geneseed 3.1.3 → 3.2.0

package/CHANGELOG.md

@@ -6,6 +6,76 @@ labels in `harness.config.json`. The canonical identity of an *installed* harnes
 is the source fingerprint in `.geneseed-version` (see `geneseed version`), not this
 label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
+## [3.2.0] — 2026-08-27
+
+### Added
+
+- **Laws X and XI — the Law III split, by append.** Law III carried four rules;
+  only its first survived the lean footprint. Its two buried, independently
+  operative sub-rules move to appended laws — **X, Echo the Intent** (state an
+  inferred or ambiguous goal and get agreement before building on it; stop and
+  ask when the ambiguity touches auth, security, production, or user data) and
+  **XI, Absence Is a Claim** (an empty or truncated answer carries a duty:
+  suspect the hidden layer, bind limits per entity, surface the cut). No
+  numeral moves — III keeps its verify-before-asserting core and its 40+
+  citations stay valid; the two citations that actually meant intent-echo
+  (`clarify`, `fresh-eyes`, and Law VI's body) retarget to X, and XI is born
+  anchored (`explorer`'s output contract, `research` step 2). Titles added to
+  all 14 theme voices; `LAW_CLASS`, `LAW_META`, README, SHIPPED, and the
+  first-free-numeral fixture (now XII) updated in step.
+  Spec: `docs/specs/2026-08-27-law-iii-split-design.md`.
+
+### Changed
+
+- **`process 7` assumes its tier.** Its closing sentence leaned on the
+  ontology's Conduct section as its justification, which read as a rule living
+  on the wrong floor. It now carries a proper seam sentence — Conduct governs
+  how an answer speaks; this rule is only the addressing convention, adoptable
+  or droppable like any doctrine rule.
+- **Lean surgery on Laws IV, VI, VIII, IX** — each law's operative clause now
+  lives in its first sentence (fused with the opening aphorism), because the
+  default `--footprint lean` keeps a law's heading plus first sentence only.
+  Before this, a lean install's Law IV confirmed nothing (its first sentence was
+  the CRUD taxonomy), Law IX kept only an aphorism, Law VIII lost its ban list,
+  and Law VI lost its actual rule. No renumbering, no title change; Law VI's
+  closing aphorism ("The web is a source to read…") cut as redundant with the
+  fused opener. Spec: `docs/specs/2026-08-27-lean-surgery-design.md`.
+
+### Fixed
+
+- **`ponytail` cited a law that does not exist** — "`{{LAW}} on reuse`" is now
+  `{{DOCTRINE}} craft 4`, and "`{{LAW}} on scope`" (the only numeral-less law
+  citation in `src/`) is now `{{LAW}} II`.
+- **Laws VI, VII and IX were cited by nothing outside the canon** — each orphan
+  gains one procedural anchor at the step where it bites: VI in `research`
+  (fetched pages) and `ingest` (converted documents), VII in `parallel-agents`
+  (the handoff envelope grants only the access the unit needs), IX in
+  `forge-mcp` (a destructive tool's guard is enforced server-side).
+
+## [3.1.4] — 2026-08-27
+
+### Added
+
+- **`POST /api/pick-folder`** — the OS-native folder chooser behind the console's
+  "Exclude a folder…" and "Deploy to folder…" buttons, previously a deliberate 501. PowerShell's
+  `FolderBrowserDialog` on Windows, the original `osascript` prompt on macOS, `{error}` elsewhere;
+  async spawn with a 300 s timeout, no client input on the command line, declared argv in the
+  spawn allow-list. The decline's rationale (a modal dialog was not worth a spawn row) yielded to
+  the feature being asked for.
+
+### Changed
+
+- **The ponytail refactor** (PR #103, tranches 1–7 of the 2026-08-26 over-engineering audit):
+  dead exports and finished-port scaffolding deleted; one owner per primitive (`js/lib/fs.mjs`,
+  `js/lib/json.mjs`); stdlib in place of hand-rolled walks, `Object.hasOwn`,
+  `import.meta.dirname` (the hook's hot path drops an import), `fetch` daemon probes;
+  `util.parseArgs` tokenizing under `build-driver`'s existing wording; thirteen structural twins
+  merged; `js/web` comment ratio 38 % → 33 % with every load-bearing *why* kept; shared
+  `Sel`/`Switch`/`CatalogRow` components and `d3-force` in the console. Net −339 source lines,
+  zero emitted bytes moved, zero runtime dependencies added, 1067 tests green. Where the audit's
+  premise failed, behaviour parity won: `compact()` and the docs slugger stay hand-rolled, the
+  cli/hook argv parsers stay put — each with its reason recorded.
+
 ## [3.1.3] — 2026-08-24
 
 ### Added

package/README.md

@@ -12,7 +12,7 @@
 [![Themes](https://img.shields.io/badge/themes-14-9cf)](themes/)
 [![Skills](https://img.shields.io/badge/skills-47-blueviolet)](src/skills/)
 [![Agents](https://img.shields.io/badge/agents-17-orange)](src/agents/)
-[![Laws](https://img.shields.io/badge/laws-9-critical)](src/laws/universal.md)
+[![Laws](https://img.shields.io/badge/laws-11-critical)](src/laws/universal.md)
 [![Plugins](https://img.shields.io/badge/plugins-7-teal)](adapters/opencode/plugins/)
 [![OpenCode · Claude Code · Bob · Copilot · AGENT.md](https://img.shields.io/badge/works%20with-OpenCode%20·%20Claude%20Code%20·%20Bob%20·%20Copilot%20·%20AGENT.md-1f6feb)](#-supported-harnesses)
 
@@ -153,7 +153,7 @@ The harness ships as a small set of layers, and the web console's rail is the sa
 | Layer | What it is |
 | --- | --- |
 | **🧭 Ontology** (`ontology/`) | the mind the rules govern, in four prose sections — **Telos** (the Pact: protect the user, the truth, the agent), **Evidence** (every claim graded by how it was obtained), **Decisions** (classify and tier by reversibility, show the real forks), **Conduct** (answer what was asked, once). Always in force, never toggleable |
-| **🛡️ Rules** (`laws/`) | 9 universal laws the agent obeys — always in force, never toggleable: sealed-secrets, one-intent-one-act, verify-before-assert, deletion-is-deliberate, surface-failures, data-not-orders, least-privilege, root-cause, external-gate |
+| **🛡️ Rules** (`laws/`) | 11 universal laws the agent obeys — always in force, never toggleable: sealed-secrets, one-intent-one-act, verify-before-assert, deletion-is-deliberate, surface-failures, data-not-orders, least-privilege, root-cause, external-gate, echo-the-intent, absence-is-a-claim |
 | **📐 Doctrines** (`doctrines/`) | practice packs, chosen per install at build time: **craft** (how code is written), **rigor** (how work is proven), **ops** (how the machine is operated), **process** (how a task is run). A doctrine rule may tighten a Rule, never repeal one, and the user's own `user-rules.md` outranks it. Pick with `geneseed-build --doctrines craft,rigor` (or `none`), a single rule with `--exclude-rules "process 7"`, in the setup wizard, or through the switches on the console's Constitution page; all four pack files ship on disk either way, so a citation into a pack you left out still resolves |
 | **🤖 Agents** (17) | capability specialists: `reviewer`, `tester`, `architect`, `docs`, `security`, `explorer`, `developer` — plus a debate **council** the `council` skill convenes: `advocate`, `skeptic`, `pragmatist`, `steward`, `visionary`, `user-advocate`, `framer`, `empiricist`, `operator`, `historian` |
 | **🛠 Skills** (47) | repeatable workflows: brainstorm · **clarify** · plan · **codebase-design** · **domain-modeling** · **wayfinder** · **tickets** · tdd · **develop** · debug · **prototype** · refactor · **ponytail** · **forge-mcp** · geneseed-code-review · **fresh-eyes** · **review-response** · commit · **ship** · **release** · **migrate** · **git-archaeology** · **git-rescue** · repo-map · document-project · **frontend-design** · **prose** · **ingest** · **research** · **learning-path** · **gap-detector** · **feynman** · **crash-course** · **drill** · **decode** · handoff · roast-me · **council** · parallel-agents · **workflow** · **wiki** · **geneseed** · **rule** · **profile** · **opencode-theme** · **herdr** · **pipeline** |

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical pointers, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **3.1.3**.
+> string. Current label: **3.2.0**.
 
 > **Spec status audit (2026-06-15).** Every dated spec authored before today was
 > verified against the source tree and confirmed implemented (code + tests + docs);
@@ -35,8 +35,8 @@ Every row below is present in the tree today; "Spec" links the design record.
 | Capability | What it is | Spec |
 | --- | --- | --- |
 | **Themed generator** | One neutral `src/` → 14 themed bundles via `geneseed-build` (zero dependencies); structure stays theme-independent | [DESIGN.md](DESIGN.md) |
-| **Laws / Agents / Skills / Memory / Notebook** | 9 laws, 17 agents, 47 skills, the memory convention, and the agent's sovereign notebook | [notebook](docs/specs/2026-06-11-notebook-sovereign-space.md) · [agent-own-space](docs/specs/2026-06-10-notebook-agent-own-space.md) |
-| **Three-tier constitution** | The governance surface splits into an always-on **Ontology** (Telos, Evidence, Decisions, Conduct — the Pact absorbed into Telos), the nine always-on **Invariants**, and four toggleable **Doctrine** packs (craft, rigor, ops, process) addressed `<pack> <n>`. Packs are chosen at build time with `--doctrines` or the setup wizard; the whole catalogue ships on disk either way, so a citation into an inactive pack still resolves. Precedence, in order: Ontology + Invariants, then the user's `user-rules.md`, then the active Doctrines, then `PROFILE.md`. `doctor`'s `constitutionProblems` gates pack numbering, the per-rule Principle column, every `{{DOCTRINE}}` citation in `src/`, and the rule that an always-on tier may never cite a toggleable one | [three-tier-constitution](docs/specs/2026-08-19-three-tier-constitution-design.md) |
+| **Laws / Agents / Skills / Memory / Notebook** | 11 laws, 17 agents, 47 skills, the memory convention, and the agent's sovereign notebook | [notebook](docs/specs/2026-06-11-notebook-sovereign-space.md) · [agent-own-space](docs/specs/2026-06-10-notebook-agent-own-space.md) |
+| **Three-tier constitution** | The governance surface splits into an always-on **Ontology** (Telos, Evidence, Decisions, Conduct — the Pact absorbed into Telos), the eleven always-on **Invariants**, and four toggleable **Doctrine** packs (craft, rigor, ops, process) addressed `<pack> <n>`. Packs are chosen at build time with `--doctrines` or the setup wizard; the whole catalogue ships on disk either way, so a citation into an inactive pack still resolves. Precedence, in order: Ontology + Invariants, then the user's `user-rules.md`, then the active Doctrines, then `PROFILE.md`. `doctor`'s `constitutionProblems` gates pack numbering, the per-rule Principle column, every `{{DOCTRINE}}` citation in `src/`, and the rule that an always-on tier may never cite a toggleable one | [three-tier-constitution](docs/specs/2026-08-19-three-tier-constitution-design.md) |
 | **`doctor`** | One check: unresolved tokens, dead/non-hermetic links, theme-key parity, authoring gates, rendered-bundle drift | [theme-aware doctor/diff](docs/specs/2026-06-07-theme-aware-doctor-diff.md) |
 | **`diff` + improvements export** | Deployed-vs-source drift report; export an `improvements.md` back-port | [improvements-export](docs/specs/2026-06-12-improvements-export.md) |
 | **`status` / `version`** | Headless dashboard + fingerprint verdict (no TUI needed) | [status-command](docs/specs/2026-06-07-status-command.md) · [version-and-uninstall](docs/specs/2026-06-07-version-and-uninstall.md) |

package/bin/build-driver.mjs

@@ -16,14 +16,16 @@
  * values this file must originate. `ROOT` and the seven paths under it come from this
  * script's own location, not from an inherited `cfg`.
  *
- * TWO KEYS ARE DELIBERATELY ABSENT FROM `cfg`, and their absence is load-bearing.
- * `js_cfg()` (_build_core.py:199) always sends `structure` and `capabilityLinkRe`, because
- * the Python originals are module-level names that TESTS MUTATE — `_OWNED` membership
- * asked one level out. This driver has no Python module to mutate, so it sends neither and
- * `js/build/render.mjs:215`'s `cfg.structure ?? STRUCTURE` and `js/build/bundle.mjs`'s
- * `cfg.capabilityLinkRe ? ... : <default>` take their right-hand branches for the first
- * time. Those two fallbacks have been dead code since they were written — always
- * overridden by the driver that always supplies them. P4 is what makes them live.
+ * A KEY IS DELIBERATELY ABSENT FROM `cfg`, and its absence is load-bearing.
+ * `js_cfg()` (_build_core.py:199) always sent `structure` and `capabilityLinkRe`, because
+ * the Python originals were module-level names that TESTS MUTATE — `_OWNED` membership
+ * asked one level out. This driver has no Python module to mutate, so it sends neither;
+ * `js/build/render.mjs:215`'s `cfg.structure ?? STRUCTURE` takes its right-hand branch for
+ * that reason — a fallback that was dead code until P4, always overridden by the driver
+ * that always supplies it. `capabilityLinkRe`'s equivalent fallback in
+ * `js/build/emit-common.mjs`'s `stripCapabilityLinks` was P4's other one made live, and the
+ * over-engineering cleanup then deleted the override branch outright: nothing had ever
+ * supplied one, so there was no longer a `cfg` left to be absent from.
  *
  * THE FOOTPRINT DEFAULT IS THE FLAG'S, NOT THE FUNCTION'S. `--footprint` defaults to
  * `lean` (build.py:354); every `emit_*`/`build` SIGNATURE defaults to `full`. A driver
@@ -32,15 +34,16 @@
  */
 import {
   existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmdirSync,
-  statSync, unlinkSync,
+  unlinkSync,
 } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { parseArgs as nodeParseArgs } from 'node:util';
 import { build, phaseLog } from '../js/build/bundle.mjs';
 import { emitClaudeRender } from '../js/build/emit-claude.mjs';
 import { emitOpencodeRender, emitOpencodeGlobalRender } from '../js/build/emit-opencode.mjs';
 import { settingsIntegrityCheck } from '../js/hosts/settings.mjs';
-import { writeText, withPlatformNewlines } from '../js/lib/fs.mjs';
+import { writeText, withPlatformNewlines, isFile } from '../js/lib/fs.mjs';
 import { parseJson, jsonDumpsIndent } from '../js/lib/json.mjs';
 // P5c moved these out of this file: `bin/geneseed-cli.mjs` needs the same four resolvers to
 // find a global install, and a resolver that decides WHERE a driver writes is the last thing
@@ -188,6 +191,26 @@ const FLAGS = {
   '-v': 'verbose', '--verbose': 'verbose',
 };
 
+/**
+ * `util.parseArgs`'s own option table, DERIVED from `VALUED`/`FLAGS` rather than typed out a
+ * second time — a hand-written twin is exactly the anti-drift failure this module's docblock
+ * already names for `usage()`. Every `VALUED` entry is `type: 'string'` (so a bare `--flag
+ * value` form is captured as one token instead of leaking `value` as an orphan positional);
+ * every long `FLAGS` entry is `type: 'boolean'`. `-v` gets `short: 'v'` for the same reason
+ * `-h` deliberately does NOT get one below `PARSE_OPTIONS` — see `parseArgs`'s docblock.
+ */
+const PARSE_OPTIONS = Object.fromEntries([
+  ...Object.keys(VALUED).map((f) => [f.slice(2), { type: 'string' }]),
+  ...Object.keys(FLAGS).filter((f) => f.startsWith('--')).map((f) => [f.slice(2), { type: 'boolean' }]),
+]);
+PARSE_OPTIONS.verbose = { type: 'boolean', short: 'v' };
+
+/** `token.name` (dashes stripped, short aliases folded in) -> this file's `args` key. */
+const VALUED_BY_NAME = Object.fromEntries(Object.keys(VALUED).map((f) => [f.slice(2), VALUED[f]]));
+const FLAG_BY_NAME = Object.fromEntries(
+  Object.keys(FLAGS).filter((f) => f.startsWith('--')).map((f) => [f.slice(2), FLAGS[f]]),
+);
+
 /**
  * The four flags `choice` validates, as ONE table for the same anti-drift reason.
  *
@@ -307,7 +330,31 @@ function usage() {
   ].join('\n');
 }
 
-/** argparse's `--flag value` and `--flag=value`, plus the `--target` alias for `--out`. */
+/**
+ * argparse's `--flag value` and `--flag=value`, plus the `--target` alias for `--out` — the
+ * SPLITTING now done by `util.parseArgs({tokens: true})`, with every choice/mutex/wording
+ * decision this function made before P6 (Task 4) still made HERE, unmoved.
+ *
+ * `strict: false` is load-bearing twice: it lets an unrecognized flag surface as a token this
+ * walk can refuse in its OWN words rather than node's, and it is what makes a value-taking
+ * flag (`type: 'string'` in `PARSE_OPTIONS`) swallow the very next raw argument even when that
+ * argument itself looks like a flag — `--theme --posture peer` sets `theme` to the literal
+ * string `"--posture"` and leaves `peer` a stray token, exactly as the hand-rolled version
+ * being replaced did with its own `argv[i += 1]`. That is not a bug this port inherited by
+ * accident: it is the one shape `parseArgs`'s tokenizer reproduces for free, and reproducing
+ * anything smarter (a lookahead that refuses to swallow a flag-shaped value) would be new
+ * behaviour, not a preserved one.
+ *
+ * `-h` DELIBERATELY IS NOT `PARSE_OPTIONS.help`'s short alias. Declaring one would make
+ * `parseArgs` fold a bundled `-vh` into two tokens — `verbose` then `help` — and print the
+ * help text for a cluster the original parser refused outright as one unrecognized argument.
+ * Detecting help by re-reading `argv[tok.index]` for the literal text `-h`/`--help` keeps the
+ * ORIGINAL equality check (`tok === '-h' || tok === '--help'`) intact no matter how `parseArgs`
+ * privately tokenizes the cluster, and `argv[tok.index]` is what recovers that literal text
+ * for every refusal below — `tok.name`/`tok.rawName` are `parseArgs`'s own canonicalisation and
+ * would print `-b`/`-o`/`-g`/`-u`/`-s` for a bundle like `-bogus` where the original parser (and
+ * this one) refuses the whole typed token, `-bogus`, once.
+ */
 function parseArgs(argv, defaults) {
   const args = {
     theme: defaults.theme, posture: defaults.posture, mode: defaults.mode,
@@ -316,11 +363,12 @@ function parseArgs(argv, defaults) {
     out: 'Harness', emit: 'files', footprint: 'lean', root: null,
     syncThemes: false, validateOnly: false, verbose: false,
   };
-  for (let i = 0; i < argv.length; i += 1) {
-    const tok = argv[i];
-    const eq = tok.indexOf('=');
-    const name = eq > 0 ? tok.slice(0, eq) : tok;
-    if (tok === '-h' || tok === '--help') {
+  const { tokens } = nodeParseArgs({
+    args: argv, options: PARSE_OPTIONS, allowPositionals: true, strict: false, tokens: true,
+  });
+  for (const tok of tokens) {
+    if (tok.kind === 'option' && tok.value === undefined
+      && (argv[tok.index] === '-h' || argv[tok.index] === '--help')) {
       process.stdout.write(usage());
       // The same marker `die` throws, with a SUCCESS code: help is not a refusal, and
       // `main`'s catch is what turns either into this process's exit status. A bare
@@ -330,15 +378,24 @@ function parseArgs(argv, defaults) {
       e.exitCode = 0;
       throw e;
     }
-    if (VALUED[name]) {
-      const val = eq > 0 ? tok.slice(eq + 1) : argv[i += 1];
-      if (val === undefined) die(2, `argument ${name}: expected one argument`);
-      args[VALUED[name]] = val;
-    } else if (FLAGS[tok]) {
-      args[FLAGS[tok]] = true;
-    } else {
-      die(2, `unrecognized arguments: ${tok}`);
+    if (tok.kind === 'option' && VALUED_BY_NAME[tok.name] !== undefined) {
+      if (tok.value === undefined) die(2, `argument ${tok.rawName}: expected one argument`);
+      args[VALUED_BY_NAME[tok.name]] = tok.value;
+      continue;
     }
+    // `tok.value === undefined` excludes `--sync-themes=x` from matching here — a store_true
+    // flag never took `=` in the hand-rolled version either, because its `FLAGS[tok]` lookup
+    // keyed on the WHOLE typed token (equals sign and all), never on the split-off flag name.
+    // `parseArgs` always sets a `value` KEY on every option token (`undefined` when none was
+    // given), so this must compare the VALUE, not `'value' in tok` — the key is always there.
+    if (tok.kind === 'option' && tok.value === undefined && FLAG_BY_NAME[tok.name] !== undefined) {
+      args[FLAG_BY_NAME[tok.name]] = true;
+      continue;
+    }
+    // Every other shape — an unrecognized option, a bare positional, or `--` (which `parseArgs`
+    // always treats as a terminator but this parser never did) — refuses with the literal text
+    // typed at that argv position, matching the original's `unrecognized arguments: ${tok}`.
+    die(2, `unrecognized arguments: ${argv[tok.index]}`);
   }
   const choices = choicesFor();
   for (const flag of Object.keys(choices)) choice(flag, args[VALUED[flag]], choices[flag]);
@@ -532,10 +589,6 @@ function writeManifestAtomic(file, data) {
   renameSync(tmp, file);
 }
 
-function isFile(p) {
-  try { return statSync(p).isFile(); } catch { return false; }
-}
-
 /**
  * Write-before-delete: remove only what this layer owned before and no longer produces.
  *
@@ -567,6 +620,30 @@ function pruneOwned(oc, oldOwned, owned) {
   }
 }
 
+/**
+ * The manifest PRE-read all three emit bodies performed inline: does a manifest already
+ * exist at `manifestPath`, and if so, what does it parse to. `existed` is what
+ * `emitOpencode` alone needs (as `manifestExisted`, threaded into the render job); every
+ * caller reads `doc.owned`, and `emitClaudeCore` also reads `doc.managed` — `doc` is `null`
+ * on a missing OR a corrupt manifest, so `(doc && doc.owned) || []` covers both the same way
+ * the three inline try/catches did.
+ */
+function readManifest(manifestPath) {
+  const existed = existsSync(manifestPath);
+  let doc = null;
+  if (existed) {
+    try { doc = parseJson(readFileSync(manifestPath, 'utf8')); } catch { doc = null; }
+  }
+  return { existed, doc };
+}
+
+/** The "+ primary agent, N command(s)" tail both OpenCode summary lines share. */
+function extrasTail(stats) {
+  const extras = [...(stats.primary ? ['primary agent'] : []),
+    ...(stats.nCommands ? [`${stats.nCommands} command(s)`] : [])];
+  return extras.length ? ` + ${extras.join(', ')}` : '';
+}
+
 /**
  * `_build_global._project_survivors` — registered per-repo PROJECT installs of `emitName`.
  *
@@ -624,14 +701,8 @@ function emitOpencode(cfg, args, out) {
   // PRE. A missing manifest reads as "owned nothing before", which is what makes the first
   // re-emit after an upgrade treat already-existing files as the user's (claim-on-create)
   // rather than deleting them. The prune set is then empty by construction.
-  const manifestExisted = existsSync(manifestPath);
-  let oldOwned = [];
-  if (manifestExisted) {
-    try {
-      const m = parseJson(readFileSync(manifestPath, 'utf8'));
-      oldOwned = (m && m.owned) || [];
-    } catch { oldOwned = []; }
-  }
+  const { existed: manifestExisted, doc } = readManifest(manifestPath);
+  const oldOwned = (doc && doc.owned) || [];
 
   const agentPathRel = relUnder(out, root);
   const agentPath = agentPathRel ? `${agentPathRel}/AGENT.md` : 'AGENT.md';
@@ -658,9 +729,7 @@ function emitOpencode(cfg, args, out) {
     scope: 'project',
   });
 
-  const extras = [...(stats.primary ? ['primary agent'] : []),
-    ...(stats.nCommands ? [`${stats.nCommands} command(s)`] : [])];
-  const extra = extras.length ? ` + ${extras.join(', ')}` : '';
+  const extra = extrasTail(stats);
   process.stdout.write(`[geneseed] opencode layer: ${stats.nAgents} subagents, `
     + `${stats.nSkills} skills, ${stats.nPlugins} plugin(s), `
     + `${stats.nWorkflows} workflow file(s), ${cfgName} (instructions: ${agentPath})`
@@ -687,13 +756,8 @@ function emitOpencodeGlobal(cfg, args, out) {
   const cfgDir = args.cfgDir ?? opencodeConfigDir();
   const manifestPath = path.join(cfgDir, GLOBAL_MANIFEST);
 
-  let oldOwned = [];
-  if (existsSync(manifestPath)) {
-    try {
-      const m = parseJson(readFileSync(manifestPath, 'utf8'));
-      oldOwned = (m && m.owned) || [];
-    } catch { oldOwned = []; }
-  }
+  const { doc } = readManifest(manifestPath);
+  const oldOwned = (doc && doc.owned) || [];
 
   const agentPath = path.join(cfgDir, 'AGENT.md').split(path.sep).join('/');
 
@@ -717,9 +781,7 @@ function emitOpencodeGlobal(cfg, args, out) {
     owned: [...owned].sort(),
   });
 
-  const extras = [...(stats.primary ? ['primary agent'] : []),
-    ...(stats.nCommands ? [`${stats.nCommands} command(s)`] : [])];
-  const extra = extras.length ? ` + ${extras.join(', ')}` : '';
+  const extra = extrasTail(stats);
   process.stdout.write(`[geneseed] opencode-global -> ${cfgDir}: ${stats.nAgents} subagents, `
     + `${stats.nSkills} skills, ${stats.nPlugins} plugin(s), `
     + `${stats.nWorkflows} workflow file(s), AGENT.md, ${memStatus}, ${nbStatus}, `
@@ -749,16 +811,10 @@ function emitOpencodeGlobal(cfg, args, out) {
  */
 function emitClaudeCore(cfg, args, { cfgDir, claudeMd, scope, host, out, hookOpts }) {
   const manifestPath = path.join(cfgDir, GLOBAL_MANIFEST);
-  let oldOwned = [];
-  let oldManaged = {};
-  if (existsSync(manifestPath)) {
-    try {
-      const data = parseJson(readFileSync(manifestPath, 'utf8'));
-      oldOwned = data.owned || [];
-      oldManaged = (data.managed && typeof data.managed === 'object'
-        && !Array.isArray(data.managed)) ? data.managed : {};
-    } catch { oldOwned = []; oldManaged = {}; }
-  }
+  const { doc } = readManifest(manifestPath);
+  const oldOwned = (doc && doc.owned) || [];
+  const oldManaged = (doc && doc.managed && typeof doc.managed === 'object'
+    && !Array.isArray(doc.managed)) ? doc.managed : {};
   const isCopilot = host === 'copilot';
 
   // RENDER + WIRE in one child's worth of work. `preambleExclude` is null for every host
@@ -1123,30 +1179,22 @@ function run(argv) {
   // The marker directory is the emit's TARGET, which for a global emit is the config dir it
   // just rendered into and not `--out` at all — so the emit returns it rather than the
   // caller guessing (build.py:427-436 re-resolves; returning it keeps one resolution).
+  //
+  // NINE ARMS, TWO TABLES ALREADY ON FILE: `GLOBAL_EMITS` and `PROJECT_EMITS` above are
+  // exactly this dispatch's `-global` and per-repo halves, keyed by host rather than by
+  // `--emit` name, so splitting the suffix reaches both without a third map.
   let markerDir = out;
-  if (args.emit === 'opencode') {
-    emitOpencode(cfg, args, out);
-  } else if (args.emit === 'opencode-global') {
-    markerDir = emitOpencodeGlobal(cfg, args, out);
-  } else if (args.emit === 'copilot') {
+  if (args.emit.endsWith('-global')) {
+    markerDir = GLOBAL_EMITS[args.emit.slice(0, -'-global'.length)](cfg, args, out);
+  } else if (args.emit !== 'files') {
     // The PROJECT emits keep their markers in `out`, not in the host config dir the emit
     // wrote to (build.py:435-436) — `.github/` is the layer, `out` is the install.
-    emitCopilot(cfg, args, out);
-  } else if (args.emit === 'copilot-global') {
-    markerDir = emitCopilotGlobal(cfg, args, out);
-  } else if (args.emit === 'claude') {
-    emitClaude(cfg, args, out);
-  } else if (args.emit === 'claude-global') {
-    markerDir = emitClaudeGlobal(cfg, args, out);
-  } else if (args.emit === 'bob') {
-    emitBob(cfg, args, out);
-  } else if (args.emit === 'bob-global') {
-    markerDir = emitBobGlobal(cfg, args, out);
+    PROJECT_EMITS[args.emit](cfg, args, out);
   } else {
-    // `nativeCatalog: false` is build.py:421's three-positional-argument call reproduced:
-    // `build(args.theme, out, args.footprint)` leaves `native_catalog` at its signature
-    // default. It is the one signature default this driver DOES inherit, and it is
-    // inherited because the Python CLI inherits it too.
+    // The ninth choice, a plain bundle: `nativeCatalog: false` is build.py:421's
+    // three-positional-argument call reproduced — `build(args.theme, out, args.footprint)`
+    // leaves `native_catalog` at its signature default. It is the one signature default
+    // this driver DOES inherit, and it is inherited because the Python CLI inherits it too.
     build(cfg, args.theme, out, { footprint: args.footprint, nativeCatalog: false });
   }
 

package/bin/geneseed-cli.mjs

@@ -56,6 +56,7 @@ import { cmdExclude } from '../js/inspect/excludes.mjs';
 import { cmdBuild, cmdPrompt, cmdRebuildAll, cmdTheme } from '../js/build/generate.mjs';
 import { cmdMigrate } from '../js/maintain/migrate.mjs';
 import { parseIntStrict } from '../js/lib/text.mjs';
+import { printErr } from '../js/lib/fs.mjs';
 import { cmdLink, cmdUnlink } from '../js/hosts/link.mjs';
 import { cmdMcp } from '../js/hosts/mcp.mjs';
 import { cmdMemory } from '../js/maintain/memory.mjs';
@@ -83,56 +84,31 @@ import { cmdWeb } from '../js/web/server.mjs';
  * `tests/test_hook_cli_parity.py` scrapes `const VERBS = {` for its three matrix gates, and
  * `main`'s refusal lists `Object.keys(VERBS)` IN THIS ORDER, which `harness_golden` cells
  * assert verbatim — the order is the old table's and is not alphabetical.
+ *
+ * FLATTENED TO `verb: fn` since Task 5: every row was a single-field `{ fn: cmdX }` object,
+ * the one field this table has left after `positionals`/`options`/`flags`/etc moved to
+ * `js/cli-table.json` above. `main` reads `VERBS[verb]` directly rather than
+ * `VERBS[verb].fn` now; the scraping regexes in `tests/unit/{cli_table,hook_cli,docs}.test.mjs`
+ * match on the KEY and the colon only; the literal string `const VERBS = {` and the key
+ * order neither changed.
  */
 const VERBS = {
-  exclude: {
-    fn: cmdExclude,
-  },
-  status: {
-    fn: cmdStatus,
-  },
-  version: {
-    fn: cmdVersion,
-  },
-  build: {
-    fn: cmdBuild,
-  },
-  prompt: {
-    fn: cmdPrompt,
-  },
-  theme: {
-    fn: cmdTheme,
-  },
-  diff: {
-    fn: cmdDiff,
-  },
-  'rebuild-all': {
-    fn: cmdRebuildAll,
-  },
-  migrate: {
-    fn: cmdMigrate,
-  },
-  doctor: {
-    fn: cmdDoctor,
-  },
-  uninstall: {
-    fn: cmdUninstall,
-  },
-  link: {
-    fn: cmdLink,
-  },
-  unlink: {
-    fn: cmdUnlink,
-  },
-  setup: {
-    fn: cmdSetup,
-  },
-  web: {
-    fn: cmdWeb,
-  },
-  upgrade: {
-    fn: cmdUpgrade,
-  },
+  exclude: cmdExclude,
+  status: cmdStatus,
+  version: cmdVersion,
+  build: cmdBuild,
+  prompt: cmdPrompt,
+  theme: cmdTheme,
+  diff: cmdDiff,
+  'rebuild-all': cmdRebuildAll,
+  migrate: cmdMigrate,
+  doctor: cmdDoctor,
+  uninstall: cmdUninstall,
+  link: cmdLink,
+  unlink: cmdUnlink,
+  setup: cmdSetup,
+  web: cmdWeb,
+  upgrade: cmdUpgrade,
   // `up.add_parser(..., aliases=["update"])`, reproduced in P8c as a ROW OF ITS OWN rather than
   // as an `aliases` field on the row above — because a field would be a DECLARATION and the
   // three matrix gates read this table as the DISPATCH (rule 7, and M23 is where it was
@@ -144,28 +120,18 @@ const VERBS = {
   //
   // It is NOT what the web console's `update` ACTION needs: that row's argv names `upgrade`,
   // the subparser, and always did. The two were coupled only in a handoff's note.
-  update: {
-    fn: cmdUpgrade,
-  },
-  'sync-self': {
-    // Points at `cmdSyncSelf` rather than at `cmdUpgrade`, and that is not tidiness:
-    // `sync-self` DROPS its `ref` before `upgrade` ever sees it, where `upgrade` both WARNS
-    // about one and re-reads it as a theme — so the two verbs answer `sync-self cyberpunk`
-    // and `sync-self v1.2.3` differently. See `js/maintain/update.mjs`'s `syncSelf` for both halves.
-    fn: cmdSyncSelf,
-  },
-  bootstrap: {
-    fn: cmdBootstrap,
-  },
+  update: cmdUpgrade,
+  // Points at `cmdSyncSelf` rather than at `cmdUpgrade`, and that is not tidiness:
+  // `sync-self` DROPS its `ref` before `upgrade` ever sees it, where `upgrade` both WARNS
+  // about one and re-reads it as a theme — so the two verbs answer `sync-self cyberpunk`
+  // and `sync-self v1.2.3` differently. See `js/maintain/update.mjs`'s `syncSelf` for both halves.
+  'sync-self': cmdSyncSelf,
+  bootstrap: cmdBootstrap,
   // P7a. Both are DISPATCHERS whose off-TTY arm is the whole of what a cell can reach, and
   // `menu`'s on-TTY arm falls back rather than opening a panel — `js/ui/menu.mjs`'s header
   // argues both.
-  menu: {
-    fn: cmdMenu,
-  },
-  home: {
-    fn: cmdHome,
-  },
+  menu: cmdMenu,
+  home: cmdHome,
   // P7b, and it is the twenty-fifth and last. `cmd_tui`'s FIRST arm is `if not sys.stdin.
   // isatty()`, so off a TTY — which is every cell there is — the verb is one line and an
   // exit code, and that arm crosses byte for byte. The panel behind it is P7c's;
@@ -173,9 +139,7 @@ const VERBS = {
   // panel-unavailable line rather than inventing a second full-screen UI, and
   // `tests/test_tui_boundary.py` asserts that the arm it declares is genuinely unreachable
   // here rather than merely untested.
-  tui: {
-    fn: cmdTui,
-  },
+  tui: cmdTui,
   // THE THREE THAT NEVER HAD A PYTHON ORIGINAL, and they are last for that reason rather
   // than by alphabet: every row above is the twin of a subparser, and these three are not.
   // The information behind them existed only behind the web console — the catalog endpoint,
@@ -190,21 +154,15 @@ const VERBS = {
   // ABSOLUTE — `tests/snapshot/cli_help.test.mjs` splits the two populations by name and refuses a
   // verb that falls into neither, and each has its own unit gate stating what it does rather
   // than that it agrees.
-  catalog: {
-    fn: cmdCatalog,
-  },
-  mcp: {
-    fn: cmdMcp,
-  },
-  memory: {
-    fn: cmdMemory,
-  },
+  catalog: cmdCatalog,
+  mcp: cmdMcp,
+  memory: cmdMemory,
 };
 
 function die(code, msg) {
   // CRLF on Windows, for the same reason `js/hosts/hooks.mjs`'s funnels translate: argparse writes
-  // this line through `sys.stderr`, which does.
-  process.stderr.write(`geneseed: error: ${msg}${process.platform === 'win32' ? '\r\n' : '\n'}`);
+  // this line through `sys.stderr`, which does. `printErr` owns the `\n`-to-`os.linesep` rule.
+  printErr(`geneseed: error: ${msg}\n`);
   return code;
 }
 
@@ -358,8 +316,8 @@ async function main(argv) {
       throw e;
     }
   }
-  const spec = VERBS[verb];
-  if (!spec) {
+  const fn = VERBS[verb];
+  if (!fn) {
     // "and every other harness subcommand is still Python — run the interpreter against the
     // old harness script" is GONE, and its removal is not cosmetic: with the four hook verbs
     // named, the two entry points now cover every subcommand there is, so the clause was not
@@ -395,7 +353,7 @@ async function main(argv) {
     // it `process.exitCode` would be assigned a PENDING PROMISE, which Node coerces to 0
     // and prints nothing about. `web status` would then report "not running" and exit 0.
     // Awaiting a number is a no-op for the ten synchronous verbs.
-    return await spec.fn(parsed.args);
+    return await fn(parsed.args);
   } catch (e) {
     // `e.exitCode` is the generator's existing marker for a DELIBERATE refusal that has
     // already explained itself on stderr — `js/build/emit-claude.mjs` reads the same flag, and it is

package/bin/geneseed-hook.mjs

@@ -39,6 +39,9 @@
  */
 import { cmdContext, cmdGitGate, cmdRuleGate, cmdLearn } from '../js/hosts/hooks.mjs';
 import { printHelp } from '../js/ui/cli.mjs';
+// Not a new module on the hot path: `js/hosts/hooks.mjs` above already imports
+// `js/lib/fs.mjs`, so this edge names a file the process has already loaded.
+import { printErr } from '../js/lib/fs.mjs';
 
 const VERBS = {
   context: { fn: cmdContext, flags: { '--root': 'root' } },
@@ -54,8 +57,8 @@ const VERBS = {
 
 function die(code, msg) {
   // CRLF on Windows, for the same reason `js/hosts/hooks.mjs`'s funnels translate: argparse
-  // writes this line through `sys.stderr`, which does.
-  process.stderr.write(`geneseed-hook: error: ${msg}${process.platform === 'win32' ? '\r\n' : '\n'}`);
+  // writes this line through `sys.stderr`, which does. `printErr` owns the `\n`-to-`os.linesep` rule.
+  printErr(`geneseed-hook: error: ${msg}\n`);
   return code;
 }
 

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "3.1.3"
+  "version": "3.2.0"
 }