@davesheffer/hunch 1.31.0 → 1.32.0

package/dist/cli/index.js

@@ -25,6 +25,7 @@ import { writeFileAtomic } from "../core/io.js";
 import { looksLikeCorrection, CORRECTION_NUDGE } from "../core/correction.js";
 import { HUNCH_VERSION } from "../core/version.js";
 import { registerIntegrationCommands } from "./integrations.js";
+import { registerTaskReportCommands } from "./taskReport.js";
 import { registerServeCommands } from "./serve.js";
 import { registerUpdateCommand } from "./update.js";
 import { registerReviewMemoryCommands } from "./reviewMemory.js";
@@ -37,9 +38,11 @@ import { assertCompleteRepoScan, indexRepo, scanRepo } from "../extractors/index
 import { syncCommit, recordFailure, captureTestRun } from "../synthesis/synthesize.js";
 import { parseTestReport } from "../extractors/testreport.js";
 import { readSynthesisPreference, resolveSynthesisProvider, selectProvider, SYNTH_PREFERENCES, writeSynthesisPreference, normalizeProviderName, } from "../synthesis/provider.js";
-import { isGitRepo, isGitRepoRoot, sameGitPublication, sameRemoteUrl, canonicalRemoteUrl, repositoryUsesRemote, headSha, isolatedHeadSha, logSince, lastChangeDate, firstCommitForFile, stagedFiles, workingFiles, commitFiles, asOfDate, stagedDiff, workingDiff, commitDiff, rangeFiles, rangeDiff, rangeSubjects, revExists, revParse, commitAndPushHunch, pullHunchStatus, syncExistingHunch, gitUntrackCached, gitCommonDir, hooksDir, isLinkedWorktree, mainWorktreeRoot, gitMemoryLog, memoryMoveDiff, revertMemoryMove, pushCurrentBranch, commitChanges } from "../extractors/git.js";
+import { isGitRepo, isGitRepoRoot, sameGitPublication, sameRemoteUrl, canonicalRemoteUrl, repositoryUsesRemote, headSha, isolatedHeadSha, logSince, lastChangeDate, firstCommitForFile, stagedFiles, workingFiles, commitFiles, asOfDate, stagedDiff, workingDiff, commitDiff, rangeFiles, rangeDiff, rangeSubjects, revExists, revParse, commitAndPushHunch, pullHunchStatus, syncExistingHunch, gitUntrackCached, gitCommonDir, hooksDir, isLinkedWorktree, mainWorktreeRoot, gitMemoryLog, memoryMoveDiff, revertMemoryMove, pushCurrentBranch, commitChanges, commitRepairStatus, mergeRangeChanges, commitsExist } from "../extractors/git.js";
 import { parseMemoryLog } from "../core/memorylog.js";
 import { renamesOf, planRepair, repairDecision, repairConstraint } from "../core/repair.js";
+import { orphanedCommitDecisions, planCommitRepair, repairDecisionCommit, pickRewrite, commitRepairReviewHash, mergeRewrites, firstFor, deadRewrites, resolvedRewriteIds, withoutDropped, addDropped, withheldForUnresolvableTo } from "../core/commitrepair.js";
+import { readPendingRepairs, writePendingRepairs, readDroppedRepairs, writeDroppedRepairs, readActivePendingRepairs, withheldRewrites } from "../core/repairqueue.js";
 import { planPolicyRepair, repairPolicySpec } from "../constitution/repairPolicies.js";
 import { writeTeamConfig, ensureTeamOverlay, readTeamConfig, safeGitUrl, safeTeamRef, overlayMatchesTeamRemote, advertisedTeamRemoteContract, boundedTeamGitEnv, cloneValidatedTeamOverlay, explicitTeamRemoteContract, teamRemoteContract } from "../integrations/team.js";
 import { runbookId, decisionId } from "../core/ids.js";
@@ -47,7 +50,7 @@ import { deriveForbids, effectiveForbids } from "../core/constraintmatch.js";
 import { extractInlineIntent } from "../extractors/comments.js";
 import { renderText, renderMarkdown, renderSarif, renderImpact, reportFailsStrict } from "../core/checkreport.js";
 import { partitionReview, isReviewDraft, READY_MIN_GROUNDED } from "../core/reviewqueue.js";
-import { installPostCommitHook, installPreCommitHook, installPostMergeHook } from "../integrations/hooks.js";
+import { installPostCommitHook, installPreCommitHook, installPostMergeHook, hookStatus } from "../integrations/hooks.js";
 import { ensureSharedOverlayPointer } from "../integrations/worktree.js";
 import { flushCapture, flushMemoryHome, flushMemoryHomes, pinSharedRemote, sharedRemoteFor } from "../integrations/sync.js";
 import { installMergeDriver } from "../integrations/mergeDriver.js";
@@ -55,10 +58,11 @@ import { ensureGitignore, ignoreHunchMemory, HUNCH_MEMORY_DIRS } from "../integr
 import { writeCiWorkflow } from "../integrations/ciAction.js";
 import { updateClaudeMd, renderHunchSection } from "../integrations/claudemd.js";
 import { classifyGroundingBlock, describeGroundingFreshness } from "../core/groundingLag.js";
+import { mergeGroundingFile } from "../core/groundingMerge.js";
 import { writeMcpJson, writeSlashCommands, installClaudeHooks } from "../integrations/scaffold.js";
 import { scaffoldProviders, regenerateGrounding, refreshExistingGrounding, refreshCommittableGrounding, GROUNDING_DOC_PATHS } from "../integrations/providers.js";
 import { healClaudeConfigCaseSplit } from "../integrations/claudeConfig.js";
-import { formatContext, formatSearchHit, formatStructure } from "../core/format.js";
+import { formatSearchHit, formatStructure } from "../core/format.js";
 import { isStateKind, renderStateLine, stateSupplements } from "../core/stateDelivery.js";
 import { diagnoseIssueCorrectionStage, formatCorrectionStageDiagnostic } from "../core/correctionStage.js";
 import { compileVerifiedEvidenceMap, formatVerifiedEvidenceMap } from "../core/evidenceMap.js";
@@ -76,6 +80,9 @@ import { appendEvent, readEvents } from "../core/events.js";
 import { computeStats, formatStats } from "../core/stats.js";
 import { injectionMode, resetSessionInjections } from "../core/hookcache.js";
 import { recordServed, servedSummary } from "../core/served.js";
+import { recordTaskDelivery, reportActivity } from "../core/taskReport.js";
+import { snapshotDeliveredRecords } from "../core/taskReportEvidence.js";
+import { hookReportTaskId, startHookReport, stopHookReport, observeHookDenial } from "../core/taskReportHook.js";
 import { contextHookOutput, denyHookOutput, hookProvider, normalizeHookEvent, stopHookOutput } from "../core/agenthook.js";
 import { PIPELINE_LOOP, armExecutionObligations, beforeEditProbeVerdict, compileExecutableProbes, environmentExecutableProbes, environmentExecutionObligations, executionObligationBrief, isProductPath, loadPipelineState, onCommand, onEdit, onPrompt, onSkill, pipelineEnabled, proofCheckpoint, savePipelineState, stopVerdict, unverifiedNag, } from "../core/pipeline.js";
 import { draftDuplicateOf, isAcceptedDuplicateAnchor } from "../core/dupdetect.js";
@@ -91,7 +98,7 @@ import { ADR_DIR_CANDIDATES, ADR_FILE_RE, mapAdrCorpus } from "../extractors/adr
 import { applyImportedAdrReview, carryImportedAdrReview, importedAdrReviewHash, importedAdrSourceHash, isImportedAdrDecision, pendingImportedAdrReviews } from "../core/importReview.js";
 import { exportMadrCorpus, isRegenerableMadr } from "../integrations/madrExport.js";
 import { buildMadrManifest, writeMadrManifest, refreshMadrCorpus } from "../integrations/madrManifest.js";
-import { pendingEscalations, policyEscalations } from "../core/escalations.js";
+import { pendingEscalations, policyEscalations, commitRepairEscalations, actionableEscalations, escalationHeadline } from "../core/escalations.js";
 import { premiseEscalations } from "../core/premises.js";
 import { parseDocAnchors, renderDocGrounding } from "../core/docanchors.js";
 import { compareCandidates } from "../core/compare.js";
@@ -142,7 +149,16 @@ program.option("--initiator <name>", "bind agent launches to the originating CLI
     if (options.cliConfig)
         process.env.HUNCH_CLI_CONFIG = options.cliConfig;
 });
-registerIntegrationCommands(program);
+registerIntegrationCommands(program, () => {
+    const { store, root } = storeFor();
+    try {
+        return refreshExistingGrounding(root, store);
+    }
+    finally {
+        store.close();
+    }
+});
+registerTaskReportCommands(program, () => { const { store, root } = storeFor(); return { store, root }; });
 registerServeCommands(program);
 registerUpdateCommand(program);
 registerReviewMemoryCommands(program, (records, repository, privateOnly) => {
@@ -341,10 +357,10 @@ program
         const syncToOverlay = !!(opts.privateSync || opts.sharedSync);
         const h = installPostCommitHook(root, inv.shell, { private: syncToOverlay, commit: opts.autoCommit, localOnly: syncToOverlay });
         console.log(`  ✓ post-commit hook ${h.action} (learning loop)${syncToOverlay ? " — syncs to the shared overlay" : ""}${opts.autoCommit ? " — auto-commit on" : ""}`);
+        const pm = installPostMergeHook(root, inv.shell);
+        console.log(`  ✓ post-merge hook ${pm.action} (squash-merge provenance repair + re-syncs grounding docs after a merge that brought memory in)`);
         const m = installMergeDriver(root, inv.shell);
         console.log(`  ✓ team merge driver ${m.action}`);
-        const pm = installPostMergeHook(root, inv.shell);
-        console.log(`  ✓ post-merge hook ${pm.action} (re-syncs grounding docs after a merge that brought memory in)`);
         // Auto-install the pre-commit guard by default (advisory: flags invariants
         // touched directly OR via blast radius, never blocks). Opt out with
         // --no-enforce; --enforce-strict makes blocking near/direct hits fail the commit.
@@ -410,7 +426,8 @@ program
     }
     store.close();
     console.log("\n" + formatIntegrationHealth(inspectIntegrations(root)));
-    console.log("\nNext: make a commit (the hook captures a decision), then ask your coding assistant \"why is X built this way?\"");
+    console.log("\nTask reporting is configured through Hunch's agent instructions; actual agent activity has not been verified by setup. Reconnect the agent, then work normally. Completed task reports are available with `hunch report`.");
+    console.log(reportActivity(root));
     console.log("Cold start? Seed from history:  hunch backfill --since 90d");
     console.log("\n⭐ If Hunch earns its keep, a star helps others find it → https://github.com/davesheffer/hunch");
 });
@@ -423,6 +440,15 @@ program
     const { store, root } = storeFor();
     store.json.ensureDirs();
     ensureGitignore(root); // keep the derived SQLite index out of git (idempotent)
+    // The post-merge hook only ever got installed by `hunch init`/`hunch
+    // private`/`hunch shared` — a repo that already ran init before this hook
+    // existed never receives it. `hunch index` already self-heals gitignore
+    // the same way; do the same for the hook so an upgrade doesn't require
+    // re-running init by hand. Gated on already having post-commit: `index`
+    // is not a setup command (it runs in CI, on any git repo), so it must
+    // never be what FIRST hooks a repo that never ran init at all.
+    if (isGitRepo(root) && hookStatus(root).postCommit)
+        installPostMergeHook(root, resolveInvocation().shell);
     const res = indexRepo(store, root, { requireClean: true });
     const { counts } = store.reindex();
     const correctionSweep = new ConstitutionService(store, root).upgradeCorrections();
@@ -916,8 +942,11 @@ function beginFreshOverlaySetup(root, dest, existingLocal, includeHook) {
     const sharedPointer = commonDir ? join(commonDir, "hunch", "local.json") : "";
     const configuredHooks = includeHook ? hooksDir(root) : "";
     const hookDir = configuredHooks ? (isAbsolute(configuredHooks) ? configuredHooks : join(root, configuredHooks)) : "";
-    const hookFile = hookDir ? join(hookDir, "post-commit") : "";
-    const paths = [localFile, codeGitignore, teamFile, ...(sharedPointer ? [sharedPointer] : []), ...(hookFile ? [hookFile] : [])];
+    // Setup installs post-commit AND post-merge together, so both must be in the
+    // ledger — restoring one while leaving the other pointing at a just-deleted
+    // overlay is not a rollback.
+    const hookFiles = hookDir ? [join(hookDir, "post-commit"), join(hookDir, "post-merge")] : [];
+    const paths = [localFile, codeGitignore, teamFile, ...(sharedPointer ? [sharedPointer] : []), ...hookFiles];
     const snapshots = new Map(paths.map((path) => [path, setupPathSnapshot(path)]));
     const parentExisted = new Map([
         [dirname(localFile), existsSync(dirname(localFile))],
@@ -937,7 +966,7 @@ function beginFreshOverlaySetup(root, dest, existingLocal, includeHook) {
         markGitignoreWrite: () => mark(codeGitignore),
         markTeamWrite: () => mark(teamFile),
         markSharedPointerWrite: () => mark(sharedPointer),
-        markHookWrite: () => mark(hookFile),
+        markHookWrite: () => hookFiles.forEach(mark),
         // Migration is a one-way ownership handoff. Once public records have been
         // durably copied into this clone, a later setup failure may restore routing
         // files but must not delete the clone that now holds their surviving copy.
@@ -1180,6 +1209,8 @@ function configureOverlay(dir, opts, mode) {
             freshSetup?.markHookWrite();
             const h = installPostCommitHook(root, inv.shell, { private: true, commit: opts.autoCommit, localOnly: mode === "private" });
             hookNote = `  ✓ post-commit hook ${h.action} — captured decisions route here${opts.autoCommit ? " (auto-commit+push on)" : ""}\n`;
+            const pm = installPostMergeHook(root, inv.shell);
+            hookNote += `  ✓ post-merge hook ${pm.action} (squash-merge provenance repair + re-syncs grounding docs after a merge that brought memory in)\n`;
         }
         // 5) one-time migration: MOVE existing public memory INTO the overlay, then make
         //    THIS repo code-only. Records are absorbed (union by id) BEFORE the public
@@ -4102,6 +4133,7 @@ program
     .option("--budget <n>", "rough token budget", "1500")
     .option("--profile <profile>", "delivery role: builder, reviewer, or architect", "builder")
     .option("--as-of <ref>", "time-travel: assemble the slice as it stood at a commit/tag/branch")
+    .option("--task <id>", "retain the exact context delivery for this task's contribution report")
     .action(async (target, opts) => {
     if (!DELIVERY_PROFILES.includes(opts.profile)) {
         return fail(`--profile must be one of: ${DELIVERY_PROFILES.join(", ")}`);
@@ -4111,7 +4143,7 @@ program
     if (opts.asOf && !asOf)
         return fail(`could not resolve --as-of "${opts.asOf}" to a commit`);
     store.reindex(); // reflect any out-of-band JSON edits before assembling
-    const ctx = store.assembleContext(target, Number(opts.budget), { asOf });
+    let ctx = store.assembleContext(target, Number(opts.budget), { asOf });
     // A task PHRASE ("improve retrieval ranking") resolves no file/symbol target and
     // used to come back empty while the graph held the answer one FTS query away —
     // the task-shaped entry point must not whiff on task-shaped input. Fall back to
@@ -4127,7 +4159,16 @@ program
     // receipts matching the target — the same slice and render as hunch_context.
     const slice = asOf ? null : store.stateSlice(target);
     const stateGrounding = slice ? stateSupplements(slice, target) : [];
-    if (empty && !asOf) {
+    if (empty && !asOf && opts.task) {
+        const resolved = store.rankedSearch(target, 8).map(hit => ({ hit, record: store.resolve(hit.ref)?.record }));
+        ctx = { ...ctx,
+            constraints: resolved.filter(x => x.hit.kind === "constraints" && x.record).map(x => x.record),
+            decisions: resolved.filter(x => x.hit.kind === "decisions" && x.record).map(x => x.record),
+            bugs: resolved.filter(x => x.hit.kind === "bugs" && x.record).map(x => x.record),
+            findings: resolved.filter(x => x.hit.kind === "findings" && x.record).map(x => x.record),
+        };
+    }
+    if (empty && !asOf && !opts.task) {
         const hits = store.rankedSearch(target, 8).filter((h) => !isStateKind(h.kind));
         if (hits.length || stateGrounding.length) {
             console.log(`No file/symbol resolves for "${target}" — closest graph matches instead:\n`);
@@ -4146,7 +4187,7 @@ program
             return;
         }
     }
-    process.stdout.write(formatContext(ctx, {
+    const envelope = buildDeliveryEnvelope(ctx, {
         root,
         symbols: store.recs("symbols"),
         components: store.recs("components"),
@@ -4154,7 +4195,18 @@ program
         historical: !!asOf,
         profile: opts.profile,
         supplements: stateGrounding,
-    }));
+    });
+    process.stdout.write(envelope.text);
+    if (opts.task) {
+        try {
+            const records = asOf ? [] : snapshotDeliveredRecords(store, envelope);
+            const occurrence = recordTaskDelivery(root, opts.task, envelope, records);
+            console.log(`\nTask evidence: ${opts.task} · occurrence ${occurrence}`);
+        }
+        catch {
+            console.error(`Task evidence could not be recorded for ${opts.task}; context remains available but report attribution is unverified.`);
+        }
+    }
     store.close();
 });
 // ---- timeline -------------------------------------------------------------
@@ -4289,6 +4341,7 @@ program
         strict: "edit-time DENY + CI guard — the teeth are on",
     };
     console.log(`\nHunch — enforcement status (${basename(root)})\n`);
+    console.log(`  ${reportActivity(root)}\n`);
     console.log(`  firmness: ${firmness}   ← ${fnote[firmness] ?? ""}\n`);
     console.log(`  ✓ ARMED        ${blocking.length} confirmed blocking invariant(s) — held against every assistant`);
     if (blocking.length) {
@@ -4456,13 +4509,19 @@ program
             savePipelineState(evt.session_id, st);
             return;
         }
-        if (evt.hook_event_name === "Stop" && evt.session_id && pipelineEnabled()) {
-            const st = loadPipelineState(evt.session_id);
-            const verdict = stopVerdict(st, firmness);
-            if (verdict.block) {
-                savePipelineState(evt.session_id, verdict.state);
-                emitStop(provider, verdict.reason);
+        if (evt.hook_event_name === "Stop") {
+            if (evt.session_id && pipelineEnabled()) {
+                const st = loadPipelineState(evt.session_id);
+                const verdict = stopVerdict(st, firmness);
+                if (verdict.block) {
+                    savePipelineState(evt.session_id, verdict.state);
+                    emitStop(provider, verdict.reason);
+                    return;
+                }
             }
+            const report = stopHookReport(root, provider, evt);
+            if (report)
+                console.log(JSON.stringify(report));
             return;
         }
         if (evt.hook_event_name === "UserPromptSubmit") {
@@ -4478,6 +4537,15 @@ program
             // nag, which is documented as the one nag that must repeat but rode the same
             // deduped payload and so fired once per streak.
             let mustDeliver = isCorrection;
+            // Reporting failure must not suppress the existing correction/policy reminder.
+            try {
+                const report = startHookReport(root, provider, evt);
+                if (report) {
+                    text += `\n\n${report}`;
+                    mustDeliver = true;
+                }
+            }
+            catch { /* passive reporting remains fail-open */ }
             // Pipeline turn bookkeeping (fresh block budget) + the one nag that must
             // repeat: edits from an earlier turn still unverified.
             if (evt.session_id && pipelineEnabled()) {
@@ -4616,8 +4684,36 @@ program
                 // further than a terminal.
                 const decisions = s.advisoryRecs("decisions");
                 const { recent, roadmap, pendingReview } = nowData(decisions, 3);
-                if (!decisions.length) {
-                    // Fresh graph: nothing to orient on, but the operating loop still ships.
+                const escalations = pendingEscalations(decisions);
+                escalations.push(...premiseEscalations(decisions, { now: new Date().toISOString(), exists: (p) => existsSync(join(paths.root, p)) }));
+                // liveness checked against the full store even in private mode — a
+                // private-overlay decision's repair is fully answerable via
+                // `hunch repair-provenance` (which reads the full store), so it
+                // must not go silently unanswerable just because its title stays
+                // out of session transcripts. Only the id and commit shas surface.
+                const sessionStartQueue = readActivePendingRepairs(paths.root);
+                escalations.push(...commitRepairEscalations(sessionStartQueue, decisions, s.recs("decisions"), withheldRewrites(paths.root, sessionStartQueue)));
+                try {
+                    // Constitution human moments ride the same line; a broken policy store
+                    // must never take session-start orientation down (fail open). Public
+                    // store only — session transcripts travel further than a terminal.
+                    const { ConstitutionService: CS } = await import("../constitution/service.js");
+                    escalations.push(...policyEscalations(new CS(s, paths.root).list({ publicOnly: true }).map((p) => ({ ...p, last_action: p.audit.at(-1)?.action ?? null }))));
+                }
+                catch { /* constitution unavailable */ }
+                // Only ACTIONABLE entries are worth asking inline — a duplicate-id
+                // commit-repair follower whose own resolution says "act on a
+                // different entry first" isn't a question the assistant can put to
+                // the human directly (#61). Filtered BEFORE the bail check below so
+                // "is there anything to say" and "what do we say" share one
+                // predicate — an escalations list that's entirely non-actionable
+                // must bail exactly like an empty one would.
+                const actionableEsc = actionableEscalations(escalations);
+                if (!decisions.length && !actionableEsc.length) {
+                    // Fresh graph and nothing else to raise: nothing to orient on, but
+                    // the operating loop still ships. A queued commit-repair escalation
+                    // (checked against the full store above) is enough reason NOT to
+                    // bail here even when the visible decisions list is empty.
                     if (pipelineEnabled())
                         emitContext(provider, "SessionStart", [PIPELINE_LOOP, controllerBrief].filter(Boolean).join("\n\n"));
                     return;
@@ -4634,18 +4730,8 @@ program
                 }
                 if (pendingReview > 0)
                     L.push(`${pendingReview} legacy un-vouched draft(s) — adopt as advisory memory with \`hunch adopt-drafts\` (new captures auto-trust).`);
-                const escalations = pendingEscalations(decisions);
-                escalations.push(...premiseEscalations(decisions, { now: new Date().toISOString(), exists: (p) => existsSync(join(paths.root, p)) }));
-                try {
-                    // Constitution human moments ride the same line; a broken policy store
-                    // must never take session-start orientation down (fail open). Public
-                    // store only — session transcripts travel further than a terminal.
-                    const { ConstitutionService: CS } = await import("../constitution/service.js");
-                    escalations.push(...policyEscalations(new CS(s, paths.root).list({ publicOnly: true }).map((p) => ({ ...p, last_action: p.audit.at(-1)?.action ?? null }))));
-                }
-                catch { /* constitution unavailable */ }
-                if (escalations.length) {
-                    L.push(`⚖ ${escalations.length} decision(s) need YOUR call — ASK the user inline (don't queue): ${escalations.map((e) => e.question).join(" · ")}`);
+                if (actionableEsc.length) {
+                    L.push(`⚖ ${actionableEsc.length} decision(s) need YOUR call — ASK the user inline (don't queue): ${actionableEsc.map((e) => e.question).join(" · ")}`);
                 }
                 L.push("Orient further: hunch_context(task) · hunch_structure() · `hunch now`.");
                 // The operating loop rides session start — guaranteed delivery, once
@@ -4717,6 +4803,7 @@ program
             if (deny) {
                 appendEvent(paths, { at: new Date().toISOString(), file: target, ...deny.event });
                 emitDeny(provider, deny.reason);
+                observeHookDenial(root, provider, evt, target, deny);
                 return;
             }
             // Veto Guard (live): the proposed edit text re-introduces an approach an
@@ -4726,6 +4813,7 @@ program
             if (vetoDeny) {
                 appendEvent(paths, { at: new Date().toISOString(), file: target, ...vetoDeny.event });
                 emitDeny(provider, vetoDeny.reason);
+                observeHookDenial(root, provider, evt, target, vetoDeny);
                 return;
             }
         }
@@ -4792,13 +4880,26 @@ program
             delivery_profile: envelope.profile,
             ranking_policy: envelope.ranking_policy,
         })));
-        if (injectionMode(evt.session_id, `pre:${target}`, text) === "delta") {
+        const reportTaskId = hookReportTaskId(root, provider, evt);
+        // A new authoritative prompt gets its own full delivery. An earlier
+        // prompt's session-level delta cannot establish this task's receipt.
+        if (injectionMode(evt.session_id, `pre:${target}${reportTaskId ? `:${reportTaskId}` : ""}`, text) === "delta") {
             receipts("refreshed");
             emitContext(provider, "PreToolUse", `Hunch grounding for ${target}: unchanged this session (${envelope.delivered.filter((item) => item.kind === "decisions").length} decision(s), ${envelope.delivered.filter((item) => item.kind === "constraints").length} invariant(s) shown earlier — still current; hunch_why("${target}") to re-expand).`);
             return;
         }
         receipts("served");
-        emitContext(provider, "PreToolUse", text);
+        let reportNotice = "";
+        if (reportTaskId) {
+            try {
+                const occurrence = recordTaskDelivery(root, reportTaskId, envelope, snapshotDeliveredRecords(store, envelope));
+                reportNotice = `\n\nHunch task ${reportTaskId} · delivery ${occurrence}. Inspect exact application references with hunch_report(task_id).`;
+            }
+            catch {
+                reportNotice = "\n\nTask report observation unavailable; this delivery's task contribution remains unverified.";
+            }
+        }
+        emitContext(provider, "PreToolUse", text + reportNotice);
     }
     catch {
         // swallow — never block an edit on a hook failure
@@ -5311,7 +5412,7 @@ program
 // ---- escalations (the inline "ask the human" surface) ---------------------
 program
     .command("escalations")
-    .description("The decisions a human must make NOW — surfaced to be asked INLINE, never inferred: one exact imported ADR at a time, topic conflicts, stale premises, and Constitution activation calls. Normally empty. Exits non-zero when any are open.")
+    .description("The decisions a human must make NOW — surfaced to be asked INLINE (in the prompt), never a background queue. Captured memory auto-trusts on landing; this lists only what the graph genuinely can't resolve itself: topic conflicts, premise-stale decisions, one exact imported ADR at a time, a queued commit-provenance repair awaiting `--apply`, Constitution candidates awaiting review, and proposed policies whose activation is a human call. Normally empty. Exits non-zero when any are open, so an assistant/CI knows to raise them.")
     .option("--json", "emit the escalation entries as JSON (the VS Code panel's data source)")
     .action(async (opts) => {
     const { store, root } = storeFor();
@@ -5321,6 +5422,8 @@ program
         // Premise decay rides the same inline surface: a decision whose recorded
         // reason died is a QUESTION for the human — authority never changes here.
         items.push(...premiseEscalations(decisionsForEsc, { now: new Date().toISOString(), exists: (p) => existsSync(join(root, p)) }));
+        const escalationsQueue = readActivePendingRepairs(root);
+        items.push(...commitRepairEscalations(escalationsQueue, decisionsForEsc, decisionsForEsc, withheldRewrites(root, escalationsQueue)));
         // Constitution moments ride the same inline surface (§59.5.3) — never a queue.
         // Fail open: a broken policy store must not take the memory escalations down.
         try {
@@ -5328,9 +5431,14 @@ program
             items.push(...policyEscalations(new CS(store, root).list().map((p) => ({ ...p, last_action: p.audit.at(-1)?.action ?? null }))));
         }
         catch { /* constitution unavailable — memory escalations still surface */ }
+        // Gate (exit code + tallies) on the ACTIONABLE subset only — a duplicate-id
+        // commit-repair follower whose own resolution says "act on a different
+        // entry first" still surfaces below for transparency, but must not count
+        // as its own thing needing a decision (#61). --json keeps the full list.
+        const actionable = actionableEscalations(items);
         if (opts.json) {
             console.log(JSON.stringify(items));
-            if (items.length)
+            if (actionable.length)
                 process.exitCode = 1;
             return;
         }
@@ -5338,13 +5446,23 @@ program
             console.log("✓ Nothing needs your decision — memory is auto-trusted and self-consistent.");
             return;
         }
-        console.log(`${items.length} decision(s) need your call (ask inline; nothing is queued):\n`);
+        // escalationHeadline's own "nothing actionable, N shown for context"
+        // fallback is currently unreachable here: every escalation-producing
+        // function today guarantees at least one actionable entry whenever it
+        // emits anything at all — see commitRepairEscalations' own docstring on
+        // `firstFor`/dropTarget. Kept anyway (not assumed away) because that
+        // guarantee lives in the PRODUCERS, not in `Escalation.actionable`'s own
+        // contract, which a future producer could legitimately violate.
+        console.log(escalationHeadline(items, "cli") + "\n");
         for (const e of items) {
-            console.log(`  ⚖ ${e.question}`);
+            // A non-actionable row (a duplicate-id follower) still surfaces for
+            // transparency, but must not read like its own question — marked
+            // distinctly so a skim doesn't mistake it for one of the tally above.
+            console.log(`  ${e.actionable === false ? "·" : "⚖"} ${e.question}`);
             console.log(`      ${dim(e.detail)}`);
             console.log(`      ${dim("→ " + e.resolution)}\n`);
         }
-        process.exitCode = 1;
+        process.exitCode = actionable.length ? 1 : 0;
     }
     finally {
         store.close();
@@ -5482,6 +5600,407 @@ program
         store.close();
     }
 });
+// ---- repair-provenance (squash-merge commit provenance repair) ------------
+program
+    .command("repair-provenance")
+    .description("Self-repair: detect a decision's commit provenance going orphaned by a squash-merge, matched by exact related_files overlap against the newly merged commit range — zero guessing beyond that. A fresh match not already rejected via --drop is queued (.hunch/pending-commit-repairs.json, local-only); --apply/--drop require the --expect hash printed by the preview or escalation; --only <dec_id> limits approval to one decision. Approval never scans for fresh matches. The post-merge hook runs detection automatically in the background but never passes --apply — the match signal isn't strong enough to trust an unattended write into shared team memory.")
+    .option("--apply", "apply the reviewed queued candidates (requires --expect; does not scan for new matches)")
+    .option("--expect <hash>", "exact queue review hash printed by the preview or escalation; required for --apply/--drop")
+    .option("--only <dec_id>", "with --apply, rewrite only this decision id — everything else stays queued untouched")
+    .option("--drop <dec_id>", "reject the queued match for this decision id, without applying it — tombstoned durably, so an identical future match for the same still-orphaned commit won't resurface (a genuinely different candidate still can)")
+    .option("--from-hook", "invoked by the git post-merge hook")
+    .option("--quiet", "minimal output")
+    .option("--range <old..new>", "commit range to scan for replacement commits (default: ORIG_HEAD..HEAD)")
+    .action((opts) => {
+    const { store, root } = storeFor();
+    try {
+        if (!isGitRepo(root)) {
+            if (!opts.fromHook)
+                fail("repair-provenance needs a git repo.");
+            return;
+        }
+        let oldRef = "ORIG_HEAD";
+        let newRef = "HEAD";
+        if (opts.range) {
+            const parts = opts.range.split("..");
+            if (parts.length !== 2 || !parts[0] || !parts[1]) {
+                if (!opts.fromHook)
+                    fail('--range must look like "old..new"');
+                return;
+            }
+            [oldRef, newRef] = parts;
+        }
+        const rangeResolves = revExists(oldRef, root) && revExists(newRef, root);
+        if (!rangeResolves && opts.range) {
+            // An explicitly-given range that doesn't resolve is a usage mistake, not
+            // "no merge happened yet" — surface it. (The installed hook never passes
+            // --range, so --from-hook never reaches this branch in practice.)
+            if (!opts.fromHook)
+                fail(`range "${oldRef}..${newRef}" does not resolve in this repository`);
+            return;
+        }
+        const decisions = store.recs("decisions");
+        // One save path for every queue mutation below — a future change to
+        // queue semantics has exactly one write call to touch, not several
+        // independently-reasoned ones. This file has twice shipped the same
+        // failure class from that fragmentation: one write site's "is this
+        // entry resolved" logic gets fixed while a sibling write site quietly
+        // keeps reasoning about the queue differently, deleting an entry the
+        // fixed site would have left alone.
+        let queue = readPendingRepairs(root);
+        const save = (next) => {
+            queue = [...next];
+            writePendingRepairs(root, queue);
+        };
+        // Tombstones for exact {id, from, to} triples a human already rejected
+        // via --drop — durable across runs so detection re-deriving the
+        // identical match on a later merge doesn't re-queue what was already
+        // rejected. A genuinely different `to` for the same {id, from} is a new
+        // proposal and is unaffected.
+        let dropped = readDroppedRepairs(root);
+        const saveDropped = (next) => {
+            dropped = [...next];
+            writeDroppedRepairs(root, dropped);
+        };
+        // Review commands act only on the queue that was presented. Validate
+        // before pruning or writing either queue file; stale approval is inert.
+        if (opts.apply || opts.drop) {
+            const reviewed = withoutDropped(queue, dropped);
+            const expected = commitRepairReviewHash(reviewed, withheldRewrites(root, reviewed));
+            if (!opts.expect || opts.expect !== expected) {
+                return fail("repair review is missing or stale; run hunch repair-provenance and use its --expect hash to review the current queue.");
+            }
+            if (opts.fromHook)
+                return fail("the post-merge hook may only detect repairs, never approve them.");
+        }
+        // The queue file itself must never carry a tombstoned entry, regardless
+        // of how it got there — the fresh-match filtering further down only
+        // covers the merge this run performs. A concurrently-racing writer (the
+        // post-merge hook's backgrounded detection can read the queue/dropped
+        // files independently of a human's --drop landing in between) could
+        // still leave a tombstoned entry sitting in the queue file; sweeping on
+        // every load makes "never contains a rejected triple" a property of the
+        // queue file itself, not of one write site. Same fragmentation lesson
+        // as the comment on `save` above. Every OTHER reader of the queue
+        // (escalations, SessionStart, the MCP tools) calls
+        // readActivePendingRepairs instead of reading the raw file, so a
+        // tombstoned entry can never surface as a question even before this
+        // sweep next runs.
+        //
+        // Deletes unconditionally, without the prune's visibility caveats below
+        // — safe here because the swept entry's exact triple is preserved in
+        // dropped-commit-repairs.json, so nothing about it is unrecoverable
+        // (unlike the prune, which could otherwise destroy the queue's only
+        // durable record of a match).
+        const activeInQueue = withoutDropped(queue, dropped);
+        const swept = queue.filter((r) => !activeInQueue.includes(r));
+        // Remembered for --only below, same reasoning as onlyWasPruned: targeting
+        // an id whose only queued entry was just swept as already-rejected is not
+        // the same usage error as targeting an id that never existed.
+        const onlyWasSwept = !!opts.only && swept.some((r) => r.id === opts.only);
+        if (swept.length) {
+            save(activeInQueue);
+            if (!opts.quiet)
+                console.log(`Swept ${swept.length} already-rejected match${swept.length === 1 ? "" : "es"} from the queue: ${swept.map((r) => r.id).join(", ")}`);
+        }
+        // Prune only PROVEN-dead entries (deadRewrites: the decision is present
+        // and demonstrably moved on/superseded/rejected) — never an id merely
+        // absent from `decisions` right now, which can just mean this run
+        // checked out a branch that predates the decision, or a private
+        // overlay isn't mounted. That's the reader's transient view, not proof
+        // the match is stale, and the queue file is the one durable record of
+        // it (see repairqueue.ts) — deleting on absence would destroy it
+        // unrecoverably. This keeps the queue from accumulating an
+        // actually-dead entry that outlives any number of --only runs
+        // targeting other ids, without risking a false prune. Deferred until
+        // after --range validation so a pure usage error changes nothing.
+        const deadEntries = deadRewrites(queue, decisions);
+        // Remembered for --only below: targeting an id that was pruned THIS
+        // run is not the same usage error as targeting an id that never
+        // existed — the human's target was real and is now resolved, not
+        // unrecognized.
+        const onlyWasPruned = !!opts.only && deadEntries.some((r) => r.id === opts.only);
+        if (deadEntries.length) {
+            // Object identity, not id — a corrupted queue file can carry a dead
+            // entry and a still-live one sharing an id (#53); deadRewrites
+            // already preserves identity via a plain filter, so pruning by id
+            // here would destroy the live sibling right alongside its dead
+            // namesake instead of leaving it for repairDecisionCommit to apply.
+            const deadSet = new Set(deadEntries);
+            save(queue.filter((r) => !deadSet.has(r)));
+            if (!opts.quiet)
+                console.log(`Pruned ${deadEntries.length} dead queue entr${deadEntries.length === 1 ? "y" : "ies"} (decision moved on, has no commit on record, or was superseded/rejected): ${deadEntries.map((r) => r.id).join(", ")}`);
+        }
+        const candidates = rangeResolves && !opts.apply && !opts.drop ? mergeRangeChanges(oldRef, newRef, root) : [];
+        const orphaned = candidates.length ? orphanedCommitDecisions(decisions, (sha) => commitRepairStatus(sha, newRef, root)) : [];
+        const freshPlan = candidates.length ? planCommitRepair(orphaned, candidates) : { rewrites: [], records: [] };
+        // Detection always queues a fresh match — local-only, never committed, so
+        // it's safe to persist unconditionally. This is what makes running
+        // opportunistically (from the hook) worth anything: the match survives
+        // past this process exiting and past ORIG_HEAD getting overwritten by the
+        // next merge, so a human can confirm it later with `--apply` alone.
+        // A match whose exact {id, from, to} triple was already tombstoned by
+        // an earlier --drop is filtered out first — the human already rejected
+        // exactly this proposed replacement, and a later merge re-deriving it
+        // independently isn't a reason to ask again. A different `to` for the
+        // same still-orphaned commit is a new proposal and passes through.
+        const freshRewrites = withoutDropped(freshPlan.rewrites, dropped);
+        if (freshRewrites.length)
+            save(mergeRewrites(freshRewrites, queue));
+        if (opts.drop) {
+            const before = queue.length;
+            // firstFor is the single first-match-by-id rule — the same one
+            // pickRewrite and mergeRewrites go through (#53, #56, #58) — to
+            // decide which same-id entry would actually apply. A corrupted
+            // queue file can carry two entries sharing an id, and dropping by
+            // id would destroy the untargeted sibling too, with no tombstone
+            // recording what it was. Filtering by object identity (not
+            // `r.id !== opts.drop`) removes only the one entry actually
+            // dropped; any other entry sharing the id is untouched and stays
+            // queued.
+            const target = firstFor(queue, opts.drop);
+            save(queue.filter((r) => r !== target));
+            // Tombstone only when something real was actually queued for this id —
+            // an id that was never queued has no {from, to} to record, and
+            // "nothing queued" is a usage-mistake signal that shouldn't quietly
+            // create a tombstone file.
+            if (target) {
+                saveDropped(addDropped([{ id: target.id, from: target.from, to: target.to }], dropped));
+                // An identical {id, from, to} sibling (a corrupted queue file, a
+                // hand edit) is now tombstoned but still sitting in the queue this
+                // run just saved above — the load-time sweep near the top of this
+                // action already promises the queue file can never carry a
+                // tombstoned entry, so re-run it here. Without this, --apply later
+                // in this same invocation would happily write the exact rewrite
+                // the human just rejected (#53 follow-up).
+                save(withoutDropped(queue, dropped));
+            }
+            if (!opts.quiet) {
+                console.log(queue.length === before
+                    ? `Nothing queued or matched for "${opts.drop}" to drop.`
+                    : `Dropped "${opts.drop}" from the queue — the same match won't resurface on its own; a genuinely different candidate for this decision still can.`);
+            }
+            if (!opts.apply)
+                return;
+        }
+        // Deliberately checked before --only ever gets a chance to consult
+        // onlyWasPruned/onlyWasSwept below: when the prune or the sweep just
+        // emptied the queue entirely, --only's own explanatory messages never
+        // get a chance to fire — this generic message covers that case too,
+        // and still exits 0 either way, so no usage-error bug survives here.
+        if (!queue.length) {
+            if (!opts.quiet)
+                console.log("✓ Nothing to repair — no orphaned commit reference matched unambiguously, and nothing queued from an earlier run.");
+            return;
+        }
+        // --only restricts the apply (or dry-run preview) to one decision id,
+        // leaving every other queued/matched candidate exactly as it was — the
+        // escalation asks a per-decision question, so the answer surface should
+        // let a human accept one without also accepting everything else queued.
+        const toApply = opts.only ? queue.filter((r) => r.id === opts.only) : queue;
+        if (opts.only && !toApply.length) {
+            if (onlyWasSwept) {
+                // Not a usage error either: the human already rejected exactly this
+                // match via an earlier --drop, and this run's sweep just confirmed
+                // the rejection still holds — nothing left to apply.
+                if (!opts.quiet)
+                    console.log(`"${opts.only}" was already rejected via --drop — nothing left to do.`);
+                return;
+            }
+            if (onlyWasPruned) {
+                // Not a usage error: the human's target was real, and this run
+                // already resolved it above (see the prune's own message for why).
+                if (!opts.quiet)
+                    console.log(`"${opts.only}" was pruned earlier in this run — nothing left to do.`);
+                return;
+            }
+            if (!opts.fromHook)
+                fail(`no queued or matched entry for "${opts.only}"`);
+            return;
+        }
+        // Whether a listed entry's decision is visible at all this run — a row
+        // that isn't can't actually be resolved by --apply (see
+        // resolvedRewriteIds below), so dry-run/apply output must say so
+        // instead of listing it as though --apply would act on it. Same
+        // reasoning applies to a `to` that doesn't resolve to a real commit
+        // here (issue #48): never write an unverified `to` into a decision's
+        // commit field, and never claim --apply would either. Computed before
+        // the dry-run branch below so the preview and the real run agree on
+        // what --apply can actually do. `null` from commitsExist means the
+        // check itself failed to run (not a git repo, git missing, timeout)
+        // and is treated as fail-open — same discipline as drift.ts's own use
+        // of commitsExist, though the asymmetry is worth naming: drift.ts only
+        // decides what to REPORT on a `null`, while this gates a WRITE that
+        // gets auto-committed into shared team memory. Fail-open is still the
+        // right call here: `isGitRepo(root)` already passed above, so `null`
+        // in practice means the batched `cat-file` call itself timed out —
+        // rare, and a corrupted `to` that slips through is fully recoverable
+        // (the entry survives durably in the queue either way; a bad write
+        // is a revert). Fail-closed's cost — treating every entry as withheld
+        // on a transient git error, indefinitely, on every run until the
+        // error clears — is the worse failure mode to default to.
+        const visibleIds = new Set(decisions.map((d) => d.id));
+        const existingTargets = commitsExist(toApply.map((r) => r.to), root);
+        const { applicable, withheld } = withheldForUnresolvableTo(toApply, existingTargets);
+        const withheldSet = new Set(withheld);
+        // The plan --apply would act on if it ran right now — built here, before
+        // the dry-run branch, so the preview reasons about the exact same plan
+        // repairDecisionCommit would. `pickRewrite` (src/core/commitrepair.ts, a
+        // plan-scoped `firstFor`) decides which entry wins when `applicable`
+        // carries two sharing a decision id (a corrupted queue file, a hand
+        // edit): first match, by construction. `wasChosen` asks that same
+        // question by object identity rather than re-deriving it, so this file
+        // and commitrepair.ts can never independently drift on which entry
+        // "won" (#51, #58).
+        const plan = { rewrites: applicable, records: [...new Set(applicable.map((r) => r.id))] };
+        const applicableSet = new Set(applicable);
+        const wasChosen = (r) => pickRewrite(plan, r.id) === r;
+        // Whether an entry will still be sitting in the queue after this run,
+        // and why — computed ONCE and shared by the dry-run preview, the queue
+        // sweep, and the post-apply "left queued" report, so the three can
+        // never independently drift out of sync about the same entry (they
+        // did, twice, across two review rounds, before this was unified). The
+        // sweep walks the FULL `queue`, not just `toApply` — under --only, an
+        // untargeted id's entries never entered `applicable` at all, so
+        // `wasChosen` would read "not chosen" for them too. Gating "duplicate"
+        // on `applicableSet.has(r)` keeps the label meaning what it says: a
+        // SIBLING actually competed for this exact id and lost, not merely
+        // "this id wasn't this run's `applicable` set for some other reason."
+        //
+        // Precedence, most to least eclipsing: invisible, then withheld, then
+        // duplicate. Invisible and withheld can each resolve on their own (a
+        // later run sees the decision, or its `to` starts existing) or never
+        // will (withheld, permanently, unless dropped) — "duplicate" is neither:
+        // it means a SIBLING entry for the same id already won and got applied,
+        // which repairDecisionCommit's own from-mismatch bail already makes true
+        // by the time anything downstream would check it, so it's only worth
+        // naming for entries that are otherwise resolvable.
+        const reasonQueued = (r) => !visibleIds.has(r.id) ? "invisible"
+            : withheldSet.has(r) ? "withheld"
+                : applicableSet.has(r) && !wasChosen(r) ? "duplicate"
+                    : null;
+        const staysQueued = (r) => reasonQueued(r) !== null;
+        if (!opts.apply) {
+            if (!opts.quiet) {
+                const unresolvedCount = toApply.filter(staysQueued).length;
+                console.log(unresolvedCount
+                    ? `Would repair ${toApply.length - unresolvedCount} of ${toApply.length} listed:`
+                    : `Would repair ${toApply.length} commit reference(s):`);
+                for (const r of toApply) {
+                    const reason = reasonQueued(r);
+                    const label = reason === "invisible" ? "not visible this run — --apply would leave it queued"
+                        : reason === "withheld" ? "proposed replacement commit doesn't resolve in this repository — --apply would leave it queued"
+                            : reason === "duplicate" ? "another queued entry for this same decision would be applied instead — --apply would leave this one queued"
+                                : null;
+                    console.log(`  ${r.id}  ${r.from} → ${r.to}${label ? `  (${label})` : ""}`);
+                }
+                const reviewHash = commitRepairReviewHash(queue, withheldRewrites(root, queue));
+                const only = opts.only ? ` --only ${opts.only}` : "";
+                console.log(dim(`\nDry run — no decision was rewritten. Review this queue, then run hunch repair-provenance --apply${only} --expect ${reviewHash}.`));
+                for (const id of new Set(toApply.map((r) => r.id))) {
+                    console.log(dim(`Reject: hunch repair-provenance --drop ${id} --expect ${reviewHash}`));
+                }
+            }
+            return;
+        }
+        const touchedHomes = new Set();
+        const appliedIds = new Set();
+        for (const d of decisions) {
+            const healed = repairDecisionCommit(d, plan);
+            if (healed === d)
+                continue;
+            const home = decisionMemoryHome(store, d.id);
+            store.putWhereItLives("decisions", healed);
+            touchedHomes.add(home);
+            appliedIds.add(d.id);
+        }
+        // Only a candidate whose decision was actually VISIBLE this run AND
+        // whose `to` resolved in this repository AND wasn't beaten out by a
+        // same-id sibling is resolved (applied, or found stale by
+        // repairDecisionCommit's own from-mismatch bail) — resolvedRewriteIds
+        // shares deadRewrites' own reasoning: an id we could not see this run,
+        // or whose replacement doesn't exist, is not proof of anything, so it
+        // stays queued rather than being swept up just because it was in
+        // `toApply`. This also covers --only: toApply is just the one targeted
+        // id, so an invisible, unresolvable, or beaten-out target is left
+        // queued instead of deleted unresolved.
+        //
+        // `staysQueued` (OBJECT identity for both the withheld half, via
+        // `withheldSet.has(r)`, and the duplicate half, via `wasChosen`) is
+        // OR'd in ahead of the id-keyed `!resolvedIds.has(r.id)`: a corrupted
+        // queue file could carry two entries sharing an id — one resolvable,
+        // one not, or both resolvable — and an id-keyed check alone would treat
+        // the pair as one unit, deleting/misreporting whichever entry didn't
+        // actually get applied (#48, #51).
+        const resolvedIds = resolvedRewriteIds(applicable, decisions);
+        save(queue.filter((r) => staysQueued(r) || !resolvedIds.has(r.id)));
+        if (!appliedIds.size) {
+            // deadRewrites already pruned any VISIBLE decision that moved on or
+            // was superseded/rejected, so a targeted, resolvable id that IS
+            // visible always reaches repairDecisionCommit with a matching
+            // `from` and is always healed into a new object (appliedIds.add
+            // fires unconditionally for every visible match) — reaching here
+            // means every targeted candidate stayed queued (invisible or
+            // withheld, reported independently so neither reason disappears).
+            const invisibleIds = toApply.filter((r) => reasonQueued(r) === "invisible").map((r) => r.id);
+            const withheldIds = toApply.filter((r) => reasonQueued(r) === "withheld").map((r) => r.id);
+            if (!opts.quiet) {
+                if (invisibleIds.length) {
+                    console.log(`Nothing applied — none of the targeted decision(s) are visible this run (branch checkout, or a private overlay not mounted?): ${invisibleIds.join(", ")}. Left queued for a run where they are — or \`hunch repair-provenance --drop <dec_id>\` if a decision is gone for good.`);
+                }
+                if (withheldIds.length) {
+                    const subject = withheldIds.length === 1
+                        ? "an entry whose proposed replacement commit doesn't"
+                        : "entries whose proposed replacement commits don't";
+                    console.log(`${invisibleIds.length ? "Also nothing" : "Nothing"} applied for ${subject} resolve in this repository: ${withheldIds.join(", ")}. Left queued — this won't self-heal on its own; \`hunch repair-provenance --drop <dec_id>\` to reject it.`);
+                }
+            }
+            return;
+        }
+        store.reindex();
+        const rangeLabel = rangeResolves ? `${oldRef}..${newRef}` : "queued";
+        pumpMemoryHomes(store, root, touchedHomes, `hunch: repair ${appliedIds.size} commit reference(s) after squash-merge (${rangeLabel})`);
+        if (!opts.quiet) {
+            console.log(`✓ Repaired ${appliedIds.size} commit reference(s):`);
+            // `wasChosen` restricts this to the one entry per id that
+            // repairDecisionCommit actually wrote — `appliedIds` alone is keyed by
+            // decision id, so without it a same-id sibling that never got written
+            // would print here too (#51).
+            for (const r of applicable)
+                if (appliedIds.has(r.id) && wasChosen(r))
+                    console.log(`  ${r.id}  ${r.from} → ${r.to}`);
+            const stillQueued = toApply.filter((r) => staysQueued(r) || !resolvedIds.has(r.id));
+            const stillInvisible = stillQueued.filter((r) => reasonQueued(r) === "invisible");
+            const stillWithheld = stillQueued.filter((r) => reasonQueued(r) === "withheld");
+            const stillDuplicate = stillQueued.filter((r) => reasonQueued(r) === "duplicate");
+            if (stillInvisible.length) {
+                console.log(`\n${stillInvisible.length} entr${stillInvisible.length === 1 ? "y" : "ies"} not visible this run, left queued: ${stillInvisible.map((r) => r.id).join(", ")} — or \`hunch repair-provenance --drop <dec_id>\` if a decision is gone for good.`);
+            }
+            if (stillWithheld.length) {
+                console.log(`\n${stillWithheld.length} entr${stillWithheld.length === 1 ? "y" : "ies"} left queued — the proposed replacement commit doesn't resolve in this repository: ${stillWithheld.map((r) => r.id).join(", ")} — \`hunch repair-provenance --drop <dec_id>\` to reject it.`);
+            }
+            if (stillDuplicate.length) {
+                // Every entry here shares its id with the sibling that won (that's
+                // what "duplicate" means) — listing ids would just repeat one
+                // value, so name the `to` each one proposed instead. No
+                // `--drop <dec_id>` pointer, unlike the other two buckets: `--drop`
+                // targets the first queued match for an id (the same one
+                // pickRewrite would apply), which by now is the winning sibling
+                // that's already gone from the queue, not the losing one named
+                // here — pointing at `--drop <dec_id>` would read as an offer to
+                // reject this exact entry when it can't (#53).
+                console.log(`\n${stillDuplicate.length} entr${stillDuplicate.length === 1 ? "y" : "ies"} left queued — a sibling entry for the same decision was applied instead (only the first queued match per decision is ever applied): ${stillDuplicate.map((r) => `${r.id} (${r.to})`).join(", ")}`);
+            }
+        }
+    }
+    catch (err) {
+        if (!opts.fromHook)
+            throw err;
+    }
+    finally {
+        store.close();
+    }
+});
 program
     .command("revert-move <sha>")
     .description("Undo one validated memory-only move from a clean checkout (LOCAL only, never pushed). Powers the Hunch view's 'reject move'.")
@@ -5508,7 +6027,7 @@ program
 // ---- drift (doc≠graph detector; advisory + CI-gateable) -------------------
 program
     .command("drift")
-    .description("Detect memory drift: dead refs, dangling supersedes, stale 'proposed' docs, doc≠graph anchor-stale (a file still anchored to a superseded decision), markdown sections whose <!-- hunch:topic … dec_id --> pin points at a superseded or missing decision (AGENTS.md/CLAUDE.md as a drift surface), and ledger≠records replay divergence when this partition has a change ledger. Exits non-zero on any anchor-stale drift, topic collision or replay divergence — the doc≠graph and ledger≠records gate.")
+    .description("Detect memory drift: dead refs, dangling supersedes, stale 'proposed' docs, commit-unresolvable (a decision cites a commit that no longer resolves in this repository), doc≠graph anchor-stale (a file still anchored to a superseded decision), markdown sections whose <!-- hunch:topic … dec_id --> pin points at a superseded or missing decision (AGENTS.md/CLAUDE.md as a drift surface), and ledger≠records replay divergence when this partition has a change ledger. Exits non-zero on any anchor-stale drift, topic collision or replay divergence — the doc≠graph and ledger≠records gate.")
     .action(() => {
     const { store, root } = storeFor();
     try {
@@ -5970,6 +6489,14 @@ program
                 console.log(`· ${f.id} — ${f.detail}`);
             console.log(`\nHeal: this is a HUMAN call — the decision's authority is unchanged until you make it. Re-attest (update the premise's review_by/attested), supersede via /capture, or retire the decision. Keeping it for consistency is a valid answer.\n`);
         }
+        // Every drift kind heals here — see bug_drift_heal_asymmetry above.
+        const commitUnresolvable = kind("commit-unresolvable");
+        if (commitUnresolvable.length) {
+            console.log(`${commitUnresolvable.length} decision(s) cite a commit that no longer resolves in this repository:\n`);
+            for (const f of commitUnresolvable)
+                console.log(`· ${f.id} — ${f.detail}`);
+            console.log(`\nHeal: this is a HUMAN call — check \`hunch repair-provenance\` for a queued match (the post-merge hook detects these automatically while the commit is still resolvable, but never applies one unattended); run \`hunch repair-provenance --apply\` to confirm it, or if the commit is already gone, manually correct the decision's provenance or leave it as historical record.\n`);
+        }
         console.log(`Hunch never rewrites prose for you; this is a read-only reconciliation report.`);
     }
     finally {
@@ -6072,6 +6599,21 @@ program
         process.exitCode = 1; // conflict markers remain → block the commit for review
     }
 });
+// ---- merge-driver-grounding (internal; git invokes this) ------------------
+program
+    .command("merge-driver-grounding")
+    .description("(internal) git merge driver for the generated grounding docs — auto-resolves a hard conflict confined to the record-counts sentence.")
+    .argument("<base>", "%O — common ancestor")
+    .argument("<ours>", "%A — current branch (also the OUTPUT file)")
+    .argument("<theirs>", "%B — other branch")
+    .argument("[path]", "%P — pathname being merged")
+    .action((base, ours, theirs) => {
+    const res = mergeGroundingFile(base, ours, theirs);
+    if (res.write !== null)
+        writeFileSync(ours, res.write);
+    if (res.conflict)
+        process.exitCode = 1; // real conflict, or git itself errored → leave for a human
+});
 // ---- doctor ---------------------------------------------------------------
 program
     .command("doctor")
@@ -6086,6 +6628,23 @@ program
     const { store, root } = storeFor();
     console.log(`Hunch root: ${root}`);
     console.log(`git repo:   ${isGitRepo(root) ? "yes" : "no"}  ${isGitRepo(root) ? `(HEAD ${headSha(root).slice(0, 8)})` : ""}`);
+    // post-commit/post-merge are the two hooks every setup path installs; a
+    // repo that ran `hunch init` before the post-merge hook existed never
+    // received it, and there was no way to discover that short of noticing a
+    // squash-merge went unrepaired. pre-commit is opt-out (`--no-enforce`),
+    // so its absence is informational only, never a warning.
+    if (isGitRepo(root)) {
+        const hooks = hookStatus(root);
+        const missing = [!hooks.postCommit && "post-commit", !hooks.postMerge && "post-merge"].filter((h) => !!h);
+        // `hunch index` only ever installs post-merge onto an existing
+        // post-commit install (it never hooks an un-hooked repo — see
+        // isGitRepo(root) && hookStatus(root).postCommit above) — so the fix
+        // hint must not point there when post-commit itself is missing.
+        const fix = !hooks.postCommit ? "run `hunch init` for the full setup" : "run `hunch index` to install it";
+        console.log(`hooks:      ${missing.length
+            ? `⚠ missing ${missing.join(", ")} — ${fix}`
+            : `post-commit, post-merge installed${hooks.preCommit ? " (+ pre-commit)" : ""}`}`);
+    }
     // In unified mode the public .hunch directory is only a routing shell.
     // Report the same effective manifest that `hunch migrate` reads and stamps,
     // or every healthy code-only team clone looks permanently out of date.