@davesheffer/hunch 1.43.0 → 1.45.0

package/dist/mcp/server.js

@@ -16,6 +16,7 @@ import { z } from "zod";
 import { hunchPaths, findRoot, toPosixTarget, repoRelativeTarget } from "../core/paths.js";
 import { matchSymbolsTiered } from "../core/glob.js";
 import { resolveMcpToolset } from "./toolset.js";
+import { installLeanToolList } from "./leanToolList.js";
 import { PolicyRepository } from "../constitution/repository.js";
 import { readConfig } from "../core/config.js";
 import { canonicalRootPath, resolveActiveRoot } from "./roots.js";
@@ -32,7 +33,7 @@ import { knownRepoDeps } from "../synthesis/tripwires.js";
 import { refreshExistingGrounding } from "../integrations/providers.js";
 import { workspaceLedgerView, renderWorktreeTable, renderBranchTable, workspaceSummaryLine, snapshotHasHome, recordWorkspaceSnapshot, branchRows, worktreeRows } from "../integrations/workspaceLedger.js";
 import { workspacesConfig } from "../core/config.js";
-import { revParse, asOfDate, revExists, lastChangeDate, rangeFiles, rangeGateDiff, commitFiles, commitGateDiff, stagedFiles, stagedGateDiff, workingFiles, workingGateDiff, pullHunchStatus, sameRemoteUrl, currentBranch, worktreePaths, pathKnownToHistory } from "../extractors/git.js";
+import { revParse, asOfDate, revExists, lastChangeDate, checkFreshnessRevision, teamPullIsFresh, rangeFiles, rangeGateDiff, commitFiles, commitGateDiff, stagedFiles, stagedGateDiff, workingFiles, workingGateDiff, pullHunchStatus, sameRemoteUrl, currentBranch, worktreePaths, pathKnownToHistory } from "../extractors/git.js";
 import { flushCapture, flushMemoryHome, pinSharedRemote } from "../integrations/sync.js";
 import { withWriteLock } from "../serve/writelock.js";
 import { advertisedTeamRemoteContract, ensureTeamOverlay, isTeamStoreTrusted, overlayMatchesTeamRemote, teamWiringConsented, untrustedTeamStoreMessage, readTeamConfig, teamRemoteContract, teamSharedRef } from "../integrations/team.js";
@@ -940,6 +941,16 @@ function unconfirmedReason(c) {
         : "this client could not ask the human to confirm it (no MCP form elicitation, or the request failed)";
 }
 const clipForPrompt = (s, max = 400) => (s.length > max ? `${s.slice(0, max - 1)}…` : s);
+/** Whether a re-record changes what a human signed: every field except bookkeeping
+ *  (provenance, date, valid_from). Fails closed: a field added to Decision later counts
+ *  as substance until it is named here. Absent, null and empty-array values are equal. */
+const DECISION_BOOKKEEPING = new Set(["provenance", "date", "valid_from"]);
+export function decisionSubstanceChanged(before, after) {
+    const norm = (v) => (v === undefined || (Array.isArray(v) && v.length === 0) ? null : v);
+    const keys = [...new Set([...Object.keys(before), ...Object.keys(after)])].filter((k) => !DECISION_BOOKKEEPING.has(k)).sort();
+    const substance = (d) => JSON.stringify(keys.map((k) => [k, norm(d[k])]));
+    return substance(before) !== substance(after);
+}
 /** The interrogation protocol returned by hunch_capture_decision. With `deciding`,
  *  the choice is NOT yet made: the verdict loop runs first so the record's
  *  alternatives_rejected are attacks that actually ran — not post-hoc fiction. */
@@ -1018,7 +1029,7 @@ function pullBackoff(status, finishedAt, failures) {
     if (status === "busy") {
         return { consecutivePullFailures: failures, nextRemotePullAt: finishedAt + 100 };
     }
-    if (status === "unconfigured") {
+    if (status === "unconfigured" || status === "empty") {
         return { consecutivePullFailures: 0, nextRemotePullAt: finishedAt + 30_000 };
     }
     const consecutivePullFailures = Math.min(failures + 1, 6);
@@ -1119,7 +1130,7 @@ function prepareRoot(root, explicitOverlay, requireIndex) {
 export const MCP_INSTRUCTIONS = [
     "Hunch is this repository's engineering memory: decisions, bug history, invariants, components, with provenance.",
     "Per user task: (1) hunch_task(action:\"start\", title) once — skip it when the host's prompt hook already opened the task and printed its verify command, and reuse that task_id; (2) hunch_context(target, task_id) FIRST, before reading or editing, for the file, symbol, or task phrase; (3) hunch_check_constraints(scope) before editing shared code; (4) hunch_task(action:\"finish\", task_id) before the final response, showing its contribution card — required, with one exception: the host's prompt hook opened the task AND its instruction said that host closes the task AND the task used no Hunch (no hunch_* call on this task_id, no task verify check, no hook context you acted on, nothing to claim). A task you started with hunch_task is always finished by you.",
-    "Then by moment: hunch_why(target) for rationale and rejected alternatives, hunch_bug_lineage before fixing a failure, hunch_record_decision after a non-trivial choice, hunch_record_correction when a human corrects you.",
+    "Then by moment: hunch_why(target) for rationale and rejected alternatives, hunch_bug_lineage before fixing a failure, hunch_record_correction when a human corrects you, hunch_record_decision for a decision the human makes; record only what the human decides or corrects.",
     "Hosts without lifecycle hooks (Windsurf, Cursor, or Codex before its hooks are trusted) receive no automatic grounding: call these tools yourself.",
 ].join("\n");
 export function buildServerWithRootControl(initialRoot, options = {}) {
@@ -1197,6 +1208,7 @@ export function buildServerWithRootControl(initialRoot, options = {}) {
     if (toolset.hidden.length)
         process.stderr.write(`[hunch-mcp] tool groups: ${toolset.groups.length ? toolset.groups.join(", ") : "core only"} (${toolset.source}); ${toolset.hidden.length} specialist tool(s) hidden — HUNCH_MCP_TOOLS=all or .hunch/config.json mcp_tools to expose\n`);
     const server = new McpServer({ name: "hunch", version: HUNCH_VERSION }, { instructions: MCP_INSTRUCTIONS });
+    installLeanToolList(server);
     let activeRequests = 0;
     let pendingRoot = null;
     let pendingScheduled = false;
@@ -1954,6 +1966,24 @@ export function buildServerWithRootControl(initialRoot, options = {}) {
             const decision = store.advisoryRecs("decisions").find((candidate) => candidate.id === decision_id);
             if (!decision)
                 return invalid(`Imported ADR ${decision_id} is not present in the current advisory memory home.`);
+            // Approval grants human authority, so the agent's report that the human approved
+            // is not enough: the human confirms in the client prompt, a channel the agent does
+            // not control, or approves with the CLI. A decline keeps the ADR advisory.
+            if (disposition === "approve") {
+                const confirmation = await askHumanToConfirm(server, [
+                    "Hunch: an agent reports that you approved this imported ADR as your decision. Confirm only if YOU approve it.",
+                    "",
+                    `Title: ${clipForPrompt(decision.title, 200)}`,
+                    `Decision: ${clipForPrompt(decision.decision || "(none)")}`,
+                    `Source hash: ${expected_source_hash}`,
+                    "",
+                    "Confirmed, it carries your authority (human_confirmed). Unconfirmed, it stays advisory.",
+                ].join("\n"));
+                if (confirmation !== "confirmed") {
+                    return refused(`Not approved: ${unconfirmedReason(confirmation)}, so ${decision_id} stays advisory and nothing was written. ` +
+                        `The human approves it by running: hunch review --approve-import ${decision_id} --expected-source-hash ${expected_source_hash} --expected-review-hash ${expected_review_hash} --reviewed-by <you>`);
+                }
+            }
             const reviewed = applyImportedAdrReview(decision, {
                 disposition,
                 expectedSourceHash: expected_source_hash,
@@ -2046,7 +2076,7 @@ export function buildServerWithRootControl(initialRoot, options = {}) {
         // bounded convergence. An unavailable remote produces an explicit abstention.
         if (live.length === 0 && store.mode === "shared" && store.privateDir) {
             const status = pullTeamMemory(true);
-            if (status !== "updated" && status !== "current") {
+            if (status === "cooldown" || status === "not_shared" || !teamPullIsFresh(status)) {
                 return err(`Shared team memory refresh is ${status}; Hunch cannot confirm that topic "${topic}" has no current decision. Retry when the shared store is available.`);
             }
             try {
@@ -2075,7 +2105,7 @@ export function buildServerWithRootControl(initialRoot, options = {}) {
     // -- hunch_record_decision (write-back) -----------------------------------
     server.registerTool("hunch_record_decision", {
         title: "Record a decision (write-back)",
-        description: "Persist a Decision (ADR) with provenance after a non-trivial design choice. private:true keeps it in the HUNCH_PRIVATE_DIR overlay, never committed here. Returns id, home, status. Not for an agent-obeyed rule (hunch_record_correction) or an observation (hunch_record_finding). Errors: 'Refused:' a gate held (don't retry); 'Invalid:' fix arguments; 'Failed to' internal.",
+        description: "Persist a Decision (ADR) with provenance when the human makes or confirms one in conversation; routine choices are captured from commits. private:true keeps it in the HUNCH_PRIVATE_DIR overlay, never committed here. Returns id, home, status. Not for an agent-obeyed rule (hunch_record_correction) or an observation (hunch_record_finding). Errors: 'Refused:' a gate held (don't retry); 'Invalid:' fix arguments; 'Failed to' internal.",
         inputSchema: {
             decision: z.object({
                 title: z.string(),
@@ -2212,6 +2242,8 @@ export function buildServerWithRootControl(initialRoot, options = {}) {
                 valid_from: existing?.valid_from ?? now,
                 valid_to: existing?.valid_to ?? null,
                 retired: existing?.retired ?? { symbols: [], deps: [] },
+                ...(existing?.conformance ? { conformance: existing.conformance } : {}),
+                ...(existing?.visibility ? { visibility: existing.visibility } : {}),
                 provenance: { source: "agent_recorded", confidence: 0.75, evidence: (decision.related_files ?? existing?.provenance.evidence ?? []).map(toPosixTarget) },
                 date: now,
             };
@@ -2261,6 +2293,23 @@ export function buildServerWithRootControl(initialRoot, options = {}) {
             const humanSigned = confirmation === "confirmed";
             if (slotConflict && !humanSigned)
                 return slotRefusal();
+            // An inherited signature covers only the text the human signed. Changed substance
+            // without a fresh confirmation would keep human_confirmed on words nobody vouched for.
+            if (existingIsHuman && !humanSigned) {
+                if (decisionSubstanceChanged(existing, rec)) {
+                    return refused(`Decision ${id} is human-confirmed and this write changes its content; refusing to keep the human's signature on unconfirmed text, so nothing was written. ` +
+                        "Record the change through /capture so the human confirms it in the client prompt.");
+                }
+                // Same substance: the human's record already says this. Rewriting it would only
+                // replace the human's provenance with the agent's, so it is a no-op.
+                return ok(`Decision ${id} is human-confirmed and already says this; nothing was written.`);
+            }
+            // Closing a human-confirmed decision is as much a change to it as rewriting it.
+            const supersededIncumbent = decision.supersedes ? store.recs("decisions").find((d) => d.id === decision.supersedes) : undefined;
+            if (supersededIncumbent && !humanSigned && supersededIncumbent.provenance.source.split("+").includes("human_confirmed")) {
+                return refused(`Decision ${supersededIncumbent.id} is human-confirmed; an unconfirmed write cannot supersede it, so nothing was written. ` +
+                    "Record the change through /capture so the human confirms it in the client prompt.");
+            }
             const tier = humanSigned || existingIsHuman ? "human_confirmed" : "agent_recorded";
             const source = existing && existing.provenance.source.includes("llm_draft")
                 ? `llm_draft+${tier}`
@@ -2385,6 +2434,12 @@ export function buildServerWithRootControl(initialRoot, options = {}) {
             }
             const rec = buildCorrectionConstraint({ ...input, knownDeps, root, vouched: false }, now);
             const existing = home === "private" ? store.getPrivateRec("constraints", rec.id) : store.json.get("constraints", rec.id);
+            // A human-confirmed rule is changed only by the same human act that confirmed it.
+            // Writing `rec` here would replace the signature with testimony and cap its severity.
+            if (existing && existing.provenance.source.split("+").includes("human_confirmed")) {
+                return refused(`Constraint ${rec.id} is already human-confirmed; an agent write cannot replace or downgrade it, so nothing was written. ` +
+                    `A change needs the human, outside the agent channel: ${confirmCommand(rec.id, { private: home === "private", severity: requested.severity })}`);
+            }
             // Same cross-home twin guard as the decision path above.
             const stored = store.putCapture("constraints", rec, !!input.private);
             const observed = observeReportCapture(root, input.task_id, "constraints", stored, home, !!existing, home === "private" ? store.privateDir ?? undefined : hunchPaths(root).hunch);
@@ -2812,7 +2867,8 @@ export function buildServerWithRootControl(initialRoot, options = {}) {
             if (!files.length)
                 return ok(`VERDICT: ✅ PASS — no changed files in ${scope}.`);
             const gate = commit ? commitGateDiff(commit, root) : base ? rangeGateDiff(base, root) : working ? workingGateDiff(root) : stagedGateDiff(root);
-            const report = store.buildCheckReport(files, gate.diff, { strict: true, lastChange: (f) => lastChangeDate(f, root), diffStatus: gate });
+            const freshAt = checkFreshnessRevision({ base, commit }, root);
+            const report = store.buildCheckReport(files, gate.diff, { strict: true, lastChange: (f) => lastChangeDate(f, root, freshAt), diffStatus: gate });
             const v = verdict(report);
             const head = v === "block"
                 ? "VERDICT: ⛔ BLOCK — a recorded guard requires review; inspect the cited scope and evidence below before merge."

package/dist/serve/mcpHttp.js

@@ -1,4 +1,5 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { installLeanToolList } from "../mcp/leanToolList.js";
 // The web-standard transport, not the Node one: the Node wrapper imports @hono/node-server,
 // which the production dependency audit keeps unreachable (tooling/production-dependency-audit.mjs).
 // Bridging IncomingMessage → Request → ServerResponse here is a few lines and keeps that boundary.
@@ -51,6 +52,7 @@ const TOOLS = [
 ];
 function buildServer(dispatch, problemOf, version) {
     const server = new McpServer({ name: "hunch-serve", version });
+    installLeanToolList(server);
     for (const tool of TOOLS) {
         server.registerTool(tool.name, { title: tool.title, description: tool.description, inputSchema: tool.input }, async (input) => {
             try {

package/dist/serve/writelock.d.ts

@@ -7,6 +7,10 @@ export declare const ACQUIRE_TIMEOUT_MS = 10000;
  *  claimed section is a few syscalls, so anything this old means its claimer
  *  crashed inside it. */
 export declare const CLAIM_STALE_MS = 10000;
+/** How much later than the lock's recorded `at` the pid's current process must
+ *  have been created before it is proven not to be the owner. A genuine owner
+ *  started BEFORE it took the lock; the slack only absorbs clock granularity. */
+export declare const CREATED_AFTER_SLACK_MS = 5000;
 export interface LockOwner {
     pid: number;
     host: string;
@@ -22,6 +26,9 @@ export interface StartTokenProbe {
     self: string | null;
     of: (pid: number) => string | null;
     platform?: NodeJS.Platform;
+    /** When the process now holding `pid` was created (wall-clock ms), or null.
+     *  Defaults to the OS probe `processStartedAt`. */
+    startedAt?: (pid: number) => number | null;
 }
 export declare class WriteLockTimeout extends Error {
     readonly path: string;

package/dist/serve/writelock.js

@@ -10,7 +10,10 @@
  * stealable once its owner is provably gone (pid dead — or RECYCLED — on the same
  * host) or older than any plausible write. "Recycled" is decided by comparing the
  * owner's recorded process-instance token with the current holder's, by string
- * equality and never by clock arithmetic (see core/procstart.ts). Removing a stale
+ * equality and never by clock arithmetic (see core/procstart.ts). Where no token can
+ * compare them (macOS, Windows, legacy records) a stale-looking lock whose live pid
+ * belongs to a process CREATED after the lock's recorded `at` is taken over too: that
+ * process cannot be the one that took it (issue #287). Removing a stale
  * lock is itself serialized behind an exclusive `.reclaim` claim directory, because
  * judging and removing are two steps and two contenders can otherwise both "win"
  * (see `takeOver`).
@@ -19,7 +22,7 @@ import { hostname } from "node:os";
 import { randomBytes } from "node:crypto";
 import { closeSync, mkdirSync, openSync, readFileSync, rmSync, rmdirSync, statSync, writeSync } from "node:fs";
 import { join } from "node:path";
-import { heldLockNonces, judgeSameHostOwner, selfStartToken, startTokenOf } from "../core/procstart.js";
+import { heldLockNonces, judgeSameHostOwner, processStartedAt, selfStartToken, startTokenOf } from "../core/procstart.js";
 /** Longest a write may hold the lock before another process may steal it: a put plus a
  *  git commit and push — seconds, not minutes. */
 export const STALE_AFTER_MS = 60_000;
@@ -30,6 +33,10 @@ export const ACQUIRE_TIMEOUT_MS = 10_000;
  *  crashed inside it. */
 export const CLAIM_STALE_MS = 10_000;
 const POLL_MS = 25;
+/** How much later than the lock's recorded `at` the pid's current process must
+ *  have been created before it is proven not to be the owner. A genuine owner
+ *  started BEFORE it took the lock; the slack only absorbs clock granularity. */
+export const CREATED_AFTER_SLACK_MS = 5_000;
 export class WriteLockTimeout extends Error {
     path;
     heldBy;
@@ -109,11 +116,22 @@ function stealable(path, owner, now, token) {
             selfPid: process.pid,
             heldNonces: heldLockNonces,
         });
+        if (verdict === "unproven")
+            return ageMs > STALE_AFTER_MS && createdAfterLock(owner, token);
         if (verdict !== "age")
             return verdict === "stale";
     }
     return ageMs > STALE_AFTER_MS;
 }
+/** Is the process now holding the owner's pid provably newer than the lock?
+ *  Unreadable either way means not proven, and a live pid keeps its lock. */
+function createdAfterLock(owner, token) {
+    const at = Date.parse(owner.at);
+    if (!Number.isFinite(at))
+        return false;
+    const started = (token.startedAt ?? processStartedAt)(owner.pid);
+    return started !== null && started > at + CREATED_AFTER_SLACK_MS;
+}
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 /** The claim a contender must hold to REMOVE a stale lock. A sibling directory,
  *  created with the same exclusive `mkdir` the commit lock uses
@@ -204,7 +222,16 @@ function takeOver(path, token) {
 export async function withWriteLock(hunchDir, fn, opts = {}) {
     const path = writeLockPath(hunchDir);
     const timeoutMs = opts.timeoutMs ?? ACQUIRE_TIMEOUT_MS;
-    const token = opts.startToken ?? { self: selfStartToken(), of: startTokenOf };
+    const probe = opts.startToken ?? { self: selfStartToken(), of: startTokenOf };
+    // The creation-time probe spawns; ask it once per pid for this acquisition, not
+    // on every poll.
+    const createdAt = new Map();
+    const startedAt = probe.startedAt ?? processStartedAt;
+    const token = { ...probe, startedAt: (pid) => {
+            if (!createdAt.has(pid))
+                createdAt.set(pid, startedAt(pid));
+            return createdAt.get(pid);
+        } };
     const nonce = randomBytes(8).toString("hex");
     const started = Date.now();
     let fd;

package/dist/store/changeLedger.d.ts

@@ -127,8 +127,11 @@ export declare function compactLedger(hunchDir: string, scope: Scope, opts?: {
 };
 /** Three-way merge of one scope's ledger, for the git merge driver: two clones that both
  *  appended to the same partition. The union of events is kept (identity = what changed, to
- *  which hash, when, by whom), ordered by time then ours-before-theirs, and RE-SEQUENCED from
- *  the higher floor. When that renumbering moves an event either side had already published,
+ *  which hash, when, by whom), interleaved so each side keeps its own order (see `interleave`;
+ *  the result does not depend on which side is "ours"), and RE-SEQUENCED from the higher floor.
+ *  Two sides that published opposite orders (left by the side-biased merge before #361) are
+ *  resolved by (time, identity), never a conflict: that moves published seqs, so the floor
+ *  rule below makes every subscriber resynchronize onto the one merged order. When that renumbering moves an event either side had already published,
  *  no pre-merge cursor of EITHER side can be trusted — a cursor could otherwise sit above an
  *  event that now holds a lower seq and never see it (issue #285). The floor is then raised
  *  past BOTH pre-merge heads, so every such cursor satisfies subscribe's `after_seq <

package/dist/store/changeLedger.js

@@ -149,10 +149,79 @@ export function compactLedger(hunchDir, scope, opts = {}) {
     return { dropped, floor_seq: ledger.floor_seq, head_seq: ledger.head_seq };
 }
 const eventIdentity = (e) => [e.change, e.facet, e.record_id, e.record_hash, e.at, e.cause ? JSON.stringify(e.cause) : ""].join("|");
+/** A total order: by instant (so `...:09Z`, `...:09.500Z` and `+02:00` offsets compare as
+ *  times, not text), unparseable `at` after every parseable one, then `at` text, then identity. */
+const byTimeThenIdentity = (a, b) => {
+    const ta = Date.parse(a.at), tb = Date.parse(b.at);
+    if (Number.isNaN(ta) !== Number.isNaN(tb))
+        return Number.isNaN(ta) ? 1 : -1;
+    if (!Number.isNaN(ta) && ta !== tb)
+        return ta < tb ? -1 : 1;
+    if (a.at !== b.at)
+        return a.at < b.at ? -1 : 1;
+    const ka = eventIdentity(a), kb = eventIdentity(b);
+    return ka < kb ? -1 : ka > kb ? 1 : 0;
+};
+/** Interleave two event sequences without reordering either (issue #361). Each side's order
+ *  is history it already published — a batch, or successive updates to one record — so it is
+ *  kept; only events neither side orders relative to each other are placed by (time, identity).
+ *  Every rule is mirrored, so swapping the sides yields the same sequence: merge(A,B) and
+ *  merge(B,A) agree, and re-merging their results renumbers nothing. Where the two sides
+ *  order a pair oppositely — clones an older, side-biased merge already left diverged — the
+ *  same (time, identity) rule decides, so even they converge on one order. */
+function interleave(a, b) {
+    const posA = new Map(a.map((e, i) => [eventIdentity(e), i]));
+    const posB = new Map(b.map((e, i) => [eventIdentity(e), i]));
+    const emitted = new Set();
+    const out = [];
+    const emit = (e) => { emitted.add(eventIdentity(e)); out.push(e); };
+    let i = 0, j = 0;
+    for (;;) {
+        while (i < a.length && emitted.has(eventIdentity(a[i])))
+            i++;
+        while (j < b.length && emitted.has(eventIdentity(b[j])))
+            j++;
+        if (i >= a.length) {
+            for (; j < b.length; j++)
+                if (!emitted.has(eventIdentity(b[j])))
+                    emit(b[j]);
+            break;
+        }
+        if (j >= b.length) {
+            for (; i < a.length; i++)
+                if (!emitted.has(eventIdentity(a[i])))
+                    emit(a[i]);
+            break;
+        }
+        const x = a[i], y = b[j];
+        const kx = eventIdentity(x), ky = eventIdentity(y);
+        if (kx === ky) {
+            emit(x);
+            continue;
+        }
+        const xLaterInB = (posB.get(kx) ?? -1) > j; // b orders y before x
+        const yLaterInA = (posA.get(ky) ?? -1) > i; // a orders x before y
+        if (xLaterInB && !yLaterInA)
+            emit(y);
+        else if (yLaterInA && !xLaterInB)
+            emit(x);
+        else
+            emit(byTimeThenIdentity(x, y) <= 0 ? x : y);
+    }
+    return out;
+}
+function uniqueByIdentity(events) {
+    const seen = new Set();
+    return events.filter((e) => { const k = eventIdentity(e); if (seen.has(k))
+        return false; seen.add(k); return true; });
+}
 /** Three-way merge of one scope's ledger, for the git merge driver: two clones that both
  *  appended to the same partition. The union of events is kept (identity = what changed, to
- *  which hash, when, by whom), ordered by time then ours-before-theirs, and RE-SEQUENCED from
- *  the higher floor. When that renumbering moves an event either side had already published,
+ *  which hash, when, by whom), interleaved so each side keeps its own order (see `interleave`;
+ *  the result does not depend on which side is "ours"), and RE-SEQUENCED from the higher floor.
+ *  Two sides that published opposite orders (left by the side-biased merge before #361) are
+ *  resolved by (time, identity), never a conflict: that moves published seqs, so the floor
+ *  rule below makes every subscriber resynchronize onto the one merged order. When that renumbering moves an event either side had already published,
  *  no pre-merge cursor of EITHER side can be trusted — a cursor could otherwise sit above an
  *  event that now holds a lower seq and never see it (issue #285). The floor is then raised
  *  past BOTH pre-merge heads, so every such cursor satisfies subscribe's `after_seq <
@@ -164,47 +233,29 @@ const eventIdentity = (e) => [e.change, e.facet, e.record_id, e.record_hash, e.a
 export function mergeLedgers(base, ours, theirs) {
     if (scopePath(ours.scope) !== scopePath(theirs.scope))
         throw new Error("ledgers for different scopes cannot be merged");
-    const seen = new Map();
-    const order = [];
-    const add = (e) => { const k = eventIdentity(e); if (!seen.has(k)) {
-        seen.set(k, e);
-        order.push(e);
-    } };
-    const ourIdentities = new Set(ours.events.map(eventIdentity));
-    const theirIdentities = new Set(theirs.events.map(eventIdentity));
-    // Base is a merge ancestor, not a source of history both clones have compacted away.
-    for (const e of base?.events ?? []) {
+    const oursEvents = uniqueByIdentity(ours.events);
+    const theirsEvents = uniqueByIdentity(theirs.events);
+    const ourIdentities = new Set(oursEvents.map(eventIdentity));
+    const theirIdentities = new Set(theirsEvents.map(eventIdentity));
+    // Base is a merge ancestor, not a source of history both clones have compacted away: it adds
+    // only events neither side holds that are still above both floors.
+    const baseOnly = uniqueByIdentity((base?.events ?? []).filter((e) => {
         const key = eventIdentity(e);
-        if (ourIdentities.has(key) || theirIdentities.has(key) || (e.seq > ours.floor_seq && e.seq > theirs.floor_seq))
-            add(e);
-    }
-    for (const e of ours.events)
-        add(e);
-    for (const e of theirs.events)
-        add(e);
-    // The tiebreak is "ours before theirs", so only an event theirs ALONE contributed sorts late:
-    // side 1 iff theirs holds it and neither ours nor base does. Deciding by object identity
-    // (`includes`) would instead put anything ours compacted away — base's object, which `add`
-    // keeps — after its same-`at` siblings and silently reorder a batch both sides already had.
-    const baseIdentities = new Set((base?.events ?? []).map(eventIdentity));
-    const theirsOnly = (e) => {
-        const k = eventIdentity(e);
-        return !ourIdentities.has(k) && !baseIdentities.has(k);
-    };
-    const ranked = order.map((e, i) => ({ e, i, side: (theirsOnly(e) ? 1 : 0) }));
-    ranked.sort((a, b) => a.e.at.localeCompare(b.e.at) || a.side - b.side || a.i - b.i);
-    const theirSeqs = new Map(theirs.events.map((e) => [eventIdentity(e), e.seq]));
-    const ourSeqs = new Map(ours.events.map((e) => [eventIdentity(e), e.seq]));
+        return !ourIdentities.has(key) && !theirIdentities.has(key) && e.seq > ours.floor_seq && e.seq > theirs.floor_seq;
+    }));
+    const merged = interleave(interleave(oursEvents, theirsEvents), baseOnly);
+    const conflicts = [];
+    const theirSeqs = new Map(theirsEvents.map((e) => [eventIdentity(e), e.seq]));
+    const ourSeqs = new Map(oursEvents.map((e) => [eventIdentity(e), e.seq]));
     let floor = Math.max(base?.floor_seq ?? 0, ours.floor_seq, theirs.floor_seq);
-    const renumbers = ranked.some(({ e }, i) => {
+    const renumbers = merged.some((e, i) => {
         const k = eventIdentity(e);
-        const merged = floor + i + 1;
-        return (ourSeqs.get(k) ?? merged) !== merged || (theirSeqs.get(k) ?? merged) !== merged;
+        const seq = floor + i + 1;
+        return (ourSeqs.get(k) ?? seq) !== seq || (theirSeqs.get(k) ?? seq) !== seq;
     });
     if (renumbers)
         floor = Math.max(floor, Math.max(ours.head_seq, theirs.head_seq) + 1);
-    const events = ranked.map(({ e }, i) => ({ ...e, seq: floor + i + 1 }));
-    const conflicts = [];
+    const events = merged.map((e, i) => ({ ...e, seq: floor + i + 1 }));
     const idempotency = { ...(base?.idempotency ?? {}), ...theirs.idempotency, ...ours.idempotency };
     for (const [key, entry] of Object.entries(theirs.idempotency)) {
         const mine = ours.idempotency[key];

package/dist/store/hunchStore.js

@@ -202,7 +202,10 @@ export class HunchStore {
      *  that re-registers it. Never auto-re-registered: the pointer may be repository content. */
     unregisteredPointerMessage(dir) {
         const { mode, autoCommit } = this.ignoredLocalPointerSetup;
-        const quoted = /^[\w@%+=:,./-]+$/.test(dir) ? dir : JSON.stringify(dir);
+        // A Windows drive path is shown with forward slashes: it means the same path to Hunch and
+        // pastes unquoted into bash, PowerShell and cmd. JSON quoting would double every backslash.
+        const shown = /^[a-z]:\\/i.test(dir) ? dir.replace(/\\/g, "/") : dir;
+        const quoted = /^[\w@%+=:,./-]+$/.test(shown) ? shown : JSON.stringify(shown);
         const command = `hunch ${mode === "shared" ? "shared" : "private"} ${quoted}${autoCommit === false ? " --no-auto-commit" : ""}`;
         return `.hunch/local.json names a memory store at ${dir} that this machine's setup has not registered in the git common dir, ` +
             "so Hunch refuses to open this repository's memory rather than silently writing captures to the public .hunch/. " +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.43.0",
+  "version": "1.45.0",
   "mcpName": "io.github.davesheffer/hunch",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
@@ -44,7 +44,6 @@
     "contracts/change-proof/*.json",
     "server.json",
     "bench/constitution-exp03-v1.json",
-    "tooling/competitive-watch.mjs",
     "tooling/md1-benchmark.mjs",
     "LICENSE",
     "NOTICE"
@@ -91,16 +90,14 @@
     "site:proof": "npm run build && node tooling/generate-public-proof.mjs",
     "site:sitemap": "node tooling/generate-sitemap.mjs",
     "bench:md1": "node tooling/md1-benchmark.mjs",
-    "research:competitors": "node tooling/competitive-watch.mjs",
-    "outreach": "node tooling/outreach-pipeline.mjs",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "@tree-sitter-grammars/tree-sitter-yaml": "^0.6.1",
     "commander": "^15.0.0",
     "cross-spawn": "^7.0.6",
-    "smol-toml": "1.8.0",
+    "smol-toml": "1.9.0",
     "tree-sitter": "0.21.1",
     "tree-sitter-go": "^0.23.4",
     "tree-sitter-php": "0.23.12",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://www.hunchmemory.com",
-  "version": "1.43.0",
+  "version": "1.45.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@davesheffer/hunch",
-      "version": "1.43.0",
+      "version": "1.45.0",
       "runtimeHint": "npx",
       "packageArguments": [
         {

package/tooling/md1-benchmark.mjs

@@ -18,7 +18,7 @@ import { dirname, join, resolve } from "node:path";
 import process from "node:process";
 import { fileURLToPath } from "node:url";
 
-export const BENCHMARK_BASELINE_REF = "610cd2e5673bf3c69ac984b4737e2d4a749ed374";
+export const BENCHMARK_BASELINE_REF = "a1ad6d89631cce7c194f3f679abf7ed4e56d13e3";
 export const BENCHMARK_SCHEMA = "hunch.md1a.performance.v1";
 
 const projectRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");