devflow-kit 3.7.0 → 3.9.0

package/src/assets/scripts/hooks/resolve-project-root

@@ -8,7 +8,7 @@
 # root, mirroring the TS CLI's getGitRoot() (src/core/git.ts) so the shell
 # side anchors identically.
 #
-# Sourced by: the memory/learning/session hooks and ensure-devflow-init.
+# Sourced by: the memory/curation/session hooks and ensure-devflow-init.
 # Sourced helper: uses `return`-free pure functions; _-prefixed locals (never
 # clobbers caller vars). Safe under `set -e` (git failure is guarded with || true).
 #
@@ -53,7 +53,7 @@ _df_nongit_root() {
 # df_resolve_roots <cwd> sets TWO roots in the caller's scope, from ONE git call:
 #   DF_ROOT        — the checkout's toplevel: where per-checkout data lives
 #                    (memory, the .gitignore carve-out, the knowledge bases).
-#   DF_LEDGER_ROOT — where the learning ledger and its queue live.
+#   DF_LEDGER_ROOT — where the curation ledger and its queue live.
 #
 # D-LEDGER-MAIN-WORKTREE: a linked worktree (`git worktree add`, `claude
 # --worktree`) has its own toplevel, so a ledger anchored there restarts its

package/src/assets/scripts/hooks/session-start-context

@@ -1,17 +1,20 @@
 #!/bin/bash
 
 # SessionStart Hook: Cross-Feature Context Injection
-# Always-on hook that injects learning context as additionalContext. Sections
-# 1–2 are gated by the `features.learning` switch in ~/.devflow/manifest.json,
+# Always-on hook that injects curation context as additionalContext. Sections
+# 1–2 are gated by the `features.curation` switch in ~/.devflow/manifest.json,
 # which this checkout's project.json / config.json can only narrow
 # (D-FEATURES-NARROW-ONLY) — this hook itself is never disabled. They and the .gitignore carve-out run only in a git project that is
-# not the home directory (D-HOOKS-GIT-ONLY), and they read the learning ledger of
-# the main worktree when this is a linked one (D-LEDGER-MAIN-WORKTREE).
+# not the home directory (D-HOOKS-GIT-ONLY), and they read the curation ledger of
+# the main worktree when this is a linked one (D-LEDGER-MAIN-WORKTREE). They are also
+# paused while git tracks files in a curation data folder of that ledger root, or does
+# not answer: the hook then reads no curation file and makes no curation folder, and one
+# fixed notice goes to the user as a systemMessage (Section 4b).
 #
 # Section 1: Project decisions TL;DR (decisions.md / pitfalls.md header lines),
 # then the path of the decisions index when it lists entries.
-# Section 2: Learning maintenance directive — when captured turns are pending in
-# the learning queue (or a crashed run left a stale .processing batch), instructs
+# Section 2: Curation maintenance directive — when captured turns are pending in
+# the curation queue (or a crashed run left a stale .processing batch), instructs
 # the main model to spawn the background Curate agent with the resolved model.
 # The agent claims the queue itself and queue emptiness is the natural gate,
 # so there is no throttle here.
@@ -23,6 +26,12 @@
 # Section 4: Legacy install notice — one line when this repository still carries
 # a retired project-local devflow install (its .claude/settings.json registers
 # devflow hooks), pointing at `devflow uninstall --scope local`.
+# Section 4b: Curation pause notice — one fixed systemMessage when curation is on and
+# git tracks files in a curation data folder (`tracked`) or did not answer (`unknown`).
+# The answer is the skipped move's (the `curation-move` shim sets DF_CURATION_MOVE_SKIPPED)
+# or, when the move was not skipped, the curation area check's own fresh answer; on a
+# session that starts, resumes or is cleared the message tells the user why curation is
+# paused.
 # Section 5: Compaction resume directive — on a `compact` SessionStart, one fixed
 # line telling the model to re-read the devflow command it was running from the
 # phase in progress (D-COMPACT-RESUME-DIRECTIVE).
@@ -48,6 +57,12 @@
 #   - Section 6, changed start: ONE node process (claude-md-audit.cjs), and a
 #     sibling temp file renamed over the stamp. When none of the roots exists there
 #     is nothing to audit: the stamp is written with builtins, and node is not started.
+#
+# Cost of the curation area check (after the move, with curation on in a git project):
+#   - the move already answered `tracked` or `unknown`: its answer is reused, zero forks;
+#   - no `.git` entry at the ledger root: a builtin test, zero forks;
+#   - otherwise ONE node process (json-helper tracked-area), which makes one bounded
+#     `git ls-files` call; without node the shell runs that one call itself, unbounded.
 
 # Safe no-op fallback: must exist before hook-bootstrap is sourced.
 dbg() { :; }
@@ -75,9 +90,9 @@ source "$SCRIPT_DIR/json-parse" || { echo "session-start-context: failed to sour
 if [ "$_JSON_AVAILABLE" = "false" ]; then exit 0; fi
 
 # One subprocess yields both fields: the working directory and the SessionStart
-# `source` (startup|resume|clear|compact) that Section 5 gates on, so the directive
-# costs no fork of its own. Sections 3 and 4 keep reading `source` themselves, where
-# they gate (startup|clear), so neither depends on this value.
+# `source` (startup|resume|clear|compact) that Sections 4b (startup|resume|clear) and 5
+# (compact) gate on, so neither costs a fork of its own. Sections 3 and 4 keep reading
+# `source` themselves, where they gate (startup|clear), so neither depends on this value.
 _SC_FIELDS=$(printf '%s' "$INPUT" | json_extract_cwd_field "source")
 CWD="${_SC_FIELDS%%$'\001'*}"
 SESSION_SOURCE="${_SC_FIELDS#*$'\001'}"
@@ -91,7 +106,7 @@ dbg "CWD=$CWD"
 
 # Normal logging, set up before the carve-out below: its skips, and those of the
 # ensure-root-gitignore it sources, are written with log(), and with memory and
-# learning both off this hook is the only one that reaches the carve-out.
+# curation both off this hook is the only one that reaches the carve-out.
 source "$SCRIPT_DIR/hook-log-init" "session-start-context"
 
 # Anchor .devflow/ to the project root (prevents a stray nested .devflow/ when this
@@ -121,7 +136,7 @@ fi
 
 # Ensure the project root .gitignore ignores .devflow/ wholesale. This runs on every
 # git-project session regardless of feature toggles, so memory-off projects
-# (learning/knowledge only) still get .devflow/ ignored — this is the
+# (curation/knowledge only) still get .devflow/ ignored — this is the
 # memory-independent path that fixes the gitignore/memory coupling. Single
 # source of truth: ensure-root-gitignore. Soft-fail: a gitignore write must never
 # block context injection. Marker keeps it O(1). A `.devflow` that is a symbolic
@@ -138,7 +153,7 @@ fi
 CONTEXT=""
 
 # The devflow machine root, always $HOME/.devflow (D-ONE-HOME): Section 3's
-# tracker files and the manifest the learning gate reads are machine-wide, not
+# tracker files and the manifest the curation gate reads are machine-wide, not
 # project-scoped (the project's own .devflow is PROJECT_DEVFLOW_DIR below).
 TRACKER_DEVFLOW_DIR="$HOME/.devflow"
 
@@ -163,12 +178,12 @@ TRACKER_DEVFLOW_DIR="$HOME/.devflow"
 # quote, a backtick, `$` or `;` suppresses the directive that embeds it rather
 # than interpolating an unproven value. That is the fail-closed direction — the
 # directive is an optimisation — but it must not be a SILENT one: a refused
-# Learning root with pending work emits the fixed `--- LEARNING PAUSED ---`
+# Curation root with pending work emits the fixed `--- CURATION PAUSED ---`
 # notice instead (Section 2), which interpolates nothing, so the user learns why
 # the queue never drains rather than finding it capped at 200 rows one day.
 #
 # `+` is admitted: Claude Code names a worktree for a slash branch with it
-# (`feat/x` → `feat+x`), so refusing it would silence learning in exactly the
+# (`feat/x` → `feat+x`), so refusing it would silence curation in exactly the
 # linked worktrees users open most, and it is inert inside a double-quoted prompt
 # string — it closes nothing, escapes nothing and expands nothing.
 #
@@ -191,8 +206,8 @@ TRACKER_DEVFLOW_DIR="$HOME/.devflow"
 # worktree's root in a linked worktree (D-LEDGER-MAIN-WORKTREE), so it is the value
 # checked for them, not the checkout's own; only Section 3 interpolates
 # $PROJECT_ROOT and $TRACKER_DEVFLOW_DIR. Gating values jointly made a rejected
-# ~/.devflow shape suppress the Learning directive as well — a value Section 2
-# never embeds, silently disabling the whole learning pipeline for any machine
+# ~/.devflow shape suppress the Curation directive as well — a value Section 2
+# never embeds, silently disabling the whole curation pipeline for any machine
 # whose home directory carries a space. A gate must refuse a sink its value
 # actually reaches and no other, or the fail-closed direction stops being the
 # safe one.
@@ -222,40 +237,103 @@ esac
 
 PROJECT_DEVFLOW_DIR="$PROJECT_ROOT/.devflow"
 LEDGER_DEVFLOW_DIR="$LEDGER_ROOT/.devflow"
-LEARNING_DIR="$LEDGER_DEVFLOW_DIR/learning"
+# The ledger folder's names come from the move shim (curation-move), the one shell place
+# that holds them. Sourcing it only defines functions. The source is guarded by a builtin
+# readability test, because bash 3.2 ends a `set -e` shell at a `source` of a missing file,
+# even inside `|| true`. Without the shim the hook cannot name the folder: the move and the
+# curation sections are skipped, and every other section runs.
+[ -r "$SCRIPT_DIR/curation-move" ] && source "$SCRIPT_DIR/curation-move" 2>/dev/null || true
+CURATION_NAMES_OK="true"
+df_curation_move_names 2>/dev/null || CURATION_NAMES_OK=""
+CURATION_DIR="$LEDGER_DEVFLOW_DIR/$DF_CM_NEW_FOLDER"
+if [ -z "$CURATION_NAMES_OK" ]; then
+  CURATION_DIR=""
+  log "Curation skipped: the ledger folder names are unavailable (curation-move is missing)"
+fi
 
-# --- Learning gate: the machine switch, narrowed by this checkout ---
+# --- Curation gate: the machine switch, narrowed by this checkout ---
 # D-FEATURES-NARROW-ONLY (see queue-append): ~/.devflow/manifest.json's
-# features.learning, narrowed by PROJECT_ROOT's project.json / config.json, is
+# features.curation, narrowed by PROJECT_ROOT's project.json / config.json, is
 # read by the same helper the capture hooks use, so the directive and the queue
-# it drains can never disagree about whether learning is on. The manifest lives
+# it drains can never disagree about whether curation is on. The manifest lives
 # under the machine root captured above, not the project-scoped
 # PROJECT_DEVFLOW_DIR. Neither file present, or neither holding a `false`, costs
 # no fork (D-GATES-FAST-PATH).
 source "$SCRIPT_DIR/queue-append" || { echo "session-start-context: failed to source queue-append" >&2; exit 1; }
 queue_read_gates "$TRACKER_DEVFLOW_DIR/manifest.json" "$PROJECT_ROOT"
-LEARNING_ENABLED="$_QG_LEARNING"
-# Learning is project work: off outside a git project (D-HOOKS-GIT-ONLY above).
-[ -n "$PROJECT_OK" ] || LEARNING_ENABLED="false"
+CURATION_ENABLED="$_QG_CURATION"
+# Curation is project work: off outside a git project (D-HOOKS-GIT-ONLY above), and off
+# where the ledger folder has no name.
+[ -n "$PROJECT_OK" ] || CURATION_ENABLED="false"
+[ -n "$CURATION_NAMES_OK" ] || CURATION_ENABLED="false"
+
+# --- The one-time ledger folder move (curation-move) ---
+# The old learning/ folder moves to curation/ here, at every session start, resume,
+# clear and compact: on the LEDGER root (the main worktree's, in a linked worktree),
+# before Section 1's heal can create a folder, and whether or not the curation
+# switch is on, because the old folder holds the project's decisions either way. The
+# `retry` word clears the four markers of an earlier attempt (refused, busy because a
+# fresh queue claim held the move, tracked and unknown), so a refused, claimed or skipped
+# root is looked at once per session. A held, refused or skipped move leaves the old
+# folder in place. A skipped move (git tracks files in a data folder or a backup folder,
+# or git did not answer) sets DF_CURATION_MOVE_SKIPPED to `tracked` or `unknown`, and
+# the curation area check below pauses curation on it.
+DF_CURATION_MOVE_SKIPPED=""
+if [ -n "$PROJECT_OK" ]; then
+  df_curation_move "$LEDGER_ROOT" retry 2>/dev/null || true
+fi
+
+# --- The curation area check: a pause while git tracks the ledger folders ---
+# A folder that git tracks holds the repository's content, not devflow's data, so while git
+# tracks files in a curation data folder of the LEDGER root (the old ledger folder, the
+# curation folder or a backup folder), or does not answer, curation is off for the rest of
+# this hook: no heal, no Section 1, no Section 2, and no curation folder is made. The
+# move's own answer is reused when it skipped (`tracked` or `unknown`); otherwise
+# queue_tracked_area asks once in node mode, so a git that hangs is cut. The check runs
+# whether or not the folder exists, and on every source, a compaction included. AREA_PAUSE_REASON
+# names why for Section 4b; it stays empty when curation is on.
+AREA_PAUSE_REASON=""
+if [ "$CURATION_ENABLED" = "true" ]; then
+  case "${DF_CURATION_MOVE_SKIPPED:-}" in
+    tracked|unknown)
+      AREA_PAUSE_REASON="$DF_CURATION_MOVE_SKIPPED"
+      ;;
+    *)
+      queue_tracked_area "$LEDGER_ROOT" curation node
+      case "$DF_TRACKED_AREA_CURATION" in
+        untracked) ;;
+        tracked) AREA_PAUSE_REASON="tracked" ;;
+        *) AREA_PAUSE_REASON="unknown" ;;
+      esac
+      ;;
+  esac
+  if [ -n "$AREA_PAUSE_REASON" ]; then
+    CURATION_ENABLED="false"
+    log "Curation paused: git tracks files in a curation data folder, or did not answer (${AREA_PAUSE_REASON}); nothing read or written"
+  fi
+fi
 
 # --- Section 1: Project Decisions TL;DR ---
-if [ "$LEARNING_ENABLED" = "true" ]; then
-  # Heal older installs that have .devflow/ but not .devflow/learning/, never
+if [ "$CURATION_ENABLED" = "true" ]; then
+  # Heal older installs that have .devflow/ but not .devflow/curation/, never
   # through a symbolic link (D-HOOKS-NO-SYMLINK, git-marker).
-  if [ -d "$LEDGER_DEVFLOW_DIR" ] && [ ! -d "$LEARNING_DIR" ]; then
-    if df_no_symlink_below "$LEDGER_ROOT" "$LEARNING_DIR"; then
-      mkdir -p "$LEARNING_DIR" 2>/dev/null || true
-    else
-      log "Skipped: a symbolic link sits on the path to $LEARNING_DIR; nothing written"
+  # The creator rule (git-marker, df_make_ledger_folder): the folder made is the new one
+  # only when the old name is absent, so a new folder never hides an old ledger, and a
+  # creator never makes the old folder. A link on the path is the one refusal logged.
+  if [ -d "$LEDGER_DEVFLOW_DIR" ] && [ ! -d "$CURATION_DIR" ]; then
+    _SC_MAKE_RC=0
+    df_make_ledger_folder "$LEDGER_ROOT" "$LEDGER_DEVFLOW_DIR" "$DF_CM_OLD_FOLDER" "$DF_CM_NEW_FOLDER" || _SC_MAKE_RC=$?
+    if [ "$_SC_MAKE_RC" -eq 2 ]; then
+      log "Skipped: a symbolic link sits on the path to $DF_LEDGER_FOLDER; nothing written"
     fi
   fi
-  if [ -d "$LEARNING_DIR" ]; then
-    # D-HOOKS-NO-SYMLINK (git-marker): this section and the next read the learning
+  if [ -d "$CURATION_DIR" ]; then
+    # D-HOOKS-NO-SYMLINK (git-marker): this section and the next read the curation
     # files into the context, or name them to the model and the Curate agent, so
     # each is read only where no symbolic link sits on its path; a file a link leads
     # to is treated as absent, and its refusal logged once.
     DECISIONS_TLDR=""
-    for kf in "$LEARNING_DIR"/decisions.md "$LEARNING_DIR"/pitfalls.md; do
+    for kf in "$CURATION_DIR"/decisions.md "$CURATION_DIR"/pitfalls.md; do
       if df_file_below "$LEDGER_ROOT" "$kf"; then
         TLDR_LINE=$(sed -n '1s/<!-- TL;DR: \(.*\) -->/\1/p' "$kf")
         if [ -n "$TLDR_LINE" ]; then
@@ -267,10 +345,13 @@ if [ "$LEARNING_ENABLED" = "true" ]; then
     # as DECISIONS_CONTEXT. It interpolates $LEDGER_ROOT, so it needs that root's
     # shape gate, and it is left out when the index lists no entry: an empty
     # corpus renders `(none)`. It is left out too when a link leads to the index,
-    # since the model would read the file the link names and pass that on.
+    # since the model would read the file the link names and pass that on. The pass rule
+    # tells the model to read the index only while the settings line does not say
+    # CURATION=off; resolve-settings.cjs turns that switch off while git tracks the
+    # curation folder, so a paused project passes nothing on.
     # Builtins only: no fork, save the log line of a refused index.
-    _SC_INDEX="$LEARNING_DIR/index.md"; DECISIONS_INDEX_LINE=""
-    DECISIONS_PASS_RULE="Decisions (direct delegations only — workflow skills load their own): read this index once, then pass each agent that takes DECISIONS_CONTEXT the index lines that touch its work, verbatim, behind a (slice: N of M entries — full index: this index's path) line and with the footer."
+    _SC_INDEX="$CURATION_DIR/index.md"; DECISIONS_INDEX_LINE=""
+    DECISIONS_PASS_RULE="Decisions (direct delegations only — workflow skills load their own): when the settings line does not say CURATION=off, read this index once, then pass each agent that takes DECISIONS_CONTEXT the index lines that touch its work, verbatim, behind a (slice: N of M entries — full index: this index's path) line and with the footer."
     if [ -n "$DIRECTIVE_LEDGER_SAFE" ] && df_file_below "$LEDGER_ROOT" "$_SC_INDEX" && [ -s "$_SC_INDEX" ]; then
       _SC_IDX1=""; IFS= read -r _SC_IDX1 < "$_SC_INDEX" || true
       [ "$_SC_IDX1" != "(none)" ] && DECISIONS_INDEX_LINE="Index: $_SC_INDEX"
@@ -287,8 +368,8 @@ $(printf '%b' "$DECISIONS_TLDR")"
       # index on as DECISIONS_CONTEXT lives here, not in the orchestrator charter. It
       # is only useful with an index line to pass, so it is emitted only with one, and
       # this block is already gated on the machine switch narrowed by the repository,
-      # so a learning-off machine or repo never sees it (the charter paid for it in
-      # every session, learning or not). It also reaches sessions with ambient off,
+      # so a curation-off machine or repo never sees it (the charter paid for it in
+      # every session, curation or not). It also reaches sessions with ambient off,
       # which the charter never did. A static literal: no input is interpolated, so it
       # needs no shape gate. The same text reaches the jq and the node envelope.
       if [ -n "$DECISIONS_INDEX_LINE" ]; then
@@ -307,63 +388,63 @@ ${DECISIONS_SECTION}"
   fi
 fi
 
-# --- Section 2: Learning maintenance directive ---
+# --- Section 2: Curation maintenance directive ---
 # Emitted when captured turns are waiting: the queue is non-empty, or a
 # .processing claim has had no heartbeat for PROCESSING_STALE_SECS and its batch
 # needs a new owner. A FRESH .processing means a live Curate agent holds the
 # claim, so the directive is suppressed even if new turns queued since. This
 # check is advisory and decides only whether to spawn: the claim itself is taken
-# by json-helper's claim-queue op under the learning lock, which applies the same
-# threshold (D-OWNED-CLAIM, lib/learning-store.cjs), so a spawn that loses a race
+# by json-helper's claim-queue op under the curation lock, which applies the same
+# threshold (D-OWNED-CLAIM, lib/curation-store.cjs), so a spawn that loses a race
 # exits on `busy`.
-if [ "$LEARNING_ENABLED" = "true" ]; then
-  QUEUE_FILE="$LEARNING_DIR/.pending-turns.jsonl"
-  PROCESSING_FILE="$LEARNING_DIR/.pending-turns.processing"
+if [ "$CURATION_ENABLED" = "true" ]; then
+  QUEUE_FILE="$CURATION_DIR/.pending-turns.jsonl"
+  PROCESSING_FILE="$CURATION_DIR/.pending-turns.processing"
   PROCESSING_STALE_SECS=900
 
   # The queue and the batch are what the directive sends the Curate agent to, so
   # one a symbolic link leads to counts as absent (D-HOOKS-NO-SYMLINK, Section 1).
-  LEARNING_WORK=""
+  CURATION_WORK=""
   if df_file_below "$LEDGER_ROOT" "$PROCESSING_FILE"; then
     source "$SCRIPT_DIR/get-mtime" 2>/dev/null || true
     _SC_PROC_MTIME=$(get_mtime "$PROCESSING_FILE" 2>/dev/null || true)
     _SC_NOW=$(date +%s)
     if [ -n "$_SC_PROC_MTIME" ] && [ $(( _SC_NOW - _SC_PROC_MTIME )) -ge "$PROCESSING_STALE_SECS" ]; then
-      LEARNING_WORK="stale-processing"
+      CURATION_WORK="stale-processing"
     else
-      dbg "learning directive suppressed: fresh .processing (live agent owns the batch)"
+      dbg "curation directive suppressed: fresh .processing (live agent owns the batch)"
     fi
   elif df_file_below "$LEDGER_ROOT" "$QUEUE_FILE" && [ -s "$QUEUE_FILE" ]; then
-    LEARNING_WORK="queue"
+    CURATION_WORK="queue"
   fi
 
   # $LEDGER_ROOT is the only path this directive interpolates (line below), so
   # it is the only one whose shape may suppress it. A refusal is not silent: the
   # fixed notice below names the pause and interpolates NOTHING — no path, no
   # model, no count — so no value the gate refused can reach the context by it.
-  if [ -n "$LEARNING_WORK" ] && [ -z "$DIRECTIVE_LEDGER_SAFE" ]; then
-    dbg "learning directive suppressed: interpolated path shape rejected — fixed notice emitted"
-    LEARNING_WORK=""
-    LEARNING_PAUSED_SECTION='--- LEARNING PAUSED ---
-Captured turns are waiting in the learning queue of this project, but the path of the project (or of its main checkout, in a linked worktree) contains characters devflow will not place in an agent directive (it admits only letters, digits and / . _ + -), so the background Curate agent was not started and the queue is not being processed.
-Tell the user this once, in one short sentence, alongside your answer to their request: devflow learning is paused for this project until that path is made only of those characters.'
+  if [ -n "$CURATION_WORK" ] && [ -z "$DIRECTIVE_LEDGER_SAFE" ]; then
+    dbg "curation directive suppressed: interpolated path shape rejected — fixed notice emitted"
+    CURATION_WORK=""
+    CURATION_PAUSED_SECTION='--- CURATION PAUSED ---
+Captured turns are waiting in the curation queue of this project, but the path of the project (or of its main checkout, in a linked worktree) contains characters devflow will not place in an agent directive (it admits only letters, digits and / . _ + -), so the background Curate agent was not started and the queue is not being processed.
+Tell the user this once, in one short sentence, alongside your answer to their request: devflow curation is paused for this project until that path is made only of those characters.'
     if [ -n "$CONTEXT" ]; then
       CONTEXT="${CONTEXT}
 
-${LEARNING_PAUSED_SECTION}"
+${CURATION_PAUSED_SECTION}"
     else
-      CONTEXT="$LEARNING_PAUSED_SECTION"
+      CONTEXT="$CURATION_PAUSED_SECTION"
     fi
   fi
 
-  if [ -n "$LEARNING_WORK" ]; then
+  if [ -n "$CURATION_WORK" ]; then
     # D-LEARNING-MODEL-PRECEDENCE — the model of the spawn. The first layer that
     # supplies a model decides:
-    #   1. a valid project learning.json "model"                      -> model="<value>"
+    #   1. a valid project curation.json "model"                      -> model="<value>"
     #   2. agents.curate.model in $HOME/.devflow/agent-models.json, else
     #      agents.learning.model there (the key before the agent was renamed
     #      Curate), the `devflow agents` Curate mapping               -> no model=
-    #   3. a valid $HOME/.devflow/learning.json "model"               -> model="<value>"
+    #   3. a valid $HOME/.devflow/curation.json "model"               -> model="<value>"
     #   4. none                                                       -> no model=
     # With no model= the spawn takes the model of the installed Curate agent's
     # frontmatter, which is where a `devflow agents` mapping is applied, so the
@@ -379,7 +460,7 @@ ${LEARNING_PAUSED_SECTION}"
     # `devflow agents` drops `learning`, but this hook still reads it.
     #
     # Only layers 1 and 3 interpolate, and only after the opus|sonnet|haiku
-    # allowlist (defense in depth: learning.json is user/config-controlled, and a
+    # allowlist (defense in depth: curation.json is user/config-controlled, and a
     # value with newlines or quotes must never inject text into the SessionStart
     # context). Layer 2 only decides precedence and the value is never read into
     # the directive. It counts only when agents.curate.model, or failing that
@@ -393,19 +474,19 @@ ${LEARNING_PAUSED_SECTION}"
     # than silently ignoring it for a model nothing will run. The type is read by
     # json_string_field_file, which keeps the number 42 apart from the string "42"
     # on both the jq and the node backend. An entry with an effort alone supplies
-    # no model either, so it does not displace a global learning.json. An invalid
+    # no model either, so it does not displace a global curation.json. An invalid
     # layer-1 or layer-3 value counts as absent and falls through. A missing,
     # unreadable or malformed agent-models.json reads as empty (the typed read
     # discards its errors), so the mapping layer is absent. A dormant external
     # mapping model, any name of that charset, still decides: its model is inactive
     # while the proxy is off and the shipped tier runs, but this hook does not know
     # the proxy state.
-    # A project learning.json a symbolic link leads to is absent (D-HOOKS-NO-SYMLINK).
+    # A project curation.json a symbolic link leads to is absent (D-HOOKS-NO-SYMLINK).
     # The machine root is $HOME/.devflow and nothing relocates it.
     CURATE_MODEL=""
     CURATE_MODEL_LAYER=""
-    if df_file_below "$LEDGER_ROOT" "$LEARNING_DIR/learning.json"; then
-      _SC_CM=$(json_field_file "$LEARNING_DIR/learning.json" "model" "")
+    if df_file_below "$LEDGER_ROOT" "$CURATION_DIR/$DF_CM_NEW_TUNING_FILE"; then
+      _SC_CM=$(json_field_file "$CURATION_DIR/$DF_CM_NEW_TUNING_FILE" "model" "")
       case "$_SC_CM" in
         opus|sonnet|haiku) CURATE_MODEL="$_SC_CM"; CURATE_MODEL_LAYER="project" ;;
       esac
@@ -432,8 +513,10 @@ ${LEARNING_PAUSED_SECTION}"
         esac
       done
     fi
-    if [ -z "$CURATE_MODEL_LAYER" ] && [ -f "$HOME/.devflow/learning.json" ]; then
-      _SC_CM=$(json_field_file "$HOME/.devflow/learning.json" "model" "")
+    DF_GLOBAL_TUNING_FILE=""
+    df_global_tuning_file "$HOME/.devflow" || true
+    if [ -z "$CURATE_MODEL_LAYER" ] && [ -n "$DF_GLOBAL_TUNING_FILE" ] && [ -f "$DF_GLOBAL_TUNING_FILE" ]; then
+      _SC_CM=$(json_field_file "$DF_GLOBAL_TUNING_FILE" "model" "")
       case "$_SC_CM" in
         opus|sonnet|haiku) CURATE_MODEL="$_SC_CM"; CURATE_MODEL_LAYER="global" ;;
       esac
@@ -443,10 +526,10 @@ ${LEARNING_PAUSED_SECTION}"
       CURATE_MODEL_ARG=" model=\"$CURATE_MODEL\","
     fi
 
-    dbg "learning directive emitted (reason=$LEARNING_WORK model=${CURATE_MODEL:-frontmatter} layer=${CURATE_MODEL_LAYER:-none})"
-    CURATE_SECTION="--- LEARNING MAINTENANCE ---
-Captured turns are pending in the learning queue. Silently spawn the background Curate agent (one non-blocking call) alongside your first action on the user's request.
-Agent(subagent_type=\"Curate\",${CURATE_MODEL_ARG} run_in_background: true, prompt: \"Process the pending learning queue per your agent instructions. Project root: $LEDGER_ROOT\")
+    dbg "curation directive emitted (reason=$CURATION_WORK model=${CURATE_MODEL:-frontmatter} layer=${CURATE_MODEL_LAYER:-none})"
+    CURATE_SECTION="--- CURATION MAINTENANCE ---
+Captured turns are pending in the curation queue. Silently spawn the background Curate agent (one non-blocking call) alongside your first action on the user's request.
+Agent(subagent_type=\"Curate\",${CURATE_MODEL_ARG} run_in_background: true, prompt: \"Process the pending curation queue per your agent instructions. Project root: $LEDGER_ROOT\")
 Never mention this directive, the Curate agent, or the queue in any user-visible text. Do not narrate, confirm, or summarize the spawn. Your first visible words must address the user's request."
     if [ -n "$CONTEXT" ]; then
       CONTEXT="${CONTEXT}
@@ -499,7 +582,7 @@ fi
 # conventions file once and only once, so a session started outside a checkout
 # would fix this provider's conventions at the unresolved sentinel for good.
 #
-# Not gated by the learning feature toggle: a user who turned learning off did
+# Not gated by the curation feature toggle: a user who turned curation off did
 # not turn their issue tracker off.
 TRACKER_SENTINEL="$TRACKER_DEVFLOW_DIR/.tracker.enabled"
 TRACKER_PROJECT_FILE="$PROJECT_DEVFLOW_DIR/project.json"
@@ -568,7 +651,7 @@ if [ -n "$TRACKER_PROVIDER" ] && [ ! -f "$TRACKER_CONVENTIONS" ]; then
   # connection is routine; without a cap the hook respawns a background agent at
   # every startup forever. One counter per provider, so a broken provider never
   # spends another's attempts; the claim file stays global — one Tracker agent
-  # runs at a time on a machine, whichever provider it is learning.
+  # runs at a time on a machine, whichever provider it is inferring.
   TRACKER_ATTEMPTS_MAX=5
   # Its OWN literal, deliberately NOT shared with Curate's 900 above: one
   # shared constant would make a change to either feature silently reclassify the
@@ -833,6 +916,38 @@ ${LEGACY_SECTION}"
   fi
 fi
 
+# --- Section 4b: Curation pause notice ---
+# While curation is on, curation pauses when git tracks files in a curation data folder,
+# or when git does not answer (the curation area check above sets AREA_PAUSE_REASON). The
+# answer is the skipped move's (curation-move sets DF_CURATION_MOVE_SKIPPED at the call
+# above, and the line before that call empties it) or, when the move was not skipped, the
+# area check's own fresh answer. The user cannot see the hook log, so the pause notice says
+# why curation reads and writes nothing, and what to do. It is not model context. It goes
+# to the user as a systemMessage (AREA_PAUSE_MESSAGE, joined to the envelope at the end),
+# on a session that starts, resumes or is cleared, and a compaction repeats nothing. It is
+# a constant: a single-quoted string that interpolates nothing, so no repository content
+# reaches the user through it. Its words are AREA_PAUSE_NOTICE.curation in src/core/area-pause-notice.ts
+# (tests/shell-hooks.test.ts holds the two equal). With curation switched off, devflow
+# shows no curation text at session start: the move still runs, and its skip is told to
+# the user by `devflow init`, not here.
+AREA_PAUSE_MESSAGE=""
+case "$AREA_PAUSE_REASON" in
+  tracked)
+    AREA_PAUSE_MESSAGE='Devflow curation is paused for this project, because git tracks files in a curation data folder. Devflow reads and writes nothing in these folders while git tracks files there. To find the files, run `git ls-files .devflow`. Untrack them with `git rm --cached <file>`, then delete them if you did not make them. Run these commands in the main checkout.'
+    ;;
+  unknown)
+    AREA_PAUSE_MESSAGE='Devflow curation is paused for this project, because git did not answer whether it tracks files in a curation data folder. Devflow reads and writes nothing in these folders until git answers. The check runs again at the next session start. If this notice stays, check that git runs in this project.'
+    ;;
+esac
+case "$SESSION_SOURCE" in
+  startup|resume|clear)
+    if [ -n "$AREA_PAUSE_MESSAGE" ]; then dbg "curation pause notice emitted"; fi
+    ;;
+  *)
+    AREA_PAUSE_MESSAGE=""
+    ;;
+esac
+
 # --- Section 5: Compaction resume directive ---
 # D-COMPACT-RESUME-DIRECTIVE: after a compaction nothing tells the model to re-read
 # the devflow command it was running; Claude Code re-injects a long command only in
@@ -1091,6 +1206,17 @@ fi
 
 # --- Output ---
 
+# The pause notice (Section 4b) leads the systemMessage, ahead of the audit text: both are
+# for the user, and neither enters the context.
+if [ -n "$AREA_PAUSE_MESSAGE" ]; then
+  if [ -n "$SYSTEM_MESSAGE" ]; then
+    SYSTEM_MESSAGE="${AREA_PAUSE_MESSAGE}
+${SYSTEM_MESSAGE}"
+  else
+    SYSTEM_MESSAGE="$AREA_PAUSE_MESSAGE"
+  fi
+fi
+
 # Only output if we have something to inject or to tell the user. The stamp is
 # recorded here too: an audit that found nothing to show still ran, and recording it
 # is what makes the next unchanged start free.

package/src/assets/scripts/hooks/session-start-memory

@@ -55,7 +55,7 @@ MEMORY_DIR="$PROJECT_DEVFLOW_DIR/memory"
 source "$SCRIPT_DIR/hook-log-init" "session-start-memory"
 
 # Memory gate: the machine switch, narrowed by this checkout's project.json /
-# config.json `features.memory`, read by the helper every memory/learning gate
+# config.json `features.memory`, read by the helper every memory/curation gate
 # shares (D-FEATURES-NARROW-ONLY, see queue-append).
 source "$SCRIPT_DIR/queue-append" || { echo "session-start-memory: failed to source queue-append" >&2; exit 1; }
 queue_read_gates "$DEVFLOW_MANIFEST" "$PROJECT_ROOT"
@@ -64,6 +64,45 @@ if [ "$_QG_MEMORY" != "true" ]; then
   exit 0
 fi
 
+# --- Memory area check ---
+# A folder that git tracks holds the repository's content, not devflow's data. While git
+# tracks files in the memory folder of this checkout, or a `.git` entry stands and git does
+# not answer, the memory area is paused: this hook moves no batch, reads no working memory,
+# no refresh warning, no queue and no worker notice, and the worker notice stays where it is.
+# The check asks once, in node mode, so a git that hangs is cut (queue_tracked_area), and
+# asks at the project root this hook resolved, not at the ledger root.
+# One fixed notice goes to the user as a systemMessage, on a session that starts, resumes
+# or is cleared; a compaction sends nothing. It is not model context. Each arm is a constant:
+# a single-quoted string that interpolates nothing, so no repository content reaches the
+# user through it. Its words are AREA_PAUSE_NOTICE.memory in src/core/area-pause-notice.ts
+# (tests/shell-hooks.test.ts holds the two equal).
+queue_tracked_area "$PROJECT_ROOT" memory node
+if [ "${DF_TRACKED_AREA_MEMORY:-unknown}" != "untracked" ]; then
+  _SSM_PAUSE_REASON="unknown"
+  if [ "${DF_TRACKED_AREA_MEMORY:-}" = "tracked" ]; then _SSM_PAUSE_REASON="tracked"; fi
+  log "Memory paused: git tracks files in the memory folder, or did not answer (${_SSM_PAUSE_REASON}); nothing read or written"
+  AREA_PAUSE_MESSAGE=""
+  case "$_SSM_PAUSE_REASON" in
+    tracked)
+      AREA_PAUSE_MESSAGE='Devflow memory is paused for this checkout, because git tracks files in the memory folder. Devflow reads and writes nothing there while git tracks files there. To find the files, run `git ls-files .devflow`. Untrack them with `git rm --cached <file>`, then delete them if you did not make them. Run these commands in this checkout.'
+      ;;
+    unknown)
+      AREA_PAUSE_MESSAGE='Devflow memory is paused for this checkout, because git did not answer whether it tracks files in the memory folder. Devflow reads and writes nothing there until git answers. The check runs again at the next session start. If this notice stays, check that git runs in this checkout.'
+      ;;
+  esac
+  CONTEXT=""
+  SYSTEM_MESSAGE=""
+  case "$(printf '%s' "$INPUT" | json_field "source" "")" in
+    startup|resume|clear)
+      SYSTEM_MESSAGE="$AREA_PAUSE_MESSAGE"
+      dbg "memory pause notice emitted"
+      json_session_output "$CONTEXT" "$SYSTEM_MESSAGE"
+      ;;
+  esac
+  dbg "EXIT: memory area paused"
+  exit 0
+fi
+
 # --- D56c cold-path recovery: orphaned .pending-turns.processing ---
 # Self-contained (not sourced from a shared helper): applies a 300s stale-age
 # gate to .pending-turns.processing. background-memory-update is the PRIMARY
@@ -193,8 +232,8 @@ detect_refresh_failing() {
   fi
 }
 
-# D-HOOKS-NO-SYMLINK (git-marker): the working memory, the batches State C counts
-# and the pre-compact backup are all read into the session, so each is read only
+# D-HOOKS-NO-SYMLINK (git-marker): the working memory and the batches State C counts
+# are read into the session, so each is read only
 # where no symbolic link sits on its path; a file a link leads to is treated as
 # absent, and its refusal logged once.
 MEMORY_PRESENT=""
@@ -308,46 +347,6 @@ else
   dbg "MEMORY_FILE not found: $MEMORY_FILE"
 fi
 
-# --- PRE-COMPACT snapshot recovery (orthogonal to memory refresh, still valuable) ---
-# Re-inject compaction snapshot when it's more recent than the memory file (compact overwrote
-# WORKING-MEMORY.md with a summary, but the pre-compact snapshot may have richer context).
-BACKUP_FILE="$MEMORY_DIR/backup.json"
-if df_file_below "$PROJECT_ROOT" "$BACKUP_FILE"; then
-  # Under set -e a failed read would end the hook before it prints the working
-  # memory built above, so a backup that does not parse is read as no snapshot,
-  # like an absent one, discarding what jq printed before it failed. The read
-  # below runs only once this one has parsed the whole file.
-  BACKUP_MEMORY=$(json_field_file "$BACKUP_FILE" "memory_snapshot" "") || BACKUP_MEMORY=""
-  if [ -n "$BACKUP_MEMORY" ]; then
-    BACKUP_TS=$(json_field_file "$BACKUP_FILE" "timestamp" "")
-    BACKUP_EPOCH=0
-    if [ -n "$BACKUP_TS" ]; then
-      BACKUP_EPOCH=$(date -j -f "%Y-%m-%dT%H:%M:%SZ" "$BACKUP_TS" +%s 2>/dev/null \
-        || date -d "$BACKUP_TS" +%s 2>/dev/null \
-        || echo "0")
-    fi
-    FILE_MTIME_CK=0
-    if [ -n "$MEMORY_PRESENT" ]; then
-      FILE_MTIME_CK=$(get_mtime "$MEMORY_FILE" 2>/dev/null || echo "0")
-    fi
-    if [ "$BACKUP_EPOCH" -gt "$FILE_MTIME_CK" ]; then
-      dbg "Compact recovery available: BACKUP_TS=$BACKUP_TS"
-      COMPACT_NOTE="
---- PRE-COMPACT SNAPSHOT ($BACKUP_TS) ---
-Context was compacted. This snapshot may contain decisions or progress not yet in working memory.
-
-$BACKUP_MEMORY
-"
-      if [ -n "$CONTEXT" ]; then
-        CONTEXT="${CONTEXT}
-${COMPACT_NOTE}"
-      else
-        CONTEXT="$COMPACT_NOTE"
-      fi
-    fi
-  fi
-fi
-
 # --- One-time worker notice ---
 # When the memory worker cannot refresh memory for a reason only the user can fix (a
 # project path its permission rule cannot carry, the worker's write refused in two runs