geneseed 3.14.0 → 3.15.0

package/js/hosts/opencode.mjs

@@ -16,18 +16,21 @@
  *
  * TWO STREAMS, AND THE SPLIT IS NOT TIDY. `_warn_if_overrides_stale` prints to STDOUT
  * while every warning in `js/hosts/native.mjs` goes to stderr. That is the Python's own
- * inconsistency and it is reproduced, not corrected: the parity gate compares both
- * specification, and `tests/unit/agent_overrides.test.mjs` pins the stale notice to stdout.
- * It is safe because this is the
- * generator's CLI, which prints progress to stdout by design — unlike a hook path, where
- * a stray stdout byte silently disarms a blocking gate.
+ * inconsistency and it is reproduced, not corrected: `tests/unit/agent_overrides.test.mjs`
+ * pins the stale notice to stdout. It is safe because this is the generator's CLI, which
+ * prints progress to stdout by design — unlike a hook path, where a stray stdout byte
+ * silently disarms a blocking gate.
  */
 import { existsSync, mkdirSync, readdirSync, statSync } from 'node:fs';
 import path from 'node:path';
 import { writeText, readText, copyFile } from '../lib/fs.mjs';
 import { jsonDumps, jsonDumpsIndent, parseJson } from '../lib/json.mjs';
 import { comparePaths } from '../lib/paths.mjs';
-import { descOf, stripSkillBodyLinks, pushOverrideLines } from './native.mjs';
+import { sourceReleaseVersion } from '../build/version.mjs';
+import { firstBlockquote, stripSkillBodyLinks, pushOverrideLines } from './native.mjs';
+
+// Re-exported for `js/web/api.mjs` and the tests, which import it from here.
+export { sourceReleaseVersion };
 
 /** ANSI colour-name -> integer (0-7). Mirrors `_build_emit._ANSI`. */
 const ANSI = {
@@ -94,9 +97,17 @@ const AGENT_OVERRIDES_STUB = {
   },
 };
 
-/** Mirrors `_build_emit.COMMAND_SET` — the hot skills worth a one-keystroke trigger. */
-const COMMAND_SET = ['commit', 'plan', 'code-review', 'review-response',
-  'ship', 'debug', 'research'];
+/**
+ * `_build_emit.COMMAND_SET` — the hot skills worth a one-keystroke trigger, as command name ->
+ * skill name. A map, not a list, because the two can differ: `code-review` became
+ * `geneseed-code-review` (so it no longer shadows a host built-in) while the command stays
+ * `/code-review`. As a list the renamed entry missed its skill and was dropped in silence, so a
+ * missing skill is now a thrown error in `writeCommandLayer`.
+ */
+const COMMAND_SET = {
+  commit: 'commit', plan: 'plan', 'code-review': 'geneseed-code-review',
+  'review-response': 'review-response', ship: 'ship', debug: 'debug', research: 'research',
+};
 
 /** Mirrors `_build_emit.PONYTAIL_COMMAND_BODY`. */
 const PONYTAIL_COMMAND_BODY =
@@ -113,22 +124,6 @@ function truthyEnv(name) {
   return ['1', 'on', 'true', 'yes'].includes((process.env[name] || '').toLowerCase());
 }
 
-/**
- * `_build_core.source_release_version`. It reads `cfg.config`, so it takes `cfg` rather than
- * importing core — and it stayed HERE when core landed as `js/build/source.mjs`, which is why
- * `js/build/version.mjs` reaches back into the OpenCode module for it.
- */
-export function sourceReleaseVersion(cfg) {
-  try {
-    const data = parseJson(readText(cfg.config));
-    const v = data && typeof data === 'object' && !Array.isArray(data) ? data.version : null;
-    if (typeof v === 'string' && v) return v;
-  } catch {
-    // OSError / JSONDecodeError — degrade to "not newer" rather than raising.
-  }
-  return '0.0.0';
-}
-
 const GRAY = 8;
 const GREEN = 2;
 const RED = 1;
@@ -181,7 +176,6 @@ export function writeTheme(themesDir, themeName, theme) {
   return dest;
 }
 
-/** `_build_emit._color_theme_json`. */
 /**
  * `_build_emit._PALETTE_ROLES` — every role some slot reads, as a set.
  *
@@ -192,6 +186,7 @@ export function writeTheme(themesDir, themeName, theme) {
  */
 export const PALETTE_ROLES = new Set(Object.values(SLOT_ROLE));
 
+/** `_build_emit._color_theme_json`. */
 export function colorThemeJson(palette, transparent) {
   const t = {};
   for (const [slot, role] of Object.entries(SLOT_ROLE)) {
@@ -272,8 +267,16 @@ export function ensureAgentOverridesStub(cfg, base) {
   writeText(dest, `${jsonDumpsIndent(stub, { ensureAscii: false })}\n`);
 }
 
-/** `_build_emit._write_primary_agent` — the opt-in `mode: primary` orchestrator. */
-export function writePrimaryAgent(cfg, agentsDir, overrides) {
+/**
+ * `_build_emit._write_primary_agent` — the opt-in `mode: primary` orchestrator.
+ *
+ * `claim` is `claimer`'s closure from `js/hosts/native.mjs`, and this and the two command
+ * writers below take it for the reason `writeNativeLayer` does: their paths are pushed into
+ * `owned`, and uninstall deletes what `owned` names — so writing over a user's own
+ * `command/commit.md` without the check made uninstall delete it. Default: claim everything,
+ * for a caller with no manifest to consult.
+ */
+export function writePrimaryAgent(cfg, agentsDir, overrides, claim = () => true) {
   if (!truthyEnv('GENESEED_PRIMARY') || !existsSync(cfg.primaryAgentSrc)
       || !statSync(cfg.primaryAgentSrc).isFile()) {
     return null;
@@ -286,13 +289,14 @@ export function writePrimaryAgent(cfg, agentsDir, overrides) {
     && overrides.orchestrator) || {};
   pushOverrideLines(fm, ov);
   const dest = path.join(agentsDir, 'orchestrator.md');
+  if (!claim(dest)) return null;
   mkdirSync(path.dirname(dest), { recursive: true });
   writeText(dest, `---\n${fm.join('\n')}\n---\n\n${body}`);
   return dest;
 }
 
 /** `_build_emit._write_command_layer` — the opt-in /slash commands. */
-export function writeCommandLayer(cfg, items, commandDir) {
+export function writeCommandLayer(cfg, items, commandDir, claim = () => true) {
   if (!truthyEnv('GENESEED_COMMANDS')) return [];
   const byName = new Map();
   for (const { text, src } of items) {
@@ -304,12 +308,15 @@ export function writeCommandLayer(cfg, items, commandDir) {
     }
   }
   const written = [];
-  for (const name of COMMAND_SET) {
-    const text = byName.get(name);
-    if (text === undefined) continue;
-    const desc = descOf(text);
-    const body = stripSkillBodyLinks(text.replace(/^\n+/, ''));
+  for (const [name, skill] of Object.entries(COMMAND_SET)) {
+    const text = byName.get(skill);
+    if (text === undefined) {
+      throw new Error(`COMMAND_SET: /${name} runs skill '${skill}', which src/skills/ does not have`);
+    }
     const dest = path.join(commandDir, `${name}.md`);
+    if (!claim(dest)) continue;
+    const desc = firstBlockquote(text);
+    const body = stripSkillBodyLinks(text.replace(/^\n+/, ''));
     mkdirSync(path.dirname(dest), { recursive: true });
     writeText(dest, `---\ndescription: ${jsonDumps(desc)}\n---\n\n${body}`);
     written.push(dest);
@@ -317,9 +324,10 @@ export function writeCommandLayer(cfg, items, commandDir) {
   return written;
 }
 
-/** `_build_emit._write_ponytail_command` — registered UNCONDITIONALLY. */
-export function writePonytailCommand(commandDir) {
+/** `_build_emit._write_ponytail_command` — registered UNCONDITIONALLY; null when the user's. */
+export function writePonytailCommand(commandDir, claim = () => true) {
   const dest = path.join(commandDir, 'ponytail.md');
+  if (!claim(dest)) return null;
   mkdirSync(path.dirname(dest), { recursive: true });
   const desc = 'Set the ponytail minimal-code level for the session: lite | full | ultra | off';
   writeText(dest, `---\ndescription: ${jsonDumps(desc)}\n---\n\n${PONYTAIL_COMMAND_BODY}`);

package/js/hosts/shim.mjs

@@ -273,7 +273,8 @@ export function hookPrefix({ runner, entry, platform = process.platform } = {})
  * interpreter silently disables every hook in the install. Both halves are gone. `runner` is
  * `process.execPath` — the node already running this file, which by construction exists —
  * so there is nothing left to discover and no way for discovery to fail. P4e kept the
- * unreachable exit-3 branch because `test_the_node_driver_classifies_every_emit` asserts a
+ * unreachable exit-3 branch because 'the driver classifies every emit'
+ * (`tests/unit/node_driver.test.mjs`) asserts a
  * partition it belongs to; nothing asserts a partition over this one, so keeping it would
  * be keeping code no test can reach for no stated reason.
  *
@@ -287,7 +288,8 @@ export function hookPrefix({ runner, entry, platform = process.platform } = {})
  *
  * That is correct exactly while the two entry points answer the same verbs the same way, so
  * the gate that used to be a formality is now load-bearing:
- * `test_the_entry_carries_exactly_the_verbs_the_emitter_wires` reads the emitter's wiring
+ * 'the hook entry carries exactly the verbs the emitter wires' (`tests/unit/hook_cli.test.mjs`)
+ * reads the emitter's wiring
  * and `bin/geneseed-hook.mjs`'s VERBS table and requires them EQUAL — a wired verb the entry
  * lacks is a dead hook on every install on the machine, not just this one. The alternative
  * considered and rejected was a per-driver shim path: the path is baked into every already

package/js/inspect/diff.mjs

@@ -22,11 +22,10 @@
  *   * **The diff algorithm.** A cell can produce ONE edited file and see one hunk. It cannot
  *     produce the shapes where `difflib`'s choices differ from any other diff's — ties, the
  *     recursion's alignment, and above all `autojunk`, which only engages at 200 lines and
- *     changes the hunks on every real harness file. Gated as a corpus —
- *     `tests/fixtures/pure_probe.mjs`'s `unified_diff` entry, replayed by
- *     `tests/snapshot/pure_snapshot.test.mjs` against `tests/__snapshots__/primitives/` —
- *     measured in both directions (28 of the 176 cases there disagree when `autojunk` is
- *     switched off, so the corpus is not describing a constant).
+ *     changes the hunks on every real harness file. The former Python suite gated it as a
+ *     corpus, measured in both directions (28 of its 176 cases disagreed when `autojunk` was
+ *     switched off). That corpus is gone and no Node test drives `unifiedDiff` directly, so
+ *     beyond the one hunk the `diff/--full-…` cell sees, nothing pins these shapes today.
  *   * **The timestamp.** `_write_improvements` names the file `improvements-%Y%m%d-%H%M%S.md`
  *     and stamps the report with `datetime.now()`, so the two implementations cannot write the
  *     same bytes across a second boundary — and a cell runs them in sequence, so the boundary
@@ -177,7 +176,7 @@ export function diffCollect({ target = null, theme = null, emit = null, footprin
       // makes explicit rather than leaving to `makeCfg`'s parameter default two layers down.
       posture: postureOfDir(dir), mode: modeOfDir(dir), doctrines: doctrinesForBuild(dir),
       // The loop skill's preset, or its `Default trust preset:` line reads as edited.
-      trust: trustOfDir(dir),
+      trust: trustOfDir(dir, host),
       // The excluded rules, or an install built `--exclude-rules "process 5"` reads its
       // carrier as drift: `expected` would re-state the rule the deployment took away.
       excludeRules: excludedRulesOfDir(dir),

package/js/inspect/excludes.mjs

@@ -78,14 +78,19 @@ const canon = (p) => resolvePath(p);
 /**
  * `_same` — is this stored entry the same folder as `repo`?
  *
- * `toPlatformPath` and not `path.normalize`: the latter collapses `a/../b` to `b`, and Python's
- * `Path()` does not, so a hand-edited entry carrying `..` matches here and would not match
- * there. Getting that backwards makes `exclude remove` unwire a repo the reference left
- * alone.
+ * Resolved like `repo` itself (`canon`: `..` collapsed, symlinks followed), the one rule the
+ * hook's `sovereignBypass` and the OpenCode plugins apply too — so an entry that EXCLUDES a
+ * folder is exactly the entry `exclude remove` can take back. It used to compare lexically,
+ * mirroring the former Python `Path()`, which made a hand-edited `<repo>/../repo` an entry the
+ * plugins honoured, the hook ignored, and `remove` could not find.
  */
 function same(stored, repo) {
   if (typeof stored !== 'string' || !stored) return false;
-  return normcase(toPlatformPath(stored)) === normcase(repo);
+  try {
+    return normcase(canon(stored)) === normcase(repo);
+  } catch {
+    return false;  // a `~user` form `expanduser` refuses names no folder
+  }
 }
 
 /**

package/js/inspect/status.mjs

@@ -34,25 +34,26 @@
  * became the second and third. Nothing about them changed in the move — the 166-cell
  * acceptance matrix is what licensed attempting it, `status`'s own eleven cells among them.
  *
- * WHAT NO CELL CAN REACH, and where it is gated instead. `tests/harness_golden.py`'s
- * status/version section carries the long form; the short form is that ROOT is not
+ * WHAT NO CELL CAN REACH, and where it is gated instead. The former Python matrix's
+ * status/version section carried the long form; the short form is that ROOT is not
  * redirectable across a process boundary, so three things here are unreachable from any
  * cell: `versionVerdict`'s "up to date" (needs a marker holding a fingerprint no cell can
  * know), `accentFor`'s cyan fallback (an unknown theme is refused upstream by
  * `effectiveTheme`), and the whole ANSI half of `statusLines` (`_color_enabled` is
  * `sys.stdout.isatty()`, and every harness captures stdout through a pipe). All three are
- * PURE FUNCTIONS of their arguments, so all three are gated as a corpus instead:
- * `tests/fixtures/pure_probe.mjs` calls them and `tests/snapshot/pure_snapshot.test.mjs`
- * replays that against `tests/__snapshots__/primitives/`. That was a third answer to the
- * colour question, which had been posed as a choice between shipping it ungated and not
- * shipping it.
+ * PURE FUNCTIONS of their arguments, so the former Python suite gated all three as a corpus
+ * instead — a third answer to the colour question, which had been posed as a choice between
+ * shipping it ungated and not shipping it. That corpus is gone: `tests/unit/lifecycle.test.mjs`
+ * now calls `versionVerdict` and both halves of `statusLines` directly, and nothing pins
+ * `accentFor`'s fallback.
  *
  * `manifestIsClaude` was a FOURTH until wave 2 of the P0/P1 review: it is only reached for
  * a candidate with no known host, and `ROOT/"Harness"` was ordered ahead of the sandbox's
  * own. Both ROOT-relative bundle candidates are gone from this walk and from
  * `installedDefaults`, so the only no-known-host candidate left is `cwd/"Harness"`, which
  * is inside the sandbox. It is reachable now; no cell seeds a manifest without an emit
- * marker, so it is still gated only by the corpus, and that is a gap rather than a wall.
+ * marker, so it is gated only by the direct calls in `tests/unit/claude.test.mjs`, and that is
+ * a gap rather than a wall.
  */
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import path from 'node:path';
@@ -66,19 +67,15 @@ import {
 } from '../hosts/hosts.mjs';
 // P5f moved the install DETECTORS out of this file — `diff` renders its expected copy in the
 // deployed theme and footprint, and `rebuild-all` re-emits in the deployed everything, so
-// three verbs now read them. `defaultTheme`, `manifestIsClaude` and `installedDefaults` are
-// re-exported below because `tests/fixtures/pure_probe.mjs` names this module for two of them
-// and a corpus that followed the code to its new file would stop testing the caller's view.
+// three verbs now read them.
 import {
-  defaultTheme, installedDefaults, installTargets, manifestIsClaude, readJsonMaybe, readMaybe,
+  defaultTheme, installedDefaults, installTargets, readJsonMaybe, readMaybe,
 } from '../hosts/installs.mjs';
 import { installProfile, rebuildCommand } from '../build/generate.mjs';
 import { shimDead } from '../hosts/shim.mjs';
 import { printOut } from '../lib/fs.mjs';
 import { codePointLength, padEndToWidth } from '../lib/text.mjs';
 
-export { defaultTheme, manifestIsClaude };
-
 // ---- version ---------------------------------------------------------------------------
 
 /** `_harness_status._version_verdict`. */
@@ -331,13 +328,13 @@ export function statusLines(d, color = false) {
       + `(${d.facts} fact${d.facts === 1 ? '' : 's'})`],
     ['version', `${d.installed_fp || '(none)'}  ${DOT}  source ${d.source_fp}`],
   ];
-  // ⚠ A ROW, NOT A WIDER `components` LINE, AND THE REASON IS THAT THE CORPUS CANNOT BE
-  // RE-BLESSED. `statusLines` has 30 recorded cases per platform in
-  // `tests/__snapshots__/primitives/`, every one of them holding the box's exact bytes —
-  // including `17 agents · 47 skills · 37 laws` — and the recorder was Python and is gone.
-  // Touching `components` moves all 30; adding a row would too, since the box width is
-  // measured over `rows`. So the row is CONDITIONAL on a key the recorded arguments do not
-  // carry, exactly as `agent_md` below already is, and the recording renders unchanged.
+  // ⚠ A ROW, NOT A WIDER `components` LINE. When this landed, `statusLines` had 30 recorded
+  // cases per platform in the former Python suite's corpus, every one holding the box's exact
+  // bytes — including `17 agents · 47 skills · 37 laws` — and no recorder left to re-bless them.
+  // Touching `components` would have moved all 30; adding a row would too, since the box width
+  // is measured over `rows`. So the row is CONDITIONAL on a key those arguments did not carry,
+  // exactly as `agent_md` below already is. The corpus is gone; a caller without the key still
+  // gets the box it got before.
   //
   // It carries the two tiers `components` cannot: `components` counts the invariants as
   // `laws`, which is still true, and says nothing about the ontology or the packs.

package/js/inspect/validate.mjs

@@ -149,8 +149,8 @@ export function cmdValidate(args) {
       // which ends `raise SystemExit(res.get("exit", 1))` — an INTEGER — so every refusal
       // that crosses the seam arrives here as `SystemExit(1)` and `str(e)` is `'1'`, not the
       // sentence `load_theme` wrote on stderr on the way out. A port that printed `e.message`
-      // says `unknown theme 'x'` where the reference says `1`. The corpus in
-      // `tests/test_maintainer_tools_parity.py` is what found it; nothing else could.
+      // says `unknown theme 'x'` where the reference says `1`. The former Python
+      // cross-implementation corpus is what found it; nothing else could.
       if (e && e.exitCode !== undefined) {
         printOut(`[validate-only] render/emit FAILED for theme '${args.theme}' `
           + `emit '${emit}': ${e.exitCode}\n`);

package/js/lib/fs.mjs

@@ -4,9 +4,11 @@
  * These are definitions, not an adaptation of somebody else's. Every rule below was
  * originally MEASURED against CPython, because the generator these functions serve had to
  * emit bytes indistinguishable from a Python one; that second party is gone and the rules
- * are not. What holds them now is the recorded corpora under `tests/__snapshots__/`, which
- * compare this module's output byte for byte and can never be re-recorded — so a rule here
- * is a frozen fact about what this tool emits, and changing one is a product change.
+ * are not. The recorded corpora that compared this module's output byte for byte went with
+ * the former Python suite; what holds the rules now is `tests/unit/lib_primitives.test.mjs`
+ * (`isFile`/`isDir`), `tests/unit/hook_cli.test.mjs`'s platform-newline count (the stream
+ * funnels), and for the rest only the per-function provenance below. A rule here is still a
+ * frozen fact about what this tool emits, and changing one is a product change.
  *
  * ⚠ NONE OF THESE IS THE NODE DEFAULT, AND THAT IS THE ONE THING TO KNOW BEFORE EDITING ONE.
  * Each is a deliberate divergence from the obvious one-liner, and the obvious one-liner is
@@ -107,10 +109,10 @@ export function copyFile(src, dest) {
  * its caller different BYTES than the Python one: measured at 176 vs 171 for one `context`
  * run before this existed.
  *
- * `harness_golden.py` structurally cannot see the difference — `subprocess` decodes with
- * universal newlines on the way back, folding both shapes to `\n` before any cell compares
- * them, the same shape as the shim's exclusion from `golden.py`. So the gate for it is
- * `test_the_two_entry_points_agree_on_stdout_BYTES`, which captures raw bytes. Moved here
+ * The CLI matrix structurally cannot see the difference — every cell decodes stdout with
+ * universal newlines, folding both shapes to `\n` before anything compares them. So the gate
+ * for it is `tests/unit/hook_cli.test.mjs`'s `every newline the entry points write is the
+ * platform's`, which counts raw bytes. Moved here
  * from `js/hosts/hooks.mjs` in P5c, when `js/inspect/excludes.mjs` became the second caller: a translation
  * that exists twice is a translation that can be fixed once.
  */
@@ -167,10 +169,9 @@ export function withDiscardableStderr(fn) {
  * `emitGlobalInto`.
  *
  * The item it closes: a plain `--emit files` handed its caller 104 bytes where `python
- * build.py` handed over 105, and `tests/golden.py`'s `text=True` capture folds both to the
- * same string. `test_the_two_entry_points_agree_on_stdout_BYTES` grew a `build` row (through
- * `harness build`, which calls this `main` in-process) and a `rebuild-all` row, and those are
- * what can see it.
+ * build.py` handed over 105, and a `text=True` capture folds both to the same string.
+ * `tests/unit/hook_cli.test.mjs`'s newline test carries a `build` row (through `geneseed
+ * build`, which calls this `main` in-process), and that is what can see it.
  *
  * A Buffer chunk passes through untouched: `writeText` owns file bytes and nothing on this
  * path writes binary to a stream, so translating one would be corrupting data rather than

package/js/lib/json.mjs

@@ -5,8 +5,8 @@
  * These are definitions, not an adaptation of somebody else's; see `fs.mjs` for why the
  * measurements against CPython are recorded per function, and why NONE of these is the Node
  * default — the warning the retired `py` prefix used to carry now lives in each docblock.
- * A rule here is a frozen fact about what this tool emits — the corpora under
- * `tests/__snapshots__/` compare it byte for byte and can never be re-recorded.
+ * A rule here is a frozen fact about what this tool emits — the written-out tables in
+ * `tests/unit/lib_primitives.test.mjs` and `tests/unit/settings_jsonc.test.mjs` pin it.
  *
  * `JsonNumber` is why this module holds both the parser and the renderers: the wrapper is
  * created by `parseJson` and read by `formatValue`, `formatRepr`, `isTruthy` and `deepEquals`, so the
@@ -305,8 +305,8 @@ function escapeNonAscii(text) {
  * Indentation is what makes this tractable: passing `indent` switches Python's
  * separators from `(', ', ': ')` to `(',', ': ')`, which is exactly what
  * `JSON.stringify(v, null, 2)` emits. Verified rather than argued \u2014
- * `tests/test_opencode_extras_parity.py` compares both variants against Python over a
- * corpus of container shapes.
+ * the former Python suite compared both variants against Python over a corpus of container
+ * shapes; `tests/unit/lib_primitives.test.mjs` now pins only this writer's number spellings.
  */
 export function jsonDumpsIndent(value, { ensureAscii = true } = {}) {
   const text = JSON.stringify(value, null, 2);

package/js/lib/paths.mjs

@@ -22,7 +22,7 @@ const { X_OK } = constants;
  * BMP), and `str.lower()` is not `toLowerCase()` for a handful of characters.
  *
  * THE SEPARATOR CONVERSION IS NOT OPTIONAL, and it was missing until the byte-bearing
- * corpus in `tests/test_pure_function_parity.py` asked. `ntpath.normcase` is
+ * corpus in the former Python parity suite asked. `ntpath.normcase` is
  * `s.replace('/', '\\').lower()`, and `PurePath._str_normcase` gets the same conversion for
  * free because `Path` has already done it — so BOTH readings of the reference fold slashes
  * and this did not. Every sort call site feeds it `path.join` output or a bare `readdir`
@@ -50,7 +50,7 @@ export const normcase = process.platform === 'win32'
  * a directory depth, and `golden.py` compared CONTENT rather than order. It became visible
  * the first time a full path list was PRINTED \u2014 `geneseed validate -v` \u2014 against a real
  * skills tree that happens to contain both `skills/geneseed/` and `skills/geneseed-code-review/`.
- * `tests/test_maintainer_tools_parity.py` found it and died with the reference it compared
+ * The former Python maintainer-tools test found it and died with the reference it compared
  * against. What HOLDS it now is `tests/unit/maintainer_tools.test.mjs`, and specifically its
  * `theme files are visited in THIS platform's Path collation order` test: it re-derives Python's
  * `sorted(Path)` order for the running platform instead of replaying a recording, so it cannot
@@ -73,10 +73,14 @@ export function comparePaths(a, b) {
  * `_install_move_list` in `js/maintain/uninstall.mjs` \u2014 a CLI-level module that must not import the
  * web tree to reach it. Beside `normcase`, which is the thing it is actually about.
  * `js/web/api.mjs` re-exports it so its existing importers are unchanged.
+ *
+ * TRAILING SEPARATORS ARE STRIPPED FROM `parent` FIRST. A root is the one path whose canonical
+ * spelling ends in one — `D:\` and `/` — and splitting it leaves an empty last segment that no
+ * child's segment equals, so nothing was ever `within` a drive root or `/`.
  */
 export function within(child, parent) {
   const c = normcase(child).split(/[\\/]/);
-  const p = normcase(parent).split(/[\\/]/);
+  const p = normcase(parent).replace(/[\\/]+$/, '').split(/[\\/]/);
   return p.length <= c.length && p.every((seg, i) => c[i] === seg);
 }
 
@@ -86,7 +90,7 @@ export function within(child, parent) {
  * `Path` is `WindowsPath` on Windows and `PosixPath` everywhere else, and the two parsers
  * disagree about the two things below. A body that is right on one host is therefore wrong
  * on the other, which is exactly how this one passed a whole Windows suite and failed two
- * cases on the first Linux run of `tests/test_pure_function_parity.py`:
+ * cases on the first Linux run of the former Python pure-function parity suite:
  *
  *   * SEPARATORS. `ntpath` treats `\` and `/` alike; `posixpath` treats `\` as an ordinary
  *     filename character. `str(PurePosixPath('C:\\x\\bin\\'))` is that string VERBATIM —
@@ -100,8 +104,8 @@ export function within(child, parent) {
  * NOT reproduced, and named here rather than left as a gap nobody wrote down: `//` and
  * `///x` on WINDOWS, where `PureWindowsPath` answers `\\` and `\\\x` and this answers `\`
  * and `\x`. Those are incomplete UNC prefixes and matching them needs ntpath's share-name
- * parsing; both inputs are kept OUT of the corpus in `tests/test_pure_function_parity.py`
- * instead of sitting in it wrong.
+ * parsing; both inputs were kept OUT of the retired parity corpus instead of sitting in it
+ * wrong.
  *
  * The root's separators are still rewritten ONE AT A TIME, never `replace(/[\\/]+/g, sep)`:
  * a UNC root's leading pair is part of it, so collapsing runs turns `//server/share/x` into
@@ -143,7 +147,8 @@ export function toPlatformPath(s) {
  * `context` cell varies it, and changing it in this phase would be an ungated edit to a verb
  * that crossed three phases ago. Recorded in the spec's "Still owed" with this reproduction.
  *
- * Gated by a corpus in `tests/test_pure_function_parity.py`: no cell can vary the shape.
+ * It was gated by a corpus in the retired Python pure-function parity suite; nothing has
+ * replaced it, and no CLI test can vary the shape.
  */
 export function isAbsolutePath(s) {
   if (process.platform !== 'win32') return s.startsWith('/');
@@ -166,27 +171,21 @@ export function isAbsolutePath(s) {
  * PATH-removal refutation is aimed at, and the reason this is a real lookup rather than one
  * line of "we are node, we know where node is".
  *
- * The Windows half is the part with behaviour in it, and three of its four rules were
- * MEASURED against CPython 3.13 rather than assumed. `PATHEXT` supplies the suffixes, and the
+ * The Windows half is the part with behaviour in it, and its suffix rules were MEASURED
+ * against CPython 3.13 rather than assumed. `PATHEXT` supplies the suffixes, and the
  * returned path carries PATHEXT's OWN SPELLING of the extension rather than the file's
  * (`zzcmd.CMD` for a `zzcmd.cmd` on disk). An extension already in that set means the command
- * is spelled in full. An EMPTY PATH entry is not skipped either: `join('', cmd)` is a
- * relative path, and Python answers with one.
- *
- * THE FOURTH RULE IS THE CURRENT DIRECTORY, and it was measured on a machine that could not
- * see it. `shutil.which` prepends `os.curdir` to the search — even to a `path=` given
- * explicitly — when `_winapi.NeedCurrentDirectoryForExePath` says so, and that Win32 call
- * answers TRUE unless `NoDefaultCurrentDirectoryInExePath` is DEFINED in the environment.
- * Git Bash and this repo's developer machine both define it, so the reference answered None
- * there and the first draft's "the current directory is NOT prepended — it was until 3.12"
- * described an environment variable it had mistaken for a version change. GitHub's Windows
- * runner does not define it: the reference answered `.\\geneseed.CMD` for a `geneseed` looked
- * up beside the repo root, this returned null, and the parity corpus said so on the first CI
- * run. The variable is an INPUT, so it is read here rather than baked, and
- * `test_the_curdir_rule_agrees_in_both_environment_states` runs the corpus with it both ways.
- *
- * Gated as a pure function over a seeded directory in `tests/test_pure_function_parity.py`:
- * a cell can only ever observe the one answer this machine's PATH gives.
+ * is spelled in full.
+ *
+ * THE CURRENT DIRECTORY IS NEVER SEARCHED IMPLICITLY, and here this departs from
+ * `shutil.which` on purpose. The reference prepends `os.curdir` on Windows unless
+ * `NoDefaultCurrentDirectoryInExePath` is defined, and answers an EMPTY PATH entry (a
+ * trailing `;` is routine) with a cwd-relative path. Every caller SPAWNS what this returns —
+ * `git` from `upgrade`, `java` from `setup`, `node` from the doctor, `npm` from the web server
+ * — from whatever directory the user is in, so a `git.exe` committed to an untrusted clone ran
+ * the moment `geneseed upgrade` was typed inside it. Both routes are closed; a `.` the user
+ * wrote into PATH themselves is still honoured, because that is their choice and not ours.
+ * Gated in `tests/unit/lib_primitives.test.mjs`.
  */
 export function which(cmd, searchPath = null) {
   const win = process.platform === 'win32';
@@ -209,14 +208,9 @@ export function which(cmd, searchPath = null) {
   // then spawns. Measured: the corpus case with a posix-spelled directory was the one that
   // differed, and `path.join` had rewritten the whole path rather than appending to it.
   const joinRaw = (dir, name) => (
-    dir === '' || /[\\/]$/.test(dir) || (win && dir.endsWith(':'))
+    /[\\/]$/.test(dir) || (win && dir.endsWith(':'))
       ? dir + name : dir + path.sep + name);
-  const dirs = (searchPath ?? process.env.PATH ?? '').split(path.delimiter);
-  // `NeedCurrentDirectoryForExePath(cmd)`: TRUE — so `.` goes in FRONT — unless the variable
-  // is defined. Only reachable with a separator-free `cmd`, which is the only way execution
-  // gets this far. Inserted before the dedupe, exactly where `shutil.which` inserts it, so a
-  // PATH that already names `.` is searched once.
-  if (win && process.env.NoDefaultCurrentDirectoryInExePath === undefined) dirs.unshift('.');
+  const dirs = (searchPath ?? process.env.PATH ?? '').split(path.delimiter).filter(Boolean);
   const seen = new Set();
   for (const dir of dirs) {
     const key = win ? dir.toLowerCase() : dir;

package/js/lib/proc.mjs

@@ -11,9 +11,9 @@
  * that module and six of its spawns used it, so the four spawn sites in `js/inspect/checks-authoring.mjs`,
  * `js/hosts/hooks.mjs`, `js/maintain/setup.mjs` and `js/hosts/link.mjs` each had to remember the flag on their
  * own. Two of them did not — and the miss is BYTE-INVISIBLE: a console window is not
- * something the CLI prints, so every recorded cell under `tests/__snapshots__/` stays green
- * while the windows pop. The property under test never reaches the comparison, which is why
- * a recorded corpus cannot be the gate here. A shared constant plus
+ * something the CLI prints, so every cell of `tests/golden.mjs --cli` stays green while the
+ * windows pop. The property under test never reaches the comparison, which is why a byte
+ * comparison cannot be the gate here. A shared constant plus
  * `tests/unit/spawn_hygiene.test.mjs` is what makes the next spawn site inherit the answer
  * instead of re-deciding it.
  *