fix(claude): correct stale codebase facts in agent and skill prompts

bug-triage still told the agent that RxJava 3 and SQLCipher were in use.
RxJava was removed in 715f9ec and no build file declares SQLCipher, so
the agent would look for threading and encryption bugs that cannot occur.
The async and persistence lines now match CLAUDE.md.

dependency-impact named ui:navigation and libs:locale:public as leaking
RxJava and coroutines-rx3. Neither declares those api() dependencies. Its
list of non-catalog dependencies also named sol4k, which is gone, and
webkit, which is in the catalog. Both lines now describe how to find the
answer instead of a list that goes stale.

pr-reviewer pointed IO work at Dispatchers.IO, while CLAUDE.md says
dispatchers are injected through DispatcherProvider.

Also drops the all-caps ALWAYS in the release-notes prompt and rewords
the "no longer vendored" line in fetch-protos to state the current setup.

Author: bmc08gt

.claude/agents/bug-triage.md

@@ -25,7 +25,7 @@ When given a bug report (Bugsnag link, stack trace, error description, or user r
 3. **Trace the Execution Path**: Follow the code path that leads to the crash. Examine:
    - The throwing method and its callers
    - State management (MVI/MVVM patterns, reactive streams)
-   - Threading (Coroutines, RxJava 3) — look for race conditions, missing dispatchers
+   - Threading (Coroutines + Flow, dispatchers from `DispatcherProvider`) — look for race conditions, missing dispatchers
    - Dependency injection (Hilt) — look for missing bindings or scoping issues
    - Null safety — look for unsafe casts, Java interop nullability gaps
    - CompositionLocal access — check if locals are accessed outside their provider scope
@@ -34,7 +34,7 @@ When given a bug report (Bugsnag link, stack trace, error description, or user r
    - Crypto operations — look for key management edge cases, encryption failures
 
 4. **Identify Patterns**: When the user mentions patterns (e.g., "same device", "repeated", "after update"), specifically investigate:
-   - Device-specific state corruption (Room/SQLCipher, DataStore)
+   - Device-specific state corruption (Room, DataStore)
    - Cached state inconsistencies
    - Migration issues
    - Retry loops or infinite error cycles
@@ -79,8 +79,8 @@ Concrete code changes with file paths and rationale.
 
 - Namespaces: `com.flipcash.app.android`, `com.getcode`, `com.flipcash.features.*`, `com.flipcash.shared.*`
 - DI: Hilt with CompositionLocal injection pattern
-- Async: Kotlin Coroutines + RxJava 3 coexist
-- DB: Room with SQLCipher encryption
+- Async: Kotlin Coroutines + Flow; dispatchers injected via `DispatcherProvider`
+- DB: Room, one database per user (name derived from account entropy, not encrypted); DataStore for preferences
 - Network: gRPC + Protobuf
 - Convention plugins handle module setup — check `build-logic/` if build config is relevant
 

.claude/agents/dependency-impact.md

@@ -85,5 +85,5 @@ Proceed / Proceed with caution / Investigate further — with reasoning.
   - `flipcash.android.library` → `timber`, `kotlinx-coroutines-core`
   - `flipcash.android.library.compose` → Compose BOM, `compose-ui`, `compose-foundation`
   - `flipcash.android.feature` → Hilt, full Compose bundle, project deps
-- `api()` declarations leak transitively — check `ui:navigation` (leaks RxJava), `libs:locale:public` (leaks coroutines-rx3)
-- Some dependencies are hardcoded outside the catalog (emoji2, guava, sol4k, jsoup, webkit)
+- `api()` declarations leak transitively — read the `api(...)` lines of every module that declares the dependency, then follow its consumers
+- Some dependencies are declared as string coordinates outside the catalog; find them with `grep -rn 'implementation("' --include=*.kts .`

.claude/agents/pr-reviewer.md

@@ -30,7 +30,7 @@ Review code changes (PR diff or local changes) and provide actionable, prioritiz
 
 ### Kotlin & Coroutines
 - Structured concurrency — no leaked coroutine scopes, proper cancellation
-- Dispatcher usage — IO work on `Dispatchers.IO`, no blocking on Main
+- Dispatcher usage — IO work on the dispatcher injected via `DispatcherProvider`, no blocking on Main
 - `Result` handling — MockK double-boxes `Result` inline class; Mockito should be used for `Result`-returning mocks in tests
 - Null safety — especially at Java/proto interop boundaries
 

.claude/skills/fetch-protos/SKILL.md

@@ -17,9 +17,9 @@ allowed-tools:
 
 # Fetch Protos
 
-The protos are no longer vendored here. Both contracts arrive as published
-artifacts, so "fetching" is bumping a version pin and reacting to what the new
-version changed.
+Both contracts arrive as published artifacts, not as protos in this repo, so
+"fetching" is bumping a version pin and reacting to what the new version
+changed.
 
 | Target | Artifact | Client repo | Upstream contract |
 |--------|----------|-------------|-------------------|

.claude/skills/release-notes/SKILL.md

@@ -48,7 +48,7 @@ Use the Agent tool with `model: "haiku"`. Pass the raw changelog output with thi
 > - One short sentence per item
 > - Group related commits into a single bullet when they address the same area
 > - Use scope as context but write in plain language; keep scope in **bold** prefix when it adds clarity
-> - ALWAYS include bug fixes — only drop pure refactors, CI pipeline changes, and release/manifest bookkeeping
+> - Include every bug fix; drop only pure refactors, CI pipeline changes, and release/manifest bookkeeping
 > - Feature bullets start with a lowercase verb (e.g., "add", "support", "enable")
 > - Bug fix bullets start with "Fixed" (capitalized)
 > - **Dependencies** section: list each dependency bump as `Name X.Y.Z → A.B.C` (use the human-readable library name, not the Maven coordinate). Include targetSdkVersion and Gradle wrapper bumps in this section too.