devflow-kit 3.8.0 → 3.10.0

package/src/assets/scripts/hooks/queue-append

@@ -29,6 +29,10 @@
 #   finds the old folder gone (the one-time move ran meanwhile) looks again and goes
 #   on in the new folder, so a capture never drops a row and never waits. Any other
 #   queue's folder is created if absent.
+#   A queue in an area that git tracks, or that git did not answer for, is paused: before
+#   the row is built, queue_tracked_area asks for the area the queue lies in, and a queue
+#   that is not untracked gets no row, no folder and no file. The skip is logged once. The
+#   check runs on every call, whether or not the queue's folder exists.
 #   After appending, truncates from 200 to the newest 100 lines under a lock
 #   (curation_lock_acquire on "<queue_file>.lock", 2s timeout), keeping mode 0600.
 #   The append itself is intentionally lock-free (accepted-class race shared with
@@ -40,7 +44,29 @@
 #   *_enabled flag is "true", with the root that queue lies below. Each queue is gated
 #   independently -- callers compute memory_enabled/curation_enabled themselves (see
 #   queue_read_gates below for the at-most-one-fork read of both). With neither queue
-#   enabled it builds nothing.
+#   enabled it builds nothing. A queue whose area is paused (see queue_tracked_area) reads
+#   as not enabled for the call, and nothing is built for it.
+#
+# queue_tracked_area <root> <curation|memory|both> [git|node]
+#   Does git track files in the data folders of the area at <root>? Sets
+#   DF_TRACKED_AREA_CURATION or DF_TRACKED_AREA_MEMORY (one variable per area) to
+#   `tracked`, `untracked` or `unknown`, and always returns 0. The area `both` is one
+#   call over the union of the two: it sets both variables, and a listing in it is
+#   followed by one call per area, so each variable names its own area. A root is asked
+#   once per area in a process. The shell twin of lib/tracked-areas.cjs, held to its
+#   answers by tests/decisions/tracked-area-parity.test.ts:
+#     - no `.git` entry (a file, a folder or a link) at the root: `untracked`, no call;
+#     - a root that is not an absolute path, whose physical parent holds a colon, or that
+#       can not be entered: `unknown`;
+#     - git mode (the default): one `git ls-files -z` over the area's pathspecs, with the
+#       leaf's environment scrub, a ceiling at the root's parent and the fsmonitor command
+#       off. Only the first byte of the listing is read. A byte read means `tracked`,
+#       whatever git's status (git ends on a closed pipe). With no byte, git status 0
+#       means `untracked`, and any other status `unknown`;
+#     - node mode: the json-helper `tracked-area` op, which bounds the call in time. Without
+#       node it runs as git mode; an answer that is not one of the three words is `unknown`.
+#   The capture hooks ask in git mode, with no process but git. The session start asks in
+#   node mode, so a hung git is cut.
 #
 # queue_read_gates <manifest_path> [<root>]
 #   Reads BOTH switches, `memory` and `curation` (curation is read under both of
@@ -245,7 +271,194 @@ _qar_trim_overflow() {
   return 0
 }
 
+# --- The tracked-area gate: no capture into a folder that git tracks ---
+#
+# A folder that git tracks holds the repository's content, not devflow's data, so a
+# capture writes nothing into it, and also when git did not answer (queue_tracked_area,
+# documented above). The check runs before the row is built and before any folder is
+# made, on every call, whether or not the queue's folder exists.
+
+# _qta_specs <curation|memory|both> -- sets the array _QTA_SPECS to the pathspecs of the
+# area: the shell twin of AREA_PATHSPECS in lib/tracked-areas.cjs, in the leaf's order and
+# spelling (tests/decisions/tracked-area-parity.test.ts holds the two equal, element by
+# element). `.devflow` is spelled twice, the second time with the fl ligature (U+FB02,
+# bytes ef ac 82), which a case-folding file system opens as the same name. The `.devflow`
+# entry itself (a link, a gitlink or a plain file) stands over every folder: the character
+# class keeps `glob` from matching it as a leading directory. Fails for any other word.
+_qta_specs() {
+  local _qs_fl=$'\xef\xac\x82' _qs_dir="" _qs_curation=() _qs_memory=() _qs_entry=()
+  for _qs_dir in ".devflow" ".dev${_qs_fl}ow"; do
+    _qs_curation+=(
+      ":(icase,literal)${_qs_dir}/learning"
+      ":(icase,literal)${_qs_dir}/curation"
+      ":(icase,glob)${_qs_dir}/learning.backup-*"
+      ":(icase,glob)${_qs_dir}/learning.backup-*/**"
+    )
+    _qs_memory+=(":(icase,literal)${_qs_dir}/memory")
+    _qs_entry+=(":(icase,glob)[.]${_qs_dir#.}")
+  done
+  case "${1:-}" in
+    curation) _QTA_SPECS=("${_qs_curation[@]}" "${_qs_entry[@]}") ;;
+    memory) _QTA_SPECS=("${_qs_memory[@]}" "${_qs_entry[@]}") ;;
+    both) _QTA_SPECS=("${_qs_curation[@]}" "${_qs_entry[@]}" "${_qs_memory[@]}") ;;
+    *) _QTA_SPECS=(); return 1 ;;
+  esac
+  return 0
+}
+
+# _qta_probe <root> <curation|memory|both> <git|node> -- sets _QTA_ANSWER to `tracked`,
+# `untracked` or `unknown`, as queue_tracked_area documents. Always returns 0.
+#
+# The git mode reads one byte of the listing and ends. Under bash 3.2 with errexit set the
+# pipeline sits in an `if` condition (an empty listing makes `read` fail, and a failing
+# condition does not end the shell), and PIPESTATUS is copied in both arms before any other
+# command resets it: the second element is the reader's status, the first git's. Nothing
+# follows the pipeline in an `||` list. The `cd -P` runs inside the subshell, so the
+# caller's directory never changes, and git runs there with the variables that redirect it
+# removed (the list is GIT_REDIRECT_VARIABLES of the leaf), a fixed locale, no optional
+# lock, and the root's physical parent as its ceiling.
+_qta_probe() {
+  local _qp_root="${1:-}" _qp_area="${2:-}" _qp_mode="${3:-git}" _qp_out="" _qp_ceiling="" _qp_c="" _qp_st=()
+  _QTA_ANSWER="unknown"
+  case "$_qp_root" in /*) ;; *) return 0 ;; esac
+  if [ ! -e "$_qp_root/.git" ] && [ ! -L "$_qp_root/.git" ]; then
+    _QTA_ANSWER="untracked"
+    return 0
+  fi
+  if [ "$_qp_mode" = "node" ] && [ "${_HAS_NODE:-}" = "true" ] && [ -n "${_JSON_HELPER:-}" ]; then
+    case "$_qp_area" in curation|memory|both) ;; *) return 0 ;; esac
+    _qp_out=$(node "$_JSON_HELPER" tracked-area "$_qp_area" "$_qp_root" 2>/dev/null) || _qp_out=""
+    _qp_out="${_qp_out%%$'\n'*}"
+    case "$_qp_out" in tracked|untracked|unknown) _QTA_ANSWER="$_qp_out" ;; esac
+    return 0
+  fi
+  _qta_specs "$_qp_area" || return 0
+  if (
+      cd -P "$_qp_root" >/dev/null 2>&1 || exit 1
+      _qp_ceiling="${PWD%/*}"
+      [ -n "$_qp_ceiling" ] || _qp_ceiling="/"
+      case "$_qp_ceiling" in *:*) exit 1 ;; esac
+      unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE GIT_COMMON_DIR GIT_OBJECT_DIRECTORY GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_NAMESPACE GIT_LITERAL_PATHSPECS GIT_GLOB_PATHSPECS GIT_NOGLOB_PATHSPECS GIT_ICASE_PATHSPECS
+      export LC_ALL=C GIT_OPTIONAL_LOCKS=0 GIT_CEILING_DIRECTORIES="$_qp_ceiling"
+      exec git --no-literal-pathspecs -c core.fsmonitor=false ls-files -z -- "${_QTA_SPECS[@]}"
+    ) </dev/null 2>/dev/null | { IFS= read -r -n 1 _qp_c; }; then
+    _qp_st=("${PIPESTATUS[@]}")
+  else
+    _qp_st=("${PIPESTATUS[@]}")
+  fi
+  if [ "${#_qp_st[@]}" -eq 2 ]; then
+    if [ "${_qp_st[1]}" -eq 0 ]; then
+      _QTA_ANSWER="tracked"
+    elif [ "${_qp_st[0]}" -eq 0 ]; then
+      _QTA_ANSWER="untracked"
+    fi
+  fi
+  return 0
+}
+
+# _qta_ask <root> <curation|memory> <git|node> -- sets the area's variable, unless this
+# process already asked for that root and area. Always returns 0.
+_qta_ask() {
+  case "$2" in
+    curation)
+      if [ "${_QTA_ASKED_CURATION:-}" != "r$1" ]; then
+        _qta_probe "$1" curation "$3"
+        DF_TRACKED_AREA_CURATION="$_QTA_ANSWER"
+        _QTA_ASKED_CURATION="r$1"
+      fi
+      ;;
+    memory)
+      if [ "${_QTA_ASKED_MEMORY:-}" != "r$1" ]; then
+        _qta_probe "$1" memory "$3"
+        DF_TRACKED_AREA_MEMORY="$_QTA_ANSWER"
+        _QTA_ASKED_MEMORY="r$1"
+      fi
+      ;;
+  esac
+  return 0
+}
+
+queue_tracked_area() {
+  local _qa_root="${1:-}" _qa_area="${2:-}" _qa_mode="${3:-git}"
+  case "$_qa_area" in
+    curation|memory)
+      _qta_ask "$_qa_root" "$_qa_area" "$_qa_mode"
+      ;;
+    both)
+      if [ "${_QTA_ASKED_CURATION:-}" != "r$_qa_root" ] || [ "${_QTA_ASKED_MEMORY:-}" != "r$_qa_root" ]; then
+        _qta_probe "$_qa_root" both "$_qa_mode"
+        if [ "$_QTA_ANSWER" = "tracked" ]; then
+          # The union listed something: one call per area says which.
+          _QTA_ASKED_CURATION=""
+          _QTA_ASKED_MEMORY=""
+          _qta_ask "$_qa_root" curation "$_qa_mode"
+          _qta_ask "$_qa_root" memory "$_qa_mode"
+        else
+          DF_TRACKED_AREA_CURATION="$_QTA_ANSWER"
+          DF_TRACKED_AREA_MEMORY="$_QTA_ANSWER"
+          _QTA_ASKED_CURATION="r$_qa_root"
+          _QTA_ASKED_MEMORY="r$_qa_root"
+        fi
+      fi
+      ;;
+  esac
+  return 0
+}
+
+# _qar_gate <memory_root> <memory_on> <curation_root> <curation_on> -- the one gate both
+# append functions use. Sets _QAR_MEMORY_ON and _QAR_CURATION_ON to the flags as given,
+# except that a queue whose area is not `untracked` reads "false" (paused), with one fixed
+# log line. Only an enabled queue is asked about. When both are enabled at one root, one
+# call over the union answers for both (queue_tracked_area `both`). Always returns 0.
+_qar_gate() {
+  local _qg_mroot="$1" _qg_mon="$2" _qg_croot="$3" _qg_con="$4"
+  if [ "$_qg_mon" = "true" ] && [ "$_qg_con" = "true" ] && [ "$_qg_mroot" = "$_qg_croot" ]; then
+    queue_tracked_area "$_qg_mroot" both git
+  else
+    if [ "$_qg_mon" = "true" ]; then queue_tracked_area "$_qg_mroot" memory git; fi
+    if [ "$_qg_con" = "true" ]; then queue_tracked_area "$_qg_croot" curation git; fi
+  fi
+  if [ "$_qg_mon" = "true" ] && [ "${DF_TRACKED_AREA_MEMORY:-unknown}" != "untracked" ]; then
+    _qg_mon="false"
+    log "Queue skipped: the memory area is paused (git tracks files in its data folders, or did not answer); nothing written"
+  fi
+  if [ "$_qg_con" = "true" ] && [ "${DF_TRACKED_AREA_CURATION:-unknown}" != "untracked" ]; then
+    _qg_con="false"
+    log "Queue skipped: the curation area is paused (git tracks files in its data folders, or did not answer); nothing written"
+  fi
+  _QAR_MEMORY_ON="$_qg_mon"
+  _QAR_CURATION_ON="$_qg_con"
+  return 0
+}
+
+# _qar_area_of <root> <queue_file> -- sets _QAR_AREA to the area the queue lies in:
+# `memory` below <root>/.devflow/memory, `curation` below the ledger folder (either name),
+# and `both` for a queue in neither, which is paused when either area is.
+_qar_area_of() {
+  case "$2" in
+    "$1"/.devflow/memory/*) _QAR_AREA="memory" ;;
+    "$1"/.devflow/learning/*|"$1"/.devflow/curation/*) _QAR_AREA="curation" ;;
+    *) _QAR_AREA="both" ;;
+  esac
+  return 0
+}
+
 queue_append_row() {
+  _qar_area_of "$1" "$2"
+  case "$_QAR_AREA" in
+    memory)
+      _qar_gate "$1" true "" false
+      if [ "$_QAR_MEMORY_ON" != "true" ]; then return 0; fi
+      ;;
+    curation)
+      _qar_gate "" false "$1" true
+      if [ "$_QAR_CURATION_ON" != "true" ]; then return 0; fi
+      ;;
+    *)
+      _qar_gate "$1" true "$1" true
+      if [ "$_QAR_MEMORY_ON" != "true" ] || [ "$_QAR_CURATION_ON" != "true" ]; then return 0; fi
+      ;;
+  esac
   _qar_build_row "$3" "$4" "$5" || return 0
   if _qar_append "$1" "$2" "$_QAR_ROW"; then _qar_trim_overflow "$_QAR_FILE"; fi
   return 0
@@ -257,6 +470,10 @@ queue_append_both() {
   local _qab_memory_enabled="$5" _qab_curation_enabled="$6"
   local _qab_role="$7" _qab_content="$8" _qab_ts="$9" _qab_row=""
 
+  # A paused queue reads as not enabled: the gate comes before the row is built.
+  _qar_gate "$_qab_memory_root" "$_qab_memory_enabled" "$_qab_curation_root" "$_qab_curation_enabled"
+  _qab_memory_enabled="$_QAR_MEMORY_ON"
+  _qab_curation_enabled="$_QAR_CURATION_ON"
   if [ "$_qab_memory_enabled" != "true" ] && [ "$_qab_curation_enabled" != "true" ]; then return 0; fi
   # One row for both queues: it is built once, and each enabled queue takes the same line.
   _qar_build_row "$_qab_role" "$_qab_content" "$_qab_ts" || return 0

package/src/assets/scripts/hooks/session-start-context

@@ -6,7 +6,10 @@
 # which this checkout's project.json / config.json can only narrow
 # (D-FEATURES-NARROW-ONLY) — this hook itself is never disabled. They and the .gitignore carve-out run only in a git project that is
 # not the home directory (D-HOOKS-GIT-ONLY), and they read the curation ledger of
-# the main worktree when this is a linked one (D-LEDGER-MAIN-WORKTREE).
+# the main worktree when this is a linked one (D-LEDGER-MAIN-WORKTREE). They are also
+# paused while git tracks files in a curation data folder of that ledger root, or does
+# not answer: the hook then reads no curation file and makes no curation folder, and one
+# fixed notice goes to the user as a systemMessage (Section 4b).
 #
 # Section 1: Project decisions TL;DR (decisions.md / pitfalls.md header lines),
 # then the path of the decisions index when it lists entries.
@@ -23,11 +26,12 @@
 # Section 4: Legacy install notice — one line when this repository still carries
 # a retired project-local devflow install (its .claude/settings.json registers
 # devflow hooks), pointing at `devflow uninstall --scope local`.
-# Section 4b: Curation move skipped notice — one fixed line when the one-time move of
-# the old ledger folder left the project alone because git tracks files in a curation
-# data folder (`tracked`) or did not answer (`unknown`); the `curation-move` shim sets
-# DF_CURATION_MOVE_SKIPPED, and on a session that starts, resumes or is cleared the line
-# tells the main model to tell the user once.
+# Section 4b: Curation pause notice — one fixed systemMessage when curation is on and
+# git tracks files in a curation data folder (`tracked`) or did not answer (`unknown`).
+# The answer is the skipped move's (the `curation-move` shim sets DF_CURATION_MOVE_SKIPPED)
+# or, when the move was not skipped, the curation area check's own fresh answer; on a
+# session that starts, resumes or is cleared the message tells the user why curation is
+# paused.
 # Section 5: Compaction resume directive — on a `compact` SessionStart, one fixed
 # line telling the model to re-read the devflow command it was running from the
 # phase in progress (D-COMPACT-RESUME-DIRECTIVE).
@@ -53,6 +57,12 @@
 #   - Section 6, changed start: ONE node process (claude-md-audit.cjs), and a
 #     sibling temp file renamed over the stamp. When none of the roots exists there
 #     is nothing to audit: the stamp is written with builtins, and node is not started.
+#
+# Cost of the curation area check (after the move, with curation on in a git project):
+#   - the move already answered `tracked` or `unknown`: its answer is reused, zero forks;
+#   - no `.git` entry at the ledger root: a builtin test, zero forks;
+#   - otherwise ONE node process (json-helper tracked-area), which makes one bounded
+#     `git ls-files` call; without node the shell runs that one call itself, unbounded.
 
 # Safe no-op fallback: must exist before hook-bootstrap is sourced.
 dbg() { :; }
@@ -267,12 +277,42 @@ CURATION_ENABLED="$_QG_CURATION"
 # root is looked at once per session. A held, refused or skipped move leaves the old
 # folder in place. A skipped move (git tracks files in a data folder or a backup folder,
 # or git did not answer) sets DF_CURATION_MOVE_SKIPPED to `tracked` or `unknown`, and
-# Section 4b tells the user.
+# the curation area check below pauses curation on it.
 DF_CURATION_MOVE_SKIPPED=""
 if [ -n "$PROJECT_OK" ]; then
   df_curation_move "$LEDGER_ROOT" retry 2>/dev/null || true
 fi
 
+# --- The curation area check: a pause while git tracks the ledger folders ---
+# A folder that git tracks holds the repository's content, not devflow's data, so while git
+# tracks files in a curation data folder of the LEDGER root (the old ledger folder, the
+# curation folder or a backup folder), or does not answer, curation is off for the rest of
+# this hook: no heal, no Section 1, no Section 2, and no curation folder is made. The
+# move's own answer is reused when it skipped (`tracked` or `unknown`); otherwise
+# queue_tracked_area asks once in node mode, so a git that hangs is cut. The check runs
+# whether or not the folder exists, and on every source, a compaction included. AREA_PAUSE_REASON
+# names why for Section 4b; it stays empty when curation is on.
+AREA_PAUSE_REASON=""
+if [ "$CURATION_ENABLED" = "true" ]; then
+  case "${DF_CURATION_MOVE_SKIPPED:-}" in
+    tracked|unknown)
+      AREA_PAUSE_REASON="$DF_CURATION_MOVE_SKIPPED"
+      ;;
+    *)
+      queue_tracked_area "$LEDGER_ROOT" curation node
+      case "$DF_TRACKED_AREA_CURATION" in
+        untracked) ;;
+        tracked) AREA_PAUSE_REASON="tracked" ;;
+        *) AREA_PAUSE_REASON="unknown" ;;
+      esac
+      ;;
+  esac
+  if [ -n "$AREA_PAUSE_REASON" ]; then
+    CURATION_ENABLED="false"
+    log "Curation paused: git tracks files in a curation data folder, or did not answer (${AREA_PAUSE_REASON}); nothing read or written"
+  fi
+fi
+
 # --- Section 1: Project Decisions TL;DR ---
 if [ "$CURATION_ENABLED" = "true" ]; then
   # Heal older installs that have .devflow/ but not .devflow/curation/, never
@@ -305,10 +345,13 @@ if [ "$CURATION_ENABLED" = "true" ]; then
     # as DECISIONS_CONTEXT. It interpolates $LEDGER_ROOT, so it needs that root's
     # shape gate, and it is left out when the index lists no entry: an empty
     # corpus renders `(none)`. It is left out too when a link leads to the index,
-    # since the model would read the file the link names and pass that on.
+    # since the model would read the file the link names and pass that on. The pass rule
+    # tells the model to read the index only while the settings line does not say
+    # CURATION=off; resolve-settings.cjs turns that switch off while git tracks the
+    # curation folder, so a paused project passes nothing on.
     # Builtins only: no fork, save the log line of a refused index.
     _SC_INDEX="$CURATION_DIR/index.md"; DECISIONS_INDEX_LINE=""
-    DECISIONS_PASS_RULE="Decisions (direct delegations only — workflow skills load their own): read this index once, then pass each agent that takes DECISIONS_CONTEXT the index lines that touch its work, verbatim, behind a (slice: N of M entries — full index: this index's path) line and with the footer."
+    DECISIONS_PASS_RULE="Decisions (direct delegations only — workflow skills load their own): when the settings line does not say CURATION=off, read this index once, then pass each agent that takes DECISIONS_CONTEXT the index lines that touch its work, verbatim, behind a (slice: N of M entries — full index: this index's path) line and with the footer."
     if [ -n "$DIRECTIVE_LEDGER_SAFE" ] && df_file_below "$LEDGER_ROOT" "$_SC_INDEX" && [ -s "$_SC_INDEX" ]; then
       _SC_IDX1=""; IFS= read -r _SC_IDX1 < "$_SC_INDEX" || true
       [ "$_SC_IDX1" != "(none)" ] && DECISIONS_INDEX_LINE="Index: $_SC_INDEX"
@@ -873,39 +916,37 @@ ${LEGACY_SECTION}"
   fi
 fi
 
-# --- Section 4b: Curation move skipped notice ---
-# The move of the old curation folder leaves a project alone when git tracks files in
-# a curation data folder, or when git does not answer (curation-move sets
-# DF_CURATION_MOVE_SKIPPED at the call above, and the line before that call empties it).
-# The user cannot see the hook log, so one fixed line goes into the context on a session
-# that starts, resumes or is cleared, and the model tells the user once per such session.
-# Each line is a constant: a single-quoted string that interpolates nothing, so no
-# repository content reaches the model through it. Its words are MOVE_SKIP_NOTICE in
-# src/core/curation-move-skip.ts (tests/shell-hooks.test.ts holds the two equal). A
-# compaction repeats nothing.
-MOVE_SKIP_SECTION=""
-case "${DF_CURATION_MOVE_SKIPPED:-}" in
+# --- Section 4b: Curation pause notice ---
+# While curation is on, curation pauses when git tracks files in a curation data folder,
+# or when git does not answer (the curation area check above sets AREA_PAUSE_REASON). The
+# answer is the skipped move's (curation-move sets DF_CURATION_MOVE_SKIPPED at the call
+# above, and the line before that call empties it) or, when the move was not skipped, the
+# area check's own fresh answer. The user cannot see the hook log, so the pause notice says
+# why curation reads and writes nothing, and what to do. It is not model context. It goes
+# to the user as a systemMessage (AREA_PAUSE_MESSAGE, joined to the envelope at the end),
+# on a session that starts, resumes or is cleared, and a compaction repeats nothing. It is
+# a constant: a single-quoted string that interpolates nothing, so no repository content
+# reaches the user through it. Its words are AREA_PAUSE_NOTICE.curation in src/core/area-pause-notice.ts
+# (tests/shell-hooks.test.ts holds the two equal). With curation switched off, devflow
+# shows no curation text at session start: the move still runs, and its skip is told to
+# the user by `devflow init`, not here.
+AREA_PAUSE_MESSAGE=""
+case "$AREA_PAUSE_REASON" in
   tracked)
-    MOVE_SKIP_SECTION='Devflow notice: tell the user once, in one short message alongside your answer: devflow did not move the curation data of this project from .devflow/learning/ to .devflow/curation/, because git tracks files in a curation data folder. To find them, run `git ls-files .devflow`. Untrack them with `git rm --cached <file>`, and delete them if you did not make them. Run these commands in the checkout that holds these folders.'
+    AREA_PAUSE_MESSAGE='Devflow curation is paused for this project, because git tracks files in a curation data folder. Devflow reads and writes nothing in these folders while git tracks files there. To find the files, run `git ls-files .devflow`. Untrack them with `git rm --cached <file>`, then delete them if you did not make them. Run these commands in the main checkout.'
     ;;
   unknown)
-    MOVE_SKIP_SECTION='Devflow notice: tell the user once, in one short message alongside your answer: devflow did not move the curation data of this project from .devflow/learning/ to .devflow/curation/, because git did not answer. The move runs again at the next session start or the next init. If this notice stays, check that git runs in this project.'
+    AREA_PAUSE_MESSAGE='Devflow curation is paused for this project, because git did not answer whether it tracks files in a curation data folder. Devflow reads and writes nothing in these folders until git answers. The check runs again at the next session start. If this notice stays, check that git runs in this project.'
+    ;;
+esac
+case "$SESSION_SOURCE" in
+  startup|resume|clear)
+    if [ -n "$AREA_PAUSE_MESSAGE" ]; then dbg "curation pause notice emitted"; fi
+    ;;
+  *)
+    AREA_PAUSE_MESSAGE=""
     ;;
 esac
-if [ -n "$MOVE_SKIP_SECTION" ]; then
-  case "$SESSION_SOURCE" in
-    startup|resume|clear)
-      dbg "curation move skipped notice emitted"
-      if [ -n "$CONTEXT" ]; then
-        CONTEXT="${CONTEXT}
-
-${MOVE_SKIP_SECTION}"
-      else
-        CONTEXT="$MOVE_SKIP_SECTION"
-      fi
-      ;;
-  esac
-fi
 
 # --- Section 5: Compaction resume directive ---
 # D-COMPACT-RESUME-DIRECTIVE: after a compaction nothing tells the model to re-read
@@ -1165,6 +1206,17 @@ fi
 
 # --- Output ---
 
+# The pause notice (Section 4b) leads the systemMessage, ahead of the audit text: both are
+# for the user, and neither enters the context.
+if [ -n "$AREA_PAUSE_MESSAGE" ]; then
+  if [ -n "$SYSTEM_MESSAGE" ]; then
+    SYSTEM_MESSAGE="${AREA_PAUSE_MESSAGE}
+${SYSTEM_MESSAGE}"
+  else
+    SYSTEM_MESSAGE="$AREA_PAUSE_MESSAGE"
+  fi
+fi
+
 # Only output if we have something to inject or to tell the user. The stamp is
 # recorded here too: an audit that found nothing to show still ran, and recording it
 # is what makes the next unchanged start free.

package/src/assets/scripts/hooks/session-start-memory

@@ -64,6 +64,45 @@ if [ "$_QG_MEMORY" != "true" ]; then
   exit 0
 fi
 
+# --- Memory area check ---
+# A folder that git tracks holds the repository's content, not devflow's data. While git
+# tracks files in the memory folder of this checkout, or a `.git` entry stands and git does
+# not answer, the memory area is paused: this hook moves no batch, reads no working memory,
+# no refresh warning, no queue and no worker notice, and the worker notice stays where it is.
+# The check asks once, in node mode, so a git that hangs is cut (queue_tracked_area), and
+# asks at the project root this hook resolved, not at the ledger root.
+# One fixed notice goes to the user as a systemMessage, on a session that starts, resumes
+# or is cleared; a compaction sends nothing. It is not model context. Each arm is a constant:
+# a single-quoted string that interpolates nothing, so no repository content reaches the
+# user through it. Its words are AREA_PAUSE_NOTICE.memory in src/core/area-pause-notice.ts
+# (tests/shell-hooks.test.ts holds the two equal).
+queue_tracked_area "$PROJECT_ROOT" memory node
+if [ "${DF_TRACKED_AREA_MEMORY:-unknown}" != "untracked" ]; then
+  _SSM_PAUSE_REASON="unknown"
+  if [ "${DF_TRACKED_AREA_MEMORY:-}" = "tracked" ]; then _SSM_PAUSE_REASON="tracked"; fi
+  log "Memory paused: git tracks files in the memory folder, or did not answer (${_SSM_PAUSE_REASON}); nothing read or written"
+  AREA_PAUSE_MESSAGE=""
+  case "$_SSM_PAUSE_REASON" in
+    tracked)
+      AREA_PAUSE_MESSAGE='Devflow memory is paused for this checkout, because git tracks files in the memory folder. Devflow reads and writes nothing there while git tracks files there. To find the files, run `git ls-files .devflow`. Untrack them with `git rm --cached <file>`, then delete them if you did not make them. Run these commands in this checkout.'
+      ;;
+    unknown)
+      AREA_PAUSE_MESSAGE='Devflow memory is paused for this checkout, because git did not answer whether it tracks files in the memory folder. Devflow reads and writes nothing there until git answers. The check runs again at the next session start. If this notice stays, check that git runs in this checkout.'
+      ;;
+  esac
+  CONTEXT=""
+  SYSTEM_MESSAGE=""
+  case "$(printf '%s' "$INPUT" | json_field "source" "")" in
+    startup|resume|clear)
+      SYSTEM_MESSAGE="$AREA_PAUSE_MESSAGE"
+      dbg "memory pause notice emitted"
+      json_session_output "$CONTEXT" "$SYSTEM_MESSAGE"
+      ;;
+  esac
+  dbg "EXIT: memory area paused"
+  exit 0
+fi
+
 # --- D56c cold-path recovery: orphaned .pending-turns.processing ---
 # Self-contained (not sourced from a shared helper): applies a 300s stale-age
 # gate to .pending-turns.processing. background-memory-update is the PRIMARY

package/src/assets/scripts/hooks/session-start-orchestrator

@@ -3,8 +3,10 @@
 # SessionStart Hook: Orchestrator Charter Injection
 # Presence-gated: registered/removed by `devflow ambient --enable/--disable`.
 # Git repos only: silent outside a git repo (df_has_git_marker bounded walk).
-# Charter includes the plan-handoff fallback bullet — SessionStart provably fires
-# (SessionStart:clear) in plan-handoff sessions even if UserPromptSubmit does not.
+# The installed charter carries the plan-handoff fallback bullet only while
+# devflow:implement is installed (init renders the charter for the installed plugin set) —
+# SessionStart provably fires (SessionStart:clear) in plan-handoff sessions even if
+# UserPromptSubmit does not.
 # NOTE: the literal prefix `Implement the following plan:` is duplicated in
 # src/assets/scripts/hooks/preamble — update both if Claude Code changes the handoff format.
 

package/src/assets/scripts/pr-evidence.cjs

@@ -91,12 +91,15 @@ const LIMITS = Object.freeze({
  * D-MARKERS: the ONLY home of the marker literals. Every other site builds a
  * marker from these fields, and a source guard holds that no literal appears
  * outside this object. The block markers bracket the PR body's test-plan block;
- * the evidence marker is the first line of an evidence comment.
+ * the evidence marker is the first line of an evidence comment, and its head prefix
+ * is what that line starts with whatever its head and key. The head prefix is the
+ * evidence open literal plus ' head:', so it adds no literal of its own.
  */
 const MARKERS = Object.freeze({
   BLOCK_START: '<!-- devflow:test-plan -->',
   BLOCK_END: '<!-- /devflow:test-plan -->',
   EVIDENCE_OPEN: '<!-- devflow:evidence',
+  get EVIDENCE_HEAD_PREFIX() { return this.EVIDENCE_OPEN + ' head:'; },
   EVIDENCE_RE: Object.freeze(/^<!-- devflow:evidence head:(?<head>[0-9a-f]{40}) key:(?<key>[0-9a-f]{12}) -->$/),
 });
 
@@ -247,7 +250,11 @@ const WAVE_VERDICTS = Object.freeze(/** @type {WaveVerdict[]} */ (['PASS', 'UNVE
 /** The verdicts of a ticket that merged — the only rows a `Closes` line may name. */
 const WAVE_MERGED_VERDICTS = Object.freeze(/** @type {WaveVerdict[]} */ (['PASS', 'UNVERIFIED']));
 
-/** An Evaluate or Test cell: a Gate 2 verdict, or `—` where the gate never ran. */
+/**
+ * An Evaluate or Test cell: a Gate 2 verdict, or `—` where the gate never ran or a Test run gave no result.
+ * `BLOCKED` is never a cell here, and it has two meanings in the table: a row Verdict `BLOCKED` is a ticket that
+ * never ran, and a Test result `BLOCKED` is a run that gave no result, shown as `—`.
+ */
 const WAVE_GATE_VALUES = Object.freeze(['PASS', 'FAIL', 'FAIL-FIXED', 'SKIPPED', EM_DASH]);
 
 /** A Coverage cell: whether the review pass covered every focus. */
@@ -1250,7 +1257,7 @@ function cell(text) {
  */
 function stubLines(ev, t) {
   return [
-    MARKERS.EVIDENCE_OPEN + ' head:' + ev.head + ' key:' + ev.key + ' -->',
+    MARKERS.EVIDENCE_HEAD_PREFIX + ev.head + ' key:' + ev.key + ' -->',
     EVIDENCE_HEADING + ' ' + EM_DASH + ' ' + ev.head.slice(0, 7),
     tallyLine(t),
     '',
@@ -1813,6 +1820,26 @@ function parseWaveRow(line) {
   };
 }
 
+/**
+ * D-WAVE-LINKS-ONLY: the links-only block, for related lines that ran to the end of the
+ * text. Only `Refs #<n>` and `Refs <KEY-N>` lines make a block of their own (RELATED_LINE_RE
+ * has already shaped each ref), and a ref may not repeat. Null when the lines are not all
+ * `Refs` lines: the caller refuses the block as before.
+ *
+ * @param {readonly WaveRelated[]} related
+ * @returns {Result<WaveBlock> | null}
+ */
+function parseLinksOnlyBlock(related) {
+  if (related.length === 0 || !related.every(rel => rel.keyword === 'Refs')) return null;
+  /** @type {Set<string>} */
+  const seen = new Set();
+  for (const rel of related) {
+    if (seen.has(rel.ref)) return fail('duplicate', rel.line);
+    seen.add(rel.ref);
+  }
+  return ok(Object.freeze({ tracking: null, related: Object.freeze(related), rows: Object.freeze([]) }));
+}
+
 /**
  * D-WAVE: parse a wave block (LF or CRLF, at most WAVE_BLOCK_CHARS). It holds
  * exactly, in order: `## Related Issues`; 0–WAVE_ROWS + 1 related lines; one
@@ -1835,13 +1862,23 @@ function parseWaveRow(line) {
  * like every related line, so it adds no free text to the body. A leading `Refs`
  * that names a row is that row's line, never a tracking line.
  *
+ * D-WAVE-LINKS-ONLY: with `options.linksOnly === true` (the opt-in, spelled
+ * `check wave --links-only` on the command line), a block may also be the
+ * `## Related Issues` heading and 1–WAVE_ROWS + 1 `Refs #<n>` or `Refs <KEY-N>` lines and
+ * nothing after them (blank lines aside): no evidence section, no rows. It parses to no
+ * tracking line and no rows. A ref may not repeat (`duplicate`). `Closes` is never
+ * admitted there: with no row, nothing has merged, so nothing may close an issue.
+ * Without the opt-in, and for any other block that stops after its related lines, a lone
+ * `Closes #<n>` included, the block is `malformed`, as the grammar stood before the opt-in.
+ *
  * Structure is checked before the cross rules, so the first failure found is the
  * one reported. An error carries a code and a line number, never input bytes.
  *
  * @param {unknown} text
+ * @param {{ linksOnly?: boolean }} [options]
  * @returns {Result<WaveBlock>}
  */
-function parseWaveBlock(text) {
+function parseWaveBlock(text, options) {
   if (typeof text !== 'string') return fail('invalid');
   if (text.length > LIMITS.WAVE_BLOCK_CHARS) return fail('oversize');
   const rows = textLines(text);
@@ -1864,6 +1901,11 @@ function parseWaveBlock(text) {
       line: i + 1,
     }));
   }
+  // D-WAVE-LINKS-ONLY: the opt-in is set and the related lines ran to the end of the text.
+  if (isObject(options) && options.linksOnly === true && i >= end) {
+    const linksOnly = parseLinksOnlyBlock(related);
+    if (linksOnly !== null) return linksOnly;
+  }
   // rows[i] is the one blank line; indices past `end` hold only blanks, so a
   // missing section fails the first comparison that expects a non-blank line.
   if (rows[i + 1] !== WAVE_HEADINGS[1]) return fail('malformed', i + 2);