geneseed 3.1.1 → 3.1.2

package/web/dist/assets/{index-Dg58ScBe.js → index-DGM5j2hB.js}

@@ -1,2 +1,2 @@
-import{h as _,j as e,g,I as N,u as w,E as S,L as E,a as T}from"./index-CH_Z725C.js";import{r as p}from"./react-DOpiTn5v.js";import{m as I}from"./marked.esm-JKvyS0Pp.js";const R="geneseed-harness",P=[{id:"opencode",label:"OpenCode"},{id:"claude",label:"Claude Code"}];function A(){return _(R,s=>s==="claude"||s==="opencode"?s:"opencode")}function $(s,n=0){const a=String(s).toLowerCase().trim().replace(/[^a-z0-9\s-]/g,"").replace(/\s+/g,"-").replace(/-+/g,"-").replace(/^-+|-+$/g,"");return a&&/^[a-z]/.test(a)?a:`h-${n}-${a||"section"}`}function y(s,n){if(!s||!n)return null;try{return s.querySelector(n)}catch{return null}}function H(s){const n=[];let a=!1,l=0;for(const r of(s||"").split(`
+import{h as _,j as e,g,I as N,u as w,E as S,L as E,a as T}from"./index-BgIs5eIa.js";import{r as p}from"./react-DOpiTn5v.js";import{m as I}from"./marked.esm-JKvyS0Pp.js";const R="geneseed-harness",P=[{id:"opencode",label:"OpenCode"},{id:"claude",label:"Claude Code"}];function A(){return _(R,s=>s==="claude"||s==="opencode"?s:"opencode")}function $(s,n=0){const a=String(s).toLowerCase().trim().replace(/[^a-z0-9\s-]/g,"").replace(/\s+/g,"-").replace(/-+/g,"-").replace(/^-+|-+$/g,"");return a&&/^[a-z]/.test(a)?a:`h-${n}-${a||"section"}`}function y(s,n){if(!s||!n)return null;try{return s.querySelector(n)}catch{return null}}function H(s){const n=[];let a=!1,l=0;for(const r of(s||"").split(`
 `)){if(r.startsWith("```")){a=!a;continue}if(a)continue;const d=r.match(/^(##|###)\s+(.+?)\s*$/);d&&(l+=1,n.push({level:d[1].length,title:d[2],id:$(d[2],l)}))}return n}function M(s,n){const a=new Map((n||[]).map(r=>[r.label,r])),l=(s||"").replace(/\[\[([^\]]+)\]\]/g,(r,d)=>{const i=a.get(d.trim());return i?`[${i.label}](#/item/${i.type}/${encodeURIComponent(i.name)})`:r});return I.parse(l,{breaks:!1})}const q={"opencode-global":"path-a-opencode-global-recommended","opencode-per-repo":"path-b-opencode-per-repo","claude-code":"path-c-claude-code","agent-md":"path-d-any-agentmd-tool",bundle:"path-d-any-agentmd-tool"};function O({page:s,overview:n,onAction:a}){const l=p.useRef(null),r=p.useMemo(()=>H(s.body),[s.body]),d=p.useMemo(()=>M(s.body,s.links),[s.body,s.links]);p.useEffect(()=>{const t=l.current;if(!t)return;let o=0;t.querySelectorAll("h1, h2, h3").forEach(u=>{if(o+=1,!u.id){const x=$(u.textContent||"",o);x&&(u.id=x)}})},[d]),p.useEffect(()=>{const t=l.current;if(!t)return;const o=u=>{const x=u.target.closest("a[href]");if(!x)return;const f=x.getAttribute("href");f&&f.startsWith("#/")&&(u.preventDefault(),g(f))};return t.addEventListener("click",o),()=>t.removeEventListener("click",o)},[d]),p.useEffect(()=>{const t=s.anchor;if(!t)return;const o=y(l.current,`#${CSS.escape(t)}`);o&&o.scrollIntoView({behavior:"smooth",block:"start"})},[d,s.anchor]),p.useEffect(()=>{const t=l.current;if(!t||s.id!=="install-paths")return;t.querySelectorAll(".docs-here").forEach(x=>x.classList.remove("docs-here"));const o=q[n==null?void 0:n.emit];if(!o)return;const u=y(t,`#${CSS.escape(o)}`);u&&u.classList.add("docs-here")},[d,s.id,n==null?void 0:n.emit]);const i=t=>{if(!t)return;const o=y(l.current,`#${CSS.escape(t)}`);o&&o.scrollIntoView({behavior:"smooth",block:"start"})},j=r.length>=3,m=[];return(s.id==="install-paths"||s.id==="install-quick")&&(m.push({label:"Run doctor",action:"doctor"}),m.push({label:"Rebuild",action:"build"})),s.id==="verify"&&m.push({label:"Run doctor",action:"doctor"}),s.id==="self-improve"&&m.push({label:"Open diff",hash:"#/diff"}),s.id==="upgrade"&&m.push({label:"Update",action:"update"}),e.jsxs("div",{className:"detail-doc",children:[e.jsx("h1",{style:{marginTop:0},children:s.title}),s.source&&e.jsx("div",{className:"doc-meta",children:e.jsxs("span",{className:"badge",children:[e.jsx("span",{className:"dot"}),s.source]})}),m.length>0&&e.jsx("div",{className:"row wrap gap-10",style:{margin:"10px 0 14px"},children:m.map(t=>t.hash?e.jsx("a",{className:"btn ghost sm",href:t.hash,children:t.label},t.label):e.jsx("button",{className:"btn ghost sm",onClick:()=>a&&a(t.action),children:t.label},t.label))}),j&&e.jsxs("div",{className:"docs-toc",children:[e.jsx("div",{className:"docs-toc-head",children:"On this page"}),e.jsx("ul",{children:r.map(t=>e.jsx("li",{className:`lvl-${t.level}`,children:e.jsx("a",{href:`#${t.id}`,onClick:o=>{o.preventDefault(),i(t.id)},children:t.title})},t.id))})]}),e.jsx("div",{className:"markdown",ref:l,dangerouslySetInnerHTML:{__html:d}}),s.link&&e.jsx("div",{style:{marginTop:24},children:e.jsx("a",{className:"btn soft sm",href:s.link.hash,children:s.link.label})})]})}const U=1200;function k({a:s,kind:n}){const a=n==="positional"?s.dest:s.names.join(", "),l=[];return s.metavar&&l.push(s.metavar),s.choices&&l.push(`{${s.choices.join("|")}}`),s.default!==null&&s.default!==void 0&&s.default!==""&&!s.is_flag&&l.push(`default: ${s.default}`),s.required&&l.push("required"),e.jsxs("div",{className:"cli-arg",children:[e.jsx("code",{className:"cli-arg-name",children:a}),l.length>0&&e.jsxs("code",{className:"cli-arg-meta",children:[" ",l.join(" · ")]}),s.help&&e.jsx("div",{className:"cli-arg-help",children:s.help})]})}function D({text:s}){const[n,a]=p.useState(!1),l=async()=>{try{await navigator.clipboard.writeText(s),a(!0),setTimeout(()=>a(!1),U)}catch{}};return e.jsxs("button",{className:"btn ghost sm",onClick:l,title:"Copy command",children:[e.jsx(N,{name:n?"spark":"copy"}),n?"Copied":"Copy"]})}function F({cmd:s,prog:n}){const a=[n,s.name];for(const r of s.positionals||[]){const d=(r.metavar||r.dest||"").toUpperCase();a.push(r.required?d:`[${d}]`)}(s.options||[]).length&&a.push("[OPTIONS]");const l=a.join(" ");return e.jsxs("div",{className:"card pad-md mb-12 cli-card",children:[e.jsxs("div",{className:"row wrap between",style:{alignItems:"flex-start"},children:[e.jsxs("div",{className:"stack",style:{gap:4},children:[e.jsx("h3",{style:{margin:0},children:e.jsx("code",{children:s.name})}),s.help&&e.jsx("p",{className:"sub",style:{margin:0},children:s.help})]}),e.jsx(D,{text:`${n} ${s.name}`})]}),e.jsx("pre",{className:"cli-syn",children:l}),(s.positionals||[]).length>0&&e.jsxs("div",{className:"cli-block",children:[e.jsx("div",{className:"cli-block-head",children:"Arguments"}),s.positionals.map(r=>e.jsx(k,{a:r,kind:"positional"},r.dest))]}),(s.options||[]).length>0&&e.jsxs("div",{className:"cli-block",children:[e.jsx("div",{className:"cli-block-head",children:"Options"}),s.options.map(r=>e.jsx(k,{a:r,kind:"option"},r.names.join(",")))]})]})}function G({page:s}){const n=s.prog||"geneseed",a=s.commands||[];return e.jsxs("div",{className:"detail-doc",children:[e.jsx("h1",{style:{marginTop:0},children:s.title}),e.jsxs("p",{className:"sub",style:{marginTop:4},children:["Every subcommand of ",e.jsx("code",{children:n}),". Generated from the parser at request time (the same one ",e.jsx("code",{children:"geneseed"})," actually parses), so this page cannot drift."]}),e.jsx("div",{style:{marginTop:18},children:a.map(l=>e.jsx(F,{cmd:l,prog:n},l.name))})]})}function z({page:s}){const n=s.rows||[],a=s.theme||"neutral";return e.jsxs("div",{className:"detail-doc",children:[e.jsx("h1",{style:{marginTop:0},children:s.title}),e.jsxs("p",{className:"sub",style:{marginTop:4},children:["Geneseed's invented vocabulary, decoded. Left: the neutral, plain-English term. Right: the word your ",e.jsx("code",{style:{textTransform:"capitalize"},children:a})," theme actually uses in the agent's voice."]}),e.jsx("div",{className:"card pad-md",style:{marginTop:18},children:e.jsxs("table",{className:"glossary-table",children:[e.jsx("thead",{children:e.jsxs("tr",{children:[e.jsx("th",{children:"Concept"}),e.jsx("th",{children:"Neutral term"}),e.jsxs("th",{children:["In ",a]}),e.jsx("th",{children:"Meaning"})]})}),e.jsx("tbody",{children:n.map(l=>e.jsxs("tr",{children:[e.jsx("td",{children:e.jsx("strong",{children:l.label})}),e.jsx("td",{children:e.jsx("code",{children:l.neutral||"—"})}),e.jsx("td",{children:e.jsx("code",{children:l.themed||l.neutral||"—"})}),e.jsx("td",{className:"dim",children:l.desc})]},l.label))})]})})]})}function B({page:s}){const n=s.version||{},a=[["Theme",s.theme],["Install mode",s.emit],["Deployed",s.deployed?"yes":"no"],["Target",e.jsx("code",{children:s.target},"t")],["Source root",e.jsx("code",{children:s.root},"r")],["Installed build",e.jsx("code",{children:n.installed_fp||"(none)"},"i")],["Source build",e.jsx("code",{children:n.source_fp||"—"},"s")],["Match?",n.verdict||"—"],["License",s.license]];return e.jsxs("div",{className:"detail-doc",children:[e.jsx("h1",{style:{marginTop:0},children:s.title}),e.jsx("p",{className:"sub",style:{marginTop:4},children:"Live snapshot of the install behind this UI, plus where to go next."}),e.jsx("div",{className:"card pad-md",style:{marginTop:18},children:a.map(([l,r])=>e.jsxs("div",{className:"kv",children:[e.jsx("span",{className:"k",children:l}),e.jsx("span",{className:"v",children:r??"—"})]},l))}),e.jsxs("div",{className:"row wrap gap-10",style:{marginTop:18},children:[e.jsxs("a",{className:"btn ghost",href:s.repo,target:"_blank",rel:"noreferrer",children:[e.jsx(N,{name:"external"}),s.repo_is_github?"GitHub repo":"Source repo"]}),s.repo_is_github&&e.jsxs(e.Fragment,{children:[e.jsxs("a",{className:"btn ghost",href:`${s.repo}/issues`,target:"_blank",rel:"noreferrer",children:[e.jsx(N,{name:"external"}),"File an issue"]}),e.jsxs("a",{className:"btn ghost",href:`${s.repo}/blob/main/LICENSE`,target:"_blank",rel:"noreferrer",children:[e.jsx(N,{name:"external"}),"License"]})]})]})]})}function C(s){var a,l,r;const n=(r=(l=(a=s==null?void 0:s.groups)==null?void 0:a[0])==null?void 0:l.pages)==null?void 0:r[0];return(n==null?void 0:n.id)||""}function V({pageId:s,harness:n,overview:a,onAction:l}){const{data:r,error:d,loading:i}=w(()=>s?T.docsPage(s,n):Promise.resolve(null),[s,n]);if(d)return e.jsx(S,{error:d,style:{margin:18}});if(i||!r)return e.jsx(E,{label:"Loading page…"});switch(r.kind){case"markdown":case"concept":return e.jsx(O,{page:r,overview:a,onAction:l});case"cli":return e.jsx(G,{page:r});case"glossary":return e.jsx(z,{page:r});case"about":return e.jsx(B,{page:r});default:return e.jsxs("div",{className:"empty",children:[e.jsx("div",{className:"big",children:"Unknown page kind"}),r.kind]})}}function Y(s,n){if(!s||!n)return null;for(const a of s.groups)if(a.pages.some(l=>l.id===n))return a;return null}function Q({page:s,query:n,overview:a,onAction:l}){var v;const[r,d]=A(),{data:i,error:j}=w(()=>T.docs(r),[r]),m=s||C(i);p.useEffect(()=>{if(!i||!m)return;if(!i.groups.some(h=>h.pages.some(b=>b.id===m))){const h=C(i);h&&h!==m&&g(`#/docs/${encodeURIComponent(h)}`)}},[i,m]);const t=Y(i,m)||((v=i==null?void 0:i.groups)==null?void 0:v[0]),o=(n||"").toLowerCase().trim(),u=p.useMemo(()=>i?o?i.groups.map(c=>({...c,pages:c.pages.filter(h=>h.title.toLowerCase().includes(o)||c.label.toLowerCase().includes(o)||h.id.toLowerCase().includes(o))})).filter(c=>c.pages.length>0):t?[t]:[]:[],[i,o,t]);if(j)return e.jsx(S,{error:j});const x=(i==null?void 0:i.groups)||[],f=!!o,L=c=>{var b;const h=(b=c.pages[0])==null?void 0:b.id;h&&g(`#/docs/${encodeURIComponent(h)}`)};return e.jsxs(e.Fragment,{children:[e.jsxs("div",{className:"head-row mb-16",children:[e.jsxs("div",{children:[e.jsx("div",{className:"eyebrow",children:"documentation"}),e.jsx("h1",{className:"h",children:"Docs"}),e.jsx("p",{className:"sub",children:"Concept pages, a generated CLI reference, and a glossary. Pages and config that differ by host are filtered to your selected harness."})]}),e.jsx("div",{className:"seg",role:"group","aria-label":"Harness",children:P.map(c=>e.jsx("button",{className:r===c.id?"on":"",onClick:()=>d(c.id),"aria-pressed":r===c.id,children:c.label},c.id))})]}),e.jsx("div",{className:"lib-secbar",children:x.map(c=>e.jsxs("button",{className:`lib-secchip ${(t==null?void 0:t.id)===c.id?"on":""}`,onClick:()=>L(c),children:[e.jsx("span",{children:c.label}),e.jsx("span",{className:"lib-secchip-n",children:c.pages.length})]},c.id))}),e.jsxs("div",{className:"lib lib-2",children:[e.jsxs("div",{className:"card lib-main",children:[e.jsxs("div",{className:"lib-head",children:[e.jsx("span",{className:"lib-head-label",children:o?"all groups":(t==null?void 0:t.label)||""}),e.jsxs("span",{className:"lib-head-count",children:[u.reduce((c,h)=>c+h.pages.length,0)," pages"]})]}),e.jsxs("div",{className:"lib-rows",children:[u.map(c=>e.jsxs("div",{className:"docs-group",children:[f&&e.jsx("div",{className:"docs-group-head",children:c.label}),c.pages.map(h=>e.jsxs("button",{className:`lib-row ${m===h.id?"on":""}`,onClick:()=>g(`#/docs/${encodeURIComponent(h.id)}`),children:[e.jsx("div",{className:"lr-name",children:h.title}),h.date?e.jsx("div",{className:"lr-desc",children:h.date}):null]},h.id))]},c.id)),u.length===0&&i&&e.jsxs("div",{className:"empty",style:{padding:32},children:[e.jsx("div",{className:"big",children:"No matches"}),"Try another search."]}),!i&&e.jsx(E,{label:"Loading docs…"})]})]}),e.jsx("div",{className:"card lib-detail",children:e.jsx(V,{pageId:m,harness:r,overview:a,onAction:l})})]})]})}export{Q as default};

package/web/dist/index.html

@@ -11,9 +11,9 @@
     <!-- The brand sprout as an inline SVG favicon (no extra asset to serve). -->
     <link rel="icon" type="image/svg+xml"
       href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'%3E%3Cpath d='M12 21.5v-9' stroke='%233AD4C4' stroke-width='2' stroke-linecap='round' fill='none'/%3E%3Cpath d='M12 13c0-4.5 3.2-7.5 7.5-7.5 0 4.5-3.2 7.5-7.5 7.5z' fill='%233AD4C4'/%3E%3Cpath d='M12 14.5c0-3.6-2.6-6-6-6 0 3.6 2.6 6 6 6z' fill='%233AD4C4' opacity='.42'/%3E%3C/svg%3E" />
-    <script type="module" crossorigin src="/assets/index-CH_Z725C.js"></script>
+    <script type="module" crossorigin src="/assets/index-BgIs5eIa.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/react-DOpiTn5v.js">
-    <link rel="stylesheet" crossorigin href="/assets/index-B-mXquBZ.css">
+    <link rel="stylesheet" crossorigin href="/assets/index-BE226Gv6.css">
   </head>
   <body>
     <div id="root"></div>

package/web/src/pages/Laws.jsx

@@ -15,7 +15,7 @@ import ErrorState from '../components/ErrorState.jsx'
 //
 // ⚠ SIX, THOUGH ONLY FOUR HAVE A MEMBER. `context` and `comms` lost theirs when the corpus became
 // nine invariants — that material moved to the ontology and the doctrine packs, neither of which
-// is classed here. The list stays six because it is the VOCABULARY that js/inventory.mjs's
+// is classed here. The list stays six because it is the VOCABULARY that js/inspect/inventory.mjs's
 // LAW_CLASSES publishes and doctor quotes verbatim; the PAGE renders only non-empty facets, which
 // is a display decision and not a change to the taxonomy.
 const LAW_CATS = {

package/docs/declined.md

@@ -1,200 +0,0 @@
-# Declined divergences
-
-Places where this CLI deliberately does **not** reproduce the Python reference it was ported
-from, with the reason written down. A divergence that is not on this page is a bug; one that is,
-is a decision.
-
-The reference has been deleted, so "the reference does X" is no longer an argument anyone can
-re-run. What is recorded in `tests/__snapshots__/` is the reference's answer, frozen; what is
-listed here is where this implementation answers differently on purpose.
-
-**The recording is smaller than it was.** On **2026-08-17** the emit, cli and web corpora were
-retired — 1381 cells, produced by an implementation that no longer exists and re-recordable by
-nothing, so they reddened on every deliberate content change while saying nothing about a defect
-that happened to be stable. What licensed it was a measurement: all five mutations whose only
-declared gate was a corpus replay are killed by `tests/unit/` alone. `docs/limits.md` carries the
-full argument and what it cost. **The consequence for this page is narrow and worth stating: an
-entry whose "how it stays honest" half named one of those three corpora now names a weaker gate, or
-none.** The help fixtures under `tests/__snapshots__/help/`, which most of this page rests on, are
-untouched.
-
----
-
-## `--help`: the prog is `geneseed`, not `harness`
-
-**Status:** declined (the port's wording is kept), narrow and gated.
-
-**What differs.** The reference opened `usage: harness status` for `status --help`; this CLI
-opens `usage: geneseed status`. The same substitution applies to `bin/geneseed-hook.mjs`, which
-spells itself `geneseed-hook`.
-
-**Why.** `harness` named the Python file this migration deleted. It was not a command anyone
-could type, and now it names nothing at all. This CLI already spells itself `geneseed` in every
-error it prints (`geneseed: error: …`, `bin/geneseed-cli.mjs`'s `die`), so reproducing `harness`
-here would make the help text the only surface still pointing at the old name.
-
-**How it stays honest.** `prog` is an ARGUMENT of `js/cli.mjs`'s `formatHelp`, not a constant.
-`tests/snapshot/cli_help.test.mjs` replays all 26 recorded fixtures through it with the reference's own
-prog and requires them byte for byte. The rename is the only thing that moves, and a separate
-assertion pins the shipped spelling so a renderer that ignored `prog` could not pass both.
-
-That the formatter agrees at every WIDTH — argparse's whole layout: usage assembly, the wrapped
-continuation indent, the two-column help position, the wrap column — was established by a live
-sweep over all 26 verbs at every `COLUMNS` from 20 to 200 while the reference still ran. It
-retired with the reference, and it is the reason the fixtures can be trusted: the 26 are recorded
-at ONE width (`COLUMNS=80`), and at that width two real divergences were invisible — a mutually
-exclusive group emitted as one unsplittable usage part, and `_max_help_position` baked as a
-constant where argparse derives it from the width. Both were found by the sweep and fixed. A
-claim about "the entire layout" that rests on a corpus at one width is a claim about one width,
-so a change to the wrapping arithmetic now needs its own argument rather than a green corpus.
-
-Note that the divergence could not have been applied to a recorded text after the fact: the
-continuation indent of a wrapped usage line is `len('usage: ') + len(prog) + 1`, so four of the
-26 usage blocks re-flow when the prog changes length.
-
----
-
-## `update --help` names `update`, where the reference names `upgrade`
-
-**Status:** reference behaviour, deliberately not reproduced.
-
-**What differs.** The reference printed `usage: harness upgrade [-h] [theme]` for `update --help`
-— the canonical verb, for a command the user spelled `update`. This CLI prints `usage: geneseed
-update`.
-
-**Why.** argparse implements an alias by registering a second key in `_SubParsersAction.choices`
-pointing at the SAME parser object, and `parser.prog` was fixed when that object was built. The
-leaked name is an implementation detail of the reference's alias mechanism, not a statement about
-the CLI. Recorded verbatim in `tests/__snapshots__/help/update.txt` and replayed with the
-reference's prog, so the reference's answer is preserved; the shipped call passes the verb the
-user typed.
-
----
-
-## `link` bakes the interpreter into a written shim, where the Unix arm used to symlink
-
-**Status:** ACCEPTED, both consequences below. This is a change to the PRODUCT, not a port
-divergence — since Task 2b both implementations write the same shim — and it is recorded here
-because this is the page that exists for "what did we decide to live with".
-
-**What changed.** `./geneseed link` used to symlink `ROOT/geneseed` into `~/.local/bin`; the
-launcher then resolved the symlink at RUN TIME and found its own interpreter. It now writes a
-`#!/bin/sh` shim carrying a `# GENESEED_LINK_SHIM` marker that `exec`s the runtime named by
-absolute path (`process.execPath`), mirroring what the Windows arm has always done. The reason it
-moved is in `.superpowers/sdd/progress.md` Task 2b: the two implementations disagreed on four
-cells, and this repo has no deliberate-divergence mechanism, so the reference moved to the port's
-shape rather than the corpus recording a split.
-
-**Consequence 1 — durability.** The baked path can go away. A shim written under `nvm` names
-`~/.nvm/versions/node/v22.x/bin/node`; switch or clean up, and `geneseed` on `PATH` points at a
-runtime that no longer exists. The old symlink survived that, because it deferred the choice to the
-launcher. Accepted: the fix is one `./geneseed link` re-run, the failure is loud and immediate
-(`no such file or directory`), and the Windows arm has carried the same property since it
-shipped. Prefer the old behaviour? A shell function in your rc does exactly that, and SETUP.md
-offers it beside `link`.
-
-**Consequence 2 — which CLI is on `PATH`.** The shim names the implementation that WROTE it, and
-while two implementations existed that decided whether `geneseed tui` and `geneseed menu` opened
-the full-screen panel or refused it. This is now settled rather than a consequence: there is one
-implementation, and the panel it does not carry no longer exists anywhere to be reached. Both
-verbs cross and both refuse the panel by name, stating what this entry does carry (the TUI's
-layout half, not its screens) and offering `setup`, `doctor` and `build` instead. The refusal
-names no file, deliberately — an earlier one pointed at the panel's source, and a pointer to
-something a migration is deleting is worse than a plain statement that the screen is not there.
-
----
-
-## argparse's ERROR wording is not reproduced
-
-**Status:** declined, pre-existing (P5a, P10c), restated here because it is the neighbour of the
-entry above and readers keep finding it separately.
-
-argparse printed a usage block around every parse failure and prefixed it `harness: error:`; both
-entries state the fault on one line prefixed `geneseed: error:` / `geneseed-hook: error:`. See
-`bin/geneseed-cli.mjs`'s `parse` docblock.
-
-**What used to be gated beside it no longer is.** Every error a command's own body raises was in
-the recorded CLI corpus, replayed cell by cell; that corpus was retired on 2026-08-17 and the
-per-verb error texts are now covered only where `tests/unit/` happens to drive the verb. The
-divergence declared here is unchanged — the port has never reproduced argparse's wording and does
-not start now — but the *neighbouring* claim, that the rest of the error surface is pinned byte for
-byte, has expired.
-
----
-
-## Top-level `--help` is still a refusal on the Node entries
-
-**Status:** open, out of scope for Task 10, stated so it is not mistaken for done.
-
-`geneseed --help` with no verb prints
-`geneseed: error: the following arguments are required: cmd (one of …)` on stderr and exits 2,
-where the reference printed the whole parser's help with a subcommand table. Task 10's surface
-was the 26 per-verb help texts and only those are recorded.
-
-Rendering the top-level help needs argparse's `_iter_indented_subactions` path — the subcommand
-choices as a metavar in the usage line, and a nested, differently-indented action list whose
-invocations feed the same `_action_max_length` — which is a distinct piece of the formatter with
-no fixture behind it. Whoever writes it should record it the same way first.
-
----
-
-## `--help` anywhere on the line wins, where argparse would fail on an earlier option
-
-**Status:** declined (the port's behaviour is kept), and the gate that pins it has been corrected
-to stop calling it argparse's rule.
-
-**What differs.** Both Node entries scan the whole argument list for `-h`/`--help` BEFORE parsing
-(`bin/geneseed-cli.mjs`, `bin/geneseed-hook.mjs`), so `geneseed version --target --help` prints
-the help and exits 0. argparse consumes optionals left to right, so `--target` swallows `--help`
-as its value and the reference exits 2 with `argument --target: expected one argument`. Three
-error classes reach it — a missing value, an invalid `type=int` value (`web --port abc -h`), and a
-mutex conflict (`theme --solid-only --transparent-only --help`) — across 19 mandatory-value
-options on 13 verbs, plus `--memory` and `--root` on the hook entry.
-
-**Why declined.** On a malformed command line the two answers are "help, exit 0" and "the error,
-exit 2". Neither takes an action; nothing is written, nothing is destroyed. A scan that stopped at
-the first option expecting a value would have to reproduce argparse's consumption order to be
-right, and that order is the piece of the parser this port deliberately does not carry (see
-argparse's ERROR wording above). Printing help for a line that contains `--help` is the answer a
-user is more likely to have wanted, and it is the same answer for every shape of malformed line.
-
-**How it stays honest.** `tests/snapshot/cli_help.test.mjs`'s `a --help anywhere in the line wins` used to
-docblock this as "argparse's own rule". It is not — that generalised from `diff --nope --help`,
-which works only because an UNKNOWN option is deferred to the end of `parse_known_args`. Two of
-that test's four cases are cases where the reference errors instead, so the test pins a
-divergence; its docblock now says which cases those are and points here.
-
-## A verb that postdates the recorder is exempted from the cell matrix by name
-
-**Status:** ACCEPTED, 2026-08-19. This widens an existing exemption rather than minting a second
-one, and it changes a TEST, not the product.
-
-**What differs.** `tests/unit/hook_cli.test.mjs`'s `the matrix covers every verb each entry
-claims` asserted a strict equality between the hook verbs `tests/helpers/matrix/cli.*.json`
-covers and the verbs `bin/geneseed-hook.mjs` carries. The CLI half of the same test already
-exempted a named `NATIVE` list; the hook half exempted nothing. Both halves now filter through
-the same list.
-
-**Why the recording could not be kept as the whole answer.** The matrix was exported by the
-reference implementation, which was deleted on 2026-08-17 along with every recorder that could
-write a cell. So the covered set is frozen at four hook verbs for good. A fifth hook verb —
-wired in `js/settings.mjs`, carried in `bin/geneseed-hook.mjs`, declared in `js/cli-table.json` —
-would fail this equality with **no green path**: the corpus cannot grow, and the failure message
-correctly forbids deleting cells to pass. The gate had become a wall, and a wall that stops a
-legitimate change is not protection, it is an accident of when the recorder died.
-
-The reason the three CLI verbs were exempted in the first place — *the reference had nothing to
-compare against, and authoring one would be recording a copy of the value under test* — is
-exactly the reason a verb that postdates the reference has no cell. Same reason, same exemption.
-
-**What was lost, measured.** Nothing that another gate does not already hold. The only property
-the frozen hook half carried beyond `NATIVE` was *"a hook verb cannot be removed by a coordinated
-edit of three files"* — and `tests/unit/hook_cli.test.mjs`'s own literal (`sorted(wired)` against
-the four names) plus its `verbsOf(HOOK) === wired` equality are two editable copies of that same
-set, twelve lines above. `tests/mutate.mjs`'s M8 plants the one-file removal and is killed there,
-not here.
-
-**How it stays honest.** The exemption is a NAMED list, not a containment: a new verb has to be
-written into `NATIVE` deliberately, in two files that read each other's source, and the reverse
-check refuses an exemption for a verb neither entry point carries. So the next new verb still
-fails loudly until someone decides about it — which is the whole point of the original design.

package/docs/limits.md

@@ -1,329 +0,0 @@
-# Limits — what this tool does not prove about itself
-
-Geneseed is one implementation: `bin/`, `js/`, `adapters/`. It used to be two. Until the 2.0
-re-layout there was a second, older implementation beside it, and three cell harnesses ran both
-and compared every byte either one wrote plus both streams and the exit code. That second party
-is deleted, and **on 2026-08-17 the recording it left behind was retired with it** — the emit, cli
-and web corpora, 1381 cells, plus the two replayers that existed only to drive them. What survives
-under `tests/__snapshots__/` is the narrower set of pure-function and help recordings that
-`tests/snapshot/` replays. *The emit, cli and web corpora were RETIRED* below carries the
-measurement that licensed that, what it cost, and what is left holding the line.
-
-This file is the standing answer to *"what does this tool not prove about itself?"* It is kept
-beside the code rather than in a phase note, because phase notes are per-machine and this
-outlives them.
-
-Each row says whether the limit is **ASSERTED** — there is a test that fails if it closes or
-widens without this file changing — or **STATED**, meaning the claim rests on prose and nothing
-enforces it. Prefer asserting. A structural gate must read *code*, never the paragraph that
-admits the limit, or deleting the paragraph is a way to pass it.
-
-**New in the 2.0 re-layout**, and each is checked against the tree rather than inherited from the
-previous version of this document:
-
-* **Limit zero** below — a corpus proves *unchanged*, never *correct* — promoted from a bullet
-  to the frame every other row sits inside, because with the second party gone it now governs all
-  of them. It governs a smaller estate since the retirement: the pure-function and help
-  recordings, and nothing else.
-* **Row 1** — there is no full-screen panel at all any more, on any path. Not "unported": absent.
-* **Row 3** — `/api/pick-folder` still exists as a declared decline and a live 501, but there is
-  no longer a handler anywhere for it to be declined *against*.
-* **Row 12** — the width tables are pinned by a recorded hash and a declared Unicode version, not
-  by a live Unicode oracle.
-
----
-
-## ⚠ Limit zero — a corpus proves UNCHANGED, never CORRECT
-
-Every replay left in this repository — the pure-function recordings under `tests/__snapshots__/`
-and the 26 help fixtures beside them — compares today's answer against a recorded one. That is a
-regression gate and it is a good one. It is **not** a correctness gate, and the difference is the
-whole subject of this file.
-
-The recording was taken from an implementation that **agreed with this one at the time it was
-taken**. Where the two agreed and were both right, the corpus freezes a right answer. Where the
-two agreed and were both wrong, the corpus freezes the agreement — and there is no longer a
-second party who could disagree. A cross-implementation comparison was already structurally blind
-to a defect both sides shared; the recording inherited that blindness and made it permanent.
-
-So: a green replay says *"this code still answers what it answered on the day the recording was
-taken."* It says nothing about whether that answer was ever the right one. Everything below is the
-standing list of where that matters and of the branches nothing reaches at all.
-
-**The recordings that remain can never be taken again either.** They were produced by the
-reference implementation and by nothing else; every program that could write one is deleted, and
-the two suites in `tests/snapshot/` replay and do not record. So a change that moves a byte in one
-of them is a **finding, not a step**. There is no re-bless. If a replay goes red the choice is to
-revert the change or to argue, in writing, that the recording was wrong — and nothing can settle
-that argument any more.
-
-## ⚠ The emit, cli and web corpora were RETIRED — 2026-08-17
-
-**1381 recorded cells under `tests/__snapshots__/{emit,cli,web}` are deleted**, with the two
-replayers that existed only to drive them (`tests/cli_golden.mjs`, `tests/web_golden.mjs`), the
-scan that swept their bytes for Python, and the three `node-cells` steps in
-`.github/workflows/ci.yml` that ran them. What is left of that job is the two self-comparisons,
-which have no corpus and need none.
-
-**The reason is limit zero with the brake off.** A recording nobody can re-bless makes every
-deliberate content change a red gate — an emitted sentence, a reworded refusal, a version bump —
-while saying nothing at all about a defect that happened to be stable on the day it was taken. Run
-long enough, that is a gate reporting the author's intent rather than the code's behaviour, and the
-only way to stay green is to stop changing the product. The 2.0 bump had already shown the shape:
-one label moving reddened 224 of 259 emit cells and none of them was a defect.
-
-**The retirement was licensed by MEASUREMENT, not by the redness.** `tests/mutate.mjs` declares 31
-mutations and names, per row, the gate that must kill each one. Five declared a corpus replay and
-nothing else — **M1, M2, M3, M4 and M8** (`EMIT`, `EMIT_IMPERIAL`, `EMIT_CLAUDE`, `WEB_CATALOG`,
-`CLI_CONTEXT`). All five are killed by `tests/unit/` alone, the control included, and each row now
-**declares** the unit file that kills it rather than a replay that can no longer run — M1 and M3
-`maintainer_tools`, M2 `node_driver`, M4 `hook_form`, M8 `hook_cli`. A gate a matrix names and
-cannot run guards nothing, and is worse than none, because it is trusted (Doctrine rigor 2,
-Honest Tests). For every defect the mutation matrix knows how to plant, the corpus was
-redundant. That is the whole argument, and it is the only one that licenses a deletion:
-a test goes because a living gate already proves the property, never because it is red.
-
-**What was knowingly LOST: byte-level regression detection on emit, cli and web output.** Nothing
-now notices that a rendered bundle, a verb's stdout / stderr / exit code, or an HTTP response body
-moved by one byte for a reason nobody intended. A defect the mutation matrix does not carry, in a
-region `tests/unit/` does not reach, is one this repository will no longer see. That is a real
-reduction in coverage, stated here rather than discovered later.
-
-**What REMAINS:**
-
-* `node tests/golden.mjs --idempotent` — the re-emit path every user is on from their second build
-  onwards, a run compared against another run of the same generator.
-* `node tests/golden.mjs --deletion` — configuration A, then B onto A's tree, against a **fresh**
-  emit of B; the only thing that makes the write-before-delete prune actually delete.
-* `node bin/geneseed-cli.mjs doctor --all` — every theme, plus the parity, authoring and drift
-  checks.
-* `tests/unit/` — the suite that kills every mutation the matrix declares but one. The exception is
-  **M7**, whose seam is the `updated` branch of `managedBlockWrite`: it runs only on a *re-emit*, so
-  no fresh-sandbox fixture reaches it and `--idempotent` is its gate by construction.
-
-Both `golden.mjs` modes compare a run against another run of the *same* implementation, so they are
-determinism checks rather than regression gates — the same degradation standing decision 2 below
-has been calling the live one. What they buy for it is that they keep working however the content
-changes, which is exactly what the retired corpora could not do.
-
-**The tag `python-reference-v1.0.0` is kept as the historical pointer.** The second implementation
-and every cell it recorded still exist there, in full, and that is the only place they will. Nothing
-in the working tree reads it; it is a place to go and look, not a gate.
-
-### The one hand-edit ever made to a recorded file
-
-**2026-08-17 — `tests/__snapshots__/primitives/{win32,posix}.json`, the `note` field of three cases
-each, edited by hand to repoint `docs/port-ledger.md` at `docs/limits.md`.** It was safe for a
-reason that has to be re-checked before anyone ever does it again, not quoted as a precedent:
-`note` is **never compared as an answer**. `tests/snapshot/pure_snapshot.test.mjs`'s replay loop compares
-`result` and `result_ascii` and reads nothing else from a case; the only claim on `note` is the
-assertion that every noted case's note names this document, and that assertion was updated to the
-new filename rather than dropped — *a note that quietly stops being emitted is a bug that quietly
-becomes an unremarked-on fact.* Nothing that any replay treats as an answer was touched, and the
-edit was verified to move only `note` lines.
-
-**This is an exception, not a precedent.** The next person who wants to hand-edit a recording
-should assume the answer is no and re-derive the whole argument above for their own field.
-
-### The second thing the comparison was taught to ignore — HISTORY, and the reason the retirement above happened
-
-*This describes the emit corpus, which is gone. The destamp survives it and is now inert: a run
-compared against another run of the same generator carries the same version on both sides. Kept
-because it is the clearest measurement of what a frozen corpus costs, and it is what made the case
-for retiring one.*
-
-**2026-08-17 — `destamp()` in `tests/helpers/golden.mjs` learned to blank `"_version"` inside
-`agent-overrides.json`, as it already blanked `[release <REL>]` inside `.geneseed-version`.**
-
-The configured release version is stamped into emitted bundles in **two** places, and only the first
-had ever been blanked before comparison. The second was found by attempting the 2.0.0 bump: **224 of
-259 emit cells went red**, every one of them the same file, `CHANGED (558 -> 558 bytes)`. It had
-stayed invisible for two reasons worth remembering — the sweep that added the first arm hunted the
-**bracketed** spelling, which this site does not use; and `1.0.0` and `2.0.0` are the same length, so
-the size never moved and only the hash could see it.
-
-**Left unfixed, the frozen corpus would have pinned this project's version at `1.0.0` permanently** —
-not merely 2.0.0 but every possible bump, in 448 recorded files, with no recorder left to re-bless
-one. That is not a limit anyone chose, and it is the reason this is a fix rather than a concession.
-
-**The distinction that mattered at the time:** it narrowed what the replay COMPARED; it did not touch
-a recorded byte. The other ~553 bytes of that stub, and every other file in all 259 cells, stayed
-asserted exactly as before. **It was still a real loss of coverage** — nothing checked that the
-emitted `_version` matched the configured one, and nothing could, because verifying it needed the
-oracle that recorded those bytes. **And that is the pattern that ran out.** Every bump, every reworded
-sentence, every renamed file would have arrived as the same choice: narrow the comparison again, or
-freeze the product. Two exemptions in one release is a trend, not an incident, and the third would
-have been the version bump after this one.
-
-## Frozen residue — true statements that are now permanently unfixable
-
-Four things in this repository are wrong, known to be wrong, and **cannot be corrected**, because
-correcting them would move a byte in a corpus with no recorder left. They are listed so a future
-reader finds a decision here rather than concluding nobody looked. This list was six until
-2026-08-17; the two the retirement freed are recorded under it, because *which* residue a corpus
-creates is the clearest measure of what freezing one costs.
-
-- **`tests/__snapshots__/primitives/{win32,posix}.json` freeze `[authoring] _web_core prose says …`**
-  across five cases, naming a module the cut deleted. Frozen evidence about a program that no
-  longer exists — accurate as a record of what the reference answered, misleading as a description
-  of today.
-- **`tests/helpers/matrix/*.json` — 4 files — are permanently un-regenerable.** Their only producer
-  was the reference's matrix exporter. The committed copies are the last export. `tests/golden.mjs`
-  drives the `emit` pair; `tests/unit/hook_cli.test.mjs` reads both halves of the `cli` pair to
-  derive the platform union. **The `web` pair was deleted on 2026-08-19** — 418 kB whose only
-  reader went with the web corpus, so nothing had exercised them since; `tests/ported.json` carries
-  the decision and the criterion it was taken on.
-- **`tests/__snapshots__/token_report_primitives.json` names `js/lib/pyfs.mjs`** in one recorded
-  `why` field, and this release renamed that file to `js/lib/fs.mjs`. **This one was left alone on
-  purpose, and the reasoning is the point:** `why` is never compared — it is interpolated into a
-  failure message — so editing it would have been *safe*. Nothing *forced* it. The one hand-edit of a
-  recording this release did make (the `note` fields, below) was forced: an assertion matched on
-  those strings and would have gone stale. **Reserve editing a recording for when an assertion
-  demands it, not for when it is merely harmless**, or the exception becomes the rule and the corpus
-  stops being evidence.
-
-Three of the four share one shape: **a string is cheap to fix right up until it is recorded, and
-then it is not fixable at all.** That is the cost of freezing a corpus, paid knowingly.
-
-**Freed on 2026-08-17, and neither is fixed yet.** Both are now ordinary edits somebody has to make;
-they are kept here so the next reader finds the reason the code looks the way it does.
-
-- **`js/tui.mjs` and `js/menu.mjs` end a refusal with ``Use `harness setup`, `doctor`, or `build`.``**
-  `harness` was the reference's argparse program name and now names nothing. Both strings were
-  recorded in the CLI corpus, so changing either used to redden cells nobody could re-record. That
-  corpus is gone; the wrong word is now just a wrong word.
-- **`tests/workflow_runtime.test.mjs` sits at `tests/` top level, alone among the plugin suites.**
-  `adapters/opencode/workflows/_runtime.js` names that path in a comment, and that file is EMITTED,
-  so its bytes were hashed into the emit corpus: moving the suite to `tests/plugins/` and updating
-  the pointer grew the emitted file by 8 bytes and turned the corpus red. **The layout bent around
-  the frozen recording rather than leaving the shipped comment to rot** — the one place the freeze
-  was visible in the directory structure. Nothing holds it there now.
-
-## What IS covered
-
-All 25 subcommands, 29 of 29 web paths, 5 of 5 docs kinds. Every `NOT_PORTED*` table in `js/web/`
-is empty and stays declared as the empty half of a partition — the shape that makes the next
-missing thing visible instead of silently absent.
-
-## Declared, with an assertion
-
-| # | The limit | Where it is asserted |
-|---|---|---|
-| 1 | **There is no full-screen panel.** Not unported — absent. `js/tui.mjs`'s `cmdTui` has two arms and **both print and return 1**: off a TTY it says so, on one it says the entry carries the TUI's layout half and not its screens. The reference's panel — its loop, its eighteen screens, its `(stdscr, curses, pal)` drawing helpers, its Windows console window, its menus, the curses arms of `setup` and `bootstrap`, and `doctor`'s progress callback — is deleted with the implementation that had it. **The comparison half of this row is history**: there is no panel to declare a gap against. What is live is the claim about the shipping code, and it is a claim about ABSENCE, which is the kind a structural gate can hold. (This row used to say the refusal *names* the interpreter-and-script invocation of the panel. It has not since P2, which removed the pointer rather than re-aiming it: a refusal naming a file this migration deletes is worse than one that simply says the screen does not exist. The row was factually stale for two phases, which is the argument for reading the gate out of the code rather than out of the prose.) | **`tests/unit/no_panel.test.mjs`**, which needs nothing but the port: behavioural (faked `isTTY`, exit 1, no panel marks on stdout, and the refusal is the only line it writes) and structural — it fails if `js/tui.mjs` grows any of `?1049h`, `?1049l`, `?25l`, a literal ESC, `\x1b[`, `[`. **What is NOT asserted and cannot be**: that a panel, if one were written, would work. The positive control that used to prove the reference panel really painted — the thing that stopped the mark list being a set of strings nothing produces — retired with the reference. The Node file replaces it with a control of its own (see row 6), which proves the marks still match how *this* codebase spells an escape, not that any panel exists. Landing a real panel means deleting the structural test **first** and updating this row second. |
-| 2 | **`_wrap_lines`, the panel's line wrapper.** Its only caller was the panel loop, so it travels with row 1 and is now history along with it. **`textwrap.wrap` itself CROSSED** — this row said "a stdlib payload with no Node twin … port it *with* the panel or not at all" until P1 made `--help` the caller that required it: `pyTextWrap` (`js/cli.mjs`) is a real port of it, driven by `formatHelp`. | `tests/__snapshots__/textwrap.json` freezes the CPython answers (38 cases × widths 11..198, sha256 over the matrix) and `tests/snapshot/pure_snapshot.test.mjs` replays them with no interpreter anywhere on the machine. The live comparison against a running `textwrap` retired with the reference, so **limit zero applies here in its sharpest form**: the matrix is 38 cases wide and one CPython version deep, and a wrap CPython itself later changes is a divergence this repository cannot see. The corpus declares which side of gh-139065 it was recorded on, precisely so it cannot be mistaken for one frozen against the behaviour CPython already fixed. |
-| 3 | **`/api/pick-folder` will never exist here.** It opens an OS-native folder dialog on the daemon host, which is a GUI dependency and a sixth allowed-spawn row for a modal window. `js/web/server.mjs` carries it in `DECLINED_POST`, a set kept distinct from `NOT_PORTED_POST` because "will never cross" is a different claim from "not yet". **What changed in this phase**: there is no longer anything on the other side to decline. The reference's own handler is deleted, so this stopped being a comparison between an endpoint that exists over there and one that does not exist here, and became simply a documented, permanent 501 — and it is the ONLY member of either set, which makes it the last live target the dispatcher's 501 arm has (see row 9). | Probed live, not merely declared: `tests/unit/web_server.test.mjs` drives the real dispatcher and requires POST → 501 and GET → *not* 501 (it must fall through to the SPA). That pair is what refuses the one-line collapse of the POST declarations back into the GET set, which would leave every exported set exactly as written and every set-reading test green. The collapse is planted as **M23** in `tests/mutate.mjs` and killed, so the row's own argument is gated rather than asserted. |
-| 4 | **`_win_user_path`'s registry-write success arm.** `link`/`unlink` edit the persistent user Path through PowerShell. No test in this repo may run that — the edit would outlive the suite, the checkout and the machine. | The *failure* arm used to be reached honestly, by `unlink` cells that handed the verb a PATH with no `powershell` on it so the code took the "said nothing about PATH" branch with the registry untouched. **Those cells went with the CLI corpus on 2026-08-17 and nothing replaced them**, so the spawn half is now ungated on both arms rather than one — a downgrade this row carries rather than hides. Everything that can be *wrong* still lives in the pure `winUserPathScript` half, and `tests/__snapshots__/win_user_path.json` is a recorded corpus over it, replayed by `tests/snapshot/pure_snapshot.test.mjs` on every platform (the builder reads nothing host-shaped, and a non-Windows run is what measures that). That the spawn half carries no logic used to be **STATED**, in a test docstring; `tests/unit/win_user_path.test.mjs`'s last test now checks it — one `spawnSync`, the builder's output passed through unchanged, no string work on the directory, and a statement ceiling. If logic drifts INTO the spawn the ungated region grows, and this is what refuses that. |
-| 5 | ~~**`link`/`unlink`'s Unix arm.**~~ **CLOSED at P11.** It writes a `#!/bin/sh` shim into `~/.local/bin` carrying a `# GENESEED_LINK_SHIM` marker and chmod 0755, and it has six cells of its own. (It *symlinked* `ROOT/geneseed` until P0/P1 Task 2b; the `is_symlink()` branch survives so `unlink` still removes a legacy symlink install, and **no cell covers that branch** — the one piece of this row still open.) The six include the `PATH` split (a substring test passes every other cell and fails `a-path-entry-that-merely-contains-the-dir`), the **marker check** that leaves a foreign `geneseed` alone — the decoy is a regular file, not a symlink, so the marker is what has to reject it — and an explicit dir argument with a trailing slash. That last one found a live divergence: the reference built a `Path` and the port kept the raw string, so `str(Path('/x/bin/'))` and `/x/bin/` disagreed in two messages and in the PATH comparison. Fixed in `js/link.mjs` with `pyPathStr`. | The group is a UNION across the two platforms, and **the six cells are gone with the CLI corpus.** `platformDeclarationProblems` travelled with the replay — one id per built cell, the other platform's half absent, neither half empty, and the skipped half PRINTED — so it retired with it. What is left is `tests/unit/hook_cli.test.mjs`, which reads **both** halves of `tests/helpers/matrix/*.json` at once and is now the whole of this row's gate rather than the part of it that needed two files. The behaviour itself — the marker check, the `PATH` split, the trailing slash — is no longer probed end to end anywhere. |
-| 6 | **The boot animation's call site.** `playLine` itself is exercised; what is declared is that `js/setup.mjs` and `js/update.mjs` reach no panel. **Nothing about this row ever needed a second implementation** — its subject is two JavaScript files — and until P3 its only gate was a test that retired with the reference. | **`tests/unit/no_panel.test.mjs`**. Escape sequences, not the word "curses": the first draft looked for the word and failed on a *docblock*, and a structural gate that reads prose is a gate on the documentation — it would have been satisfied by deleting the paragraph that admits the limit. It carries two things its predecessor had not. A **positive control**: the same scan run over `js/anim.mjs`, which paints by design and is excluded by name, must find a hit — otherwise a mark list that has stopped matching how this codebase spells an escape retires all three gates green. And a **literal ESC byte** among the marks, found by accident while falsifying the gate: the falsifying edit was appended with `printf`, which ate the backslash and wrote a real ESC, and every scan stayed green over a module that had just grown a screen-clear. A gate that knows the spellings of a character but not the character is a gate on a coding style. |
-
-## Ungated, and honest about it
-
-| # | The limit | Why nothing reaches it |
-|---|---|---|
-| 7 | **`npmBuild`** (`npm install && npm run build`). | A first-run-from-a-partial-checkout path; no cell can be in that state, because `web/dist/` is tracked. `tests/unit/web_daemon.test.mjs` asserts *that* — it re-derives the unreachability from `git ls-files`, so untracking `web/dist/index.html` fails the test instead of quietly making the arm live. It also asserts the file must EXIST in the working tree, because tracked-but-absent is a real state in which the `ask` arm is reachable here and now while the tracking claim still holds. The two branches only reachable through it — the prompt's wording and EOF handling, and the `npm install` → `npm run build` order — are asserted as source and gated as **M25**. |
-| 8 | **The stale-factory probe.** *(HISTORY, not a live limit.)* | Its subject was a reference CLI too old to know `upgrade`, dead-ending on argparse's `invalid choice` — a program that no longer exists. `js/update.mjs` argues the absence out at the call site: the update step is an **import, not a spawn**, so there is no second program to be stale, no argparse to refuse, and no `invalid choice` to recognise. The half that DID have a live subject is the durable trace a failed step leaves, and it is asserted absolutely by `tests/unit/update_steps.test.mjs` — persisted before it is printed, appended rather than overwritten, still returned when the log itself cannot be written. |
-| 9 | **The web dispatcher's 501 arm, for anything but one path.** | `NOT_PORTED_ACTIONS`, `NOT_PORTED_KINDS` and `NOT_PORTED_POST` are all empty, so `/api/pick-folder` (row 3) is the only target the arm has left, and no second one can be borrowed: every remaining action either starts a job in the developer's checkout or writes a shim and edits the real user PATH. The action-side claim therefore rests on `tests/unit/web_jobs.test.mjs` reading the set out of the module — **a gate on a declaration, which is weaker than a probe**, and is declared as such at both sites. A new row in that set makes the arm reachable again and obliges this row to become a probe. The sibling declaration beside it used to be stronger — each of the three `INLINE_ACTIONS` named a recorded cell that really drove the dispatcher, and the cell's existence was asserted on both corpus halves. **Those cells retired on 2026-08-17**, so both declarations now rest on the module being read rather than driven, and the row is weaker by exactly that much. |
-| 10 | **`pyStrPath` / `pyPathStr`.** Two spellings of one translation in `js/generate.mjs`. | Ungated; the comment at the call site says so. The recorded CLI cells could not see the difference the split is about either — they read stderr through a universal-newline decode — and they are gone as of 2026-08-17, so the row went from ungated-with-a-witness-nearby to simply ungated. |
-| 11 | **The Linux browser lookup answering FALSE.** The reference walked `webbrowser`'s registry (`$BROWSER`, `xdg-open`, `gio`, `gvfs-open`, a dozen browser binaries); `js/menu.mjs`'s `browserAvailable` asks only whether `xdg-open` — the binary `openUrl` will actually run — is on PATH. On a box with `gio` and no `xdg-open` they disagreed, which is what a WSL run measured. | The corpus in `tests/unit/web_first.test.mjs` SUPPLIES the input instead of inheriting it: an `xdg-open` stub on PATH plus `DISPLAY`, so the True arm is reached identically on every host, and a `no-display` row gates the Linux-only display refusal absolutely. Reaching the FALSE arm needs a PATH with no `xdg-open` at all, which is not something a probe on Windows survives — so it stays ungated, here, rather than in a comment. **The divergence it names is now permanent** and belongs in `docs/declined.md`'s territory rather than this file's: with the reference gone, `browserAvailable`'s answer is simply the answer, and nothing can say it is the wrong one. |
-| 12 | **The width tables are pinned by a HASH, not by a live oracle.** `js/tui.mjs`'s `WIDE`/`COMBINING` tables are a snapshot of unidata **15.1.0** (declared as `DWIDTH_UNIDATA`). Nothing in this repository consults a live Unicode database any more — there is none to consult — so what the sweep proves is that the tables have not moved since they were recorded, and **not** that they encode any Unicode version correctly. This was already true of the CPython comparison in one direction (3.14 carries 16.0.0 and assigned U+0897 a combining class, so the old live sweep reported a divergence that was neither implementation's); it is now true in both. | `tests/__snapshots__/dwidth.json` carries all 527 runs, a sha256 over them, and the unidata version they were measured at; `tests/snapshot/pure_snapshot.test.mjs` checks `DWIDTH_UNIDATA` against that declaration, asserts the constant NAMES a Unicode version at all — read out of `js/tui.mjs` by regex **as well as** imported, so the gate cannot be satisfied by deleting the declaration and supplying the value some other way — and replays the sweep. The document self-checks against its own hash first, so a hand-edited `rle` is not accepted as an oracle. The interpreter pin that used to hold this together retired with the live sweep. Regenerating the tables means moving the constant and re-recording the corpus **together**, and re-recording is exactly what is no longer possible: **new tables would have to arrive with a new corpus recorded from the port itself, which is a determinism check and not a regression gate.** |
-| 13 | **`minuteStamp`'s recorded answers carry the recording machine's clock.** `%Y-%m-%d %H:%M` off a naive local-time conversion, so the frozen answers hold one UTC offset. There is no token to substitute — the offset is the answer's arithmetic, not a substring of it. | Each of the five cases carries a `guard` naming the UTC offset **at that instant** (so DST is part of the match, not an approximation), and `tests/snapshot/pure_snapshot.test.mjs` recomputes it from `Date` before asserting. A replay in another zone SKIPS those cases and PRINTS how many it skipped — the width sweep's rule that a skip is not a pass. The live comparison that used to gate them everywhere is retired, so they are gated only where the offsets agree, which is not many machines. That is the cost of the cut, taken deliberately: a case asserted in one zone and declared in the others beats one silently re-blessed to whatever zone last ran it. |
-
-| 14 | **A RENAMED test file is no longer detected.** `tests/ported.json` named the Node successor of every deleted Python test, and `tests/unit/ported.test.mjs` asserted each of those 52 paths still existed on disk — so renaming one reddened the suite. That test was **retired on 2026-08-19**: four of its six assertions only ever checked that the ledger agreed with itself, and the two that reached outside it charged a hand edit inside a 231 kB, 92%-prose JSON for every rename. | A *deletion* is still caught, and over a wider set: `.github/workflows/ci.yml`'s discovery floor fails below 500 reported tests across all 71 files, where the ledger pinned 52. What is genuinely gone is the *rename* signal — a file renamed and still discovered by the glob passes. The one assertion that outranked the ledger, the recursive walk for a stray untracked `tests/**/*.py`, was salvaged verbatim into `tests/unit/package_manifest.test.mjs` beside the tracked-file count it strengthens: it needs no row to be true and no repository to run, which is exactly why it was worth keeping and the other five were not. The ledger itself is kept, unread, as the record of the migration; its own `doc` now opens by saying it does not execute. |
-
-**On row 8, and the shape it is an example of.** A row whose only gate was a retiring test silently
-demotes from ASSERTED to prose at a deletion — which is the exact failure this file exists to
-prevent. Row 8 was the first to be settled the other way instead: its *stale-factory* half
-describes machinery this tool cannot have, so it is recorded as history and the design argument
-lives at the call site in `js/update.mjs`; its *durable trace* half had a live subject, so it landed
-absolutely on the Node side **before** the code that used to carry it went. Rows 1, 2 and 12 are
-now settled the same way, and row 3's history half with them.
-
-## Not proven anywhere, and worth knowing before a release
-
-* ~~**The three cell harnesses have only ever run on Windows.**~~ **FIXED at P11**, and the
-  two-platform rule outlived the corpora that motivated it: `node-cells` still runs on
-  **`ubuntu-latest` AND `windows-latest`** on every push — `--idempotent` and `--deletion` now,
-  where it replayed all three corpora until 2026-08-17 — and `validate` (doctor plus the whole
-  Node suite) runs on both as well. What the first Linux run found, recorded because it is the
-  honest measure of what one-platform testing hides, and because every one of these was found by
-  a cell harness that no longer exists:
-  * The POSIX shim's `"$@"` was read as a path, so every healthy install's hooks were reported
-    dead — **a user-visible `doctor` bug on every Linux and macOS install**, in both
-    implementations, plus 112 of 259 golden cells and four `--validate-only` tests. Fixed at the
-    single owner.
-  * A POSIX re-exec called `execv` without flushing, so `bootstrap` discarded everything it had
-    printed since the last spawn — a redirected `bootstrap` lost its completion line on every Unix
-    run. Windows has no `exec` and never reaches the line; a terminal hides it because line
-    buffering had already written it.
-  * A cell driver left the interpreter a bare name, which `CreateProcess` resolves against the
-    PARENT's PATH and `execvpe` does not — so any cell that replaces PATH could not spawn the
-    candidate at all off Windows.
-  * A wizard decline was POSITIONAL (six newlines, then `n`), and the wizard does not ask a fixed
-    number of questions. Off Windows the `n` landed one prompt late, the wizard proceeded, and it
-    emitted a whole install into the sandbox HOME.
-  * Two web `expect_re`s named Windows' case-folded catalog order as if it were the only one.
-  * The `link`/`unlink` Unix arm (row 5) and the browser step (row 11).
-* **What the first WINDOWS CI run found, and what the harnesses now guarantee.** The same argument,
-  one platform over: PR #78's first run was green on a Windows laptop and in WSL, and red on
-  `windows-latest`. Every finding was an environment the developer's machine could not produce, so
-  each fix carries a gate that MANUFACTURES the environment rather than one that waits for a runner
-  to supply it.
-  * **Sandbox paths are CANONICAL.** GitHub's Windows runner spells `TEMP` as the 8.3 alias
-    `C:\Users\RUNNER~1\…`; the generator resolves it, so every destamp root matched nothing and the
-    raw sandbox name leaked into 45 byte comparisons — and `git-gate/sovereign-bypass` went VACUOUS
-    because the excludes entry it seeds stopped matching a resolved cwd. `tests/helpers/sandbox.mjs`
-    is the one owner for all three replayers. POSIX reaches the same duality through symlinks and
-    the gates build one there.
-  * **`resolveOut` was `path.resolve` where the reference resolved** — a defect the aliasing exposed
-    and a canonicalising fixture would have hidden. Now `pyResolve`, the twin that already existed
-    for this and is used at nine other sites.
-  * **`pyWhich` did not reproduce the current-directory rule.** `NoDefaultCurrentDirectoryInExePath`
-    is an INPUT, Git Bash defines it and the runner does not. The corpus reached the branch and
-    never varied the variable; `tests/snapshot/pure_snapshot.test.mjs` now drives both states and asserts
-    that exactly one of fifteen answers moves, and which.
-  * **A locale-decoded child stdout** in a Windows-path test, which this repo's `PYTHONUTF8=1`
-    runbook had been making accidentally right.
-  * **A temp-directory cleanup race killed the Linux job** after it had compared 270 of 318 cells;
-    the same commit passed on re-run. A sandbox teardown cannot raise.
-* ~~**The reference is load-bearing.**~~ **HISTORY.** The replayers used to default to the reference
-  as their `--ref`; there is no `--ref` left to default, and since 2026-08-17 there is no recording
-  of it left on the emit, cli or web surfaces either. On those three, this project's only second
-  party is another run of itself.
-* **Nothing measures the surviving corpora's own coverage from the outside.** The claims that stop a corpus
-  quietly ceasing to exercise a function it still names — the fence really varies, the diff reaches
-  past 200 elements, a splitlines case breaks where `split('\n')` does not, a capitalize case where
-  the rest matters, a `len` case where code points and UTF-16 units differ, both arms of every
-  two-valued decision — all live in `tests/snapshot/pure_snapshot.test.mjs` and are written by hand. They
-  are the best thing available and they are a list somebody maintains, not a measurement.
-
-## Standing decisions the cut handed forward
-
-Not limits on what the tool proves: limits that OPENED when the reference went, created by the
-recordings the cut took. They are here rather than in a phase note because the phase note is
-per-machine.
-
-1. ~~**`cli.json` is a frozen oracle as well as a runtime table.**~~ **SETTLED IN P2.** The roles
-   were split rather than ranked. The file MOVED — byte for byte, minus its source digest — to
-   **`js/cli-table.json`**, a product path `package.json` already ships, and it is now the OWNED
-   document: nothing generates it, and the generator, the digest and doctor's row for it are gone.
-   The FROZEN ORACLE role was retired outright: the recorded copy was byte-identical to the table,
-   and a second copy nothing could re-record would have made every legitimate future edit an
-   unblessable red.
-2. **The 26 help fixtures cannot be re-recorded.** Adding or rewording a single CLI flag changes
-   `formatHelp`'s output and reddens `tests/snapshot/cli_help.test.mjs`, with no argparse left to ask.
-   Either the CLI's help text becomes effectively immutable, or the fixtures get re-blessed from
-   the port — which makes them a DETERMINISM check rather than a regression gate, the same
-   degradation `--idempotent`/`--deletion` already carry. Neither is wrong; picking neither is.
-   **This is limit zero with a deadline**, and it is the live one.
-3. ~~**`record-corpus` stops working entirely.**~~ **DONE, and it is what made item 2 sharp.** The
-   job is deleted from `.github/workflows/ci.yml`. With it went the platform-independence gate and
-   the record-twice rot detector: the two recorded platform halves WERE the platform table, and
-   nothing re-derived them. A replacement had to be written while both implementations still
-   existed — a port-recorded corpus proves nothing the port did not already believe — and what was
-   written instead was the two-OS `node-cells` job above, which replayed rather than recorded.
-4. ~~**Every content change is a corpus argument.**~~ **SETTLED ON 2026-08-17 by retiring the emit,
-   cli and web corpora** — see the section of that name above. This is what item 2 looks like once
-   its deadline arrives: the choice was never between a green corpus and a red one, it was between
-   freezing the product and admitting the recording had stopped being evidence. Item 2 is still
-   open, on the 26 help fixtures, and it is still the live one — but it is now the *only* one, and
-   the CLI's help text is a much smaller thing to hold still than every emitted byte.