linksee-memory 0.8.0 → 0.11.0

package/dist/db/migrate.js

@@ -110,6 +110,42 @@ export function runMigrations(db) {
         addCol('last_confirmed_at', 'last_confirmed_at INTEGER');
         addCol('owner', 'owner TEXT');
     }
+    // v11 → v12: reconciler overlay columns on map_nodes (the Map shipped at v11
+    // without them). Only ALTER if map_nodes already exists; a v10→v12 jump creates
+    // it fresh (with the columns) via db.exec(sql) below.
+    if (currentVersion > 0 && currentVersion < 12) {
+        const hasMapNodes = db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='map_nodes'").get();
+        if (hasMapNodes) {
+            const have = new Set(db.prepare('PRAGMA table_info(map_nodes)').all().map((c) => c.name));
+            const addCol = (name, ddl) => { if (!have.has(name))
+                db.exec(`ALTER TABLE map_nodes ADD COLUMN ${ddl}`); };
+            addCol('reality', "reality TEXT NOT NULL DEFAULT '{}'");
+            addCol('live_verdict', 'live_verdict TEXT');
+            addCol('verdict_evidence', "verdict_evidence TEXT NOT NULL DEFAULT '{}'");
+            addCol('reconciled_at', 'reconciled_at INTEGER');
+        }
+    }
+    // v12 → v13: edge strength + accounted-for expiry (anti-noise / anti-graveyard).
+    if (currentVersion > 0 && currentVersion < 13) {
+        const has = (table, col) => db.prepare(`PRAGMA table_info(${table})`).all().some((c) => c.name === col);
+        if (db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='map_edges'").get()) {
+            if (!has('map_edges', 'strength'))
+                db.exec('ALTER TABLE map_edges ADD COLUMN strength TEXT');
+        }
+        if (db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='map_nodes'").get()) {
+            if (!has('map_nodes', 'review_by'))
+                db.exec('ALTER TABLE map_nodes ADD COLUMN review_by TEXT');
+            if (!has('map_nodes', 'revival_condition'))
+                db.exec('ALTER TABLE map_nodes ADD COLUMN revival_condition TEXT');
+        }
+    }
+    // v13 → v14: per-project uniqueness. map_nodes PK was the global `id`, and map_edges
+    // UNIQUE was global (from_id,to_id,type) — so two projects couldn't both have a `readme`
+    // node or a `readme→docs-site` edge. SQLite can't alter a PK/UNIQUE, so drop + recreate;
+    // safe because importMap rebuilds both from map.yaml on every run.
+    if (currentVersion > 0 && currentVersion < 14) {
+        db.exec('DROP TABLE IF EXISTS map_nodes; DROP TABLE IF EXISTS map_edges;');
+    }
     db.exec(sql);
     if (currentVersion > 0 && currentVersion < 4) {
         db.exec(`INSERT INTO memories_fts(rowid, content) SELECT id, content FROM memories;`);

package/dist/db/schema.sql

@@ -335,6 +335,100 @@ CREATE TABLE IF NOT EXISTS memory_write_candidates (
 CREATE INDEX IF NOT EXISTS idx_mwc_status ON memory_write_candidates(status);
 CREATE INDEX IF NOT EXISTS idx_mwc_scope  ON memory_write_candidates(scope);
 
+-- ============================================================
+-- v10: Re-injection log — the ACTIVE-observability stream (pre-action gate hits).
+-- Separate from drift_edges (POST-action reality): the gate (guard.ts, fired by a Claude Code
+-- PreToolUse hook) writes here when an accepted anchor is re-surfaced into context BEFORE an action.
+-- Feeds `dream` — "re-injected N times, still contradicted (heeded=0)" is the machine evidence behind
+-- #15443. trigger: boot=SessionStart · cue=prompt · gate=PreToolUse.
+-- ============================================================
+CREATE TABLE IF NOT EXISTS injection_log (
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+  anchor_id   INTEGER REFERENCES drift_anchors(id) ON DELETE CASCADE,
+  session_id  TEXT,
+  trigger     TEXT NOT NULL CHECK (trigger IN ('boot', 'cue', 'gate')),
+  surface     TEXT NOT NULL CHECK (surface IN ('inform', 'warn', 'block', 'allow')),
+  tool_name   TEXT,
+  action_snip TEXT,                                   -- first ~120 chars of the attempted action
+  verdict     TEXT,                                   -- contradicts | in_scope | none
+  heeded      INTEGER,                                -- NULL=unknown / 1=followed / 0=ignored (dream backfills)
+  occurred_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE INDEX IF NOT EXISTS idx_injlog_anchor  ON injection_log(anchor_id, occurred_at);
+CREATE INDEX IF NOT EXISTS idx_injlog_session ON injection_log(session_id, occurred_at);
+
+-- ============================================================
+-- v11: Current Truth Map — journey-spine topology (Product Drift OS spec v3).
+-- map.yaml (git) is the desired-state SOURCE OF TRUTH (anchor #58); these tables
+-- are the runtime index the importer reconciles INTO. A map_node is product
+-- STRUCTURE (surface | implementation) — a SUPERSET of drift_anchors, which hold
+-- only NORMATIVE claims. A normative node links out via anchor_id; descriptive
+-- surfaces ("README exists") leave it NULL, so the violation scanner never sees
+-- them. Full-rebuild import: the importer wipes a project's rows and re-inserts.
+-- ============================================================
+CREATE TABLE IF NOT EXISTS map_nodes (
+  id              TEXT NOT NULL,                     -- stable slug from map.yaml (e.g. 'readme'); unique PER PROJECT
+  project         TEXT NOT NULL,
+  layer           TEXT NOT NULL,                     -- surface | implementation
+  stage           TEXT,                              -- journey stage id (NULL for implementation layer)
+  statement       TEXT NOT NULL,
+  status          TEXT NOT NULL DEFAULT 'active',    -- active|experiment|commitment|planned|paused|suspect|future_thesis
+  facets          TEXT NOT NULL DEFAULT '[]',        -- JSON array (the demoted old domains, as tags)
+  role            TEXT,                              -- e.g. 'diffusion'
+  note            TEXT,
+  due             TEXT,                              -- ISO date (commitments)
+  paused_reason   TEXT,
+  related_project TEXT,
+  spinout_candidate INTEGER NOT NULL DEFAULT 0,
+  anchor_id       INTEGER REFERENCES drift_anchors(id) ON DELETE SET NULL,  -- link IFF normative
+  review_by       TEXT,                              -- ISO date: when an accounted-for/deferred node must be revisited
+  revival_condition TEXT,                            -- the release condition that clears a deferral (anti-graveyard)
+  reality         TEXT NOT NULL DEFAULT '{}',        -- JSON: how to verify this node from reality (kind/dir/signal)
+  live_verdict    TEXT,                              -- reconciler overlay: convergence|divergence|absence|NULL(unchecked)
+  verdict_evidence TEXT NOT NULL DEFAULT '{}',       -- JSON: file/line/term that decided the verdict
+  reconciled_at   INTEGER,                           -- when the reconciler last ran for this node
+  extra           TEXT NOT NULL DEFAULT '{}',        -- JSON catch-all (forward-compat fields)
+  updated_at      INTEGER NOT NULL DEFAULT (unixepoch()),
+  PRIMARY KEY (project, id)                          -- a node id is unique PER PROJECT, not globally
+);
+CREATE INDEX IF NOT EXISTS idx_map_nodes_project ON map_nodes(project);
+CREATE INDEX IF NOT EXISTS idx_map_nodes_stage   ON map_nodes(stage);
+CREATE INDEX IF NOT EXISTS idx_map_nodes_status  ON map_nodes(status);
+CREATE INDEX IF NOT EXISTS idx_map_nodes_layer   ON map_nodes(layer);
+
+-- Node↔node typed edges — the topology that makes blast-radius computable.
+-- type: realizes (impl→surface) | supports | must-stay-consistent-with | reflux (expand→discover).
+-- Endpoints are map_nodes slugs (validated in the lib, not FK-constrained, to keep
+-- the wipe+reinsert import order trivial).
+CREATE TABLE IF NOT EXISTS map_edges (
+  id        INTEGER PRIMARY KEY AUTOINCREMENT,
+  project   TEXT NOT NULL,
+  from_id   TEXT NOT NULL,
+  to_id     TEXT NOT NULL,
+  type      TEXT NOT NULL,                           -- realizes|supports|must-stay-consistent-with|should-align-with|mentions|reflux
+  strength  TEXT,                                    -- hard|soft|watch (controls AFFECTS noise); NULL → derived from type
+  note      TEXT,
+  UNIQUE(project, from_id, to_id, type)              -- an edge is unique PER PROJECT
+);
+CREATE INDEX IF NOT EXISTS idx_map_edges_from ON map_edges(from_id);
+CREATE INDEX IF NOT EXISTS idx_map_edges_to   ON map_edges(to_id);
+CREATE INDEX IF NOT EXISTS idx_map_edges_type ON map_edges(type);
+
+-- Project-level Map meta — the spine order/labels + the Job statement live in map.yaml,
+-- NOT derivable from nodes alone. Persist them so any reader (dashboard) can render the
+-- canonical journey order and the Job headline without parsing the YAML.
+CREATE TABLE IF NOT EXISTS map_projects (
+  project          TEXT PRIMARY KEY,
+  job              TEXT,
+  audience         TEXT NOT NULL DEFAULT '{}',   -- JSON
+  product_status   TEXT,
+  template         TEXT,
+  stages           TEXT NOT NULL DEFAULT '[]',   -- JSON [{id,label}] — canonical spine order
+  related_projects TEXT NOT NULL DEFAULT '[]',   -- JSON
+  updated_at       INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
 -- ============================================================
 -- Meta — schema version tracking
 -- ============================================================
@@ -343,6 +437,6 @@ CREATE TABLE IF NOT EXISTS meta (
   value         TEXT NOT NULL
 );
 
-INSERT OR IGNORE INTO meta (key, value) VALUES ('schema_version', '9');
+INSERT OR IGNORE INTO meta (key, value) VALUES ('schema_version', '14');
 INSERT OR IGNORE INTO meta (key, value) VALUES ('created_at', CAST(unixepoch() AS TEXT));
-UPDATE meta SET value = '9' WHERE key = 'schema_version' AND value IN ('1', '2', '3', '4', '5', '6', '7', '8');
+UPDATE meta SET value = '14' WHERE key = 'schema_version' AND value IN ('1', '2', '3', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13');

package/dist/lib/drift-detection.js

@@ -285,12 +285,47 @@ export function detectDrift(db, opts = {}) {
 // session_file_edits (so we know where the affects files actually live on disk); code
 // extensions only; most-recent first; capped per anchor. Purely additive — detectDrift is
 // untouched. Comment lines are skipped so a doc-mention of a forbidden term isn't a hit.
+// Prose (.md/.html) DESCRIBES rules; it is not where a code/operational constraint is *violated*.
+// Scanning it produced false positives (a SKILL.md line literally saying "NOT raw chat"). Code only.
 const CODE_EXT = new Set([
     '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.json', '.sql', '.py', '.go', '.rs',
-    '.java', '.rb', '.php', '.sh', '.yml', '.yaml', '.toml', '.env', '.md', '.html',
+    '.java', '.rb', '.php', '.sh', '.yml', '.yaml', '.toml', '.env',
 ]);
 const MAX_FILES_PER_ANCHOR = 400;
 const COMMENT_PREFIXES = ['//', '*', '/*', '#', '<!--', '--'];
+// ── precision guards ─────────────────────────────────────────────────────────
+// A raw substring of a forbidden term is too weak a notion of "violation". On the real corpus
+// the bare-substring match produced ~90% false positives in three classes; reject each deductively:
+//   1. sub-token — "forget" inside "forgetting" / "decideForgetting"        → word-boundary match
+//   2. negated   — the line FORBIDS the term ("...NOT raw chat", "…禁止")     → negation window before
+//   3. citation  — a scrape-prohibition's host appears only as a stored value → require a real net call
+//                  ('cosmetic-info.jp' as a provenance label is not a fetch of it)
+const NEGATION_NEAR = /\b(?:not|never|no\s+longer|don'?t|do\s+not|avoid|without)\b|禁止|しない|させない|不可|避け|してはいけない|ではなく/i;
+const SCRAPE_ANCHOR = /crawl|scrap|robots|クロール|スクレイピング|スクレイプ|自動収集|自動巡回/i;
+const NET_CALL = /\b(?:fetch|axios|requests?|urllib|httpx|curl|wget|got|puppeteer|playwright|cheerio|beautifulsoup|selenium|crawl|scrape|scraping)\b|クロール|スクレイピング/i;
+// Locate a signal: ASCII signals must hit on a word boundary; CJK (no boundaries) stays substring.
+function signalIndex(lowerLine, signal) {
+    if (/^[\x20-\x7e]+$/.test(signal)) {
+        const esc = signal.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const m = new RegExp(`(?<![a-z0-9_])${esc}(?![a-z0-9_])`).exec(lowerLine);
+        return m ? m.index : -1;
+    }
+    return lowerLine.indexOf(signal);
+}
+// Deductive violation match with the three precision guards applied (returns the hit term or null).
+function matchViolation(rawLine, lowerLine, signals, isScrapeAnchor) {
+    for (const s of signals) {
+        const idx = signalIndex(lowerLine, s);
+        if (idx < 0)
+            continue; // 1. word-boundary
+        if (NEGATION_NEAR.test(rawLine.slice(Math.max(0, idx - 24), idx)))
+            continue; // 2. negated context
+        if (isScrapeAnchor && !NET_CALL.test(rawLine))
+            continue; // 3. citation, no net call
+        return s;
+    }
+    return null;
+}
 export function detectFileViolations(db, opts = {}) {
     const emitThreshold = opts.emitThreshold ?? EMIT_THRESHOLD_DEFAULT;
     const res = {
@@ -333,6 +368,7 @@ export function detectFileViolations(db, opts = {}) {
             if (signals.length === 0)
                 continue; // no signal → can't deduce a contradiction
             const terms = parseArray(a.detect_terms);
+            const isScrapeAnchor = SCRAPE_ANCHOR.test(a.statement);
             const aW = tierWeight(a.tier);
             const confidence = Math.min(aW, REALITY_TIER_WEIGHT) * SCOPE_WEIGHT_GLOB;
             if (confidence < emitThreshold)
@@ -367,7 +403,7 @@ export function detectFileViolations(db, opts = {}) {
                     if (COMMENT_PREFIXES.some((p) => trimmed.startsWith(p)))
                         continue; // skip comments
                     const ll = trimmed.toLowerCase();
-                    const hit = signals.find((s) => ll.includes(s));
+                    const hit = matchViolation(trimmed, ll, signals, isScrapeAnchor);
                     if (hit) {
                         found = { line_no: i + 1, line_text: trimmed.slice(0, 280), hit };
                         break; // one edge per (anchor, file): first real hit

package/dist/lib/guard.d.ts

@@ -0,0 +1,81 @@
+import type Database from 'better-sqlite3';
+export type GateMode = 'off' | 'soft' | 'hard';
+export type GateLevel = 'allow' | 'inform' | 'warn' | 'block';
+export interface AcceptedAnchor {
+    id: number;
+    kind: string;
+    statement: string;
+    rationale: string | null;
+    affects: string;
+    detect_terms: string;
+    violation_signal: string;
+    card_policy: string;
+}
+export interface GateMatch {
+    anchor_id: number;
+    statement: string;
+    rationale: string | null;
+    verdict: 'contradicts' | 'in_scope';
+    why: string;
+    gate_mode: GateMode;
+}
+export interface GateResult {
+    gate: GateLevel;
+    matched: GateMatch[];
+    reinject: string;
+}
+export interface ActionInput {
+    tool?: string;
+    file_path?: string;
+    files?: string[];
+    command?: string;
+    content?: string;
+    diff?: string;
+    action?: string;
+}
+interface ActionCtx {
+    tool: string;
+    files: string[];
+    lines: string[];
+    haystack: string;
+}
+export declare function acceptedAnchors(db: Database.Database): AcceptedAnchor[];
+export declare function matchAction(db: Database.Database, act: ActionCtx): GateMatch[];
+export declare function gateAction(db: Database.Database, input: ActionInput, opts?: {
+    sessionId?: string;
+}): GateResult;
+export declare function formatReinject(matches: GateMatch[], gate: GateLevel): string;
+export declare function buildBootDigest(db: Database.Database, opts?: {
+    maxAnchors?: number;
+    maxForks?: number;
+}): {
+    text: string;
+    anchors: number;
+    forks: number;
+    distill: number;
+};
+export interface FrictionItem {
+    anchor_id: number;
+    statement: string;
+    gate_mode: GateMode;
+    lifecycle: string;
+    gate_contradicts: number;
+    gate_blocks: number;
+    ignored: number;
+    reality_contradicts: number;
+    last_at: string | null;
+    signal: 'violated_for_real' | 'gate_holding';
+    suggested_action: 'escalate_to_hard' | 'review_or_supersede' | 'none';
+    recommendation: string;
+}
+export declare function backfillHeeded(db: Database.Database): void;
+export declare function getReinjectionFriction(db: Database.Database, opts?: {
+    minContradicts?: number;
+}): FrictionItem[];
+export declare function setGateMode(db: Database.Database, anchorId: number, mode: GateMode): {
+    ok: boolean;
+    anchor_id: number;
+    gate_mode: GateMode;
+    card_policy: Record<string, unknown>;
+};
+export {};

package/dist/lib/guard.js

@@ -0,0 +1,321 @@
+// Re-injection guard (the "6th pillar" — active observability). The post-hoc detector
+// (drift-detection.ts) answers "did reality drift from a declared anchor?" AFTER the fact, into
+// drift_edges. This module answers "is the action ABOUT to be taken in scope of / contradicting an
+// accepted anchor?" BEFORE the fact, and re-surfaces that anchor into the agent's context. Pre vs
+// post: the gate writes ONLY injection_log, never drift_edges — the two streams stay separate and
+// rejoin in `dream`.
+//
+// Enforcement lives OUTSIDE the agent's volition (a Claude Code PreToolUse hook calls this via the
+// guard-hook bin), because the load-bearing pain — "Claude read the rule, understood it, still used
+// cp" (anthropics/claude-code#15443) — is precisely the case where the agent will NOT self-check.
+//
+// FAIL-OPEN by construction: every DB op is best-effort; only an explicit 'hard' contradiction yields
+// a block. Lexical only (no embeddings): reuses lexical-match.ts (the same logic as the detector).
+import { normPath, compileGlob, parseArray, matchViolation, SCRAPE_ANCHOR } from './lexical-match.js';
+// "accepted = the only thing the gate compares against": declared (status active), still live
+// (lifecycle active|experiment — NOT at_risk/superseded/deprecated), and not explicitly card-disabled.
+// at_risk(stale) anchors deliberately DON'T gate — we don't enforce a rule we're no longer sure of.
+const ACCEPTED_SQL = `status = 'active'
+  AND lifecycle IN ('active', 'experiment')
+  AND COALESCE(json_extract(card_policy, '$.enabled'), 1) != 0`;
+const nowSec = () => Math.floor(Date.now() / 1000);
+function jsonGet(json, key, def) {
+    try {
+        const o = JSON.parse(json || '{}');
+        return o && o[key] !== undefined && o[key] !== null ? o[key] : def;
+    }
+    catch {
+        return def;
+    }
+}
+function bestEffort(fn) {
+    try {
+        fn();
+    }
+    catch {
+        /* logging/telemetry must NEVER block the gate */
+    }
+}
+export function acceptedAnchors(db) {
+    return db
+        .prepare(`SELECT id, kind, statement, rationale, affects, detect_terms, violation_signal, card_policy
+         FROM drift_anchors WHERE ${ACCEPTED_SQL}`)
+        .all();
+}
+function buildActionCtx(input) {
+    const files = [];
+    if (input.file_path)
+        files.push(input.file_path);
+    if (Array.isArray(input.files))
+        files.push(...input.files);
+    const rawParts = [input.command, input.diff, input.content, input.action].filter((x) => typeof x === 'string' && x.length > 0);
+    const lines = [];
+    for (const part of rawParts) {
+        for (const ln of part.split(/\r?\n/)) {
+            const t = ln.trim();
+            if (t)
+                lines.push(t);
+        }
+    }
+    const haystack = [...files.map(normPath), ...rawParts].join('\n').toLowerCase();
+    return { tool: input.tool ?? 'unknown', files, lines, haystack };
+}
+export function matchAction(db, act) {
+    const out = [];
+    for (const a of acceptedAnchors(db)) {
+        const gate_mode = jsonGet(a.card_policy, 'gate_mode', 'soft');
+        if (gate_mode === 'off')
+            continue;
+        const globs = parseArray(a.affects).map(compileGlob);
+        const terms = parseArray(a.detect_terms)
+            .map((t) => t.trim().toLowerCase())
+            .filter(Boolean);
+        const signals = parseArray(a.violation_signal)
+            .map((s) => s.trim().toLowerCase())
+            .filter(Boolean);
+        const hasScope = globs.length > 0;
+        const pathHit = hasScope && act.files.some((f) => {
+            const p = normPath(f);
+            return globs.some((g) => g(p));
+        });
+        const termHit = terms.length > 0 && terms.some((t) => act.haystack.includes(t));
+        const isScrape = SCRAPE_ANCHOR.test(a.statement);
+        let sigHit = null;
+        if (signals.length > 0) {
+            for (const line of act.lines) {
+                const hit = matchViolation(line, line.toLowerCase(), signals, isScrape);
+                if (hit) {
+                    sigHit = hit;
+                    break;
+                }
+            }
+        }
+        // Scope (mirrors the detector): a path-scoped anchor requires the action to touch an in-scope
+        // file; a global anchor (no affects) fires on topical-term OR forbidden-signal relevance.
+        const inScope = hasScope ? pathHit : termHit || sigHit != null;
+        if (!inScope)
+            continue;
+        out.push({
+            anchor_id: a.id,
+            statement: a.statement,
+            rationale: a.rationale,
+            verdict: sigHit ? 'contradicts' : 'in_scope',
+            why: sigHit
+                ? `your action contains \`${sigHit}\``
+                : pathHit
+                    ? `touches a file under this decision's scope`
+                    : `matches this decision's topic`,
+            gate_mode,
+        });
+    }
+    // contradicts first (the headline), then in_scope.
+    return out.sort((x, y) => (y.verdict === 'contradicts' ? 1 : 0) - (x.verdict === 'contradicts' ? 1 : 0));
+}
+function withinCooldown(db, anchorId, sessionId) {
+    if (!sessionId)
+        return false;
+    const minutes = jsonGet(db.prepare(`SELECT card_policy FROM drift_anchors WHERE id = ?`).get(anchorId)
+        ?.card_policy, 'reinject_cooldown_min', 30);
+    const cutoff = nowSec() - minutes * 60;
+    const row = db
+        .prepare(`SELECT 1 FROM injection_log WHERE anchor_id = ? AND session_id = ? AND occurred_at >= ? LIMIT 1`)
+        .get(anchorId, sessionId, cutoff);
+    return !!row;
+}
+function logInjection(db, matches, act, surface, sessionId) {
+    const ins = db.prepare(`INSERT INTO injection_log (anchor_id, session_id, trigger, surface, tool_name, action_snip, verdict)
+     VALUES (?, ?, 'gate', ?, ?, ?, ?)`);
+    const snip = (act.lines[0] ?? '').slice(0, 120);
+    const tx = db.transaction(() => {
+        for (const m of matches)
+            ins.run(m.anchor_id, sessionId ?? null, surface, act.tool, snip, m.verdict);
+    });
+    tx();
+}
+export function gateAction(db, input, opts = {}) {
+    const act = buildActionCtx(input);
+    let matches = matchAction(db, act);
+    if (matches.length === 0)
+        return { gate: 'allow', matched: [], reinject: '' };
+    const contradictions = matches.filter((m) => m.verdict === 'contradicts');
+    let gate = contradictions.length > 0 ? 'warn' : 'inform';
+    if (contradictions.some((m) => m.gate_mode === 'hard'))
+        gate = 'block';
+    // Cooldown applies ONLY to pure-informational re-injection (no contradiction). A real contradiction
+    // is surfaced every single time — an ignored rule must not be silenced by a timer.
+    if (gate === 'inform') {
+        matches = matches.filter((m) => !withinCooldown(db, m.anchor_id, opts.sessionId));
+        if (matches.length === 0)
+            return { gate: 'allow', matched: [], reinject: '' };
+    }
+    const shown = matches.slice(0, 4);
+    const reinject = formatReinject(shown, gate);
+    bestEffort(() => logInjection(db, shown, act, gate, opts.sessionId));
+    return { gate, matched: shown, reinject };
+}
+export function formatReinject(matches, gate) {
+    const head = gate === 'block'
+        ? '⛔ Blocked — this action breaks a decision you locked earlier.'
+        : gate === 'warn'
+            ? '⚠ Heads up — this action contradicts a decision you locked earlier.'
+            : 'ℹ Reminder — you have an active decision covering what you are about to touch.';
+    const body = matches.map((m) => {
+        const rationale = m.rationale ? ` — ${m.rationale}` : '';
+        const tail = m.verdict === 'contradicts' ? `${m.why} → contradicts it.` : `${m.why}.`;
+        return `• [#${m.anchor_id}] "${m.statement}"${rationale}\n  ↳ ${tail}`;
+    });
+    const firstContra = matches.find((m) => m.verdict === 'contradicts');
+    const foot = firstContra
+        ? `\nIf you are intentionally changing this decision, supersede it on the record:\n  resolve_drift(anchor_id: ${firstContra.anchor_id}, action: 'supersede', superseded_by: <new anchor>).`
+        : '';
+    return [head, ...body, foot].filter(Boolean).join('\n');
+}
+// SessionStart boot digest — re-load the accepted anchors + open forks into a fresh session, killing
+// cross-session amnesia ("groundhog day"). Kept small (top-N) and budget-bounded by caller.
+export function buildBootDigest(db, opts = {}) {
+    const maxAnchors = opts.maxAnchors ?? 8;
+    const maxForks = opts.maxForks ?? 5;
+    const anchors = db
+        .prepare(`SELECT id, statement, rationale FROM drift_anchors
+         WHERE ${ACCEPTED_SQL} AND kind IN ('prohibition', 'decision', 'constraint')
+         ORDER BY confidence DESC, updated_at DESC LIMIT ?`)
+        .all(maxAnchors);
+    const forks = db
+        .prepare(`SELECT c.id, c.rationale, a.statement
+         FROM memory_write_candidates c
+         LEFT JOIN drift_anchors a ON a.id = c.target_node_id
+         WHERE c.scope = 'orphaned_proposal' AND c.status = 'pending_review'
+         ORDER BY c.created_at DESC LIMIT ?`)
+        .all(maxForks);
+    // Distillation pressure — the routine's structural trigger. The drain must not depend on
+    // the agent remembering to dream (#15443 lesson): while raw auto-captured memories exist,
+    // EVERY session boot says so. Inflow (new sessions) vs drain (8/dream) stays visible.
+    let distill = 0;
+    try {
+        distill = db.prepare(`SELECT COUNT(*) AS n FROM memories
+          WHERE layer IN ('learning', 'caveat') AND json_valid(content)
+            AND (json_extract(content, '$.needs_distill') = 1
+                 OR json_extract(content, '$.why') = 'Decision detected by pattern match — may need agent enrichment'
+                 OR json_extract(content, '$.why') = 'User-stated warning/prohibition — auto-extracted by caveat pattern match')`).get().n;
+    }
+    catch {
+        /* digest must never fail on the nudge */
+    }
+    if (anchors.length === 0 && forks.length === 0 && distill === 0)
+        return { text: '', anchors: 0, forks: 0, distill: 0 };
+    const parts = [];
+    if (anchors.length > 0) {
+        parts.push('📌 Linksee — decisions you locked (still in force):');
+        for (const a of anchors)
+            parts.push(`• [#${a.id}] "${a.statement}"${a.rationale ? ` — ${a.rationale}` : ''}`);
+    }
+    if (forks.length > 0) {
+        parts.push('', '🔀 Open forks still awaiting your call:');
+        for (const f of forks)
+            parts.push(`• ${f.statement ?? f.rationale}`);
+    }
+    if (distill > 0) {
+        parts.push('', `🧪 ${distill} auto-captured memories are still raw utterances — call dream() and rewrite the distill_queue via remember(memory_id, content) with "distilled": true.`);
+    }
+    if (anchors.length > 0)
+        parts.push('', 'Honor these unless you explicitly supersede them (resolve_drift action=supersede).');
+    return { text: parts.join('\n'), anchors: anchors.length, forks: forks.length, distill };
+}
+// Coarse, best-effort heeded backfill (idempotent — only touches heeded IS NULL). heeded=0 when a soft
+// re-injection failed to prevent the violation (the anchor still has an OPEN reality contradiction);
+// heeded=1 for blocks (the tool was denied) and for soft injections whose anchor's reality is clean.
+// Intentionally NOT timestamp-correlated — it powers the "ignored" tally only, never a gating decision.
+export function backfillHeeded(db) {
+    bestEffort(() => {
+        const live = `SELECT anchor_id FROM drift_edges WHERE verdict = 'contradicts' AND status = 'open'`;
+        db.prepare(`UPDATE injection_log SET heeded = 0
+         WHERE heeded IS NULL AND surface IN ('warn', 'inform') AND verdict = 'contradicts'
+           AND anchor_id IN (${live})`).run();
+        db.prepare(`UPDATE injection_log SET heeded = 1
+         WHERE heeded IS NULL AND surface IN ('warn', 'inform')
+           AND anchor_id NOT IN (${live})`).run();
+        db.prepare(`UPDATE injection_log SET heeded = 1 WHERE heeded IS NULL AND surface = 'block'`).run();
+    });
+}
+// Surface anchors the gate keeps re-injecting. PRIMARY signal = two directly-queryable counts (no fragile
+// inference): gate_contradicts (pre-action) × reality_contradicts (post-action). Both > 0 ⇒ re-injection
+// isn't holding ⇒ escalate (soft→hard) or review/supersede (if reality has outrun the rule).
+export function getReinjectionFriction(db, opts = {}) {
+    const minC = opts.minContradicts ?? 3;
+    backfillHeeded(db);
+    const rows = db
+        .prepare(`SELECT i.anchor_id,
+              SUM(CASE WHEN i.verdict = 'contradicts' THEN 1 ELSE 0 END) AS gate_contradicts,
+              SUM(CASE WHEN i.surface = 'block' THEN 1 ELSE 0 END)       AS gate_blocks,
+              SUM(CASE WHEN i.heeded = 0 THEN 1 ELSE 0 END)              AS ignored,
+              datetime(MAX(i.occurred_at), 'unixepoch')                 AS last_at,
+              a.statement, a.lifecycle, a.card_policy
+         FROM injection_log i
+         JOIN drift_anchors a ON a.id = i.anchor_id
+        WHERE a.status = 'active'
+        GROUP BY i.anchor_id
+       HAVING gate_contradicts >= ?`)
+        .all(minC);
+    const realityStmt = db.prepare(`SELECT COUNT(*) AS n FROM drift_edges WHERE anchor_id = ? AND verdict = 'contradicts' AND status = 'open'`);
+    const out = [];
+    for (const r of rows) {
+        const gate_mode = jsonGet(r.card_policy, 'gate_mode', 'soft');
+        const reality_contradicts = realityStmt.get(r.anchor_id).n;
+        let signal;
+        let suggested_action;
+        let recommendation;
+        if (reality_contradicts > 0) {
+            signal = 'violated_for_real';
+            if (gate_mode !== 'hard') {
+                suggested_action = 'escalate_to_hard';
+                recommendation = `Re-surfaced ${r.gate_contradicts}× yet ${reality_contradicts} contradiction(s) are still live in the code — soft warnings aren't holding. Escalate to gate_mode:'hard', or supersede the anchor if reality has outrun the rule.`;
+            }
+            else {
+                suggested_action = 'review_or_supersede';
+                recommendation = `Hard-gated yet ${reality_contradicts} contradiction(s) persist (pre-existing or overridden) — the rule is fighting reality. Review whether it is still correct; supersede if not.`;
+            }
+        }
+        else {
+            signal = 'gate_holding';
+            const heavy = gate_mode !== 'hard' && r.gate_contradicts >= minC * 2;
+            suggested_action = heavy ? 'escalate_to_hard' : 'none';
+            recommendation = `The gate caught ${r.gate_contradicts} attempt(s) and reality stayed clean — working as intended.${heavy ? " It keeps firing — consider gate_mode:'hard' to stop the attempts at the source." : ''}`;
+        }
+        out.push({
+            anchor_id: r.anchor_id,
+            statement: r.statement,
+            gate_mode,
+            lifecycle: r.lifecycle,
+            gate_contradicts: r.gate_contradicts,
+            gate_blocks: r.gate_blocks,
+            ignored: r.ignored,
+            reality_contradicts,
+            last_at: r.last_at,
+            signal,
+            suggested_action,
+            recommendation,
+        });
+    }
+    return out.sort((x, y) => y.reality_contradicts - x.reality_contradicts || y.gate_contradicts - x.gate_contradicts);
+}
+// One-call enforcement change — applies the friction "escalate_to_hard" recommendation. Merges gate_mode
+// into the anchor's card_policy (preserving other keys). Exposed via resolve_drift(action:'harden'|'soften'),
+// NOT a new tool — honoring anchor #1 ("public tools = 3, don't add a 4th"; the surface already drifted to 10).
+export function setGateMode(db, anchorId, mode) {
+    const row = db.prepare(`SELECT card_policy FROM drift_anchors WHERE id = ?`).get(anchorId);
+    if (!row)
+        throw new Error(`anchor #${anchorId} not found`);
+    let policy = {};
+    try {
+        policy = JSON.parse(row.card_policy || '{}') || {};
+    }
+    catch {
+        policy = {};
+    }
+    policy.gate_mode = mode;
+    if (policy.enabled === undefined)
+        policy.enabled = true;
+    db.prepare(`UPDATE drift_anchors SET card_policy = ?, updated_at = unixepoch() WHERE id = ?`).run(JSON.stringify(policy), anchorId);
+    return { ok: true, anchor_id: anchorId, gate_mode: mode, card_policy: policy };
+}
+//# sourceMappingURL=guard.js.map

package/dist/lib/lexical-match.d.ts

@@ -0,0 +1,6 @@
+export declare function parseArray(s: string | null | undefined): string[];
+export declare function normPath(p: string): string;
+export declare function compileGlob(glob: string): (path: string) => boolean;
+export declare const SCRAPE_ANCHOR: RegExp;
+export declare function signalIndex(lowerLine: string, signal: string): number;
+export declare function matchViolation(rawLine: string, lowerLine: string, signals: string[], isScrapeAnchor: boolean): string | null;