@fenglimg/fabric-shared 2.2.0 → 2.3.0-rc.10

package/dist/index.js

@@ -7,7 +7,8 @@ import {
   BOOTSTRAP_REGEX,
   matchBootstrapCanonicalLocale,
   resolveBootstrapCanonical
-} from "./chunk-BDJQIOQO.js";
+} from "./chunk-KFFBQRL5.js";
+import "./chunk-LXNCAKJZ.js";
 import {
   PROTECTED_TOKENS,
   createTranslator,
@@ -15,7 +16,7 @@ import {
   enMessages,
   resolveFabricLocale,
   zhCNMessages
-} from "./chunk-AQMDXC6J.js";
+} from "./chunk-XRX6RVZY.js";
 import {
   GLOBAL_BINDINGS_DIR,
   GLOBAL_STATE_DIR,
@@ -50,7 +51,7 @@ import {
   storeRelativePath,
   storeRelativePathForMount,
   storeUuidSchema
-} from "./chunk-2GLIAZ5M.js";
+} from "./chunk-ASS2KBB7.js";
 import {
   atomicWriteJson,
   withFileLock
@@ -59,6 +60,10 @@ import {
   FabExtractKnowledgeInputSchema,
   FabExtractKnowledgeInputShape,
   FabExtractKnowledgeOutputSchema,
+  FabPendingInputSchema,
+  FabPendingInputShape,
+  FabPendingOutputSchema,
+  FabPendingOutputShape,
   FabReviewInputSchema,
   FabReviewInputShape,
   FabReviewOutputSchema,
@@ -74,6 +79,7 @@ import {
   PERSONAL_SCOPE,
   PROPOSED_REASON_DESCRIPTIONS_BY_LOCALE,
   ProposedReasonSchema,
+  SCOPE_COORDINATE_HINT,
   SCOPE_COORDINATE_PATTERN,
   StableIdSchema,
   annotateIntentRequestSchema,
@@ -85,6 +91,7 @@ import {
   citeLayerTypeBreakdownSchema,
   entryScopeMetadataSchema,
   fabExtractKnowledgeAnnotations,
+  fabPendingAnnotations,
   fabReviewAnnotations,
   formatKnowledgeId,
   historyStateQuerySchema,
@@ -109,8 +116,7 @@ import {
   scopeCoordinateSchema,
   scopeRoot,
   structuredWarningSchema
-} from "./chunk-5AKCRBKJ.js";
-import "./chunk-LXNCAKJZ.js";
+} from "./chunk-TV264D7E.js";
 
 // src/schemas/agents-meta.ts
 import { z } from "zod";
@@ -132,7 +138,6 @@ var ruleDescriptionSchema = z.object({
   tech_stack: z.array(z.string()),
   impact: z.array(z.string()),
   must_read_if: z.string(),
-  entities: z.array(z.string()).optional(),
   // v2.0 knowledge entry fields (TASK-002 schemas). All optional for backward compat.
   id: z.string().optional(),
   // rc.31 NEW-1: forward-compat for legacy on-disk agents.meta.json carrying
@@ -145,8 +150,8 @@ var ruleDescriptionSchema = z.object({
     z.enum(["models", "decisions", "guidelines", "pitfalls", "processes"])
   ).optional(),
   maturity: z.enum(["draft", "verified", "proven"]).optional(),
-  knowledge_layer: z.enum(["personal", "team"]).optional(),
-  layer_reason: z.string().optional(),
+  // W4/Track1: `knowledge_layer` removed — an entry's layer is derived from its
+  // stable_id prefix (KP-→personal, else team; KT-DEC-0004), never a field.
   created_at: z.string().optional(),
   // v2/rc.2: flat flow-style YAML array; populated by init-scan from forensic tech stack and editable by user. Used by rc.3 review skill for tag-filter search.
   tags: z.array(z.string()).default([]).optional(),
@@ -349,6 +354,32 @@ var humanLockFileSchema = z4.object({
 
 // src/schemas/fabric-config.ts
 import { z as z5 } from "zod";
+function isNonPersonalRequiredStore(entry) {
+  return entry.id !== PERSONAL_STORE_SENTINEL;
+}
+function refineMaxOneTeamStore(entries, ctx) {
+  const teamCount = entries.filter(isNonPersonalRequiredStore).length;
+  if (teamCount > 1) {
+    ctx.addIssue({
+      code: z5.ZodIssueCode.custom,
+      message: `a project may bind at most one team store (found ${teamCount}); run \`fabric install\` to migrate to the single team slot`
+    });
+  }
+}
+function migrateRequiredStores(config) {
+  const declared = config.required_stores;
+  if (declared === void 0) {
+    return config;
+  }
+  const team = declared.filter(isNonPersonalRequiredStore);
+  if (team.length <= 1) {
+    return config;
+  }
+  const personal = declared.filter((entry) => !isNonPersonalRequiredStore(entry));
+  const active = config.active_write_store;
+  const kept = (active !== void 0 ? team.find((entry) => entry.id === active) : void 0) ?? team[0];
+  return { ...config, required_stores: [...personal, kept] };
+}
 var auditModeSchema = z5.enum(["strict", "warn", "off"]);
 var clientPathsSchema = z5.object({
   claudeCodeCLI: z5.string().optional(),
@@ -395,7 +426,9 @@ var fabricConfigSchema = z5.object({
   // `$personal` sentinel). Drives the read-set (required_stores ∪ implicit
   // personal, S11/S54) and `clone`'s missing-store onboarding (S51). Optional
   // + absent → read-set is just the implicit personal store.
-  required_stores: z5.array(requiredStoreEntrySchema).optional(),
+  // W2 dual-slot (TASK-002 / R6): at most ONE non-personal (team-type) store —
+  // the two-slot model. >1 fails parse and is migrated by `migrateRequiredStores`.
+  required_stores: z5.array(requiredStoreEntrySchema).superRefine(refineMaxOneTeamStore).optional(),
   // v2.1.0-rc.1 P3 (S60 / `store switch-write`): alias of the store that
   // non-personal-scope writes land in for this project. Set by
   // `fabric store switch-write <alias>`; consumed as the resolver's
@@ -494,92 +527,28 @@ var fabricConfigSchema = z5.object({
   // worst — pairing 14d trigger + 7d cooldown means at most ~2 reminders
   // per month for a workspace that ignores them.
   maintenance_hint_cooldown_days: z5.number().int().positive().optional().default(7),
-  // rc.9+ (skill-contract-fix B1): first-run import window in months. The
-  // `fabric-import` skill scans this many months of git history on the very
-  // first invocation (when no prior `import_run_completed` event exists).
-  // Default 60 (~5 years) captures the bulk of a mature repo's signal in
-  // one pass; small / fresh repos can lower to 12-24 with no loss.
-  import_window_first_run_months: z5.number().int().min(1).optional().default(60),
-  // rc.9+ (skill-contract-fix B1): rerun import window in months. After
-  // the first successful import, subsequent runs only scan this many
-  // recent months — assumed everything older has already been crystallized
-  // into pending or canonical knowledge. Default 2 keeps incremental cost
-  // low; raise to 6 if the workspace pauses fabric-import for long stretches.
-  import_window_rerun_months: z5.number().int().min(1).optional().default(2),
-  // rc.9+ (skill-contract-fix B1): hard cap on pending entries produced
-  // per fabric-import invocation. Prevents one run from dumping hundreds
-  // of proposals when a backfill window is wide open. Default 10 matches
-  // the rule-of-thumb "human can triage ~10 pending entries in one
-  // review pass." Range 1-50.
-  import_max_pending_per_run: z5.number().int().min(1).max(50).optional().default(10),
-  // rc.9+ (skill-contract-fix B1): hard cap on commits scanned per
-  // fabric-import invocation. Bounds runtime on monorepos with high
-  // commit velocity. Default 500 covers ~2 months of typical churn;
-  // range 50-2000. Hitting the cap mid-window is logged but non-fatal.
-  import_max_commits_scan: z5.number().int().min(50).max(2e3).optional().default(500),
-  // rc.9+ (skill-contract-fix B1): canonical-node count above which
-  // fabric-import's pre-flight should warn / suggest review instead of
-  // proceeding. A workspace with 50+ canonical entries usually benefits
-  // more from `fabric-review` to consolidate than from importing more.
-  // Default 50; raise to 100+ for large polyglot repos.
-  import_skip_canonical_threshold: z5.number().int().positive().optional().default(50),
-  // rc.9+ (skill-contract-fix B1): max candidate entries surfaced per
-  // fabric-archive batch (one invocation of the skill). Pagination knob
-  // for the archive UI flow. Default 8 keeps each batch reviewable in
-  // one sitting; raise for large repos with high archive throughput.
-  archive_max_candidates_per_batch: z5.number().int().positive().optional().default(8),
-  // rc.9+ (skill-contract-fix B1): max recently-touched paths included
-  // in fabric-archive's "relevant context" lookup. Limits the size of
-  // the path-relevance digest the skill emits when ranking candidates.
-  // Default 20; large repos with deep directory fan-out can raise to
-  // 50+ if archive candidates feel under-contextualized.
-  archive_max_recent_paths: z5.number().int().positive().optional().default(20),
-  // rc.9+ (skill-contract-fix B1): max prior fabric-archive sessions
-  // summarised in the digest the skill loads on start. Prevents the
-  // digest from ballooning past the model context budget on workspaces
-  // that have archived repeatedly. Default 10; lower if context pressure
-  // bites, raise if you want longer-range archive trend visibility.
-  archive_digest_max_sessions: z5.number().int().positive().optional().default(10),
-  // rc.9+ (skill-contract-fix B1): max review results returned per
-  // topic when `fabric-review` clusters pending entries. Pagination
-  // knob analogous to archive_max_candidates_per_batch but scoped to
-  // each topic cluster. Default 8; raise to 15-20 for large repos
-  // where each topic legitimately groups many pending entries.
-  review_topic_result_cap: z5.number().int().positive().optional().default(8),
+  // ux-w2-3: import_*/archive_max_*/review_topic_result_cap skill thresholds
+  // were hardcoded (✂ per census Table 1) — never tuned, pure skill-internal
+  // pagination/window caps. Removed from the schema; the skills/services read
+  // raw config with a built-in default, so an absent key falls to that default
+  // (60/2/10/500/50/8/20/10/8 respectively). Lenient parser drops any stale
+  // on-disk value.
   // rc.9+ (skill-contract-fix B1): age threshold (in days) above which
   // a pending entry is considered "stale" by fabric-review and surfaced
   // for explicit resolve-or-drop decision. Default 14; tighter than the
   // 7d Signal-B trigger because review specifically targets the long
   // tail. Large repos with slower cadence can raise to 30.
   review_stale_pending_days: z5.number().int().positive().optional().default(14),
-  // v2.0.0-rc.34 TASK-05: reverse-unarchive opt-in. When true, callers of the
-  // `unarchiveKnowledge` primitive (and any future doctor auto-detect lint built
-  // on top) will execute the file move + ledger emit. When false (default),
-  // the same callers MUST short-circuit before any mutation — the primitive is
-  // shipped but inert until explicitly enabled. Opt-in posture mirrors the
-  // archive-flow precedent: destructive-ish file moves stay behind a flag.
-  reverse_unarchive_enabled: z5.boolean().optional().default(false),
-  // v2.0.0-rc.34 TASK-05: forces `unarchiveKnowledge` into dry-run mode even
-  // when called with `options.dryRun=false`. Lets operators preview a
-  // restoration pass before flipping `reverse_unarchive_enabled` to true.
-  reverse_unarchive_dry_run: z5.boolean().optional().default(false),
-  // v2.0.0-rc.34 TASK-06: long-session cite-policy evict window in user-prompt
-  // turns. UserPromptSubmit hook (Claude Code only) maintains a per-session
-  // counter and re-injects the cite contract reminder via
-  // hookSpecificOutput.additionalContext when `turn_count % interval === 0`.
-  // Default 0 = OFF (opt-in). Recommend 10-20 for active sessions; 5 for
-  // high-contract-criticality projects. Other strategies (time-based,
-  // token-budget) deferred to rc.35 per plan locked-decisions 2026-05-26.
-  cite_evict_interval: z5.number().int().min(0).optional().default(0),
   // v2.1 ⑤ cite-redesign (P5): recall-based cite-accounting hook config. The
-  // rc.34 cite_evict_interval turn-counter above is superseded by the
-  // PreToolUse(Edit/Write) recall-aware nudge in cite-policy-evict.cjs; the old
-  // key is retained for back-compat (inert now that the hook moved off
-  // UserPromptSubmit). `cite_recall_nudge` is the master switch (default true =
-  // ON); set false to silence the "改前先 fab_recall" nudge entirely (mirrors
-  // the cite_evict_interval=0 opt-out convention). `cite_recall_window_minutes`
-  // bounds how far back an in-session fab_recall counts as "informing" the edit
-  // (default 30; 0 = unbounded).
+  // PreToolUse(Edit/Write) recall-aware nudge in cite-policy-evict.cjs replaced
+  // the retired rc.34 `cite_evict_interval` turn-counter. ux-w1-5: that inert
+  // key — plus the never-wired `reverse_unarchive_enabled`/`reverse_unarchive_dry_run`
+  // opt-in flags (the unarchiveKnowledge primitive takes dryRun from its caller,
+  // not from config) — were deleted; the lenient root parser drops any stale
+  // value left in an on-disk config. `cite_recall_nudge` is the master switch
+  // (default true = ON); set false to silence the "改前先 fab_recall" nudge
+  // entirely. `cite_recall_window_minutes` bounds how far back an in-session
+  // fab_recall counts as "informing" the edit (default 30; 0 = unbounded).
   cite_recall_nudge: z5.boolean().optional().default(true),
   cite_recall_window_minutes: z5.number().int().min(0).optional().default(30),
   // F2: glob exemptions for the cite nudge (cite-policy-evict.cjs). Edit paths
@@ -625,18 +594,11 @@ var fabricConfigSchema = z5.object({
   // Default `[]` keeps the field optional on existing configs — fresh
   // installs land with no opt-outs.
   onboard_slots_opted_out: z5.array(z5.string()).optional().default([]),
-  // v2.0.0-rc.33 W2-1 (P0-9): TopK upper bound for the broad SessionStart hint
-  // banner emitted by knowledge-hint-broad.cjs. After plan-context-hint returns
-  // its full broad-scoped index, the hook slices the entries to this many
-  // before grouping/truncation rendering — keeps the banner from scrolling off
-  // screen on well-seeded repos (Werewolf-class projects routinely surface 40+
-  // broad entries which buried the actually-relevant top hits). Default 8 is
-  // calibrated against the rc.32 eval baseline (cite-coverage 3.1%): the
-  // banner needs to fit in ~1 screenful so the agent actually reads it.
-  // Range 1..50; values above 20 effectively disable the cap because the
-  // TRUNCATION_THRESHOLD=12 grouped-render kicks in. Mirrors the rc.7 T7 +
-  // archive_max_* pattern of externalizing previously-hardcoded thresholds.
-  hint_broad_top_k: z5.number().int().min(1).max(50).optional().default(8),
+  // ux-w3-j (W3-J): `hint_broad_top_k` was deleted. W2-1 (KT-DEC-0028) retired its
+  // hard-cap function — the SessionStart broad banner now shows EVERY broad entry
+  // and `broad_index_backstop` (below) is the sole scale guard; the field had been
+  // inert ever since (its only remaining refs were retirement comments). The lenient
+  // root parser drops any stale on-disk value (zero migration).
   // KT-DEC-0036: the SessionStart broad-menu is now index-only (title + summary
   // per always-active entry, no eager body), so the former `hint_broad_budget_chars`
   // body char-budget knob was retired — there is no rendered body left to bound.
@@ -649,12 +611,37 @@ var fabricConfigSchema = z5.object({
   // banner silently truncates. Default 50; range 20..500 (read inline by
   // knowledge-hint-broad.cjs#readBroadIndexBackstop with the same bounds).
   broad_index_backstop: z5.number().int().min(20).max(500).optional().default(50),
-  // v2.0.0-rc.37 NEW-16: durable per-signal dismiss for the fabric-hint Stop
-  // hook nudges. Any signal type listed here is suppressed at emit time across
+  // v2.0.0-rc.37 NEW-16: durable per-signal dismiss for the fabric-hint hook
+  // nudges. Any signal type listed here is suppressed at emit time across
   // all sessions (the session-scoped sibling lives in a .fabric/.cache sidecar
   // written on request). Mirrors the cite_evict_interval=0 opt-out convention —
   // a knob for an existing surface, not a new feature. Unknown types ignored.
-  hint_dismiss_signals: z5.array(z5.enum(["archive", "review", "import", "maintenance"])).optional(),
+  //
+  // TASK-005 (grill G5 / C-004 "全 nudge MUST 可 dismiss"): the enum now spans
+  // ALL nudge surfaces, not just the fabric-hint Stop signals:
+  //   - Stop (fabric-hint):        archive / review / import / maintenance
+  //   - SessionStart (broad):      review / import / maintenance now surface as
+  //                                the SessionStart summary line (see
+  //                                buildSessionStartSinks H4 ladder) — the same
+  //                                dismiss key silences them there too.
+  //   - PreToolUse (per-edit):     "narrow" (knowledge-hint-narrow) and
+  //                                "cite-evict" (cite-before-edit nudge).
+  // C-004 semantics are enforced at the trigger sites, NOT here: "narrow"
+  // defaults ON (impact-bearing) and "cite-evict" defaults OFF-able; listing
+  // either key here is the durable opt-out. Adding enum values is backward
+  // compatible — legacy configs that omit the new keys parse unchanged, and
+  // unknown on-disk values are dropped by the lenient root parser.
+  hint_dismiss_signals: z5.array(
+    z5.enum([
+      "archive",
+      "review",
+      "import",
+      "maintenance",
+      // per-edit (PreToolUse) nudge surfaces — TASK-005
+      "narrow",
+      "cite-evict"
+    ])
+  ).optional(),
   // v2.1 ADJ-NEWN-4: user-override escape hatches for the two strong behavioral
   // policies (cite-before-edit + self-archive). The strong policies can make an
   // agent feel like a "stubborn parrot" (D2 user-in-control red line); these
@@ -714,6 +701,36 @@ var fabricConfigSchema = z5.object({
   orphan_demote_proven_days: z5.number().int().min(1).max(3650).optional(),
   orphan_demote_verified_days: z5.number().int().min(1).max(3650).optional(),
   orphan_demote_draft_days: z5.number().int().min(1).max(3650).optional(),
+  // PLN-004 F1 (credibility content-age decay): per-knowledge-type half-lives
+  // (days) for the recall-scoring credibility MULTIPLIER. Orthogonal to the
+  // orphan_demote usage-inactivity ladder above (that is last-activity age; this
+  // is content age off created_at) and to recencyBoost (a 7-day additive
+  // freshness bump). Team-curated knowledge decays slower than transient work, so
+  // defaults run longer than upstream: decisions 180 / guidelines 150 / models
+  // 150 / pitfalls 120 / processes 120 (applied in config-loader). Each optional;
+  // absent → the loader default. Range 1..3650 mirrors orphan_demote.
+  credibility_half_life_decisions_days: z5.number().int().min(1).max(3650).optional(),
+  credibility_half_life_guidelines_days: z5.number().int().min(1).max(3650).optional(),
+  credibility_half_life_models_days: z5.number().int().min(1).max(3650).optional(),
+  credibility_half_life_pitfalls_days: z5.number().int().min(1).max(3650).optional(),
+  credibility_half_life_processes_days: z5.number().int().min(1).max(3650).optional(),
+  // PLN-004 F1: per-maturity floor the credibility multiplier never decays below
+  // (a stale-but-endorsed entry keeps a minimum weight). Higher maturity → higher
+  // floor: draft 0.4 / verified 0.55 / proven 0.7 (config-loader defaults). Range
+  // [0,1]. This is the softened form of the "content leads structural" invariant —
+  // credibility may sink a stale match but never zero it.
+  credibility_floor_draft: z5.number().min(0).max(1).optional(),
+  credibility_floor_verified: z5.number().min(0).max(1).optional(),
+  credibility_floor_proven: z5.number().min(0).max(1).optional(),
+  // v2.2 C1 (processes/maturity-promotion-rubric-v1): days a `broad` entry may
+  // go without a fab-review re-confirmation before doctor surfaces a RECHECK
+  // nudge. `broad` is EXEMPT from usage-age decay (it is SessionStart-pushed,
+  // never pull-recalled → usage-blind, KT-DEC; see doctor-knowledge-age.ts), so
+  // its continued validity is instead checked against the review-confirmation
+  // clock (`last_review_confirmed_at`, stamped at approve/modify). This is a
+  // non-blocking INFO nudge ("re-confirm"), NEVER an auto-demote. Absent → the
+  // config-loader default (180d) applies. Range 1..3650 mirrors orphan_demote.
+  broad_review_recheck_days: z5.number().int().min(1).max(3650).optional(),
   // v2.0.0-rc.33 W4-A3 (T4 P2): per-entry summary truncation length used by
   // knowledge-hint-{broad,narrow}.cjs. Hard-coded at 80 chars in rc.32 — too
   // short for entries with parameterized summaries (e.g. "Use bcrypt with
@@ -762,10 +779,13 @@ var fabricConfigSchema = z5.object({
   // sole retrieval knob (plan_context_top_k above); payload limits pass through
   // explicit `mcpPayloadLimits`, else the fixed PAYLOAD_LIMIT_DEFAULT_* guardrail.
   // v2.2 C2-vector (W2-T7): OPTIONAL dense-embedding semantic retrieval, layered
-  // as a recall supplement after BM25. Default OFF (`--no-embed` is the baseline);
-  // requires the operator to install the optional `fastembed` package — absent →
-  // text-only fallback. Never grows the default install footprint.
-  embed_enabled: z5.boolean().optional().default(false),
+  // as a recall supplement after BM25. P1 recall-engine-refactor (TASK-004):
+  // Default ON — `fastembed` is now an optionalDependency (auto-installed; absent →
+  // degrade-safe text-only fallback), so CJK semantic recall is on out of the box.
+  // OFF only when set explicitly to false. This default mirrors the runtime read in
+  // config-loader.ts (`embed_enabled !== false`); keep the two in sync so config
+  // introspection never reports a default that contradicts runtime behavior.
+  embed_enabled: z5.boolean().optional().default(true),
   // Weight applied to the 0..1 cosine similarity before it joins the additive
   // score. Capped at 49 — strictly BELOW BM25_WEIGHT (50) — so a perfect vector
   // match (weight × 1) can never outscore a single strong BM25 term match. This
@@ -790,8 +810,25 @@ var fabricConfigSchema = z5.object({
     "fast-bge-base-en-v1.5",
     "fast-bge-base-en",
     "fast-all-MiniLM-L6-v2"
-  ]).optional().default("fast-bge-small-zh-v1.5")
-});
+  ]).optional().default("fast-bge-small-zh-v1.5"),
+  // P1 recall-engine-refactor (TASK-003 + follow-up): content-channel fusion
+  // strategy. 'additive' = the weighted-sum path (BM25_WEIGHT·bm25 + vectorWeight·
+  // vector + structural); the vector term is structurally minor (cosine·30 vs an
+  // unbounded BM25), so additive is effectively BM25-led. 'rrf' = Reciprocal Rank
+  // Fusion over the two CONTENT channels (bm25_rank, vector_rank, equal footing)
+  // + a re-scaled structural tiebreaker — lets semantic recall actually matter.
+  // 'auto' (DEFAULT) = adaptive: use 'rrf' WHEN the vector channel is actually
+  // producing scores (embeddings installed + model warm), else fall back to
+  // 'additive'. This is the safe default — real-store shadow showed single-channel
+  // rrf (no vectors) is strictly worse than additive, so auto never lets that
+  // happen. no-query ranking is byte-identical under every value.
+  fusion: z5.enum(["additive", "rrf", "auto"]).optional().default("auto")
+});
+var fabricConfigLoadSchema = fabricConfigSchema.merge(
+  z5.object({
+    required_stores: z5.array(requiredStoreEntrySchema).optional()
+  })
+);
 
 // src/schemas/fabric-config-introspect.ts
 import { z as z6 } from "zod";
@@ -956,9 +993,15 @@ var PANEL_FIELDS = [
   // nudge_mode — the master switch for the human-visible nudge experience
   // (the most user-facing runtime knob, previously JSON-only). embed_enabled —
   // vector semantic recall, panel-editable now that config lives in `.fabric`
-  // (A1); enabling also needs the host-side `fabric install --enable-embed`.
+  // (A1). TASK-004: default ON (fastembed is an optionalDependency, degrade-safe
+  // when absent) — this introspection default mirrors the runtime read in
+  // config-loader.ts so the panel never shows a default that contradicts behavior.
   makeEnumField("nudge_mode", "D_behavior", nudgeModeSchema.options, "normal"),
-  makeBooleanField("embed_enabled", false)
+  makeBooleanField("embed_enabled", true),
+  // P1 recall-engine-refactor (follow-up): the content-channel fusion strategy,
+  // panel-editable so it sits next to embed_enabled (the two go together — rrf
+  // only pays off when embeddings are on). 'auto' is the safe adaptive default.
+  makeEnumField("fusion", "D_behavior", ["additive", "rrf", "auto"], "auto")
 ];
 
 // src/schemas/store-stable-id.ts
@@ -1125,6 +1168,13 @@ var storeResolveInputSchema = z9.object({
   ),
   // Alias selected as the active write store for non-personal scopes, if any.
   activeWriteAlias: z9.string().min(1).optional(),
+  // Alias/UUID of the ACTIVE personal store among possibly-many mounted
+  // `personal:true` stores (语义 A: singleton-at-a-time). Drives the SINGLE
+  // personal choke point (findPersonal) → both read-set inclusion and the
+  // personal-scope write-target. Absent or dangling ⇒ the resolver falls back
+  // to the first mounted personal, so legacy single-personal configs are
+  // unchanged. Sourced from `~/.fabric/fabric-global.json` → active_personal_store.
+  activePersonalAlias: z9.string().min(1).optional(),
   // Scope-aware write routes. Exact scope wins first, then longest prefix route.
   writeRoutes: z9.array(
     z9.object({
@@ -1187,7 +1237,16 @@ function createProjectRootResolver() {
 
 // src/resolver/store-resolver.ts
 function findPersonal(input) {
-  return input.mountedStores.find((s) => s.personal);
+  const actives = input.mountedStores.filter((s) => s.personal);
+  if (input.activePersonalAlias !== void 0) {
+    const picked = actives.find(
+      (s) => s.alias === input.activePersonalAlias || s.store_uuid === input.activePersonalAlias
+    );
+    if (picked !== void 0) {
+      return picked;
+    }
+  }
+  return actives[0];
 }
 function personalEntry(input) {
   const p = findPersonal(input);
@@ -1254,7 +1313,7 @@ function createStoreResolver() {
             warnings.push({
               code: "missing_store",
               ref: req.id,
-              message: `required store '${req.id}' is not mounted; run \`fabric store add\` (suggested remote: $personal)`
+              message: `required store '${req.id}' is not mounted; run \`fabric store mount\` (suggested remote: $personal)`
             });
           }
           continue;
@@ -1267,7 +1326,7 @@ function createStoreResolver() {
           warnings.push({
             code: "missing_store",
             ref: req.id,
-            message: `required store '${req.id}' is not mounted; run \`fabric store add\`${suffix}`
+            message: `required store '${req.id}' is not mounted; run \`fabric store mount\`${suffix}`
           });
           continue;
         }
@@ -1313,7 +1372,7 @@ function createStoreResolver() {
             {
               code: "missing_write_route",
               ref: scope,
-              message: `scope '${scope}' has no explicit write route; set \`fabric store route-write ${scope} <alias>\``
+              message: `scope '${scope}' has no explicit write route; set \`fabric store switch-write <alias> --scope ${scope}\``
             }
           ]
         };
@@ -1555,6 +1614,7 @@ import { execFile } from "child_process";
 import { access, mkdir, readdir, readFile as readFile2, writeFile } from "fs/promises";
 import { join as join2 } from "path";
 import { promisify } from "util";
+var STORE_PROJECTS_DIR = "projects";
 var STORE_PENDING_DIR = "pending";
 var STORE_GITIGNORE = [
   "# v2.1 store \u2014 volatile / derived data is never committed",
@@ -1608,12 +1668,28 @@ async function listMarkdown(dir) {
   return entries.filter((name) => name.endsWith(".md")).sort().map((name) => join2(dir, name));
 }
 async function listStoreKnowledge(store) {
+  const knowledgeDir = join2(store.dir, STORE_LAYOUT.knowledgeDir);
   const refs = [];
   for (const type of STORE_KNOWLEDGE_TYPE_DIRS) {
-    for (const file of await listMarkdown(join2(store.dir, STORE_LAYOUT.knowledgeDir, type))) {
+    for (const file of await listMarkdown(join2(knowledgeDir, type))) {
       refs.push({ store_uuid: store.store_uuid, alias: store.alias, type, file });
     }
   }
+  let projectEntries;
+  try {
+    projectEntries = await readdir(join2(knowledgeDir, STORE_PROJECTS_DIR));
+  } catch {
+    return refs;
+  }
+  const reserved = /* @__PURE__ */ new Set([STORE_PROJECTS_DIR, ...STORE_KNOWLEDGE_TYPE_DIRS]);
+  const projectIds = projectEntries.filter((id) => STORE_PROJECT_ID_PATTERN.test(id) && !reserved.has(id)).sort();
+  for (const project of projectIds) {
+    for (const type of STORE_KNOWLEDGE_TYPE_DIRS) {
+      for (const file of await listMarkdown(join2(knowledgeDir, STORE_PROJECTS_DIR, project, type))) {
+        refs.push({ store_uuid: store.store_uuid, alias: store.alias, type, file, project });
+      }
+    }
+  }
   return refs;
 }
 async function readKnowledgeAcrossStores(stores) {
@@ -1776,7 +1852,12 @@ function loadProjectConfig(projectRoot) {
   if (!existsSync3(path)) {
     return null;
   }
-  return fabricConfigSchema.parse(JSON.parse(readFileSync3(path, "utf8")));
+  const raw = JSON.parse(readFileSync3(path, "utf8"));
+  const parsed = fabricConfigSchema.safeParse(raw);
+  if (parsed.success) {
+    return parsed.data;
+  }
+  return fabricConfigLoadSchema.parse(raw);
 }
 function saveProjectConfig(config, projectRoot) {
   const validated = fabricConfigSchema.parse(config);
@@ -1809,6 +1890,7 @@ function buildStoreResolveInput(projectRoot, globalRoot = resolveGlobalRoot()) {
       })
     ),
     ...project?.active_write_store === void 0 ? {} : { activeWriteAlias: project.active_write_store },
+    ...global.active_personal_store === void 0 ? {} : { activePersonalAlias: global.active_personal_store },
     writeRoutes: project?.write_routes ?? [],
     ...project?.default_write_store === void 0 ? {} : { defaultWriteAlias: project.default_write_store }
   };
@@ -2018,7 +2100,7 @@ var MCP_STORE_AWARE_TOOLS = [
   "fab_plan_context",
   "fab_get_knowledge_sections",
   "fab_archive_scan",
-  "fab_extract_knowledge",
+  "fab_propose",
   "fab_review"
 ];
 var storeAwareEntrySchema = z11.object({
@@ -2043,8 +2125,8 @@ var MCP_STORE_AWARE_CONTRACTS = {
     surfacesEntries: false,
     echoesWrittenStore: false
   },
-  fab_extract_knowledge: {
-    tool: "fab_extract_knowledge",
+  fab_propose: {
+    tool: "fab_propose",
     surfacesEntries: false,
     echoesWrittenStore: true
   },
@@ -3217,10 +3299,81 @@ var eventLedgerEventSchema = z16.discriminatedUnion("event_type", [
   graphEdgeCandidateRequestedEventSchema
 ]);
 
+// src/high-value-predicate.ts
+var HIGH_VALUE_ARCHIVE_EVENT_TYPES = /* @__PURE__ */ new Set([
+  "knowledge_context_planned",
+  "edit_paths_recorded",
+  "edit_intent_checked"
+  // the real high-freq edit signal (rc.37 NEW-14/B3)
+]);
+var NORMATIVE_KEYWORDS = [
+  "\u4EE5\u540E",
+  "always",
+  "never",
+  "from now on",
+  "\u4E0B\u6B21",
+  "\u8BB0\u4E00\u4E0B",
+  "\u6C38\u8FDC\u4E0D\u8981"
+];
+function isHighValueArchiveCandidate(events, sessionId, watermarkTs) {
+  if (!Array.isArray(events)) return false;
+  if (typeof sessionId !== "string" || sessionId.length === 0) return false;
+  const wm = typeof watermarkTs === "number" ? watermarkTs : 0;
+  let latestTurn = null;
+  for (const raw of events) {
+    const e = raw;
+    if (!e || typeof e.ts !== "number" || e.ts <= wm) continue;
+    if (e.session_id !== sessionId) continue;
+    if (typeof e.event_type === "string" && HIGH_VALUE_ARCHIVE_EVENT_TYPES.has(e.event_type)) {
+      return true;
+    }
+    if (e.event_type === "assistant_turn_observed") {
+      if (latestTurn === null || typeof latestTurn.ts === "number" && e.ts > latestTurn.ts) {
+        latestTurn = e;
+      }
+    }
+  }
+  if (latestTurn !== null) {
+    const haystack = JSON.stringify(latestTurn).toLowerCase();
+    for (const kw of NORMATIVE_KEYWORDS) {
+      if (haystack.includes(kw.toLowerCase())) return true;
+    }
+  }
+  return false;
+}
+
 // src/text-tokenize.ts
 var CJK_CLASS = "\\u3400-\\u4dbf\\u4e00-\\u9fff\\uf900-\\ufaff\\u3040-\\u30ff\\uac00-\\ud7af";
 var RUN_RE = new RegExp(`[a-z0-9]+|[${CJK_CLASS}]+`, "gu");
 var CJK_FIRST_RE = new RegExp(`[${CJK_CLASS}]`, "u");
+var STOP_WORDS = /* @__PURE__ */ new Set([
+  "the",
+  "a",
+  "an",
+  "and",
+  "or",
+  "of",
+  "to",
+  "in",
+  "on",
+  "for",
+  "is",
+  "it",
+  "with",
+  "as",
+  "at",
+  "by",
+  "be",
+  "are",
+  "was",
+  "were",
+  "this",
+  "that",
+  "from",
+  "but",
+  "not"
+]);
+var MAX_CJK_NGRAM = 3;
 function tokenize(text) {
   if (text.length === 0) {
     return [];
@@ -3234,12 +3387,17 @@ function tokenize(text) {
     if (CJK_FIRST_RE.test(run[0])) {
       if (run.length === 1) {
         tokens.push(run);
-      } else {
-        for (let i = 0; i < run.length - 1; i += 1) {
-          tokens.push(run.slice(i, i + 2));
+        continue;
+      }
+      for (let n = 2; n <= MAX_CJK_NGRAM; n += 1) {
+        if (run.length < n) {
+          break;
+        }
+        for (let i = 0; i + n <= run.length; i += 1) {
+          tokens.push(run.slice(i, i + n));
         }
       }
-    } else {
+    } else if (run.length >= 2 && !STOP_WORDS.has(run)) {
       tokens.push(run);
     }
   }
@@ -3258,6 +3416,10 @@ export {
   FabExtractKnowledgeInputSchema,
   FabExtractKnowledgeInputShape,
   FabExtractKnowledgeOutputSchema,
+  FabPendingInputSchema,
+  FabPendingInputShape,
+  FabPendingOutputSchema,
+  FabPendingOutputShape,
   FabReviewInputSchema,
   FabReviewInputShape,
   FabReviewOutputSchema,
@@ -3285,6 +3447,7 @@ export {
   PROTECTED_TOKENS,
   ProposedReasonSchema,
   REDACTION_PLACEHOLDER_PREFIX,
+  SCOPE_COORDINATE_HINT,
   SCOPE_COORDINATE_PATTERN,
   STORES_ROOT_DIR,
   STORE_ALIAS_PATTERN,
@@ -3355,7 +3518,9 @@ export {
   eventsRotatedEventSchema,
   explainStore,
   fabExtractKnowledgeAnnotations,
+  fabPendingAnnotations,
   fabReviewAnnotations,
+  fabricConfigLoadSchema,
   fabricConfigSchema,
   fabricEventSchema,
   fabricLanguageSchema,
@@ -3399,7 +3564,9 @@ export {
   initScanCompletedEventSchema,
   initStore,
   installDiffAppliedEventSchema,
+  isHighValueArchiveCandidate,
   isKnowledgeStableId,
+  isNonPersonalRequiredStore,
   isPersonalLeakIntoSharedStore,
   isPersonalScope,
   knowledgeArchiveAttemptedEventSchema,
@@ -3452,6 +3619,7 @@ export {
   metaReconciledEventSchema,
   metaReconciledOnStartupEventSchema,
   metaUpdatedEventSchema,
+  migrateRequiredStores,
   mountedStoreSchema,
   normalizeCiteTag,
   normalizeLocale,