harnery 0.36.0 → 0.38.0

package/dist/core/diagnostics/contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../../src/core/diagnostics/contract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,2BAA2B,CAAC;AAEnC,eAAO,MAAM,gCAAgC,EAAG,CAAU,CAAC;AAC3D,eAAO,MAAM,iCAAiC,EAAG,CAAU,CAAC;AAC5D,eAAO,MAAM,+BAA+B,EAAG,CAAU,CAAC;AAC1D,eAAO,MAAM,kCAAkC,EAAG,CAAU,CAAC;AAC7D,eAAO,MAAM,iCAAiC,EAAG,CAAU,CAAC;AAC5D,eAAO,MAAM,gCAAgC,EAAG,CAAU,CAAC;AAC3D,eAAO,MAAM,oCAAoC,EAAG,CAAU,CAAC;AAE/D,eAAO,MAAM,wBAAwB;;;CAG3B,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AAChF,MAAM,MAAM,8BAA8B,GACtC,SAAS,GACT,aAAa,GACb,mBAAmB,GACnB,SAAS,CAAC;AAEd,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,SAAS,GAAG,UAAU,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qBAAqB,CAAC,EAAE,aAAa,GAAG,wBAAwB,GAAG,SAAS,CAAC;CAC9E;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EACA,0BAA0B,GAC1B,yBAAyB,GACzB,6BAA6B,GAC7B,6BAA6B,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,OAAO,gCAAgC,CAAC;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,sBAAsB,EAAE,8BAA8B,CAAC;IACvD,aAAa,EAAE,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,oBAAoB,CAAC;IACxC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,0BAA0B,EAAE,MAAM,CAAC;IACnC,kCAAkC,EAAE,MAAM,CAAC;IAC3C,qBAAqB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC1D,OAAO,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAC5C;AAED,eAAO,MAAM,uBAAuB,8HAM1B,CAAC;AAEX,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,CAAC,wBAAwB,EAAE,0BAA0B,CAAC,CAAC;IACpE,UAAU,EAAE,kBAAkB,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,0BAA0B,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,OAAO,gCAAgC,CAAC;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC3C,YAAY,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC9C,KAAK,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACvC,MAAM,EAAE;QACN,UAAU,EAAE,0BAA0B,CAAC;QACvC,eAAe,EAAE,wBAAwB,CAAC;QAC1C,aAAa,EAAE,eAAe,CAAC;KAChC,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,OAAO,+BAA+B,CAAC;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,OAAO,+BAA+B,CAAC;IACvD,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,OAAO,kCAAkC,CAAC;IAC1D,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACzC,YAAY,EAAE,SAAS,4BAA4B,EAAE,CAAC;IACtD,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,OAAO,iCAAiC,CAAC;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,cAAc,CAAC;IAChC,SAAS,EAAE,mBAAmB,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,wBAAwB,CAAC;IACnC,YAAY,EAAE,sBAAsB,CAAC;IACrC,UAAU,EAAE,oBAAoB,CAAC;IACjC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,OAAO,iCAAiC,CAAC;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,0BAA0B,GAClC,YAAY,GACZ,UAAU,GACV,SAAS,GACT,UAAU,GACV,UAAU,GACV,WAAW,CAAC;AAEhB,MAAM,MAAM,4BAA4B,GAAG,OAAO,GAAG,UAAU,GAAG,YAAY,CAAC;AAE/E,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EACD,UAAU,GACV,OAAO,GACP,kBAAkB,GAClB,qBAAqB,GACrB,OAAO,GACP,uBAAuB,CAAC;IAC5B,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,4BAA4B,CAAC;IAC3C,MAAM,EAAE,0BAA0B,CAAC;IACnC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,aAAa,EAAE,SAAS,4BAA4B,EAAE,CAAC;CACxD;AAED,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;IACtD,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,KAAK,CAAC,EAAE,oBAAoB,CAAC;CAC9B;AAED,MAAM,WAAW,8BAA8B;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,2BAA2B;IAC1C,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,SAAS,8BAA8B,EAAE,CAAC;CACvD;AAED,MAAM,WAAW,gCAAgC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kCAAkC,CAAC,CAAC;IACnD,iBAAiB,EAAE,oBAAoB,CAAC;IACxC,gBAAgB,EAAE,oBAAoB,CAAC;IACvC,MAAM,CAAC,EAAE,CAAC,CAAC;IACX,KAAK,CAAC,EAAE,CAAC,CAAC;CACX;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EACA,0BAA0B,GAC1B,wBAAwB,GACxB,iBAAiB,GACjB,wBAAwB,GACxB,uBAAuB,GACvB,2BAA2B,GAC3B,yBAAyB,GACzB,8BAA8B,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,0BAA0B;IACzC,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,aAAa,EAAE,IAAI,CAAC;IACpB,MAAM,EAAE,6BAA6B,CAAC;IACtC,KAAK,EAAE,6BAA6B,CAAC;IACrC,aAAa,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,QAAQ,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACjD,MAAM,EAAE;QACN,MAAM,EAAE,gBAAgB,CAAC;QACzB,KAAK,EAAE,gBAAgB,CAAC;QACxB,SAAS,EAAE,WAAW,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,CAAC;KAClE,CAAC;IACF,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,SAAS,2BAA2B,EAAE,CAAC;KAC9C,CAAC;IACF,YAAY,EAAE,SAAS,8BAA8B,EAAE,CAAC;IACxD,WAAW,EAAE,kCAAkC,CAAC,2BAA2B,CAAC,CAAC;IAC7E,gBAAgB,EAAE,kCAAkC,CAAC,gCAAgC,CAAC,CAAC;IACvF,iBAAiB,EAAE,MAAM,CAAC;CAC3B"}

package/dist/core/diagnostics/contract.js

@@ -0,0 +1,18 @@
+export const DIAGNOSTIC_BUNDLE_SCHEMA_VERSION = 3;
+export const DIAGNOSTIC_COMMAND_SCHEMA_VERSION = 1;
+export const DIAGNOSTIC_INPUT_SCHEMA_VERSION = 2;
+export const DIAGNOSTIC_EXPECTED_SCHEMA_VERSION = 3;
+export const DIAGNOSTIC_SUMMARY_SCHEMA_VERSION = 1;
+export const DIAGNOSTIC_ADVICE_SCHEMA_VERSION = 1;
+export const DIAGNOSTIC_COMPARISON_SCHEMA_VERSION = 1;
+export const DIAGNOSTIC_ADVICE_LIMITS = {
+    max_contributing_findings: 8,
+    max_reasons: 4,
+};
+export const DIAGNOSTIC_BUNDLE_FILES = [
+    "diagnostic-manifest.json",
+    "inputs/observations.json",
+    "inputs/thresholds.json",
+    "expected.json",
+    "summary.json",
+];

package/dist/core/diagnostics/identity.d.ts

@@ -0,0 +1,3 @@
+/** Stable within one machine label, but not reversible to that label. */
+export declare function pseudonymousMachineId(machineLabel?: string): string;
+//# sourceMappingURL=identity.d.ts.map

package/dist/core/diagnostics/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/core/diagnostics/identity.ts"],"names":[],"mappings":"AAGA,yEAAyE;AACzE,wBAAgB,qBAAqB,CAAC,YAAY,SAAwB,GAAG,MAAM,CAMlF"}

package/dist/core/diagnostics/identity.js

@@ -0,0 +1,10 @@
+import { createHash } from "node:crypto";
+import { resolveMachineLabel } from "../../lib/machine.js";
+/** Stable within one machine label, but not reversible to that label. */
+export function pseudonymousMachineId(machineLabel = resolveMachineLabel()) {
+    const digest = createHash("sha256")
+        .update("harnery-diagnostic-machine-v1\0")
+        .update(machineLabel)
+        .digest("hex");
+    return `machine_${digest}`;
+}

package/dist/core/diagnostics/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./advice.js";
+export * from "./bundle.js";
+export * from "./comparison.js";
+export * from "./contract.js";
+export * from "./identity.js";
+export * from "./replay.js";
+export * from "./sanitize.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/core/diagnostics/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/diagnostics/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}

package/dist/core/diagnostics/index.js

@@ -0,0 +1,7 @@
+export * from "./advice.js";
+export * from "./bundle.js";
+export * from "./comparison.js";
+export * from "./contract.js";
+export * from "./identity.js";
+export * from "./replay.js";
+export * from "./sanitize.js";

package/dist/core/diagnostics/replay.d.ts

@@ -0,0 +1,8 @@
+import { type DiagnosticExpected, type DiagnosticObservations, type DiagnosticThresholds } from "./contract.js";
+export declare function canonicalJson(value: unknown): string;
+export declare function sha256(value: string | Buffer): string;
+/** Record the live engine's frozen output. Replay never uses this as an input. */
+export declare function deriveCapturedExpected(observations: DiagnosticObservations, thresholds: DiagnosticThresholds): DiagnosticExpected;
+/** Re-run the pure finding engine from frozen source inputs only. */
+export declare function replayDiagnosticInputs(observations: DiagnosticObservations, thresholds: DiagnosticThresholds): DiagnosticExpected;
+//# sourceMappingURL=replay.d.ts.map

package/dist/core/diagnostics/replay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../../../src/core/diagnostics/replay.ts"],"names":[],"mappings":"AA0BA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAE3B,KAAK,oBAAoB,EAC1B,MAAM,eAAe,CAAC;AAEvB,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAErD;AAED,kFAAkF;AAClF,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,sBAAsB,EACpC,UAAU,EAAE,oBAAoB,GAC/B,kBAAkB,CAkBpB;AAED,qEAAqE;AACrE,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,sBAAsB,EACpC,UAAU,EAAE,oBAAoB,GAC/B,kBAAkB,CAiDpB"}

package/dist/core/diagnostics/replay.js

@@ -0,0 +1,213 @@
+import { createHash } from "node:crypto";
+import { RESOURCE_SNAPSHOT_SCHEMA_VERSION } from "../resources/contract.js";
+import { SUPERVISOR_HISTORY_SCHEMA_VERSION, SUPERVISOR_LOG_FEED_SCHEMA_VERSION, SUPERVISOR_SNAPSHOT_SCHEMA_VERSION, } from "../supervisor/contract.js";
+import { explainSupervisorFinding } from "../supervisor/explanations.js";
+import { updateSupervisorFindings } from "../supervisor/findings.js";
+import { projectHookHealth } from "../supervisor/hook-health.js";
+import { buildSupervisorTimeline } from "../supervisor/timeline.js";
+import { buildDiagnosticAdvice } from "./advice.js";
+import { DIAGNOSTIC_EXPECTED_SCHEMA_VERSION, } from "./contract.js";
+export function canonicalJson(value) {
+    return JSON.stringify(sortValue(value));
+}
+export function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+/** Record the live engine's frozen output. Replay never uses this as an input. */
+export function deriveCapturedExpected(observations, thresholds) {
+    const selection = observations.selection;
+    const findings = filterFindings(findingsProjection(sourceValue(observations, "supervisor.findings")), selection);
+    const coordination = sourceValue(observations, "coordination.health");
+    const relatedSources = coordination?.recent_events ?? [];
+    return expected(thresholds, selection, findings, findings.map((finding) => diagnosticTimeline(finding, relatedSources)), findings.map(explainSupervisorFinding), observations);
+}
+/** Re-run the pure finding engine from frozen source inputs only. */
+export function replayDiagnosticInputs(observations, thresholds) {
+    const resource = optionalSource(observations, "resources.snapshot") ??
+        neutralResource(observations.captured_at);
+    const supervisor = optionalSource(observations, "supervisor.snapshot") ??
+        neutralSupervisor(observations.captured_at);
+    const history = optionalSource(observations, "supervisor.history") ?? neutralHistory();
+    const logFeed = optionalSource(observations, "supervisor.log-feed") ??
+        neutralLogFeed(observations.captured_at);
+    const hookHealth = projectHookHealth(logFeed, new Date(observations.captured_at));
+    const coordination = optionalSource(observations, "coordination.health");
+    const activity = optionalSource(observations, "supervisor.activity");
+    const currentProjection = optionalSource(observations, "supervisor.findings");
+    const observedAt = currentProjection?.active[0]?.observed_at ??
+        currentProjection?.transitions.at(-1)?.observed_at ??
+        resource.sampled_at;
+    // The frozen projection supplies lifecycle state only. Candidates, severity,
+    // attribution, workload context, and evidence are all re-evaluated from the
+    // captured source observations. Without this prior state, a replay would
+    // mint fresh IDs and discard recurrence and peak history for open episodes.
+    const evaluated = updateSupervisorFindings({
+        previous: currentProjection,
+        resource,
+        services: supervisor.services,
+        hooks: supervisor.hooks,
+        history,
+        logFeed,
+        hookHealth,
+        coordination,
+        activity,
+        now: new Date(observedAt),
+    });
+    const findings = filterFindings(findingsProjection(evaluated), observations.selection);
+    const relatedSources = coordination?.recent_events ?? [];
+    return expected(thresholds, observations.selection, findings, findings.map((finding) => diagnosticTimeline(finding, relatedSources)), findings.map(explainSupervisorFinding), observations);
+}
+function diagnosticTimeline(finding, relatedSources) {
+    return buildSupervisorTimeline(finding, relatedSources.filter((source) => {
+        const delta = Math.abs(Date.parse(source.observed_at) - Date.parse(finding.observed_at));
+        return Number.isFinite(delta) && delta <= 5 * 60_000;
+    }));
+}
+function expected(thresholds, selection, findings, timelines, explanations, observations) {
+    return {
+        schema_version: DIAGNOSTIC_EXPECTED_SCHEMA_VERSION,
+        threshold_digest: sha256(canonicalJson(thresholds)),
+        selection,
+        findings,
+        timelines: [...timelines].sort((left, right) => left.finding_id.localeCompare(right.finding_id)),
+        explanations: [...explanations].sort((left, right) => left.finding_id.localeCompare(right.finding_id)),
+        advice: buildDiagnosticAdvice({
+            findings,
+            sourceCapability: capturedSourceCapability(observations, "supervisor.findings"),
+            evaluatedAt: observations.captured_at,
+        }),
+    };
+}
+function capturedSourceCapability(observations, sourceKind) {
+    const source = observations.sources.find((candidate) => candidate.source_kind === sourceKind);
+    return source
+        ? {
+            source_kind: sourceKind,
+            state: source.capability,
+            reason_code: source.reason_code,
+        }
+        : {
+            source_kind: sourceKind,
+            state: "unsupported",
+            reason_code: "source_missing",
+        };
+}
+function findingsProjection(value) {
+    const record = object(value);
+    return [
+        ...collectNamedRecords(record?.active),
+        ...collectNamedRecords(record?.transitions),
+    ];
+}
+function filterFindings(rows, selection) {
+    const deduped = new Map(rows.map((finding) => [finding.id, finding]));
+    return [...deduped.values()]
+        .filter((finding) => {
+        if (selection.finding_id)
+            return finding.id === selection.finding_id;
+        const observed = Date.parse(finding.observed_at);
+        return observed >= Date.parse(selection.start_at) && observed <= Date.parse(selection.end_at);
+    })
+        .sort((left, right) => left.observed_at.localeCompare(right.observed_at) || left.id.localeCompare(right.id));
+}
+function optionalSource(observations, sourceKind) {
+    const source = observations.sources.find((candidate) => candidate.source_kind === sourceKind);
+    return source?.capability === "supported" && source.value !== undefined
+        ? source.value
+        : undefined;
+}
+function neutralResource(sampledAt) {
+    return {
+        schema_version: RESOURCE_SNAPSHOT_SCHEMA_VERSION,
+        sampled_at: sampledAt,
+        interval_ms: null,
+        sample_duration_ms: 0,
+        collector_cpu_ms: 0,
+        platform: "linux",
+        namespace: "unknown",
+        support: {
+            state: "unsupported",
+            sampler: "unsupported",
+            reason: "captured-source-unavailable",
+        },
+        machine: {
+            cpu_percent: null,
+            cpu_logical_count: 0,
+            load_average: null,
+            memory_total_bytes: null,
+            memory_available_bytes: null,
+            memory_used_bytes: null,
+            memory_percent: null,
+            swap_total_bytes: null,
+            swap_used_bytes: null,
+            process_count: 0,
+        },
+        groups: [],
+        processes: [],
+        visible_process_count: 0,
+        omitted_process_count: 0,
+        unattributed_process_count: 0,
+    };
+}
+function neutralSupervisor(sampledAt) {
+    return {
+        schema_version: SUPERVISOR_SNAPSHOT_SCHEMA_VERSION,
+        sampled_at: sampledAt,
+        sequence: 0,
+        collector_duration_ms: 0,
+        resource_sample_duration_ms: 0,
+        services: [],
+        hooks: [],
+        active_finding_count: 0,
+        history_point_count: 0,
+        log_record_count: 0,
+        live_consumer_count: 0,
+        attributed_agent_count: 0,
+    };
+}
+function neutralHistory() {
+    return {
+        schema_version: SUPERVISOR_HISTORY_SCHEMA_VERSION,
+        interval_ms: 10_000,
+        max_points: 90,
+        points: [],
+    };
+}
+function neutralLogFeed(capturedAt) {
+    return {
+        schema_version: SUPERVISOR_LOG_FEED_SCHEMA_VERSION,
+        captured_at: capturedAt,
+        sequence: 0,
+        lanes: [],
+        total_records: 0,
+        unavailable_families: 0,
+    };
+}
+function sourceValue(observations, sourceKind) {
+    return observations.sources.find((source) => source.source_kind === sourceKind)?.value;
+}
+function collectNamedRecords(value) {
+    if (Array.isArray(value))
+        return value.filter(isObject);
+    const record = object(value);
+    if (!record)
+        return [];
+    if (Array.isArray(record.rows))
+        return record.rows.filter(isObject);
+    return Object.values(record).filter(isObject);
+}
+function sortValue(value) {
+    if (Array.isArray(value))
+        return value.map(sortValue);
+    if (!isObject(value))
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, item]) => [key, sortValue(item)]));
+}
+function object(value) {
+    return isObject(value) ? value : undefined;
+}
+function isObject(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}

package/dist/core/diagnostics/sanitize.d.ts

@@ -0,0 +1,9 @@
+export interface SanitizationStats {
+    sanitized_value_count: number;
+    omitted_value_count: number;
+}
+export declare function sanitizeDiagnosticValue(value: unknown): {
+    value: unknown;
+    stats: SanitizationStats;
+};
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/core/diagnostics/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../src/core/diagnostics/sanitize.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,iBAAiB;IAChC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG;IACvD,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,iBAAiB,CAAC;CAC1B,CAGA"}

package/dist/core/diagnostics/sanitize.js

@@ -0,0 +1,84 @@
+const SENSITIVE_KEY = /(?:authorization|cookie|credential|password|passwd|private[_-]?key|secret|session[_-]?token|access[_-]?token|refresh[_-]?token|api[_-]?key)/i;
+const OMITTED_CONTENT_KEY = /(?:^|[_-])(?:environment|env|prompt|prompts|tool[_-]?payload|tool[_-]?result|transcript|transcripts)(?:$|[_-])/i;
+const HOME_PATH = /(?:[A-Za-z]:\\Users\\[^\\\s]+|\/home\/[^/\s]+|\/Users\/[^/\s]+)/g;
+const BEARER_VALUE = /\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi;
+const URL_CREDENTIALS = /([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/gi;
+const PRIVATE_KEY = /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g;
+const TOKENISH_VALUE = /\b(?:sk|pk|ghp|github_pat|xox[baprs])[-_][A-Za-z0-9_-]{16,}\b/g;
+const AWS_ACCESS_KEY = /\bAKIA[A-Z0-9]{16,}\b/g;
+const SENSITIVE_QUERY = /([?&](?:access_token|api_key|key|password|secret|token)=)[^&#\s]+/gi;
+const SENSITIVE_ENV = /(\b[A-Z0-9_]*(?:API_KEY|PASSWORD|SECRET|TOKEN)=)[^\s]+/g;
+const SENSITIVE_ARGUMENT = /(\B--?(?:access-token|api-key|password|secret|token)\s+)[^\s]+/gi;
+export function sanitizeDiagnosticValue(value) {
+    const stats = { sanitized_value_count: 0, omitted_value_count: 0 };
+    return { value: sanitize(value, stats, 0), stats };
+}
+function sanitize(value, stats, depth) {
+    if (depth > 24) {
+        stats.omitted_value_count += 1;
+        return "[OMITTED:depth-limit]";
+    }
+    if (value === null || typeof value === "boolean" || typeof value === "number")
+        return value;
+    if (typeof value === "string")
+        return sanitizeString(value, stats);
+    if (Array.isArray(value)) {
+        const sliced = value.slice(0, 5_000);
+        const kept = sliced.map((item, index) => {
+            if (typeof sliced[index - 1] === "string" &&
+                /^(?:--?)(?:access-token|api-key|password|secret|token)$/i.test(sliced[index - 1])) {
+                stats.sanitized_value_count += 1;
+                return "[REDACTED:argument]";
+            }
+            return sanitize(item, stats, depth + 1);
+        });
+        if (kept.length !== value.length)
+            stats.omitted_value_count += value.length - kept.length;
+        return kept;
+    }
+    if (!value || typeof value !== "object")
+        return String(value);
+    const result = {};
+    const entries = Object.entries(value);
+    const namedSensitiveField = entries.some(([key, item]) => key === "name" && typeof item === "string" && SENSITIVE_KEY.test(item));
+    for (const [key, item] of entries) {
+        if (OMITTED_CONTENT_KEY.test(key)) {
+            result[key] = "[OMITTED:sensitive-content]";
+            stats.omitted_value_count += 1;
+            continue;
+        }
+        if (key === "value" && namedSensitiveField) {
+            result[key] = "[REDACTED:sensitive-field]";
+            stats.sanitized_value_count += 1;
+            continue;
+        }
+        if (SENSITIVE_KEY.test(key)) {
+            result[key] = "[REDACTED:sensitive-field]";
+            stats.sanitized_value_count += 1;
+            continue;
+        }
+        result[key] = sanitize(item, stats, depth + 1);
+    }
+    return result;
+}
+function sanitizeString(value, stats) {
+    let next = value;
+    const replacements = [
+        [PRIVATE_KEY, "[REDACTED:private-key]"],
+        [BEARER_VALUE, "Bearer [REDACTED:token]"],
+        [TOKENISH_VALUE, "[REDACTED:token]"],
+        [AWS_ACCESS_KEY, "[REDACTED:access-key]"],
+        [SENSITIVE_QUERY, "$1[REDACTED]"],
+        [SENSITIVE_ENV, "$1[REDACTED]"],
+        [SENSITIVE_ARGUMENT, "$1[REDACTED]"],
+        [URL_CREDENTIALS, (_match, scheme) => `${scheme}[REDACTED]@`],
+        [HOME_PATH, "[REDACTED:home]"],
+    ];
+    for (const [pattern, replacement] of replacements) {
+        const replaced = next.replace(pattern, replacement);
+        if (replaced !== next)
+            stats.sanitized_value_count += 1;
+        next = replaced;
+    }
+    return next;
+}

package/dist/core/events/legacy-storage/compression.d.ts

@@ -0,0 +1,13 @@
+/** Verified in-place compression for sealed, non-terminal legacy V1 shards. */
+export interface LegacyV1CompressionEntry {
+    filename: string;
+    path: string;
+    bytes_before: number;
+    bytes_after: number | null;
+    action: "keep" | "would-compress" | "compressed";
+    reason: string;
+}
+export declare function compressSealedLegacyV1Segments(coordRoot: string, opts?: {
+    yes?: boolean;
+}): Promise<LegacyV1CompressionEntry[]>;
+//# sourceMappingURL=compression.d.ts.map

package/dist/core/events/legacy-storage/compression.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compression.d.ts","sourceRoot":"","sources":["../../../../src/core/events/legacy-storage/compression.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAW/E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,YAAY,CAAC;IACjD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,8BAA8B,CAClD,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3B,OAAO,CAAC,wBAAwB,EAAE,CAAC,CA0FrC"}

package/dist/core/events/legacy-storage/compression.js

@@ -0,0 +1,107 @@
+/** Verified in-place compression for sealed, non-terminal legacy V1 shards. */
+import { createReadStream, createWriteStream } from "node:fs";
+import { chmod, lstat, rename, rm } from "node:fs/promises";
+import { basename } from "node:path";
+import { pipeline } from "node:stream/promises";
+import { createGzip } from "node:zlib";
+import { verifyLegacyV1HardFence } from "./fence.js";
+import { inventoryLegacyV1Segments } from "./inventory.js";
+import { streamLegacyV1Rows } from "./reader.js";
+export async function compressSealedLegacyV1Segments(coordRoot, opts = {}) {
+    const fence = await verifyLegacyV1HardFence(coordRoot);
+    const terminal = basename(fence.terminal_archive_path);
+    const inventory = await inventoryLegacyV1Segments(coordRoot);
+    const rows = inventory.map((entry) => {
+        if (entry.filename === terminal) {
+            return {
+                filename: entry.filename,
+                path: entry.path,
+                bytes_before: entry.bytes,
+                bytes_after: null,
+                action: "keep",
+                reason: "terminal shard is bound by the V1 hard-fence digest",
+            };
+        }
+        if (entry.compressed) {
+            return {
+                filename: entry.filename,
+                path: entry.path,
+                bytes_before: entry.bytes,
+                bytes_after: entry.bytes,
+                action: "keep",
+                reason: "already compressed",
+            };
+        }
+        return {
+            filename: entry.filename,
+            path: entry.path,
+            bytes_before: entry.bytes,
+            bytes_after: null,
+            action: "would-compress",
+            reason: "sealed non-terminal V1 shard",
+        };
+    });
+    if (!opts.yes)
+        return rows;
+    for (const row of rows) {
+        if (row.action !== "would-compress")
+            continue;
+        const expected = inventory.find((entry) => entry.path === row.path);
+        const current = (await inventoryLegacyV1Segments(coordRoot)).find((entry) => entry.path === row.path);
+        if (!current ||
+            current.bytes !== expected.bytes ||
+            current.digest !== expected.digest ||
+            current.compressed) {
+            throw new Error(`legacy_v1_segment_changed_before_compression:${row.filename}`);
+        }
+        const sourceStat = await lstat(row.path);
+        const destination = `${row.path}.gz`;
+        const temporary = `${row.path}.partial-${process.pid}.gz`;
+        try {
+            try {
+                await lstat(destination);
+                throw new Error(`legacy_v1_compressed_destination_exists:${row.filename}`);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+            await pipeline(createReadStream(row.path), createGzip({ level: 9 }), createWriteStream(temporary, { flags: "wx", mode: 0o600 }));
+            await proveRowParity(row.path, temporary);
+            const unchanged = (await inventoryLegacyV1Segments(coordRoot)).find((entry) => entry.path === row.path);
+            if (!unchanged ||
+                unchanged.bytes !== expected.bytes ||
+                unchanged.digest !== expected.digest) {
+                throw new Error(`legacy_v1_segment_changed_during_compression:${row.filename}`);
+            }
+            await chmod(temporary, sourceStat.mode & 0o777);
+            await rename(temporary, destination);
+            await rm(row.path);
+            row.action = "compressed";
+            row.reason = "verified gzip replacement preserved every logical row";
+            row.bytes_after = (await lstat(destination)).size;
+            row.path = destination;
+            row.filename = basename(destination);
+        }
+        catch (error) {
+            await rm(temporary, { force: true });
+            throw error;
+        }
+    }
+    return rows;
+}
+async function proveRowParity(loose, compressed) {
+    const left = streamLegacyV1Rows(loose)[Symbol.asyncIterator]();
+    const right = streamLegacyV1Rows(compressed)[Symbol.asyncIterator]();
+    while (true) {
+        const [looseRow, packedRow] = await Promise.all([left.next(), right.next()]);
+        if (looseRow.done || packedRow.done) {
+            if (looseRow.done !== packedRow.done)
+                throw new Error("legacy_v1_compression_row_count_mismatch");
+            return;
+        }
+        if (!looseRow.value.bytes.equals(packedRow.value.bytes)) {
+            throw new Error(`legacy_v1_compression_row_mismatch:${looseRow.value.row_number}`);
+        }
+    }
+}

package/dist/core/events/legacy-storage/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./canary.js";
+export * from "./compression.js";
 export * from "./fence.js";
 export * from "./inventory.js";
 export * from "./manifest.js";

package/dist/core/events/legacy-storage/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/events/legacy-storage/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/events/legacy-storage/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC"}

package/dist/core/events/legacy-storage/index.js

@@ -1,4 +1,5 @@
 export * from "./canary.js";
+export * from "./compression.js";
 export * from "./fence.js";
 export * from "./inventory.js";
 export * from "./manifest.js";

package/dist/core/events/v3/archive-retention.d.ts

@@ -0,0 +1,33 @@
+/** Bounded retention for complete, closed Event Ledger V3 epochs. */
+import { type EventLedgerArchivePolicy } from "../../config.js";
+export type EventV3ArchiveClassification = "retained" | "expired" | "over-budget" | "protected-minimum" | "unmanaged" | "symlink" | "unknown";
+export interface EventV3ArchiveEntry {
+    name: string;
+    path: string;
+    relative_path: string;
+    classification: EventV3ArchiveClassification;
+    reason: string;
+    action: "keep" | "would-delete" | "deleted";
+    bytes: number | null;
+    last_modified_at: string | null;
+}
+export interface EventV3ArchiveAutoCleanResult {
+    ran: boolean;
+    reason: "swept" | "disabled" | "fresh" | "no-root";
+    deleted: number;
+    bytes: number;
+}
+export declare function eventV3ArchivesRoot(repoRoot: string): string;
+export declare function inventoryEventV3Archives(repoRoot: string, opts?: {
+    now?: Date;
+    policy?: EventLedgerArchivePolicy;
+}): EventV3ArchiveEntry[];
+export declare function cleanEventV3Archives(repoRoot: string, opts?: {
+    yes?: boolean;
+    now?: Date;
+    policy?: EventLedgerArchivePolicy;
+}): EventV3ArchiveEntry[];
+export declare function autoCleanEventV3Archives(repoRoot: string, opts?: {
+    now?: Date;
+}): EventV3ArchiveAutoCleanResult;
+//# sourceMappingURL=archive-retention.d.ts.map

package/dist/core/events/v3/archive-retention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-retention.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/archive-retention.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAYrE,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,4BAA4B,GACpC,UAAU,GACV,SAAS,GACT,aAAa,GACb,mBAAmB,GACnB,WAAW,GACX,SAAS,GACT,SAAS,CAAC;AAEd,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,4BAA4B,CAAC;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,6BAA6B;IAC5C,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,CAAC;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAKD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,wBAAwB,CAAA;CAAO,GAC3D,mBAAmB,EAAE,CA4CvB;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,wBAAwB,CAAA;CAAO,GAC1E,mBAAmB,EAAE,CAqCvB;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GACxB,6BAA6B,CAgC/B"}