@davesheffer/hunch 1.10.3 → 1.10.5

package/dist/core/correction.js

@@ -8,6 +8,7 @@
  *   - buildCorrectionConstraint(): mint the Constraint record (human-confirmed,
  *     scoped conservatively) that the pre-edit hook + CI guard then enforce.
  */
+import { isAbsolute, relative } from "node:path";
 import { constraintId } from "./ids.js";
 import { toPosixTarget } from "./paths.js";
 import { deriveForbids } from "./constraintmatch.js";
@@ -40,6 +41,32 @@ export const CORRECTION_NUDGE = "This looks like a correction. If it's a rule th
     "call hunch_record_correction({ rule, scope_hint_file, severity, applies_to_all }) so it " +
     "becomes an enforced, scoped constraint (held at edit-time and in CI) — not a one-off the next session forgets. " +
     "Use severity:\"blocking\" only when the human said never/must; set applies_to_all:true only if the rule is genuinely repo-wide.";
+/** Normalize a scope hint to a repo-relative POSIX path.
+ *
+ *  An ABSOLUTE hint is the shape an agent naturally sends, but `checkConstraints`
+ *  anchors its globs at `^` against repo-relative paths, so an absolute scope matches
+ *  NOTHING — while the constraint keeps `severity: "blocking"` and
+ *  `provenance: human_confirmed`, and the MCP tool affirmatively reports it as enforced
+ *  at edit time and in CI. It also leaks the developer's local filesystem path into the
+ *  committed graph and CLAUDE.md.
+ *
+ *  Returns "" when the hint cannot be made repo-relative (no root, or a path outside the
+ *  repo). The caller then falls back to "**", where the existing severity guard
+ *  down-ranks a non-explicit blocking rule to a warning — fail-safe and honest, rather
+ *  than a blocking rule enforced nowhere. */
+function repoRelativeHint(rawHint, root) {
+    if (!rawHint)
+        return "";
+    const looksAbsolute = isAbsolute(rawHint) || /^[a-zA-Z]:/.test(rawHint);
+    if (!looksAbsolute)
+        return rawHint;
+    if (!root)
+        return "";
+    const rel = toPosixTarget(relative(root, rawHint));
+    if (!rel || rel === ".." || rel.startsWith("../") || isAbsolute(rel) || /^[a-zA-Z]:/.test(rel))
+        return "";
+    return rel;
+}
 /**
  * Build the Constraint a correction mints. Pure (caller passes `now`), so the
  * scope/severity policy is testable in isolation. Key safety rule (research
@@ -55,7 +82,7 @@ export function buildCorrectionConstraint(input, now) {
     // A blank/"." scope hint would mint a meaningless or repo-wide constraint by
     // accident, so fall back to "**" (which the severity guard below then keeps
     // non-blocking unless applies_to_all was explicitly set).
-    const hinted = input.scope_hint_file ? toPosixTarget(input.scope_hint_file) : "";
+    const hinted = repoRelativeHint(input.scope_hint_file ? toPosixTarget(input.scope_hint_file) : "", input.root);
     const scope = input.applies_to_all || !hinted || hinted === "." ? ["**"] : [hinted];
     const repoWide = scope.length === 1 && scope[0] === "**";
     let severity = input.severity ?? "warning";

package/dist/extractors/git.js

@@ -590,8 +590,8 @@ export function commitAndPushHunch(hunchDir, message, opts) {
         // a clean overlay store — most dangerously, the overlay was never its own git repo so `git -C`
         // walked UP to the PROJECT repo. Committing/pushing there would overwrite/delete the user's
         // code (we shipped exactly this). Refuse hard: unstage and bail without committing or pushing.
-        const memoryPaths = stagedMemoryPaths(hunchDir, env);
-        if (memoryPaths === null) {
+        const staged = stagedMemoryPaths(hunchDir, env);
+        if (staged === null) {
             try {
                 execFileSync("git", ["-C", hunchDir, "reset", "-q", "--", "."], { stdio: "ignore", env });
             }
@@ -605,6 +605,16 @@ export function commitAndPushHunch(hunchDir, message, opts) {
             }
             return null;
         }
+        // Unstage every derived artifact the scan skipped (catch-log, SQLite index,
+        // atomic-write temps). A public store keeps ordinary ignore semantics, so one
+        // created before those ignore entries existed still stages them above — and the
+        // commit below is `--only` over the memory paths, which would leave them in the
+        // index forever. A permanently dirty index is what the release gate reads as an
+        // unstable tree, and it is exactly what `git reset -- .` used to clean up as a
+        // side effect of the abort path these artifacts no longer take.
+        if (staged.derived.length)
+            run(["reset", "-q", "--", ...staged.derived]);
+        const memoryPaths = staged.memory;
         if (memoryPaths.length === 0)
             return null;
         // Grounding docs refreshed by this capture ride the same memory commit, so committed record
@@ -727,11 +737,6 @@ export function headFileContent(root, rel) {
         return null;
     }
 }
-/** Is the staged set a clean, MEMORY-ONLY change — only JSON record adds/updates, nothing else?
- *  The overlay store is entirely JSON (decisions/, bugs/, …, manifest.json). A real memory sync
- *  is purely additive; a DELETION, rename, or any non-.json staged path means hunchDir is NOT a
- *  clean overlay repo (e.g. it resolved to the project repo), so committing there would clobber
- *  code. Empty stage ⇒ [] (nothing to commit); invalid stage ⇒ null. The transient mkdir lock is ignored. */
 function stagedMemoryPaths(hunchDir, env) {
     let out = "";
     let prefix = "";
@@ -751,8 +756,9 @@ function stagedMemoryPaths(hunchDir, env) {
     }
     const lines = out.split("\n").map((l) => l.trim()).filter(Boolean);
     if (!lines.length)
-        return [];
+        return { memory: [], derived: [] };
     const memoryPaths = [];
+    const derivedPaths = [];
     for (const line of lines) {
         const parts = line.split("\t");
         const status = (parts[0] ?? "").trim();
@@ -767,11 +773,32 @@ function stagedMemoryPaths(hunchDir, env) {
         const memoryRelativePath = normalizedPath.slice(prefix.length);
         if (!memoryRelativePath || memoryRelativePath === "local.json")
             return null; // machine-local overlay pointer; never publish it
+        // Known CLONE-LOCAL/DERIVED artifacts are skipped, never treated as a topology
+        // violation — mirroring committableOverlayJsonPaths below, which already carves
+        // out exactly these. Without this, the strict hook's own catch-log
+        // (.hunch/events.log, append-only with no rotation) made this function return
+        // null forever from its first line onward: the public flush then unstaged
+        // everything and aborted SILENTLY on every later capture, while the MCP tool
+        // still reported success and records piled up untracked.
+        if (isDerivedStoreArtifact(memoryRelativePath)) {
+            derivedPaths.push(memoryRelativePath);
+            continue;
+        }
         if (!normalizedPath.endsWith(".json"))
             return null; // the store is entirely JSON records
         memoryPaths.push(memoryRelativePath);
     }
-    return [...new Set(memoryPaths)];
+    return { memory: [...new Set(memoryPaths)], derived: [...new Set(derivedPaths)] };
+}
+/** Clone-local / DERIVED artifacts that legitimately sit inside a `.hunch` store but
+ *  are never memory records: the SQLite index, temp files, and the strict hook's
+ *  append-only catch-log. A store carrying one of these is a NORMAL store, not a
+ *  topology violation — so both enumerators skip them rather than refusing the whole
+ *  commit. Shared so the public and overlay paths can never disagree again. */
+function isDerivedStoreArtifact(relativeName) {
+    return /^[^/]+\.sqlite[^/]*$/i.test(relativeName)
+        || relativeName.split("/").some((segment) => segment.includes(".tmp"))
+        || relativeName === "events.log";
 }
 /** Enumerate ordinary JSON files already contained under an overlay. Push-capable
  * stores force-add this exact allowlist so remote .gitignore, info/exclude, or an
@@ -806,9 +833,7 @@ function committableOverlayJsonPaths(hunchDir) {
                 else if (relativeName === "local.json") {
                     return false;
                 }
-                else if (/^[^/]+\.sqlite[^/]*$/i.test(relativeName)
-                    || relativeName.split("/").some((segment) => segment.includes(".tmp"))
-                    || relativeName === "events.log") {
+                else if (isDerivedStoreArtifact(relativeName)) {
                     // Known clone-local/derived artifacts are never staged. Everything
                     // else is a topology violation: a shared graph repository cannot
                     // quietly carry arbitrary source alongside its JSON memory.

package/dist/integrations/gitignore.js

@@ -24,6 +24,8 @@ const ENTRIES = [
     // Per-machine private-overlay pointer written by `hunch private` (holds the local
     // path to the private store) — never committed.
     ".hunch/local.json",
+    // The strict hook's append-only catch-log: clone-local, never a memory record.
+    ".hunch/events.log",
     // A local PRIVATE overlay store (HUNCH_PRIVATE_DIR) for sensitive memory — never
     // committed. This is the conventional in-repo path; point the env elsewhere for a
     // fully separate private repo.

package/dist/mcp/server.js

@@ -873,7 +873,7 @@ export function buildServerWithRootControl(initialRoot) {
         description: "When a human corrects the agent ('no, do it this way' / 'never call X here'), persist that correction as a first-class, SCOPED Constraint with provenance — so the pre-edit hook and the CI Constraint Guard hold EVERY assistant to it from now on, instead of it being forgotten next session. Writes to the shared .hunch/ graph (client-agnostic). Set severity:'blocking' only when the human said never/must; set applies_to_all:true only when the rule is genuinely repo-wide (otherwise it is scoped to scope_hint_file).",
         inputSchema: {
             rule: z.string().describe("The invariant in the human's words, e.g. \"never call the pay-per-token API here\"."),
-            scope_hint_file: z.string().optional().describe("A file the correction was about; scopes the constraint to it (the conservative default)."),
+            scope_hint_file: z.string().optional().describe("A file the correction was about; scopes the constraint to it (the conservative default). Prefer a REPO-RELATIVE path (src/foo.ts); an absolute path is relativized against the repo root, and one outside the repo is discarded rather than scoped to a path that could never match."),
             severity: z.enum(["advisory", "warning", "blocking"]).optional().describe("Default 'warning'. Use 'blocking' only for a hard never/must rule."),
             applies_to_all: z.boolean().optional().describe("True ONLY if the rule is genuinely repo-wide (scopes to **); required to make a repo-wide rule blocking."),
             type: z.enum(["security", "performance", "correctness", "architecture", "compliance"]).optional(),
@@ -885,7 +885,11 @@ export function buildServerWithRootControl(initialRoot) {
         try {
             if (!input.rule || !input.rule.trim())
                 return err("rule is required — state the invariant in plain words.");
-            const rec = buildCorrectionConstraint({ ...input, knownDeps: knownRepoDeps(root) }, new Date().toISOString());
+            // root: relativizes an ABSOLUTE scope_hint_file. Agents naturally send absolute
+            // paths (edit-tool payloads and MCP roots are absolute) and every consumer matches
+            // repo-relative — without this the rule would be blocking-but-inert and would leak
+            // the local filesystem path into the committed graph.
+            const rec = buildCorrectionConstraint({ ...input, knownDeps: knownRepoDeps(root), root }, new Date().toISOString());
             // Private corrections go to the overlay (enforced locally via the merged read,
             // never rendered into the public CI comment, which is public-only by construction).
             const home = store.captureHome(!!input.private);

package/dist/store/db.js

@@ -59,22 +59,60 @@ function createDb(sqlitePath) {
     db.exec("PRAGMA busy_timeout = 5000");
     return db;
 }
+/** Does this error mean the derived index FILE itself is unusable?
+ *
+ *  Matched narrowly, on SQLite's own corruption signatures only. An environment failure —
+ *  a permission denial, a full disk, a locked file — must still propagate: deleting the
+ *  file would not fix it and would destroy a cache the user may still be able to keep.
+ *  `SQLITE_CANTOPEN` ("unable to open database file") is deliberately NOT here for that
+ *  reason: it usually means a permissions or path problem, not corruption. */
+function isCorruptIndexFile(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return /database disk image is malformed|file is not a database|file is encrypted or is not a database|malformed database schema|database corruption/i.test(message);
+}
+function discardDerivedIndex(sqlitePath) {
+    for (const path of [sqlitePath, `${sqlitePath}-wal`, `${sqlitePath}-shm`])
+        rmSync(path, { force: true });
+}
 export function openDb(sqlitePath) {
     mkdirSync(dirname(sqlitePath), { recursive: true });
-    let db = createDb(sqlitePath);
+    // A corrupt file can fail at OPEN as well as at schema init (node:sqlite opens lazily,
+    // so "file is not a database" typically surfaces on the first statement — but not always).
+    let db;
+    try {
+        db = createDb(sqlitePath);
+    }
+    catch (error) {
+        if (!isCorruptIndexFile(error))
+            throw error;
+        discardDerivedIndex(sqlitePath);
+        db = createDb(sqlitePath);
+    }
     try {
         initializeSchema(db);
         return db;
     }
     catch (error) {
-        if (!(error instanceof RebuildDerivedIndex)) {
+        // The ENTIRE database is derived from the Git-native JSON in .hunch/ — it is a cache,
+        // and a cache that cannot be read should be rebuilt, not fatal. That reasoning was
+        // already written here, but it was wired to exactly ONE trigger: RebuildDerivedIndex,
+        // thrown only when an fts5 index meets a runtime without the FTS5 module. Every other
+        // error propagated as a raw SQLite string, so a corrupt file took out `hunch index`,
+        // `query`, `check` and `doctor` at once — and, because the pre-edit hook must emit
+        // nothing and exit 0 on any failure (con_03a0b94b2e), it also went SILENTLY blind,
+        // permanently, with no command left that could repair it.
+        if (!(error instanceof RebuildDerivedIndex) && !isCorruptIndexFile(error)) {
             db.close();
             throw error;
         }
-        db.close();
-        for (const path of [sqlitePath, `${sqlitePath}-wal`, `${sqlitePath}-shm`])
-            rmSync(path, { force: true });
+        try {
+            db.close();
+        }
+        catch { /* a corrupt handle may refuse to close; the file goes anyway */ }
+        discardDerivedIndex(sqlitePath);
         db = createDb(sqlitePath);
+        // Deliberately NOT wrapped in another rebuild attempt: if a freshly created file also
+        // fails, the problem is the environment, not the cache, and it must surface.
         initializeSchema(db);
         return db;
     }

package/dist/store/hunchStore.js

@@ -481,14 +481,30 @@ export class HunchStore {
         return { embedded, skipped: docs.length - todo.length, total: docs.length };
     }
     /** Post-fusion rerank by graph PRIORS (dec_25e277f479): relevance ordering, not
-     *  just reachability. Rank-based blend — blended(i) = 1/(60+i) × liveness ×
-     *  provenance × recency — so bm25's negative scale never leaks in. Priors are
-     *  BOUNDED (a superseded or ancient record dims, never disappears): liveness 0.6
+     *  just reachability. Trust weight w = liveness × provenance × recency: liveness 0.6
      *  for superseded/retired/rejected, provenance 1.0 / 0.85 / 0.75 for
      *  human_confirmed / llm_draft / extracted-inferred, recency 0.7 + 0.3·½^(age/90d).
      *  Runbook trigger phrases matching the query boost ×1.5 (exact intent beats
      *  keyword luck). Structural refs (symbols/components/edges) stay neutral.
-     *  Deterministic; ties keep fused order (stable sort). */
+     *
+     *  The prior is applied as a BOUNDED POSITIONAL SHIFT, not as a multiplier on a
+     *  rank-derived score. That is deliberate and load-bearing. The old form —
+     *  `1/(60+i) × w`, sorted descending, sliced to `limit` — could not keep the
+     *  "dims, never disappears" promise it made: across a fused pool of 24 the
+     *  positional term spans only 1/60…1/83 (a 0.72 ratio) while w spans 0.48…1.0 on
+     *  this repo's own records, so the prior was WIDER than the entire pool's
+     *  positional spread and simply overrode fusion. Worse, `priorMeta` returns null
+     *  for structural refs, which left them at w = 1 — a ceiling above what any record
+     *  that is not both human_confirmed and brand-new can reach. Measured over this
+     *  repo's 152 committed decisions with the rest of the pool structural (symbols are
+     *  ~91% of the corpus): 38% of decisions were dropped from the top-12 even when
+     *  they were the #1 fused hit, and 88% from fused rank 8. Both retrieval layers
+     *  ranked the record first and the rerank alone threw it away.
+     *
+     *  A shift of at most ±MAX_PRIOR_SHIFT positions restores the intended semantics:
+     *  a stale or low-provenance record visibly dims, an exact runbook-trigger match
+     *  visibly promotes, and neither can leapfrog the whole pool. Same measurement
+     *  after: 0% evicted from fused ranks 0–8. Deterministic; ties keep fused order. */
     rerankByPriors(hits, limit, query) {
         if (!hits.length)
             return hits; // a SINGLE hit still runs — topic-chain promotion must fire for the lone stale match
@@ -499,10 +515,10 @@ export class HunchStore {
         // predecessor's rank — the reader asked about the topic, and the graph's one
         // live answer must be reachable even when only history matches lexically.
         const present = new Set(hits.map((h) => h.ref));
-        // Each candidate carries its BASE rank position; an injected successor
-        // inherits its predecessor's position (× a hair under, so an exact-match
-        // live record already in the pool is never displaced by an injection).
-        const pool = hits.map((h, i) => ({ h, base: 1 / (60 + i) }));
+        // Each candidate carries its fused POSITION; an injected successor inherits its
+        // predecessor's position + a half step, so it lands immediately after it and an
+        // exact-match live record already in the pool is never displaced by an injection.
+        const pool = hits.map((h, i) => ({ h, pos: i }));
         for (const [i, h] of hits.entries()) {
             if (h.kind !== "decisions")
                 continue;
@@ -515,10 +531,10 @@ export class HunchStore {
             present.add(cur.id);
             pool.push({
                 h: { ref: cur.id, kind: "decisions", title: cur.title, snippet: `current for topic "${d.topic}" (supersedes ${h.ref})`, score: h.score },
-                base: (1 / (60 + i)) * 0.98,
+                pos: i + 0.5,
             });
         }
-        const scored = pool.map(({ h, base }) => {
+        const scored = pool.map(({ h, pos }) => {
             const m = this.priorMeta(h.ref, h.kind);
             let w = 1;
             if (m) {
@@ -533,9 +549,11 @@ export class HunchStore {
                 if (q && m.triggers?.some((tr) => q.includes(tr) || tr.includes(q)))
                     w *= 1.5;
             }
-            return { h, s: base * w };
+            // w > 1 (a trigger match) shifts UP, w < 1 shifts DOWN, both clamped.
+            const shift = Math.max(-MAX_PRIOR_SHIFT, Math.min(MAX_PRIOR_SHIFT, (1 - w) * PRIOR_SHIFT_SCALE));
+            return { h, pos: pos + shift };
         });
-        scored.sort((a, b) => b.s - a.s);
+        scored.sort((a, b) => a.pos - b.pos);
         return scored.slice(0, limit).map((x) => x.h);
     }
     /** The prior-bearing metadata for a hit: liveness, provenance, effective date,
@@ -1526,6 +1544,13 @@ const RRF_W_FTS = numEnv("HUNCH_RRF_W_FTS", 1);
 const RRF_W_SEM = numEnv("HUNCH_RRF_W_SEM", 0.7);
 const RRF_W_GRAPH = numEnv("HUNCH_RRF_W_GRAPH", 0.5);
 const GRAPH_GAMMA = numEnv("HUNCH_GRAPH_GAMMA", 0.25);
+/** Prior tuning: how far a trust weight may move a hit from its FUSED position.
+ *  SCALE maps the weight's realistic span onto positions (this repo's own decisions
+ *  span w 0.48…1.0, so ×12 reaches the clamp at the low end); MAX_PRIOR_SHIFT is the
+ *  hard bound that keeps the prior a dimmer rather than the primary sort key — see
+ *  rerankByPriors for the measurement that fixed it at 4. */
+const PRIOR_SHIFT_SCALE = numEnv("HUNCH_PRIOR_SHIFT_SCALE", 12);
+const MAX_PRIOR_SHIFT = numEnv("HUNCH_MAX_PRIOR_SHIFT", 4);
 function numEnv(name, dflt) {
     const v = Number(process.env[name]);
     // >= 0, not > 0: zero is the documented kill-switch (HUNCH_RRF_W_*=0 disables

package/dist/store/merge.js

@@ -95,9 +95,49 @@ export function pickWinner(ours, theirs) {
     const tr = recency(theirs);
     if (orr !== tr)
         return orr > tr ? ours : theirs;
+    // A merge must never silently UNDO recorded progress. Closing a bug does not touch
+    // `provenance` or `date` — captureTestRun writes
+    // `{ ...bug, status: "fixed", lineage: { ...lineage, fixed_commit: sha } }` — so
+    // recency() TIES against the still-open side and control always reached the
+    // lexicographic tiebreak below. That tiebreak then picked the LESS-resolved record,
+    // twice over: `"fixed_commit":null` sorts above `"fixed_commit":"<sha>"` (n > "), and
+    // `"status":"open"` sorts above `"status":"fixed"` (o > f). So a clean merge reverted
+    // the closure every time, in the subsystem whose entire job is not losing state.
+    //
+    // Prefer the side carrying more one-way lifecycle evidence. Deterministic and
+    // side-independent (a pure function of each record), so A-merges-B and B-merges-A
+    // still agree.
+    const oe = closureEvidence(ours);
+    const te = closureEvidence(theirs);
+    if (oe !== te)
+        return oe > te ? ours : theirs;
     // Deterministic, side-independent tiebreak so A-merges-B and B-merges-A agree.
     return canon(ours) >= canon(theirs) ? ours : theirs;
 }
+/** Count the one-way lifecycle facts a record carries: a fix commit, a spawned
+ *  decision/constraint, a supersession, an end of validity. Each is something that
+ *  HAPPENED and was recorded — never something a merge should quietly discard.
+ *
+ *  Deliberately counts EVIDENCE fields rather than reading `status`: a status string can
+ *  be moved in either direction (a reopened bug goes fixed -> open), but a recorded
+ *  `fixed_commit` is a fact about history. Ranking on evidence means a genuine reopen —
+ *  which clears the commit — is still allowed to win, while a merge can no longer drop a
+ *  closure that nobody reopened. */
+function closureEvidence(r) {
+    let n = 0;
+    const lineage = r.lineage;
+    if (isRec(lineage)) {
+        for (const key of ["fixed_commit", "spawned_decision", "spawned_constraint"]) {
+            if (typeof lineage[key] === "string" && lineage[key].length > 0)
+                n += 1;
+        }
+    }
+    for (const key of ["superseded_by", "valid_to"]) {
+        if (typeof r[key] === "string" && r[key].length > 0)
+            n += 1;
+    }
+    return n;
+}
 function parseSide(text) {
     const trimmed = (text ?? "").trim();
     if (!trimmed)

package/dist/synthesis/synthesize.js

@@ -271,7 +271,7 @@ export async function recordFailure(store, root, failure, opts = {}) {
     // a regression Constraint to stop it coming back, and bumps fragility.
     let constraint;
     if (shouldPromoteConstraint(draft.severity, bug.root_cause, !!prior)) {
-        constraint = promoteConstraint(store, bug, home);
+        constraint = promoteConstraint(store, bug, home, !!prior);
         bug.lineage.spawned_constraint = constraint.id;
         putBugInHome(store, bug, home);
     }
@@ -330,16 +330,37 @@ export function shouldPromoteConstraint(severity, rootCause, isRecurrence) {
     const severe = severity === "high" || severity === "critical";
     return severe && rootCause.trim().length > 0;
 }
-/** Turn a bug into an advisory regression constraint scoped to its files. */
-function promoteConstraint(store, bug, home) {
+/** Turn a bug into a regression constraint scoped to its files.
+ *
+ *  Severity policy mirrors buildCorrectionConstraint's scope-footgun guard, for the
+ *  same reason: a BLOCKING constraint DENIES edits under strict firmness, and neither
+ *  input here is human-confirmed. `bug.severity` is whatever the synthesis provider's
+ *  enum emitted (provenance "derived", an LLM label no human saw), and `affected_files`
+ *  is EMPTY whenever suspect ranking resolves nothing — the common case for a failure
+ *  that names no known symbol. Left unguarded those compose into the worst outcome:
+ *  one model-labeled "critical" failure with no resolvable suspects mints
+ *  scope ["**"] + severity "blocking", a repo-wide deny on every subsequent edit.
+ *
+ *  So blocking requires BOTH a real file scope AND deterministic corroboration — a
+ *  recurrence, meaning the graph itself already saw and closed this symptom. Everything
+ *  else lands as a warning: still surfaced at edit time and in CI, and still promotable
+ *  by a human via `hunch record-constraint`, but never an automatic deny.
+ *
+ *  Exported for the same reason as shouldPromoteConstraint — it is policy, and policy
+ *  should be provable without spinning up a provider. */
+export function shouldBlockOnPromotion(severity, affectedFiles, isRecurrence) {
+    return severity === "critical" && affectedFiles.length > 0 && isRecurrence;
+}
+function promoteConstraint(store, bug, home, isRecurrence) {
     const scope = bug.affected_files.length ? bug.affected_files : ["**"];
+    const blocking = shouldBlockOnPromotion(bug.severity, bug.affected_files, isRecurrence);
     const statement = `Regression guard: "${bug.title}" must not recur.`;
     const con = {
         id: constraintId(statement),
         type: bug.severity === "critical" ? "security" : "correctness",
         statement,
         scope,
-        severity: bug.severity === "critical" ? "blocking" : "warning",
+        severity: blocking ? "blocking" : "warning",
         enforcement: "advisory_v1",
         match: null,
         forbids: null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.10.3",
+  "version": "1.10.5",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
   "description": "Engineering memory and a deterministic Change Gate for AI-assisted codebases: decisions, rejected approaches, constraints, and bug lineage become portable context and opt-in enforcement for every MCP assistant.",