geneseed 2.0.0 → 3.0.0

package/js/setup.mjs

@@ -46,7 +46,7 @@ import path from 'node:path';
 
 import { main as driverMain, resolveOut } from '../bin/geneseed.mjs';
 import { playLine } from './anim.mjs';
-import { discoverNames } from './checkout.mjs';
+import { discoverNames, PACK_ORDER } from './checkout.mjs';
 import { exportImprovements } from './diff.mjs';
 import { cmdDoctor } from './doctor.mjs';
 import { setupBuildArgs } from './generate.mjs';
@@ -211,6 +211,23 @@ const MODE_BLURBS = {
   foreman: 'triages tasks, spawns pipelines for substantial work',
 };
 
+/**
+ * One line per doctrine pack, written for someone who has never read `src/doctrines/README.md`
+ * — this is the only description of a pack an installer ever sees.
+ *
+ * `process` says what turning it OFF costs, and it is the only one that has to. The other three
+ * trade practices for context; process 5 is the commit/push consent gate, so dropping the pack
+ * drops the rule that every commit and every push is asked for. A blurb that read "planning and
+ * context economy" would have sold that away in a menu.
+ */
+const DOCTRINE_BLURBS = {
+  craft: 'how code is written — reuse first, house conventions, docs, the smallest diff',
+  rigor: 'how work is proven — idempotence, honest tests, coverage, gates that can fail',
+  ops: 'how the machine is driven — tool discovery, non-blocking commands, teardown',
+  process: 'how a session runs — planning, context economy, docs first, and the consent gate '
+    + 'on every commit and push (drop this pack and that gate goes with it)',
+};
+
 /**
  * `_harness_setup._theme_options`.
  *
@@ -243,6 +260,20 @@ export function modeOptions() {
   return discoverNames('modes', 'direct').map((n) => [n, MODE_BLURBS[n] ?? '']);
 }
 
+/**
+ * The doctrine packs, in `PACK_ORDER` — the third option table, and the one that is a SET.
+ *
+ * The order is NARRATIVE and comes from `PACK_ORDER`; `discoverNames` only says which packs
+ * this checkout actually ships. Ordering by discovery instead would read `craft, ops, process,
+ * rigor` — it `.sort()`s — and the menu a human answers would stop matching the `Active packs:`
+ * line the build writes, which is normalised into `PACK_ORDER` at the driver. Same intersection
+ * the driver's `parseDoctrines` and the config loader take, for the same reason.
+ */
+export function doctrineOptions() {
+  const known = discoverNames('doctrines', PACK_ORDER[0]);
+  return PACK_ORDER.filter((n) => known.includes(n)).map((n) => [n, DOCTRINE_BLURBS[n] ?? '']);
+}
+
 /**
  * `_harness_setup.EMIT_OPTIONS`.
  *
@@ -272,12 +303,60 @@ const FOOTPRINT_OPTIONS = [
 // --------------------------------------------------------------------------------------
 
 /**
- * `_harness_setup._collect_setup_lines` — the five questions, the plan, the confirm.
+ * The Doctrine-packs question — one `all`/`choose` gate, then a y/n per pack.
+ *
+ * TWO LEVELS RATHER THAN FOUR QUESTIONS, because the overwhelmingly common answer is "all of
+ * them" and a wizard that asks four yes/nos to get there taxes every install for the rare one.
+ * The gate's default is `all`, so an installer who holds Enter through the whole wizard gets
+ * the full set — which is what every pre-packs install already had.
+ *
+ * `askChoice` and not `confirm` for the per-pack question: `confirm` reads the first character
+ * and prints no description, so the pack's blurb — the only place a reader is told what the
+ * pack costs — would have nowhere to go. Two named options give it a line.
+ *
+ * Answering `no` to all four is legal and yields `[]`, which `setupBuildArgs` spells
+ * `--doctrines none`. That is a real configuration (invariants and ontology only), not a
+ * mistake to guard against, so it is not second-guessed here.
+ *
+ * `deployed` is what the machine's carriers already say (`installedDefaults().doctrines`), and
+ * it drives BOTH levels: a narrowed install opens on `choose` with its own packs pre-ticked,
+ * so holding Enter through the wizard KEEPS the selection instead of silently widening it back
+ * to all four. `null` — no carrier said — still opens on `all`, which is the same resolution
+ * `doctrinesForBuild` gives unknown, so the wizard and the build agree about silence.
+ *
+ * ⚠ It never returns `null`, at either level, and `tests/unit/setup.test.mjs` pins that: this
+ * is the one call site allowed to reach `setupBuildArgs` without a `doctrinesForBuild`
+ * fallback, and that exemption is only sound while the function is total.
+ */
+function askDoctrines(deployed = null) {
+  const opts = doctrineOptions();
+  const all = opts.map(([n]) => n);
+  const known = Array.isArray(deployed) ? all.filter((n) => deployed.includes(n)) : null;
+  const narrowed = known !== null && known.length !== all.length;
+  const pick = askChoice('Doctrine packs', [
+    ['all', `${all.join(' + ')}${narrowed ? '' : ' (default)'}`],
+    ['choose', `pick packs${narrowed ? ` (installed: ${known.join(', ') || 'none'})` : ''}`],
+  ], narrowed ? 'choose' : 'all');
+  if (pick !== 'choose') return all;
+  return all.filter((name) => askChoice(`Include ${name} — ${DOCTRINE_BLURBS[name] ?? name}`,
+    [['yes', `build ${name} into AGENT.md`], ['no', `leave ${name} out`]],
+    known === null || known.includes(name) ? 'yes' : 'no') === 'yes');
+}
+
+/**
+ * `_harness_setup._collect_setup_lines` — the six questions, the plan, the confirm.
  *
  * Returns the selection, or null when the confirm is declined. Every default is the
  * DEPLOYED value first (`installedDefaults`) and the CONFIGURED one second, which is why
  * P5i is the phase that had to give `installedDefaults` its posture, mode and footprint keys
  * back: three of the five questions read them.
+ *
+ * Doctrines reads the same walk, and joined it last because the `Active packs:` marker reader
+ * did not exist when the question shipped. Until it did, every re-run of the wizard offered
+ * `all` to an installer who had deliberately narrowed their packs — the one register where
+ * holding Enter SILENTLY WIDENED a selection instead of keeping it. `inst.doctrines` is passed
+ * whole, `null` included, because `askDoctrines` distinguishes "no carrier said" from "a
+ * carrier said none" and the two open the question differently.
  */
 export function collectSetupLines() {
   pyPrint('Geneseed setup — answer a few questions; nothing is written until you confirm.\n');
@@ -285,6 +364,7 @@ export function collectSetupLines() {
   const theme = askChoice('Theme', themeOptions(), inst.theme || defaultTheme());
   const posture = askChoice('Posture', postureOptions(), inst.posture || defaultPosture());
   const mode = askChoice('Mode', modeOptions(), inst.mode || defaultMode());
+  const doctrines = askDoctrines(inst.doctrines);
   const emit = askChoice('Install mode', EMIT_OPTIONS, inst.emit || 'opencode-global');
   const footprint = askChoice('Footprint', FOOTPRINT_OPTIONS.map(([k, d]) => [k, d]),
     inst.footprint || 'lean');
@@ -299,10 +379,15 @@ export function collectSetupLines() {
   } else if (emit === 'files') {
     out = ask('Output dir for the bundle', 'Harness');
   }
+  // The full pack list is passed as the elision default rather than left to `setupBuildArgs`'s
+  // own: the menu the user just answered was built from `doctrineOptions()`, so "they picked
+  // everything" must be judged against that same list, not against a second one.
+  const allPacks = doctrineOptions().map(([n]) => n);
   pyPrint(`\nAbout to run:  geneseed build ${
-    setupBuildArgs(theme, emit, out, root, footprint, posture, mode).join(' ')}\n`);
+    setupBuildArgs(theme, emit, out, root, footprint, posture, mode, doctrines, allPacks)
+      .join(' ')}\n`);
   if (!confirm('Proceed?', true)) return null;
-  return { theme, posture, mode, emit, out, root, footprint };
+  return { theme, posture, mode, doctrines, emit, out, root, footprint };
 }
 
 // --------------------------------------------------------------------------------------
@@ -441,6 +526,7 @@ export function setupLines() {
   }
   const {
     theme, emit, out, root, footprint = 'lean', posture = 'peer', mode = 'direct',
+    doctrines = null,
   } = sel;
   if (emit === 'opencode-global') {
     // The build below overwrites the deployed global harness, and the self-improvement loops
@@ -455,7 +541,11 @@ export function setupLines() {
       pyPrint(`! could not export local edits (${e && e.message}) — continuing.\n`);
     }
   }
-  const argv = setupBuildArgs(theme, emit, out, root, footprint, posture, mode);
+  // Same list the question was built from — see `collectSetupLines`. The build that actually
+  // runs must carry the pack selection the plan line just previewed, or the wizard would print
+  // one command and run another.
+  const argv = setupBuildArgs(theme, emit, out, root, footprint, posture, mode, doctrines,
+    doctrineOptions().map(([n]) => n));
   pyPrint(`Running:  geneseed build ${argv.join(' ')}\n`);
   const rc = driverMain(argv);
   if (rc !== 0) {

package/js/status.mjs

@@ -125,9 +125,24 @@ export function cmdVersion(args) {
  * it, and the eleven `status` cells and the catalog cells now gate the same classifier
  * from opposite ends.
  */
-export function inventoryCounts(themeName) {
-  const inv = tuiInventory(themeName);
-  return { agents: inv.agents.length, skills: inv.skills.length, laws: inv.laws.length };
+export function inventoryCounts(themeName, doctrines = null) {
+  const inv = tuiInventory(themeName, doctrines);
+  const on = inv.doctrines.filter((p) => p.active);
+  return {
+    agents: inv.agents.length,
+    skills: inv.skills.length,
+    laws: inv.laws.length,
+    ontology: inv.ontology.length,
+    // ⚠ THREE NUMBERS AND NOT ONE, because a pack-off install is a real configuration and
+    // "23 rules" would be a lie in it. `packs`/`packsTotal` is the fraction the console and
+    // the panel both print; `doctrineRules` counts only the ACTIVE packs' rules — what this
+    // install is actually bound by, not what its bundle happens to carry. The catalogue is
+    // always whole (every pack file ships), so the total is recoverable from `tuiInventory`
+    // by anything that needs it and is not duplicated here.
+    packs: on.length,
+    packsTotal: inv.doctrines.length,
+    doctrineRules: on.reduce((n, p) => n + p.rules.length, 0),
+  };
 }
 
 /**
@@ -163,7 +178,10 @@ export function statusData() {
   const inst = installedDefaults();
   const theme = inst.theme || defaultTheme();
   const mdir = resolveMemoryDir(null);
-  const inv = inventoryCounts(theme);
+  // `inst.doctrines` is what the machine's carriers say — `null` when none of them does, which
+  // `tuiInventory` reads as every pack, the same resolution `doctrinesForBuild` gives unknown.
+  // This is a DISPLAY read: nothing here decides what a build emits.
+  const inv = inventoryCounts(theme, inst.doctrines);
   let cfgDir = null;
   try { cfgDir = opencodeConfigDir(); } catch { cfgDir = null; }
   const sourceFp = sourceFingerprint(makeCfg());
@@ -189,6 +207,15 @@ export function statusData() {
     agents: inv.agents,
     skills: inv.skills,
     laws: inv.laws,
+    // ⚠ NAMED ONE BY ONE, AND THAT IS THE TRAP THIS FUNCTION SETS TWICE. `inv` is already
+    // `inventoryCounts`' reduction, and this literal names its keys again — so a count added
+    // to the inventory and not to BOTH places is dropped here in silence, with nothing to
+    // fail. There is deliberately no spread: the panel's payload is a stated contract, and
+    // `js/web/api.mjs` spreads THIS, so anything reaching that endpoint passes through here.
+    ontology: inv.ontology,
+    packs: inv.packs,
+    packs_total: inv.packsTotal,
+    doctrine_rules: inv.doctrineRules,
     memory_dir: mdir ? String(mdir) : null,
     facts: mdir ? memoryFactCount(mdir) : 0,
     source_fp: sourceFp,
@@ -248,6 +275,20 @@ export function statusLines(d, color = false) {
       + `(${d.facts} fact${d.facts === 1 ? '' : 's'})`],
     ['version', `${d.installed_fp || '(none)'}  ${DOT}  source ${d.source_fp}`],
   ];
+  // ⚠ A ROW, NOT A WIDER `components` LINE, AND THE REASON IS THAT THE CORPUS CANNOT BE
+  // RE-BLESSED. `statusLines` has 30 recorded cases per platform in
+  // `tests/__snapshots__/primitives/`, every one of them holding the box's exact bytes —
+  // including `17 agents · 47 skills · 37 laws` — and the recorder was Python and is gone.
+  // Touching `components` moves all 30; adding a row would too, since the box width is
+  // measured over `rows`. So the row is CONDITIONAL on a key the recorded arguments do not
+  // carry, exactly as `agent_md` below already is, and the recording renders unchanged.
+  //
+  // It carries the two tiers `components` cannot: `components` counts the invariants as
+  // `laws`, which is still true, and says nothing about the ontology or the packs.
+  if (d.packs_total !== undefined) {
+    rows.push(['constitution', `${d.ontology} ontology sections ${DOT} ${d.doctrine_rules} `
+      + `doctrine rules in ${d.packs}/${d.packs_total} packs`]);
+  }
   if (d.agent_md) {
     rows.push(['AGENT.md',
       `${d.agent_md}  (${d.agent_md_present ? 'present' : 'MISSING'})`]);

package/js/themes.mjs

@@ -59,7 +59,7 @@ import {
  *   - the three `strip` spellings are Python's whitespace set, not `String.prototype.trim`'s;
  *   - `jsonDumpsCompact(v, {ensureAscii: false})` is `json.dumps(v, ensure_ascii=False)`,
  *     including the `', '`/`': '` separators — which matter for exactly ONE key,
- *     `AGENT_COLORS`, the only non-string among `_TEMPLATE.json`'s 137 values. `ensureAscii`
+ *     `AGENT_COLORS`, the only non-string among `_TEMPLATE.json`'s 140 values. `ensureAscii`
  *     is false because the reference passes `ensure_ascii=False`, and 33 template values
  *     carry non-ASCII text that would otherwise be escaped into the committed file;
  *   - `pyEq`, because the safety net compares two `json.loads` results and `===` is identity

package/js/tui.mjs

@@ -246,6 +246,11 @@ const ICONS = {
   agent: ['🤖', '◆', '@'],
   skill: ['✨', '✦', '*'],
   law: ['📜', '§', '#'],
+  // The other two tiers. Safe to add: `icon` has 32 recorded cases and none of them names a
+  // key that did not exist, so a new entry changes no recorded answer — unlike `glyphs`,
+  // whose recorded results are the whole object and which is therefore left alone.
+  ontology: ['🧭', '◉', 'O'],
+  doctrine: ['📐', '⌘', 'D'],
   library: ['📚', '❒', 'L'],
   notebook: ['📓', '✎', 'N'],
   wiki: ['📘', '▥', 'W'],
@@ -387,14 +392,47 @@ export function themeFlair(theme) {
 /**
  * `_tui_entries` — the ordered (kind, label, data) rows for the left list. `head` is a
  * section divider and is not selectable.
+ *
+ * ⚠ THE TWO NEW TIERS ARE GUARDED, AND THE GUARD IS NOT DEFENSIVENESS. This function has two
+ * recorded cases per platform in `tests/__snapshots__/primitives/`, replayed under
+ * `deepStrictEqual`, and their argument is a synthetic inventory carrying exactly
+ * `{agents, skills, laws, theme}` — no recorder survives to re-bless them. Reading
+ * `inv.doctrines.length` there THROWS; emitting a head unconditionally changes the recorded
+ * result array. Keyed on presence, the recording renders byte-identical and a real inventory
+ * gets all three tiers.
+ *
+ * The order is CONSTITUTIONAL and not alphabetical: ontology, then invariants, then doctrines
+ * — the order they are read in, the order AGENT.md renders them, and the order the console's
+ * three bands appear in. `Rule` and `Doctrine` are hardcoded English here, as `Rule` already
+ * was: this function receives an inventory, not a theme's nouns.
  */
 export function tuiEntries(inv) {
   const rows = [['head', `AGENTS (${inv.agents.length})`, null]];
   for (const e of inv.agents) rows.push(['agent', e.name, e]);
   rows.push(['head', `SKILLS (${inv.skills.length})`, null]);
   for (const e of inv.skills) rows.push(['skill', e.name, e]);
+  if (inv.ontology?.length) {
+    rows.push(['head', `ONTOLOGY (${inv.ontology.length})`, null]);
+    for (const e of inv.ontology) rows.push(['ontology', e.title, e]);
+  }
   rows.push(['head', `LAWS (${inv.laws.length})`, null]);
   for (const e of inv.laws) rows.push(['law', `Rule ${e.num} — ${e.title}`, e]);
+  if (inv.doctrines?.length) {
+    // The head counts the ACTIVE packs' rules and names the fraction, because a pack that is
+    // not built in is still listed — greyed rather than absent, so "off" never looks like
+    // "gone" — and a head reading `DOCTRINES (23)` over an install bound by six would be the
+    // one number in this panel that lies.
+    const on = inv.doctrines.filter((p) => p.active);
+    const n = on.reduce((a, p) => a + p.rules.length, 0);
+    rows.push(['head',
+      `DOCTRINES (${n} in ${on.length}/${inv.doctrines.length} packs)`, null]);
+    for (const p of inv.doctrines) {
+      for (const r of p.rules) {
+        rows.push(['doctrine', `Doctrine ${r.pack} ${r.n} — ${r.title}`,
+          { ...r, active: p.active, source: p.source }]);
+      }
+    }
+  }
   return rows;
 }
 
@@ -420,7 +458,12 @@ export function tuiEntries(inv) {
  * the fix is one `or []` at the call site, and it belongs in the same change as the port.
  */
 export function detailLines(kind, label, data) {
-  if (kind === 'law') return [label, ''].concat(data ? pySplitLines(data.body) : []);
+  // The three constitutional tiers share one treatment — the label, a blank, then the body —
+  // because all three are a titled rule rather than a rendered spec. New kinds only: the nine
+  // recorded cases name kinds that already existed, so no recorded answer moves.
+  if (kind === 'law' || kind === 'doctrine' || kind === 'ontology') {
+    return [label, ''].concat(data ? pySplitLines(data.body) : []);
+  }
   if ((kind === 'agent' || kind === 'skill') && data) return pySplitLines(data.body);
   return null;
 }
@@ -433,12 +476,12 @@ export function detailLines(kind, label, data) {
  */
 export function cmdTui() {
   if (!process.stdin.isTTY) {
-    pyPrint('[tui] not an interactive terminal. Use `harness setup`, `doctor`, or `build`.\n');
+    pyPrint('[tui] not an interactive terminal. Use `geneseed setup`, `geneseed doctor`, or `geneseed build`.\n');
     return 1;
   }
   // The pointer to the Python panel is gone for `js/menu.mjs`'s reason: the
   // panel it named is the Python being deleted. What is left is true and stays true.
   pyPrint('[tui] full-screen panel unavailable (this entry carries the TUI\'s layout '
-    + 'half, not its screens). Use `harness setup`, `doctor`, or `build`.\n');
+    + 'half, not its screens). Use `geneseed setup`, `geneseed doctor`, or `geneseed build`.\n');
   return 1;
 }

package/js/uninstall.mjs

@@ -1,5 +1,5 @@
 /**
- * `harness uninstall` — the first verb in this port that DELETES.
+ * `geneseed uninstall` — the first verb in this port that DELETES.
  *
  * Thirteen subcommands crossed before this one and every one of them either writes or
  * reports. `uninstall` removes a deployed install: the manifest's owned files, the empty
@@ -50,7 +50,7 @@ import path from 'node:path';
 import { hookRunnerEntry } from '../bin/geneseed.mjs';
 import { confirm } from './setup.mjs';
 import {
-  claudeCfg, claudeReadManifest, emitHostScopeOf, installKind, installState,
+  claudeCfg, claudeReadManifest, doctrinesOfDir, emitHostScopeOf, installKind, installState,
   registeredTargets, readMaybe, DISABLED_STASH,
 } from './installs.mjs';
 import {
@@ -187,7 +187,7 @@ function warnSurvivors(failed) {
 
 function warnMarkersKept() {
   pyPrintErr('[uninstall] WARN: the manifest and markers were KEPT so '
-    + '`harness uninstall` can be retried once the file(s) are '
+    + '`geneseed uninstall` can be retried once the file(s) are '
     + 'unlocked/removable.\n');
 }
 
@@ -510,7 +510,7 @@ export function installUninstall(root, host = 'opencode', scope = 'global', memo
       // With `failed` set the reversal already warned twice — no third overlapping WARN.
       pyPrintErr('[uninstall] WARN: could not fully remove the install — still present: '
         + `${survivors.join(', ')}. The install marker was KEPT so you can retry `
-        + '`harness uninstall` once the file(s) are unlocked/removable.\n');
+        + '`geneseed uninstall` once the file(s) are unlocked/removable.\n');
     }
     const out = {
       ok: true,
@@ -626,7 +626,7 @@ export function printSurvivingProjectInventory(removedRoot) {
     + 'does not affect them (each is self-contained):\n');
   for (const [host, scope, root] of survivors) {
     pyPrint(`  - ${root} (${host}:${scope}) — remove with: `
-      + `harness uninstall --target "${root}" --yes\n`);
+      + `geneseed uninstall --target "${root}" --yes\n`);
   }
 }
 
@@ -733,7 +733,7 @@ export function cmdUninstall(args) {
   if (s.incomplete && s.incomplete.length) {
     pyPrint(`[uninstall] INCOMPLETE — removed ${s.removed} file(s), but `
       + `${s.incomplete.length} item(s) survived (see the WARN above); `
-      + 'the install marker was kept — retry `harness uninstall` once they\'re '
+      + 'the install marker was kept — retry `geneseed uninstall` once they\'re '
       + `removable. ${cfgfile} updated where needed; memory/notebook ${mem}.\n`);
   } else {
     pyPrint(`[uninstall] done — removed ${s.removed} file(s); ${cfgfile} updated where `
@@ -1013,15 +1013,27 @@ function cleanHostStash(cfg, host = 'claude') {
  * file and swallows its own OSError, exactly as the reference does — a failed bookkeeping
  * write must not fail the reactivate that has already moved every file back.
  */
-function remergeClaudeHooks(cfg) {
+function remergeClaudeHooks(cfg, root = cfg) {
   const data = claudeReadManifest(cfg);
   const managed = managedOf(data);
   // `hookOpts` is the one argument `mergeClaudeSettings` will not default, and it is right
   // not to: there is no computable fallback for the runner/entry the shim bakes. The
   // emitter's own originator is imported rather than restated — a reactivate that wired a
   // different shim path would point every re-added hook at a file the emitter never writes.
+  // The pack selection is read back off the reactivated carrier, not defaulted: a reactivate
+  // that re-wired the git-gate into an install whose owner had turned the process pack off
+  // would put the boundary back at odds with the prompt. `null` (no marker) keeps the gate.
+  //
+  // ⚠ THE CARRIER IS NOT ALWAYS UNDER `cfg`, WHICH IS WHY `root` IS A SECOND PARAMETER. On a
+  // PROJECT install `cfg` is `<repo>/.claude` and the carrier is `<repo>/CLAUDE.md`, so
+  // reading `cfg` alone answered `null` for every project reactivate and re-wired the gate
+  // unconditionally (fail-closed, so not a hole — but wrong, and it made the toggle one-way
+  // for project installs). `root` first, `cfg` second: copilot keeps its carrier INSIDE the
+  // config dir (`.github/copilot-instructions.md`), and on a global install the two are the
+  // same directory anyway. Both silent ⇒ `null` ⇒ the gate stays.
+  const doctrines = doctrinesOfDir(root) ?? doctrinesOfDir(cfg);
   const [, claims] = mergeClaudeSettings(settingsFile(cfg, managed), 'global',
-    managed.settings_hooks ?? null, hookRunnerEntry());
+    managed.settings_hooks ?? null, hookRunnerEntry(), doctrines);
   // `and data` — a manifest that did not parse is not one to write back.
   if (!pyEq(claims, managed.settings_hooks ?? null) && Object.keys(data).length > 0) {
     managed.settings_hooks = claims;
@@ -1106,7 +1118,7 @@ function claudeReactivate(root, scope = 'global', host = 'claude') {
       && isFile(path.join(cfg, 'rules', 'geneseed.md'));
   }
   if (relive) {
-    remergeClaudeHooks(cfg);   // ensure the hooks are present (and the claims exact)
+    remergeClaudeHooks(cfg, root);   // ensure the hooks are present (and the claims exact)
     cleanHostStash(cfg, host);
     return { ok: true,
       note: 'install was re-created while disabled; discarded the stashed snapshot' };
@@ -1126,12 +1138,19 @@ function claudeReactivate(root, scope = 'global', host = 'claude') {
     moved += 1;
   }
   if (leftovers.length) return { ok: false, failed: leftovers, moved };
-  remergeClaudeHooks(cfg);
   const managed = claudeReadManifest(cfg).managed || {};
-  wireClaudeExcludes(settingsFile(cfg, managed), managed.settings_excludes || []);
+  // ⚠ THE CARRIER IS RESTORED BEFORE THE HOOKS ARE RE-MERGED, AND THE ORDER IS LOAD-BEARING.
+  // `remergeClaudeHooks` reads the install's pack selection back off the carrier, and on a
+  // Claude-style host that selection lives inside the MANAGED BLOCK — which the deactivate
+  // stashed. Re-merging first therefore asked a CLAUDE.md with its block cut out, got `null`
+  // ("unknown"), and fail-closed straight back to the consent gate: every reactivate re-wired a
+  // git-gate the owner had turned off, in both scopes. The two writes touch different files
+  // (`CLAUDE.md` vs `settings*.json`), so nothing else depends on which goes first.
   if (existsSync(blockFile)) {
     managedBlockWrite(claudeMdPath(cfg, managed), readText(blockFile));
   }
+  remergeClaudeHooks(cfg, root);
+  wireClaudeExcludes(settingsFile(cfg, managed), managed.settings_excludes || []);
   cleanHostStash(cfg, host);
   return { ok: true, kind: host, moved };
 }

package/js/web/actions.mjs

@@ -104,7 +104,7 @@ import os from 'node:os';
 import path from 'node:path';
 
 import { emitGlobalInto } from '../../bin/geneseed.mjs';
-import { ROOT, discoverNames } from '../checkout.mjs';
+import { ROOT, discoverNames, PACK_ORDER } from '../checkout.mjs';
 import { withStdoutSwallowed } from '../diff.mjs';
 import { excludeAdd, excludeRemove } from '../excludes.mjs';
 import { setupBuildArgs } from '../generate.mjs';
@@ -114,8 +114,8 @@ import {
   pyResolve,
 } from '../hosts.mjs';
 import {
-  EMIT_HOST_SCOPE, footprintOfDir, installState, installTargets, modeOfDir, postureOfDir,
-  readMaybe,
+  EMIT_HOST_SCOPE, doctrinesForBuild, footprintOfDir, installState, installTargets, modeOfDir,
+  postureOfDir, readMaybe,
 } from '../installs.mjs';
 import {
   MCP_PRESETS, isDict, mcpApply, mcpCommented, mcpInstallTargets, mcpKnownNames, mcpLoad,
@@ -140,6 +140,36 @@ const bget = (body, key, dflt = null) => (isDict(body) && Object.hasOwn(body, ke
 /** `str(x or "")` — Python's truthiness, then Python's `str`. */
 const strOr = (v) => (pyTruthy(v) ? pyStr(v) : '');
 
+/**
+ * A request body's `doctrines` -> a normalised pack list, or `null` for "said nothing usable".
+ *
+ * THE SAME TRUST BOUNDARY THE THEME CROSSES, and it needs more care than posture or mode do
+ * because this value is a LIST: `discoverNames(...).includes(x)` closes a scalar in one call,
+ * but a list has to be closed member by member or one bogus element rides in beside three good
+ * ones and reaches an argv. Every name is checked against DISCOVERY — what this checkout
+ * actually ships — and the result is re-ordered through `PACK_ORDER`, because the
+ * `Active packs:` line the build writes is a marker that a later reader parses back out and a
+ * marker whose contents depend on request-body order compares unequal to itself.
+ *
+ * `null` rather than a substituted default on every rejection, so the caller decides what
+ * "unspecified" means for its own endpoint — a rebuild keeps the deployment's answer, a fresh
+ * deploy takes the configured one. That mirrors the bogus-theme fallback right beside it.
+ *
+ * Accepts an array (what the console sends) or a comma string (what a curl by hand sends), and
+ * `none`/`[]` both mean the deliberate empty selection — a real configuration, not a rejection.
+ */
+function bodyDoctrines(body) {
+  const raw = bget(body, 'doctrines');
+  if (Array.isArray(raw) && !raw.length) return [];
+  const names = Array.isArray(raw) ? raw
+    : (typeof raw === 'string' ? raw.split(',').map((s) => s.trim()).filter(Boolean) : null);
+  if (names === null || !names.length) return null;
+  if (names.length === 1 && names[0] === 'none') return [];
+  const known = discoverNames('doctrines', PACK_ORDER[0]);
+  if (!names.every((n) => typeof n === 'string' && known.includes(n))) return null;
+  return PACK_ORDER.filter((p) => names.includes(p));
+}
+
 /** `str.split()` with no argument — runs of PYTHON whitespace, no empties. */
 const pyWords = (s) => s.split(new RegExp(`[${PY_SPACE}]+`)).filter(Boolean);
 
@@ -534,14 +564,30 @@ export function apiMcp() {
  * `,]`. A file that will not parse is refused rather than clobbered: it may be
  * `~/.claude.json`, which holds projects and history far beyond MCP wiring.
  */
-export function apiMcpToggle(state, body) {
-  const name = strOr(bget(body, 'name'));
-  const want = pyTruthy(bget(body, 'enabled'));
-  const pathArg = strOr(bget(body, 'path'));
+/**
+ * The MCP config paths a request body is allowed to name, as `path -> [path, host]`.
+ *
+ * LIFTED OUT OF `apiMcpToggle` BECAUSE IT NOW HAS A SECOND CALLER, not for tidiness. `/api/reveal`
+ * hands a path to the desktop's file manager, and the allowlist is the whole security of that
+ * endpoint exactly as it is of the toggle: an unlisted path must 404 before anything is opened.
+ * Two copies of a security check drift, and the copy that drifts is the one nobody re-read.
+ *
+ * It is rebuilt per call rather than cached: installs come and go while the daemon runs, and a
+ * stale allowlist is wrong in both directions — refusing a real target, or naming a dead one.
+ */
+export function mcpTargetPaths() {
   const known = new Map();
   for (const [, cfgPath, host] of mcpInstallTargets()) {
     known.set(String(cfgPath), [cfgPath, host]);
   }
+  return known;
+}
+
+export function apiMcpToggle(state, body) {
+  const name = strOr(bget(body, 'name'));
+  const want = pyTruthy(bget(body, 'enabled'));
+  const pathArg = strOr(bget(body, 'path'));
+  const known = mcpTargetPaths();
   const hit = known.get(pathArg);
   if (hit === undefined || !name) {
     throw new NotFound(`mcp target ${pathArg || '(none)'}`);
@@ -686,6 +732,13 @@ export function apiRestore(state, files) {
       footprint: state.footprint,
       posture: state.posture,
       mode: state.mode,
+      // THE PACK SELECTION IS THE FIFTH, and it is the one that makes this verb a BOUNDARY
+      // question rather than a cosmetic one. `expected` rendered at all four packs, and this
+      // verb COPIES OUT OF IT: restoring AGENT.md onto an install built `--doctrines craft`
+      // wrote a carrier stating doctrine process 5 while `claudeHookGroups` had wired no gate
+      // behind it — prompt and boundary disagreeing by a WRITE, the write-side twin of the
+      // read-side hole `diffCollect` had (and the reason the panel offered the file at all).
+      doctrines: doctrinesForBuild(target),
     }));
     for (const raw of (pyTruthy(files) ? files : [])) {
       const rel = pyStripSpace(pyStr(raw).replace(/\\/g, '/')).replace(/^\/+/, '');
@@ -765,8 +818,15 @@ export function apiInstallCmd(state, body) {
   const bmode = bget(body, 'mode');
   const mode = discoverNames('modes', 'direct').includes(bmode)
     ? bmode : (modeOfDir(root) || 'direct');
+  // Unspecified means "keep what this install already has", exactly as theme, footprint,
+  // posture and mode above do — a rebuild through the console is not a place to silently
+  // re-decide the constitution. ⚠ AND A CARRIER WITH NO `Active packs:` MARKER (a pre-2.3
+  // install) MUST NOT LAND ON `harness.config.json`: `doctrinesOfDir` answers `null` there,
+  // `null` elided the flag, and the generator's config fallback then narrowed the install and
+  // took its consent gate with it. `doctrinesForBuild` resolves unknown to ALL packs.
+  const doctrines = bodyDoctrines(body) ?? doctrinesForBuild(root);
   const out = scope === 'global' ? null : String(root);
-  const argv = setupBuildArgs(theme || 'neutral', emit, out, out, fp, pos, mode);
+  const argv = setupBuildArgs(theme || 'neutral', emit, out, out, fp, pos, mode, doctrines);
   return { cmd: [process.execPath, path.join(ROOT, 'bin', 'geneseed.mjs'), ...argv] };
 }
 
@@ -862,7 +922,14 @@ export function apiDeployCmd(state, body) {
   const pos = discoverNames('postures', 'peer').includes(bpos) ? bpos : 'peer';
   const bmode = bget(body, 'mode');
   const mode = discoverNames('modes', 'direct').includes(bmode) ? bmode : 'direct';
+  // Same resolution as `apiInstallCmd` above, and for the same reason: the console's Deploy
+  // form sends host/path/theme/footprint/posture/mode and NO pack selection, and nothing stops
+  // it landing on a directory that already holds an install. Taking `bodyDoctrines` alone left
+  // the flag off, the generator fell back to `harness.config.json`, and deploying onto an
+  // existing all-four Claude install dropped it to one pack — measured: 6 hook groups became 5
+  // and `PreToolUse::Bash` went with them. `doctrinesForBuild` resolves unknown to ALL packs.
+  const doctrines = bodyDoctrines(body) ?? doctrinesForBuild(root);
   // project-scope emit name == host name (opencode / claude / bob / copilot)
-  const argv = setupBuildArgs(theme || 'neutral', host, root, root, fp, pos, mode);
+  const argv = setupBuildArgs(theme || 'neutral', host, root, root, fp, pos, mode, doctrines);
   return { cmd: [process.execPath, path.join(ROOT, 'bin', 'geneseed.mjs'), ...argv] };
 }