feat(init): seed store project on init + nag unwired repos on four surfaces

[s-annam]

Summary

The memory link is per-repo, and nothing said so. install.sh wires only the repo it runs in, so every other project silently remembered nothing — a failure with no symptom.

Worse, the documented fix was broken: in a repo that had never saved memory, link_project_memory found no <store>/projects/<name>/ and returned ("skip", "no store project dir yet"), making okfmem init a silent no-op in exactly the case the step exists for. It now seeds that dir (starter MEMORY.md + STATE.md, never overwriting an existing file) and links it — a fresh repo wires up in one command.

With the fix real, the instruction is now unmissable on four surfaces, all sharing one read-only probe so they can't drift:

okfmem init --project-link-state   # linked <name> | unlinked <name> | not-a-repo | no-claude

Surface	Behavior
install.sh / install.ps1	Ruled banner: "ONE MORE STEP — REQUIRED IN EVERY REPO", naming the repo actually wired
SessionStart hook (memory_pull.py)	Reminder when unlinked, printed even under --quiet
/okfmem	Probes after status; leads the summary with the fix
/okfmem-save	Probes first, stops and fixes before writing

Two deliberate choices worth review:

• Printing under --quiet. SessionStart is the only okfmem surface that fires in a repo the user never ran init in, and its stdout reaches the agent as context. A silent unlinked repo is precisely the failure the notice exists to catch, so --quiet suppresses the pull line but not this one (documented in the flag's help text). Fail-open contract preserved — unlinked_repo_notice never raises, exit code unchanged.
• Stop hook stays silent. Stop-hook stdout is not surfaced to the user on exit 0, and blocking a session over unwired memory is the wrong trade. SessionStart covers the case Stop can't reach anyway.

The probe also removes a real Windows bug: /okfmem-save derived the encoded project path with sed 's|/|-|g', but encode_root encodes the drive colon (C:\ → C--). No surface re-derives that path now.

Rung-1 discipline: the probe is read-only and never prompts; seeding is additive, inside the user's own store, and only for the repo they explicitly ran init in. --dry-run writes nothing.

Refs #3

Test plan

• python3 scripts/check-leaks.py exits 0 — "scanned 62 tracked files, no leaks"
• python3 -m pytest -q — 209 passed, 1 skipped
• ruff check clean on all changed files
• bash -n install.sh OK
• New coverage: seeding, dry-run writes nothing, seed idempotent, 6 probe cases (unlinked before init / linked after / unlinked when the link points elsewhere / not-a-repo / no-claude / never-raises), notice fires only when unlinked, notice never raises
• Live probe: linked okfmem in-repo, not-a-repo outside
• install.ps1 not parse-checked locally — no pwsh on this machine. Verified pure ASCII (grep -nP '[^\x00-\x7F]' clean, per the BOM-less-cp1252 hazard). Windows CI is the first real parse check; worth an extra eye on that job.

Provenance

Code implementation via: Claude Opus 4.8 (1M context), high effort
Verification: local test suite + leak gate green; CI verify pending

[s-annam]

Windows verification — closes the open install.ps1 checkbox

Ran on a real Windows 11 machine that has both PowerShell editions, so this covers the parse the author couldn't do locally.

install.ps1 parse-check (AST, no execution)

Parsed via [System.Management.Automation.Language.Parser]::ParseFile(...) under both editions:

• Windows PowerShell 5.1.26100 — 0 errors. This is the edition that matters for the BOM-less/cp1252 hazard (#Requires -Version 5.1 is the floor), and it's clean.
• PowerShell 7.6.3 — 0 errors.
• grep -nP '[^\x00-\x7F]' clean → pure ASCII confirmed independently.

Live install run

pwsh -NoProfile -NonInteractive -File install.ps1 → exit 0, fully idempotent against an already-installed store:

• backfill — 2270 pages scanned across 14 projects, 1 stamped, remainder already-stamped (additive, no churn).
• init — fully wired — nothing to do: memory link, registry, .gitignore, pointers, stale refs, skills, stop hook, pull hook all reported up to date.
• remote step — Set-StoreRemote correctly early-returned (Store already has a remote) rather than re-prompting.
• non-interactive contract — under -NonInteractive, Read-Host throws, so Read-PromptAnswer returns $null and both the remote and statusline prompts skipped cleanly with the exit code unchanged. This is the fail-open path the PR relies on, exercised end to end.
• nag banner — the ONE MORE STEP — REQUIRED IN EVERY REPO block rendered, naming the repo actually wired (okfmem).

New probe surface

The four-surface probe added by this PR, checked directly:

• okfmem init --project-link-state → linked okfmem in-repo, not-a-repo from outside any repo — matches the documented probe cases.
• okfmem init --statusline-state → custom, which is exactly why the live installer skipped the badge step silently (correct behavior on a machine with an existing statusline).

Incidental (pre-existing, not this PR)

init emits ! legacy clone found ~\claude-memory — the known retired-memgraph leftover. Warn-not-delete, hands over the manual command; unrelated to these changes.