@mnemom/mnemom 0.17.31 → 0.17.32-next.0

package/dist/lib/statusline.js

@@ -1,240 +1,82 @@
 /**
- * The `mnemom agent` status-bar savings counter: a Claude Code statusLine command that
- * prints "mnemom saved ~$X this session".
+ * The `mnemom agent` status-bar segment: a Claude Code statusLine command that prints
+ * "mnemom", after the user's own status line when they have one.
  *
- * The number is the first-run look's estimator (first-run/backtest.ts), applied live to this
- * session's own transcript: each request priced at API list prices, times the empirical
- * curve's lower-bound saving rate for its original context. So the counter and the
- * first-run screen always agree, and it rounds DOWN to the cent.
+ * The segment never says "saved" and never shows an estimate (decision 14). The old
+ * "mnemom saved ~$X this session" counter priced the transcript with the first-run look's
+ * benchmark estimate; it is gone on every channel, stable included.
  *
- * Claude Code runs the command on every status update with its status JSON on stdin
- * (session_id, transcript_path, …). It must be fast, so the transcript is read
- * incrementally: per session, a state file (~/.mnemom/statusline/<session>.json, 0600)
- * keeps each file's byte offset and each message id's contribution, and a tick reads at
- * most MAX_BYTES_PER_TICK of new bytes (a big resumed session catches up over ticks).
- *
- * Measured mode (the `measured-savings` experimental feature; the launch sets
- * MNEMOM_STATUSLINE_MEASURED=1): the gateway measures each request's saving — the stock
- * request's input cost minus what it billed — and writes it into the response usage as
- * `mnemom_savings` inside a `usage.iterations` entry, the one place Claude Code keeps an
- * unknown usage key in its transcript. The counter sums those per message id
- * ("mnemom saved $X this session", no "~": it is measured) and makes no claim before the
- * first one arrives. Its state lives in its own file (<session>.measured.json), so the two
- * modes never share a count.
+ * On a prerelease (`next`) launch the segment is fed: the launcher writes this session's
+ * measured model cost and μ from Record's accumulator to the file named in
+ * MNEMOM_STATUSLINE_FEED (lib/statusline-feed.ts), and the segment reads
+ * "mnemom · $0.42 · 1.70 μ". Until that file holds valid totals it is only "mnemom".
+ * Stable launches set no feed, so stable is only "mnemom".
  *
  * A user's own statusLine is never replaced: the launch passes it in
  * MNEMOM_STATUSLINE_INNER, it runs with the same stdin, and our segment is appended.
- * Read-only on every transcript; no network. It lives outside lib/first-run because it runs
- * the user's own statusLine command, and the first-run code is held to spawning nothing.
+ * No transcript reads and no network: the only file read is the feed.
  */
 import { execSync } from "node:child_process";
-import { closeSync, fstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, writeFileSync, } from "node:fs";
+import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { origContext, parseUsageLine, rowCost, ruleRate } from "./first-run/backtest.js";
 import { parseJson } from "./first-run/lines.js";
-export const STATE_DIR = "statusline";
-export const MAX_BYTES_PER_TICK = 8 * 1024 * 1024;
 /** The launcher passes the user's own statusLine command here. */
 export const INNER_ENV = "MNEMOM_STATUSLINE_INNER";
-/** Set to 1 to launch without the counter. */
+/** Set to 1 to launch without the segment. */
 export const NO_STATUSLINE_ENV = "MNEMOM_AGENT_NO_STATUSLINE";
-/** The launcher sets this to 1 when the gateway measures the session's saving. */
-export const MEASURED_ENV = "MNEMOM_STATUSLINE_MEASURED";
 export const INNER_TIMEOUT_MS = 2000;
-export function freshState() {
-    return { v: 1, files: {}, ids: {}, actual: 0, saved: 0 };
-}
-export function freshMeasuredState() {
-    return { v: 1, files: {}, ids: {}, saved: 0, seen: false };
-}
-/** The main transcript, then its subagent transcripts (sorted). */
-export function sessionFiles(transcriptPath) {
-    const dir = join(transcriptPath.replace(/\.jsonl$/, ""), "subagents");
-    let subs = [];
-    try {
-        subs = readdirSync(dir)
-            .filter((f) => f.endsWith(".jsonl"))
-            .sort()
-            .map((f) => join(dir, f));
-    }
-    catch {
-        /* no subagents */
-    }
-    return [transcriptPath, ...subs];
-}
+/** What the segment says until it is fed. */
+export const SEGMENT = "mnemom";
+/** The launcher names the feed file here (prerelease launches only). */
+export const FEED_ENV = "MNEMOM_STATUSLINE_FEED";
 /**
- * The complete lines of `path` from `offset`, at most `maxBytes` of them, and the offset
- * after the last complete line. null: the file is unreadable or shorter than `offset`.
+ * The gateway's per-conversation lineage key (deriveLineageKey): `cid:` or `cr:` + 16 hex.
+ * base-url-proxy.mjs (a standalone script) keeps its own copy; a test pins the two equal.
  */
-export function readNewLines(path, offset, maxBytes) {
-    let fd;
+export const LINEAGE_KEY_RE = /^(cid|cr):[0-9a-f]{16}$/;
+/** A millimu amount as the record route returns it: a decimal string, no sign, no leading 0. */
+export const MMU_RE = /^(0|[1-9][0-9]{0,18})$/;
+/** The feed file's totals, or null when it is absent or anything in it is off. */
+export function readFeed(path) {
     try {
-        fd = openSync(path, "r");
+        const d = parseJson(readFileSync(path, "utf8"));
+        if (!d)
+            return null;
+        const cost = d.model_cost_mmu;
+        const mu = d.mu_charged_mmu;
+        if (typeof cost !== "string" || !MMU_RE.test(cost))
+            return null;
+        if (mu !== null && (typeof mu !== "string" || !MMU_RE.test(mu)))
+            return null;
+        return { model_cost_mmu: cost, mu_charged_mmu: mu };
     }
     catch {
         return null;
     }
-    try {
-        const size = fstatSync(fd).size;
-        if (size < offset)
-            return null;
-        const n = Math.min(size - offset, maxBytes);
-        if (n <= 0)
-            return { lines: [], next: offset };
-        const buf = Buffer.allocUnsafe(n);
-        const got = readSync(fd, buf, 0, n, offset);
-        const view = buf.subarray(0, got);
-        const last = view.lastIndexOf(0x0a);
-        // One line longer than the whole budget: skip past it rather than stall forever.
-        if (last === -1)
-            return { lines: [], next: got === maxBytes ? offset + got : offset };
-        const lines = [];
-        let start = 0;
-        for (let nl = view.indexOf(0x0a); nl !== -1 && nl <= last; nl = view.indexOf(0x0a, start)) {
-            lines.push(view.subarray(start, nl));
-            start = nl + 1;
-        }
-        return { lines, next: offset + last + 1 };
-    }
-    finally {
-        closeSync(fd);
-    }
-}
-/**
- * The incremental read both modes share: each file's new complete lines, within the tick's
- * byte budget, go to `add` (with the key a record without an id is counted under). A file
- * that shrank or vanished starts over from `fresh()`.
- */
-function readSession(st, files, maxBytes, fresh, add) {
-    let budget = maxBytes;
-    for (const f of files) {
-        if (budget <= 0)
-            break;
-        const from = st.files[f] ?? 0;
-        const r = readNewLines(f, from, budget);
-        if (r === null) {
-            if (from > 0)
-                return readSession(fresh(), files, maxBytes, fresh, add);
-            continue;
-        }
-        budget -= r.next - from;
-        const subagent = f.includes("/subagents/");
-        r.lines.forEach((line, i) => add(st, line, subagent, `anon-${f}-${from}-${i}`));
-        st.files[f] = r.next;
-    }
-    return st;
 }
-/** Read what is new in the session's files into `st`. A file that shrank resets the count. */
-export function update(st, files, maxBytes = MAX_BYTES_PER_TICK) {
-    return readSession(st, files, maxBytes, freshState, (s, line, subagent, anonKey) => {
-        const p = parseUsageLine(line, subagent);
-        if (!p)
-            return;
-        const key = p.id ?? anonKey;
-        const cost = rowCost(p.row);
-        const saved = ruleRate(origContext(p.row)).screen * cost;
-        const prev = s.ids[key];
-        if (prev) {
-            s.actual -= prev[0];
-            s.saved -= prev[1];
-        }
-        s.ids[key] = [cost, saved];
-        s.actual += cost;
-        s.saved += saved;
-    });
+/** `n / 10^scale` rounded half up, as a decimal with `places` digits, in BigInt (never a float). */
+function fixed(mmu, divisor, places) {
+    const v = (BigInt(mmu) * 10n ** BigInt(places) * 2n + divisor) / (2n * divisor);
+    const s = v.toString().padStart(places + 1, "0");
+    return `${s.slice(0, -places)}.${s.slice(-places)}`;
 }
-const SAVINGS = Buffer.from('"mnemom_savings"');
-const ASSISTANT = Buffer.from('"assistant"');
-/** A `usage.iterations` entry's measured saving (`mnemom_savings` v1), or null. */
-export function measuredSaving(entry) {
-    const m = entry?.mnemom_savings;
-    return m?.v === 1 && Number.isFinite(m.saved_usd) ? m.saved_usd : null;
-}
-/**
- * One transcript line → the gateway's measured saving for its request, or null (not an
- * assistant record, or no measurement in its `message.usage.iterations`). `id` is the message
- * id (or record uuid); null when the record carries neither. Claude Code writes one record per
- * content block, all with the same id and usage, so the id is what dedupes them.
- */
-export function parseMeasuredLine(line) {
-    if (line.indexOf(SAVINGS) === -1 || line.indexOf(ASSISTANT) === -1)
-        return null;
-    const d = parseJson(line);
-    if (d?.type !== "assistant")
-        return null;
-    const m = d.message;
-    const iterations = m?.usage?.iterations;
-    if (!Array.isArray(iterations))
-        return null;
-    const saved = iterations.map(measuredSaving).find((v) => v !== null);
-    if (saved === undefined)
-        return null;
-    const id = (typeof m?.id === "string" && m.id) || (typeof d.uuid === "string" && d.uuid) || null;
-    return { id, saved };
+/** Model cost in dollars: 1000 mmu = 1 μ = 1¢. Under half a cent reads "<$0.01", never "$0.00". */
+export function formatCost(mmu) {
+    const big = BigInt(mmu);
+    if (big > 0n && big < 500n)
+        return "<$0.01";
+    return `$${fixed(mmu, 100000n, 2)}`;
 }
-/** Measured mode's `update`: sums each request's measured saving, replace-by-id. */
-export function updateMeasured(st, files, maxBytes = MAX_BYTES_PER_TICK) {
-    return readSession(st, files, maxBytes, freshMeasuredState, (s, line, _subagent, anonKey) => {
-        const p = parseMeasuredLine(line);
-        if (!p)
-            return;
-        const key = p.id ?? anonKey;
-        s.saved += p.saved - (s.ids[key] ?? 0);
-        s.ids[key] = p.saved;
-        s.seen = true;
-    });
+/** μ charged, two places; null (no billing row) reads "μ not charged" (OD-9). */
+export function formatMu(mmu) {
+    if (mmu === null)
+        return "μ not charged";
+    return `${fixed(mmu, 1000n, 2)} μ`;
 }
-/** USD rounded DOWN to the cent and never below 0.00. */
-function cents(usd) {
-    return (Math.max(Math.floor(usd * 100 + 1e-9), 0) / 100).toFixed(2);
-}
-/** The segment, rounded DOWN to the cent and never below $0.00. */
-export function segment(saved) {
-    return `mnemom saved ~$${cents(saved)} this session`;
-}
-/** Measured mode's segment: no claim until the gateway has measured something; no "~". */
-export function measuredSegment(st) {
-    return st.seen ? `mnemom saved $${cents(st.saved)} this session` : "mnemom";
-}
-function stateName(sessionId) {
-    return sessionId.replace(/[^A-Za-z0-9_-]/g, "_");
-}
-function statePath(stateDir, sessionId) {
-    return join(stateDir, `${stateName(sessionId)}.json`);
-}
-/** Measured mode's own file: a sanitized id has no ".", so it never collides with statePath. */
-function measuredStatePath(stateDir, sessionId) {
-    return join(stateDir, `${stateName(sessionId)}.measured.json`);
-}
-export function loadState(path) {
-    try {
-        const v = parseJson(readFileSync(path, "utf8"));
-        if (v && v.v === 1 && v.files && v.ids)
-            return v;
-    }
-    catch {
-        /* none yet */
-    }
-    return freshState();
-}
-export function loadMeasuredState(path) {
-    try {
-        const v = parseJson(readFileSync(path, "utf8"));
-        if (v && v.v === 1 && v.files && v.ids && typeof v.seen === "boolean") {
-            return v;
-        }
-    }
-    catch {
-        /* none yet */
-    }
-    return freshMeasuredState();
-}
-export function saveState(path, st) {
-    mkdirSync(join(path, ".."), { recursive: true, mode: 0o700 });
-    const tmp = `${path}.${process.pid}.tmp`;
-    writeFileSync(tmp, JSON.stringify(st), { mode: 0o600 });
-    renameSync(tmp, path);
+/** The segment for these totals: "mnemom · $0.42 · 1.70 μ". */
+export function fedSegment(t) {
+    return `${SEGMENT} · ${formatCost(t.model_cost_mmu)} · ${formatMu(t.mu_charged_mmu)}`;
 }
 /** Run the user's own statusLine command with the same stdin; its first line, or "". */
 export function runInner(command, input) {
@@ -251,43 +93,12 @@ export function runInner(command, input) {
         return "";
     }
 }
-/** Is the counter in measured mode? The launch's MEASURED_ENV, exactly "1". */
-export function measuredMode(env) {
-    return env[MEASURED_ENV] === "1";
-}
-function saveQuietly(path, st) {
-    try {
-        saveState(path, st);
-    }
-    catch {
-        /* an unwritable state dir only means the next tick re-reads */
-    }
-}
 /** Claude Code's status JSON → the one status line. Never throws. */
-export function render(stdin, deps) {
+export function render(stdin, deps = {}) {
     const innerOut = deps.inner ? (deps.runInner ?? runInner)(deps.inner, stdin) : "";
-    let seg = "mnemom";
-    try {
-        const d = parseJson(stdin);
-        const tp = typeof d?.transcript_path === "string" ? d.transcript_path : null;
-        const sid = typeof d?.session_id === "string" && d.session_id ? d.session_id : null;
-        if (tp && sid && deps.measured) {
-            const path = measuredStatePath(deps.stateDir, sid);
-            const st = updateMeasured(loadMeasuredState(path), sessionFiles(tp));
-            seg = measuredSegment(st);
-            saveQuietly(path, st);
-        }
-        else if (tp && sid) {
-            const path = statePath(deps.stateDir, sid);
-            const st = update(loadState(path), sessionFiles(tp));
-            seg = segment(st.saved);
-            saveQuietly(path, st);
-        }
-    }
-    catch {
-        /* the counter never breaks the status bar */
-    }
-    return innerOut ? `${innerOut} · ${seg}` : seg;
+    const totals = deps.feed ? readFeed(deps.feed) : null;
+    const segment = totals ? fedSegment(totals) : SEGMENT;
+    return innerOut ? `${innerOut} · ${segment}` : segment;
 }
 /**
  * The statusLine Claude Code would use without us: the first settings file (highest
@@ -319,9 +130,8 @@ export function userStatusLine(cwd, configDir) {
 }
 const sq = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
 /**
- * Launch args + env that add the counter, or null when it should stay off: the opt-out
+ * Launch args + env that add the segment, or null when it should stay off: the opt-out
  * env, or the user passing their own --settings (two would fight over precedence).
- * `measured` puts the counter in measured mode (MEASURED_ENV).
  */
 export function statuslineLaunch(o) {
     if (o.env[NO_STATUSLINE_ENV] === "1")
@@ -337,8 +147,6 @@ export function statuslineLaunch(o) {
     if (user?.padding !== undefined)
         statusLine.padding = user.padding;
     const env = user ? { [INNER_ENV]: user.command } : {};
-    if (o.measured)
-        env[MEASURED_ENV] = "1";
     // `settings` is the same layer as `args`, for a caller that merges it with its own (Claude Code
     // keeps only the last --settings it is given).
     return { args: ["--settings", JSON.stringify({ statusLine })], env, settings: { statusLine } };

package/dist/lib/update/decide.d.ts

@@ -15,8 +15,13 @@
  *            for entitled callers (internal cohort, staff, `cli_next` invite —
  *            GET /v1/cli/channel-entitlement); otherwise it behaves as latest.
  *
- * Never downgrades automatically: switching next → latest while ahead of latest
- * keeps the current build until latest overtakes it (`mnemom update --force`).
+ * Never downgrades on its own, with one exception: a moved tag. Switching
+ * next → latest while ahead of latest keeps the current build until latest
+ * overtakes it (`mnemom update --force`). But when the channel pointed at the
+ * running build on the last check and now points lower, the tag was moved back
+ * (a bad release rolled back by hand: OIDC publishing can't move a tag, a
+ * person can), and the next check follows it down. A build the channel never
+ * pointed at (a dev build, a newer local install) is never downgraded.
  */
 export type UpdateChannel = "latest" | "next";
 export type UpdateMode = "auto" | "notify" | "off";
@@ -64,6 +69,13 @@ export interface UpdateState {
     method?: InstallMethod;
     /** Channel the last successful update installed from; feeds defaultChannel. */
     followChannel?: UpdateChannel;
+    /** What the channel pointed at on the last check; detects a tag moved back. */
+    channelTarget?: {
+        channel: UpdateChannel;
+        version: string;
+    };
+    /** `available` is the channel's tag moved back below the running build. */
+    movedBack?: boolean;
     /** The background worker startup last spawned, while it runs (cleared when it finishes). */
     workerPid?: number;
     workerSince?: number;
@@ -124,6 +136,11 @@ export declare function entitlementFresh(cache: EntitlementCache | undefined, no
  * registry response).
  */
 export declare function pickTarget(tags: DistTags, channel: UpdateChannel): string | undefined;
+/**
+ * The channel's tag was moved back off the running build: on the last check it
+ * pointed at `current`, and now it points at an older version.
+ */
+export declare function tagMovedBack(previous: UpdateState["channelTarget"], channel: UpdateChannel, current: string, target: string | undefined): boolean;
 /**
  * Longest a worker lives: it waits for its parent `mnemom` (a whole agent session)
  * up to this long. A recorded worker older than this is treated as gone, so a
@@ -155,7 +172,8 @@ export type UpdateAction = {
 /**
  * The single decision: given where the registry is and how we're installed,
  * install / notify / do nothing. `force` (explicit `mnemom update --force`)
- * permits a downgrade to the channel's target.
+ * permits a downgrade to the channel's target; `followMovedTag` (see
+ * tagMovedBack) permits one to the version the channel's tag was moved back to.
  */
 export declare function decide(input: {
     current: string;
@@ -164,6 +182,7 @@ export declare function decide(input: {
     method: InstallMethod;
     installBlocked?: boolean;
     force?: boolean;
+    followMovedTag?: boolean;
 }): UpdateAction;
 /** The command a human should run to upgrade, for the given install method. */
 export declare function manualUpgradeCommand(method: InstallMethod, version: string): string;

package/dist/lib/update/decide.js

@@ -15,8 +15,13 @@
  *            for entitled callers (internal cohort, staff, `cli_next` invite —
  *            GET /v1/cli/channel-entitlement); otherwise it behaves as latest.
  *
- * Never downgrades automatically: switching next → latest while ahead of latest
- * keeps the current build until latest overtakes it (`mnemom update --force`).
+ * Never downgrades on its own, with one exception: a moved tag. Switching
+ * next → latest while ahead of latest keeps the current build until latest
+ * overtakes it (`mnemom update --force`). But when the channel pointed at the
+ * running build on the last check and now points lower, the tag was moved back
+ * (a bad release rolled back by hand: OIDC publishing can't move a tag, a
+ * person can), and the next check follows it down. A build the channel never
+ * pointed at (a dev build, a newer local install) is never downgraded.
  */
 import { compareVersions, isPrerelease, isValidVersion } from "./semver.js";
 export const UPDATE_CHANNELS = ["latest", "next"];
@@ -115,6 +120,24 @@ export function pickTarget(tags, channel) {
         return next;
     return compareVersions(next, stable) >= 0 ? next : stable;
 }
+/**
+ * The channel's tag was moved back off the running build: on the last check it
+ * pointed at `current`, and now it points at an older version.
+ */
+export function tagMovedBack(previous, channel, current, target) {
+    return (previous !== undefined &&
+        previous.channel === channel &&
+        previous.version === current &&
+        target !== undefined &&
+        compareVersions(target, current) < 0);
+}
+/** `state.available` is something to act on: newer, or the tag moved back to it. */
+function actionable(state, current) {
+    if (!state.available || !isValidVersion(state.available))
+        return false;
+    const cmp = compareVersions(state.available, current);
+    return cmp > 0 || (state.movedBack === true && cmp < 0);
+}
 /**
  * Longest a worker lives: it waits for its parent `mnemom` (a whole agent session)
  * up to this long. A recorded worker older than this is treated as gone, so a
@@ -128,9 +151,7 @@ export const WORKER_MAX_AGE_MS = 12 * HOUR;
  * scheduled check.
  */
 export function shouldResume(state, current, now, alive) {
-    if (!state.available || !isValidVersion(state.available))
-        return false;
-    if (compareVersions(state.available, current) <= 0)
+    if (!actionable(state, current))
         return false;
     if (state.installBlocked || !canSelfUpdate(state.method ?? "unknown"))
         return false;
@@ -160,10 +181,11 @@ export function canSelfUpdate(method) {
 /**
  * The single decision: given where the registry is and how we're installed,
  * install / notify / do nothing. `force` (explicit `mnemom update --force`)
- * permits a downgrade to the channel's target.
+ * permits a downgrade to the channel's target; `followMovedTag` (see
+ * tagMovedBack) permits one to the version the channel's tag was moved back to.
  */
 export function decide(input) {
-    const { current, target, mode, method, installBlocked, force } = input;
+    const { current, target, mode, method, installBlocked, force, followMovedTag } = input;
     if (mode === "off")
         return { kind: "noop", reason: "updates are off" };
     if (!target)
@@ -171,7 +193,7 @@ export function decide(input) {
     const cmp = compareVersions(target, current);
     if (cmp === 0)
         return { kind: "noop", reason: "already on the newest version" };
-    if (cmp < 0 && !force)
+    if (cmp < 0 && !force && !followMovedTag)
         return { kind: "noop", reason: "current build is newer than the channel" };
     if (!canSelfUpdate(method)) {
         return { kind: "notify", version: target, reason: `installed via ${method}` };
@@ -215,9 +237,7 @@ export function startupNotice(input) {
             patch: { pending: undefined },
         };
     }
-    if (mode === "off" || !state.available || !isValidVersion(state.available))
-        return null;
-    if (compareVersions(state.available, current) <= 0)
+    if (mode === "off" || !actionable(state, current))
         return null;
     // In auto mode with a working self-update, the worker installs it — stay quiet.
     if (mode === "auto" && canSelfUpdate(method) && !state.installBlocked)
@@ -229,8 +249,11 @@ export function startupNotice(input) {
         : state.installBlocked
             ? ` — the global npm prefix isn't writable; run: ${manualUpgradeCommand(method, state.available)} (see https://docs.npmjs.com/resolving-eacces-permissions-errors-when-installing-packages-globally)`
             : " — run: mnemom update";
+    const what = state.movedBack
+        ? `mnemom ${current} was withdrawn; the channel is back on ${state.available}`
+        : `mnemom ${state.available} is available (you have ${current})`;
     return {
-        message: `mnemom ${state.available} is available (you have ${current})${cmd}`,
+        message: `${what}${cmd}`,
         patch: { lastNotified: now },
     };
 }

package/dist/lib/update/doctor.js

@@ -46,7 +46,11 @@ export function updateDoctorRow(input) {
             hint: "it retries automatically with backoff; `mnemom update` retries now",
         };
     }
-    const pending = state.available ? `, ${state.available} available` : "";
+    const pending = !state.available
+        ? ""
+        : state.movedBack
+            ? `, withdrawn: the channel is back on ${state.available}`
+            : `, ${state.available} available`;
     return {
         mark: "ok",
         text: `auto-update: ${settings.mode} on ${settings.channel} (v${current}${pending})`,

package/dist/lib/update/run.d.ts

@@ -42,6 +42,8 @@ export interface RunResult {
     action?: UpdateAction;
     installed?: string;
     error?: string;
+    /** The channel's tag moved back below the running build (a withdrawn release). */
+    movedBack?: boolean;
 }
 /**
  * Resolve the `next` entitlement: a fresh cache wins; otherwise ask the API.

package/dist/lib/update/run.js

@@ -5,7 +5,7 @@
  * (maybe) install → persist state. Never throws; failures become state
  * (backoff) and a result the caller may print.
  */
-import { backoffDelay, decide, effectiveChannel, entitlementFresh, pickTarget, } from "./decide.js";
+import { backoffDelay, decide, effectiveChannel, entitlementFresh, pickTarget, tagMovedBack, } from "./decide.js";
 import { compareVersions } from "./semver.js";
 /**
  * Resolve the `next` entitlement: a fresh cache wins; otherwise ask the API.
@@ -55,6 +55,7 @@ export async function runUpdate(deps, settings, opts = {}) {
     const channelDowngraded = channel !== settings.channel;
     const target = pickTarget(tags, channel);
     const method = await deps.installMethod();
+    const movedBack = tagMovedBack(state.channelTarget, channel, deps.current, target);
     const action = decide({
         current: deps.current,
         target,
@@ -63,17 +64,30 @@ export async function runUpdate(deps, settings, opts = {}) {
         // An explicit `mnemom update` retries even after an EACCES (the user may have fixed it).
         installBlocked: opts.foreground ? false : state.installBlocked,
         force: opts.force,
+        followMovedTag: movedBack,
     });
     const newer = target !== undefined && compareVersions(target, deps.current) > 0;
     const base = {
         lastCheck: now,
         method,
-        available: newer ? target : undefined,
+        available: newer || movedBack ? target : undefined,
+        movedBack: movedBack || undefined,
+        // A moved-back tag keeps the old record until it is followed, so a deferred
+        // or notify-only pass doesn't forget the move on the next check; an empty
+        // answer from the registry keeps it too.
+        ...(movedBack || target === undefined ? {} : { channelTarget: { channel, version: target } }),
         failures: undefined,
         backoffUntil: undefined,
         lastError: undefined,
     };
-    const result = { channel, channelDowngraded, method, target, action };
+    const result = {
+        channel,
+        channelDowngraded,
+        method,
+        target,
+        action,
+        ...(movedBack ? { movedBack: true } : {}),
+    };
     if (action.kind !== "install") {
         deps.saveState({ ...base, ...done });
         return result;
@@ -94,9 +108,11 @@ export async function runUpdate(deps, settings, opts = {}) {
         deps.saveState({
             ...base,
             available: undefined,
+            movedBack: undefined,
             installBlocked: undefined,
             pending: { from: deps.current, to: action.version, channel },
             followChannel: channel,
+            channelTarget: { channel, version: action.version },
             ...done,
         });
         return { ...result, installed: action.version };
@@ -106,11 +122,9 @@ export async function runUpdate(deps, settings, opts = {}) {
         deps.saveState({ ...base, installBlocked: true, lastError: outcome.message, ...done });
     }
     else {
-        deps.saveState({
-            ...failurePatch(state, now, outcome.message),
-            available: base.available,
-            ...done,
-        });
+        // Keep the moved-tag record: startup reads `movedBack` to notify and resume,
+        // and a moved-back tag must stay remembered until it is followed.
+        deps.saveState({ ...base, ...failurePatch(state, now, outcome.message), ...done });
     }
     return { ...result, error: outcome.message };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.31",
+  "version": "0.17.32-next.0",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {