replen 1.0.22 → 1.0.24

package/dist/discover-projects.js

@@ -171,7 +171,7 @@ export function discoverProjects(roots) {
             seenGithub.add(githubFullName);
             // Slug + display name both anchor on the GitHub repo NAME, not the
             // local folder name. Deriving from the folder meant a folder rename (or
-            // an org rename like Covelent→nsokin) minted a fresh slug and the server
+            // an org rename) minted a fresh slug and the server
             // inserted a duplicate row. `~/code/drone` with remote
             // `nsokin/palisade-website` now registers as slug `palisade-website`.
             // The repo name is also the fallback display name, so a generic

package/extras/skills/replen/SKILL.md

@@ -79,6 +79,12 @@ and versions ONLY — never code. This is what turns Replen's deadline and
 security lines from "worth checking your pins" into "affects `aegis`
 (3.10.12)" — and silences alarms for versions this repo verifiably isn't on.
 
+This step is NOT optional, and not only about deadlines: the reported
+names are also the matcher's "already a dependency" exclusion list. A
+repo that never reports versions WILL get its own dependencies suggested
+back to it as candidates (fastapi pinned in requirements.txt, fastapi in
+the shortlist) — a shipped failure this step prevents.
+
 If `candidates.length === 0`, tell the user "No new candidates today for
 `<owner/name>`. Calm-cadence working as designed — 1-3 actionable
 matches a month is the goal." Stop.
@@ -177,20 +183,40 @@ that means here.
 mismatch, security flag. Empty list is fine; don't manufacture.
 ```
 
+#### 3d. Record the verdict NOW — don't wait for the user
+
+As soon as a candidate's verdict is formed, call `replen_record_triage`
+for it — **before** you present the batch, and **without asking**.
+Recording is observation, not action: it captures what you concluded
+(verdict, score, reason code, one-liner, cosine) so the learning loop and
+re-surfacing suppression actually fire. It is non-destructive and doesn't
+foreclose anything — the user's star / hide / handoff choices in Step 4
+are a separate axis layered on top.
+
+The failure mode this rule exists to kill: a session triages four
+candidates, presents them, ends with "want me to record these?", the
+user moves on — and Replen learned NOTHING. The same four will come back.
+A triage that isn't recorded never happened.
+
+Only the user-judgment actions (star / hide / handoff / queue work) wait
+for the user. Verdicts never do.
+
 No marketing voice. No hype. The user is a working engineer; talk to
 them like a peer. Concrete > clever.
 
 ### Step 4 — Present + capture actions
 
-After all writeups, summarise:
+By this point every verdict is ALREADY recorded (3d). After all
+writeups, summarise, and ask only about the actions that genuinely need
+the user's call — skips need nothing further:
 
 ```
-3 candidates triaged for tech-news-site:
+3 candidates triaged for tech-news-site (all verdicts recorded):
   ✓ adopt: kribblo/node-ffmpeg-installer (high · quick) — ffmpeg-static swap
   ⏭ port:  tj/n (medium · moderate) — version-manager pattern
   ✗ skip:  vercel/turbo (medium · deep) — wrong runtime, already have Vite
 
-For each, what would you like to do? (star / hide / handoff / skip)
+Want the adopt wired up, or any of these starred / hidden / handed off?
 ```
 
 Then, for each candidate, capture the user's choice. For each action,
@@ -327,7 +353,13 @@ verdict it calibrates the relevance floor for this project, and your
 adopt/skip pattern continuously tunes the ranking via the taste vector).
 A skip coded `modality-collision` teaches Replen that this repo fits a
 *different* modality — so it stays available for the right project but stops
-colliding with this one.
+colliding with this one. A skip coded `covered` is the strongest signal you
+can send: it tells Replen the capability is **already built in this repo**, so
+it stops probing that facet entirely and won't surface a different tool for it
+next session. Use `covered` ONLY when you've confirmed the implementation in
+the code (e.g. the repo has its own `services/llm_client.py`), not just because
+a similar dependency exists — that's what makes "we already do this" stick to
+the capability instead of replaying every session against a new candidate.
 
 **Candidate's README is unreachable (WebFetch 404)**. Note it in the
 writeup (`Caveats: README unreachable; verdict based on description

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replen",
-  "version": "1.0.22",
+  "version": "1.0.24",
   "description": "Make your AI coding tools smarter. One command, no API keys, free. Replen watches what your projects actually do and surfaces a few things worth bringing in each month. Use one as is, port a piece of another, cherry pick an idea, or build it clean room. The match happens inside your AI tool's session. A few actionable matches a month, by design.",
   "type": "module",
   "bin": {