devflow-kit 3.6.0 → 3.8.0

package/src/assets/scripts/hooks/pre-compact-memory

@@ -54,7 +54,7 @@ MEMORY_DIR="$PROJECT_DEVFLOW_DIR/memory"
 source "$SCRIPT_DIR/hook-log-init" "pre-compact-memory"
 
 # Memory gate: the machine switch, narrowed by this checkout's project.json /
-# config.json `features.memory`, read by the helper every memory/learning gate
+# config.json `features.memory`, read by the helper every memory/curation gate
 # shares (D-FEATURES-NARROW-ONLY, see queue-append).
 source "$SCRIPT_DIR/queue-append" || { echo "pre-compact-memory: failed to source queue-append" >&2; exit 1; }
 queue_read_gates "$DEVFLOW_MANIFEST" "$PROJECT_ROOT"
@@ -112,27 +112,18 @@ if cd "$CWD" 2>/dev/null && git rev-parse --git-dir >/dev/null 2>&1; then
   dbg "GIT_BRANCH=$GIT_BRANCH HEAD=$GIT_HEAD_SHA"
 fi
 
-# Snapshot current WORKING-MEMORY.md (preserves session context through compaction).
-# The snapshot goes into the backup the next session start injects, so a working
-# memory a symbolic link leads to is treated as absent (D-HOOKS-NO-SYMLINK).
-MEMORY_SNAPSHOT=""
-if df_file_below "$PROJECT_ROOT" "$MEMORY_DIR/WORKING-MEMORY.md"; then
-  MEMORY_SNAPSHOT=$(head -c 65536 "$MEMORY_DIR/WORKING-MEMORY.md")
-  dbg "MEMORY_SNAPSHOT_LENGTH=${#MEMORY_SNAPSHOT}"
-fi
-
 # Write backup JSON
 # D-BACKUP-RENAME: the backup is written whole into a copy beside it, then
 # renamed over it; it is never truncated and refilled in place. Reason:
-# session-start-memory reads it twice, and a read landing between a truncate
-# and the write that refills it would meet a partial file; a rename hands every
-# read either the previous backup or the new one. SEC-2: the copy is created
+# a read landing between a truncate and the write that refills it would meet a
+# partial file; a rename hands every read either the previous backup or the new
+# one. SEC-2: the copy is created
 # under umask 077, and only where nothing stands at its name: builtin tests come
 # first, so an entry already there, a link to a FIFO or a device included, is
 # never opened (noclobber alone would open one, as no regular file stands there),
 # and noclobber then makes the create itself exclusive. The rename gives the
-# backup the copy's inode and mode, so the backup, which holds the working
-# memory, is 0600 whatever the caller's umask (as in queue-append). A write or
+# backup the copy's inode and mode, so the Git-state backup is 0600 whatever
+# the caller's umask (as in queue-append). A write or
 # rename that fails removes whatever holds the copy's name and keeps the
 # previous backup; the bootstrap below still runs.
 #
@@ -157,7 +148,6 @@ elif [ ! -e "$BACKUP_TMP" ] && [ ! -L "$BACKUP_TMP" ] && (umask 077 && set -o no
     --arg status "$GIT_STATUS" \
     --arg log "$GIT_LOG" \
     --arg diff "$GIT_DIFF_STAT" \
-    --arg memory "$MEMORY_SNAPSHOT" \
     > "$BACKUP_TMP") && mv "$BACKUP_TMP" "$BACKUP_FILE"; then
   log "Wrote backup: $BACKUP_FILE"
   dbg "Wrote backup: $BACKUP_FILE"

package/src/assets/scripts/hooks/queue-append

@@ -6,35 +6,47 @@
 # under a lock. Used by capture-prompt, capture-turn, and capture-question so the
 # per-feature dual-queue-append logic exists in exactly one place.
 #
-# Source-order requirement: source json-parse (for _HAS_JQ) and learning-lock (for
-# learning_lock_acquire/learning_lock_release, which itself requires get-mtime) BEFORE
+# Source-order requirement: source json-parse (for _HAS_JQ) and curation-lock (for
+# curation_lock_acquire/curation_lock_release, which itself requires get-mtime) BEFORE
 # calling queue_append_row or queue_append_both, and define log/dbg. This file
-# sources its sibling git-marker itself, for df_no_symlink_below. Sourcing it only
-# defines functions -- no side effects until they are called.
+# sources its siblings git-marker (for df_no_symlink_below) and curation-move (for the
+# ledger folder's names, df_curation_move_names) itself. Sourcing it only defines
+# functions -- no side effects until they are called.
 #
 # queue_append_row <root> <queue_file> <role> <content> <ts>
 #   Appends one JSONL row {role, content, ts} to <queue_file>, which lies below
-#   <root>: the project root for the memory queue, the ledger root for the learning
+#   <root>: the project root for the memory queue, the ledger root for the curation
 #   queue. When the queue, or a folder between <root> and it, is a symbolic link,
 #   nothing is written: the skip is logged once and the call returns 0, as a
-#   skipped capture does (D-HOOKS-NO-SYMLINK, git-marker). Otherwise it
-#   creates the queue's folder if absent, and the file with mode 0600 (umask 077).
+#   skipped capture does (D-HOOKS-NO-SYMLINK, git-marker). Otherwise it builds the
+#   row first (a row that fails to build writes nothing), then makes one builtin
+#   append under umask 077, so a queue it creates has mode 0600. The umask is the
+#   caller's again when the append returns, so a folder made later in the same hook
+#   has the mode its parent's umask gives. A ledger queue follows the creator rule
+#   (git-marker, df_ledger_queue): it is appended to in the
+#   old learning/ folder while that exists, which is never created here; the new
+#   curation/ folder is created only when the old name is absent. An append that
+#   finds the old folder gone (the one-time move ran meanwhile) looks again and goes
+#   on in the new folder, so a capture never drops a row and never waits. Any other
+#   queue's folder is created if absent.
 #   After appending, truncates from 200 to the newest 100 lines under a lock
-#   (learning_lock_acquire on "<queue_file>.lock", 2s timeout), keeping mode 0600.
+#   (curation_lock_acquire on "<queue_file>.lock", 2s timeout), keeping mode 0600.
 #   The append itself is intentionally lock-free (accepted-class race shared with
 #   the pre-existing memory design -- see the design doc's "Append-vs-claim race"
 #   note).
 #
-# queue_append_both <memory_root> <memory_queue> <learning_root> <learning_queue> <memory_enabled> <learning_enabled> <role> <content> <ts>
-#   Calls queue_append_row for each queue whose *_enabled flag is "true", with the
-#   root that queue lies below. Each queue is gated independently -- callers
-#   compute memory_enabled/learning_enabled themselves (see queue_read_gates below
-#   for the at-most-one-fork read of both).
+# queue_append_both <memory_root> <memory_queue> <curation_root> <curation_queue> <memory_enabled> <curation_enabled> <role> <content> <ts>
+#   Builds the row once, then appends it as queue_append_row does to each queue whose
+#   *_enabled flag is "true", with the root that queue lies below. Each queue is gated
+#   independently -- callers compute memory_enabled/curation_enabled themselves (see
+#   queue_read_gates below for the at-most-one-fork read of both). With neither queue
+#   enabled it builds nothing.
 #
 # queue_read_gates <manifest_path> [<root>]
-#   Reads BOTH switches, `memory` and `learning`, in at most ONE subprocess fork
+#   Reads BOTH switches, `memory` and `curation` (curation is read under both of
+#   its keys, the current one and the pre-rename copy), in at most ONE subprocess fork
 #   (AC-P1 -- at most one gate-read fork per capture hook, not two; none when
-#   the fast paths settle it). Sets _QG_MEMORY and _QG_LEARNING ("true"/"false")
+#   the fast paths settle it). Sets _QG_MEMORY and _QG_CURATION ("true"/"false")
 #   in the caller's scope. The two values are newline-separated
 #   rather than using a control-character delimiter: they are always the literal
 #   strings "true"/"false", never arbitrary content, so a plain newline split is
@@ -44,35 +56,43 @@
 #   machine switch is on AND neither repository file sets `features.<name>` to
 #   the literal `false` -- the rule resolve-settings.cjs folds, held to the same
 #   answers by the shared table tests/fixtures/settings-switch-table.ts (TP-49).
-#   A repository can switch memory or learning off for itself, never back on.
+#   A repository can switch memory or curation off for itself, never back on.
 #     machine   <manifest_path>, the ~/.devflow/manifest.json `devflow init` and
-#               `devflow memory|learning --enable/--disable` write. Only an
+#               `devflow memory|curation --enable/--disable` write. Only an
 #               explicit boolean `false` switches a feature off -- an absent,
 #               unreadable or malformed manifest, a missing key, or a non-boolean
 #               value leaves it ON (fail-open), the rule
 #               isMachineFeatureOn() applies in the CLI.
 #     project   <root>/.devflow/project.json (team-committed) and
 #     personal  <root>/.devflow/config.json (this worktree's own), read ONLY under
-#               `features.memory` / `features.learning`. The retired top-level
-#               keys (`memory`, `learning`, `decisions`) and `features.decisions`
-#               narrow nothing (#378: reading them let a feature run in every repo
-#               but one). An invalid file -- unparseable, over 4096 bytes, a BOM,
-#               a symlink, a duplicated key -- narrows nothing.
+#               `features.memory` and, for curation, `features.curation` or
+#               `features.learning` (a narrow-only union: a literal false in
+#               either key turns curation off, and each key is parsed on its
+#               own). The retired top-level keys (`memory`, `curation`,
+#               `learning`, `decisions`) and `features.decisions` narrow nothing
+#               (#378: reading them let a feature run in every repo but one). An
+#               invalid file -- unparseable, over 4096 bytes, a BOM, a symlink, a
+#               duplicated key -- narrows nothing.
 #   <root> is the checkout's toplevel (DF_ROOT, which every caller holds as
-#   $PROJECT_ROOT), for learning too: project.json is committed per branch and
+#   $PROJECT_ROOT), for curation too: project.json is committed per branch and
 #   config.json lives per worktree, so both are read where the session runs, as
 #   resolve-settings.cjs reads them -- never at DF_LEDGER_ROOT, which only says
 #   where the queue lands. Without <root> (or with an empty one) no repository
 #   file is read.
 #
-#   D-LEARNING-LEGACY-DECISIONS: in the MANIFEST only, learning reads
-#   `features.learning` when it is a boolean, else the pre-rename
-#   `features.decisions` -- readManifest's migration precedence
-#   exactly, so a legacy `decisions: false` switches learning off before any
-#   command has healed the file. Only a boolean `false` in whichever key decides
-#   is off, as above.
+#   The machine rule for curation (#529), the one isMachineFeatureOn() applies:
+#   off when `features.curation` or `features.learning` is a boolean false; else
+#   on when either is a boolean true; else, when neither is a boolean, the
+#   pre-rename `features.decisions` decides if it is a boolean; else on. A
+#   non-boolean value is ignored for that key only, so a disagreeing pair
+#   resolves to off.
 #
-#   Every hook that gates on memory or learning reads it through here: the
+#   D-LEARNING-LEGACY-DECISIONS: in the MANIFEST only, the pre-rename
+#   `features.decisions` is read when neither current key is a boolean --
+#   readManifest's migration precedence exactly, so a legacy `decisions: false`
+#   switches curation off before any command has healed the file.
+#
+#   Every hook that gates on memory or curation reads it through here: the
 #   capture hooks, session-start-context (Sections 1-2), memory-worker,
 #   session-start-memory, pre-compact-memory and background-memory-update. The
 #   callers pass <manifest_path> as $HOME/.devflow/manifest.json, the machine
@@ -81,80 +101,179 @@
 
 # queue_append_row checks its queue with df_no_symlink_below, so this helper sources
 # git-marker itself rather than trusting every caller to have done so first. One that
-# failed to source is a command not found: the refusing branch, so nothing is written.
-source "${BASH_SOURCE[0]%/*}/git-marker" 2>/dev/null || true
+# is missing is a command not found: the refusing branch, so nothing is written.
+# The ledger folder's names come from the move shim (df_curation_move_names), sourced
+# the same way and refused the same way.
+#
+# Each source is guarded by a builtin readability test, because bash 3.2 under `set -e`
+# ends the shell at a `source` of a missing file, even inside `|| true`. Without the test
+# the refusing branch would never run, and the capture hooks would stop here.
+[ -r "${BASH_SOURCE[0]%/*}/git-marker" ] && source "${BASH_SOURCE[0]%/*}/git-marker" 2>/dev/null || true
+[ -r "${BASH_SOURCE[0]%/*}/curation-move" ] && source "${BASH_SOURCE[0]%/*}/curation-move" 2>/dev/null || true
 
-queue_append_row() {
-  local _qar_root="$1" _qar_file="$2" _qar_role="$3" _qar_content="$4" _qar_ts="$5"
+# The caller's umask, read once per process. A queue is created 0600, so the append
+# runs under umask 077 -- and the rest of the hook must run under the umask its parent
+# gave it, or a folder the next append makes would be 0700. `$(umask)` is one subshell
+# with no exec, and it runs on the first append only; each append gives this value
+# back, so the umask the process holds when it first appends is the one it keeps.
+_QAR_UMASK=""
+
+# _qar_build_row <role> <content> <ts> -- sets _QAR_ROW to the JSONL row, built by jq
+# (--arg, --argjson) or node (JSON.stringify), never by string concatenation. A
+# predicate: it succeeds only for a row that built, and a row that fails to build is
+# empty, so nothing partial can reach a queue. Call it in an `if` or an `||` list.
+_qar_build_row() {
+  _QAR_ROW=""
+  if [ "$_HAS_JQ" = "true" ]; then
+    _QAR_ROW=$(jq -n -c --arg role "$1" --arg content "$2" --argjson ts "$3" \
+      '{role: $role, content: $content, ts: $ts}') || _QAR_ROW=""
+  else
+    _QAR_ROW=$(node -e "process.stdout.write(JSON.stringify({role:process.argv[1],content:process.argv[2],ts:parseInt(process.argv[3])}))" \
+      -- "$1" "$2" "$3") || _QAR_ROW=""
+  fi
+  if [ -z "$_QAR_ROW" ]; then
+    log "Queue skipped: the row could not be built; nothing written"
+    return 1
+  fi
+  return 0
+}
+
+# _qar_write <queue_file> <row> -- one builtin append, under umask 077 so a queue it
+# creates has mode 0600 (SEC-2). The umask is the caller's again before it returns,
+# whether the append worked or not. The redirection error is silenced by 2>/dev/null
+# written BEFORE it. A predicate: it fails when the row was not written.
+_qar_write() {
+  local _qar_status=0
+  umask 077
+  printf '%s\n' "$2" 2>/dev/null >> "$1" || _qar_status=1
+  umask "$_QAR_UMASK" 2>/dev/null || true
+  return "$_qar_status"
+}
+
+# _qar_append <root> <queue_file> <row> -- appends <row> to <queue_file>, which lies
+# below <root>, and sets _QAR_FILE to the queue it reached (the old ledger folder, or
+# the new one after a move). A predicate: it fails when nothing was written -- a link on
+# the path (D-HOOKS-NO-SYMLINK: the skip is logged once) or a queue that could not be
+# written -- and a skipped capture is not an error for the hook.
+_qar_append() {
+  local _qar_root="$1" _qar_file="$2" _qar_row="$3"
+  local _qar_given="$2" _qar_old="" _qar_new=""
+  _QAR_FILE=""
+
+  # The names the creator rule below needs. A shim that failed to source is a command
+  # not found, so nothing is appended: no queue is written without them.
+  if ! df_curation_move_names 2>/dev/null; then
+    log "Queue skipped: the ledger folder names are unavailable; nothing written"
+    return 1
+  fi
+  _qar_old="$DF_CM_OLD_FOLDER"
+  _qar_new="$DF_CM_NEW_FOLDER"
+
+  # The creator rule (git-marker, df_ledger_queue): a ledger queue is appended to in
+  # the old folder while that folder is present, so a new name never hides an old
+  # ledger. Any other queue (the memory queue) comes back unchanged. A helper that
+  # failed to source is a command not found, so the queue stays as given and the
+  # check below, from the same library, refuses it.
+  if df_ledger_queue "$_qar_file" "$_qar_old" "$_qar_new"; then _qar_file="$DF_LEDGER_QUEUE"; fi
 
   # D-HOOKS-NO-SYMLINK (git-marker): a skipped append is a skipped capture.
   if ! df_no_symlink_below "$_qar_root" "$_qar_file"; then
     log "Queue skipped: a symbolic link sits on the path to $_qar_file; nothing written"
-    return 0
+    return 1
   fi
-  mkdir -p "${_qar_file%/*}" 2>/dev/null || true
 
-  if [ ! -f "$_qar_file" ]; then
-    (umask 077 && touch "$_qar_file") 2>/dev/null || true
-  fi
+  # A folder is made only where this append is its creator: never the old ledger
+  # folder, which a move may rename away at any moment, and which a make-again would
+  # bring back beside the new one. An old folder that is gone leaves the append to
+  # fail, and the re-probe below decides again. A folder is made under the caller's
+  # umask: only the write below runs under 077.
+  case "${_qar_file%/*}" in
+    */"$_qar_old") ;;
+    *) mkdir -p "${_qar_file%/*}" 2>/dev/null || true ;;
+  esac
 
-  if [ "$_HAS_JQ" = "true" ]; then
-    jq -n -c --arg role "$_qar_role" --arg content "$_qar_content" --argjson ts "$_qar_ts" \
-      '{role: $role, content: $content, ts: $ts}' >> "$_qar_file"
-  else
-    node -e "process.stdout.write(JSON.stringify({role:process.argv[1],content:process.argv[2],ts:parseInt(process.argv[3])})+String.fromCharCode(10))" \
-      -- "$_qar_role" "$_qar_content" "$_qar_ts" >> "$_qar_file"
+  if [ -z "$_QAR_UMASK" ]; then _QAR_UMASK=$(umask) || _QAR_UMASK=""; fi
+  if ! _qar_write "$_qar_file" "$_qar_row"; then
+    # The old folder may have been moved after the probe. Look again: when the old
+    # name is gone, the creator makes the new folder once and the row goes there.
+    df_ledger_queue "$_qar_given" "$_qar_old" "$_qar_new" || true
+    if [ "$DF_LEDGER_QUEUE" != "$_qar_file" ] \
+      && df_no_symlink_below "$_qar_root" "$DF_LEDGER_QUEUE" \
+      && mkdir -p "${DF_LEDGER_QUEUE%/*}" 2>/dev/null \
+      && _qar_write "$DF_LEDGER_QUEUE" "$_qar_row"; then
+      _qar_file="$DF_LEDGER_QUEUE"
+    else
+      log "Queue append failed: $_qar_file could not be written"
+      return 1
+    fi
   fi
+  _QAR_FILE="$_qar_file"
+  return 0
+}
 
-  # Overflow safety: >200 lines -> keep newest 100, locked to prevent a multi-session race.
-  if [ -f "$_qar_file" ]; then
-    local _qar_lines
-    _qar_lines=$(wc -l < "$_qar_file" | tr -d ' ')
-    if [ "$_qar_lines" -gt 200 ]; then
-      local _qar_lock="${_qar_file}.lock"
-      if learning_lock_acquire "$_qar_lock" 2; then
-        _qar_lines=$(wc -l < "$_qar_file" | tr -d ' ')
-        if [ "$_qar_lines" -gt 200 ]; then
-          local _qar_tmp="${_qar_file}.tmp.$$"
-          # SEC-2: the trimmed copy is created under umask 077, so the renamed
-          # queue keeps mode 0600. mv replaces the inode, so the queue takes the
-          # copy's mode, and a chmod after the mv would leave a window. The copy is
-          # created only where nothing stands at its name: builtin tests come first,
-          # so an entry already there, a link to a FIFO or a device included, is
-          # never opened (noclobber alone would open one, as no regular file stands
-          # there), and noclobber then makes the create itself exclusive. Such an
-          # entry is removed instead, and the trim waits for a later append.
-          if [ ! -e "$_qar_tmp" ] && [ ! -L "$_qar_tmp" ] && (umask 077 && set -o noclobber && tail -100 "$_qar_file" > "$_qar_tmp") && mv "$_qar_tmp" "$_qar_file"; then
-            log "Queue overflow: truncated from $_qar_lines to 100 lines ($(basename "$_qar_file"))"
-            dbg "Queue overflow: truncated from $_qar_lines to 100 lines ($_qar_file)"
-          else
-            rm -f "$_qar_tmp" 2>/dev/null || true
-            log "Queue overflow: not truncated, its copy could not be written ($(basename "$_qar_file"))"
-          fi
+# _qar_trim_overflow <queue_file> -- overflow safety: past 200 lines, keep the newest
+# 100, locked to prevent a multi-session race.
+_qar_trim_overflow() {
+  local _qar_file="$1" _qar_lines="" _qar_lock="" _qar_tmp=""
+  [ -f "$_qar_file" ] || return 0
+  _qar_lines=$(wc -l < "$_qar_file" | tr -d ' ')
+  if [ "$_qar_lines" -gt 200 ]; then
+    _qar_lock="${_qar_file}.lock"
+    if curation_lock_acquire "$_qar_lock" 2; then
+      _qar_lines=$(wc -l < "$_qar_file" | tr -d ' ')
+      if [ "$_qar_lines" -gt 200 ]; then
+        _qar_tmp="${_qar_file}.tmp.$$"
+        # SEC-2: the trimmed copy is created under umask 077, so the renamed
+        # queue keeps mode 0600. mv replaces the inode, so the queue takes the
+        # copy's mode, and a chmod after the mv would leave a window. The copy is
+        # created only where nothing stands at its name: builtin tests come first,
+        # so an entry already there, a link to a FIFO or a device included, is
+        # never opened (noclobber alone would open one, as no regular file stands
+        # there), and noclobber then makes the create itself exclusive. Such an
+        # entry is removed instead, and the trim waits for a later append.
+        if [ ! -e "$_qar_tmp" ] && [ ! -L "$_qar_tmp" ] && (umask 077 && set -o noclobber && tail -100 "$_qar_file" > "$_qar_tmp") && mv "$_qar_tmp" "$_qar_file"; then
+          log "Queue overflow: truncated from $_qar_lines to 100 lines ($(basename "$_qar_file"))"
+          dbg "Queue overflow: truncated from $_qar_lines to 100 lines ($_qar_file)"
+        else
+          rm -f "$_qar_tmp" 2>/dev/null || true
+          log "Queue overflow: not truncated, its copy could not be written ($(basename "$_qar_file"))"
         fi
-        learning_lock_release "$_qar_lock"
       fi
+      curation_lock_release "$_qar_lock"
     fi
   fi
+  return 0
+}
+
+queue_append_row() {
+  _qar_build_row "$3" "$4" "$5" || return 0
+  if _qar_append "$1" "$2" "$_QAR_ROW"; then _qar_trim_overflow "$_QAR_FILE"; fi
+  return 0
 }
 
 queue_append_both() {
   local _qab_memory_root="$1" _qab_memory_queue="$2"
-  local _qab_learning_root="$3" _qab_learning_queue="$4"
-  local _qab_memory_enabled="$5" _qab_learning_enabled="$6"
-  local _qab_role="$7" _qab_content="$8" _qab_ts="$9"
+  local _qab_curation_root="$3" _qab_curation_queue="$4"
+  local _qab_memory_enabled="$5" _qab_curation_enabled="$6"
+  local _qab_role="$7" _qab_content="$8" _qab_ts="$9" _qab_row=""
+
+  if [ "$_qab_memory_enabled" != "true" ] && [ "$_qab_curation_enabled" != "true" ]; then return 0; fi
+  # One row for both queues: it is built once, and each enabled queue takes the same line.
+  _qar_build_row "$_qab_role" "$_qab_content" "$_qab_ts" || return 0
+  _qab_row="$_QAR_ROW"
 
   if [ "$_qab_memory_enabled" = "true" ]; then
-    queue_append_row "$_qab_memory_root" "$_qab_memory_queue" "$_qab_role" "$_qab_content" "$_qab_ts"
+    if _qar_append "$_qab_memory_root" "$_qab_memory_queue" "$_qab_row"; then _qar_trim_overflow "$_QAR_FILE"; fi
   fi
-  if [ "$_qab_learning_enabled" = "true" ]; then
-    queue_append_row "$_qab_learning_root" "$_qab_learning_queue" "$_qab_role" "$_qab_content" "$_qab_ts"
+  if [ "$_qab_curation_enabled" = "true" ]; then
+    if _qar_append "$_qab_curation_root" "$_qab_curation_queue" "$_qab_row"; then _qar_trim_overflow "$_QAR_FILE"; fi
   fi
+  return 0
 }
 
 # _qg_repo_file_can_narrow <file> -- succeeds when <file> COULD set
-# features.memory or features.learning to false, so only the parser can decide
-# it; fails when it certainly cannot. Builtins only: no fork.
+# features.memory, features.curation or features.learning to false, so only the
+# parser can decide it; fails when it certainly cannot. Builtins only: no fork.
 #
 # D-GATES-FAST-PATH (repository files): the read is bounded -- `-n 4097`, which
 # bash 3.2 supports -- and `read -d ''` succeeds only when it stops short of the
@@ -164,14 +283,14 @@ queue_append_both() {
 # symlink and refuses a directory or FIFO, so nothing here can block; the parser
 # itself refuses the symlink. A `\u` escape is the only JSON spelling of a
 # letter other than the letter itself, so without one a narrowing file shows
-# `"features"`, then `{`, then `"memory"` or `"learning"`, then `false`,
-# literally and in that order. `.` spans newlines (POSIX ERE without
+# `"features"`, then `{`, then `"memory"`, `"curation"` or `"learning"`, then
+# `false`, literally and in that order. `.` spans newlines (POSIX ERE without
 # REG_NEWLINE), so the match can only over-report -- an over-report costs one
 # fork and the parser's answer, never a wrong one. No `"decisions"` and no
 # top-level key before `features` is ever matched.
 _qg_repo_file_can_narrow() {
   local _qgf_text=""
-  local _qgf_re='"features"[[:space:]]*:[[:space:]]*[{].*"(memory|learning)"[[:space:]]*:[[:space:]]*false'
+  local _qgf_re='"features"[[:space:]]*:[[:space:]]*[{].*"(memory|curation|learning)"[[:space:]]*:[[:space:]]*false'
   [ -f "$1" ] || return 1
   if IFS= read -r -d '' -n 4097 _qgf_text 2>/dev/null < "$1"; then return 1; fi
   case "$_qgf_text" in *'\u'*) return 0 ;; esac
@@ -180,22 +299,24 @@ _qg_repo_file_can_narrow() {
 
 queue_read_gates() {
   local _qg_manifest="${1:-}" _qg_root="${2:-}" _qg_text="" _qg_parse="false" _qg_repo="false" _qg_fields=""
+  local _qg_scripts="${BASH_SOURCE[0]%/*}/.."
   _QG_MEMORY="true"
-  _QG_LEARNING="true"
+  _QG_CURATION="true"
 
   if [ -n "$_qg_manifest" ] && [ -f "$_qg_manifest" ]; then
     # D-GATES-FAST-PATH: every capture hook and every session start pays this
     # read, and on most machines both switches are on. Only a JSON boolean
-    # `false` under a "memory", "learning" or "decisions" key can switch anything
-    # off, and a `\u` escape is the only JSON spelling of a letter other than the
-    # letter itself, so without one such a key appears literally. A text holding
-    # no `\u` and no key-then-`false` sequence therefore cannot switch anything
-    # off -- valid or not, it reads both-on either way -- and is settled by shell
-    # builtins (read, case, [[ =~ ]]) with no jq/node fork; everything else takes
-    # the full parse below. `read -d ''` succeeds only on reaching a NUL byte,
-    # i.e. before the end of the file, so a text it cut short is parsed in full
-    # too. An unreadable file reads empty and fails open, as the parser would.
-    local _qg_re='"(memory|learning|decisions)"[[:space:]]*:[[:space:]]*false'
+    # `false` under a "memory", "curation", "learning" or "decisions" key can
+    # switch anything off, and a `\u` escape is the only JSON spelling of a
+    # letter other than the letter itself, so without one such a key appears
+    # literally. A text holding no `\u` and no key-then-`false` sequence
+    # therefore cannot switch anything off -- valid or not, it reads both-on
+    # either way -- and is settled by shell builtins (read, case, [[ =~ ]]) with
+    # no jq/node fork; everything else takes the full parse below. `read -d ''`
+    # succeeds only on reaching a NUL byte, i.e. before the end of the file, so a
+    # text it cut short is parsed in full too. An unreadable file reads empty
+    # and fails open, as the parser would.
+    local _qg_re='"(memory|curation|learning|decisions)"[[:space:]]*:[[:space:]]*false'
     IFS= read -r -d '' _qg_text 2>/dev/null < "$_qg_manifest" && _qg_parse="true"
     case "$_qg_text" in *'\u'*) _qg_parse="true" ;; esac
     if [[ $_qg_text =~ $_qg_re ]]; then _qg_parse="true"; fi
@@ -216,7 +337,7 @@ queue_read_gates() {
     # manifest too, read only when the fast path above flagged it (an unflagged
     # manifest is both-on), so a false in all three layers still costs one fork.
     # jq cannot see duplicate keys, so this path is node whatever _HAS_JQ says.
-    local _qg_scripts="${BASH_SOURCE[0]%/*}/.." _qg_manifest_arg=""
+    local _qg_manifest_arg=""
     [ "$_qg_parse" = "true" ] && _qg_manifest_arg="$_qg_manifest"
     _qg_fields=$(node -e "
       const S = require(require('path').resolve(process.argv[1], 'resolve-settings.cjs'));
@@ -225,7 +346,7 @@ queue_read_gates() {
         try { m = JSON.parse(require('fs').readFileSync(process.argv[2], 'utf8')); } catch (_) { m = undefined; }
       }
       const w = S.foldSettings(Object.assign({ manifest: m }, S.readRepoLayers(process.argv[3]))).switches;
-      process.stdout.write(String(w.memory.on) + String.fromCharCode(10) + String(w.learning.on));
+      process.stdout.write(String(w.memory.on) + String.fromCharCode(10) + String(w.curation.on));
     " -- "$_qg_scripts" "$_qg_manifest_arg" "$_qg_root" 2>/dev/null) || _qg_fields=""
   fi
 
@@ -237,20 +358,24 @@ queue_read_gates() {
       # `try` covers a manifest whose top level or `features` is not an object; a
       # parse failure empties the output, which reads as "not switched off". The
       # comma produces two raw-output lines (newline-separated) in one jq process.
+      # Curation (#529): off when a boolean curation or learning is false; else,
+      # when neither is a boolean, off when decisions is false (isMachineFeatureOn).
       _qg_fields=$(jq -r '
         (if (try .features.memory catch null) == false then "false" else "true" end),
-        (if (try (.features | if (.learning | type) == "boolean" then .learning else .decisions end) catch null) == false
+        (if (try (.features
+            | ([.curation, .learning] | map(select(type == "boolean"))) as $c
+            | if ($c | length) > 0 then any($c[]; . == false) else .decisions == false end
+          ) catch false)
           then "false" else "true" end)
       ' "$_qg_manifest" 2>/dev/null) || _qg_fields=""
     else
+      # No jq: the fold is the resolver's own machineSwitchOn (resolve-settings.cjs),
+      # so the machine rule is not copied here. One node fork, as for jq's one process.
       _qg_fields=$(node -e "
+        const S = require(require('path').resolve(process.argv[2], 'resolve-settings.cjs'));
         const m = JSON.parse(require('fs').readFileSync(process.argv[1], 'utf8'));
-        const f = m !== null && typeof m === 'object' ? m.features : undefined;
-        const isObj = f !== null && typeof f === 'object';
-        const on = (k) => !(isObj && f[k] === false);
-        const learnKey = isObj && typeof f.learning !== 'boolean' ? 'decisions' : 'learning';
-        process.stdout.write(String(on('memory')) + String.fromCharCode(10) + String(on(learnKey)));
-      " -- "$_qg_manifest" 2>/dev/null) || _qg_fields=""
+        process.stdout.write(String(S.machineSwitchOn(m, 'memory')) + String.fromCharCode(10) + String(S.machineSwitchOn(m, 'curation')));
+      " -- "$_qg_manifest" "$_qg_scripts" 2>/dev/null) || _qg_fields=""
     fi
   fi
 
@@ -258,7 +383,7 @@ queue_read_gates() {
   case "$_qg_fields" in
     true$'\n'true|true$'\n'false|false$'\n'true|false$'\n'false)
       _QG_MEMORY="${_qg_fields%%$'\n'*}"
-      _QG_LEARNING="${_qg_fields#*$'\n'}"
+      _QG_CURATION="${_qg_fields#*$'\n'}"
       ;;
   esac
 

package/src/assets/scripts/hooks/resolve-project-root

@@ -8,7 +8,7 @@
 # root, mirroring the TS CLI's getGitRoot() (src/core/git.ts) so the shell
 # side anchors identically.
 #
-# Sourced by: the memory/learning/session hooks and ensure-devflow-init.
+# Sourced by: the memory/curation/session hooks and ensure-devflow-init.
 # Sourced helper: uses `return`-free pure functions; _-prefixed locals (never
 # clobbers caller vars). Safe under `set -e` (git failure is guarded with || true).
 #
@@ -53,7 +53,7 @@ _df_nongit_root() {
 # df_resolve_roots <cwd> sets TWO roots in the caller's scope, from ONE git call:
 #   DF_ROOT        — the checkout's toplevel: where per-checkout data lives
 #                    (memory, the .gitignore carve-out, the knowledge bases).
-#   DF_LEDGER_ROOT — where the learning ledger and its queue live.
+#   DF_LEDGER_ROOT — where the curation ledger and its queue live.
 #
 # D-LEDGER-MAIN-WORKTREE: a linked worktree (`git worktree add`, `claude
 # --worktree`) has its own toplevel, so a ledger anchored there restarts its