geneseed 3.1.2 → 3.2.0

package/CHANGELOG.md

@@ -6,6 +6,131 @@ labels in `harness.config.json`. The canonical identity of an *installed* harnes
 is the source fingerprint in `.geneseed-version` (see `geneseed version`), not this
 label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
+## [3.2.0] — 2026-08-27
+
+### Added
+
+- **Laws X and XI — the Law III split, by append.** Law III carried four rules;
+  only its first survived the lean footprint. Its two buried, independently
+  operative sub-rules move to appended laws — **X, Echo the Intent** (state an
+  inferred or ambiguous goal and get agreement before building on it; stop and
+  ask when the ambiguity touches auth, security, production, or user data) and
+  **XI, Absence Is a Claim** (an empty or truncated answer carries a duty:
+  suspect the hidden layer, bind limits per entity, surface the cut). No
+  numeral moves — III keeps its verify-before-asserting core and its 40+
+  citations stay valid; the two citations that actually meant intent-echo
+  (`clarify`, `fresh-eyes`, and Law VI's body) retarget to X, and XI is born
+  anchored (`explorer`'s output contract, `research` step 2). Titles added to
+  all 14 theme voices; `LAW_CLASS`, `LAW_META`, README, SHIPPED, and the
+  first-free-numeral fixture (now XII) updated in step.
+  Spec: `docs/specs/2026-08-27-law-iii-split-design.md`.
+
+### Changed
+
+- **`process 7` assumes its tier.** Its closing sentence leaned on the
+  ontology's Conduct section as its justification, which read as a rule living
+  on the wrong floor. It now carries a proper seam sentence — Conduct governs
+  how an answer speaks; this rule is only the addressing convention, adoptable
+  or droppable like any doctrine rule.
+- **Lean surgery on Laws IV, VI, VIII, IX** — each law's operative clause now
+  lives in its first sentence (fused with the opening aphorism), because the
+  default `--footprint lean` keeps a law's heading plus first sentence only.
+  Before this, a lean install's Law IV confirmed nothing (its first sentence was
+  the CRUD taxonomy), Law IX kept only an aphorism, Law VIII lost its ban list,
+  and Law VI lost its actual rule. No renumbering, no title change; Law VI's
+  closing aphorism ("The web is a source to read…") cut as redundant with the
+  fused opener. Spec: `docs/specs/2026-08-27-lean-surgery-design.md`.
+
+### Fixed
+
+- **`ponytail` cited a law that does not exist** — "`{{LAW}} on reuse`" is now
+  `{{DOCTRINE}} craft 4`, and "`{{LAW}} on scope`" (the only numeral-less law
+  citation in `src/`) is now `{{LAW}} II`.
+- **Laws VI, VII and IX were cited by nothing outside the canon** — each orphan
+  gains one procedural anchor at the step where it bites: VI in `research`
+  (fetched pages) and `ingest` (converted documents), VII in `parallel-agents`
+  (the handoff envelope grants only the access the unit needs), IX in
+  `forge-mcp` (a destructive tool's guard is enforced server-side).
+
+## [3.1.4] — 2026-08-27
+
+### Added
+
+- **`POST /api/pick-folder`** — the OS-native folder chooser behind the console's
+  "Exclude a folder…" and "Deploy to folder…" buttons, previously a deliberate 501. PowerShell's
+  `FolderBrowserDialog` on Windows, the original `osascript` prompt on macOS, `{error}` elsewhere;
+  async spawn with a 300 s timeout, no client input on the command line, declared argv in the
+  spawn allow-list. The decline's rationale (a modal dialog was not worth a spawn row) yielded to
+  the feature being asked for.
+
+### Changed
+
+- **The ponytail refactor** (PR #103, tranches 1–7 of the 2026-08-26 over-engineering audit):
+  dead exports and finished-port scaffolding deleted; one owner per primitive (`js/lib/fs.mjs`,
+  `js/lib/json.mjs`); stdlib in place of hand-rolled walks, `Object.hasOwn`,
+  `import.meta.dirname` (the hook's hot path drops an import), `fetch` daemon probes;
+  `util.parseArgs` tokenizing under `build-driver`'s existing wording; thirteen structural twins
+  merged; `js/web` comment ratio 38 % → 33 % with every load-bearing *why* kept; shared
+  `Sel`/`Switch`/`CatalogRow` components and `d3-force` in the console. Net −339 source lines,
+  zero emitted bytes moved, zero runtime dependencies added, 1067 tests green. Where the audit's
+  premise failed, behaviour parity won: `compact()` and the docs slugger stay hand-rolled, the
+  cli/hook argv parsers stay put — each with its reason recorded.
+
+## [3.1.3] — 2026-08-24
+
+### Added
+
+- **The Journal Atlas console.** A fourth dashboard lens, `journal`: growth rings per section,
+  the newest hand-authored entries, and the constitution drawn as a map — a hub of rules in
+  force, its three tiers, and dashed edges to the skills, agents, memory and wiki they govern.
+  Every node navigates. The map is data-driven where the design was hand-placed: circles size
+  to the text they hold and the pack nodes ride a fitted arc, so a harness with seven
+  invariants or six packs draws the same picture rather than overflowing it.
+- **`atlas`, a twelfth console skin** — loam dark, sage ink, Space Grotesk, pills, in both
+  light and dark. Atlas and Greenhouse default to the journal lens; every other skin is
+  unchanged, and the lens is pickable from any of them in Settings.
+- **`GET /api/recent`** — the newest file-backed entries across the harness. Nothing on the API
+  carried a per-entry date: every catalog row is `{name, title, desc, source}` and a browser
+  cannot stat a path. It answers only the four sections a person writes by hand, and drops any
+  section too large to stat exhaustively rather than reporting the newest of a truncated
+  sample. Declared in `GET_BEYOND_REF` — the GET twin of `POST_BEYOND_REF` — so the route
+  partition keeps its set equality against a reference surface that must not be rewritten.
+- **`overview.install` now reports `build_epoch`** beside `build_time`, so a relative label is
+  computed rather than parsed back out of a formatted stamp.
+- **`Ctrl`/`⌘`+`K` opens Spotlight**, beside `/`. The chord is the one that still works from
+  inside a text field, which is where `/` deliberately does not fire.
+
+### Changed
+
+- **The rail regroups into Codex · Care · Setup**, with the Dashboard on its own and a vitals
+  card above the index — germination, drift, the doctor's verdict, and how long ago the harness
+  was built, on every page. Doctor badges `clean` in words; it used to badge nothing, which
+  reads the same as never having run.
+- **Harnesses and Themes merge into one Harness page**, and About folds into Settings. No route
+  dies: `#/harnesses`, `#/themes` and `#/about` all still resolve. An uninstalled host now
+  offers one `Install…` that discloses its four choices instead of rendering them inline.
+- **The voice gallery is a reference, not a second control.** Every install picks its own voice
+  beside its own footprint, posture and mode; a gallery at the top of the page could only ever
+  act on one of them. It keeps the taglines — which a `<select>` of bare names cannot show —
+  and gives up the buttons.
+- **The rail width is responsive**, `clamp(232px, 18vw, 256px)`, between the two widths the
+  console has been designed at. The breakpoint overrides still win, so it still collapses.
+
+### Fixed
+
+- **The Spotlight input was never wired to its own listbox.** No `role="combobox"`,
+  `aria-expanded`, `aria-controls`, or `aria-activedescendant`, and the rows had no ids —
+  so the arrow keys moved a highlight that was visual and nothing else, and a screen reader
+  was never told results had appeared.
+- **The rail overflowed the document** on short windows once the vitals card was added: a fixed
+  `100vh` box with no scroller of its own produced a second scrollbar beside the page's.
+- **`web/dist` is now gated on the publish path.** It ships in `files[]`, and until now nothing
+  on that path built it or looked at it — the freshness check ran only on pull requests, while
+  `workflow_dispatch` can publish any ref.
+- **Two tests in `laws.test.jsx` failed roughly one run in three.** They gated on rows existing,
+  but the pack selection is seeded in an effect, so there is a rendered frame in which every
+  pack reads as off. The same race, twice, and neither was a product defect.
+
 ## [3.1.2] — 2026-08-24
 
 ### Changed

package/README.md

@@ -12,7 +12,7 @@
 [![Themes](https://img.shields.io/badge/themes-14-9cf)](themes/)
 [![Skills](https://img.shields.io/badge/skills-47-blueviolet)](src/skills/)
 [![Agents](https://img.shields.io/badge/agents-17-orange)](src/agents/)
-[![Laws](https://img.shields.io/badge/laws-9-critical)](src/laws/universal.md)
+[![Laws](https://img.shields.io/badge/laws-11-critical)](src/laws/universal.md)
 [![Plugins](https://img.shields.io/badge/plugins-7-teal)](adapters/opencode/plugins/)
 [![OpenCode · Claude Code · Bob · Copilot · AGENT.md](https://img.shields.io/badge/works%20with-OpenCode%20·%20Claude%20Code%20·%20Bob%20·%20Copilot%20·%20AGENT.md-1f6feb)](#-supported-harnesses)
 
@@ -153,7 +153,7 @@ The harness ships as a small set of layers, and the web console's rail is the sa
 | Layer | What it is |
 | --- | --- |
 | **🧭 Ontology** (`ontology/`) | the mind the rules govern, in four prose sections — **Telos** (the Pact: protect the user, the truth, the agent), **Evidence** (every claim graded by how it was obtained), **Decisions** (classify and tier by reversibility, show the real forks), **Conduct** (answer what was asked, once). Always in force, never toggleable |
-| **🛡️ Rules** (`laws/`) | 9 universal laws the agent obeys — always in force, never toggleable: sealed-secrets, one-intent-one-act, verify-before-assert, deletion-is-deliberate, surface-failures, data-not-orders, least-privilege, root-cause, external-gate |
+| **🛡️ Rules** (`laws/`) | 11 universal laws the agent obeys — always in force, never toggleable: sealed-secrets, one-intent-one-act, verify-before-assert, deletion-is-deliberate, surface-failures, data-not-orders, least-privilege, root-cause, external-gate, echo-the-intent, absence-is-a-claim |
 | **📐 Doctrines** (`doctrines/`) | practice packs, chosen per install at build time: **craft** (how code is written), **rigor** (how work is proven), **ops** (how the machine is operated), **process** (how a task is run). A doctrine rule may tighten a Rule, never repeal one, and the user's own `user-rules.md` outranks it. Pick with `geneseed-build --doctrines craft,rigor` (or `none`), a single rule with `--exclude-rules "process 7"`, in the setup wizard, or through the switches on the console's Constitution page; all four pack files ship on disk either way, so a citation into a pack you left out still resolves |
 | **🤖 Agents** (17) | capability specialists: `reviewer`, `tester`, `architect`, `docs`, `security`, `explorer`, `developer` — plus a debate **council** the `council` skill convenes: `advocate`, `skeptic`, `pragmatist`, `steward`, `visionary`, `user-advocate`, `framer`, `empiricist`, `operator`, `historian` |
 | **🛠 Skills** (47) | repeatable workflows: brainstorm · **clarify** · plan · **codebase-design** · **domain-modeling** · **wayfinder** · **tickets** · tdd · **develop** · debug · **prototype** · refactor · **ponytail** · **forge-mcp** · geneseed-code-review · **fresh-eyes** · **review-response** · commit · **ship** · **release** · **migrate** · **git-archaeology** · **git-rescue** · repo-map · document-project · **frontend-design** · **prose** · **ingest** · **research** · **learning-path** · **gap-detector** · **feynman** · **crash-course** · **drill** · **decode** · handoff · roast-me · **council** · parallel-agents · **workflow** · **wiki** · **geneseed** · **rule** · **profile** · **opencode-theme** · **herdr** · **pipeline** |

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical pointers, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **3.1.2**.
+> string. Current label: **3.2.0**.
 
 > **Spec status audit (2026-06-15).** Every dated spec authored before today was
 > verified against the source tree and confirmed implemented (code + tests + docs);
@@ -35,8 +35,8 @@ Every row below is present in the tree today; "Spec" links the design record.
 | Capability | What it is | Spec |
 | --- | --- | --- |
 | **Themed generator** | One neutral `src/` → 14 themed bundles via `geneseed-build` (zero dependencies); structure stays theme-independent | [DESIGN.md](DESIGN.md) |
-| **Laws / Agents / Skills / Memory / Notebook** | 9 laws, 17 agents, 47 skills, the memory convention, and the agent's sovereign notebook | [notebook](docs/specs/2026-06-11-notebook-sovereign-space.md) · [agent-own-space](docs/specs/2026-06-10-notebook-agent-own-space.md) |
-| **Three-tier constitution** | The governance surface splits into an always-on **Ontology** (Telos, Evidence, Decisions, Conduct — the Pact absorbed into Telos), the nine always-on **Invariants**, and four toggleable **Doctrine** packs (craft, rigor, ops, process) addressed `<pack> <n>`. Packs are chosen at build time with `--doctrines` or the setup wizard; the whole catalogue ships on disk either way, so a citation into an inactive pack still resolves. Precedence, in order: Ontology + Invariants, then the user's `user-rules.md`, then the active Doctrines, then `PROFILE.md`. `doctor`'s `constitutionProblems` gates pack numbering, the per-rule Principle column, every `{{DOCTRINE}}` citation in `src/`, and the rule that an always-on tier may never cite a toggleable one | [three-tier-constitution](docs/specs/2026-08-19-three-tier-constitution-design.md) |
+| **Laws / Agents / Skills / Memory / Notebook** | 11 laws, 17 agents, 47 skills, the memory convention, and the agent's sovereign notebook | [notebook](docs/specs/2026-06-11-notebook-sovereign-space.md) · [agent-own-space](docs/specs/2026-06-10-notebook-agent-own-space.md) |
+| **Three-tier constitution** | The governance surface splits into an always-on **Ontology** (Telos, Evidence, Decisions, Conduct — the Pact absorbed into Telos), the eleven always-on **Invariants**, and four toggleable **Doctrine** packs (craft, rigor, ops, process) addressed `<pack> <n>`. Packs are chosen at build time with `--doctrines` or the setup wizard; the whole catalogue ships on disk either way, so a citation into an inactive pack still resolves. Precedence, in order: Ontology + Invariants, then the user's `user-rules.md`, then the active Doctrines, then `PROFILE.md`. `doctor`'s `constitutionProblems` gates pack numbering, the per-rule Principle column, every `{{DOCTRINE}}` citation in `src/`, and the rule that an always-on tier may never cite a toggleable one | [three-tier-constitution](docs/specs/2026-08-19-three-tier-constitution-design.md) |
 | **`doctor`** | One check: unresolved tokens, dead/non-hermetic links, theme-key parity, authoring gates, rendered-bundle drift | [theme-aware doctor/diff](docs/specs/2026-06-07-theme-aware-doctor-diff.md) |
 | **`diff` + improvements export** | Deployed-vs-source drift report; export an `improvements.md` back-port | [improvements-export](docs/specs/2026-06-12-improvements-export.md) |
 | **`status` / `version`** | Headless dashboard + fingerprint verdict (no TUI needed) | [status-command](docs/specs/2026-06-07-status-command.md) · [version-and-uninstall](docs/specs/2026-06-07-version-and-uninstall.md) |

package/bin/build-driver.mjs

@@ -16,14 +16,16 @@
  * values this file must originate. `ROOT` and the seven paths under it come from this
  * script's own location, not from an inherited `cfg`.
  *
- * TWO KEYS ARE DELIBERATELY ABSENT FROM `cfg`, and their absence is load-bearing.
- * `js_cfg()` (_build_core.py:199) always sends `structure` and `capabilityLinkRe`, because
- * the Python originals are module-level names that TESTS MUTATE — `_OWNED` membership
- * asked one level out. This driver has no Python module to mutate, so it sends neither and
- * `js/build/render.mjs:215`'s `cfg.structure ?? STRUCTURE` and `js/build/bundle.mjs`'s
- * `cfg.capabilityLinkRe ? ... : <default>` take their right-hand branches for the first
- * time. Those two fallbacks have been dead code since they were written — always
- * overridden by the driver that always supplies them. P4 is what makes them live.
+ * A KEY IS DELIBERATELY ABSENT FROM `cfg`, and its absence is load-bearing.
+ * `js_cfg()` (_build_core.py:199) always sent `structure` and `capabilityLinkRe`, because
+ * the Python originals were module-level names that TESTS MUTATE — `_OWNED` membership
+ * asked one level out. This driver has no Python module to mutate, so it sends neither;
+ * `js/build/render.mjs:215`'s `cfg.structure ?? STRUCTURE` takes its right-hand branch for
+ * that reason — a fallback that was dead code until P4, always overridden by the driver
+ * that always supplies it. `capabilityLinkRe`'s equivalent fallback in
+ * `js/build/emit-common.mjs`'s `stripCapabilityLinks` was P4's other one made live, and the
+ * over-engineering cleanup then deleted the override branch outright: nothing had ever
+ * supplied one, so there was no longer a `cfg` left to be absent from.
  *
  * THE FOOTPRINT DEFAULT IS THE FLAG'S, NOT THE FUNCTION'S. `--footprint` defaults to
  * `lean` (build.py:354); every `emit_*`/`build` SIGNATURE defaults to `full`. A driver
@@ -32,15 +34,16 @@
  */
 import {
   existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmdirSync,
-  statSync, unlinkSync,
+  unlinkSync,
 } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { parseArgs as nodeParseArgs } from 'node:util';
 import { build, phaseLog } from '../js/build/bundle.mjs';
 import { emitClaudeRender } from '../js/build/emit-claude.mjs';
 import { emitOpencodeRender, emitOpencodeGlobalRender } from '../js/build/emit-opencode.mjs';
 import { settingsIntegrityCheck } from '../js/hosts/settings.mjs';
-import { writeText, withPlatformNewlines } from '../js/lib/fs.mjs';
+import { writeText, withPlatformNewlines, isFile } from '../js/lib/fs.mjs';
 import { parseJson, jsonDumpsIndent } from '../js/lib/json.mjs';
 // P5c moved these out of this file: `bin/geneseed-cli.mjs` needs the same four resolvers to
 // find a global install, and a resolver that decides WHERE a driver writes is the last thing
@@ -188,6 +191,26 @@ const FLAGS = {
   '-v': 'verbose', '--verbose': 'verbose',
 };
 
+/**
+ * `util.parseArgs`'s own option table, DERIVED from `VALUED`/`FLAGS` rather than typed out a
+ * second time — a hand-written twin is exactly the anti-drift failure this module's docblock
+ * already names for `usage()`. Every `VALUED` entry is `type: 'string'` (so a bare `--flag
+ * value` form is captured as one token instead of leaking `value` as an orphan positional);
+ * every long `FLAGS` entry is `type: 'boolean'`. `-v` gets `short: 'v'` for the same reason
+ * `-h` deliberately does NOT get one below `PARSE_OPTIONS` — see `parseArgs`'s docblock.
+ */
+const PARSE_OPTIONS = Object.fromEntries([
+  ...Object.keys(VALUED).map((f) => [f.slice(2), { type: 'string' }]),
+  ...Object.keys(FLAGS).filter((f) => f.startsWith('--')).map((f) => [f.slice(2), { type: 'boolean' }]),
+]);
+PARSE_OPTIONS.verbose = { type: 'boolean', short: 'v' };
+
+/** `token.name` (dashes stripped, short aliases folded in) -> this file's `args` key. */
+const VALUED_BY_NAME = Object.fromEntries(Object.keys(VALUED).map((f) => [f.slice(2), VALUED[f]]));
+const FLAG_BY_NAME = Object.fromEntries(
+  Object.keys(FLAGS).filter((f) => f.startsWith('--')).map((f) => [f.slice(2), FLAGS[f]]),
+);
+
 /**
  * The four flags `choice` validates, as ONE table for the same anti-drift reason.
  *
@@ -307,7 +330,31 @@ function usage() {
   ].join('\n');
 }
 
-/** argparse's `--flag value` and `--flag=value`, plus the `--target` alias for `--out`. */
+/**
+ * argparse's `--flag value` and `--flag=value`, plus the `--target` alias for `--out` — the
+ * SPLITTING now done by `util.parseArgs({tokens: true})`, with every choice/mutex/wording
+ * decision this function made before P6 (Task 4) still made HERE, unmoved.
+ *
+ * `strict: false` is load-bearing twice: it lets an unrecognized flag surface as a token this
+ * walk can refuse in its OWN words rather than node's, and it is what makes a value-taking
+ * flag (`type: 'string'` in `PARSE_OPTIONS`) swallow the very next raw argument even when that
+ * argument itself looks like a flag — `--theme --posture peer` sets `theme` to the literal
+ * string `"--posture"` and leaves `peer` a stray token, exactly as the hand-rolled version
+ * being replaced did with its own `argv[i += 1]`. That is not a bug this port inherited by
+ * accident: it is the one shape `parseArgs`'s tokenizer reproduces for free, and reproducing
+ * anything smarter (a lookahead that refuses to swallow a flag-shaped value) would be new
+ * behaviour, not a preserved one.
+ *
+ * `-h` DELIBERATELY IS NOT `PARSE_OPTIONS.help`'s short alias. Declaring one would make
+ * `parseArgs` fold a bundled `-vh` into two tokens — `verbose` then `help` — and print the
+ * help text for a cluster the original parser refused outright as one unrecognized argument.
+ * Detecting help by re-reading `argv[tok.index]` for the literal text `-h`/`--help` keeps the
+ * ORIGINAL equality check (`tok === '-h' || tok === '--help'`) intact no matter how `parseArgs`
+ * privately tokenizes the cluster, and `argv[tok.index]` is what recovers that literal text
+ * for every refusal below — `tok.name`/`tok.rawName` are `parseArgs`'s own canonicalisation and
+ * would print `-b`/`-o`/`-g`/`-u`/`-s` for a bundle like `-bogus` where the original parser (and
+ * this one) refuses the whole typed token, `-bogus`, once.
+ */
 function parseArgs(argv, defaults) {
   const args = {
     theme: defaults.theme, posture: defaults.posture, mode: defaults.mode,
@@ -316,11 +363,12 @@ function parseArgs(argv, defaults) {
     out: 'Harness', emit: 'files', footprint: 'lean', root: null,
     syncThemes: false, validateOnly: false, verbose: false,
   };
-  for (let i = 0; i < argv.length; i += 1) {
-    const tok = argv[i];
-    const eq = tok.indexOf('=');
-    const name = eq > 0 ? tok.slice(0, eq) : tok;
-    if (tok === '-h' || tok === '--help') {
+  const { tokens } = nodeParseArgs({
+    args: argv, options: PARSE_OPTIONS, allowPositionals: true, strict: false, tokens: true,
+  });
+  for (const tok of tokens) {
+    if (tok.kind === 'option' && tok.value === undefined
+      && (argv[tok.index] === '-h' || argv[tok.index] === '--help')) {
       process.stdout.write(usage());
       // The same marker `die` throws, with a SUCCESS code: help is not a refusal, and
       // `main`'s catch is what turns either into this process's exit status. A bare
@@ -330,15 +378,24 @@ function parseArgs(argv, defaults) {
       e.exitCode = 0;
       throw e;
     }
-    if (VALUED[name]) {
-      const val = eq > 0 ? tok.slice(eq + 1) : argv[i += 1];
-      if (val === undefined) die(2, `argument ${name}: expected one argument`);
-      args[VALUED[name]] = val;
-    } else if (FLAGS[tok]) {
-      args[FLAGS[tok]] = true;
-    } else {
-      die(2, `unrecognized arguments: ${tok}`);
+    if (tok.kind === 'option' && VALUED_BY_NAME[tok.name] !== undefined) {
+      if (tok.value === undefined) die(2, `argument ${tok.rawName}: expected one argument`);
+      args[VALUED_BY_NAME[tok.name]] = tok.value;
+      continue;
     }
+    // `tok.value === undefined` excludes `--sync-themes=x` from matching here — a store_true
+    // flag never took `=` in the hand-rolled version either, because its `FLAGS[tok]` lookup
+    // keyed on the WHOLE typed token (equals sign and all), never on the split-off flag name.
+    // `parseArgs` always sets a `value` KEY on every option token (`undefined` when none was
+    // given), so this must compare the VALUE, not `'value' in tok` — the key is always there.
+    if (tok.kind === 'option' && tok.value === undefined && FLAG_BY_NAME[tok.name] !== undefined) {
+      args[FLAG_BY_NAME[tok.name]] = true;
+      continue;
+    }
+    // Every other shape — an unrecognized option, a bare positional, or `--` (which `parseArgs`
+    // always treats as a terminator but this parser never did) — refuses with the literal text
+    // typed at that argv position, matching the original's `unrecognized arguments: ${tok}`.
+    die(2, `unrecognized arguments: ${argv[tok.index]}`);
   }
   const choices = choicesFor();
   for (const flag of Object.keys(choices)) choice(flag, args[VALUED[flag]], choices[flag]);
@@ -532,10 +589,6 @@ function writeManifestAtomic(file, data) {
   renameSync(tmp, file);
 }
 
-function isFile(p) {
-  try { return statSync(p).isFile(); } catch { return false; }
-}
-
 /**
  * Write-before-delete: remove only what this layer owned before and no longer produces.
  *
@@ -567,6 +620,30 @@ function pruneOwned(oc, oldOwned, owned) {
   }
 }
 
+/**
+ * The manifest PRE-read all three emit bodies performed inline: does a manifest already
+ * exist at `manifestPath`, and if so, what does it parse to. `existed` is what
+ * `emitOpencode` alone needs (as `manifestExisted`, threaded into the render job); every
+ * caller reads `doc.owned`, and `emitClaudeCore` also reads `doc.managed` — `doc` is `null`
+ * on a missing OR a corrupt manifest, so `(doc && doc.owned) || []` covers both the same way
+ * the three inline try/catches did.
+ */
+function readManifest(manifestPath) {
+  const existed = existsSync(manifestPath);
+  let doc = null;
+  if (existed) {
+    try { doc = parseJson(readFileSync(manifestPath, 'utf8')); } catch { doc = null; }
+  }
+  return { existed, doc };
+}
+
+/** The "+ primary agent, N command(s)" tail both OpenCode summary lines share. */
+function extrasTail(stats) {
+  const extras = [...(stats.primary ? ['primary agent'] : []),
+    ...(stats.nCommands ? [`${stats.nCommands} command(s)`] : [])];
+  return extras.length ? ` + ${extras.join(', ')}` : '';
+}
+
 /**
  * `_build_global._project_survivors` — registered per-repo PROJECT installs of `emitName`.
  *
@@ -624,14 +701,8 @@ function emitOpencode(cfg, args, out) {
   // PRE. A missing manifest reads as "owned nothing before", which is what makes the first
   // re-emit after an upgrade treat already-existing files as the user's (claim-on-create)
   // rather than deleting them. The prune set is then empty by construction.
-  const manifestExisted = existsSync(manifestPath);
-  let oldOwned = [];
-  if (manifestExisted) {
-    try {
-      const m = parseJson(readFileSync(manifestPath, 'utf8'));
-      oldOwned = (m && m.owned) || [];
-    } catch { oldOwned = []; }
-  }
+  const { existed: manifestExisted, doc } = readManifest(manifestPath);
+  const oldOwned = (doc && doc.owned) || [];
 
   const agentPathRel = relUnder(out, root);
   const agentPath = agentPathRel ? `${agentPathRel}/AGENT.md` : 'AGENT.md';
@@ -658,9 +729,7 @@ function emitOpencode(cfg, args, out) {
     scope: 'project',
   });
 
-  const extras = [...(stats.primary ? ['primary agent'] : []),
-    ...(stats.nCommands ? [`${stats.nCommands} command(s)`] : [])];
-  const extra = extras.length ? ` + ${extras.join(', ')}` : '';
+  const extra = extrasTail(stats);
   process.stdout.write(`[geneseed] opencode layer: ${stats.nAgents} subagents, `
     + `${stats.nSkills} skills, ${stats.nPlugins} plugin(s), `
     + `${stats.nWorkflows} workflow file(s), ${cfgName} (instructions: ${agentPath})`
@@ -687,13 +756,8 @@ function emitOpencodeGlobal(cfg, args, out) {
   const cfgDir = args.cfgDir ?? opencodeConfigDir();
   const manifestPath = path.join(cfgDir, GLOBAL_MANIFEST);
 
-  let oldOwned = [];
-  if (existsSync(manifestPath)) {
-    try {
-      const m = parseJson(readFileSync(manifestPath, 'utf8'));
-      oldOwned = (m && m.owned) || [];
-    } catch { oldOwned = []; }
-  }
+  const { doc } = readManifest(manifestPath);
+  const oldOwned = (doc && doc.owned) || [];
 
   const agentPath = path.join(cfgDir, 'AGENT.md').split(path.sep).join('/');
 
@@ -717,9 +781,7 @@ function emitOpencodeGlobal(cfg, args, out) {
     owned: [...owned].sort(),
   });
 
-  const extras = [...(stats.primary ? ['primary agent'] : []),
-    ...(stats.nCommands ? [`${stats.nCommands} command(s)`] : [])];
-  const extra = extras.length ? ` + ${extras.join(', ')}` : '';
+  const extra = extrasTail(stats);
   process.stdout.write(`[geneseed] opencode-global -> ${cfgDir}: ${stats.nAgents} subagents, `
     + `${stats.nSkills} skills, ${stats.nPlugins} plugin(s), `
     + `${stats.nWorkflows} workflow file(s), AGENT.md, ${memStatus}, ${nbStatus}, `
@@ -749,16 +811,10 @@ function emitOpencodeGlobal(cfg, args, out) {
  */
 function emitClaudeCore(cfg, args, { cfgDir, claudeMd, scope, host, out, hookOpts }) {
   const manifestPath = path.join(cfgDir, GLOBAL_MANIFEST);
-  let oldOwned = [];
-  let oldManaged = {};
-  if (existsSync(manifestPath)) {
-    try {
-      const data = parseJson(readFileSync(manifestPath, 'utf8'));
-      oldOwned = data.owned || [];
-      oldManaged = (data.managed && typeof data.managed === 'object'
-        && !Array.isArray(data.managed)) ? data.managed : {};
-    } catch { oldOwned = []; oldManaged = {}; }
-  }
+  const { doc } = readManifest(manifestPath);
+  const oldOwned = (doc && doc.owned) || [];
+  const oldManaged = (doc && doc.managed && typeof doc.managed === 'object'
+    && !Array.isArray(doc.managed)) ? doc.managed : {};
   const isCopilot = host === 'copilot';
 
   // RENDER + WIRE in one child's worth of work. `preambleExclude` is null for every host
@@ -1123,30 +1179,22 @@ function run(argv) {
   // The marker directory is the emit's TARGET, which for a global emit is the config dir it
   // just rendered into and not `--out` at all — so the emit returns it rather than the
   // caller guessing (build.py:427-436 re-resolves; returning it keeps one resolution).
+  //
+  // NINE ARMS, TWO TABLES ALREADY ON FILE: `GLOBAL_EMITS` and `PROJECT_EMITS` above are
+  // exactly this dispatch's `-global` and per-repo halves, keyed by host rather than by
+  // `--emit` name, so splitting the suffix reaches both without a third map.
   let markerDir = out;
-  if (args.emit === 'opencode') {
-    emitOpencode(cfg, args, out);
-  } else if (args.emit === 'opencode-global') {
-    markerDir = emitOpencodeGlobal(cfg, args, out);
-  } else if (args.emit === 'copilot') {
+  if (args.emit.endsWith('-global')) {
+    markerDir = GLOBAL_EMITS[args.emit.slice(0, -'-global'.length)](cfg, args, out);
+  } else if (args.emit !== 'files') {
     // The PROJECT emits keep their markers in `out`, not in the host config dir the emit
     // wrote to (build.py:435-436) — `.github/` is the layer, `out` is the install.
-    emitCopilot(cfg, args, out);
-  } else if (args.emit === 'copilot-global') {
-    markerDir = emitCopilotGlobal(cfg, args, out);
-  } else if (args.emit === 'claude') {
-    emitClaude(cfg, args, out);
-  } else if (args.emit === 'claude-global') {
-    markerDir = emitClaudeGlobal(cfg, args, out);
-  } else if (args.emit === 'bob') {
-    emitBob(cfg, args, out);
-  } else if (args.emit === 'bob-global') {
-    markerDir = emitBobGlobal(cfg, args, out);
+    PROJECT_EMITS[args.emit](cfg, args, out);
   } else {
-    // `nativeCatalog: false` is build.py:421's three-positional-argument call reproduced:
-    // `build(args.theme, out, args.footprint)` leaves `native_catalog` at its signature
-    // default. It is the one signature default this driver DOES inherit, and it is
-    // inherited because the Python CLI inherits it too.
+    // The ninth choice, a plain bundle: `nativeCatalog: false` is build.py:421's
+    // three-positional-argument call reproduced — `build(args.theme, out, args.footprint)`
+    // leaves `native_catalog` at its signature default. It is the one signature default
+    // this driver DOES inherit, and it is inherited because the Python CLI inherits it too.
     build(cfg, args.theme, out, { footprint: args.footprint, nativeCatalog: false });
   }