devflow-kit 3.8.0 → 3.10.0

package/dist/cli/commands/init.js

@@ -14,16 +14,18 @@ import { loadCurationMove } from '../../core/curation-move.js';
 import { describeMoveText, describeOutcome, runInitCurationMove, shownSkipAt } from './curation-move-step.js';
 import { realGlobalTuningMoveIO, realProjectLedgerMoveIO } from './curation-move-io.js';
 import { describeEchoedValue } from '../../core/echo-value.js';
-import { installViaFileCopy, composeScripts } from '../../targets/claude-code/installer.js';
-import { formatOverlaySummary, formatSkillScopeSummary, formatTrackerAssetSummary, isPluginListUnchanged } from './install-report.js';
+import { installViaFileCopy, installScripts } from '../../targets/claude-code/installer.js';
+import { formatLinksSummary, formatOverlaySummary, formatSkillScopeSummary, formatTrackerAssetSummary, isPluginListUnchanged } from './install-report.js';
+import { mergeLinkReports, newLinkReport } from '../../targets/claude-code/linked-folder.js';
+import { sweepLegacyDevflowFiles } from './legacy-sweep.js';
 import { convergeTrackerArtifacts } from '../../targets/claude-code/tracker-install.js';
 import { installSettings, installManagedSettings, installClaudeignore, hasClaudeignore, discoverProjectGitRoots, ensureDevflowGitignore, applyUserSecurityDenyList, detectDenyState, resolveSecurityAction, assertHistoricalDenySuperset, loadTemplateDenyEntries, stripUserSecurityDenyList, } from '../../targets/claude-code/post-install.js';
-import { DEVFLOW_PLUGINS, LEGACY_COMMAND_NAMES, LEGACY_RULE_NAMES, buildAssetMaps, buildScopedSkillsMap, buildRulesMap, partitionSelectablePlugins, WORKFLOW_ORDER, parsePluginSelection, resolveFeatureRedirect } from '../../core/plugins.js';
+import { DEVFLOW_PLUGINS, registeredPluginNames, buildAssetMaps, buildScopedSkillsMap, buildRulesMap, partitionSelectablePlugins, WORKFLOW_ORDER, parsePluginSelection, resolveFeatureRedirect } from '../../core/plugins.js';
 import { LEGACY_SKILL_NAMES } from '../../targets/claude-code/legacy.js';
 import { detectPlatform, detectShell, getProfilePath, getSafeDeleteInfo, hasSafeDelete } from '../../core/safe-delete.js';
 import { generateSafeDeleteBlock, installToProfile, removeFromProfile, getInstalledVersion, SAFE_DELETE_BLOCK_VERSION } from '../../core/safe-delete-install.js';
 import { convergeAmbientHooks } from './ambient.js';
-import { convergeMemoryHooks, drainMemoryQueue, workingMemoryNote } from './memory.js';
+import { convergeMemoryHooks, drainMemoryQueue, formatMemoryNotDrained, workingMemoryNote } from './memory.js';
 import { addCaptureHooks, removeCaptureHooks } from './capture.js';
 import { removeDreamHook } from './legacy-hooks.js';
 import { addProxyHooks, removeProxyHooks, applyProxyEnv, stripProxyEnv, runProxyPreflight, buildRealPreflightDeps } from './proxy.js';
@@ -39,7 +41,6 @@ import { addContextHook, removeContextHook, hasContextHook } from './context.js'
 import { writeSettingsFileAtomic } from '../../core/fs-atomic.js';
 import { writeManagedConfig, readConfigIfPresent, DEFAULT_CONFIG } from '../../core/feature-config.js';
 import { drainDisabledCurationQueue, formatCurationNotDrained } from '../../core/curation-queue-cleanup.js';
-import { formatRefusedDrain } from '../../core/queue-drain.js';
 import { removeManagedDenyList, describeManagedDenyRemoval } from './security.js';
 import { resolveInitSeed, applyCliToggles, resolveResetGatedInputs, resolvePluginsToInstall } from './init-seed.js';
 import { parseFrameworkList, normalizeFrameworks } from '../../core/compliance.js';
@@ -50,8 +51,8 @@ import { applyTrackerSentinel, effectiveTrackerServers, parseTrackerId, rearmTra
 import { formatTrackerSummary, shouldRunTrackerStep, runTrackerStep, buildClackTrackerPrompts, } from './tracker-prompts.js';
 import { buildClackGateLevelPrompts, carriedGateLevel, formatGateLevelRow, formatGateLevelSummary, readStoredGateLevel, resolveGateLevelForInit, resolveGateLevelInitState, } from './gate-level-prompts.js';
 import { shouldRunAttributionStep, runAttributionStep, buildClackAttributionPrompts, applyAttributionAnswer, attributionSeedFrom, } from './attribution-prompts.js';
-import { convergeFromManifest } from '../../targets/claude-code/compliance-install.js';
-import { convergeCurationVariants, installedVersionMatches, readRunningVersion } from '../../targets/claude-code/curation-install.js';
+import { convergeVariantAxes, describePostingLeft, installedVersionMatches, readRunningVersion } from '../../targets/claude-code/curation-install.js';
+import { POSTING_OFF_NOTICE, installRecordFor, postingNoticeDue, readInstalledVariants } from '../../core/installed-variants.js';
 import { auditAndRecordClaudeMd, formatClaudeMdAuditNote, formatClaudeMdAuditUnavailable, } from '../../core/claude-md-audit.js';
 import * as os from 'os';
 // Re-export pure functions for tests (canonical source is post-install.ts)
@@ -146,6 +147,43 @@ function logSummaryLines(lines) {
         }
     }
 }
+/**
+ * Converge the installed agents onto the saved model and effort assignments, after the file copy
+ * wrote the shipped defaults. Per-item failures are non-fatal.
+ *
+ * Init-only optimization: with an empty mapping and the proxy off, every agent already holds its
+ * shipped default, so the walk would read the agent files and write none; it is skipped. The
+ * disable and revert paths call `reapplyAgentMapping` directly and always need the full walk.
+ * `hasAgentMappingEntries` counts agent entries only: an `agents.memory`-only mapping names no
+ * installed file, so it keeps this gate closed (D-WORKER-AGENTS).
+ *
+ * The links this walk met are returned, not printed: the caller prints them once, through the same
+ * summary as the install step. `verbose` prints the other warnings of the walk.
+ */
+export async function reapplyAgentMappingForInit(opts) {
+    const { proxyEnabled, claudeDir, devflowDir, verbose } = opts;
+    const preCheckMapping = await readAgentMapping(devflowDir);
+    const hasMappingEntries = preCheckMapping.ok && hasAgentMappingEntries(preCheckMapping.value);
+    if (!hasMappingEntries && !proxyEnabled)
+        return newLinkReport();
+    const result = await reapplyAgentMapping({
+        proxyEnabled,
+        installDir: path.join(claudeDir, 'agents', 'devflow'),
+        devflowDir,
+    });
+    const links = { replacedLinks: result.replacedLinks, refusedFolders: result.refusedFolders };
+    if (verbose) {
+        const linkLines = new Set(formatLinksSummary(links).map(line => line.message));
+        for (const warning of result.warnings) {
+            if (!linkLines.has(warning))
+                p.log.warn(warning);
+        }
+        if (result.updated.length > 0) {
+            p.log.info(`Agent model mapping reapplied: ${result.updated.length} agent(s) updated`);
+        }
+    }
+    return links;
+}
 /**
  * Classify the safe-delete installation state based on the installed version
  * in the user's shell profile.
@@ -517,11 +555,13 @@ export async function lookupDrainLedgerRoot(opts, lookup = lookupLedgerRoot) {
  *
  * Returns one warning for each drain refused because a folder on the way to its
  * queue is a symbolic link (D-CLI-NO-SYMLINK), one for a curation drain that
- * could not list the backups (the live queue is drained then), and one for a curation
+ * could not list the backups (the live queue is drained then), one for a curation
  * drain that left the project alone because git tracks a data folder or did not answer
- * (the fixed notice of a skipped move); the caller prints them. When the move step has
- * printed that notice for the ledger root (`shownSkip`, its reason), the drain's line
- * does not repeat it.
+ * (the fixed notice of a paused curation area), and one for a memory drain that left the project
+ * alone because git tracks the memory folder or did not answer (the fixed notice of a
+ * paused memory area); the caller prints them. When the move step has printed its own
+ * notice of a skipped move for the ledger root (`shownSkip`, its reason), the curation
+ * drain's line is only the short sentence that the queue was not drained.
  */
 export async function drainDisabledFeatureQueues(opts, io = { drainMemoryQueue, drainCurationQueue: drainDisabledCurationQueue }) {
     if (!opts.manifestWritten)
@@ -530,7 +570,7 @@ export async function drainDisabledFeatureQueues(opts, io = { drainMemoryQueue,
     if (!opts.memoryEnabled && opts.gitRoot !== null) {
         const memory = await io.drainMemoryQueue(opts.gitRoot);
         if (!memory.drained)
-            refused.push(formatRefusedDrain('memory', memory.linkedFolder));
+            refused.push(formatMemoryNotDrained(memory));
     }
     if (!opts.curationEnabled && opts.ledgerRoot !== null) {
         const curation = await io.drainCurationQueue(opts.ledgerRoot);
@@ -590,6 +630,20 @@ export function buildHudOnlyManifest(existing, version, now, refusedGateLevel) {
         updatedAt: now,
     };
 }
+/**
+ * The plugin names `init --hud-only` renders the orchestrator charter for. Pure.
+ *
+ * D-CHARTER-INSTALL-RENDER: --hud-only reinstalls no plugin, so the installed charter must keep describing
+ * what the manifest says is installed: the recorded plugins, with a deleted name pruned and a legacy name
+ * mapped as every other partial run does (`resolvePluginList`), and only names this registry has kept
+ * ({@link registeredPluginNames}). With no manifest, or one `readManifest()` refused, nothing is known to be installed, so the set is EMPTY: the
+ * render then names no workflow, and no sentinel is written. The registry fallback that uninstall takes
+ * would hand a machine with no record every workflow's routing line, which is the failure the render exists
+ * to prevent.
+ */
+export function hudOnlyCharterPlugins(manifest) {
+    return registeredPluginNames(resolvePluginList([], manifest, true));
+}
 /**
  * The line `init --hud-only` prints when the version the manifest records is not the
  * running version, or null when there is nothing to say. Pure.
@@ -703,8 +757,8 @@ export const initCommand = new Command('init')
     .option('--no-proxy', 'Disable external model routing')
     .option('--behavior', 'Enable the behavior rule (agents reply in ASD-STE100 Simplified Technical English; off by default)')
     .option('--no-behavior', 'Disable the behavior rule')
-    .option('--compliance <list>', 'Enable compliance with comma-separated framework IDs (e.g., gdpr,hipaa)')
-    .option('--no-compliance', 'Disable compliance (removes the rule; the skill and framework references stay installed; frameworks remembered for re-enable)')
+    .option('--compliance <list>', 'Enable compliance with comma-separated framework IDs (e.g., gdpr,hipaa); installs the steps that post evidence and summaries to GitHub or a tracker')
+    .option('--no-compliance', 'Disable compliance (removes the rule and every step that posts evidence or summaries to GitHub or a tracker; the skill and framework references stay installed; frameworks remembered for re-enable)')
     .option('--tracker <id>', 'The machine\'s default issue tracker provider: github, jira, or linear')
     .option('--gate-level <full|standard|lean>', 'The machine\'s default gate level: full, standard, or lean (skips the gate level prompt)')
     .option('--security <mode>', 'Security deny list location: user, managed, or none', /^(user|managed|none)$/i)
@@ -780,22 +834,28 @@ export const initCommand = new Command('init')
             p.log.error(`Failed to update settings: ${error instanceof Error ? error.message : error}`);
             process.exit(1);
         }
-        // Install HUD scripts to devflow dir
-        const scriptsTarget = path.join(devflowDir, 'scripts');
-        try {
-            await composeScripts(scriptsTarget);
-        }
-        catch (error) {
-            p.log.error(`Failed to install HUD scripts: ${error instanceof Error ? error.message : error}`);
-            process.exit(1);
-        }
         // Read the existing manifest: over a prior install, --hud-only touches only
-        // the HUD (D-HUD-ONLY-PRESERVE in buildHudOnlyManifest).
+        // the HUD (D-HUD-ONLY-PRESERVE in buildHudOnlyManifest). Read before the scripts are
+        // installed, so the charter render works from the record as the run found it.
         let existingHudManifest = null;
         try {
             existingHudManifest = await readManifest(devflowDir);
         }
         catch { /* absent on fresh install — existingHudManifest stays null */ }
+        // Install HUD scripts to devflow dir. The orchestrator charter and the implement sentinel
+        // render for the plugins the manifest records, and for the empty set when it records none
+        // (D-CHARTER-INSTALL-RENDER). A render failure is a warning.
+        try {
+            await installScripts({
+                scriptsTarget: path.join(devflowDir, 'scripts'),
+                plugins: hudOnlyCharterPlugins(existingHudManifest),
+                warn: (msg) => p.log.warn(msg),
+            });
+        }
+        catch (error) {
+            p.log.error(`Failed to install HUD scripts: ${error instanceof Error ? error.message : error}`);
+            process.exit(1);
+        }
         // A manifest readManifest() refuses reads as none, but its machine gate level is still
         // stored there: --hud-only keeps it and says so, as the full init does. --reset does not
         // apply here, so nothing asks to forget it.
@@ -1311,9 +1371,9 @@ export const initCommand = new Command('init')
         }
         else {
             p.note('Puts every session (git repos only) in orchestrator posture:\n' +
-                'a ~535-token charter at session start plus a per-prompt reminder\n' +
+                'a charter of up to ~850 tokens at session start plus a per-prompt reminder\n' +
                 'steer the main model to delegate work to agents and devflow workflows\n' +
-                'instead of doing it mainline. Plan-mode handoffs auto-run devflow:implement.', 'Ambient Mode');
+                'instead of doing it mainline. Plan-mode handoffs run devflow:implement when it is installed.', 'Ambient Mode');
             const ambientChoice = await p.select({
                 message: 'Enable ambient mode?',
                 options: [
@@ -1809,6 +1869,10 @@ export const initCommand = new Command('init')
             // their say (D-LEARNING-VARIANT-INSTALL): the files installed here and the
             // manifest written at the end of init cannot disagree about it.
             curation: curationEnabled,
+            // The SETTLED compliance switch, never a raw seed or a repository's narrowing: the
+            // variant follows the machine switch alone, and with it off the install refuses
+            // before it writes a file when the variant files are not all there.
+            compliance: complianceEnabled,
             trackerServers,
             // Non-fatal install notices with no other channel (skipped symlinks in the
             // generated reference tree, mode-normalisation failures) reach the user rather
@@ -1821,55 +1885,44 @@ export const initCommand = new Command('init')
         p.log.error(`${error}`);
         process.exit(1);
     }
-    // D-LEARNING-VARIANT-INSTALL: converge the curation variants. The file copy above
-    // installed the variant of everything IT installed; on a `--plugin` install the
-    // other plugins' files, already on disk, may still be the other variant (this run
-    // may have flipped the switch), and the apply-decisions skill is removed here when
-    // the copy skipped it on a partial install. Rewrites only what is installed.
-    // Warn-not-abort: either mismatch is safe (an on variant is still gated at run
-    // time, an off variant loads no decisions). The agent mapping is reapplied below.
-    try {
-        const curationConverge = await convergeCurationVariants({
-            claudeDir,
-            devflowDir,
-            curation: curationEnabled,
-            plugins: effectivePlugins,
-            warn: (msg) => installWarnings.push(msg),
-        });
-        if (verbose && curationConverge.converged) {
-            p.log.info(`Curation ${curationEnabled ? 'on' : 'off'} variants: ` +
-                `${curationConverge.commandsRewritten.length} command(s) and ${curationConverge.agentsRewritten.length} agent(s) ` +
-                `rewritten, ${curationConverge.unchanged} already current`);
-        }
-    }
-    catch (err) {
-        installWarnings.push(`Curation variant convergence failed — ${err instanceof Error ? err.message : String(err)}`);
-    }
-    // Converge compliance artifacts (always converge, never short-circuit).
-    // Called unconditionally so that enabling/disabling compliance during init
-    // is reflected in the installed artifacts without a separate devflow compliance run.
-    // Wrapped in its own try/catch (warn-not-abort).
-    let convergeResult = null;
-    try {
-        convergeResult = await convergeFromManifest({
-            claudeDir,
-            devflowDir,
-            manifest: { features: { compliance: { enabled: complianceEnabled, frameworks: complianceFrameworks }, rules: rulesEnabled } },
-            warn: (msg) => p.log.warn(msg),
-        });
-        // I41: emit legacy-upgrade notice when compliance is disabled AND a pre-existing rule
-        // was found. The skill is no signal — converge installs it on every machine
-        // (D-COMPLIANCE-INSTALL-ALWAYS) — so removedPreexisting reports the rule alone, on a
-        // partial install; hadComplianceRule covers full installs, where installViaFileCopy
-        // wipes the rules dir before converge probes it.
-        if (!complianceEnabled && (convergeResult.removedPreexisting || hadComplianceRule)) {
-            p.log.info('Compliance rule removed — if you previously had devflow-compliance installed, ' +
-                'run `devflow compliance --enable` to re-enable with your framework selection.');
-        }
-    }
-    catch (err) {
-        p.log.warn(`Compliance artifact convergence failed — install succeeded but compliance artifacts may be stale: ` +
-            `${err instanceof Error ? err.message : String(err)}`);
+    // The one converge for both switches (D-LEARNING-VARIANT-INSTALL, AC-27): the file copy
+    // above installed the variant of everything IT installed; on a `--plugin` install the
+    // other plugins' files, already on disk, may still be another variant (this run may
+    // have flipped a switch), and the apply-decisions skill is removed here when the copy
+    // skipped it on a partial install. It also converges the compliance skill and rule, so
+    // enabling or disabling compliance during init needs no separate devflow compliance run.
+    // Rewrites only what is installed. Warn-not-abort: a failure is a warning here and the
+    // install record below is withheld, so the status line says to run init again. The agent
+    // mapping is reapplied below.
+    const variantConverge = await convergeVariantAxes({
+        claudeDir,
+        devflowDir,
+        manifest: {
+            features: {
+                curation: curationEnabled,
+                compliance: { enabled: complianceEnabled, frameworks: complianceFrameworks },
+                rules: rulesEnabled,
+            },
+        },
+        plugins: effectivePlugins,
+        warn: (msg) => installWarnings.push(msg),
+    });
+    if (verbose && variantConverge.converged) {
+        p.log.info(`Curation ${curationEnabled ? 'on' : 'off'}, compliance ${complianceEnabled ? 'on' : 'off'} variants: ` +
+            `${variantConverge.commandsRewritten.length} command(s) and ${variantConverge.agentsRewritten.length} agent(s) ` +
+            `rewritten, ${variantConverge.unchanged} already current`);
+    }
+    // A compliance-off converge that cannot prove the installed prompts free of posting steps
+    // warns and names the files; init never exits non-zero for it (AC-28 binds the compliance command).
+    installWarnings.push(...describePostingLeft(variantConverge.posting));
+    // I41: emit legacy-upgrade notice when compliance is disabled AND a pre-existing rule
+    // was found. The skill is no signal — converge installs it on every machine
+    // (D-COMPLIANCE-INSTALL-ALWAYS) — so removedPreexisting reports the rule alone, on a
+    // partial install; hadComplianceRule covers full installs, where installViaFileCopy
+    // wipes the rules dir before converge probes it.
+    if (!complianceEnabled && (variantConverge.compliance.removedPreexisting || hadComplianceRule)) {
+        p.log.info('Compliance rule removed — if you previously had devflow-compliance installed, ' +
+            'run `devflow compliance --enable` to re-enable with your framework selection.');
     }
     // D-BEHAVIOR-OPT-IN: converge the behavior rule. The plugin installer never copies it (no
     // plugin declares it) and a full install wiped rules/devflow/ above, so this is the one
@@ -1898,52 +1951,12 @@ export const initCommand = new Command('init')
     if (staleRemoved > 0 && verbose) {
         p.log.info(`Cleaned up ${staleRemoved} legacy skill(s)`);
     }
-    // Clean up stale commands from previous installations (e.g., /review → /code-review)
-    const commandsDir = path.join(claudeDir, 'commands', 'devflow');
-    let staleCommandsRemoved = 0;
-    for (const legacy of LEGACY_COMMAND_NAMES) {
-        for (const suffix of ['.md']) {
-            const legacyPath = path.join(commandsDir, `${legacy}${suffix}`);
-            try {
-                await fs.rm(legacyPath);
-                staleCommandsRemoved++;
-            }
-            catch {
-                // Doesn't exist — expected for most entries
-            }
-        }
-    }
-    // Sweep orphaned *-teams.md workflow command variants left by the Agent Teams
-    // refactor. None are ever re-installed, so a blanket sweep is safe on any
-    // install type (the full-install dir wipe only covers full installs).
-    try {
-        for (const f of await fs.readdir(commandsDir)) {
-            if (f.endsWith('-teams.md')) {
-                try {
-                    await fs.rm(path.join(commandsDir, f));
-                    staleCommandsRemoved++;
-                }
-                catch { /* already gone */ }
-            }
-        }
-    }
-    catch { /* commands dir absent — nothing to sweep */ }
+    // Clean up stale commands (e.g., /review → /code-review) and rules from previous installations.
+    // A folder the install refused, or that is a link, is not swept: nothing is read or removed through it.
+    const { staleCommandsRemoved, staleRulesRemoved } = await sweepLegacyDevflowFiles({ claudeDir, report: installReport });
     if (staleCommandsRemoved > 0 && verbose) {
         p.log.info(`Cleaned up ${staleCommandsRemoved} legacy command(s)`);
     }
-    // Clean up stale rules from previous installations
-    const rulesDir = path.join(claudeDir, 'rules', 'devflow');
-    let staleRulesRemoved = 0;
-    for (const legacy of LEGACY_RULE_NAMES) {
-        const legacyPath = path.join(rulesDir, `${legacy}.md`);
-        try {
-            await fs.rm(legacyPath);
-            staleRulesRemoved++;
-        }
-        catch {
-            // Doesn't exist — expected for most entries
-        }
-    }
     if (staleRulesRemoved > 0 && verbose) {
         p.log.info(`Cleaned up ${staleRulesRemoved} legacy rule(s)`);
     }
@@ -2113,33 +2126,9 @@ export const initCommand = new Command('init')
     // MUST run AFTER the proxy preflight block above: preflight can force proxyEnabled=false
     // on failure, and reapply's dormancy (GPT models materialize only while proxy enabled)
     // depends on the FINAL proxyEnabled value — running earlier would leave GPT model lines
-    // in agent frontmatter after a preflight failure. Per-item failures are non-fatal.
-    //
-    // Init-only optimization: skip reapply when mapping is empty AND proxy is off.
-    // An empty mapping means every agent uses its shipped default; the file copy already
-    // wrote those defaults, so reapply would read ~34 files and write zero. The
-    // disable/revert paths call reapplyAgentMapping directly and always need the full walk.
-    {
-        const agentInstallDir = path.join(claudeDir, 'agents', 'devflow');
-        const preCheckMapping = await readAgentMapping(devflowDir);
-        // hasAgentMappingEntries counts agent entries only: an agents.memory-only
-        // mapping names no installed file, so it keeps this gate closed (D-WORKER-AGENTS).
-        const hasMappingEntries = preCheckMapping.ok && hasAgentMappingEntries(preCheckMapping.value);
-        if (hasMappingEntries || proxyEnabled) {
-            const reapplyResult = await reapplyAgentMapping({
-                proxyEnabled,
-                installDir: agentInstallDir,
-                devflowDir,
-                onWarning: (msg) => { if (verbose)
-                    p.log.warn(msg); },
-            });
-            if (reapplyResult.updated.length > 0) {
-                if (verbose) {
-                    p.log.info(`Agent model mapping reapplied: ${reapplyResult.updated.length} agent(s) updated`);
-                }
-            }
-        }
-    }
+    // in agent frontmatter after a preflight failure. Per-item failures are non-fatal. The links
+    // the walk met are printed below, through the install summary.
+    const agentMappingLinks = await reapplyAgentMappingForInit({ proxyEnabled, claudeDir, devflowDir, verbose });
     // Configure ambient hook, memory hooks, and HUD statusLine in a single read-modify-write pass
     try {
         let content = await fs.readFile(settingsPath, 'utf-8');
@@ -2436,6 +2425,10 @@ export const initCommand = new Command('init')
     // Reference-overlay reporting: the overlay rewrites files inside an installed skill
     // the user may have shadowed, and reports any unit it had to leave alone.
     logSummaryLines(formatOverlaySummary(installReport));
+    // A link the install or the agent model reapply replaced is a change to a path the user made.
+    // A folder either refused is not refreshed, and looks refreshed on disk. A path the two steps
+    // both met is named once.
+    logSummaryLines(formatLinksSummary(mergeLinkReports(installReport, agentMappingLinks)));
     // Skill-scoping reporting: a deselected skill is deleted and a dormant shadow
     // is inert, and neither is distinguishable from "never installed" on disk.
     //
@@ -2483,6 +2476,7 @@ export const initCommand = new Command('init')
     }
     // Write installation manifest for upgrade tracking (non-fatal — install already succeeded)
     const now = new Date().toISOString();
+    const installRecord = installRecordFor(variantConverge.converged, { curation: curationEnabled, compliance: complianceEnabled });
     const manifestData = {
         version,
         // Resolved above, before the install, because the skills install set is
@@ -2524,6 +2518,9 @@ export const initCommand = new Command('init')
         },
         installedAt: existingManifest?.installedAt ?? now,
         updatedAt: now,
+        // The install record, written only after a converge that finished clean (AC-29): an
+        // unclean one leaves the field out, which reads as unknown and names `devflow init`.
+        ...(installRecord !== null ? { installedVariants: installRecord } : {}),
     };
     // ── Manifest write + tracker selection lifecycle (the ONE call site) ──────
     // persistManifestThenConvergeTracker owns the ordering invariant: the
@@ -2541,6 +2538,14 @@ export const initCommand = new Command('init')
         else
             p.log.info(msg.text);
     }
+    // The posting notice (AC-30): once, when the record moves from posting (compliance on, or no
+    // record before this release) to non-posting. It follows the record write, so a record that
+    // was withheld or never reached the disk leaves the notice due for the next init.
+    if (trackerLifecycle.manifestWritten &&
+        installRecord !== null &&
+        postingNoticeDue(readInstalledVariants(existingManifest?.installedVariants), complianceEnabled)) {
+        p.log.info(POSTING_OFF_NOTICE);
+    }
     // Only now that the machine-wide switch is on disk (D-INIT-DRAIN-AFTER-SWITCH).
     const drainRoot = await lookupDrainLedgerRoot({ gitRoot, curationEnabled, manifestWritten: trackerLifecycle.manifestWritten });
     if (drainRoot.warning !== null)

package/dist/cli/commands/install-report.js

@@ -9,6 +9,7 @@
  */
 import color from 'picocolors';
 import { overlayUnitLabel } from '../../targets/claude-code/installer.js';
+import { refusedFolderMessage, replacedLinkMessage } from '../../targets/claude-code/linked-folder.js';
 import { SKILL_REFS_SKILL_NAME } from '../../core/mds-variants.js';
 import { prefixSkillName } from '../../core/plugins.js';
 /**
@@ -49,6 +50,39 @@ export function formatOverlaySummary(report, skillName = SKILL_REFS_SKILL_NAME)
     }
     return lines;
 }
+/**
+ * Turn the replaced-link half of an InstallReport into summary lines, one per link.
+ *
+ * An install removes a link it finds where it keeps one of its own files or folders and writes a
+ * real file or folder there. What the link pointed to is not touched, which looks the same from the
+ * filesystem as an install that never met the link, so the line says both.
+ *
+ * Pure function — returns lines, logs nothing.
+ */
+export function formatReplacedLinksSummary(report) {
+    return report.replacedLinks.map(linkPath => ({ level: 'warn', message: replacedLinkMessage(linkPath) }));
+}
+/**
+ * Turn the refused-folder half of an InstallReport into summary lines, one per folder.
+ *
+ * An install writes nothing at a path that is a link it could not remove, or not a folder where it
+ * needs one, and leaves the entry as it was. That looks the same on disk as an install that refreshed
+ * the path, so the line says what was skipped and what to do about it.
+ *
+ * Pure function — returns lines, logs nothing.
+ */
+export function formatRefusedFoldersSummary(report) {
+    return report.refusedFolders.map(folder => ({ level: 'warn', message: refusedFolderMessage(folder) }));
+}
+/**
+ * Both halves in one list, the replaced links first: for a command that prints the links one
+ * converge met and has no other summary of its own.
+ *
+ * Pure function — returns lines, logs nothing.
+ */
+export function formatLinksSummary(report) {
+    return [...formatReplacedLinksSummary(report), ...formatRefusedFoldersSummary(report)];
+}
 /**
  * The half of an overlay warning that describes what is actually on disk.
  *

package/dist/cli/commands/legacy-sweep.js

@@ -0,0 +1,64 @@
+import { promises as fs } from 'fs';
+import * as path from 'path';
+import { LEGACY_COMMAND_NAMES, LEGACY_RULE_NAMES } from '../../core/plugins.js';
+import { isUnrealFolder } from '../../targets/claude-code/linked-folder.js';
+/**
+ * Whether the sweep may remove files from `dir`: the install did not refuse it, and `lstat` shows a
+ * real folder or nothing. `readdir` and `rm` of a path below a link act on the folder it points to.
+ */
+async function mayRemoveFrom(report, dir) {
+    return !report.refusedFolders.includes(dir) && !(await isUnrealFolder(dir));
+}
+/**
+ * Remove the files that earlier releases installed into `commands/devflow` and `rules/devflow` and
+ * that no release installs now: the legacy command and rule names, and every `*-teams.md` command.
+ * Runs on every install shape, since the full install's pre-clean covers only a full install.
+ *
+ * A folder the install refused (`report.refusedFolders`) or that is a link now is skipped whole: the
+ * sweep reads and removes nothing there, and the folder it points to is left as it is. Never throws.
+ *
+ * @param opts.legacyCommands - Legacy command names; defaults to the registry list.
+ * @param opts.legacyRules - Legacy rule names; defaults to the registry list.
+ */
+export async function sweepLegacyDevflowFiles(opts) {
+    const { claudeDir, report } = opts;
+    const legacyCommands = opts.legacyCommands ?? LEGACY_COMMAND_NAMES;
+    const legacyRules = opts.legacyRules ?? LEGACY_RULE_NAMES;
+    const result = { staleCommandsRemoved: 0, staleRulesRemoved: 0 };
+    const commandsDir = path.join(claudeDir, 'commands', 'devflow');
+    if (await mayRemoveFrom(report, commandsDir)) {
+        for (const legacy of legacyCommands) {
+            try {
+                await fs.rm(path.join(commandsDir, `${legacy}.md`));
+                result.staleCommandsRemoved++;
+            }
+            catch { /* absent — expected for most entries */ }
+        }
+        // Orphaned *-teams.md workflow command variants left by the Agent Teams refactor. None is ever
+        // re-installed, so a blanket sweep is safe on any install type.
+        try {
+            for (const entry of await fs.readdir(commandsDir)) {
+                if (!entry.endsWith('-teams.md'))
+                    continue;
+                try {
+                    await fs.rm(path.join(commandsDir, entry));
+                    result.staleCommandsRemoved++;
+                }
+                catch { /* already gone */ }
+            }
+        }
+        catch { /* commands folder absent — nothing to sweep */ }
+    }
+    const rulesDir = path.join(claudeDir, 'rules', 'devflow');
+    if (await mayRemoveFrom(report, rulesDir)) {
+        for (const legacy of legacyRules) {
+            try {
+                await fs.rm(path.join(rulesDir, `${legacy}.md`));
+                result.staleRulesRemoved++;
+            }
+            catch { /* absent — expected for most entries */ }
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=legacy-sweep.js.map