@techgoblin/gobstack 0.4.4-beta.8 → 0.5.0-beta.1

package/README.md

@@ -28,7 +28,7 @@ dependencies disagree with npm's. If you see `ERESOLVE` after a local install, r
 dependency from `package.json` and install globally instead.
 
 **The two-layer model.** The global install gives you the CLI only. `gob init` (or
-`gob install --target <dir> --class A`) then vendors a self-contained engine into the target
+`gob install --target <dir> --class software`) then vendors a self-contained engine into the target
 repo under `.goblin/` — verifier, manifest, ban probes, skills, all of it. That second layer is
 why an initialized repo keeps working on machines with **no gobstack installed at all**: the
 engine lives in the repo, not in your `node_modules`, and `bash .goblin/bin/goblin-verify` (or a
@@ -36,7 +36,7 @@ plain `git` + `bash` box) is the only runtime the repo's gate needs.
 
 Then, from any project:
 
-    gob install --target /path/to/repo --class A
+    gob install --target /path/to/repo --class software
 
 The installer writes only paths it records, hash-compares before writing, and prints `no-op` on a
 second run with the same arguments. It never overwrites `HANDOFF.md`, `AGENTS.md`, a `*-SPEC.md`,
@@ -46,6 +46,12 @@ of file it manages: `docs/CONTRACTS.md`.
 A repo that already has its own `HANDOFF.md` exits 1 on the refusal. That is the contract, not a
 failure: reconcile the file rather than forcing over it — `docs/ADOPTION.md`.
 
+`--class` picks the preset: **software** (the default — shipped features, PRs, review gates),
+**service** (backend jobs, config, unattended runs), **game** (playable builds, perf budgets),
+**research** (specs, replays, reference corpora) and **fleet** (config-of-the-agent repos).
+The single letters `A`–`E` are accepted aliases. What each preset turns on is the matrix in
+`docs/ADOPTION.md`; the older names still resolve (see `docs/CONTRACTS.md`).
+
 After installing, in this order:
 
     cd <target> && git add -A && git commit   # the install is a change like any other
@@ -53,7 +59,7 @@ After installing, in this order:
     gob emit --platform <p>                   # optional, per platform: the agent skills are an opt-in
     gob audit                              # once, deliberately: the ONLY network step (SC-07)
 
-**A default class-A install (no agent skills — those are `gob emit`'s job) verifies green —
+**A default software-class install (no agent skills — those are `gob emit`'s job) verifies green —
 `38 passed, 0 failed, 11 advisory, 33 skipped`, exit 0 — once
 `HANDOFF.md` names a commit that exists. Before that edit the scaffold's `0000000` placeholder is
 the one expected red: `37 passed, 1 failed`, `HP-05`. Both numbers measured at W6 (neutral-first);
@@ -91,7 +97,7 @@ The measurement and the vacuous-pass reading are in `docs/CONTRACTS.md`.
 | `gob upgrade` | migrate a repo to the shared global engine at `~/.goblin/engine` — 8 steps, two commits, one report |
 | `gob doctor` | one run across the platforms below: DETECTED / NOT-DETECTED / DRIFT per platform |
 | `gob emit` | write the skills + context block for one platform (`--scope project` or `global`); `--unshadow` removes a hermes project skill whose hash equals the source |
-| `gob init` | the first-run wizard: detect → class → branch/email → first gate → emit → verify, one screen per question; every question has a flag (`--class app --branch main --email a@b.c --gate 'cmd' --emit hermes`), so CI runs it with zero prompts; `--dry-run` prints the plan and writes nothing |
+| `gob init` | the first-run wizard: detect → class → branch/email → first gate → emit → verify, one screen per question; every question has a flag (`--class software --branch main --email a@b.c --gate 'cmd' --emit hermes`), so CI runs it with zero prompts; `--dry-run` prints the plan and writes nothing |
 
 `goblin` remains as a legacy alias for every command above — existing scripts keep working, but
 new commands and docs use `gob`.
@@ -145,9 +151,9 @@ below is the reference material the guide points into, so the two do not compete
 | `docs/CONTRACTS.md` | the installer/verifier interface, exit codes, idempotency, uninstall |
 | `docs/INTEGRATION.md` | the board, cron, the skills precedence order, the referenced standard |
 | `docs/RISKS.md` | the risk register, the advisory rows named, the non-goals |
-| `docs/CI.md` | the CI lane: what makes a workflow a gate, the four settings a repository cannot set, and the desktop-shell class |
+| `docs/CI.md` | the CI lane: what makes a workflow a gate, the four settings a repository cannot set, and the electron opt-in |
 | `docs/LOOP.md` | the judge role and the loop contract: what a goal-mode loop actually does, the record, and what neither can see |
-| `docs/ADOPTION.md` | the six classes, the preset matrix, the adoption order |
+| `docs/ADOPTION.md` | the five classes, the preset matrix, the adoption order |
 | `docs/LIMITS.md` | where this is weaker than its sources, and what is unproven |
 
 `manifest/enforcement.tsv` is the source of truth for rules; `manifest/classes.tsv` for what a
@@ -166,7 +172,7 @@ run · `3` the manifest is broken. Every run prints what it cannot see.
     bash tests/run-tests.sh
 
 Runs the source-scope rules (PR-01..PR-05) and the test scripts, including `t-verify-red.sh` —
-one control per target-scope row (167 over 82 target rows), each required to go RED and then
+one control per target-scope row (168 over 82 target rows), each required to go RED and then
 restored, plus `t-audit.sh` for the SC-07 producer. **A verifier that only ever prints GREEN is a
 failure**, so that file is the one that matters most.
 

package/VERSION

@@ -1 +1 @@
-0.4.4
+0.5.0

package/bin/goblin-audit

@@ -23,7 +23,7 @@
 #      because an empty record reads to SC-07 as "clean" and that would be a fabricated pass
 set -uo pipefail
 
-GOBLIN_AUDIT_VERSION="0.4.4"
+GOBLIN_AUDIT_VERSION="0.5.0"
 
 usage() { sed -n '2,/^$/p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; }
 

package/bin/goblin-bans

@@ -28,7 +28,7 @@
 
 set -uo pipefail
 
-GOBLIN_BANS_VERSION="0.4.4"
+GOBLIN_BANS_VERSION="0.5.0"
 SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 # shellcheck source=goblin-lib.sh
 . "$SELF_DIR/goblin-lib.sh"
@@ -88,6 +88,14 @@ if [ -f "$CONFIG" ]; then
   ENABLED=$(g_yaml_scalar "$CONFIG" bans)
   ENABLED=${ENABLED#[}; ENABLED=${ENABLED%]}
   ENABLED=$(printf '%s' "$ENABLED" | tr ',' ' ' | tr -s ' ' ' ')
+  # The electron opt-in (software class): `electron: true` turns the electron ban set ON even
+  # when a hand-edited bans: list omits it — the declaration is the contract, and the engine
+  # (not the LLM) is what makes a listed ban non-skippable. A repo without the key is unaffected.
+  if [ "$(g_yaml_scalar "$CONFIG" electron)" = "true" ]; then
+    for e in BN-06 BN-07 BN-08 BN-09; do
+      case " $ENABLED " in *" $e "*) ;; *) ENABLED="$ENABLED $e" ;; esac
+    done
+  fi
 fi
 enabled() {
   [ -z "$ENABLED" ] && return 1

package/bin/goblin-init

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 # goblin-init — the W6 first-run wizard (`gob init`).
 #
-#   gob init [--target <dir>] [--class <app|service|game|research|agent|desktop|A..F>]
-#               [--branch <name>] [--email <addr>] [--gate <cmd>]
+#   gob init [--target <dir>] [--class <software|service|game|research|fleet|A..E|app|agent|desktop>]
+#               [--electron] [--branch <name>] [--email <addr>] [--gate <cmd>]
 #               [--emit <p[,p..]>] [--scope project|global] [--yes] [--dry-run]
 #
 # One screen per question, answered steps collapsing into the ✔/◆/○ rail above. On a tty
@@ -143,6 +143,7 @@ ask_value() {
 
 # ------------------------------------------------------------------ flags -----
 TARGET="" CLASS="" BRANCH="" EMAIL="" GATE="" EMIT="" SCOPE=""
+ELECTRON=0
 YES=0; DRYRUN=0
 usage() { sed -n '2,/^$/p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; }
 
@@ -150,6 +151,7 @@ while [ $# -gt 0 ]; do
   case "$1" in
     --target)  TARGET="${2:-}"; shift 2 ;;
     --class)   CLASS="${2:-}"; shift 2 ;;
+    --electron) ELECTRON=1; shift ;;
     --branch)  BRANCH="${2:-}"; shift 2 ;;
     --email)   EMAIL="${2:-}"; shift 2 ;;
     --gate)    GATE="${2:-}"; shift 2 ;;
@@ -255,45 +257,45 @@ if [ -z "$CLASS" ]; then
   if [ "$TTY_IN" -eq 1 ]; then
     rail_say ""
     rail_say "      ${C_MUTED}what kind of work does this repo do?$C_RESET"
-    rail_say "      $C_TEXT  1 ▸ app        shipped features, PRs, review gates        ${C_DIM}(class A)$C_RESET"
+    rail_say "      $C_TEXT  1 ▸ software   shipped features, PRs, review gates        ${C_DIM}(class A)$C_RESET"
     rail_say "      $C_TEXT  2   service    backend jobs, config, unattended runs      ${C_DIM}(class B)$C_RESET"
     rail_say "      $C_TEXT  3   game       playable builds, perf budgets              ${C_DIM}(class C)$C_RESET"
     rail_say "      $C_TEXT  4   research   specs, replays, reference corpora          ${C_DIM}(class D)$C_RESET"
-    rail_say "      $C_TEXT  5   agent      fleets, loops, unattended automation       ${C_DIM}(class E)$C_RESET"
-    rail_say "      $C_TEXT  6   desktop    the shell you live in, perf budget         ${C_DIM}(class F)$C_RESET"
-    rail_say "      ${C_MUTED}↑ number + Enter · Enter = app · the class letter works too (A-F)$C_RESET"
+    rail_say "      $C_TEXT  5   fleet      fleets, loops, unattended automation       ${C_DIM}(class E)$C_RESET"
+    rail_say "      ${C_MUTED}↑ number + Enter · Enter = software · a class letter also works (A-E)$C_RESET"
+    rail_say "      ${C_DIM}an Electron desktop shell: pick software, then --electron$C_RESET"
     printf '      '
     read -r REPLY_CLASS
     ASKED_ANY=1
     rail_say ""
   else
     REPLY_CLASS="1"
-    cascade "class: app (default; --class app|service|game|research|agent|desktop or A-F)"
+    cascade "class: software (default; --class software|service|game|research|fleet or A-E)"
   fi
   case "$REPLY_CLASS" in
-    1) CLASS="app" ;; 2) CLASS="service" ;; 3) CLASS="game" ;;
-    4) CLASS="research" ;; 5) CLASS="agent" ;; 6) CLASS="desktop" ;;
-    *) CLASS="${REPLY_CLASS:-app}" ;;
+    1) CLASS="software" ;; 2) CLASS="service" ;; 3) CLASS="game" ;;
+    4) CLASS="research" ;; 5) CLASS="fleet" ;;
+    *) CLASS="${REPLY_CLASS:-software}" ;;
   esac
 fi
-# Normalise every accepted spelling to the letter goblin-install requires. Domain names,
-# the class letter, and a lowercase letter all resolve; anything else is refused here,
-# with the full enum, rather than deep inside the installer.
-case "$CLASS" in
-  app|A|a)      CLASS="A" ;;
-  service|B|b)  CLASS="B" ;;
-  game|C|c)     CLASS="C" ;;
-  research|D|d) CLASS="D" ;;
-  agent|E|e)    CLASS="E" ;;
-  desktop|F|f)  CLASS="F" ;;
-  *)
-    g_err "--class must be app|service|game|research|agent|desktop (or A-F), got '$CLASS'"
-    exit 2 ;;
+# Resolve every accepted spelling to the canonical class NAME. The letters A-E and the old
+# taught names (app/agent/desktop) are read-time aliases; anything else is refused here, with
+# the full enum, rather than deep inside the installer. `desktop`/F means the OLD desktop
+# install, so it also sets the electron opt-in.
+g_class_is_electron_alias "$CLASS" && ELECTRON=1
+CLASS_RAW="$CLASS"
+CLASS=$(g_class_canon "$CLASS") \
+  || { g_err "--class must be software|service|game|research|fleet (or A-E / app / agent / desktop), got '$CLASS_RAW'"; exit 2; }
+case "$CLASS_RAW" in
+  app|agent|desktop) g_info "note: '$CLASS_RAW' is now called '$CLASS' (accepted as an alias)";;
 esac
-CLASS_NAME=$(ls "$SRC"/presets/"$CLASS"-*.yaml 2>/dev/null | head -n 1)
-STEP_VAL[1]="$C_TEXT$CLASS ($([ -n "$CLASS_NAME" ] && basename "$CLASS_NAME" .yaml | cut -d- -f2-))$C_RESET"
+if [ "$ELECTRON" -eq 1 ]; then
+  g_info "electron: on (the desktop opt-in — the app_bundle_bytes ratchet, BN-06..09 bans, a host gate)"
+fi
+CLASS_NAME="$SRC/presets/$CLASS.yaml"
+STEP_VAL[1]="$C_TEXT$CLASS$C_RESET"
 if [ "$TTY_OUT" -eq 1 ]; then
-  rail_say "  ✔ $((CURRENT - 1)). class            $C_TEXT$CLASS$([ -n "$CLASS_NAME" ] && printf ' — %s' "$(basename "$CLASS_NAME" .yaml | cut -d- -f2-)")$C_RESET"
+  rail_say "  ✔ $((CURRENT - 1)). class            $C_TEXT$CLASS$C_RESET"
 else
   cascade "class: $CLASS"
 fi
@@ -460,11 +462,15 @@ fi
 # never rewinds past its own buffer by counting lines it did not print.
 if [ "$TTY_OUT" -eq 1 ]; then
   rail_note ""
-  rail_note "  ${C_MUTED}running: goblin-install --target $TARGET --class $CLASS${C_RESET}"
+  rail_note "  ${C_MUTED}running: goblin-install --target $TARGET --class $CLASS$([ "$ELECTRON" -eq 1 ] && printf ' --electron')${C_RESET}"
+else
+  printf 'gob init [run] goblin-install --target %s --class %s%s\n' "$TARGET" "$CLASS" "$([ "$ELECTRON" -eq 1 ] && printf ' --electron')"
+fi
+if [ "$ELECTRON" -eq 1 ]; then
+  bash "$SRC/bin/goblin-install" --target "$TARGET" --class "$CLASS" --electron --skills no --yes
 else
-  printf 'gob init [run] goblin-install --target %s --class %s\n' "$TARGET" "$CLASS"
+  bash "$SRC/bin/goblin-install" --target "$TARGET" --class "$CLASS" --skills no --yes
 fi
-bash "$SRC/bin/goblin-install" --target "$TARGET" --class "$CLASS" --skills no --yes
 EXIT_INSTALL=$?
 if [ "$EXIT_INSTALL" -ne 0 ]; then
   g_err "install failed (exit $EXIT_INSTALL) — the refusals above name the path and the fix"

package/bin/goblin-install

@@ -3,7 +3,11 @@
 #
 # Usage: gob install --target <dir> [options]   (script: bin/goblin-install)
 #   --target <dir>        required; the repo root to install into
-#   --class A|B|C|D|E|F    required unless --uninstall or --re-pin; anything else needs an explicit class
+#   --class <name>        required unless --uninstall or --re-pin; one of
+#                         software|service|game|research|fleet, or the aliases A-E / app / agent
+#                         / desktop (desktop/F => software + --electron); anything else is refused
+#   --electron            the electron opt-in overlay over the software class (electron: true):
+#                         the app_bundle_bytes ratchet, BN-06..09 bans, the host-gate declaration
 #   --models <path>       model mapping file   (default: $GOBLIN_MODELS -> ~/projects/fleet-model.yaml)
 #   --practice <path>     the referenced standard (default: $GOBLIN_PRACTICE -> ~/projects/PROJECT-PRACTICE.md); a named path that is absent is reported, never silently dropped
 #   --parts <list>        comma list to install; default = every part the class requires
@@ -23,7 +27,7 @@
 
 set -uo pipefail
 
-GOBLIN_INSTALL_VERSION="0.4.4"
+GOBLIN_INSTALL_VERSION="0.5.0"
 SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 SRC=$(cd "$SELF_DIR/.." && pwd)
 # shellcheck source=goblin-lib.sh
@@ -57,6 +61,10 @@ UNINSTALL=0
 RE_PIN=0
 FORCE=0
 OPT_OUT=""
+# The electron opt-in (the merged desktop/F class): renders presets/electron-overlay.yaml over
+# the software preset. Auto-set when --class resolves via the desktop/F/f alias, so the alias
+# behaves as the old class F did rather than silently installing weaker software.
+ELECTRON=0
 
 usage() {
   # The header comment runs from line 2 to the first blank line, so adding an option cannot
@@ -73,6 +81,7 @@ while [ $# -gt 0 ]; do
     --practice)  PRACTICE="${2:-}"; PRACTICE_ARG="$PRACTICE"; shift 2 ;;
     --parts)     PARTS="${2:-}"; shift 2 ;;
     --archive)   ARCHIVE="true"; shift ;;
+    --electron)  ELECTRON=1; shift ;;
     --skills)    SKILLS="${2:-}"; SKILLS_NAMED=1; shift 2 ;;
     --dry-run)   DRY_RUN=1; shift ;;
     --upgrade)   UPGRADE=1; shift ;;
@@ -239,8 +248,14 @@ if [ "$RE_PIN" -eq 1 ]; then
   exit 0
 fi
 
-[ -n "$CLASS" ] || { g_err "--class is required (A|B|C|D|E|F)"; exit 2; }
-case "$CLASS" in A|B|C|D|E|F) ;; *) g_err "--class must be one of A B C D E F, got '$CLASS'"; exit 2 ;; esac
+[ -n "$CLASS" ] || { g_err "--class is required (software|service|game|research|fleet, or A-E / app / agent / desktop)"; exit 2; }
+# Resolve every accepted spelling to the canonical class NAME before anything reads it. The
+# letters A-E and the old names app/agent/desktop are read-time aliases; desktop/F/f also sets
+# the electron opt-in so the merged class behaves as the old class F did.
+g_class_is_electron_alias "$CLASS" && ELECTRON=1
+CLASS_RAW="$CLASS"
+CLASS=$(g_class_canon "$CLASS") \
+  || { g_err "--class must be software|service|game|research|fleet (or A-E / app / agent / desktop), got '$CLASS_RAW'"; exit 2; }
 case "$SKILLS" in yes|no) ;; *) g_err "--skills must be yes or no"; exit 2 ;; esac
 
 # W6 migration safety: on a --upgrade (or any re-install) of a repo whose record shows skills
@@ -257,10 +272,24 @@ if [ -f "$INSTALLED" ] && [ "$SKILLS_NAMED" -eq 0 ]; then
   fi
 fi
 
-PRESET=$(ls "$SRC"/presets/"$CLASS"-*.yaml 2>/dev/null | head -n 1)
-[ -n "$PRESET" ] || { g_err "no preset for class $CLASS"; exit 2; }
+PRESET="$SRC/presets/$CLASS.yaml"
+[ -f "$PRESET" ] || { g_err "no preset for class $CLASS ($PRESET)"; exit 2; }
 
-preset() { local v; v=$(g_yaml_scalar "$PRESET" "$1"); printf '%s' "${v%\"}" | sed 's/^"//'; }
+# The electron overlay (the merged desktop/F class): every key it declares — including an empty
+# one like sec_write_routes: "" — wins over the class preset; an absent key falls through. This
+# is config, not a second code path: the same preset() reader, one layer up.
+OVERLAY=""
+if [ "$ELECTRON" -eq 1 ]; then
+  OVERLAY="$SRC/presets/electron-overlay.yaml"
+  [ -f "$OVERLAY" ] || { g_err "no electron overlay at $OVERLAY"; exit 2; }
+fi
+overlay_has() { [ -n "$OVERLAY" ] && grep -qE "^$1:" "$OVERLAY"; }
+
+preset() {
+  local v
+  if overlay_has "$1"; then v=$(g_yaml_scalar "$OVERLAY" "$1"); else v=$(g_yaml_scalar "$PRESET" "$1"); fi
+  printf '%s' "${v%\"}" | sed 's/^"//'
+}
 
 HARNESS_DIR=$(preset harness_dir); [ -n "$HARNESS_DIR" ] || HARNESS_DIR=checks
 SCAFFOLD=$(preset scaffold_checks); [ -n "$SCAFFOLD" ] || SCAFFOLD=no
@@ -488,6 +517,7 @@ render_config() {
   runtime="  - $RUNTIME_DATA"
   render "$SRC/templates/goblin.yaml.tmpl" \
     CLASS "$CLASS" \
+    ELECTRON "$( [ "$ELECTRON" -eq 1 ] && printf 'true' || printf 'false' )" \
     BRANCH "$BRANCH" \
     MODELS_FILE "$MODELS" \
     PRACTICE "$PRACTICE" \

package/bin/goblin-lib.sh

@@ -16,7 +16,7 @@
 #     - name: typecheck        four-space-indented second member of a list entry
 #       cmd: npx tsc --noEmit
 
-GOBLIN_LIB_VERSION="0.4.4"
+GOBLIN_LIB_VERSION="0.5.0"
 
 # ---------------------------------------------------------------- output -----
 g_pass() { printf 'PASS  %-6s %s\n' "$1" "$2"; }
@@ -185,6 +185,33 @@ g_part_disabled() {
 }
 
 # ------------------------------------------------------------- class data ----
+# g_class_canon <spelling> -> the canonical class NAME
+#   software | service | game | research | fleet
+# The taxonomy is five domain-named classes. The letters A-E and the older taught domain names
+# (app, agent, desktop) stay as READ-TIME aliases so every existing installed.json / goblin.yaml
+# - which record a letter or an old name - keeps verifying with no rewrite. `desktop` / `F` / `f`
+# resolve to `software`: F was merged into A (their classes.tsv need columns are identical), and
+# what made a desktop shell different is the `electron:` opt-in + ban list, config keys the repo
+# already carries. Unknown spelling -> empty output; the caller refuses with the enum.
+g_class_canon() {
+  case "$1" in
+    software|A|a|app)    printf 'software' ;;
+    service|B|b)         printf 'service' ;;
+    game|C|c)            printf 'game' ;;
+    research|D|d)        printf 'research' ;;
+    fleet|E|e|agent)     printf 'fleet' ;;
+    desktop|F|f)         printf 'software' ;;
+    *) return 1 ;;
+  esac
+}
+
+# g_class_is_electron_alias <spelling> -> 0 when the spelling is the merged desktop/F spelling.
+# `--class desktop` (or F/f) must mean the OLD desktop install, not a silently weaker software
+# one: the installer auto-sets electron: true so the alias behaves as F did.
+g_class_is_electron_alias() {
+  case "$1" in desktop|F|f) return 0 ;; *) return 1 ;; esac
+}
+
 # g_class_need <classes.tsv> <class> <part> -> R | O | -
 g_class_need() {
   awk -F'\t' -v c="$2" -v p="$3" '

package/bin/goblin-upgrade

@@ -30,7 +30,7 @@
 # `git revert` of this command's own two commits (W3-SPEC §5).
 set -uo pipefail
 
-GOBLIN_UPGRADE_VERSION="0.4.4"
+GOBLIN_UPGRADE_VERSION="0.5.0"
 
 usage() { sed -n '2,/^$/p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; }
 

package/bin/goblin-verify

@@ -19,7 +19,7 @@
 
 set -uo pipefail
 
-GOBLIN_VERIFY_VERSION="0.4.4"
+GOBLIN_VERIFY_VERSION="0.5.0"
 SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 # shellcheck source=goblin-lib.sh
 . "$SELF_DIR/goblin-lib.sh"
@@ -261,15 +261,17 @@ if [ -n "$ONLY" ]; then
 fi
 
 if [ ! -f "$CONFIG" ]; then
-  g_err "not installed: $CONFIG is absent. Run: goblin-install --target $ROOT --class <A|B|C|D|E>"
+  g_err "not installed: $CONFIG is absent. Run: goblin-install --target $ROOT --class <software|service|game|research|fleet>"
   exit 2
 fi
 
-CLASS=$(g_yaml_scalar "$CONFIG" class)
-case "$CLASS" in
-  A|B|C|D|E|F) ;;
-  *) g_err "unknown class '${CLASS:-<empty>}' in $CONFIG (expected A|B|C|D|E|F)"; exit 2 ;;
-esac
+# The class is read-time resolved: goblin.yaml records the canonical name on new installs, but
+# every repo installed before the 5-class merge records a letter (A..F) or an old name
+# (app/agent/desktop). g_class_canon maps them all to the five canonical names; the tsv carries
+# the canonical names, so nothing else in this file has to know about letters. `desktop`/F -> software.
+CLASS_RAW=$(g_yaml_scalar "$CONFIG" class)
+CLASS=$(g_class_canon "$CLASS_RAW") \
+  || { g_err "unknown class '${CLASS_RAW:-<empty>}' in $CONFIG (expected software|service|game|research|fleet, or A-E / app / agent / desktop)"; exit 2; }
 
 # Root vs git toplevel. find_installed_root resolves the CONFIG lookup correctly, but the
 # rows that shell out to git run in $ROOT and git resolves that to the ENCLOSING repo when
@@ -374,8 +376,12 @@ PERF_BASELINE_COMMIT=$(g_unquote "$(g_yaml_block_scalar "$CONFIG" perf baseline_
 PERF_BASELINE_VALUE=$(g_yaml_block_scalar "$CONFIG" perf baseline_value)
 PERF_MEASURED=$(g_unquote "$(g_yaml_block_scalar "$CONFIG" perf measured)")
 PERF_HOST_GATE=$(g_yaml_block_scalar "$CONFIG" perf host_gate)
+# The electron opt-in (software class): true means the electron ban set stays on regardless of a
+# hand-edited bans: list, and a perf host gate must be declared (PF-01). Absent on a repo
+# installed before the merge — read as off, so a legacy class-F repo verifies with no rewrite.
+ELECTRON=$(g_yaml_scalar "$CONFIG" electron)
 export SEC_GITIGNORE_FAMILY SEC_BUILD_OUTPUT SEC_AUDIT_CMD SEC_AUDIT_MAX_AGE SEC_WAIVER_MAX_AGE
-export SEC_WRITE_ROUTES PERF_METRIC PERF_CMD PERF_BASELINE_VALUE PERF_HOST_GATE
+export SEC_WRITE_ROUTES PERF_METRIC PERF_CMD PERF_BASELINE_VALUE PERF_HOST_GATE ELECTRON
 
 # Whole days between an ISO date and today, or empty when the date does not parse on this host
 # (`date -d` is GNU; the row FAILS rather than assuming, because an unreadable date is not a
@@ -613,8 +619,14 @@ check_hp_03() {
       m = split(names, dn, " ")
       for (i = 1; i <= m; i++) if (dn[i] != "") decl[dn[i]] = 1
     }
-    tolower($0) ~ /^#{2,3}[[:space:]]+[^[:alpha:]]*gates?([^[:alpha:]]|$)/ { g = 1; next }
-    g && /^#{1,3}[[:space:]]/ { g = 0 }
+    # Portability (clean-room catch, 2026-10-05): the Debian default awk (mawk) has no
+    # interval expressions ({2,3}) — the header rule matched nothing and HP-03 went red on
+    # every fresh Debian install. The hash-header variants are spelled out as two pattern
+    # statements, and the date as repeated [0-9] groups. (No apostrophes here: this
+    # program is a single-quoted shell string.)
+    tolower($0) ~ /^###[[:space:]]+[^[:alpha:]]*gates?([^[:alpha:]]|$)/ { g = 1; next }
+    tolower($0) ~ /^##[[:space:]]+[^[:alpha:]]*gates?([^[:alpha:]]|$)/ { g = 1; next }
+    g && (/^###[[:space:]]/ || /^##[[:space:]]/ || /^#[[:space:]]/) { g = 0 }
     !g { next }
     tolower($0) ~ /example of the required form/ { next }
     $0 !~ /=/ { next }
@@ -624,7 +636,7 @@ check_hp_03() {
       if (!hit) for (k in decl) if (hasname($0, k)) { hit = 1; break }
       if (hit) {
         n++
-        if ($0 !~ /measured [0-9]{4}-[0-9]{2}-[0-9]{2}/) {
+        if ($0 !~ /measured [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]/) {
           print "a gate line carries no measured date: " $0
           bad = 1
         }
@@ -1594,6 +1606,13 @@ check_pf_01() {
   # to ignore it.
   local rname bad=0
   rname=$(g_yaml_block_scalar "$CONFIG" ratchet name)
+  # The electron opt-in's done-definition: an Electron repo declares its host gate (the FPS /
+  # main_thread_busy_pct number a hermetic rule cannot measure). `electron: true` with no host
+  # gate is a repo missing half its definition — FAIL, before the baseline skip below can mask it.
+  if [ "$ELECTRON" = "true" ] && [ -z "$PERF_HOST_GATE" ]; then
+    printf 'electron: true requires a declared perf.host_gate — declare the host-gate probe (the number no hermetic rule can measure) or drop electron: true\n'
+    return 1
+  fi
   [ -n "$PERF_METRIC" ] || {
     printf 'this class declares no perf metric (perf.metric is empty). The ratchet still carries\n%s; declare metric/cmd here the day you pick one\n' "${rname:-nothing}"
     return 3

package/docs/ADOPTION.md

@@ -1,26 +1,25 @@
 # Adoption — classes, presets, and the order
 
-## The six classes
+## The five classes
 
 A class is **not** a stringency level. It selects which parts are required, optional or off, and
 it supplies the default gate and ratchet shape. The gate vocabulary differs by class; the
-harness does not.
+harness does not. The names are words; the letters `A`..`E` are read-time aliases.
 
 | Class | What "done" means |
 |---|---|
-| **A. Shipped software** | a gate set reports measured numbers, a round lands, the artifact deploys or publishes |
-| **B. Service / configuration** | a contract (schema, route, API) is unchanged, or the change is intentional and migrated |
-| **C. Game** | a suite green in the Editor **and** a human feel verdict — the verdict is a first-class deliverable |
-| **D. Knowledge / research** | a question is answered with sources and the answer is findable |
-| **E. Agent-fleet config** | a config change is applied, verified against the **artifact**, and versioned |
-| **F. Desktop shell** | the renderer is isolated from Node, the main process is not busy, and the packaged bundle ships no dev dependency |
+| **software** (A) | a gate set reports measured numbers, a round lands, the artifact deploys or publishes |
+| **service** (B) | a contract (schema, route, API) is unchanged, or the change is intentional and migrated |
+| **game** (C) | a suite green in the Editor **and** a human feel verdict — the verdict is a first-class deliverable |
+| **research** (D) | a question is answered with sources and the answer is findable |
+| **fleet** (E) | a config change is applied, verified against the **artifact**, and versioned |
 
 Two placements worth arguing about:
 
 - A repo whose code is small and lives elsewhere, while the repo holds *output*, belongs in
-  **D**, not A — gating it like an application gates the wrong artifact; its gate is freshness,
-  not compilation.
-- An input directory that is not a build target at all belongs in **D** with **`--archive`**.
+  **research**, not **software** — gating it like an application gates the wrong artifact; its gate
+  is freshness, not compilation.
+- An input directory that is not a build target at all belongs in **research** with **`--archive`**.
   Without the flag the installer keeps producing HANDOFFs for a directory whose own design
   folders are empty.
 
@@ -29,25 +28,28 @@ Two placements worth arguing about:
 `R` = required · `O` = optional (installed, reported) · `—` = off. The same data is in
 `manifest/classes.tsv`, and `CL-01` checks it against the repo.
 
-| Part | A | B | C | D | E | F |
-|---|---|---|---|---|---|---|
-| HANDOFF | R | R | R | R | R | R |
-| SPEC before change | R | R | R | — | R | R |
-| Verification gate | R | R | R | O | R | R |
-| Pinned-commit REPLAY | R | — | R | — | O | R |
-| Ratchet | R | O | O | — | O | R |
-| PR gate | O | — | O | — | O | O |
-| Review panel | O | — | R | — | O | O |
-| Playbooks (the skills) | R | R | R | R | R | R |
-| Design tokens | O | — | — | — | — | O |
-| CI lane | R | — | O | — | O | R |
-
-**F is the desktop shell**, added at W4: it declares the Electron failure surface as bans
-(`BN-06`..`BN-09`) and declares its FPS number as a **host gate** rather than a ratchet, because
-the probe that measures it needs Playwright or Electron plus a display — neither of which a
-shipped rule may depend on. Its ratchet carries `app_bundle_bytes` instead. `docs/CI.md` §3 argues
-that in full, including why frame time is the wrong number (measured flat at 16.70 ms while the
-main thread went from 1.8 % to 54.5 % busy).
+| Part | software | service | game | research | fleet |
+|---|---|---|---|---|---|
+| HANDOFF | R | R | R | R | R |
+| SPEC before change | R | R | R | — | R |
+| Verification gate | R | R | R | O | R |
+| Pinned-commit REPLAY | R | — | R | — | O |
+| Ratchet | R | O | O | — | O |
+| PR gate | O | — | O | — | O |
+| Review panel | O | — | R | — | O |
+| Playbooks (the skills) | R | R | R | R | R |
+| Design tokens | O | — | — | — | O |
+| CI lane | R | — | O | — | O |
+
+**The electron opt-in, not a class**, added at W4: an Electron app is the **software** class with
+`electron: true`, which declares the Electron failure surface as bans (`BN-06`..`BN-09`) and
+declares its FPS number as a **host gate** rather than a ratchet, because the probe that measures
+it needs Playwright or Electron plus a display — neither of which a shipped rule may depend on. Its
+ratchet carries `app_bundle_bytes` instead. The old sixth class was merged into `software` (its need
+column measured identical on all ten parts), and the old `F` letter remains an install-time alias
+that selects `software` **with** the opt-in. `docs/CI.md` §3 argues it in full, including why frame
+time is the wrong number (measured flat at 16.70 ms while the main thread went from 1.8 % to 54.5 %
+busy).
 
 **`—` is a real, enforced option.** The installer records every off part in `disabled:`, so its
 rows report `SKIP (opt-out)`; `CL-01` fails if a forbidden part's artifact exists. A repo with
@@ -105,7 +107,7 @@ Then, in order:
     .goblin/bin/goblin-verify         # 37 passed, 1 failed - HP-05, until HANDOFF names a commit
     gob emit --platform <p>           # optional, per platform: the agent skills are an opt-in
 
-A default class-A install (no agent skills) is **green** — `38 passed, 0 failed, 11 advisory,
+A default software-class install (no agent skills) is **green** — `38 passed, 0 failed, 11 advisory,
 33 skipped`, exit 0 — once
 `HANDOFF.md` names a commit that exists; before that edit the scaffold's `0000000` placeholder is
 the one expected red (`37 passed, 1 failed`). Both numbers are measured, not assumed
@@ -164,7 +166,7 @@ The remedy is a reconciliation. The project's file stays the file of record; not
        .goblin/bin/goblin-verify        # HP-02, HP-03, HP-05 go green
 
    Success is the class's full green path (`38 passed, 0 failed, 11 advisory, 33 skipped`, exit 0 for
-   class A) with `git status --short` empty.
+   the software class) with `git status --short` empty.
 
 The edit is additive and small — measured on the model repo (§1's exemplar, 2450 lines): three
 headings plus a `State` block, one dated gate line and a `Not verified` block, 15 lines, no line

package/docs/CI.md

@@ -43,8 +43,8 @@ not the model.
 
 ## 2. What goblin-stack places, and what it checks
 
-The `ci-gate` part is `R` for classes A and F, `O` for C and E, and `-` for B and D
-(`manifest/classes.tsv`). When it is installed, the installer renders
+The `ci-gate` part is `R` for **software**, `O` for **game** and **fleet**, and `-` for **service**
+and **research** (`manifest/classes.tsv`). When it is installed, the installer renders
 `templates/ci/goblin-gate.yml.tmpl` into `.github/workflows/goblin-gate.yml` — one job, no `if:` at
 any level, whose only step runs `.goblin/bin/goblin-verify`. It is `owned`, so a second install is a
 no-op and a hand-edited copy is never overwritten.
@@ -70,11 +70,14 @@ comment and cannot count toward a pass.
 
 ---
 
-## 3. The Electron / desktop-shell class (F)
+## 3. The Electron opt-in (software class)
 
-Class F exists because a desktop shell needs a part no other class has — a **host gate**, a number
-measured on a machine with a display — and forbids a thing the others allow: a **renderer that
-reaches Node or the filesystem directly**. That is a new row-set, not a flag on class A.
+An Electron app is the **`software`** class with `electron: true`. The opt-in exists because such an
+app needs a part no other shape has — a **host gate**, a number measured on a machine with a display
+— and forbids a thing the plain software class allows: a **renderer that reaches Node or the
+filesystem directly**. The merge measured the old sixth class's part needs identical to `software` on
+all ten parts, so none of this is a sixth column in `manifest/classes.tsv`: it is the `bans:` list and
+the `perf.host_gate:` key, rendered over the software preset by `presets/electron-overlay.yaml`.
 
 ### 3.1 The failure surface, and the check for each
 
@@ -94,14 +97,14 @@ reaches Node or the filesystem directly**. That is a new row-set, not a flag on
 
 ### 3.2 The perf lane: one ratchet, and a host gate beside it
 
-There is **one** mechanism, and class F reuses it unchanged: `ratchet: {name, cmd, ceiling}`,
+There is **one** mechanism, and the opt-in reuses it unchanged: `ratchet: {name, cmd, ceiling}`,
 enforced by `GT-04`/`GT-05` and pinned to a commit by `PF-01`. A second perf mechanism is not
 introduced.
 
 What the ratchet measures here is `app_bundle_bytes` — the packaged bundle's byte count. It is
 hermetic, it needs no browser, no display and no dependency, and a fat bundle is a slow cold start on
 every machine. **The FPS number is declared as a host gate instead** (`perf_host_gate:` in
-`presets/F-electron.yaml`), and carried in the HANDOFF with the date it was measured.
+`presets/electron-overlay.yaml`), and carried in the HANDOFF with the date it was measured.
 
 This is a **deviation from G6 §B.3**, which put `main_thread_busy_pct` in the ratchet, and the reason
 is measured: the instrument that produces it — CDP `Performance.getMetrics`, or

package/docs/CONTRACTS.md

@@ -9,7 +9,10 @@ same way the fleet's own tool reads it. Everything else is line-oriented shell.
     goblin-install --target <dir> [options]
 
     --target <dir>        required; the repo root to install into
-    --class A|B|C|D|E|F  required unless --uninstall or --re-pin
+    --class <class>       required unless --uninstall or --re-pin. One of the five domain classes:
+                          software · service · game · research · fleet. The letters A-E and the
+                          older names app (software), agent (fleet) and desktop/F (software + the
+                          electron opt-in) are read-time aliases.
     --models <path>       model mapping file   (default: $GOBLIN_MODELS -> ~/projects/fleet-model.yaml)
     --practice <path>     the referenced standard (default: $GOBLIN_PRACTICE -> ~/projects/PROJECT-PRACTICE.md)
     --parts <list>        comma list to install; default = every part the class requires
@@ -115,7 +118,7 @@ Output is one line per executed row, in manifest order, plus a summary line at t
     ADV   MD-02  code lane and review lane both resolve to the same family
     SKIP  HS-02  no pinned pre-change commit yet - REPLAY not provable
 
-Those four lines are one row of each marking. The summary line of a green default class-A run is:
+Those four lines are one row of each marking. The summary line of a green default software-class run is:
 
           38 passed, 0 failed, 11 advisory, 33 skipped
 
@@ -138,7 +141,7 @@ settings that make a workflow a **gate** are written down.
 
 ### A fresh install verifies green
 
-Measured on a fresh DEFAULT class-A install (skills opt-in, W6 neutral-first), committed with no
+Measured on a fresh DEFAULT software-class install (skills opt-in, W6 neutral-first), committed with no
 hand edit: **`38 passed, 0 failed, 11 advisory, 33 skipped`, exit 0.** Thirty-three rows skip with
 a reason — the same not-yet rows as before, plus the five skill rows (`SK-01`..`SK-04`,
 `AU-04`) that skip on the `playbooks` opt-out a skills-free install records: `HS-02` — no pre-change commit
@@ -178,7 +181,7 @@ verifier is reporting FAILs.
 - **Per part:** `--opt-out <part>` records the part in `disabled:`. `goblin-verify` then reports
   the part's rows as `SKIP (opt-out)` in the summary, so the opt-out is **visible rather than
   absent**. The same mechanism is what makes a class's `-` (off) real.
-- **The opt-out numbers are pinned (V3-3).** A class-A install with an explicit `--skills no`
+- **The opt-out numbers are pinned (V3-3).** A software-class install with an explicit `--skills no`
   verifies `38 passed, 0 failed, 11 advisory, 33 skipped`, exit 0, and
   `tests/t-install-off-switch.sh` asserts that line: a silent drift in the opt-out path is caught
   rather than left as a number nobody wrote down (the `--skills no` count moved from `37/0/9/11`
@@ -201,7 +204,7 @@ verifier is reporting FAILs.
 
 ## The two commands, verbatim
 
-    bash bin/goblin-install --target /path/to/repo --class A
+    bash bin/goblin-install --target /path/to/repo --class software
     .goblin/bin/goblin-verify
 
 From a checkout, without installing anything:

package/docs/ENFORCEMENT.md

@@ -164,26 +164,30 @@ OR its `enforced_by` cell does.
 the installer records every `-` part in `disabled:`, so its rows report `SKIP (opt-out)`
 instead of silently passing, and `CL-01` fails if a forbidden part's artifact exists.
 
-| part | A | B | C | D | E | F |
-|---|---|---|---|---|---|---|
-| handoff | R | R | R | R | R | R |
-| spec | R | R | R | - | R | R |
-| gate | R | R | R | O | R | R |
-| replay | R | - | R | - | O | R |
-| ratchet | R | O | O | - | O | R |
-| pr-gate | O | - | O | - | O | O |
-| review-panel | O | - | R | - | O | O |
-| playbooks | R | R | R | R | R | R |
-| tokens | O | - | - | - | - | O |
-| ci-gate | R | - | O | - | O | R |
-
-Class **F** is the desktop shell: it needs a part no other class has — a **host gate**, a number
-measured on a machine with a display — and forbids nothing the others allow except a renderer that
-reaches Node directly, which its ban list catches. `ci-gate` is the one part added at W4: when it
-is required or optional the installer renders `templates/ci/goblin-gate.yml.tmpl` into
-`.github/workflows/goblin-gate.yml`, and when it is `-` the artifact must be **absent** (which is
-why `CL-01` keys off that exact path, not the `.github/` directory — a repo is still allowed CI of
-its own). `docs/CI.md` is the contract for what that file does and does not make true.
+| part | software | service | game | research | fleet |
+|---|---|---|---|---|---|
+| handoff | R | R | R | R | R |
+| spec | R | R | R | - | R |
+| gate | R | R | R | O | R |
+| replay | R | - | R | - | O |
+| ratchet | R | O | O | - | O |
+| pr-gate | O | - | O | - | O |
+| review-panel | O | - | R | - | O |
+| playbooks | R | R | R | R | R |
+| tokens | O | - | - | - | O |
+| ci-gate | R | - | O | - | O |
+
+The five columns carry the domain names; the letters `A`..`E` and the older names `app` (software)
+and `agent` (fleet) are read-time aliases. The old `F` class — the Electron shell — was merged into
+`software`: the merge measured the two need columns identical on all ten parts, so what it added
+lives in config, not in this table. The **electron opt-in** (`electron: true`) turns the electron
+bans `BN-06`..`BN-09` on even when a hand-edited `bans:` list omits them, and requires a declared
+**host gate** — a number measured on a machine with a display; `docs/CI.md` §3 is the contract for
+it. `ci-gate` is the one part added at W4: when it is required or optional the installer renders
+`templates/ci/goblin-gate.yml.tmpl` into `.github/workflows/goblin-gate.yml`, and when it is `-` the
+artifact must be **absent** (which is why `CL-01` keys off that exact path, not the `.github/`
+directory — a repo is still allowed CI of its own). `docs/CI.md` is the contract for what that file
+does and does not make true.
 
 ## The ban list (G5)
 

package/docs/GUIDE.md

@@ -3,7 +3,7 @@
 A step-by-step guide for your first week. **Read this before the README.** The README tells you
 what the pieces are; this tells you what to *do*, in order, and what you should see when it works.
 
-Version: `0.4.4` · Last measured: 2026-09-25 · Every command and every output below was run on a
+Version: `0.5.0` · Last measured: 2026-10-05 · Every command and every output below was run on a
 real repository while writing this guide.
 
 ---
@@ -97,12 +97,12 @@ see the plan first:
     git config user.email "you@example.com"
     git config user.name "you"
 
-    gob init --target . --class app --branch main --email "you@example.com" \
+    gob init --target . --class software --branch main --email "you@example.com" \
         --gate "bash tests/run-tests.sh" --yes
 
 or the plain installer this wizard drives, if you prefer the one-shot shape:
 
-    gob install --target . --class A
+    gob install --target . --class software
 
 Expected output (this is a real transcript, trimmed):
 
@@ -199,7 +199,7 @@ Everything you configure lives in **one file**, created once and then never over
 
 Open it. The keys that matter on day one:
 
-    class: A                              # A|B|C|D|E|F - what kind of project this is (step 6)
+    class: software                       # software|service|game|research|fleet (A-E are aliases) - what kind of project this is (step 6)
     branch: main                          # DECLARED, never assumed
     owner_email: you@example.com          # the commit identity this repo expects
     practice: /path/to/your-standard.md   # optional: your own house rules, hash-pinned
@@ -245,19 +245,21 @@ supplies the default gate shape. Choose by asking *what does "done" mean here?*
 
 | Class | Choose it when | "Done" means |
 |---|---|---|
-| **A · Shipped software** | an app, library, or tool users run | a gate set reports measured numbers and a round lands |
-| **B · Service / config** | an API, schema, route, or deployment config | the contract is unchanged, or the change is deliberate and migrated |
-| **C · Game** | a game | a suite is green **and** a human feel verdict exists |
-| **D · Knowledge / research** | notes, a vault, a research directory | a question is answered with sources and is findable |
-| **E · Agent-fleet config** | your agent's own config (`~/.hermes`) | the change is applied, verified against the artifact, versioned |
-| **F · Desktop shell** | an Electron / desktop app | renderer isolated from Node, main process not busy, no dev dependency shipped |
+| **software** (A) | an app, library, or tool users run | a gate set reports measured numbers and a round lands |
+| **service** (B) | an API, schema, route, or deployment config | the contract is unchanged, or the change is deliberate and migrated |
+| **game** (C) | a game | a suite is green **and** a human feel verdict exists |
+| **research** (D) | notes, a vault, a research directory | a question is answered with sources and is findable |
+| **fleet** (E) | your agent's own config (`~/.hermes`) | the change is applied, verified against the artifact, versioned |
+
+An Electron app is **software** with `electron: true` — the opt-in adds the electron bans and a host
+gate, not a sixth class. The old `F` letter still resolves there as an install alias.
 
 **Two placements people get wrong:**
 
-- A repo that holds *output* while the code lives elsewhere → **D**, not A. Gating it like an
-  application gates the wrong artifact.
-- A plain input directory that is not a build target → **D** with `--archive`, which tells verify to
-  expect no HANDOFF and no gates, and to say so.
+- A repo that holds *output* while the code lives elsewhere → **research**, not **software**. Gating
+  it like an application gates the wrong artifact.
+- A plain input directory that is not a build target → **research** with `--archive`, which tells
+  verify to expect no HANDOFF and no gates, and to say so.
 
 Switch class later by editing `class:` in the config and re-running install. The parts you no longer
 need are recorded as **disabled** and will report `SKIP (opt-out)` rather than failing.
@@ -392,7 +394,7 @@ the next session.
 
 ## 9. What to expect on day one (so you do not misread it)
 
-A class-A install lands on a specific shape. The scaffold ships one deliberate red — `HP-05`, the
+A software-class install lands on a specific shape. The scaffold ships one deliberate red — `HP-05`, the
 `0000000` placeholder in `HANDOFF.md` (§4) — so a literal first run prints:
 
     37 passed, 1 failed, 11 advisory, 33 skipped     (the one FAIL is HP-05)
@@ -409,7 +411,7 @@ Two readings that are easy to get wrong:
 
 - **Advisory rows are not passes.** Ten rules are labelled `advisory` — counted, not enforced, and
   nine of them carry no executable check at all. The count is capped by `advisory_ceiling: 10`, and
-  a class-A install already sits at 10 of 10: adding another unenforceable rule fails verify until
+  a software-class install already sits at 10 of 10: adding another unenforceable rule fails verify until
   one is removed. That is intentional. (The summary line can print `11 advisory`: the eleventh ADV
   line is `JG-02`, a row with a real command of its own that reports ADV here because your model
   file declares no `judge:` lane — it prints the remedy rather than failing a repo for a fleet's
@@ -485,7 +487,7 @@ engine and silently de-migrate the record).
 
 ### Commands
 
-    gob install --target <dir> --class A|B|C|D|E|F [options]
+    gob install --target <dir> --class <software|service|game|research|fleet> [options]
     gob install --target <dir> --uninstall
     gob install --target <dir> --re-pin
     gob install --target <dir> --upgrade
@@ -581,7 +583,7 @@ with *"prove it was broken first"* — it is the one practice that survives cont
     # 1. try it somewhere disposable
     mkdir -p /tmp/gs-try && cd /tmp/gs-try
     git init -b main
-    gob install --target . --class A                     # expect: created 25 (no skills — those are gob emit)
+    gob install --target . --class software              # expect: created 25 (no skills — those are gob emit)
 
     # 2. commit and check
     git add -A && git commit -m "chore: install gobstack"
@@ -602,7 +604,7 @@ with *"prove it was broken first"* — it is the one practice that survives cont
 
     # 5. do it for real, in a repo you care about
     cd ~/projects/your-project
-    gob install --target . --class A
+    gob install --target . --class software
     git add -A && git commit -m "chore: adopt gobstack"
     .goblin/bin/goblin-verify
     $EDITOR HANDOFF.md              # state / gates (dated!) / next / NOT verified

package/docs/LIMITS.md

@@ -275,7 +275,8 @@ Electron perf number is a host gate, and the ratchet deliberately carries a diff
     flow-style `jobs: {…}` mapping is refused, and a `#` inside a quoted string truncates the line
     it is on. Two further measured gaps: the template's job is `ubuntu-latest` with no cache, so a
     repo whose gate needs a display, a licence, a GPU or a signed-in session cannot use it at all
-    (that is a **host** gate — the class-C rule, restated for class F), and a private repo's
+    (that is a **host** gate — the class-C rule, restated for class F; **corrected 2026-10-02 (W6):**
+    F is merged into `software`, so this is the electron opt-in), and a private repo's
     Actions minutes are billed to the account (2,000/month free). Measured ground truth at W4:
     **one** first-party workflow exists in the whole estate and it self-skips; five of the six
     repos with a remote have none.
@@ -295,7 +296,9 @@ Electron perf number is a host gate, and the ratchet deliberately carries a diff
     while the main thread went from 1.8 % to 54.5 % busy, `docs/CI.md` §3.3); an absolute FPS
     claim is not. Three further Electron failure modes are **recorded, not mechanised**, and
     `docs/CI.md` §4 says why: the dependency-graph boundary check, `ipcMain` sender validation,
-    and fuses at package time.
+    and fuses at package time. **Corrected 2026-10-02 (W6):** this preset is now
+    `presets/electron-overlay.yaml`, rendered over `presets/software.yaml` by `--electron` (or the
+    `desktop`/`F` install alias) — the old `F` class was merged into `software`.
 36. **A ban's exemption reaches the probe through its environment, so a custom probe can ignore it.**
     `bans_exempt:` and the inline `// BAN-OK(<id>): <reason>` are filtered *before* the exit code is
     chosen, because a filter applied to a probe's stdout afterwards cannot change a verdict — that
@@ -589,3 +592,17 @@ the Node the gates ran under.
     a source row can never fail a user's repo, and a target row can never substitute for the
     framework's own suite. Recorded as a definition; `docs/ENFORCEMENT.md`'s scope paragraph
     carries the same sentence for the reader who arrives there first.
+
+53. **The sixth class is gone: the desktop shell is `software` + `electron: true`, and `A`..`E` are
+    read-time aliases.** W6 merged `F` into `software` because their `manifest/classes.tsv` need
+    columns were measured identical on all ten parts — the old column added config (the electron
+    `bans:`, the `perf.host_gate:`, the `app_bundle_bytes` ratchet, the `dist out release`
+    build-output scope), never a part. Measured on the merge tree (2026-10-02): the tsv is 50 rows
+    over five classes; `gob init --class desktop`, `--class F` and `--class software --electron`
+    render byte-identical `goblin.yaml` (`class: software`, `electron: true`); and a pre-merge repo
+    carrying `class: F` with no `electron:` key verifies unchanged, `38 passed, 0 failed, 11
+    advisory, 33 skipped`, exit 0, with `git status --porcelain` empty — zero writes, because its
+    bans and host gate live in its own config. What this costs, recorded rather than fixed: such a
+    repo gets the merge's declaration-time host-gate check only after hand-adding `electron: true`;
+    its bans and host gate keep running either way, so nothing fails closed, and the CLI keeps
+    accepting `desktop`/`F` as aliases.

package/manifest/classes.tsv

@@ -1,61 +1,51 @@
 class	part	need
-A	handoff	R
-B	handoff	R
-C	handoff	R
-D	handoff	R
-E	handoff	R
-F	handoff	R
-A	spec	R
-B	spec	R
-C	spec	R
-D	spec	-
-E	spec	R
-F	spec	R
-A	gate	R
-B	gate	R
-C	gate	R
-D	gate	O
-E	gate	R
-F	gate	R
-A	replay	R
-B	replay	-
-C	replay	R
-D	replay	-
-E	replay	O
-F	replay	R
-A	ratchet	R
-B	ratchet	O
-C	ratchet	O
-D	ratchet	-
-E	ratchet	O
-F	ratchet	R
-A	pr-gate	O
-B	pr-gate	-
-C	pr-gate	O
-D	pr-gate	-
-E	pr-gate	O
-F	pr-gate	O
-A	review-panel	O
-B	review-panel	-
-C	review-panel	R
-D	review-panel	-
-E	review-panel	O
-F	review-panel	O
-A	playbooks	R
-B	playbooks	R
-C	playbooks	R
-D	playbooks	R
-E	playbooks	R
-F	playbooks	R
-A	tokens	O
-B	tokens	-
-C	tokens	-
-D	tokens	-
-E	tokens	-
-F	tokens	O
-A	ci-gate	R
-B	ci-gate	-
-C	ci-gate	O
-D	ci-gate	-
-E	ci-gate	O
-F	ci-gate	R
+software	handoff	R
+service	handoff	R
+game	handoff	R
+research	handoff	R
+fleet	handoff	R
+software	spec	R
+service	spec	R
+game	spec	R
+research	spec	-
+fleet	spec	R
+software	gate	R
+service	gate	R
+game	gate	R
+research	gate	O
+fleet	gate	R
+software	replay	R
+service	replay	-
+game	replay	R
+research	replay	-
+fleet	replay	O
+software	ratchet	R
+service	ratchet	O
+game	ratchet	O
+research	ratchet	-
+fleet	ratchet	O
+software	pr-gate	O
+service	pr-gate	-
+game	pr-gate	O
+research	pr-gate	-
+fleet	pr-gate	O
+software	review-panel	O
+service	review-panel	-
+game	review-panel	R
+research	review-panel	-
+fleet	review-panel	O
+software	playbooks	R
+service	playbooks	R
+game	playbooks	R
+research	playbooks	R
+fleet	playbooks	R
+software	tokens	O
+service	tokens	-
+game	tokens	-
+research	tokens	-
+fleet	tokens	O
+software	ci-gate	R
+service	ci-gate	-
+game	ci-gate	O
+research	ci-gate	-
+fleet	ci-gate	O

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@techgoblin/gobstack",
-  "version": "0.4.4-beta.8",
+  "version": "0.5.0-beta.1",
   "description": "Agent-discipline toolkit: one verify command, an enforcement matrix, and LIMITS. bash engine, npm shim.",
   "bin": {
     "goblin": "bin/goblin.js",

package/presets/electron-overlay.yaml

@@ -0,0 +1,38 @@
+# presets/electron-overlay.yaml — the electron opt-in for the `software` class.
+#
+# The `desktop` class is gone; F was merged into software because their classes.tsv need
+# columns are IDENTICAL on all 10 parts (measured). Everything F added beyond software lives in
+# plain goblin.yaml config keys, so it is an OVERLAY, not a class: `gob install --class software
+# --electron` (or the `--class desktop` / `F` alias, which sets --electron) renders the keys
+# below OVER the software preset. An absent key falls through to presets/software.yaml; a key
+# present here — including an empty one like sec_write_routes: "" — wins.
+#
+# The prose F carried (label / done_means / notes) is preserved here for the record; it is not a
+# rendered template key, so it never reaches a target's goblin.yaml.
+label: Desktop shell
+done_means: the renderer is isolated from Node, the main process is not busy, and the packaged bundle ships no dev dependency
+# software's A-only second gate (the TODO ceiling) is NOT applied: F never had it.
+gate2_name: ""
+gate2_cmd: ""
+# The perf lane is the shipped ratchet, reused verbatim; the hermetic number here is the
+# packaged bundle's byte count (a fat bundle is a slow cold start on every machine).
+ratchet_name: app_bundle_bytes
+ratchet_cmd: find dist out release -type f -exec cat {} + 2>/dev/null | wc -c
+sec_build_output: dist out release
+# A renderer that reaches the filesystem or Node directly is forbidden, so there are no write
+# routes to allow (software allows app/ and src/app/; the overlay blanks that).
+sec_write_routes: ""
+# perf_metric must EQUAL ratchet_name (PF-01 fails when the budget and the measurement disagree).
+perf_metric: app_bundle_bytes
+perf_cmd: find dist out release -type f -exec cat {} + 2>/dev/null | wc -c
+# THE FPS NUMBER IS A HOST GATE, not the ratchet: the instrument that produces
+# main_thread_busy_pct needs Playwright or Electron plus a GUI, which the no-npm contract
+# forbids a shipped rule to launch. It is DECLARED here and carried in the HANDOFF with its date
+# (docs/LIMITS.md #34, docs/CI.md carries the sweep). `electron: true` with this empty FAILs PF-01.
+perf_host_gate: "Electron run - main_thread_busy_pct with a window open (app.getAppMetrics()[i].cpu.percentCPUUsage, or CDP Performance.getMetrics), on a machine with a display"
+# The nine electron bans (G5's mechanism, G6's failure surface): nodeIntegration, context
+# isolation / sandbox, the dangerous webPreferences, and synchronous IPC / @electron/remote. An
+# unlisted ban SKIPs with a reason, so the other classes are unaffected; with electron: true the
+# engine also treats BN-06..09 as enabled even if a hand-edited bans: list omits them.
+bans: BN-01, BN-02, BN-05, BN-06, BN-07, BN-08, BN-09
+notes: a perf number measured on one box is not a user's experience - the renderer half can be a CI job, the Electron half is a host gate and cannot be.

package/presets/{E-fleet-config.yaml → fleet.yaml}

@@ -1,4 +1,4 @@
-# presets/E-fleet-config.yaml — class E: agent-fleet configuration.
+# presets/fleet.yaml — the `fleet` class (letters/aliases E, agent).
 #
 # "Done" means a config change is applied, verified against the ARTIFACT, and versioned.
 # The gate therefore checks the artifact (a commit exists, dated), never the intention.

package/presets/{C-game.yaml → game.yaml}

@@ -1,4 +1,4 @@
-# presets/C-game.yaml — class C: game.
+# presets/game.yaml — the `game` class (letter/alias C).
 #
 # "Done" means a suite green in the Editor AND a human feel verdict. The verdict is a
 # first-class deliverable, which is why this class requires the review-panel part: the panel

package/presets/{D-knowledge.yaml → research.yaml}

@@ -1,4 +1,4 @@
-# presets/D-knowledge.yaml — class D: knowledge / research.
+# presets/research.yaml — the `research` class (letter/alias D).
 #
 # "Done" means a question is answered with sources and the answer is findable. A research
 # note is not a spec, so the SPEC part is OFF, not optional. So are the REPLAY and the PR

package/presets/{B-service-config.yaml → service.yaml}

@@ -1,4 +1,4 @@
-# presets/B-service-config.yaml — class B: service / configuration.
+# presets/service.yaml — the `service` class (letter/alias B).
 #
 # "Done" means a contract (schema, route, API) is unchanged, or the change is intentional
 # and migrated. The class turns off the REPLAY and the PR gate, because a config repo has no

package/presets/{A-shipped-software.yaml → software.yaml}

@@ -1,4 +1,4 @@
-# presets/A-shipped-software.yaml — class A: shipped software.
+# presets/software.yaml — the `software` class (letters/aliases A, app).
 #
 # A class is not a stringency level. It selects WHICH PARTS are required, optional or off
 # (manifest/classes.tsv), and it supplies the default gate/ratchet shape below. The gate

package/skills/goblin-bootstrap/SKILL.md

@@ -7,12 +7,15 @@ description: P8: adopt goblin-stack in a repo - classify, install, verify, then
 
 Use when adopting goblin-stack in a repo, or starting one.
 
-1. **Classify the project A-F.** The class selects which parts are required, optional or off;
-   it is not a stringency level. F is a desktop shell: it adds the electron bans and a host gate.
+1. **Classify the project into one of five classes.** `software`, `service`, `game`, `research` or
+   `fleet` — the class selects which parts are required, optional or off; it is not a stringency
+   level. `software` also carries the electron opt-in (`--electron`): an Electron app is `software`
+   with the electron bans and a host gate, not a sixth class. The letters `A`-`E` and the older
+   names are read-time aliases.
 2. **`goblin-install --target <dir> --class <x>`** — the default install is a NEUTRAL harness:
    no agent skills. Opt in per platform afterwards with `gob emit --platform <p>` (or vendor the
    Hermes project tier with `--skills yes`).
-3. **`goblin-verify`** — a default class-A install (no agent skills) verifies green:
+3. **`goblin-verify`** — a default software-class install (no agent skills) verifies green:
    `38 passed, 0 failed, 11 advisory, 33 skipped`, exit 0, once `HANDOFF.md` names a commit that
    exists; before that edit the
    scaffold's `0000000` placeholder is `HP-05`'s one expected day-one red (`37 passed, 1 failed`).

package/templates/goblin.yaml.tmpl

@@ -4,9 +4,17 @@
 # Format: a flat, line-oriented YAML subset, parsed by .goblin/bin/goblin-lib.sh. No YAML
 # library, no network, no npm. Keep one key per line and keep comments on their own line.
 
-# Which class this project is (A|B|C|D|E). Selects the required parts (manifest/classes.tsv).
+# Which class this project is: software | service | game | research | fleet.
+# The letters A-E and the older names app/agent/desktop are READ-TIME aliases, so an old
+# value keeps verifying; `desktop`/`F` resolve to software. Selects the required parts
+# (manifest/classes.tsv).
 class: {{CLASS}}
 
+# Electron opt-in (software class). true turns on the electron ban set (BN-06..09) even if the
+# bans: list below omits them, and requires a declared perf.host_gate (PF-01 fails without one).
+# The `desktop`/`F` install alias sets this true; a text-editor app leaves it false.
+electron: {{ELECTRON}}
+
 # The default branch, DECLARED, never assumed. A preset that assumes the wrong branch
 # silently skips a repo.
 branch: {{BRANCH}}

package/presets/F-electron.yaml

@@ -1,67 +0,0 @@
-# presets/F-electron.yaml — class F: desktop shell (Electron).
-#
-# A class is not a stringency level: it selects WHICH PARTS are required, optional or off
-# (manifest/classes.tsv) and supplies the default gate/ratchet shape. A desktop shell needs a
-# part no other class has — a HOST gate, a number measured on a machine with a display — and it
-# forbids a thing the others allow: a renderer that reaches the filesystem or Node directly.
-# That is a new row-set, not a flag on class A (G6 section B.2, Part B).
-#
-# THE PERF LANE IS THE SHIPPED RATCHET, NOT A SECOND ONE (G6 section B.3). There is one
-# mechanism — `ratchet: {name, cmd, ceiling}`, enforced by GT-04/GT-05 and pinned to a commit by
-# PF-01 — and this class reuses it verbatim. What the ratchet measures here is the one hermetic
-# perf number a desktop shell has: the packaged bundle's byte count. A fat bundle is a slow
-# cold start on every machine, and the number needs no browser, no display and no dependency.
-#
-# THE FPS NUMBER IS A HOST GATE, and this is a DEVIATION from G6 section B.3, recorded with its
-# measured reason. G6 wants `main_thread_busy_pct` in the ratchet. It cannot be: the instrument
-# that produces it (CDP `Performance.getMetrics` over a real Chromium, or
-# `app.getAppMetrics()[i].cpu.percentCPUUsage` inside a real Electron) needs Playwright or
-# Electron plus a GUI, and the dependency contract (docs/CONTRACTS.md) allows a shipped rule
-# nothing but bash/git/awk/sed/grep/python3. A `ratchet.cmd` that cannot run on a fresh install
-# makes a fresh install BORN RED, which is the one thing every class must not be. So the probe
-# belongs to the project, next to the code it measures, and the number it produces is declared
-# here as a host gate and carried in the HANDOFF with its date (the class C pattern).
-#
-# Why frame time is the WRONG number, measured in G6 on a real Chromium (CDP, 0 to 32 ms of
-# work per frame): p50 frame time stayed FLAT at 16.70 ms while the main thread went from 1.8%
-# to 54.5% busy, and the dropped-frame count was non-monotone (0,0,0,1,3,11,0 — the worst
-# workload read 0). A frame-time gate at 16.7 ms is green on the idle tree AND on the loaded
-# tree: PROJECT-PRACTICE section 3, reproduced live in the exact metric the note proposed.
-# `main_thread_busy_pct` is the only monotone instrument in that sweep (1.8 -> 13.5 -> 26.0 ->
-# 54.5 -> 76.9 -> 99.5%), which is why it is named here as the host gate's metric.
-# docs/CI.md carries the sweep; docs/LIMITS.md #34 carries the gap.
-label: Desktop shell
-done_means: the renderer is isolated from Node, the main process is not busy, and the packaged bundle ships no dev dependency
-harness_dir: checks
-scaffold_checks: yes
-gate_name: commit
-gate_cmd: git rev-parse --verify --quiet HEAD
-ratchet_name: app_bundle_bytes
-ratchet_cmd: find dist out release -type f -exec cat {} + 2>/dev/null | wc -c
-ratchet_ceiling: measure
-replay_env: GOBLIN_PRE_COMMIT
-replay_cmd: node checks/{name}.mjs
-runtime_data: .goblin/state.json
-sec_gitignore_family: yes
-sec_build_output: dist out release
-sec_audit_cmd: npm audit --json
-sec_audit_max_age_days: 90
-sec_waiver_max_age_days: 180
-sec_write_routes: ""
-# perf_metric must EQUAL ratchet_name (PF-01 fails when the budget and the measurement disagree),
-# so the hermetic metric is named here too, and the host gate carries the FPS number beside it.
-perf_metric: app_bundle_bytes
-perf_cmd: find dist out release -type f -exec cat {} + 2>/dev/null | wc -c
-perf_baseline_commit: ""
-perf_baseline_value: 0
-perf_measured: ""
-perf_host_gate: "Electron run - main_thread_busy_pct with a window open (app.getAppMetrics()[i].cpu.percentCPUUsage, or CDP Performance.getMetrics), on a machine with a display"
-# The nine electron bans (G5's mechanism, G6's failure surface): nodeIntegration, context
-# isolation / sandbox, the dangerous webPreferences, and synchronous IPC / @electron/remote.
-# An unlisted ban SKIPs with a reason, so the other classes are unaffected by this list.
-bans: BN-01, BN-02, BN-05, BN-06, BN-07, BN-08, BN-09
-notes: a perf number measured on one box is not a user's experience - the renderer half can be a CI job, the Electron half is a host gate and cannot be.
-
-# The loop ceiling (G2, LP-03): the most turns ONE loop record may declare in its budget.
-# The same number for every class - a ceiling, not a per-class policy. 20 is the engine default.
-loop_max_turns_ceiling: 20