feat(worktrees): narrow the manifest store behind a facade (PR 5/6)

[hzcheng]

Summary

PR 5/6 of the Harness Simplification program. Structural single-writer enforcement for the worktree group manifest store, replacing the type-resolved method scan for this state family.

• The store class leaves the entrypoint: cross-module consumers receive a capability-free WorktreeGroupManifestStoreHandle plus narrow WorktreeGroupManifestReader / WorktreeGroupManifestWriter views. A write call outside the 5-method writer view is a compile error; importing the store file from outside the module is an entrypoint violation.
• Intra-module writers (8 files) take the handle and unwrap it via the module-internal worktreeGroupManifestStoreOf, which is never re-exported.
• dashboard.ts (composition root) holds only the views; its write surface shrinks from 25 methods to the 5 it legitimately needs. The unlisted renameGroup enumeration gap disappears with the scan.
• checkSingleWriters: a stateFamily with writerFacade: true is enforced by a structural import rule on the dependency graph — only declared writers and the module entrypoint may import the store file. Families sharing one store must agree on the flag. Non-facade families (provisioningStore) keep the type-resolved scan during migration.
• Invariant catalog: both groupManifest families declare the facade.

Mutation-sensitivity proof: a probe file importing the store from src/todos/ fails the guard (single-writer: src/todos/__sneaky_probe.ts imports facade store ...); removing it restores green.

Skill harvest

no skill change — the facade pattern followed existing codebase conventions (injected closures, handle unwrap); the CI workflow lessons from this program were already harvested in #297/#299.

Owner approvals

Copy each line into a separate PR comment below (both bind the exact head SHA and expire when the head moves):

approve-architecture c7033e76275cfd4aa48e267a49a61f86cb347b39

approve c7033e76275cfd4aa48e267a49a61f86cb347b39

Verification

• npm run test-compile
• node --test tests/unit/architecture/** tests/unit/tooling/** — 546 pass (3 new facade edge-rule cases)
• node --test tests/unit/worktrees/** — 191 pass; full unit/contract/integration suites pass
• npm run test:behavior-contracts / npm run lint — pass
• Default-branch gate evaluation replayed against the exact head: classification relaxing, zero errors with approval
• node scripts/run-trusted-kernel.js — passes with approval, fails closed without

[github-actions]

Architecture impact report — c7033e76

• classification: relaxing
• touched modules: MOD-DASHBOARD-SHELL, MOD-WORKTREE-LIFECYCLE
• protected paths touched: docs/testing/architecture-invariants.json
• harness surface touched: scripts/architecture/checkSingleWriters.js, tests/unit/architecture/singleWriters.test.js
• mayDependOn grown: (no)
• entrypoints grown: (no)
• invariants changed: ARCH-WORKTREE-MEMBER-WRITER-001, ARCH-WORKTREE-MANIFEST-STRUCTURE-001
• invariants removed: (no)
• baseline grown: (no)
• waivers added: (no)
• ledger regressions: (no)
• capabilities: MAIN-WORKTREE-CHANGES-PANEL
• behaviors: WORKTREE-CHANGES-COLLECT-001, WORKTREE-CHANGES-PANEL-001, WORKTREE-GROUPS-BASELINE-001, WORKTREE-GROUPS-CREATE-001, WORKTREE-GROUPS-CREATE-HANDLER-001, WORKTREE-GROUPS-MERGE-001, WORKTREE-GROUPS-REPLAY-001

Generated by the merge-approval gate from the exact PR head; the PR body carries no machine-checked declaration.

[hzcheng]

approve-architecture c7033e7
approve c7033e7