geneseed 3.1.3 → 3.2.0

package/js/inspect/registry.mjs

@@ -13,25 +13,22 @@
  * compares `installs.json` byte-for-byte, so a changed path or a dropped prune fails cells
  * rather than passing quietly.
  */
-import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync } from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 
 import { expanduser } from '../hosts/hosts.mjs';
-import { writeText } from '../lib/fs.mjs';
+import { writeText, isFile, isDir } from '../lib/fs.mjs';
 import { parseJson, jsonDumpsIndent } from '../lib/json.mjs';
 import { toPlatformPath } from '../lib/paths.mjs';
 
-const isDir = (p) => { try { return statSync(p).isDirectory(); } catch { return false; } };
-const isFile = (p) => { try { return statSync(p).isFile(); } catch { return false; } };
-
 /** `_install_registry._path()` — `$XDG_CONFIG_HOME/geneseed/installs.json`. */
-export function registryPath() {
+function registryPath() {
   const base = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
   return path.join(base, 'geneseed', 'installs.json');
 }
 
-export function registryLoad() {
+function registryLoad() {
   try {
     const data = parseJson(readFileSync(registryPath(), 'utf8'));
     return Array.isArray(data) ? data.map(String) : [];

package/js/inspect/scan.mjs

@@ -12,7 +12,14 @@ import os from 'node:os';
 import path from 'node:path';
 import { SRC } from '../build/source.mjs';
 import { comparePaths, normcase } from '../lib/paths.mjs';
-import { mkdtempSync, readdirSync, rmSync, statSync } from 'node:fs';
+import { isDir, isFile } from '../lib/fs.mjs';
+import { has } from '../lib/json.mjs';
+import { mkdtempSync, readdirSync, rmSync } from 'node:fs';
+
+// `isDir`/`isFile`/`has` are owned by `js/lib` now (single owner across `hosts/`, `build/`,
+// `inspect/` and `web/`) — re-exported here so this module's own existing callers keep
+// importing them from `./scan.mjs` unchanged.
+export { isDir, isFile, has };
 
 // --------------------------------------------------------------------------------------
 // _harness_core's scanning primitives
@@ -48,9 +55,6 @@ export function within(child, parent) {
   return p.length <= c.length && p.every((seg, i) => c[i] === seg);
 }
 
-export const isDir = (p) => { try { return statSync(p).isDirectory(); } catch { return false; } };
-export const isFile = (p) => { try { return statSync(p).isFile(); } catch { return false; } };
-
 /** `sorted(d.glob(pat))`, or `[]` for a directory that is not there. */
 export function globSorted(dir, filter) {
   let names;
@@ -87,17 +91,6 @@ export const sortedUnique = (xs) => [...new Set(xs)].sort((a, b) => (a < b ? -1
 /** `sorted(probs)` — SORTED, not deduped, which is what `_ran` fills a group with. */
 export const sortedProblems = (xs) => [...xs].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
 
-/**
- * `k in d` for a Python dict — OWN keys only.
- *
- * Every membership test in this file reads a key that came out of a JSON document or a source
- * filename, and a bare `k in obj` would answer true for `constructor`, `toString` and the rest
- * of `Object.prototype`. A theme defining a `toString` voice token, or a skill file named
- * `valueOf.md`, would then be reported as missing by the reference and not by this port — a
- * divergence no cell can reach and no reviewer would look for.
- */
-export const has = (obj, k) => Object.prototype.hasOwnProperty.call(obj, k);
-
 /** `_harness_build._src_stems` — spec stems under `src/<folder>`, minus `_`-scaffolds. */
 export function srcStems(folder) {
   const d = path.join(SRC, folder);

package/js/inspect/status.mjs

@@ -242,7 +242,7 @@ const ANSI_CODES = {
  * short-circuits on the first, NO_COLOR and TERM are never read through a pipe, which is
  * why `golden.cell_env` clearing them is insurance rather than a fix.
  */
-export function colorEnabled() {
+function colorEnabled() {
   return Boolean(process.stdout.isTTY) && process.env.NO_COLOR === undefined
     && process.env.TERM !== 'dumb';
 }

package/js/lib/fs.mjs

@@ -193,3 +193,37 @@ export function withPlatformNewlines(fn) {
   }
 }
 
+/**
+ * `Path.is_file()` / `Path.is_dir()` — false for a missing path, never a throw.
+ *
+ * SINGLE OWNER. Six modules (`js/inspect/scan.mjs` plus five more under `hosts/`, `inspect/`,
+ * `build/`, `web/` and `bin/`) each carried a private `(p) => { try {...} catch { return
+ * false; } }` copy of one or both; this is now the one definition, and `scan.mjs` re-exports
+ * it for its own existing callers rather than owning a copy itself. `js/hosts/hooks.mjs` is
+ * the deliberate exception — the hot path keeps its own inline copy rather than pay an import.
+ *
+ * `statSync`'s Node default THROWS for a missing path; `throwIfNoEntry: false` (Node >= 15.3)
+ * is the one option that turns ONLY that case into `undefined`, and still throws for anything
+ * else — a permission failure, a path with a non-directory ancestor (`ENOTDIR`). Every copy
+ * this replaces used a bare `try/catch` instead, which swallowed ALL of those alike into the
+ * same `false`. That is a real, deliberate narrowing: a permission failure silently read as
+ * "not there" was the wrong answer to preserve, not a byte worth keeping.
+ */
+export function isFile(p) {
+  return statSync(p, { throwIfNoEntry: false })?.isFile() ?? false;
+}
+
+export function isDir(p) {
+  return statSync(p, { throwIfNoEntry: false })?.isDirectory() ?? false;
+}
+
+/**
+ * `except OSError` — an fs failure carries a `code`; anything else is a bug, so rethrow.
+ *
+ * SINGLE OWNER of a one-line predicate `js/hosts/settings.mjs`, `js/maintain/uninstall.mjs`
+ * and `js/inspect/excludes.mjs` each declared privately, byte-identically.
+ */
+export function isOsError(e) {
+  return Boolean(e) && typeof e.code === 'string';
+}
+

package/js/lib/json.mjs

@@ -217,7 +217,7 @@ export function deepEquals(a, b) {
   const kx = Object.keys(x);
   const ky = Object.keys(y);
   return kx.length === ky.length
-    && kx.every((k) => Object.prototype.hasOwnProperty.call(y, k) && deepEquals(x[k], y[k]));
+    && kx.every((k) => Object.hasOwn(y, k) && deepEquals(x[k], y[k]));
 }
 
 /** `value in list` and `list.index(value)` under `deepEquals` \u2014 Python's `in`, not `includes`. */
@@ -225,6 +225,33 @@ export function indexOfDeepEqual(arr, value) {
   return arr.findIndex((v) => deepEquals(v, value));
 }
 
+/**
+ * `dict.get(key)` / `k in d` / `isinstance(x, dict)` \u2014 Python dict semantics, OWN properties
+ * only, for a value that came out of `parseJson`.
+ *
+ * SINGLE OWNER of three helpers that had accumulated private copies in `js/hosts/settings.mjs`,
+ * `js/build/emit-common.mjs`, `js/inspect/scan.mjs` (`has` only) and `js/inspect/excludes.mjs`.
+ * They live beside `parseJson` rather than beside `js/lib/fs.mjs`'s filesystem primitives
+ * because every caller is reading a manifest, a theme or an overrides file \u2014 `obj['constructor']`
+ * or `obj['toString']` answering `Object.prototype`'s member instead of `undefined` is the same
+ * hazard `JsonNumber` and `deepEquals` above exist to guard against for the same values.
+ *
+ * They cannot live in `hosts/`, `build/` or `inspect/` themselves: callers on BOTH sides of the
+ * one-way dependency line those three sit on (`js/README.md`) need all three, and a copy in any
+ * one of them would force the others to import up the graph to reach it.
+ */
+export function get(obj, key) {
+  return Object.hasOwn(obj, key) ? obj[key] : undefined;
+}
+
+export function has(obj, key) {
+  return Object.hasOwn(obj, key);
+}
+
+export function isDict(v) {
+  return Boolean(v) && typeof v === 'object' && !Array.isArray(v);
+}
+
 /**
  * `json.dumps(s)` for a STRING, with Python's default `ensure_ascii=True`.
  *

package/js/lib/paths.mjs

@@ -80,16 +80,6 @@ export function within(child, parent) {
   return p.length <= c.length && p.every((seg, i) => c[i] === seg);
 }
 
-/**
- * `str(PurePath(s))` — separators normalised to the platform's, `.` components dropped,
- * duplicate separators collapsed, a trailing one removed.
- *
- * `path.normalize` is NOT this: it also collapses `a/../b` to `b`, and `PurePath` keeps the
- * `..` because a symlinked `a` makes those two different directories. The distinction is
- * live in `js/inspect/excludes.mjs`, where a hand-edited `excludes.json` entry is compared against a
- * RESOLVED repo path — Python never matches a `..` entry there, and a normalising port would
- * match it and unwire a file the reference would have left alone.
- */
 /**
  * `str(Path(x))` — and it is PLATFORM-SHAPED, because `Path` is.
  *

package/js/lib/udiff.mjs

@@ -40,7 +40,7 @@
  * have its index hoisted to the front of an object literal (the P3a hazard). Nothing here
  * iterates `b2j`, so the hoist would be invisible until the day something did.
  */
-function chainB(b, autojunk) {
+function chainB(b) {
   const b2j = new Map();
   for (let i = 0; i < b.length; i += 1) {
     const cur = b2j.get(b[i]);
@@ -48,7 +48,7 @@ function chainB(b, autojunk) {
     else cur.push(i);
   }
   const n = b.length;
-  if (autojunk && n >= 200) {
+  if (n >= 200) {
     const ntest = Math.floor(n / 100) + 1;
     for (const [elt, idxs] of [...b2j]) {
       if (idxs.length > ntest) b2j.delete(elt);
@@ -135,8 +135,8 @@ function matchingBlocks(a, b, b2j) {
 }
 
 /** `SequenceMatcher.get_opcodes` — [tag, i1, i2, j1, j2]. */
-export function opcodes(a, b, { autojunk = true } = {}) {
-  const b2j = chainB(b, autojunk);
+function opcodes(a, b) {
+  const b2j = chainB(b);
   let i = 0;
   let j = 0;
   const answer = [];
@@ -159,8 +159,8 @@ export function opcodes(a, b, { autojunk = true } = {}) {
  * Returns a list rather than a generator: the Python's caller is a `for` loop that consumes
  * it once, and a lazy JS equivalent would buy nothing but a second shape to reason about.
  */
-export function groupedOpcodes(a, b, n = 3, opts) {
-  let codes = opcodes(a, b, opts);
+function groupedOpcodes(a, b, n = 3) {
+  let codes = opcodes(a, b);
   if (!codes.length) codes = [['equal', 0, 1, 0, 1]];
   if (codes[0][0] === 'equal') {
     const [tag, i1, i2, j1, j2] = codes[0];
@@ -261,15 +261,10 @@ export function unifiedDiff(a, b, {
 const LINE_BOUNDARY = /\r\n|[\n\r\v\f\x1c\x1d\x1e\x85\u2028\u2029]/g;
 
 export function splitLines(text) {
-  const out = [];
-  let last = 0;
-  LINE_BOUNDARY.lastIndex = 0;
-  let m = LINE_BOUNDARY.exec(text);
-  while (m !== null) {
-    out.push(text.slice(last, m.index));
-    last = m.index + m[0].length;
-    m = LINE_BOUNDARY.exec(text);
-  }
-  if (last < text.length) out.push(text.slice(last));
+  // `String.split` doesn't touch the shared regex's `lastIndex`, so no reset is needed —
+  // and a text ending exactly on a boundary is the ONLY way `split` can hand back a
+  // trailing empty string here, which is exactly the case `splitlines()` drops.
+  const out = text.split(LINE_BOUNDARY);
+  if (out.at(-1) === '') out.pop();
   return out;
 }

package/js/maintain/memory.mjs

@@ -27,14 +27,12 @@
  * `memoryDropIndex` is the hook module's, not a copy: writing the fact and unwriting its
  * index line are two halves of one format, and the half that writes lives there.
  */
-import { readdirSync, statSync, unlinkSync } from 'node:fs';
+import { readdirSync, unlinkSync } from 'node:fs';
 import path from 'node:path';
 
 import { memoryDropIndex } from '../hosts/hooks.mjs';
 import { resolveMemoryDir } from '../hosts/hosts.mjs';
-import { printOut, printErr } from '../lib/fs.mjs';
-
-const isFile = (p) => { try { return statSync(p).isFile(); } catch { return false; } };
+import { printOut, printErr, isFile } from '../lib/fs.mjs';
 
 /**
  * The two names the store owns rather than holds: the index the agent reads at session

package/js/maintain/migrate.mjs

@@ -65,7 +65,7 @@ function hookSettingsFile(root, host, scope) {
 }
 
 /** Every hook command string in a settings file, or [] when it cannot be read or parsed. */
-export function hookCommandsOf(file) {
+function hookCommandsOf(file) {
   // `readJsonc`, NOT `JSON.parse`. A hand-edited settings.json with comments and a trailing
   // comma is the one shape no machine in this project writes, and strict JSON rejects it —
   // which would classify a wired install as `none` and make `migrate` skip the machine
@@ -89,7 +89,7 @@ export function hookCommandsOf(file) {
 }
 
 /** `<GENESEED_HOME>/.migrated` — the ROOT the last successful migration installed from. */
-export function stampPath() { return path.join(shimHome(), '.migrated'); }
+function stampPath() { return path.join(shimHome(), '.migrated'); }
 
 /** Where the pre-migration copies live while the re-emit runs. */
 function stashDir() { return path.join(shimHome(), '.migrate-backup'); }
@@ -101,7 +101,7 @@ function stashDir() { return path.join(shimHome(), '.migrate-backup'); }
  * no rollback. That ordering is the cheapest atomicity there is and it is why the survey is a
  * separate pass rather than a check inside the loop.
  */
-export function migrateSurvey() {
+function migrateSurvey() {
   const rows = [];
   const commands = [];
   const unrecognised = [];

package/js/maintain/uninstall.mjs

@@ -42,7 +42,7 @@
  * byte-identical in every cell of the matrix, so only the allow-list refutes it.
  */
 import {
-  existsSync, lstatSync, mkdirSync, readdirSync, renameSync, rmSync, rmdirSync, statSync,
+  existsSync, lstatSync, mkdirSync, readdirSync, renameSync, rmSync, rmdirSync,
   unlinkSync,
 } from 'node:fs';
 import path from 'node:path';
@@ -63,12 +63,10 @@ import {
   opencodeTarget, readJsonc, settingsIntegrityCheck, wireClaudeExcludes,
   unwireClaudeExcludes, unwireClaudeSettings,
 } from '../hosts/settings.mjs';
-import { printOut, printErr, readText, writeText } from '../lib/fs.mjs';
+import { printOut, printErr, readText, writeText, isFile, isDir, isOsError } from '../lib/fs.mjs';
 import { indexOfDeepEqual, jsonDumps, jsonDumpsIndent, deepEquals } from '../lib/json.mjs';
 import { comparePaths, isAbsolutePath, within } from '../lib/paths.mjs';
 
-const isDir = (p) => { try { return statSync(p).isDirectory(); } catch { return false; } };
-const isFile = (p) => { try { return statSync(p).isFile(); } catch { return false; } };
 const hostSpec = (host) => HOSTS.find((h) => h.host === host);
 
 /** The Claude-STYLE hosts — one manifest shape, one reversal. Spelled once. */
@@ -240,10 +238,12 @@ export function unmergeOpencodeJson(p, entry) {
  * copy path back.
  */
 export function archiveStore(store) {
-  const now = new Date();
-  const p2 = (n) => String(n).padStart(2, '0');
-  const stamp = `${now.getFullYear()}${p2(now.getMonth() + 1)}${p2(now.getDate())}`
-    + `-${p2(now.getHours())}${p2(now.getMinutes())}${p2(now.getSeconds())}`;
+  // `toLocaleString('sv-SE')` — LOCAL time, matching the old hand-rolled stamp
+  // (`getHours()`/`getMinutes()`/`getSeconds()` are all local-time getters, unlike
+  // `toISOString()`'s UTC). sv-SE's default format is already zero-padded
+  // "YYYY-MM-DD HH:MM:SS"; stripping the punctuation and reinserting one dash reproduces
+  // the exact `YYYYMMDD-HHMMSS` shape the padStart version built by hand.
+  const stamp = new Date().toLocaleString('sv-SE').replace(/\D/g, '').replace(/^(\d{8})/, '$1-');
   const dest = path.join(path.dirname(store), `archived-${path.basename(store)}`, stamp);
   mkdirSync(path.dirname(dest), { recursive: true });
   renameSync(store, dest);
@@ -293,11 +293,12 @@ export function claudeUninstall(cfg, archiveMemory) {
   const [removed, failed] = unlinkOwned(cfg, ownedOf(man));
   if (failed.length) warnSurvivors(failed);
   const hooks = managed.settings_hooks || [];
-  const unwired = unwireClaudeSettings(settingsFile(cfg, managed), hooks);
-  unwireClaudeExcludes(settingsFile(cfg, managed), managed.settings_excludes || []);
+  const sf = settingsFile(cfg, managed);
+  const unwired = unwireClaudeSettings(sf, hooks);
+  unwireClaudeExcludes(sf, managed.settings_excludes || []);
   // The unwire is VERIFIED, not assumed: a commented settings file is never rewritten, so a
   // supposedly-uninstalled repo could keep firing Geneseed's hooks. Loud, never fatal.
-  settingsIntegrityCheck(settingsFile(cfg, managed), managed, 'absent');
+  settingsIntegrityCheck(sf, managed, 'absent');
   // Always EXCISE, never whole-file delete: even where Geneseed created CLAUDE.md the user
   // may have added prose since. The file goes only if the excision leaves it empty.
   managedBlockRemove(claudeMdPath(cfg, managed));
@@ -401,7 +402,7 @@ export function installAgentEntryOf(instr) {
  * describing a file that no longer exists, which the fallback would then paper over with the
  * canonical spelling — and a bundle sub-dir layout would be left wired.
  */
-export function opencodeProjectUninstall(root) {
+function opencodeProjectUninstall(root) {
   const entry = installAgentEntry(root, 'project');
   let removed = 0;
   let failed = [];
@@ -436,7 +437,7 @@ export function opencodeProjectUninstall(root) {
 }
 
 /** `_harness_mcp._install_data_dir` — where the manifest and the runtime stores live. */
-export function installDataDir(root, host = 'opencode', scope = 'global') {
+function installDataDir(root, host = 'opencode', scope = 'global') {
   if (scope === 'project' && CLAUDE_STYLE.includes(host)) {
     return path.join(root, hostSpec(host).projectMarker);
   }
@@ -607,7 +608,7 @@ export function uninstallResolve(targetArg) {
  * config dir. The registry is the only place a project install outside the cwd can be
  * rediscovered from, and the just-removed root is excluded.
  */
-export function survivingProjectInstalls(removedRoot) {
+function survivingProjectInstalls(removedRoot) {
   const rroot = resolvePath(removedRoot);
   const out = [];
   for (const [host, scope, root] of registeredTargets()) {
@@ -619,7 +620,7 @@ export function survivingProjectInstalls(removedRoot) {
 }
 
 /** `_harness_mcp._print_surviving_project_inventory` — informational, never a cascade. */
-export function printSurvivingProjectInventory(removedRoot) {
+function printSurvivingProjectInventory(removedRoot) {
   const survivors = survivingProjectInstalls(removedRoot);
   if (!survivors.length) return;
   printOut(`[uninstall] ${survivors.length} project install(s) remain — the global removal `
@@ -636,7 +637,7 @@ export function printSurvivingProjectInventory(removedRoot) {
  * A repo can carry `.opencode/`, `.claude/` and `.bob/` side by side and `uninstall` only ever
  * removes the one it resolved to, so a repeat run needs to know there is more to do.
  */
-export function printOtherHostHits(root, removedHost) {
+function printOtherHostHits(root, removedHost) {
   for (const spec of HOSTS) {
     if (spec.host !== removedHost && projectQualifies(root, spec.host)) {
       printOut(`[uninstall] also found ${spec.host}:project here — run \`harness `
@@ -759,9 +760,6 @@ export function cmdUninstall(args) {
 // drives it: a manifest naming a file AND its parent directory is the only shape a seeded
 // world can use to make the SECOND move collide.
 
-/** `e` is an OSError rather than a programming fault — Node tags fs errors with `code`. */
-const isOsError = (e) => Boolean(e) && typeof e.code === 'string';
-
 /**
  * `_harness_mcp._move_tree` — move a file or dir, refusing an existing destination.
  *
@@ -849,7 +847,7 @@ function installMoveList(root, kind) {
  * tells the operator what to add rather than failing the whole reactivate. That asymmetry is
  * the reference's and is gated per side.
  */
-export function installReaddEntry(target, entry) {
+function installReaddEntry(target, entry) {
   if (!existsSync(target)) {
     mkdirSync(path.dirname(target), { recursive: true });
     writeText(target, `${jsonDumpsIndent({
@@ -900,6 +898,68 @@ function stashFiles(stash) {
 /** `rel.as_posix()` for a path already known to be relative. */
 const asPosix = (rel) => rel.split(path.sep).join('/');
 
+/**
+ * The move-with-rollback loop `installDeactivate` and `claudeDeactivate` each wrote out
+ * inline: move every `rel` from `srcBase` to `dstBase`, and on the first failure put every
+ * earlier move back onto `srcBase` before reporting it. All-or-nothing is the property
+ * (see the P6i note above `moveTree`), so a caught failure never leaves a partial move
+ * standing even though this function itself takes no side action on failure beyond the
+ * rollback — cleaning up the now-empty stash is the caller's, because the two hosts name
+ * their stash differently (`rmtreeQuiet(stash)` plain, `cleanHostStash(cfg, host)` tagged).
+ *
+ * Returns `{ done }` on a clean run, or `{ done, failed }` once a move has failed and been
+ * rolled back — `done` stays the moved-so-far list either way, which is what `rolled_back:
+ * done.length` in both callers reports.
+ */
+function moveAll(srcBase, dstBase, rels) {
+  const done = [];
+  for (const rel of rels) {
+    const src = path.join(srcBase, rel);
+    if (!existsSync(src)) continue;   // a manifest entry already gone — nothing to move
+    try {
+      moveTree(src, path.join(dstBase, rel));
+      done.push(rel);
+    } catch (e) {
+      if (!isOsError(e)) throw e;
+      for (const r of [...done].reverse()) {
+        try { renameSync(path.join(dstBase, r), path.join(srcBase, r)); } catch { /* OSError */ }
+      }
+      return { done, failed: [`${rel} (${e.message})`] };
+    }
+  }
+  return { done };
+}
+
+/**
+ * The stash-restore loop `installReactivate` and `claudeReactivate` each wrote out inline:
+ * move every file under `stash` back onto `base`, by its relative path. `skip`, when given,
+ * is one relative-posix path to leave untouched — `claudeReactivate`'s
+ * `_claude_md_block.txt`, which holds the managed block's TEXT and is restored separately by
+ * `managedBlockWrite` rather than a raw file move, because it is not a file that belongs
+ * verbatim at that relative path.
+ *
+ * NEVER deletes the stash while anything is unrestored: a destination collision is a
+ * leftover, reported rather than clobbered, so a retry has something left to restore from.
+ */
+function restoreAll(stash, base, skip = null) {
+  const leftovers = [];
+  let moved = 0;
+  for (const src of stashFiles(stash)) {
+    const rel = path.relative(stash, src);
+    if (skip && asPosix(rel) === skip) continue;
+    const dst = path.join(base, rel);
+    if (existsSync(dst)) {
+      // NEVER delete the stash while anything is unrestored — skip, keep, report.
+      leftovers.push(asPosix(rel));
+      continue;
+    }
+    mkdirSync(path.dirname(dst), { recursive: true });
+    renameSync(src, dst);
+    moved += 1;
+  }
+  return { leftovers, moved };
+}
+
 /**
  * `_harness_mcp._install_deactivate` — turn an OpenCode install off without deleting a byte.
  *
@@ -923,21 +983,10 @@ export function installDeactivate(root, host = 'opencode', scope = 'global') {
         + 'Disable by hand or convert it to plain .json first.' };
   }
   const stash = path.join(root, DISABLED_STASH);
-  const done = [];   // rels already moved, for rollback
-  for (const rel of installMoveList(root, kind)) {
-    const src = path.join(root, rel);
-    if (!existsSync(src)) continue;   // a manifest entry already gone — nothing to move
-    try {
-      moveTree(src, path.join(stash, rel));
-      done.push(rel);
-    } catch (e) {
-      if (!isOsError(e)) throw e;
-      for (const r of [...done].reverse()) {
-        try { renameSync(path.join(stash, r), path.join(root, r)); } catch { /* OSError */ }
-      }
-      rmtreeQuiet(stash);
-      return { ok: false, failed: [`${rel} (${e.message})`], rolled_back: done.length };
-    }
+  const { done, failed } = moveAll(root, stash, installMoveList(root, kind));
+  if (failed) {
+    rmtreeQuiet(stash);
+    return { ok: false, failed, rolled_back: done.length };
   }
   unmergeOpencodeJson(path.join(root, 'opencode.json'), installAgentEntry(root, kind));
   for (const rel of done) pruneAncestors(path.dirname(path.join(root, rel)), root);
@@ -962,20 +1011,7 @@ export function installReactivate(root, host = 'opencode', scope = 'global') {
     return { ok: true,
       note: 'install was re-created while disabled; discarded the stashed snapshot' };
   }
-  const leftovers = [];
-  let moved = 0;
-  for (const src of stashFiles(stash)) {
-    const rel = path.relative(stash, src);
-    const dst = path.join(root, rel);
-    if (existsSync(dst)) {
-      // NEVER delete the stash while anything is unrestored — skip, keep, report.
-      leftovers.push(asPosix(rel));
-      continue;
-    }
-    mkdirSync(path.dirname(dst), { recursive: true });
-    renameSync(src, dst);
-    moved += 1;
-  }
+  const { leftovers, moved } = restoreAll(stash, root);
   if (leftovers.length) return { ok: false, failed: leftovers, moved };
   const kind = installKind(root) || 'global';
   installReaddEntry(target, installAgentEntry(root, kind));
@@ -1065,21 +1101,10 @@ function claudeDeactivate(root, scope = 'global', host = 'claude') {
   const rroot = resolvePath(cfg);
   const rels = ownedOf(man).filter((r) => r && r !== VERSION_MARKER
     && within(resolvePath(path.resolve(rroot, r)), rroot));
-  const done = [];
-  for (const rel of rels) {
-    const src = path.join(cfg, rel);
-    if (!existsSync(src)) continue;
-    try {
-      moveTree(src, path.join(stash, rel));
-      done.push(rel);
-    } catch (e) {
-      if (!isOsError(e)) throw e;
-      for (const r of [...done].reverse()) {
-        try { renameSync(path.join(stash, r), path.join(cfg, r)); } catch { /* OSError */ }
-      }
-      cleanHostStash(cfg, host);
-      return { ok: false, failed: [`${rel} (${e.message})`], rolled_back: done.length };
-    }
+  const { done, failed } = moveAll(cfg, stash, rels);
+  if (failed) {
+    cleanHostStash(cfg, host);
+    return { ok: false, failed, rolled_back: done.length };
   }
   unwireClaudeSettings(settingsFile(cfg, managed), managed.settings_hooks || []);
   unwireClaudeExcludes(settingsFile(cfg, managed), managed.settings_excludes || []);
@@ -1127,20 +1152,7 @@ function claudeReactivate(root, scope = 'global', host = 'claude') {
     return { ok: true,
       note: 'install was re-created while disabled; discarded the stashed snapshot' };
   }
-  const leftovers = [];
-  let moved = 0;
-  for (const src of stashFiles(stash)) {
-    const rel = path.relative(stash, src);
-    if (asPosix(rel) === '_claude_md_block.txt') continue;   // restored separately, below
-    const dst = path.join(cfg, rel);
-    if (existsSync(dst)) {
-      leftovers.push(asPosix(rel));
-      continue;
-    }
-    mkdirSync(path.dirname(dst), { recursive: true });
-    renameSync(src, dst);
-    moved += 1;
-  }
+  const { leftovers, moved } = restoreAll(stash, cfg, '_claude_md_block.txt');
   if (leftovers.length) return { ok: false, failed: leftovers, moved };
   const managed = claudeReadManifest(cfg).managed || {};
   // ⚠ THE CARRIER IS RESTORED BEFORE THE HOOKS ARE RE-MERGED, AND THE ORDER IS LOAD-BEARING.

package/js/maintain/update.mjs

@@ -383,7 +383,7 @@ export async function measureUpstream(log = null) {
   return ['ready', behind, ''];
 }
 
-export const DOCTOR_LEGEND = [
+const DOCTOR_LEGEND = [
   '[geneseed] doctor problem legend — what the lines above mean / how to fix:',
   "  • 'dead link'          → a skill/agent body links a sibling as <dir>/<name>.md; use the BARE <name>.md (source bug)",
   "  • 'unresolved token'   → a {{TOKEN}} is missing from a theme; add it to ALL theme JSONs",
@@ -600,7 +600,7 @@ export async function rebuildBundle(here, out, theme, emit, rootDir, log) {
  * emit-marker rebuild only covers THIS checkout's own bundle; without this pass a
  * claude-global or bob install keeps serving the OLD render after every upgrade, silently.
  */
-export async function rebuildInstalls(here, log) {
+async function rebuildInstalls(here, log) {
   log('[geneseed] refreshing every active install (rebuild-all) ...');
   await drainStdout();
   const proc = spawnSync(process.execPath,

package/js/ui/anim.mjs

@@ -37,7 +37,7 @@
 import { printOut } from '../lib/fs.mjs';
 import { parseIntStrict, codePointLength, padEndToWidth } from '../lib/text.mjs';
 
-export const ART = {
+const ART = {
   imperial: {
     title: '+ ADEPTUS ASTARTES +',
     sprite: [

package/js/ui/menu.mjs

@@ -42,7 +42,7 @@ import { which } from '../lib/paths.mjs';
 import { startDaemon } from '../web/daemon.mjs';
 
 /** `_menu_help` — the off-TTY arm, and the fallback both TTY arms end in. */
-export function menuHelp() {
+function menuHelp() {
   printOut('Geneseed — no interactive menu here. Get started with:  geneseed setup\n');
   printOut('Other commands:  bootstrap · update · build · doctor · diff · tui · web\n');
   printOut('On a VT-capable terminal, a bare `./geneseed` opens the interactive menu of these.\n');

package/js/ui/tui.mjs

@@ -83,26 +83,6 @@ export const GLYPH = glyphs(TUI_ASCII);
 // — measured, it disagrees on 897 codepoints across 229 ranges, because a spacing mark is
 // `Mc` with combining class 0 and a great many `Mn` have class 0 too. So the tables below
 // are the port's own, and no dependency was added to get them.
-//
-// A HAND-CARRIED UNICODE TABLE IS THE KIND OF THING THAT IS RIGHT UNTIL IT IS NOT, so the
-// gate over it is not a case list. `tests/__snapshots__/dwidth.json` holds the whole
-// U+0000..U+2FFFF sweep run-length encoded — 196 608 inputs, and a range this table gets wrong
-// has nowhere to hide — replayed by `tests/snapshot/pure_snapshot.test.mjs`. It was RECORDED
-// from Python's live `unicodedata` while that was still here; it cannot be re-recorded now, so
-// a run that goes red is a change in these tables and never a change in the reference.
-//
-// THE VERSION IS DECLARED, not left in a comment, and that changed on the day the gate fired
-// for real. `python3.14` ships unidata 16.0.0, which assigned U+0897 a combining class these
-// tables (built from 15.1.0) do not carry — so the sweep went red naming a codepoint, exactly
-// as designed, on a machine whose only difference was the interpreter. That is not a defect
-// in either implementation and it must not read as one: the sweep is a comparison against a
-// SPECIFIC Unicode version, and a comparison is meaningless against a different one. So the
-// version is a constant, `tests/__snapshots__/dwidth.json` records the version its runs were
-// measured at, and `tests/snapshot/pure_snapshot.test.mjs` asserts the two still agree —
-// reading the constant both by import and by regex out of this file, so the declaration
-// cannot be satisfied by deleting it. There is no interpreter left to pin: CI now FAILS if
-// python is findable at all.
-export const DWIDTH_UNIDATA = '15.1.0';
 
 //: East_Asian_Width W or F, below U+1F000 — above it the reference's own `>= 0x1F000` rule
 //: already answers 2, so the table stops where that rule takes over.
@@ -458,6 +438,9 @@ export function tuiEntries(inv) {
  * an empty state. `_TUI_INV_EMPTY` in `tests/test_pure_function_parity.py` is the corpus
  * entry that surfaced it. **P7c must not reproduce the crash when it ports `_tui_loop`** —
  * the fix is one `or []` at the call site, and it belongs in the same change as the port.
+ *
+ * Its only consumer with direct assertions is `tests/unit/setup.test.mjs`; tests/fixtures/pure_probe.mjs
+ * also dispatches it to exercise wizard/web_first test scenarios.
  */
 export function detailLines(kind, label, data) {
   // The three constitutional tiers share one treatment — the label, a blank, then the body —