fix(store): repair persistence contract and enforce honest quality gates (Plan 131 W1)

[d-oit]

Plan 131 Wave 1 — GOAP Swarm Audit follow-up

Implements the two P0 goals from `plans/131-goap-swarm-improvement-audit-2026-08-22.md` (six-agent swarm audit, ~90 findings).

G1 — Persistence contract repair (data-loss fixes)

• Thread zustand's version argument into `runMigrations`; reject future-version envelopes instead of silently back-migrating and destroying newer-format fields (`migrations.ts`)
• Validate every hydration, not just version mismatches: new `hydration.ts` makes a custom `merge` the single enforcement point; corrupt payloads now raise `HydrationRejectedError` so the middleware aborts before its post-migration `setItem` — previously the false seed-fallback merged raw unvalidated records over seed state (Library white-screen vector), and silent fallback would have overwritten recoverable data
• Rebase undo history on rehydrate: first edit after reload + undo no longer reverts the corpus to demo seeds
• Envelope schema covers every partialize key (+ lockstep guard test); UI prefs survive version migrations; legacy pre-pref envelopes still load
• searchQuery removed from partialize — typing no longer serializes the whole corpus to localStorage per keystroke

New composed round-trip suite (`store-persist.test.ts`) pins: undo-after-reload safety, corrupt-payload discard + on-disk preservation, future-version rejection without rewrite, pref survival through migration, legacy v1 migration.

G7 — Quality-infrastructure honesty

• Coverage excludes colocated test files; honest re-baseline: branches 75 / functions 78 / lines 84 / statements 85 (were 48–55 against inflated numbers; true source coverage is ~77–87%)
• `restoreMocks: true` default; vitest typecheck wired to real `.test-d.ts` contracts (73 legacy test-file type errors documented for G9 via `ignoreSourceErrors`)
• Lint governance (explicit maintainer decision): `react-hooks/exhaustive-deps` and `@typescript-eslint/no-explicit-any` restored to `error`; fixed all 7 dep violations (incl. two audit P1s: mindmap stale closure, graph-view unnecessary deps) and 3 `any` usages
• Committed `.githooks/` activated via `core.hooksPath` (prepare script); CI no longer sets `SKIP_GLOBAL_HOOKS_CHECK`; validator resolves effective hooks dir on fresh checkouts
• New `deps-verify` CI job runs `verify-deps.sh` when manifests/lockfile change

Verification

• Full suite: 2277 passed | lint/typecheck clean | pre-commit gate green | honest coverage thresholds enforced

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
do-knowledge-studio	Ready	Preview, v0	Aug 22, 2026 8:30pm

[github-actions]

Blocked merge diagnosis — blocked
⏳ Check run(s) still in progress: ["Codacy Static Code Analysis","GitHub Actions Workflow Validation","Diagnose Blocked Merge State","Infrastructure as Code Security","Secret Detection","Shell Script Security Analysis","commitlint","labeler","Trivy Filesystem Security Scan","Detect Changes","YAML Syntax Validation","Analyze (actions)","Analyze (javascript-typescript)"]

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 21 complexity · 0 duplication

Metric	Results
Complexity	21
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}