agent-recall-core 3.4.30 → 3.4.35

package/dist/storage/corrections.js

@@ -28,6 +28,33 @@ function correctionsDir(project) {
 function outcomesPath(project) {
     return path.join(correctionsDir(project), "_outcomes.jsonl");
 }
+function rejectedPath(project) {
+    return path.join(correctionsDir(project), "_rejected.jsonl");
+}
+/**
+ * Gate version stamp — bump whenever isLikelyRealCorrection's accept criteria
+ * change so a rejected-log analysis can attribute discard rates to a specific
+ * gate revision. Kept in lock-step with the classifier below.
+ *
+ * v3 (2026-06-21, Loop 8): the gate now scans the FULL correction text (and its
+ * decimal-safe sentence fragments) for an actionable marker instead of only the
+ * truncated first sentence. Loop 7 proved the first-sentence-slice discarded
+ * genuine soft corrections whose directive lived in sentence 2. The NOISE
+ * filters (system-fragment / too-short / pure-acknowledgment / doc-header) are
+ * unchanged and still run FIRST so the precision floor holds.
+ *
+ * v4 (2026-06-22, Loop 14): split directive markers into STRONG (accept anywhere)
+ * vs WEAK (accept only outside a hedged/reporting frame), closing the round-table's
+ * MEDIUM false-accept where tentative filler ("I think we should use it") passed on
+ * a bare weak verb. Recall-safe — no fixture correction relies on a hedged weak verb.
+ */
+export const GATE_VERSION = "v4-2026-06-22";
+/**
+ * Cap for _rejected.jsonl — keep the most-recent N rows so a survivorship-bias
+ * probe can never grow the file unbounded on the hot capture path. Rotation is
+ * best-effort: a failure to rotate must never throw into writeCorrection.
+ */
+const REJECTED_LOG_CAP = 2000;
 /** Auto-detect severity: p0 if uses strong negation/mandate language, else p1. */
 function detectSeverity(text) {
     const p0Patterns = /\bnever\b|\balways\b|\bdon'?t\b|\bdo not\b|\bmust not\b|\bforbid\b|\bprohibit\b/i;
@@ -47,59 +74,212 @@ function defaultWeight(severity) {
 function todayDate() {
     return new Date().toISOString().slice(0, 10);
 }
+/**
+ * Atomic JSON write — tmp + rename, mode 0600. Prevents truncation on SIGTERM.
+ * Extracted from the three identical inlined copies (writeCorrection /
+ * retractCorrection / recordOutcome) so every correction writer shares one
+ * durable path. Pure side-effect helper; no behavior change vs the originals.
+ */
+function writeRecordAtomic(filepath, record) {
+    const tmp = `${filepath}.tmp.${process.pid}.${Date.now()}`;
+    fs.writeFileSync(tmp, JSON.stringify(record, null, 2), { encoding: "utf-8", mode: 0o600 });
+    fs.renameSync(tmp, filepath);
+}
+/**
+ * Beta posterior mean E[Beta(α,β)] with α=heeded+1, β=recurrence+1 (Laplace).
+ * Mirrors the canonical `betaUtility` in tools-logic/smart-recall.ts — kept INLINE
+ * so the low-level storage layer never imports the recall stack. Returns (0,1):
+ * neutral (no evidence) = 0.5; more heeded → higher; more recurrence → lower.
+ */
+function betaPosterior(heeded, recurrence) {
+    return (heeded + 1) / (heeded + recurrence + 2);
+}
+/** Days after which an untouched correction is considered stale (P4). */
+const STALE_DAYS = 30;
+/**
+ * P4: a correction is stale when its most recent touch (last_retrieved, else
+ * last_outcome, else its date) is older than STALE_DAYS. Pure — `nowMs` is
+ * injectable for tests. INFORMATIONAL ONLY: the corrections room is decay-
+ * protected, so this never archives on its own; it surfaces a review candidate.
+ */
+export function isStaleCorrection(rec, nowMs = Date.now()) {
+    const touch = rec.last_retrieved ?? rec.last_outcome ?? rec.date;
+    const t = new Date(touch).getTime();
+    if (Number.isNaN(t))
+        return false;
+    return nowMs - t > STALE_DAYS * 24 * 60 * 60 * 1000;
+}
 function applyCorrectionDefaults(record, holderDefault) {
+    const kind = record.kind ?? "correction";
+    const weight = record.weight ?? defaultWeight(record.severity);
     return {
         ...record,
         holder: record.holder ?? holderDefault,
-        kind: record.kind ?? "correction",
-        weight: record.weight ?? defaultWeight(record.severity),
+        kind,
+        weight,
         active: record.active ?? true,
+        // Wave 5: a human correction is authoritative ground truth by default.
+        // Non-correction kinds (insight/hunch/fact) are advisory unless explicitly
+        // marked authoritative. Honor an explicit value when present.
+        authoritative: record.authoritative ?? (kind === "correction"),
+        // Consolidation/lifecycle defaults (2026-06-29). Old records lack these;
+        // they normalize on read with no migration. proof_confidence seeds from the
+        // authority weight so it is meaningful before any outcome has accrued.
+        proof_count: record.proof_count ?? 1,
+        proof_confidence: record.proof_confidence ?? weight,
+        stale: record.stale ?? false,
     };
 }
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
+/**
+ * Decimal-safe sentence splitter. Splits on sentence-ending punctuation
+ * (`.`, `!`, `?`, or a newline) ONLY when followed by whitespace or end-of-text
+ * — NOT on a bare `.` that sits between digits/word chars. This protects
+ * version/model tokens like "Opus 4.7", "v3.4.32", "novada-search" and URLs
+ * from being chopped mid-fragment (the exact Loop-7 mis-split that hid the
+ * imperative in "Show BOTH Opus 4.7 and 4.8" behind the slice "Show BOTH Opus 4").
+ *
+ * Returns the FULL text as a single fragment when no sentence boundary is found.
+ * Empty fragments are dropped. This is a classifier helper, not a linguistic
+ * tokenizer — it deliberately errs toward NOT splitting.
+ */
+export function splitSentences(text) {
+    // Boundary = one of . ! ? OR a newline, that is followed by whitespace or EOT.
+    // A `.` wedged between two non-space chars (4.7, file.md, e.g.) is NOT a boundary.
+    const out = [];
+    let buf = "";
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        buf += ch;
+        const next = text[i + 1];
+        const isPunct = ch === "." || ch === "!" || ch === "?";
+        const isNewline = ch === "\n" || ch === "\r";
+        // Sentence boundary: terminal punctuation at end OR followed by whitespace;
+        // newline is always a boundary. A `.` between non-whitespace chars is NOT
+        // a boundary (next is defined and not whitespace) — keeps decimals intact.
+        const atBoundary = isNewline ||
+            (isPunct && (next === undefined || /\s/.test(next)));
+        if (atBoundary) {
+            const frag = buf.trim();
+            if (frag)
+                out.push(frag);
+            buf = "";
+        }
+    }
+    const tail = buf.trim();
+    if (tail)
+        out.push(tail);
+    return out.length > 0 ? out : [text.trim()].filter(Boolean);
+}
+// Directive markers, split by STRENGTH (Loop 14 precision fix). Scanned
+// per-fragment (Loop 8) so a directive in sentence 2+ is seen.
+//
+// STRONG markers signal a behavioral rule even inside prose, so they accept
+// unconditionally. WEAK markers (a bare modal/verb) are genuine in a direct
+// correction ("stop making it full width, it should be inline") but ALSO appear
+// in tentative first-person filler ("I think we should use it") — the MEDIUM
+// false-accept the Loop 14 round-table found. WEAK markers therefore accept only
+// when the fragment is NOT a hedged/reporting frame. This is recall-safe: every
+// genuine fixture correction carries a STRONG marker, a preference shape, or a
+// non-hedged weak verb (verified by scripts/eval/capture-gate-confusion.mjs).
+const STRONG_IMPERATIVE = /\b(never|always|don'?t|do not|must\s+not|must|should\s+not|needs?\s+(to|those|the|a|an|more|all)\b|instead|make\s+sure|remember\s+to|remove\s+all|replace\s+with|default\s+to|keep\s+the|keep\s+\w|show\s+(both|all|the|only))\b/i;
+const WEAK_IMPERATIVE = /\b(should|use|using|stop|avoid|prefer)\b/i;
+// Tentative / reporting frame at the START of a fragment — the speaker is musing
+// or reporting, not issuing a rule. A WEAK marker inside such a frame is NOT a
+// directive. Anchored at ^ so it only catches the OPENER, never a directive
+// sentence that merely follows a hedge.
+const HEDGE_FRAME = /^\s*(i\s+(think|guess|suppose|believe|reckon|feel|will)\b|i'?ll\b|i'?m\s+going\s+to\b|maybe\b|perhaps\b|sounds?\s+good\b|the\s+team\s+(wants?|thinks?|prefers?)\b|we\s+(could|might|may)\b)/i;
+// Preference / corrective-fact statement. Includes user-preference verbs (CJK
+// equivalents) AND the "X not Y" / "wrong … not" corrective-fact shape that
+// carries real intent without an imperative verb (e.g. "Product names are
+// novada-search (not novada-mcp)"). Scanned per-fragment.
+const PREFERENCE_PATTERN = /(\buser\s+(wants?|prefers?|likes?|needs?|agreed|tested|chose|wanted)\b|\bthe\s+user\s+is\b|偏好|喜欢|要求|\bwrong\b[\s\S]{0,60}\bnot\b|\(not\s+[^)]+\)|\bnot\s+\w[\w-]*[,.]?\s+(it'?s|its|use|the\s+\w))/i;
 /**
  * Capture-quality gate — rejects context-free fragments, pure acknowledgments,
  * and text that carries no actionable signal.
  *
- * v2 (2026-06-12): classifies on the RULE field only (context param reserved for
- * future use but never classified on — prevents long context from bypassing the
- * acknowledgment gate).
+ * v3 (2026-06-21, Loop 8): the ACTIONABLE-signal scan now runs over the FULL
+ * text AND each decimal-safe sentence fragment — accepting if ANY fragment
+ * carries an imperative/modal/preference marker. This fixes the Loop-7 root
+ * cause where the gate only ever saw the truncated first sentence
+ * (`text.split(/[.\n]/)[0].slice(0,100)`), discarding ~60% of genuine soft
+ * corrections whose directive lived in sentence 2 (e.g. "No, that's wrong.
+ * Don't use dark backgrounds.") or whose first sentence was chopped by a
+ * decimal ("Show BOTH Opus 4.7 and 4.8" → "Show BOTH Opus 4").
+ *
+ * PRECISION FLOOR: the HARD noise gates run FIRST, on the WHOLE text — these can
+ * never be rescued by the actionable scan:
+ *  1. too-short (< 12 chars).
+ *  2. system/tool fragment: starts with '<', pure number, bare file path.
+ *  3. doc/report/transcript header (starts with '#', a report/mission title,
+ *     or a file:// URL) — pasted artifacts, never a behavioral rule.
+ *
+ * Then the ACTIONABLE-signal scan runs over the FULL text + each fragment. A
+ * text that OPENS like an acknowledgment ("No, that's wrong …") is RESCUED only
+ * if a fragment carries a genuine directive (the Loop-7 leak: "No, that's wrong.
+ * Don't use dark backgrounds." → fragment 2 "Don't use …" is a real rule).
+ *
+ * Finally the SOFT acknowledgment gate rejects pure acks that the actionable
+ * scan did NOT rescue (bare "ok sure", "no that's not what I meant"). Because it
+ * runs AFTER the actionable scan, it can no longer eat a genuine correction that
+ * merely opens with "no" — but a content-free ack still has no directive to
+ * rescue it, so it is still dropped. The marker set is TIGHT (dropped the v2
+ * loose "verb-ish anywhere" path) so a long prose blob with no real directive
+ * is NOT re-admitted just because it contains a generic verb.
+ *
+ * Returns { ok: true } when the text passes, or { ok: false, reason } explaining
+ * which gate fired. Callers may surface the reason in a warning.
+ */
+/**
+ * dropHardNoise — the four hard-noise precision-floor gates extracted so they
+ * can be called independently by the two-lane router (both lanes apply the same
+ * pre-filter before routing).
+ *
+ * Returns true  = text passes (KEEP — not obviously noise)
+ * Returns false = text fails a hard gate (DROP — un-rescuable by actionable scan)
  *
- * Gates (in order):
- *  1. Must be >= 12 chars after trim.
- *  2. Must NOT be a pure acknowledgment/fragment — applied unconditionally (no
- *     length cap — v1 60-char cap allowed long-context bypass).
- *  3. Reject system/tool fragments: starts with '<', is a pure number, or is a
- *     bare file path (no spaces, contains path separator, no verb-ish content).
- *  4. PASS if any of:
- *     a) imperative/modal marker present
- *     b) preference statement ("user wants/prefers/likes/needs", CJK equiv.)
- *     c) substantive rule: len >= 40 AND >= 2 words of >= 5 chars AND verb-ish
- *  5. else reject: "no actionable signal"
+ * Identical semantics to the inline gates in isLikelyRealCorrection; this
+ * extraction must NOT change gate v4 behaviour (Loops 7/8/14 must stay intact).
  *
- * Returns { ok: true } when the text passes all gates, or { ok: false, reason }
- * explaining which gate fired. Callers may surface the reason in a warning.
+ * Gate 1  — minimum length (< 12 chars)
+ * Gate 2a — starts with '<' (system/tool fragment)
+ * Gate 2b — pure digits (bare number, no rule content)
+ * Gate 2c — bare file path (no spaces, has / or \, no 4+ letter word)
+ * Gate 3  — doc/report/transcript header (markdown '#', file://, ⏺, report title)
  */
+export function dropHardNoise(text) {
+    const r = (typeof text === "string" ? text : "").trim();
+    // Gate 1 — minimum length
+    if (r.length < 12)
+        return false;
+    // Gate 2a — system/tool fragment
+    if (r.startsWith("<"))
+        return false;
+    // Gate 2b — bare number
+    if (/^\d+$/.test(r))
+        return false;
+    // Gate 2c — bare file path: no spaces, contains / or \, no 4+ letter words
+    if (!/\s/.test(r) && /[/\\]/.test(r) && !/\b[a-zA-Z]{4,}\b/.test(r))
+        return false;
+    // Gate 3 — doc/report/transcript header
+    const firstLine = r.split(/\r?\n/, 1)[0]?.trim() ?? "";
+    const docHeaderPattern = /^(#{1,6}\s|file:\/\/|⏺|.*\b(test\s+report|status\s+report|local\s+test|mission|protocol|语言风格指南)\b\s*[—\-:])/i;
+    if (docHeaderPattern.test(firstLine))
+        return false;
+    return true;
+}
 export function isLikelyRealCorrection(rule, _context) {
     // NOTE: _context is accepted for forward-compat but NEVER classified on.
     const r = rule.trim();
+    // ── HARD NOISE GATES (precision floor) — un-rescuable, run on WHOLE text ───
+    // Mirrors dropHardNoise's gates (kept inline for the per-gate reason strings).
     // Gate 1 — minimum length
     if (r.length < 12) {
         return { ok: false, reason: "too short" };
     }
-    // Gate 2 — pure acknowledgment / fragment patterns (NO length cap — applied always).
-    // Matches strings that start with an acknowledgment word and trail with only filler content
-    // up to 80 extra chars. The 80-char trailing budget covers e.g.
-    // "Ok good, then we don't change anything. let's focus on novada-mcp" (67 total)
-    // without catching real rules that happen to open with "ok" or "yes" (those tend to be
-    // much longer and/or contain definitive nouns + verbs checked in gate 4).
-    const acknowledgmentPattern = /^(no[,.]?\s*(that'?s\s+wrong[.!]?)?|ok(ay)?\b|good\b|great\b|nice\b|yes\b|yeah\b|right\b|wait\b|hmm+\b|sure\b|thanks?\b)[\s\S]{0,80}$/i;
-    if (acknowledgmentPattern.test(r)) {
-        return { ok: false, reason: "pure acknowledgment or fragment — no rule content" };
-    }
-    // Gate 3 — system/tool fragments
+    // Gate 2 — system/tool fragments
     if (r.startsWith("<")) {
         return { ok: false, reason: "system/tool fragment (starts with '<')" };
     }
@@ -110,27 +290,67 @@ export function isLikelyRealCorrection(rule, _context) {
     if (!/\s/.test(r) && /[/\\]/.test(r) && !/\b[a-zA-Z]{4,}\b/.test(r)) {
         return { ok: false, reason: "looks like a bare file path — no rule content" };
     }
-    // Gate 4 — must carry actionable signal (pass if ANY of a/b/c)
-    // (a) imperative/modal marker
-    const imperativePattern = /\b(never|always|don'?t|do not|must|should|use|stop|avoid|prefer|instead|make sure|remember to)\b/i;
-    if (imperativePattern.test(r)) {
+    // Gate 3 — doc / report / transcript header (pasted artifact, not a rule).
+    // Loop-7 true-noise "doc/report headers": markdown headers, report/mission
+    // titles, file:// URL pastes, and the agent's own "⏺ …" transcript echo.
+    // Anchored at the START so a real rule that merely mentions "report"
+    // mid-sentence is unaffected. This is what stops the full-text scan from
+    // re-admitting a long pasted doc just because its body contains a verb.
+    const firstLine = r.split(/\r?\n/, 1)[0]?.trim() ?? "";
+    const docHeaderPattern = /^(#{1,6}\s|file:\/\/|⏺|.*\b(test\s+report|status\s+report|local\s+test|mission|protocol|语言风格指南)\b\s*[—\-:])/i;
+    if (docHeaderPattern.test(firstLine)) {
+        return { ok: false, reason: "doc/report/transcript header — pasted artifact, no rule content" };
+    }
+    // ── ACTIONABLE-SIGNAL SCAN (v3) — FULL text + each sentence fragment ───────
+    // Loop 8 root-cause fix: accept if the FULL text OR ANY decimal-safe fragment
+    // carries a directive marker. Fragments come from the WHOLE text (never a
+    // truncated slice), so a directive in sentence 2+ is now seen and can RESCUE
+    // a text that opens with an acknowledgment.
+    const fragments = [r, ...splitSentences(r)];
+    // (a) STRONG directive marker in any fragment → accept unconditionally.
+    if (fragments.some((f) => STRONG_IMPERATIVE.test(f))) {
         return { ok: true };
     }
-    // (b) preference statement
-    const preferencePattern = /\b(user\s+(wants?|prefers?|likes?|needs?)|the\s+user\s+is|偏好|喜欢|要求)\b/i;
-    if (preferencePattern.test(r)) {
+    // (a2) WEAK directive marker → accept only in a fragment that is NOT a hedged/
+    // reporting frame. Closes the Loop-14 filler-prose false-accept ("I think we
+    // should use it") while still accepting a direct weak-verb correction ("stop
+    // making it full width") and a directive sentence that merely FOLLOWS a hedge.
+    if (fragments.some((f) => WEAK_IMPERATIVE.test(f) && !HEDGE_FRAME.test(f))) {
         return { ok: true };
     }
-    // (c) substantive rule: len >= 40, >= 2 words of >= 5 alphanum chars, has verb-ish token
-    if (r.length >= 40) {
-        const longWords = (r.match(/\b[a-zA-Z0-9]{5,}\b/g) ?? []).length;
-        const verbIsh = /\b(bump|consolidate|release|phase|version|publish|push|format|palette|font|round|warm|side.by.side|bilingual|batch|clean|parse|build|compile|deploy|migrate|export|import|store|handle|return|check|verify|ensure)\b/i;
-        if (longWords >= 2 && verbIsh.test(r)) {
-            return { ok: true };
-        }
+    // (b) preference / corrective-fact statement in any fragment
+    if (fragments.some((f) => PREFERENCE_PATTERN.test(f))) {
+        return { ok: true };
+    }
+    // ── SOFT ACKNOWLEDGMENT GATE — runs AFTER the actionable scan ──────────────
+    // Pure acknowledgment / fragment: opens with an ack word and trails with only
+    // filler (<=80 extra chars). By this point the actionable scan has already
+    // found NO directive, so anything matching here is a genuine content-free ack
+    // ("ok sure", "no that's not what I meant", "confirmed"). NO length cap on the
+    // anchor — only the trailing budget — matching the v2 behavior for true acks.
+    const acknowledgmentPattern = /^(no[,.]?\s*(that'?s\s+wrong[.!]?)?|ok(ay)?\b|good\b|great\b|nice\b|yes\b|yeah\b|right\b|wait\b|hmm+\b|sure\b|thanks?\b|confirmed\b|fair\s+point\b)[\s\S]{0,80}$/i;
+    if (acknowledgmentPattern.test(r)) {
+        return { ok: false, reason: "pure acknowledgment or fragment — no rule content" };
     }
     return { ok: false, reason: "no actionable signal — rule lacks imperative/modal marker, preference statement, or substantive content" };
 }
+/**
+ * P1 consolidation match key. A new correction folds into an existing ACTIVE one
+ * only when their rule titles are IDENTICAL after normalization (lowercase, all
+ * runs of non-alphanumerics collapsed to a single space, trimmed).
+ *
+ * Deliberately VERBATIM-only. The dominant duplicate source is the SAME correction
+ * captured again across sessions, and exact-match is the ONE gate with ZERO risk
+ * of folding two DISTINCT rules into one. Fuzzy/semantic matching is unsafe on the
+ * zero-LLM storage path because it cannot tell a duplicate from a contradiction:
+ * "use proxy.ts" vs "use middleware.ts" and a "P0" vs "P1" variant differ by a
+ * short/numeric token that any local matcher either inflates (char-trigram) or
+ * drops (sub-3-char token filter) — so it would wrongly merge them. Paraphrase-
+ * level consolidation is left to the optional semantic/LLM path, never here.
+ */
+function normalizeRule(rule) {
+    return (rule ?? "").toLowerCase().replace(/[^\p{L}\p{N}]+/gu, " ").trim();
+}
 /**
  * Write a correction to persistent storage.
  * Auto-detects severity from the rule/context text.
@@ -142,9 +362,28 @@ export function isLikelyRealCorrection(rule, _context) {
  */
 export function writeCorrection(project, correction) {
     // Capture-quality gate — reject noise before touching disk.
-    // v2: classify on rule field only (context is for future use, never gate-input).
-    const gate = isLikelyRealCorrection(correction.rule ?? "");
+    // v3 (Loop 8): classify on the FULL correction text, not the truncated rule.
+    // `rule` is a first-sentence title slice (set by check.ts) that hid the
+    // directive when it lived in sentence 2 or after a decimal. The full text
+    // lives in `context`. ACCEPT if EITHER the rule OR the context carries a
+    // directive — a directive anywhere in the correction is genuine signal. The
+    // gate's own HARD noise gates (system-fragment / doc-header / too-short) run
+    // on each candidate, so this can't re-admit a long noise blob: a blob that
+    // matched a hard gate is rejected regardless of which field it came from.
+    const ruleText = (correction.rule ?? "").trim();
+    const contextText = (correction.context ?? "").trim();
+    const ruleGate = ruleText ? isLikelyRealCorrection(ruleText) : { ok: false, reason: "empty rule" };
+    // Only consult context when it adds NEW text (production: context ⊇ rule).
+    const contextGate = contextText && contextText !== ruleText
+        ? isLikelyRealCorrection(contextText)
+        : { ok: false };
+    const gate = ruleGate.ok || contextGate.ok ? { ok: true } : ruleGate;
     if (!gate.ok) {
+        // Survivorship-bias probe — record the discarded candidate (FULL rejected
+        // text + reason) so soft corrections the palace silently drops become
+        // measurable. Best-effort: logRejectedCorrection can NEVER throw here.
+        const rejectedText = contextText.length > ruleText.length ? contextText : ruleText;
+        logRejectedCorrection(project, rejectedText, gate.reason ?? "rejected");
         return { written: false, reason: gate.reason };
     }
     const dir = correctionsDir(project);
@@ -152,13 +391,41 @@ export function writeCorrection(project, correction) {
     // Auto-detect severity if not already set
     const severity = correction.severity ?? detectSeverity(`${correction.rule} ${correction.context}`);
     const record = applyCorrectionDefaults({ ...correction, severity }, todayDate());
+    // ── P1: on-write consolidation (refine-not-overwrite) ─────────────────────
+    // Borrow Hindsight's consolidation idea, AR-native: instead of accumulating a
+    // new dated file for a re-stated rule, fold it into the most similar ACTIVE
+    // correction of the SAME kind and bump that record's proof_count. The matched
+    // record keeps its id/date (stable document_id) and absorbs the new tags +
+    // higher severity/authority/weight. High-precision LOCAL gate — no key, no
+    // network — so this never runs an LLM on the storage hot path.
+    const normNew = normalizeRule(record.rule);
+    for (const existing of readActiveCorrections(project)) {
+        if (existing.id === record.id)
+            continue; // never merge into self (same-day re-slug)
+        if ((existing.kind ?? "correction") !== (record.kind ?? "correction"))
+            continue;
+        if (normalizeRule(existing.rule) !== normNew)
+            continue;
+        const merged = {
+            ...existing,
+            proof_count: (existing.proof_count ?? 1) + 1,
+            merged_from: [...(existing.merged_from ?? []), record.id],
+            tags: Array.from(new Set([...(existing.tags ?? []), ...(record.tags ?? [])])),
+            // keep the STRONGER signal on every axis
+            severity: existing.severity === "p0" || record.severity === "p0" ? "p0" : "p1",
+            weight: Math.max(existing.weight ?? 0, record.weight ?? 0),
+            authoritative: Boolean(existing.authoritative || record.authoritative),
+            last_outcome: new Date().toISOString(),
+        };
+        const mfile = `${merged.date}-${slugify(merged.rule || merged.id)}.json`;
+        writeRecordAtomic(path.join(dir, mfile), merged);
+        return { written: true, merged: true, id: merged.id };
+    }
     const filename = `${record.date}-${slugify(record.rule || record.id)}.json`;
     const filepath = path.join(dir, filename);
     // Atomic write — tmp + rename, mode 0600
-    const tmp = `${filepath}.tmp.${process.pid}.${Date.now()}`;
-    fs.writeFileSync(tmp, JSON.stringify(record, null, 2), { encoding: "utf-8", mode: 0o600 });
-    fs.renameSync(tmp, filepath);
-    return { written: true };
+    writeRecordAtomic(filepath, record);
+    return { written: true, merged: false, id: record.id };
 }
 /**
  * Read all corrections for a project, sorted newest first.
@@ -202,7 +469,7 @@ export function readP0Corrections(project) {
  * The file is rewritten atomically — never deleted. The record remains in
  * _outcomes.jsonl history and can be manually reactivated by editing the JSON.
  */
-export function retractCorrection(project, id, reason) {
+export function retractCorrection(project, id, reason, supersededBy) {
     const dir = correctionsDir(project);
     // Find the correction record by id
     const all = readCorrections(project);
@@ -215,13 +482,13 @@ export function retractCorrection(project, id, reason) {
         active: false,
         retracted_at: new Date().toISOString(),
         ...(reason !== undefined ? { retract_reason: reason } : {}),
+        // P2: forward pointer to the correction that replaced this one (audit trail).
+        ...(supersededBy !== undefined ? { superseded_by: supersededBy } : {}),
     };
     const filename = `${updated.date}-${slugify(updated.rule || updated.id)}.json`;
     const filepath = path.join(dir, filename);
     // Atomic rewrite — tmp + rename, mode 0600
-    const tmp = `${filepath}.tmp.${process.pid}.${Date.now()}`;
-    fs.writeFileSync(tmp, JSON.stringify(updated, null, 2), { encoding: "utf-8", mode: 0o600 });
-    fs.renameSync(tmp, filepath);
+    writeRecordAtomic(filepath, updated);
     return { success: true, id };
 }
 /**
@@ -257,18 +524,247 @@ export function recordOutcome(outcome) {
         updated.recurrence_count = (updated.recurrence_count ?? 0) + 1;
         updated.last_outcome = outcome.at;
     }
+    else if (outcome.kind === "predicted") {
+        // Wave 5: prediction fired — instrument the predict-the-correction loop.
+        updated.predicted_count = (updated.predicted_count ?? 0) + 1;
+        updated.last_predicted = outcome.at;
+    }
+    else if (outcome.kind === "predict_hit") {
+        updated.predict_hits = (updated.predict_hits ?? 0) + 1;
+    }
     const r = updated.retrieved_count ?? 0;
     // Clamp to [0,1]: `retrieved` is guarded 1/day but `heeded` can fire on every
     // session_end, so raw heeded/retrieved can exceed 1.0 ("150% heeded" is
     // nonsense). min(1, …) keeps the metric honest. (Root-cause follow-up: apply
     // the same 1/day guard to heeded as retrieved has, for finer resolution.)
+    // NB (Wave 5): `precision` is heeded/retrieved ONLY — predict_* never touch it.
     updated.precision = r > 0 ? Math.min(1, Number(((updated.heeded_count ?? 0) / r).toFixed(3))) : undefined;
+    // Wave 5: predict_precision = predict_hits / predicted_count, kept SEPARATE
+    // from `precision`. Undefined until at least one prediction has fired.
+    // A predict_hit implies a prior prediction. If data is inconsistent (hits
+    // recorded without a matching predicted_count — e.g. migrated/corrupt records),
+    // floor the denominator at predict_hits so the metric stays VISIBLE and bounded
+    // rather than silently undefined while hits exist.
+    const pc = updated.predicted_count ?? 0;
+    const ph = updated.predict_hits ?? 0;
+    const predictDenom = Math.max(pc, ph);
+    updated.predict_precision = predictDenom > 0
+        ? Math.min(1, Number((ph / predictDenom).toFixed(3)))
+        : undefined;
+    // P3: evidence-grounded proof_confidence. With NO outcome evidence yet, keep the
+    // authority prior (weight); once heeded/recurrence accrue, move to the Beta
+    // posterior so a rule that keeps being honored strengthens and one whose bug
+    // keeps recurring weakens. Kept SEPARATE from `precision` (heeded/retrieved) and
+    // from `weight` (static authority) — this is the evidence axis.
+    const heededC = updated.heeded_count ?? 0;
+    const recurC = updated.recurrence_count ?? 0;
+    updated.proof_confidence = (heededC + recurC) > 0
+        ? Number(betaPosterior(heededC, recurC).toFixed(3))
+        : (updated.weight ?? defaultWeight(updated.severity));
     // Re-write the JSON file atomically (tmp + rename — prevents truncation on SIGTERM).
     const filename = `${updated.date}-${slugify(updated.rule || updated.id)}.json`;
     const filepath = path.join(dir, filename);
-    const tmp = `${filepath}.tmp.${process.pid}.${Date.now()}`;
-    fs.writeFileSync(tmp, JSON.stringify(updated, null, 2), { encoding: "utf-8", mode: 0o600 });
-    fs.renameSync(tmp, filepath);
+    writeRecordAtomic(filepath, updated);
+}
+/**
+ * Best-effort: append one row to corrections/_rejected.jsonl recording a
+ * gate-rejected correction candidate. INVARIANT: never throws — every fs op is
+ * wrapped so a rejection log can never escalate into the capture path. Reads
+ * nothing on the hot path except the (already-small) file it rotates.
+ *
+ * Rotation: when the file exceeds REJECTED_LOG_CAP rows, it is rewritten with
+ * only the most-recent rows (append-only semantics, bounded size). Rotation is
+ * itself best-effort — a rotation failure still leaves the append intact.
+ */
+export function logRejectedCorrection(project, rule, reason) {
+    try {
+        const dir = correctionsDir(project);
+        ensureDir(dir);
+        const row = {
+            ts: new Date().toISOString(),
+            project,
+            rule,
+            reason,
+            gate_version: GATE_VERSION,
+        };
+        const p = rejectedPath(project);
+        fs.appendFileSync(p, JSON.stringify(row) + "\n", "utf-8");
+        // Bounded rotation — keep only the most-recent rows. Best-effort: if any
+        // step throws, the append above already succeeded and we simply skip trim.
+        try {
+            const raw = fs.readFileSync(p, "utf-8");
+            const lines = raw.split("\n").filter((l) => l.trim());
+            if (lines.length > REJECTED_LOG_CAP) {
+                const kept = lines.slice(-REJECTED_LOG_CAP).join("\n") + "\n";
+                const tmp = `${p}.tmp.${process.pid}.${Date.now()}`;
+                fs.writeFileSync(tmp, kept, { encoding: "utf-8", mode: 0o600 });
+                fs.renameSync(tmp, p);
+            }
+        }
+        catch {
+            /* rotation is best-effort — append already landed */
+        }
+    }
+    catch {
+        /* a rejection log can NEVER throw into the capture path */
+    }
+}
+/**
+ * Read all rejected correction candidates for a project, oldest-first (file
+ * order). Returns [] when no log exists — never throws. Skips malformed lines.
+ */
+export function readRejectedCorrections(project) {
+    const p = rejectedPath(project);
+    if (!fs.existsSync(p))
+        return [];
+    let raw;
+    try {
+        raw = fs.readFileSync(p, "utf-8");
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const line of raw.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        try {
+            const rec = JSON.parse(trimmed);
+            if (rec && typeof rec.rule === "string" && typeof rec.reason === "string") {
+                out.push(rec);
+            }
+        }
+        catch {
+            /* skip malformed line */
+        }
+    }
+    return out;
+}
+/**
+ * Aggregate the rejected log into discard count + per-reason breakdown. When
+ * `acceptedCount` is supplied the discard RATE is computed too. Read-only.
+ */
+export function getRejectedStats(project, acceptedCount) {
+    const rows = readRejectedCorrections(project);
+    const byReason = new Map();
+    for (const r of rows) {
+        byReason.set(r.reason, (byReason.get(r.reason) ?? 0) + 1);
+    }
+    const top_reasons = [...byReason.entries()]
+        .map(([reason, count]) => ({ reason, count }))
+        .sort((a, b) => b.count - a.count);
+    const discarded = rows.length;
+    const denom = acceptedCount !== undefined ? discarded + acceptedCount : undefined;
+    return {
+        project,
+        discarded,
+        accepted: acceptedCount,
+        rate: denom && denom > 0 ? Number((discarded / denom).toFixed(4)) : undefined,
+        top_reasons,
+    };
+}
+/**
+ * Internal: bucket _outcomes.jsonl events per correction id, keeping only the
+ * lines for which `keep(localDay)` returns true. `localDay` is the event's
+ * local-TZ date (`sv` locale → YYYY-MM-DD), matching the 1/day guards elsewhere.
+ * Returns an empty Map when no log exists — never throws.
+ *
+ * This is the single parsing core shared by readOutcomesForToday /
+ * readOutcomesBefore / readOutcomesOnDate so all three agree on date handling.
+ */
+function bucketOutcomesBy(project, keep) {
+    const map = new Map();
+    const p = outcomesPath(project);
+    if (!fs.existsSync(p))
+        return map;
+    let raw;
+    try {
+        raw = fs.readFileSync(p, "utf-8");
+    }
+    catch {
+        return map;
+    }
+    for (const line of raw.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        let evt;
+        try {
+            evt = JSON.parse(trimmed);
+        }
+        catch {
+            continue; // skip malformed lines
+        }
+        if (!evt || !evt.correction_id || !evt.at)
+            continue;
+        let day;
+        try {
+            day = new Date(evt.at).toLocaleDateString("sv");
+        }
+        catch {
+            continue;
+        }
+        if (!keep(day))
+            continue;
+        let set = map.get(evt.correction_id);
+        if (!set) {
+            set = new Set();
+            map.set(evt.correction_id, set);
+        }
+        set.add(evt.kind);
+    }
+    return map;
+}
+/**
+ * Wave 5 — single source for "what outcomes already fired today" across the
+ * predict / check-action / session-start / session-end call sites. Reads the
+ * _outcomes.jsonl audit trail and buckets today's events (local-TZ) per
+ * correction id. Returns an empty Map when no log exists — never throws.
+ *
+ * Local-TZ date (`sv` locale → YYYY-MM-DD) matches the 1/day guards elsewhere
+ * (session-start/session-end) so "today" agrees across all four readers.
+ */
+export function readOutcomesForToday(project) {
+    const todayStr = new Date().toLocaleDateString("sv");
+    return bucketOutcomesBy(project, (day) => day === todayStr);
+}
+/**
+ * Loop 3 — bucket outcome events recorded STRICTLY BEFORE a given ISO/date
+ * cutoff (local-TZ day comparison). Mirrors readOutcomesForToday but with an
+ * explicit date arg, so the cross-day predict_hit path can ask "was this risk
+ * already PREDICTED on an earlier day?" without depending on today's bucket.
+ *
+ * `isoCutoff` may be a full ISO timestamp or a YYYY-MM-DD date; only its
+ * local-TZ day is used. An event on the SAME day as the cutoff is EXCLUDED
+ * (strictly-before) — this is what keeps a same-session/same-day prediction
+ * from ever counting as a cross-day hit.
+ */
+export function readOutcomesBefore(project, isoCutoff) {
+    let cutoffDay;
+    try {
+        cutoffDay = new Date(isoCutoff).toLocaleDateString("sv");
+    }
+    catch {
+        return new Map();
+    }
+    return bucketOutcomesBy(project, (day) => day < cutoffDay);
+}
+/**
+ * Loop 3 — bucket outcome events recorded ON a specific local-TZ day. Mirrors
+ * readOutcomesForToday but with an explicit date arg (for replaying a past day
+ * in tests / offline analysis). `isoDate` may be a full ISO timestamp or a
+ * YYYY-MM-DD date; only its local-TZ day is used.
+ */
+export function readOutcomesOnDate(project, isoDate) {
+    let onDay;
+    try {
+        onDay = new Date(isoDate).toLocaleDateString("sv");
+    }
+    catch {
+        return new Map();
+    }
+    return bucketOutcomesBy(project, (day) => day === onDay);
 }
 /**
  * Aggregate KPIs over all corrections for a project — the "is this learning loop working?" view.
@@ -294,6 +790,13 @@ export function getCorrectionKPIs(project) {
             hot.push({ id: r.id, rule: r.rule, precision: p, retrieved: ret });
         }
     }
+    const nowMs = Date.now();
+    const stale = [];
+    for (const r of active) {
+        if (isStaleCorrection(r, nowMs)) {
+            stale.push({ id: r.id, rule: r.rule, last_seen: r.last_retrieved ?? r.last_outcome ?? r.date });
+        }
+    }
     return {
         project,
         total: all.length,
@@ -304,6 +807,52 @@ export function getCorrectionKPIs(project) {
         precision: retrieved > 0 ? Math.min(1, Number((heeded / retrieved).toFixed(3))) : NaN,
         noise_candidates: noise,
         high_signal: hot,
+        stale_candidates: stale,
+    };
+}
+/**
+ * P4: review low-signal corrections for archiving. SUGGEST-ONLY by default —
+ * returns candidates and mutates NOTHING. Set AR_CONSOLIDATE_AUTO=1 (or pass
+ * { auto: true }) to actually retract them. This mirrors AR's conservative
+ * posture: deleting belief is a deliberate act, so the default never mutates;
+ * an explicit human (or opt-in flag) triggers the retraction.
+ */
+export function reviewNoiseCorrections(project, opts) {
+    const auto = opts?.auto ?? (process.env.AR_CONSOLIDATE_AUTO === "1");
+    const suggestions = getCorrectionKPIs(project).noise_candidates;
+    const pruned = [];
+    if (auto) {
+        for (const c of suggestions) {
+            const res = retractCorrection(project, c.id, "auto-pruned: low signal (precision<0.3, retrieved≥3)");
+            if (res.success)
+                pruned.push(c.id);
+        }
+    }
+    return { suggestions, pruned, auto };
+}
+/**
+ * P5: order corrections for surfacing when a cap applies. Today P0s are surfaced
+ * `slice(0, 10)` in newest-first FILENAME order — so when a project has >10 P0s
+ * the ones that survive are arbitrary (just the most-recently-dated). This ranks
+ * by a composite LOCAL score (NO key, NO network) so the most authoritative +
+ * evidence-backed + recently-relevant rules win the cap:
+ *   severity (p0 always above p1) ≫ proof_confidence ≫ recency ≫ proof_count.
+ * Deterministic and stable; pure (Date.now only for recency decay).
+ */
+export function rankCorrections(records, limit) {
+    const nowMs = Date.now();
+    const scoreOf = (r) => {
+        const sev = r.severity === "p0" ? 1 : 0;
+        const conf = r.proof_confidence ?? r.weight ?? 0;
+        const touch = r.last_retrieved ?? r.last_outcome ?? r.date;
+        const t = new Date(touch).getTime();
+        const days = Number.isNaN(t) ? 9999 : Math.max(0, (nowMs - t) / (24 * 60 * 60 * 1000));
+        const recency = Math.exp(-days / 180); // slow decay, matches knowledge half-life
+        const proof = Math.min(1, (r.proof_count ?? 1) / 5);
+        // severity dominates the ordering; the rest breaks ties within a severity tier.
+        return sev * 100 + conf * 10 + recency * 3 + proof;
     };
+    const sorted = [...records].sort((a, b) => scoreOf(b) - scoreOf(a));
+    return limit !== undefined ? sorted.slice(0, limit) : sorted;
 }
 //# sourceMappingURL=corrections.js.map