fix(cli): give error remedies that work as written

[theCodeDrift]

Four error messages told the user to do something that could not work. Each now gives a remedy that does.

Message	Was	Now
Migration 0005, loose rules/*.yml	"Migration 0004 moves those…; run it to completion first." No command runs one migration, and 0004 is already recorded as done.	Move the files into .taskless/sg/rules/ by hand, then run init again. No migration number, so it no longer clashes with the runner's Migration 5 failed: prefix.
check git steps, plan without rule recovery	git restore --source=<commit>, where <commit> is the newest commit git log lists. For a deleted rule that commit is the deletion, so nothing comes back.	git restore --source=HEAD for an uncommitted change, otherwise git restore --source=<commit>~1.
update --rules with no .taskless/	"Run the CLI once." check, verify and test refuse a missing scaffold.	Names init.
check, rule id held by two engines	"Rename one." Renaming the issued rule makes it a copy, which doesn't run either.	Rename the rule you wrote locally, not the issued one, plus every place the id appears for each engine involved.

Notes for review

• Git steps, measured. In a scratch repo, the new commands restored the rule in all six cases tried: committed deletion (exact path and the any-engine pathspec), committed edit, uncommitted deletion, uncommitted edit, and a staged git rm. The parent is spelled ~1 rather than ^ because zsh with extendedglob rejects abc^ with "no matches found", while abc~1 passes through.
• Duplicate id. check can't tell which of the two rules is the issued one, because the pair is refused before reconcile runs. So the message says how to choose rather than naming a path. The places listed are the ones migration 9 rewrites. Migration 9 doesn't run again on a current scaffold, so a collision created later has to be fixed by hand.
• Spec. cli-rule-recovery spelled out the old git restore wording. The OpenSpec change error-remedies-that-work restates that requirement in full and is archived in this PR. All six existing scenarios survive the archive, and one is added.
• The check agent recipe moves to topic v6 with the new example. Error codes are unchanged; only message text changes.
• Tests: the 0005 refusal had none and now has one. The verdict, reconcile-marker and duplicate-id tests assert the new wording. Typecheck, lint and the full suite (2015 tests) pass locally.

Fixes #452

[theCodeDrift]

@claude /review

[claude]

Claude finished @theCodeDrift's task in 13m 57s —— View job

---

Review complete

Review mode: incremental — read 0 prior review thread(s) before reviewing. .prior-review.json contained no review threads, review summaries, or top-level comments beyond the triggering @claude /review itself — this is the first review of this PR, so the whole diff was assessed fresh (nothing to classify as already-addressed).

• Read .prior-review.json
• Fetch PR diff via gh pr diff
• Read full contents of changed source files for context (recovery-advice.ts, plan-check.ts, 0005-rule-directories.ts, layout.ts, check.md, recover-rule.md, package-manager.ts, 0004-vale-engine.ts, 0009-unique-rule-ids.ts)
• Review correctness, security, performance, test adequacy, clarity
• Post inline comments for concrete issues
• Post final top-level summary

Verified correct

• The four message fixes each match the file/table they claim to: the 0005 "move by hand" remedy targets .taskless/sg/rules/, which is exactly what migration 0004's own RULES_MOVE mapping moves loose .taskless/rules/*.yml into, so the remedy is reachable.
• renameAdvice's per-engine "where the id appears" text (sg: directory + .yml + id: + .tests/<id>-*-test.yml; vale: directory + .yml + tskl) rule breadcrumb + <id>.<id> key; runtime: directory alone) matches migration 0009's own table of what it rewrites, word for word in substance.
• The archived spec delta restates the full cli-rule-recovery requirement (all 6 prior scenarios + the 1 new one = 7), avoiding the "MODIFIED replaces, doesn't patch" trap this repo has been burned by before.
• recover-rule.md's RULE_ID_AMBIGUOUS row already says "rename the local one, then restore" — consistent with the new guidance, and wasn't stale.
• The ~1 vs ^ reasoning, the HEAD branch for an uncommitted change, and the test updates (verdicts.test.ts, runtime-check.test.ts, reconcile-marker.test.ts, migrate-engine-layout.test.ts) all line up with the corresponding source changes.

Findings (posted inline)

1. [New] Orphaned doc comment in packages/cli/src/rules/plan-check.ts (~line 332): /** The one notice a withheld run prints... */ used to sit directly above withheldNotice. The new renameAdvice function is now spliced in between, so the comment now floats over the wrong declaration and withheldNotice loses its doc comment. Pure documentation drift, easy one-line fix.
2. [New] buildInvocation() vs getCliPrefix() in packages/cli/src/rules/reconcile-marker.ts (and new code in 0005-rule-directories.ts): these new error remedies use buildInvocation(), which is the static build-time string and ignores how the user actually launched the CLI (npx vs pnpm dlx). getCliPrefix() exists specifically for "an error remedy" per its own doc comment, and the sibling rules/plan-check.ts already uses it for the auth login suggestion. Flagged at moderate confidence since filesystem/migrate.ts already uses the same buildInvocation() pattern for a similar message — this may be an existing convention in the migration layer rather than something this PR invented, but worth a deliberate check given the PR's own "remedies that work as written" goal.

Nothing else stood out as a correctness, security, or test-adequacy gap; the duplicate-id, missing-rule, and committed/uncommitted git-step scenarios are all exercised by the updated tests, and the engine-ordering/wording in the combined-engine case checks out against report.ts.

Branch: fix/452-error-remedies

[theCodeDrift]

Re: @claude[bot] — "Claude finished @theCodeDrift's task in 13m 57s —— [View job]…"
#464 (comment)

Thanks. Both findings are addressed: the orphaned doc comment is back above withheldNotice (cff6f86), and both new init remedies now use getCliPrefix().

— AI Coding Agent