Self-healing journal import, .ctxrc promotion, GitNexus fold — reviewed & fixed

[josealekhine]

Summary

A multi-spec changeset (the "jumbo diff") put through a 4-pass adversarial code
review before merge. The review surfaced 20 findings (3 critical,
4 medium, 13 low); all are fixed, each with regression tests. Docs are
updated and the tracked docs site is rebuilt. Every commit carries a truthful
Spec: trailer and a DCO Signed-off-by.

267 files changed (including 182 generated site/ files; ~85 hand-edited
source/doc files).

What's in it (by spec)

feat: self-healing journal import (Phase JI) — specs/journal-import-self-heal.md
ctx journal import becomes growth-aware: the unit of memory is the source
transcript (has it grown?), not the output file (does it exist?). --all
imports new sessions and completes any whose transcript has grown, skipping
only unchanged sources. Hand-edited entries are detected via a body render-hash
and never clobbered. Wired into a SessionEnd hook + the wrap-up ceremony, so it
self-heals with no flags to remember.

feat: promote runtime constants to .ctxrc — specs/ctxrc-constant-promotion.md
Six new opt-in .ctxrc keys: auto_prune_days, agent_cooldown_minutes,
task_budget_pct, convention_budget_pct, title_slug_max_len,
recall_list_limit. Absent keys preserve prior behavior.

chore: remove experimental spec-kit skills; add spec-driven recipe — specs/remove-experimental-spec-kit-chain.md
Delete the unused ctx-experimental-{plan,spec,handoff} skills (they only
bridged to an unused spec-kit); add the operator-facing
spec-driven-development recipe and register it in the nav/index.

build: vendor GitNexus Docker tooling; drop npx gitnexus — specs/gitnexus-docker-fold.md
npx gitnexus doesn't run here (tree-sitter@0.21.1 vs Node 24). Vendor a Docker
wrapper (hack/gitnexus-*.sh) + Make targets. A registry_mounts helper guards
against GitNexus pruning registry entries whose paths it can't stat in-container
(fails loud on a missing python3 on registry-touching branches).

docs: repair site nav; fix connect→connection references — specs/docs-link-integrity.md
Add orphaned recipe/CLI pages to the nav; delete the stale cli/connect.md
(superseded by connection.md); fix broken ctx connect references. New
docs_nav_test.go guards nav reachability both ways (page↔nav).

chore: rebuild docs site + DCO governance
Regenerate the tracked site/ (zensical). Mandate DCO sign-off and forbid agent
sign-offs in CONSTITUTION.md, the session-start gate, and the /ctx-commit
skill (with Copilot mirror).

Adversarial review — 20 findings fixed

Critical

• C1 — ctx journal site rewrote entry bodies in place without refreshing
  the render-hash, so growth-aware import false-flagged every site-normalized
  entry as foreign-edited and stranded it. Fixed: refresh the hash + persist
  state on every body-authoring pass.
• C2 — a negative auto_prune_days moved the prune cutoff into the future
  and deleted every session-state file. Fixed: <= 0 guard in the getter
  and defensively in health.AutoPrune.
• C3 — a negative title_slug_max_len reached a slice bound and panicked
  every ctx journal source/import. Fixed: <= 0 guard.

Medium

• M1 — the source stat was committed at plan time, so a failed/partial grown
  write silently forgot the growth. Moved to execute, gated on a clean write.
• M2 — agent_cooldown_minutes: 0 couldn't disable the cooldown. Cooldown
  and budget-percentage keys are now pointer types (explicit 0 ≠ unset).
• M3 — resume/multi-file dedup kept first-seen by walk order, not the richest
  transcript. Now picks the largest; growth also compares the source path.
• M4 — a v1→v2 adopted entry recorded no render-hash, mislabeling later
  growth as a foreign edit. Now backfills the hash at adoption.

Low — GrownCount split (routine growth no longer trips the regenerate
prompt) · atomic entry writes · shell registry_mounts fail-open + python3
preflight · budget clamp to [0,1] and per-tier cap · nav-test sentinel +
reverse-link check · drift-proof reflection-based schema test · doc/wording
fixes.

New regression tests cover every confirmed bug: negative-value fallbacks,
0-disables-cooldown, budget clamp, adoption hash, failed-write-doesn't-strand,
GrownCount, and the full New → Unchanged → Grown → ForeignEdit self-heal
cycle.

Behavior / migration notes

• Journal state schema v1 → v2 (per-session source tracking + per-entry
  render-hash). v1 files load tolerantly and round-trip as v2 on the next save.
• ctx journal import --all no longer skips existing entries — it completes
  grown ones. Hand-edited entries are protected (detected by render-hash and
  left untouched with a warning).
• The six new .ctxrc keys are opt-in; unset means prior defaults.

Testing

make build ✓ · gofmt clean · golangci-lint 0 issues · make test
0 failures (169 packages) · docs site rebuilt with zensical and verified
(new recipe rendered, stale connect page pruned).