16599,11 +16710,12 @@ function getHookTimeout(name) {
 }
 function buildHooksConfig(_hooksDir) {
   const version = getInstallerVersion();
+  const shim = resolveMassuShim();
   return {
     SessionStart: [
       {
         hooks: [
-          { type: "command", command: hookCmd(version, "session-start"), timeout: getHookTimeout("session-start") }
+          { type: "command", command: hookCmd(version, "session-start", shim), timeout: getHookTimeout("session-start") }
         ]
       }
     ],
@@ -16618,26 +16730,26 @@ function buildHooksConfig(_hooksDir) {
       {
         matcher: "Bash|Write|Edit",
         hooks: [
-          { type: "command", command: hookCmd(version, "pre-tool-use-gate"), timeout: getHookTimeout("pre-tool-use-gate") }
+          { type: "command", command: hookCmd(version, "pre-tool-use-gate", shim), timeout: getHookTimeout("pre-tool-use-gate") }
         ]
       }
     ],
     PostToolUse: [
       {
         hooks: [
-          { type: "command", command: hookCmd(version, "post-tool-use"), timeout: getHookTimeout("post-tool-use") },
-          { type: "command", command: hookCmd(version, "quality-event"), timeout: getHookTimeout("quality-event") },
-          { type: "command", command: hookCmd(version, "cost-tracker"), timeout: getHookTimeout("cost-tracker") }
+          { type: "command", command: hookCmd(version, "post-tool-use", shim), timeout: getHookTimeout("post-tool-use") },
+          { type: "command", command: hookCmd(version, "quality-event", shim), timeout: getHookTimeout("quality-event") },
+          { type: "command", command: hookCmd(version, "cost-tracker", shim), timeout: getHookTimeout("cost-tracker") }
         ]
       },
       {
         matcher: "Edit|Write",
         hooks: [
-          { type: "command", command: hookCmd(version, "post-edit-context"), timeout: getHookTimeout("post-edit-context") },
+          { type: "command", command: hookCmd(version, "post-edit-context", shim), timeout: getHookTimeout("post-edit-context") },
           // Auto-learning pipeline — classifies failures and detects fixes on
           // file changes. See Phase 5-6 of the autodetect plan.
-          { type: "command", command: hookCmd(version, "fix-detector"), timeout: getHookTimeout("fix-detector") },
-          { type: "command", command: hookCmd(version, "classify-failure"), timeout: getHookTimeout("classify-failure") }
+          { type: "command", command: hookCmd(version, "fix-detector", shim), timeout: getHookTimeout("fix-detector") },
+          { type: "command", command: hookCmd(version, "classify-failure", shim), timeout: getHookTimeout("classify-failure") }
         ]
       },
       {
@@ -16645,35 +16757,35 @@ function buildHooksConfig(_hooksDir) {
         hooks: [
           // Incident + rule enforcement pipelines fire on Write-only (incidents
           // are authored as .md files; rules are enforced after new-file drops).
-          { type: "command", command: hookCmd(version, "incident-pipeline"), timeout: getHookTimeout("incident-pipeline") },
-          { type: "command", command: hookCmd(version, "rule-enforcement-pipeline"), timeout: getHookTimeout("rule-enforcement-pipeline") }
+          { type: "command", command: hookCmd(version, "incident-pipeline", shim), timeout: getHookTimeout("incident-pipeline") },
+          { type: "command", command: hookCmd(version, "rule-enforcement-pipeline", shim), timeout: getHookTimeout("rule-enforcement-pipeline") }
         ]
       }
     ],
     Stop: [
       {
         hooks: [
-          { type: "command", command: hookCmd(version, "session-end"), timeout: getHookTimeout("session-end") },
+          { type: "command", command: hookCmd(version, "session-end", shim), timeout: getHookTimeout("session-end") },
           // Session-end auto-learning aggregation (failure-class roll-up).
-          { type: "command", command: hookCmd(version, "auto-learning-pipeline"), timeout: getHookTimeout("auto-learning-pipeline") }
+          { type: "command", command: hookCmd(version, "auto-learning-pipeline", shim), timeout: getHookTimeout("auto-learning-pipeline") }
         ]
       }
     ],
     PreCompact: [
       {
         hooks: [
-          { type: "command", command: hookCmd(version, "pre-compact"), timeout: getHookTimeout("pre-compact") }
+          { type: "command", command: hookCmd(version, "pre-compact", shim), timeout: getHookTimeout("pre-compact") }
         ]
       }
     ],
     UserPromptSubmit: [
       {
         hooks: [
-          { type: "command", command: hookCmd(version, "user-prompt"), timeout: getHookTimeout("user-prompt") },
-          { type: "command", command: hookCmd(version, "intent-suggester"), timeout: getHookTimeout("intent-suggester") },
+          { type: "command", command: hookCmd(version, "user-prompt", shim), timeout: getHookTimeout("user-prompt") },
+          { type: "command", command: hookCmd(version, "intent-suggester", shim), timeout: getHookTimeout("intent-suggester") },
           // plan-living-memory-slice-1 P3-002: automatic relevant-recall.
           // Injects a compact "🧠 Relevant memory" block; fails open (empty).
-          { type: "command", command: hookCmd(version, "memory-recall"), timeout: getHookTimeout("memory-recall") }
+          { type: "command", command: hookCmd(version, "memory-recall", shim), timeout: getHookTimeout("memory-recall") }
         ]
       }
     ]
@@ -16711,21 +16823,31 @@ function mergeHooksConfig(existing, additions) {
   }
   return merged;
 }
+function massuHookIdentity(command) {
+  if (!/@massu\/core|[/\\]\.?massu[/\\]/.test(command)) return null;
+  const m3 = /\bhook-runner\s+([A-Za-z0-9._-]+)/.exec(command);
+  return m3 ? m3[1] : null;
+}
 function mergeHookEntries(existing, additions) {
-  const seen = /* @__PURE__ */ new Set();
+  const seenCommands = /* @__PURE__ */ new Set();
+  const seenIdentities = /* @__PURE__ */ new Set();
   const result = [];
-  for (const entry of additions ?? []) {
-    if (!entry || typeof entry.command !== "string") continue;
-    if (seen.has(entry.command)) continue;
-    seen.add(entry.command);
-    result.push(entry);
-  }
-  for (const entry of existing ?? []) {
-    if (!entry || typeof entry.command !== "string") continue;
-    if (seen.has(entry.command)) continue;
-    seen.add(entry.command);
+  const take = (entry) => {
+    if (!entry || typeof entry.command !== "string") return;
+    const identity = massuHookIdentity(entry.command);
+    if (identity !== null) {
+      if (seenIdentities.has(identity)) return;
+      seenIdentities.add(identity);
+      seenCommands.add(entry.command);
+      result.push(entry);
+      return;
+    }
+    if (seenCommands.has(entry.command)) return;
+    seenCommands.add(entry.command);
     result.push(entry);
-  }
+  };
+  for (const entry of additions ?? []) take(entry);
+  for (const entry of existing ?? []) take(entry);
   return result;
 }
 function installHooks(projectRoot) {
@@ -18716,6 +18838,16 @@ async function runInstallHooks() {
   console.log("Massu AI - Hook Installation");
   console.log("============================");
   console.log("");
+  const version = getInstallerVersion();
+  const shimOk = installMassuShim();
+  const runtimeOk = materializeMassuRuntime(version);
+  if (shimOk && runtimeOk) {
+    console.log("  Launcher: shim + runtime ready (fast path, ~9x cheaper per hook)");
+  } else if (shimOk) {
+    console.log("  Launcher: shim ready, runtime unavailable \u2014 shim will fall back to npx at fire time");
+  } else {
+    console.log("  Launcher: npx (shim unavailable \u2014 works, ~0.9s slower per hook)");
+  }
   const { count } = installHooks(projectRoot);
   console.log(`  Installed ${count} hooks in .claude/settings.local.json`);
   console.log("");
@@ -20454,7 +20586,7 @@ import { createHash as createHash8 } from "crypto";
 function renderMemoryFiles(db, candidates, opts) {
   const config = opts.config ?? resolveMemoryFilesConfig();
   if (!config.renderEnabled) {
-    return EMPTY("render_disabled");
+    return EMPTY("render_disabled", candidates.length);
   }
   const dryRun = opts.dryRun === true;
   const now = opts.now ?? Date.now();
@@ -20463,7 +20595,7 @@ function renderMemoryFiles(db, candidates, opts) {
   });
   const { memoryDir } = opts;
   if (!existsSync33(memoryDir)) {
-    return EMPTY("no_memory_dir");
+    return EMPTY("no_memory_dir", candidates.length);
   }
   try {
     return withMemoryIndexLock(
@@ -20472,10 +20604,10 @@ function renderMemoryFiles(db, candidates, opts) {
     );
   } catch (err) {
     if (err instanceof MemoryIndexLockBusy) {
-      return EMPTY("lock_busy");
+      return EMPTY("lock_busy", candidates.length);
     }
     audit("memory_file_render_refused", { reason: "unexpected_error", error: String(err) });
-    return EMPTY("error");
+    return EMPTY("error", candidates.length);
   }
 }
 function renderLocked(db, candidates, o) {
@@ -20485,11 +20617,14 @@ function renderLocked(db, candidates, o) {
   try {
     tombstones = readTombstones(memoryDir);
   } catch {
-    return EMPTY("tombstone_ledger_unreadable");
+    return EMPTY("tombstone_ledger_unreadable", candidates.length);
   }
   const ownerOf = relPathOwnerLookup(db);
   const planned = [];
-  for (const c2 of candidates) {
+  let unchanged = 0;
+  let capped = 0;
+  for (let i = 0; i < candidates.length; i++) {
+    const c2 = candidates[i];
     if (!isLocalOrigin(c2.origin)) {
       refusals.push({ name: c2.name, reason: "non_local_origin", detail: c2.origin || "unknown" });
       audit("memory_file_render_refused", { name: c2.name, reason: "non_local_origin" });
@@ -20545,7 +20680,10 @@ function renderLocked(db, candidates, o) {
         continue;
       }
       const next = composeFile(c2, home);
-      if (next !== null && next === existing) continue;
+      if (next !== null && next === existing) {
+        unchanged++;
+        continue;
+      }
     }
     const content = composeFile(c2, home);
     if (content === null) {
@@ -20553,9 +20691,24 @@ function renderLocked(db, candidates, o) {
       continue;
     }
     planned.push({ c: c2, relPath, absPath, content });
-    if (planned.length >= config.renderMaxFilesPerSession) break;
+    if (planned.length >= config.renderMaxFilesPerSession) {
+      capped = candidates.length - (i + 1);
+      break;
+    }
+  }
+  const accounted = planned.length + refusals.length + unchanged + capped;
+  if (accounted !== candidates.length) {
+    audit("memory_file_render_refused", {
+      reason: "accounting_leak",
+      considered: candidates.length,
+      accounted
+    });
+    throw new RenderAccountingLeak(
+      `render did not account for every candidate: considered=${candidates.length} but accounted=${accounted} (planned=${planned.length} refused=${refusals.length} unchanged=${unchanged} capped=${capped}). A candidate was dropped without a bucket.`
+    );
   }
   const indexLines = buildIndexLines(db, memoryDir, planned, config);
+  const books = { considered: candidates.length, unchanged, capped };
   if (dryRun) {
     return {
       enabled: true,
@@ -20563,11 +20716,20 @@ function renderLocked(db, candidates, o) {
       written: planned.map((p19) => p19.relPath),
       refusals,
       indexLines,
-      bytesWritten: 0
+      bytesWritten: 0,
+      ...books
     };
   }
   if (planned.length === 0 && indexLines.length === 0) {
-    return { enabled: true, dryRun: false, written: [], refusals, indexLines: [], bytesWritten: 0 };
+    return {
+      enabled: true,
+      dryRun: false,
+      written: [],
+      refusals,
+      indexLines: [],
+      bytesWritten: 0,
+      ...books
+    };
   }
   if (!hasFreshBackup(memoryDir, home)) {
     try {
@@ -20577,7 +20739,7 @@ function renderLocked(db, candidates, o) {
         reason: "backup_failed",
         error: err instanceof BackupError ? err.message : String(err)
       });
-      return EMPTY("backup_failed");
+      return EMPTY("backup_failed", candidates.length);
     }
   }
   const indexPath = o.indexPath ?? join19(memoryDir, "MEMORY.md");
@@ -20645,7 +20807,10 @@ function renderLocked(db, candidates, o) {
         errors: restored.errors
       });
       return {
-        ...EMPTY("rollback_incomplete"),
+        ...EMPTY("rollback_incomplete", candidates.length),
+        // The books were balanced before the write began; keep them rather than zeroing.
+        unchanged,
+        capped,
         enabled: true,
         refusals: [
           ...refusals,
@@ -20654,9 +20819,9 @@ function renderLocked(db, candidates, o) {
       };
     }
     audit("memory_file_render_refused", { reason: "write_failed", error: String(err) });
-    return { ...EMPTY("write_failed"), enabled: true, refusals };
+    return { ...EMPTY("write_failed", candidates.length), enabled: true, refusals, unchanged, capped };
   }
-  return { enabled: true, dryRun: false, written, refusals, indexLines, bytesWritten };
+  return { enabled: true, dryRun: false, written, refusals, indexLines, bytesWritten, ...books };
 }
 function sha2562(s) {
   return createHash8("sha256").update(s, "utf8").digest("hex");
@@ -20725,7 +20890,7 @@ function buildIndexLines(db, memoryDir, planned, config) {
 function oneLine(s) {
   return s.replace(/[\r\n]+/g, " ").slice(0, 120);
 }
-var EMPTY;
+var RenderAccountingLeak, EMPTY;
 var init_memory_renderer = __esm({
   "src/memory-renderer.ts"() {
     "use strict";
@@ -20740,14 +20905,22 @@ var init_memory_renderer = __esm({
     init_memory_index_region();
     init_memory_files_config();
     init_memory_file_ingest();
-    EMPTY = (reason) => ({
+    RenderAccountingLeak = class extends Error {
+    };
+    EMPTY = (reason, considered = 0) => ({
       enabled: false,
       dryRun: false,
       written: [],
       refusals: [],
       indexLines: [],
       bytesWritten: 0,
-      skippedReason: reason
+      skippedReason: reason,
+      // An early gate refused, so every candidate was dropped — by that ONE named reason.
+      // Reporting `considered` here is what distinguishes "nothing to do" from "walked away
+      // from 59 rows because the lock was busy".
+      considered,
+      unchanged: 0,
+      capped: 0
     });
   }
 });
@@ -20938,25 +21111,46 @@ var init_memory_render_cli = __esm({
 function loadRenderCandidates(db) {
   const cfg = resolveMemoryFilesConfig();
   const typePlaceholders = RENDERABLE_MEMORY_TYPES.map(() => "?").join(", ");
+  const WHERE = `WHERE importance >= ?
+       AND COALESCE(expired_at_epoch, 0) = 0
+       AND type IN (${typePlaceholders})`;
+  const { population } = db.prepare(`SELECT COUNT(*) AS population FROM observations ${WHERE}`).get(cfg.renderMinImportance, ...RENDERABLE_MEMORY_TYPES);
   const rows = db.prepare(
     `SELECT id, title, detail, importance, COALESCE(origin, 'local') AS origin
          FROM observations
-        WHERE importance >= ?
-          AND COALESCE(expired_at_epoch, 0) = 0
-          AND type IN (${typePlaceholders})
+         ${WHERE}
         ORDER BY importance DESC, created_at_epoch DESC
-        LIMIT 50`
+        LIMIT ${CANDIDATE_WINDOW}`
   ).all(cfg.renderMinImportance, ...RENDERABLE_MEMORY_TYPES);
-  return rows.filter((r2) => !r2.title.startsWith("[memory-file]")).map((r2) => ({
-    observationId: r2.id,
-    name: r2.title,
-    title: r2.title,
-    body: r2.detail ?? "",
-    importance: r2.importance,
-    origin: r2.origin
-  }));
+  const reingest = rows.filter((r2) => r2.title.startsWith("[memory-file]"));
+  const kept = rows.filter((r2) => !r2.title.startsWith("[memory-file]"));
+  const excluded = reingest.length ? [{ reason: EXCLUSION_MEMORY_FILE_REINGEST, count: reingest.length }] : [];
+  const ledger = {
+    population,
+    windowed: rows.length,
+    truncatedByWindow: Math.max(0, population - rows.length),
+    excluded,
+    returned: kept.length
+  };
+  const accounted = ledger.returned + ledger.truncatedByWindow + excluded.reduce((n, e2) => n + e2.count, 0);
+  if (accounted !== population) {
+    throw new CandidateAccountingLeak(
+      `candidate ledger does not balance: population=${population} but accounted=${accounted} (returned=${ledger.returned} truncated=${ledger.truncatedByWindow} excluded=${JSON.stringify(excluded)}). A row was dropped without a bucket.`
+    );
+  }
+  return {
+    ledger,
+    candidates: kept.map((r2) => ({
+      observationId: r2.id,
+      name: r2.title,
+      title: r2.title,
+      body: r2.detail ?? "",
+      importance: r2.importance,
+      origin: r2.origin
+    }))
+  };
 }
-var RENDERABLE_MEMORY_TYPES;
+var RENDERABLE_MEMORY_TYPES, CANDIDATE_WINDOW, EXCLUSION_MEMORY_FILE_REINGEST, CandidateAccountingLeak;
 var init_memory_render_candidates = __esm({
   "src/memory-render-candidates.ts"() {
     "use strict";
@@ -20967,6 +21161,10 @@ var init_memory_render_candidates = __esm({
       "incident_near_miss",
       "cr_violation"
     ];
+    CANDIDATE_WINDOW = 50;
+    EXCLUSION_MEMORY_FILE_REINGEST = "memory_file_reingest";
+    CandidateAccountingLeak = class extends Error {
+    };
   }
 });
 
@@ -21046,13 +21244,13 @@ function pruneNoiseObservations(db, opts = {}) {
   const counts = countNoise(db);
   if (dryRun || counts.total === 0) return { counts, expired: 0, dryRun };
   const nowSec = opts.now ?? Math.floor(Date.now() / 1e3);
-  const nowIso = new Date(nowSec * 1e3).toISOString();
+  const nowIso2 = new Date(nowSec * 1e3).toISOString();
   const res = db.prepare(
     `UPDATE observations
           SET expired_at = ?, expired_at_epoch = ?, valid_to = ?, valid_to_epoch = ?
         WHERE COALESCE(expired_at_epoch, 0) = 0
           AND ((${DA_PREDICATE}) OR (${FT_DECISION_PREDICATE}) OR (${DB_PREDICATE}))`
-  ).run(nowIso, nowSec, nowIso, nowSec);
+  ).run(nowIso2, nowSec, nowIso2, nowSec);
   return { counts, expired: res.changes, dryRun: false };
 }
 var DA_PREDICATE, FT_DECISION_PREDICATE, DB_PREDICATE;
@@ -21097,7 +21295,7 @@ async function runMemoryRenderCli(sub, args2) {
           };
         }
         const cfg = resolveMemoryFilesConfig();
-        const candidates = loadRenderCandidates(db);
+        const { candidates, ledger } = loadRenderCandidates(db);
         const result = renderMemoryFiles(db, candidates, {
           memoryDir,
           dryRun: true,
@@ -21112,6 +21310,19 @@ async function runMemoryRenderCli(sub, args2) {
         }
         lines.push(`Massu would write ${result.written.length} file(s):`);
         for (const f2 of result.written) lines.push(`  ${f2}`);
+        lines.push("", "Where every row went:");
+        lines.push(`  candidate population (type+importance+expiry) : ${ledger.population}`);
+        if (ledger.truncatedByWindow > 0) {
+          lines.push(`    truncated by the row window                : ${ledger.truncatedByWindow}`);
+        }
+        for (const e2 of ledger.excluded) {
+          lines.push(`    excluded: ${e2.reason.padEnd(30)} : ${e2.count}`);
+        }
+        lines.push(`    -> reached the renderer                    : ${ledger.returned}`);
+        lines.push(
+          `  renderer: considered ${result.considered} = written ${result.written.length} + refused ${result.refusals.length} + unchanged ${result.unchanged} + capped ${result.capped}`
+        );
+        lines.push(`  skipped: ${result.skippedReason ?? "(none)"}`);
         if (result.indexLines.length > 0) {
           lines.push("", "MEMORY.md \u2014 inside the massu:learned region only:");
           for (const l2 of result.indexLines) lines.push(`  ${l2}`);
@@ -23270,7 +23481,7 @@ async function pullInstalledPackRules(db, opts = {}) {
   }
   const packs = parsePacks(envelope.packs_json);
   const result = { ...ZERO };
-  const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+  const nowIso2 = (/* @__PURE__ */ new Date()).toISOString();
   for (const pack of packs) {
     if (!isValidInstalledPack(pack)) continue;
     for (const rawRule of pack.rules) {
@@ -23287,7 +23498,7 @@ async function pullInstalledPackRules(db, opts = {}) {
         result.skipped += 1;
         continue;
       }
-      materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack, signedOrgId, nowIso, opts.home ?? homedir20());
+      materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack, signedOrgId, nowIso2, opts.home ?? homedir20());
       result.materialized += 1;
     }
   }
@@ -23334,7 +23545,7 @@ function alreadyApplied(db, promptHash) {
     return false;
   }
 }
-function materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack, orgId, nowIso, home) {
+function materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack, orgId, nowIso2, home) {
   const promptText = `${rule.title}: ${rule.description}`.replace(/\n+/g, " ").slice(0, 200) || `pack rule ${promptHash}`;
   const draftText = rule.pattern ?? rule.check ?? rule.description;
   const hardened = isExecutableDestination(rule.destination);
@@ -23350,7 +23561,7 @@ function materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack
     score: 0,
     signals: [],
     prior_turn_files: [],
-    timestamp: nowIso,
+    timestamp: nowIso2,
     session_id: `pack:${pack.slug}`,
     // Provenance (P2-002/P2-003): the applier's team-origin / hardened apply-gate
     // keys on this. `origin:'pack'` rides the SAME gate as a team origin
@@ -23362,7 +23573,7 @@ function materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack
       origin: "pack",
       org_id: orgId,
       promoted_by: `pack:${pack.slug}`,
-      promoted_at: nowIso,
+      promoted_at: nowIso2,
       signature_verified: true,
       ...applyMac ? { apply_mac: applyMac } : {},
       pack_slug: pack.slug,
@@ -34562,7 +34773,7 @@ function indexAllKnowledge(db) {
     files.push(...docsFiles);
   }
   const now = /* @__PURE__ */ new Date();
-  const nowIso = now.toISOString();
+  const nowIso2 = now.toISOString();
   const nowEpoch = now.getTime();
   const transaction = db.transaction(() => {
     db.exec("DROP TRIGGER IF EXISTS kc_fts_delete");
@@ -34606,7 +34817,7 @@ function indexAllKnowledge(db) {
       const category = categorizeFile(filePath);
       const title = extractTitle(content, filePath);
       const description = extractDescription2(content);
-      const result = insertDoc.run(relPath, category, title, description, hash, nowIso, nowEpoch);
+      const result = insertDoc.run(relPath, category, title, description, hash, nowIso2, nowEpoch);
       const docId = result.lastInsertRowid;
       stats.filesIndexed++;
       const sections = parseSections(content, filePath);