jeo-code 0.7.19 → 0.7.20

package/CHANGELOG.md

@@ -6,6 +6,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.7.20] - 2026-06-26
+_OKF concept-memory retrieval gains a hybrid reranker ported from memsearch. Injection priority no longer rides one raw keyword score — it fuses two complementary ranked channels by Reciprocal Rank Fusion (RRF): IDF-weighted lexical relevance (the sparse/BM25 channel, so rare discriminating terms steer recall) and concept-graph proximity (the local dense/semantic-neighbour channel, so a hub linked from multiple query hits surfaces even with no keyword of its own). All embedding-free and deterministic, layered atop the existing failure-first tier and pinned-invariant reserved budget._
+
+### Added
+- **IDF-weighted lexical scoring (`buildCorpusStats` / `tokenIdf`).** `src/agent/memory.ts` adds `CorpusStats` (corpus size + per-token document frequency) built once per retrieval pass, and BM25-style non-negative IDF `ln(1 + (N − df + 0.5)/(df + 0.5))`. `scoreConcept` now takes optional `stats` and scales each token's field weight (title ≫ tags ≫ type/description ≫ body) by its IDF, so a rare specific term outranks a concept hit only by common filler. Always > 0 for a present token, so the score-presence semantics the failure-gate and filters depend on are preserved; omitting `stats` keeps the raw field-weighted count.
+- **Reciprocal Rank Fusion (`reciprocalRankFusion`, k=60).** Fuses several ranked id-lists into one score map — each list contributes `1/(k + rank)` summed across lists, rank-based (not score-based) so a strong lexical hit and a strong graph-proximity hit combine on equal, scale-free footing, and a concept ranked in BOTH channels rises above one strong in only one. Tunable `k`; an empty channel is a no-op.
+- **Graph-proximity channel (`graphProximityOrder`).** Ranks concepts by how many distinct query-hit seeds reach them via 1-hop links (using the public `expandByGraph` API), the local stand-in for memsearch's dense-vector channel: a strongly-connected neighbour surfaces even when its own lexical score is weak. Input order breaks ties.
+
+### Changed
+- **`priorityOrder` fuses lexical ⊕ graph by RRF instead of raw score + a boolean `related` flag.** The failure-first and high-confidence "core" tiers are unchanged; below them, the prior `score`-then-`related` ordering is replaced by the fused RRF rank, with input order as the stable final tiebreak. `searchConcepts` now IDF-weights via `buildCorpusStats` too. The failure boost still only fires on an actual query hit (score > 0).
+
+### Verified
+- `bun run typecheck` clean; full suite green — 2022 pass / 0 fail across 234 files — including new `test/memory-search-okf.test.ts` cases (`buildCorpusStats` document-frequency counting, `scoreConcept` IDF scaling, a rare term outranking a higher raw-weight common term, `reciprocalRankFusion` cross-channel summation + tunable `k` + empty-channel no-op, graph proximity lifting a multiply-linked hub above an unlinked equal-score concept). `scripts/rrf-runtime-check.ts` drives the production `memoryPromptSection` against a real on-disk bundle.
+
+
 ## [0.7.19] - 2026-06-26
 _The live model picker gains gajae-code's `/model` provider tabs, and skill invocation is consolidated onto a single `$` entrypoint. The picker now shows an `ALL` tab plus one tab per provider that `tab`/`shift+tab` cycles, and skills (including their declared aliases) are invoked only via `$` — the slash palette stays builtins-only._
 

package/README.ja.md

@@ -205,11 +205,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.20]** (2026-06-26) — OKF concept-memory retrieval gains a hybrid reranker ported from memsearch. Injection priority no longer rides one raw keyword score — it fuses two complementary ranked channels by Reciprocal Rank Fusion (RRF): IDF-weighted lexical relevance (the sparse/BM25 channel, so rare discriminating terms steer recall) and concept-graph proximity (the local dense/semantic-neighbour channel, so a hub linked from multiple query hits surfaces even with no keyword of its own). All embedding-free and deterministic, layered atop the existing failure-first tier and pinned-invariant reserved budget.
 - **[0.7.19]** (2026-06-26) — The live model picker gains gajae-code's `/model` provider tabs, and skill invocation is consolidated onto a single `$` entrypoint. The picker now shows an `ALL` tab plus one tab per provider that `tab`/`shift+tab` cycles, and skills (including their declared aliases) are invoked only via `$` — the slash palette stays builtins-only.
 - **[0.7.18]** (2026-06-26) — Slash-command discovery and the `/model` flow reach gajae-code parity. The slash palette/autocomplete now fuzzy-matches command names (with a description fallback for intent-style queries), resolved skills can contribute their own `/aliases` as real dispatchable commands, and `/model` runs gjc's two-menu target → reasoning flow so a picked model can be assigned to the default or any subagent role with its own thinking budget.
 - **[0.7.17]** (2026-06-25) — Developer workflow parity (gjc `dev:link`/`dev:doctor`, adapted for jeo's zero-native-dep Bun runtime): the global `jeo` command can be linked to run this checkout's source hot to every edit, with a drift doctor that flags when `jeo` resolves to a compiled binary or an installed copy instead. README gains "Skill migration and bundled skill inspection" + "Development" sections. Also ships OKF concept-memory search/scoring with budget-aware injection and a round of workflow-prompt hardening (anti-punt, todo-first planning, verdict discipline) that keeps every loop escape hatch intact.
 - **[0.7.16]** (2026-06-25) — Bundled skills get a safe installer: `jeo skills sync` materializes the built-in workflow skills into `~/.jeo/skills`, preserving local edits by default, with a CI-friendly `--check` drift report and a `--force` overwrite.
-- **[0.7.15]** (2026-06-25) — Rollback release: the runtime source and test suite are restored to the **0.7.9** state. The intervening 0.7.10–0.7.14 runtime changes (quiet-mode/`-q`, `/resume` transcript rework, `mutatedFiles` plumbing, Ollama `num_ctx`, tmux REPL reaping, and related engine/provider/TUI edits) are reverted. Published as a new version because npm cannot re-issue an existing version number; `latest` now serves code identical to 0.7.9.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -205,11 +205,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.20]** (2026-06-26) — OKF concept-memory retrieval gains a hybrid reranker ported from memsearch. Injection priority no longer rides one raw keyword score — it fuses two complementary ranked channels by Reciprocal Rank Fusion (RRF): IDF-weighted lexical relevance (the sparse/BM25 channel, so rare discriminating terms steer recall) and concept-graph proximity (the local dense/semantic-neighbour channel, so a hub linked from multiple query hits surfaces even with no keyword of its own). All embedding-free and deterministic, layered atop the existing failure-first tier and pinned-invariant reserved budget.
 - **[0.7.19]** (2026-06-26) — The live model picker gains gajae-code's `/model` provider tabs, and skill invocation is consolidated onto a single `$` entrypoint. The picker now shows an `ALL` tab plus one tab per provider that `tab`/`shift+tab` cycles, and skills (including their declared aliases) are invoked only via `$` — the slash palette stays builtins-only.
 - **[0.7.18]** (2026-06-26) — Slash-command discovery and the `/model` flow reach gajae-code parity. The slash palette/autocomplete now fuzzy-matches command names (with a description fallback for intent-style queries), resolved skills can contribute their own `/aliases` as real dispatchable commands, and `/model` runs gjc's two-menu target → reasoning flow so a picked model can be assigned to the default or any subagent role with its own thinking budget.
 - **[0.7.17]** (2026-06-25) — Developer workflow parity (gjc `dev:link`/`dev:doctor`, adapted for jeo's zero-native-dep Bun runtime): the global `jeo` command can be linked to run this checkout's source hot to every edit, with a drift doctor that flags when `jeo` resolves to a compiled binary or an installed copy instead. README gains "Skill migration and bundled skill inspection" + "Development" sections. Also ships OKF concept-memory search/scoring with budget-aware injection and a round of workflow-prompt hardening (anti-punt, todo-first planning, verdict discipline) that keeps every loop escape hatch intact.
 - **[0.7.16]** (2026-06-25) — Bundled skills get a safe installer: `jeo skills sync` materializes the built-in workflow skills into `~/.jeo/skills`, preserving local edits by default, with a CI-friendly `--check` drift report and a `--force` overwrite.
-- **[0.7.15]** (2026-06-25) — Rollback release: the runtime source and test suite are restored to the **0.7.9** state. The intervening 0.7.10–0.7.14 runtime changes (quiet-mode/`-q`, `/resume` transcript rework, `mutatedFiles` plumbing, Ollama `num_ctx`, tmux REPL reaping, and related engine/provider/TUI edits) are reverted. Published as a new version because npm cannot re-issue an existing version number; `latest` now serves code identical to 0.7.9.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -232,11 +232,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.20]** (2026-06-26) — OKF concept-memory retrieval gains a hybrid reranker ported from memsearch. Injection priority no longer rides one raw keyword score — it fuses two complementary ranked channels by Reciprocal Rank Fusion (RRF): IDF-weighted lexical relevance (the sparse/BM25 channel, so rare discriminating terms steer recall) and concept-graph proximity (the local dense/semantic-neighbour channel, so a hub linked from multiple query hits surfaces even with no keyword of its own). All embedding-free and deterministic, layered atop the existing failure-first tier and pinned-invariant reserved budget.
 - **[0.7.19]** (2026-06-26) — The live model picker gains gajae-code's `/model` provider tabs, and skill invocation is consolidated onto a single `$` entrypoint. The picker now shows an `ALL` tab plus one tab per provider that `tab`/`shift+tab` cycles, and skills (including their declared aliases) are invoked only via `$` — the slash palette stays builtins-only.
 - **[0.7.18]** (2026-06-26) — Slash-command discovery and the `/model` flow reach gajae-code parity. The slash palette/autocomplete now fuzzy-matches command names (with a description fallback for intent-style queries), resolved skills can contribute their own `/aliases` as real dispatchable commands, and `/model` runs gjc's two-menu target → reasoning flow so a picked model can be assigned to the default or any subagent role with its own thinking budget.
 - **[0.7.17]** (2026-06-25) — Developer workflow parity (gjc `dev:link`/`dev:doctor`, adapted for jeo's zero-native-dep Bun runtime): the global `jeo` command can be linked to run this checkout's source hot to every edit, with a drift doctor that flags when `jeo` resolves to a compiled binary or an installed copy instead. README gains "Skill migration and bundled skill inspection" + "Development" sections. Also ships OKF concept-memory search/scoring with budget-aware injection and a round of workflow-prompt hardening (anti-punt, todo-first planning, verdict discipline) that keeps every loop escape hatch intact.
 - **[0.7.16]** (2026-06-25) — Bundled skills get a safe installer: `jeo skills sync` materializes the built-in workflow skills into `~/.jeo/skills`, preserving local edits by default, with a CI-friendly `--check` drift report and a `--force` overwrite.
-- **[0.7.15]** (2026-06-25) — Rollback release: the runtime source and test suite are restored to the **0.7.9** state. The intervening 0.7.10–0.7.14 runtime changes (quiet-mode/`-q`, `/resume` transcript rework, `mutatedFiles` plumbing, Ollama `num_ctx`, tmux REPL reaping, and related engine/provider/TUI edits) are reverted. Published as a new version because npm cannot re-issue an existing version number; `latest` now serves code identical to 0.7.9.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -205,11 +205,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.20]** (2026-06-26) — OKF concept-memory retrieval gains a hybrid reranker ported from memsearch. Injection priority no longer rides one raw keyword score — it fuses two complementary ranked channels by Reciprocal Rank Fusion (RRF): IDF-weighted lexical relevance (the sparse/BM25 channel, so rare discriminating terms steer recall) and concept-graph proximity (the local dense/semantic-neighbour channel, so a hub linked from multiple query hits surfaces even with no keyword of its own). All embedding-free and deterministic, layered atop the existing failure-first tier and pinned-invariant reserved budget.
 - **[0.7.19]** (2026-06-26) — The live model picker gains gajae-code's `/model` provider tabs, and skill invocation is consolidated onto a single `$` entrypoint. The picker now shows an `ALL` tab plus one tab per provider that `tab`/`shift+tab` cycles, and skills (including their declared aliases) are invoked only via `$` — the slash palette stays builtins-only.
 - **[0.7.18]** (2026-06-26) — Slash-command discovery and the `/model` flow reach gajae-code parity. The slash palette/autocomplete now fuzzy-matches command names (with a description fallback for intent-style queries), resolved skills can contribute their own `/aliases` as real dispatchable commands, and `/model` runs gjc's two-menu target → reasoning flow so a picked model can be assigned to the default or any subagent role with its own thinking budget.
 - **[0.7.17]** (2026-06-25) — Developer workflow parity (gjc `dev:link`/`dev:doctor`, adapted for jeo's zero-native-dep Bun runtime): the global `jeo` command can be linked to run this checkout's source hot to every edit, with a drift doctor that flags when `jeo` resolves to a compiled binary or an installed copy instead. README gains "Skill migration and bundled skill inspection" + "Development" sections. Also ships OKF concept-memory search/scoring with budget-aware injection and a round of workflow-prompt hardening (anti-punt, todo-first planning, verdict discipline) that keeps every loop escape hatch intact.
 - **[0.7.16]** (2026-06-25) — Bundled skills get a safe installer: `jeo skills sync` materializes the built-in workflow skills into `~/.jeo/skills`, preserving local edits by default, with a CI-friendly `--check` drift report and a `--force` overwrite.
-- **[0.7.15]** (2026-06-25) — Rollback release: the runtime source and test suite are restored to the **0.7.9** state. The intervening 0.7.10–0.7.14 runtime changes (quiet-mode/`-q`, `/resume` transcript rework, `mutatedFiles` plumbing, Ollama `num_ctx`, tmux REPL reaping, and related engine/provider/TUI edits) are reverted. Published as a new version because npm cannot re-issue an existing version number; `latest` now serves code identical to 0.7.9.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.7.19",
+  "version": "0.7.20",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/AGENTS.md

@@ -18,7 +18,7 @@ The core runtime loop, tool registry, session management, and state persistence
 | `json.ts` | Brief description of purpose |
 | `loop.ts` | The primary execution loop orchestrating model calls and tool execution |
 | `loop-guards.ts` | Intermediate-judgment classification (gjc ultragoal-guard parity): named `GuardState` taxonomy, `GUARD_LIMITS` thresholds, and pure classifiers (`isVerificationSignal`, `repeatHint`, `classifyDoneGate` — incl. `done_stale_verification` for a passing test/build that predates the last edit) consumed by `engine.ts` |
-| `memory.ts` | OKF concept-bundle memory: session distill, query-aware budget injection (failure-first `priorityOrder` + pinned-invariant reserved budget), mid-loop `recordFailedAttempt` capture, shared `upsertConceptFile` writer, legacy MEMORY.md migration (`migrateLegacyMemory`) + `JEO_MEMORY_LEGACY` rollback toggle |
+| `memory.ts` | OKF concept-bundle memory: session distill, query-aware budget injection with a **hybrid reranker ported from memsearch** — `priorityOrder` fuses two ranked channels via `reciprocalRankFusion` (RRF, k=60): lexical IDF relevance (`buildCorpusStats`/`scoreConcept`, the sparse/BM25 channel so rare discriminating terms steer retrieval) ⊕ graph proximity (`graphProximityOrder`, the local dense/semantic-neighbour channel — a hub linked from multiple query hits surfaces even with no keyword of its own); all embedding-free, deterministic, atop the failure-first tier + pinned-invariant reserved budget. Plus mid-loop `recordFailedAttempt` capture, shared `upsertConceptFile` writer, legacy MEMORY.md migration (`migrateLegacyMemory`) + `JEO_MEMORY_LEGACY` rollback toggle |
 | `memory-okf.ts` | OKF v0.1 format layer: frontmatter parse/serialize, concept IDs, conformance validation |
 | `memory-graph.ts` | Concept cross-link graph: build/expand (1-hop search), broken-link-tolerant lint, optional graphify detection |
 | `model-recency.ts` | Brief description of purpose |

package/src/agent/memory.ts

@@ -17,7 +17,7 @@ import { callLlm, type Message } from "./loop";
 import { jeoEnv } from "../util/env";
 import { parseConcept, serializeConcept, slugify, isReservedFile, conceptId } from "./memory-okf";
 import { tryExtractJsonObject } from "./json";
-import { buildConceptGraph, expandByGraph, lintConceptGraph, type GraphLintReport } from "./memory-graph";
+import { buildConceptGraph, expandByGraph, lintConceptGraph, type ConceptGraph, type GraphLintReport } from "./memory-graph";
 
 /** On-disk document cap — the distill prompt instructs the model to stay under it. */
 export const MEMORY_MAX_CHARS = 6_000;
@@ -314,9 +314,56 @@ function tokenize(query?: string): string[] {
   return Array.from(new Set((query.toLowerCase().match(/[a-z0-9]+/g) ?? []).filter(t => t.length >= 3)));
 }
 
+/** Corpus statistics for IDF (inverse document frequency) weighting: total concept
+ *  count `n` and per-token document frequency `df` (how many concepts' searchable
+ *  text contains the token). Built once per retrieval pass over the loaded bundle. */
+export interface CorpusStats {
+  n: number;
+  df: Map<string, number>;
+}
+
+/** Lowercased searchable text of a concept (title + tags + type + description +
+ *  body) — the field corpus over which document frequency is measured. */
+function searchableText(concept: Concept): string {
+  return [concept.title, concept.tags.join(" "), concept.type, concept.description, concept.body]
+    .join(" ")
+    .toLowerCase();
+}
+
+/** Build IDF corpus stats from the concept set: per distinct token, how many
+ *  concepts contain it. Pure and deterministic — no embeddings, no network
+ *  (memsearch's hybrid BM25 contribution adapted to jeo's local-first bundle). */
+export function buildCorpusStats(concepts: Concept[]): CorpusStats {
+  const df = new Map<string, number>();
+  for (const c of concepts) {
+    const text = searchableText(c);
+    // Distinct tokens of THIS concept (length ≥ 3, mirroring tokenize) so each
+    // concept contributes at most 1 to a token's document frequency.
+    const seen = new Set((text.match(/[a-z0-9]+/g) ?? []).filter(t => t.length >= 3));
+    for (const t of seen) df.set(t, (df.get(t) ?? 0) + 1);
+  }
+  return { n: concepts.length, df };
+}
+
+/** BM25-style non-negative IDF for a token: ln(1 + (N − df + 0.5)/(df + 0.5)).
+ *  A token that discriminates (appears in few concepts) outweighs a token that
+ *  appears everywhere — so a query's rare, specific terms steer retrieval instead
+ *  of common filler. Always > 0 for a present token (df ≥ 1), so the score > 0
+ *  presence semantics the failure-gate and filters depend on are preserved. A
+ *  token absent from the corpus only ever contributes through a field it does not
+ *  match (weight 0), so its IDF is moot; we floor df at the token's own presence. */
+function tokenIdf(token: string, stats: CorpusStats): number {
+  const df = stats.df.get(token) ?? 1;
+  return Math.log(1 + (stats.n - df + 0.5) / (df + 0.5));
+}
+
 /** Relevance score of a concept against query tokens. Field weights mirror
- *  llm-wiki's retrieval bias (title ≫ tags ≫ type/description ≫ body). 0 = no hit. */
-export function scoreConcept(concept: Concept, tokens: string[]): number {
+ *  llm-wiki's retrieval bias (title ≫ tags ≫ type/description ≫ body). When
+ *  `stats` is supplied, each token's field weight is scaled by its corpus IDF
+ *  (memsearch-style BM25 weighting) so a rare discriminating term ranks a concept
+ *  above one hit only by common tokens. Without `stats` this is the raw
+ *  field-weighted presence count (IDF = 1). 0 = no hit. */
+export function scoreConcept(concept: Concept, tokens: string[], stats?: CorpusStats): number {
   if (tokens.length === 0) return 0;
   const title = concept.title.toLowerCase();
   const desc = concept.description.toLowerCase();
@@ -325,70 +372,127 @@ export function scoreConcept(concept: Concept, tokens: string[]): number {
   const tags = concept.tags.map(t => t.toLowerCase());
   let score = 0;
   for (const t of tokens) {
-    if (title.includes(t)) score += 5;
-    if (tags.some(tag => tag.includes(t))) score += 3;
-    if (type.includes(t)) score += 2;
-    if (desc.includes(t)) score += 2;
-    if (body.includes(t)) score += 1;
+    let weight = 0;
+    if (title.includes(t)) weight += 5;
+    if (tags.some(tag => tag.includes(t))) weight += 3;
+    if (type.includes(t)) weight += 2;
+    if (desc.includes(t)) weight += 2;
+    if (body.includes(t)) weight += 1;
+    score += stats ? weight * tokenIdf(t, stats) : weight;
   }
   return score;
 }
 
 /** Search the bundle's concepts for a query, returning the relevant ones (score > 0)
- *  highest-score first. A type/tags/title/body keyword match all contribute. */
+ *  highest-score first. A type/tags/title/body keyword match all contribute, scaled
+ *  by corpus IDF so the most discriminating hits rank first. */
 export function searchConcepts(concepts: Concept[], query: string): { concept: Concept; score: number }[] {
   const tokens = tokenize(query);
+  const stats = buildCorpusStats(concepts);
   return concepts
-    .map(concept => ({ concept, score: scoreConcept(concept, tokens) }))
+    .map(concept => ({ concept, score: scoreConcept(concept, tokens, stats) }))
     .filter(r => r.score > 0)
     .sort((a, b) => b.score - a.score);
 }
 
+/** Reciprocal Rank Fusion constant (memsearch / TREC standard k=60): dampens any
+ *  single list's contribution so no one channel can dominate the fused order. */
+const RRF_K = 60;
+
+/** Fuse several ranked id-lists into one score map via Reciprocal Rank Fusion:
+ *  each list contributes 1/(k + rank) (rank 0-based) for the ids it ranks, summed
+ *  across lists. Rank-based (not score-based), so a strong lexical hit and a strong
+ *  graph-proximity hit combine on equal, scale-free footing — memsearch's hybrid
+ *  reranker (BM25 ⊕ dense) adapted to jeo's lexical ⊕ concept-graph channels. An id
+ *  ranked in no list simply gets 0. */
+export function reciprocalRankFusion(lists: string[][], k = RRF_K): Map<string, number> {
+  const fused = new Map<string, number>();
+  for (const list of lists) {
+    list.forEach((id, rank) => {
+      fused.set(id, (fused.get(id) ?? 0) + 1 / (k + rank));
+    });
+  }
+  return fused;
+}
+
+/** Rank concepts by graph proximity to the query seeds: the more distinct seeds a
+ *  concept is reachable from (itself, or a 1-hop link to/from a seed), the higher it
+ *  ranks. This is the local stand-in for memsearch's dense-vector channel — a
+ *  strongly-connected neighbour surfaces even when its OWN lexical score is weak,
+ *  the way a semantic neighbour does under dense retrieval. Only concepts reachable
+ *  from ≥1 seed are returned; input order breaks ties. Uses the public graph API
+ *  (expandByGraph) so it stays correct if the graph internals change. */
+function graphProximityOrder(concepts: Concept[], seedIds: string[], graph: ConceptGraph): string[] {
+  if (seedIds.length === 0) return [];
+  const reach = new Map<string, number>();
+  for (const seed of seedIds) {
+    for (const id of expandByGraph([seed], graph, 1)) reach.set(id, (reach.get(id) ?? 0) + 1);
+  }
+  const index = new Map(concepts.map((c, i) => [conceptId(c.relPath), i] as const));
+  return [...reach.entries()]
+    .sort((a, b) => b[1] - a[1] || (index.get(a[0]) ?? 0) - (index.get(b[0]) ?? 0))
+    .map(([id]) => id);
+}
+
+
 /** Priority order for injection. Failure-first: a query-relevant FailedAttempt is
  *  surfaced AHEAD of everything else — resurfacing a known dead end is higher-leverage
  *  than reinforcing what already works ("못하는 게 없도록" — close the gaps, don't just
  *  polish strengths), and it is the mechanism by which the loop gets more precise the
  *  more it repeats (llm-wiki: accumulated failure knowledge sharpens future runs). Then
- *  high-confidence "core" concepts, then query relevance (descending), then concepts the
- *  relevant ones LINK TO (1-hop graph expansion — Sprint 04: a directly-hit concept pulls
- *  its neighbours in as context ahead of unrelated noise), preserving input order as a
- *  stable tiebreak. The failure boost only fires when the query actually hits the concept
- *  (score > 0), so an unrelated FailedAttempt never crowds out relevant context. */
+ *  high-confidence "core" concepts, then HYBRID relevance.
+ *
+ *  Hybrid relevance (memsearch's reranker, ported): two complementary ranked channels
+ *  are fused by Reciprocal Rank Fusion instead of one raw score with a boolean boost —
+ *    (1) lexical: query-hit concepts ranked by IDF-weighted score (the "sparse"/BM25
+ *        channel), and
+ *    (2) graph proximity: concepts reachable from the query-hit seeds via 1-hop links,
+ *        ranked by how many seeds reach them (the local "dense"/semantic-neighbour
+ *        channel — Sprint 04 graph expansion, now a ranked signal, not just a flag).
+ *  Fusing by rank lets a strongly-linked neighbour with a weak lexical score still
+ *  outrank unrelated noise, and lets a concept that is BOTH a lexical hit and a graph
+ *  hub rise above a concept strong in only one channel. Input order is the stable
+ *  final tiebreak. The failure boost only fires when the query actually hits the
+ *  concept (score > 0), so an unrelated FailedAttempt never crowds out relevant
+ *  context. */
 function priorityOrder(concepts: Concept[], query?: string): Concept[] {
   const tokens = tokenize(query);
-  // 1-hop graph expansion: seed from concepts the query directly hits, then mark
-  // their link-neighbours as "related" so they outrank unrelated zero-score noise.
-  const related = new Set<string>();
-  if (tokens.length > 0) {
-    const graph = buildConceptGraph(concepts);
-    const seeds = concepts.filter(c => scoreConcept(c, tokens) > 0).map(c => conceptId(c.relPath));
-    for (const id of expandByGraph(seeds, graph, 1)) related.add(id);
+  const stats = buildCorpusStats(concepts);
+  const scored = concepts.map(c => ({ c, id: conceptId(c.relPath), score: scoreConcept(c, tokens, stats) }));
+
+  // Channel 1 — lexical ("sparse"/BM25): query-hit concepts, IDF score descending.
+  // Stable sort keeps input order on ties.
+  const lexicalOrder = scored.filter(s => s.score > 0).slice().sort((a, b) => b.score - a.score).map(s => s.id);
+
+  // Channel 2 — graph proximity ("dense"): neighbours of the query-hit seeds.
+  let graphOrder: string[] = [];
+  if (tokens.length > 0 && lexicalOrder.length > 0) {
+    graphOrder = graphProximityOrder(concepts, lexicalOrder, buildConceptGraph(concepts));
   }
-  return concepts
-    .map((concept, i) => {
-      const score = scoreConcept(concept, tokens);
-      return {
-        concept,
-        i,
-        // Query-relevant past failure → resurface first so the loop is reminded of
-        // what NOT to repeat for the current task. Gated on score > 0: a stale,
-        // unrelated dead end stays out of the way.
-        failure: concept.type === "FailedAttempt" && score > 0,
-        core: concept.confidence === "high",
-        score,
-        related: related.has(conceptId(concept.relPath)),
-      };
-    })
+
+  const fused = reciprocalRankFusion([lexicalOrder, graphOrder]);
+
+  return scored
+    .map(({ c, id, score }, i) => ({
+      concept: c,
+      i,
+      // Query-relevant past failure → resurface first so the loop is reminded of
+      // what NOT to repeat for the current task. Gated on score > 0: a stale,
+      // unrelated dead end stays out of the way.
+      failure: c.type === "FailedAttempt" && score > 0,
+      core: c.confidence === "high",
+      rrf: fused.get(id) ?? 0,
+    }))
     .sort((a, b) => {
       if (a.failure !== b.failure) return a.failure ? -1 : 1;
       if (a.core !== b.core) return a.core ? -1 : 1;
-      if (b.score !== a.score) return b.score - a.score;
-      if (a.related !== b.related) return a.related ? -1 : 1;
+      if (b.rrf !== a.rrf) return b.rrf - a.rrf;
       return a.i - b.i;
     })
     .map(s => s.concept);
 }
 
+
 /** Group items by their `type` into ordered `{ header, list }` sections: TYPE_LAYOUT
  *  order first, then any unknown types under their raw type name (lenient). The one
  *  place that encodes the section ordering — shared by render and index. */