@davesheffer/hunch 1.10.2 → 1.10.4

package/dist/cli/index.js

@@ -68,7 +68,7 @@ import { computeDrift } from "../core/drift.js";
 import { renderCompilerScorecard, scoreCompilerCaseBank } from "../constitution/scorecard.js";
 import { generateWiki, wikiStatus, wikiPrompt, publicHome, privateHome, readWikiManifestAt, nowData } from "../wiki/wiki.js";
 import { adoptProsePrompt } from "../wiki/adopt.js";
-import { topicCollisions, renderGrounding } from "../core/topics.js";
+import { topicCollisions, renderGrounding, isInForce } from "../core/topics.js";
 import { pendingEscalations, policyEscalations } from "../core/escalations.js";
 import { parseDocAnchors, renderDocGrounding } from "../core/docanchors.js";
 import { compareCandidates } from "../core/compare.js";
@@ -3420,7 +3420,7 @@ vetoCmd
     let drafted = 0;
     let touched = 0;
     for (const d of store.json.loadAll("decisions")) {
-        if (d.superseded_by || d.status === "superseded")
+        if (!isInForce(d))
             continue;
         if (!d.alternatives_rejected.length)
             continue;

package/dist/constitution/repairPolicies.js

@@ -30,9 +30,16 @@ export function planPolicyRepair(renames, policies) {
                 rewrites.push({ id: p.id, field: "scope.paths", from: path, to });
         }
         if (p.assertion.kind !== "executable-behavior") {
+            // must-pass-through carries a THIRD selector (`via`). Omitting it meant an
+            // ordinary rename left the via binding pointing at the old symbol: the policy
+            // either bricked (its semantic hash moved, invalidating the proof, while the
+            // stale via could never be re-proved) or silently stopped enforcing. This runs
+            // automatically from the post-commit hook, so neither outcome was visible.
             const selectors = p.assertion.kind === "exists"
                 ? [p.assertion.subject.selector]
-                : [p.assertion.subject.selector, p.assertion.object.selector];
+                : p.assertion.kind === "must-pass-through"
+                    ? [p.assertion.subject.selector, p.assertion.via.selector, p.assertion.object.selector]
+                    : [p.assertion.subject.selector, p.assertion.object.selector];
             for (const raw of selectors) {
                 const healed = repairSelector(raw, map);
                 if (healed !== raw)
@@ -54,11 +61,18 @@ export function repairPolicySpec(policy, rewrites, at) {
         ? policy.assertion
         : policy.assertion.kind === "exists"
             ? { ...policy.assertion, subject: { selector: subSelector(policy.assertion.subject.selector) } }
-            : {
-                ...policy.assertion,
-                subject: { selector: subSelector(policy.assertion.subject.selector) },
-                object: { selector: subSelector(policy.assertion.object.selector) },
-            };
+            : policy.assertion.kind === "must-pass-through"
+                ? {
+                    ...policy.assertion,
+                    subject: { selector: subSelector(policy.assertion.subject.selector) },
+                    via: { selector: subSelector(policy.assertion.via.selector) },
+                    object: { selector: subSelector(policy.assertion.object.selector) },
+                }
+                : {
+                    ...policy.assertion,
+                    subject: { selector: subSelector(policy.assertion.subject.selector) },
+                    object: { selector: subSelector(policy.assertion.object.selector) },
+                };
     return {
         ...policy,
         revision: policy.revision + 1,

package/dist/core/conformance.js

@@ -1,4 +1,5 @@
 import { externalImportNodeId } from "./externalImports.js";
+import { isInForce } from "./topics.js";
 function resolveSymbols(graph, ref) {
     const syms = graph.symbols;
     if (ref.startsWith("sym_"))
@@ -102,8 +103,8 @@ export function checkConformance(store, opts = {}) {
     const graph = opts.graph ?? { symbols: load("symbols"), edges: load("edges") };
     const out = [];
     for (const d of load("decisions")) {
-        if (d.status === "superseded" || d.superseded_by)
-            continue; // in-force decisions only
+        if (!isInForce(d))
+            continue; // in-force only — a REJECTED intent is not an intent
         for (const p of d.conformance ?? [])
             out.push(evalPredicate(graph, d, p));
     }

package/dist/core/correction.js

@@ -8,6 +8,7 @@
  *   - buildCorrectionConstraint(): mint the Constraint record (human-confirmed,
  *     scoped conservatively) that the pre-edit hook + CI guard then enforce.
  */
+import { isAbsolute, relative } from "node:path";
 import { constraintId } from "./ids.js";
 import { toPosixTarget } from "./paths.js";
 import { deriveForbids } from "./constraintmatch.js";
@@ -40,6 +41,32 @@ export const CORRECTION_NUDGE = "This looks like a correction. If it's a rule th
     "call hunch_record_correction({ rule, scope_hint_file, severity, applies_to_all }) so it " +
     "becomes an enforced, scoped constraint (held at edit-time and in CI) — not a one-off the next session forgets. " +
     "Use severity:\"blocking\" only when the human said never/must; set applies_to_all:true only if the rule is genuinely repo-wide.";
+/** Normalize a scope hint to a repo-relative POSIX path.
+ *
+ *  An ABSOLUTE hint is the shape an agent naturally sends, but `checkConstraints`
+ *  anchors its globs at `^` against repo-relative paths, so an absolute scope matches
+ *  NOTHING — while the constraint keeps `severity: "blocking"` and
+ *  `provenance: human_confirmed`, and the MCP tool affirmatively reports it as enforced
+ *  at edit time and in CI. It also leaks the developer's local filesystem path into the
+ *  committed graph and CLAUDE.md.
+ *
+ *  Returns "" when the hint cannot be made repo-relative (no root, or a path outside the
+ *  repo). The caller then falls back to "**", where the existing severity guard
+ *  down-ranks a non-explicit blocking rule to a warning — fail-safe and honest, rather
+ *  than a blocking rule enforced nowhere. */
+function repoRelativeHint(rawHint, root) {
+    if (!rawHint)
+        return "";
+    const looksAbsolute = isAbsolute(rawHint) || /^[a-zA-Z]:/.test(rawHint);
+    if (!looksAbsolute)
+        return rawHint;
+    if (!root)
+        return "";
+    const rel = toPosixTarget(relative(root, rawHint));
+    if (!rel || rel === ".." || rel.startsWith("../") || isAbsolute(rel) || /^[a-zA-Z]:/.test(rel))
+        return "";
+    return rel;
+}
 /**
  * Build the Constraint a correction mints. Pure (caller passes `now`), so the
  * scope/severity policy is testable in isolation. Key safety rule (research
@@ -55,7 +82,7 @@ export function buildCorrectionConstraint(input, now) {
     // A blank/"." scope hint would mint a meaningless or repo-wide constraint by
     // accident, so fall back to "**" (which the severity guard below then keeps
     // non-blocking unless applies_to_all was explicitly set).
-    const hinted = input.scope_hint_file ? toPosixTarget(input.scope_hint_file) : "";
+    const hinted = repoRelativeHint(input.scope_hint_file ? toPosixTarget(input.scope_hint_file) : "", input.root);
     const scope = input.applies_to_all || !hinted || hinted === "." ? ["**"] : [hinted];
     const repoWide = scope.length === 1 && scope[0] === "**";
     let severity = input.severity ?? "warning";

package/dist/core/strictgate.js

@@ -8,6 +8,7 @@
  *  weaker signals still print, as advisory. This makes strict mode safe to enable
  *  on a shared repo: a false positive downgrades to a warning instead of wrongly
  *  failing a teammate's commit. */
+import { isInForce } from "./topics.js";
 export const STRICT_MIN_CONFIDENCE = 0.8;
 /** Is a provenance source HUMAN-CONFIRMED? Token-aware, so a composite source like
  *  "llm_draft+human_confirmed" counts, but a lookalike ("not_human_confirmed",
@@ -34,8 +35,10 @@ export function isStrictBlocker(c, stale) {
  *  warns. Semantic similarity never blocks. In-force + non-stale gates run first.
  *  This is what makes the "day-one is advisory" DX true (dec_a466655539). */
 export function isVetoBlocker(d, tw, tier, stale) {
-    if (d.status === "superseded" || d.superseded_by)
-        return false; // in-force decisions only
+    // Shared in-force predicate (core/topics.ts): superseded, REJECTED and
+    // window-closed decisions all lose their teeth here, not just superseded ones.
+    if (!isInForce(d))
+        return false;
     if (stale)
         return false; // freshness gate
     if (tier === "semantic")

package/dist/core/topics.js

@@ -4,6 +4,21 @@
 export function isLive(d) {
     return d.status === "accepted" && d.superseded_by === null && d.valid_to === null;
 }
+/** In force for ENFORCEMENT — the one predicate every guard must share.
+ *
+ *  Deliberately BROADER than `isLive`: a `proposed` draft still contributes ADVISORY
+ *  signal (its tripwires are `llm_draft`, which `isVetoBlocker` can never promote to a
+ *  block), and that is the curate loop working as designed. What must never contribute
+ *  is a decision the team formally REJECTED, or one whose valid-time window was closed.
+ *
+ *  The guards previously each inlined a weaker `superseded`-only copy of this test, so a
+ *  REJECTED decision kept driving the veto, regression, retired-symbol and conformance
+ *  guards — it went on blocking commits and injecting "don't re-add this" into the
+ *  pre-edit hook, with no way to un-stick it short of hand-editing the JSON. Structural
+ *  parameter so the strict gate (which sees only a partial record) shares it too. */
+export function isInForce(d) {
+    return d.status !== "superseded" && d.status !== "rejected" && !d.superseded_by && !d.valid_to;
+}
 /** Every live decision anchored to `topic`. In a healthy graph this is length 0 or 1;
  *  length > 1 is a topic collision the §4 resolution must settle. */
 export function liveForTopic(decisions, topic) {

package/dist/extractors/git.js

@@ -590,8 +590,8 @@ export function commitAndPushHunch(hunchDir, message, opts) {
         // a clean overlay store — most dangerously, the overlay was never its own git repo so `git -C`
         // walked UP to the PROJECT repo. Committing/pushing there would overwrite/delete the user's
         // code (we shipped exactly this). Refuse hard: unstage and bail without committing or pushing.
-        const memoryPaths = stagedMemoryPaths(hunchDir, env);
-        if (memoryPaths === null) {
+        const staged = stagedMemoryPaths(hunchDir, env);
+        if (staged === null) {
             try {
                 execFileSync("git", ["-C", hunchDir, "reset", "-q", "--", "."], { stdio: "ignore", env });
             }
@@ -605,6 +605,16 @@ export function commitAndPushHunch(hunchDir, message, opts) {
             }
             return null;
         }
+        // Unstage every derived artifact the scan skipped (catch-log, SQLite index,
+        // atomic-write temps). A public store keeps ordinary ignore semantics, so one
+        // created before those ignore entries existed still stages them above — and the
+        // commit below is `--only` over the memory paths, which would leave them in the
+        // index forever. A permanently dirty index is what the release gate reads as an
+        // unstable tree, and it is exactly what `git reset -- .` used to clean up as a
+        // side effect of the abort path these artifacts no longer take.
+        if (staged.derived.length)
+            run(["reset", "-q", "--", ...staged.derived]);
+        const memoryPaths = staged.memory;
         if (memoryPaths.length === 0)
             return null;
         // Grounding docs refreshed by this capture ride the same memory commit, so committed record
@@ -727,11 +737,6 @@ export function headFileContent(root, rel) {
         return null;
     }
 }
-/** Is the staged set a clean, MEMORY-ONLY change — only JSON record adds/updates, nothing else?
- *  The overlay store is entirely JSON (decisions/, bugs/, …, manifest.json). A real memory sync
- *  is purely additive; a DELETION, rename, or any non-.json staged path means hunchDir is NOT a
- *  clean overlay repo (e.g. it resolved to the project repo), so committing there would clobber
- *  code. Empty stage ⇒ [] (nothing to commit); invalid stage ⇒ null. The transient mkdir lock is ignored. */
 function stagedMemoryPaths(hunchDir, env) {
     let out = "";
     let prefix = "";
@@ -751,8 +756,9 @@ function stagedMemoryPaths(hunchDir, env) {
     }
     const lines = out.split("\n").map((l) => l.trim()).filter(Boolean);
     if (!lines.length)
-        return [];
+        return { memory: [], derived: [] };
     const memoryPaths = [];
+    const derivedPaths = [];
     for (const line of lines) {
         const parts = line.split("\t");
         const status = (parts[0] ?? "").trim();
@@ -767,11 +773,32 @@ function stagedMemoryPaths(hunchDir, env) {
         const memoryRelativePath = normalizedPath.slice(prefix.length);
         if (!memoryRelativePath || memoryRelativePath === "local.json")
             return null; // machine-local overlay pointer; never publish it
+        // Known CLONE-LOCAL/DERIVED artifacts are skipped, never treated as a topology
+        // violation — mirroring committableOverlayJsonPaths below, which already carves
+        // out exactly these. Without this, the strict hook's own catch-log
+        // (.hunch/events.log, append-only with no rotation) made this function return
+        // null forever from its first line onward: the public flush then unstaged
+        // everything and aborted SILENTLY on every later capture, while the MCP tool
+        // still reported success and records piled up untracked.
+        if (isDerivedStoreArtifact(memoryRelativePath)) {
+            derivedPaths.push(memoryRelativePath);
+            continue;
+        }
         if (!normalizedPath.endsWith(".json"))
             return null; // the store is entirely JSON records
         memoryPaths.push(memoryRelativePath);
     }
-    return [...new Set(memoryPaths)];
+    return { memory: [...new Set(memoryPaths)], derived: [...new Set(derivedPaths)] };
+}
+/** Clone-local / DERIVED artifacts that legitimately sit inside a `.hunch` store but
+ *  are never memory records: the SQLite index, temp files, and the strict hook's
+ *  append-only catch-log. A store carrying one of these is a NORMAL store, not a
+ *  topology violation — so both enumerators skip them rather than refusing the whole
+ *  commit. Shared so the public and overlay paths can never disagree again. */
+function isDerivedStoreArtifact(relativeName) {
+    return /^[^/]+\.sqlite[^/]*$/i.test(relativeName)
+        || relativeName.split("/").some((segment) => segment.includes(".tmp"))
+        || relativeName === "events.log";
 }
 /** Enumerate ordinary JSON files already contained under an overlay. Push-capable
  * stores force-add this exact allowlist so remote .gitignore, info/exclude, or an
@@ -806,9 +833,7 @@ function committableOverlayJsonPaths(hunchDir) {
                 else if (relativeName === "local.json") {
                     return false;
                 }
-                else if (/^[^/]+\.sqlite[^/]*$/i.test(relativeName)
-                    || relativeName.split("/").some((segment) => segment.includes(".tmp"))
-                    || relativeName === "events.log") {
+                else if (isDerivedStoreArtifact(relativeName)) {
                     // Known clone-local/derived artifacts are never staged. Everything
                     // else is a topology violation: a shared graph repository cannot
                     // quietly carry arbitrary source alongside its JSON memory.

package/dist/integrations/gitignore.js

@@ -24,6 +24,8 @@ const ENTRIES = [
     // Per-machine private-overlay pointer written by `hunch private` (holds the local
     // path to the private store) — never committed.
     ".hunch/local.json",
+    // The strict hook's append-only catch-log: clone-local, never a memory record.
+    ".hunch/events.log",
     // A local PRIVATE overlay store (HUNCH_PRIVATE_DIR) for sensitive memory — never
     // committed. This is the conventional in-repo path; point the env elsewhere for a
     // fully separate private repo.

package/dist/mcp/server.js

@@ -821,10 +821,14 @@ export function buildServerWithRootControl(initialRoot) {
             // Route the write to its ONE home: an explicit private:true goes to the overlay
             // (putPrivate throws rather than silently falling public); in unified ("shared")
             // mode EVERY capture goes to the overlay; else the public store.
-            if (home === "private")
-                store.putPrivate("decisions", rec);
-            else
-                store.json.put("decisions", rec);
+            // Through putCapture, NOT the raw per-home writers: it carries the cross-home
+            // twin guard. Branching on `home` here bypassed that guard, so one id could
+            // exist in BOTH stores — after which the merged/private-first read makes the
+            // topic-uniqueness check see one record while a later public `supersedes:`
+            // closes the other, leaving two live decisions on one topic and grounding
+            // silently injecting nothing for it. The guard throws; the surrounding catch
+            // turns that into a clean tool error instead of a silent twin.
+            store.putCapture("decisions", rec, !!decision.private);
             // Invalidate, don't delete: closing the superseded decision's valid-time window
             // (+ a supersedes edge) preserves the why-it-changed trail. Route the close to the
             // same store the new record landed in — a private decision supersedes within the
@@ -869,7 +873,7 @@ export function buildServerWithRootControl(initialRoot) {
         description: "When a human corrects the agent ('no, do it this way' / 'never call X here'), persist that correction as a first-class, SCOPED Constraint with provenance — so the pre-edit hook and the CI Constraint Guard hold EVERY assistant to it from now on, instead of it being forgotten next session. Writes to the shared .hunch/ graph (client-agnostic). Set severity:'blocking' only when the human said never/must; set applies_to_all:true only when the rule is genuinely repo-wide (otherwise it is scoped to scope_hint_file).",
         inputSchema: {
             rule: z.string().describe("The invariant in the human's words, e.g. \"never call the pay-per-token API here\"."),
-            scope_hint_file: z.string().optional().describe("A file the correction was about; scopes the constraint to it (the conservative default)."),
+            scope_hint_file: z.string().optional().describe("A file the correction was about; scopes the constraint to it (the conservative default). Prefer a REPO-RELATIVE path (src/foo.ts); an absolute path is relativized against the repo root, and one outside the repo is discarded rather than scoped to a path that could never match."),
             severity: z.enum(["advisory", "warning", "blocking"]).optional().describe("Default 'warning'. Use 'blocking' only for a hard never/must rule."),
             applies_to_all: z.boolean().optional().describe("True ONLY if the rule is genuinely repo-wide (scopes to **); required to make a repo-wide rule blocking."),
             type: z.enum(["security", "performance", "correctness", "architecture", "compliance"]).optional(),
@@ -881,7 +885,11 @@ export function buildServerWithRootControl(initialRoot) {
         try {
             if (!input.rule || !input.rule.trim())
                 return err("rule is required — state the invariant in plain words.");
-            const rec = buildCorrectionConstraint({ ...input, knownDeps: knownRepoDeps(root) }, new Date().toISOString());
+            // root: relativizes an ABSOLUTE scope_hint_file. Agents naturally send absolute
+            // paths (edit-tool payloads and MCP roots are absolute) and every consumer matches
+            // repo-relative — without this the rule would be blocking-but-inert and would leak
+            // the local filesystem path into the committed graph.
+            const rec = buildCorrectionConstraint({ ...input, knownDeps: knownRepoDeps(root), root }, new Date().toISOString());
             // Private corrections go to the overlay (enforced locally via the merged read,
             // never rendered into the public CI comment, which is public-only by construction).
             const home = store.captureHome(!!input.private);
@@ -890,10 +898,8 @@ export function buildServerWithRootControl(initialRoot) {
                 return err(`Refusing to record public correction ${rec.id}: source decision ${rec.source_decision} ${location}.`);
             }
             const existing = home === "private" ? store.getPrivateRec("constraints", rec.id) : store.json.get("constraints", rec.id);
-            if (home === "private")
-                store.putPrivate("constraints", rec);
-            else
-                store.json.put("constraints", rec);
+            // Same cross-home twin guard as the decision path above.
+            store.putCapture("constraints", rec, !!input.private);
             store.reindex();
             // Propagate the new rule to EVERY assistant's ambient grounding (Cursor/Copilot/
             // Windsurf/AGENTS.md/CLAUDE.md), so a correction captured in one assistant is held

package/dist/store/hunchStore.js

@@ -20,7 +20,7 @@ import { selectEmbedder } from "./embedder.js";
 import { JsonStore } from "./jsonStore.js";
 import { gitCommonDir, gitWorktreeRoot, sameGitPublication } from "../extractors/git.js";
 import { pathMatchesGlob } from "../core/glob.js";
-import { currentForTopic } from "../core/topics.js";
+import { currentForTopic, isInForce } from "../core/topics.js";
 import { edgeId } from "../core/ids.js";
 import { isStrictBlocker, isVetoBlocker } from "../core/strictgate.js";
 import { effectiveForbids, matchForbids } from "../core/constraintmatch.js";
@@ -481,14 +481,30 @@ export class HunchStore {
         return { embedded, skipped: docs.length - todo.length, total: docs.length };
     }
     /** Post-fusion rerank by graph PRIORS (dec_25e277f479): relevance ordering, not
-     *  just reachability. Rank-based blend — blended(i) = 1/(60+i) × liveness ×
-     *  provenance × recency — so bm25's negative scale never leaks in. Priors are
-     *  BOUNDED (a superseded or ancient record dims, never disappears): liveness 0.6
+     *  just reachability. Trust weight w = liveness × provenance × recency: liveness 0.6
      *  for superseded/retired/rejected, provenance 1.0 / 0.85 / 0.75 for
      *  human_confirmed / llm_draft / extracted-inferred, recency 0.7 + 0.3·½^(age/90d).
      *  Runbook trigger phrases matching the query boost ×1.5 (exact intent beats
      *  keyword luck). Structural refs (symbols/components/edges) stay neutral.
-     *  Deterministic; ties keep fused order (stable sort). */
+     *
+     *  The prior is applied as a BOUNDED POSITIONAL SHIFT, not as a multiplier on a
+     *  rank-derived score. That is deliberate and load-bearing. The old form —
+     *  `1/(60+i) × w`, sorted descending, sliced to `limit` — could not keep the
+     *  "dims, never disappears" promise it made: across a fused pool of 24 the
+     *  positional term spans only 1/60…1/83 (a 0.72 ratio) while w spans 0.48…1.0 on
+     *  this repo's own records, so the prior was WIDER than the entire pool's
+     *  positional spread and simply overrode fusion. Worse, `priorMeta` returns null
+     *  for structural refs, which left them at w = 1 — a ceiling above what any record
+     *  that is not both human_confirmed and brand-new can reach. Measured over this
+     *  repo's 152 committed decisions with the rest of the pool structural (symbols are
+     *  ~91% of the corpus): 38% of decisions were dropped from the top-12 even when
+     *  they were the #1 fused hit, and 88% from fused rank 8. Both retrieval layers
+     *  ranked the record first and the rerank alone threw it away.
+     *
+     *  A shift of at most ±MAX_PRIOR_SHIFT positions restores the intended semantics:
+     *  a stale or low-provenance record visibly dims, an exact runbook-trigger match
+     *  visibly promotes, and neither can leapfrog the whole pool. Same measurement
+     *  after: 0% evicted from fused ranks 0–8. Deterministic; ties keep fused order. */
     rerankByPriors(hits, limit, query) {
         if (!hits.length)
             return hits; // a SINGLE hit still runs — topic-chain promotion must fire for the lone stale match
@@ -499,10 +515,10 @@ export class HunchStore {
         // predecessor's rank — the reader asked about the topic, and the graph's one
         // live answer must be reachable even when only history matches lexically.
         const present = new Set(hits.map((h) => h.ref));
-        // Each candidate carries its BASE rank position; an injected successor
-        // inherits its predecessor's position (× a hair under, so an exact-match
-        // live record already in the pool is never displaced by an injection).
-        const pool = hits.map((h, i) => ({ h, base: 1 / (60 + i) }));
+        // Each candidate carries its fused POSITION; an injected successor inherits its
+        // predecessor's position + a half step, so it lands immediately after it and an
+        // exact-match live record already in the pool is never displaced by an injection.
+        const pool = hits.map((h, i) => ({ h, pos: i }));
         for (const [i, h] of hits.entries()) {
             if (h.kind !== "decisions")
                 continue;
@@ -515,10 +531,10 @@ export class HunchStore {
             present.add(cur.id);
             pool.push({
                 h: { ref: cur.id, kind: "decisions", title: cur.title, snippet: `current for topic "${d.topic}" (supersedes ${h.ref})`, score: h.score },
-                base: (1 / (60 + i)) * 0.98,
+                pos: i + 0.5,
             });
         }
-        const scored = pool.map(({ h, base }) => {
+        const scored = pool.map(({ h, pos }) => {
             const m = this.priorMeta(h.ref, h.kind);
             let w = 1;
             if (m) {
@@ -533,9 +549,11 @@ export class HunchStore {
                 if (q && m.triggers?.some((tr) => q.includes(tr) || tr.includes(q)))
                     w *= 1.5;
             }
-            return { h, s: base * w };
+            // w > 1 (a trigger match) shifts UP, w < 1 shifts DOWN, both clamped.
+            const shift = Math.max(-MAX_PRIOR_SHIFT, Math.min(MAX_PRIOR_SHIFT, (1 - w) * PRIOR_SHIFT_SCALE));
+            return { h, pos: pos + shift };
         });
-        scored.sort((a, b) => b.s - a.s);
+        scored.sort((a, b) => a.pos - b.pos);
         return scored.slice(0, limit).map((x) => x.h);
     }
     /** The prior-bearing metadata for a hit: liveness, provenance, effective date,
@@ -1254,9 +1272,9 @@ export class HunchStore {
         // attribution (the strict guard fails on `blocking`).
         const ordered = [...decisions].sort((a, b) => Number(blockingDec.has(b.id)) - Number(blockingDec.has(a.id)));
         for (const d of ordered) {
-            // Only IN-FORCE decisions: re-adding what an OUTDATED (superseded) decision
-            // removed is not a regression against the current design.
-            if (d.superseded_by || d.status === "superseded")
+            // Only IN-FORCE decisions: re-adding what an OUTDATED (superseded), REJECTED, or
+            // window-closed decision removed is not a regression against the current design.
+            if (!isInForce(d))
                 continue;
             if (!d.retired.symbols.length && !d.retired.deps.length)
                 continue;
@@ -1283,8 +1301,8 @@ export class HunchStore {
         const out = [];
         const seen = new Set(); // dedup: one hit per decision+alternative
         for (const d of this.recs("decisions")) {
-            if (d.superseded_by || d.status === "superseded")
-                continue; // in-force only
+            if (!isInForce(d))
+                continue; // in-force only (excludes rejected + window-closed)
             const tripwires = d.rejected_tripwires ?? [];
             if (!tripwires.length)
                 continue;
@@ -1353,7 +1371,7 @@ export class HunchStore {
     retiredForFile(file) {
         const out = [];
         for (const d of this.recs("decisions")) {
-            if (d.superseded_by || d.status === "superseded")
+            if (!isInForce(d))
                 continue;
             if (!d.retired.symbols.length && !d.retired.deps.length)
                 continue;
@@ -1526,6 +1544,13 @@ const RRF_W_FTS = numEnv("HUNCH_RRF_W_FTS", 1);
 const RRF_W_SEM = numEnv("HUNCH_RRF_W_SEM", 0.7);
 const RRF_W_GRAPH = numEnv("HUNCH_RRF_W_GRAPH", 0.5);
 const GRAPH_GAMMA = numEnv("HUNCH_GRAPH_GAMMA", 0.25);
+/** Prior tuning: how far a trust weight may move a hit from its FUSED position.
+ *  SCALE maps the weight's realistic span onto positions (this repo's own decisions
+ *  span w 0.48…1.0, so ×12 reaches the clamp at the low end); MAX_PRIOR_SHIFT is the
+ *  hard bound that keeps the prior a dimmer rather than the primary sort key — see
+ *  rerankByPriors for the measurement that fixed it at 4. */
+const PRIOR_SHIFT_SCALE = numEnv("HUNCH_PRIOR_SHIFT_SCALE", 12);
+const MAX_PRIOR_SHIFT = numEnv("HUNCH_MAX_PRIOR_SHIFT", 4);
 function numEnv(name, dflt) {
     const v = Number(process.env[name]);
     // >= 0, not > 0: zero is the documented kill-switch (HUNCH_RRF_W_*=0 disables

package/dist/synthesis/synthesize.js

@@ -271,7 +271,7 @@ export async function recordFailure(store, root, failure, opts = {}) {
     // a regression Constraint to stop it coming back, and bumps fragility.
     let constraint;
     if (shouldPromoteConstraint(draft.severity, bug.root_cause, !!prior)) {
-        constraint = promoteConstraint(store, bug, home);
+        constraint = promoteConstraint(store, bug, home, !!prior);
         bug.lineage.spawned_constraint = constraint.id;
         putBugInHome(store, bug, home);
     }
@@ -330,16 +330,37 @@ export function shouldPromoteConstraint(severity, rootCause, isRecurrence) {
     const severe = severity === "high" || severity === "critical";
     return severe && rootCause.trim().length > 0;
 }
-/** Turn a bug into an advisory regression constraint scoped to its files. */
-function promoteConstraint(store, bug, home) {
+/** Turn a bug into a regression constraint scoped to its files.
+ *
+ *  Severity policy mirrors buildCorrectionConstraint's scope-footgun guard, for the
+ *  same reason: a BLOCKING constraint DENIES edits under strict firmness, and neither
+ *  input here is human-confirmed. `bug.severity` is whatever the synthesis provider's
+ *  enum emitted (provenance "derived", an LLM label no human saw), and `affected_files`
+ *  is EMPTY whenever suspect ranking resolves nothing — the common case for a failure
+ *  that names no known symbol. Left unguarded those compose into the worst outcome:
+ *  one model-labeled "critical" failure with no resolvable suspects mints
+ *  scope ["**"] + severity "blocking", a repo-wide deny on every subsequent edit.
+ *
+ *  So blocking requires BOTH a real file scope AND deterministic corroboration — a
+ *  recurrence, meaning the graph itself already saw and closed this symptom. Everything
+ *  else lands as a warning: still surfaced at edit time and in CI, and still promotable
+ *  by a human via `hunch record-constraint`, but never an automatic deny.
+ *
+ *  Exported for the same reason as shouldPromoteConstraint — it is policy, and policy
+ *  should be provable without spinning up a provider. */
+export function shouldBlockOnPromotion(severity, affectedFiles, isRecurrence) {
+    return severity === "critical" && affectedFiles.length > 0 && isRecurrence;
+}
+function promoteConstraint(store, bug, home, isRecurrence) {
     const scope = bug.affected_files.length ? bug.affected_files : ["**"];
+    const blocking = shouldBlockOnPromotion(bug.severity, bug.affected_files, isRecurrence);
     const statement = `Regression guard: "${bug.title}" must not recur.`;
     const con = {
         id: constraintId(statement),
         type: bug.severity === "critical" ? "security" : "correctness",
         statement,
         scope,
-        severity: bug.severity === "critical" ? "blocking" : "warning",
+        severity: blocking ? "blocking" : "warning",
         enforcement: "advisory_v1",
         match: null,
         forbids: null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.10.2",
+  "version": "1.10.4",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
   "description": "Engineering memory and a deterministic Change Gate for AI-assisted codebases: decisions, rejected approaches, constraints, and bug lineage become portable context and opt-in enforcement for every MCP assistant.",