geneseed 3.1.0 → 3.1.2

package/js/{hooks.mjs → hosts/hooks.mjs}

@@ -3,7 +3,7 @@
  *
  * These are the commands the emitted `settings.json` actually invokes on a user's machine,
  * every session: a SessionStart injector, two PreToolUse gates, and a Stop/SubagentStop
- * distiller. Since P5b they are also what the emitted hooks name: `bin/geneseed.mjs` bakes
+ * distiller. Since P5b they are also what the emitted hooks name: `bin/build-driver.mjs` bakes
  * `<node> <checkout>/bin/geneseed-hook.mjs` into the machine-wide shim, so an install this
  * driver emits has no Python in its hook path at all — which is what let the interpreter
  * discovery and its exit-4 refusal be deleted rather than merely bypassed.
@@ -14,7 +14,7 @@
  * ~11,600 lines and the generator behind them. This module loads none of that, and that is
  * deliberate rather than incidental: the Python originals already refuse to import `build`
  * for the marker filenames they need ("literals keep the hook dependency-free"), and
- * `bin/geneseed.mjs` could not be imported anyway, since its last statement runs the
+ * `bin/build-driver.mjs` could not be imported anyway, since its last statement runs the
  * generator. What that rule does NOT license is a second copy of a shared resolver under a
  * different name — see the primitives section below, where P5d found one that had silently
  * diverged from its twin.
@@ -26,24 +26,27 @@
  * failure has to be diagnosable, and its hook command carries `|| exit 0` for exactly that
  * reason.
  *
- * The gate is `tests/harness_golden.py`, which runs each verb through both CLIs in a
- * seeded sandbox and compares stdout, stderr, the exit code and every file left behind.
+ * The gate is `tests/helpers/cli_golden.mjs` replaying `tests/helpers/matrix/cli.{posix,win32}.json`:
+ * each verb run in a seeded sandbox, with ABSOLUTE assertions on stdout, stderr, the exit code
+ * and every file left behind. Absolute rather than compared is what let it survive the deletion
+ * of the implementation it was once compared against.
  */
 import { existsSync, statSync, readFileSync, readdirSync, mkdirSync, realpathSync }
   from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import { readText, writeText, jsonDumpsCompact, normcase, comparePaths, pyPathStr, pyPrint,
-  pyPrintErr, withDiscardableStderr } from './lib/fs.mjs';
-import { NO_WINDOW } from './lib/proc.mjs';
+import { readText, writeText, printOut, printErr, withDiscardableStderr } from '../lib/fs.mjs';
+import { jsonDumpsCompact } from '../lib/json.mjs';
+import { normcase, comparePaths, toPlatformPath } from '../lib/paths.mjs';
+import { NO_WINDOW } from '../lib/proc.mjs';
 // `harness status` reports the memory store, and `bin/geneseed-cli.mjs` cannot import THIS
 // module to find it: the CLI is under a hard transitive `child_process` ban and `learn`
-// spawns. So the resolver has one owner in `js/hosts.mjs` rather than a second copy — and
+// spawns. So the resolver has one owner in `js/hosts/hosts.mjs` rather than a second copy — and
 // with it went this file's private `opencodeConfigDir`, whose only caller it was.
 import { resolveMemoryDir, expanduser } from './hosts.mjs';
 
-const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const ROOT = path.dirname(path.dirname(path.dirname(fileURLToPath(import.meta.url))));
 
 // ---- Python path and text primitives -------------------------------------------------
 // Small, and each one is here because a JS-idiomatic equivalent differs observably.
@@ -52,8 +55,8 @@ const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 // coupling a hook to the emitter", with `readText`/`writeText`/`normcase` as the stated
 // exceptions. That is the wrong line, and `pyStrPath` is what proved it: it was a second
 // implementation of `str(Path(p))` under a different NAME from `js/lib/fs.mjs`'s
-// `pyPathStr`, and the two disagreed. P5c found that `path.normalize` collapses `a/../b`
-// where `PurePath` keeps it, fixed `pyPathStr`, and gated it with a 25-path corpus — and
+// `toPlatformPath`, and the two disagreed. P5c found that `path.normalize` collapses `a/../b`
+// where `PurePath` keeps it, fixed `toPlatformPath`, and gated it with a 25-path corpus — and
 // none of that reached this file, because a corpus finds what it is pointed at and nothing
 // named `pyStrPath` was. The consequence was live: `sovereignBypass` compares an
 // `excludes.json` entry against cwd, so a hand-edited `..` entry made the NODE hook stand
@@ -63,16 +66,16 @@ const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 // So the line is not "duplicate rather than couple" — it is "one owner for anything that
 // reproduces a language primitive, wherever it is used". `fs.mjs` carries no
 // `child_process` and costs nothing at hook latency. What stays local is what is genuinely
-// only the hook's (`fnmatch`, the transcript readers, `pyOsError`'s errno table).
+// only the hook's (`fnmatch`, the transcript readers, `asOsError`'s errno table).
 //
 // AND `expanduser` WAS THE SECOND VIOLATION, closed here. This file carried its own, which
-// returned a `~user` path UNCHANGED while `js/hosts.mjs`'s single owner REFUSES the form —
+// returned a `~user` path UNCHANGED while `js/hosts/hosts.mjs`'s single owner REFUSES the form —
 // an adjudicated product decision (`TheTildeUserFormIsADeliberateDivergence`) that the hook
 // was quietly exempt from because it had a private copy. It now imports the owner. The
 // refusal throws, so `sovereignBypass` and `cmdContext` below contain it per entry / per
 // call: a hook that CRASHES reports success, because these gates exit 0 and signal on
 // stdout, so "the gate blew up" and "the gate found nothing" are the same observation to
-// Claude. `pyResolve` just below is the THIRD copy of a primitive `js/hosts.mjs` also
+// Claude. `resolvePath` just below is the THIRD copy of a primitive `js/hosts/hosts.mjs` also
 // exports, and is the next item in this series.
 
 /**
@@ -82,7 +85,7 @@ const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
  * `excludes.json` may name a folder that was deleted), so the existing prefix is
  * canonicalised and the rest appended verbatim — `resolve(strict=False)`'s behaviour.
  */
-function pyResolve(p) {
+function resolvePath(p) {
   let cur = path.resolve(expanduser(p));
   const tail = [];
   for (;;) {
@@ -121,7 +124,7 @@ function selfAndParents(p) {
  * the other. The trailing empty is dropped the way Python drops it (`"a\n"` is one line,
  * `""` is none).
  */
-function pySplitlines(text) {
+function splitLines(text) {
   if (!text) return [];
   const parts = text.split(/\r\n|[\n\r\v\f\x1c\x1d\x1e\x85\u2028\u2029]/);
   if (parts.length && parts[parts.length - 1] === '') parts.pop();
@@ -129,7 +132,7 @@ function pySplitlines(text) {
 }
 
 /** `str.split()` with no argument — runs of whitespace, ends stripped, no empties. */
-function pyWords(s) {
+function splitWords(s) {
   return s.split(/\s+/).filter(Boolean);
 }
 
@@ -156,7 +159,7 @@ const _ERRNO = {
   EPERM: [1, 'Operation not permitted'],
 };
 
-function pyOsError(e, filename) {
+function asOsError(e, filename) {
   const hit = _ERRNO[e && e.code];
   if (!hit) return String((e && e.message) || e);
   // Python reprs the filename, so a Windows path comes out with its backslashes doubled.
@@ -208,10 +211,10 @@ function readStdin() {
 
 // The two output funnels, with Python's newline translation reproduced. They moved to
 // `js/lib/fs.mjs` in P5c — beside `writeText`, which is the same rule for FILES — when
-// `js/excludes.mjs` became the second caller; see that docblock for why the translation
+// `js/inspect/excludes.mjs` became the second caller; see that docblock for why the translation
 // exists and which gate can see it.
-const out = pyPrint;
-const err = pyPrintErr;
+const out = printOut;
+const err = printErr;
 
 // ======================================================================================
 // context — project-context discovery
@@ -243,7 +246,7 @@ export function globalHookStandingDown(hookRoot, cwd) {
     if (isFile(path.join(cand, GENESEED_MANIFEST))) {
       // Path equality, which is case-folded on Windows — `~/.claude` and `~/.Claude` are
       // the same install there and two different ones on Linux.
-      return normcase(pyResolve(cand)) !== normcase(pyResolve(hookRoot));
+      return normcase(resolvePath(cand)) !== normcase(resolvePath(hookRoot));
     }
   }
   return false;
@@ -265,7 +268,7 @@ export function sovereignBypass(root) {
   }
   let cwd;
   try {
-    cwd = normcase(pyResolve(process.cwd()));
+    cwd = normcase(resolvePath(process.cwd()));
   } catch {
     return false;
   }
@@ -281,7 +284,7 @@ export function sovereignBypass(root) {
       // and this caller catches: the reference prints nothing here, so replaying the
       // message would be a stderr divergence on every hook call for one bad entry.
       base = withDiscardableStderr(
-        () => normcase(pyPathStr(expanduser(raw.trim()))).replace(/[\\/]+$/, ''));
+        () => normcase(toPlatformPath(expanduser(raw.trim()))).replace(/[\\/]+$/, ''));
     } catch {
       // PER ENTRY, and the loop continues. One unusable line in a file the USER hand-edits
       // must not decide the whole function — `expanduser` refuses a `~user` form, and the
@@ -381,7 +384,7 @@ export function resolveContextSets(root) {
   if (env && isFile(env)) {
     // `Path(env)`, and the label is printed — so the separators are folded exactly the
     // way `str(Path(...))` folds them, or the source line differs by every slash in it.
-    manifest = pyPathStr(env);
+    manifest = toPlatformPath(env);
   } else {
     for (const cand of [path.join(root, '.harness', 'context.json'),
       path.join(root, 'context.json')]) {
@@ -398,7 +401,7 @@ export function resolveContextSets(root) {
   try {
     raw = readText(manifest);
   } catch (e) {
-    err(`[context] could not read ${manifest}: ${pyOsError(e, manifest)}\n`);
+    err(`[context] could not read ${manifest}: ${asOsError(e, manifest)}\n`);
     return [[], [], String(manifest)];
   }
   let entries;
@@ -453,7 +456,7 @@ export function resolveContextSets(root) {
       }
       continue;
     }
-    const abs = path.isAbsolute(raw) ? raw : pyResolve(path.join(root, raw));
+    const abs = path.isAbsolute(raw) ? raw : resolvePath(path.join(root, raw));
     put(abs, load, desc);
   }
 
@@ -468,8 +471,8 @@ export function resolveContextSets(root) {
 export function cmdContext(args) {
   // Discovery runs against the project root the hook was launched from — Claude runs
   // SessionStart hooks with cwd = repo root — not the harness package dir.
-  // The only two `pyResolve` calls in this file whose argument can be a `~user` path the
-  // user typed — `$GENESEED_ROOT` and `--root` — and `pyResolve` expands, so both can now
+  // The only two `resolvePath` calls in this file whose argument can be a `~user` path the
+  // user typed — `$GENESEED_ROOT` and `--root` — and `resolvePath` expands, so both can now
   // throw. Every other caller either builds its argument by `path.join` from an absolute
   // root (so no leading tilde survives) or already sits inside a `try`. Refused input
   // injects nothing, which is the same degrade as "nothing to load" below.
@@ -477,8 +480,8 @@ export function cmdContext(args) {
   let hookRoot;
   try {
     ({ root, hookRoot } = withDiscardableStderr(() => ({
-      root: pyResolve(process.env.GENESEED_ROOT || process.cwd()),
-      hookRoot: args.root ? pyResolve(args.root) : null,
+      root: resolvePath(process.env.GENESEED_ROOT || process.cwd()),
+      hookRoot: args.root ? resolvePath(args.root) : null,
     })));
   } catch {
     return 0;
@@ -505,7 +508,7 @@ export function cmdContext(args) {
     try {
       lines.push(readText(target).replace(/\n+$/, ''));
     } catch (e) {
-      lines.push(`[context] MISSING eager file: ${pyOsError(e, target)}`);
+      lines.push(`[context] MISSING eager file: ${asOsError(e, target)}`);
     }
     lines.push('');
   }
@@ -583,9 +586,9 @@ export function ruleGateTarget(p, root) {
   if (name === 'memory.md') return 'the memory index';
   if (!root || !name.endsWith('.md')) return null;
   try {
-    const store = normcase(pyResolve(path.join(root, 'memory')));
+    const store = normcase(resolvePath(path.join(root, 'memory')));
     // `.parents`, so the store dir itself is not one of its own ancestors.
-    return selfAndParents(pyResolve(p)).slice(1).some((d) => normcase(d) === store)
+    return selfAndParents(resolvePath(p)).slice(1).some((d) => normcase(d) === store)
       ? 'memory' : null;
   } catch {
     return null;
@@ -660,11 +663,11 @@ export function appendAgentLesson(memDir, agent, lesson) {
   mkdirSync(d, { recursive: true });
   const f = path.join(d, `${agent}.md`);
   let bullets = [];
-  if (existsSync(f)) bullets = pySplitlines(readText(f)).filter((l) => l.startsWith('- '));
+  if (existsSync(f)) bullets = splitLines(readText(f)).filter((l) => l.startsWith('- '));
   const now = new Date();
   const day = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, '0')}-`
     + `${String(now.getDate()).padStart(2, '0')}`;
-  bullets.push(`- ${day}: ${pyWords(lesson).join(' ')}`);
+  bullets.push(`- ${day}: ${splitWords(lesson).join(' ')}`);
   bullets = bullets.slice(-MAX_AGENT_BULLETS);
   writeText(f, `# ${agent} \u2014 lessons\n${bullets.join('\n')}\n`);
   return f;
@@ -703,7 +706,7 @@ function flattenTranscript(p) {
     return '';
   }
   const acc = [];
-  for (let line of pySplitlines(raw)) {
+  for (let line of splitLines(raw)) {
     line = line.trim();
     if (!line) continue;
     let obj;
@@ -747,7 +750,7 @@ export function readNotes(raw) {
   return raw;
 }
 
-// `resolveMemoryDir` moved to `js/hosts.mjs` in P5d — see the import at the top of this
+// `resolveMemoryDir` moved to `js/hosts/hosts.mjs` in P5d — see the import at the top of this
 // file. Re-exported here so the hook entry's own import list does not change.
 export { resolveMemoryDir };
 
@@ -764,7 +767,7 @@ export function frontmatter(md) {
   const m = FRONTMATTER_RE.exec(md);
   if (!m) return [new Map(), md];
   const fm = new Map();
-  for (const line of pySplitlines(m[1])) {
+  for (const line of splitLines(m[1])) {
     const at = line.indexOf(':');
     if (at >= 0) {
       // `str.strip('"')` strips the character from BOTH ends, however many there are.
@@ -853,7 +856,7 @@ export function memoryDropIndex(memDir, name) {
   const idx = path.join(memDir, 'MEMORY.md');
   let lines;
   try {
-    lines = pySplitlines(readText(idx));
+    lines = splitLines(readText(idx));
   } catch {
     return;                       // the reference's `except OSError: return`
   }
@@ -882,7 +885,7 @@ export function consolidateMemory(memDir) {
   const index = path.join(memDir, 'MEMORY.md');
   const oldSlugs = new Set();
   if (existsSync(index)) {
-    for (const line of pySplitlines(readText(index))) {
+    for (const line of splitLines(readText(index))) {
       const m = /^- \[[^\]]*\]\(([^)]+)\.md\)/.exec(line.trim());
       if (m) oldSlugs.add(m[1]);
     }
@@ -912,7 +915,7 @@ export function consolidateMemory(memDir) {
  * would truncate a long reply into a silently-half-parsed set of memory files.
  */
 function runLlm(llm, prompt) {
-  const argv = pyWords(llm);
+  const argv = splitWords(llm);
   // `_harness_learn.py:85` runs this through the wrapped `run(..., capture_output=True)`,
   // which folds in `CREATE_NO_WINDOW`; a model CLI invoked from the windowless daemon
   // otherwise pops a console for as long as it takes to answer.
@@ -958,7 +961,7 @@ function learnAgentLesson(meta, notes, args) {
   const proc = runLlm(llm, prompt);
   const text = proc.stdout.trim();
   if (text && text.toUpperCase() !== 'NOTHING') {
-    const lesson = pySplitlines(text)[0].replace(/^[-*]+/, '').trim();
+    const lesson = splitLines(text)[0].replace(/^[-*]+/, '').trim();
     const n = Array.from(lesson).length;   // code points, as `len()` counts them
     if (n >= 10 && n <= 300) {
       err(`[learn] agent lesson -> ${appendAgentLesson(memDir, agent, lesson)}\n`);
@@ -985,7 +988,7 @@ export function cmdLearn(args) {
 
   // The Stop/SubagentStop hook always passes `--memory <cfg>/memory`; inside an excluded
   // folder the global install must not learn.
-  if (args.memory && sovereignBypass(path.dirname(pyPathStr(args.memory)))) return 0;
+  if (args.memory && sovereignBypass(path.dirname(toPlatformPath(args.memory)))) return 0;
 
   const raw = args.file ? readText(args.file) : readStdin();
   let notes = readNotes(raw);

package/js/{hosts.mjs → hosts/hosts.mjs}

@@ -1,22 +1,24 @@
 /**
  * The four host config dirs, and the two path primitives they are built on.
  *
- * EXTRACTED IN P5c, and the reason is arithmetic rather than taste. `bin/geneseed.mjs`
+ * EXTRACTED IN P5c, and the reason is arithmetic rather than taste. `bin/build-driver.mjs`
  * owned these; `bin/geneseed-cli.mjs` needs the same four to find a global install, and a
  * resolver that decides WHERE a driver writes is the last thing that should exist twice.
- * `js/hooks.mjs` carries a third copy of `opencodeConfigDir` on purpose — the hook path is
- * deliberately dependency-free and says so — but the CLI has no such reason, so this is one
- * owner for both drivers rather than a second exception.
- *
- * The move is a pure one, which is why it could be made at all: `tests/golden.py` runs
- * `bin/geneseed.mjs` over 259 cells and compares the tree byte-for-byte, and roughly half
- * of those resolve a global config dir. A move that changed one of these by a character
- * fails ~126 cells, not zero.
+ * `js/hosts/hooks.mjs` USED to carry a third copy of `opencodeConfigDir`, on the rule that the
+ * hook path stays dependency-free; P5d deleted it when `resolveMemoryDir` moved here and the
+ * hook became an importer instead. This module is now the single owner for both drivers AND
+ * for the hook.
+ *
+ * The move is a pure one. What holds it is no longer a byte corpus — `tests/golden.mjs`'s two
+ * modes compare a run against another run of the SAME generator, so they would follow a
+ * changed resolver rather than catch it — but `tests/unit/node_driver.test.mjs`'s relocation
+ * table, which asserts each host's global target absolutely.
  */
 import { realpathSync, statSync } from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
-import { pyPathStr, pyPrintErr, withDiscardableStderr } from './lib/fs.mjs';
+import { printErr, withDiscardableStderr } from '../lib/fs.mjs';
+import { toPlatformPath } from '../lib/paths.mjs';
 
 const isDir = (p) => { try { return statSync(p).isDirectory(); } catch { return false; } };
 
@@ -24,8 +26,8 @@ const isDir = (p) => { try { return statSync(p).isDirectory(); } catch { return
 export const GLOBAL_MANIFEST = '.geneseed-manifest.json';
 
 /**
- * `_build_core.VERSION_MARKER`. Third caller, so it moves here — `js/emit.mjs` and
- * `js/diff.mjs` each had a private const of their own and `js/uninstall.mjs` would have made
+ * `_build_core.VERSION_MARKER`. Third caller, so it moves here — `js/build/version.mjs` and
+ * `js/inspect/diff.mjs` each had a private const of their own and `js/maintain/uninstall.mjs` would have made
  * a third copy of a value whose whole job is being the same string everywhere. Same
  * arithmetic that put `GLOBAL_MANIFEST` above it.
  */
@@ -66,7 +68,7 @@ export function expanduser(p) {
     const msg = `refusing '${p}': a '~user' path is not expanded by this port (Python's `
       + "ntpath/posixpath would guess a home directory for 'user' — this port does not); "
       + 'pass an absolute path, or "~" / "~/…" for your own home directory';
-    pyPrintErr(`${msg}\n`);
+    printErr(`${msg}\n`);
     const e = new Error(msg);
     e.exitCode = 1;
     throw e;
@@ -83,7 +85,7 @@ export function expanduser(p) {
  * the part that exists and appends the rest verbatim, so that is what this reproduces.
  * It matters because the resolved directory is printed on stdout and compared byte-for-byte.
  */
-export function pyResolve(p) {
+export function resolvePath(p) {
   let cur = path.resolve(expanduser(p));
   const tail = [];
   for (;;) {
@@ -100,7 +102,7 @@ export function pyResolve(p) {
 
 /**
  * `_build_core._opencode_config_dir` — and the four resolvers like it are the reason
- * `bin/geneseed.mjs` exists rather than a child doing the work.
+ * `bin/build-driver.mjs` exists rather than a child doing the work.
  *
  * P3c's rule was "the child must never resolve this": a render child that did would write
  * 135 files into the developer's real `~/.config/opencode`. A driver is the PARENT, so the
@@ -109,10 +111,10 @@ export function pyResolve(p) {
  */
 export function opencodeConfigDir() {
   const env = process.env.OPENCODE_CONFIG_DIR;
-  if (env) return pyResolve(env);
+  if (env) return resolvePath(env);
   const xdg = process.env.XDG_CONFIG_HOME;
   const base = xdg ? expanduser(xdg) : path.join(os.homedir(), '.config');
-  return pyResolve(path.join(base, 'opencode'));
+  return resolvePath(path.join(base, 'opencode'));
 }
 
 /**
@@ -125,8 +127,8 @@ export function opencodeConfigDir() {
  */
 export function copilotConfigDir() {
   const env = process.env.COPILOT_CONFIG_DIR;
-  if (env) return pyResolve(env);
-  return pyResolve(path.join(os.homedir(), '.copilot'));
+  if (env) return resolvePath(env);
+  return resolvePath(path.join(os.homedir(), '.copilot'));
 }
 
 /**
@@ -141,14 +143,14 @@ export function copilotConfigDir() {
  * as an omission.
  */
 export function claudeConfigDir() {
-  return pyResolve(path.join(os.homedir(), '.claude'));
+  return resolvePath(path.join(os.homedir(), '.claude'));
 }
 
 /** `_build_core._bob_config_dir` — `~/.bob`, relocatable via `$BOB_CONFIG_DIR`. */
 export function bobConfigDir() {
   const env = process.env.BOB_CONFIG_DIR;
-  if (env) return pyResolve(env);
-  return pyResolve(path.join(os.homedir(), '.bob'));
+  if (env) return resolvePath(env);
+  return resolvePath(path.join(os.homedir(), '.bob'));
 }
 
 /**
@@ -158,14 +160,14 @@ export function bobConfigDir() {
  * An array rather than an object because the order is observable output, not an
  * implementation detail: `harness exclude add` walks it and prints one message per host, so
  * a reordering is a diff in stderr. (`emit_global` and `native_catalog` stay out;
- * `bin/geneseed.mjs` receives those decisions from its own dispatch rather than reading a
+ * `bin/build-driver.mjs` receives those decisions from its own dispatch rather than reading a
  * table.)
  *
  * `projectMarker` joined in P5f. `_install_targets` asks "does this cwd carry a project
  * install of host H", and `_claude_cfg` asks "which subdir holds a project install's
  * manifest" — both are the same `.opencode`/`.claude`/`.bob`/`.github` value the Python reads
  * out of `build.HOSTS[host]["project_marker"]`, so it belongs beside the config dir rather
- * than in a second table in `js/installs.mjs`.
+ * than in a second table in `js/hosts/installs.mjs`.
  *
  * `agentFile` joined in P5h, and for one caller: `cmd_uninstall` names the managed block's
  * carrier in its "removes:" preamble (`the CLAUDE.md managed block`, `the AGENTS.md managed
@@ -213,7 +215,7 @@ const MEMORY_DIR_NAMES = ['memory', 'anamnesis'];
  * The last two matter for the recommended opencode-global install, whose store lives in
  * `~/.config/opencode` rather than beside any repo. null => stdout-only.
  *
- * HERE rather than in `js/hooks.mjs`, where it was written, because P5d gave it a second
+ * HERE rather than in `js/hosts/hooks.mjs`, where it was written, because P5d gave it a second
  * caller that cannot import that file: `bin/geneseed-cli.mjs` is under a transitive
  * `child_process` ban and `learn` spawns the model CLI. This module is the one both can
  * reach, and it already owns the `opencodeConfigDir` the last fallback needs — so the move
@@ -221,18 +223,18 @@ const MEMORY_DIR_NAMES = ['memory', 'anamnesis'];
  */
 export function resolveMemoryDir(explicit) {
   if (explicit) {
-    const p = pyPathStr(explicit);
+    const p = toPlatformPath(explicit);
     return isDir(p) ? p : null;
   }
   const env = process.env.GENESEED_MEMORY;
-  if (env && isDir(env)) return pyPathStr(env);
+  if (env && isDir(env)) return toPlatformPath(env);
   const cwd = process.cwd();
   const bases = [cwd, path.join(cwd, 'Harness')];
   const gh = process.env.GENESEED_HARNESS;
   if (gh) {
     // PER BASE, and the walk continues. `$GENESEED_HARNESS` is the FOURTH user-controlled
     // tilde input and the one the `~user` refusal was never swept onto: `expanduser` throws
-    // on `~someone/x`, and this resolver is reached by `geneseed status` (js/status.mjs's
+    // on `~someone/x`, and this resolver is reached by `geneseed status` (js/inspect/status.mjs's
     // `resolveMemoryDir(null)`) and by the `learn` hook, whose entry point
     // (`bin/geneseed-hook.mjs`) has NO top-level try — so an unguarded throw here is a stack
     // trace on a hook path and a non-zero exit, the exact failure the other three guards

package/js/{installs.mjs → hosts/installs.mjs}

@@ -2,9 +2,9 @@
  * How a DEPLOYED install is recognised — `_harness_setup`'s detection half and
  * `_harness_mcp`'s registry-reading half, which are one subject in two Python files.
  *
- * EXTRACTED IN P5f, and by the same arithmetic that produced `js/hosts.mjs` and
- * `js/checkout.mjs`: this is the third verb-set to need it. P5d wrote `themeOfDir` and
- * `footprintOfDir` inside `js/status.mjs` because `status` was the only caller; `diff`
+ * EXTRACTED IN P5f, and by the same arithmetic that produced `js/hosts/hosts.mjs` and
+ * `js/build/source.mjs`: this is the third verb-set to need it. P5d wrote `themeOfDir` and
+ * `footprintOfDir` inside `js/inspect/status.mjs` because `status` was the only caller; `diff`
  * renders its 'expected' copy in the theme and footprint the deployment actually uses, and
  * `rebuild-all` re-emits every install in its own theme, emit, footprint, posture and mode.
  * Three callers of one detector is where a private helper becomes a module.
@@ -32,13 +32,15 @@
  * web cells recorded it. Both candidates are gone (the argument is in the Python), and the
  * claim is now true rather than aspirational.
  */
-import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { existsSync, readdirSync, statSync } from 'node:fs';
 import path from 'node:path';
 
-import { CONFIG, PACK_ORDER, THEMES, discoverNames } from './checkout.mjs';
-import { GLOBAL_MANIFEST, HOSTS, pyResolve } from './hosts.mjs';
-import { registryRoots } from './registry.mjs';
-import { comparePaths, pyPrintErr, pyRepr, readText } from './lib/fs.mjs';
+import { CONFIG, PACK_ORDER, THEMES, discoverNames } from '../build/source.mjs';
+import { GLOBAL_MANIFEST, HOSTS, resolvePath } from './hosts.mjs';
+import { registryRoots } from '../inspect/registry.mjs';
+import { printErr, readText } from '../lib/fs.mjs';
+import { formatRepr } from '../lib/json.mjs';
+import { comparePaths } from '../lib/paths.mjs';
 
 const isDir = (p) => { try { return statSync(p).isDirectory(); } catch { return false; } };
 const isFile = (p) => { try { return statSync(p).isFile(); } catch { return false; } };
@@ -99,7 +101,7 @@ export const defaultMode = () => configuredDefault('mode', 'direct');
 // pre-2.3 install on its first upgrade — `{"doctrines":["craft"]}` and the gate is gone from
 // carriers that never asked. Unknown resolves to ALL packs; see `doctrinesForBuild` below.
 // The config value keeps exactly one legitimate reader: `configDefaults()` in
-// `bin/geneseed.mjs`, which answers `geneseed build` — the case where there is no install to
+// `bin/build-driver.mjs`, which answers `geneseed build` — the case where there is no install to
 // ask in the first place.
 
 // ---- theme, footprint, posture, mode, read back off a deployed tree -----------------------
@@ -180,7 +182,7 @@ export function footprintOfDir(d) {
     const v = (readMaybe(marker) ?? '').trim();
     if (FOOTPRINTS.includes(v)) return v;
     if (v) {
-      pyPrintErr(`[geneseed] WARN: ${marker} holds unknown footprint ${pyRepr(v)} — `
+      printErr(`[geneseed] WARN: ${marker} holds unknown footprint ${formatRepr(v)} — `
         + `reading it as 'full'. Known: ${FOOTPRINTS.join(', ')}.\n`);
     }
   }
@@ -202,7 +204,7 @@ export function footprintOfDir(d) {
  * lowercasing. Every shipped name is already lowercase, which is exactly why the difference
  * would go unnoticed — the corpus in `tests/test_pure_function_parity.py` is what covers it.
  */
-export function pyCapitalize(s) {
+export function capitalize(s) {
   return s.length ? s[0].toUpperCase() + s.slice(1).toLowerCase() : s;
 }
 
@@ -211,7 +213,7 @@ function leadOfDir(d, names) {
     const text = readMaybe(path.join(d, carrier));
     if (text === null) continue;
     for (const name of names) {
-      if (text.includes(`**${pyCapitalize(name)}**`)) return name;
+      if (text.includes(`**${capitalize(name)}**`)) return name;
     }
   }
   return null;
@@ -281,7 +283,7 @@ export function doctrinesOfDir(d) {
  * got WIDER when the reader was hardened, because more inputs now answer `null`.
  *
  * A config value is a legitimate default only where there is NO INSTALL TO ASK: a fresh
- * `geneseed build`, which `configDefaults()` in `bin/geneseed.mjs` answers. Anything holding a
+ * `geneseed build`, which `configDefaults()` in `bin/build-driver.mjs` answers. Anything holding a
  * directory has an install to ask, so it calls this and never the config.
  *
  * `[]` still passes through untouched — a marker that reads `none` is an answer, not a silence.
@@ -290,6 +292,47 @@ export function doctrinesForBuild(d) {
   return doctrinesOfDir(d) ?? [...PACK_ORDER];
 }
 
+/** `Excluded rules: process 7, craft 3` — the marker's optional second line. */
+const EXCLUDED_RULES_RE = /^Excluded rules:[ \t]*(.+?)[ \t]*$/m;
+
+/**
+ * The individual doctrine rules a DEPLOYED install left out — the second axis, read back.
+ *
+ * ⚠ ITS NULL SEMANTICS ARE THE OPPOSITE OF `doctrinesOfDir`'S, AND THAT IS THE POINT. A
+ * missing `Active packs:` line means "this install does not say", which has to resolve to
+ * ALL packs or a pre-migration install loses its consent gate on the next upgrade. A missing
+ * `Excluded rules:` line means "nothing was excluded" — because the line is only ever written
+ * when something is, so its absence is a STATEMENT rather than a silence. Both answers fail
+ * closed: unknown packs bind the most, unknown exclusions take away the least. They only look
+ * inconsistent until you ask which direction is safe for each.
+ *
+ * That is also what makes this backward compatible by construction: every install that exists
+ * today has no such line, reads as `[]`, and behaves exactly as it does now.
+ *
+ * A malformed entry condemns the whole line to `[]` rather than to the part that parsed —
+ * same rule as the pack list, same reason, opposite default. Half an exclusion list would
+ * take away rules nobody named.
+ */
+export function excludedRulesOfDir(d) {
+  for (const carrier of CARRIERS) {
+    const text = readMaybe(path.join(d, carrier));
+    if (text === null) continue;
+    const m = EXCLUDED_RULES_RE.exec(text);
+    if (!m) continue;
+    if (m[1] === 'none') return [];
+    const named = m[1].split(',').map((s) => s.trim());
+    // `<pack> <n>` on the page, `<pack>.<n>` in the code — the same asymmetry the rendered
+    // line documents. A name this checkout does not ship is a corrupt line, not a hint.
+    const ids = named.map((s) => {
+      const parts = s.split(/[ \t]+/);
+      return parts.length === 2 && PACK_ORDER.includes(parts[0]) && /^\d+$/.test(parts[1])
+        ? `${parts[0]}.${Number(parts[1])}` : null;
+    });
+    return ids.every(Boolean) ? [...new Set(ids)].sort() : [];
+  }
+  return [];
+}
+
 // ---- what host a deployed dir belongs to (`_harness_mcp`) ---------------------------------
 
 /** `_harness_mcp._claude_read_manifest`. */
@@ -377,7 +420,7 @@ export function registeredTargets() {
  * De-duplicated on the (host, RESOLVED path) pair, which is three behaviours in one rule: a
  * cwd carrying both `.opencode/` and `.claude/` yields two correctly-typed rows, a cwd that
  * IS a global config dir never doubles its own host's row, and a registered root that is also
- * the cwd never doubles either. `pyResolve` rather than `path.resolve` because Python's
+ * the cwd never doubles either. `resolvePath` rather than `path.resolve` because Python's
  * `Path.resolve()` returns the filesystem's own casing — on Windows two spellings of the same
  * directory differ as strings and not as installs, and this Set is keyed by string.
  */
@@ -392,12 +435,12 @@ export function installTargets() {
     if (scope !== 'global') {
       try {
         const spec = HOSTS.find((h) => h.host === host);
-        if (pyResolve(path.join(root, spec.projectMarker)) === pyResolve(spec.configDir())) {
+        if (resolvePath(path.join(root, spec.projectMarker)) === resolvePath(spec.configDir())) {
           return;
         }
       } catch { /* as the Python's bare `except Exception: pass` */ }
     }
-    const key = `${host}\0${pyResolve(root)}`;
+    const key = `${host}\0${resolvePath(root)}`;
     if (!seen.has(key)) { seen.add(key); out.push([host, scope, root]); }
   };
 
@@ -437,6 +480,7 @@ export function installTargets() {
 export function installedDefaults() {
   const found = {
     theme: null, posture: null, mode: null, emit: null, footprint: null, doctrines: null,
+    excludeRules: null,
   };
   const candidates = [];
   for (const { host, configDir } of HOSTS) {
@@ -470,6 +514,14 @@ export function installedDefaults() {
     // for a carrier with no marker, which would end this walk at the FIRST candidate and hide
     // a later carrier that does say. The null has to survive to the caller here.
     if (found.doctrines === null) found.doctrines = doctrinesOfDir(base);
+    // ⚠ THE PER-RULE AXIS HAS ONLY TWO STATES, so the walk cannot use `=== null` to mean
+    // "keep looking" the way the line above does — `excludedRulesOfDir` answers `[]` for a
+    // carrier that excludes nothing AND for one with no marker at all, and the empty list is a
+    // real answer. An EMPTY answer therefore keeps the walk going and a non-empty one stops it:
+    // the first carrier on this machine that actually names an exclusion is the one that
+    // pre-selects. The cost of that choice is that "excludes nothing" and "no carrier" are
+    // indistinguishable here, which is exactly what the marker itself already says.
+    if (!found.excludeRules?.length) found.excludeRules = excludedRulesOfDir(base);
   }
   return found;
 }