geneseed 3.1.3 → 3.2.0

package/js/hosts/settings.mjs

@@ -42,35 +42,15 @@ import {
 } from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
-import { printErr, readText, writeText } from '../lib/fs.mjs';
+import { readText, writeText, isOsError } from '../lib/fs.mjs';
 import {
   jsonDumps, jsonDumpsCompact, jsonDumpsIndent, parseJson, deepEquals, formatRepr,
-  indexOfDeepEqual,
+  indexOfDeepEqual, get, has, isDict,
 } from '../lib/json.mjs';
+import { expanduser } from './hosts.mjs';
+import { stripWhitespace, stripWhitespaceEnd } from '../lib/text.mjs';
 
-export const OPENCODE_SCHEMA = 'https://opencode.ai/config.json';
-
-/** `dict.get(key)` with Python's semantics — OWN properties only.
- *
- * `loaded[event]` where `event` came out of a manifest hands back `Object.prototype`'s
- * member for `constructor`, `toString` or `valueOf`, where Python's `.get` returns None.
- * The same hazard `js/hosts/native.mjs` hit with `overrides[stem]`, on a dict the USER edits. */
-function get(obj, key) {
-  return Object.prototype.hasOwnProperty.call(obj, key) ? obj[key] : undefined;
-}
-
-function has(obj, key) {
-  return Object.prototype.hasOwnProperty.call(obj, key);
-}
-
-/** `except OSError` — an fs failure carries a `code`; anything else is a bug, so rethrow. */
-function isOsError(e) {
-  return Boolean(e) && typeof e.code === 'string';
-}
-
-function isDict(v) {
-  return Boolean(v) && typeof v === 'object' && !Array.isArray(v);
-}
+const OPENCODE_SCHEMA = 'https://opencode.ai/config.json';
 
 /**
  * Is the `process` doctrine pack active for the install being emitted?
@@ -114,7 +94,7 @@ const consentRuleOn = (d, excluded = []) =>
  * Law IV's territory — an always-on invariant — not the process pack's, and the guard
  * plugin's own force-push arm is unconditional for the same reason.
  */
-export function defaultPermission(doctrines = null, excluded = []) {
+function defaultPermission(doctrines = null, excluded = []) {
   const bash = { 'rm -rf *': 'ask' };
   if (consentRuleOn(doctrines, excluded)) {
     bash['git commit*'] = 'ask';
@@ -205,22 +185,10 @@ function reconcileOpencodePermission(perm, want) {
   return [changed, stranded, null];
 }
 
-/**
- * `Path.with_suffix(suffix)` for the one shape this module needs.
- *
- * `PurePath.suffix` and `path.extname` disagree on leading-dot and trailing-dot names
- * (`.bashrc`, `x.`); the only caller passes `…/opencode.json`, and the emit's own callers
- * pass a literal. Spelled off `path.extname` with the empty-extension case handled so a
- * future caller with a suffix-less path appends rather than truncates.
- */
-function withSuffix(p, suffix) {
-  const ext = path.extname(p);
-  return (ext ? p.slice(0, p.length - ext.length) : p) + suffix;
-}
-
-/** `_build_settings._opencode_target`. */
+/** `_build_settings._opencode_target`. Only caller of a `.json` -> `.jsonc` suffix swap. */
 export function opencodeTarget(jsonPath) {
-  const jsonc = withSuffix(jsonPath, '.jsonc');
+  const ext = path.extname(jsonPath);
+  const jsonc = (ext ? jsonPath.slice(0, jsonPath.length - ext.length) : jsonPath) + '.jsonc';
   return existsSync(jsonc) ? jsonc : jsonPath;
 }
 
@@ -305,7 +273,7 @@ export function readJsonc(text) {
  * already has a `permission` key to add one is not saying so. Any other truthy value is read as
  * `'add'`, which is what the boolean callers this replaced meant.
  */
-export function warnCommentedJsonc(target, agentPath, permission,
+function warnCommentedJsonc(target, agentPath, permission,
   includeLsp = false, prefix = 'geneseed', doctrines = null, excluded = []) {
   process.stdout.write(`[${prefix}] ${path.basename(target)} has comments — not rewriting `
     + 'it (your edits are kept). Add this to its "instructions" array by hand:\n');
@@ -354,7 +322,7 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [])
       raw = readText(target);
     } catch (e) {
       if (!isOsError(e)) throw e;
-      process.stderr.write(`[geneseed] WARN: could not read ${target} (${asOsError(e)}) `
+      process.stderr.write(`[geneseed] WARN: could not read ${target} (${e.message}) `
         + `— NOT touching it. Add ${jsonDumps(agentPath)} to its "instructions" array by `
         + "hand once it's readable again.\n");
       return target;
@@ -433,25 +401,18 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [])
     atomicWriteJson(target, config);
   } catch (e) {
     if (!isOsError(e)) throw e;
-    process.stderr.write(`[geneseed] WARN: could not write ${target} (${asOsError(e)}) — `
+    process.stderr.write(`[geneseed] WARN: could not write ${target} (${e.message}) — `
       + `the harness will NOT auto-load until this is fixed. Add ${jsonDumps(agentPath)} `
       + 'to its "instructions" array by hand.\n');
   }
   return target;
 }
 
-/**
- * `str(OSError)` — what Python interpolates for `except OSError as e: f"({e})"`.
- *
- * Python renders `[Errno 13] Permission denied: 'C:\\x\\y'`; Node's message is
- * `EACCES: permission denied, open 'C:\x\y'`. The two cannot be made to agree, so the
- * parity gate does not drive a cell through a real fs failure — it exercises the branch
- * with an injectable failure instead and compares everything except the OS's own wording.
- * Named here so the gap is a decision rather than a surprise at GA.
- */
-function asOsError(e) {
-  return e.message;
-}
+// `except OSError as e: f"({e})"` is inlined as `e.message` at each call site above and below.
+// Python renders `[Errno 13] Permission denied: 'C:\\x\\y'`; Node's message is
+// `EACCES: permission denied, open 'C:\x\y'`. The two cannot be made to agree, so the parity
+// gate does not drive a cell through a real fs failure — it exercises the branch with an
+// injectable failure instead and compares everything except the OS's own wording.
 
 // ---- the hook shim ----------------------------------------------------------------
 // `|| exit 0` on the emitted commands does NOT mean "ignore failures": git-gate and
@@ -499,32 +460,18 @@ export function shimRel(platform = process.platform) {
   return ['bin', SHIM_MARK + (platform === 'win32' ? '.cmd' : '')];
 }
 
-/** `_build_settings._shim_home`. */
-export function shimHome() {
-  const env = process.env.GENESEED_HOME;
-  return env ? expanduser(env) : path.join(os.homedir(), '.geneseed');
-}
-
 /**
- * `Path(x).expanduser()` — private twin of `js/hosts/hosts.mjs`'s `expanduser`, same guard.
+ * `_build_settings._shim_home`.
  *
- * `GENESEED_HOME` is user-set, same as any config-dir env var there, so a `~user` value here
- * has the identical failure mode (a hook shim written under a literal `~user` directory) and
- * gets the identical fix — refuse rather than pass through. See that file's docblock for why
- * the refusal lives IN the primitive rather than at `shimHome`'s caller.
+ * `expanduser` is `js/hosts/hosts.mjs`'s — GENESEED_HOME is user-set, same as any config-dir
+ * env var there, so a `~user` value here has the identical failure mode (a hook shim written
+ * under a literal `~user` directory) and gets the identical refusal. This module used to carry
+ * a private "same guard" twin; the two had drifted (this one's refusal message dropped the
+ * parenthetical explaining WHY), which is exactly the kind of divergence one owner prevents.
  */
-function expanduser(p) {
-  if (p === '~') return os.homedir();
-  if (p.startsWith('~/') || p.startsWith('~\\')) return path.join(os.homedir(), p.slice(2));
-  if (p.startsWith('~')) {
-    const msg = `refusing '${p}': a '~user' path is not expanded by this port; pass an `
-      + 'absolute path, or "~" / "~/…" for your own home directory';
-    printErr(`${msg}\n`);
-    const e = new Error(msg);
-    e.exitCode = 1;
-    throw e;
-  }
-  return p;
+export function shimHome() {
+  const env = process.env.GENESEED_HOME;
+  return env ? expanduser(env) : path.join(os.homedir(), '.geneseed');
 }
 
 /** `_build_settings._hook_shim_path`. */
@@ -918,7 +865,7 @@ export function wireClaudeExcludes(p, excludes) {
     atomicWriteJson(p, config);
   } catch (e) {
     if (!isOsError(e)) throw e;
-    process.stderr.write(`[geneseed] WARN: could not write ${p} (${asOsError(e)}) — `
+    process.stderr.write(`[geneseed] WARN: could not write ${p} (${e.message}) — `
       + 'claudeMdExcludes were not wired. Add to its "claudeMdExcludes" array by hand: '
       + `${jsonDumpsCompact(added)}\n`);
     return [];
@@ -973,7 +920,7 @@ export const GENESEED_HOOK_SNIFF = ['harness.py', SHIM_MARK];
 // 2 and 3 differ ONLY inside the shim body. A classifier reading the host config alone would
 // call a fully-unmigrated machine "already migrated" — silently — and `migrate` would no-op on
 // exactly the installs it exists for. The shim body is a REQUIRED input, not a refinement.
-export const SHIM_ENTRY_MARK = 'geneseed-hook.mjs';
+const SHIM_ENTRY_MARK = 'geneseed-hook.mjs';
 
 /**
  * `_build_settings._migrate_shape` — 'legacy' | 'current' | 'none'.
@@ -1028,7 +975,7 @@ export function autostartStale(text, root) {
 }
 
 /** `_build_settings._settings_hook_groups` — flatten `hooks` to [event, group] pairs. */
-export function settingsHookGroups(loaded) {
+function settingsHookGroups(loaded) {
   const hooks = get(loaded, 'hooks');
   if (!isDict(hooks)) return [];
   const out = [];
@@ -1068,7 +1015,7 @@ export function settingsIntegrityCheck(p, managed, expect = 'present') {
     [loaded] = readJsonc(readText(p));
   } catch (e) {
     if (!isOsError(e)) throw e;
-    problems.push(`${p}: could not read the file (${asOsError(e)})`);
+    problems.push(`${p}: could not read the file (${e.message})`);
     return flush();
   }
   if (!isDict(loaded)) {
@@ -1128,12 +1075,7 @@ export function settingsIntegrityCheck(p, managed, expect = 'present') {
   return flush();
 }
 
-const BLOCK_BEGIN = '<!-- BEGIN {id} -->';
-const BLOCK_END = '<!-- END {id} -->';
-
-function delimiters(blockId) {
-  return [BLOCK_BEGIN.replace('{id}', blockId), BLOCK_END.replace('{id}', blockId)];
-}
+const delimiters = (blockId) => [`<!-- BEGIN ${blockId} -->`, `<!-- END ${blockId} -->`];
 
 /**
  * `_build_settings._managed_block_write` — 'created' | 'updated' | 'merged'.
@@ -1141,7 +1083,7 @@ function delimiters(blockId) {
  */
 export function managedBlockWrite(p, content, blockId = 'GENESEED') {
   const [begin, end] = delimiters(blockId);
-  const block = `${begin}\n${stripEnd(content)}\n${end}\n`;
+  const block = `${begin}\n${stripWhitespaceEnd(content)}\n${end}\n`;
   if (!existsSync(p)) {
     mkdirSync(path.dirname(p), { recursive: true });
     writeText(p, block);
@@ -1171,7 +1113,7 @@ export function managedBlockRemove(p, blockId = 'GENESEED', whole = false) {
   if (!existing.includes(begin) || !existing.includes(end)) return;
   const pre = existing.split(begin)[0];
   const post = existing.slice(existing.indexOf(end) + end.length);
-  const rest = stripEnds(`${stripTrailingNewlines(pre)}\n${lstripNewlines(post)}`);
+  const rest = stripWhitespace(`${stripTrailingNewlines(pre)}\n${lstripNewlines(post)}`);
   if (rest) writeText(p, `${rest}\n`);
   else unlinkSync(p);
 }
@@ -1186,25 +1128,6 @@ export function managedBlockRead(p, blockId = 'GENESEED') {
   return stripNewlines(inner.slice(0, inner.indexOf(end)));
 }
 
-// `str.strip()` and friends. JS's `trim()` is NOT `strip()`, and the difference runs both
-// ways: `trim()` eats U+FEFF, which Python does not strip, and Python strips U+0085 and
-// U+001C–U+001F, which `trim()` leaves. A managed block is user-editable prose in a file
-// Geneseed shares with the user, so the set is spelled out rather than approximated — and
-// spelled with escapes, never literals: a raw U+2028 in a JS source file ends the line.
-const WHITESPACE = '[\t\n\v\f\r\x1c-\x1f \x85\xa0\u1680\u2000-\u200a'
-  + '\u2028\u2029\u202f\u205f\u3000]';
-
-const RSTRIP_RE = new RegExp(`${WHITESPACE}+$`);
-const LSTRIP_RE = new RegExp(`^${WHITESPACE}+`);
-
-function stripEnd(s) {
-  return s.replace(RSTRIP_RE, '');
-}
-
-function stripEnds(s) {
-  return s.replace(LSTRIP_RE, '').replace(RSTRIP_RE, '');
-}
-
 function lstripNewlines(s) {
   return s.replace(/^\n+/, '');
 }

package/js/inspect/checks-authoring.mjs

@@ -411,7 +411,8 @@ export function constitutionProblems() {
     try { text = readText(path.join(dir, `${pack}.md`)); } catch { continue; }
     for (const [, key] of text.matchAll(DOC_TOKEN_RE)) wanted.add(key);
   }
-  const lexWant = ['I', 'II', 'III', 'IV', 'V', 'VI', 'VII', 'VIII', 'IX'].map((r) => `LEX_${r}`);
+  const lexWant = ['I', 'II', 'III', 'IV', 'V', 'VI', 'VII', 'VIII', 'IX', 'X', 'XI']
+    .map((r) => `LEX_${r}`);
   // `_TEMPLATE.json` is included — it is the file `--sync-themes` seeds a new theme from, so a
   // stale key there propagates into every voice added afterwards. `themeFiles()` excludes it.
   const files = [...themeFiles(), path.join(THEMES, '_TEMPLATE.json')];
@@ -443,11 +444,11 @@ export function constitutionProblems() {
     const stale = lex.filter((k) => !lexWant.includes(k));
     const missing = lexWant.filter((k) => !lex.includes(k));
     for (const k of stale) {
-      problems.push(`[authoring] ${name} still defines {${k}} — the invariants are I..IX and `
-        + 'nothing renders this key, so it is a title for a rule that no longer exists');
+      problems.push(`[authoring] ${name} still defines {${k}} — no law heading carries this `
+        + 'numeral and nothing renders this key, so it is a title for a rule that no longer exists');
     }
     for (const k of missing) {
-      problems.push(`[authoring] ${name} has no {${k}} — one of the nine invariants would `
+      problems.push(`[authoring] ${name} has no {${k}} — one of the invariants would `
         + 'render with an empty title');
     }
     // M10 — ⚠ BOTH HEADING PARSERS MATCH THE TIER NOUN WITH `\S+`. A two-word value does not

package/js/inspect/checks-build.mjs

@@ -217,7 +217,7 @@ export function renderedProblems(bundle) {
       // The OpenCode emits de-link AGENT.md's per-row table entries after rendering, so the
       // bundle on disk legitimately differs from `renderAll`'s output for this one file.
       const text = host === 'opencode' && outRel === 'AGENT.md'
-        ? stripCapabilityLinks(cfg, rendered) : rendered;
+        ? stripCapabilityLinks(rendered) : rendered;
       if (readText(dest) !== text) {
         problems.push(`[rendered] ${name}/${outRel} stale (differs from a fresh render) `
           + '— rebuild');

package/js/inspect/diff.mjs

@@ -47,11 +47,9 @@ import {
   readJsonMaybe, readMaybe, themeOfDir,
 } from '../hosts/installs.mjs';
 import { unifiedDiff, splitLines } from '../lib/udiff.mjs';
-import { printOut, printErr, readText, writeText } from '../lib/fs.mjs';
+import { printOut, printErr, readText, writeText, isFile } from '../lib/fs.mjs';
 import { toPlatformPath } from '../lib/paths.mjs';
 
-const isFile = (p) => { try { return statSync(p).isFile(); } catch { return false; } };
-
 /**
  * `_harness_core._T0` — this process's start, in epoch seconds.
  *

package/js/inspect/doctor.mjs

@@ -58,6 +58,17 @@ export function themesToCheck(theme, allThemes, detected, available) {
   return [...available].sort();
 }
 
+/**
+ * `swallowStdout` and `captureBoth` below are the same operation over a different stream
+ * list: replace each stream's `write` with a no-op for the duration of `fn`, then restore
+ * every original in `finally` regardless of how `fn` exits.
+ */
+function withSwallowed(streams, fn) {
+  const saved = streams.map((s) => [s, s.write.bind(s)]);
+  for (const [s] of saved) s.write = () => true;
+  try { return fn(); } finally { for (const [s, w] of saved) s.write = w; }
+}
+
 /**
  * `contextlib.redirect_stdout(io.StringIO())` — swallow an emit's log, and ONLY stdout.
  *
@@ -68,44 +79,60 @@ export function themesToCheck(theme, allThemes, detected, available) {
  * installed at call time, so it translates into this buffer and the bytes never leave.
  */
 function swallowStdout(fn) {
-  const real = process.stdout.write.bind(process.stdout);
-  process.stdout.write = () => true;
-  try { return fn(); } finally { process.stdout.write = real; }
+  return withSwallowed([process.stdout], fn);
 }
 
 /**
- * `_harness_build._global_emit_problems` — validate the opencode-global emit, in BOTH
- * footprints.
- *
- * The RECOMMENDED install, and otherwise a doctor blind spot: the files build and ./Harness
- * were checked and the global layout never was. The two footprints produce genuinely
- * different AGENT.md bodies — lean swaps the inlined laws for a digest plus a pointer and
- * ships a standalone laws file the full emit does not write — so checking one leaves the
- * other's links and tokens unvalidated, and lean being the default made that the shape most
- * installs actually run.
+ * The loop `globalEmitProblems`/`claudeBobEmitProblems` each wrote out: render one item into
+ * its own fresh temp dir with stdout swallowed, then `checkBuild` the result — a build
+ * failure and a check finding both prefixed with the SAME per-cell label. `makeCell(tmp,
+ * item)` returns `{ label, dir, run, vendored }`; `vendored` is passed straight through to
+ * `checkBuild`, which defaults it exactly as an omitted third argument always did.
  */
-export function globalEmitProblems(themeName) {
+function emitProblemsOver(items, makeCell) {
   const problems = [];
-  for (const footprint of ['lean', 'full']) {
+  for (const item of items) {
     withTempDir((tmp) => {
-      const cfgDir = path.join(tmp, 'cfg');
+      const { label, dir, run, vendored } = makeCell(tmp, item);
       try {
-        swallowStdout(() => emitGlobalInto('opencode', {
-          theme: themeName, out: path.join(tmp, 'bundle'), cfgDir, footprint,
-        }));
+        swallowStdout(run);
       } catch (e) {
         if (e && e.exitCode !== undefined) {
-          problems.push(`[${themeName} global/${footprint}] build failed`);
+          problems.push(`[${label}] build failed`);
           return;
         }
         throw e;
       }
-      problems.push(...checkBuild(`${themeName} global/${footprint}`, cfgDir));
+      problems.push(...checkBuild(label, dir, vendored));
     });
   }
   return problems;
 }
 
+/**
+ * `_harness_build._global_emit_problems` — validate the opencode-global emit, in BOTH
+ * footprints.
+ *
+ * The RECOMMENDED install, and otherwise a doctor blind spot: the files build and ./Harness
+ * were checked and the global layout never was. The two footprints produce genuinely
+ * different AGENT.md bodies — lean swaps the inlined laws for a digest plus a pointer and
+ * ships a standalone laws file the full emit does not write — so checking one leaves the
+ * other's links and tokens unvalidated, and lean being the default made that the shape most
+ * installs actually run.
+ */
+export function globalEmitProblems(themeName) {
+  return emitProblemsOver(['lean', 'full'], (tmp, footprint) => {
+    const cfgDir = path.join(tmp, 'cfg');
+    return {
+      label: `${themeName} global/${footprint}`,
+      dir: cfgDir,
+      run: () => emitGlobalInto('opencode', {
+        theme: themeName, out: path.join(tmp, 'bundle'), cfgDir, footprint,
+      }),
+    };
+  });
+}
+
 /**
  * `_harness_build._claude_bob_emit_problems` — validate the claude/bob/copilot PER-REPO
  * emits, which were never checked before.
@@ -116,25 +143,17 @@ export function globalEmitProblems(themeName) {
  * skills one level deeper than a bundle does.
  */
 export function claudeBobEmitProblems(themeName) {
-  const problems = [];
-  for (const label of ['claude', 'bob', 'copilot']) {
-    withTempDir((tmp) => {
-      const root = path.join(tmp, 'root');
-      try {
-        swallowStdout(() => emitProjectInto(label, {
-          theme: themeName, out: path.join(root, 'bundle'), root,
-        }));
-      } catch (e) {
-        if (e && e.exitCode !== undefined) {
-          problems.push(`[${themeName} ${label}] build failed`);
-          return;
-        }
-        throw e;
-      }
-      problems.push(...checkBuild(`${themeName} ${label}`, root, validateIsVendored));
-    });
-  }
-  return problems;
+  return emitProblemsOver(['claude', 'bob', 'copilot'], (tmp, label) => {
+    const root = path.join(tmp, 'root');
+    return {
+      label: `${themeName} ${label}`,
+      dir: root,
+      run: () => emitProjectInto(label, {
+        theme: themeName, out: path.join(root, 'bundle'), root,
+      }),
+      vendored: validateIsVendored,
+    };
+  });
 }
 
 /**
@@ -219,11 +238,7 @@ export function doctorCollect({
 
 /** `run(..., capture_output=True)` — both streams into the void, the return code out. */
 function captureBoth(fn) {
-  const out = process.stdout.write.bind(process.stdout);
-  const err = process.stderr.write.bind(process.stderr);
-  process.stdout.write = () => true;
-  process.stderr.write = () => true;
-  try { return fn(); } finally { process.stdout.write = out; process.stderr.write = err; }
+  return withSwallowed([process.stdout, process.stderr], fn);
 }
 
 /**

package/js/inspect/excludes.mjs

@@ -18,24 +18,18 @@
  * Every path a hook takes on this file is READ-only, so nothing here is on the PreToolUse
  * latency budget — which is why it lives beside the CLI and not in `js/hosts/hooks.mjs`.
  */
-import { existsSync, mkdirSync, readdirSync, renameSync, rmdirSync, statSync, unlinkSync }
+import { existsSync, mkdirSync, readdirSync, renameSync, rmdirSync, unlinkSync }
   from 'node:fs';
 import path from 'node:path';
 import { EXCLUDES_FILE, EXCLUDES_STUB, BOB_RULES_STUB } from '../build/stubs.mjs';
 import { wireClaudeExcludes, unwireClaudeExcludes } from '../hosts/settings.mjs';
 import { GLOBAL_MANIFEST, HOSTS, resolvePath } from '../hosts/hosts.mjs';
-import { readText, writeText, printOut, printErr } from '../lib/fs.mjs';
-import { parseJson, jsonDumpsIndent } from '../lib/json.mjs';
+import { readText, writeText, printOut, printErr, isDir, isFile, isOsError } from '../lib/fs.mjs';
+import { parseJson, jsonDumpsIndent, get, isDict } from '../lib/json.mjs';
 import { normcase, toPlatformPath } from '../lib/paths.mjs';
 
-const get = (o, k) => (o && Object.prototype.hasOwnProperty.call(o, k) ? o[k] : undefined);
-const isDict = (v) => Boolean(v) && typeof v === 'object' && !Array.isArray(v);
-const isOsError = (e) => Boolean(e) && typeof e.code === 'string';
-const isDir = (p) => { try { return statSync(p).isDirectory(); } catch { return false; } };
-const isFile = (p) => { try { return statSync(p).isFile(); } catch { return false; } };
-
 /** `_global_installs` — every host whose GLOBAL config dir carries a Geneseed manifest. */
-export function globalInstalls() {
+function globalInstalls() {
   const out = [];
   for (const { host, configDir } of HOSTS) {
     let cfg;

package/js/inspect/inventory.mjs

@@ -62,7 +62,7 @@ export const DOCTRINE_HEADING_RE = /^###\s+\S+\s+([a-z]+)\s+(\d+)\s+[—-]\s+(.+
  * from `STRUCTURE` rather than from a theme, so the id below is stable across all fourteen
  * voices and is safe to put in a deep link.
  */
-export const ONTOLOGY_HEADING_RE = /^####\s+(.+?)\s*$/;
+const ONTOLOGY_HEADING_RE = /^####\s+(.+?)\s*$/;
 
 /** The lead line of a pack file — `**Craft** — how code is written.` */
 const PACK_LEAD_RE = /^\*\*(.+?)\*\*\s+[—-]\s+(.+?)\s*$/;
@@ -70,7 +70,8 @@ const PACK_LEAD_RE = /^\*\*(.+?)\*\*\s+[—-]\s+(.+?)\s*$/;
 /** `_harness_tui.LAW_CLASS` — each rule's class, keyed by Roman numeral. */
 export const LAW_CLASS = {
   I: 'security', II: 'process', III: 'verify', IV: 'security', V: 'verify',
-  VI: 'security', VII: 'security', VIII: 'craft', IX: 'security',
+  VI: 'security', VII: 'security', VIII: 'craft', IX: 'security', X: 'verify',
+  XI: 'verify',
 };
 
 /** `_harness_tui.ENTITY_STATUSES` — the lifecycle statuses `registry.json` may carry. */
@@ -110,41 +111,46 @@ export const SKILL_CLASS = {
 const has = (obj, k) => Object.hasOwn(obj, k);
 
 /**
- * `_harness_tui._parse_laws` — the rendered laws file split into
- * `{num, title, klass, body}`.
+ * The one accumulator `_parse_laws`, the doctrine-pack parser and the ontology parser each
+ * wrote out separately: split `text` on its heading regex, opening a new record — everything
+ * `makeRecord(match)` returns, plus a `body` — at every match, and appending every other line
+ * (including a blank one) to the CURRENT record's body. Text before the first heading is
+ * dropped on the floor because `cur` is still null.
  *
- * The accumulator appends `line + "\n"` to every non-heading line INCLUDING the ones
- * before the first heading, which are discarded because `cur` is still None — and then
- * strips each body at the end. Reproduced literally: a body's internal blank lines are
- * kept and only its ends are trimmed.
+ * `str.strip()`, applied at the end to every body. `trim()`'s whitespace set differs from
+ * Python's only at U+FEFF, which is the standing item this port has carried since P4 — a
+ * rendered body cannot end in a BOM, and a fourth primitive to say so would cost more than
+ * it gates.
  */
-export function parseLaws(text) {
-  const laws = [];
+function parseSections(text, re, makeRecord) {
+  const out = [];
   let cur = null;
   for (const line of text.split('\n')) {
-    const m = LAW_HEADING_RE.exec(line);
+    const m = re.exec(line);
     if (m) {
-      if (cur) laws.push(cur);
-      cur = { num: m[1], title: m[2], klass: has(LAW_CLASS, m[1]) ? LAW_CLASS[m[1]] : 'craft', body: '' };
+      if (cur) out.push(cur);
+      cur = { ...makeRecord(m), body: '' };
     } else if (cur !== null) {
       cur.body += `${line}\n`;
     }
   }
-  if (cur) laws.push(cur);
-  // `str.strip()`. `trim()`'s whitespace set differs from Python's only at U+FEFF, which
-  // is the standing item this port has carried since P4 — a rendered law body cannot end
-  // in a BOM, and a fourth primitive to say so would cost more than it gates.
-  for (const law of laws) law.body = law.body.trim();
-  return laws;
+  if (cur) out.push(cur);
+  for (const item of out) item.body = item.body.trim();
+  return out;
+}
+
+/**
+ * `_harness_tui._parse_laws` — the rendered laws file split into
+ * `{num, title, klass, body}`.
+ */
+function parseLaws(text) {
+  return parseSections(text, LAW_HEADING_RE, (m) => (
+    { num: m[1], title: m[2], klass: has(LAW_CLASS, m[1]) ? LAW_CLASS[m[1]] : 'craft' }));
 }
 
 /**
  * One rendered doctrine pack file split into `{pack, n, title, klass, body}` rows.
  *
- * Same accumulator as `parseLaws`, and deliberately so: text before the first heading — the
- * pack's own lead line — is dropped on the floor because `cur` is still null, and each body is
- * trimmed at its ends only.
- *
  * `klass` IS THE PACK ID, not one of `LAW_CLASSES`. A doctrine rule is grouped by the pack it
  * belongs to and there is no second taxonomy over it; the six-class chip is the invariants'.
  * The collision with the class names `craft` and `process` is real and harmless — the two
@@ -155,20 +161,8 @@ export function parseLaws(text) {
  * two; this function just reports what the text says.
  */
 export function parseDoctrines(text) {
-  const rules = [];
-  let cur = null;
-  for (const line of text.split('\n')) {
-    const m = DOCTRINE_HEADING_RE.exec(line);
-    if (m) {
-      if (cur) rules.push(cur);
-      cur = { pack: m[1], n: Number(m[2]), title: m[3], klass: m[1], body: '' };
-    } else if (cur !== null) {
-      cur.body += `${line}\n`;
-    }
-  }
-  if (cur) rules.push(cur);
-  for (const rule of rules) rule.body = rule.body.trim();
-  return rules;
+  return parseSections(text, DOCTRINE_HEADING_RE, (m) => (
+    { pack: m[1], n: Number(m[2]), title: m[3], klass: m[1] }));
 }
 
 /**
@@ -179,25 +173,13 @@ export function parseDoctrines(text) {
  * come from `STRUCTURE` in `js/build/render.mjs` and not from any theme file — the same reason a
  * citation can spell itself `({{ONTOLOGY}}: {{ONT_TELOS}})` with a token on both sides.
  *
- * The preamble above the first `####` is dropped, as in the two parsers above. It is the
- * paragraph that states the tier order, and it renders into AGENT.md whole — the catalogue
- * lists sections, and the preamble is not one.
+ * The preamble above the first `####` is dropped, as `parseSections` drops it for the two
+ * parsers above. It is the paragraph that states the tier order, and it renders into AGENT.md
+ * whole — the catalogue lists sections, and the preamble is not one.
  */
-export function parseOntology(text) {
-  const sections = [];
-  let cur = null;
-  for (const line of text.split('\n')) {
-    const m = ONTOLOGY_HEADING_RE.exec(line);
-    if (m) {
-      if (cur) sections.push(cur);
-      cur = { id: m[1].toLowerCase().replace(/\s+/g, '-'), title: m[1], body: '' };
-    } else if (cur !== null) {
-      cur.body += `${line}\n`;
-    }
-  }
-  if (cur) sections.push(cur);
-  for (const s of sections) s.body = s.body.trim();
-  return sections;
+function parseOntology(text) {
+  return parseSections(text, ONTOLOGY_HEADING_RE, (m) => (
+    { id: m[1].toLowerCase().replace(/\s+/g, '-'), title: m[1] }));
 }
 
 /**