Phase 11 features: covenant-apply, machine-readable, plugin, metals, custom DB

All remaining Phase 11 deliverables + nice-to-have features in one
commit. 274/274 tests passing on Scala Native.

=== enforce: covenant-apply subcommand ===

New `re-scale enforce covenant-apply` stamps or updates a Covenant
header in a Scala file's leading block comment. Extracts current
method set + LOC, optionally verifies zero shortcut hits (--force
to skip), writes/updates the Covenant block before `*/`. Round-trip
verified: Covenant.parse and Covenant.verify both work on created
headers. 7 tests.

CLI:
  re-scale enforce covenant-apply \
    --file <path> --source <ref> \
    [--spec-pass N] [--covenant full-port] [--dry-run] [--force]

=== enforce: --machine-readable output ===

`--machine-readable` flag for `enforce shortcuts`, `stale-stubs`,
and `verify --all` — outputs TSV (tab-separated with `#`-prefixed
header) to stdout for CI diff scripts and baseline comparison.
Machine-readable mode suppresses informational stderr messages.

=== re-scale metals ===

Metals LSP server lifecycle commands (install/start/stop/status).
Ported from sge-dev MetalsCmd (~100 LOC). Uses a PID file under
.rescale/.metals-pid and Coursier for install. Wired into Main.scala.

=== Custom DB tables via .rescale/databases.yaml ===

Projects can define arbitrary TSV-backed tables with column schemas,
key columns, and defaults. `re-scale db <table> list/get/set/add/
delete/stats` works on any declared table. Motivating use case:
ssg-sass port-tasks tracking without hardcoding into the binary.
Engine creates the TSV file on first write with correct headers.

=== Hook rules: adb deny + .rescale/data guard ===

- adb/fastboot deny rule in DefaultRules — denies Android Debug
  Bridge commands by default; projects opt in via claude-hooks.yaml.
- .rescale/data/ access guard — Read/Edit/Write tool calls on paths
  containing .rescale/data/ are denied, forcing agents to use
  `re-scale db` commands for data integrity (atomic writes, file
  locking, consistent TSV formatting). 5 new tests.

=== CI baseline diff script ===

`scripts/baseline-diff.sh` — runs enforce shortcuts --machine-readable,
diffs against a stored baseline TSV in .rescale/data/, exits 1 on
new regressions (one-directional: improvements don't fail).

=== Plugin packaging: .claude-plugin/ with 13 seed skills ===

Ships re-scale as a Claude Code plugin. Skills auto-load when
context matches their description — no manual invocation needed.

Guide skills (generic porting knowledge):
  guide-conversion       Cross-language conversion rules
  guide-code-style       Formatting + Scala 3 conventions
  guide-nullable         Nullable[A] opaque type patterns
  guide-control-flow     boundary/break patterns
  guide-verification     Post-conversion verification checklist

Workflow skills (re-scale command orchestration):
  rescale-audit-file     Full file audit against source
  rescale-verify-file    Convention + compile + test verification
  rescale-find-issues    Quality scan (shortcuts + stale-stubs + grep)
  rescale-check-progress Migration/audit/covenant progress dashboard
  rescale-audit-status   Audit status per-package or overall
  rescale-gap-fix        Fix enforcement failures using template

All skills use the proper format: description-only frontmatter,
$ARGUMENTS for parameterized skills, no name: field.

=== Documentation ===

- docs/contributing/verification-checklist.md — rewritten against
  re-scale enforce commands (7-step checklist with quick-reference)
- docs/contributing/gap-fix-task-template.md — standard template for
  driving gap-fix waves (task prompt + batch workflow + triage table)
- README.md — expanded Install section with prerequisites, new
  "Claude Code skills (per project)" subsection with 13-skill table,
  updated test counts from 245 → 274, added metals/ to architecture

=== Infrastructure ===

- Tsv.readOrEmpty helper for tables that may not exist yet
- extractStringField helper in HookCmd for non-Bash tool inspection

Author: MateuszKubuszok

.claude-plugin/plugin.json

@@ -0,0 +1,6 @@
+{
+  "name": "re-scale",
+  "description": "Scala Native porting toolkit — enforcement gates, migration tracking, and conversion guides",
+  "version": "0.1.0",
+  "author": {"name": "kubuszok"}
+}

.claude-plugin/skills/guide-code-style/SKILL.md

@@ -0,0 +1,23 @@
+---
+description: Code style rules for Scala 3 porting projects — headers, formatting, conventions
+---
+
+# Code style
+
+- **License header**: Apache-2.0, with Migration notes block for audited files
+- **Braces required** (`-no-indent`): `{}` for all trait/class/enum/method defs
+- **Split packages**: `package ssg` / `package md` / `package core` (never flat)
+- **No `return`**: use `boundary`/`break`
+- **No `null`**: use `Nullable[A]`
+- **No `scala.Enumeration`**: use Scala 3 `enum`, preferably `extends java.lang.Enum`
+- **Case classes must be `final`**
+- **No Java-style getters/setters**: no-logic `getX()`/`setX(v)` → public `var x`
+- **Preserve all original comments** from the source
+- **Fix bugs, don't work around them**: when a test reveals a pre-existing bug, fix it
+
+## Formatting
+
+Scalafmt config is `.scalafmt.conf` at project root. Run:
+```
+re-scale build fmt
+```

.claude-plugin/skills/guide-control-flow/SKILL.md

@@ -0,0 +1,51 @@
+---
+description: boundary/break patterns replacing return/break/continue in Scala 3
+---
+
+# Control flow guide
+
+Scala 3 with `-no-indent` and the project's `no return` rule requires
+`scala.util.boundary` / `break` for early exit patterns.
+
+## Replacing return
+
+```scala
+import scala.util.boundary, boundary.break
+
+def find(xs: List[Int]): Int = boundary {
+  for (x <- xs) {
+    if (x > 10) break(x)
+  }
+  -1 // default
+}
+```
+
+## Replacing break/continue in loops
+
+```scala
+boundary {
+  for (x <- xs) {
+    if (shouldSkip(x)) break() // acts like continue in the innermost boundary
+    process(x)
+  }
+}
+```
+
+## Nested boundaries
+
+Use `boundary.Label` to disambiguate:
+```scala
+boundary[Int] { outer ?=>
+  for (xs <- xss) {
+    boundary[Unit] { inner ?=>
+      for (x <- xs) {
+        if (done(x)) break(x)(using outer)
+        if (skip(x)) break(())(using inner)
+      }
+    }
+  }
+  -1
+}
+```
+
+The shortcuts scanner flags `var done/continue/stop` as `flag-break-var`.

.claude-plugin/skills/guide-conversion/SKILL.md

@@ -0,0 +1,34 @@
+---
+description: Cross-language conversion rules for porting Java/Dart/Ruby to Scala 3
+---
+
+# Conversion guide
+
+Load the appropriate language-specific rules based on the source language:
+
+- **Java → Scala 3** (flexmark-java, liqp): Java getters → Scala vals/defs,
+  checked exceptions → Either/Try, generics → type parameters, streams → FS2
+- **Dart → Scala 3** (dart-sass): Dart null-safety → Nullable[A], extension
+  methods → extension objects, cascade notation → builder pattern
+- **Ruby → Scala 3** (jekyll-minifier): dynamic typing → ADT/sealed trait,
+  monkey-patching → implicit class, blocks → lambdas
+
+## Key principles
+
+1. Port the LOGIC, not the syntax. Idiomatic Scala 3 over transliteration.
+2. Use `Nullable[A]` for nullable values — never raw `null` except at Java interop.
+3. Use `boundary`/`break` instead of `return`/`break`/`continue`.
+4. All `case class` must be `final`.
+5. No `scala.Enumeration` — use Scala 3 `enum`.
+6. Preserve all original comments.
+7. Fix bugs from the original when found during porting.
+
+## Verification
+
+After converting, run:
+```
+re-scale enforce shortcuts --file <path>    # must be 0 hits
+re-scale enforce compare --port <scala> --source <original> --strict
+re-scale build compile --module <mod> --all
+re-scale test unit --module <mod>
+```

.claude-plugin/skills/guide-nullable/SKILL.md

@@ -0,0 +1,27 @@
+---
+description: Nullable[A] opaque type patterns for null-safe Scala porting
+---
+
+# Nullable guide
+
+Use `Nullable[A]` instead of raw `null`. The opaque type provides:
+- `Nullable.empty[A]` instead of `null`
+- `Nullable(value)` to wrap
+- `.getOrElse(default)` for safe unwrapping
+- `.map(f)` / `.flatMap(f)` for chaining
+- `.orNull` only at Java interop boundaries (requires `@nowarn` + comment)
+
+## Common patterns
+
+```scala
+// Java: String result = map.get(key);  // nullable
+// Scala:
+val result: Nullable[String] = Nullable(map.get(key))
+result.getOrElse("default")
+
+// Java: if (x != null) x.doSomething()
+// Scala:
+x.foreach(_.doSomething())
+```
+
+Never use `null.asInstanceOf[T]` — the shortcuts scanner flags it as `null-cast`.

.claude-plugin/skills/guide-verification/SKILL.md

@@ -0,0 +1,17 @@
+---
+description: Post-conversion verification checklist using re-scale enforce
+---
+
+# Verification checklist
+
+Run these checks after every conversion, in order (cheapest first):
+
+1. **Compile**: `re-scale build compile --module <M> --all`
+2. **Tests**: `re-scale test unit --module <M> --all`
+3. **Shortcuts**: `re-scale enforce shortcuts --file <path>` → 0 hits
+4. **Compare**: `re-scale enforce compare --port <scala> --source <original> --strict`
+5. **Stale stubs**: `re-scale enforce stale-stubs --src <dir>`
+6. **Covenant verify**: `re-scale enforce verify --file <path>`
+7. **Stamp**: `re-scale enforce covenant-apply --file <path> --source <ref> [--spec-pass N]`
+
+See `docs/contributing/verification-checklist.md` for full details.

.claude-plugin/skills/rescale-audit-file/SKILL.md

@@ -0,0 +1,45 @@
+---
+description: Audit a ported Scala file against its original source — runs shortcuts, compare, stale-stubs, and records the result
+---
+
+Audit the file at `$ARGUMENTS` against its original source.
+
+## Procedure
+
+1. Read the Scala file with the Read tool.
+
+2. Identify the original source file:
+   - Check the license header for `Covenant-source-reference:` or a `Migration notes:` block
+   - Or look in the `original-src/` submodule using the project's type-mapping convention
+
+3. Read the original source file from the local submodule (**never fetch from GitHub**).
+
+4. Run enforcement checks:
+   ```
+   re-scale enforce shortcuts --file <path>
+   re-scale enforce compare --port <path> --source <original> --strict
+   re-scale enforce verify --file <path>
+   ```
+
+5. Check conventions:
+   - License header with original source attribution
+   - No `return`, no raw `null` (use `Nullable[A]`)
+   - `final case class`, split packages, braces required
+   - Uses `boundary`/`break` where the original has early returns
+
+6. Check tests — does the original have tests? Are they ported?
+
+7. Record the audit result:
+   ```
+   re-scale db audit set <file_path> --status <pass|minor_issues|major_issues> --tested <yes|no|partial> --notes "..."
+   ```
+
+8. If the file passes all checks, stamp the covenant:
+   ```
+   re-scale enforce covenant-apply --file <path> --source <original> [--spec-pass N]
+   ```
+
+## Important
+
+**Do NOT access .rescale/data/ files directly.** Use `re-scale db` commands.
+**Do NOT use shell commands for search/read.** Use Grep, Glob, Read, Edit tools.

.claude-plugin/skills/rescale-audit-status/SKILL.md

@@ -0,0 +1,29 @@
+---
+description: Show audit status for a package or the whole project — counts by status, identifies unaudited files
+---
+
+Show audit status. If `$ARGUMENTS` is provided, show status for that package; otherwise show overall stats.
+
+## Procedure
+
+### Overall (no arguments)
+
+1. Query audit database:
+   ```
+   re-scale db audit stats
+   ```
+
+2. Show breakdown by status (pass / minor_issues / major_issues).
+
+### Per-package (with arguments)
+
+1. Query audit database for the package:
+   ```
+   re-scale db audit list --package $ARGUMENTS
+   ```
+
+2. Show each file's status, identify unaudited files in the package.
+
+## Important
+
+**Do NOT access .rescale/data/ files directly.** Use `re-scale db audit` commands.

.claude-plugin/skills/rescale-check-progress/SKILL.md

@@ -0,0 +1,39 @@
+---
+description: Show migration and audit progress — database stats, covenant coverage, enforcement summary
+---
+
+Show migration progress for this project.
+
+## Procedure
+
+1. Query migration database:
+   ```
+   re-scale db migration stats
+   ```
+
+2. Query audit database:
+   ```
+   re-scale db audit stats
+   ```
+
+3. Run a covenant coverage check:
+   ```
+   re-scale enforce verify --all --machine-readable
+   ```
+   Count pass vs fail (excluding "no covenant header" which just means not yet stamped).
+
+4. Run a shortcuts summary:
+   ```
+   re-scale enforce shortcuts --machine-readable
+   ```
+   Count total hits and files affected.
+
+5. Report:
+   - Migration: X files converted out of Y total
+   - Audit: X pass, Y minor, Z major
+   - Covenanted: N files with covenant headers, M verified passing
+   - Shortcuts: N files still have hits (gap-fix candidates)
+
+## Important
+
+**Do NOT access .rescale/data/ files directly.** Use `re-scale db` commands.

.claude-plugin/skills/rescale-find-issues/SKILL.md

@@ -0,0 +1,30 @@
+---
+description: Find code quality issues across the codebase — shortcuts, stale stubs, open issues, convention violations
+---
+
+Find code quality issues in the project.
+
+## Procedure
+
+1. Run enforcement scans:
+   ```
+   re-scale enforce shortcuts
+   re-scale enforce stale-stubs
+   ```
+
+2. Search for convention violations using the Grep tool:
+   - `\breturn\b` in `*/src/main/scala/` — remaining `return` statements
+   - `\bnull\b` in `*/src/main/scala/` — raw null usage
+   - `TODO|FIXME` in `*/src/main/scala/` — outstanding work markers
+
+3. Check issues database:
+   ```
+   re-scale db issues list --status open
+   ```
+
+4. Summarize findings by severity and suggest fixes.
+
+## Important
+
+**Do NOT access .rescale/data/ files directly.** Use `re-scale db` commands.
+**Do NOT use shell commands for search.** Use the Grep tool.