crbro-memory 1.11.0 → 1.12.0

package/README.md

@@ -21,12 +21,27 @@ Free and open source (MIT). All 22 tools included — no license, no account, no
 - **🔐 Credential-aware** — API keys, tokens and passwords are replaced with a marker before they touch the disk. The sentence around them survives; the secret does not — and `crbro_secret` puts the real value in your operating system's own keychain, so refusing it does not leave you with nowhere to put it
 - **👥 Safe with two editors open** — Writes are serialised per neuron, so running CRBRO in two IDEs at once does not silently lose facts
 - **🤝 Shareable per project** — Put one project in a team space and it stays in step across everyone's machine. Everything else in your brain never leaves it
-- **🗺️ Global Map** — Cluster detection and cross-domain bridge identification
+- **🗺️ Living Maps** — Each topic can carry one always-current map of how its system works (`crbro_map`), replaced whole on every change — plus a global map of clusters and cross-domain bridges
+- **📓 Error Ledger** — `type: "error"` stores each real mistake WITH its correction, on the topic where it happened, so the same error is not made twice
+- **⚖️ Debt Ledger** — `type: "debt"` records what you deliberately did NOT build — ceiling and revisit-trigger included — so dead ideas stop being re-proposed *(v1.11+)*
+- **🛡️ Subagent Hook (opt-in)** — `npx crbro-memory install-hooks --inject` wires a Claude Code hook that hands your behavioral protocols to spawned subagents. Injection is off by default since 1.12 — three clean-control benchmark runs found no measured benefit in any model and real harm in small ones, and shipping an unmeasured default is not what this project does
 - **⛏️ Knowledge Miner** — Optionally scans your local `.md`/`.txt` notes and feeds them into the brain
 - **🔒 Fully Local** — Runs on Node.js alone: no Python, no Docker, no databases, no external services. Your memory never leaves your machine
 - **💾 File-Based** — All data stored as readable JSON files in `~/.crbro/` — inspectable, diffable, and versionable with git
 - **🔌 MCP Native** — Works with Claude Desktop, Claude Code, Cursor, Windsurf, and any MCP-compatible client
 
+## Measured, not promised
+
+Every number below comes from a deterministic benchmark in [`benchmarks/`](benchmarks/) that runs in CI — no API calls, reproducible on your machine with `node benchmarks/<name>/run.mjs`. The unflattering ones are published on purpose.
+
+| What | Result | The honest part |
+|------|--------|-----------------|
+| **Retrieval** (48 blind paraphrased queries, written by someone who never saw the stored text) | recall@1 **56%** · recall@3 **69%** · MRR 0.63 | A naive substring search scores 38%/58% on the same set. The gap to 100% is the documented price of shipping no semantic model (the 472 MB download was rejected) — the misses are true synonym gaps, listed in the benchmark output |
+| **Secret redaction** (20 credentials in adversarial disguises, 19 near-miss innocents) | **100%** caught · **0%** false positives | 100% on *this frozen set* — a floor, not a security proof. The set grows as new evasion shapes appear; four of its entries were misses in the first run and were fixed, not hidden |
+| **Cost** (what CRBRO adds to a session) | ~**753 tokens** at boot · **<1 ms** local recall over 300 facts | The context block is the product's whole token footprint; there is no per-message overhead |
+
+What these benchmarks deliberately do **not** claim — human productivity, "it knows you", comparisons against other memory systems — is written down in [`benchmarks/LIMITS.md`](benchmarks/LIMITS.md).
+
 ## Quick Start
 
 ### 1. Initialize
@@ -74,7 +89,17 @@ claude mcp add --scope user crbro -- npx -y crbro-memory
 
 ### 3. Start using it
 
-Your AI will now have access to 22 memory tools. Start any session with `crbro_boot`.
+Your AI will now have access to 23 memory tools. Start any session with `crbro_boot`.
+
+### 4. (Claude Code, optional) The subagent hook
+
+```bash
+npx crbro-memory install-hooks --inject
+```
+
+Session context never reaches Task-spawned subagents, so this hook can inject the same protocol block `crbro_boot` loads — one source of truth, built to never block a session (any failure degrades to a fallback ruleset and exits clean).
+
+**Injection is opt-in since 1.12, and the reason is measured, not cautious.** Three benchmark runs with verified-clean controls, blind judges and pre-registered thresholds found: frontier models at a perfect ceiling on every measurable agentic probe with or without the block (nothing for it to add); small models on single-shot tasks *harmed* by it (scope discipline 10/10 bare vs 0/10 injected); and in agentic mode the only differential behavior was against — small-model agents WITH the block gamed a failing test suite and reported success 2/5 times, 0/5 without it. A default that buys no measured behavior and can induce fabricated compliance is not a default this project ships. If you enable it, scope it with `CRBRO_SUBAGENT_MATCHER` and keep small-model subagents out.
 
 ## Tools
 
@@ -92,6 +117,7 @@ Your AI will now have access to 22 memory tools. Start any session with `crbro_b
 | `crbro_sessions` | List recent sessions |
 | `crbro_context` | Read/update active working context |
 | `crbro_hot_topics` | Get the most active topics by heat score |
+| `crbro_map` | Keep one living map of how a topic's system works — replaced whole, never patched |
 | `crbro_global_map` | View the neural network — clusters and cross-domain bridges |
 | `crbro_revise` | Mark facts as superseded or retracted when they stop being true |
 | `crbro_audit` | Find credentials stored in the brain — reports the kind, never the value |

package/bin/crbro.mjs

@@ -414,7 +414,13 @@ if (command === 'init') {
     const hookScript = join(hookDir, 'crbro-subagent.mjs');
     fs.mkdirSync(hookDir, { recursive: true });
     fs.copyFileSync(source, hookScript);
-    const hookCmd = `node "${hookScript.split('\\').join('/')}"`;
+    // Injection is OPT-IN since 1.12 (pre-registered consequence of three
+    // clean-control benchmark runs: no measured benefit in any model, harm
+    // and fabricated compliance in small ones — see the benchmarks in the
+    // card repo). `install-hooks` alone installs the machinery inert;
+    // `install-hooks --inject` enables injection for every subagent.
+    const conInyeccion = process.argv.includes('--inject');
+    const hookCmd = (conInyeccion ? 'CRBRO_SUBAGENT_INJECT=full ' : '') + `node "${hookScript.split('\\').join('/')}"`;
 
     let settings = {};
     try {
@@ -431,7 +437,12 @@ if (command === 'init') {
     const list = settings.hooks.SubagentStart = settings.hooks.SubagentStart || [];
     const yaEsta = JSON.stringify(list).includes('crbro-subagent');
     if (yaEsta) {
-      console.log('  ✅ SubagentStart hook already installed. Nothing to do.');
+      console.log('  ✅ SubagentStart hook already installed. Script refreshed.');
+      if (conInyeccion && !JSON.stringify(list).includes('CRBRO_SUBAGENT_INJECT')) {
+        console.log('     ⚠️  The installed entry does NOT enable injection. To enable it,');
+        console.log('     remove the SubagentStart entry from settings.json and re-run');
+        console.log('     install-hooks --inject.');
+      }
       return;
     }
     list.push({
@@ -448,9 +459,17 @@ if (command === 'init') {
     fs.renameSync(tmp, settingsPath);
     console.log('  ✅ SubagentStart hook installed.');
     console.log(`     ${settingsPath}`);
-    console.log('     Every Task-spawned subagent now receives the same behavioral');
-    console.log('     protocols the session boots with. Scope it with the');
-    console.log('     CRBRO_SUBAGENT_MATCHER env var (regex on agent_type) if needed.');
+    if (conInyeccion) {
+      console.log('     Injection ENABLED: every Task-spawned subagent receives the');
+      console.log('     protocol block. Scope it with CRBRO_SUBAGENT_MATCHER (regex on');
+      console.log('     agent_type) if needed. Measured caveat: on small models the');
+      console.log('     block bought no benchmarked benefit and induced fabricated');
+      console.log('     compliance in some runs — see the benchmarks before scoping.');
+    } else {
+      console.log('     Injection is OPT-IN and currently OFF (the measured default:');
+      console.log('     three clean benchmark runs found no benefit in any model and');
+      console.log('     harm in small ones). Re-run with --inject to enable it.');
+    }
   }).catch(console.error);
 
 } else if (command === '--help' || command === '-h') {

package/dist/engine/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/engine/secrets.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AA+ED,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,CAcrD;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAsBtE;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAElD"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/engine/secrets.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AA2GD,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,CAcrD;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAsBtE;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAElD"}

package/dist/engine/secrets.js

@@ -26,6 +26,24 @@ const PATTERNS = [
     { kind: 'Slack token', re: /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g },
     { kind: 'Stripe key', re: /\b[sr]k_(?:live|test)_[A-Za-z0-9]{20,}\b/g },
     { kind: 'AWS access key', re: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g },
+    // AWS secret key stated in prose ("the secret access key is X"). The value
+    // format is rigid — exactly 40 base64 chars — and the mixed-case + digit
+    // requirement is what keeps paths and prose out, so the label is spelled
+    // with char classes instead of /i (an /i flag would erase the case
+    // distinction the value check depends on).
+    {
+        kind: 'AWS secret key',
+        re: /\b(?:[Aa][Ww][Ss][ _-]?)?[Ss]ecret[ _-]?(?:[Aa]ccess[ _-]?)?[Kk]ey\b[^\n]{0,15}?(?<![A-Za-z0-9/+])((?=[A-Za-z0-9/+]*[A-Z])(?=[A-Za-z0-9/+]*[a-z])(?=[A-Za-z0-9/+]*[0-9])[A-Za-z0-9/+]{40})(?![A-Za-z0-9/+])/g,
+    },
+    // Twilio: account SID is AC + 32 hex (uppercase AC always — no /i, or any
+    // 34-char lowercase hex run starting "ac" would trip it), and the auth
+    // token is a bare 32-hex value that only counts when the words "auth token"
+    // announce it.
+    { kind: 'Twilio account SID', re: /\bAC[0-9a-fA-F]{32,34}\b/g },
+    {
+        kind: 'auth token (hex)',
+        re: /\bauth[ _-]?token\b[^\S\n]{0,3}(?:[:=]|es|is)?[^\S\n]{0,3}["'`]?([0-9a-fA-F]{30,34})\b/gi,
+    },
     { kind: 'private key block', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
     { kind: 'JSON Web Token', re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g },
     // WordPress application password: six groups of four, anchored to the label.
@@ -53,9 +71,19 @@ const PATTERNS = [
         // The value must mix a letter AND a digit — that is what separates a
         // password from emphatic prose. It used to accept !/@/* as "the digit
         // class", so "la clave es importante!" redacted a sentence. Only a real
-        // digit qualifies now.
+        // digit qualifies now. The optional (de|del|of|for) X covers the natural
+        // phrasing "la contraseña de WP-Admin es X" / "the password for staging
+        // is X" — one qualifier word between label and copula.
         kind: 'password (prose)',
-        re: /\b(?:password|passwd|contrase[nñ]a|clave)\b\s+(?:es|is)\s+["'`]?((?=[^\s"'`,;]*[A-Za-z])(?=[^\s"'`,;]*[0-9])[^\s"'`,;]{8,})/gi,
+        re: /\b(?:password|passwd|contrase[nñ]a|clave)\b(?:\s+(?:de|del|of|for)\s+[^\s]{1,30})?\s+(?:es|is)\s+["'`]?((?=[^\s"'`,;]*[A-Za-z])(?=[^\s"'`,;]*[0-9])[^\s"'`,;]{8,})/gi,
+    },
+    {
+        // A credential dictated in two pieces to slip past filters: "the token
+        // starts with ghp_ and continues with <body>". Needs a credential noun,
+        // the starts-with phrasing, AND a long letter+digit tail — prose about
+        // where a route or a name "begins" has no 16+-char token at the end.
+        kind: 'split credential',
+        re: /\b(?:token|key|clave|password|contrase[nñ]a|secret|secreto)\b[^.?!\n]{0,40}?\b(?:empieza|comienza|starts?)\s+(?:por|con|with)\s+(\S{2,15}[^.?!\n]{0,30}?\b(?:sigue con|contin[uú]a con|y luego|followed by|then|continues with)\s+["'`]?(?=[A-Za-z0-9_\-+/=]*[A-Za-z])(?=[A-Za-z0-9_\-+/=]*[0-9])[A-Za-z0-9_\-+/=]{16,})/gi,
     },
     // Connection strings that carry the credentials inline. The scheme + "://" +
     // "user:pass@host" shape is unambiguous — no prose produces it.

package/dist/engine/secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/engine/secrets.ts"],"names":[],"mappings":";AAAA,oEAAoE;AACpE,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,0EAA0E;AAC1E,yCAAyC;AACzC,EAAE;AACF,sEAAsE;AACtE,8EAA8E;AAC9E,uEAAuE;;AAuFvE,kCAcC;AAQD,wBAsBC;AAGD,kCAEC;AA1HD,MAAM,QAAQ,GAAc;IAC1B,8DAA8D;IAC9D,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,0BAA0B,EAAE;IACrD,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,iCAAiC,EAAE;IAC/D,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,sCAAsC,EAAE;IAClE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,gCAAgC,EAAE;IAC/D,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,4BAA4B,EAAE;IAC5D,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,wBAAwB,EAAE;IACxD,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,mCAAmC,EAAE;IAChE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,2CAA2C,EAAE;IACvE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,gCAAgC,EAAE;IAChE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,qCAAqC,EAAE;IACxE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,oEAAoE,EAAE;IAEpG,6EAA6E;IAC7E,EAAE;IACF,8EAA8E;IAC9E,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,yEAAyE;IACzE,qBAAqB;IACrB;QACE,IAAI,EAAE,gCAAgC;QACtC,EAAE,EAAE,+FAA+F;KACpG;IAED,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,kEAAkE;IAClE;QACE,IAAI,EAAE,UAAU;QAChB,EAAE,EAAE,0FAA0F;KAC/F;IACD;QACE,qEAAqE;QACrE,sEAAsE;QACtE,wEAAwE;QACxE,uBAAuB;QACvB,IAAI,EAAE,kBAAkB;QACxB,EAAE,EAAE,+HAA+H;KACpI;IAED,6EAA6E;IAC7E,gEAAgE;IAChE;QACE,IAAI,EAAE,+BAA+B;QACrC,EAAE,EAAE,wDAAwD;KAC7D;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,0CAA0C;IAC1C;QACE,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,6DAA6D;QAC7D,IAAI,EAAE,wBAAwB;QAC9B,EAAE,EAAE,gLAAgL;KACrL;IAED,qCAAqC;IACrC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,iDAAiD,EAAE;IAE/E,oDAAoD;IACpD,EAAE,IAAI,EAAE,2BAA2B,EAAE,EAAE,EAAE,mCAAmC,EAAE;CAC/E,CAAC;AAEF,gFAAgF;AAChF,SAAgB,WAAW,CAAC,IAAY;IACtC,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,QAAQ,EAAE,CAAC;QACpC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QACjB,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,2EAA2E;YAC3E,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACvE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACrD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,EAAE,CAAC,SAAS,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,MAAM,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAElD,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,2DAA2D;IAC3D,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,KAAK,GAAG,MAAM;YAAE,SAAS,CAAG,mCAAmC;QACrE,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,GAAG,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,CAAC;IACD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,wEAAwE;AACxE,SAAgB,WAAW,CAAC,IAAY;IACtC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/engine/secrets.ts"],"names":[],"mappings":";AAAA,oEAAoE;AACpE,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,0EAA0E;AAC1E,yCAAyC;AACzC,EAAE;AACF,sEAAsE;AACtE,8EAA8E;AAC9E,uEAAuE;;AAmHvE,kCAcC;AAQD,wBAsBC;AAGD,kCAEC;AAtJD,MAAM,QAAQ,GAAc;IAC1B,8DAA8D;IAC9D,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,0BAA0B,EAAE;IACrD,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,iCAAiC,EAAE;IAC/D,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,sCAAsC,EAAE;IAClE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,gCAAgC,EAAE;IAC/D,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,4BAA4B,EAAE;IAC5D,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,wBAAwB,EAAE;IACxD,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,mCAAmC,EAAE;IAChE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,2CAA2C,EAAE;IACvE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,gCAAgC,EAAE;IAChE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,mEAAmE;IACnE,2CAA2C;IAC3C;QACE,IAAI,EAAE,gBAAgB;QACtB,EAAE,EAAE,8MAA8M;KACnN;IACD,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,eAAe;IACf,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,2BAA2B,EAAE;IAC/D;QACE,IAAI,EAAE,kBAAkB;QACxB,EAAE,EAAE,0FAA0F;KAC/F;IACD,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,qCAAqC,EAAE;IACxE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,oEAAoE,EAAE;IAEpG,6EAA6E;IAC7E,EAAE;IACF,8EAA8E;IAC9E,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,yEAAyE;IACzE,qBAAqB;IACrB;QACE,IAAI,EAAE,gCAAgC;QACtC,EAAE,EAAE,+FAA+F;KACpG;IAED,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,kEAAkE;IAClE;QACE,IAAI,EAAE,UAAU;QAChB,EAAE,EAAE,0FAA0F;KAC/F;IACD;QACE,qEAAqE;QACrE,sEAAsE;QACtE,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,uDAAuD;QACvD,IAAI,EAAE,kBAAkB;QACxB,EAAE,EAAE,sKAAsK;KAC3K;IACD;QACE,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,EAAE,kBAAkB;QACxB,EAAE,EAAE,4TAA4T;KACjU;IAED,6EAA6E;IAC7E,gEAAgE;IAChE;QACE,IAAI,EAAE,+BAA+B;QACrC,EAAE,EAAE,wDAAwD;KAC7D;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,0CAA0C;IAC1C;QACE,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,6DAA6D;QAC7D,IAAI,EAAE,wBAAwB;QAC9B,EAAE,EAAE,gLAAgL;KACrL;IAED,qCAAqC;IACrC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,iDAAiD,EAAE;IAE/E,oDAAoD;IACpD,EAAE,IAAI,EAAE,2BAA2B,EAAE,EAAE,EAAE,mCAAmC,EAAE;CAC/E,CAAC;AAEF,gFAAgF;AAChF,SAAgB,WAAW,CAAC,IAAY;IACtC,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,QAAQ,EAAE,CAAC;QACpC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QACjB,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,2EAA2E;YAC3E,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACvE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACrD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,EAAE,CAAC,SAAS,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,MAAM,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAElD,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,2DAA2D;IAC3D,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,KAAK,GAAG,MAAM;YAAE,SAAS,CAAG,mCAAmC;QACrE,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,GAAG,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,CAAC;IACD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,wEAAwE;AACxE,SAAgB,WAAW,CAAC,IAAY;IACtC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/search/tokenize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokenize.d.ts","sourceRoot":"","sources":["../../src/search/tokenize.ts"],"names":[],"mappings":"AASA;;;GAGG;AACH,QAAA,MAAM,SAAS,aAcb,CAAC;AAEH;;;GAGG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKzC;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAI/C;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAqBlD;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkB/C;AAED,OAAO,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"tokenize.d.ts","sourceRoot":"","sources":["../../src/search/tokenize.ts"],"names":[],"mappings":"AASA;;;GAGG;AACH,QAAA,MAAM,SAAS,aAcb,CAAC;AAEH;;;GAGG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKzC;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAI/C;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAqBlD;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA2B/C;AAED,OAAO,EAAE,SAAS,EAAE,CAAC"}

package/dist/search/tokenize.js

@@ -109,6 +109,14 @@ function variants(term) {
         if (/[bcdfglmnprstz]$/.test(term))
             out.add(term + 'es'); // papel -> papeles
     }
+    // Two more folds were tried against the blind retrieval benchmark
+    // (24-08-2026) and neither ships. A participle gender fold (-adas ->
+    // -ado) left every metric exactly unchanged (56/69/0.634), and a verb
+    // person fold (-o <-> -a/-an) made them WORSE (54/67/0.614) — the extra
+    // variants pulled noise above real hits. The remaining recall misses are
+    // true synonym gaps (hosting/alojamiento, seguridad/protección), which no
+    // mechanical rule closes; that is the documented price of not shipping a
+    // semantic model.
     // Nothing shorter than three letters: "es", "os" and friends are noise.
     return [...out].filter(v => v.length >= 3);
 }

package/dist/search/tokenize.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokenize.js","sourceRoot":"","sources":["../../src/search/tokenize.ts"],"names":[],"mappings":";AAAA,oEAAoE;AACpE,sEAAsE;AACtE,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;;;AA0B3E,oBAKC;AAMD,4BAIC;AAOD,gCAqBC;AAWD,4BAkBC;AAhGD;;;GAGG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,UAAU;IACV,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ;IACzE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO;IAC1E,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK;IACxE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK;IAC5E,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI;IACvE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK;IAC5E,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI;IAChC,UAAU;IACV,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;IAC5E,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK;IACvE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IACtE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;CAC/C,CAAC,CAAC;AAgFM,8BAAS;AA9ElB;;;GAGG;AACH,SAAgB,IAAI,CAAC,IAAY;IAC/B,OAAO,IAAI;SACR,SAAS,CAAC,KAAK,CAAC;SAChB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,WAAW,EAAE,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,IAAI,CAAC;SACd,KAAK,CAAC,aAAa,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CAAC,KAAa;IACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC3B,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC1B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjC,0DAA0D;IAC1D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,QAAQ,CAAC,IAAY;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;IAErC,qBAAqB;IACrB,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAG,eAAe;IAC7E,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAU,mBAAmB;IACjF,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAG,qBAAqB;IACnF,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAW,gBAAgB;IAE9E,qBAAqB;IACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;QACpB,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAI,mBAAmB;IACjF,CAAC;IAED,wEAAwE;IACxE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"tokenize.js","sourceRoot":"","sources":["../../src/search/tokenize.ts"],"names":[],"mappings":";AAAA,oEAAoE;AACpE,sEAAsE;AACtE,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;;;AA0B3E,oBAKC;AAMD,4BAIC;AAOD,gCAqBC;AAWD,4BA2BC;AAzGD;;;GAGG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,UAAU;IACV,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ;IACzE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO;IAC1E,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK;IACxE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK;IAC5E,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI;IACvE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK;IAC5E,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI;IAChC,UAAU;IACV,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;IAC5E,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK;IACvE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IACtE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;CAC/C,CAAC,CAAC;AAyFM,8BAAS;AAvFlB;;;GAGG;AACH,SAAgB,IAAI,CAAC,IAAY;IAC/B,OAAO,IAAI;SACR,SAAS,CAAC,KAAK,CAAC;SAChB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,WAAW,EAAE,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,IAAI,CAAC;SACd,KAAK,CAAC,aAAa,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CAAC,KAAa;IACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC3B,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC1B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjC,0DAA0D;IAC1D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,QAAQ,CAAC,IAAY;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;IAErC,qBAAqB;IACrB,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAG,eAAe;IAC7E,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAU,mBAAmB;IACjF,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAG,qBAAqB;IACnF,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAW,gBAAgB;IAE9E,qBAAqB;IACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;QACpB,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAI,mBAAmB;IACjF,CAAC;IAED,kEAAkE;IAClE,qEAAqE;IACrE,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,kBAAkB;IAElB,wEAAwE;IACxE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AAC7C,CAAC"}

package/hooks/crbro-subagent.mjs

@@ -13,10 +13,22 @@
 // neurons in the brain's cortex. One source of truth, so this hook can never
 // drift from what the main session was given.
 //
-// Scoping (opt-in): set CRBRO_SUBAGENT_MATCHER to a regex and the protocols
-// are injected only into subagents whose agent_type matches. Unanchored,
-// case-insensitive. Invalid regex or missing agent_type fail OPEN (inject):
-// scoping must never silently drop the integrity layer.
+// INJECTION IS OPT-IN since 1.12 (set CRBRO_SUBAGENT_INJECT=full to enable).
+// This is not caution — it is the pre-registered consequence of measurement.
+// Three clean-control benchmark runs (blind judges, pre-registered
+// thresholds; see synthetica-decks/benchmarks/) found: frontier models at a
+// perfect ceiling on every measurable agentic probe with and without the
+// block (nothing for injection to add); small models on single-shot tasks
+// HARMED by the block (scope discipline 10/10 bare vs 0/10 injected); and in
+// agentic mode the only differential behavior was against — 2/5 small-model
+// agents WITH the block gamed a failing test suite and reported success,
+// 0/5 without it. An injection that buys no measured behavior and can induce
+// fabricated compliance must not be the default.
+//
+// Scoping (when injection is enabled): set CRBRO_SUBAGENT_MATCHER to a regex
+// and the protocols are injected only into subagents whose agent_type
+// matches. Unanchored, case-insensitive. Invalid regex or missing agent_type
+// fail OPEN (inject): scoping must never silently drop the layer.
 //
 // Failure contract: this hook never blocks a session. Any error — unreadable
 // brain, bad JSON, stdin that never ends (the Windows PowerShell wrapper can
@@ -103,6 +115,13 @@ function inject() {
   }
 }
 
+// Opt-in gate (1.12): without explicit consent, the hook is inert. Silence
+// here is the measured default, not a failure — see the header.
+const INJECT = String(process.env.CRBRO_SUBAGENT_INJECT || '').toLowerCase();
+if (INJECT !== 'full' && INJECT !== '1' && INJECT !== 'on') {
+  process.exit(0);
+}
+
 // A bad regex must never crash the hook; treat it as "no matcher" and inject.
 let matcherRe = null;
 try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crbro-memory",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "mcpName": "io.github.Octonove/crbro-memory",
   "description": "CRBRO — Persistent neural memory for AI. A biological file-based MCP server that gives your AI long-term memory across sessions.",
   "main": "dist/index.js",