feat: consolidate TraceDecay V2 PR8-PR13 delivery

.cargo/config.toml

@@ -33,6 +33,6 @@ TRACEDECAY_DATA_DIR = { value = "target/test-profile/.tracedecay", force = false
 [alias]
 # Local default for the full Rust test suite. Requires cargo-nextest:
 # https://nexte.st/docs/installation/pre-built-binaries/
-test-all = "nextest run --workspace --no-fail-fast"
-test-ci = "nextest run --workspace --no-fail-fast"
+test-all = "nextest run --workspace --all-features --no-fail-fast"
+test-ci = "nextest run --workspace --all-features --no-fail-fast"
 dogfood = "run --quiet --release --bin tracedecay -- dogfood"

.claude/skills/dogfooding-tracedecay/SKILL.md

@@ -25,8 +25,15 @@ The command builds the release binary, copies it outside the repository to
 `~/.local/lib/tracedecay/dogfood/tracedecay`, atomically replaces
 `~/.local/bin/tracedecay`, refreshes tracked integrations through the normal
 post-update lifecycle, restarts the managed daemon, and runs health checks.
-Cargo's isolated `target/test-profile/.tracedecay` profile is removed before
-the live refresh.
+`scripts/dogfood.sh` unsets `TRACEDECAY_DATA_DIR` and
+`TRACEDECAY_DISABLE_GLOBAL_DB` before the live refresh, so post-update work
+targets the real user profile rather than Cargo's isolated
+`target/test-profile/.tracedecay`. That profile is left on disk, not deleted.
+
+The release build runs `build.rs`, and `dashboard/app-dist/` is git-ignored, so
+a fresh worktree has no bundle and the build shells out to `npm ci` plus
+`npm run build` in `dashboard/`. Node.js 22+ and npm must be on PATH, and the
+first dogfood in a new worktree pays that frontend build.
 
 ## Verify live use
 
@@ -39,12 +46,46 @@ tracedecay daemon status
 tracedecay doctor
 ```
 
+A checkout build names the commit it was compiled from, as SemVer build
+metadata appended to the released version:
+
+```
+tracedecay 0.0.66+330e47a0e780          # built from that commit, clean tree
+tracedecay 0.0.66+330e47a0e780.dirty    # built with uncommitted changes
+```
+
+Compare that commit against the checkout you meant to deploy (`git rev-parse
+--short=12 HEAD`); a mismatch means an older binary is still installed. A
+`.dirty` build corresponds to no commit at all, which is ordinary while
+iterating but is not something a verification claim should rest on. The suffix
+is build metadata, ignored for SemVer precedence, so release-plz still owns the
+bare `0.0.66` — never hand-edit `version` in `Cargo.toml` to mark a dogfood
+build. A binary installed from a published release has no commit to name and
+prints `tracedecay 0.0.66`.
+
+`tracedecay doctor`, `tracedecay daemon status`, the MCP `serverInfo`
+handshake, and the dashboard all report that same string, so a daemon left
+running from an earlier dogfood build now shows as a version mismatch instead
+of looking current.
+
+Confirm the upgrade actually took effect on the live profile: exactly one
+managed daemon process is running (`systemctl --user show tracedecay.service
+-p MainPID`), doctor's current-project integrity check passes under the new
+daemon owner, and a daemon-brokered call answers (for example
+`tracedecay tool memory_status --args '{}'`). Schema migrations run when the
+new daemon first opens each store — roll forward only; never let an older
+daemon reopen a store a newer binary has migrated.
+
 Then reproduce the changed host scenario with the ordinary global
 `tracedecay` command. Inspect relevant service/host logs. Restart a host only
 when its integration is in-process or its plugin module cannot hot-reload.
 
 ## Guardrails
 
+- Invoke ordinary `cargo dogfood` without setting `CARGO_TARGET_DIR` or
+  `TRACEDECAY_DATA_DIR`: a redirected target dir breaks the staged-binary path,
+  and an injected data dir deploys against an isolated test profile instead of
+  the real one.
 - Do not run `tracedecay upgrade` for checkout dogfood; it installs a published
   release.
 - Do not kill host-owned MCP shim processes indiscriminately.

.claude/skills/evaluating-hook-hints/SKILL.md

@@ -9,7 +9,7 @@ Use this skill for TraceDecay repo development only. These are repo-local dev in
 
 ## Workflow
 
-1. Start with TraceDecay context for `src/hooks/tool_hints.rs`, `src/hooks/tool_hints/classifiers.rs`, `src/hooks/tool_hints/evals.rs`, host adapters in `src/hooks/{codex,claude,cursor}.rs`, and recent transcript evidence.
+1. Start with TraceDecay context for `src/hooks/tool_hints.rs`, `src/hooks/tool_hints/classifiers.rs`, the `src/hooks/tool_hints/evals/` module (`mod.rs` plus `host_cases.rs`), host adapters in `src/hooks/{codex,claude,cursor}.rs`, and recent transcript evidence.
 2. Render model-visible hook input when judging verbosity:
    `scripts/render-codex-hook-inputs.py --glob '/home/zack/.codex/sessions/**/*.jsonl' --all --limit 5 --max-chars 800`.
 3. Run deterministic evals before behavior edits:
@@ -22,7 +22,7 @@ Use this skill for TraceDecay repo development only. These are repo-local dev in
 ## Acceptance Rules
 
 - Hints should be contextual and short; avoid generic TraceDecay availability boilerplate.
-- Real-world transcript cases and synthetic cases should both be represented in `src/hooks/tool_hints/evals.rs`.
+- Real-world transcript cases and synthetic cases should both be represented in `src/hooks/tool_hints/evals/` (`host_cases.rs` holds the per-host scenarios). The module is `#[cfg(test)]`, so it only compiles under a test profile.
 - A normal user prompt should not be wrapped into a noisy `UserPromptSubmit hook (completed)` model-visible user message.
 - No hint is a valid outcome when the request does not need TraceDecay guidance.
 - Repeated native behavior should get at most one initial hint plus one later escalation per category, bounded by the session budget.