devflow-kit 3.0.1 → 3.1.0

package/dist/core/feature-config.js

@@ -14,7 +14,7 @@ import { loadProjectConfigLib } from './evidence-policy.js';
  * carrying it would leave a `learning: false` in the file that no longer does
  * what it says. `decisions` is the pre-rename spelling of `learning`;
  * `autoCommit` is inert. `features` is deliberately NOT here — it is a live key,
- * carried like any other unmanaged key (avoids PF-071).
+ * carried like any other unmanaged key.
  */
 const RETIRED_CONFIG_KEYS = new Set([
     'memory', 'learning', 'knowledge', 'decisions', 'autoCommit',
@@ -77,7 +77,7 @@ function coerceConfig(parsed) {
     if (!isJsonObject(parsed))
         return null;
     const p = parsed;
-    // Coerce reviewPublication: any invalid or absent value → 'auto' (self-heal, ADR-014 idiom).
+    // Coerce reviewPublication: any invalid or absent value → 'auto' (self-heal).
     const rp = p.reviewPublication;
     const reviewPublication = rp === 'auto' || rp === 'full' || rp === 'off' ? rp : 'auto';
     // The per-repo tracker override is carried through VERBATIM — never coerced,
@@ -185,7 +185,7 @@ async function writeConfigBody(projectRoot, body) {
  * Merge devflow's managed keys over the config body the file already holds.
  * Pure — returns a new object and never mutates `existing`.
  *
- * D-CONFIG-PRESERVE-UNMANAGED (avoids PF-071): `.devflow/config.json` is a
+ * D-CONFIG-PRESERVE-UNMANAGED: `.devflow/config.json` is a
  * user-editable file that devflow only PARTLY owns. The managed keys come from
  * `managed`; every other key comes from the file, verbatim and by key presence
  * — the hand-written per-repo `tracker` override (whose invalid values must

package/dist/core/feature-switch.js

@@ -6,7 +6,7 @@ function isJsonObject(value) {
 }
 /**
  * The pre-rename key each machine feature was stored under, where one exists:
- * `learning` was `decisions` (ADR-011) and `knowledge` was `kb`. A manifest no
+ * `learning` was `decisions` and `knowledge` was `kb`. A manifest no
  * command has rewritten since the rename can still hold only the legacy key.
  * `memory` was never renamed.
  */
@@ -19,7 +19,7 @@ const LEGACY_KEYS = {
  *
  * Only an explicit boolean `false` switches a feature off. A missing key, a
  * non-boolean value, or anything that is not a manifest-shaped object reads as
- * ON — fail-open (ADR-028), and the exact rule `queue_read_gates` applies in the
+ * ON — fail-open, and the exact rule `queue_read_gates` applies in the
  * shell hooks, so the CLI's status and the runtime never disagree about the
  * same file.
  *
@@ -37,7 +37,7 @@ const LEGACY_KEYS = {
  * precedence exactly, so `devflow knowledge --status` reports a `kb: false`
  * as disabled. queue_read_gates never reads knowledge, so there is no shell
  * mirror. The knowledge write-back prose gate deliberately does not learn the
- * legacy key (ADR-028: no prompt text for a state only an un-upgraded install
+ * legacy key (no prompt text for a state only an un-upgraded install
  * can hold); readManifest rewrites `kb` to `knowledge` on the next CLI run
  * that loads the manifest, after which that gate reads the healed key.
  *

package/dist/core/flags.js

@@ -7,7 +7,7 @@
  * D14: Typed registry — flags carry kind (boolean|enum|number|string), target
  * (env|setting), and per-kind defaultValue. Neutral values delete their target
  * key; active values write the appropriate payload. Number 0 is ACTIVE. Sink
- * validation via coerceFlagValue (applies PF-023: validate at the convergence
+ * validation via coerceFlagValue (validate at the convergence
  * point every caller reaches). applyFlags(settingsJson, FlagsRecord) is the
  * sole API; init.ts works directly with FlagsRecord (no legacy string[] bridge).
  */
@@ -139,7 +139,7 @@ export const FLAG_REGISTRY = [
     {
         // Devflow fan-outs routinely exceed the upstream default of 20.
         // Set to 40 by default so parallel Code/Review/Research waves don't
-        // silently queue. upstreamDefault recorded for display. (applies PF-023 bounds)
+        // silently queue. upstreamDefault recorded for display.
         id: 'max-concurrent-subagents',
         label: 'Max concurrent subagents',
         description: 'Maximum number of subagents Claude Code will spawn concurrently',
@@ -150,7 +150,7 @@ export const FLAG_REGISTRY = [
         recommended: true,
         defaultValue: 40,
         min: 1,
-        max: 100, // devflow sanity bound (applies PF-023)
+        max: 100, // devflow sanity bound
         integer: true,
         upstreamDefault: 20,
     },
@@ -341,7 +341,7 @@ export const FLAG_REGISTRY = [
     // ── Valued flags (number/enum/string) ────────────────────────────────────
     {
         // Domain: unset by default; set only when users want a non-default spawn depth.
-        // upstreamDefault: 3 (recorded for display). PF-023 bounds: max 10.
+        // upstreamDefault: 3 (recorded for display). Sanity bound: max 10.
         id: 'subagent-spawn-depth',
         label: 'Max subagent spawn depth',
         description: 'Maximum depth of nested subagent spawning',
@@ -352,7 +352,7 @@ export const FLAG_REGISTRY = [
         recommended: false,
         defaultValue: undefined,
         min: 1,
-        max: 10, // devflow sanity bound (applies PF-023)
+        max: 10, // devflow sanity bound
         integer: true,
         upstreamDefault: 3,
     },
@@ -384,7 +384,7 @@ export const FLAG_REGISTRY = [
     },
     {
         // Upstream default: 30 min. 0 = disabled (still ACTIVE — written to env).
-        // PF-023 bounds: max 1440 (24h). min 0 (0 = off, explicit value not neutral).
+        // Sanity bounds: max 1440 (24h). min 0 (0 = off, explicit value not neutral).
         id: 'goal-checkin-minutes',
         label: 'Goal check-in interval',
         description: 'Interval in minutes for Claude to check in on task goals',
@@ -395,7 +395,7 @@ export const FLAG_REGISTRY = [
         recommended: false,
         defaultValue: undefined,
         min: 0, // 0 = off (ACTIVE, not neutral — written as "0")
-        max: 1440, // devflow sanity bound: 24 hours (applies PF-023)
+        max: 1440, // devflow sanity bound: 24 hours
         integer: true,
         upstreamDefault: 30,
     },
@@ -411,7 +411,7 @@ export const FLAG_REGISTRY = [
         recommended: false,
         defaultValue: undefined,
         wrapKey: 'command',
-        maxLength: 256, // devflow sanity bound (applies PF-023)
+        maxLength: 256, // devflow sanity bound
     },
     {
         // view-mode folded into the registry; neutralValue 'default' deletes the viewMode key.
@@ -474,7 +474,7 @@ export function isNeutral(flag, value) {
 /**
  * Map a record value to a TUI value.
  *
- * viewMode GLUE RULE (PF-017 one-shared-definition corollary): the mapping lives here,
+ * viewMode GLUE RULE (one shared definition): the mapping lives here,
  * next to neutralValueOf — the definition it depends on — not across a module boundary.
  *   enum with neutralValue: neutralValue → null in TUI (null is the TUI representation
  *   of "use the default"; the key is deleted when persisted).
@@ -494,7 +494,7 @@ export function recordToTui(flag, v) {
 /**
  * Map a TUI value back to a record value.
  *
- * viewMode GLUE RULE (PF-017 one-shared-definition corollary): inverse of recordToTui,
+ * viewMode GLUE RULE (one shared definition): inverse of recordToTui,
  * co-located with that function so the round-trip contract is auditable in one place.
  *   enum with neutralValue: null → neutralValue (e.g. 'default').
  * All other values pass through unchanged.
@@ -509,7 +509,7 @@ export function tuiToRecord(flag, v) {
 }
 /**
  * Validate and coerce `raw` to a safe value for `flag` at the sink.
- * Returns null when the value is invalid (hostile-value defence — applies PF-023).
+ * Returns null when the value is invalid (hostile-value defence).
  *
  * Number invariants: finite, within [min, max], integer when required.
  * String invariants: within maxLength, no control characters.
@@ -567,7 +567,7 @@ export function coerceFlagValue(flag, raw) {
  * Parse a CLI text input to a FlagsRecordValue.
  * 'unset' (literal) → null for any flag.
  *
- * Number branch uses strict decimal grammar (applies PF-023 — invariant at the sink
+ * Number branch uses strict decimal grammar (invariant at the sink
  * every caller reaches, not per-caller): rejects empty, padded, hex, exponent,
  * and leading-zero forms. Equivalent to the TUI's strict parsing so both entry
  * points share one grammar.
@@ -749,7 +749,7 @@ export function readViewMode(record) {
  * Sanitize a FlagsRecord by coercing each known flag's value through
  * coerceFlagValue.
  *
- * Known flag IDs (applies ADR-014 key-presence semantics):
+ * Known flag IDs (key-presence semantics):
  *   - explicit null input → kept as null (deliberately unset)
  *   - valid non-null input → kept as coerced value
  *   - invalid non-null input → KEY DROPPED (absent = adopt default on next init,
@@ -758,7 +758,7 @@ export function readViewMode(record) {
  * Unknown flag IDs (forward-compat):
  *   - primitive values (boolean, number, string, null) → kept as-is
  *   - non-primitive values (objects, arrays) → DROPPED to avoid laundering
- *     untrusted shapes into FlagsRecordValue (applies PF-023)
+ *     untrusted shapes into FlagsRecordValue
  *
  * D39: `__proto__`, `constructor`, `prototype` are always skipped.
  */
@@ -823,7 +823,7 @@ export function getDefaultFlagsRecord() {
  * Migrate a legacy (string-array) enabled-flags manifest to a typed FlagsRecord.
  * Called by manifest.ts self-healing when it encounters an old string-array manifest.
  *
- * Contract (applies ADR-014 transition semantics):
+ * Contract:
  * - knownIds defined   → knownSet = knownIds ∪ enabledIds
  * - knownIds undefined → knownSet = full current registry ∪ enabledIds
  *   (pre-knownFlags manifests: all flags known, so adopt-nothing is expressed
@@ -884,7 +884,7 @@ export function settingValueHoldsManagedShape(flag, value) {
     return isDeepStrictEqual(value, guard);
 }
 /**
- * D-ATTR-GUARD single-source predicate (consistency-01 / ADR-024).
+ * D-ATTR-GUARD single-source predicate (consistency-01).
  *
  * Returns true when the settings.json string contains a value at the flag's
  * target key that equals the flag's managed shape (`settingDeleteGuard`).
@@ -926,7 +926,7 @@ export function settingHoldsManagedShape(settingsJson, flagId) {
  *
  * Delegates to `settingValueHoldsManagedShape` — the single equality oracle for
  * managed-shape comparisons — so there is exactly one `isDeepStrictEqual` call
- * across the entire apply/strip pipeline (ADR-024 mechanism 3).
+ * across the entire apply/strip pipeline.
  *
  * Single-source invariant: both the disable path (applyFlags neutral branch) and
  * the uninstall path (stripFlags) collapse to this predicate.
@@ -980,7 +980,7 @@ function buildPayload(flag, value) {
  * Apply a FlagsRecord to a settings JSON string.
  *
  * - Unknown flag IDs are skipped (forward-compatible with future flags).
- * - `coerceFlagValue` is called at the sink before applying (applies PF-023).
+ * - `coerceFlagValue` is called at the sink before applying.
  * - Neutral values delete their target key.
  * - Env payloads for number flags are stringified ('40', never 40).
  * - Setting payloads for string flags with wrapKey are shaped ({ command: v }).
@@ -988,7 +988,7 @@ function buildPayload(flag, value) {
  * - `__proto__`, `constructor`, `prototype` keys are silently skipped.
  */
 export function applyFlags(settingsJson, flags) {
-    // REL-M2 sink guard (applies PF-023): a non-plain-object root (null, array, scalar)
+    // REL-M2 sink guard: a non-plain-object root (null, array, scalar)
     // would cause a silent no-op or a confusing TypeError deep inside the loop.
     // Throw early with a clear message so every caller path is self-guarding.
     const root = JSON.parse(settingsJson);
@@ -1003,7 +1003,7 @@ export function applyFlags(settingsJson, flags) {
         const flag = FLAG_REGISTRY_MAP.get(id);
         if (!flag)
             continue; // unknown id — skip for forward compat
-        // Coerce at the sink (applies PF-023: validate at the convergence point)
+        // Coerce at the sink (validate at the convergence point)
         const safe = coerceFlagValue(flag, value);
         if (isNeutral(flag, safe)) {
             // Neutral → delete the target key
@@ -1045,7 +1045,7 @@ export function applyFlags(settingsJson, flags) {
  * Cleans up empty env object. Strip-then-apply idempotence preserved (INV-1).
  */
 export function stripFlags(settingsJson) {
-    // REL-M2 sink guard (applies PF-023): mirror of applyFlags — throw early on a
+    // REL-M2 sink guard: mirror of applyFlags — throw early on a
     // non-plain-object root so every caller path is self-guarding.
     const root = JSON.parse(settingsJson);
     if (root === null || typeof root !== 'object' || Array.isArray(root)) {
@@ -1122,7 +1122,7 @@ export function resolveFinalViewMode(current, selected, explicit) {
 // ─── Fold-before-strip pipeline ───────────────────────────────────────────────
 /**
  * Fold-before-strip pipeline — the single authoritative entry point for all
- * settings.json mutation paths (applies PF-015, PF-017, ADR-014).
+ * settings.json mutation paths.
  *
  * Both `init.ts` and `persistFlagConfig` (flags.ts) MUST call this instead of
  * invoking `stripFlags` + `applyFlags` directly; the invariant lives in the
@@ -1143,7 +1143,7 @@ export function resolveFinalViewMode(current, selected, explicit) {
  *   A flag is "claimed" when it is present and non-null in the claimed set.
  *   Claimed: record value wins (devflow previously set this value).
  *   Unclaimed: fold from settings — if the user has a value in settings.json,
- *   adopt it into the record (ADR-014 adoption, devflow takes ownership).
+ *   adopt it into the record (devflow takes ownership).
  *
  *   Boolean flags: never folded — on/off is always record-driven.
  *
@@ -1166,7 +1166,7 @@ export function resolveFinalViewMode(current, selected, explicit) {
  */
 export function convergeFlagsIntoSettings(settingsJson, record, opts) {
     // ── Step 1: fold view-mode (must read pre-strip) ──────────────────────────
-    // PF-015: resolveExistingViewMode reads the viewMode key. stripFlags removes
+    // resolveExistingViewMode reads the viewMode key. stripFlags removes
     // it as part of the view-mode registry entry. Reading after strip silently
     // reverts an externally-set /focus.
     const folded = {
@@ -1229,7 +1229,7 @@ export function convergeFlagsIntoSettings(settingsJson, record, opts) {
         }
     }
     // ── Step 2b: adopt guarded boolean settings before the strip ─────────────
-    // D-ATTR-ADOPT (PF-050 / ADR-024): a delete guard is evidence about the VALUE,
+    // D-ATTR-ADOPT: a delete guard is evidence about the VALUE,
     // never about the record — a pre-existing on-disk key whose value matches the
     // managed shape means devflow wrote it, so adopt it into the record now, before
     // stripFlags can unconditionally remove it on the next line.

package/dist/core/fs-atomic.js

@@ -5,11 +5,10 @@ import { promises as fs } from 'fs';
  * D34: Canonical atomic-write helper for the TypeScript CLI surface.
  *
  * Call sites: used by the CLI's exclusive-write call sites (migrations, init, post-install,
- * uninstall, security, ambient, memory, HUD, observation I/O).
- * The CJS counterpart (`writeExclusive` in `src/assets/scripts/hooks/json-helper.cjs` and
- * `src/assets/scripts/hooks/decisions-usage-scan.cjs`) intentionally remains a separate
- * implementation — same semantics, different module system. Any change to the
- * retry logic here MUST be mirrored in both CJS files.
+ * uninstall, security, ambient, memory, HUD).
+ * The CJS counterpart (`writeExclusive` in `src/assets/scripts/hooks/lib/learning-store.cjs`)
+ * intentionally remains a separate implementation — same semantics, different module
+ * system. Any change to the retry logic here MUST be mirrored there.
  */
 /**
  * Atomically write `filePath` by writing to a sibling `.tmp` then renaming.
@@ -34,7 +33,7 @@ export async function writeFileAtomicExclusive(filePath, data) {
     // PID-scope the tmp name so concurrent writers from different processes
     // (e.g., two Claude Code sessions) never collide on the same .tmp path.
     // mirrors proxy-log.ts rotation at src/core/proxy-log.ts which PID-scopes
-    // for the same reason.  avoids PF-011.
+    // for the same reason.
     const tmp = `${filePath}.tmp.${process.pid}`;
     try {
         await fs.writeFile(tmp, data, { encoding: 'utf-8', flag: 'wx' });
@@ -58,7 +57,7 @@ export async function writeFileAtomicExclusive(filePath, data) {
     //
     // Non-fatal path: if stat fails (ENOENT → fresh file, or any other I/O
     // error), skip chmod and keep the umask default — the write must still
-    // complete correctly (avoids PF-009 failure-isolation principle).
+    // complete correctly.
     try {
         const { mode } = await fs.stat(filePath);
         // mode includes file-type bits; mask to permission bits only for chmod.

package/dist/core/learning-queue-cleanup.js

@@ -1,92 +1,28 @@
 /**
  * @file learning-queue-cleanup.ts
  *
- * Shared cleanup helpers for `.devflow/learning/`. Imported solely by
- * `src/cli/commands/learning.ts`:
- * - `sweepLegacyDreamMarkers` — used by `devflow learning --reset`
- * - `drainLearningQueue` — used by `devflow learning --clear` / `--disable`
+ * `drainLearningQueue`, the learning queue drain shared by `devflow learning
+ * --clear` and `--disable` (src/cli/commands/learning.ts) and by the drain
+ * `devflow init` runs when learning is switched off (src/cli/commands/init.ts).
  */
 import { promises as fs } from 'fs';
-import * as path from 'path';
-import { getLearningPendingTurnsPath, getLearningPendingTurnsProcessingPath, } from './project-paths.js';
-// ---------------------------------------------------------------------------
-// Legacy marker-pipeline sweep
-// ---------------------------------------------------------------------------
-/** Fixed-name stamps left by the retired dream marker pipeline. */
-const LEGACY_FIXED_STAMPS = ['.decisions-runs-today', '.curation-last', '.processor-spawned-at'];
-/** Per-session marker variants: (decisions|curation).*.{json,processing,retries,failed} */
-function isLegacyPerSessionMarker(name) {
-    return ((name.startsWith('decisions.') || name.startsWith('curation.')) &&
-        (name.endsWith('.json') || name.endsWith('.processing') || name.endsWith('.retries') || name.endsWith('.failed')));
-}
-/**
- * Sweep legacy marker-pipeline files from a `.devflow/learning/` directory:
- * the fixed-name stamps above, plus per-session `decisions.*`/`curation.*`
- * markers. Never touches `learning.json` or the live
- * `.pending-turns.jsonl`/`.pending-turns.processing` queue files.
- *
- * ENOENT-idempotent (missing learning dir or already-removed files are not
- * errors). Non-ENOENT errors are rethrown — callers that need best-effort
- * semantics (e.g. `--reset`, which must still finish releasing its lock)
- * should wrap the call in their own try/catch.
- *
- * @returns number of files removed
- */
-export async function sweepLegacyDreamMarkers(learningDir) {
-    let removed = 0;
-    for (const name of LEGACY_FIXED_STAMPS) {
-        try {
-            await fs.unlink(path.join(learningDir, name));
-            removed++;
-        }
-        catch (err) {
-            const code = err.code;
-            if (code !== 'ENOENT')
-                throw err;
-        }
-    }
-    try {
-        const entries = await fs.readdir(learningDir);
-        for (const entry of entries) {
-            if (isLegacyPerSessionMarker(entry)) {
-                try {
-                    await fs.unlink(path.join(learningDir, entry));
-                    removed++;
-                }
-                catch (err) {
-                    const code = err.code;
-                    if (code !== 'ENOENT')
-                        throw err;
-                }
-            }
-        }
-    }
-    catch (err) {
-        const code = err.code;
-        if (code !== 'ENOENT')
-            throw err;
-    }
-    return removed;
-}
-// ---------------------------------------------------------------------------
-// Live queue drain
-// ---------------------------------------------------------------------------
+import { getLearningClaimOwnerPath, getLearningPendingTurnsPath, getLearningPendingTurnsProcessingPath, } from './project-paths.js';
 /**
- * Drain the learning (decisions-detection) pending-turns queue so stale turns
- * don't process later — used by both `--clear` and `--disable`. A mid-run
- * Learning agent whose claimed batch vanishes aborts without changes, which is
- * the desired outcome in both cases. ENOENT-tolerant; other errors propagate.
+ * Drain the learning (decisions-detection) pending-turns queue, its claimed
+ * batch and the claim's owner file so stale turns don't process later — used by
+ * both `--clear` and `--disable`. A mid-run Learning agent whose claimed batch
+ * vanishes aborts without changes, which is the desired outcome in both cases.
+ * ENOENT-tolerant; other errors propagate.
  */
 export async function drainLearningQueue(gitRoot) {
+    const unlinkIfPresent = (file) => fs.unlink(file).catch((e) => {
+        if (e.code !== 'ENOENT')
+            throw e;
+    });
     await Promise.all([
-        fs.unlink(getLearningPendingTurnsPath(gitRoot)).catch((e) => {
-            if (e.code !== 'ENOENT')
-                throw e;
-        }),
-        fs.unlink(getLearningPendingTurnsProcessingPath(gitRoot)).catch((e) => {
-            if (e.code !== 'ENOENT')
-                throw e;
-        }),
+        unlinkIfPresent(getLearningPendingTurnsPath(gitRoot)),
+        unlinkIfPresent(getLearningPendingTurnsProcessingPath(gitRoot)),
+        unlinkIfPresent(getLearningClaimOwnerPath(gitRoot)),
     ]);
 }
 //# sourceMappingURL=learning-queue-cleanup.js.map

package/dist/core/learning-store.js

@@ -0,0 +1,61 @@
+/**
+ * The CLI's view of the learning store — a typed seam onto the package's own
+ * `hooks/lib/learning-store.cjs`, never a second implementation of it.
+ *
+ * D-LEARNING-STORE-SEAM: `devflow learning` reads and writes the learning tree only
+ * through the store module json-helper's ops and the hooks run, loaded with the
+ * evidence-policy seam's `loadScript` from the package's own scripts directory and
+ * shape-checked against LEARNING_STORE_SURFACE; the interfaces below are
+ * TRANSCRIBED from the store's JSDoc and are this side's only shape authority.
+ * Reason: the CLI's own TypeScript reader judged every row by the v1 shape, so it
+ * counted v2 observations as invalid, and its `--clear` truncated the log without
+ * the lock every learning writer takes.
+ *
+ * As with the evidence resolver (D-POLICY-CJS-SEAM), the CLI loads the package
+ * copy, which `npm` installs with this CLI, not `~/.devflow/scripts`, which
+ * `devflow init` refreshes: the two can differ until the next init.
+ */
+import { join } from 'path';
+import { scriptsDir } from './assets.js';
+import { loadScript } from './evidence-policy.js';
+/** The store, relative to src/assets/scripts/ (and ~/.devflow/scripts/). */
+export const LEARNING_STORE_SCRIPT_NAME = join('hooks', 'lib', 'learning-store.cjs');
+/**
+ * Every key of LearningStoreModule and the runtime kind the loader requires of
+ * it. `satisfies` makes the compiler reject an interface key missing here.
+ */
+export const LEARNING_STORE_SURFACE = Object.freeze({
+    INACTIVE_STATUSES: 'string-array',
+    ANCHOR_ID_RE: 'regexp',
+    readLearningState: 'function',
+    buildListing: 'function',
+    readListing: 'function',
+    formatListing: 'function',
+    showByKey: 'function',
+    restoreAnchor: 'function',
+    clearUnreferenced: 'function',
+    resetLearning: 'function',
+});
+/**
+ * Load the learning store from `dir` (default: the package's own scripts
+ * directory) and shape-check its surface. Never throws: a missing file is
+ * `not-found`; a module that throws on load or lacks a surface key is `unusable`.
+ */
+export function loadLearningStore(dir = scriptsDir()) {
+    return loadScript(join(dir, LEARNING_STORE_SCRIPT_NAME), LEARNING_STORE_SURFACE);
+}
+/**
+ * Why the store cannot be used, and the remedy: a package reinstall, since the
+ * CLI loads the package's own copy, which `devflow init` does not restore.
+ */
+export function formatLearningStoreUnavailable(error) {
+    switch (error.kind) {
+        case 'not-found': return 'learning store not found — reinstall devflow-kit';
+        case 'unusable': return 'learning store failed to load — reinstall devflow-kit';
+        default: {
+            const exhaustive = error;
+            return exhaustive;
+        }
+    }
+}
+//# sourceMappingURL=learning-store.js.map

package/dist/core/manifest.js

@@ -54,7 +54,7 @@ function parseManifestFlags(features, knownFlags) {
 /**
  * Read and parse the manifest file. Returns null if missing or corrupt.
  *
- * Self-heals the following on-disk inconsistencies (applies ADR-014):
+ * Self-heals the following on-disk inconsistencies:
  * - features.kb → features.knowledge rename (both absent → true, D-FEATURES-ABSENT-ON)
  * - features.decisions → features.learning rename (both absent → true, D-FEATURES-ABSENT-ON)
  * - features.flags as string[] → FlagsRecord (via migrateLegacyFlagsToRecord)
@@ -103,7 +103,7 @@ export async function readManifest(devflowDir) {
         const knowledge = typeof features.knowledge === 'boolean' ? features.knowledge
             : typeof features.kb === 'boolean' ? features.kb
                 : true;
-        // Self-heal: rename features.decisions → features.learning on disk (ADR-011).
+        // Self-heal: rename features.decisions → features.learning on disk.
         // Coalesce: features.learning wins; fall back to features.decisions; default ON.
         // D-LEARNING-LEGACY-DECISIONS: isMachineFeatureOn and queue_read_gates apply
         // this exact precedence, so the legacy key is honoured before the heal lands.
@@ -122,7 +122,7 @@ export async function readManifest(devflowDir) {
         // `flagsWereLegacy` is true only when the on-disk shape was a string[] (Case A),
         // keeping the needsHeal predicate in lockstep with the parse branch above.
         const { flags: parsedFlags, legacy: flagsWereLegacy } = parseManifestFlags(features, knownFlags);
-        // PF-023 + D39: sanitize all values; block prototype pollution keys.
+        // D39: sanitize all values; block prototype pollution keys.
         const sanitizedFlags = sanitizeFlagsRecord(parsedFlags);
         // needsHeal when any legacy artifact is present on disk
         const needsHeal = features.kb !== undefined ||
@@ -154,14 +154,14 @@ export async function readManifest(devflowDir) {
                 security: typeof features.security === 'string' && SECURITY_MODES.includes(features.security)
                     ? features.security
                     : undefined,
-                // Self-heal: absent proxy field defaults to false (applies ADR-014 self-heal idiom)
+                // Self-heal: absent proxy field defaults to false
                 proxy: typeof features.proxy === 'boolean' ? features.proxy : false,
                 // Self-heal: absent/malformed compliance → {enabled:false, frameworks:[]}
                 compliance: normalizeComplianceFeature(features.compliance),
                 // Self-heal: absent/malformed/unknown tracker → {provider:'github'} (AC-3.21).
                 // Deliberately NOT in the hard-null set above — see the field's doc comment.
                 // Healing here is silent and emits no DEGRADED: that is the correct
-                // ADR-014 behaviour, and a different condition from a per-repo config
+                // self-heal behaviour, and a different condition from a per-repo config
                 // value outside the domain (which does emit `unknown tracker provider`).
                 tracker: normalizeTrackerFeature(features.tracker),
             },

package/dist/core/mds-variants.js

@@ -4,11 +4,11 @@
  * Pure module — zero I/O. Every question a caller asks about a HOST is answered
  * with a Result; callers own every filesystem call and every process exit.
  *
- * applies ADR-013: pure core-layer module, no build-script or adapter concerns.
+ * Pure core-layer module, no build-script or adapter concerns.
  * The registries below are agent-neutral, so what is DERIVED from them is derived
  * here rather than inside an install target — a target adapter computing a build
  * fact, with tests importing that adapter to learn it, is the seam inverting.
- * avoids PF-014: no process.exit(); every fallible path returns Result. The
+ * No process.exit(); every fallible path returns Result. The
  * exiting shell is scripts/build-mds.ts, which renders these errors into its
  * pre-existing messages.
  *
@@ -85,7 +85,7 @@ export function validateOutputName(name) {
  * `tracker/jira/`, and `tracker/mcp.md` would read as a third provider.
  * Relaxing the shared rule instead would have admitted `_anything.md`
  * as a command or an agent basename too — a widening across all three build
- * destinations to buy a property only this one needs (ADR-025: classify the case,
+ * destinations to buy a property only this one needs (classify the case,
  * never blanket-widen).
  *
  * Every other guarantee is inherited by delegation, so the dot-segment,
@@ -127,8 +127,8 @@ export const AGENTS_OUTPUT_DIR = 'dist/agents';
  * the installer decides which skill install triggers the reference overlay from
  * it, and the init summary renders `prefixSkillName()` of it. Retyped at each of
  * those three sites, moving the references to another skill would mean finding
- * all three spellings with nothing failing if only two were found — the PF-013
- * shape, a hardcoded spelling that still resolves.
+ * all three spellings with nothing failing if only two were found — a hardcoded
+ * spelling that still resolves.
  *
  * Bare, not `devflow:`-prefixed: the build writes to `dist/skills/git/…` while
  * the install target is `skills/devflow:git/`. prefixSkillName is what spans that
@@ -162,7 +162,7 @@ const ALLOWED_OUTPUT_DIRS = [
  *
  * Exported so guards assert the build's refusal text against the table itself
  * rather than against a retyped literal: adding a destination then rewrites both
- * the message and its assertion from one edit (PF-018 — the expectation must
+ * the message and its assertion from one edit (the expectation must
  * come from the thing under test, not a copy of it).
  */
 export const ALLOWED_OUTPUT_DIR_NAMES = ALLOWED_OUTPUT_DIRS.map(entry => entry.dir);
@@ -223,7 +223,7 @@ export function resolveOutputDir(root, declared) {
  * reverse alone lets a listed op silently emit nothing.
  *
  * The list is long from its first commit on purpose. A one- or two-element list
- * makes every parity assertion over it vacuous (GAP-42, the PF-018 trap) and is
+ * makes every parity assertion over it vacuous (GAP-42) and is
  * structurally identical to the single-arm conditional AC-1.2 forbids, so
  * expandVariants refuses a pair list below MIN_VARIANT_PAIRS.
  */
@@ -283,8 +283,8 @@ export const TRACKER_GITHUB_OPS = TRACKER_OPS;
  * carries one pointer to each.
  *
  * 9 entries, one above {@link MIN_VARIANT_PAIRS}, which is a floor and not a
- * target: a shorter roster makes every parity assertion over it vacuous (GAP-42,
- * the PF-018 trap) and `expandVariants` refuses the build, so the roster can grow
+ * target: a shorter roster makes every parity assertion over it vacuous (GAP-42)
+ * and `expandVariants` refuses the build, so the roster can grow
  * but never drop below 8. `update-pr-evidence` (#363) is the ninth — it edits the
  * PR body and comments on the PR, both GitHub whatever the tracker is.
  */
@@ -558,7 +558,7 @@ export const MIN_VARIANT_PAIRS = 8;
  * writes.
  *
  * Pure and total: every refusal is a Result, so the build shell keeps its single
- * exit (avoids PF-014). The expansion is deliberately flat rather than nested —
+ * exit. The expansion is deliberately flat rather than nested —
  * one list of destinations is what the plan pass needs to detect two hosts
  * claiming one file, and a nested shape would have to be flattened there anyway.
  *
@@ -642,14 +642,14 @@ export function expandVariants(modules = resolveVariantModules()) {
  * Lives beside the registry it reads rather than in the Claude Code installer that
  * consumes it: nothing about the answer is Claude-Code-specific, and the packaging
  * and containment tests that read it are asking the BUILD what it emits, not
- * asking an install target (applies ADR-013).
+ * asking an install target.
  *
  * Asserts where its siblings return a Result. The registry is a compile-time
  * constant, so a refusal is a programming error rather than an install-time
  * degradation: no caller could sensibly continue, and every caller would otherwise
  * carry the same impossible branch. The full refusal is rendered and not just its
  * `kind` — the payload is what names the offending module and op, and a payload
- * nothing reads is a payload nothing maintains (avoids PF-041). Same rendering the
+ * nothing reads is a payload nothing maintains. Same rendering the
  * build's own refusal sinks use (scripts/build-mds.ts).
  */
 export function generatedReferenceManifest() {
@@ -721,7 +721,7 @@ export const VARIANT_SECTION_MARKER_RE = /^<!-- op: (_?[a-z0-9][a-z0-9._-]{0,63}
  *
  * Bidirectional, and both directions are load-bearing:
  *   - unknown-section — the body carries a section for an op the registry does
- *     not name, so a file would ship that nothing loads (ADR-003);
+ *     not name, so a file would ship that nothing loads;
  *   - missing-section — the registry names an op the body does not cover, so the
  *     preamble's load instruction resolves to nothing at runtime.
  * A forward-only check passes on either half of that pair.