devflow-kit 3.9.0 → 3.11.0

package/dist/cli/commands/init.js

@@ -14,11 +14,15 @@ import { loadCurationMove } from '../../core/curation-move.js';
 import { describeMoveText, describeOutcome, runInitCurationMove, shownSkipAt } from './curation-move-step.js';
 import { realGlobalTuningMoveIO, realProjectLedgerMoveIO } from './curation-move-io.js';
 import { describeEchoedValue } from '../../core/echo-value.js';
-import { installViaFileCopy, composeScripts } from '../../targets/claude-code/installer.js';
-import { formatOverlaySummary, formatSkillScopeSummary, formatTrackerAssetSummary, isPluginListUnchanged } from './install-report.js';
+import { installViaFileCopy, installScripts } from '../../targets/claude-code/installer.js';
+import { logSummaryLines, openBackupSession, runWithLateBackupReport } from './backup-session.js';
+import { formatKeptLegacySkills, formatLinksSummary, formatOverlaySummary, formatSkillScopeSummary, formatTrackerAssetSummary, isPluginListUnchanged } from './install-report.js';
+import { mergeLinkReports, newLinkReport } from '../../targets/claude-code/linked-folder.js';
+import { sweepLegacyDevflowFiles, sweepLegacySkillFolders } from './legacy-sweep.js';
+import { removeRulesFolder, rulesFolderRefusedMessage } from '../../targets/claude-code/rules-folder.js';
 import { convergeTrackerArtifacts } from '../../targets/claude-code/tracker-install.js';
 import { installSettings, installManagedSettings, installClaudeignore, hasClaudeignore, discoverProjectGitRoots, ensureDevflowGitignore, applyUserSecurityDenyList, detectDenyState, resolveSecurityAction, assertHistoricalDenySuperset, loadTemplateDenyEntries, stripUserSecurityDenyList, } from '../../targets/claude-code/post-install.js';
-import { DEVFLOW_PLUGINS, LEGACY_COMMAND_NAMES, LEGACY_RULE_NAMES, buildAssetMaps, buildScopedSkillsMap, buildRulesMap, partitionSelectablePlugins, WORKFLOW_ORDER, parsePluginSelection, resolveFeatureRedirect } from '../../core/plugins.js';
+import { DEVFLOW_PLUGINS, registeredPluginNames, buildAssetMaps, buildScopedSkillsMap, buildRulesMap, partitionSelectablePlugins, WORKFLOW_ORDER, parsePluginSelection, resolveFeatureRedirect } from '../../core/plugins.js';
 import { LEGACY_SKILL_NAMES } from '../../targets/claude-code/legacy.js';
 import { detectPlatform, detectShell, getProfilePath, getSafeDeleteInfo, hasSafeDelete } from '../../core/safe-delete.js';
 import { generateSafeDeleteBlock, installToProfile, removeFromProfile, getInstalledVersion, SAFE_DELETE_BLOCK_VERSION } from '../../core/safe-delete-install.js';
@@ -49,8 +53,8 @@ import { applyTrackerSentinel, effectiveTrackerServers, parseTrackerId, rearmTra
 import { formatTrackerSummary, shouldRunTrackerStep, runTrackerStep, buildClackTrackerPrompts, } from './tracker-prompts.js';
 import { buildClackGateLevelPrompts, carriedGateLevel, formatGateLevelRow, formatGateLevelSummary, readStoredGateLevel, resolveGateLevelForInit, resolveGateLevelInitState, } from './gate-level-prompts.js';
 import { shouldRunAttributionStep, runAttributionStep, buildClackAttributionPrompts, applyAttributionAnswer, attributionSeedFrom, } from './attribution-prompts.js';
-import { convergeFromManifest } from '../../targets/claude-code/compliance-install.js';
-import { convergeCurationVariants, installedVersionMatches, readRunningVersion } from '../../targets/claude-code/curation-install.js';
+import { convergeVariantAxes, describePostingLeft, installedVersionMatches, readRunningVersion } from '../../targets/claude-code/curation-install.js';
+import { POSTING_OFF_NOTICE, installRecordFor, postingNoticeDue, readInstalledVariants } from '../../core/installed-variants.js';
 import { auditAndRecordClaudeMd, formatClaudeMdAuditNote, formatClaudeMdAuditUnavailable, } from '../../core/claude-md-audit.js';
 import * as os from 'os';
 // Re-export pure functions for tests (canonical source is post-install.ts)
@@ -118,32 +122,41 @@ export function formatSweepSummary(report) {
     return lines;
 }
 /**
- * Log each summary line at the severity it carries — the one dispatch every
- * `SummaryLine[]` renderer shares.
+ * Converge the installed agents onto the saved model and effort assignments, after the file copy
+ * wrote the shipped defaults. Per-item failures are non-fatal.
  *
- * Exhaustive over `SummaryLine['level']` rather than an `if/else`: a level added
- * to the interface has to be routed here, at compile time, instead of silently
- * degrading to `info` at every call site.
+ * Init-only optimization: with an empty mapping and the proxy off, every agent already holds its
+ * shipped default, so the walk would read the agent files and write none; it is skipped. The
+ * disable and revert paths call `reapplyAgentMapping` directly and always need the full walk.
+ * `hasAgentMappingEntries` counts agent entries only: an `agents.memory`-only mapping names no
+ * installed file, so it keeps this gate closed (D-WORKER-AGENTS).
+ *
+ * The links this walk met are returned, not printed: the caller prints them once, through the same
+ * summary as the install step. `verbose` prints the other warnings of the walk.
  */
-function logSummaryLines(lines) {
-    for (const line of lines) {
-        switch (line.level) {
-            case 'success':
-                p.log.success(line.message);
-                break;
-            case 'info':
-                p.log.info(line.message);
-                break;
-            case 'warn':
-                p.log.warn(line.message);
-                break;
-            default: {
-                const _exhaustive = line.level;
-                void _exhaustive;
-                break;
-            }
+export async function reapplyAgentMappingForInit(opts) {
+    const { proxyEnabled, claudeDir, devflowDir, verbose } = opts;
+    const preCheckMapping = await readAgentMapping(devflowDir);
+    const hasMappingEntries = preCheckMapping.ok && hasAgentMappingEntries(preCheckMapping.value);
+    if (!hasMappingEntries && !proxyEnabled)
+        return newLinkReport();
+    const result = await reapplyAgentMapping({
+        proxyEnabled,
+        installDir: path.join(claudeDir, 'agents', 'devflow'),
+        devflowDir,
+    });
+    const links = { replacedLinks: result.replacedLinks, refusedFolders: result.refusedFolders };
+    if (verbose) {
+        const linkLines = new Set(formatLinksSummary(links).map(line => line.message));
+        for (const warning of result.warnings) {
+            if (!linkLines.has(warning))
+                p.log.warn(warning);
+        }
+        if (result.updated.length > 0) {
+            p.log.info(`Agent model mapping reapplied: ${result.updated.length} agent(s) updated`);
         }
     }
+    return links;
 }
 /**
  * Classify the safe-delete installation state based on the installed version
@@ -591,6 +604,20 @@ export function buildHudOnlyManifest(existing, version, now, refusedGateLevel) {
         updatedAt: now,
     };
 }
+/**
+ * The plugin names `init --hud-only` renders the orchestrator charter for. Pure.
+ *
+ * D-CHARTER-INSTALL-RENDER: --hud-only reinstalls no plugin, so the installed charter must keep describing
+ * what the manifest says is installed: the recorded plugins, with a deleted name pruned and a legacy name
+ * mapped as every other partial run does (`resolvePluginList`), and only names this registry has kept
+ * ({@link registeredPluginNames}). With no manifest, or one `readManifest()` refused, nothing is known to be installed, so the set is EMPTY: the
+ * render then names no workflow, and no sentinel is written. The registry fallback that uninstall takes
+ * would hand a machine with no record every workflow's routing line, which is the failure the render exists
+ * to prevent.
+ */
+export function hudOnlyCharterPlugins(manifest) {
+    return registeredPluginNames(resolvePluginList([], manifest, true));
+}
 /**
  * The line `init --hud-only` prints when the version the manifest records is not the
  * running version, or null when there is nothing to say. Pure.
@@ -704,8 +731,8 @@ export const initCommand = new Command('init')
     .option('--no-proxy', 'Disable external model routing')
     .option('--behavior', 'Enable the behavior rule (agents reply in ASD-STE100 Simplified Technical English; off by default)')
     .option('--no-behavior', 'Disable the behavior rule')
-    .option('--compliance <list>', 'Enable compliance with comma-separated framework IDs (e.g., gdpr,hipaa)')
-    .option('--no-compliance', 'Disable compliance (removes the rule; the skill and framework references stay installed; frameworks remembered for re-enable)')
+    .option('--compliance <list>', 'Enable compliance with comma-separated framework IDs (e.g., gdpr,hipaa); installs the steps that post evidence and summaries to GitHub or a tracker')
+    .option('--no-compliance', 'Disable compliance (removes the rule and every step that posts evidence or summaries to GitHub or a tracker; the skill and framework references stay installed; frameworks remembered for re-enable)')
     .option('--tracker <id>', 'The machine\'s default issue tracker provider: github, jira, or linear')
     .option('--gate-level <full|standard|lean>', 'The machine\'s default gate level: full, standard, or lean (skips the gate level prompt)')
     .option('--security <mode>', 'Security deny list location: user, managed, or none', /^(user|managed|none)$/i)
@@ -713,7 +740,7 @@ export const initCommand = new Command('init')
     .option('--recommended', 'Apply recommended defaults after plugin selection (skip advanced prompts)')
     .option('--advanced', 'Show all configuration prompts')
     .option('--reset', 'Factory reset — restore all defaults, ignoring prior installation state')
-    .action(async (options) => {
+    .action((options) => runWithLateBackupReport(async (backupReport) => {
     // Get package version
     const packageJsonPath = path.join(getPackageRoot(), 'package.json');
     let version = '';
@@ -781,22 +808,28 @@ export const initCommand = new Command('init')
             p.log.error(`Failed to update settings: ${error instanceof Error ? error.message : error}`);
             process.exit(1);
         }
-        // Install HUD scripts to devflow dir
-        const scriptsTarget = path.join(devflowDir, 'scripts');
-        try {
-            await composeScripts(scriptsTarget);
-        }
-        catch (error) {
-            p.log.error(`Failed to install HUD scripts: ${error instanceof Error ? error.message : error}`);
-            process.exit(1);
-        }
         // Read the existing manifest: over a prior install, --hud-only touches only
-        // the HUD (D-HUD-ONLY-PRESERVE in buildHudOnlyManifest).
+        // the HUD (D-HUD-ONLY-PRESERVE in buildHudOnlyManifest). Read before the scripts are
+        // installed, so the charter render works from the record as the run found it.
         let existingHudManifest = null;
         try {
             existingHudManifest = await readManifest(devflowDir);
         }
         catch { /* absent on fresh install — existingHudManifest stays null */ }
+        // Install HUD scripts to devflow dir. The orchestrator charter and the implement sentinel
+        // render for the plugins the manifest records, and for the empty set when it records none
+        // (D-CHARTER-INSTALL-RENDER). A render failure is a warning.
+        try {
+            await installScripts({
+                scriptsTarget: path.join(devflowDir, 'scripts'),
+                plugins: hudOnlyCharterPlugins(existingHudManifest),
+                warn: (msg) => p.log.warn(msg),
+            });
+        }
+        catch (error) {
+            p.log.error(`Failed to install HUD scripts: ${error instanceof Error ? error.message : error}`);
+            process.exit(1);
+        }
         // A manifest readManifest() refuses reads as none, but its machine gate level is still
         // stored there: --hud-only keeps it and says so, as the full init does. --reset does not
         // apply here, so nothing asks to forget it.
@@ -1312,9 +1345,9 @@ export const initCommand = new Command('init')
         }
         else {
             p.note('Puts every session (git repos only) in orchestrator posture:\n' +
-                'a ~535-token charter at session start plus a per-prompt reminder\n' +
+                'a charter of up to ~850 tokens at session start plus a per-prompt reminder\n' +
                 'steer the main model to delegate work to agents and devflow workflows\n' +
-                'instead of doing it mainline. Plan-mode handoffs auto-run devflow:implement.', 'Ambient Mode');
+                'instead of doing it mainline. Plan-mode handoffs run devflow:implement when it is installed.', 'Ambient Mode');
             const ambientChoice = await p.select({
                 message: 'Enable ambient mode?',
                 options: [
@@ -1763,6 +1796,17 @@ export const initCommand = new Command('init')
     const { agentsMap } = buildAssetMaps(pluginsToInstall);
     // Rules: install only from selected plugins (plugin-scoped, not universal)
     const rulesMap = rulesEnabled ? buildRulesMap(pluginsToInstall) : new Map();
+    // The one backup session of this run, made before any change. The install and the converge
+    // after it share it, so the run makes at most one backup folder. When the shipped set cannot
+    // be built, init changes nothing.
+    const openedBackups = await openBackupSession({ claudeDir, devflowDir });
+    if (!openedBackups.ok) {
+        s.stop('Installation failed');
+        p.log.error(openedBackups.message);
+        process.exit(1);
+    }
+    const backups = openedBackups.session;
+    backupReport.begin(backups);
     // D32/D35: Apply one-time migrations (global + per-project) tracked at ~/.devflow/migrations.json.
     // Migrations clean up ~/.devflow runtime data and never touch the installer's copy
     // targets, so their position relative to installViaFileCopy carries no dependency.
@@ -1810,67 +1854,64 @@ export const initCommand = new Command('init')
             // their say (D-LEARNING-VARIANT-INSTALL): the files installed here and the
             // manifest written at the end of init cannot disagree about it.
             curation: curationEnabled,
+            // The SETTLED compliance switch, never a raw seed or a repository's narrowing: the
+            // variant follows the machine switch alone, and with it off the install refuses
+            // before it writes a file when the variant files are not all there.
+            compliance: complianceEnabled,
             trackerServers,
             // Non-fatal install notices with no other channel (skipped symlinks in the
             // generated reference tree, mode-normalisation failures) reach the user rather
             // than the void. Collected now, emitted after the spinner stops.
             warn: (msg) => { installWarnings.push(msg); },
+            backups,
         });
     }
     catch (error) {
         s.stop('Installation failed');
         p.log.error(`${error}`);
+        // A file the install moved aside before it failed is named now: nothing runs after the exit.
+        backupReport.print();
         process.exit(1);
     }
-    // D-LEARNING-VARIANT-INSTALL: converge the curation variants. The file copy above
-    // installed the variant of everything IT installed; on a `--plugin` install the
-    // other plugins' files, already on disk, may still be the other variant (this run
-    // may have flipped the switch), and the apply-decisions skill is removed here when
-    // the copy skipped it on a partial install. Rewrites only what is installed.
-    // Warn-not-abort: either mismatch is safe (an on variant is still gated at run
-    // time, an off variant loads no decisions). The agent mapping is reapplied below.
-    try {
-        const curationConverge = await convergeCurationVariants({
-            claudeDir,
-            devflowDir,
-            curation: curationEnabled,
-            plugins: effectivePlugins,
-            warn: (msg) => installWarnings.push(msg),
-        });
-        if (verbose && curationConverge.converged) {
-            p.log.info(`Curation ${curationEnabled ? 'on' : 'off'} variants: ` +
-                `${curationConverge.commandsRewritten.length} command(s) and ${curationConverge.agentsRewritten.length} agent(s) ` +
-                `rewritten, ${curationConverge.unchanged} already current`);
-        }
-    }
-    catch (err) {
-        installWarnings.push(`Curation variant convergence failed — ${err instanceof Error ? err.message : String(err)}`);
-    }
-    // Converge compliance artifacts (always converge, never short-circuit).
-    // Called unconditionally so that enabling/disabling compliance during init
-    // is reflected in the installed artifacts without a separate devflow compliance run.
-    // Wrapped in its own try/catch (warn-not-abort).
-    let convergeResult = null;
-    try {
-        convergeResult = await convergeFromManifest({
-            claudeDir,
-            devflowDir,
-            manifest: { features: { compliance: { enabled: complianceEnabled, frameworks: complianceFrameworks }, rules: rulesEnabled } },
-            warn: (msg) => p.log.warn(msg),
-        });
-        // I41: emit legacy-upgrade notice when compliance is disabled AND a pre-existing rule
-        // was found. The skill is no signal — converge installs it on every machine
-        // (D-COMPLIANCE-INSTALL-ALWAYS) — so removedPreexisting reports the rule alone, on a
-        // partial install; hadComplianceRule covers full installs, where installViaFileCopy
-        // wipes the rules dir before converge probes it.
-        if (!complianceEnabled && (convergeResult.removedPreexisting || hadComplianceRule)) {
-            p.log.info('Compliance rule removed — if you previously had devflow-compliance installed, ' +
-                'run `devflow compliance --enable` to re-enable with your framework selection.');
-        }
-    }
-    catch (err) {
-        p.log.warn(`Compliance artifact convergence failed — install succeeded but compliance artifacts may be stale: ` +
-            `${err instanceof Error ? err.message : String(err)}`);
+    // The one converge for both switches (D-LEARNING-VARIANT-INSTALL, AC-27): the file copy
+    // above installed the variant of everything IT installed; on a `--plugin` install the
+    // other plugins' files, already on disk, may still be another variant (this run may
+    // have flipped a switch), and the apply-decisions skill is removed here when the copy
+    // skipped it on a partial install. It also converges the compliance skill and rule, so
+    // enabling or disabling compliance during init needs no separate devflow compliance run.
+    // Rewrites only what is installed. Warn-not-abort: a failure is a warning here and the
+    // install record below is withheld, so the status line says to run init again. The agent
+    // mapping is reapplied below.
+    const variantConverge = await convergeVariantAxes({
+        claudeDir,
+        devflowDir,
+        manifest: {
+            features: {
+                curation: curationEnabled,
+                compliance: { enabled: complianceEnabled, frameworks: complianceFrameworks },
+                rules: rulesEnabled,
+            },
+        },
+        plugins: effectivePlugins,
+        warn: (msg) => installWarnings.push(msg),
+        backups,
+    });
+    if (verbose && variantConverge.converged) {
+        p.log.info(`Curation ${curationEnabled ? 'on' : 'off'}, compliance ${complianceEnabled ? 'on' : 'off'} variants: ` +
+            `${variantConverge.commandsRewritten.length} command(s) and ${variantConverge.agentsRewritten.length} agent(s) ` +
+            `rewritten, ${variantConverge.unchanged} already current`);
+    }
+    // A compliance-off converge that cannot prove the installed prompts free of posting steps
+    // warns and names the files; init never exits non-zero for it (AC-28 binds the compliance command).
+    installWarnings.push(...describePostingLeft(variantConverge.posting));
+    // I41: emit legacy-upgrade notice when compliance is disabled AND a pre-existing rule
+    // was found. The skill is no signal — converge installs it on every machine
+    // (D-COMPLIANCE-INSTALL-ALWAYS) — so removedPreexisting reports the rule alone, on a
+    // partial install; hadComplianceRule covers full installs, where installViaFileCopy
+    // wipes the rules dir before converge probes it.
+    if (!complianceEnabled && (variantConverge.compliance.removedPreexisting || hadComplianceRule)) {
+        p.log.info('Compliance rule removed — if you previously had devflow-compliance installed, ' +
+            'run `devflow compliance --enable` to re-enable with your framework selection.');
     }
     // D-BEHAVIOR-OPT-IN: converge the behavior rule. The plugin installer never copies it (no
     // plugin declares it) and a full install wiped rules/devflow/ above, so this is the one
@@ -1891,69 +1932,22 @@ export const initCommand = new Command('init')
     if (behaviorEnabled && !rulesEnabled) {
         p.log.info('Behavior rule is on but rules are disabled, so it is not installed — run `devflow rules --enable`.');
     }
-    // Clean up stale skills from previous installations
+    // Stale skill folders from previous installations move whole to the backup folder and are named,
+    // but a bare folder moves only when its SKILL.md is a copy that a release of devflow installed.
+    // A bare folder that the check cannot judge stays where it is, and is named here.
     s.message('Cleaning up');
-    const skillsDir = path.join(claudeDir, 'skills');
-    const skillRemoveResults = await Promise.allSettled(LEGACY_SKILL_NAMES.map(legacy => fs.rm(path.join(skillsDir, legacy), { recursive: true })));
-    const staleRemoved = skillRemoveResults.filter(r => r.status === 'fulfilled').length;
-    if (staleRemoved > 0 && verbose) {
-        p.log.info(`Cleaned up ${staleRemoved} legacy skill(s)`);
-    }
-    // Clean up stale commands from previous installations (e.g., /review → /code-review)
-    const commandsDir = path.join(claudeDir, 'commands', 'devflow');
-    let staleCommandsRemoved = 0;
-    for (const legacy of LEGACY_COMMAND_NAMES) {
-        for (const suffix of ['.md']) {
-            const legacyPath = path.join(commandsDir, `${legacy}${suffix}`);
-            try {
-                await fs.rm(legacyPath);
-                staleCommandsRemoved++;
-            }
-            catch {
-                // Doesn't exist — expected for most entries
-            }
-        }
-    }
-    // Sweep orphaned *-teams.md workflow command variants left by the Agent Teams
-    // refactor. None are ever re-installed, so a blanket sweep is safe on any
-    // install type (the full-install dir wipe only covers full installs).
-    try {
-        for (const f of await fs.readdir(commandsDir)) {
-            if (f.endsWith('-teams.md')) {
-                try {
-                    await fs.rm(path.join(commandsDir, f));
-                    staleCommandsRemoved++;
-                }
-                catch { /* already gone */ }
-            }
-        }
-    }
-    catch { /* commands dir absent — nothing to sweep */ }
-    if (staleCommandsRemoved > 0 && verbose) {
-        p.log.info(`Cleaned up ${staleCommandsRemoved} legacy command(s)`);
-    }
-    // Clean up stale rules from previous installations
-    const rulesDir = path.join(claudeDir, 'rules', 'devflow');
-    let staleRulesRemoved = 0;
-    for (const legacy of LEGACY_RULE_NAMES) {
-        const legacyPath = path.join(rulesDir, `${legacy}.md`);
-        try {
-            await fs.rm(legacyPath);
-            staleRulesRemoved++;
-        }
-        catch {
-            // Doesn't exist — expected for most entries
-        }
-    }
-    if (staleRulesRemoved > 0 && verbose) {
-        p.log.info(`Cleaned up ${staleRulesRemoved} legacy rule(s)`);
-    }
-    // Disable rules directory if rules not enabled
+    const legacySkills = await sweepLegacySkillFolders({ claudeDir, backups, legacySkills: LEGACY_SKILL_NAMES });
+    logSummaryLines(formatKeptLegacySkills(legacySkills.kept));
+    // Clean up stale commands (e.g., /review → /code-review) and rules from previous installations.
+    // A folder the install refused, or that is a link, is not swept: nothing is read or removed through it.
+    // Each removed file is named on the retired line of the backup record.
+    await sweepLegacyDevflowFiles({ claudeDir, report: installReport, backups });
+    // Disable rules directory if rules not enabled: the files devflow did not ship move aside first.
     if (!rulesEnabled) {
-        try {
-            await fs.rm(path.join(claudeDir, 'rules', 'devflow'), { recursive: true, force: true });
+        const rulesFolder = path.join(claudeDir, 'rules', 'devflow');
+        if ((await removeRulesFolder(rulesFolder, backups)) === 'refused') {
+            p.log.warn(rulesFolderRefusedMessage(rulesFolder));
         }
-        catch { /* ignore */ }
     }
     // Clean up legacy hook scripts and lib files left by prior installs
     // (paths relative to hooksDir; copyDirectory is additive, so stale files
@@ -1995,12 +1989,11 @@ export const initCommand = new Command('init')
     ];
     const hooksDir = path.join(devflowDir, 'scripts', 'hooks');
     for (const legacy of LEGACY_HOOK_FILES) {
-        const legacyPath = path.join(hooksDir, legacy);
-        try {
-            await fs.rm(legacyPath);
-        }
-        catch { /* doesn't exist */ }
+        await backups.removeExact(path.join(hooksDir, legacy));
     }
+    // Every step that moves or removes files in devflow's folders has run: name what the session
+    // moved aside, ahead of the summary below. A throw before this point prints it on the way out.
+    backupReport.print();
     // The curation move (#529): after the legacy sweep, before the manifest persist and
     // the disabled-feature drain below, so the drain sees the moved folder. Its lines
     // and its one notice print with the install warnings, after the spinner stops.
@@ -2114,33 +2107,9 @@ export const initCommand = new Command('init')
     // MUST run AFTER the proxy preflight block above: preflight can force proxyEnabled=false
     // on failure, and reapply's dormancy (GPT models materialize only while proxy enabled)
     // depends on the FINAL proxyEnabled value — running earlier would leave GPT model lines
-    // in agent frontmatter after a preflight failure. Per-item failures are non-fatal.
-    //
-    // Init-only optimization: skip reapply when mapping is empty AND proxy is off.
-    // An empty mapping means every agent uses its shipped default; the file copy already
-    // wrote those defaults, so reapply would read ~34 files and write zero. The
-    // disable/revert paths call reapplyAgentMapping directly and always need the full walk.
-    {
-        const agentInstallDir = path.join(claudeDir, 'agents', 'devflow');
-        const preCheckMapping = await readAgentMapping(devflowDir);
-        // hasAgentMappingEntries counts agent entries only: an agents.memory-only
-        // mapping names no installed file, so it keeps this gate closed (D-WORKER-AGENTS).
-        const hasMappingEntries = preCheckMapping.ok && hasAgentMappingEntries(preCheckMapping.value);
-        if (hasMappingEntries || proxyEnabled) {
-            const reapplyResult = await reapplyAgentMapping({
-                proxyEnabled,
-                installDir: agentInstallDir,
-                devflowDir,
-                onWarning: (msg) => { if (verbose)
-                    p.log.warn(msg); },
-            });
-            if (reapplyResult.updated.length > 0) {
-                if (verbose) {
-                    p.log.info(`Agent model mapping reapplied: ${reapplyResult.updated.length} agent(s) updated`);
-                }
-            }
-        }
-    }
+    // in agent frontmatter after a preflight failure. Per-item failures are non-fatal. The links
+    // the walk met are printed below, through the install summary.
+    const agentMappingLinks = await reapplyAgentMappingForInit({ proxyEnabled, claudeDir, devflowDir, verbose });
     // Configure ambient hook, memory hooks, and HUD statusLine in a single read-modify-write pass
     try {
         let content = await fs.readFile(settingsPath, 'utf-8');
@@ -2437,6 +2406,10 @@ export const initCommand = new Command('init')
     // Reference-overlay reporting: the overlay rewrites files inside an installed skill
     // the user may have shadowed, and reports any unit it had to leave alone.
     logSummaryLines(formatOverlaySummary(installReport));
+    // A link the install or the agent model reapply replaced is a change to a path the user made.
+    // A folder either refused is not refreshed, and looks refreshed on disk. A path the two steps
+    // both met is named once.
+    logSummaryLines(formatLinksSummary(mergeLinkReports(installReport, agentMappingLinks)));
     // Skill-scoping reporting: a deselected skill is deleted and a dormant shadow
     // is inert, and neither is distinguishable from "never installed" on disk.
     //
@@ -2484,6 +2457,7 @@ export const initCommand = new Command('init')
     }
     // Write installation manifest for upgrade tracking (non-fatal — install already succeeded)
     const now = new Date().toISOString();
+    const installRecord = installRecordFor(variantConverge.converged, { curation: curationEnabled, compliance: complianceEnabled });
     const manifestData = {
         version,
         // Resolved above, before the install, because the skills install set is
@@ -2525,6 +2499,9 @@ export const initCommand = new Command('init')
         },
         installedAt: existingManifest?.installedAt ?? now,
         updatedAt: now,
+        // The install record, written only after a converge that finished clean (AC-29): an
+        // unclean one leaves the field out, which reads as unknown and names `devflow init`.
+        ...(installRecord !== null ? { installedVariants: installRecord } : {}),
     };
     // ── Manifest write + tracker selection lifecycle (the ONE call site) ──────
     // persistManifestThenConvergeTracker owns the ordering invariant: the
@@ -2542,6 +2519,14 @@ export const initCommand = new Command('init')
         else
             p.log.info(msg.text);
     }
+    // The posting notice (AC-30): once, when the record moves from posting (compliance on, or no
+    // record before this release) to non-posting. It follows the record write, so a record that
+    // was withheld or never reached the disk leaves the notice due for the next init.
+    if (trackerLifecycle.manifestWritten &&
+        installRecord !== null &&
+        postingNoticeDue(readInstalledVariants(existingManifest?.installedVariants), complianceEnabled)) {
+        p.log.info(POSTING_OFF_NOTICE);
+    }
     // Only now that the machine-wide switch is on disk (D-INIT-DRAIN-AFTER-SWITCH).
     const drainRoot = await lookupDrainLedgerRoot({ gitRoot, curationEnabled, manifestWritten: trackerLifecycle.manifestWritten });
     if (drainRoot.warning !== null)
@@ -2607,5 +2592,5 @@ export const initCommand = new Command('init')
         p.log.info(`External model routing: ${color.green('enabled')} — takes effect in new Claude Code sessions`);
     }
     p.outro(color.green('Ready! Run any command in Claude Code to get started.'));
-});
+}));
 //# sourceMappingURL=init.js.map