v4.9.0 — cross-OS registry, learner false positives, verified scrubbing

The first release built mostly from other people's work.

Contributors

@Sergio-LPA — cross-OS project de-dup (#22)

If you use Sinapsis from more than one machine and sync your registry, a project with no git remote showed up twice — once per OS, because the id is derived from the root path and /Users/me/Proj is not C:/Users/Me/Proj. That double entry then split your /projects, your /eod and your cross-project instinct search.

Sergio collapses the two sightings into one entry, keyed on the git remote when there is one and on the project name when there is not. The name fallback is guarded so it only fires across OS families and only when the entry has no root of your family recorded — two same-named projects on the same machine stay apart. A migration pass heals registries that already contain the duplicates. _eod-gather and /projects follow aliases through to the merged project.

He dogfooded it for two months across Mac and PC before opening the PR, then took two rounds of review with weeks in between and closed both of them completely.

@juanparisma — learner false positives (#29)

The observer set is_error whenever output contained the substring error or failed — including the content of files it had read successfully. Reading source code with throw new Error in it counted as a tool failure. One real session produced 190 proposals, 189 of them junk.

Detection is now structural, and hard markers only apply to execution output, where a marker is a verdict rather than arbitrary content. user_correction stops counting files that are re-edited by design (journals, daily summaries). workflow_chain needs 5+ repetitions with two distinct tools instead of proposing every Bash>Bash>Bash.

Measured over a real 8,000-observation window: 1,074 flagged observations down to 22.

Fixed on top

• Non-Bash failures were flagged by nobody. Restricting markers to Bash was right for false positives but left genuine Edit/Read failures — String to replace not found, File does not exist — invisible. Detection keys on shape: a failure returns a bare verdict string, a success returns a payload starting with { or [, and payloads are never scanned. Zero false positives over 7,931 real non-Bash observations.
• The learner threw away its own diagnostics. The node block ended in 2>/dev/null, which swallowed lock-contention and failed-upsert messages and overrode the SINAPSIS_DEBUG redirect — so the debug switch produced nothing at all for the 95% of the script inside that block. Diagnostics now append to _session-learner.log. Sergio found this independently while working on #22.
• The cross-OS suite could not run under Git Bash. The Git Bash fix was itself what broke it: MSYS_NO_PATHCONV=1 is needed suite-wide, but with conversion off, node — a native Windows binary — resolved mktemp's /tmp/... to a path that does not exist. 0 of 10 tests actually ran on Windows while reporting green elsewhere.

Verified for the first time

Secret scrubbing had never been tested. Test Group 4 imported a script that cannot be imported, then looked for a function that does not exist. Every assertion returned LOAD_FAIL and printed as SKIP — so "11/11 passed" covered nothing at all. It now drives the hook through the front door and asserts what reached disk, across five secret formats, with a control proving the scrubber is not simply destroying all output.

Known limits, documented rather than hidden

• osFamily() puts macOS and Linux both in posix, so a mac↔linux pair is not de-duplicated. Tracked separately.
• The name key cannot tell two unrelated projects that share a folder name apart when they are seen from different OS families — with no remote there is nothing left to distinguish them. Guarding it would break the legitimate case. So every name-based fusion now stamps name_merged on the entry and records the root pair in name_merge_log: a wrong fusion is an auditable event you can undo by hand, not silent drift.

Tests

217 across 16 files, green on ubuntu, macos and windows.

Upgrade: re-run install.sh (or install.bat). Existing registries are migrated on the next Stop event.