@davesheffer/hunch 1.43.0 → 1.44.0

package/README.md

@@ -106,6 +106,16 @@ hunch integrations check --harness codex --require context
 
 The first command checks configuration. The probe starts a fresh MCP process and reads memory. The context check requires observed hook delivery on the expected version, so run it after the new assistant session begins. `--require` fails when the named capability is not verified; none of these checks proves that a model followed the advice.
 
+## Remove Hunch from a repository
+
+```bash
+hunch uninstall --dry-run   # show what would change
+hunch uninstall             # remove what Hunch installed; keep .hunch/ (your memory)
+hunch uninstall --purge     # also delete .hunch/, the derived cache and Hunch's .gitignore blocks
+```
+
+It removes the instruction blocks, MCP entries, agent and git hooks, merge driver, slash commands and CI workflow that Hunch installed, and leaves your own content in those files alone. If a file it needs to edit can't be parsed, it changes nothing and says which file. It writes `.hunch-removed`: while that file exists, no Hunch command sets Hunch up here again. Commit it so every clone stays opted out; to reinstall, delete it and run `hunch init`. Close running `hunch mcp` / `hunch serve` processes first, so they can't recreate files.
+
 ## See what Hunch contributed
 
 Task reports answer: what memory reached this task, what did the agent say it used, and what checks actually ran?

package/dist/cli/index.js

@@ -43,7 +43,8 @@ import { isParserLoadError, loadNativeTreeSitter } from "../extractors/nativeTre
 import { syncCommit, recordFailure, captureTestRun } from "../synthesis/synthesize.js";
 import { parseTestReport } from "../extractors/testreport.js";
 import { readSynthesisPreference, resolveSynthesisProvider, selectProvider, SYNTH_PREFERENCES, writeSynthesisPreference, normalizeProviderName, } from "../synthesis/provider.js";
-import { isGitRepo, isGitRepoRoot, sameGitPublication, sameRemoteUrl, canonicalRemoteUrl, repositoryUsesRemote, headSha, isolatedHeadSha, logSince, lastChangeDate, firstCommitForFile, stagedFiles, workingFiles, commitFiles, asOfDate, stagedGateDiff, workingGateDiff, commitGateDiff, rangeFiles, rangeGateDiff, rangeSubjects, revExists, revParse, commitAndPushHunch, pullHunchStatus, syncExistingHunch, gitUntrackCached, gitCommonDir, checkoutCommonDir, separateGitDirCandidate, separateGitDirLink, hooksDir, isLinkedWorktree, mainWorktreeRoot, gitMemoryLog, memoryMoveDiff, revertMemoryMove, pushCurrentBranch, commitChanges, commitRepairStatus, mergeRangeChanges, commitsExist } from "../extractors/git.js";
+import { isGitRepo, isGitRepoRoot, sameGitPublication, sameRemoteUrl, canonicalRemoteUrl, repositoryUsesRemote, headSha, isolatedHeadSha, logSince, lastChangeDate, checkFreshnessRevision, teamPullIsFresh, firstCommitForFile, stagedFiles, workingFiles, commitFiles, asOfDate, stagedGateDiff, workingGateDiff, commitGateDiff, rangeFiles, rangeGateDiff, rangeCommits, revExists, revParse, commitAndPushHunch, pullHunchStatus, syncExistingHunch, gitUntrackCached, gitCommonDir, checkoutCommonDir, separateGitDirCandidate, separateGitDirLink, hooksDir, isLinkedWorktree, mainWorktreeRoot, gitMemoryLog, memoryMoveDiff, revertMemoryMove, pushCurrentBranch, commitChanges, commitRepairStatusAgainst, commitPatchIds, mergeRangeChanges, commitsExist } from "../extractors/git.js";
+import { runbookDraft } from "../core/runbookDraft.js";
 import { parseMemoryLog } from "../core/memorylog.js";
 import { renamesOf, planRepair, repairDecision, repairConstraint } from "../core/repair.js";
 import { orphanedCommitDecisions, planCommitRepair, repairDecisionCommit, pickRewrite, commitRepairReviewHash, mergeRewrites, firstFor, deadRewrites, resolvedRewriteIds, withoutDropped, addDropped, withheldForUnresolvableTo } from "../core/commitrepair.js";
@@ -61,6 +62,7 @@ import { flushCapture, flushMemoryHome, flushMemoryHomes, pinSharedRemote, share
 import { installMergeDriver } from "../integrations/mergeDriver.js";
 import { ensureGitignore, ignoreHunchMemory, HUNCH_MEMORY_DIRS, upgradeManagedGitignore, describeGitignoreUpgrade } from "../integrations/gitignore.js";
 import { writeCiWorkflow } from "../integrations/ciAction.js";
+import { applyUninstall, formatUninstallPlan, isOptedOut, OPT_OUT_FILE, optOutMessage, planUninstall } from "../integrations/uninstall.js";
 import { updateClaudeMd, renderHunchSection } from "../integrations/claudemd.js";
 import { HOOK_REMINDER } from "../core/hookText.js";
 import { measureFootprint } from "../core/footprint.js";
@@ -218,6 +220,26 @@ registerReviewMemoryCommands(program, (records, repository, privateOnly) => {
     return { root, existing: store.captureHome(privateOnly) === "private"
             ? store.recs("constraints") : store.json.loadAll("constraints") };
 });
+// Opt-out gate (#449): a repository `hunch uninstall` opted out stays out. Setup
+// and every other command refuse; the commands a leftover git or agent hook may
+// still call exit 0 so they never break the user's commit, merge or agent turn
+// (`hook` silently: its stdout is the agent's context). The merge drivers still
+// run: a leftover driver that exits without writing %A would let git drop `theirs`.
+const OPT_OUT_ALLOWED = new Set(["uninstall", "doctor", "help", "merge-driver", "merge-driver-grounding"]);
+const OPT_OUT_QUIET = new Set(["hook", "sync", "check", "grounding", "repair-provenance", "workspaces"]);
+program.hook("preAction", (_thisCommand, actionCommand) => {
+    let top = actionCommand;
+    while (top.parent && top.parent !== program)
+        top = top.parent;
+    const name = top.name();
+    if (OPT_OUT_ALLOWED.has(name))
+        return;
+    if (!isOptedOut(findRoot()))
+        return;
+    if (name !== "hook")
+        console.error(optOutMessage());
+    process.exit(OPT_OUT_QUIET.has(name) ? 0 : 1);
+});
 // Read an already-known update and schedule any registry refresh in a detached
 // worker. No network handle is opened in this command's process, so the
 // advisory cannot delay command completion or process exit.
@@ -510,6 +532,46 @@ program
     console.log("Cold start? Seed from history:  hunch backfill --since 90d");
     console.log("\n⭐ If Hunch earns its keep, a star helps others find it → https://github.com/davesheffer/hunch");
 });
+// ---- uninstall ------------------------------------------------------------
+program
+    .command("uninstall")
+    .description("Remove everything Hunch installed in this repository (instruction blocks, MCP entries, agent and git hooks, merge driver, slash commands, CI workflow) and opt the repository out so Hunch never sets itself up here again. Keeps .hunch/ (your engineering memory) unless --purge.")
+    .option("--dry-run", "print what would change and write nothing")
+    .option("--purge", "also delete .hunch/ (the engineering memory), the derived cache, Hunch's .gitignore blocks and this clone's pointer in the git dir")
+    .action((opts) => {
+    const root = findRoot();
+    const plan = planUninstall(root, { purge: !!opts.purge });
+    if (plan.refused.length) {
+        console.error(`Hunch uninstall at ${root}: nothing was changed — fix the file(s) below, then re-run.`);
+        for (const line of formatUninstallPlan(plan, !!opts.dryRun))
+            console.error(line);
+        process.exitCode = 1;
+        return;
+    }
+    const { applied, failed } = opts.dryRun ? { applied: plan.steps, failed: [] } : applyUninstall(plan);
+    // The header follows what actually ran: a failed opt-out marker stops
+    // everything, and saying "uninstalled" then would be a lie.
+    const header = opts.dryRun ? "Hunch uninstall (dry run — nothing written)"
+        : !failed.length ? "Hunch uninstalled"
+            : applied.some((s) => s.kind !== "keep") ? "Hunch partly uninstalled"
+                : "Hunch uninstall: nothing was changed";
+    console.log(`${header} at ${root}${opts.purge ? " (--purge)" : ""}`);
+    if (!plan.steps.some((s) => s.kind !== "keep"))
+        console.log("  nothing to remove — Hunch is not installed here");
+    for (const line of formatUninstallPlan({ ...plan, steps: applied }, !!opts.dryRun))
+        console.log(line);
+    if (failed.length) {
+        console.error(`
+✗ ${failed.length} step(s) could not be applied — close running Hunch processes (\`hunch mcp\`, \`hunch serve\`, editors using them), then re-run \`hunch uninstall${opts.purge ? " --purge" : ""}\`:`);
+        for (const f of failed)
+            console.error(`  ✗ ${f.path}: ${f.error}`);
+        process.exitCode = 1;
+        return;
+    }
+    if (!opts.dryRun && plan.steps.some((s) => s.path === OPT_OUT_FILE)) {
+        console.log(`\nCommit ${OPT_OUT_FILE} (and the removals) so every clone stays opted out. To reinstall later, delete ${OPT_OUT_FILE} and run \`hunch init\`.`);
+    }
+});
 // ---- index ----------------------------------------------------------------
 program
     .command("index")
@@ -1975,11 +2037,14 @@ program
         store.close();
         return fail(`base ref "${base ?? ""}" not found (range: ${range})`);
     }
-    const steps = rangeSubjects(base, root, head);
-    const files = rangeFiles(base, root, head);
+    // Hunch's own capture commits and store/grounding files are bookkeeping, not steps (#425).
+    const commits = rangeCommits(base, root, head);
+    const { steps, files } = runbookDraft(commits, rangeFiles(base, root, head));
     if (!steps.length && !files.length) {
         store.close();
-        return fail(`no commits or changes in range ${range}`);
+        return fail(commits.length
+            ? `range ${range} only holds Hunch's own capture commits and files; nothing to draft`
+            : `no commits or changes in range ${range}`);
     }
     const now = new Date().toISOString();
     const rec = {
@@ -4109,7 +4174,7 @@ program
     .description("Flag changes that touch a do-not-break invariant — the local guardrail AND the CI/PR Constraint Guard. Also flags (advisory) symbols you add that already exist elsewhere — possible re-implementation/sprawl.")
     .option("--staged", "check git staged files (default)")
     .option("--working", "check all working-tree edits vs HEAD (staged, unstaged, and untracked files)")
-    .option("--commit <sha>", "check a specific commit's files")
+    .option("--commit <sha>", "check a specific commit's files (judged alone, against its parent; use --base to gate a whole branch)")
     .option("--base <ref>", "check a PR/branch: files changed vs <ref> (e.g. origin/main) — for CI")
     .option("--strict", "exit non-zero ONLY on a direct, high-confidence, non-stale blocking invariant (near/stale/low-confidence stay advisory)")
     .option("--format <fmt>", "output: text (default) | markdown (a PR comment) | sarif (SARIF 2.1.0 for code scanning)", "text")
@@ -4125,11 +4190,14 @@ program
     const sarif = opts.format === "sarif";
     const emptyReport = { fileCount: 0, strict: !!opts.strict, direct: [], near: [], regressions: [], vetoes: [], redundant: [], strictBlockers: 0, regBlocking: 0, vetoBlocking: 0 };
     const { store, root, teamPullStatus } = storeFor({ requireFreshTeamMemory: !!opts.strict && !opts.publicOnly });
-    const teamFreshnessFailure = teamPullStatus !== null
-        && teamPullStatus !== "updated"
-        && teamPullStatus !== "current"
-        ? `strict check could not refresh the advertised team memory (${teamPullStatus}); refusing a stale pass`
+    const teamFreshnessFailure = teamPullStatus !== null && !teamPullIsFresh(teamPullStatus)
+        ? `strict check could not refresh the advertised team memory (${teamPullStatus}); refusing a stale pass` +
+            (teamPullStatus === "unconfigured" ? " — the shared memory remote has no published branch while this clone has memory; publish it with `hunch shared --sync`" : "")
         : null;
+    // An empty team remote is in sync with a never-committed clone, but it is also what
+    // lost team memory looks like: never let that strict pass be silent (#427).
+    if (teamPullStatus === "empty")
+        console.error("· the advertised team memory has no published branch yet; this strict check ran with no team rules (publish with `hunch shared --sync` after the first capture)");
     // Fail loudly on an unresolvable --base (e.g. CI forgot to fetch the base
     // branch) — otherwise the diff is empty and the guard passes vacuously.
     if (opts.base && !revExists(opts.base, root)) {
@@ -4195,13 +4263,14 @@ program
     // blocking conformance predicate or an active policy guards.
     // The COMPLETE diff (no synthesis byte budget); an incomplete one is flagged so
     // content-matched blocking invariants fail closed instead of passing unseen.
+    const freshAt = checkFreshnessRevision({ base: opts.base, commit: exactCommit }, root);
     const gate = files.length
         ? (exactCommit ? commitGateDiff(exactCommit, root) : opts.base ? rangeGateDiff(opts.base, root) : opts.working ? workingGateDiff(root) : stagedGateDiff(root))
         : { diff: "" };
     const report = files.length
         ? store.buildCheckReport(files, gate.diff, {
             strict: !!opts.strict,
-            lastChange: (f) => lastChangeDate(f, root),
+            lastChange: (f) => lastChangeDate(f, root, freshAt),
             publicOnly: !!opts.publicOnly,
             diffStatus: gate,
         })
@@ -4342,7 +4411,8 @@ const vetoCmd = program
         return;
     }
     const gate = opts.commit ? commitGateDiff(opts.commit, root) : opts.base ? rangeGateDiff(opts.base, root) : stagedGateDiff(root);
-    const full = store.buildCheckReport(files, gate.diff, { strict: !!opts.strict, lastChange: (f) => lastChangeDate(f, root), diffStatus: gate });
+    const freshAt = checkFreshnessRevision({ base: opts.base, commit: opts.commit }, root);
+    const full = store.buildCheckReport(files, gate.diff, { strict: !!opts.strict, lastChange: (f) => lastChangeDate(f, root, freshAt), diffStatus: gate });
     if (!full.vetoes.length) {
         console.log(`✓ ${files.length} changed file(s) reverse no decision you rejected.`);
         store.close();
@@ -4984,8 +5054,7 @@ program
                         const opened = openTeamStore(root, { requireFreshTeamMemory: firmness === "strict" });
                         store = opened.store;
                         // Same rule as the pre-edit path: strict never grounds from stale team rules.
-                        const stale = firmness === "strict" && opened.teamPullStatus
-                            && opened.teamPullStatus !== "updated" && opened.teamPullStatus !== "current";
+                        const stale = firmness === "strict" && opened.teamPullStatus && !teamPullIsFresh(opened.teamPullStatus);
                         if (!stale)
                             shellGround = shellWriteGrounding(root, store, provider, evt, written);
                     }
@@ -5375,8 +5444,7 @@ program
         // never grounding from public/stale memory (dec_77d99014e0).
         const opened = openTeamStore(root, { requireFreshTeamMemory: firmness === "strict" });
         store = opened.store;
-        if (firmness === "strict" && opened.teamPullStatus
-            && opened.teamPullStatus !== "updated" && opened.teamPullStatus !== "current") {
+        if (firmness === "strict" && opened.teamPullStatus && !teamPullIsFresh(opened.teamPullStatus)) {
             // A strict deny is only trustworthy when it includes the latest team
             // rules. Offline/busy/unconfigured team memory is unavailable, so the
             // non-blocking hook says so instead of denying from stale state.
@@ -6323,8 +6391,11 @@ program
                 console.log(`Pruned ${deadEntries.length} dead queue entr${deadEntries.length === 1 ? "y" : "ies"} (decision moved on, has no commit on record, or was superseded/rejected): ${deadEntries.map((r) => r.id).join(", ")}`);
         }
         const candidates = rangeResolves && !opts.apply && !opts.drop ? mergeRangeChanges(oldRef, newRef, root) : [];
-        const orphaned = candidates.length ? orphanedCommitDecisions(decisions, (sha) => commitRepairStatus(sha, newRef, root)) : [];
-        const freshPlan = candidates.length ? planCommitRepair(orphaned, candidates) : { rewrites: [], records: [] };
+        // Orphaned means HEAD no longer reaches the commit either: a historical
+        // --range tip alone would flag every newer, perfectly reachable commit (#450).
+        const orphaned = candidates.length ? orphanedCommitDecisions(decisions, (sha) => commitRepairStatusAgainst(sha, [newRef, "HEAD"], root)) : [];
+        const patchIds = orphaned.length ? commitPatchIds([...orphaned.map((d) => d.commit), ...candidates.map((c) => c.sha)], root) : new Map();
+        const freshPlan = candidates.length ? planCommitRepair(orphaned, candidates, (sha) => patchIds.get(sha) ?? null) : { rewrites: [], records: [] };
         // Detection always queues a fresh match — local-only, never committed, so
         // it's safe to persist unconditionally. This is what makes running
         // opportunistically (from the hook) worth anything: the match survives
@@ -6477,12 +6548,17 @@ program
                 console.log(unresolvedCount
                     ? `Would repair ${toApply.length - unresolvedCount} of ${toApply.length} listed:`
                     : `Would repair ${toApply.length} commit reference(s):`);
+                // Match strength, so a reviewer can tell an identical change from a
+                // file-overlap guess before applying it into shared memory (#450).
+                const previewPatchIds = commitPatchIds(toApply.flatMap((r) => [r.from, r.to]), root);
                 for (const r of toApply) {
                     const reason = reasonQueued(r);
+                    const samePatch = !!previewPatchIds.get(r.from) && previewPatchIds.get(r.from) === previewPatchIds.get(r.to);
                     const label = reason === "invisible" ? "not visible this run — --apply would leave it queued"
                         : reason === "withheld" ? "proposed replacement commit doesn't resolve in this repository — --apply would leave it queued"
                             : reason === "duplicate" ? "another queued entry for this same decision would be applied instead — --apply would leave this one queued"
-                                : null;
+                                : samePatch ? "same patch-id: identical change"
+                                    : "file match only — check the diff before applying";
                     console.log(`  ${r.id}  ${r.from} → ${r.to}${label ? `  (${label})` : ""}`);
                 }
                 const reviewHash = commitRepairReviewHash(queue, withheldRewrites(root, queue));
@@ -7128,6 +7204,13 @@ program
                 console.log(`· ${f.id} — ${f.detail}`);
             console.log(`\nHeal: this is a HUMAN call — check \`hunch repair-provenance\` for a queued match (the post-merge hook detects these automatically while the commit is still resolvable, but never applies one unattended); run \`hunch repair-provenance --apply\` to confirm it, or if the commit is already gone, manually correct the decision's provenance or leave it as historical record.\n`);
         }
+        const fenceUnclosed = kind("doc-fence-unclosed");
+        if (fenceUnclosed.length) {
+            console.log(`${fenceUnclosed.length} markdown file(s) open a code fence that never closes, hiding the topic markers below it:\n`);
+            for (const f of fenceUnclosed)
+                console.log(`· ${f.id} — ${f.detail}`);
+            console.log(`\nHeal: close the fence (a line of the same \`\`\` or ~~~ run) where the example ends; the markers after it become live again.\n`);
+        }
         console.log(`Hunch never rewrites prose for you; this is a read-only reconciliation report.`);
     }
     finally {
@@ -7250,7 +7333,19 @@ program
     .command("doctor")
     .description("Diagnose the environment (git, synthesis provider, index freshness).")
     .action(async () => {
-    const integrations = inspectIntegrations(findRoot());
+    const doctorRoot = findRoot();
+    if (isOptedOut(doctorRoot)) {
+        console.log(`Hunch: not installed (opted out — ${OPT_OUT_FILE} is present).`);
+        const left = planUninstall(doctorRoot).steps.filter((s) => s.kind === "edit" || s.kind === "delete");
+        if (left.length) {
+            console.log(`  ⚠ ${left.length} Hunch leftover(s) remain; \`hunch uninstall\` removes them:`);
+            for (const s of left)
+                console.log(`    - ${s.path}`);
+        }
+        console.log(`  To reinstall: delete ${OPT_OUT_FILE}, then run \`hunch init\`.`);
+        return;
+    }
+    const integrations = inspectIntegrations(doctorRoot);
     console.log(formatIntegrationHealth(integrations));
     // A pin npm cannot serve kills every npx launcher (hooks and MCP) before Hunch
     // runs, and the hosts report nothing. Name it here; bounded, offline-safe.

package/dist/core/changeProof.js

@@ -313,7 +313,8 @@ export function deriveChangeProof(root, store, baseRef, resultRef = "HEAD", opti
         // A diff cut at MAX_DIFF_BYTES is a prefix: content-matched blocking rules over the
         // files it omits fail closed rather than read as compliant (dec_20db57c576).
         diffStatus: diff.gaps.length ? { incomplete: `the guard diff exceeded ${MAX_DIFF_BYTES} bytes and was cut`, truncated: true } : undefined,
-        lastChange: (path) => lastChangeAt(root, change.head_revision, path),
+        // Freshness as of the base: the change under proof must not make its own guard stale (#426).
+        lastChange: (path) => lastChangeAt(root, change.base_revision, path),
     });
     const allStrictBlockerIds = sortedUnique([
         ...guardReport.direct.filter((item) => item.strictBlocks).map((item) => item.id),

package/dist/core/commitrepair.d.ts

@@ -30,9 +30,15 @@ export interface CommitRepairPlan {
  *  doesn't resolve at all ("unresolvable") is out of repair scope, and a git
  *  failure ("unknown") must never be mistaken for repair-eligible. */
 export declare function orphanedCommitDecisions(decisions: readonly Decision[], status: (sha: string) => CommitRepairStatus): Decision[];
-/** Match each orphaned decision to exactly one candidate whose changed files are
- *  a superset of the decision's related_files (non-empty, no globs). */
-export declare function planCommitRepair(orphaned: readonly Decision[], candidates: readonly CommitCandidate[]): CommitRepairPlan;
+/** Match each orphaned decision to exactly one candidate. A candidate with the
+ *  same `git patch-id --stable` as the orphaned commit (a rebase- or
+ *  single-commit squash-merge of it) is the strong match and wins. Only when
+ *  no candidate shares the patch-id does it fall back to the one candidate
+ *  whose changed files are a superset of the decision's related_files
+ *  (non-empty, no globs) -- needed for a squash of several commits, whose
+ *  patch-id never equals any one of them, but weak: shared files like
+ *  CHANGELOG.md often have one wrong superset (#450). */
+export declare function planCommitRepair(orphaned: readonly Decision[], candidates: readonly CommitCandidate[], patchIdOf?: (sha: string) => string | null): CommitRepairPlan;
 /** Whether a queued rewrite is still worth ASKING about: the decision it
  *  names still exists, still cites the commit the entry expects to replace (a
  *  decision that already moved on would make repairDecisionCommit's own

package/dist/core/commitrepair.js

@@ -4,9 +4,10 @@
  * A squash-merge produces one new commit whose parent is the pre-merge target
  * tip — the original per-commit SHAs it squashed are never ancestors of it.
  * This module matches an orphaned decision to the ONE newly-merged commit
- * whose changed files are a superset of the decision's related_files. Zero or
- * multiple qualifying candidates means "don't guess" — same discipline as
- * repair.ts's rename-repair.
+ * with the same patch-id, or failing that the ONE whose changed files are a
+ * superset of the decision's related_files. Zero or multiple qualifying
+ * candidates means "don't guess" — same discipline as repair.ts's
+ * rename-repair.
  */
 import { createHash } from "node:crypto";
 import { replaceExact } from "./refrepair.js";
@@ -33,11 +34,27 @@ export function orphanedCommitDecisions(decisions, status) {
         return status(d.commit) === "orphaned";
     });
 }
-/** Match each orphaned decision to exactly one candidate whose changed files are
- *  a superset of the decision's related_files (non-empty, no globs). */
-export function planCommitRepair(orphaned, candidates) {
+/** Match each orphaned decision to exactly one candidate. A candidate with the
+ *  same `git patch-id --stable` as the orphaned commit (a rebase- or
+ *  single-commit squash-merge of it) is the strong match and wins. Only when
+ *  no candidate shares the patch-id does it fall back to the one candidate
+ *  whose changed files are a superset of the decision's related_files
+ *  (non-empty, no globs) -- needed for a squash of several commits, whose
+ *  patch-id never equals any one of them, but weak: shared files like
+ *  CHANGELOG.md often have one wrong superset (#450). */
+export function planCommitRepair(orphaned, candidates, patchIdOf = () => null) {
     const rewrites = [];
     for (const d of orphaned) {
+        const patchId = patchIdOf(d.commit);
+        if (patchId) {
+            const same = candidates.filter((c) => patchIdOf(c.sha) === patchId);
+            if (same.length === 1) {
+                rewrites.push({ id: d.id, from: d.commit, to: same[0].sha });
+                continue;
+            }
+            if (same.length > 1)
+                continue; // ambiguous: never guess
+        }
         const files = (d.related_files ?? []).filter(isExactPath);
         if (!files.length)
             continue;

package/dist/core/correction.d.ts

@@ -30,7 +30,7 @@ export interface CorrectionInput {
      *  enough — any agent can mint and consume one. Determines the TIER, never whether
      *  the write lands: an un-vouched correction still records immediately and still
      *  surfaces at edit time and in CI. Only the authority to DENY waits for a countersign
-     *  (`hunch review --confirm <id>`). */
+     *  (`hunch review --confirm <id>`). Omitted means false. */
     vouched?: boolean;
 }
 /** Default rationales, exported so a later human countersign can replace the testimony

package/dist/core/correction.js

@@ -5,8 +5,8 @@
  *  agent hook so they are unit-testable without spinning either up:
  *   - looksLikeCorrection(): does a user prompt read like "no / that's wrong /
  *     never do X" — the cue to nudge the agent to persist it.
- *   - buildCorrectionConstraint(): mint the Constraint record (human-confirmed,
- *     scoped conservatively) that the pre-edit hook + CI guard then enforce.
+ *   - buildCorrectionConstraint(): mint the Constraint record (human-confirmed
+ *     only when vouched, scoped conservatively) that the pre-edit hook + CI guard then enforce.
  */
 import { isAbsolute } from "node:path";
 import { constraintId } from "./ids.js";
@@ -108,7 +108,8 @@ export function buildCorrectionConstraint(input, now) {
     // still recorded immediately and still held against every assistant at edit time and
     // in CI — Never Twice keeps its promise. What waits for a countersign is only the
     // authority to DENY.
-    const vouched = input.vouched !== false;
+    // Fails closed: an omitted flag is testimony, never a signature.
+    const vouched = input.vouched === true;
     if (!vouched && severity === "blocking")
         severity = "warning";
     return {

package/dist/core/docanchors.d.ts

@@ -22,9 +22,18 @@ export interface DocAnchor {
     line: number;
 }
 /** Parse every hunch:topic marker out of a markdown document. Markers inside
- *  fenced code blocks or inline code spans are examples, not declarations,
- *  and are skipped. */
+ *  code blocks or inline code spans are examples, not declarations, and are
+ *  skipped. */
 export declare function parseDocAnchors(text: string): DocAnchor[];
+/** parseDocAnchors plus what drift reports about the document: a fence that
+ *  never closes hides every marker below it, almost always by mistake (#381). */
+export declare function scanDocAnchors(text: string): {
+    anchors: DocAnchor[];
+    unclosedFence: {
+        line: number;
+        hidden: number;
+    } | null;
+};
 /** Pre-edit grounding for a markdown document that carries topic anchors: the
  *  CURRENT decision per declared topic (graph over prose), what it rejected,
  *  and a stale-pin warning the editor can heal inline. Empty when no anchor