nlm-memory 0.20.1 → 0.21.12

package/dist/core/facts/reconcile-facts.js

@@ -0,0 +1,133 @@
+/**
+ * Reconcile live facts against operator-supplied authorities. Structured
+ * sources win: a live fact that contradicts an authority, or that names a
+ * deleted file, is retired (never replaced). Deterministic, no LLM calls.
+ */
+import { readFileSync } from "node:fs";
+import { appendFactSupersedence } from "../storage/supersedence-log.js";
+import { DEFAULT_TEAM_ID } from "../tenancy/default-team.js";
+export function loadAuthorities(path) {
+    const raw = JSON.parse(readFileSync(path, "utf8"));
+    const authorities = raw.authorities ?? [];
+    const deleted = raw.deleted_files ?? [];
+    for (const a of authorities) {
+        if (!Array.isArray(a.aliases) || a.aliases.length === 0 || !a.predicate || a.value === undefined) {
+            throw new Error("each authority needs non-empty aliases, a predicate and a value");
+        }
+    }
+    for (const d of deleted) {
+        if (!d.name)
+            throw new Error("each deleted_files entry needs a name");
+    }
+    return { authorities, deleted_files: deleted };
+}
+export function normalizeSubject(s) {
+    return s.toLowerCase().replace(/[\s_-]+/g, " ").trim();
+}
+function ports(value) {
+    return (value.match(/\d+/g) ?? []).map(Number);
+}
+/**
+ * `host:port` via the WHATWG URL parser only. One parser, so a value can't
+ * read one way to this check and another way to whatever consumes it.
+ */
+function hostPort(value) {
+    try {
+        const u = new URL(value.includes("://") ? value : `http://${value}`);
+        if (u.username || u.password)
+            return null;
+        return u.hostname && u.port ? `${u.hostname}:${u.port}`.toLowerCase() : null;
+    }
+    catch {
+        return null;
+    }
+}
+function contradicts(predicate, factValue, authorityValue) {
+    if (predicate === "port") {
+        const want = Number.parseInt(authorityValue, 10);
+        const have = ports(factValue);
+        return have.length > 0 && !have.includes(want);
+    }
+    if (predicate === "host" || predicate === "url" || predicate === "endpoint") {
+        // Prose values ("the Pro on :7803") aren't comparable; never retire on a guess.
+        const a = hostPort(authorityValue);
+        const f = hostPort(factValue.trim());
+        return a !== null && f !== null && a !== f;
+    }
+    return factValue.trim().toLowerCase() !== authorityValue.trim().toLowerCase();
+}
+export function findContradictions(db, file) {
+    const rows = db
+        .prepare(`SELECT id, subject, predicate, value, created_at, tenant_id FROM facts
+       WHERE superseded_by IS NULL AND retired_at IS NULL AND kind != 'decision'
+       ORDER BY created_at, id`)
+        .all();
+    const aliasMap = new Map();
+    for (const a of file.authorities) {
+        for (const alias of a.aliases) {
+            const key = normalizeSubject(alias);
+            aliasMap.set(key, [...(aliasMap.get(key) ?? []), a]);
+        }
+    }
+    const dead = file.deleted_files.map((d) => ({ d, key: normalizeSubject(d.name) }));
+    const findings = [];
+    for (const row of rows) {
+        const subject = normalizeSubject(row.subject);
+        const base = {
+            factId: row.id,
+            subject: row.subject,
+            predicate: row.predicate,
+            value: row.value,
+            createdAt: row.created_at,
+            tenantId: row.tenant_id ?? DEFAULT_TEAM_ID,
+        };
+        const predicate = row.predicate.trim().toLowerCase();
+        const bad = (aliasMap.get(subject) ?? []).find((a) => a.predicate.trim().toLowerCase() === predicate && contradicts(predicate, row.value, a.value));
+        if (bad) {
+            findings.push({ ...base, type: "value_mismatch", authorityValue: bad.value, authoritySource: bad.source });
+            continue;
+        }
+        const gone = dead.find(({ key }) => subject === key || subject.startsWith(key));
+        if (gone) {
+            findings.push({
+                ...base,
+                type: "dead_reference",
+                authorityValue: null,
+                authoritySource: gone.d.source ?? `deleted file ${gone.d.name}`,
+            });
+        }
+    }
+    return findings;
+}
+export async function applyRetirements(db, dbFilePath, findings, limit, logPath) {
+    const batch = findings.slice(0, limit);
+    if (batch.length === 0)
+        return { retired: [], backupPath: null };
+    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    const backupPath = `${dbFilePath}.bak-reconcile-${stamp}`;
+    await db.backup(backupPath);
+    const retire = db.prepare("UPDATE facts SET retired_at = datetime('now') WHERE id = ? AND retired_at IS NULL AND superseded_by IS NULL");
+    db.transaction(() => {
+        for (const f of batch)
+            retire.run(f.factId);
+    })();
+    for (const f of batch) {
+        await appendFactSupersedence(f.tenantId, { factId: f.factId, reason: `${f.type}: contradicted by ${f.authoritySource}`, source: "reconcile" }, logPath);
+    }
+    return { retired: batch, backupPath };
+}
+export function formatReport(findings, limit) {
+    const lines = [];
+    for (const type of ["value_mismatch", "dead_reference"]) {
+        const group = findings.filter((f) => f.type === type);
+        lines.push(`${type} (${group.length})`);
+        for (const f of group) {
+            const auth = f.authorityValue === null ? "" : `authority=${f.authorityValue} `;
+            lines.push(`  ${f.factId}  subject=${f.subject}  predicate=${f.predicate}  value=${f.value}  ` +
+                `${auth}source=${f.authoritySource}  created=${f.createdAt}`);
+        }
+    }
+    lines.push(`total: ${findings.length} (--apply would retire ${Math.min(findings.length, limit)})`);
+    return lines.join("\n");
+}
+//# sourceMappingURL=reconcile-facts.js.map

package/dist/core/facts/reconcile-facts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile-facts.js","sourceRoot":"","sources":["../../../src/core/facts/reconcile-facts.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AA2C7D,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA6B,CAAC;IAC/E,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACjG,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB,EAAE,SAAiB,EAAE,cAAsB;IAC/E,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC5E,gFAAgF;QAChF,MAAM,CAAC,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACrC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EAAqB,EAAE,IAAqB;IAC7E,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CACN;;+BAEyB,CAC1B;SACA,GAAG,EAAE,CAAC;IACT,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACpC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG;YACX,MAAM,EAAE,GAAG,CAAC,EAAE;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,eAAe;SAC3C,CAAC;QACF,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,SAAS,IAAI,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CACpG,CAAC;QACF,IAAI,GAAG,EAAE,CAAC;YACR,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,cAAc,EAAE,GAAG,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3G,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,OAAO,KAAK,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,IAAI,IAAI,EAAE,CAAC;YACT,QAAQ,CAAC,IAAI,CAAC;gBACZ,GAAG,IAAI;gBACP,IAAI,EAAE,gBAAgB;gBACtB,cAAc,EAAE,IAAI;gBACpB,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,gBAAgB,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAqB,EACrB,UAAkB,EAClB,QAA4B,EAC5B,KAAa,EACb,OAAgB;IAEhB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACjE,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,GAAG,UAAU,kBAAkB,KAAK,EAAE,CAAC;IAC1D,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB,6GAA6G,CAC9G,CAAC;IACF,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QAClB,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,EAAE,CAAC;IACL,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,sBAAsB,CAC1B,CAAC,CAAC,QAAQ,EACV,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,qBAAqB,CAAC,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EACpG,OAAO,CACR,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAA4B,EAAE,KAAa;IACtE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,CAAU,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,cAAc,GAAG,CAAC;YAC/E,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,OAAO,eAAe,CAAC,CAAC,SAAS,WAAW,CAAC,CAAC,KAAK,IAAI;gBACjF,GAAG,IAAI,UAAU,CAAC,CAAC,eAAe,aAAa,CAAC,CAAC,SAAS,EAAE,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,UAAU,QAAQ,CAAC,MAAM,0BAA0B,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnG,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/core/health/embed-failure-state.d.ts

@@ -0,0 +1,4 @@
+export type EmbedFailureKind = "chunk" | "fact";
+export declare function recordEmbedFailure(kind: EmbedFailureKind): void;
+export declare function embedFailureSnapshot(): Readonly<Record<EmbedFailureKind, number>>;
+export declare function resetEmbedFailureForTests(): void;

package/dist/core/health/embed-failure-state.js

@@ -0,0 +1,12 @@
+const state = { chunk: 0, fact: 0 };
+export function recordEmbedFailure(kind) {
+    state[kind] += 1;
+}
+export function embedFailureSnapshot() {
+    return Object.freeze({ ...state });
+}
+export function resetEmbedFailureForTests() {
+    state.chunk = 0;
+    state.fact = 0;
+}
+//# sourceMappingURL=embed-failure-state.js.map

package/dist/core/health/embed-failure-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"embed-failure-state.js","sourceRoot":"","sources":["../../../src/core/health/embed-failure-state.ts"],"names":[],"mappings":"AAEA,MAAM,KAAK,GAAqC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAEtE,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;IAChB,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;AACjB,CAAC"}

package/dist/core/health/warmup-retry.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Retry loop for a warmup probe that must survive a backend being absent.
+ *
+ * The embedder warmup used to be a single fire-and-forget attempt with an empty
+ * catch. If the backend was not servable at that instant the stage latched cold
+ * for the daemon's entire uptime, even after the backend returned, and only a
+ * restart cleared it. Two costs, both real: a five-day silent outage while the
+ * embedder was reachable throughout, and a three-week hunt for a release
+ * "regression" that did not exist, because restarting inside the same outage
+ * window reproduces the failure every time and reads as determinism.
+ *
+ * Pure except for the injected `sleep`, so the backoff schedule is testable
+ * without timers. Never throws: a warmup probe must not be able to take down
+ * the process it is reporting on.
+ */
+export interface RetryUntilWarmDeps {
+    /** The probe. Resolving means the lane is live. */
+    readonly attempt: () => Promise<unknown>;
+    readonly onSuccess: () => void;
+    /** Called per failed attempt so health can name the cause instead of showing a bare false. */
+    readonly onFailure: (reason: string, attempt: number) => void;
+    readonly sleep: (ms: number) => Promise<void>;
+    readonly maxAttempts?: number;
+    readonly baseDelayMs?: number;
+    readonly maxDelayMs?: number;
+}
+export declare function retryUntilWarm(deps: RetryUntilWarmDeps): Promise<void>;

package/dist/core/health/warmup-retry.js

@@ -0,0 +1,53 @@
+/**
+ * Retry loop for a warmup probe that must survive a backend being absent.
+ *
+ * The embedder warmup used to be a single fire-and-forget attempt with an empty
+ * catch. If the backend was not servable at that instant the stage latched cold
+ * for the daemon's entire uptime, even after the backend returned, and only a
+ * restart cleared it. Two costs, both real: a five-day silent outage while the
+ * embedder was reachable throughout, and a three-week hunt for a release
+ * "regression" that did not exist, because restarting inside the same outage
+ * window reproduces the failure every time and reads as determinism.
+ *
+ * Pure except for the injected `sleep`, so the backoff schedule is testable
+ * without timers. Never throws: a warmup probe must not be able to take down
+ * the process it is reporting on.
+ */
+const DEFAULT_MAX_ATTEMPTS = 60;
+const DEFAULT_BASE_DELAY_MS = 1_000;
+// Caps the tail at a minute: long enough that a backend absent for hours costs
+// ~60 cheap probes, short enough that recovery is noticed within a minute.
+const DEFAULT_MAX_DELAY_MS = 60_000;
+function reasonOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+export async function retryUntilWarm(deps) {
+    const maxAttempts = deps.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+    const baseDelay = deps.baseDelayMs ?? DEFAULT_BASE_DELAY_MS;
+    const maxDelay = deps.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        try {
+            await deps.attempt();
+            deps.onSuccess();
+            return;
+        }
+        catch (err) {
+            try {
+                deps.onFailure(reasonOf(err), attempt);
+            }
+            catch {
+                // A broken reporter must not end the retry loop.
+            }
+            if (attempt === maxAttempts)
+                return;
+            const delay = Math.min(baseDelay * 2 ** (attempt - 1), maxDelay);
+            try {
+                await deps.sleep(delay);
+            }
+            catch {
+                return;
+            }
+        }
+    }
+}
+//# sourceMappingURL=warmup-retry.js.map

package/dist/core/health/warmup-retry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"warmup-retry.js","sourceRoot":"","sources":["../../../src/core/health/warmup-retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAcH,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AACpC,+EAA+E;AAC/E,2EAA2E;AAC3E,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAEpC,SAAS,QAAQ,CAAC,GAAY;IAC5B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAwB;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,IAAI,qBAAqB,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,oBAAoB,CAAC;IAEzD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,iDAAiD;YACnD,CAAC;YACD,IAAI,OAAO,KAAK,WAAW;gBAAE,OAAO;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/core/health/warmup-state.d.ts

@@ -2,11 +2,26 @@ interface WarmupState {
     fts5: boolean;
     textEmbedder: boolean;
 }
+/**
+ * Why a stage is still cold. A bare `false` is indistinguishable between "the
+ * backend was absent at boot" and "this build is broken", and that ambiguity
+ * cost three weeks chasing a release regression that did not exist. `since`
+ * holds the FIRST failure so health can report how long the lane has been down
+ * rather than only the latest retry.
+ */
+export interface WarmupFailure {
+    readonly reason: string;
+    readonly attempts: number;
+    readonly since: string;
+}
+type FailureMap = Partial<Record<keyof WarmupState, WarmupFailure>>;
 export declare function markWarm(stage: keyof WarmupState): void;
+export declare function markWarmFailure(stage: keyof WarmupState, reason: string, attempts: number): void;
 export declare function warmupSnapshot(): {
     fts5: boolean;
     textEmbedder: boolean;
     ready: boolean;
+    lastError?: FailureMap;
 };
 export declare function resetWarmupState(): void;
 export {};

package/dist/core/health/warmup-state.js

@@ -1,12 +1,26 @@
 const state = { fts5: false, textEmbedder: false };
+let failures = {};
 export function markWarm(stage) {
     state[stage] = true;
+    delete failures[stage];
+}
+export function markWarmFailure(stage, reason, attempts) {
+    const since = failures[stage]?.since ?? new Date().toISOString();
+    failures[stage] = { reason, attempts, since };
 }
 export function warmupSnapshot() {
-    return { fts5: state.fts5, textEmbedder: state.textEmbedder, ready: state.fts5 && state.textEmbedder };
+    const ready = state.fts5 && state.textEmbedder;
+    const hasFailure = Object.keys(failures).length > 0;
+    return {
+        fts5: state.fts5,
+        textEmbedder: state.textEmbedder,
+        ready,
+        ...(hasFailure ? { lastError: { ...failures } } : {}),
+    };
 }
 export function resetWarmupState() {
     state.fts5 = false;
     state.textEmbedder = false;
+    failures = {};
 }
 //# sourceMappingURL=warmup-state.js.map

package/dist/core/health/warmup-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"warmup-state.js","sourceRoot":"","sources":["../../../src/core/health/warmup-state.ts"],"names":[],"mappings":"AAKA,MAAM,KAAK,GAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAEhE,MAAM,UAAU,QAAQ,CAAC,KAAwB;IAC/C,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;AACzG,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;IACnB,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"warmup-state.js","sourceRoot":"","sources":["../../../src/core/health/warmup-state.ts"],"names":[],"mappings":"AAoBA,MAAM,KAAK,GAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAChE,IAAI,QAAQ,GAAe,EAAE,CAAC;AAE9B,MAAM,UAAU,QAAQ,CAAC,KAAwB;IAC/C,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IACpB,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAwB,EAAE,MAAc,EAAE,QAAgB;IACxF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjE,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,cAAc;IAM5B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,YAAY,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACpD,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,KAAK;QACL,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;IACnB,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;IAC3B,QAAQ,GAAG,EAAE,CAAC;AAChB,CAAC"}

package/dist/core/hook/cite-memo.d.ts

@@ -7,14 +7,18 @@
  * holds the set of (conversationId, citedId) pairs already posted, so each
  * citation lands exactly once regardless of how many times Stop fires.
  *
- * Storage parallels the surfaced-memo (`memo.ts`): same state directory
- * (`~/.nlm/hook-state/`, overridable via NLM_HOOK_STATE_DIR), filename suffix
- * `.cited.json` to distinguish from the surfaced memo's `.json`. The existing
- * memo-sweep walks the directory by mtime and cleans both files together.
+ * Storage parallels the surfaced-memo (`memo.ts`): same tenant-derived state
+ * directory (core/tenancy/tenant-state-path.ts) — the default team's dir is
+ * `~/.nlm/hook-state/`, overridable via NLM_HOOK_STATE_DIR; every other
+ * tenant is isolated under `~/.nlm/tenants/<tenantId>/hook-state/` and
+ * ignores the env override. Filename suffix `.cited.json` distinguishes this
+ * memo from the surfaced memo's `.json` within the same directory. The
+ * existing memo-sweep walks the default team's directory by mtime and cleans
+ * both files together.
  *
  * Defensive: a missing or corrupt file yields an empty set; a write failure
  * is swallowed. Telemetry path — must never break the hook.
  */
-export declare function loadCited(conversationId: string): Set<string>;
-export declare function recordCited(conversationId: string, ids: ReadonlyArray<string>): void;
-export declare function clearCited(conversationId: string): boolean;
+export declare function loadCited(tenantId: string, conversationId: string): Set<string>;
+export declare function recordCited(tenantId: string, conversationId: string, ids: ReadonlyArray<string>): void;
+export declare function clearCited(tenantId: string, conversationId: string): boolean;

package/dist/core/hook/cite-memo.js

@@ -7,27 +7,35 @@
  * holds the set of (conversationId, citedId) pairs already posted, so each
  * citation lands exactly once regardless of how many times Stop fires.
  *
- * Storage parallels the surfaced-memo (`memo.ts`): same state directory
- * (`~/.nlm/hook-state/`, overridable via NLM_HOOK_STATE_DIR), filename suffix
- * `.cited.json` to distinguish from the surfaced memo's `.json`. The existing
- * memo-sweep walks the directory by mtime and cleans both files together.
+ * Storage parallels the surfaced-memo (`memo.ts`): same tenant-derived state
+ * directory (core/tenancy/tenant-state-path.ts) — the default team's dir is
+ * `~/.nlm/hook-state/`, overridable via NLM_HOOK_STATE_DIR; every other
+ * tenant is isolated under `~/.nlm/tenants/<tenantId>/hook-state/` and
+ * ignores the env override. Filename suffix `.cited.json` distinguishes this
+ * memo from the surfaced memo's `.json` within the same directory. The
+ * existing memo-sweep walks the default team's directory by mtime and cleans
+ * both files together.
  *
  * Defensive: a missing or corrupt file yields an empty set; a write failure
  * is swallowed. Telemetry path — must never break the hook.
  */
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
 import { join } from "node:path";
-function stateDir() {
-    return process.env["NLM_HOOK_STATE_DIR"] ?? join(homedir(), ".nlm", "hook-state");
+import { tenantStatePath } from "../tenancy/tenant-state-path.js";
+import { DEFAULT_TEAM_ID } from "../tenancy/default-team.js";
+function stateDir(tenantId) {
+    if (tenantId === DEFAULT_TEAM_ID) {
+        return process.env["NLM_HOOK_STATE_DIR"] ?? tenantStatePath(tenantId, "hook-state");
+    }
+    return tenantStatePath(tenantId, "hook-state");
 }
-function memoPath(conversationId) {
+function memoPath(tenantId, conversationId) {
     const safe = conversationId.replace(/[^A-Za-z0-9_-]/g, "_") || "unknown";
-    return join(stateDir(), `${safe}.cited.json`);
+    return join(stateDir(tenantId), `${safe}.cited.json`);
 }
-export function loadCited(conversationId) {
+export function loadCited(tenantId, conversationId) {
     try {
-        const path = memoPath(conversationId);
+        const path = memoPath(tenantId, conversationId);
         if (!existsSync(path))
             return new Set();
         const parsed = JSON.parse(readFileSync(path, "utf8"));
@@ -39,23 +47,23 @@ export function loadCited(conversationId) {
         return new Set();
     }
 }
-export function recordCited(conversationId, ids) {
+export function recordCited(tenantId, conversationId, ids) {
     if (ids.length === 0)
         return;
     try {
-        const merged = loadCited(conversationId);
+        const merged = loadCited(tenantId, conversationId);
         for (const id of ids)
             merged.add(id);
-        mkdirSync(stateDir(), { recursive: true });
-        writeFileSync(memoPath(conversationId), JSON.stringify([...merged]), "utf8");
+        mkdirSync(stateDir(tenantId), { recursive: true });
+        writeFileSync(memoPath(tenantId, conversationId), JSON.stringify([...merged]), "utf8");
     }
     catch {
         // Memo write failure must never break the hook.
     }
 }
-export function clearCited(conversationId) {
+export function clearCited(tenantId, conversationId) {
     try {
-        const path = memoPath(conversationId);
+        const path = memoPath(tenantId, conversationId);
         if (!existsSync(path))
             return false;
         rmSync(path);

package/dist/core/hook/cite-memo.js.map

@@ -1 +1 @@
-{"version":3,"file":"cite-memo.js","sourceRoot":"","sources":["../../../src/core/hook/cite-memo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,SAAS,QAAQ;IACf,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,QAAQ,CAAC,cAAsB;IACtC,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC;IACzE,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,cAAsB;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;QACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QACxC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAC7C,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,cAAsB,EACtB,GAA0B;IAE1B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;QACzC,KAAK,MAAM,EAAE,IAAI,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,cAAsB;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;QACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"cite-memo.js","sourceRoot":"","sources":["../../../src/core/hook/cite-memo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,SAAS,QAAQ,CAAC,QAAgB;IAChC,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB,EAAE,cAAsB;IACxD,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC;IACzE,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,cAAsB;IAChE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QACxC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAC7C,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,QAAgB,EAChB,cAAsB,EACtB,GAA0B;IAE1B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACnD,KAAK,MAAM,EAAE,IAAI,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,cAAsB;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/core/hook/claude-settings.d.ts

@@ -19,7 +19,7 @@ export declare function shellQuote(arg: string): string;
  */
 export declare function cmdQuote(arg: string): string;
 export declare function buildHookCommand(execPath: string, hookJs: string, mode: "shadow" | "live", targetPlatform?: NodeJS.Platform): string;
-export type ClaudeHookEvent = "UserPromptSubmit" | "SessionStart" | "SessionEnd" | "Stop" | "PreCompact" | "SubagentStart" | "PostToolUse" | "PreToolUse";
+export type ClaudeHookEvent = "UserPromptSubmit" | "SessionStart" | "SessionEnd" | "Stop" | "PreCompact" | "PostToolUse" | "PreToolUse";
 export declare function addHook(settingsPath: string, command: string, event?: ClaudeHookEvent): void;
 /**
  * Remove the NLM-tagged hook entry from one event (default UserPromptSubmit)

package/dist/core/hook/claude-settings.js

@@ -16,7 +16,6 @@ const HOOK_SCRIPT_MARKERS = [
     "stop-hook.js",
     "session-start-hook.js",
     "pre-compact-hook.js",
-    "subagent-start-hook.js",
 ];
 /**
  * Single-quote a shell argument so paths with spaces or other shell

package/dist/core/hook/claude-settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-settings.js","sourceRoot":"","sources":["../../../src/core/hook/claude-settings.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,gCAAgC;AAChC,MAAM,mBAAmB,GAAG;IAC1B,uBAAuB;IACvB,qBAAqB;IACrB,cAAc;IACd,uBAAuB;IACvB,qBAAqB;IACrB,wBAAwB;CAChB,CAAC;AAEX;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,MAAc,EACd,IAAuB,EACvB,iBAAkC,OAAO,CAAC,QAAQ;IAElD,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QAC/B,sEAAsE;QACtE,oEAAoE;QACpE,OAAO,qBAAqB,IAAI,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,iBAAiB,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;AAC/E,CAAC;AAwBD,SAAS,IAAI,CAAC,IAAY;IACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,uBAAuB,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAwB,CAAC;AAClC,CAAC;AAED,SAAS,KAAK,CAAC,IAAY,EAAE,QAAwB;IACnD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,UAAU,CAAC,KAAgB;IAClC,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5B,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,YAAoB,EACpB,OAAe,EACf,QAAyB,kBAAkB;IAE3C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,IAAI,GAAgB;QACxB,GAAG,MAAM;QACT,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;KAC1C,CAAC;IACF,KAAK,CAAC,YAAY,EAAE,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,YAAoB,EACpB,QAA+B,kBAAkB;IAEjD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;IACtC,MAAM,MAAM,GAAa,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,SAAS,GAAgC,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC/D,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;;YACrC,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,KAAK,CAAC,YAAY,EAAE,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"claude-settings.js","sourceRoot":"","sources":["../../../src/core/hook/claude-settings.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,gCAAgC;AAChC,MAAM,mBAAmB,GAAG;IAC1B,uBAAuB;IACvB,qBAAqB;IACrB,cAAc;IACd,uBAAuB;IACvB,qBAAqB;CACb,CAAC;AAEX;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,MAAc,EACd,IAAuB,EACvB,iBAAkC,OAAO,CAAC,QAAQ;IAElD,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QAC/B,sEAAsE;QACtE,oEAAoE;QACpE,OAAO,qBAAqB,IAAI,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,iBAAiB,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;AAC/E,CAAC;AAuBD,SAAS,IAAI,CAAC,IAAY;IACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,uBAAuB,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAwB,CAAC;AAClC,CAAC;AAED,SAAS,KAAK,CAAC,IAAY,EAAE,QAAwB;IACnD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,UAAU,CAAC,KAAgB;IAClC,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5B,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,YAAoB,EACpB,OAAe,EACf,QAAyB,kBAAkB;IAE3C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,IAAI,GAAgB;QACxB,GAAG,MAAM;QACT,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;KAC1C,CAAC;IACF,KAAK,CAAC,YAAY,EAAE,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,YAAoB,EACpB,QAA+B,kBAAkB;IAEjD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;IACtC,MAAM,MAAM,GAAa,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,SAAS,GAAgC,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC/D,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;;YACrC,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,KAAK,CAAC,YAAY,EAAE,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;AACzD,CAAC"}

package/dist/core/hook/hook-log.d.ts

@@ -3,7 +3,10 @@
  * evaluated. This is the dataset the relevance gate (generative patterns +
  * score threshold) is calibrated against during the shadow window.
  *
- * Path defaults to ~/.nlm/hook-log.jsonl, overridable via NLM_HOOK_LOG.
+ * Path is tenant-derived (core/tenancy/tenant-state-path.ts): the default
+ * team's log is ~/.nlm/hook-log.jsonl, overridable via NLM_HOOK_LOG; every
+ * other tenant is isolated under ~/.nlm/tenants/<tenantId>/hook-log.jsonl
+ * and ignores the env override.
  * appendHookLog swallows its own errors — telemetry must never break the hook.
  * Uses synchronous I/O: the hook is a short-lived per-prompt process, and an
  * async write could be lost if the process exits before it flushes.
@@ -21,10 +24,18 @@ export interface HookLogEntry {
     readonly wouldInject: ReadonlyArray<string>;
     readonly estTokens: number;
     readonly mode: "shadow" | "live";
+    /**
+     * The hook build that wrote this line. Lets the digest assert the hooks
+     * actually running match the installed version — liveness alone cannot.
+     */
+    readonly v?: string;
+    /** Why recall returned what it did. Absent on gate-skipped fires (no recall ran).
+     *  Without it, `hits: []` cannot be told apart from a recall that timed out. */
+    readonly recallOutcome?: "ok" | "timeout" | "unreachable" | "http-error" | "skipped";
     /** Per-candidate relevance-gate decisions, when the recall gate ran. */
     readonly gateDecisions?: ReadonlyArray<{
         readonly id: string;
         readonly gate: "relevant" | "irrelevant";
     }>;
 }
-export declare function appendHookLog(entry: HookLogEntry): void;
+export declare function appendHookLog(tenantId: string, entry: HookLogEntry): void;

package/dist/core/hook/hook-log.js

@@ -3,23 +3,31 @@
  * evaluated. This is the dataset the relevance gate (generative patterns +
  * score threshold) is calibrated against during the shadow window.
  *
- * Path defaults to ~/.nlm/hook-log.jsonl, overridable via NLM_HOOK_LOG.
+ * Path is tenant-derived (core/tenancy/tenant-state-path.ts): the default
+ * team's log is ~/.nlm/hook-log.jsonl, overridable via NLM_HOOK_LOG; every
+ * other tenant is isolated under ~/.nlm/tenants/<tenantId>/hook-log.jsonl
+ * and ignores the env override.
  * appendHookLog swallows its own errors — telemetry must never break the hook.
  * Uses synchronous I/O: the hook is a short-lived per-prompt process, and an
  * async write could be lost if the process exits before it flushes.
  */
 import { appendFileSync, mkdirSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-function logPath() {
-    return process.env["NLM_HOOK_LOG"] ?? join(homedir(), ".nlm", "hook-log.jsonl");
+import { dirname } from "node:path";
+import { tenantStatePath } from "../tenancy/tenant-state-path.js";
+import { DEFAULT_TEAM_ID } from "../tenancy/default-team.js";
+import { NLM_VERSION } from "../../shared/version.js";
+function logPath(tenantId) {
+    if (tenantId === DEFAULT_TEAM_ID) {
+        return process.env["NLM_HOOK_LOG"] ?? tenantStatePath(tenantId, "hook-log.jsonl");
+    }
+    return tenantStatePath(tenantId, "hook-log.jsonl");
 }
-export function appendHookLog(entry) {
+export function appendHookLog(tenantId, entry) {
     try {
-        const path = logPath();
+        const path = logPath(tenantId);
         mkdirSync(dirname(path), { recursive: true });
         // Sync I/O: hook is a short-lived process — async write could be lost on exit.
-        appendFileSync(path, `${JSON.stringify(entry)}\n`, "utf8");
+        appendFileSync(path, `${JSON.stringify({ ...entry, v: NLM_VERSION })}\n`, "utf8");
     }
     catch {
         // Telemetry failure must never break the hook.

package/dist/core/hook/hook-log.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-log.js","sourceRoot":"","sources":["../../../src/core/hook/hook-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAgB1C,SAAS,OAAO;IACd,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,+EAA+E;QAC/E,cAAc,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;AACH,CAAC"}
+{"version":3,"file":"hook-log.js","sourceRoot":"","sources":["../../../src/core/hook/hook-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAwBjD,SAAS,OAAO,CAAC,QAAgB;IAC/B,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,eAAe,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,eAAe,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,KAAmB;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,+EAA+E;QAC/E,cAAc,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;AACH,CAAC"}

package/dist/core/hook/memo.d.ts

@@ -3,15 +3,19 @@
  * conversation holds the set of session ids already surfaced, so each is
  * surfaced at most once per conversation.
  *
- * State dir defaults to ~/.nlm/hook-state/, overridable via
- * NLM_HOOK_STATE_DIR (testability — mirrors query-log.ts).
+ * State dir is tenant-derived (core/tenancy/tenant-state-path.ts): the
+ * default team's memo dir is ~/.nlm/hook-state/, overridable via
+ * NLM_HOOK_STATE_DIR (testability — mirrors query-log.ts); every other
+ * tenant is isolated under ~/.nlm/tenants/<tenantId>/hook-state/ and
+ * ignores the env override (see the path contract note in
+ * tenant-state-path.ts).
  *
  * Every function is defensive: a missing or corrupt file yields an empty
  * memo, and a write failure is swallowed. The hook must never break on memo
  * I/O.
  */
-export declare function loadSurfaced(conversationId: string): Set<string>;
-export declare function recordSurfaced(conversationId: string, ids: ReadonlyArray<string>): void;
+export declare function loadSurfaced(tenantId: string, conversationId: string): Set<string>;
+export declare function recordSurfaced(tenantId: string, conversationId: string, ids: ReadonlyArray<string>): void;
 /**
  * Reverse lookup: which conversation most recently surfaced `sessionId`?
  *
@@ -23,10 +27,10 @@ export declare function recordSurfaced(conversationId: string, ids: ReadonlyArra
  *
  * Defensive: any I/O error yields null so cite_session never breaks.
  */
-export declare function resolveConversationForSession(sessionId: string): string | null;
+export declare function resolveConversationForSession(tenantId: string, sessionId: string): string | null;
 /**
  * Delete the memo file for a closed conversation. Called by the SessionEnd
  * hook so memo files don't accumulate forever. Returns true if a file was
  * removed, false otherwise — callers may want to log the outcome.
  */
-export declare function clearSurfaced(conversationId: string): boolean;
+export declare function clearSurfaced(tenantId: string, conversationId: string): boolean;