geneseed 3.13.0 → 3.15.0

package/js/maintain/uninstall.mjs

@@ -17,9 +17,9 @@
  * 2. AN EMPTY DIRECTORY WAS INVISIBLE TO EVERY CELL. The ancestor-climb prune is a quarter of
  *    this verb and `_snapshot` could not see it: a port that unlinked the files and left
  *    `skills/<name>/` behind was byte-identical everywhere. Closed by a `<dirs>` column in
- *    `tests/harness_golden.py`'s snapshot rather than a per-cell expectation, because one
- *    entry closes it for all 219 cells written before it existed — `cmdTheme`'s statement
- *    order sat in the same hole. The ABSOLUTE half is a different axis and is the sixth
+ *    the CLI matrix's snapshot (`tests/helpers/cli_golden.mjs`) rather than a per-cell
+ *    expectation, because one entry closes it for all 219 cells written before it existed —
+ *    `cmdTheme`'s statement order sat in the same hole. The ABSOLUTE half is a different axis and is the sixth
  *    expectation kind, `expect_absent_files`.
  * 3. `--archive-memory` TOUCHES THE MEMORY STORE, the one thing here a user cannot rebuild.
  *    It is why `_archive_store` MOVES and never deletes, and why the Python's `memory=delete`
@@ -47,31 +47,28 @@ import {
 } from 'node:fs';
 import path from 'node:path';
 
-import { hookRunnerEntry } from '../build/driver.mjs';
-import { confirm } from './setup.mjs';
+import { hookRunnerEntry } from '../hosts/shim.mjs';
+import { confirm } from '../lib/prompt.mjs';
 import {
   claudeCfg, claudeReadManifest, doctrinesOfDir, emitHostScopeOf, excludedRulesOfDir, installKind,
   installState,
-  registeredTargets, readMaybe, DISABLED_STASH,
+  registeredTargets, DISABLED_STASH,
 } from '../hosts/installs.mjs';
 import {
-  GLOBAL_MANIFEST, HOSTS, VERSION_MARKER, expanduser, opencodeConfigDir, resolvePath,
+  CLAUDE_STYLE, GLOBAL_MANIFEST, HOSTS, VERSION_MARKER, expanduser, opencodeConfigDir, resolvePath,
 } from '../hosts/hosts.mjs';
-import { mcpCommented } from '../hosts/mcp.mjs';
+import { mcpCommented, mcpLoad } from '../hosts/mcp.mjs';
 import {
-  managedBlockRead, managedBlockRemove, managedBlockWrite,
-  mergeClaudeSettings, opencodeTarget, readJsonc,
+  atomicWriteJson, managedBlockRead, managedBlockRemove, managedBlockWrite,
+  loadJsonObject, mergeClaudeSettings, opencodeTarget,
   settingsIntegrityCheck, wireClaudeExcludes, unwireClaudeExcludes, unwireClaudeSettings,
 } from '../hosts/settings.mjs';
 import { printOut, printErr, readText, writeText, isFile, isDir, isOsError } from '../lib/fs.mjs';
-import { indexOfDeepEqual, jsonDumps, jsonDumpsIndent, deepEquals } from '../lib/json.mjs';
+import { indexOfDeepEqual, isDict, jsonDumps, deepEquals } from '../lib/json.mjs';
 import { comparePaths, isAbsolutePath, within } from '../lib/paths.mjs';
 
 const hostSpec = (host) => HOSTS.find((h) => h.host === host);
 
-/** The Claude-STYLE hosts — one manifest shape, one reversal. Spelled once. */
-const CLAUDE_STYLE = ['claude', 'bob', 'openclaude'];
-
 /**
  * `shutil.rmtree(p, ignore_errors=True)`.
  *
@@ -154,11 +151,15 @@ function pruneAncestors(start, stop) {
  * failure strings) differ in the root and in the label, which are the two arguments. The
  * `victim.is_file()` guard is load-bearing rather than defensive: a manifest entry naming a
  * directory is SKIPPED, not recursed into, and `removed` counts only what actually went.
+ *
+ * `ownedWithin` first, the same containment boundary deactivate draws: the manifest is a file
+ * on disk, and without it an `owned` entry of `../../.bashrc` was unlinked — and the prune
+ * then climbed from ITS parent, which never meets `base`, removing empty directories as it went.
  */
 function unlinkOwned(base, owned, label = '') {
   let removed = 0;
   const failed = [];
-  for (const rel of owned) {
+  for (const rel of ownedWithin(base, owned)) {
     const victim = path.join(base, rel);
     try {
       if (isFile(victim)) {
@@ -177,6 +178,23 @@ function unlinkOwned(base, owned, label = '') {
   return [removed, failed];
 }
 
+/**
+ * The manifest rels that resolve INSIDE `base` — the one security boundary every walk over
+ * `owned` goes through (uninstall, both deactivates).
+ *
+ * `path.resolve(rroot, r)` and NOT `path.join`, which is the one line here that is a security
+ * boundary rather than a translation. The Python is `(rroot / r).resolve()`, and pathlib's
+ * `/` REPLACES the base when the right operand is absolute — so a manifest entry naming
+ * `C:/evil.md` resolves outside the root and `_within` rejects it. `path.join` would have
+ * concatenated it into `<root>/C:/evil.md`, which passes containment and would then be acted
+ * on. `path.resolve` has pathlib's semantics for exactly this case, and collapses `..`
+ * besides, which is why the guard runs on the resolved path rather than the lexical one.
+ */
+function ownedWithin(base, rels) {
+  const rroot = resolvePath(base);
+  return rels.filter((r) => r && within(resolvePath(path.resolve(rroot, r)), rroot));
+}
+
 /** The two WARNs every reversal prints when an owned file survives. Identical in all three. */
 function warnSurvivors(failed) {
   printErr('[uninstall] WARN: could not remove '
@@ -203,13 +221,9 @@ const REVERSAL_MARKERS = [GLOBAL_MANIFEST, '.geneseed-theme', '.geneseed-emit',
  */
 export function unmergeOpencodeJson(p, entry) {
   const target = opencodeTarget(p);
-  if (!existsSync(target)) return false;
-  let cfg;
-  let hadComments;
-  const text = readMaybe(target);
-  if (text === null) return false;             // the Python's `except OSError: return False`
-  [cfg, hadComments] = readJsonc(text);
-  if (cfg === null || typeof cfg !== 'object' || Array.isArray(cfg)) return false;
+  // Absent, unreadable (the Python's `except OSError: return False`) or not an object: decline.
+  const { state, data: cfg, hadComments } = loadJsonObject(target);
+  if (state !== 'ok') return false;
   const instr = cfg.instructions;
   if (!Array.isArray(instr) || !instr.includes(entry)) return false;
   if (path.extname(target) === '.jsonc' && hadComments) {
@@ -218,7 +232,7 @@ export function unmergeOpencodeJson(p, entry) {
     return false;
   }
   cfg.instructions = instr.filter((i) => i !== entry);
-  writeText(target, `${jsonDumpsIndent(cfg)}\n`);
+  atomicWriteJson(target, cfg);
   return true;
 }
 
@@ -269,8 +283,7 @@ function claudeMdPath(cfg, managed) {
 
 /** A manifest's `managed` map, or `{}` — the Python's `isinstance(..., dict)` guard. */
 function managedOf(man) {
-  const mg = man.managed;
-  return typeof mg === 'object' && mg !== null && !Array.isArray(mg) ? mg : {};
+  return isDict(man.managed) ? man.managed : {};
 }
 
 /** A manifest's `owned` list, or `[]`. */
@@ -339,22 +352,6 @@ export function uninstallGlobal(target, archiveMemory, host = 'opencode') {
   return { removed, unmerged, archived, failed };
 }
 
-/**
- * `_harness_mcp._mcp_load`, reduced to the OpenCode arm.
- *
- * The Claude arm (`.mcp.json`, `~/.claude.json`, parsed STRICTLY — see `mcpLoad` in
- * js/hosts/mcp.mjs for why) lives with the MCP catalog. `installAgentEntry` is this port's only caller and passes
- * no host, so porting the branch would ship an unreachable arm with no cell and no partition
- * to be part of — the criterion this port decides keep-vs-delete by.
- */
-function mcpLoadOpencode(p) {
-  if (!existsSync(p)) return {};
-  const text = readMaybe(p);
-  if (text === null) return {};
-  const [data] = readJsonc(text);
-  return typeof data === 'object' && data !== null && !Array.isArray(data) ? data : {};
-}
-
 /**
  * `_harness_mcp._install_agent_entry` — the `instructions` entry to drop.
  *
@@ -367,7 +364,7 @@ export function installAgentEntry(root, kind) {
   if (kind === 'global') {
     return path.join(root, 'AGENT.md').split(path.sep).join('/');
   }
-  const cfg = mcpLoadOpencode(opencodeTarget(path.join(root, 'opencode.json')));
+  const cfg = mcpLoad(opencodeTarget(path.join(root, 'opencode.json')));
   return installAgentEntryOf(cfg.instructions);
 }
 
@@ -377,7 +374,7 @@ export function installAgentEntry(root, kind) {
  * A cell can only ever observe the entries a seeded `opencode.json` holds, and the shape
  * that separates the two `is_absolute` rules is a Windows ROOTLESS path — which a cell CAN
  * seed but whose answer then only differs on one platform, in one branch, with no other
- * observable effect. `tests/test_pure_function_parity.py` drives the list directly.
+ * observable effect. The former Python corpus drove the list directly; nothing does now.
  */
 export function installAgentEntryOf(instr) {
   if (Array.isArray(instr)) {
@@ -645,22 +642,6 @@ function printOtherHostHits(root, removedHost) {
   }
 }
 
-/**
- * `_harness_setup._confirm`, and the only interactive read this verb makes.
- *
- * MOVED TO `js/maintain/setup.mjs` IN P5i, where the Python's own owner is: `_confirm` lives in
- * `_harness_setup` beside the `_ask` it is built on, and `setup` is its second caller. The
- * body stayed here for one phase because a helper with one caller is not shared yet; the
- * rule this port uses is that the SECOND owner is what moves it, and a byte gate is what
- * licenses the move.
- *
- * UNREACHABLE FROM EVERY CELL, restated because moving it does not change that: `cmdUninstall`
- * only reaches it when stdin is a TTY, and the harness gives every cell a pipe. What the
- * cells DO gate is the branch beside it — the non-interactive refusal — which is why that one
- * has an `expect` naming its wording. It is now gated positively too, by the stdin-seeded
- * corpus P5i added for the wizard.
- */
-
 /**
  * `_harness_mcp.cmd_uninstall`.
  *
@@ -690,7 +671,7 @@ export function cmdUninstall(args) {
   const data = installDataDir(root, host, scope);
   const stores = ['memory', 'notebook'].filter((n) => isDir(path.join(data, n)));
   printOut(`[uninstall] target: ${root} (${host}:${scope})\n`);
-  if (['claude', 'bob', 'openclaude'].includes(host)) {
+  if (CLAUDE_STYLE.includes(host)) {
     printOut('[uninstall] removes: agents/, skills/, markers, the '
       + `${hostSpec(host).agentFile} managed block, and Geneseed's `
       + 'settings.json hooks/excludes (your own keys/hooks are kept).\n');
@@ -751,9 +732,10 @@ export function cmdUninstall(args) {
 // ALL-OR-NOTHING IS THE PROPERTY, and it is the one a port breaks silently. A move that fails
 // puts every earlier move back and reports, leaving the install fully `active`; a port that
 // merely stopped on the failure would leave a half-gutted config dir that neither state
-// answers for. `tests/web_golden.py`'s `install/a-deactivate-whose-second-move-collides…`
-// drives it: a manifest naming a file AND its parent directory is the only shape a seeded
-// world can use to make the SECOND move collide.
+// answers for. `tests/unit/web_api.test.mjs`'s `deactivate rolls back on a failed move`
+// drives it with a file planted where the stash dir belongs, which fails the FIRST move; the
+// former web matrix's SECOND-move collision (a manifest naming a file AND its parent
+// directory) has no successor.
 
 /**
  * `_harness_mcp._move_tree` — move a file or dir, refusing an existing destination.
@@ -810,17 +792,7 @@ function installRelive(root) {
   return isFile(path.join(root, 'AGENT.md'));
 }
 
-/**
- * `_harness_mcp._install_move_list` — the rels to move aside, `_within`-guarded.
- *
- * `path.resolve(rroot, r)` and NOT `path.join`, which is the one line here that is a security
- * boundary rather than a translation. The Python is `(rroot / r).resolve()`, and pathlib's
- * `/` REPLACES the base when the right operand is absolute — so a manifest entry naming
- * `C:/evil.md` resolves outside the root and `_within` rejects it. `path.join` would have
- * concatenated it into `<root>/C:/evil.md`, which passes containment and would then be MOVED.
- * `path.resolve` has pathlib's semantics for exactly this case, and collapses `..` besides,
- * which is why the guard runs on the resolved path rather than the lexical one.
- */
+/** `_harness_mcp._install_move_list` — the rels to move aside, `ownedWithin`-guarded. */
 function installMoveList(root, kind) {
   let rels;
   if (kind === 'project') {
@@ -828,8 +800,7 @@ function installMoveList(root, kind) {
   } else {
     rels = ownedOf(claudeReadManifest(root)).filter((r) => r !== VERSION_MARKER);
   }
-  const rroot = resolvePath(root);
-  return rels.filter((r) => r && within(resolvePath(path.resolve(rroot, r)), rroot));
+  return ownedWithin(root, rels);
 }
 
 /**
@@ -844,16 +815,11 @@ function installMoveList(root, kind) {
  */
 function installReaddEntry(target, entry) {
   if (!existsSync(target)) {
-    mkdirSync(path.dirname(target), { recursive: true });
-    writeText(target, `${jsonDumpsIndent({
-      $schema: 'https://opencode.ai/config.json', instructions: [entry],
-    })}\n`);
+    atomicWriteJson(target, { $schema: 'https://opencode.ai/config.json', instructions: [entry] });
     return true;
   }
-  let raw;
-  try { raw = readText(target); } catch { return false; }   // except OSError
-  const [cfg, hadComments] = readJsonc(raw);
-  if (typeof cfg !== 'object' || cfg === null || Array.isArray(cfg)) return false;
+  const { state, data: cfg, hadComments } = loadJsonObject(target);
+  if (state !== 'ok') return false;            // unreadable (except OSError), or not an object
   const instr = Array.isArray(cfg.instructions) ? cfg.instructions : [];
   if (indexOfDeepEqual(instr, entry) >= 0) return false;
   if (path.extname(target) === '.jsonc' && hadComments) {
@@ -862,7 +828,7 @@ function installReaddEntry(target, entry) {
     return false;
   }
   cfg.instructions = [...instr, entry];
-  writeText(target, `${jsonDumpsIndent(cfg)}\n`);
+  atomicWriteJson(target, cfg);
   return true;
 }
 
@@ -961,7 +927,7 @@ function restoreAll(stash, base, skip = null) {
  * The config edit is the LAST step and the only non-move mutation, so a move failure rolls
  * back cleanly with the `instructions` entry still intact. The prune climbs from each moved
  * file's PARENT so a `skills/<name>/` husk goes too — the half of this function no file
- * snapshot can see, and the reason `tests/web_golden.py` grew a `<dirs>` column in P6i.
+ * snapshot can see, and the reason the former web matrix grew a `<dirs>` column in P6i.
  */
 export function installDeactivate(root, host = 'opencode', scope = 'global') {
   if (CLAUDE_STYLE.includes(host)) return claudeDeactivate(root, scope, host);
@@ -1067,16 +1033,14 @@ function remergeClaudeHooks(cfg, root = cfg, host = 'claude') {
   const excluded = excludedRulesOfDir(root).length ? excludedRulesOfDir(root)
     : excludedRulesOfDir(cfg);
   // `host` reaches the group builder: a Bob reactivate must re-wire Gemini-named groups.
-  const [, claims] = mergeClaudeSettings(settingsFile(cfg, managed), 'global',
+  const [, claims] = mergeClaudeSettings(settingsFile(cfg, managed),
     managed.settings_hooks ?? null, hookRunnerEntry(), doctrines, excluded, host, cfg);
   // `and data` — a manifest that did not parse is not one to write back.
   if (!deepEquals(claims, managed.settings_hooks ?? null) && Object.keys(data).length > 0) {
     managed.settings_hooks = claims;
     data.managed = managed;
-    const tmp = path.join(cfg, `${GLOBAL_MANIFEST}.tmp`);
     try {
-      writeText(tmp, `${jsonDumpsIndent(data)}\n`);
-      renameSync(tmp, path.join(cfg, GLOBAL_MANIFEST));
+      atomicWriteJson(path.join(cfg, GLOBAL_MANIFEST), data);
     } catch { /* except OSError: pass */ }
   }
 }
@@ -1093,9 +1057,7 @@ function claudeDeactivate(root, scope = 'global', host = 'claude') {
   const man = claudeReadManifest(cfg);
   const managed = managedOf(man);
   const stash = path.join(cfg, DISABLED_STASH, host);
-  const rroot = resolvePath(cfg);
-  const rels = ownedOf(man).filter((r) => r && r !== VERSION_MARKER
-    && within(resolvePath(path.resolve(rroot, r)), rroot));
+  const rels = ownedWithin(cfg, ownedOf(man).filter((r) => r !== VERSION_MARKER));
   const { done, failed } = moveAll(cfg, stash, rels);
   if (failed) {
     cleanHostStash(cfg, host);
@@ -1129,9 +1091,7 @@ function claudeReactivate(root, scope = 'global', host = 'claude') {
   const stash = path.join(cfg, DISABLED_STASH, host);
   const blockFile = path.join(stash, '_claude_md_block.txt');
   const reliveManifest = claudeReadManifest(cfg);
-  // `.get("managed") or {}` — an `or`, not an isinstance guard, and the difference is
-  // observable on a manifest whose `managed` is `null`.
-  const reliveManaged = reliveManifest.managed || {};
+  const reliveManaged = managedOf(reliveManifest);
   let relive = managedBlockRead(claudeMdPath(cfg, reliveManaged)) !== null;
   // Bob GLOBAL writes no managed AGENTS.md block — its preamble carrier is the owned
   // `rules/geneseed.md`, so a live copy of THAT is the relive signal there. Without this arm
@@ -1149,7 +1109,7 @@ function claudeReactivate(root, scope = 'global', host = 'claude') {
   }
   const { leftovers, moved } = restoreAll(stash, cfg, '_claude_md_block.txt');
   if (leftovers.length) return { ok: false, failed: leftovers, moved };
-  const managed = claudeReadManifest(cfg).managed || {};
+  const managed = managedOf(claudeReadManifest(cfg));
   // ⚠ THE CARRIER IS RESTORED BEFORE THE HOOKS ARE RE-MERGED, AND THE ORDER IS LOAD-BEARING.
   // `remergeClaudeHooks` reads the install's pack selection back off the carrier, and on a
   // Claude-style host that selection lives inside the MANAGED BLOCK — which the deactivate

package/js/maintain/update.mjs

@@ -1,10 +1,8 @@
 /**
  * Self-update: `git pull` the install's own origin, validate, rebuild.
  *
- * The verb this whole port exists for. Every other subcommand can be Python for one more
- * release; `upgrade` is the one operation a "no Python needed" install cannot delegate,
- * because a Node install that shelled out to the Python harness to update itself
- * would have Python as a hard dependency of the only command a user MUST be able to run.
+ * The one operation a user MUST always be able to run: every other verb can be broken by a bad
+ * release, and this is the verb that fetches the fix.
  *
  * WHY THIS MODULE SPAWNS, AND WHY THE ARGUMENT IS NOT THE JOB RUNNER'S. `js/web/jobs.mjs`
  * re-executes this program for ISOLATION — a synchronous verb in the daemon's event loop
@@ -15,21 +13,23 @@
  * the modules this process loaded before the merge — it would validate the old source, pass,
  * and then render the old source into the bundle, reporting success. That is not a slower
  * version of the right answer, it is the wrong one. So `runDoctor`, `rebuildBundle` and
- * `rebuildInstalls` each start a fresh interpreter over the tree as it now is, exactly as the
- * reference does, and `_ALLOWED_SPAWNS` in `tests/test_hook_cli_parity.py` carries the argv.
+ * `rebuildInstalls` each start a fresh interpreter over the tree as it now is, and
+ * `ALLOWED_SPAWNS` in `tests/unit/hook_cli.test.mjs` carries the argv. The same reason is why
+ * the two modules this file reaches lazily (`js/build/generate.mjs`, `js/web/daemon.mjs`) are
+ * loaded BEFORE the pull and not at their call sites: an `import()` after the merge would mix
+ * pulled files with the ones already cached, and a renamed export kills the upgrade mid-way.
  *
  * `git` is the fourth spawn and the plainest: there is no git library in the Node stdlib,
  * and the port will not vendor one. Every git call goes through the `gitRun` seam —
  * which-guarded, credential-redacted, and it never throws.
  *
- * WHAT THE GATE CANNOT SEE, stated rather than implied. `upgrade/*` in
- * `tests/harness_golden.py` runs each arm against a private clone of a bare origin the
- * fixture builds, so no cell can reach a network — which is a safety property and a blind
+ * WHAT THE GATE CANNOT SEE, stated rather than implied. `tests/unit/update_git.test.mjs` and
+ * `tests/unit/update_flow.test.mjs` run each arm against a private clone of a bare origin the
+ * fixture builds, so no test can reach a network — which is a safety property and a blind
  * spot at once: `git fetch --progress` over a local path prints NOTHING, so
  * `fetchStreaming`'s reader, its phase filter and its 15s heartbeat are reachable in every
- * cell and varied in none. The phase filter is gated as a corpus in
- * `tests/test_pure_function_parity.py`; the heartbeat and the hard deadline are gated by
- * neither and are declared in the P8a handoff.
+ * run and varied in none. The phase filter is gated over a recorded transcript in
+ * `tests/unit/update_git.test.mjs`; the heartbeat and the hard deadline are gated by nothing.
  *
  * ALSO HERE, SINCE P8b: `syncSelf`/`cmdSyncSelf` and the bootstrap step runner
  * (`cmdBootstrap`, `bootstrapPlain`) at the bottom of this file. Still NOT here: `main`, the
@@ -47,10 +47,9 @@ import { ROOT } from '../build/source.mjs';
 import { exportImprovements, flushExportNotes } from '../inspect/diff.mjs';
 import { opencodeConfigDir } from '../hosts/hosts.mjs';
 import { appendText, copyFile, printOut, printErr, readText, writeText } from '../lib/fs.mjs';
-import { toPlatformPath, which } from '../lib/paths.mjs';
+import { comparePaths, toPlatformPath, which } from '../lib/paths.mjs';
 import { WHITESPACE, parseIntStrict, stripWhitespace } from '../lib/text.mjs';
 import { NO_WINDOW } from '../lib/proc.mjs';
-import { bounceDaemonIfRunning } from '../web/daemon.mjs';
 
 /**
  * `_CREDS_RE` / `_redact_url_creds` — strip a `user[:token]@` userinfo out of any URL in
@@ -248,8 +247,14 @@ export function countOccurrences(s) {
 export function killTree(child) {
   try {
     if (process.platform !== 'win32') process.kill(-child.pid, 'SIGKILL');
-    else spawnSync('taskkill', ['/F', '/T', '/PID', String(child.pid)],
-      { encoding: 'utf8', timeout: 15000, ...NO_WINDOW });
+    else {
+      // `which`, never a bare name (a bare name resolves against the cwd first on Windows);
+      // no taskkill on PATH falls through to the `child.kill()` below.
+      const taskkill = which('taskkill');
+      if (!taskkill) throw new Error('taskkill not on PATH');
+      spawnSync(taskkill, ['/F', '/T', '/PID', String(child.pid)],
+        { encoding: 'utf8', timeout: 15000, ...NO_WINDOW });
+    }
   } catch {
     try { child.kill(); } catch { /* already gone */ }
   }
@@ -262,7 +267,7 @@ export function killTree(child) {
  * times and universal-newline decoding turns every `\r` repaint into its own line, so
  * without this a 30-second fetch writes a thousand lines into the install log. No cell can
  * reach it — a local-path fetch prints nothing at all — so
- * `tests/test_pure_function_parity.py` runs it over a recorded fetch transcript instead.
+ * `tests/unit/update_git.test.mjs` runs it over a recorded fetch transcript instead.
  *
  * Returns `[linesToLog, lastPhase]`, splitting the reference's loop from its side effects.
  */
@@ -366,13 +371,19 @@ export async function fetchStreaming(log = null) {
 
 /**
  * `_measure_upstream(log)` — Phase B: fetch (streamed), then classify. Returns
- * `[code, behind, err]` with `code` ∈ {ready, fetch_failed, unrelated, diverged, uptodate}.
+ * `[code, behind, err]` with `code` ∈ {ready, fetch_failed, no_upstream, unrelated, diverged,
+ * uptodate}.
+ *
+ * `no_upstream` HERE, AFTER PREFLIGHT SAID THERE WAS ONE: the fetch itself can take it away.
+ * An upstream branch deleted on the remote, fetched with `fetch.prune`, leaves `@{u}` naming
+ * nothing — both counts then fail, and read as two zeros they said "already up to date".
  */
 export async function measureUpstream(log = null) {
   const [rc, err] = await fetchStreaming(log);
   if (rc !== 0) return ['fetch_failed', 0, err];
-  const [, aheadRaw] = gitRun(['rev-list', '--count', '@{u}..HEAD']);
-  const [, behindRaw] = gitRun(['rev-list', '--count', 'HEAD..@{u}']);
+  const [arc, aheadRaw] = gitRun(['rev-list', '--count', '@{u}..HEAD']);
+  const [brc, behindRaw] = gitRun(['rev-list', '--count', 'HEAD..@{u}']);
+  if (arc !== 0 || brc !== 0) return ['no_upstream', 0, ''];
   const ahead = countOccurrences(aheadRaw);
   const behind = countOccurrences(behindRaw);
   if (ahead > 0) {
@@ -419,16 +430,31 @@ export function runDoctor(cand) {
   return [r.status === 0, universal(r.stdout) + universal(r.stderr)];
 }
 
-/** `_pull_and_validate(log)` — fast-forward to `@{u}`, then doctor-gate with exact rollback. */
+/**
+ * `_pull_and_validate(log)` — fast-forward to `@{u}`, then doctor-gate with exact rollback.
+ *
+ * `collision` ONLY WHEN GIT SAYS SO. A fast-forward can fail for other reasons — a lock file, a
+ * permission, a merge refused outright — and calling every one an untracked-file collision
+ * sent the user hunting for a file that is not there, with an info exit (3) over an error.
+ *
+ * THE ROLLBACK IS `reset --keep`, NEVER `--hard`. The doctor window lasts up to 300 s, and an
+ * edit made in the checkout meanwhile is a tracked edit `--hard` would destroy without a word.
+ * `--keep` refuses instead when such an edit touches a file the rollback must change; that
+ * refusal is reported as itself — the user is left on the pulled commit, with the command to
+ * finish the rollback — rather than as a rollback that did not happen.
+ */
 export function pullAndValidate(log) {
   const [rc0, old] = gitRun(['rev-parse', 'HEAD']);
   if (rc0 !== 0 || !old) return [false, 'not_git', 'could not read HEAD'];
   log('[geneseed] fast-forwarding to upstream ...');
   const [rc1, , err] = gitRun(['merge', '--ff-only', '@{u}'], { timeout: 60 });
   if (rc1 !== 0) {
-    return [false, 'collision',
-      'Update blocked — a new upstream file collides with a local untracked '
-      + 'file. Move or remove it, then update.\n' + err];
+    if (/would be overwritten/.test(err)) {
+      return [false, 'collision',
+        'Update blocked — a new upstream file collides with a local untracked '
+        + 'file. Move or remove it, then update.\n' + err];
+    }
+    return [false, 'merge_failed', `Update failed — could not fast-forward to upstream.\n${err}`];
   }
   const [rc2, pulled] = gitRun(['log', '--oneline', '--no-decorate', '-20', `${old}..HEAD`]);
   if (rc2 === 0 && pulled) {
@@ -439,8 +465,15 @@ export function pullAndValidate(log) {
   const [passed, output] = runDoctor(ROOT);
   log(output.replace(/\n+$/, ''));
   if (!passed) {
-    gitRun(['reset', '--hard', old], { timeout: 60 });
+    const [rc3, , rerr] = gitRun(['reset', '--keep', old], { timeout: 60 });
     for (const line of DOCTOR_LEGEND) log(line);
+    if (rc3 !== 0) {
+      return [false, 'doctor_fail',
+        'the pulled source FAILS validation, and the rollback was REFUSED — a file it must '
+        + 'restore was edited while the doctor ran, and those edits were kept. You are still '
+        + `on the pulled commit; save your edits, then roll back with: git reset --keep ${old}\n`
+        + rerr];
+    }
     return [false, 'doctor_fail',
       'the pulled source FAILS validation — rolled back to the previous commit. '
       + 'Fix the problems listed above.'];
@@ -505,8 +538,9 @@ export function markerTheme(cfg, out) {
 }
 
 /**
- * `_config_theme(here)` — the theme the LOCAL `harness.config.json` asks for, captured
- * before SYNC overwrites it with upstream's. Fallback only; a bundle marker still wins.
+ * `_config_theme(here)` — the theme the checkout's `harness.config.json` asks for. Fallback
+ * only; a bundle marker still wins. Read before the pull, but nothing local is at stake: the
+ * file is tracked and `preflight` refuses a dirty tree, so the value read is the committed one.
  */
 export function configTheme(here) {
   try {
@@ -518,11 +552,16 @@ export function configTheme(here) {
 /**
  * `_migrate_stray_bundle` — move host state (context.json, memory/) from an OLD in-folder
  * bundle to the canonical sibling `out` BEFORE rebuilding, then drop the stray.
+ *
+ * "IS `out` THE STRAY ITSELF?" IS A PATH COMPARISON, NOT A STRING ONE. `GENESEED_OUT` is typed
+ * by a user, so on Windows `c:\x\Geneseed\harness` is the same directory as the stray and was a
+ * different string: the rescue was skipped as "nothing to move into", and the `rmSync` at the
+ * bottom then deleted the LIVE bundle — memory/ and context.json with it.
  */
 export function migrateStrayBundle(here, out, log) {
   const stray = path.join(String(here), 'Harness');
   const outStr = String(out);
-  if (outStr === stray) return;
+  if (comparePaths(path.resolve(outStr), path.resolve(stray)) === 0) return;
   try { if (!statSync(stray).isDirectory()) return; } catch { return; }
   mkdirSync(outStr, { recursive: true });
   const ctx = path.join(stray, 'context.json');
@@ -559,15 +598,40 @@ async function drainStdout() {
   await new Promise((resolve) => { process.stdout.write('', resolve); });
 }
 
+/**
+ * The flags that re-emit the install at `dir` on its OWN axes — footprint, posture, mode,
+ * trust, doctrine packs, excluded rules — or `[]` when no build ever wrote a marker there.
+ *
+ * WITHOUT THEM THE REBUILD RESETS THE INSTALL. The generator's defaults are not the install's:
+ * a missing `--footprint` is `lean`, and posture, mode, packs and excluded rules come from
+ * `harness.config.json`. So a `full`, mentor, narrowed or rule-excluded install was re-emitted
+ * as the config default — markers included — and `rebuild-all` right after reads those
+ * rewritten markers back through `installProfile`, so the loss stuck. `installProfile` is the
+ * one reader of an install's axes; this takes its answer rather than growing a second one.
+ *
+ * Only the TAIL of the argv is kept: theme and emit are `upgrade`'s to decide (a theme argument
+ * may override the marker), and `setupBuildArgs` opens with exactly those four tokens when it
+ * is given no out and no root.
+ */
+export async function installAxes(dir, { installProfile, setupBuildArgs }) {
+  if (!existsSync(path.join(String(dir), '.geneseed-emit'))) return [];
+  const p = installProfile('opencode', 'global', String(dir));
+  return setupBuildArgs('', 'files', null, null, p.footprint, p.posture, p.mode, p.doctrines,
+    undefined, p.excludeRules, p.trust).slice(4);
+}
+
 /**
  * `_rebuild_bundle` — render the bundle from the (already-updated) source and bounce a
- * running web daemon. Returns the build subprocess returncode (0 = ok).
+ * running web daemon. Returns the build subprocess returncode (0 = ok). `axes` is
+ * `installAxes` of the target, read before the pull; `bounce` is the daemon module's
+ * `bounceDaemonIfRunning`, loaded before the pull for the reason the file header gives.
  */
-export async function rebuildBundle(here, out, theme, emit, rootDir, log) {
+export async function rebuildBundle(here, out, theme, emit, rootDir, log, axes, bounce) {
   const buildArgs = ['--out', String(out)];
   if (theme) buildArgs.push('--theme', theme);
   if (emit === 'opencode') buildArgs.push('--emit', 'opencode', '--root', String(rootDir));
   else if (emit === 'opencode-global') buildArgs.push('--emit', 'opencode-global');
+  buildArgs.push(...axes);
   log(`[geneseed] rebuilding bundle -> ${out} (theme: ${theme || 'config default'}, emit: ${emit}) ...`);
   await drainStdout();
   // THE GENERATOR, RE-EXECUTED. `js/build/generate.mjs`'s `cmdBuild` calls `driverMain` in-process
@@ -580,7 +644,7 @@ export async function rebuildBundle(here, out, theme, emit, rootDir, log) {
   // If a web daemon is running, bounce it so the new source and the freshly rebuilt web/dist
   // take effect — otherwise the open PWA keeps hitting the old code. The web-job exception
   // (`upgrade/the-web-job-marker-...` gates it) lives with the helper.
-  await bounceDaemonIfRunning(theme, log);
+  await bounce(theme, log);
   return 0;
 }
 
@@ -636,6 +700,12 @@ export async function upgrade(ref = null, themeArg = null) {
     return p.kind === 'info' ? 3 : 1;
   }
 
+  // Loaded and read BEFORE the pull — see the file header for why the imports cannot wait, and
+  // `installAxes` for why the target's own axes must be carried into the rebuild.
+  const [generate, { bounceDaemonIfRunning }] = await Promise.all([
+    import('../build/generate.mjs'), import('../web/daemon.mjs')]);
+  const axes = await installAxes(emit === 'opencode-global' ? cfg : out, generate);
+
   log(`[geneseed] fetching from origin (git: ${which('git') || 'git'}, `
     + `timeout: ${fetchTimeout()}s) ...`);
   const [code, behind, err] = await measureUpstream(log);
@@ -647,6 +717,10 @@ export async function upgrade(ref = null, themeArg = null) {
       + 'Kerberos credentials). Restart it from that terminal: `geneseed web restart`.');
     return 1;
   }
+  if (code === 'no_upstream') {
+    log(`[geneseed] ${PRE_MSG.no_upstream[1]}`);
+    return 3;
+  }
   if (code === 'unrelated') {
     log('[geneseed] Upstream history was rewritten; back up local work, then re-clone '
       + 'or `git reset --hard @{u}`.');
@@ -676,7 +750,8 @@ export async function upgrade(ref = null, themeArg = null) {
   } catch (e) {
     log(`[geneseed] ⚠️  could not migrate the old in-folder bundle (${e && e.message ? e.message : e}) — continuing.`);
   }
-  let rc = await rebuildBundle(here, out, theme, emit, rootDir, log);
+  let rc = await rebuildBundle(here, out, theme, emit, rootDir, log, axes,
+    bounceDaemonIfRunning);
   if (rc !== 0) {
     log(`[geneseed][E-BUILD] ✗ the bundle build FAILED (theme: ${theme || 'default'}, emit: ${emit}).`);
     return 1;
@@ -886,13 +961,19 @@ function reexec(argv) {
  * `flushExportNotes()` runs BEFORE the handoff, deliberately: the re-exec replaces this process
  * and the update step's own improvements notice has scrolled past (or, under the reference's
  * curses arm, died with the alternate screen).
+ *
+ * A FAILED UPDATE STILL EXITS 1 AFTER THE HANDOFF. `setup` still runs — the user asked for it,
+ * and it can repair what the update could not — but its exit code used to become bootstrap's,
+ * so a script saw 0 over an update that never happened. `handoff` is the seam a test needs:
+ * the real `setup` exits 1 off a terminal, which would make the two answers indistinguishable.
  */
-export async function cmdBootstrap(args) {
+export async function cmdBootstrap(args, { handoff = reexec } = {}) {
   const failed = await bootstrapPlain();
   flushExportNotes();
   if (!args.noSetup) {
-    return reexec([process.execPath,
+    const rc = handoff([process.execPath,
       path.join(String(ROOT), 'bin', 'geneseed-cli.mjs'), 'setup']);
+    return failed ? 1 : rc;
   }
   // Scripted `bootstrap --no-setup` must not exit 0 over a failed update.
   return failed ? 1 : 0;