devflow-kit 3.6.0 → 3.8.0

package/dist/cli/commands/init.js

@@ -8,7 +8,12 @@ import { resolveInstallationPaths } from '../../targets/claude-code/claude-paths
 import { getGitRoot } from '../../core/git.js';
 import { isSameLocation, withoutHomeRoots } from '../../core/same-location.js';
 import { pruneHookLogDirs, MAX_HOOK_LOG_DIRS } from '../../core/hook-log-dirs.js';
-import { getLedgerRoot } from '../../core/ledger-root.js';
+import { LEDGER_ROOT_TIMEOUT_MS, lookupLedgerRoot } from '../../core/ledger-root.js';
+import { formatCurationStoreUnavailable } from '../../core/curation-store.js';
+import { loadCurationMove } from '../../core/curation-move.js';
+import { describeMoveText, describeOutcome, runInitCurationMove, shownSkipAt } from './curation-move-step.js';
+import { realGlobalTuningMoveIO, realProjectLedgerMoveIO } from './curation-move-io.js';
+import { describeEchoedValue } from '../../core/echo-value.js';
 import { installViaFileCopy, composeScripts } from '../../targets/claude-code/installer.js';
 import { formatOverlaySummary, formatSkillScopeSummary, formatTrackerAssetSummary, isPluginListUnchanged } from './install-report.js';
 import { convergeTrackerArtifacts } from '../../targets/claude-code/tracker-install.js';
@@ -18,7 +23,7 @@ import { LEGACY_SKILL_NAMES } from '../../targets/claude-code/legacy.js';
 import { detectPlatform, detectShell, getProfilePath, getSafeDeleteInfo, hasSafeDelete } from '../../core/safe-delete.js';
 import { generateSafeDeleteBlock, installToProfile, removeFromProfile, getInstalledVersion, SAFE_DELETE_BLOCK_VERSION } from '../../core/safe-delete-install.js';
 import { convergeAmbientHooks } from './ambient.js';
-import { convergeMemoryHooks, drainMemoryQueue } from './memory.js';
+import { convergeMemoryHooks, drainMemoryQueue, workingMemoryNote } from './memory.js';
 import { addCaptureHooks, removeCaptureHooks } from './capture.js';
 import { removeDreamHook } from './legacy-hooks.js';
 import { addProxyHooks, removeProxyHooks, applyProxyEnv, stripProxyEnv, runProxyPreflight, buildRealPreflightDeps } from './proxy.js';
@@ -33,7 +38,7 @@ import { convergeFlagsIntoSettings, countActiveFlags, readViewMode } from '../..
 import { addContextHook, removeContextHook, hasContextHook } from './context.js';
 import { writeSettingsFileAtomic } from '../../core/fs-atomic.js';
 import { writeManagedConfig, readConfigIfPresent, DEFAULT_CONFIG } from '../../core/feature-config.js';
-import { drainLearningQueue } from '../../core/learning-queue-cleanup.js';
+import { drainDisabledCurationQueue, formatCurationNotDrained } from '../../core/curation-queue-cleanup.js';
 import { formatRefusedDrain } from '../../core/queue-drain.js';
 import { removeManagedDenyList, describeManagedDenyRemoval } from './security.js';
 import { resolveInitSeed, applyCliToggles, resolveResetGatedInputs, resolvePluginsToInstall } from './init-seed.js';
@@ -43,9 +48,10 @@ import { shouldRunBehaviorStep, runBehaviorStep, buildClackBehaviorPrompts } fro
 import { convergeBehaviorFromManifest } from '../../targets/claude-code/behavior-install.js';
 import { applyTrackerSentinel, effectiveTrackerServers, parseTrackerId, rearmTrackerInference, DEFAULT_TRACKER_PROVIDER, } from '../../core/tracker.js';
 import { formatTrackerSummary, shouldRunTrackerStep, runTrackerStep, buildClackTrackerPrompts, } from './tracker-prompts.js';
+import { buildClackGateLevelPrompts, carriedGateLevel, formatGateLevelRow, formatGateLevelSummary, readStoredGateLevel, resolveGateLevelForInit, resolveGateLevelInitState, } from './gate-level-prompts.js';
 import { shouldRunAttributionStep, runAttributionStep, buildClackAttributionPrompts, applyAttributionAnswer, attributionSeedFrom, } from './attribution-prompts.js';
 import { convergeFromManifest } from '../../targets/claude-code/compliance-install.js';
-import { convergeLearningVariants } from '../../targets/claude-code/learning-install.js';
+import { convergeCurationVariants, installedVersionMatches, readRunningVersion } from '../../targets/claude-code/curation-install.js';
 import { auditAndRecordClaudeMd, formatClaudeMdAuditNote, formatClaudeMdAuditUnavailable, } from '../../core/claude-md-audit.js';
 import * as os from 'os';
 // Re-export pure functions for tests (canonical source is post-install.ts)
@@ -67,7 +73,7 @@ import { getPackageRoot } from '../../core/paths.js';
  *      migrations are vacuously applied per D37 semantics).
  *
  * Migrations are a one-time cleanup pass over ~/.devflow runtime data
- * (memory, learning, knowledge). They never touch the installer's
+ * (memory, curation, knowledge). They never touch the installer's
  * copy targets (skills, agents, rules, commands, scripts), so ordering
  * relative to installViaFileCopy carries no data dependency.
  *
@@ -427,9 +433,73 @@ export async function persistManifestThenConvergeTracker(opts) {
     };
 }
 /**
- * Drain this repo's memory and learning queues for each feature init switched
+ * The curation move step (#529): rename the global tuning file, then move each target
+ * project's ledger folder from the old name to the new one. The targets are the
+ * discovered projects (else the current repository) plus the current repository's own
+ * ledger root, which the step lists once. State-checked on every run, with no run-once
+ * record. Never throws: a project that cannot move is a line, not an exit code.
+ *
+ * Init runs it after the legacy sweep and BEFORE the manifest is persisted and the
+ * disabled-feature queues drain, so the drain sees the moved folder.
+ *
+ * The own ledger root is looked up within the shared budget (`lookupOwnLedgerRoot`). A
+ * lookup that times out is no ledger root: the step moves the other targets, and one
+ * skipped line names the repository, unless the repository is itself a project root,
+ * where the step's own lookup reports it.
+ */
+export async function moveCurationData(opts, lookup = lookupLedgerRoot) {
+    const loaded = loadCurationMove();
+    const roots = projectRoots([...opts.discoveredProjects], opts.gitRoot);
+    const own = await lookupOwnLedgerRoot(opts.gitRoot, lookup);
+    const report = await runInitCurationMove({
+        projectRoots: roots,
+        ownLedgerRoot: own.root,
+        homeDir: opts.homeDir,
+        machineDir: opts.devflowDir,
+    }, {
+        ledger: loaded.ok ? realProjectLedgerMoveIO(loaded.value) : { unavailable: formatCurationStoreUnavailable(loaded.error) },
+        tuning: realGlobalTuningMoveIO(),
+    });
+    if (!own.timedOut || opts.gitRoot === null || roots.includes(opts.gitRoot))
+        return report;
+    const skipped = describeOutcome({ kind: 'skipped', root: opts.gitRoot, reason: 'git-root-timed-out' });
+    return { ...report, lines: [...report.lines, ...skipped] };
+}
+/**
+ * The ledger root of the current repository for init's own move and drain
+ * (D-LEDGER-MAIN-WORKTREE): one lookup from the working directory, bounded by
+ * LEDGER_ROOT_TIMEOUT_MS like the HUD's and the step's lookups, so a repository on a
+ * hung mount costs a bounded wait and never stalls init. A lookup that timed out is no
+ * root (`root` null, `timedOut` true), so the caller acts on nothing and says so.
+ * Outside a git repository (`gitRoot` null) nothing is asked.
+ */
+export async function lookupOwnLedgerRoot(gitRoot, lookup = lookupLedgerRoot) {
+    if (gitRoot === null)
+        return { root: null, timedOut: false };
+    const found = await lookup(undefined, { timeoutMs: LEDGER_ROOT_TIMEOUT_MS });
+    return { root: found.kind === 'root' ? found.root : null, timedOut: found.kind === 'timed-out' };
+}
+/**
+ * The ledger root init's disabled-feature drain acts on, and the one line to print when
+ * there is none because git did not answer in time. Asks only when the drain can run: curation
+ * is off, in a git repository, and the manifest holding the switch was written. With curation
+ * on there is nothing to drain, and with no manifest written the drain does not run, so a
+ * line that says it was not drained for want of the root would name the wrong cause.
+ */
+export async function lookupDrainLedgerRoot(opts, lookup = lookupLedgerRoot) {
+    if (opts.curationEnabled || opts.gitRoot === null || !opts.manifestWritten)
+        return { ledgerRoot: null, warning: null };
+    const own = await lookupOwnLedgerRoot(opts.gitRoot, lookup);
+    const warning = own.timedOut
+        ? `The curation queue was not drained for ${describeMoveText(opts.gitRoot)}: git did not answer in time. The next init tries again.`
+        : null;
+    return { ledgerRoot: own.root, warning };
+}
+/**
+ * Drain this repo's memory and curation queues for each feature init switched
  * off, so stale turns are not processed on a future re-enable — the same drains
- * `devflow memory --disable` and `devflow learning --disable` perform. Other
+ * `devflow memory --disable` and `devflow curation --disable` perform (the curation
+ * drain also removes the pending rows of the backups a move left). Other
  * repos' queues are inert: every gate reads the machine-wide switch, so nothing
  * appends to or processes them while the feature is off.
  *
@@ -442,13 +512,18 @@ export async function persistManifestThenConvergeTracker(opts) {
  * everywhere, so its queue is live and is left alone.
  *
  * D-LEDGER-MAIN-WORKTREE: each queue drains where the hooks write it — memory at
- * this checkout's toplevel (`gitRoot`), learning at the ledger root (`ledgerRoot`,
- * getLedgerRoot), which in a linked worktree is the main checkout.
+ * this checkout's toplevel (`gitRoot`), curation at the ledger root (`ledgerRoot`,
+ * lookupOwnLedgerRoot), which in a linked worktree is the main checkout.
  *
  * Returns one warning for each drain refused because a folder on the way to its
- * queue is a symbolic link (D-CLI-NO-SYMLINK); the caller prints them.
+ * queue is a symbolic link (D-CLI-NO-SYMLINK), one for a curation drain that
+ * could not list the backups (the live queue is drained then), and one for a curation
+ * drain that left the project alone because git tracks a data folder or did not answer
+ * (the fixed notice of a skipped move); the caller prints them. When the move step has
+ * printed that notice for the ledger root (`shownSkip`, its reason), the drain's line
+ * does not repeat it.
  */
-export async function drainDisabledFeatureQueues(opts, io = { drainMemoryQueue, drainLearningQueue }) {
+export async function drainDisabledFeatureQueues(opts, io = { drainMemoryQueue, drainCurationQueue: drainDisabledCurationQueue }) {
     if (!opts.manifestWritten)
         return [];
     const refused = [];
@@ -457,10 +532,12 @@ export async function drainDisabledFeatureQueues(opts, io = { drainMemoryQueue,
         if (!memory.drained)
             refused.push(formatRefusedDrain('memory', memory.linkedFolder));
     }
-    if (!opts.learningEnabled && opts.ledgerRoot !== null) {
-        const learning = await io.drainLearningQueue(opts.ledgerRoot);
-        if (!learning.drained)
-            refused.push(formatRefusedDrain('learning', learning.linkedFolder));
+    if (!opts.curationEnabled && opts.ledgerRoot !== null) {
+        const curation = await io.drainCurationQueue(opts.ledgerRoot);
+        if (!curation.drained)
+            refused.push(formatCurationNotDrained(curation, opts.shownSkip ?? null));
+        else if (curation.warning !== undefined)
+            refused.push(curation.warning);
     }
     return refused;
 }
@@ -471,18 +548,23 @@ export async function drainDisabledFeatureQueues(opts, io = { drainMemoryQueue,
  * nothing else, so the manifest keeps every recorded value — plugins, version,
  * installedAt and every feature — and only `features.hud` turns on. The
  * earlier shape rewrote the whole record as a HUD-only fresh install (ambient,
- * memory, learning, knowledge, rules and proxy all `false`, plugins `[]`) while
+ * memory, curation, knowledge, rules and proxy all `false`, plugins `[]`) while
  * leaving those features' artifacts on disk: the record stopped describing the
  * machine, the next re-init seeded every feature off, and with
- * memory/learning/knowledge switched by the manifest alone
+ * memory/curation/knowledge switched by the manifest alone
  * (D-FEATURES-NARROW-ONLY) a HUD install would have really disabled them
  * everywhere. `version` is kept too: --hud-only reinstalls no plugin, and a
  * bumped version would make the next init skip the upgrade it still owes.
  *
  * With no prior manifest the result is the fresh HUD-only record: every other
- * feature off, which is what is installed.
+ * feature off, which is what is installed. `readManifest()` also reads a manifest it
+ * refuses as no manifest, so `refusedGateLevel` carries the machine gate level found in
+ * the raw file (`readStoredGateLevel`): the fresh record keeps it exactly as stored,
+ * malformed and `null` included, and holds no key when it is `undefined`. Init never
+ * writes a gate level the user did not choose. It is ignored over a prior install,
+ * whose own level is already kept.
  */
-export function buildHudOnlyManifest(existing, version, now) {
+export function buildHudOnlyManifest(existing, version, now, refusedGateLevel) {
     if (existing !== null) {
         return {
             ...existing,
@@ -496,17 +578,35 @@ export function buildHudOnlyManifest(existing, version, now) {
         scope: 'user',
         features: {
             ambient: false, memory: false, hud: true, knowledge: false,
-            learning: false, rules: false, flags: {}, proxy: false,
+            curation: false, rules: false, flags: {}, proxy: false,
             behavior: false,
             compliance: { enabled: false, frameworks: [] },
             // The exported default, not a literal — the one constant every other
             // module reads, so a moved default moves here too.
             tracker: { provider: DEFAULT_TRACKER_PROVIDER },
+            ...(refusedGateLevel !== undefined ? { gateLevel: refusedGateLevel } : {}),
         },
         installedAt: now,
         updatedAt: now,
     };
 }
+/**
+ * The line `init --hud-only` prints when the version the manifest records is not the
+ * running version, or null when there is nothing to say. Pure.
+ *
+ * `--hud-only` refreshes the scripts under ~/.devflow and leaves the installed
+ * commands and agents alone, so after an upgrade or a downgrade the prompts and the
+ * scripts they call can disagree until a full init. The window is accepted; this
+ * line names it, in either direction, and ends with the remedy. A machine with no
+ * readable manifest records no version, so there is nothing to compare. The recorded
+ * version is hand-editable file content, so it prints through `describeEchoedValue`.
+ */
+export function formatHudOnlySkew(recordedVersion, runningVersion) {
+    if (recordedVersion === null || installedVersionMatches(recordedVersion, runningVersion))
+        return null;
+    return `The installed prompts come from devflow ${describeEchoedValue(recordedVersion)} and this CLI is ${runningVersion ?? 'of unknown version'}. ` +
+        '--hud-only refreshed only the scripts, so run `devflow init` to update the prompts.';
+}
 /**
  * Decide what `init --scope <value>` does now that there is one install scope.
  * Pure — the action performs the exit.
@@ -595,8 +695,8 @@ export const initCommand = new Command('init')
     .option('--no-hud', 'Disable HUD status line')
     .option('--knowledge', 'Enable feature knowledge bases')
     .option('--no-knowledge', 'Disable feature knowledge bases')
-    .option('--learning', 'Enable learning (decision/pitfall tracking)')
-    .option('--no-learning', 'Disable learning (decision/pitfall tracking)')
+    .option('--curation', 'Enable curation (decision/pitfall tracking)')
+    .option('--no-curation', 'Disable curation (decision/pitfall tracking)')
     .option('--rules', 'Enable rules (always-on engineering principles)')
     .option('--no-rules', 'Disable rules')
     .option('--proxy', 'Enable external model routing (GPT models via your OpenAI/Codex subscription)')
@@ -606,6 +706,7 @@ export const initCommand = new Command('init')
     .option('--compliance <list>', 'Enable compliance with comma-separated framework IDs (e.g., gdpr,hipaa)')
     .option('--no-compliance', 'Disable compliance (removes the rule; the skill and framework references stay installed; frameworks remembered for re-enable)')
     .option('--tracker <id>', 'The machine\'s default issue tracker provider: github, jira, or linear')
+    .option('--gate-level <full|standard|lean>', 'The machine\'s default gate level: full, standard, or lean (skips the gate level prompt)')
     .option('--security <mode>', 'Security deny list location: user, managed, or none', /^(user|managed|none)$/i)
     .option('--hud-only', 'Install only the HUD (no plugins, hooks, or extras)')
     .option('--recommended', 'Apply recommended defaults after plugin selection (skip advanced prompts)')
@@ -631,6 +732,19 @@ export const initCommand = new Command('init')
         p.log.error('--reset and --plugin are mutually exclusive. Use --reset alone to restore defaults, or --plugin to update a specific plugin.');
         process.exit(1);
     }
+    // Parse --gate-level at the boundary, before anything is written (--hud-only writes early).
+    // Strict — reject, never repair — so a typo'd level exits here rather than being ignored.
+    let cliGateLevel;
+    {
+        const gateLevelResult = resolveGateLevelInitState(options.gateLevel, !!options.hudOnly);
+        if (gateLevelResult !== undefined) {
+            if (!gateLevelResult.ok) {
+                p.log.error(gateLevelResult.error);
+                process.exit(1);
+            }
+            cliGateLevel = gateLevelResult.value;
+        }
+    }
     // D-SCOPE-RETIRED: refuse a retired --scope value before anything is written.
     const scopeDecision = resolveRetiredScopeOption(options.scope);
     if (scopeDecision.kind === 'refuse') {
@@ -682,10 +796,28 @@ export const initCommand = new Command('init')
             existingHudManifest = await readManifest(devflowDir);
         }
         catch { /* absent on fresh install — existingHudManifest stays null */ }
+        // A manifest readManifest() refuses reads as none, but its machine gate level is still
+        // stored there: --hud-only keeps it and says so, as the full init does. --reset does not
+        // apply here, so nothing asks to forget it.
+        const hudStoredGate = await readStoredGateLevel(devflowDir, existingHudManifest, false);
+        let hudManifestWritten = false;
         try {
-            await writeManifest(devflowDir, buildHudOnlyManifest(existingHudManifest, version, new Date().toISOString()));
+            await writeManifest(devflowDir, buildHudOnlyManifest(existingHudManifest, version, new Date().toISOString(), hudStoredGate.value));
+            hudManifestWritten = true;
         }
         catch { /* non-fatal */ }
+        if (hudStoredGate.origin !== 'manifest') {
+            logSummaryLines(formatGateLevelSummary({
+                level: hudStoredGate.value,
+                priorLevel: hudStoredGate.value,
+                priorOrigin: hudStoredGate.origin,
+                kept: true,
+                manifestWritten: hudManifestWritten,
+            }));
+        }
+        const hudOnlySkew = formatHudOnlySkew(existingHudManifest?.version ?? null, await readRunningVersion());
+        if (hudOnlySkew !== null)
+            p.log.warn(hudOnlySkew);
         p.log.success('HUD installed');
         p.log.info(`Configure later: ${color.cyan('devflow hud --status')}`);
         p.outro(color.green('HUD-only install complete.'));
@@ -697,6 +829,15 @@ export const initCommand = new Command('init')
         existingManifest = await readManifest(devflowDir, { onWarning: (message) => p.log.warn(message) });
     }
     catch { /* unreadable manifest — seeded as a fresh install */ }
+    // The stored machine gate level, and where it was found. readManifest() reads a manifest it
+    // refuses (a missing required field, a byte-order mark, unparseable JSON) as no manifest, so
+    // the seed holds no level for it, yet `devflow gates` and the settings resolver still read
+    // that file's level. Init never writes a level the user did not choose, so when readManifest()
+    // returned none the raw file decides: a level found in it is the level the run replaces, and
+    // is kept as stored unless --reset asks to forget it. A file that cannot be read at all is
+    // reported as "unreadable". This is an init-side override; the seed itself still comes from
+    // the manifest alone.
+    const storedGate = await readStoredGateLevel(devflowDir, existingManifest, !!options.reset);
     // D-INIT-NOT-HOME (same-location.ts): a repository rooted at HOME is no
     // project, so init treats it as no repository — no .devflow/config.json (that
     // would be the machine root's), no .claudeignore, no .gitignore block, no
@@ -914,7 +1055,7 @@ export const initCommand = new Command('init')
     let memoryEnabled = seed.features.memory;
     let hudEnabled = seed.features.hud;
     let knowledgeEnabled = seed.features.knowledge;
-    let learningEnabled = seed.features.learning;
+    let curationEnabled = seed.features.curation;
     let rulesEnabled = seed.features.rules;
     // proxy: Advanced-only; Recommended path carries seed value unchanged.
     // Fresh installs → false (FEATURE_DEFAULTS.proxy). Re-inits → prior manifest value.
@@ -935,6 +1076,21 @@ export const initCommand = new Command('init')
     // alone, so init carries the prior value through untouched: it stamps the installed agents
     // with it and writes it back to the manifest. Absent stays absent (the default list).
     const trackerServers = seed.features.tracker.servers;
+    // The machine gate level (features.gateLevel), shared with `devflow gates --set`. The seed holds
+    // it raw: `undefined` only for an absent key or a --reset seed, a malformed value or `null` as
+    // stored. When readManifest() returned none, the raw level (`storedGate`, read above) stands in
+    // for the seed, as `carriedGateLevel` decides. It stays raw unless --gate-level or the wizard
+    // step sets it, so a plain init never defaults, narrows or heals it; the full manifest write
+    // below then leaves an absent key out. Each wizard path assigns the decision `runGateLevelStepAt`
+    // makes; that is the only precedence site (--gate-level, then the wizard answer, then this
+    // carried level), and `carried` says whether the level is still the carried one.
+    const carriedGate = carriedGateLevel({
+        manifest: existingManifest,
+        reset: !!options.reset,
+        stored: storedGate,
+        seedLevel: seed.features.gateLevel,
+    });
+    let gateDecision = { level: carriedGate.value, carried: true };
     let enabledFlags = { ...seed.flags };
     // viewModeExplicit: true when --reset is passed; signals resolveFinalViewMode to let the
     // seed-time view-mode win over an externally-set value in settings.json.
@@ -992,6 +1148,31 @@ export const initCommand = new Command('init')
         }
         return trackerStep.state;
     };
+    /**
+     * Decide the machine gate level for one wizard path: --gate-level, else the wizard step
+     * (gated on modePromptShown), else the stored value untouched. The step's outcome line is
+     * the post-install gate level summary row, on both paths.
+     *
+     * Returns the decision, the level raw as `resolveGateLevelForInit` returns it and whether it
+     * is the carried stored level. The caller assigns it to `gateDecision`: that value is the
+     * only precedence decision, and nothing after the call revises it.
+     */
+    const runGateLevelStepAt = async (mode) => {
+        const outcome = await resolveGateLevelForInit({
+            cliLevel: cliGateLevel,
+            stored: gateDecision.level,
+            storedOrigin: carriedGate.origin,
+            mode,
+            modePromptShown,
+            isTTY: process.stdin.isTTY,
+            prompts: buildClackGateLevelPrompts(),
+        });
+        if (outcome.kind === 'cancelled') {
+            p.cancel('Installation cancelled.');
+            process.exit(0);
+        }
+        return { level: outcome.level, carried: outcome.carried };
+    };
     // Safe-delete detection (both paths need this)
     const platform = detectPlatform();
     const shell = detectShell();
@@ -1031,6 +1212,9 @@ export const initCommand = new Command('init')
         // Tracker line via formatTrackerSummary, so the step's own outcome line
         // would be a duplicate.
         const wizardTracker = await runTrackerStepAt('recommended', seed.features.tracker.provider, false);
+        // Gate level wizard step — same gate; --recommended and !isTTY keep the stored value.
+        // The decision is final here: applyCliToggles below carries no gate level.
+        gateDecision = await runGateLevelStepAt('recommended');
         // No attribution step here: the suppress-attribution question is Advanced-only (D27).
         // Recommended silently carries the seeded value in enabledFlags — fresh installs get
         // the registry default (off), re-inits get prior state. See shouldRunAttributionStep.
@@ -1042,7 +1226,7 @@ export const initCommand = new Command('init')
             memory: options.memory,
             hud: options.hud,
             knowledge: options.knowledge,
-            learning: options.learning,
+            curation: options.curation,
             rules: options.rules,
             proxy: options.proxy,
             behavior: options.behavior,
@@ -1054,7 +1238,7 @@ export const initCommand = new Command('init')
         memoryEnabled = effectiveFeatures.memory;
         hudEnabled = effectiveFeatures.hud;
         knowledgeEnabled = effectiveFeatures.knowledge;
-        learningEnabled = effectiveFeatures.learning;
+        curationEnabled = effectiveFeatures.curation;
         rulesEnabled = effectiveFeatures.rules;
         proxyEnabled = effectiveFeatures.proxy;
         behaviorEnabled = effectiveFeatures.behavior;
@@ -1093,7 +1277,7 @@ export const initCommand = new Command('init')
         const summaryLines = [
             `Ambient mode:    ${ambientEnabled ? 'enabled' : 'disabled'}`,
             `Working memory:  ${memoryEnabled ? 'enabled' : 'disabled'}`,
-            `Learning:        ${learningEnabled ? 'enabled' : 'disabled'}`,
+            `Curation:        ${curationEnabled ? 'enabled' : 'disabled'}`,
             `Rules:           ${rulesEnabled ? 'enabled' : 'disabled'}`,
             `HUD:             ${hudEnabled ? 'enabled' : 'disabled'}`,
             `Knowledge bases: ${knowledgeEnabled ? 'enabled' : 'disabled'}`,
@@ -1104,6 +1288,9 @@ export const initCommand = new Command('init')
             // tracker step's ONLY surface on this path — both surfaces or it is
             // invisible on one path.
             `Tracker:         ${formatTrackerSummary(trackerProvider)}`,
+            // The level this run will record, or the stored one it keeps; the summary after the
+            // install reports what the run really recorded.
+            `Gate level:      ${formatGateLevelRow(gateDecision.level, carriedGate.origin)}`,
             `View mode:       ${readViewMode(enabledFlags)}`,
             `Claude Code flags: ${defaultFlagCount} configured`,
             `.claudeignore:   ${resolveClaudeignoreOutcome(claudeignorePresent)}`,
@@ -1145,12 +1332,7 @@ export const initCommand = new Command('init')
             memoryEnabled = options.memory;
         }
         else {
-            p.note('Preserves session context across /clear, restarts, and context\n' +
-                'compaction. Clear your session at any point and resume right\n' +
-                'where you left off.\n\n' +
-                'Runs a background agent on session stop that consumes additional\n' +
-                'tokens. Consider skipping if token usage is a concern.\n' +
-                'Applies to every project.', 'Working Memory');
+            p.note(workingMemoryNote(), 'Working Memory');
             const memoryChoice = await p.confirm({
                 message: 'Enable working memory? (Recommended)',
                 initialValue: seed.features.memory,
@@ -1195,22 +1377,22 @@ export const initCommand = new Command('init')
             }
             knowledgeEnabled = knowledgeChoice;
         }
-        if (options.learning !== undefined) {
-            learningEnabled = options.learning;
+        if (options.curation !== undefined) {
+            curationEnabled = options.curation;
         }
         else {
             p.note('Detects architectural decisions and pitfalls from your session\n' +
                 'dialogs. Runs a background agent on session stop that consumes\n' +
-                'additional tokens. Applies to every project.', 'Learning (Decision/Pitfall Tracking)');
-            const learningChoice = await p.confirm({
-                message: 'Enable learning? (Recommended)',
-                initialValue: seed.features.learning,
+                'additional tokens. Applies to every project.', 'Curation (Decision/Pitfall Tracking)');
+            const curationChoice = await p.confirm({
+                message: 'Enable curation? (Recommended)',
+                initialValue: seed.features.curation,
             });
-            if (p.isCancel(learningChoice)) {
+            if (p.isCancel(curationChoice)) {
                 p.cancel('Installation cancelled.');
                 process.exit(0);
             }
-            learningEnabled = learningChoice;
+            curationEnabled = curationChoice;
         }
         if (options.rules !== undefined) {
             rulesEnabled = options.rules;
@@ -1340,6 +1522,8 @@ export const initCommand = new Command('init')
             else
                 p.log.info(overrideLine.text);
         }
+        // Gate level wizard step — same gate as the Recommended path; re-init lands here.
+        gateDecision = await runGateLevelStepAt('advanced');
         // Attribution feature (after compliance, before flags). This is the ONLY call site —
         // the attribution question is Advanced-only (D27); the Recommended path never asks and
         // silently carries the seeded value. The gate stays an explicit predicate call so the
@@ -1624,7 +1808,7 @@ export const initCommand = new Command('init')
             // The SETTLED switch, after the flag, the prompt and the seed have all had
             // their say (D-LEARNING-VARIANT-INSTALL): the files installed here and the
             // manifest written at the end of init cannot disagree about it.
-            learning: learningEnabled,
+            curation: curationEnabled,
             trackerServers,
             // Non-fatal install notices with no other channel (skipped symlinks in the
             // generated reference tree, mode-normalisation failures) reach the user rather
@@ -1637,7 +1821,7 @@ export const initCommand = new Command('init')
         p.log.error(`${error}`);
         process.exit(1);
     }
-    // D-LEARNING-VARIANT-INSTALL: converge the learning variants. The file copy above
+    // D-LEARNING-VARIANT-INSTALL: converge the curation variants. The file copy above
     // installed the variant of everything IT installed; on a `--plugin` install the
     // other plugins' files, already on disk, may still be the other variant (this run
     // may have flipped the switch), and the apply-decisions skill is removed here when
@@ -1645,21 +1829,21 @@ export const initCommand = new Command('init')
     // Warn-not-abort: either mismatch is safe (an on variant is still gated at run
     // time, an off variant loads no decisions). The agent mapping is reapplied below.
     try {
-        const learningConverge = await convergeLearningVariants({
+        const curationConverge = await convergeCurationVariants({
             claudeDir,
             devflowDir,
-            learning: learningEnabled,
+            curation: curationEnabled,
             plugins: effectivePlugins,
             warn: (msg) => installWarnings.push(msg),
         });
-        if (verbose && learningConverge.converged) {
-            p.log.info(`Learning ${learningEnabled ? 'on' : 'off'} variants: ` +
-                `${learningConverge.commandsRewritten.length} command(s) and ${learningConverge.agentsRewritten.length} agent(s) ` +
-                `rewritten, ${learningConverge.unchanged} already current`);
+        if (verbose && curationConverge.converged) {
+            p.log.info(`Curation ${curationEnabled ? 'on' : 'off'} variants: ` +
+                `${curationConverge.commandsRewritten.length} command(s) and ${curationConverge.agentsRewritten.length} agent(s) ` +
+                `rewritten, ${curationConverge.unchanged} already current`);
         }
     }
     catch (err) {
-        installWarnings.push(`Learning variant convergence failed — ${err instanceof Error ? err.message : String(err)}`);
+        installWarnings.push(`Curation variant convergence failed — ${err instanceof Error ? err.message : String(err)}`);
     }
     // Converge compliance artifacts (always converge, never short-circuit).
     // Called unconditionally so that enabling/disabling compliance during init
@@ -1805,6 +1989,8 @@ export const initCommand = new Command('init')
         'lib/staleness.cjs',
         'dream-lock',
         'decisions-usage-scan.cjs',
+        'learning-lock',
+        'lib/learning-store.cjs',
     ];
     const hooksDir = path.join(devflowDir, 'scripts', 'hooks');
     for (const legacy of LEGACY_HOOK_FILES) {
@@ -1814,6 +2000,10 @@ export const initCommand = new Command('init')
         }
         catch { /* doesn't exist */ }
     }
+    // The curation move (#529): after the legacy sweep, before the manifest persist and
+    // the disabled-feature drain below, so the drain sees the moved folder. Its lines
+    // and its one notice print with the install warnings, after the spinner stops.
+    const curationMove = await moveCurationData({ discoveredProjects, gitRoot, homeDir, devflowDir });
     // === Settings & hooks (all automatic based on collected choices) ===
     s.message('Configuring settings');
     await installSettings(claudeDir, rootDir, devflowDir, verbose);
@@ -2040,7 +2230,7 @@ export const initCommand = new Command('init')
             'Manifest records intended state; run devflow init again to retry.');
     }
     // Write .devflow/config.json — facts about this repo. The machine switches for
-    // memory/learning/knowledge are the manifest's; a hand-written `features`
+    // memory/curation/knowledge are the manifest's; a hand-written `features`
     // object here only narrows them and is carried, never written
     // (D-FEATURES-NARROW-ONLY; the managed write drops the retired top-level
     // per-repo keys). A managed
@@ -2257,6 +2447,10 @@ export const initCommand = new Command('init')
     logSummaryLines(formatSkillScopeSummary(installReport, pluginListUnchanged));
     for (const warning of installWarnings)
         p.log.warn(warning);
+    for (const line of curationMove.lines)
+        p.log.warn(describeMoveText(line));
+    if (curationMove.notice !== null)
+        p.log.info(curationMove.notice);
     const installedSet = new Set(pluginsToInstall.flatMap(p => p.commands).filter(c => c.length > 0));
     const orderedCommands = WORKFLOW_ORDER.filter(cmd => installedSet.has(cmd));
     if (orderedCommands.length > 0) {
@@ -2304,7 +2498,7 @@ export const initCommand = new Command('init')
             memory: memoryEnabled,
             hud: hudEnabled,
             knowledge: knowledgeEnabled,
-            learning: learningEnabled,
+            curation: curationEnabled,
             rules: rulesEnabled,
             // FlagsRecord written directly — key-presence encodes "known".
             // view-mode is encoded as flags['view-mode'] (the resolved final value).
@@ -2324,6 +2518,9 @@ export const initCommand = new Command('init')
             // through parseTrackerId (CLI), the typed wizard select, or the seed, which
             // itself came through normalizeTrackerFeature on read.
             tracker: { provider: trackerProvider, ...(trackerServers !== undefined ? { servers: trackerServers } : {}) },
+            // The machine gate level: --gate-level, the wizard answer, or the prior value raw
+            // (see where `gateDecision` is read above).
+            ...(gateDecision.level !== undefined ? { gateLevel: gateDecision.level } : {}),
         },
         installedAt: existingManifest?.installedAt ?? now,
         updatedAt: now,
@@ -2345,12 +2542,16 @@ export const initCommand = new Command('init')
             p.log.info(msg.text);
     }
     // Only now that the machine-wide switch is on disk (D-INIT-DRAIN-AFTER-SWITCH).
+    const drainRoot = await lookupDrainLedgerRoot({ gitRoot, curationEnabled, manifestWritten: trackerLifecycle.manifestWritten });
+    if (drainRoot.warning !== null)
+        p.log.warn(drainRoot.warning);
     const refusedDrains = await drainDisabledFeatureQueues({
         gitRoot,
-        ledgerRoot: learningEnabled || gitRoot === null ? null : await getLedgerRoot(),
+        ledgerRoot: drainRoot.ledgerRoot,
         memoryEnabled,
-        learningEnabled,
+        curationEnabled,
         manifestWritten: trackerLifecycle.manifestWritten,
+        shownSkip: shownSkipAt(curationMove, drainRoot.ledgerRoot),
     });
     for (const line of refusedDrains)
         p.log.warn(line);
@@ -2378,6 +2579,14 @@ export const initCommand = new Command('init')
         agent: trackerLifecycle.agent,
     });
     logSummaryLines(trackerLines);
+    // The gate level this run recorded, from the manifest the run wrote (D-INIT-REAL-OUTCOME).
+    logSummaryLines(formatGateLevelSummary({
+        level: gateDecision.level,
+        priorLevel: storedGate.value,
+        priorOrigin: storedGate.origin,
+        kept: gateDecision.carried && carriedGate.origin === 'rejected',
+        manifestWritten: trackerLifecycle.manifestWritten,
+    }));
     // CLAUDE.md import audit (D-CLAUDE-MD-IMPORT-AUDIT, D-AUDIT-STAMP): after the install, on
     // both paths, through claudeMdAuditStep. Global roots always; the project's roots when init
     // runs inside a git repository that is not HOME, at its toplevel. The stamp is written here,