dsh-continual-evolve 0.4.0 → 0.6.0

package/lib/command.js

@@ -8,11 +8,13 @@ import { saveHarnessState } from "./state.js";
 import { appendResult, storePaths } from "./store.js";
 import { entrySourceOf } from "./source.js";
 import { filterLogBySession, formatLogLine, pluginLogFilePath } from "./logfile.js";
-import { readBenchmarkFailures, readReviewFailures, summarizeFailures, formatFailureSummary } from "./failures.js";
+import { collectFailureSummary, formatFailureSummary } from "./failures.js";
 import { executeGoalCommand } from "./goal-command.js";
 import { executeMountCommand, executeUnmountCommand } from "./mount-command.js";
 import { executeBenchmarkCommand } from "./benchmark-command.js";
 import { executeWrapupCommand } from "./wrapup-command.js";
+import { loadUsage } from "./usage.js";
+import { planConsolidation } from "./consolidate.js";
 const USAGE = `Usage:
   /evolve                  show this help and the current local store
   /evolve list [global]    list entries (add "global" for the cross-session store)
@@ -24,6 +26,10 @@ const USAGE = `Usage:
   /evolve archive <id> [global]   hide an entry from injection (data kept, restorable)
   /evolve unarchive <id> [global] restore an archived entry
   /evolve demote <id>             hide a (global) entry from injection, keep data
+  /evolve consolidate [apply] [merge]
+                                  report (or apply) a batch archive of conflict-hinted
+                                  and stale zero-use global entries; "merge" folds
+                                  near-duplicate content into the surviving original
   /evolve log [tail N]            show the recent plugin log (default 50 lines)
   /evolve failures               aggregated failure counts (gate + benchmark, by class)
   /evolve export [global] <path>  backup a store to a JSON file
@@ -172,13 +178,43 @@ async function executeEvolveCommand(ctx, engine, invocation, opts, runtime) {
                 }, { scope });
                 return success(renderResult(result));
             }
+            case "consolidate": {
+                // R3: deterministic global-store hygiene. Report by default;
+                // `apply` re-scans fresh state and lands the whole batch as ONE
+                // refinement (single snapshot + audit record, fully rollback-able).
+                // `merge` (P1 反膨胀) additionally merges conflict-pair content
+                // into the surviving original instead of only archiving.
+                const apply = rest[0] === "apply";
+                const merge = rest.includes("merge");
+                const state = engine.load("global", undefined);
+                const { candidates, edits } = planConsolidation(state, loadUsage(engine.baseDir), Date.now(), { mergeDuplicates: merge });
+                if (candidates.length === 0) {
+                    return success("global store is already consolidated — no conflict-hinted or stale zero-use entries.");
+                }
+                const mergeCount = merge ? candidates.filter((candidate) => candidate.mergeInto).length : 0;
+                const report = candidates
+                    .map((candidate, index) => {
+                    const mergeNote = candidate.mergeInto && merge ? ` → 内容并入 ${candidate.mergeInto.id}` : "";
+                    return `${index + 1}. [${candidate.kind}:${candidate.id}] ${candidate.title}${mergeNote}\n   ${candidate.reason}`;
+                })
+                    .join("\n");
+                if (!apply) {
+                    return success(`consolidation plan — ${candidates.length} archive candidate(s):\n${report}\n(run "/evolve consolidate apply" to archive all of them in one refinement; add "merge" to fold near-duplicate content into the survivors)`);
+                }
+                const result = engine.apply("global", undefined, {
+                    summary: `Consolidate global store: archive ${candidates.length} entries${mergeCount > 0 ? `, merge ${mergeCount} into survivors` : ""}`,
+                    rationale: "Human-invoked batch consolidation via /evolve consolidate apply.",
+                    expectedOutcome: "Candidate entries are hidden from injection (data kept; restorable via /evolve unarchive). Merged survivors carry the near-duplicate content with a mergedFrom provenance stamp.",
+                    edits,
+                }, { scope: "global" });
+                return success(`${report}\n\napplied:\n${renderResult(result)}`);
+            }
             case "failures": {
                 // /evolve failures — failure-signature aggregation (D1 observation):
                 // failed review-gate records + failed benchmark cells, counted by class.
-                const failed = [...readReviewFailures(engine.baseDir), ...readBenchmarkFailures(engine.baseDir)];
-                const summary = summarizeFailures(failed);
+                const { summary, records } = collectFailureSummary(engine.baseDir);
                 const parts = formatFailureSummary(summary).split("\n");
-                const recent = failed
+                const recent = records
                     .sort((a, b) => (b.timestamp ?? "").localeCompare(a.timestamp ?? ""))
                     .slice(0, 10)
                     .map((f) => `  [${f.timestamp ?? "(benchmark)"}] ${f.kind} · ${f.source}: ${f.message.slice(0, 140)}`);
@@ -234,7 +270,7 @@ async function executeEvolveCommand(ctx, engine, invocation, opts, runtime) {
                     refinements: state.refinements,
                     history,
                 };
-                writeFileSync(path, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
+                writeFileSync(path, `${JSON.stringify(payload, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
                 return success(`exported ${scope} store (${Object.values(state.entries).reduce((n, e) => n + Object.keys(e).length, 0)} entries, ${history.length} refinements) to ${path}`);
             }
             case "import": {

package/lib/consolidate.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Global-store consolidation (R3): turn the two hygiene signals — R2's
+ * `conflictHint` stamps and usage v2's zero-injection staleness — into one
+ * deterministic, human-approved batch of archive edits (`/evolve consolidate`).
+ *
+ * Design (ADR implemented/feature/2026-08-24-consolidation-command.md):
+ * - pure functions only; the command layer owns loading, reporting, and the
+ *   apply phase, and ALWAYS re-scans fresh state before applying (the report
+ *   and the apply are two separate invocations — prefer under-archiving over
+ *   mis-archiving when state moved in between);
+ * - archiving keeps data (ARCHIVED_AT_KEY stamp, restorable via
+ *   `/evolve unarchive`) and preserves every existing metadata key including
+ *   the conflictHint itself, so unarchived entries keep their trail;
+ * - no LLM call anywhere: code proposes, the human disposes.
+ */
+import type { HarnessState, RefinementEdit, RefinementKind } from "./types.js";
+import { type UsageStore } from "./usage.js";
+/** Zero-use entries at least this old are stale candidates (30d, matching the injection recency half-life scale). */
+export declare const STALE_MIN_AGE_MS: number;
+/** Parsed `<kind>:<id>:<score>` value of a {@link CONFLICT_HINT_KEY} stamp. */
+export interface ConflictHint {
+    kind: RefinementKind;
+    id: string;
+    score: number;
+}
+/**
+ * Parse one conflictHint metadata value. Returns undefined for anything that
+ * is not exactly `<kind>:<id>:<score>` with a known kind and a score in
+ * [0, 1] — foreign or legacy junk must never crash the scan.
+ */
+export declare function parseConflictHint(value: unknown): ConflictHint | undefined;
+/** One planned archive with its human-readable justification. */
+export interface ConsolidationCandidate {
+    kind: RefinementKind;
+    id: string;
+    title: string;
+    reason: string;
+    /**
+     * Merge tier (P1 反膨胀): set on conflict-pair candidates — the entry's
+     * content merges into this survivor (pointed-to original) before the
+     * entry itself archives, so nothing readable is lost by the archive. The
+     * plan only EMITS the merge when `mergeDuplicates` is on.
+     */
+    mergeInto?: {
+        kind: RefinementKind;
+        id: string;
+        title: string;
+    };
+}
+/**
+ * Entries stamped by the write-time conflict guard whose target still exists
+ * and is still active. The hinted (newer) entry is the archive candidate —
+ * the pointed-to original stays as the live copy.
+ */
+export declare function findConflictPairs(state: HarnessState): ConsolidationCandidate[];
+/**
+ * Active global entries never injected in any session and untouched for at
+ * least `minAgeMs`: prime staleness candidates. Operates on whatever state
+ * it is handed (callers pass the global store).
+ */
+export declare function findStaleEntries(state: HarnessState, store: UsageStore, now: number, minAgeMs?: number): ConsolidationCandidate[];
+/**
+ * Append a source entry's content to a survivor with an attributed divider,
+ * so the survivor's reader can see which part came from which entry.
+ */
+export declare function mergeContent(target: string, source: string, sourceRef: string, dateIso: string): string;
+/**
+ * Merge both scans (conflict reason wins on overlap), deduped by kind:id,
+ * and build the batch archive edits. Each edit preserves the entry's full
+ * content and existing metadata — only ARCHIVED_AT_KEY is added — so
+ * `/evolve unarchive` restores everything intact.
+ *
+ * With `opts.mergeDuplicates`, conflict-pair candidates additionally merge
+ * their content INTO the pointed-to survivor (an attributed `mergeContent`
+ * section + a `mergedFrom` provenance stamp) before archiving — the #11
+ * candidate-c tier the 2026-08-28 ecosystem review promoted. Per-target
+ * accumulation composes multiple hints into one survivor (update edits
+ * replace content/metadata wholesale, so parallel merge edits would clobber
+ * each other).
+ *
+ * @param now Epoch ms used for the archivedAt stamp (injected for tests).
+ */
+export declare function planConsolidation(state: HarnessState, store: UsageStore, now?: number, opts?: {
+    minAgeMs?: number;
+    mergeDuplicates?: boolean;
+}): {
+    candidates: ConsolidationCandidate[];
+    edits: RefinementEdit[];
+};
+//# sourceMappingURL=consolidate.d.ts.map

package/lib/consolidate.js

@@ -0,0 +1,180 @@
+import { ARCHIVED_AT_KEY, CONFLICT_HINT_KEY, MERGED_FROM_KEY, isArchived } from "./types.js";
+import { getUsageCount } from "./usage.js";
+/** Zero-use entries at least this old are stale candidates (30d, matching the injection recency half-life scale). */
+export const STALE_MIN_AGE_MS = 30 * 24 * 60 * 60 * 1000;
+const KINDS = ["prompt", "memory", "skill", "subagent"];
+/**
+ * Parse one conflictHint metadata value. Returns undefined for anything that
+ * is not exactly `<kind>:<id>:<score>` with a known kind and a score in
+ * [0, 1] — foreign or legacy junk must never crash the scan.
+ */
+export function parseConflictHint(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const parts = value.split(":");
+    if (parts.length !== 3) {
+        return undefined;
+    }
+    const [kind, id, rawScore] = parts;
+    if (!kind || !id || !rawScore || !KINDS.includes(kind)) {
+        return undefined;
+    }
+    const score = Number(rawScore);
+    if (!Number.isFinite(score) || score < 0 || score > 1) {
+        return undefined;
+    }
+    return { kind: kind, id, score };
+}
+/**
+ * Entries stamped by the write-time conflict guard whose target still exists
+ * and is still active. The hinted (newer) entry is the archive candidate —
+ * the pointed-to original stays as the live copy.
+ */
+export function findConflictPairs(state) {
+    const candidates = [];
+    for (const kind of KINDS) {
+        for (const entry of Object.values(state.entries[kind])) {
+            if (isArchived(entry))
+                continue;
+            const hint = parseConflictHint(entry.metadata[CONFLICT_HINT_KEY]);
+            if (!hint || hint.kind !== kind)
+                continue;
+            const target = state.entries[hint.kind]?.[hint.id];
+            if (!target || isArchived(target))
+                continue;
+            candidates.push({
+                kind,
+                id: entry.id,
+                title: entry.title,
+                reason: `near-duplicate of ${hint.id} 「${target.title}」 (${Math.round(hint.score * 100)}%) — keep the original`,
+                mergeInto: { kind: hint.kind, id: hint.id, title: target.title },
+            });
+        }
+    }
+    return candidates;
+}
+/**
+ * Active global entries never injected in any session and untouched for at
+ * least `minAgeMs`: prime staleness candidates. Operates on whatever state
+ * it is handed (callers pass the global store).
+ */
+export function findStaleEntries(state, store, now, minAgeMs = STALE_MIN_AGE_MS) {
+    const candidates = [];
+    for (const kind of KINDS) {
+        for (const entry of Object.values(state.entries[kind])) {
+            if (isArchived(entry))
+                continue;
+            if (getUsageCount(store, kind, entry.id) !== 0)
+                continue;
+            const updatedAt = Date.parse(entry.updated_at);
+            if (Number.isNaN(updatedAt) || now - updatedAt < minAgeMs)
+                continue;
+            candidates.push({
+                kind,
+                id: entry.id,
+                title: entry.title,
+                reason: `0 injections since ${entry.updated_at.slice(0, 10)} (stale)`,
+            });
+        }
+    }
+    return candidates;
+}
+/**
+ * Append a source entry's content to a survivor with an attributed divider,
+ * so the survivor's reader can see which part came from which entry.
+ */
+export function mergeContent(target, source, sourceRef, dateIso) {
+    const body = source.trim();
+    if (body.length === 0) {
+        return target;
+    }
+    return `${target.trimEnd()}\n\n---\n[Merged from ${sourceRef} on ${dateIso.slice(0, 10)} — near-duplicate consolidated]\n${body}`;
+}
+/** Existing `<kind>:<id>` strings of a target's {@link MERGED_FROM_KEY} trail. */
+function existingMergedFrom(metadata) {
+    const value = metadata[MERGED_FROM_KEY];
+    return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+/**
+ * Merge both scans (conflict reason wins on overlap), deduped by kind:id,
+ * and build the batch archive edits. Each edit preserves the entry's full
+ * content and existing metadata — only ARCHIVED_AT_KEY is added — so
+ * `/evolve unarchive` restores everything intact.
+ *
+ * With `opts.mergeDuplicates`, conflict-pair candidates additionally merge
+ * their content INTO the pointed-to survivor (an attributed `mergeContent`
+ * section + a `mergedFrom` provenance stamp) before archiving — the #11
+ * candidate-c tier the 2026-08-28 ecosystem review promoted. Per-target
+ * accumulation composes multiple hints into one survivor (update edits
+ * replace content/metadata wholesale, so parallel merge edits would clobber
+ * each other).
+ *
+ * @param now Epoch ms used for the archivedAt stamp (injected for tests).
+ */
+export function planConsolidation(state, store, now = Date.now(), opts) {
+    const byKey = new Map();
+    for (const candidate of [...findConflictPairs(state), ...findStaleEntries(state, store, now, opts?.minAgeMs)]) {
+        const key = `${candidate.kind}:${candidate.id}`;
+        if (!byKey.has(key)) {
+            byKey.set(key, candidate);
+        }
+    }
+    const candidates = [...byKey.values()];
+    const dateIso = new Date(now).toISOString();
+    // A merge survivor must not itself be an archive candidate in the same
+    // batch: its archive edit is built from the ORIGINAL state snapshot, so it
+    // would overwrite the merge edit's content/mergedFrom wholesale and then
+    // archive the survivor (review audit 2026-08-28 S2). Survivors stay live;
+    // their merge lands, the source archives.
+    const mergeTargets = new Set(candidates.filter((candidate) => candidate.mergeInto).map((candidate) => `${candidate.mergeInto.kind}:${candidate.mergeInto.id}`));
+    const archiveCandidates = candidates.filter((candidate) => !mergeTargets.has(`${candidate.kind}:${candidate.id}`));
+    const edits = archiveCandidates.map((candidate) => {
+        const entry = state.entries[candidate.kind][candidate.id];
+        const metadata = { ...entry?.metadata, [ARCHIVED_AT_KEY]: dateIso };
+        return {
+            action: "update",
+            kind: candidate.kind,
+            id: candidate.id,
+            title: candidate.title,
+            content: entry?.content ?? "",
+            metadata,
+        };
+    });
+    if (opts?.mergeDuplicates) {
+        const merges = new Map();
+        for (const candidate of candidates) {
+            if (!candidate.mergeInto)
+                continue;
+            const source = state.entries[candidate.kind][candidate.id];
+            const target = state.entries[candidate.mergeInto.kind]?.[candidate.mergeInto.id];
+            if (!source || !target)
+                continue;
+            const key = `${candidate.mergeInto.kind}:${candidate.mergeInto.id}`;
+            const acc = merges.get(key) ??
+                {
+                    kind: candidate.mergeInto.kind,
+                    id: candidate.mergeInto.id,
+                    title: target.title,
+                    content: target.content,
+                    mergedFrom: existingMergedFrom(target.metadata),
+                    metadata: target.metadata,
+                };
+            acc.content = mergeContent(acc.content, source.content ?? "", `${candidate.kind}:${candidate.id}`, dateIso);
+            acc.mergedFrom.push(`${candidate.kind}:${candidate.id}`);
+            merges.set(key, acc);
+        }
+        for (const acc of merges.values()) {
+            edits.unshift({
+                action: "update",
+                kind: acc.kind,
+                id: acc.id,
+                title: acc.title,
+                content: acc.content,
+                metadata: { ...acc.metadata, [MERGED_FROM_KEY]: acc.mergedFrom },
+            });
+        }
+    }
+    return { candidates, edits };
+}
+//# sourceMappingURL=consolidate.js.map

package/lib/failures.d.ts

@@ -33,7 +33,10 @@ export declare function readReviewFailures(baseDir: string): FailureRecord[];
  */
 export declare function readBenchmarkFailures(baseDir: string): FailureRecord[];
 /** Combine both sources into one summary. */
-export declare function collectFailureSummary(baseDir: string): FailureSummary;
+export declare function collectFailureSummary(baseDir: string): {
+    summary: FailureSummary;
+    records: FailureRecord[];
+};
 /** Human-readable report for the command line. */
 export declare function formatFailureSummary(summary: FailureSummary): string;
 //# sourceMappingURL=failures.d.ts.map

package/lib/failures.js

@@ -143,7 +143,8 @@ export function readBenchmarkFailures(baseDir) {
 }
 /** Combine both sources into one summary. */
 export function collectFailureSummary(baseDir) {
-    return summarizeFailures([...readReviewFailures(baseDir), ...readBenchmarkFailures(baseDir)]);
+    const records = [...readReviewFailures(baseDir), ...readBenchmarkFailures(baseDir)];
+    return { summary: summarizeFailures(records), records };
 }
 /** Human-readable report for the command line. */
 export function formatFailureSummary(summary) {

package/lib/index.d.ts

@@ -34,6 +34,12 @@ export declare const Config: z<Schemastery.ObjectS<{
     logMaxBytes: z<number, number>;
     /** After a benchmark decision rejects a candidate, roll the refinement back automatically. */
     autoRollbackOnReject: z<boolean, boolean>;
+    /**
+     * P1 auto-case capture: failed evolution attempts (benchmark-rejected
+     * candidates, gate proposals without consent) land as draft cases in the
+     * auto-regression container benchmark, seeding the regression loop.
+     */
+    autoCase: z<boolean, boolean>;
     /**
      * Gap C1: optional model override for the review gate (cheaper model).
      * Format: "provider/model" or just "model" (same provider as the agent).
@@ -97,6 +103,12 @@ export declare const Config: z<Schemastery.ObjectS<{
     logMaxBytes: z<number, number>;
     /** After a benchmark decision rejects a candidate, roll the refinement back automatically. */
     autoRollbackOnReject: z<boolean, boolean>;
+    /**
+     * P1 auto-case capture: failed evolution attempts (benchmark-rejected
+     * candidates, gate proposals without consent) land as draft cases in the
+     * auto-regression container benchmark, seeding the regression loop.
+     */
+    autoCase: z<boolean, boolean>;
     /**
      * Gap C1: optional model override for the review gate (cheaper model).
      * Format: "provider/model" or just "model" (same provider as the agent).

package/lib/index.js

@@ -53,6 +53,12 @@ export const Config = z.object({
     logMaxBytes: z.natural().default(5 * 1024 * 1024),
     /** After a benchmark decision rejects a candidate, roll the refinement back automatically. */
     autoRollbackOnReject: z.boolean().default(true),
+    /**
+     * P1 auto-case capture: failed evolution attempts (benchmark-rejected
+     * candidates, gate proposals without consent) land as draft cases in the
+     * auto-regression container benchmark, seeding the regression loop.
+     */
+    autoCase: z.boolean().default(true),
     /**
      * Gap C1: optional model override for the review gate (cheaper model).
      * Format: "provider/model" or just "model" (same provider as the agent).
@@ -127,9 +133,11 @@ export function apply(ctx, config) {
         minPromoteChars: config.promotionMinChars,
     });
     registerEvolveTools(ctx, engine, gate);
+    const rubricKey = resolveRubricKey(baseDir, config.rubricKey, process.env, (m) => ctx.logger("continual-evolve").warn(m));
     registerEvolveCommand(ctx, engine, gate, {
-        rubricKey: resolveRubricKey(baseDir, config.rubricKey, process.env, (m) => ctx.logger("continual-evolve").warn(m)),
+        rubricKey,
         autoRollbackOnReject: config.autoRollbackOnReject ?? true,
+        autoCase: config.autoCase ?? true,
         promotionPolicy,
     });
     // Plugin-owned file logging: every cordis log message lands in
@@ -155,6 +163,8 @@ export function apply(ctx, config) {
             fateIntervalTurns: config.fateIntervalTurns ?? config.reviewIntervalTurns ?? 6,
             goalBlockedWrapupTurns: config.goalBlockedWrapupTurns ?? 3,
             promotionPolicy,
+            autoCase: config.autoCase ?? true,
+            rubricKey,
             ...(config.reviewModel ? { reviewModel: config.reviewModel } : {}),
         });
         ctx.logger("continual-evolve").info(`continual-evolve auto-review enabled (every ${config.reviewIntervalTurns ?? 6} turns; local-fate ${config.localFate ?? true ? "on" : "off"} every ${config.fateIntervalTurns ?? config.reviewIntervalTurns ?? 6} turns)`);

package/lib/inject.d.ts

@@ -19,6 +19,9 @@
  */
 import type { HarnessEntry, HarnessState } from "./types.js";
 import type { EvolutionEngine } from "./service.js";
+import { tokenize } from "./search.js";
+/** CJK-bigram tokenizer re-exported for ranking consumers (see search.ts). */
+export { tokenize };
 /** Prompt sections render at most this many entries per kind. */
 export declare const MAX_INJECTED_ENTRIES_PER_KIND = 6;
 /** Per-entry content budget inside the injected block (matches render.ts). */
@@ -60,17 +63,6 @@ export interface AgentLike {
 export interface InjectContext {
     agent?: AgentLike;
 }
-/**
- * Lowercase tokenization for the keyword relevance scorer: runs of ASCII
- * alphanumerics and CJK characters become tokens (CJK is not split so whole
- * Chinese words/characters stay comparable), everything else is a separator.
- */
-export declare function tokenize(text: string): string[];
-/**
- * Keyword hit count of `query` tokens inside an entry: title hits weigh 2×,
- * content/path hits 1×. BM25-level relevance without any external service.
- */
-export declare function relevanceHits(entry: HarnessEntry, query: string): number;
 /**
  * Normalized recency in [0, 1]: 1 when the entry was just updated, decaying
  * linearly to 0 after {@link RECENCY_HALF_LIFE_MS}. Unparseable timestamps
@@ -78,12 +70,16 @@ export declare function relevanceHits(entry: HarnessEntry, query: string): numbe
  */
 export declare function recencyScore(entry: HarnessEntry, now: number): number;
 /**
- * Rank entries for injection, best first. With no query the ranking is pure
- * recency (newest first). With a query, any entry with at least one keyword
- * hit outranks every hit-less entry (`hits * 2 + recency <= 1` for the
- * latter), and hits decide the order among relevant entries; recency then
- * breaks remaining ties, and the stable dictionary order is the final
- * tiebreak, so the result is deterministic.
+ * Rank entries for injection, best first. With no query the ranking is
+ * negative-valence first (contradicted entries last), then pure recency
+ * (newest first). With a query, entries are scored once against a per-call
+ * BM25 index (CJK bigrams; field-weighted title ×2 — see search.ts): any
+ * entry with a positive score (≥1 matched token) outranks every hit-less
+ * entry (score exactly 0), scores decide the order among relevant entries,
+ * the negative-valence counter breaks remaining ties (contradicted entries
+ * sink), recency breaks remaining ties, and the stable dictionary order is
+ * the final tiebreak, so the result is deterministic. The input is never
+ * mutated.
  */
 export declare function rankEntries(entries: readonly HarnessEntry[], query?: string, now?: number): HarnessEntry[];
 /**

package/lib/inject.js

@@ -1,7 +1,10 @@
-import { isArchived } from "./types.js";
+import { isArchived, VALENCE_NEGATIVE_KEY } from "./types.js";
 import { mergeHarnessStates } from "./state.js";
 import { entryLine } from "./render.js";
 import { recordInjection } from "./usage.js";
+import { buildRelevanceIndex, relevanceScore, tokenize } from "./search.js";
+/** CJK-bigram tokenizer re-exported for ranking consumers (see search.ts). */
+export { tokenize };
 /** Prompt sections render at most this many entries per kind. */
 export const MAX_INJECTED_ENTRIES_PER_KIND = 6;
 /** Per-entry content budget inside the injected block (matches render.ts). */
@@ -18,31 +21,6 @@ export const MAX_QUERY_CHARS = 400;
 function stableCompare(a, b) {
     return [a.path, a.title, a.id].join("\0").localeCompare([b.path, b.title, b.id].join("\0"));
 }
-/**
- * Lowercase tokenization for the keyword relevance scorer: runs of ASCII
- * alphanumerics and CJK characters become tokens (CJK is not split so whole
- * Chinese words/characters stay comparable), everything else is a separator.
- */
-export function tokenize(text) {
-    return text
-        .toLowerCase()
-        .split(/[^a-z0-9\u4e00-\u9fff]+/)
-        .filter((token) => token.length > 0);
-}
-/**
- * Keyword hit count of `query` tokens inside an entry: title hits weigh 2×,
- * content/path hits 1×. BM25-level relevance without any external service.
- */
-export function relevanceHits(entry, query) {
-    const titleTokens = tokenize(entry.title);
-    const bodyTokens = tokenize(`${entry.content} ${entry.path}`);
-    let hits = 0;
-    for (const token of tokenize(query)) {
-        hits += titleTokens.filter((t) => t === token).length * 2;
-        hits += bodyTokens.filter((t) => t === token).length;
-    }
-    return hits;
-}
 /**
  * Normalized recency in [0, 1]: 1 when the entry was just updated, decaying
  * linearly to 0 after {@link RECENCY_HALF_LIFE_MS}. Unparseable timestamps
@@ -60,21 +38,55 @@ export function recencyScore(entry, now) {
     return Math.max(0, 1 - age / RECENCY_HALF_LIFE_MS);
 }
 /**
- * Rank entries for injection, best first. With no query the ranking is pure
- * recency (newest first). With a query, any entry with at least one keyword
- * hit outranks every hit-less entry (`hits * 2 + recency <= 1` for the
- * latter), and hits decide the order among relevant entries; recency then
- * breaks remaining ties, and the stable dictionary order is the final
- * tiebreak, so the result is deterministic.
+ * Negative-valence counter (P1 效价反馈): entries contradicted by later
+ * assessments sink below clean ones at equal relevance/recency — the
+ * behavioral analog of a confidence penalty (pi-continuous-learning's
+ * contradicted −0.15), without inventing a new score axis.
+ */
+function negativeValence(entry) {
+    const value = entry.metadata[VALENCE_NEGATIVE_KEY];
+    return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : 0;
+}
+/**
+ * Rank entries for injection, best first. With no query the ranking is
+ * negative-valence first (contradicted entries last), then pure recency
+ * (newest first). With a query, entries are scored once against a per-call
+ * BM25 index (CJK bigrams; field-weighted title ×2 — see search.ts): any
+ * entry with a positive score (≥1 matched token) outranks every hit-less
+ * entry (score exactly 0), scores decide the order among relevant entries,
+ * the negative-valence counter breaks remaining ties (contradicted entries
+ * sink), recency breaks remaining ties, and the stable dictionary order is
+ * the final tiebreak, so the result is deterministic. The input is never
+ * mutated.
  */
 export function rankEntries(entries, query, now = Date.now()) {
     const q = (query ?? "").trim();
-    return [...entries].sort((a, b) => {
-        if (q.length > 0) {
-            const relevanceDelta = relevanceHits(b, q) * 2 - relevanceHits(a, q) * 2;
-            if (relevanceDelta !== 0) {
-                return relevanceDelta;
+    if (q.length === 0) {
+        return [...entries].sort((a, b) => {
+            const valenceDelta = negativeValence(a) - negativeValence(b);
+            if (valenceDelta !== 0) {
+                return valenceDelta;
+            }
+            const recencyDelta = recencyScore(b, now) - recencyScore(a, now);
+            if (recencyDelta !== 0) {
+                return recencyDelta;
             }
+            return stableCompare(a, b);
+        });
+    }
+    // Precompute scores once: the old comparator re-tokenized both sides on
+    // every comparison (O(n log n) tokenizations); one index + one score per
+    // entry turns the pass into table lookups.
+    const index = buildRelevanceIndex(entries);
+    const scores = new Map(entries.map((entry) => [entry, relevanceScore(index, entry, q)]));
+    return [...entries].sort((a, b) => {
+        const relevanceDelta = (scores.get(b) ?? 0) - (scores.get(a) ?? 0);
+        if (relevanceDelta !== 0) {
+            return relevanceDelta;
+        }
+        const valenceDelta = negativeValence(a) - negativeValence(b);
+        if (valenceDelta !== 0) {
+            return valenceDelta;
         }
         const recencyDelta = recencyScore(b, now) - recencyScore(a, now);
         if (recencyDelta !== 0) {

package/lib/mount.js

@@ -16,6 +16,7 @@
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { skillNameOf } from "./skill.js";
+import { secretLeakReason } from "./promotion.js";
 export function mountedDir(baseDir) {
     return join(baseDir, "evolve", "mounted");
 }
@@ -41,6 +42,14 @@ export function saveLedger(baseDir, ledger) {
 }
 /** Generate the plugin package files for one skill entry; returns the package dir. */
 export function renderMountPackage(baseDir, entry) {
+    // Secret-leak quarantine: the entry content AND its reference contract are
+    // embedded verbatim into the generated index.js, so a credential in either
+    // would be written to disk (and executed in-process). Block before ANY
+    // file is created (review audit 2026-08-28 B2: reference was unscreened).
+    const secret = secretLeakReason([entry.title, entry.content, JSON.stringify(entry.reference ?? {}), JSON.stringify(entry.arguments ?? {})].join("\n"));
+    if (secret) {
+        throw new Error(`mount blocked: ${secret}`);
+    }
     const dir = join(mountedDir(baseDir), skillNameOf(entry.id));
     mkdirSync(dir, { recursive: true });
     const toolName = `skill_${skillNameOf(entry.id)}`;