geneseed 2.0.0 → 2.1.0

package/docs/limits.md

@@ -3,9 +3,11 @@
 Geneseed is one implementation: `bin/`, `js/`, `adapters/`. It used to be two. Until the 2.0
 re-layout there was a second, older implementation beside it, and three cell harnesses ran both
 and compared every byte either one wrote plus both streams and the exit code. That second party
-is deleted. What survives it is a **recording**: the answers it gave, frozen under
-`tests/__snapshots__/`, replayed by `tests/golden.mjs`, `tests/cli_golden.mjs` and
-`tests/web_golden.mjs` against the code that ships.
+is deleted, and **on 2026-08-17 the recording it left behind was retired with it** — the emit, cli
+and web corpora, 1381 cells, plus the two replayers that existed only to drive them. What survives
+under `tests/__snapshots__/` is the narrower set of pure-function and help recordings that
+`tests/snapshot/` replays. *The emit, cli and web corpora were RETIRED* below carries the
+measurement that licensed that, what it cost, and what is left holding the line.
 
 This file is the standing answer to *"what does this tool not prove about itself?"* It is kept
 beside the code rather than in a phase note, because phase notes are per-machine and this
@@ -19,9 +21,10 @@ admits the limit, or deleting the paragraph is a way to pass it.
 **New in the 2.0 re-layout**, and each is checked against the tree rather than inherited from the
 previous version of this document:
 
-* **Limit zero** below — the corpus proves *unchanged*, never *correct* — promoted from a bullet
+* **Limit zero** below — a corpus proves *unchanged*, never *correct* — promoted from a bullet
   to the frame every other row sits inside, because with the second party gone it now governs all
-  of them.
+  of them. It governs a smaller estate since the retirement: the pure-function and help
+  recordings, and nothing else.
 * **Row 1** — there is no full-screen panel at all any more, on any path. Not "unported": absent.
 * **Row 3** — `/api/pick-folder` still exists as a declared decline and a live 501, but there is
   no longer a handler anywhere for it to be declined *against*.
@@ -30,9 +33,10 @@ previous version of this document:
 
 ---
 
-## ⚠ Limit zero — the corpus proves UNCHANGED, never CORRECT
+## ⚠ Limit zero — a corpus proves UNCHANGED, never CORRECT
 
-Every replay in this repository compares today's answer against a recorded one. That is a
+Every replay left in this repository — the pure-function recordings under `tests/__snapshots__/`
+and the 26 help fixtures beside them — compares today's answer against a recorded one. That is a
 regression gate and it is a good one. It is **not** a correctness gate, and the difference is the
 whole subject of this file.
 
@@ -42,37 +46,69 @@ two agreed and were both wrong, the corpus freezes the agreement — and there i
 second party who could disagree. A cross-implementation comparison was already structurally blind
 to a defect both sides shared; the recording inherited that blindness and made it permanent.
 
-So: a green replay says *"this code still answers what it answered on 2026-08-17."* It says
-nothing about whether that answer was ever the right one. Everything below is the standing list of
-where that matters and of the branches nothing reaches at all.
-
-## ⚠ The corpus is frozen — recorded 2026-08-17, replay-only from here
-
-**The recordings under `tests/__snapshots__/` can never be taken again.** They were produced by the
-reference implementation and by nothing else; every program that has ever written a cell is
-deleted, and the three Node replayers reject `--record` by design. The dispatch-only CI job that
-produced the `lf` halves is gone from `.github/workflows/ci.yml` in the same history, so the
-workflow did not outlive the reference it drove.
-
-The last recording was taken deliberately, immediately after the edits that had to be made while
-an oracle still existed — the emitted prose that named files the deletion removes, the removal of
-the web API's interpreter field, the three verbs the reference never had, and the release-label
-destamp that stops a version bump from reddening a corpus nobody can re-bless. Everything after
-that point may only be checked against those bytes.
-
-**The consequence, ASSERTED by the replayers themselves:** a change that moves a recorded byte is
-a **finding, not a step**. There is no re-bless. If a replay goes red the choice is to revert the
-change or to argue, in writing, that the recording was wrong — and nothing can settle that
-argument any more.
-
-**What the last recording fixed, and what a reader should know it cost.** The two platform halves
-had drifted apart for a reason that had nothing to do with either implementation: the `crlf` half
-had captured a stale `Harness/` — this repository's own dogfooded install, which is **gitignored
-build output** — so `doctor` reported seven stale renders on the machine that recorded it and none
-on CI, and the two platforms disagreed permanently. The final recording was taken with that
-directory absent, which is the state a fresh clone has. **A stale local build tree moves recorded
-bytes; an absent or freshly built one does not.** Anyone comparing the halves should know they now
-agree because that input was removed, not because it was ever normalised.
+So: a green replay says *"this code still answers what it answered on the day the recording was
+taken."* It says nothing about whether that answer was ever the right one. Everything below is the
+standing list of where that matters and of the branches nothing reaches at all.
+
+**The recordings that remain can never be taken again either.** They were produced by the
+reference implementation and by nothing else; every program that could write one is deleted, and
+the two suites in `tests/snapshot/` replay and do not record. So a change that moves a byte in one
+of them is a **finding, not a step**. There is no re-bless. If a replay goes red the choice is to
+revert the change or to argue, in writing, that the recording was wrong — and nothing can settle
+that argument any more.
+
+## ⚠ The emit, cli and web corpora were RETIRED — 2026-08-17
+
+**1381 recorded cells under `tests/__snapshots__/{emit,cli,web}` are deleted**, with the two
+replayers that existed only to drive them (`tests/cli_golden.mjs`, `tests/web_golden.mjs`), the
+scan that swept their bytes for Python, and the three `node-cells` steps in
+`.github/workflows/ci.yml` that ran them. What is left of that job is the two self-comparisons,
+which have no corpus and need none.
+
+**The reason is limit zero with the brake off.** A recording nobody can re-bless makes every
+deliberate content change a red gate — an emitted sentence, a reworded refusal, a version bump —
+while saying nothing at all about a defect that happened to be stable on the day it was taken. Run
+long enough, that is a gate reporting the author's intent rather than the code's behaviour, and the
+only way to stay green is to stop changing the product. The 2.0 bump had already shown the shape:
+one label moving reddened 224 of 259 emit cells and none of them was a defect.
+
+**The retirement was licensed by MEASUREMENT, not by the redness.** `tests/mutate.mjs` declares 31
+mutations and names, per row, the gate that must kill each one. Five declared a corpus replay and
+nothing else — **M1, M2, M3, M4 and M8** (`EMIT`, `EMIT_IMPERIAL`, `EMIT_CLAUDE`, `WEB_CATALOG`,
+`CLI_CONTEXT`). All five are killed by `tests/unit/` alone, the control included, and each row now
+**declares** the unit file that kills it rather than a replay that can no longer run — M1 and M3
+`maintainer_tools`, M2 `node_driver`, M4 `hook_form`, M8 `hook_cli`. A gate a matrix names and
+cannot run guards nothing, and is worse than none, because it is trusted (law XXXVIII). For every
+defect the mutation matrix knows how to plant, the corpus was redundant. That is the whole
+argument, and it is the only one that licenses a deletion: a test goes because a living gate
+already proves the property, never because it is red.
+
+**What was knowingly LOST: byte-level regression detection on emit, cli and web output.** Nothing
+now notices that a rendered bundle, a verb's stdout / stderr / exit code, or an HTTP response body
+moved by one byte for a reason nobody intended. A defect the mutation matrix does not carry, in a
+region `tests/unit/` does not reach, is one this repository will no longer see. That is a real
+reduction in coverage, stated here rather than discovered later.
+
+**What REMAINS:**
+
+* `node tests/golden.mjs --idempotent` — the re-emit path every user is on from their second build
+  onwards, a run compared against another run of the same generator.
+* `node tests/golden.mjs --deletion` — configuration A, then B onto A's tree, against a **fresh**
+  emit of B; the only thing that makes the write-before-delete prune actually delete.
+* `node bin/geneseed-cli.mjs doctor --all` — every theme, plus the parity, authoring and drift
+  checks.
+* `tests/unit/` — the suite that kills every mutation the matrix declares but one. The exception is
+  **M7**, whose seam is the `updated` branch of `managedBlockWrite`: it runs only on a *re-emit*, so
+  no fresh-sandbox fixture reaches it and `--idempotent` is its gate by construction.
+
+Both `golden.mjs` modes compare a run against another run of the *same* implementation, so they are
+determinism checks rather than regression gates — the same degradation standing decision 2 below
+has been calling the live one. What they buy for it is that they keep working however the content
+changes, which is exactly what the retired corpora could not do.
+
+**The tag `python-reference-v1.0.0` is kept as the historical pointer.** The second implementation
+and every cell it recorded still exist there, in full, and that is the only place they will. Nothing
+in the working tree reads it; it is a place to go and look, not a gate.
 
 ### The one hand-edit ever made to a recorded file
 
@@ -89,9 +125,14 @@ edit was verified to move only `note` lines.
 **This is an exception, not a precedent.** The next person who wants to hand-edit a recording
 should assume the answer is no and re-derive the whole argument above for their own field.
 
-### The second thing the comparison was taught to ignore, and why that is not the same as a hand-edit
+### The second thing the comparison was taught to ignore — HISTORY, and the reason the retirement above happened
 
-**2026-08-17 — `destamp()` in `tests/helpers/golden.mjs` now blanks `"_version"` inside
+*This describes the emit corpus, which is gone. The destamp survives it and is now inert: a run
+compared against another run of the same generator carries the same version on both sides. Kept
+because it is the clearest measurement of what a frozen corpus costs, and it is what made the case
+for retiring one.*
+
+**2026-08-17 — `destamp()` in `tests/helpers/golden.mjs` learned to blank `"_version"` inside
 `agent-overrides.json`, as it already blanked `[release <REL>]` inside `.geneseed-version`.**
 
 The configured release version is stamped into emitted bundles in **two** places, and only the first
@@ -105,38 +146,33 @@ the size never moved and only the hash could see it.
 not merely 2.0.0 but every possible bump, in 448 recorded files, with no recorder left to re-bless
 one. That is not a limit anyone chose, and it is the reason this is a fix rather than a concession.
 
-**The distinction that matters:** this narrows what the replay COMPARES; it does not touch a recorded
-byte. The other ~553 bytes of that stub, and every other file in all 259 cells, stay asserted exactly
-as before. **But it is still a real loss of coverage** — nothing now checks that the emitted
-`_version` matches the configured one, and nothing can, because verifying it would need the oracle
-that recorded these bytes. If that mapping ever breaks, this corpus will be silent about it.
+**The distinction that mattered at the time:** it narrowed what the replay COMPARED; it did not touch
+a recorded byte. The other ~553 bytes of that stub, and every other file in all 259 cells, stayed
+asserted exactly as before. **It was still a real loss of coverage** — nothing checked that the
+emitted `_version` matched the configured one, and nothing could, because verifying it needed the
+oracle that recorded those bytes. **And that is the pattern that ran out.** Every bump, every reworded
+sentence, every renamed file would have arrived as the same choice: narrow the comparison again, or
+freeze the product. Two exemptions in one release is a trend, not an incident, and the third would
+have been the version bump after this one.
 
 ## Frozen residue — true statements that are now permanently unfixable
 
 Four things in this repository are wrong, known to be wrong, and **cannot be corrected**, because
 correcting them would move a byte in a corpus with no recorder left. They are listed so a future
-reader finds a decision here rather than concluding nobody looked.
+reader finds a decision here rather than concluding nobody looked. This list was six until
+2026-08-17; the two the retirement freed are recorded under it, because *which* residue a corpus
+creates is the clearest measure of what freezing one costs.
 
-- **`js/tui.mjs` and `js/menu.mjs` end a refusal with ``Use `harness setup`, `doctor`, or `build`.``**
-  `harness` was the reference's argparse program name and now names nothing. Both strings are
-  recorded in the CLI corpus. Changing either reddens cells that can never be re-recorded.
 - **`tests/__snapshots__/primitives/{win32,posix}.json` freeze `[authoring] _web_core prose says …`**
   across five cases, naming a module the cut deleted. Frozen evidence about a program that no
   longer exists — accurate as a record of what the reference answered, misleading as a description
   of today.
-- **`js/cli-table.json`'s `tui` help still promises a "full-screen curses control panel"** for a
-  verb that returns 1 on every path. The help corpus is frozen at the 26 texts argparse rendered,
-  so this string has no oracle to be corrected against. The verb's actual output is honest; only
-  its help is not.
-- **`tests/helpers/matrix/*.json` — 6 files — are permanently un-regenerable.** Their only producer
-  was the reference's matrix exporter. The committed copies are the last export, and
-  `tests/unit/hook_cli.test.mjs` reads both halves of them to derive the platform union.
-- **`tests/workflow_runtime.test.mjs` sits at `tests/` top level, alone among the plugin suites.**
-  `adapters/opencode/workflows/_runtime.js` names that path in a comment, and that file is EMITTED,
-  so its bytes are hashed into the emit corpus. Moving the suite to `tests/plugins/` and updating the
-  pointer grew the emitted file by 8 bytes and turned the corpus red. **The layout bent around the
-  frozen recording, rather than the shipped comment being left to rot.** This is the one place where
-  the freeze is visible in the directory structure, and it is deliberate.
+- **`tests/helpers/matrix/*.json` — 4 files — are permanently un-regenerable.** Their only producer
+  was the reference's matrix exporter. The committed copies are the last export. `tests/golden.mjs`
+  drives the `emit` pair; `tests/unit/hook_cli.test.mjs` reads both halves of the `cli` pair to
+  derive the platform union. **The `web` pair was deleted on 2026-08-19** — 418 kB whose only
+  reader went with the web corpus, so nothing had exercised them since; `tests/ported.json` carries
+  the decision and the criterion it was taken on.
 - **`tests/__snapshots__/token_report_primitives.json` names `js/lib/pyfs.mjs`** in one recorded
   `why` field, and this release renamed that file to `js/lib/fs.mjs`. **This one was left alone on
   purpose, and the reasoning is the point:** `why` is never compared — it is interpolated into a
@@ -146,8 +182,22 @@ reader finds a decision here rather than concluding nobody looked.
   demands it, not for when it is merely harmless**, or the exception becomes the rule and the corpus
   stops being evidence.
 
-The first three share one shape: **a string is cheap to fix right up until it is recorded, and then
-it is not fixable at all.** That is the cost of freezing a corpus, paid knowingly.
+Three of the four share one shape: **a string is cheap to fix right up until it is recorded, and
+then it is not fixable at all.** That is the cost of freezing a corpus, paid knowingly.
+
+**Freed on 2026-08-17, and neither is fixed yet.** Both are now ordinary edits somebody has to make;
+they are kept here so the next reader finds the reason the code looks the way it does.
+
+- **`js/tui.mjs` and `js/menu.mjs` end a refusal with ``Use `harness setup`, `doctor`, or `build`.``**
+  `harness` was the reference's argparse program name and now names nothing. Both strings were
+  recorded in the CLI corpus, so changing either used to redden cells nobody could re-record. That
+  corpus is gone; the wrong word is now just a wrong word.
+- **`tests/workflow_runtime.test.mjs` sits at `tests/` top level, alone among the plugin suites.**
+  `adapters/opencode/workflows/_runtime.js` names that path in a comment, and that file is EMITTED,
+  so its bytes were hashed into the emit corpus: moving the suite to `tests/plugins/` and updating
+  the pointer grew the emitted file by 8 bytes and turned the corpus red. **The layout bent around
+  the frozen recording rather than leaving the shipped comment to rot** — the one place the freeze
+  was visible in the directory structure. Nothing holds it there now.
 
 ## What IS covered
 
@@ -162,8 +212,8 @@ missing thing visible instead of silently absent.
 | 1 | **There is no full-screen panel.** Not unported — absent. `js/tui.mjs`'s `cmdTui` has two arms and **both print and return 1**: off a TTY it says so, on one it says the entry carries the TUI's layout half and not its screens. The reference's panel — its loop, its eighteen screens, its `(stdscr, curses, pal)` drawing helpers, its Windows console window, its menus, the curses arms of `setup` and `bootstrap`, and `doctor`'s progress callback — is deleted with the implementation that had it. **The comparison half of this row is history**: there is no panel to declare a gap against. What is live is the claim about the shipping code, and it is a claim about ABSENCE, which is the kind a structural gate can hold. (This row used to say the refusal *names* the interpreter-and-script invocation of the panel. It has not since P2, which removed the pointer rather than re-aiming it: a refusal naming a file this migration deletes is worse than one that simply says the screen does not exist. The row was factually stale for two phases, which is the argument for reading the gate out of the code rather than out of the prose.) | **`tests/unit/no_panel.test.mjs`**, which needs nothing but the port: behavioural (faked `isTTY`, exit 1, no panel marks on stdout, and the refusal is the only line it writes) and structural — it fails if `js/tui.mjs` grows any of `?1049h`, `?1049l`, `?25l`, a literal ESC, `\x1b[`, `[`. **What is NOT asserted and cannot be**: that a panel, if one were written, would work. The positive control that used to prove the reference panel really painted — the thing that stopped the mark list being a set of strings nothing produces — retired with the reference. The Node file replaces it with a control of its own (see row 6), which proves the marks still match how *this* codebase spells an escape, not that any panel exists. Landing a real panel means deleting the structural test **first** and updating this row second. |
 | 2 | **`_wrap_lines`, the panel's line wrapper.** Its only caller was the panel loop, so it travels with row 1 and is now history along with it. **`textwrap.wrap` itself CROSSED** — this row said "a stdlib payload with no Node twin … port it *with* the panel or not at all" until P1 made `--help` the caller that required it: `pyTextWrap` (`js/cli.mjs`) is a real port of it, driven by `formatHelp`. | `tests/__snapshots__/textwrap.json` freezes the CPython answers (38 cases × widths 11..198, sha256 over the matrix) and `tests/snapshot/pure_snapshot.test.mjs` replays them with no interpreter anywhere on the machine. The live comparison against a running `textwrap` retired with the reference, so **limit zero applies here in its sharpest form**: the matrix is 38 cases wide and one CPython version deep, and a wrap CPython itself later changes is a divergence this repository cannot see. The corpus declares which side of gh-139065 it was recorded on, precisely so it cannot be mistaken for one frozen against the behaviour CPython already fixed. |
 | 3 | **`/api/pick-folder` will never exist here.** It opens an OS-native folder dialog on the daemon host, which is a GUI dependency and a sixth allowed-spawn row for a modal window. `js/web/server.mjs` carries it in `DECLINED_POST`, a set kept distinct from `NOT_PORTED_POST` because "will never cross" is a different claim from "not yet". **What changed in this phase**: there is no longer anything on the other side to decline. The reference's own handler is deleted, so this stopped being a comparison between an endpoint that exists over there and one that does not exist here, and became simply a documented, permanent 501 — and it is the ONLY member of either set, which makes it the last live target the dispatcher's 501 arm has (see row 9). | Probed live, not merely declared: `tests/unit/web_server.test.mjs` drives the real dispatcher and requires POST → 501 and GET → *not* 501 (it must fall through to the SPA). That pair is what refuses the one-line collapse of the POST declarations back into the GET set, which would leave every exported set exactly as written and every set-reading test green. The collapse is planted as **M23** in `tests/mutate.mjs` and killed, so the row's own argument is gated rather than asserted. |
-| 4 | **`_win_user_path`'s registry-write success arm.** `link`/`unlink` edit the persistent user Path through PowerShell. No test in this repo may run that — the edit would outlive the suite, the checkout and the machine. | The *failure* arm is reached honestly: the `unlink` cells hand the verb a PATH with no `powershell` on it, so the code takes the "said nothing about PATH" branch with the registry untouched. Everything that can be *wrong* lives in the pure `winUserPathScript` half, and `tests/__snapshots__/win_user_path.json` is a recorded corpus over it, replayed by `tests/snapshot/pure_snapshot.test.mjs` on every platform (the builder reads nothing host-shaped, and a non-Windows run is what measures that). That the spawn half carries no logic used to be **STATED**, in a test docstring; `tests/unit/win_user_path.test.mjs`'s last test now checks it — one `spawnSync`, the builder's output passed through unchanged, no string work on the directory, and a statement ceiling. If logic drifts INTO the spawn the ungated region grows, and this is what refuses that. |
-| 5 | ~~**`link`/`unlink`'s Unix arm.**~~ **CLOSED at P11.** It writes a `#!/bin/sh` shim into `~/.local/bin` carrying a `# GENESEED_LINK_SHIM` marker and chmod 0755, and it has six cells of its own. (It *symlinked* `ROOT/geneseed` until P0/P1 Task 2b; the `is_symlink()` branch survives so `unlink` still removes a legacy symlink install, and **no cell covers that branch** — the one piece of this row still open.) The six include the `PATH` split (a substring test passes every other cell and fails `a-path-entry-that-merely-contains-the-dir`), the **marker check** that leaves a foreign `geneseed` alone — the decoy is a regular file, not a symlink, so the marker is what has to reject it — and an explicit dir argument with a trailing slash. That last one found a live divergence: the reference built a `Path` and the port kept the raw string, so `str(Path('/x/bin/'))` and `/x/bin/` disagreed in two messages and in the PATH comparison. Fixed in `js/link.mjs` with `pyPathStr`. | The group is a UNION across the two platforms. `tests/cli_golden.mjs`'s `platformDeclarationProblems` travels with the matrix and asserts, on every replay and on both operating systems in CI, that every id declared for this platform is built, every id declared for the other is absent, and neither half is empty; it also PRINTS the half it did not run, so a run says out loud what it skipped. The two directions that need to read **both** halves at once live in `tests/unit/hook_cli.test.mjs`. |
+| 4 | **`_win_user_path`'s registry-write success arm.** `link`/`unlink` edit the persistent user Path through PowerShell. No test in this repo may run that — the edit would outlive the suite, the checkout and the machine. | The *failure* arm used to be reached honestly, by `unlink` cells that handed the verb a PATH with no `powershell` on it so the code took the "said nothing about PATH" branch with the registry untouched. **Those cells went with the CLI corpus on 2026-08-17 and nothing replaced them**, so the spawn half is now ungated on both arms rather than one — a downgrade this row carries rather than hides. Everything that can be *wrong* still lives in the pure `winUserPathScript` half, and `tests/__snapshots__/win_user_path.json` is a recorded corpus over it, replayed by `tests/snapshot/pure_snapshot.test.mjs` on every platform (the builder reads nothing host-shaped, and a non-Windows run is what measures that). That the spawn half carries no logic used to be **STATED**, in a test docstring; `tests/unit/win_user_path.test.mjs`'s last test now checks it — one `spawnSync`, the builder's output passed through unchanged, no string work on the directory, and a statement ceiling. If logic drifts INTO the spawn the ungated region grows, and this is what refuses that. |
+| 5 | ~~**`link`/`unlink`'s Unix arm.**~~ **CLOSED at P11.** It writes a `#!/bin/sh` shim into `~/.local/bin` carrying a `# GENESEED_LINK_SHIM` marker and chmod 0755, and it has six cells of its own. (It *symlinked* `ROOT/geneseed` until P0/P1 Task 2b; the `is_symlink()` branch survives so `unlink` still removes a legacy symlink install, and **no cell covers that branch** — the one piece of this row still open.) The six include the `PATH` split (a substring test passes every other cell and fails `a-path-entry-that-merely-contains-the-dir`), the **marker check** that leaves a foreign `geneseed` alone — the decoy is a regular file, not a symlink, so the marker is what has to reject it — and an explicit dir argument with a trailing slash. That last one found a live divergence: the reference built a `Path` and the port kept the raw string, so `str(Path('/x/bin/'))` and `/x/bin/` disagreed in two messages and in the PATH comparison. Fixed in `js/link.mjs` with `pyPathStr`. | The group is a UNION across the two platforms, and **the six cells are gone with the CLI corpus.** `platformDeclarationProblems` travelled with the replay — one id per built cell, the other platform's half absent, neither half empty, and the skipped half PRINTED — so it retired with it. What is left is `tests/unit/hook_cli.test.mjs`, which reads **both** halves of `tests/helpers/matrix/*.json` at once and is now the whole of this row's gate rather than the part of it that needed two files. The behaviour itself — the marker check, the `PATH` split, the trailing slash — is no longer probed end to end anywhere. |
 | 6 | **The boot animation's call site.** `playLine` itself is exercised; what is declared is that `js/setup.mjs` and `js/update.mjs` reach no panel. **Nothing about this row ever needed a second implementation** — its subject is two JavaScript files — and until P3 its only gate was a test that retired with the reference. | **`tests/unit/no_panel.test.mjs`**. Escape sequences, not the word "curses": the first draft looked for the word and failed on a *docblock*, and a structural gate that reads prose is a gate on the documentation — it would have been satisfied by deleting the paragraph that admits the limit. It carries two things its predecessor had not. A **positive control**: the same scan run over `js/anim.mjs`, which paints by design and is excluded by name, must find a hit — otherwise a mark list that has stopped matching how this codebase spells an escape retires all three gates green. And a **literal ESC byte** among the marks, found by accident while falsifying the gate: the falsifying edit was appended with `printf`, which ate the backslash and wrote a real ESC, and every scan stayed green over a module that had just grown a screen-clear. A gate that knows the spellings of a character but not the character is a gate on a coding style. |
 
 ## Ungated, and honest about it
@@ -172,12 +222,14 @@ missing thing visible instead of silently absent.
 |---|---|---|
 | 7 | **`npmBuild`** (`npm install && npm run build`). | A first-run-from-a-partial-checkout path; no cell can be in that state, because `web/dist/` is tracked. `tests/unit/web_daemon.test.mjs` asserts *that* — it re-derives the unreachability from `git ls-files`, so untracking `web/dist/index.html` fails the test instead of quietly making the arm live. It also asserts the file must EXIST in the working tree, because tracked-but-absent is a real state in which the `ask` arm is reachable here and now while the tracking claim still holds. The two branches only reachable through it — the prompt's wording and EOF handling, and the `npm install` → `npm run build` order — are asserted as source and gated as **M25**. |
 | 8 | **The stale-factory probe.** *(HISTORY, not a live limit.)* | Its subject was a reference CLI too old to know `upgrade`, dead-ending on argparse's `invalid choice` — a program that no longer exists. `js/update.mjs` argues the absence out at the call site: the update step is an **import, not a spawn**, so there is no second program to be stale, no argparse to refuse, and no `invalid choice` to recognise. The half that DID have a live subject is the durable trace a failed step leaves, and it is asserted absolutely by `tests/unit/update_steps.test.mjs` — persisted before it is printed, appended rather than overwritten, still returned when the log itself cannot be written. |
-| 9 | **The web dispatcher's 501 arm, for anything but one path.** | `NOT_PORTED_ACTIONS`, `NOT_PORTED_KINDS` and `NOT_PORTED_POST` are all empty, so `/api/pick-folder` (row 3) is the only target the arm has left, and no second one can be borrowed: every remaining action either starts a job in the developer's checkout or writes a shim and edits the real user PATH. The action-side claim therefore rests on `tests/unit/web_jobs.test.mjs` reading the set out of the module — **a gate on a declaration, which is weaker than a probe**, and is declared as such at both sites. A new row in that set makes the arm reachable again and obliges this row to become a probe. What is stronger is the sibling declaration beside it: each of the three `INLINE_ACTIONS` names a recorded cell that really drives the dispatcher, and the cell's existence is asserted on both corpus halves. |
-| 10 | **`pyStrPath` / `pyPathStr`.** Two spellings of one translation in `js/generate.mjs`. | Ungated; the comment at the call site says so. The recorded CLI cells read stderr through a universal-newline decode and cannot see the difference the split is about. |
+| 9 | **The web dispatcher's 501 arm, for anything but one path.** | `NOT_PORTED_ACTIONS`, `NOT_PORTED_KINDS` and `NOT_PORTED_POST` are all empty, so `/api/pick-folder` (row 3) is the only target the arm has left, and no second one can be borrowed: every remaining action either starts a job in the developer's checkout or writes a shim and edits the real user PATH. The action-side claim therefore rests on `tests/unit/web_jobs.test.mjs` reading the set out of the module — **a gate on a declaration, which is weaker than a probe**, and is declared as such at both sites. A new row in that set makes the arm reachable again and obliges this row to become a probe. The sibling declaration beside it used to be stronger — each of the three `INLINE_ACTIONS` named a recorded cell that really drove the dispatcher, and the cell's existence was asserted on both corpus halves. **Those cells retired on 2026-08-17**, so both declarations now rest on the module being read rather than driven, and the row is weaker by exactly that much. |
+| 10 | **`pyStrPath` / `pyPathStr`.** Two spellings of one translation in `js/generate.mjs`. | Ungated; the comment at the call site says so. The recorded CLI cells could not see the difference the split is about either — they read stderr through a universal-newline decode — and they are gone as of 2026-08-17, so the row went from ungated-with-a-witness-nearby to simply ungated. |
 | 11 | **The Linux browser lookup answering FALSE.** The reference walked `webbrowser`'s registry (`$BROWSER`, `xdg-open`, `gio`, `gvfs-open`, a dozen browser binaries); `js/menu.mjs`'s `browserAvailable` asks only whether `xdg-open` — the binary `openUrl` will actually run — is on PATH. On a box with `gio` and no `xdg-open` they disagreed, which is what a WSL run measured. | The corpus in `tests/unit/web_first.test.mjs` SUPPLIES the input instead of inheriting it: an `xdg-open` stub on PATH plus `DISPLAY`, so the True arm is reached identically on every host, and a `no-display` row gates the Linux-only display refusal absolutely. Reaching the FALSE arm needs a PATH with no `xdg-open` at all, which is not something a probe on Windows survives — so it stays ungated, here, rather than in a comment. **The divergence it names is now permanent** and belongs in `docs/declined.md`'s territory rather than this file's: with the reference gone, `browserAvailable`'s answer is simply the answer, and nothing can say it is the wrong one. |
 | 12 | **The width tables are pinned by a HASH, not by a live oracle.** `js/tui.mjs`'s `WIDE`/`COMBINING` tables are a snapshot of unidata **15.1.0** (declared as `DWIDTH_UNIDATA`). Nothing in this repository consults a live Unicode database any more — there is none to consult — so what the sweep proves is that the tables have not moved since they were recorded, and **not** that they encode any Unicode version correctly. This was already true of the CPython comparison in one direction (3.14 carries 16.0.0 and assigned U+0897 a combining class, so the old live sweep reported a divergence that was neither implementation's); it is now true in both. | `tests/__snapshots__/dwidth.json` carries all 527 runs, a sha256 over them, and the unidata version they were measured at; `tests/snapshot/pure_snapshot.test.mjs` checks `DWIDTH_UNIDATA` against that declaration, asserts the constant NAMES a Unicode version at all — read out of `js/tui.mjs` by regex **as well as** imported, so the gate cannot be satisfied by deleting the declaration and supplying the value some other way — and replays the sweep. The document self-checks against its own hash first, so a hand-edited `rle` is not accepted as an oracle. The interpreter pin that used to hold this together retired with the live sweep. Regenerating the tables means moving the constant and re-recording the corpus **together**, and re-recording is exactly what is no longer possible: **new tables would have to arrive with a new corpus recorded from the port itself, which is a determinism check and not a regression gate.** |
 | 13 | **`minuteStamp`'s recorded answers carry the recording machine's clock.** `%Y-%m-%d %H:%M` off a naive local-time conversion, so the frozen answers hold one UTC offset. There is no token to substitute — the offset is the answer's arithmetic, not a substring of it. | Each of the five cases carries a `guard` naming the UTC offset **at that instant** (so DST is part of the match, not an approximation), and `tests/snapshot/pure_snapshot.test.mjs` recomputes it from `Date` before asserting. A replay in another zone SKIPS those cases and PRINTS how many it skipped — the width sweep's rule that a skip is not a pass. The live comparison that used to gate them everywhere is retired, so they are gated only where the offsets agree, which is not many machines. That is the cost of the cut, taken deliberately: a case asserted in one zone and declared in the others beats one silently re-blessed to whatever zone last ran it. |
 
+| 14 | **A RENAMED test file is no longer detected.** `tests/ported.json` named the Node successor of every deleted Python test, and `tests/unit/ported.test.mjs` asserted each of those 52 paths still existed on disk — so renaming one reddened the suite. That test was **retired on 2026-08-19**: four of its six assertions only ever checked that the ledger agreed with itself, and the two that reached outside it charged a hand edit inside a 231 kB, 92%-prose JSON for every rename. | A *deletion* is still caught, and over a wider set: `.github/workflows/ci.yml`'s discovery floor fails below 500 reported tests across all 71 files, where the ledger pinned 52. What is genuinely gone is the *rename* signal — a file renamed and still discovered by the glob passes. The one assertion that outranked the ledger, the recursive walk for a stray untracked `tests/**/*.py`, was salvaged verbatim into `tests/unit/package_manifest.test.mjs` beside the tracked-file count it strengthens: it needs no row to be true and no repository to run, which is exactly why it was worth keeping and the other five were not. The ledger itself is kept, unread, as the record of the migration; its own `doc` now opens by saying it does not execute. |
+
 **On row 8, and the shape it is an example of.** A row whose only gate was a retiring test silently
 demotes from ASSERTED to prose at a deletion — which is the exact failure this file exists to
 prevent. Row 8 was the first to be settled the other way instead: its *stale-factory* half
@@ -188,13 +240,13 @@ now settled the same way, and row 3's history half with them.
 
 ## Not proven anywhere, and worth knowing before a release
 
-* ~~**The three cell harnesses have only ever run on Windows.**~~ **FIXED at P11**, and widened in
-  the 2.0 re-layout: the `node-cells` job in `.github/workflows/ci.yml` replays all three corpora
-  on **`ubuntu-latest` AND `windows-latest`** on every push, and `validate` (doctor plus the whole
-  Node suite) runs on both as well. The budget argument that kept the old comparison job
-  Linux-only does not carry over — a replay is a single spawn per cell — and the `crlf` half of
-  the corpus has no other replayer at all. What the first Linux run found, recorded because it is
-  the honest measure of what one-platform testing hides:
+* ~~**The three cell harnesses have only ever run on Windows.**~~ **FIXED at P11**, and the
+  two-platform rule outlived the corpora that motivated it: `node-cells` still runs on
+  **`ubuntu-latest` AND `windows-latest`** on every push — `--idempotent` and `--deletion` now,
+  where it replayed all three corpora until 2026-08-17 — and `validate` (doctor plus the whole
+  Node suite) runs on both as well. What the first Linux run found, recorded because it is the
+  honest measure of what one-platform testing hides, and because every one of these was found by
+  a cell harness that no longer exists:
   * The POSIX shim's `"$@"` was read as a path, so every healthy install's hooks were reported
     dead — **a user-visible `doctor` bug on every Linux and macOS install**, in both
     implementations, plus 112 of 259 golden cells and four `--validate-only` tests. Fixed at the
@@ -234,9 +286,10 @@ now settled the same way, and row 3's history half with them.
   * **A temp-directory cleanup race killed the Linux job** after it had compared 270 of 318 cells;
     the same commit passed on re-run. A sandbox teardown cannot raise.
 * ~~**The reference is load-bearing.**~~ **HISTORY.** The replayers used to default to the reference
-  as their `--ref`; there is no `--ref` left to default. What replaced it is limit zero: the
-  recording is now the only second party, and it cannot be asked a new question.
-* **Nothing measures the corpus's own coverage from the outside.** The claims that stop a corpus
+  as their `--ref`; there is no `--ref` left to default, and since 2026-08-17 there is no recording
+  of it left on the emit, cli or web surfaces either. On those three, this project's only second
+  party is another run of itself.
+* **Nothing measures the surviving corpora's own coverage from the outside.** The claims that stop a corpus
   quietly ceasing to exercise a function it still names — the fence really varies, the diff reaches
   past 200 elements, a splitlines case breaks where `split('\n')` does not, a capitalize case where
   the rest matters, a `len` case where code points and UTF-16 units differ, both arms of every
@@ -262,9 +315,15 @@ per-machine.
    the port — which makes them a DETERMINISM check rather than a regression gate, the same
    degradation `--idempotent`/`--deletion` already carry. Neither is wrong; picking neither is.
    **This is limit zero with a deadline**, and it is the live one.
-3. ~~**`record-corpus` stops working entirely.**~~ **DONE, and it is what makes item 2 sharp.** The
+3. ~~**`record-corpus` stops working entirely.**~~ **DONE, and it is what made item 2 sharp.** The
    job is deleted from `.github/workflows/ci.yml`. With it went the platform-independence gate and
-   the record-twice rot detector: the two recorded platform halves ARE the platform table now, and
-   nothing re-derives them. A replacement had to be written while both implementations still
+   the record-twice rot detector: the two recorded platform halves WERE the platform table, and
+   nothing re-derived them. A replacement had to be written while both implementations still
    existed — a port-recorded corpus proves nothing the port did not already believe — and what was
-   written instead is the two-OS `node-cells` job above, which replays rather than records.
+   written instead was the two-OS `node-cells` job above, which replayed rather than recorded.
+4. ~~**Every content change is a corpus argument.**~~ **SETTLED ON 2026-08-17 by retiring the emit,
+   cli and web corpora** — see the section of that name above. This is what item 2 looks like once
+   its deadline arrives: the choice was never between a green corpus and a red one, it was between
+   freezing the product and admitting the recording had stopped being evidence. Item 2 is still
+   open, on the 26 help fixtures, and it is still the live one — but it is now the *only* one, and
+   the CLI's help text is a much smaller thing to hold still than every emitted byte.

package/docs/web/agents.md

@@ -5,4 +5,4 @@ title: "Agents"
 kind: "concept"
 link: {"hash": "#/section/agents", "label": "Browse the catalog →"}
 ---
-{N_AGENTS} capability specialists — `reviewer`, `tester`, `architect`, `docs`, `security`, `explorer`, plus a debate **council** the [[council]] skill convenes (`advocate`, `skeptic`, `pragmatist`, `steward`, `visionary`, `user-advocate`, `framer`, `empiricist`, `operator`, `historian`). You delegate by capability, not by folder: the harness picks the right specialist from the request.
+{N_AGENTS} capability specialists — `reviewer`, `tester`, `architect`, `developer`, `docs`, `security`, `explorer`, plus a debate **council** the [[council]] skill convenes (`advocate`, `skeptic`, `pragmatist`, `steward`, `visionary`, `user-advocate`, `framer`, `empiricist`, `operator`, `historian`). You delegate by capability, not by folder: the harness picks the right specialist from the request.

package/docs/web/rules.md

@@ -5,4 +5,4 @@ title: "Rules (Laws)"
 kind: "concept"
 link: {"hash": "#/laws", "label": "Browse the ledger →"}
 ---
-{N_LAWS} universal laws the agent obeys — secrets handling, scope discipline, verify-before-assert, surface-failures, context economy, load-the-docs, tool-discovery, non-interactive-shell, and more. Each law is a short markdown file under `src/laws/` and the rendered numbered list lives in `AGENT.md`. They bind regardless of theme: an imperial deploy reads them as *Dictates*, a neutral deploy as *Rules*, but the numbering and the rule itself never move.
+{N_LAWS} universal laws the agent obeys — secrets handling, scope discipline, verify-before-assert, surface-failures, context economy, load-the-docs, tool-discovery, non-interactive-shell, and more. They are authored as one numbered list in `src/laws/universal.md`, and the rendered list lives in `AGENT.md`. They bind regardless of theme: an imperial deploy reads them as *Dictates*, a neutral deploy as *Rules*, but the numbering and the rule itself never move.

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "2.0.0"
+  "version": "2.1.0"
 }

package/js/cli-table.json

@@ -764,7 +764,7 @@
     },
     {
       "name": "tui",
-      "help": "full-screen curses control panel (Unix)",
+      "help": "print the harness at a glance (interactive terminals only)",
       "description": "",
       "positionals": [],
       "options": [

package/js/doctor.mjs

@@ -1,14 +1,14 @@
 /**
  * `_harness_build.cmd_doctor` — validate the build.
  *
- * Sixteen `_*_problems` checks over one theme (or every theme) — the newest is P10c's `cli`
- * — and `[doctor] ok — …` when all sixteen find nothing. That last sentence is why this
- * module's gate looks the way it does, and it is worth stating here rather than only in the
- * spec: **delete any single check
- * and a clean run is byte-identical**, so a cross-implementation comparison cannot tell this
- * file from a stub that prints the OK line. `tests/harness_golden.py` therefore plants ONE
- * FAULT PER CHECK, in a private copy of the checkout — see `_copy_checkout` there for why a
- * verb that reads `ROOT` needed a fixture kind that did not exist until this phase.
+ * Fifteen `*Problems` checks over one theme (or every theme) — and `[doctor] ok — …` when all
+ * fifteen find nothing. That last sentence is why this module's gate looks the way it does, and
+ * it is worth stating here rather than only in the spec: **delete any single check
+ * and a clean run is byte-identical**, so a comparison of two runs cannot tell this
+ * file from a stub that prints the OK line. `tests/unit/harness.test.mjs` and
+ * `tests/unit/authoring_gates.test.mjs` therefore plant ONE FAULT PER CHECK, in a private copy
+ * of the checkout — see `copyCheckout` in `tests/helpers/cli_golden.mjs` for why a verb that
+ * reads `ROOT` needed a fixture kind that did not exist until the port.
  *
  * WHY THIS IS THE VERB THAT SPAWNS. `bin/geneseed-cli.mjs` was under a blanket transitive
  * `child_process` ban, and its own docblock predicted the day a verb that genuinely spawns
@@ -48,7 +48,7 @@ import {
 } from './native.mjs';
 import { PALETTE_ROLES, colorThemeFiles } from './opencode.mjs';
 import { STRUCTURE, renderAll } from './render.mjs';
-import { SHIM_ARGV, hookShimPath } from './settings.mjs';
+import { hookShimPath, shimDeadPaths } from './settings.mjs';
 import { pySplitLines } from './lib/udiff.mjs';
 import { NO_WINDOW } from './lib/proc.mjs';
 import {
@@ -516,9 +516,9 @@ export function shimProblems() {
     return [`[shim] ${p} exists but cannot be read (${e.message}) — hooks may be dead`];
   }
   // The body is machine-generated and quotes the two baked paths — plus, on POSIX, the argv
-  // placeholder `"$@"`, which is not a path. `SHIM_ARGV` is the single owner of that pair.
-  const quoted = [...body.matchAll(/"([^"]+)"/g)].map((m) => m[1]);
-  return quoted.filter((q) => !SHIM_ARGV.has(q) && !existsSync(q)).map(
+  // placeholder `"$@"`, which is not a path. `shimDeadPaths` is the single owner of that rule;
+  // `hookPrefix` is its other reader, and the two must not drift.
+  return shimDeadPaths(body).map(
     (m) => `[shim] ${p} pointed at ${m}, which does not exist — every hook in every `
       + "install was dead (the checkout most likely moved). This run's own "
       + 'emit has refreshed it; no further action needed.',
@@ -736,6 +736,14 @@ export function proseMirrorProblems(readme, web, counts, skillStems, shipped = '
     }
   }
 
+  // ⚠ THE ABSENCE OF THIS TRIPLE IS CHECKED BY THE CALLER, NOT HERE, AND THAT IS FORCED RATHER
+  // THAN CHOSEN. This arm is satisfiable by DELETING THE SENTENCE — no match, no problem, green
+  // — which is a gate failing open. The obvious fix is an `else` right here, and it cannot go
+  // here: `prose_mirror_problems` is one of the pure functions recorded in
+  // `tests/__snapshots__/primitives/`, the recording holds a case that passes an EMPTY `shipped`
+  // and expects `[]`, and there is no recorder left to re-bless it. So the presence check lives
+  // in `countTableProblems`, which is not recorded — beside the read that already knows whether
+  // the file could be opened at all, which is where it reads better anyway.
   const s = /(\d+) laws, (\d+) agents, (\d+) skills/.exec(shipped);
   if (s) {
     for (const [got, want, label] of [[s[1], laws, 'laws'], [s[2], agents, 'agents'],
@@ -821,9 +829,19 @@ export function countTableProblems() {
   };
   let readme;
   try { readme = readText(path.join(ROOT, 'README.md')); } catch { return problems; }
+  // ⚠ PRESENCE FIRST, THEN THE VALUE — the same absence arm the SHIPPED triple needed, for the
+  // same reason: `if (m && …)` is green when there is no badge, so deleting a badge silences its
+  // own gate. The `continue` keeps the loop's MESSAGE ORDER intact, which is load-bearing (see
+  // the `plugins`-is-last comment above): a missing badge reports in its own slot rather than
+  // reordering the ones after it.
   for (const [key, n] of Object.entries(counts)) {
     const m = new RegExp(`badge/${key}-(\\d+)`).exec(readme);
-    if (m && Number(m[1]) !== n) {
+    if (!m) {
+      problems.push(`[authoring] README has no ${key} badge — deleting one is how this gate `
+        + 'goes green while the reader is told nothing');
+      continue;
+    }
+    if (Number(m[1]) !== n) {
       problems.push(`[authoring] README ${key} badge says ${m[1]} but src has ${n}`);
     }
   }
@@ -843,8 +861,34 @@ export function countTableProblems() {
     web = globSorted(path.join(ROOT, 'docs', 'web'), (n) => n.endsWith('.md'))
       .map(readText).join('\n');
   } catch { web = ''; }
+  // ⚠ NOT FAIL-SOFT, UNLIKE `web` ABOVE, AND THE ASYMMETRY IS THE POINT. A missing `docs/web`
+  // tree is not an authoring fault — a checkout can legitimately lack it. SHIPPED.md is a
+  // tracked, shipped file that this function asserts the CONTENT of, so an unreadable one is
+  // indistinguishable from a deleted claim: swallowing it into `''` used to hand the triple arm
+  // an empty string and turn a hard read failure into a silent pass.
+  // ⚠ NOT FAIL-SOFT, UNLIKE `web` ABOVE, AND THE ASYMMETRY IS THE POINT. A missing `docs/web`
+  // tree is not an authoring fault — a checkout can legitimately lack it. SHIPPED.md is a
+  // tracked, shipped file whose CONTENT this function asserts, so an unreadable one was
+  // indistinguishable from a deleted claim: swallowing it into `''` handed the triple arm an
+  // empty string and turned a hard read failure into a silent pass.
+  //
+  // AND THE PRESENCE OF THE TRIPLE IS CHECKED HERE rather than inside `proseMirrorProblems`,
+  // which is where it belongs by subject and cannot go by construction — that function is
+  // recorded in `tests/__snapshots__/primitives/` with a case that passes an empty `shipped` and
+  // expects `[]`, and nothing can re-bless a recording whose recorder is deleted. This is the
+  // caller, it is not recorded, and it already owns the question "could the file be read".
   let shipped;
-  try { shipped = readText(path.join(ROOT, 'SHIPPED.md')); } catch { shipped = ''; }
+  try {
+    shipped = readText(path.join(ROOT, 'SHIPPED.md'));
+  } catch (e) {
+    problems.push(`[authoring] SHIPPED.md is unreadable (${e.message}) — the counts it carries `
+      + 'cannot be checked, and a gate that cannot read its subject must say so');
+    shipped = '';
+  }
+  if (shipped && !/(\d+) laws, (\d+) agents, (\d+) skills/.test(shipped)) {
+    problems.push('[authoring] SHIPPED.md carries no \'N laws, N agents, N skills\' line — '
+      + 'deleting it is how that gate goes green while the count drifts');
+  }
   problems.push(...proseMirrorProblems(readme, web, counts, skillFiles, shipped));
   return problems;
 }
@@ -1163,15 +1207,16 @@ export function cmdDoctor(args) {
         + '`./geneseed update` (or re-sync src/), then re-check.\n');
     }
     if (problems.some((p) => p.startsWith('[themes]') && p.includes('missing key'))) {
-      // `./geneseed build --sync-themes`, and the spelling is a one-shot decision frozen in
-      // two fixtures, so it is argued here. The FRONT DOOR, not an interpreter and a file:
-      // `build` forwards its extra arguments to the generator, so the tip names a command that
-      // works today AND after the Python is deleted — which naming the interpreter and the
-      // generator's file, as the old tip did, would not. The `./` prefix matches the sibling tip
-      // five lines up (`./geneseed update`) and is honest about the audience: this problem is
-      // only reachable while authoring themes in a checkout, which is where `./geneseed` is.
+      // ⚠ THE TIP USED TO NAME `./geneseed build --sync-themes`, AND THAT COMMAND ERRORS.
+      // It was argued here on the premise that "`build` forwards its extra arguments to the
+      // generator" — which was true of the reference and is not true of `cmdBuild`
+      // (`js/generate.mjs`), which forwards `--theme` and nothing else. So the front door
+      // answered `unrecognized arguments: --sync-themes` to anyone who followed doctor's own
+      // advice, for as long as the premise went unchecked. The flag belongs to the GENERATOR,
+      // whose binary is `geneseed-build` — which is what `README.md` and `SETUP.md` have said
+      // all along. A hint is a command; if it is not runnable it is decoration.
       pyPrint('  tip: a theme is missing a key another theme defines — run '
-        + '`./geneseed build --sync-themes` to fill it from _TEMPLATE.json, '
+        + '`geneseed-build --sync-themes` to fill it from _TEMPLATE.json, '
         + 'then restyle the added key(s) and re-check.\n');
     }
     if (note) pyPrint(`${note}\n`);

package/js/inventory.mjs

@@ -45,7 +45,8 @@ export const LAW_CLASS = {
   XXI: 'process', XXII: 'security', XXIII: 'security', XXIV: 'craft', XXV: 'craft',
   XXVI: 'craft', XXVII: 'verify', XXVIII: 'process', XXIX: 'comms', XXX: 'comms',
   XXXI: 'comms', XXXII: 'craft', XXXIII: 'craft', XXXIV: 'verify', XXXV: 'verify',
-  XXXVI: 'security', XXXVII: 'process',
+  XXXVI: 'security', XXXVII: 'process', XXXVIII: 'verify', XXXIX: 'comms',
+  XL: 'comms',
 };
 
 /** `_harness_tui.ENTITY_STATUSES` — the lifecycle statuses `registry.json` may carry. */

package/js/lib/fs.mjs

@@ -281,10 +281,14 @@ export const normcase = process.platform === 'win32'
  *     flat cmp  : the reverse again
  *
  * Nothing in the emitted tree could see it: `js/render.mjs` sorts a list whose members share
- * a directory depth, and `golden.py` compares CONTENT rather than order. It became visible
+ * a directory depth, and `golden.py` compared CONTENT rather than order. It became visible
  * the first time a full path list was PRINTED \u2014 `geneseed validate -v` \u2014 against a real
  * skills tree that happens to contain both `skills/geneseed/` and `skills/geneseed-code-review/`.
- * `tests/test_maintainer_tools_parity.py` is the gate that found it and the one that holds it.
+ * `tests/test_maintainer_tools_parity.py` found it and died with the reference it compared
+ * against. What HOLDS it now is `tests/unit/maintainer_tools.test.mjs`, and specifically its
+ * `theme files are visited in THIS platform's Path collation order` test: it re-derives Python's
+ * `sorted(Path)` order for the running platform instead of replaying a recording, so it cannot
+ * agree with a drift \u2014 and it is the measured killer of this function's mutation (M3).
  */
 export function comparePaths(a, b) {
   const A = normcase(a).split(/[\\/]/);