create-claude-cabinet 0.46.0 → 0.47.0

package/README.md

@@ -129,13 +129,9 @@ you already use GitHub Issues, Linear, or something else.
 Claude Code has built-in file memory, but no guardrails around it.
 The memory module adds structure:
 
-- **`/cc-remember`** — write a new memory with automatic indexing.
-  Every memory gets its own file and an entry in `MEMORY.md` so
-  `/orient` can find it next session.
+- **`/cc-remember`** — write a new memory with automatic indexing. Every memory gets its own file and is made reachable from `MEMORY.md` — by a direct entry or a region pointer — so `/orient` can find it next session.
 - **`/memory`** — browse and search what Claude remembers.
-- **Validation** — `validate-memory.mjs` checks that the index stays
-  within Claude Code's session-start budget and that every file is
-  indexed. A PostToolUse hook flags unindexed writes in real time.
+- **Validation** — `validate-memory.mjs` checks that the index stays within Claude Code's session-start budget and that every memory file is reachable from `MEMORY.md`. A PostToolUse hook flags unreachable writes in real time.
 
 ### Compliance Stack (full install)
 

package/lib/cli.js

@@ -3,10 +3,10 @@ const path = require('path');
 const fs = require('fs');
 const os = require('os');
 const crypto = require('crypto');
-const { copyTemplates, recordSkip } = require('./copy');
+const { copyTemplates, recordSkip, isProjectOwnedSeed, freezeRetain } = require('./copy');
 const { mergeSettings, healUserSettings, mergeWatchtowerHooks, mergeMuxHooks, mergeBashCompressHooks } = require('./settings-merge');
-const { create: createMetadata, read: readMetadata } = require('./metadata');
-const { setupDb } = require('./db-setup');
+const { create: createMetadata, read: readMetadata, readFrozenModules, setFrozenModules } = require('./metadata');
+const { setupDb, shouldSkipInit, readBundledSchemaVersion } = require('./db-setup');
 const { setupVerifyRuntime } = require('./verify-setup');
 const { setupSiteAuditRuntime } = require('./site-audit-setup');
 const { setupEngagement } = require('./engagement-setup');
@@ -468,6 +468,20 @@ const MODULES = {
       'skills/debrief/phases/record-lessons.md',
       'skills/debrief/phases/upstream-feedback.md',
       'skills/debrief/phases/qa-handoff-sweep.md',
+      // Reversibility scaffolding (act:6fa60c7d) — standalone classic copies
+      // of orient/debrief, kept invokable so the orient/debrief retirement is
+      // reversible during the watchtower transition. They do NOT delegate to
+      // the live orient/debrief (which will change at retirement); they ARE
+      // the old skills under a new name. orient-classic ships SKILL.md only
+      // (its phases use skeleton defaults, like live orient); debrief-classic
+      // ships its SKILL.md + the same instruction phases as live debrief.
+      'skills/orient-classic',
+      'skills/debrief-classic',
+      'skills/debrief-classic/phases/audit-pattern-capture.md',
+      'skills/debrief-classic/phases/methodology-capture.md',
+      'skills/debrief-classic/phases/record-lessons.md',
+      'skills/debrief-classic/phases/upstream-feedback.md',
+      'skills/debrief-classic/phases/qa-handoff-sweep.md',
       'skills/menu',
     ],
   },
@@ -485,7 +499,7 @@ const MODULES = {
     mandatory: false,
     default: true,
     lean: false,
-    templates: ['scripts/pib-db.mjs', 'scripts/pib-db-lib.mjs', 'scripts/pib-db-mcp-server.mjs', 'scripts/pib-db-schema.sql', 'scripts/work-tracker-server.mjs', 'scripts/work-tracker-ui.html', 'skills/work-tracker', 'skills/spring-clean'],
+    templates: ['scripts/pib-db.mjs', 'scripts/pib-db-path.mjs', 'scripts/pib-db-lib.mjs', 'scripts/pib-db-mcp-server.mjs', 'scripts/pib-db-schema.sql', 'scripts/work-tracker-server.mjs', 'scripts/work-tracker-ui.html', 'skills/work-tracker', 'skills/spring-clean'],
     needsDb: true,
   },
   'planning': {
@@ -494,7 +508,7 @@ const MODULES = {
     mandatory: false,
     default: true,
     lean: true,
-    templates: ['skills/plan', 'skills/execute', 'skills/execute/phases/post-impl-checklist.md', 'skills/debrief/phases/checklist-feedback.md', 'skills/checklist-discover', 'skills/generate-plan-groups', 'skills/execute-group', 'workflows/execute-group-implement.js', 'workflows/execute-group-complete.js', 'skills/investigate', 'cabinet/checkpoint-protocol.md', 'cabinet/elicitation-methods.md', 'cabinet/qa-dimensions-template.yaml', 'cabinet/checklist-stats-schema.md', 'scripts/qa-dimensions-validator.cjs', 'skills/orient/phases/checklist-status.md', 'skills/audit/phases/checklist-pruning.md'],
+    templates: ['skills/plan', 'skills/execute', 'skills/execute/phases/post-impl-checklist.md', 'skills/debrief/phases/checklist-feedback.md', 'skills/checklist-discover', 'skills/generate-plan-groups', 'skills/execute-group', 'workflows/execute-group-implement.js', 'workflows/execute-group-complete.js', 'skills/investigate', 'cabinet/checkpoint-protocol.md', 'cabinet/worktree-invocation-contract.md', 'cabinet/elicitation-methods.md', 'cabinet/qa-dimensions-template.yaml', 'cabinet/checklist-stats-schema.md', 'scripts/qa-dimensions-validator.cjs', 'skills/orient/phases/checklist-status.md', 'skills/audit/phases/checklist-pruning.md'],
   },
   'compliance': {
     name: 'Compliance Stack (rules + enforcement)',
@@ -502,7 +516,7 @@ const MODULES = {
     mandatory: false,
     default: true,
     lean: false,
-    templates: ['rules/enforcement-pipeline.md', 'rules/maintainability.md', 'rules/markdown-prose.md', 'skills/unwrap', 'memory/patterns/_pattern-template.md', 'memory/patterns/pattern-intelligence-first.md'],
+    templates: ['rules/enforcement-pipeline.md', 'rules/maintainability.md', 'rules/markdown-prose.md', 'rules/verify-before-asserting.md', 'rules/plan-before-bulk-or-irreversible-actions.md', 'rules/acknowledge-when-corrected.md', 'skills/unwrap', 'memory/patterns/_pattern-template.md', 'memory/patterns/pattern-intelligence-first.md'],
   },
   'memory': {
     name: 'Built-In Memory (cc-remember + reader + validator)',
@@ -518,6 +532,7 @@ const MODULES = {
       'skills/cc-remember',
       'skills/memory',
       'rules/memory-capture.md',
+      'cabinet/memory-lifecycle-contract.md',
       'scripts/write-memory-file.mjs',
       'scripts/validate-memory.mjs',
       // project-context.cjs ships as a co-located sibling: the two .mjs
@@ -555,6 +570,7 @@ const MODULES = {
       'skills/cabinet-narrative-architect', 'skills/cabinet-interactive-storyteller',
       'skills/cabinet-elegance',
       'scripts/merge-findings.js', 'scripts/load-triage-history.js',
+      'scripts/pib-db-path.mjs', // load-triage-history.js imports it (declared cross-module dep; also shipped by work-tracking)
       'scripts/triage-server.mjs', 'scripts/triage-ui.html',
       'scripts/finding-schema.json', 'scripts/resolve-committees.cjs',
       'scripts/review-server.mjs', 'scripts/review-ui.html',
@@ -634,11 +650,17 @@ const MODULES = {
       'scripts/watchtower-lib.mjs',
       'scripts/watchtower-queue.mjs',
       'scripts/watchtower-routines.mjs',
+      'scripts/watchtower-hook-runner.mjs',
+      'scripts/watchtower-phase-shim.mjs',
+      'scripts/watchtower-sync.mjs',
       'scripts/watchtower-advisories.mjs',
       'cabinet/advisories-state-schema.md',
       'skills/inbox',
       'hooks/watchtower-session-start.sh',
       'scripts/watchtower-build-context.mjs',
+      'scripts/watchtower-snapshot.mjs',
+      'scripts/watchtower-narrative-corpus.mjs',
+      'scripts/watchtower-cross-ring-reader.mjs',
       'scripts/watchtower-ring1.mjs',
       'scripts/watchtower-ring1-runner.sh',
       'skills/watchtower',
@@ -655,11 +677,15 @@ const MODULES = {
       'watchtower/watchtower-ring2-slow.timer',
       'hooks/watchtower-session-end.sh',
       'scripts/watchtower-ring3-close.mjs',
+      'scripts/watchtower-ring4.mjs',
+      'scripts/watchtower-ring4-runner.sh',
       'scripts/watchtower-status.sh',
       'skills/briefing',
       'skills/threads',
+      'skills/catch-up',
       'skills/qa-handoff',
       'skills/qa-drain',
+      'skills/close',
     ],
   },
   mux: {
@@ -708,6 +734,94 @@ function walkDir(dir, base) {
   return results;
 }
 
+// Map a module template path to its install-time manifest key (the path
+// relative to the project root). Top-level so both the install copy loop and
+// computeRemovals derive the key the same way — single source of truth.
+function manifestPath(tmpl) {
+  if (tmpl.startsWith('scripts/')) return tmpl;
+  return '.claude/' + tmpl;
+}
+
+/**
+ * Expand a declared frozen-module list by its `requires` closure (act:c1013967).
+ * Freezing a module must also pin the modules it depends on, or a frozen
+ * caller can be left bound to a refreshed callee contract (the cross-runtime
+ * version-skew failure: green in the dev tree, broken on a fresh install).
+ * E.g. freezing `engagement` (requires work-tracking) also pins work-tracking.
+ * Returns a Set of module keys. Unknown keys are ignored (validated elsewhere).
+ */
+function expandFrozenClosure(frozenKeys, modules = MODULES) {
+  const closure = new Set();
+  const queue = [...(frozenKeys || [])];
+  while (queue.length) {
+    const key = queue.shift();
+    if (closure.has(key)) continue;
+    closure.add(key);
+    const mod = modules[key];
+    for (const req of (mod && mod.requires) || []) {
+      if (!closure.has(req)) queue.push(req);
+    }
+  }
+  return closure;
+}
+
+/**
+ * Classify which manifest entries should be removed because they are no longer
+ * shipped upstream — the pure core of the cleanup/reconcile loop, extracted so
+ * it is unit-testable in isolation (the inline loop never was). Returns
+ * `{ toRemove, kept }`: `toRemove` is the list of project-relative paths whose
+ * files exist on disk and are safe to delete; `kept` carries `{path, reason}`
+ * for files deliberately spared, which the caller logs.
+ *
+ * The four safeguards from the original loop are preserved exactly: S1 only
+ * delete known-template paths; S2 only from selected modules; project-owned
+ * seeds and non-CC project skills are never deleted. A FROZEN file needs no
+ * special case here — it was RETAINED in `allManifest` (at its on-disk hash),
+ * so it never reaches the `!allManifest[oldPath]` test; a frozen file removed
+ * upstream is kept by S1 ("non-template").
+ */
+function computeRemovals({ existingManifest, allManifest, selectedModules, templateRoot, projectDir, modules = MODULES }) {
+  const collectPaths = (modKeys) => {
+    const set = new Set();
+    for (const modKey of modKeys) {
+      const mod = modules[modKey];
+      for (const tmpl of (mod && mod.templates) || []) {
+        const srcPath = path.join(templateRoot, tmpl);
+        if (fs.existsSync(srcPath) && fs.statSync(srcPath).isDirectory()) {
+          for (const rel of walkDir(srcPath)) set.add(manifestPath(tmpl) + '/' + rel);
+        } else if (fs.existsSync(srcPath)) {
+          set.add(manifestPath(tmpl));
+        }
+      }
+    }
+    return set;
+  };
+
+  const allTemplatePaths = collectPaths(Object.keys(modules));
+  const selectedTemplatePaths = collectPaths(selectedModules);
+
+  const ccSkillNames = new Set();
+  for (const mod of Object.values(modules)) {
+    for (const tmpl of mod.templates || []) {
+      if (tmpl.startsWith('skills/')) ccSkillNames.add(tmpl.split('/')[1]);
+    }
+  }
+
+  const toRemove = [];
+  const kept = [];
+  for (const oldPath of Object.keys(existingManifest)) {
+    if (allManifest[oldPath]) continue;
+    if (/\/phases\//.test(oldPath)) continue; // user-customizable
+    if (isProjectOwnedSeed(oldPath)) { kept.push({ path: oldPath, reason: 'project-owned seed' }); continue; }
+    if (!allTemplatePaths.has(oldPath)) { kept.push({ path: oldPath, reason: 'non-template file' }); continue; }
+    if (!selectedTemplatePaths.has(oldPath)) continue; // deselected module — leave it
+    const skillDirMatch = oldPath.match(/^\.claude\/skills\/([^/]+)\//);
+    if (skillDirMatch && !ccSkillNames.has(skillDirMatch[1])) { kept.push({ path: oldPath, reason: 'project skill' }); continue; }
+    if (fs.existsSync(path.join(projectDir, oldPath))) toRemove.push(oldPath);
+  }
+  return { toRemove, kept };
+}
+
 // Signals that a directory contains a real project (not just empty)
 const PROJECT_SIGNALS = [
   'package.json', 'Cargo.toml', 'requirements.txt', 'pyproject.toml',
@@ -730,6 +844,13 @@ function detectProjectState(dir) {
   return 'empty';
 }
 
+// A `--freeze`/`--unfreeze` value token vs the positional target dir. Module
+// keys are simple kebab-case identifiers; a flag or any path-like token
+// (separator, or . / ..) is the target directory, never a module list.
+function looksLikeModuleArg(s) {
+  return Boolean(s) && !s.startsWith('-') && !s.includes('/') && !s.includes('\\') && s !== '.' && s !== '..';
+}
+
 function parseArgs(argv) {
   const args = argv.slice(2);
   const flags = {
@@ -752,11 +873,32 @@ function parseArgs(argv) {
     else if (arg === '--help' || arg === '-h') flags.help = true;
     else if (arg === '--reset') flags.reset = true;
     else if (arg === '--force') flags.force = true;
+    else if (arg === '--reindex') flags.reindex = true;
     else if (arg === '--migrate-memory') flags.migrateMemory = true;
     else if (arg === '--unmigrate-memory') flags.unmigrateMemory = true;
+    else if (arg === '--list-frozen') flags.listFrozen = true;
     else if (arg === '--modules' && i + 1 < args.length) {
       flags.modules = args[++i].split(',').map(s => s.trim()).filter(Boolean);
     }
+    // --freeze <mods> / --unfreeze [mods]: edit .ccrc.json frozenModules and
+    // exit. Consume the next token as the module list ONLY when it looks like
+    // one — a flag, or a path-like token (contains a separator, or is . / ..),
+    // is the target directory, not a value. Module keys are simple kebab-case
+    // identifiers and never contain a path separator, so this can't swallow a
+    // real module while it does stop `--unfreeze /path/to/project` from being
+    // misread as a module (which would silently fail to clear-all). An empty
+    // --freeze is an error (dispatch warns, never a silent no-op); an empty
+    // --unfreeze clears all.
+    else if (arg === '--freeze') {
+      flags.freeze = looksLikeModuleArg(args[i + 1])
+        ? args[++i].split(',').map(s => s.trim()).filter(Boolean)
+        : [];
+    }
+    else if (arg === '--unfreeze') {
+      flags.unfreeze = looksLikeModuleArg(args[i + 1])
+        ? args[++i].split(',').map(s => s.trim()).filter(Boolean)
+        : []; // clear all
+    }
     else if (arg === '--frontier-model' && i + 1 < args.length) {
       // Empty/whitespace values are treated as absent: '' is a substring of
       // every model ID, which would match everything and leave the watchdog
@@ -782,6 +924,16 @@ function printHelp() {
     --modules <keys>  Comma-separated module keys to install (e.g., 'verify').
                   Mandatory modules are always included.
     --dry-run     Show what would be copied without writing
+    --reindex     Regenerate .claude/skills/_index.json in place (picks up
+                  directives-project.yaml mandate/routine edits without a full
+                  reinstall) and exit
+    --freeze <keys>    Pin module(s) (comma-separated) in .ccrc.json so the
+                  NEXT reinstall holds their CC-owned files at the current
+                  version (e.g. --freeze engagement while a client engagement
+                  is live). Also pins the requires-closure. Edits config, exits.
+    --unfreeze [keys]  Clear the freeze for the given module(s), or all if no
+                  keys. Re-run the installer to refresh the unfrozen module(s).
+    --list-frozen      Show which modules are frozen (+ their closure) and exit.
     --reset       Remove Claude Cabinet files (uses manifest for safety)
     --force       With --reset: remove even customized files;
                   with --migrate-memory: override already-migrated guard
@@ -823,6 +975,80 @@ async function run() {
     return;
   }
 
+  // Standalone skill-index regen (act:98d41fa2). Advisor standing-mandates and
+  // routine declarations are read from .claude/skills/_index.json, which is
+  // otherwise regenerated only by a full install — coupling every overlay
+  // change (e.g. adding a session-close mandate to directives-project.yaml) to
+  // an upgrade cycle. This regenerates the index in place so a change is
+  // verifiable immediately, no reinstall needed.
+  if (flags.reindex) {
+    const projectDir = path.resolve(flags.targetDir);
+    if (!fs.existsSync(path.join(projectDir, '.claude', 'skills'))) {
+      console.log(`  No .claude/skills/ in ${projectDir} — nothing to reindex.`);
+      return;
+    }
+    const n = generateSkillIndex(projectDir);
+    console.log(`  📇 Reindexed ${n} skill${n === 1 ? '' : 's'} in .claude/skills/_index.json`);
+    return;
+  }
+
+  // Standalone freeze management (act:c1013967) — edit .ccrc.json frozenModules
+  // and exit, no install. Freeze pins a module's CC-owned files across a
+  // reinstall (the "reinstall maginnis without disturbing Ed's engagement" fix);
+  // the install body reads frozenModules + expands the requires closure.
+  if (flags.listFrozen || flags.freeze || flags.unfreeze) {
+    const projectDir = path.resolve(flags.targetDir);
+    const current = readFrozenModules(projectDir);
+
+    const describe = (mods) => {
+      if (mods.length === 0) { console.log('  No modules are frozen.'); return; }
+      const closure = expandFrozenClosure(mods, MODULES);
+      const pulledIn = [...closure].filter(k => !mods.includes(k));
+      console.log(`  ❄ Frozen modules: ${mods.join(', ')}`);
+      if (pulledIn.length) console.log(`    + required closure (also pinned): ${pulledIn.join(', ')}`);
+      console.log('    A reinstall holds these modules’ CC-owned files at the current version.');
+    };
+
+    if (flags.listFrozen) {
+      describe(current);
+      return;
+    }
+
+    if (flags.freeze) {
+      if (flags.freeze.length === 0) {
+        console.log('  ✗ --freeze needs at least one module key, e.g. --freeze engagement');
+        return;
+      }
+      const known = Object.keys(MODULES);
+      const unknown = flags.freeze.filter(m => !known.includes(m));
+      if (unknown.length) console.log(`  ⚠ Unknown module key(s) ignored: ${unknown.join(', ')} (known: ${known.join(', ')})`);
+      const valid = flags.freeze.filter(m => known.includes(m));
+      const next = [...new Set([...current, ...valid])];
+      if (flags.dryRun) {
+        console.log(`  [dry run] Would set frozenModules to: ${next.join(', ') || '(none)'}`);
+      } else {
+        setFrozenModules(projectDir, next);
+        console.log('  ✓ Updated .ccrc.json frozenModules.');
+      }
+      describe(next);
+      return;
+    }
+
+    if (flags.unfreeze) {
+      const next = flags.unfreeze.length === 0
+        ? []                                              // --unfreeze → clear all
+        : current.filter(m => !flags.unfreeze.includes(m));
+      if (flags.dryRun) {
+        console.log(`  [dry run] Would set frozenModules to: ${next.join(', ') || '(none)'}`);
+      } else {
+        setFrozenModules(projectDir, next);
+        console.log('  ✓ Updated .ccrc.json frozenModules. Re-run the installer to refresh the unfrozen module(s).');
+      }
+      describe(next);
+      return;
+    }
+  }
+
   if (flags.migrateMemory) {
     const { migrateMemoryCmd } = require('./migrate-memory-cmd');
     const projectDir = path.resolve(flags.targetDir);
@@ -1151,18 +1377,24 @@ async function run() {
     return crypto.createHash('sha256').update(content).digest('hex').slice(0, 16);
   }
 
-  // Compute the relative path from projectDir for manifest entries
-  function manifestPath(tmpl) {
-    if (tmpl.startsWith('skills/') || tmpl.startsWith('hooks/') || tmpl.startsWith('rules/')) {
-      return '.claude/' + tmpl;
-    } else if (tmpl.startsWith('scripts/')) {
-      return tmpl;
-    }
-    return '.claude/' + tmpl;
-  }
+  // Frozen modules (act:c1013967): the operator pinned these in .ccrc.json so
+  // a reinstall holds their CC-owned files at the current version. Expand by
+  // the `requires` closure (freezing engagement also pins work-tracking, so a
+  // frozen caller is never left bound to a refreshed callee), then intersect
+  // with what is actually installed. `effectiveFrozen` gates ALL freeze
+  // behavior — never the raw declared list — so a typo'd / uninstalled / dead
+  // key can't silently pin global state or claim protection it isn't giving.
+  const declaredFrozen = readFrozenModules(projectDir);
+  const effectiveFrozen = new Set(
+    [...expandFrozenClosure(declaredFrozen, MODULES)].filter(
+      (k) => MODULES[k] && selectedModules.includes(k)
+    )
+  );
+  const frozenCounts = {}; // modKey -> # files held this install
 
   for (const modKey of selectedModules) {
     const mod = MODULES[modKey];
+    const frozen = effectiveFrozen.has(modKey);
     for (const tmpl of mod.templates) {
       const srcPath = path.join(templateRoot, tmpl);
       if (!fs.existsSync(srcPath)) {
@@ -1211,7 +1443,9 @@ async function run() {
           projectRoot: projectDir,
           existingManifest,
           instructionPhases: instrPhases,
+          frozen,
         });
+        if (results.frozen.length) frozenCounts[modKey] = (frozenCounts[modKey] || 0) + results.frozen.length;
         totalCopied += results.copied.length;
         totalSkipped += results.skipped.length;
         totalOverwritten += results.overwritten.length;
@@ -1256,6 +1490,22 @@ async function run() {
             continue;
           }
 
+          // Frozen module (act:c1013967): held instead of overwritten. Mirrors
+          // copy.js's directory path via the shared freezeRetain rule — retain
+          // at the on-disk hash only if already CC-owned; a project-owned file
+          // falls through to the normal skip-and-omit path below.
+          if (frozen) {
+            const decision = freezeRetain({ existing: existingContent, isCcOwned: Boolean(existingManifest[mPath]) });
+            if (decision.manifestHash) {
+              totalSkipped++;
+              frozenCounts[modKey] = (frozenCounts[modKey] || 0) + 1;
+              allManifest[mPath] = decision.manifestHash;
+              console.log(`  ❄ Frozen (held): ${path.relative(projectDir, destPath)}`);
+              continue;
+            }
+            // decision.omit → project-owned; fall through.
+          }
+
           if (flags.yes || dirState === 'existing-install') {
             // If file is in the old manifest, it's upstream-managed — overwrite.
             // If not, it's project-created — skip.
@@ -1298,6 +1548,14 @@ async function run() {
             }
           }
         } else {
+          // New file in a frozen module: hold it back (don't create) so the
+          // module stays internally consistent at its pinned version. Report
+          // only — never a manifest entry (no on-disk content to hash).
+          if (frozen) {
+            frozenCounts[modKey] = (frozenCounts[modKey] || 0) + 1;
+            console.log(`  ❄ Frozen (held new): ${path.relative(projectDir, destPath)}`);
+            continue;
+          }
           if (!flags.dryRun) fs.copyFileSync(srcPath, destPath);
           totalCopied++;
           allManifest[mPath] = incomingHash;
@@ -1308,6 +1566,28 @@ async function run() {
 
   console.log(`  📁 Files: ${totalCopied} copied, ${totalOverwritten} overwritten, ${totalSkipped} unchanged`);
 
+  // --- Frozen-module report (act:c1013967) ---
+  // Plain-English, per-module: surface WHICH modules were held and how many
+  // files, so a gitignored freeze can never quietly change install behavior.
+  // Note in plain words when the requires-closure pinned a module the operator
+  // didn't name directly.
+  if (effectiveFrozen.size > 0) {
+    const declaredSet = new Set(declaredFrozen);
+    for (const modKey of effectiveFrozen) {
+      const n = frozenCounts[modKey] || 0;
+      let reason = '';
+      if (!declaredSet.has(modKey)) {
+        const namedBy = [...declaredSet].find(d => expandFrozenClosure([d], MODULES).has(modKey) && d !== modKey);
+        if (namedBy) reason = ` (pinned because ${namedBy} requires it)`;
+      }
+      if (n > 0) {
+        console.log(`  ❄ Frozen: ${n} file${n === 1 ? '' : 's'} in module '${modKey}'${reason} held at current version — unfreeze to update.`);
+      } else {
+        console.log(`  ❄ Frozen: module '${modKey}'${reason} — no CC-owned files differed (nothing to hold this run).`);
+      }
+    }
+  }
+
   // --- Make hook scripts executable ---
   const hooksDir = path.join(claudeDir, 'hooks');
   if (!flags.dryRun && fs.existsSync(hooksDir)) {
@@ -1378,10 +1658,34 @@ async function run() {
   }
 
   // --- Set up database ---
+  // dbSchemaVersion is recorded into .ccrc.json so a future reinstall can
+  // tell, WITHOUT loading better-sqlite3, that no migration is pending and
+  // skip the init step entirely (lib/db-setup.js shouldSkipInit).
+  let dbSchemaVersion;
   if (includeDb && selectedModules.includes('work-tracking') && !flags.dryRun) {
     try {
-      const dbResults = setupDb(projectDir);
-      for (const r of dbResults) console.log(`  🗄️  ${r}`);
+      // Freeze insurance (act:c1013967): when a module is frozen and a schema
+      // migration is actually pending, back up pib.db before db-setup runs so
+      // the operator has true one-file rollback for the store holding live
+      // engagement data. Reuses db-setup's own skip decision (no logic
+      // duplication): if work-tracking is itself frozen, its pib-db-lib.mjs
+      // stayed old → bundled == recorded → no migration → no backup. The
+      // existsSync guard means a fresh install (no pib.db yet) still creates
+      // the db normally; there's just nothing to back up.
+      if (effectiveFrozen.size > 0) {
+        const dbPath = path.join(projectDir, 'pib.db');
+        const recordedVersion = (readMetadata(projectDir) || {}).dbSchemaVersion;
+        const bundledVersion = readBundledSchemaVersion(path.join(projectDir, 'scripts'));
+        const willMigrate = !shouldSkipInit({ dbExists: fs.existsSync(dbPath), recordedVersion, bundledVersion });
+        if (willMigrate && fs.existsSync(dbPath)) {
+          const backupPath = `${dbPath}.cc-bak-${new Date().toISOString().replace(/[:.]/g, '-')}`;
+          fs.copyFileSync(dbPath, backupPath);
+          console.log(`  ❄ Backed up pib.db → ${path.basename(backupPath)} before migration (freeze active).`);
+        }
+      }
+      const dbResult = setupDb(projectDir);
+      for (const r of dbResult.results) console.log(`  🗄️  ${r}`);
+      if (dbResult.schemaVersion != null) dbSchemaVersion = dbResult.schemaVersion;
     } catch (err) {
       console.log(`  ⚠ Database setup failed: ${err.message}`);
       console.log('    You can set it up later: node scripts/pib-db.mjs init');
@@ -1487,78 +1791,26 @@ async function run() {
   //   S3: Itemize — list all deletions and confirm before proceeding
   //   S4: Backup — copy files to .cc-backup/<timestamp>/ before deletion
   if (Object.keys(existingManifest).length > 0) {
-    // S1: Build complete template path set (ALL modules) for classification
-    const allTemplatePaths = new Set();
-    for (const mod of Object.values(MODULES)) {
-      for (const tmpl of mod.templates || []) {
-        const srcPath = path.join(templateRoot, tmpl);
-        if (fs.existsSync(srcPath) && fs.statSync(srcPath).isDirectory()) {
-          for (const rel of walkDir(srcPath)) {
-            allTemplatePaths.add(manifestPath(tmpl) + '/' + rel);
-          }
-        } else if (fs.existsSync(srcPath)) {
-          allTemplatePaths.add(manifestPath(tmpl));
-        }
-      }
-    }
-
-    // S2: Build selected-module template paths for scoping
-    const selectedTemplatePaths = new Set();
-    for (const modKey of selectedModules) {
-      const mod = MODULES[modKey];
-      for (const tmpl of mod.templates || []) {
-        const srcPath = path.join(templateRoot, tmpl);
-        if (fs.existsSync(srcPath) && fs.statSync(srcPath).isDirectory()) {
-          for (const rel of walkDir(srcPath)) {
-            selectedTemplatePaths.add(manifestPath(tmpl) + '/' + rel);
-          }
-        } else if (fs.existsSync(srcPath)) {
-          selectedTemplatePaths.add(manifestPath(tmpl));
-        }
-      }
-    }
-
-    // Build CC template skill name set for project-skill guard (act:4ac281ba)
-    const ccSkillNames = new Set();
-    for (const mod of Object.values(MODULES)) {
-      for (const tmpl of mod.templates || []) {
-        if (tmpl.startsWith('skills/')) {
-          const skillName = tmpl.split('/')[1];
-          ccSkillNames.add(skillName);
-        }
-      }
-    }
-
-    // Collect files that would be removed
-    const toRemove = [];
-    for (const oldPath of Object.keys(existingManifest)) {
-      if (!allManifest[oldPath]) {
-        // Skip phase files — they may be user-customized
-        if (/\/phases\//.test(oldPath)) continue;
-
-        // S1: Only delete if the path maps to a known CC template
-        if (!allTemplatePaths.has(oldPath)) {
-          console.log(`  Keeping non-template file: ${oldPath}`);
-          continue;
-        }
-
-        // S2: Only delete from selected modules (don't purge deselected modules)
-        if (!selectedTemplatePaths.has(oldPath)) {
-          continue;
-        }
-
-        // Project-skill guard: never delete skills CC didn't create
-        const skillDirMatch = oldPath.match(/^\.claude\/skills\/([^/]+)\//);
-        if (skillDirMatch && !ccSkillNames.has(skillDirMatch[1])) {
-          console.log(`  Keeping project skill: ${oldPath}`);
-          continue;
-        }
-
-        const fullPath = path.join(projectDir, oldPath);
-        if (fs.existsSync(fullPath)) {
-          toRemove.push(oldPath);
-        }
-      }
+    // Classification is the pure `computeRemovals` (top-level, unit-tested): S1
+    // only known-template paths, S2 only selected modules, plus the
+    // project-owned-seed and project-skill guards. A FROZEN file needs no case
+    // here — retain-in-manifest (the freeze copy path) kept it in allManifest,
+    // so it never reaches the removal test; a frozen file removed upstream is
+    // kept by S1 ("non-template"). The S3 itemize/confirm + S4 backup/delete
+    // stay inline below.
+    const { toRemove, kept } = computeRemovals({
+      existingManifest,
+      allManifest,
+      selectedModules,
+      templateRoot,
+      projectDir,
+    });
+    for (const k of kept) {
+      // 'deselected module' files are silently left (matching the prior loop's
+      // bare `continue` for that S2 case); the rest log their keep reason.
+      if (k.reason === 'project-owned seed') console.log(`  Keeping project-owned seed: ${k.path}`);
+      else if (k.reason === 'non-template file') console.log(`  Keeping non-template file: ${k.path}`);
+      else if (k.reason === 'project skill') console.log(`  Keeping project skill: ${k.path}`);
     }
 
     // S3: Itemize and confirm before deleting
@@ -1629,6 +1881,7 @@ async function run() {
       skipped: skippedModules,
       version: VERSION,
       manifest: allManifest,
+      dbSchemaVersion,
     });
     console.log('  📝 Created .ccrc.json');
   }
@@ -1684,9 +1937,13 @@ async function run() {
       } else {
         console.log('  📋 Registered in project registry');
       }
-      // Self-announcing: print the effective designation on every run.
+      // Self-announcing: print the effective designation on every run, and
+      // the inert-state notice when none is set — a never-configured
+      // watchdog must not read the same as a passing one (act:77f7b7b2).
       if (registry.frontierModel) {
         console.log(`  🛰  Frontier model: ${registry.frontierModel} (visibility watchdog — /orient + SessionStart warn on mismatch; nothing is pinned)`);
+      } else {
+        console.log('  🛰  Frontier model: none designated — watchdog inert. Set with: npx create-claude-cabinet --frontier-model <value>');
       }
     } catch (err) {
       // Non-fatal — registry is nice-to-have
@@ -1710,4 +1967,4 @@ async function run() {
   console.log('');
 }
 
-module.exports = { run, MODULES, generateAgentWrappers };
+module.exports = { run, MODULES, generateAgentWrappers, generateSkillIndex, expandFrozenClosure, computeRemovals, manifestPath };