devflow-kit 3.7.0 → 3.9.0

package/src/assets/scripts/hooks/queue-append

@@ -6,35 +6,73 @@
 # under a lock. Used by capture-prompt, capture-turn, and capture-question so the
 # per-feature dual-queue-append logic exists in exactly one place.
 #
-# Source-order requirement: source json-parse (for _HAS_JQ) and learning-lock (for
-# learning_lock_acquire/learning_lock_release, which itself requires get-mtime) BEFORE
+# Source-order requirement: source json-parse (for _HAS_JQ) and curation-lock (for
+# curation_lock_acquire/curation_lock_release, which itself requires get-mtime) BEFORE
 # calling queue_append_row or queue_append_both, and define log/dbg. This file
-# sources its sibling git-marker itself, for df_no_symlink_below. Sourcing it only
-# defines functions -- no side effects until they are called.
+# sources its siblings git-marker (for df_no_symlink_below) and curation-move (for the
+# ledger folder's names, df_curation_move_names) itself. Sourcing it only defines
+# functions -- no side effects until they are called.
 #
 # queue_append_row <root> <queue_file> <role> <content> <ts>
 #   Appends one JSONL row {role, content, ts} to <queue_file>, which lies below
-#   <root>: the project root for the memory queue, the ledger root for the learning
+#   <root>: the project root for the memory queue, the ledger root for the curation
 #   queue. When the queue, or a folder between <root> and it, is a symbolic link,
 #   nothing is written: the skip is logged once and the call returns 0, as a
-#   skipped capture does (D-HOOKS-NO-SYMLINK, git-marker). Otherwise it
-#   creates the queue's folder if absent, and the file with mode 0600 (umask 077).
+#   skipped capture does (D-HOOKS-NO-SYMLINK, git-marker). Otherwise it builds the
+#   row first (a row that fails to build writes nothing), then makes one builtin
+#   append under umask 077, so a queue it creates has mode 0600. The umask is the
+#   caller's again when the append returns, so a folder made later in the same hook
+#   has the mode its parent's umask gives. A ledger queue follows the creator rule
+#   (git-marker, df_ledger_queue): it is appended to in the
+#   old learning/ folder while that exists, which is never created here; the new
+#   curation/ folder is created only when the old name is absent. An append that
+#   finds the old folder gone (the one-time move ran meanwhile) looks again and goes
+#   on in the new folder, so a capture never drops a row and never waits. Any other
+#   queue's folder is created if absent.
+#   A queue in an area that git tracks, or that git did not answer for, is paused: before
+#   the row is built, queue_tracked_area asks for the area the queue lies in, and a queue
+#   that is not untracked gets no row, no folder and no file. The skip is logged once. The
+#   check runs on every call, whether or not the queue's folder exists.
 #   After appending, truncates from 200 to the newest 100 lines under a lock
-#   (learning_lock_acquire on "<queue_file>.lock", 2s timeout), keeping mode 0600.
+#   (curation_lock_acquire on "<queue_file>.lock", 2s timeout), keeping mode 0600.
 #   The append itself is intentionally lock-free (accepted-class race shared with
 #   the pre-existing memory design -- see the design doc's "Append-vs-claim race"
 #   note).
 #
-# queue_append_both <memory_root> <memory_queue> <learning_root> <learning_queue> <memory_enabled> <learning_enabled> <role> <content> <ts>
-#   Calls queue_append_row for each queue whose *_enabled flag is "true", with the
-#   root that queue lies below. Each queue is gated independently -- callers
-#   compute memory_enabled/learning_enabled themselves (see queue_read_gates below
-#   for the at-most-one-fork read of both).
+# queue_append_both <memory_root> <memory_queue> <curation_root> <curation_queue> <memory_enabled> <curation_enabled> <role> <content> <ts>
+#   Builds the row once, then appends it as queue_append_row does to each queue whose
+#   *_enabled flag is "true", with the root that queue lies below. Each queue is gated
+#   independently -- callers compute memory_enabled/curation_enabled themselves (see
+#   queue_read_gates below for the at-most-one-fork read of both). With neither queue
+#   enabled it builds nothing. A queue whose area is paused (see queue_tracked_area) reads
+#   as not enabled for the call, and nothing is built for it.
+#
+# queue_tracked_area <root> <curation|memory|both> [git|node]
+#   Does git track files in the data folders of the area at <root>? Sets
+#   DF_TRACKED_AREA_CURATION or DF_TRACKED_AREA_MEMORY (one variable per area) to
+#   `tracked`, `untracked` or `unknown`, and always returns 0. The area `both` is one
+#   call over the union of the two: it sets both variables, and a listing in it is
+#   followed by one call per area, so each variable names its own area. A root is asked
+#   once per area in a process. The shell twin of lib/tracked-areas.cjs, held to its
+#   answers by tests/decisions/tracked-area-parity.test.ts:
+#     - no `.git` entry (a file, a folder or a link) at the root: `untracked`, no call;
+#     - a root that is not an absolute path, whose physical parent holds a colon, or that
+#       can not be entered: `unknown`;
+#     - git mode (the default): one `git ls-files -z` over the area's pathspecs, with the
+#       leaf's environment scrub, a ceiling at the root's parent and the fsmonitor command
+#       off. Only the first byte of the listing is read. A byte read means `tracked`,
+#       whatever git's status (git ends on a closed pipe). With no byte, git status 0
+#       means `untracked`, and any other status `unknown`;
+#     - node mode: the json-helper `tracked-area` op, which bounds the call in time. Without
+#       node it runs as git mode; an answer that is not one of the three words is `unknown`.
+#   The capture hooks ask in git mode, with no process but git. The session start asks in
+#   node mode, so a hung git is cut.
 #
 # queue_read_gates <manifest_path> [<root>]
-#   Reads BOTH switches, `memory` and `learning`, in at most ONE subprocess fork
+#   Reads BOTH switches, `memory` and `curation` (curation is read under both of
+#   its keys, the current one and the pre-rename copy), in at most ONE subprocess fork
 #   (AC-P1 -- at most one gate-read fork per capture hook, not two; none when
-#   the fast paths settle it). Sets _QG_MEMORY and _QG_LEARNING ("true"/"false")
+#   the fast paths settle it). Sets _QG_MEMORY and _QG_CURATION ("true"/"false")
 #   in the caller's scope. The two values are newline-separated
 #   rather than using a control-character delimiter: they are always the literal
 #   strings "true"/"false", never arbitrary content, so a plain newline split is
@@ -44,35 +82,43 @@
 #   machine switch is on AND neither repository file sets `features.<name>` to
 #   the literal `false` -- the rule resolve-settings.cjs folds, held to the same
 #   answers by the shared table tests/fixtures/settings-switch-table.ts (TP-49).
-#   A repository can switch memory or learning off for itself, never back on.
+#   A repository can switch memory or curation off for itself, never back on.
 #     machine   <manifest_path>, the ~/.devflow/manifest.json `devflow init` and
-#               `devflow memory|learning --enable/--disable` write. Only an
+#               `devflow memory|curation --enable/--disable` write. Only an
 #               explicit boolean `false` switches a feature off -- an absent,
 #               unreadable or malformed manifest, a missing key, or a non-boolean
 #               value leaves it ON (fail-open), the rule
 #               isMachineFeatureOn() applies in the CLI.
 #     project   <root>/.devflow/project.json (team-committed) and
 #     personal  <root>/.devflow/config.json (this worktree's own), read ONLY under
-#               `features.memory` / `features.learning`. The retired top-level
-#               keys (`memory`, `learning`, `decisions`) and `features.decisions`
-#               narrow nothing (#378: reading them let a feature run in every repo
-#               but one). An invalid file -- unparseable, over 4096 bytes, a BOM,
-#               a symlink, a duplicated key -- narrows nothing.
+#               `features.memory` and, for curation, `features.curation` or
+#               `features.learning` (a narrow-only union: a literal false in
+#               either key turns curation off, and each key is parsed on its
+#               own). The retired top-level keys (`memory`, `curation`,
+#               `learning`, `decisions`) and `features.decisions` narrow nothing
+#               (#378: reading them let a feature run in every repo but one). An
+#               invalid file -- unparseable, over 4096 bytes, a BOM, a symlink, a
+#               duplicated key -- narrows nothing.
 #   <root> is the checkout's toplevel (DF_ROOT, which every caller holds as
-#   $PROJECT_ROOT), for learning too: project.json is committed per branch and
+#   $PROJECT_ROOT), for curation too: project.json is committed per branch and
 #   config.json lives per worktree, so both are read where the session runs, as
 #   resolve-settings.cjs reads them -- never at DF_LEDGER_ROOT, which only says
 #   where the queue lands. Without <root> (or with an empty one) no repository
 #   file is read.
 #
-#   D-LEARNING-LEGACY-DECISIONS: in the MANIFEST only, learning reads
-#   `features.learning` when it is a boolean, else the pre-rename
-#   `features.decisions` -- readManifest's migration precedence
-#   exactly, so a legacy `decisions: false` switches learning off before any
-#   command has healed the file. Only a boolean `false` in whichever key decides
-#   is off, as above.
+#   The machine rule for curation (#529), the one isMachineFeatureOn() applies:
+#   off when `features.curation` or `features.learning` is a boolean false; else
+#   on when either is a boolean true; else, when neither is a boolean, the
+#   pre-rename `features.decisions` decides if it is a boolean; else on. A
+#   non-boolean value is ignored for that key only, so a disagreeing pair
+#   resolves to off.
+#
+#   D-LEARNING-LEGACY-DECISIONS: in the MANIFEST only, the pre-rename
+#   `features.decisions` is read when neither current key is a boolean --
+#   readManifest's migration precedence exactly, so a legacy `decisions: false`
+#   switches curation off before any command has healed the file.
 #
-#   Every hook that gates on memory or learning reads it through here: the
+#   Every hook that gates on memory or curation reads it through here: the
 #   capture hooks, session-start-context (Sections 1-2), memory-worker,
 #   session-start-memory, pre-compact-memory and background-memory-update. The
 #   callers pass <manifest_path> as $HOME/.devflow/manifest.json, the machine
@@ -81,80 +127,370 @@
 
 # queue_append_row checks its queue with df_no_symlink_below, so this helper sources
 # git-marker itself rather than trusting every caller to have done so first. One that
-# failed to source is a command not found: the refusing branch, so nothing is written.
-source "${BASH_SOURCE[0]%/*}/git-marker" 2>/dev/null || true
+# is missing is a command not found: the refusing branch, so nothing is written.
+# The ledger folder's names come from the move shim (df_curation_move_names), sourced
+# the same way and refused the same way.
+#
+# Each source is guarded by a builtin readability test, because bash 3.2 under `set -e`
+# ends the shell at a `source` of a missing file, even inside `|| true`. Without the test
+# the refusing branch would never run, and the capture hooks would stop here.
+[ -r "${BASH_SOURCE[0]%/*}/git-marker" ] && source "${BASH_SOURCE[0]%/*}/git-marker" 2>/dev/null || true
+[ -r "${BASH_SOURCE[0]%/*}/curation-move" ] && source "${BASH_SOURCE[0]%/*}/curation-move" 2>/dev/null || true
 
-queue_append_row() {
-  local _qar_root="$1" _qar_file="$2" _qar_role="$3" _qar_content="$4" _qar_ts="$5"
+# The caller's umask, read once per process. A queue is created 0600, so the append
+# runs under umask 077 -- and the rest of the hook must run under the umask its parent
+# gave it, or a folder the next append makes would be 0700. `$(umask)` is one subshell
+# with no exec, and it runs on the first append only; each append gives this value
+# back, so the umask the process holds when it first appends is the one it keeps.
+_QAR_UMASK=""
+
+# _qar_build_row <role> <content> <ts> -- sets _QAR_ROW to the JSONL row, built by jq
+# (--arg, --argjson) or node (JSON.stringify), never by string concatenation. A
+# predicate: it succeeds only for a row that built, and a row that fails to build is
+# empty, so nothing partial can reach a queue. Call it in an `if` or an `||` list.
+_qar_build_row() {
+  _QAR_ROW=""
+  if [ "$_HAS_JQ" = "true" ]; then
+    _QAR_ROW=$(jq -n -c --arg role "$1" --arg content "$2" --argjson ts "$3" \
+      '{role: $role, content: $content, ts: $ts}') || _QAR_ROW=""
+  else
+    _QAR_ROW=$(node -e "process.stdout.write(JSON.stringify({role:process.argv[1],content:process.argv[2],ts:parseInt(process.argv[3])}))" \
+      -- "$1" "$2" "$3") || _QAR_ROW=""
+  fi
+  if [ -z "$_QAR_ROW" ]; then
+    log "Queue skipped: the row could not be built; nothing written"
+    return 1
+  fi
+  return 0
+}
+
+# _qar_write <queue_file> <row> -- one builtin append, under umask 077 so a queue it
+# creates has mode 0600 (SEC-2). The umask is the caller's again before it returns,
+# whether the append worked or not. The redirection error is silenced by 2>/dev/null
+# written BEFORE it. A predicate: it fails when the row was not written.
+_qar_write() {
+  local _qar_status=0
+  umask 077
+  printf '%s\n' "$2" 2>/dev/null >> "$1" || _qar_status=1
+  umask "$_QAR_UMASK" 2>/dev/null || true
+  return "$_qar_status"
+}
+
+# _qar_append <root> <queue_file> <row> -- appends <row> to <queue_file>, which lies
+# below <root>, and sets _QAR_FILE to the queue it reached (the old ledger folder, or
+# the new one after a move). A predicate: it fails when nothing was written -- a link on
+# the path (D-HOOKS-NO-SYMLINK: the skip is logged once) or a queue that could not be
+# written -- and a skipped capture is not an error for the hook.
+_qar_append() {
+  local _qar_root="$1" _qar_file="$2" _qar_row="$3"
+  local _qar_given="$2" _qar_old="" _qar_new=""
+  _QAR_FILE=""
+
+  # The names the creator rule below needs. A shim that failed to source is a command
+  # not found, so nothing is appended: no queue is written without them.
+  if ! df_curation_move_names 2>/dev/null; then
+    log "Queue skipped: the ledger folder names are unavailable; nothing written"
+    return 1
+  fi
+  _qar_old="$DF_CM_OLD_FOLDER"
+  _qar_new="$DF_CM_NEW_FOLDER"
+
+  # The creator rule (git-marker, df_ledger_queue): a ledger queue is appended to in
+  # the old folder while that folder is present, so a new name never hides an old
+  # ledger. Any other queue (the memory queue) comes back unchanged. A helper that
+  # failed to source is a command not found, so the queue stays as given and the
+  # check below, from the same library, refuses it.
+  if df_ledger_queue "$_qar_file" "$_qar_old" "$_qar_new"; then _qar_file="$DF_LEDGER_QUEUE"; fi
 
   # D-HOOKS-NO-SYMLINK (git-marker): a skipped append is a skipped capture.
   if ! df_no_symlink_below "$_qar_root" "$_qar_file"; then
     log "Queue skipped: a symbolic link sits on the path to $_qar_file; nothing written"
-    return 0
+    return 1
+  fi
+
+  # A folder is made only where this append is its creator: never the old ledger
+  # folder, which a move may rename away at any moment, and which a make-again would
+  # bring back beside the new one. An old folder that is gone leaves the append to
+  # fail, and the re-probe below decides again. A folder is made under the caller's
+  # umask: only the write below runs under 077.
+  case "${_qar_file%/*}" in
+    */"$_qar_old") ;;
+    *) mkdir -p "${_qar_file%/*}" 2>/dev/null || true ;;
+  esac
+
+  if [ -z "$_QAR_UMASK" ]; then _QAR_UMASK=$(umask) || _QAR_UMASK=""; fi
+  if ! _qar_write "$_qar_file" "$_qar_row"; then
+    # The old folder may have been moved after the probe. Look again: when the old
+    # name is gone, the creator makes the new folder once and the row goes there.
+    df_ledger_queue "$_qar_given" "$_qar_old" "$_qar_new" || true
+    if [ "$DF_LEDGER_QUEUE" != "$_qar_file" ] \
+      && df_no_symlink_below "$_qar_root" "$DF_LEDGER_QUEUE" \
+      && mkdir -p "${DF_LEDGER_QUEUE%/*}" 2>/dev/null \
+      && _qar_write "$DF_LEDGER_QUEUE" "$_qar_row"; then
+      _qar_file="$DF_LEDGER_QUEUE"
+    else
+      log "Queue append failed: $_qar_file could not be written"
+      return 1
+    fi
   fi
-  mkdir -p "${_qar_file%/*}" 2>/dev/null || true
+  _QAR_FILE="$_qar_file"
+  return 0
+}
 
-  if [ ! -f "$_qar_file" ]; then
-    (umask 077 && touch "$_qar_file") 2>/dev/null || true
+# _qar_trim_overflow <queue_file> -- overflow safety: past 200 lines, keep the newest
+# 100, locked to prevent a multi-session race.
+_qar_trim_overflow() {
+  local _qar_file="$1" _qar_lines="" _qar_lock="" _qar_tmp=""
+  [ -f "$_qar_file" ] || return 0
+  _qar_lines=$(wc -l < "$_qar_file" | tr -d ' ')
+  if [ "$_qar_lines" -gt 200 ]; then
+    _qar_lock="${_qar_file}.lock"
+    if curation_lock_acquire "$_qar_lock" 2; then
+      _qar_lines=$(wc -l < "$_qar_file" | tr -d ' ')
+      if [ "$_qar_lines" -gt 200 ]; then
+        _qar_tmp="${_qar_file}.tmp.$$"
+        # SEC-2: the trimmed copy is created under umask 077, so the renamed
+        # queue keeps mode 0600. mv replaces the inode, so the queue takes the
+        # copy's mode, and a chmod after the mv would leave a window. The copy is
+        # created only where nothing stands at its name: builtin tests come first,
+        # so an entry already there, a link to a FIFO or a device included, is
+        # never opened (noclobber alone would open one, as no regular file stands
+        # there), and noclobber then makes the create itself exclusive. Such an
+        # entry is removed instead, and the trim waits for a later append.
+        if [ ! -e "$_qar_tmp" ] && [ ! -L "$_qar_tmp" ] && (umask 077 && set -o noclobber && tail -100 "$_qar_file" > "$_qar_tmp") && mv "$_qar_tmp" "$_qar_file"; then
+          log "Queue overflow: truncated from $_qar_lines to 100 lines ($(basename "$_qar_file"))"
+          dbg "Queue overflow: truncated from $_qar_lines to 100 lines ($_qar_file)"
+        else
+          rm -f "$_qar_tmp" 2>/dev/null || true
+          log "Queue overflow: not truncated, its copy could not be written ($(basename "$_qar_file"))"
+        fi
+      fi
+      curation_lock_release "$_qar_lock"
+    fi
   fi
+  return 0
+}
 
-  if [ "$_HAS_JQ" = "true" ]; then
-    jq -n -c --arg role "$_qar_role" --arg content "$_qar_content" --argjson ts "$_qar_ts" \
-      '{role: $role, content: $content, ts: $ts}' >> "$_qar_file"
+# --- The tracked-area gate: no capture into a folder that git tracks ---
+#
+# A folder that git tracks holds the repository's content, not devflow's data, so a
+# capture writes nothing into it, and also when git did not answer (queue_tracked_area,
+# documented above). The check runs before the row is built and before any folder is
+# made, on every call, whether or not the queue's folder exists.
+
+# _qta_specs <curation|memory|both> -- sets the array _QTA_SPECS to the pathspecs of the
+# area: the shell twin of AREA_PATHSPECS in lib/tracked-areas.cjs, in the leaf's order and
+# spelling (tests/decisions/tracked-area-parity.test.ts holds the two equal, element by
+# element). `.devflow` is spelled twice, the second time with the fl ligature (U+FB02,
+# bytes ef ac 82), which a case-folding file system opens as the same name. The `.devflow`
+# entry itself (a link, a gitlink or a plain file) stands over every folder: the character
+# class keeps `glob` from matching it as a leading directory. Fails for any other word.
+_qta_specs() {
+  local _qs_fl=$'\xef\xac\x82' _qs_dir="" _qs_curation=() _qs_memory=() _qs_entry=()
+  for _qs_dir in ".devflow" ".dev${_qs_fl}ow"; do
+    _qs_curation+=(
+      ":(icase,literal)${_qs_dir}/learning"
+      ":(icase,literal)${_qs_dir}/curation"
+      ":(icase,glob)${_qs_dir}/learning.backup-*"
+      ":(icase,glob)${_qs_dir}/learning.backup-*/**"
+    )
+    _qs_memory+=(":(icase,literal)${_qs_dir}/memory")
+    _qs_entry+=(":(icase,glob)[.]${_qs_dir#.}")
+  done
+  case "${1:-}" in
+    curation) _QTA_SPECS=("${_qs_curation[@]}" "${_qs_entry[@]}") ;;
+    memory) _QTA_SPECS=("${_qs_memory[@]}" "${_qs_entry[@]}") ;;
+    both) _QTA_SPECS=("${_qs_curation[@]}" "${_qs_entry[@]}" "${_qs_memory[@]}") ;;
+    *) _QTA_SPECS=(); return 1 ;;
+  esac
+  return 0
+}
+
+# _qta_probe <root> <curation|memory|both> <git|node> -- sets _QTA_ANSWER to `tracked`,
+# `untracked` or `unknown`, as queue_tracked_area documents. Always returns 0.
+#
+# The git mode reads one byte of the listing and ends. Under bash 3.2 with errexit set the
+# pipeline sits in an `if` condition (an empty listing makes `read` fail, and a failing
+# condition does not end the shell), and PIPESTATUS is copied in both arms before any other
+# command resets it: the second element is the reader's status, the first git's. Nothing
+# follows the pipeline in an `||` list. The `cd -P` runs inside the subshell, so the
+# caller's directory never changes, and git runs there with the variables that redirect it
+# removed (the list is GIT_REDIRECT_VARIABLES of the leaf), a fixed locale, no optional
+# lock, and the root's physical parent as its ceiling.
+_qta_probe() {
+  local _qp_root="${1:-}" _qp_area="${2:-}" _qp_mode="${3:-git}" _qp_out="" _qp_ceiling="" _qp_c="" _qp_st=()
+  _QTA_ANSWER="unknown"
+  case "$_qp_root" in /*) ;; *) return 0 ;; esac
+  if [ ! -e "$_qp_root/.git" ] && [ ! -L "$_qp_root/.git" ]; then
+    _QTA_ANSWER="untracked"
+    return 0
+  fi
+  if [ "$_qp_mode" = "node" ] && [ "${_HAS_NODE:-}" = "true" ] && [ -n "${_JSON_HELPER:-}" ]; then
+    case "$_qp_area" in curation|memory|both) ;; *) return 0 ;; esac
+    _qp_out=$(node "$_JSON_HELPER" tracked-area "$_qp_area" "$_qp_root" 2>/dev/null) || _qp_out=""
+    _qp_out="${_qp_out%%$'\n'*}"
+    case "$_qp_out" in tracked|untracked|unknown) _QTA_ANSWER="$_qp_out" ;; esac
+    return 0
+  fi
+  _qta_specs "$_qp_area" || return 0
+  if (
+      cd -P "$_qp_root" >/dev/null 2>&1 || exit 1
+      _qp_ceiling="${PWD%/*}"
+      [ -n "$_qp_ceiling" ] || _qp_ceiling="/"
+      case "$_qp_ceiling" in *:*) exit 1 ;; esac
+      unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE GIT_COMMON_DIR GIT_OBJECT_DIRECTORY GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_NAMESPACE GIT_LITERAL_PATHSPECS GIT_GLOB_PATHSPECS GIT_NOGLOB_PATHSPECS GIT_ICASE_PATHSPECS
+      export LC_ALL=C GIT_OPTIONAL_LOCKS=0 GIT_CEILING_DIRECTORIES="$_qp_ceiling"
+      exec git --no-literal-pathspecs -c core.fsmonitor=false ls-files -z -- "${_QTA_SPECS[@]}"
+    ) </dev/null 2>/dev/null | { IFS= read -r -n 1 _qp_c; }; then
+    _qp_st=("${PIPESTATUS[@]}")
   else
-    node -e "process.stdout.write(JSON.stringify({role:process.argv[1],content:process.argv[2],ts:parseInt(process.argv[3])})+String.fromCharCode(10))" \
-      -- "$_qar_role" "$_qar_content" "$_qar_ts" >> "$_qar_file"
+    _qp_st=("${PIPESTATUS[@]}")
+  fi
+  if [ "${#_qp_st[@]}" -eq 2 ]; then
+    if [ "${_qp_st[1]}" -eq 0 ]; then
+      _QTA_ANSWER="tracked"
+    elif [ "${_qp_st[0]}" -eq 0 ]; then
+      _QTA_ANSWER="untracked"
+    fi
   fi
+  return 0
+}
+
+# _qta_ask <root> <curation|memory> <git|node> -- sets the area's variable, unless this
+# process already asked for that root and area. Always returns 0.
+_qta_ask() {
+  case "$2" in
+    curation)
+      if [ "${_QTA_ASKED_CURATION:-}" != "r$1" ]; then
+        _qta_probe "$1" curation "$3"
+        DF_TRACKED_AREA_CURATION="$_QTA_ANSWER"
+        _QTA_ASKED_CURATION="r$1"
+      fi
+      ;;
+    memory)
+      if [ "${_QTA_ASKED_MEMORY:-}" != "r$1" ]; then
+        _qta_probe "$1" memory "$3"
+        DF_TRACKED_AREA_MEMORY="$_QTA_ANSWER"
+        _QTA_ASKED_MEMORY="r$1"
+      fi
+      ;;
+  esac
+  return 0
+}
 
-  # Overflow safety: >200 lines -> keep newest 100, locked to prevent a multi-session race.
-  if [ -f "$_qar_file" ]; then
-    local _qar_lines
-    _qar_lines=$(wc -l < "$_qar_file" | tr -d ' ')
-    if [ "$_qar_lines" -gt 200 ]; then
-      local _qar_lock="${_qar_file}.lock"
-      if learning_lock_acquire "$_qar_lock" 2; then
-        _qar_lines=$(wc -l < "$_qar_file" | tr -d ' ')
-        if [ "$_qar_lines" -gt 200 ]; then
-          local _qar_tmp="${_qar_file}.tmp.$$"
-          # SEC-2: the trimmed copy is created under umask 077, so the renamed
-          # queue keeps mode 0600. mv replaces the inode, so the queue takes the
-          # copy's mode, and a chmod after the mv would leave a window. The copy is
-          # created only where nothing stands at its name: builtin tests come first,
-          # so an entry already there, a link to a FIFO or a device included, is
-          # never opened (noclobber alone would open one, as no regular file stands
-          # there), and noclobber then makes the create itself exclusive. Such an
-          # entry is removed instead, and the trim waits for a later append.
-          if [ ! -e "$_qar_tmp" ] && [ ! -L "$_qar_tmp" ] && (umask 077 && set -o noclobber && tail -100 "$_qar_file" > "$_qar_tmp") && mv "$_qar_tmp" "$_qar_file"; then
-            log "Queue overflow: truncated from $_qar_lines to 100 lines ($(basename "$_qar_file"))"
-            dbg "Queue overflow: truncated from $_qar_lines to 100 lines ($_qar_file)"
-          else
-            rm -f "$_qar_tmp" 2>/dev/null || true
-            log "Queue overflow: not truncated, its copy could not be written ($(basename "$_qar_file"))"
-          fi
+queue_tracked_area() {
+  local _qa_root="${1:-}" _qa_area="${2:-}" _qa_mode="${3:-git}"
+  case "$_qa_area" in
+    curation|memory)
+      _qta_ask "$_qa_root" "$_qa_area" "$_qa_mode"
+      ;;
+    both)
+      if [ "${_QTA_ASKED_CURATION:-}" != "r$_qa_root" ] || [ "${_QTA_ASKED_MEMORY:-}" != "r$_qa_root" ]; then
+        _qta_probe "$_qa_root" both "$_qa_mode"
+        if [ "$_QTA_ANSWER" = "tracked" ]; then
+          # The union listed something: one call per area says which.
+          _QTA_ASKED_CURATION=""
+          _QTA_ASKED_MEMORY=""
+          _qta_ask "$_qa_root" curation "$_qa_mode"
+          _qta_ask "$_qa_root" memory "$_qa_mode"
+        else
+          DF_TRACKED_AREA_CURATION="$_QTA_ANSWER"
+          DF_TRACKED_AREA_MEMORY="$_QTA_ANSWER"
+          _QTA_ASKED_CURATION="r$_qa_root"
+          _QTA_ASKED_MEMORY="r$_qa_root"
         fi
-        learning_lock_release "$_qar_lock"
       fi
-    fi
+      ;;
+  esac
+  return 0
+}
+
+# _qar_gate <memory_root> <memory_on> <curation_root> <curation_on> -- the one gate both
+# append functions use. Sets _QAR_MEMORY_ON and _QAR_CURATION_ON to the flags as given,
+# except that a queue whose area is not `untracked` reads "false" (paused), with one fixed
+# log line. Only an enabled queue is asked about. When both are enabled at one root, one
+# call over the union answers for both (queue_tracked_area `both`). Always returns 0.
+_qar_gate() {
+  local _qg_mroot="$1" _qg_mon="$2" _qg_croot="$3" _qg_con="$4"
+  if [ "$_qg_mon" = "true" ] && [ "$_qg_con" = "true" ] && [ "$_qg_mroot" = "$_qg_croot" ]; then
+    queue_tracked_area "$_qg_mroot" both git
+  else
+    if [ "$_qg_mon" = "true" ]; then queue_tracked_area "$_qg_mroot" memory git; fi
+    if [ "$_qg_con" = "true" ]; then queue_tracked_area "$_qg_croot" curation git; fi
+  fi
+  if [ "$_qg_mon" = "true" ] && [ "${DF_TRACKED_AREA_MEMORY:-unknown}" != "untracked" ]; then
+    _qg_mon="false"
+    log "Queue skipped: the memory area is paused (git tracks files in its data folders, or did not answer); nothing written"
+  fi
+  if [ "$_qg_con" = "true" ] && [ "${DF_TRACKED_AREA_CURATION:-unknown}" != "untracked" ]; then
+    _qg_con="false"
+    log "Queue skipped: the curation area is paused (git tracks files in its data folders, or did not answer); nothing written"
   fi
+  _QAR_MEMORY_ON="$_qg_mon"
+  _QAR_CURATION_ON="$_qg_con"
+  return 0
+}
+
+# _qar_area_of <root> <queue_file> -- sets _QAR_AREA to the area the queue lies in:
+# `memory` below <root>/.devflow/memory, `curation` below the ledger folder (either name),
+# and `both` for a queue in neither, which is paused when either area is.
+_qar_area_of() {
+  case "$2" in
+    "$1"/.devflow/memory/*) _QAR_AREA="memory" ;;
+    "$1"/.devflow/learning/*|"$1"/.devflow/curation/*) _QAR_AREA="curation" ;;
+    *) _QAR_AREA="both" ;;
+  esac
+  return 0
+}
+
+queue_append_row() {
+  _qar_area_of "$1" "$2"
+  case "$_QAR_AREA" in
+    memory)
+      _qar_gate "$1" true "" false
+      if [ "$_QAR_MEMORY_ON" != "true" ]; then return 0; fi
+      ;;
+    curation)
+      _qar_gate "" false "$1" true
+      if [ "$_QAR_CURATION_ON" != "true" ]; then return 0; fi
+      ;;
+    *)
+      _qar_gate "$1" true "$1" true
+      if [ "$_QAR_MEMORY_ON" != "true" ] || [ "$_QAR_CURATION_ON" != "true" ]; then return 0; fi
+      ;;
+  esac
+  _qar_build_row "$3" "$4" "$5" || return 0
+  if _qar_append "$1" "$2" "$_QAR_ROW"; then _qar_trim_overflow "$_QAR_FILE"; fi
+  return 0
 }
 
 queue_append_both() {
   local _qab_memory_root="$1" _qab_memory_queue="$2"
-  local _qab_learning_root="$3" _qab_learning_queue="$4"
-  local _qab_memory_enabled="$5" _qab_learning_enabled="$6"
-  local _qab_role="$7" _qab_content="$8" _qab_ts="$9"
+  local _qab_curation_root="$3" _qab_curation_queue="$4"
+  local _qab_memory_enabled="$5" _qab_curation_enabled="$6"
+  local _qab_role="$7" _qab_content="$8" _qab_ts="$9" _qab_row=""
+
+  # A paused queue reads as not enabled: the gate comes before the row is built.
+  _qar_gate "$_qab_memory_root" "$_qab_memory_enabled" "$_qab_curation_root" "$_qab_curation_enabled"
+  _qab_memory_enabled="$_QAR_MEMORY_ON"
+  _qab_curation_enabled="$_QAR_CURATION_ON"
+  if [ "$_qab_memory_enabled" != "true" ] && [ "$_qab_curation_enabled" != "true" ]; then return 0; fi
+  # One row for both queues: it is built once, and each enabled queue takes the same line.
+  _qar_build_row "$_qab_role" "$_qab_content" "$_qab_ts" || return 0
+  _qab_row="$_QAR_ROW"
 
   if [ "$_qab_memory_enabled" = "true" ]; then
-    queue_append_row "$_qab_memory_root" "$_qab_memory_queue" "$_qab_role" "$_qab_content" "$_qab_ts"
+    if _qar_append "$_qab_memory_root" "$_qab_memory_queue" "$_qab_row"; then _qar_trim_overflow "$_QAR_FILE"; fi
   fi
-  if [ "$_qab_learning_enabled" = "true" ]; then
-    queue_append_row "$_qab_learning_root" "$_qab_learning_queue" "$_qab_role" "$_qab_content" "$_qab_ts"
+  if [ "$_qab_curation_enabled" = "true" ]; then
+    if _qar_append "$_qab_curation_root" "$_qab_curation_queue" "$_qab_row"; then _qar_trim_overflow "$_QAR_FILE"; fi
   fi
+  return 0
 }
 
 # _qg_repo_file_can_narrow <file> -- succeeds when <file> COULD set
-# features.memory or features.learning to false, so only the parser can decide
-# it; fails when it certainly cannot. Builtins only: no fork.
+# features.memory, features.curation or features.learning to false, so only the
+# parser can decide it; fails when it certainly cannot. Builtins only: no fork.
 #
 # D-GATES-FAST-PATH (repository files): the read is bounded -- `-n 4097`, which
 # bash 3.2 supports -- and `read -d ''` succeeds only when it stops short of the
@@ -164,14 +500,14 @@ queue_append_both() {
 # symlink and refuses a directory or FIFO, so nothing here can block; the parser
 # itself refuses the symlink. A `\u` escape is the only JSON spelling of a
 # letter other than the letter itself, so without one a narrowing file shows
-# `"features"`, then `{`, then `"memory"` or `"learning"`, then `false`,
-# literally and in that order. `.` spans newlines (POSIX ERE without
+# `"features"`, then `{`, then `"memory"`, `"curation"` or `"learning"`, then
+# `false`, literally and in that order. `.` spans newlines (POSIX ERE without
 # REG_NEWLINE), so the match can only over-report -- an over-report costs one
 # fork and the parser's answer, never a wrong one. No `"decisions"` and no
 # top-level key before `features` is ever matched.
 _qg_repo_file_can_narrow() {
   local _qgf_text=""
-  local _qgf_re='"features"[[:space:]]*:[[:space:]]*[{].*"(memory|learning)"[[:space:]]*:[[:space:]]*false'
+  local _qgf_re='"features"[[:space:]]*:[[:space:]]*[{].*"(memory|curation|learning)"[[:space:]]*:[[:space:]]*false'
   [ -f "$1" ] || return 1
   if IFS= read -r -d '' -n 4097 _qgf_text 2>/dev/null < "$1"; then return 1; fi
   case "$_qgf_text" in *'\u'*) return 0 ;; esac
@@ -180,22 +516,24 @@ _qg_repo_file_can_narrow() {
 
 queue_read_gates() {
   local _qg_manifest="${1:-}" _qg_root="${2:-}" _qg_text="" _qg_parse="false" _qg_repo="false" _qg_fields=""
+  local _qg_scripts="${BASH_SOURCE[0]%/*}/.."
   _QG_MEMORY="true"
-  _QG_LEARNING="true"
+  _QG_CURATION="true"
 
   if [ -n "$_qg_manifest" ] && [ -f "$_qg_manifest" ]; then
     # D-GATES-FAST-PATH: every capture hook and every session start pays this
     # read, and on most machines both switches are on. Only a JSON boolean
-    # `false` under a "memory", "learning" or "decisions" key can switch anything
-    # off, and a `\u` escape is the only JSON spelling of a letter other than the
-    # letter itself, so without one such a key appears literally. A text holding
-    # no `\u` and no key-then-`false` sequence therefore cannot switch anything
-    # off -- valid or not, it reads both-on either way -- and is settled by shell
-    # builtins (read, case, [[ =~ ]]) with no jq/node fork; everything else takes
-    # the full parse below. `read -d ''` succeeds only on reaching a NUL byte,
-    # i.e. before the end of the file, so a text it cut short is parsed in full
-    # too. An unreadable file reads empty and fails open, as the parser would.
-    local _qg_re='"(memory|learning|decisions)"[[:space:]]*:[[:space:]]*false'
+    # `false` under a "memory", "curation", "learning" or "decisions" key can
+    # switch anything off, and a `\u` escape is the only JSON spelling of a
+    # letter other than the letter itself, so without one such a key appears
+    # literally. A text holding no `\u` and no key-then-`false` sequence
+    # therefore cannot switch anything off -- valid or not, it reads both-on
+    # either way -- and is settled by shell builtins (read, case, [[ =~ ]]) with
+    # no jq/node fork; everything else takes the full parse below. `read -d ''`
+    # succeeds only on reaching a NUL byte, i.e. before the end of the file, so a
+    # text it cut short is parsed in full too. An unreadable file reads empty
+    # and fails open, as the parser would.
+    local _qg_re='"(memory|curation|learning|decisions)"[[:space:]]*:[[:space:]]*false'
     IFS= read -r -d '' _qg_text 2>/dev/null < "$_qg_manifest" && _qg_parse="true"
     case "$_qg_text" in *'\u'*) _qg_parse="true" ;; esac
     if [[ $_qg_text =~ $_qg_re ]]; then _qg_parse="true"; fi
@@ -216,7 +554,7 @@ queue_read_gates() {
     # manifest too, read only when the fast path above flagged it (an unflagged
     # manifest is both-on), so a false in all three layers still costs one fork.
     # jq cannot see duplicate keys, so this path is node whatever _HAS_JQ says.
-    local _qg_scripts="${BASH_SOURCE[0]%/*}/.." _qg_manifest_arg=""
+    local _qg_manifest_arg=""
     [ "$_qg_parse" = "true" ] && _qg_manifest_arg="$_qg_manifest"
     _qg_fields=$(node -e "
       const S = require(require('path').resolve(process.argv[1], 'resolve-settings.cjs'));
@@ -225,7 +563,7 @@ queue_read_gates() {
         try { m = JSON.parse(require('fs').readFileSync(process.argv[2], 'utf8')); } catch (_) { m = undefined; }
       }
       const w = S.foldSettings(Object.assign({ manifest: m }, S.readRepoLayers(process.argv[3]))).switches;
-      process.stdout.write(String(w.memory.on) + String.fromCharCode(10) + String(w.learning.on));
+      process.stdout.write(String(w.memory.on) + String.fromCharCode(10) + String(w.curation.on));
     " -- "$_qg_scripts" "$_qg_manifest_arg" "$_qg_root" 2>/dev/null) || _qg_fields=""
   fi
 
@@ -237,20 +575,24 @@ queue_read_gates() {
       # `try` covers a manifest whose top level or `features` is not an object; a
       # parse failure empties the output, which reads as "not switched off". The
       # comma produces two raw-output lines (newline-separated) in one jq process.
+      # Curation (#529): off when a boolean curation or learning is false; else,
+      # when neither is a boolean, off when decisions is false (isMachineFeatureOn).
       _qg_fields=$(jq -r '
         (if (try .features.memory catch null) == false then "false" else "true" end),
-        (if (try (.features | if (.learning | type) == "boolean" then .learning else .decisions end) catch null) == false
+        (if (try (.features
+            | ([.curation, .learning] | map(select(type == "boolean"))) as $c
+            | if ($c | length) > 0 then any($c[]; . == false) else .decisions == false end
+          ) catch false)
           then "false" else "true" end)
       ' "$_qg_manifest" 2>/dev/null) || _qg_fields=""
     else
+      # No jq: the fold is the resolver's own machineSwitchOn (resolve-settings.cjs),
+      # so the machine rule is not copied here. One node fork, as for jq's one process.
       _qg_fields=$(node -e "
+        const S = require(require('path').resolve(process.argv[2], 'resolve-settings.cjs'));
         const m = JSON.parse(require('fs').readFileSync(process.argv[1], 'utf8'));
-        const f = m !== null && typeof m === 'object' ? m.features : undefined;
-        const isObj = f !== null && typeof f === 'object';
-        const on = (k) => !(isObj && f[k] === false);
-        const learnKey = isObj && typeof f.learning !== 'boolean' ? 'decisions' : 'learning';
-        process.stdout.write(String(on('memory')) + String.fromCharCode(10) + String(on(learnKey)));
-      " -- "$_qg_manifest" 2>/dev/null) || _qg_fields=""
+        process.stdout.write(String(S.machineSwitchOn(m, 'memory')) + String.fromCharCode(10) + String(S.machineSwitchOn(m, 'curation')));
+      " -- "$_qg_manifest" "$_qg_scripts" 2>/dev/null) || _qg_fields=""
     fi
   fi
 
@@ -258,7 +600,7 @@ queue_read_gates() {
   case "$_qg_fields" in
     true$'\n'true|true$'\n'false|false$'\n'true|false$'\n'false)
       _QG_MEMORY="${_qg_fields%%$'\n'*}"
-      _QG_LEARNING="${_qg_fields#*$'\n'}"
+      _QG_CURATION="${_qg_fields#*$'\n'}"
       ;;
   esac