wicked-garden 12.51.1 → 12.52.1

package/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.51.1"}], "version": "12.51.1"}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.52.1"}], "version": "12.52.1"}

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.51.1",
+  "version": "12.52.1",
   "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), multi-model second opinions (fallback seats labelled) (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
   "wicked_vault_version": "^0.5.0",
   "wicked_ledger_version": "^0.6.0",

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## [Unreleased]
 
+## [12.52.1] — 2026-10-11
+
+### Changed
+- **The memory durability gate refuses only the unambiguous (w9-memfix3, PR #1283).** `store` / `capture-batch` refuse a body under 40 characters, a bare id / SHA / version, and first-person progress narration. Ids, versions, SHAs, PIDs and date words inside a body are returned as `warnings` and the store succeeds. "Keep SQLite >= 3.35.0 because RETURNING …" and "CRC32 polynomial edb88320 … database commit …" are stored. The three-month test in the mem skills is the agent's judgment.
+
+### Fixed
+- **Relative-path worktrees resolve to their main checkout's project scope** (`gitdir: ../../.git/worktrees/run` is resolved against the `.git` file, and `commondir` is followed), not `project:..`.
+
+## [12.52.0] — 2026-10-11
+
+### Changed
+- **Learn indexing reads what merged and replaces a topic by its source (PR #1280).**
+  - `scripts/learn/index.py --ref <ref>` reads `.wicked/knowledge/` at a git ref, never the working copy. wicked-crew's learn schedule passes `origin/<default>`.
+  - When estate advertises `knowledge.forget` (estate K1+K2), each topic becomes one `knowledge.ingest {replace_source: true}` carrying `observed_at` and `source_rev`, and a topic with nothing left is forgotten by its source.
+  - An older estate keeps the per-revision scope fallback.
+
 ## [12.51.1] — 2026-10-11
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.51.1",
+  "version": "12.52.1",
   "type": "module",
   "description": "Curated toolkit for what AI coding agents can't do alone: evidence-gated work, codegraph relationships, deterministic multi-file refactor, multi-model second opinions, and cross-session memory. Installs as a Claude Code plugin.",
   "keywords": [

package/scripts/_estate_client.py

@@ -963,6 +963,30 @@ def context(
     return call("ContextBundle", args, timeout=timeout)
 
 
+def _worktree_main(git_file: Path) -> Optional[Path]:
+    """Main checkout of a linked worktree whose ``.git`` file is ``git_file``.
+
+    ``gitdir:`` may be relative to the ``.git`` file's directory
+    (``git worktree add --relative-paths``); the worktree's ``commondir``
+    names the shared git dir (relative to the gitdir). The main checkout is
+    that git dir's parent. None when the file is not a worktree pointer.
+    """
+    try:
+        line = git_file.read_text(encoding="utf-8").strip()
+    except OSError:
+        return None
+    if not line.startswith("gitdir:"):
+        return None
+    gitdir = (git_file.parent / line[len("gitdir:"):].strip()).resolve()
+    try:
+        common = (gitdir / (gitdir / "commondir").read_text(encoding="utf-8").strip()).resolve()
+    except OSError:
+        common = gitdir.parent.parent if gitdir.parent.name == "worktrees" else None
+    if common is None or common.name != ".git":
+        return None
+    return common.parent
+
+
 def checkout_root() -> Optional[Path]:
     """The git checkout the cwd is in, resolved through linked worktrees.
 
@@ -979,14 +1003,7 @@ def checkout_root() -> Optional[Path]:
         if git.is_dir():
             return d
         if git.is_file():
-            try:
-                line = git.read_text(encoding="utf-8").strip()
-            except OSError:
-                return d
-            gitdir = line[len("gitdir:"):].strip() if line.startswith("gitdir:") else ""
-            marker = f"{os.sep}.git{os.sep}worktrees{os.sep}"
-            norm = gitdir.replace("/", os.sep)
-            return Path(norm.split(marker)[0]) if marker in norm else d
+            return _worktree_main(git) or d
     return None
 
 

package/scripts/editor/conformance.py

@@ -322,6 +322,22 @@ def _torn(page, wait: bool = False):
         return None
 
 
+def python_with_playwright() -> str | None:
+    """The first python3 / python on PATH that can import playwright. Each is probed, never compared by
+    path: a venv's python links to the same base binary yet sees other site-packages (codex)."""
+    import shutil, subprocess  # noqa: E401, PLC0415
+    for name in ("python3", "python"):
+        exe = shutil.which(name)
+        if exe is None:
+            continue
+        try:
+            if subprocess.run([exe, "-c", "import playwright.sync_api"], capture_output=True, timeout=30).returncode == 0:
+                return exe
+        except (OSError, subprocess.TimeoutExpired):
+            continue
+    return None
+
+
 def manifest_case(pack: Path) -> dict:
     """Case 0: garden's own `pack check` (the same gate wicked-crew runs before an install)."""
     try:
@@ -369,6 +385,13 @@ def main(argv: list[str] | None = None) -> int:
     try:
         from playwright.sync_api import sync_playwright  # noqa: PLC0415
     except ImportError:
+        # The launcher's snapshot venv carries no browser driver (E2E finding F-EDIT-2): run once more
+        # under a python on PATH that has one, with the same arguments.
+        other = python_with_playwright() if not os.environ.get("WG_EDITOR_CONFORMANCE_REEXEC") else None
+        if other is not None:
+            import subprocess  # noqa: PLC0415
+            env = {**os.environ, "WG_EDITOR_CONFORMANCE_REEXEC": "1"}
+            return subprocess.call([other, os.path.abspath(__file__), *(argv if argv is not None else sys.argv[1:])], env=env)
         return out({"ok": False, "pack": str(args.pack), "error": "no headless browser: the Python playwright package is "
                     "not installed (pip install playwright && playwright install chromium); refusing to report conformance "
                     "without the run"}, 3)

package/scripts/editor/install.py

@@ -278,6 +278,17 @@ def do_uninstall(args) -> tuple[int, dict]:
     return 0, out
 
 
+def consent_refusal(args, env) -> str | None:
+    """Inside a governed run (``WICKED_RUN_ID`` set) a live install happens only in the consent-gated
+    Tool unit, the one unit the engine hands ``WICKED_CONSENT_CHOICE`` (the operator's approved
+    choice). Any other unit (a creator in build, a reviewer) may plan with ``--dry-run`` but never
+    installs or uninstalls (E2E finding F-EDIT-1: a creator installed before the gate asked)."""
+    if not env.get("WICKED_RUN_ID") or env.get("WICKED_CONSENT_CHOICE"):
+        return None
+    return ("refusing to install inside a governed run outside its consent-gated install step: the operator "
+            "approves the install at that gate. Plan it with --dry-run; the install step runs it.")
+
+
 def main(argv: list[str] | None = None) -> int:
     parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
     where = parser.add_mutually_exclusive_group()
@@ -301,6 +312,10 @@ def main(argv: list[str] | None = None) -> int:
         except Failure as err:
             sys.stderr.write(f"editor install --dry-run: {err}\n")
             return err.code
+    refusal = consent_refusal(args, os.environ)
+    if refusal is not None:
+        print(json.dumps({"ok": False, "error": refusal}))
+        return 2
     try:
         code, out = do_uninstall(args) if args.uninstall else do_install(args)
     except Failure as err:

package/scripts/learn/index.py

@@ -4,14 +4,16 @@
     wicked-garden run scripts/learn/index.py --repo <checkout> [--name <repo name>] [--slug <slug>] [--dry-run]
 
 Reads ``.wicked/knowledge/<slug>/`` from the checkout (run it on the default branch: index what was
-MERGED, never an open pull request) and, per topic, REPLACES the estate scope ``learn:<repo>/topic:<slug>``:
-``knowledge.erase`` of that scope, then one ``knowledge.ingest`` whose chunks are the topic's ACTIVE
-claims (each chunk ends with its sources and observed dates) and the README's sections. A retired,
-superseded or contradicted claim therefore leaves recall at the next index.
+MERGED, never an open pull request) and, per topic, REPLACES its knowledge in estate: one
+``knowledge.ingest {replace_source: true}`` (source ``repo:<repo>/.wicked/knowledge/<slug>``, scope
+``learn:<repo>/topic:<slug>``, ``observed_at`` = the topic's refreshed_at, ``source_rev`` = its tree hash)
+whose chunks are the topic's ACTIVE claims (each chunk ends with its sources and observed dates) and the
+README's sections. A retired, superseded or contradicted claim therefore leaves recall at the next
+index; a topic with nothing left is forgotten by its source (``knowledge.forget``).
 
-When the estate binary has no ``knowledge.erase`` yet, the topic is ingested under a per-revision
-scope ``learn:<repo>/topic:<slug>/rev:<tree hash>`` instead and the output says ``"replace": "unavailable"``
-(an older revision stays recallable until estate can erase it).
+When estate does not advertise ``knowledge.forget`` (before estate K1+K2), the topic is ingested under a
+per-revision scope ``learn:<repo>/topic:<slug>/rev:<tree hash>`` instead and the output says
+``"replace": "unavailable"`` (an older revision stays recallable until estate can replace it).
 
 Never from inside a governed run: a run's estate is read-only, and learned knowledge reaches the
 store only after its pull request merged. Prints one JSON object ``{ok, repo, topics: [{slug, scope,
@@ -77,40 +79,72 @@ def topic_payload(repo: Path, name: str, d: Path) -> dict:
         "source": f"repo:{name}/.wicked/knowledge/{t.slug}",
         "chunks": chunks,
         "tree_hash": tree_hash(d),
+        # when the topic was last researched (topic.json refreshed_at, else created_at)
+        "observed_at": (t.meta.get("refreshed_at") or t.meta.get("created_at")) if isinstance(t.meta, dict) else None,
         "read_errors": t.errors,
     }
 
 
-def index_topic(client, p: dict) -> dict:
+def index_topic(client, p: dict, tools: list | None = None) -> dict:
+    """Replace one topic in estate. With ``knowledge.forget`` advertised (estate K1+K2), the topic's
+    source is replaced in place (``knowledge.ingest {replace_source: true}``, carrying ``observed_at``
+    and ``source_rev``), and a topic with nothing left to index is forgotten by its source. Without
+    it, the topic is ingested under a per-revision scope and the output says so."""
     out = {"slug": p["slug"], "scope": p["scope"], "chunks": len(p["chunks"]), "tree_hash": p["tree_hash"]}
     if p["read_errors"]:
         out["read_errors"] = p["read_errors"]
-    if p["read_errors"]:
         out["ingested"] = False
-        out["reason"] = "the topic could not be fully read; its indexed scope is left as it was"
+        out["reason"] = "the topic could not be fully read; its indexed knowledge is left as it was"
         return out
-    erased = client.call("knowledge.erase", {"scope_prefix": p["scope"]}, timeout=30.0)
-    if erased is None:
-        out["replace"] = "unavailable"
-        out["scope"] = f"{p['scope']}/rev:{p['tree_hash']}"
-    else:
-        out["replace"] = "erased"
-        out["erased"] = erased
+    replace = "knowledge.forget" in (tools if tools is not None else client.list_tools())
     if not p["chunks"]:
         out["ingested"] = False
         out["reason"] = "no active claims and no README to index"
+        if replace:
+            forgotten = client.call("knowledge.forget", {"source": p["source"]}, timeout=30.0)
+            out["replace"] = "forgotten" if forgotten is not None else "forget-failed"
+            out["forgotten"] = forgotten
+            out["ok"] = forgotten is not None
         return out
-    res = client.call("knowledge.ingest", {"title": p["title"], "chunks": p["chunks"], "scope": out["scope"],
-                                           "source": p["source"]}, timeout=60.0)
+    args = {"title": p["title"], "chunks": p["chunks"], "source": p["source"]}
+    if replace:
+        out["replace"] = "replaced"
+        args.update(scope=p["scope"], replace_source=True, source_rev=p["tree_hash"])
+        if p.get("observed_at"):
+            args["observed_at"] = p["observed_at"]
+    else:
+        out["replace"] = "unavailable"
+        out["scope"] = f"{p['scope']}/rev:{p['tree_hash']}"
+        args["scope"] = out["scope"]
+    res = client.call("knowledge.ingest", args, timeout=60.0)
     out["ingested"] = res is not None
     if res is None:
         out["reason"] = "estate knowledge.ingest failed or estate is unreachable"
     return out
 
 
+def materialize(repo: Path, ref: str, dest: Path) -> None:
+    """Copy ``.wicked/knowledge/`` as it is at git ``ref`` (e.g. ``origin/main``: what MERGED) into
+    ``dest``, so the index reads the merged tree, never the checkout's working copy."""
+    listing = subprocess.run(["git", "-C", str(repo), "ls-tree", "-r", "-z", "--name-only", ref, "--", ".wicked/knowledge"],
+                             capture_output=True, timeout=30)
+    if listing.returncode != 0:
+        raise RuntimeError(f"git ls-tree {ref} failed: {listing.stderr.decode('utf-8', 'replace').strip()[:200]}")
+    for rel in filter(None, listing.stdout.decode("utf-8", "replace").split("\0")):
+        blob = subprocess.run(["git", "-C", str(repo), "show", f"{ref}:{rel}"], capture_output=True, timeout=30)
+        if blob.returncode != 0:
+            raise RuntimeError(f"git show {ref}:{rel} failed")
+        target = dest / rel
+        if not target.resolve().is_relative_to(dest.resolve()):
+            raise RuntimeError(f"refusing a path outside the index root: {rel}")
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_bytes(blob.stdout)
+
+
 def main(argv: list[str] | None = None) -> int:
     parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
     parser.add_argument("--repo", type=Path, default=Path("."))
+    parser.add_argument("--ref", help="read the knowledge at this git ref (e.g. origin/main) instead of the working tree")
     parser.add_argument("--name", help="the repository name in the scope (default: origin's name, else the directory)")
     parser.add_argument("--slug")
     parser.add_argument("--dry-run", action="store_true", help="print what would be indexed; touch no store")
@@ -123,13 +157,27 @@ def main(argv: list[str] | None = None) -> int:
                           "learned knowledge is indexed from the merged default branch (DES-learn-workflow §4.2)"}))
         return 2
     name = args.name or repo_name(repo)
+    if args.ref:
+        import tempfile
+        with tempfile.TemporaryDirectory(prefix="learn-index-") as tmp:
+            try:
+                materialize(repo, args.ref, Path(tmp))
+            except (RuntimeError, OSError, subprocess.SubprocessError) as e:
+                print(json.dumps({"ok": False, "repo": name, "reason": str(e)}))
+                return 1
+            return _run(client, Path(tmp), name, args)
+    return _run(client, repo, name, args)
+
+
+def _run(client, repo: Path, name: str, args) -> int:
     payloads = [topic_payload(repo, name, d) for d in topic_dirs(repo, args.slug)]
     if args.dry_run:
         print(json.dumps({"ok": True, "repo": name, "dry_run": True,
                           "topics": [{k: v for k, v in p.items() if k != "chunks"} | {"chunks": len(p["chunks"])} for p in payloads]}, indent=2))
         return 0
-    results = [index_topic(client, p) for p in payloads]
-    ok = all(r.get("ingested") or (not r["chunks"] and "read_errors" not in r) for r in results)
+    tools = client.list_tools()
+    results = [index_topic(client, p, tools) for p in payloads]
+    ok = all(r.get("ingested") or (not r["chunks"] and "read_errors" not in r and r.get("ok", True)) for r in results)
     print(json.dumps({"ok": ok, "repo": name, "topics": results}, indent=2))
     return 0 if ok else 1
 

package/scripts/mem/estate_memory.py

@@ -36,9 +36,10 @@ projects' memories need the explicit opt-in ``scope_prefix: ""``.
 
 Durability gate
 ---------------
-`store` / `capture-batch` refuse content that is not a durable learning (see
-``durability_rejects``): too short, or carrying SHAs, versions, PR/run ids,
-PIDs, "today", or first-person progress narration.
+`store` / `capture-batch` refuse only the unambiguous (``durability_rejects``):
+an empty or under-40-char body, a bare id / SHA / version, or first-person
+progress narration. Ids, versions, SHAs, PIDs and dates inside a body are
+advisory ``warnings`` (``durability_warnings``); the store still succeeds.
 
 Erase guard
 -----------
@@ -200,65 +201,57 @@ def _parse_budget(args):
 
 # ── durability gate ─────────────────────────────────────────────────────────
 # A memory must help a fresh session on a different task months from now: it
-# states a rule, why it holds, and when it applies. The skill text asks the
-# agent that question; these checks refuse the mechanical misses outright, so
-# narration and status never reach the store even when the judgment slips.
+# states a rule, why it holds, and when it applies. That judgment is the
+# agent's (the skill text asks it). The backend refuses only what is
+# unambiguous, and WARNS on the rest: an id, version or SHA inside a real rule
+# ("keep SQLite >= 3.35.0 because RETURNING", "CRC32 polynomial edb88320") is
+# fine, so those heuristics never block a store.
 MIN_CONTENT_CHARS = 40
-_HEX_RUN = re.compile(r"\b[0-9a-f]{7,40}\b")
-# A hex run is a commit id when it is long (>= 12) or sits in commit context; a short one
-# alone (a CRC32 polynomial, a colour) is a constant, and constants are durable.
-_COMMIT_CONTEXT = re.compile(
-    r"\b(?:commit|sha|rev(?:ision)?|cherry-?pick(?:ed)?|revert(?:ed)?|fixed in|landed in|merged as"
-    r"|pin(?:ned)?(?: moved)? (?:to|at))\b|@[0-9a-f]{7}", re.I)
-# A version is narration only next to release status ("released 2.4.1", "shipped 0.7.26"); a
-# version constraint ("keep SQLite >= 3.35.0 because RETURNING") is a durable rule.
-_VERSION = re.compile(r"(?<![\w.])v?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.]+)?(?![.\d])")
-_RELEASE_STATUS = re.compile(
-    r"\b(?:released|shipped|published|tagged|cut|bumped|landed|merged|deployed|rolled out"
-    r"|upgraded to|is out|went out|now on)\b", re.I)
-_NON_DURABLE = (
+# First-person progress narration: "I'll retry", "I'm going to guess again", "We shipped …".
+_NARRATION = re.compile(
+    r"\b(?:i['\u2019]ll|i will|we['\u2019]ll|let me"
+    r"|(?:i['\u2019]m|i am|we['\u2019]re|we are) (?:going|about) to)\b"
+    r"|^(?:i|we)(?: just| finally)? (?:shipped|released|merged|pushed|deployed|landed|tried|retried"
+    r"|restarted|bumped|tagged)\b", re.I)
+# One identifier on its own: a SHA, a version, a uuid, a #123 / repo#123.
+_ID_TOKEN = (r"(?:[0-9a-f]{7,40}|v?\d+\.\d+\.\d+(?:[-+][0-9a-z.]+)?"
+             r"|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|[a-z][\w.-]*#\d+|#\d+)")
+_BARE_ID = re.compile(r"^[\W_]*" + _ID_TOKEN + r"[\W_]*$", re.I)
+_ADVISORIES = (
+    (re.compile(r"\b(?=[0-9a-f]*\d)(?=[0-9a-f]*[a-f])[0-9a-f]{7,40}\b", re.I), "a commit SHA?"),
+    (re.compile(r"(?<![\w.])v?\d+\.\d+\.\d+(?![.\d])"), "a version?"),
     (re.compile(r"\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b", re.I),
-     "a run/session id (uuid)"),
-    # x.y.z, but not a dotted quad (127.0.0.1) or a longer dotted run.
-    # PR #12 / issue #12 / run 38093054271 / core#880 / a bare #880 — not "run 3 retries".
+     "a run/session id?"),
     (re.compile(r"\b(?:pr|pull request|issue|run|job)\s*(?:#\s*\d+|\d{5,})\b"
-                r"|\b[a-z][\w.-]*#\d+\b|(?<![\w&])#\d+\b", re.I), "a PR/issue/run id"),
-    # pid 48668 — not "PID 1 is init".
-    (re.compile(r"\bpids?\s*[:=#]?\s*\d{3,}\b", re.I), "a process id"),
+                r"|\b[a-z][\w.-]*#\d+\b|(?<![\w&])#\d+\b", re.I), "a PR/issue/run id?"),
+    (re.compile(r"\bpids?\s*[:=#]?\s*\d{3,}\b", re.I), "a process id?"),
     (re.compile(r"\b(?:today|yesterday|tonight|this (?:morning|afternoon|evening|week))\b", re.I),
-     "a date-relative word"),
-    # I'll / we'll / I'm going to — the apostrophe is required ("ill-formed", "works well").
-    (re.compile(r"\b(?:i['\u2019]ll|i will|we['\u2019]ll|let me"
-                r"|(?:i['\u2019]m|i am|we['\u2019]re|we are) (?:going|about) to)\b", re.I),
-     "first-person progress narration"),
+     "a date-relative word?"),
 )
 
 
-def _is_sha(token):
-    return any(c.isdigit() for c in token) and any(c.isalpha() for c in token)
-
-
 def durability_rejects(content):
-    """Why ``content`` is not a durable learning ([] = it may be stored).
-
-    Deterministic and offline: empty or too-short bodies, commit SHAs (long, or
-    in commit context), versions next to release status,
-    PR/issue/run ids, PIDs, "today"-style dates, and first-person narration
-    ("I'll retry", "going to guess again") are records of a moment; the repo,
-    CHANGELOG or tracker already holds those.
+    """Hard refusals ([] = it may be stored): an empty or under-40-char body, a
+    body that is only an id / SHA / version, or first-person progress narration.
     """
     text = (content or "").strip()
     if len(text) < MIN_CONTENT_CHARS:
         return [f"too short to state a rule, why it holds and when it applies "
                 f"(< {MIN_CONTENT_CHARS} chars)"]
-    reasons = []
-    shas = [m.group(0) for m in _HEX_RUN.finditer(text.lower()) if _is_sha(m.group(0))]
-    if any(len(h) >= 12 for h in shas) or (shas and _COMMIT_CONTEXT.search(text)):
-        reasons.append("a commit SHA")
-    if _VERSION.search(text) and _RELEASE_STATUS.search(text):
-        reasons.append("release status (a version that was shipped/released)")
-    reasons += [why for rx, why in _NON_DURABLE if rx.search(text)]
-    return reasons
+    if _BARE_ID.match(text):
+        return ["only an identifier (a SHA, version or id), not a learning"]
+    if _NARRATION.search(text):
+        return ["first-person progress narration (what was done or will be done)"]
+    return []
+
+
+def durability_warnings(content):
+    """Advisory only: ids, versions, SHAs, PIDs or dates that MAY mark a moment
+    rather than a rule. The store still succeeds; the agent re-checks the
+    three-month test and keeps the memory if it holds.
+    """
+    text = (content or "").strip()
+    return [why for rx, why in _ADVISORIES if rx.search(text)]
 
 
 def _capture_one(item):
@@ -274,7 +267,7 @@ def _capture_one(item):
     rejects = durability_rejects(content)
     if rejects:
         return None, ("not a durable learning (" + "; ".join(rejects) + "): state the rule, "
-                      "why it holds and when it applies, without ids, versions or progress")
+                      "why it holds and when it applies")
     kind = item.get("kind") or "fact"
     if kind not in KINDS:
         return None, f"unknown kind: {kind} (valid: {', '.join(KINDS)})"
@@ -300,7 +293,11 @@ def do_store(args):
     memory_id, err = _capture_one(args)
     if err:
         return _fail_open(err)
-    _emit({"ok": True, "memory_id": memory_id, "scope": args.get("scope") or _default_scope()})
+    out = {"ok": True, "memory_id": memory_id, "scope": args.get("scope") or _default_scope()}
+    warnings = durability_warnings(args.get("content"))
+    if warnings:
+        out["warnings"] = warnings
+    _emit(out)
     return 0
 
 
@@ -402,12 +399,17 @@ def do_capture_batch(args):
         if err:
             failures.append({"index": i, "reason": err})
         else:
-            stored.append({"index": i, "memory_id": memory_id})
+            entry = {"index": i, "memory_id": memory_id}
+            warnings = durability_warnings(item.get("content"))
+            if warnings:
+                entry["warnings"] = warnings
+            stored.append(entry)
     _emit({
         "ok": not failures or bool(stored),
         "stored": len(stored),
         "failed": len(failures),
         "ids": [s["memory_id"] for s in stored],
+        "warnings": [s for s in stored if s.get("warnings")],
         "failures": failures,
     })
     return 0

package/skills/mem/SKILL.md

@@ -87,9 +87,11 @@ A chat seat asked by wicked-crew to label the operator's decisions reads
    when it applies, in 1–3 self-contained sentences. Never store progress or
    status, release versions ("shipped 2.4.1"), commit SHAs, PR/run ids, PIDs,
    "today", or what the repo,
-   CHANGELOG or tracker already records. The backend refuses the mechanical
-   cases with `not a durable learning`; treat that as "don't store", not as
-   an error to work around.
+   CHANGELOG or tracker already records. That test is your judgment. The
+   backend refuses only a body under 40 characters, a bare id / SHA / version
+   and first-person narration (`not a durable learning`: don't store, don't
+   work around it); it stores bodies containing ids, versions or SHAs and
+   returns `warnings` naming them, so check those before you store.
    Provenance: memory is what we witnessed, were told, or decided. A claim
    read from code, docs or the web is knowledge: use `write`
    (`{"content","class":"concept","source"}`) or `ingest` instead; `store`

package/skills/mem-capture/SKILL.md

@@ -54,10 +54,14 @@ Reject, and do not rephrase into something that sneaks past:
 
 A version *constraint* ("needs SQLite >= 3.35.0 because …") and a fixed constant
 (a CRC polynomial, a colour) are durable; keep them.
-The backend refuses the mechanical cases (ids, release versions, commit SHAs, PIDs, "today",
-first-person narration, bodies under 40 characters) with
-`not a durable learning`. A refusal means the candidate failed the test:
-drop it, unless it holds a real rule you can state without the moment.
+The test above is YOUR judgment; the backend only backs it up. It refuses
+(`not a durable learning`) a body under 40 characters, a bare id / SHA /
+version, and first-person progress narration ("I'll retry", "We shipped …"):
+drop those. Ids, versions, SHAs, PIDs or dates inside a body are allowed (a
+version constraint or a fixed constant is a real rule); the backend stores
+the memory and returns `warnings` naming them. Check for them yourself
+before the write, since the warning arrives after it, and report any
+warning with the memory it was attached to.
 If nothing passes, store nothing and say so. An empty capture is a valid
 result, and the usual one.