opencode-dejavu 2.4.0 → 2.5.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 2.5.0 — 2026-08-24
+
+### Changed (the three known gaps, closed)
+- **Diagnostics now signal.** Recurring test/lint/build-check failures (`tsc`, `pytest`, `curl`, ...) previously got zero enforcement. New gate tier `reminding`: they promote and REMIND like any gate, but NEVER block — a new status alongside `watching`/`blocking`, enforced everywhere (findGate, compaction, migrate/repair, doctor, TTL).
+- **Repo-local verbs never escalate.** npm/yarn/pnpm/bun/npx, git, gradle/maven, cargo/go/pip/poetry/uv, docker, make/cmake/bazel failures are repo quirks, not agent habits — they stay project-scoped forever (`isRepoLocal`), so a broken `npm install` in one project can no longer block another. Doctor's MISSED-ESCALATION skips them.
+- **Flag-aware fuzzy matching.** Commands with disjoint flag sets never merge (`train --lr` vs `train --epochs`); subset additions still do (`train` vs `train -v`), so enforcement doesn't fragment across harmless variants while different operations stay separate.
+
+### Migration
+- `migrate()` re-tiers legacy gates: over-blocking diagnostics → `reminding` (signal kept), and already-proven recurring diagnostics → `reminding` immediately (no waiting for the next failure).
+
 ## 2.4.0 — 2026-08-24
 
 ### Added

package/index.ts

@@ -129,7 +129,7 @@ export const Dejavu: Plugin = async ({ directory, client }) => {
         for (let i = 0; i < candidates.length; i++) {
           const sig = candidates[i] ?? ""
           const match = await stores.findGate(patternKey(sig), sig)
-          if (match && match.gate.status === "blocking") {
+          if (match && match.gate.status !== "watching") {
             found = { gate: match.gate, store: match.store, via: i > 0 && match.via === "exact" ? "segment" : match.via }
             break
           }
@@ -182,7 +182,9 @@ export const Dejavu: Plugin = async ({ directory, client }) => {
           if (fresh === undefined) return // gate deleted between find and lock
 
           // Repeat offense: reminded, retried, failed again -> hard block.
-          if (fresh.failedSessions !== undefined && fresh.failedSessions[session] !== undefined) {
+          // Remind-only gates (diagnostics) never reach this branch — they
+          // never collect failedSessions (see the after-hook).
+          if (fresh.status === "blocking" && fresh.failedSessions !== undefined && fresh.failedSessions[session] !== undefined) {
             fresh.blockedCount += 1
             if (fresh.blockedCount >= REVIEW_FIRES) fresh.review = true
             await target.store.save()
@@ -302,13 +304,15 @@ export const Dejavu: Plugin = async ({ directory, client }) => {
           let changed = false
           // Metric: failure of an already-enforced pattern (the event that
           // promoted the gate does not count — the gate did not exist yet).
-          if (fresh.status === "blocking" && !result.promoted) {
+          if (fresh.status !== "watching" && !result.promoted) {
             fresh.recurredAfterGate += 1
             changed = true
             await stores.logAll({ type: "recurred-after-gate", key: fresh.key, tool: input.tool, session, project: directory })
           }
           // Same-session repeat after a reminder -> escalate to hard block.
-          if (fresh.remindedSessions?.[session] !== undefined) {
+          // Remind-only gates (diagnostics) never collect failedSessions:
+          // they signal but must not punish iterating on tests/linters.
+          if (fresh.status === "blocking" && fresh.remindedSessions?.[session] !== undefined) {
             if (fresh.failedSessions === undefined) fresh.failedSessions = {}
             fresh.failedSessions[session] = Date.now()
             fresh.recurredAfterReminder += 1
@@ -410,7 +414,7 @@ export const Dejavu: Plugin = async ({ directory, client }) => {
 
     "experimental.session.compacting": async (_input, output) => {
       try {
-        const gates = await stores.blockingGates()
+        const gates = await stores.enforcedGates()
         if (gates.length === 0) return
         const lines = gates
           .slice(0, 20)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-dejavu",
-  "version": "2.4.0",
+  "version": "2.5.0",
   "description": "Cross-session memory prosthesis for OpenCode: detects recurring tool-call failures and promotes them into enforced gates. Remind first, block on same-session repeat offense.",
   "type": "module",
   "main": "index.ts",

package/src/AGENTS.md

@@ -12,12 +12,13 @@ Two dependency-free modules: `patterns.ts` (pure functions — call identity, no
 | Interpreter one-liner identity | patterns.ts | `hashInterpreterPayload` — `-c`/`-e` code payload → `<code:hash>` |
 | Chain-bypass protection | patterns.ts | `splitChain` (quote/paren-aware) → `bashSegmentSignatures` |
 | Free-form error collapsing | patterns.ts | `parameterizeError` (event channel) vs `normalizeCommand` (bash) |
-| Near-duplicate merge | patterns.ts | `fuzzySimilar` = normalized `levenshtein` ≤ 0.3 |
+| Near-duplicate merge | patterns.ts | `fuzzySimilar` = normalized `levenshtein` ≤ 0.3 + flag-subset rule |
 | Failure text scan | patterns.ts | `detectFailure` + `FAILURE_SIGNATURES` |
 | Noise filtering | patterns.ts | `isNoiseError` + `NOISE_ERRORS` (aborted/cancelled ≠ failed) |
-| Diagnostic/intended-exit logic | patterns.ts | `DIAGNOSTIC_VERBS`, `isIntendedNonzero`, `canBlock` |
+| Diagnostic/intended-exit logic | patterns.ts | `DIAGNOSTIC_VERBS`, `isIntendedNonzero`, `canBlock`, `canRemind` |
+| Escalation scope policy | patterns.ts | `isRepoLocal` + `REPO_LOCAL_VERBS` — repo-local verbs never escalate globally |
 | One scope (gates.json + index.json + log.jsonl) | store.ts | `GateStore` — `load`/`save`/`loadIndex`/`saveIndex`/`log`/`expire`/`extract`/`rotateLog`/`reconcile` |
-| Two-scope logic + promotion | store.ts | `Stores` — `findGate`/`recordFailure`/`migrate`/`blockingGates`/`reconcileAll`; `mergeGate` merges duplicate keys |
+| Two-scope logic + promotion | store.ts | `Stores` — `findGate`/`recordFailure`/`migrate`/`enforcedGates`/`reconcileAll`; `mergeGate` merges duplicate keys |
 | Gate parse/repair boundary | validate.ts | `coerceGateShape` (strict parse), `repairGate` (mechanical coercion), `hasNestedTokens` (corruption fingerprint) |
 | fs safety | store.ts | `ntPath`, `atomicWrite`, `withLock` |
 
@@ -26,7 +27,9 @@ Two dependency-free modules: `patterns.ts` (pure functions — call identity, no
 - Rule order in `PARAM_RULES` matters: quoted strings first, specific tokens (uuid/sha/ip/url/date), generic numbers last — reordering fragments signatures
 - Rule order in `normalizeCommand` matters too: quoted strings are parameterized BEFORE path rules — a `<str>` substitution inserts spaces that would expose an adjacent `/` to the path rule on a second pass (idempotency); interpreter payload hashing runs while the payload is still raw
 - `scrubSecrets()` runs on every string before it touches disk; `recordFailure` re-scrubs defensively
-- `canBlock(tool, sig)` = bash && non-diagnostic && not a bare one-liner shape — the ONLY path to `blocking`; probe tools use `PROMOTE_COUNT_PROBE` and never block
+- Three enforcement tiers: `canBlock` (bash && non-diagnostic && not a bare one-liner shape) is the ONLY path to `blocking`; `canRemind` (diagnostic bash) is the only path to `reminding`; probe tools use `PROMOTE_COUNT_PROBE` and never leave `watching`
+- Repo-local verbs (`isRepoLocal`) never escalate to the global store — their failures are repo quirks; both escalation paths (`recordFailure` + `reconcileAll`) and doctor's MISSED-ESCALATION honor this
+- Fuzzy merging requires comparable flag sets (one a subset of the other) — disjoint switches are different operations and must never merge; subset additions still consolidate
 - `DIAGNOSTIC_VERBS` serves two callers (exit-1 allowlist + blocking policy) — one list, two uses; edit knowing both move
 - Lock order is always project → global, gates → index (see `recordFailure` escalation) — reversing deadlocks; the log lock is separate and leaf-level
 - Cross-project evidence lives ONLY in the global `index.json` — a gate's own `projects` array sees one store and never drives escalation alone
@@ -35,7 +38,7 @@ Two dependency-free modules: `patterns.ts` (pure functions — call identity, no
 - Fuzzy consolidation in `recordFailure` prefers the gate holding the session's reminded state (before/after hooks must stay in sync) and never overwrites the evidence snippet
 - Snippets and corrections are UNTRUSTED text re-injected into agent context — keep the data-label framing in messages, the 200-char correction bound, and scrub quarantine bytes
 - Inside `runLocked` always `load(true)`; unlocked `load()` peeks are routing hints only, never a basis for mutation
-- Hot-path reads use the 1s TTL cache + key index (`byKey`/`blockingOnly`); mutations inside locks use `load(true)`; `save()` refreshes the cache directly
+- Hot-path reads use the 1s TTL cache + key index (`byKey`/`enforcedOnly`); mutations inside locks use `load(true)`; `save()` refreshes the cache directly
 - The remind→block chain is persisted ON THE GATE (`remindedSessions`/`failedSessions`) and enforced under the store lock — process memory holds nothing authoritative, so several windows and restarts share one escalation
 - Log appends and rotation take the log lock — every OpenCode window shares the global log; unlocked appends interleave into broken JSON
 - Every gate read from disk crosses `coerceGateShape` + `repairGate` in `load()` — enforcement never sees raw state; hopeless records are dropped, repairable ones coerced

package/src/patterns.ts

@@ -187,6 +187,37 @@ export function canBlock(tool: string, signature: string): boolean {
   return !GENERIC_ONELINER_SHAPE.test(signature)
 }
 
+/**
+ * Remind-only policy: diagnostic bash commands still surface a REMINDER when
+ * they recur (the old behavior gave them zero signal), but they NEVER block —
+ * blocking a test/lint the agent is iterating on punishes normal work.
+ * Generic one-liner shapes stay unenforced: they are too broad to remind on.
+ */
+export function canRemind(tool: string, signature: string): boolean {
+  if (tool !== "bash") return false
+  if (GENERIC_ONELINER_SHAPE.test(signature)) return false
+  return isDiagnosticSignature(signature)
+}
+
+/**
+ * Repo-local verbs: their success depends on THIS repo's state (deps, lockfile,
+ * remote, build cache), not on agent behavior — so a failure is a repo quirk,
+ * not an agent habit, and must never escalate to the global store (an
+ * `npm install` that broke in project A would otherwise block project B).
+ */
+const REPO_LOCAL_VERBS: RegExp[] = [
+  /\b(npm|yarn|pnpm|bun|npx)\b/i,
+  /\bgit\b/i,
+  /\b(gradlew|gradle|mvn|maven)\b/i,
+  /\b(cargo|go|pip3?|poetry|uv)\b/i,
+  /\bdocker(-compose)?\b/i,
+  /\b(make|cmake|bazel)\b/i,
+]
+
+export function isRepoLocal(signature: string): boolean {
+  return REPO_LOCAL_VERBS.some((rule) => rule.test(signature))
+}
+
 // --- Chain splitting ---------------------------------------------------------
 
 /**
@@ -338,6 +369,23 @@ export function levenshtein(a: string, b: string): number {
 /** Code fingerprints are IDENTITY, not data — they must match exactly. */
 const CODE_FINGERPRINTS = /<code:[0-9a-f]+>/g
 
+/** Flag tokens ("-x", "--foo") are the operation's switches. Two commands with
+ * DISJOINT flag sets are different operations and must never fuzzy-merge
+ * ("train --lr <n>" vs "train --epochs <n>"). A subset IS allowed — extra
+ * switches on the same operation ("gradlew test --no-daemon") still belong to
+ * the same gate, otherwise enforcement fragments across harmless variants. */
+function flagTokens(signature: string): string[] {
+  return signature
+    .split(/\s+/)
+    .filter((token) => token.startsWith("-"))
+    .sort()
+}
+
+function flagSubset(a: string[], b: string[]): boolean {
+  const set = new Set(b)
+  return a.every((token) => set.has(token))
+}
+
 /** Signatures longer than this match exactly only: a 300-char normalized
  * command is already specific enough that "30% near" is meaningless, and
  * Levenshtein on long signatures is the hot-path cost cliff. */
@@ -350,7 +398,9 @@ export const FUZZY_MAX_LEN = 300
  * commands ("git push <str>" vs "git pull <str>" = distance 2) from merging.
  * Signatures carrying <code:...> fingerprints only match if the fingerprints
  * are identical — random hashes differing in 3 chars would otherwise pass the
- * distance rule and merge unrelated one-liners into one gate.
+ * distance rule and merge unrelated one-liners into one gate. Flag sets must
+ * also be comparable (one a subset of the other) — disjoint switches mean
+ * different operations.
  */
 export function fuzzySimilar(a: string, b: string): boolean {
   if (a === b) return true
@@ -359,6 +409,9 @@ export function fuzzySimilar(a: string, b: string): boolean {
   if (codesA !== null || codesB !== null) {
     if (codesA === null || codesB === null || codesA.join("\u0000") !== codesB.join("\u0000")) return false
   }
+  const flagsA = flagTokens(a)
+  const flagsB = flagTokens(b)
+  if (!flagSubset(flagsA, flagsB) && !flagSubset(flagsB, flagsA)) return false
   const maxLen = Math.max(a.length, b.length)
   if (maxLen === 0) return true
   if (maxLen > FUZZY_MAX_LEN) return false

package/src/store.ts

@@ -1,10 +1,10 @@
 import { appendFile, mkdir, readFile, rename, stat, unlink, writeFile } from "node:fs/promises"
 import { dirname, join } from "node:path"
-import { canBlock, fuzzySimilar, FUZZY_MAX_LEN, scrubSecrets } from "./patterns"
+import { canBlock, canRemind, fuzzySimilar, FUZZY_MAX_LEN, isRepoLocal, scrubSecrets } from "./patterns"
 import { coerceGateShape, repairGate } from "./validate"
 
 /** Bumped on behavior changes; stamped into init log events so stale sessions are visible. */
-export const PLUGIN_VERSION = "2.4.0"
+export const PLUGIN_VERSION = "2.5.0"
 
 export interface Gate {
   /** sha1 signature prefix — the pattern identity */
@@ -12,8 +12,9 @@ export interface Gate {
   /** normalized call signature, e.g. "bash:npm install --legacy-peer-deps" */
   signature: string
   tool: string
-  /** watching = collecting evidence; blocking = gate is enforced */
-  status: "watching" | "blocking"
+  /** watching = collecting evidence; reminding = enforced as reminder only
+   * (diagnostics — never block); blocking = reminder + hard block on repeat */
+  status: "watching" | "reminding" | "blocking"
   count: number
   /** distinct session IDs where the failure was seen */
   sessions: string[]
@@ -199,7 +200,7 @@ export class GateStore {
   /** hot-path caches: valid until LOAD_CACHE_TTL_MS / invalidated on mutation */
   private cacheUntilMs = 0
   private keyIndex: Map<string, Gate> | null = null
-  private blockingCache: Gate[] | null = null
+  private enforcedCache: Gate[] | null = null
   private index: IndexFile | null = null
   private indexMtimeMs = 0
 
@@ -254,7 +255,7 @@ export class GateStore {
       }
       this.gates = gates
       this.keyIndex = new Map(gates.map((g) => [g.key, g]))
-      this.blockingCache = gates.filter((g) => g.status === "blocking")
+      this.enforcedCache = gates.filter((g) => g.status !== "watching")
       this.mtimeMs = info.mtimeMs
       this.cacheUntilMs = Date.now() + LOAD_CACHE_TTL_MS
       return this.gates
@@ -263,7 +264,7 @@ export class GateStore {
       if (this.gates === null) {
         this.gates = []
         this.keyIndex = new Map()
-        this.blockingCache = []
+        this.enforcedCache = []
       }
       this.cacheUntilMs = Date.now() + LOAD_CACHE_TTL_MS
       return this.gates
@@ -278,12 +279,12 @@ export class GateStore {
     return this.keyIndex.get(key)
   }
 
-  /** Cached blocking subset — the fuzzy scan iterates this, not all gates. */
-  blockingOnly(): Gate[] {
-    if (this.blockingCache === null) {
-      this.blockingCache = (this.gates ?? []).filter((g) => g.status === "blocking")
+  /** Cached enforced subset (blocking + reminding) — the fuzzy scan iterates this, not all gates. */
+  enforcedOnly(): Gate[] {
+    if (this.enforcedCache === null) {
+      this.enforcedCache = (this.gates ?? []).filter((g) => g.status !== "watching")
     }
-    return this.blockingCache
+    return this.enforcedCache
   }
 
   async save(): Promise<void> {
@@ -297,7 +298,7 @@ export class GateStore {
       // mtime refresh is best-effort
     }
     // We know the content we just wrote — refresh the TTL cache directly.
-    // (keyIndex/blockingCache hold references into this.gates, still valid.)
+    // (keyIndex/enforcedCache hold references into this.gates, still valid.)
     this.cacheUntilMs = Date.now() + LOAD_CACHE_TTL_MS
   }
 
@@ -360,14 +361,14 @@ export class GateStore {
     const gates = await this.load(true)
     const now = Date.now()
     const expired = gates.filter((g) => {
-      const ttl = g.status === "blocking" || g.count >= PROMOTE_COUNT ? ttlDays : noiseTtlDays
+      const ttl = g.status !== "watching" || g.count >= PROMOTE_COUNT ? ttlDays : noiseTtlDays
       return Date.parse(g.lastSeen) < now - ttl * DAY_MS
     })
     if (expired.length === 0) return []
     const expiredKeys = new Set(expired.map((g) => g.key))
     this.gates = gates.filter((g) => !expiredKeys.has(g.key))
     this.keyIndex = null
-    this.blockingCache = null
+    this.enforcedCache = null
     await this.save()
     return expired
   }
@@ -379,7 +380,7 @@ export class GateStore {
     if (removed.length > 0) {
       this.gates = this.gates.filter((g) => !keys.has(g.key))
       this.keyIndex = null
-      this.blockingCache = null
+      this.enforcedCache = null
     }
     return removed
   }
@@ -429,7 +430,7 @@ export class GateStore {
             await unlink(ntPath(this.gatesPath))
             this.gates = []
             this.keyIndex = null
-            this.blockingCache = null
+            this.enforcedCache = null
             this.mtimeMs = 0
             await this.save()
             await this.log({ type: "quarantined", key: "gates.json", snippet: `unparseable gates file quarantined (scrubbed) to ${quarantine}` })
@@ -582,7 +583,7 @@ export class Stores {
     if (signature.length > FUZZY_MAX_LEN) return null
     let best: { gate: Gate; store: GateStore; score: number } | null = null
     for (const store of this.scopes()) {
-      for (const gate of store.blockingOnly()) {
+      for (const gate of store.enforcedOnly()) {
         if (!fuzzySimilar(signature, gate.signature)) continue
         const score = Math.abs(signature.length - gate.signature.length)
         if (best === null || score < best.score) best = { gate, store, score }
@@ -591,12 +592,12 @@ export class Stores {
     return best === null ? null : { gate: best.gate, store: best.store, via: "fuzzy" }
   }
 
-  /** All currently enforced gates, project scope first, highest-count first. */
-  async blockingGates(): Promise<Gate[]> {
+  /** All currently enforced gates (blocking + reminding), project scope first, highest-count first. */
+  async enforcedGates(): Promise<Gate[]> {
     const result: Gate[] = []
     for (const store of this.scopes()) {
       await store.load()
-      for (const gate of store.blockingOnly()) result.push(gate)
+      for (const gate of store.enforcedOnly()) result.push(gate)
     }
     return result.sort((a, b) => b.count - a.count)
   }
@@ -681,10 +682,27 @@ export class Stores {
         const gates = await store.load(true)
         let changed = false
         for (const gate of gates) {
-          if (!canBlock(gate.tool, gate.signature) && gate.status === "blocking") {
+          if (gate.status === "blocking" && !canBlock(gate.tool, gate.signature)) {
+            // Over-blocking learned under an older policy: keep the signal if
+            // the shape can at least remind (diagnostics), else drop to watching.
+            gate.status = canRemind(gate.tool, gate.signature) ? "reminding" : "watching"
+            changed = true
+          }
+          if (gate.status === "reminding" && !canRemind(gate.tool, gate.signature)) {
             gate.status = "watching"
             changed = true
           }
+          if (
+            gate.status === "watching" &&
+            canRemind(gate.tool, gate.signature) &&
+            gate.count >= PROMOTE_COUNT &&
+            gate.sessions.length >= PROMOTE_SESSIONS
+          ) {
+            // Recurring diagnostics already proven under the old policy start
+            // reminding immediately instead of waiting for the next failure.
+            gate.status = "reminding"
+            changed = true
+          }
           const signature = scrubSecrets(gate.signature)
           const snippet = scrubSecrets(gate.snippet)
           if (signature !== gate.signature) {
@@ -753,7 +771,7 @@ export class Stores {
       const index = await this.globalStore.loadIndex()
       const toEscalate = (await projectStore.load(true)).filter((g) => {
         const entry = index.keys[g.key]
-        return entry !== undefined && entry.projects.length >= globalProjects
+        return entry !== undefined && entry.projects.length >= globalProjects && !isRepoLocal(g.signature)
       })
       if (toEscalate.length > 0) {
         await projectStore.runLocked(async () => {
@@ -918,15 +936,16 @@ export class Stores {
 
       let promoted = false
       const threshold = PROBE_TOOLS.has(input.tool) ? PROMOTE_COUNT_PROBE : PROMOTE_COUNT
-      // Policy: only bash non-diagnostic commands may ever become gates.
-      if (
-        gate.status === "watching" &&
-        canBlock(gate.tool, gate.signature) &&
-        gate.count >= threshold &&
-        gate.sessions.length >= PROMOTE_SESSIONS
-      ) {
-        gate.status = "blocking"
-        promoted = true
+      // Policy: non-diagnostic bash may hard-block; diagnostics promote to
+      // remind-only (they never block — see canRemind). Everything else stays watching.
+      if (gate.status === "watching" && gate.count >= threshold && gate.sessions.length >= PROMOTE_SESSIONS) {
+        if (canBlock(gate.tool, gate.signature)) {
+          gate.status = "blocking"
+          promoted = true
+        } else if (canRemind(gate.tool, gate.signature)) {
+          gate.status = "reminding"
+          promoted = true
+        }
       }
 
       await store.save()
@@ -954,7 +973,15 @@ export class Stores {
       })
 
       let wentGlobal = false
-      if (store !== this.globalStore && this.projectStore && indexProjects >= input.globalProjects) {
+      // Repo-local verbs (npm/git/gradle/...) never escalate: their failures are
+      // repo quirks, not agent habits — escalating them would let a broken
+      // `npm install` in one project block every other project.
+      if (
+        store !== this.globalStore &&
+        this.projectStore &&
+        indexProjects >= input.globalProjects &&
+        !isRepoLocal(moved.signature)
+      ) {
         // Global FIRST, then remove the local copy: a crash between the two
         // writes must leave a duplicate (healed by migrate), never a hole.
         await this.globalStore.runLocked(async () => {

package/src/validate.ts

@@ -5,7 +5,7 @@
  * coerceGateShape + repairGate satisfies the data-model invariants.
  */
 import type { Gate } from "./store"
-import { canBlock, scrubSecrets } from "./patterns"
+import { canBlock, canRemind, scrubSecrets } from "./patterns"
 
 /** sha1 prefix-12, the only key shape patternKey ever emits */
 const KEY_SHAPE = /^[0-9a-f]{12}$/
@@ -27,7 +27,7 @@ export function coerceGateShape(raw: unknown): Gate | null {
   if (typeof r.key !== "string" || !KEY_SHAPE.test(r.key)) return null
   if (typeof r.signature !== "string" || r.signature.trim() === "") return null
   if (typeof r.tool !== "string" || r.tool.trim() === "") return null
-  if (r.status !== "watching" && r.status !== "blocking") return null
+  if (r.status !== "watching" && r.status !== "reminding" && r.status !== "blocking") return null
 
   const num = (v: unknown, fallback: number): number =>
     typeof v === "number" && Number.isFinite(v) && v >= 0 ? Math.floor(v) : fallback
@@ -157,9 +157,14 @@ export function repairGate(gate: Gate): boolean {
     }
     if (Object.keys(failed).length === 0) delete gate.failedSessions
   }
-  // Policy is the single source of truth: a blocking gate that cannot block
-  // is a leftover from an older policy and must be demoted.
+  // Policy is the single source of truth: an enforced gate that no longer
+  // qualifies is a leftover from an older policy and must be demoted —
+  // blocking to reminding if the shape can still remind, else to watching.
   if (gate.status === "blocking" && !canBlock(gate.tool, gate.signature)) {
+    gate.status = canRemind(gate.tool, gate.signature) ? "reminding" : "watching"
+    changed = true
+  }
+  if (gate.status === "reminding" && !canRemind(gate.tool, gate.signature)) {
     gate.status = "watching"
     changed = true
   }