@davesheffer/hunch 1.10.0 → 1.10.1

package/dist/cli/index.js

@@ -222,12 +222,26 @@ program
     if (opts.autoCommit === false) {
         const localFile = join(paths.hunch, "local.json");
         let existing = {};
-        try {
-            existing = JSON.parse(readFileSync(localFile, "utf8"));
+        if (existsSync(localFile)) {
+            // Same contract as every other writer of this file (issue #40): an
+            // unparseable or non-object local.json may hold the private-overlay
+            // pointer — rewriting it from a swallowed parse failure silently
+            // re-routes private captures into the committed public store.
+            try {
+                const parsed = JSON.parse(readFileSync(localFile, "utf8"));
+                existing = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+            }
+            catch {
+                existing = null;
+            }
+        }
+        if (existing === null) {
+            console.warn(`  ⚠ refusing to rewrite ${localFile}: it is not a JSON object and may hold your private-overlay pointer. Fix or remove it, then re-run \`hunch init --no-auto-commit\`.`);
+        }
+        else {
+            writeFileAtomic(localFile, JSON.stringify({ ...existing, autoCommit: false }, null, 2) + "\n");
+            console.log("  ✓ auto-commit OFF (captures stay uncommitted; commit .hunch/ yourself)");
         }
-        catch { /* absent/invalid → fresh */ }
-        writeFileAtomic(localFile, JSON.stringify({ ...existing, autoCommit: false }, null, 2) + "\n");
-        console.log("  ✓ auto-commit OFF (captures stay uncommitted; commit .hunch/ yourself)");
     }
     if (isGitRepo(root)) {
         const syncToOverlay = !!(opts.privateSync || opts.sharedSync);
@@ -259,7 +273,10 @@ program
         console.log(`  ⚠ skipped .mcp.json: ${e.message}`);
     }
     const cmds = writeSlashCommands(root);
-    console.log(`  ✓ wrote ${cmds.length} slash commands (/hunch-why, /hunch-fix, /hunch-fragile)`);
+    console.log(`  ✓ wrote ${cmds.written.length} slash commands (/hunch-why, /hunch-fix, /hunch-fragile, /capture, /heal, /audit)`);
+    for (const s of cmds.skipped) {
+        console.log(`  ⚠ kept your existing ${rel(root, s)} (no hunch:generated marker — delete the file and re-run init to adopt Hunch's version)`);
+    }
     const cmd = updateClaudeMd(root, store);
     console.log(`  ✓ updated ${rel(root, cmd)} with ambient Hunch context`);
     // Firmness: stamp .hunch/config.json (default advisory) so `hunch hook` reads a
@@ -374,7 +391,11 @@ program
     // commit is drafted — not per-commit, and not under --deep (an ensemble may
     // fan out to several distinct workers, each with its own configuration).
     if (!opts.deep && commits.length > 0) {
-        const ctxProvider = await selectProvider();
+        // { root }: the advisory must resolve the SAME provider the synthesis
+        // inside syncCommit resolves (persisted local.json preference included) —
+        // rootless resolution could grade a different provider and swallow the
+        // num_ctx warning for an actual Ollama run (issue #46).
+        const ctxProvider = await selectProvider({ root });
         const ctxWarning = await maybeWarnOllamaContext(ctxProvider.name, process.env);
         if (ctxWarning)
             console.log(ctxWarning);
@@ -3354,6 +3375,13 @@ const vetoCmd = program
         store.close();
         return fail(`--base ref "${opts.base}" does not resolve. In CI, fetch the base branch first (git fetch origin <branch>).`);
     }
+    // Same guard for --commit: an unfetched/mistyped sha would enumerate zero
+    // files and exit 0 — a vacuous pass where CI expects the Decision Guard
+    // to have actually looked (issue #45).
+    if (opts.commit && !revExists(opts.commit, root)) {
+        store.close();
+        return fail(`--commit sha "${opts.commit}" does not resolve. In CI, ensure the commit is fetched (git fetch --depth=... or fetch-depth: 0).`);
+    }
     store.reindex();
     const files = opts.commit ? commitFiles(opts.commit, root)
         : opts.base ? rangeFiles(opts.base, root)
@@ -3593,7 +3621,7 @@ program
         firm: "surfaces + warns on a violating edit",
         strict: "edit-time DENY + CI guard — the teeth are on",
     };
-    console.log(`\nHunch — enforcement status (${root.split("/").pop()})\n`);
+    console.log(`\nHunch — enforcement status (${basename(root)})\n`);
     console.log(`  firmness: ${firmness}   ← ${fnote[firmness] ?? ""}\n`);
     console.log(`  ✓ ARMED        ${blocking.length} confirmed blocking invariant(s) — held against every assistant`);
     if (blocking.length) {

package/dist/core/drift.js

@@ -13,7 +13,7 @@
  *                 `hunch wiki --heal`, never a gate.
  */
 import { existsSync, readFileSync } from "node:fs";
-import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { toPosixTarget } from "./paths.js";
 import { currentForTopic, isLive } from "./topics.js";
 import { parseDocAnchors } from "./docanchors.js";
@@ -163,7 +163,10 @@ function referenceExists(store, root, decisionId, ref) {
     // A private-scoped reference is an overlay-repo-relative path, not an escape
     // hatch into arbitrary local files.
     const rel = relative(privateRoot, candidate);
-    if (rel === "" || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\\\" : "/"}`) || isAbsolute(rel))
+    // NOTE: sep, not an escaped literal — `"\\\\"` in a template is the TWO-char
+    // string `\\`, which `relative()` never produces, silently disabling the
+    // containment check on Windows (issue #31).
+    if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel))
         return false;
     return existsSync(candidate);
 }

package/dist/core/io.js

@@ -1,5 +1,6 @@
 /** Durable file writes for the Hunch. */
-import { linkSync, writeFileSync, renameSync, rmSync } from "node:fs";
+import { closeSync, fsyncSync, linkSync, openSync, renameSync, rmSync, writeSync } from "node:fs";
+import { dirname } from "node:path";
 let counter = 0;
 const renameRetryDelaysMs = [10, 20, 40, 80];
 const renameRetryWaiter = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
@@ -7,6 +8,13 @@ const renameRetryWaiter = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_
  * Write `data` to `file` via a temp file + rename, so an interrupted write can't
  * leave the target truncated (the symbols/edges index is the worst to half-write).
  *
+ * Durability (issue #34): the temp file is fsync'd BEFORE the rename, and the
+ * parent directory best-effort after it. A process kill was always safe (page
+ * cache preserves ordering), but on power loss / OS crash the rename's metadata
+ * could reach disk before the temp file's data blocks — leaving the target
+ * present but truncated or garbage, the exact state the atomic-write invariant
+ * (con_902759b3dc) exists to prevent.
+ *
  * Windows caveat: renameSync can't REPLACE a file another process holds open (even
  * for read) — it throws EPERM/EBUSY/EACCES, exactly when the MCP server is reading
  * while a CLI writes. Retry that atomic replacement with bounded backoff. If the
@@ -17,19 +25,42 @@ const renameRetryWaiter = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_
 export function writeFileAtomic(file, data) {
     const tmp = `${file}.tmp${process.pid}.${counter++}`;
     try {
-        writeFileSync(tmp, data);
+        const fd = openSync(tmp, "w");
+        try {
+            writeSync(fd, data);
+            fsyncSync(fd); // data blocks reach disk before the rename's metadata can
+        }
+        finally {
+            closeSync(fd);
+        }
     }
     catch (e) {
-        safeRm(tmp);
+        cleanupTmp(tmp);
         throw e;
     }
     try {
         renameWithContentionRetry(tmp, file);
     }
     catch (e) {
-        safeRm(tmp);
+        cleanupTmp(tmp);
         throw e;
     }
+    fsyncDirBestEffort(dirname(file));
+}
+/** Persist the rename itself (the directory entry). POSIX semantics; Windows
+ *  cannot open directories for fsync, so this is a silent no-op there — NTFS
+ *  journals the metadata on its own schedule. */
+function fsyncDirBestEffort(dir) {
+    try {
+        const fd = openSync(dir, "r");
+        try {
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    catch { /* platform without directory fsync — best effort by contract */ }
 }
 function renameWithContentionRetry(from, to) {
     for (let attempt = 0;; attempt++) {
@@ -55,7 +86,7 @@ function isRenameContention(error) {
 export function writeFileAtomicIfAbsent(file, data) {
     const tmp = `${file}.tmp${process.pid}.${counter++}`;
     try {
-        writeFileSync(tmp, data);
+        writeFileAtomicTmp(tmp, data);
         linkSync(tmp, file);
         return true;
     }
@@ -65,15 +96,39 @@ export function writeFileAtomicIfAbsent(file, data) {
         throw error;
     }
     finally {
-        safeRm(tmp);
+        // Not silently best-effort (issue #38): after linkSync succeeds the target
+        // shares the temp inode, so a swallowed unlink failure (a Windows AV scanner
+        // or indexer briefly holding tmp) leaves the published file with nlink=2 —
+        // which validateExistingFile rejects as hard-linked — plus a stray .tmp.
+        cleanupTmp(tmp);
     }
 }
-function safeRm(p) {
+/** Write + fsync a fresh temp file (shared by both atomic writers). */
+function writeFileAtomicTmp(tmp, data) {
+    const fd = openSync(tmp, "w");
+    try {
+        writeSync(fd, data);
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Remove a temp file, riding out a transient external hold (AV/indexer) with one
+ *  short retry; a persistent failure is REPORTED, never swallowed — a leaked tmp
+ *  beside a hard-link-published target keeps that target at nlink=2. */
+function cleanupTmp(p) {
     try {
         rmSync(p, { force: true });
+        return;
     }
-    catch {
-        /* best effort */
+    catch { /* transient hold — retry once below */ }
+    Atomics.wait(renameRetryWaiter, 0, 0, 50);
+    try {
+        rmSync(p, { force: true });
+    }
+    catch (e) {
+        console.warn(`[hunch] temp file left behind (its published target keeps nlink=2 until it is removed): ${p} (${e.message})`);
     }
 }
 //# sourceMappingURL=io.js.map

package/dist/extractors/git.js

@@ -166,6 +166,39 @@ function canonicalPath(path) {
 export function gitNullDevice() {
     return process.platform === "win32" ? "NUL" : devNull;
 }
+/** How long a live gitindex.lock can plausibly be held: every Hunch git spawn
+ *  carries a timeout well under this, so an OLDER lock provably has no living
+ *  owner in any Hunch flow. */
+const STALE_INDEX_LOCK_MS = 30_000;
+/** Heal a stranded `.git/index.lock` (issue #53). Two ways one appears:
+ *  (a) THIS call's git was timeout-killed — TerminateProcess on Windows skips
+ *      git's cleanup, so a lock created at/after this attempt started is ours;
+ *  (b) a PREVIOUS run crashed/was killed — git then fails FAST forever after,
+ *      and the best-effort flush paths swallow it, so captures keep "succeeding"
+ *      while nothing commits. A pre-existing lock older than any live git's
+ *      possible hold time has no living owner and is safe to remove.
+ *  Returns true when a lock was removed (a retry is then sensible). */
+function clearStrandedIndexLock(repoDir, env, sinceMs, error) {
+    const killed = error?.code === "ETIMEDOUT" || !!error?.signal;
+    try {
+        const rel = execFileSync("git", ["-C", repoDir, "rev-parse", "--git-path", "index.lock"], {
+            encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], env, timeout: 5_000,
+        }).trim();
+        const lockPath = isAbsolute(rel) ? rel : join(repoDir, rel);
+        const mtimeMs = statSync(lockPath).mtimeMs;
+        const stranded = killed
+            ? mtimeMs >= sinceMs // created by the git we just killed
+            : mtimeMs <= Date.now() - STALE_INDEX_LOCK_MS; // left behind long before this attempt
+        if (!stranded)
+            return false;
+        rmSync(lockPath, { force: true });
+        console.error(`hunch: removed a stranded index.lock at "${repoDir}" (${killed ? "this git operation timed out" : "left by an earlier interrupted git"}); retrying.`);
+        return true;
+    }
+    catch {
+        return false; // no lock present, or git itself unavailable — nothing to heal
+    }
+}
 /** Compare physical directory identity before path text. Git for Windows can
  * return an 8.3/short or differently-cased spelling for the same top-level
  * directory that Node reached through its long path. A nonzero file ID keeps
@@ -515,13 +548,21 @@ export function commitAndPushHunch(hunchDir, message, opts) {
             GIT_ATTR_NOSYSTEM: "1",
         });
         const run = (args) => {
-            try {
-                execFileSync("git", ["-C", hunchDir, ...args], { stdio: "ignore", env });
-                return true;
-            }
-            catch {
-                return false; // best-effort: nothing staged / not a repo / offline
+            for (let attempt = 0; attempt < 2; attempt++) {
+                const startedAt = Date.now();
+                try {
+                    execFileSync("git", ["-C", hunchDir, ...args], { stdio: "ignore", env });
+                    return true;
+                }
+                catch (error) {
+                    // best-effort: nothing staged / not a repo / offline — EXCEPT a
+                    // stranded index.lock, which would otherwise fail every future
+                    // flush silently (issue #53); heal it and retry once.
+                    if (!clearStrandedIndexLock(hunchDir, env, startedAt, error))
+                        return false;
+                }
             }
+            return false;
         };
         if (opts.push !== false) {
             if (!overlayAttributeSourcesAreSafe(hunchDir, env)) {
@@ -598,18 +639,29 @@ export function commitAndPushHunch(hunchDir, message, opts) {
         if (!hooksDir)
             return null;
         const commitPaths = [...memoryPaths, ...(opts.alsoStage ?? [])];
-        try {
-            execFileSync("git", [
-                "-C", hunchDir,
-                "-c", `core.hooksPath=${hooksDir}`,
-                ...(opts.push === false ? [] : ["-c", `core.attributesFile=${gitNullDevice()}`]),
-                "-c", "core.autocrlf=false",
-                "-c", "commit.gpgsign=false",
-                "commit", "--no-gpg-sign", "--only", "-m", message, "--", ...commitPaths,
-            ], { stdio: "ignore", env, timeout: 15_000 });
-            committed = true;
+        // One retry after healing a stranded index.lock (issue #53): a lock left by
+        // a timeout-killed or crashed git otherwise fails EVERY later flush fast and
+        // silently — captures keep reporting success while nothing commits.
+        for (let attempt = 0; attempt < 2 && !committed; attempt++) {
+            const commitStartedAt = Date.now();
+            try {
+                execFileSync("git", [
+                    "-C", hunchDir,
+                    "-c", `core.hooksPath=${hooksDir}`,
+                    ...(opts.push === false ? [] : ["-c", `core.attributesFile=${gitNullDevice()}`]),
+                    "-c", "core.autocrlf=false",
+                    "-c", "commit.gpgsign=false",
+                    "commit", "--no-gpg-sign", "--only", "-m", message, "--", ...commitPaths,
+                ], { stdio: "ignore", env, timeout: 15_000 });
+                committed = true;
+            }
+            catch (error) {
+                // Nothing staged / not a repo stays quiet, as before; only a healed
+                // stranded lock earns the single retry.
+                if (!clearStrandedIndexLock(hunchDir, env, commitStartedAt, error))
+                    break;
+            }
         }
-        catch { /* nothing staged / not a repo */ }
         if (!committed)
             return null;
         if (opts.push !== false) {
@@ -1123,6 +1175,7 @@ function mergeRemote(hunchDir, env, timeoutMs, contract, allowUnrelatedHistories
     if (!hooksDir)
         return "failed";
     const tryGit = (args, timeout = timeoutMs) => {
+        const startedAt = Date.now();
         try {
             execFileSync("git", [
                 "-C", hunchDir,
@@ -1136,7 +1189,10 @@ function mergeRemote(hunchDir, env, timeoutMs, contract, allowUnrelatedHistories
             });
             return true;
         }
-        catch {
+        catch (error) {
+            // Same stranding class as the commit path: a timeout-killed merge/fetch
+            // leaves index.lock behind and wedges every later sync (issue #53).
+            clearStrandedIndexLock(hunchDir, env, startedAt, error);
             return false;
         }
     };
@@ -1522,6 +1578,13 @@ function waitForCommitLockHandoff(lock, first, timeoutMs) {
         Atomics.wait(sleeper, 0, 0, Math.min(25, deadline - Date.now()));
         attempt = acquireCommitLock(lock);
     }
+    // The deadline can expire DURING the final wait+acquire; without this check an
+    // acquire that succeeded on that last iteration returned false while this
+    // process's owner directory held the lock — never released (the caller bails
+    // before its try/finally), wedging every flush in every process until this one
+    // exited (issue #48).
+    if (attempt.state === "acquired")
+        return true;
     return false;
 }
 export function headSha(cwd) {
@@ -1595,7 +1658,7 @@ export function currentBranch(cwd) {
 /** Files changed in a single commit. `--root` makes the initial commit (which
  *  has no parent) report its files as additions instead of returning nothing. */
 export function commitFiles(sha, cwd) {
-    const out = gitSafe(["diff-tree", "--no-commit-id", "--name-only", "-r", "--root", sha], cwd);
+    const out = gitSafe(["-c", "core.quotePath=false", "diff-tree", "--no-commit-id", "--name-only", "-r", "--root", sha], cwd);
     return out ? out.split("\n").filter(Boolean) : [];
 }
 /** Raw `git log` over `.hunch/`, paired with parseMemoryLog — the memory-move
@@ -2011,7 +2074,7 @@ export function fileGitMetrics(cwd, want, days = 90) {
         return out;
     // churn — one windowed log; tally each wanted path's appearances (= commits).
     if (days > 0) {
-        const raw = gitSafe(["log", `--since=${days}.days.ago`, "--name-only", "--format="], cwd);
+        const raw = gitSafe(["-c", "core.quotePath=false", "log", `--since=${days}.days.ago`, "--name-only", "--format="], cwd);
         if (raw) {
             for (const line of raw.split("\n")) {
                 const e = line && out.get(line);
@@ -2023,7 +2086,7 @@ export function fileGitMetrics(cwd, want, days = 90) {
     // last commit — one newest-first log; the FIRST time a path appears is its most
     // recent commit. NUL-prefixed lines mark commit boundaries; the rest are paths.
     // 256MB buffer for the all-history name-only stream on large repos.
-    const raw = gitSafe(["log", "--name-only", "--format=%x00%h"], cwd, 256 * 1024 * 1024);
+    const raw = gitSafe(["-c", "core.quotePath=false", "log", "--name-only", "--format=%x00%h"], cwd, 256 * 1024 * 1024);
     if (raw) {
         let remaining = out.size;
         let sha = "";
@@ -2044,17 +2107,23 @@ export function fileGitMetrics(cwd, want, days = 90) {
     }
     return out;
 }
-/** Files staged for commit (for `hunch check` pre-commit enforcement). */
+/** Files staged for commit (for `hunch check` pre-commit enforcement).
+ *
+ *  Every path enumerator here pins `core.quotePath=false` (issue #50): with
+ *  git's default quotePath, any path holding bytes > 0x7F comes back
+ *  octal-quoted (`"src/caf\303\251.ts"`), which matches neither the store's
+ *  POSIX paths nor constraint scope globs — a blocking constraint over such a
+ *  file graded as a vacuous PASS, and its churn/last-commit metrics read zero. */
 export function stagedFiles(cwd) {
-    const out = gitSafe(["diff", "--cached", "--no-ext-diff", "--no-textconv", "--name-only", "--diff-filter=ACMR"], cwd);
+    const out = gitSafe(["-c", "core.quotePath=false", "diff", "--cached", "--no-ext-diff", "--no-textconv", "--name-only", "--diff-filter=ACMR"], cwd);
     return out ? out.split("\n").filter(Boolean) : [];
 }
 /** Files changed anywhere in the working tree compared with HEAD: both staged
  * and unstaged tracked files, plus untracked files. This powers the local,
  * pre-commit Change Gate; it never mutates the index or asks an agent/model. */
 export function workingFiles(cwd) {
-    const changed = gitSafe(["diff", "HEAD", "--no-ext-diff", "--no-textconv", "--name-only", "--diff-filter=ACMR"], cwd).split("\n").filter(Boolean);
-    const untracked = gitSafe(["ls-files", "--others", "--exclude-standard"], cwd).split("\n").filter(Boolean);
+    const changed = gitSafe(["-c", "core.quotePath=false", "diff", "HEAD", "--no-ext-diff", "--no-textconv", "--name-only", "--diff-filter=ACMR"], cwd).split("\n").filter(Boolean);
+    const untracked = gitSafe(["-c", "core.quotePath=false", "ls-files", "--others", "--exclude-standard"], cwd).split("\n").filter(Boolean);
     return [...new Set([...changed, ...untracked])].sort();
 }
 /** Does a ref resolve to a commit in this repo? Lets `--base` fail LOUDLY on an
@@ -2066,7 +2135,7 @@ export function revExists(ref, cwd) {
 /** Files a PR/branch changes vs `base` (3-dot: changes on HEAD since the merge-base,
  *  i.e. exactly the PR's own commits — the CI Constraint Guard's surface). */
 export function rangeFiles(base, cwd, head = "HEAD") {
-    const out = gitSafe(["diff", "--no-ext-diff", "--no-textconv", "--name-only", "--diff-filter=ACMR", `${base}...${head}`], cwd);
+    const out = gitSafe(["-c", "core.quotePath=false", "diff", "--no-ext-diff", "--no-textconv", "--name-only", "--diff-filter=ACMR", `${base}...${head}`], cwd);
     return out ? out.split("\n").filter(Boolean) : [];
 }
 /** Commit subjects on `head` since `base` (2-dot: commits added by the task),
@@ -2095,8 +2164,8 @@ export function stagedDiff(cwd, maxBytes = 60_000) {
  * intentionally contribute no synthetic content to regression analysis. */
 export function workingDiff(cwd, maxBytes = 60_000) {
     let out = gitSafe(["diff", "HEAD", "--no-ext-diff", "--no-textconv", "--no-color", "--unified=2", "--", ...DIFF_NOISE], cwd);
-    const tracked = new Set(gitSafe(["diff", "HEAD", "--no-ext-diff", "--no-textconv", "--name-only", "--diff-filter=ACMR"], cwd).split("\n").filter(Boolean));
-    const untracked = gitSafe(["ls-files", "--others", "--exclude-standard"], cwd).split("\n").filter((f) => f && !tracked.has(f));
+    const tracked = new Set(gitSafe(["-c", "core.quotePath=false", "diff", "HEAD", "--no-ext-diff", "--no-textconv", "--name-only", "--diff-filter=ACMR"], cwd).split("\n").filter(Boolean));
+    const untracked = gitSafe(["-c", "core.quotePath=false", "ls-files", "--others", "--exclude-standard"], cwd).split("\n").filter((f) => f && !tracked.has(f));
     const readWorkingFile = createRepoFileReader(cwd);
     for (const file of untracked) {
         try {
@@ -2146,7 +2215,7 @@ export function fixCommits(spec, cwd, max = 200) {
 }
 /** All tracked files matching the given extensions. */
 export function trackedFiles(cwd, exts) {
-    const out = gitSafe(["ls-files"], cwd);
+    const out = gitSafe(["-c", "core.quotePath=false", "ls-files"], cwd);
     const all = out ? out.split("\n").filter(Boolean) : [];
     return all.filter((f) => exts.some((e) => f.endsWith(e)));
 }

package/dist/extractors/nativeTreeSitter.js

@@ -64,7 +64,12 @@ function copyNativeBinding(packageName, copyRoot, nodeGypBuild) {
 export function loadNativeTreeSitter() {
     if (runtime)
         return runtime;
-    const preloaded = Object.keys(runtimeRequire.cache).filter((path) => /tree-sitter(?:-typescript|-python)?\.node$/.test(path)
+    // Both binding spellings: prebuilds ship as tree-sitter[-typescript|-python].node,
+    // while from-source builds are named after the binding.gyp target with
+    // underscores (tree_sitter_runtime_binding.node, tree_sitter_python_binding.node,
+    // …). Missing the underscore names let an already-loaded source-built addon slip
+    // past this guard and defeat the file-lock isolation entirely (issue #52).
+    const preloaded = Object.keys(runtimeRequire.cache).filter((path) => /(?:tree-sitter(?:-typescript|-python)?|tree_sitter(?:_[a-z]+)*_binding)\.node$/.test(path)
         && !new RegExp(`(?:^|[\\\\/])${COPY_PREFIX}\\d+-`).test(path));
     if (preloaded.length) {
         throw new Error(`tree-sitter native addon was loaded before Hunch could isolate it: ${preloaded.join(", ")}`);

package/dist/extractors/testreport.js

@@ -56,7 +56,8 @@ export function parseTestReport(output) {
         // Collect the following more-indented diagnostic block as the message.
         const baseIndent = leadingSpaces(raw);
         const block = [];
-        for (let j = i + 1; j < lines.length; j++) {
+        let j = i + 1;
+        for (; j < lines.length; j++) {
             const ln = lines[j];
             if (ln.trim() === "") {
                 block.push("");
@@ -68,6 +69,11 @@ export function parseTestReport(output) {
         }
         const diag = block.join("\n").trim();
         failMap.set(name, { test: name, message: diag ? `${name}\n${diag}` : name });
+        // Skip the consumed diagnostic block (issue #51): re-visiting it let
+        // TAP-looking text QUOTED INSIDE an error message (assertion diffs in this
+        // very repo quote "ok N - …" lines) parse as real results — a phantom pass
+        // can mark a previously-open bug fixed without any test having re-run.
+        i = j - 1;
     }
     // A test can legitimately appear as both (flaky retry) — trust the failure.
     for (const name of failMap.keys())

package/dist/integrations/claudemd.js

@@ -3,8 +3,9 @@
  * context loaded every session for free"). We own ONLY the region between the
  * HUNCH markers — any user-authored content outside it is preserved verbatim.
  */
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
-import { join, dirname } from "node:path";
+import { readFileSync, existsSync, mkdirSync } from "node:fs";
+import { writeFileAtomic } from "../core/io.js";
+import { basename, join, dirname } from "node:path";
 import { wikiSummary } from "../wiki/wiki.js";
 import { PolicyRepository } from "../constitution/repository.js";
 const START = "<!-- HUNCH:START — auto-generated, do not edit by hand -->";
@@ -103,12 +104,14 @@ export function upsertSection(file, section, fallbackTitle) {
         content = `${fallbackTitle}\n\n${section}\n`;
     }
     mkdirSync(dirname(file), { recursive: true }); // e.g. .github/ for copilot-instructions
-    writeFileSync(file, content);
+    // Atomic: this file carries the USER'S prose around the managed block — a torn
+    // write must not be able to truncate it (issue #43).
+    writeFileAtomic(file, content);
     return file;
 }
 /** Insert/replace the HUNCH section in CLAUDE.md, preserving everything else. */
 export function updateClaudeMd(root, store) {
-    return upsertSection(join(root, "CLAUDE.md"), renderHunchSection(store, root), `# ${root.split("/").pop()}`);
+    return upsertSection(join(root, "CLAUDE.md"), renderHunchSection(store, root), `# ${basename(root)}`);
 }
 function sev(s) {
     return { blocking: 3, warning: 2, advisory: 1 }[s] ?? 0;

package/dist/integrations/providers.js

@@ -17,7 +17,8 @@
  * Every writer MERGES into existing files (preserving other servers / user prose)
  * and is idempotent, so re-running `hunch init` is safe.
  */
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { readFileSync, existsSync, mkdirSync } from "node:fs";
+import { writeFileAtomic } from "../core/io.js";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { renderHunchSection, upsertSection, updateClaudeMd } from "./claudemd.js";
@@ -135,7 +136,9 @@ function tomlStr(s) {
 }
 function writeJson(file, obj) {
     mkdirSync(dirname(file), { recursive: true });
-    writeFileSync(file, JSON.stringify(obj, null, 2) + "\n");
+    // Atomic: these files hold the USER'S merged servers/hooks — a torn write would
+    // leave them unparseable, which every writer here then refuses to touch (#43).
+    writeFileAtomic(file, JSON.stringify(obj, null, 2) + "\n");
     return file;
 }
 /** Provider hook commands live in tracked config files, so use the structured
@@ -148,7 +151,14 @@ function hookCommand(inv, provider) {
 function isHunchProviderHook(entry) {
     const e = entry && typeof entry === "object" ? entry : null;
     const command = typeof e?.command === "string" ? e.command : "";
-    return /(?:@davesheffer\/hunch|[\\/]index\.(?:js|ts))/.test(command) && /\bhook\b/.test(command);
+    // Anchored to the exact shape hookCommand() writes — JSON-quoted parts ending
+    // in "hook" "--provider" "<name>" — plus a Hunch launcher (the pinned npm
+    // package spec, or a quoted …/index.js|ts path for source installs). The old
+    // unanchored /index\.(js|ts)/ + /\bhook\b/ pair classified FOREIGN entries
+    // like `node ./hook/index.js` as ours and silently deleted them, violating
+    // the leave-every-foreign-hook-in-place contract (con_8460b6770f, issue #41).
+    return /(?:@davesheffer\/hunch|[\\/]index\.(?:js|ts)")/.test(command)
+        && /\s"hook"(?:\s+"--provider"\s+"[a-z]+")?\s*$/.test(command);
 }
 /** Merge our command entries into a standard `{ hooks: { Event: [] } }` file.
  * We replace only old Hunch commands and leave every foreign hook in place. */
@@ -255,7 +265,7 @@ export function writeCodexConfig(root, inv) {
     }
     base = base.trimEnd();
     mkdirSync(dirname(file), { recursive: true });
-    writeFileSync(file, base ? `${base}\n\n${block}\n` : `${block}\n`);
+    writeFileAtomic(file, base ? `${base}\n\n${block}\n` : `${block}\n`);
     return file;
 }
 /** AGENTS.md — the cross-tool ambient-instruction standard (Codex and a growing
@@ -273,7 +283,7 @@ export function writeCursorRule(root, store) {
     const file = join(root, ".cursor", "rules", "hunch.mdc");
     const body = `---\ndescription: Hunch engineering memory — consult the hunch_* MCP tools before editing\nalwaysApply: true\n---\n\n${renderHunchSection(store, root)}\n`;
     mkdirSync(dirname(file), { recursive: true });
-    writeFileSync(file, body);
+    writeFileAtomic(file, body);
     return file;
 }
 /** Windsurf (Cascade): .windsurf/mcp_config.json — same `mcpServers` shape as
@@ -308,7 +318,7 @@ export function writeWindsurfRule(root, store) {
     const file = join(root, ".windsurf", "rules", "hunch.md");
     const body = `---\ntrigger: always_on\ndescription: Hunch engineering memory — consult the hunch_* MCP tools before editing\n---\n\n${renderHunchSection(store, root)}\n`;
     mkdirSync(dirname(file), { recursive: true });
-    writeFileSync(file, body);
+    writeFileAtomic(file, body);
     return file;
 }
 /** Cursor's hook API is beta, but its project-level config accepts this standard

package/dist/integrations/scaffold.js

@@ -3,7 +3,8 @@
  *   - .mcp.json          → registers the `hunch` MCP server with Claude Code
  *   - .claude/commands/* → user-triggered slash commands for the §5 workflows
  */
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { readFileSync, existsSync, mkdirSync } from "node:fs";
+import { writeFileAtomic } from "../core/io.js";
 import { join, dirname } from "node:path";
 /** Merge a `hunch` server entry into .mcp.json, preserving other servers.
  *  A non-empty file we cannot parse THROWS instead of being silently replaced
@@ -28,7 +29,9 @@ export function writeMcpJson(root, inv) {
     }
     json.mcpServers = json.mcpServers ?? {};
     json.mcpServers.hunch = { command: inv.command, args: [...inv.args, "mcp"] };
-    writeFileSync(file, JSON.stringify(json, null, 2) + "\n");
+    // Atomic: .mcp.json holds the user's other servers — a torn write would leave
+    // it unparseable, which this writer then refuses to touch (issue #43).
+    writeFileAtomic(file, JSON.stringify(json, null, 2) + "\n");
     return file;
 }
 const WHY_CMD = `---
@@ -168,13 +171,17 @@ export function installClaudeHooks(root, hookCmd) {
     if (existed && before === next)
         return { path: file, action: "unchanged" };
     mkdirSync(dirname(file), { recursive: true });
-    writeFileSync(file, next);
+    writeFileAtomic(file, next);
     return { path: file, action: existed ? "updated" : "created" };
 }
+/** Ownership marker for generated slash commands: its presence means Hunch may
+ *  refresh the file; deleting the line hands the file to the user for good. */
+const CMD_MARKER = "<!-- hunch:generated — refreshed by hunch init; delete this line to take ownership -->";
 export function writeSlashCommands(root) {
     const dir = join(root, ".claude", "commands");
     mkdirSync(dir, { recursive: true });
     const written = [];
+    const skipped = [];
     const files = [
         ["hunch-why.md", WHY_CMD],
         ["hunch-fix.md", FIX_CMD],
@@ -185,9 +192,18 @@ export function writeSlashCommands(root) {
     ];
     for (const [name, body] of files) {
         const p = join(dir, name);
-        writeFileSync(p, body);
+        // Generic names (capture/heal/audit) are plausibly the USER'S OWN commands;
+        // hunch-prefixed names are namespaced ours. Overwrite an existing file only
+        // when it carries the ownership marker or the hunch- namespace — never
+        // silently replace user content (issue #42). Pre-marker Hunch installs skip
+        // once and report; re-adopt by deleting the file and re-running init.
+        if (existsSync(p) && !name.startsWith("hunch-") && !readFileSync(p, "utf8").includes("hunch:generated")) {
+            skipped.push(p);
+            continue;
+        }
+        writeFileAtomic(p, `${body}\n${CMD_MARKER}\n`);
         written.push(p);
     }
-    return written;
+    return { written, skipped };
 }
 //# sourceMappingURL=scaffold.js.map

package/dist/mcp/roots.js

@@ -5,10 +5,26 @@
  * another workspace or linked worktree. MCP roots are the client-neutral protocol
  * mechanism for following that change.
  */
-import { statSync } from "node:fs";
+import { realpathSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { findRoot, HUNCH_DIR, isDir } from "../core/paths.js";
+/** One canonical spelling per directory. `findRoot` only resolve()s, but a
+ *  client's roots/list URI can spell the same repo differently — VS Code sends
+ *  a lowercase drive letter (`c:\…`) while the spawn cwd has `C:\…`, and Git
+ *  for Windows can surface 8.3/short names. Raw string comparison then treats
+ *  ONE repo as different roots: a full re-prepare (new store + reindex) on
+ *  every connect, or a false "multiple roots equally plausible" refusal
+ *  (issue #54). realpathSync.native returns the on-disk spelling for all of
+ *  these; fall back to the input when the path is transiently unreadable. */
+export function canonicalRootPath(root) {
+    try {
+        return realpathSync.native(root);
+    }
+    catch {
+        return root;
+    }
+}
 function toPath(uri) {
     if (!uri.startsWith("file:"))
         return "";
@@ -44,12 +60,12 @@ export function resolveActiveRoot(rootUris, fallbackCwd) {
         const start = rootStart(toPath(uri));
         if (!start)
             continue;
-        const root = findRoot(start);
+        const root = canonicalRootPath(findRoot(start));
         if (!candidates.includes(root))
             candidates.push(root);
     }
     if (!candidates.length)
-        return findRoot(fallbackCwd);
+        return canonicalRootPath(findRoot(fallbackCwd));
     if (candidates.length === 1)
         return candidates[0];
     const withStore = candidates.filter((candidate) => isDir(join(candidate, HUNCH_DIR)));

package/dist/mcp/server.js

@@ -11,7 +11,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { RootsListChangedNotificationSchema } from "@modelcontextprotocol/sdk/types.js";
 import { z } from "zod";
 import { hunchPaths, findRoot, toPosixTarget } from "../core/paths.js";
-import { resolveActiveRoot } from "./roots.js";
+import { canonicalRootPath, resolveActiveRoot } from "./roots.js";
 import { HunchStore } from "../store/hunchStore.js";
 import { selectEmbedder } from "../store/embedder.js";
 import { decisionId, findingId } from "../core/ids.js";
@@ -278,8 +278,11 @@ export function buildServerWithRootControl(initialRoot) {
     let pendingScheduled = false;
     let closed = false;
     const activateRoot = (next) => {
-        const canonical = findRoot(next);
-        if (canonical === root)
+        // canonicalRootPath: a case/8.3 spelling difference must not read as a
+        // DIFFERENT repo — that closed the live store and re-prepared everything
+        // on every same-repo client connect (issue #54).
+        const canonical = canonicalRootPath(findRoot(next));
+        if (canonical === canonicalRootPath(root))
             return;
         const prepared = prepareRoot(canonical, explicitOverlay, true);
         const previous = store;
@@ -386,12 +389,18 @@ export function buildServerWithRootControl(initialRoot) {
                 if (teamAdvertised && !matchesStartupTeamRoute()) {
                     return err("The team-memory route changed during refresh. Refusing to serve a stale or redirected graph; reconnect Hunch first.");
                 }
-                try {
-                    if (store.sourceStamp() !== indexedSourceStamp)
-                        refreshIndex();
-                }
-                catch { /* corrupt/churning local source — serve the last durable indexed view */ }
             }
+            // Stamp check in EVERY mode, not only shared: a CLI capture or post-commit
+            // hook in another terminal writes JSON that mtime-invalidated loadAll sees
+            // immediately, while the SQLite FTS/graph index this long-lived process
+            // serves would stay frozen at startup — split-brain answers within one
+            // session (JSON-backed tools fresh, query/structure/dependents stale)
+            // until restart (issue #49).
+            try {
+                if (store.sourceStamp() !== indexedSourceStamp)
+                    refreshIndex();
+            }
+            catch { /* corrupt/churning local source — serve the last durable indexed view */ }
             const result = await callback(...args);
             if (teamAdvertised && !matchesStartupTeamRoute()) {
                 return err("The team-memory route changed while the tool was running. Its startup destination was not published; reconnect Hunch before retrying.");

package/dist/store/compact.js

@@ -58,6 +58,12 @@ export function planCompaction(input, opts) {
                 continue; // d is being removed → its references don't count
             if (d.supersedes)
                 refDec.add(d.supersedes);
+            // superseded_by is a reference too: supersedeIn() sets old.superseded_by
+            // without requiring the successor's `supersedes`, so removing a later-
+            // rejected successor would leave the surviving record with a dangling
+            // pointer AND permanently non-live for its topic (issue #36).
+            if (d.superseded_by)
+                refDec.add(d.superseded_by);
             if (d.caused_by_bug)
                 refBug.add(d.caused_by_bug);
         }

package/dist/store/hunchStore.js

@@ -760,11 +760,14 @@ export class HunchStore {
         const symbols = this.recs("symbols");
         const components = this.recs("components");
         const asOf = opts.asOf;
-        const matchedSymbols = symbols.filter((s) => s.file === target || s.name === target || s.id === target || s.file.endsWith(target));
+        // pathRelated, not bare endsWith: "scenario.ts".endsWith("io.ts") is true,
+        // so an unanchored suffix pulled unrelated files' records into why()/the
+        // pre-edit grounding block (issue #32). Segment-anchored matching only.
+        const matchedSymbols = symbols.filter((s) => s.file === target || s.name === target || s.id === target || pathRelated(s.file, target));
         const symIds = new Set(matchedSymbols.map((s) => s.id));
         const fileSet = new Set(matchedSymbols.map((s) => s.file));
         const isPath = target.includes("/") || target.includes(".");
-        const fileMatch = (files) => files.some((f) => f === target || (isPath && (f.endsWith(target) || target.endsWith(f))) || fileSet.has(f));
+        const fileMatch = (files) => files.some((f) => f === target || (isPath && pathRelated(f, target)) || fileSet.has(f));
         return {
             target,
             decisions: decisions.filter((d) => (fileMatch(d.related_files) || d.related_components.some((c) => components.find((x) => x.id === c && fileMatch(x.paths))))
@@ -1525,7 +1528,9 @@ const RRF_W_GRAPH = numEnv("HUNCH_RRF_W_GRAPH", 0.5);
 const GRAPH_GAMMA = numEnv("HUNCH_GRAPH_GAMMA", 0.25);
 function numEnv(name, dflt) {
     const v = Number(process.env[name]);
-    return Number.isFinite(v) && v > 0 ? v : dflt;
+    // >= 0, not > 0: zero is the documented kill-switch (HUNCH_RRF_W_*=0 disables
+    // a stream); rejecting it silently re-enabled the default weight (issue #33).
+    return Number.isFinite(v) && v >= 0 ? v : dflt;
 }
 /** Pack a vector's exact bytes for SQLite. Explicit offset+length so a SUBARRAY
  *  view (byteOffset != 0) writes only its slice, not the whole backing buffer.

package/dist/store/jsonStore.js

@@ -14,6 +14,9 @@ import { writeFileAtomic } from "../core/io.js";
  *  constraints) are one file per record so they're cleanly reviewable in PRs. */
 const SINGLE_FILE = { symbols: "index.json", edges: "index.json" };
 const encode = (v) => JSON.stringify(v, null, 2) + "\n";
+// Sleep primitive for the single-file RMW lock's bounded spin (issue #35);
+// same idiom as core/io.ts's rename backoff.
+const RMW_LOCK_WAITER = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
 /** Curated entities are intentionally small, human-reviewable records. Symbols
  * and edges are dense indexes, so they get a much larger but still finite cap. */
 export const MAX_JSON_RECORD_BYTES = 8 * 1024 * 1024;
@@ -389,6 +392,14 @@ export class JsonStore {
                 const text = this.readContainedFile(directory, join(directory.lexical, name), this.maxBytes(kind));
                 if (text === null)
                     continue;
+                // A 0-byte per-record file is a merge-driver TOMBSTONE, not a record:
+                // git cannot delete through a merge driver, so "both sides deleted" is
+                // materialized as an empty %A (issue #37). Human-approved refinement of
+                // con_947c578b2c's boundary (2026-08-04): an empty file holds no record
+                // to migrate or drop, and Hunch's own atomic writes (con_902759b3dc)
+                // never produce one — emptiness is unambiguous, so no warning.
+                if (text.trim() === "")
+                    continue;
                 raw = JSON.parse(text);
             }
             catch (e) {
@@ -403,6 +414,49 @@ export class JsonStore {
         }
         return out;
     }
+    /** Cross-process mutex for single-file index read-modify-write (issue #35).
+     *  The long-lived MCP server and CLI hooks write the same `.hunch/` concurrently;
+     *  two unsynchronized RMWs over index.json each read the same base array and the
+     *  second rename silently erases the first's record. `mkdirSync` is the atomic
+     *  acquire (EEXIST = held). A stale lock (killed process) is taken over by age;
+     *  against a live contender we wait briefly and then proceed WITH a warning —
+     *  never worse than the historical lockless behavior, and capture paths must not
+     *  start throwing on lock contention. */
+    withSingleFileLock(kind, directory, fn) {
+        const lock = join(directory.lexical, ".rmw-lock");
+        const deadline = Date.now() + 2_000;
+        for (;;) {
+            try {
+                mkdirSync(lock);
+                break;
+            }
+            catch {
+                try {
+                    if (Date.now() - lstatSync(lock).mtimeMs > 10_000) {
+                        rmSync(lock, { recursive: true, force: true }); // no live spawn holds a lock this old
+                        continue;
+                    }
+                }
+                catch {
+                    continue; /* vanished between attempts — retry the acquire */
+                }
+                if (Date.now() >= deadline) {
+                    console.warn(`[hunch] proceeding without the ${kind} index lock (still held: ${lock})`);
+                    return fn();
+                }
+                Atomics.wait(RMW_LOCK_WAITER, 0, 0, 25);
+            }
+        }
+        try {
+            return fn();
+        }
+        finally {
+            try {
+                rmSync(lock, { recursive: true, force: true });
+            }
+            catch { /* stale-takeover reclaims it */ }
+        }
+    }
     /** Write a single record (validated) to its JSON file / into the index array. */
     put(kind, record) {
         const schema = SCHEMAS[kind];
@@ -416,11 +470,14 @@ export class JsonStore {
             // record can't silently drop schema-invalid / future-schema siblings — the
             // same reason delete() reads raw. Keep the index sorted by id (stable diff,
             // and agrees with the merge driver so a re-index after a merge is a no-op).
-            const f = this.fileFor(kind, validated.id);
-            const arr = this.readRawArray(kind, directory, f).filter((r) => r?.id !== validated.id);
-            arr.push(validated);
-            arr.sort((a, b) => String(a?.id).localeCompare(String(b?.id)));
-            this.writeContainedFile(directory, f, encode(arr), this.maxBytes(kind));
+            // Locked: the read-modify-write below is what issue #35 races.
+            this.withSingleFileLock(kind, directory, () => {
+                const f = this.fileFor(kind, validated.id);
+                const arr = this.readRawArray(kind, directory, f).filter((r) => r?.id !== validated.id);
+                arr.push(validated);
+                arr.sort((a, b) => String(a?.id).localeCompare(String(b?.id)));
+                this.writeContainedFile(directory, f, encode(arr), this.maxBytes(kind));
+            });
         }
         else {
             this.writeContainedFile(directory, this.fileFor(kind, validated.id), encode(validated), this.maxBytes(kind));
@@ -446,19 +503,27 @@ export class JsonStore {
             this.writeContainedFile(directory, this.fileFor(kind, "index"), encode(validated), this.maxBytes(kind));
             return;
         }
-        // One file per record: preflight EVERY existing JSON file before deleting
+        // One file per record: preflight EVERY existing JSON file before touching
         // any, so one malicious symlink cannot cause a partially-cleared store.
         const existing = this.jsonFileNames(kind);
         for (const name of existing) {
             this.validateExistingFile(directory, join(directory.lexical, name), this.maxBytes(kind));
         }
-        for (const name of existing) {
-            this.removeContainedFile(directory, join(directory.lexical, name), this.maxBytes(kind));
-        }
+        // WRITE-FIRST, delete-stale-LAST (issue #30). The old delete-all-then-rewrite
+        // sequence had a crash window in which the kind directory held nothing — and
+        // `hunch private --migrate` runs replaceAll on the OVERLAY, so that window
+        // covered private-only records existing nowhere else. Now a crash mid-write
+        // leaves old ∪ new (same id → same file, so no duplicates), and a crash
+        // mid-delete leaves only stale extras — no state loses records.
+        const keep = new Set(validated.map((r) => `${r.id}.json`));
         for (const r of validated) {
             const id = r.id;
             this.writeContainedFile(directory, this.fileFor(kind, id), encode(r), this.maxBytes(kind));
         }
+        for (const name of existing) {
+            if (!keep.has(name))
+                this.removeContainedFile(directory, join(directory.lexical, name), this.maxBytes(kind));
+        }
     }
     /** Read a single-file index as a raw array (no validation). Missing/empty → [].
      *  A non-empty file that fails to parse THROWS — we must never silently treat a
@@ -482,6 +547,29 @@ export class JsonStore {
     get(kind, id) {
         return this.loadAll(kind).find((r) => r.id === id);
     }
+    /** On-disk record count, independent of validation: per-record kinds count
+     *  every non-tombstone .json file (a 0-byte merge tombstone is an intentional
+     *  absence), single-file kinds count raw array entries (a corrupt index file
+     *  throws readRawArray's own actionable refusal). Lets a caller about to
+     *  DELETE the kind — `hunch private --migrate` — prove the validating loader
+     *  dropped nothing first, instead of silently destroying the records loadAll
+     *  skipped (issue #29, the same never-silently-drop contract as
+     *  con_947c578b2c). */
+    rawRecordCount(kind) {
+        const directory = this.safeKindDirectory(kind, false);
+        if (!directory)
+            return 0;
+        const single = SINGLE_FILE[kind];
+        if (single)
+            return this.readRawArray(kind, directory, join(directory.lexical, single)).length;
+        let count = 0;
+        for (const name of this.jsonFileNames(kind)) {
+            const text = this.readContainedFile(directory, join(directory.lexical, name), this.maxBytes(kind));
+            if (text !== null && text.trim() !== "")
+                count++;
+        }
+        return count;
+    }
     /** Remove a record (used by the curate/reject flow). Returns true if removed.
      *  For single-file kinds we operate on the RAW JSON array (not the validating
      *  loader) so deleting one record can't silently drop schema-invalid siblings. */
@@ -491,16 +579,20 @@ export class JsonStore {
             const directory = this.safeKindDirectory(kind, false);
             if (!directory)
                 return false;
-            const f = this.fileFor(kind, "index");
-            const arr = this.readRawArray(kind, directory, f);
-            if (!this.validateExistingFile(directory, f, this.maxBytes(kind)))
-                return false;
-            const next = arr.filter((r) => r?.id !== id);
-            if (next.length === arr.length)
-                return false;
-            this.writeContainedFile(directory, f, encode(next), this.maxBytes(kind));
-            this.invalidate(kind);
-            return true;
+            // Locked like put(): an unsynchronized delete racing a concurrent put
+            // over the same index would resurrect or drop records (issue #35).
+            return this.withSingleFileLock(kind, directory, () => {
+                const f = this.fileFor(kind, "index");
+                const arr = this.readRawArray(kind, directory, f);
+                if (!this.validateExistingFile(directory, f, this.maxBytes(kind)))
+                    return false;
+                const next = arr.filter((r) => r?.id !== id);
+                if (next.length === arr.length)
+                    return false;
+                this.writeContainedFile(directory, f, encode(next), this.maxBytes(kind));
+                this.invalidate(kind);
+                return true;
+            });
         }
         this.assertSafeRecordId(id);
         const directory = this.safeKindDirectory(kind, false);

package/dist/store/privateMigrate.js

@@ -21,6 +21,18 @@ export function movePublicMemoryToPrivate(pub, priv) {
     let total = 0;
     for (const kind of ENTITY_KINDS) {
         const pubRecs = pub.loadAll(kind);
+        // The validating loader SKIPS corrupt/invalid/future-schema records with a
+        // warning — but the CLI empties the public store right after this returns,
+        // which would silently DELETE exactly those skipped records (and then
+        // untrack + gitignore their only git history). Refuse instead: prove every
+        // on-disk record actually loaded before anything becomes deletable
+        // (issue #29). A kind whose only records are invalid also stops here, so
+        // the "0 loaded → skip merge" path below can never precede a wipe.
+        const rawCount = pub.rawRecordCount(kind);
+        if (rawCount !== pubRecs.length) {
+            throw new Error(`refusing to migrate ${kind}: ${rawCount - pubRecs.length} on-disk record(s) failed to load (see the warnings above) `
+                + `and would be deleted without ever reaching the overlay. Fix or remove them, then re-run \`hunch private --migrate\`.`);
+        }
         if (pubRecs.length === 0)
             continue;
         const privRecs = priv.loadAll(kind);

package/dist/synthesis/provider.js

@@ -24,7 +24,7 @@
  * Every provider returns the same shape so the rest of the system never knows
  * (or cares) which one ran.
  */
-import { spawn } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { isIP } from "node:net";
 import { tmpdir } from "node:os";
@@ -66,6 +66,20 @@ export function pexecIn(cmd, args, opts = {}) {
         let err = "";
         let outLen = 0;
         let settled = false;
+        // Windows spawns through a cmd.exe wrapper (shell:true), and child.kill()
+        // terminates only that wrapper — the actual agent CLI survives as an orphan,
+        // still burning the user's subscription after every timeout, accumulating
+        // with each post-commit hook fire (issue #44). taskkill /T fells the tree.
+        // Best-effort by design: the wrapper kill below still runs either way.
+        const killTree = () => {
+            if (IS_WIN && child.pid) {
+                try {
+                    execFile("taskkill", ["/pid", String(child.pid), "/T", "/F"], { windowsHide: true }, () => { });
+                }
+                catch { /* taskkill unavailable — fall through to the wrapper kill */ }
+            }
+            child.kill();
+        };
         const done = (fn) => {
             if (settled)
                 return;
@@ -76,7 +90,7 @@ export function pexecIn(cmd, args, opts = {}) {
         };
         const timer = opts.timeout
             ? setTimeout(() => {
-                child.kill();
+                killTree();
                 done(() => reject(new Error(`"${cmd}" timed out after ${opts.timeout}ms`)));
             }, opts.timeout)
             : null;
@@ -84,7 +98,7 @@ export function pexecIn(cmd, args, opts = {}) {
         child.stdout.on("data", (d) => {
             outLen += d.length;
             if (outLen > max) {
-                child.kill();
+                killTree();
                 done(() => reject(new Error(`"${cmd}" exceeded maxBuffer (${max} bytes)`)));
                 return;
             }
@@ -323,6 +337,18 @@ class ClaudeCliProvider extends PromptSynthProvider {
         const childEnv = { ...process.env };
         delete childEnv.ANTHROPIC_API_KEY;
         delete childEnv.ANTHROPIC_AUTH_TOKEN;
+        // Gateway ROUTING is metered per-token exactly like a raw API key: with
+        // CLAUDE_CODE_USE_BEDROCK/VERTEX set (common in enterprise shell profiles
+        // for interactive use), headless `claude -p` bills AWS/GCP on every
+        // significant commit — silently, from a post-commit hook (issue #39,
+        // con_2ce3f2a547). Strip the routing switches and their endpoint overrides
+        // so the CLI falls through to subscription auth here too.
+        delete childEnv.CLAUDE_CODE_USE_BEDROCK;
+        delete childEnv.CLAUDE_CODE_USE_VERTEX;
+        delete childEnv.ANTHROPIC_BEDROCK_BASE_URL;
+        delete childEnv.ANTHROPIC_VERTEX_BASE_URL;
+        delete childEnv.ANTHROPIC_VERTEX_PROJECT_ID;
+        delete childEnv.CLOUD_ML_REGION;
         // Single-shot text synthesis: no tools, no agentic loop. The prompt carries
         // all needed context inline, so run from a neutral cwd to avoid loading this
         // repo's own hunch MCP server / CLAUDE.md on every commit (cheaper, and no

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.10.0",
+  "version": "1.10.1",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
   "description": "Engineering memory and a deterministic Change Gate for AI-assisted codebases: decisions, rejected approaches, constraints, and bug lineage become portable context and opt-in enforcement for every MCP assistant.",