@erclx/aitk 1.5.0 → 1.7.0

package/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "aitk",
   "description": "Automated governance, versioning, and discovery tools for Claude Code.",
-  "version": "1.5.0",
+  "version": "1.7.0",
   "author": {
     "name": "Eric Le",
     "url": "https://github.com/erclx"

package/claude/skills/claude-docs/REQUIREMENT.md

@@ -13,6 +13,8 @@ A decision's verification anchor has the same shape of gap in the other directio
 
 A handoff file has the same shape of gap as an unmarked outcome. A page a learning workspace produced and an operator already picked a destination for sits in gitignored scratch until something lands it, and the session that produced it is gone by the time a branch exists to carry the write. Left unfolded it reads as promoted while the destination holds nothing.
 
+The receipt half of that sweep was missing entirely. A review receipt is deleted per shipped branch and a memory-review receipt was skipped, because the exclusion protecting the checklist and audit prefixes caught a third by accident. Nothing but an operator asking collected it, and a collection that waits on someone remembering to ask is one a folder outgrows, so the skipped population grew per shipped branch and never shrank until it was most of the folder.
+
 The trigger side carries a gap of its own. "Sync the docs" names either corpus to the person saying it, so a description leaving its corpus to the opening clause alone competes with its public-facing sibling on nothing the routing field states, and the planning surface the request was about goes untouched.
 
 ## Must
@@ -26,6 +28,9 @@ The trigger side carries a gap of its own. "Sync the docs" names either corpus t
 - Retarget a closed task at the archived plan, so the reasoning behind finished work stays reachable
 - Anchor a decision entry this run writes or amends whose reasoning cites a measured number, re-reading the number against the tree before writing the marker
 - Report an anchored decision whose cited path the diff touched, since the number was read before the branch moved what it counted
+- Scan every memory-review receipt rather than the one matching this slug, since the skill that writes them runs after this one in the ship chain and a slug is unique per feature
+- Collect a memory-review receipt whose items are all decided, folding each skip into its memory entry first, since a declined item is recorded nowhere else and a promoted one is already in git
+- Leave a memory-review receipt holding a pending item, and report the count. A branch shipping is not an operator deciding what the receipt proposed.
 - Land each block of a promotion handoff at the destination its heading names, then delete the file so a later run does not fold it twice
 - Take a promotion destination as already decided, since the operator confirmed it where the page was produced
 

package/claude/skills/claude-docs/SKILL.md

@@ -215,7 +215,9 @@ Sweep reviews this session consumed, and sweep plans across the whole board. Res
 
 Every move and delete below is a shell operation, so send each as a plain single `Bash` command rather than joining a `mkdir -p` to the `mv` with `&&`, which is refused as compound from a linked worktree. The one edit inside an existing file is the `Plan:` retarget, and no verb covers it: read the task file and write it back whole with a heredoc, which the file-editing tools refuse from a linked worktree and no shell stream editor may do.
 
-**Plans.** Scan every file in `.claude/tasks/`, not only the ones this session touched. For each task file whose outcomes are now all `[x]`, check for a `Plan:` line directly under the title and parse the target.
+### Plans
+
+Scan every file in `.claude/tasks/`, not only the ones this session touched. For each task file whose outcomes are now all `[x]`, check for a `Plan:` line directly under the title and parse the target.
 
 The line carries a markdown link, so read the target out of the parentheses rather than taking the rest of the line. A task still carrying the older bare-path form parses the same way once the link is absent, so accept both. Resolve the target against `.claude/tasks/` before routing on it, which lands `../plans/x.md` and `.claude/plans/x.md` on the same file.
 
@@ -242,17 +244,30 @@ A plan can serve more than one task, and archiving on the first task to close st
 
 Write the retarget as a markdown link, `Plan: [feature-<slug>](../plans-archive/feature-<slug>.md)`, updating both halves so the text and the target stay in step. This branch is the only writer that produces a `Plan:` line nobody authored by hand, so a retarget that emits a bare path converts every task to the old form as it closes and drifts the board back to two shapes on its own.
 
-**Reviews.** Derive `<slug>` per `${CLAUDE_SKILL_DIR}/../../standards/slug.md`. Fall back to `latest` on an empty result.
+### Reviews
+
+Derive `<slug>` per `${CLAUDE_SKILL_DIR}/../../standards/slug.md`. Fall back to `latest` on an empty result.
+
+If `.claude/review/review-<slug>.md` exists, delete it. `claude-review` writes with this convention.
+
+Memory receipts sweep board-wide, like plans above and unlike the review receipt. Scan every `.claude/review/memory-review-*.md`, not only the one matching this slug. `claude-memory-review` writes its receipt after this skill has run in every ship chain, so a sweep keyed on the current slug looks for a file that does not exist yet, and no later branch looks for it either because a slug is unique per feature. Scanning the folder is what makes the sweep fire at all.
+
+For each receipt, count the H2 items still marked 📝 pending:
+
+- No pending item: fold it per the collection rule in `${CLAUDE_SKILL_DIR}/../../standards/memory.md`, then delete the receipt.
+- Any pending item: leave it and report the count. Pending items are decision state, and a branch shipping is not an operator deciding them.
 
-If `.claude/review/review-<slug>.md` exists, delete it. `claude-review` writes with this convention. Do not sweep any other `review-*.md` file.
+That standard owns what a fold writes and which entry types take one. `claude-memory-review` collects a receipt on the same rule, so neither body restates it.
 
-Do not sweep `ui-checklist-*.md` (pending human verification), `ux-audit-*.md`, or `ux-measure-*.md` (standalone deliverables).
+Do not sweep `ui-checklist-*.md` (pending human verification), `ux-audit-*.md`, or `ux-measure-*.md` (standalone deliverables), or any other `review-*.md` file.
 
 Output one line per file swept:
 
 - `📦 Archived: <path>` for a plan moved into `.claude/plans-archive/`
 - `⏭ Kept: <path>, still cited by <task-file>` for a plan another live task shares
 - `🧹 Deleted: <path>` for a swept review
+- `🧹 Deleted: <path>, folded <n> skips` for a swept memory receipt
+- `⏭ Kept: <path>, <n> items pending` for a memory receipt still holding decisions
 
 If nothing qualifies, skip this step silently.
 

package/claude/skills/claude-memory-review/REQUIREMENT.md

@@ -21,7 +21,10 @@ A pen the caller cannot face is the same gap wearing a different shape. Routing
 - Write the proposal to a receipt on disk and take no action until the user decides per item
 - Route every decision channel through the receipt, writing a decision given in chat into its item's slot before the parse reads the file, so a channel the skill advertises drains the pen rather than passing over it
 - Keep a promotion on its own commit, since a change to how the agent operates should not ride inside a feature a reviewer is vetting for something else
-- Confine the pass that runs after application to the one receipt it tested, so tidying up removes a file whose decisions are known to be resolved and leaves the pen and every untested receipt alone
+- Collect a receipt as soon as its last item resolves, rather than waiting for an operator to ask, since a collection nobody triggers is a folder that only grows
+- Fold each declined item into its memory entry before the receipt goes, because a promoted item survives in its target and in git while a decline is recorded nowhere else
+- Record that decline by rewriting the entry rather than appending to it, so the file states one current claim
+- Confine the pass that runs after application to the one receipt it tested, so tidying up removes a file whose decisions are known to be resolved and leaves every untested receipt alone
 
 ## Must not
 

package/claude/skills/claude-memory-review/SKILL.md

@@ -15,7 +15,7 @@ What an entry looks like and why a retired one is moved rather than deleted are
 | "challenge the promotes" (receipt exists)                              | Challenge | review file only             |
 | "discuss", "respond to questions"                                      | Discuss   | review file only             |
 | "apply decisions", "commit", "ship the review"                         | Apply     | tracked files + memory files |
-| "cleanup", "delete the receipt"                                        | Cleanup   | one review file              |
+| "cleanup", "delete the receipt"                                        | Cleanup   | one receipt + its skips      |
 
 If the user re-pings the skill with no new phrase and a receipt exists, default to Discuss when any `Decision:` contains `?`, otherwise Apply.
 
@@ -168,25 +168,34 @@ Apply promotion edits one at a time via `Edit`. Claude Code's tool permission di
 
 This governs the tracked surfaces a promote lands in, which sit at `pwd` and take `Edit` from anywhere. The receipt and the memory entries are main-root scratch and follow the guard instead.
 
-As each item resolves, update its status in the review file: flip the H2 emoji from 📝 to ✅ for applied, ⏭ for skipped, 📦 for retired, or 🤝 for handed off. Refresh the summary block counts at the top. Do not delete the review file. It stays as a receipt until Cleanup runs or the next Propose pass overwrites it.
+As each item resolves, update its status in the review file: flip the H2 emoji from 📝 to ✅ for applied, ⏭ for skipped, 📦 for retired, or 🤝 for handed off. Refresh the summary block counts at the top. Do not delete the file here. The sweep below decides whether it goes.
 
 **Chat shortcut:** the user replies with `all`, `none`, a comma-separated list of numbers, or `skip <nums>`. Write the matching verb into the `Decision:` slot of every item the reply names, `apply` for `all` or a bare list and `skip` for a `skip` reply, then run the parse above against the file. A reply of `none` writes nothing. A slot the reply does not name keeps its own value, so the receipt stays the source of truth and an empty slot still means take no action.
 
+### Sweep the receipt
+
+Count the items still 📝 pending once the parse above has run. Apply leaves one pending on `defer`, on empty, and on any unrecognized verb, so a receipt reaching this point may still be holding decisions.
+
+Leave the receipt in place when any remain. When none do, collect it per the collection rule in `${CLAUDE_SKILL_DIR}/../../standards/memory.md`, which owns what a fold writes and which entry types take one.
+
+`claude-docs` Step 10 sweeps the same folder on the same rule once per shipped branch, and either may reach a receipt first. Whichever does, the other finds no file and moves on.
+
 End with: `✅ Applied: <nums> | ⏭ Skipped: <nums> | 📝 Pending: <nums>`. Omit empty buckets. If anything is pending, remind the user they can refine `Decision:` lines and re-ping, run "discuss" for question items, or commit a skip with `skip <nums>` in chat.
 
 ## Cleanup phase
 
 Trigger: user says "cleanup" or "delete the receipt" after Apply has run.
 
-Cleanup removes one receipt and nothing else. Apply is the only phase that moves a memory entry out of the pen, and it does so per approved item into `.claude/.tmp/memory-archive/`. A user asking to sweep stale memories wants Propose, which classifies entries and writes a decision slot per entry.
+Cleanup folds one receipt's skips and removes that receipt, and does nothing else. It is the fallback route now that Apply and `claude-docs` Step 10 each collect a resolved receipt on their own, so it reaches a file those two left behind rather than being the only collector. Apply is still the only phase that moves a memory entry out of the pen, and it does so per approved item into `.claude/.tmp/memory-archive/`. A user asking to sweep stale memories wants Propose, which classifies entries and writes a decision slot per entry.
 
 If no `.claude/review/memory-review-*.md` exists at the main root, stop: `✅ No review receipt to clean up.` Every other refusal in this skill carries a message, and the phase reads a receipt before it does anything else.
 
 1. Read the latest `.claude/review/memory-review-*.md` at the main root and confirm Apply has run against it. If any item is still 📝 pending, stop and name the pending numbers.
-2. Delete that one file. Leave every other receipt beside it in place, because the pending test above covers the file it read and nothing has tested the rest.
-3. Leave every memory entry in place. A `Skip` decision is terminal, and applied promotions, governance handoffs, and user-type memories each stay as the review left them.
+2. Collect it per the collection rule in `${CLAUDE_SKILL_DIR}/../../standards/memory.md`, folding each ⏭ skipped item before the file goes. The fold happens wherever a receipt is collected, so this phase runs the same rule the Apply sweep does.
+3. Delete that one file. Leave every other receipt beside it in place, because the pending test above covers the file it read and nothing has tested the rest.
+4. Leave every memory entry in the pen. A skip records the decline on the entry and keeps the file, and applied promotions, governance handoffs, and user-type memories each stay as the review left them.
 
-Do not promote, rewrite, or archive a memory entry. Receipts only.
+Do not promote or archive a memory entry. The skip fold is the one rewrite this phase makes, and it records a decline on an entry that stays in the pen.
 
 ## After completion
 
@@ -195,6 +204,7 @@ Output one line per action taken in the most recent phase:
 - `✅ Promoted: .claude/memory/<memory-file> → <target>`
 - `✅ Handed off: .claude/memory/<memory-file> → governance`
 - `📦 Retired: .claude/memory/<memory-file> → .claude/.tmp/memory-archive/`
-- `🗑  Swept: .claude/review/<review-file>`
+- `🗑  Swept: .claude/review/<review-file>, folded <n> skips`
+- `⏭ Kept: .claude/review/<review-file>, <n> items pending`
 
 If the user accepted nothing, output: `✅ No changes applied.`

package/docs/agents/records.md

@@ -74,7 +74,7 @@ For the shapes each check enforces, see `.claude/standards/plan.md`, `.claude/st
 
 ## Size
 
-`aitk records size` reports what each record folder holds and how much of it is recent. It reads the nine backed folders named under Push and pull, plus `.claude/.tmp`, and it gates nothing.
+`aitk records size` reports what each record folder holds and how much of it is recent. It reads the ten backed folders named under Push and pull, plus `.claude/.tmp`, and it gates nothing.
 
 ```bash
 aitk records size
@@ -110,9 +110,9 @@ aitk records push --json
 aitk records pull
 ```
 
-The backed folders are `groundwork`, `intake`, `memory`, `plans`, `plans-archive`, `review`, `task-archive`, `tasks`, and `teach`, all under `.claude/`. They are the gitignored Claude group minus `.claude/.tmp`, which is deletable without loss, and `.claude/worktrees/`, whose contents belong to the project repository already. The list is a constant rather than configuration, matching the four folder names `validate` hardcodes.
+The backed folders are `groundwork`, `intake`, `memory`, `plans`, `plans-archive`, `review`, `review-archive`, `task-archive`, `tasks`, and `teach`, all under `.claude/`. They are the gitignored Claude group minus `.claude/.tmp`, which is deletable without loss, and `.claude/worktrees/`, whose contents belong to the project repository already. The list is a constant rather than configuration, matching the four folder names `validate` hardcodes.
 
-Records are gitignored by design, so the history lives in a second git directory at `.claude/.records.git` with `.claude/` as its work tree. Every path stays where it is, which is what a separate checkout could not do. The verbs stage the nine folders by explicit pathspec with `--force`, so nothing outside them can enter the index however the ignore rules read, and the project working tree and its index are never touched.
+Records are gitignored by design, so the history lives in a second git directory at `.claude/.records.git` with `.claude/` as its work tree. Every path stays where it is, which is what a separate checkout could not do. The verbs stage the ten folders by explicit pathspec with `--force`, so nothing outside them can enter the index however the ignore rules read, and the project working tree and its index are never touched.
 
 ### Setup
 
@@ -141,7 +141,7 @@ Point it at a private repository, and at one that is not a remote of the project
 | `local-ahead`       | `pull` found local commits that never reached the origin                             |
 | `git-failed`        | A git call failed, with its stderr in the message                                    |
 
-The two `pull` refusals exist because the directions are not symmetric. A push only adds, while a pull onto a machine holding work that never left it would discard that work. Resolve either by running `push` first, or by moving the local folders aside. A machine holding none of the nine has nothing to lose, so a restore onto a fresh checkout runs straight through.
+The two `pull` refusals exist because the directions are not symmetric. A push only adds, while a pull onto a machine holding work that never left it would discard that work. Resolve either by running `push` first, or by moving the local folders aside. A machine holding none of the ten has nothing to lose, so a restore onto a fresh checkout runs straight through.
 
 ### When it runs
 

package/docs/ai-workflow.md

@@ -93,7 +93,7 @@ An execution that picks other than the suggestion rewrites the `- Suggested:` li
 
 `aitk records validate plans` reports where a plan and that standard disagree: a filename that is not `feature-<slug>.md`, a missing required section, a files-to-touch entry naming no file, and a question carrying a suggestion with no answer slot. The same verb takes `groundwork`, `intake`, `memory`, and `teach`, which are governed the same way and were unreachable for the same reason. Nothing fires it automatically, because all five folders are gitignored and every check the repository runs reads changed files from git. It reports and never writes, since the folders are per-machine scratch with no history to recover a wrong repair from.
 
-`aitk records push` carries these folders off the disk they live on, and `aitk records pull` brings them back. Nine of them are backed: `groundwork`, `intake`, `memory`, `plans`, `plans-archive`, `review`, `task-archive`, `tasks`, and `teach`. The history lives in a second git directory at `.claude/.records.git` with `.claude/` as its work tree, so every path a task file cites stays where it is.
+`aitk records push` carries these folders off the disk they live on, and `aitk records pull` brings them back. Ten of them are backed: `groundwork`, `intake`, `memory`, `plans`, `plans-archive`, `review`, `review-archive`, `task-archive`, `tasks`, and `teach`. The history lives in a second git directory at `.claude/.records.git` with `.claude/` as its work tree, so every path a task file cites stays where it is.
 
 A person points it at a private repository once and both verbs refuse until they have, and `push` refuses when that origin is also a remote of the project, since the payload is the memory pen and the groundwork trails. `.husky/post-merge` runs the push after its archive loop, on every merge rather than only on one that closed a task. See [records](agents/records.md) for the refusal table.
 
@@ -150,6 +150,8 @@ If capture wrote at least one memory file, `claude-memory-review` then proposes
 
 Run `claude-memory-review` standalone to curate the whole pen. An entry it retires moves to `.claude/.tmp/memory-archive/` rather than being deleted, since the folder is gitignored and a bulk pass has no undo.
 
+The receipt is collected once every item on it has been decided, and it survives untouched while any item is still pending. Whichever runs first takes it: Apply collects the receipt it has resolved, and `claude-docs` scans the folder on every shipped branch for one an earlier session left behind. Before the file goes, each declined item is folded into the entry it was about, since a promotion survives in its target and in git while a decline is recorded nowhere else. `aitk standards memory` states what a fold writes and which entry types take one.
+
 ### UI polish
 
 Verify the change manually in the browser. Invoke `aitk:claude-ui-test` if you need e2e tests and a visual verification checklist for the session. For the fix itself, describe the change in Claude Code directly.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/aitk",
   "type": "module",
-  "version": "1.5.0",
+  "version": "1.7.0",
   "description": "Infrastructure and quality tooling for developer workflows",
   "license": "MIT",
   "bin": {

package/scripts/core/check-color-source.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -e
+set -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="${PROJECT_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+
+SCRIPTS_ROOT="$PROJECT_ROOT/scripts"
+PALETTE_SOURCE="$SCRIPTS_ROOT/lib/ui.sh"
+
+# `find` writes to stderr and returns non-zero for a missing root, inside a
+# process substitution whose status nothing reads. Without this the walk covers
+# nothing and the check reports the tree clean having never measured it.
+if [ ! -f "$PALETTE_SOURCE" ]; then
+  echo "No palette source at ${PALETTE_SOURCE#"$PROJECT_ROOT/"}, color sourcing unverifiable." >&2
+  exit 1
+fi
+
+# Any SGR sequence in either spelling. The cursor and erase sequences an
+# interactive prompt writes end in a letter instead, and they run only where a
+# terminal already exists, so they are not what this measures.
+SGR='\\(033|e|x1b)\[[0-9;]*m'
+
+# Sixteen copies of one decision is what made color impossible to turn off on
+# the TypeScript side. A rule nothing enforces rebuilds them the next time a
+# script wants grey, so the escape lives in the shared library and every other
+# script reads the palette that library derives for its stream.
+offenders=""
+while IFS= read -r file; do
+  [ "$file" = "$PALETTE_SOURCE" ] && continue
+  if grep -qE "$SGR" "$file"; then
+    offenders="$offenders  ${file#"$PROJECT_ROOT/"}"$'\n'
+  fi
+done < <(find "$SCRIPTS_ROOT" -type f -name '*.sh')
+
+if [ -n "$offenders" ]; then
+  echo "A color escape is defined outside the shared library:" >&2
+  printf '%s' "$offenders" >&2
+  echo "Source scripts/lib/ui.sh and read its palette, so one answer covers every writer." >&2
+  exit 1
+fi

package/scripts/core/snapshot.sh

@@ -2,19 +2,13 @@
 set -e
 set -o pipefail
 
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-WHITE='\033[1;37m'
-GREY='\033[0;90m'
-NC='\033[0m'
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="${PROJECT_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
 
-NESTED="${VERIFY_NESTED:-false}"
+# shellcheck source=/dev/null
+source "$PROJECT_ROOT/scripts/lib/ui.sh"
 
-log_info() { echo -e "${GREY}│${NC} ${GREEN}✓${NC} $1"; }
-log_error() {
-  echo -e "${GREY}│${NC} ${RED}✗${NC} $1"
-  exit 1
-}
+NESTED="${VERIFY_NESTED:-false}"
 
 OUTPUT_FILE=".claude/.tmp/project/PROJECT-SNAPSHOT.md"
 
@@ -117,15 +111,23 @@ write_snapshot() {
 main() {
   check_dependencies
 
-  if [ "$NESTED" = false ]; then echo -e "${GREY}┌${NC}"; fi
+  if [ "$NESTED" = false ]; then open_timeline; fi
 
-  echo -e "${GREY}├${NC} ${WHITE}Snapshot${NC}"
+  log_step "Snapshot"
   write_snapshot
   log_info "Written to $OUTPUT_FILE"
 
+  # The whole frame goes to stderr, since the run writes its document to a file
+  # and leaves stdout carrying nothing. Edges on stdout with the body on stderr
+  # would capture as a frame with no body inside it.
   if [ "$NESTED" = false ]; then
-    echo -e "${GREY}└${NC}\n"
-    echo -e "${GREEN}✓ Snapshot complete${NC}"
+    close_timeline
+    # All six are declared to scope what `set_palette` assigns, so the four this
+    # line never spells stay out of the globals a sourcing script reads.
+    # shellcheck disable=SC2034
+    local GREEN RED YELLOW WHITE GREY NC
+    set_palette 2
+    echo -e "\n${GREEN}✓ Snapshot complete${NC}" >&2
   fi
 }
 

package/scripts/core/verify.sh

@@ -595,6 +595,7 @@ main() {
   log_step "Shell"
   if has_changed '\.sh$|^package\.json$'; then
     run_check "bun run check:shell" "Shell check failed"
+    run_check "bash $PROJECT_ROOT/scripts/core/check-color-source.sh" "A color escape is defined outside scripts/lib/ui.sh."
     log_info "Shell check passed"
   else
     log_info "Skipped, no shell changes"

package/scripts/lib/ui.sh

@@ -12,26 +12,85 @@ fi
 # shellcheck source=/dev/null
 source "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/sandbox-path.sh"
 
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-YELLOW='\033[0;33m'
-WHITE='\033[1;37m'
-GREY='\033[0;90m'
-NC='\033[0m'
-
-log_info() { echo -e "${GREY}│${NC} ${GREEN}✓${NC} $1" >&2; }
-log_warn() { echo -e "${GREY}│${NC} ${YELLOW}!${NC} $1" >&2; }
+# `NO_COLOR` follows the published convention, where any non-empty value turns
+# color off whatever the value says.
+supports_color() {
+  [ -z "${NO_COLOR:-}" ] && [ -t "$1" ]
+}
+
+# Assigns the six palette names for one file descriptor. The blank palette keeps
+# every frame character and drops only the escapes, so a captured run still
+# reads as one block.
+#
+# Bash returns a string and nothing richer, so the palette arrives through the
+# caller's own scope. A writer declaring all six `local` before calling this
+# keeps the assignment to itself, which is what leaves the source-time answer
+# below standing for anything that sources this file.
+set_palette() {
+  if supports_color "$1"; then
+    GREEN='\033[0;32m'
+    RED='\033[0;31m'
+    YELLOW='\033[0;33m'
+    WHITE='\033[1;37m'
+    GREY='\033[0;90m'
+    NC='\033[0m'
+  else
+    GREEN=''
+    RED=''
+    YELLOW=''
+    WHITE=''
+    GREY=''
+    NC=''
+  fi
+}
+
+# Every writer below frames to stderr and asks about that stream at write time,
+# so no answer is frozen before a caller's redirect is in place. This one answers
+# for stdout instead, because it is read by a sourcing script writing its own
+# frame with a bare `echo`, and that is the stream a bare `echo` reaches.
+set_palette 1
+
+log_info() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+  echo -e "${GREY}│${NC} ${GREEN}✓${NC} $1" >&2
+}
+log_warn() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+  echo -e "${GREY}│${NC} ${YELLOW}!${NC} $1" >&2
+}
 log_error() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
   echo -e "${GREY}│${NC} ${RED}✗${NC} $1" >&2
   exit 1
 }
-log_step() { echo -e "${GREY}│${NC}\n${GREY}├${NC} ${WHITE}$1${NC}" >&2; }
-log_add() { echo -e "${GREY}│${NC} ${GREEN}+${NC} $1" >&2; }
-log_rem() { echo -e "${GREY}│${NC} ${RED}-${NC} $1" >&2; }
+log_step() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+  echo -e "${GREY}│${NC}\n${GREY}├${NC} ${WHITE}$1${NC}" >&2
+}
+log_add() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+  echo -e "${GREY}│${NC} ${GREEN}+${NC} $1" >&2
+}
+log_rem() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+  echo -e "${GREY}│${NC} ${RED}-${NC} $1" >&2
+}
 
-pipe_output() { while IFS= read -r line; do echo -e "${GREY}│${NC}  $line" >&2; done; }
+pipe_output() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+  while IFS= read -r line; do echo -e "${GREY}│${NC}  $line" >&2; done
+}
 
 open_timeline() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
   echo -e "${GREY}┌${NC}" >&2
   if [ -n "${1:-}" ]; then
     echo -e "${GREY}│${NC} ${WHITE}$1${NC}" >&2
@@ -39,6 +98,8 @@ open_timeline() {
 }
 
 close_timeline() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
   echo -e "${GREY}└${NC}" >&2
 }
 
@@ -52,6 +113,8 @@ guard_root() {
 }
 
 require_project_root() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
   local sandbox
   sandbox="$(resolve_sandbox_dir)"
   if [[ "$PWD" == "$sandbox" || "$PWD" == "$sandbox"/* ]]; then
@@ -65,6 +128,8 @@ require_project_root() {
 }
 
 ask() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
   local prompt_text=$1
   local var_name=$2
   local default_val=$3
@@ -107,6 +172,8 @@ ask() {
 }
 
 select_or_route_scenario() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
   local prompt_text=$1
   shift
   local options=("$@")
@@ -122,6 +189,8 @@ select_or_route_scenario() {
 }
 
 select_option() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
   local prompt_text=$1
   shift
   local options=("$@")

package/scripts/manage-sandbox.sh

@@ -320,6 +320,8 @@ execute_sandbox_and_commit() {
 }
 
 finalize_sandbox_run() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
   trap - EXIT
   close_timeline
   echo "" >&2
@@ -327,6 +329,8 @@ finalize_sandbox_run() {
 }
 
 cmd_clean() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
   log_step "Removing sandbox"
   rm -rf "$SANDBOX"
   log_rem "$SANDBOX"
@@ -337,6 +341,8 @@ cmd_clean() {
 }
 
 reset_sandbox() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
   if [ ! -d "$SANDBOX/.git" ]; then
     log_error "No sandbox found. Run \`aitk sandbox\` first."
   fi

package/scripts/tooling/ref.sh

@@ -91,6 +91,12 @@ main() {
   local stack="$1"
   local target="${2:-.}"
 
+  # Every frame below goes to stderr, so it asks about that stream rather than
+  # reading the source-time answer, which is for stdout and is what `show_help`
+  # above wants. Declared after the help branch so that call keeps it.
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+
   echo -e "${GREY}┌${NC}" >&2
   echo -e "${GREY}│${NC} ${WHITE}aitk tooling ref${NC}" >&2
 

package/src/records/backup.ts

@@ -22,6 +22,7 @@ export const BACKED_FOLDERS = [
   'plans',
   'plans-archive',
   'review',
+  'review-archive',
   'task-archive',
   'tasks',
   'teach',

package/standards/memory.md

@@ -103,6 +103,19 @@ Link a related entry as `[[name]]`, where `name` is the target's filename stem w
 
 The catalog is generated from sibling frontmatter rather than authored. Never hand-edit it, since the next regeneration discards whatever was added by hand.
 
+## Collecting a review receipt
+
+A review of the pen writes a receipt recording what it proposed per entry and what was decided. The receipt is collected once every item on it has resolved, and it is held while any item is still pending, since a pending item is decision state the next round reads back.
+
+Fold the declines before the receipt goes. A promoted entry survives in its target and in git and a retired one survives in the archive, so the one thing a receipt uniquely holds is the record that a rule was considered and turned down.
+
+- Fold into the entry the item was about, and only into that entry. A decline whose proposed target was another surface still lands here.
+- Fold a `feedback` or `project` entry alone. The decline belongs in the `**Why:**` line, which is what a later reader tests the rule against.
+- Fold nothing into a `user` or `reference` entry. Its body is one sentence carrying neither marker, and such an entry is declined for having no in-repo target, which its type already states. Writing that on the entry restates the type and breaks the body shape.
+- Record the decline by rewriting the entry, never by appending to it, per the lifecycle rule above.
+
+Which surface runs the collection is project policy. More than one may, so a collector finding no receipt has been beaten to it rather than misconfigured.
+
 ## Anti-patterns
 
 - **The domain fact filed as memory.** It reads as a capture and lands in the one folder no session opens while working that domain.

package/tooling/claude/manifest.toml

@@ -8,4 +8,4 @@ runtime = ""
 scaffold = ""
 
 [gitignore]
-"# Claude" = [".claude/.tmp/", ".claude/groundwork/", ".claude/intake/", ".claude/memory/", ".claude/plans/", ".claude/plans-archive/", ".claude/review/", ".claude/task-archive/", ".claude/worktrees/", ".claude/tasks/"]
+"# Claude" = [".claude/.tmp/", ".claude/groundwork/", ".claude/intake/", ".claude/memory/", ".claude/plans/", ".claude/plans-archive/", ".claude/review/", ".claude/review-archive/", ".claude/task-archive/", ".claude/worktrees/", ".claude/tasks/"]

package/tooling/claude/reference.md

@@ -19,6 +19,7 @@ The claude stack installs the `.claude/` workflow directory into a project. Stat
 ├── settings.json      ← seeded. Project-level Claude Code config (PreToolUse and PostToolUse hooks). User-level config installed separately via `aitk claude setup`.
 ├── plans/             ← execution detail for multi-step tasks, gitignored. `feature-*.md` entries swept by claude-docs.
 ├── review/            ← scratch for claude-review and claude-ui-test output, gitignored
+├── review-archive/    ← memory-review receipts a triage took out of review/, gitignored
 ├── .tmp/              ← ephemeral scratch space, gitignored
 └── memory/            ← session facts no context entry owns, gitignored. `index.md` regenerated by a hook.
 ```
@@ -49,7 +50,7 @@ A project installed before the diagram surface became a folder still holds `.cla
 
 ## Gitignore
 
-- `# Claude`: `.claude/.tmp/`, `.claude/groundwork/`, `.claude/intake/`, `.claude/memory/`, `.claude/plans/`, `.claude/plans-archive/`, `.claude/review/`, `.claude/task-archive/`, `.claude/worktrees/`, `.claude/tasks/`
+- `# Claude`: `.claude/.tmp/`, `.claude/groundwork/`, `.claude/intake/`, `.claude/memory/`, `.claude/plans/`, `.claude/plans-archive/`, `.claude/review/`, `.claude/review-archive/`, `.claude/task-archive/`, `.claude/worktrees/`, `.claude/tasks/`
 
 ## CLI