@davesheffer/hunch 1.39.2 → 1.40.0

package/dist/store/jsonStore.js

@@ -3,13 +3,15 @@
  * in PRs, diffable, mergeable). This layer never touches SQLite — it is the
  * authoritative read/write surface; SQLite is rebuilt from it.
  */
-import { closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, opendirSync, readSync, realpathSync, rmSync, } from "node:fs";
+import { closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, opendirSync, readSync, realpathSync, rmSync, rmdirSync, } from "node:fs";
+import { randomBytes } from "node:crypto";
 import { hostname } from "node:os";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { ENTITY_KINDS, SCHEMAS } from "../core/types.js";
 import { BASELINE_VERSION, migrateRaw, SCHEMA_VERSION } from "../core/migrate.js";
 import { writeFileAtomic } from "../core/io.js";
 import { readStoreArtifact } from "../core/storeArtifact.js";
+import { heldLockNonces, judgeSameHostOwner, selfStartToken, startTokenOf } from "../core/procstart.js";
 /** High-cardinality collections (symbols, edges) are stored as a single
  *  index.json array — there can be thousands, and one file per edge would create
  *  enormous git noise. Curated, low-volume entities (components, decisions, bugs,
@@ -38,14 +40,64 @@ export const MAX_JSON_INDEX_BYTES = 256 * 1024 * 1024;
 export const MAX_JSON_MANIFEST_BYTES = 64 * 1024;
 export const MAX_JSON_DIRECTORY_ENTRIES_PER_KIND = 100_000;
 function readRmwOwner(lock) {
-    const text = readStoreArtifact(lock, ["owner.tmp.json"], 4096);
+    let text;
+    try {
+        text = readStoreArtifact(lock, ["owner.tmp.json"], 4096);
+    }
+    catch (error) {
+        // A NORMAL release (`rmSync` of the lock dir) can land between
+        // readStoreArtifact's lstat and its read, and the reader then reports
+        // "unsafe or unreadable" for a file that simply went away — which used to
+        // make a healthy waiter throw instead of retrying. Only an ENOENT re-check
+        // excuses it: while the file still exists, a hardlink/oversize/symlink
+        // refusal is real and must still throw, unchanged.
+        //
+        // The ENOENT of the OWNER FILE is not enough on its own: a `.rmw-lock` that
+        // is itself a SYMLINK to a directory without an owner file also has no owner
+        // file, and excusing that would turn main's permanent "unsafe store artifact
+        // path" refusal into an age-based removal of the link. So the excuse also
+        // requires the lock itself to be either gone (the release we are modelling)
+        // or a REAL directory that is not a link.
+        //
+        // Residual accepted: a release + re-acquire between the reader's failure and
+        // this re-lstat makes a REAL refusal (hardlink/oversize) throw for a file
+        // that already belongs to the next holder. That only turns a retry into an
+        // error — it never licenses a steal, so the safe direction is preserved.
+        let ownerMissing = false;
+        try {
+            lstatSync(join(lock, "owner.tmp.json"));
+        }
+        catch (statError) {
+            ownerMissing = statError.code === "ENOENT";
+        }
+        if (ownerMissing) {
+            let lockOrdinary;
+            try {
+                const lockStat = lstatSync(lock);
+                lockOrdinary = lockStat.isDirectory() && !lockStat.isSymbolicLink();
+            }
+            catch (statError) {
+                if (statError.code !== "ENOENT")
+                    throw error;
+                lockOrdinary = true; // the whole lock went away: exactly the release above
+            }
+            if (lockOrdinary)
+                return undefined;
+        }
+        throw error;
+    }
     if (text === null)
         return undefined;
     try {
         const parsed = JSON.parse(text);
         if (typeof parsed.pid !== "number" || !Number.isInteger(parsed.pid) || parsed.pid < 1 || typeof parsed.host !== "string")
             return undefined;
-        return { pid: parsed.pid, host: parsed.host };
+        return {
+            pid: parsed.pid,
+            host: parsed.host,
+            ...(typeof parsed.nonce === "string" ? { nonce: parsed.nonce } : {}),
+            ...(typeof parsed.start === "string" ? { start: parsed.start } : {}),
+        };
     }
     catch {
         return undefined;
@@ -60,6 +112,114 @@ function rmwPidAlive(pid) {
         return error.code === "EPERM";
     }
 }
+/** Longest a `.rmw-lock.reclaim` claim may sit before another contender clears
+ *  it: the claimed section is a handful of syscalls. */
+const RMW_CLAIM_STALE_MS = 10_000;
+/** Is this `.rmw-lock` takeable? Same rule as before — a live same-host PID is
+ *  authoritative, everything else falls back to age — with the PID-RECYCLING
+ *  hole closed (issue #293): a restart can hand the contender the dead owner's
+ *  exact pid and host, and the orphaned lock then blocks every write forever.
+ *  The owner's recorded process-instance token settles that by string equality
+ *  (core/procstart.ts); no clock is compared, because a lock's mtime and a start
+ *  time come from different clocks and any skew would "prove" a live owner
+ *  recycled. `readRmwOwner` stays FIRST: it throws on unsafe/hardlinked or
+ *  oversized ownership metadata, and unsafe ownership never licenses removal. */
+function rmwLockIsStale(lock) {
+    let stat;
+    try {
+        stat = lstatSync(lock);
+    }
+    catch (statError) {
+        if (statError.code === "ENOENT")
+            return false; // already gone; nothing to take over
+        throw statError;
+    }
+    const owner = readRmwOwner(lock);
+    if (owner && owner.host === hostname()) {
+        // One shared table with src/serve/writelock.ts (core/procstart.ts), so the
+        // two locks can never drift apart; "age" means nothing was proven and the
+        // fallback below governs, exactly as for a foreign host.
+        const verdict = judgeSameHostOwner(owner, {
+            alive: rmwPidAlive,
+            self: selfStartToken(),
+            tokenOf: startTokenOf,
+            platform: process.platform,
+            selfPid: process.pid,
+            heldNonces: heldLockNonces,
+        });
+        if (verdict !== "age")
+            return verdict === "stale";
+    }
+    return Date.now() - stat.mtimeMs > 10_000;
+}
+/**
+ * Remove a stale `.rmw-lock` under an exclusive sibling claim, mirroring
+ * `src/serve/writelock.ts` (issue #287). "judge stale → rm → mkdir" is not
+ * atomic: two contenders can both judge the same corpse stale, the first
+ * removes it and creates its own, and the second then removes that FRESH lock —
+ * two holders, which is exactly the record-loss race this mutex exists to
+ * prevent. The claim is a directory (invisible to git, like the commit lock in
+ * src/extractors/git.ts) created with exclusive `mkdirSync`.
+ *
+ * INVARIANT: a stale lock's path can only be vacated by a claim holder (its
+ * owner is dead and will never release), and only one contender holds the claim
+ * at a time — so nothing can replace the lock between the re-judge and the `rm`.
+ * A contender that judged stale a moment earlier re-judges under the claim, sees
+ * the winner's fresh live lock, and removes nothing. Accepted residuals: (i) an
+ * AGE-judged lock (foreign host, unprobeable owner, or unreadable owner
+ * metadata) whose owner is actually alive and releases inside the re-judge→rm
+ * window — the same class as the existing 10 s age steal;
+ * (ii) two contenders racing to clear a STRANDED claim.
+ * A claim's staleness is judged by ITS MTIME against OUR clock — the one clock
+ * comparison left in the takeover path — and there is no claim-nonce file to
+ * fall back on, so with filesystem/host clock skew beyond RMW_CLAIM_STALE_MS
+ * every LIVE claim looks stranded and exclusion among three or more simultaneous
+ * contenders degrades to the pre-fix race; without such skew it needs a stranded
+ * claim section plus simultaneous removers — and "stranded" is NOT only a crash:
+ * a STALL longer than RMW_CLAIM_STALE_MS between the re-judge and the `rm`
+ * (SIGSTOP, a VM pause or live migration, a laptop sleep) does it too, and one
+ * other contender is then enough — it clears the "stranded" claim, takes over and
+ * publishes a LIVE lock, and the resumed claimer's `rm` removes that live lock;
+ * the unconditional `rmdirSync(claim)` in the `finally` can likewise remove a
+ * SUCCESSOR's claim. Same probability class as the age steal already accepted;
+ * (iii) a stranded claim blocks any takeover for up to
+ * RMW_CLAIM_STALE_MS, needing the same crash OR over-RMW_CLAIM_STALE_MS stall,
+ * and a filesystem clock AHEAD of this host extends that block by the skew;
+ * (iv) MIXED VERSIONS: a pre-fix `hunch` ignores `.reclaim`,
+ * so the race persists until every writer on the store is upgraded. Returns true
+ * when the path may now be free.
+ */
+function takeOverRmwLock(lock) {
+    const claim = `${lock}.reclaim`;
+    try {
+        mkdirSync(claim);
+    }
+    catch (error) {
+        if (error.code === "EEXIST") {
+            // Mid-takeover elsewhere, or a claimer that crashed inside the section.
+            // Clear only a provably stranded claim; either way do not take over this
+            // round — the caller falls through to its deadline check and wait.
+            try {
+                if (Date.now() - lstatSync(claim).mtimeMs > RMW_CLAIM_STALE_MS)
+                    rmdirSync(claim);
+            }
+            catch { /* vanished, or another contender cleared it first */ }
+        }
+        return false;
+    }
+    try {
+        if (!rmwLockIsStale(lock))
+            return false; // re-judged from scratch under the claim
+        rmSync(lock, { recursive: true, force: true });
+        return true;
+    }
+    finally {
+        try {
+            rmdirSync(claim);
+        }
+        catch { /* best effort; a stranded claim is cleared by age */ }
+    }
+}
 function missing(error) {
     return error.code === "ENOENT";
 }
@@ -423,7 +583,17 @@ export class JsonStore {
             }
             return out;
         }
-        for (const name of this.jsonFileNames(kind)) {
+        // The canonical home of a record is `<id>.json` (see fileFor). A leftover
+        // COPY — `dec_x_BASE_1234.json` from an aborted mergetool, `dec_x.orig.json`,
+        // a cloud-sync `dec_x (1).json` — would otherwise yield a second record with
+        // the same id and blow up the SQLite rebuild on a duplicate primary key
+        // (issue #291). A misnamed file whose canonical name is ABSENT is the
+        // record's only home, so it is kept (con_947c578b2c: never silently drop).
+        // Names are sorted, so which stray wins in that case is deterministic.
+        const names = this.jsonFileNames(kind);
+        const present = new Set(names);
+        const seenMisnamed = new Set();
+        for (const name of names) {
             let raw;
             try {
                 const text = this.readContainedFile(directory, join(directory.lexical, name), this.maxBytes(kind));
@@ -444,10 +614,20 @@ export class JsonStore {
                 continue;
             }
             const r = schema.safeParse(this.migrate(kind, raw, version));
-            if (r.success)
-                out.push(r.data);
-            else
+            if (!r.success) {
                 console.warn(`[hunch] skipping invalid ${kind}/${name}: ${r.error.issues[0]?.message}`);
+                continue;
+            }
+            const id = r.data.id;
+            if (typeof id === "string" && `${id}.json` !== name) {
+                if (present.has(`${id}.json`) || seenMisnamed.has(id)) {
+                    console.warn(`[hunch] skipping stray copy ${kind}/${name}: its record id ${id} belongs in ${id}.json`);
+                    continue;
+                }
+                console.warn(`[hunch] ${kind}/${name} holds record ${id}; expected file name ${id}.json`);
+                seenMisnamed.add(id);
+            }
+            out.push(r.data);
         }
         return out;
     }
@@ -455,29 +635,37 @@ export class JsonStore {
      *  The long-lived MCP server and CLI hooks write the same `.hunch/` concurrently;
      *  two unsynchronized RMWs over index.json each read the same base array and the
      *  second rename silently erases the first's record. `mkdirSync` is the atomic
-     *  acquire (EEXIST = held). A stale lock (killed process) is taken over by age;
-     *  against a live contender we wait briefly and then refuse the write. Proceeding
-     *  without the lock would reintroduce the record-loss race this mutex exists to
-     *  prevent. */
+     *  acquire (EEXIST = held). A stale lock (killed process, or one whose pid was
+     *  RECYCLED) is taken over behind an exclusive `.reclaim` claim — see
+     *  `takeOverRmwLock`, because judging and removing are two steps and two
+     *  contenders could otherwise both "win". Against a live contender we wait
+     *  briefly and then refuse the write. Proceeding without the lock would
+     *  reintroduce the record-loss race this mutex exists to prevent. */
     withSingleFileLock(kind, directory, fn) {
         const lock = join(directory.lexical, ".rmw-lock");
         const deadline = Date.now() + 2_000;
+        const nonce = randomBytes(8).toString("hex");
         for (;;) {
-            if (Date.now() >= deadline)
-                throw new Error(`[hunch] timed out acquiring the ${kind} index lock (still held: ${lock})`);
             try {
                 mkdirSync(lock);
+                // Synchronously adjacent to the successful mkdir: from here on this nonce
+                // is one WE hold, so our own later calls never read it as a predecessor's.
+                heldLockNonces.add(nonce);
                 // Record ownership inside the already-exclusive directory. A live local
                 // writer may exceed the stale-age heuristic while serializing a large
-                // index; its PID must prevent a second writer from taking over.
+                // index; its PID must prevent a second writer from taking over. The
+                // process-instance token (when this platform has one) is what lets a
+                // successor tell that PID apart from a recycled one.
                 try {
-                    writeFileAtomic(join(lock, "owner.tmp.json"), JSON.stringify({ pid: process.pid, host: hostname() }));
+                    const start = selfStartToken();
+                    writeFileAtomic(join(lock, "owner.tmp.json"), JSON.stringify({ pid: process.pid, host: hostname(), nonce, ...(start !== null ? { start } : {}) }));
                 }
                 catch (error) {
                     try {
                         rmSync(lock, { recursive: true, force: true });
                     }
                     catch { /* report the ownership failure below */ }
+                    heldLockNonces.delete(nonce);
                     throw new Error(`[hunch] could not record ownership for the ${kind} index lock: ${error.message}`, { cause: error });
                 }
                 break;
@@ -485,23 +673,13 @@ export class JsonStore {
             catch (error) {
                 if (error.code !== "EEXIST")
                     throw error;
-                let stat;
-                try {
-                    stat = lstatSync(lock);
-                }
-                catch (statError) {
-                    if (statError.code === "ENOENT")
-                        continue; // vanished between mkdir and inspect
-                    throw statError;
-                }
-                const owner = readRmwOwner(lock);
-                const stale = owner && owner.host === hostname()
-                    ? !rmwPidAlive(owner.pid)
-                    : Date.now() - stat.mtimeMs > 10_000;
-                if (stale) {
-                    rmSync(lock, { recursive: true, force: true });
+                if (rmwLockIsStale(lock) && takeOverRmwLock(lock))
                     continue;
-                }
+                // The deadline is checked only AFTER an acquire has been attempted: with
+                // the check at the top of the loop, a successful takeover could still be
+                // followed immediately by a spurious timeout.
+                if (Date.now() >= deadline)
+                    throw new Error(`[hunch] timed out acquiring the ${kind} index lock (still held: ${lock})`);
                 Atomics.wait(RMW_LOCK_WAITER, 0, 0, 25);
             }
         }
@@ -509,10 +687,25 @@ export class JsonStore {
             return fn();
         }
         finally {
+            // Only remove a lock that is still ours. If we were stolen from (age, or a
+            // recycled-pid verdict) the directory now protects another writer, and
+            // removing it would put two writers inside the mutex. A record we cannot
+            // read, or one without a nonce, tells us nothing — remove it exactly as
+            // main always did, so a failed ownership read can never strand the lock.
             try {
-                rmSync(lock, { recursive: true, force: true });
+                let foreign = false;
+                try {
+                    const current = readRmwOwner(lock);
+                    foreign = current?.nonce !== undefined && current.nonce !== nonce;
+                }
+                catch { /* unreadable ownership proves nothing: fall back to main's unconditional remove */ }
+                if (!foreign)
+                    rmSync(lock, { recursive: true, force: true });
             }
             catch { /* stale-takeover reclaims it */ }
+            finally {
+                heldLockNonces.delete(nonce);
+            }
         }
     }
     /** Write a single record (validated) to its JSON file / into the index array. */

package/dist/store/merge.d.ts

@@ -14,8 +14,10 @@
  *
  * Resolution for a record changed on BOTH sides: human-confirmed beats auto, then
  * higher provenance.confidence, then the more recently verified, then a deterministic
- * content tiebreak (so both developers' merges converge on the same result). Records
- * are pure data here — no filesystem access; the CLI reads/writes the files.
+ * content tiebreak (so both developers' merges converge on the same result). A lifecycle
+ * move only the losing side made (a supersession, a fix, a reopen) is carried onto the
+ * winner, so the ranking never undoes it. Records are pure data here — no filesystem
+ * access; the CLI reads/writes the files.
  */
 type Rec = Record<string, unknown>;
 export interface MergeResult {
@@ -32,8 +34,9 @@ export declare function mergeHunchJson(baseText: string, oursText: string, their
  *  only if the other side left the record unchanged (a modification beats a delete);
  *  a both-sides change is resolved by `pickWinner`. */
 export declare function mergeRecordsById(base: Rec[], ours: Rec[], theirs: Rec[]): Rec[];
-/** Both sides changed the same record: pick the one to keep. */
-export declare function pickWinner(ours: Rec, theirs: Rec): Rec;
+/** Both sides changed the same record: pick the one to keep, then make sure the
+ *  pick did not undo a lifecycle move only the OTHER side made (see carryLifecycle). */
+export declare function pickWinner(ours: Rec, theirs: Rec, base?: Rec): Rec;
 /** Stable JSON with recursively SORTED keys, so equality/compare ignore key order. */
 export declare function canon(v: unknown): string;
 export {};

package/dist/store/merge.js

@@ -14,8 +14,10 @@
  *
  * Resolution for a record changed on BOTH sides: human-confirmed beats auto, then
  * higher provenance.confidence, then the more recently verified, then a deterministic
- * content tiebreak (so both developers' merges converge on the same result). Records
- * are pure data here — no filesystem access; the CLI reads/writes the files.
+ * content tiebreak (so both developers' merges converge on the same result). A lifecycle
+ * move only the losing side made (a supersession, a fix, a reopen) is carried onto the
+ * winner, so the ranking never undoes it. Records are pure data here — no filesystem
+ * access; the CLI reads/writes the files.
  */
 import { LEDGER_SCHEMA_VERSION, LedgerSchema, mergeLedgers } from "./changeLedger.js";
 /** Merge three versions of one `.hunch` JSON file (an index array OR a single
@@ -98,7 +100,7 @@ export function mergeRecordsById(base, ours, theirs) {
             else if (bv && canon(tv) === canon(bv))
                 out.push(ov); // only ours changed
             else
-                out.push(pickWinner(ov, tv)); // both changed (or both added differently)
+                out.push(pickWinner(ov, tv, bv)); // both changed (or both added differently)
         }
         else if (ov && !tv) {
             // theirs lacks it: a delete (bv present & ours unchanged) loses to a keep/modify
@@ -115,8 +117,14 @@ export function mergeRecordsById(base, ours, theirs) {
     }
     return out;
 }
-/** Both sides changed the same record: pick the one to keep. */
-export function pickWinner(ours, theirs) {
+/** Both sides changed the same record: pick the one to keep, then make sure the
+ *  pick did not undo a lifecycle move only the OTHER side made (see carryLifecycle). */
+export function pickWinner(ours, theirs, base) {
+    const winner = pickWhole(ours, theirs);
+    return carryLifecycle(winner, winner === ours ? theirs : ours, base);
+}
+/** Whole-record ranking: provenance first, lifecycle evidence, then a content tiebreak. */
+function pickWhole(ours, theirs) {
     const oc = humanConfirmed(ours);
     const tc = humanConfirmed(theirs);
     if (oc !== tc)
@@ -172,6 +180,58 @@ function closureEvidence(r) {
     }
     return n;
 }
+/** The provenance ranking picks a whole record, and a lifecycle move never touches
+ *  provenance: `hunch supersede` writes only status/superseded_by/valid_to, while
+ *  `hunch review --accept` on the other branch raises provenance. The reviewed copy then
+ *  won outright and the superseded decision came back live beside its successor, with no
+ *  conflict reported (#290). Ranking closure evidence first would only move the loss: the
+ *  review would be dropped, and a genuine reopen would lose to any provenance-only edit.
+ *
+ *  So the lifecycle is merged three-way on its own. When the winner left it as the base
+ *  had it and the loser moved it, the move is carried onto the winner — a closure or a
+ *  reopen alike. It moves as ONE unit (status with its evidence), never blended: if both
+ *  sides moved it differently, the winner's stands. With no base (an add on both sides,
+ *  the overlay migrate) nothing says which side moved — a live copy may be a reopen or
+ *  simply older — so the whole-record ranking stands, as it did before. A pure function of (winner, loser, base), and the winner
+ *  is side-independent, so A-merges-B and B-merges-A still agree. */
+function carryLifecycle(winner, loser, base) {
+    if (!base)
+        return winner;
+    const was = canon(lifecycle(base));
+    if (canon(lifecycle(winner)) !== was || canon(lifecycle(loser)) === was)
+        return winner;
+    const out = { ...winner };
+    for (const key of LIFECYCLE_KEYS) {
+        if (key in loser)
+            out[key] = loser[key];
+        else
+            delete out[key];
+    }
+    if (isRec(loser.lineage)) {
+        const lineage = isRec(winner.lineage) ? { ...winner.lineage } : {};
+        for (const key of LIFECYCLE_LINEAGE_KEYS) {
+            if (key in loser.lineage)
+                lineage[key] = loser.lineage[key];
+            else
+                delete lineage[key];
+        }
+        out.lineage = lineage;
+    }
+    return out;
+}
+const LIFECYCLE_KEYS = ["status", "superseded_by", "valid_to"];
+const LIFECYCLE_LINEAGE_KEYS = ["fixed_commit", "spawned_decision", "spawned_constraint"];
+/** The lifecycle unit of a record, absent and null alike normalised to null so a side
+ *  that merely materialised a default does not read as having moved it. */
+function lifecycle(r) {
+    const lineage = isRec(r.lineage) ? r.lineage : {};
+    const out = {};
+    for (const key of LIFECYCLE_KEYS)
+        out[key] = r[key] ?? null;
+    for (const key of LIFECYCLE_LINEAGE_KEYS)
+        out[`lineage.${key}`] = lineage[key] ?? null;
+    return out;
+}
 function parseSide(text) {
     const trimmed = (text ?? "").trim();
     if (!trimmed)

package/dist/store/privateMigrate.js

@@ -36,6 +36,16 @@ export function movePublicMemoryToPrivate(pub, priv) {
         if (pubRecs.length === 0)
             continue;
         const privRecs = priv.loadAll(kind);
+        // Same proof for the OVERLAY side: replaceAll below deletes every overlay
+        // file whose id is not in the merged set, and a record the loader skipped
+        // is never in it — so an unloadable overlay record (corrupt, or written by
+        // a newer Hunch) would be deleted as "stale" and the deletion pushed to the
+        // shared remote (issue #289).
+        const privRawCount = priv.rawRecordCount(kind);
+        if (privRawCount !== privRecs.length) {
+            throw new Error(`refusing to migrate ${kind}: ${privRawCount - privRecs.length} overlay record(s) failed to load (see the warnings above) `
+                + `and would be deleted from the overlay by the merge. Fix or remove them (or update Hunch if they come from a newer version), then re-run \`hunch private --migrate\`.`);
+        }
         // base=[] so both sides' records are treated as additions; collisions resolved
         // by pickWinner. Public is "theirs", private "ours" — order is irrelevant since
         // pickWinner is symmetric for equal-provenance records.

package/dist/wiki/adopt.js

@@ -97,12 +97,23 @@ export function renderAdoptedDoc(doc, content, decisions, reconciled = null) {
         out.push("## 🩹 Reconciled overview", "", reconciled.trim(), "", "_LLM-drafted from the current decisions (subscription); the graph corrections below are the deterministic, authoritative layer._", "");
     }
     const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    for (const raw of lines) {
+    // Parse the WHOLE document once, like computeDrift and the pre-edit hook: a
+    // fence spans lines, so a per-line parse sees every line as outside any fence
+    // and would heal (and inject a callout into) a documentation example.
+    const anchorsByLine = new Map();
+    for (const a of parseDocAnchors(content)) {
+        const at = anchorsByLine.get(a.line);
+        if (at)
+            at.push(a);
+        else
+            anchorsByLine.set(a.line, [a]);
+    }
+    for (const [i, raw] of lines.entries()) {
         // Heal EVERY stale pin on the line, and only inside its own marker — a bare
         // decision id in the surrounding prose must never be rewritten.
         let line = raw;
         const corrections = [];
-        for (const a of parseDocAnchors(raw)) {
+        for (const a of anchorsByLine.get(i + 1) ?? []) {
             if (!a.pin)
                 continue;
             const pinned = byId.get(a.pin);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.39.2",
+  "version": "1.40.0",
   "mcpName": "io.github.davesheffer/hunch",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://www.hunchmemory.com",
-  "version": "1.39.2",
+  "version": "1.40.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@davesheffer/hunch",
-      "version": "1.39.2",
+      "version": "1.40.0",
       "runtimeHint": "npx",
       "packageArguments": [
         {