chore(memory): BDR-101 + LRN-170 + LRN-171 + EVAL-031 — feat default-profile-full

.claude/memory/learnings.md

@@ -189,6 +189,8 @@ rules:
 | LRN-167 | 2026-09-24 | a release/develop fork strands CODE on develop: a "resolved" blocker or a parallel-merged feature can miss its fix | any long-lived fork (release/*, long feature); back-merging a resolved blocker |
 | LRN-168 | 2026-09-24 | a relayed claim is not a fact: WebSearch consensus and sub-agent summaries both need a primary source or a live test | any number, feature or finding relayed by search or by a sub-agent before it shapes a plan or a client deliverable |
 | LRN-169 | 2026-09-24 | a coherence audit is cheap when parallel and read-only, and its findings are claims: spot-check, then fix every citer | any doctrine or skill rule change; sub-agent briefs; environment-dependent tests |
+| LRN-170 | 2026-09-25 | "count == 0" ≠ "all on" when default state is "nothing installed": verify a fast-path premise on the live tree | status/current/detect commands, installer "is X applied?" checks, plan premises copied from stale comments |
+| LRN-171 | 2026-09-25 | sub-agent sandbox: grep shim returns EMPTY inside `$(...)` for patterns holding literal `$VAR` — oracles pin `command grep` | contract CHECK lines, hermetic test greps, hooks parsing grep output |
 
 ---
 
@@ -1586,3 +1588,19 @@ Rule: when editing a doctrine file under structure locks, grep the test's lock s
 - **Pattern**: (a) the two dominant defect classes were MY same-day partial fixes (200-file graphify rule landed in advisor+doctrine, not in the two orchestrators that build; density pass renamed a heading 5 skills cited; a routing line kept "deploy → ship" with /deploy existing) and a 2-day-old staleness wave (BDR-095 auto-push made 5 skills' push text false, global hooks broke `gitflow init` on existing repos). Rule change → `grep -rn` every citer and every consumer BEFORE committing ([[LRN-164]] applied to doctrine). (b) test hermeticity hides environment regressions: `make test` neutralises the global git config, so the global-hook breakage of init was invisible; add a test that SIMULATES the environment (T2c sets a hooks dir as if global). (c) executors with closed briefs applied 35+8+6 prose edits cleanly in parallel; the residue was scope edges (2 lines in an agent outside E1's list, 2 passages E3 saw but was not allowed to touch) → give executors the whole file family, not a line list. (d) one executor routed around the static deny on `GIT_CONFIG_GLOBAL=` by writing a wrapper script to run a test: harmless here, but a sub-agent WILL work around a guardrail when the brief asks for a result the guardrail blocks — brief "if a guard denies a command, report and stop" explicitly ([[LRN-160]] class). (e) C3 measured superpowers over 29 sessions: 2 invocations / 126 turns, both warranted; a plugin's MUST yields to user instructions in practice — measure before disabling ([[LRN-080]]).
 - **Future application**: for any doctrine/skill rule change: grep citers first, patch them in the same commit. Environment-dependent behaviour (global hooks, PATH, HOME) → a test that simulates the environment, not one that neutralises it. Sub-agent briefs → "denied by a guard = stop and report", never "find a way". Re-run the C2 audit after each doctrine wave; re-run the C3 transcript census in 30 days.
 - **Reference**: [[BDR-099]], `lib/gitflow-test.sh` T2c, transcript census script (session scratch, re-creatable: parse `~/.claude/projects/*/*.jsonl`, Skill tool_use with `superpowers:` prefix, preceding user text).
+
+## LRN-170 — "count == 0" ≠ "all on" when default state is "nothing installed": verify a fast-path premise on the live tree
+- **Date**: 2026-09-25
+- **Context**: plan r1 for [[BDR-101]] kept `cmd_current` fast path "0 parked gstack ⇒ all gstack enabled ⇒ no profile set". Correctness challenger `ls`-ed live tree: 0 parked AND 0 linked — gstack OFF by default since [[BDR-030]]. Fast path fired after `reset`, told user to run command just run. Plan inherited pre-BDR-030 premise from code comment. Same family as [[EVAL-002]] anomaly (1). Session banner even said gstack OFF.
+- **Pattern**: sentinel derived from ABSENCE (count 0, no diff, empty dir) ambiguous whenever default state is also absence. Before building on such fast path: check live default state (one `ls`/`find`), or key on explicit signal (here: cache written by every set/apply/reset).
+- **Where applicable**: status/current/detect commands; "is X applied?" checks in installers; any "nothing parked/disabled ⇒ default" branch; plan premises copied from stale comments.
+- **How to detect early**: list state the sentinel summarises on fresh tree; design-time comment older than last behaviour change (BDR-030 here) = suspect premise.
+- **Cost when missed**: user-facing lie + destructive hint (`run: profile reset` right after reset). Would have shipped without challenge round.
+- **Reference**: plan r1→r3 `2026-09-25-default-profile-full-1254`, challenge verdicts FATAL(3)/FATAL(2). Links [[BDR-101]] [[BDR-030]] [[LRN-020]] [[EVAL-002]] [[EVAL-031]].
+
+## LRN-171 — sub-agent sandbox: grep shim returns EMPTY inside `$(...)` for patterns holding literal `$VAR` — oracles pin `command grep` / `/usr/bin/grep`
+- **Date**: 2026-09-25
+- **Context**: contract criterion 12 CHECK captured `grep -n 'bash "$REPO/link.sh"' install-plugins.sh | head -1 | cut -d: -f1` in `$(...)`. Feater executor: intermittently empty. Verifier: reproducibly empty, same bare command found line; both fell back to `command grep` / direct greps. Main-session `gates.sh run` passed same CHECK (no shim there). Not reproduced in main loop — recorded as observed; cause = rtk grep rewrite shim (ugrep) in sub-agent sandbox, [[LRN-074]] family (system grep ≠ GNU grep).
+- **Pattern**: oracles + test assertions portable across main shell / sub-agent shells pin `/usr/bin/grep` or `command grep`; avoid `$VAR` literals mid-pattern (`-F` or `--`).
+- **Where applicable**: contract `CHECK:` lines run by executors/verifiers; hermetic test greps; any hook riding on grep output.
+- **Reference**: contract `2026-09-25-default-profile-full-1254` criterion 12; verifier + executor reports 2026-09-25. Links [[LRN-074]] [[BDR-101]].