geneseed 3.14.0 → 3.16.0

package/js/hosts/hosts.mjs

@@ -66,8 +66,12 @@ export function sovereignBypass(root) {
       // `withDiscardableStderr` because `expanduser` writes its refusal at the RAISE SITE
       // and this caller catches: the reference prints nothing here, so replaying the
       // message would be a stderr divergence on every hook call for one bad entry.
+      //
+      // `resolvePath`, the same resolution as `cwd` above: symlinks and junctions are followed on
+      // BOTH sides, so an entry spelled through a link matches the real directory the session
+      // stands in (and the OpenCode plugins' `norm` applies the identical rule).
       base = withDiscardableStderr(
-        () => normcase(toPlatformPath(expanduser(raw.trim()))).replace(/[\\/]+$/, ''));
+        () => normcase(resolvePath(raw.trim())).replace(/[\\/]+$/, ''));
     } catch {
       // PER ENTRY, and the loop continues. One unusable line in a file the USER hand-edits
       // must not decide the whole function — `expanduser` refuses a `~user` form, and the
@@ -208,14 +212,13 @@ export function openclaudeConfigDir() {
 }
 
 /**
- * `_build_global.HOSTS`, reduced to the two columns a non-emitting caller needs, and IN ITS
- * ORDER — opencode, claude, bob, openclaude.
+ * `_build_global.HOSTS` — one row per host, IN ITS ORDER: opencode, claude, bob, openclaude.
+ * A new host is one row here; `EMIT_HOST_SCOPE` (`js/hosts/installs.mjs`) and `CLAUDE_STYLE`
+ * below are derived from it.
  *
  * An array rather than an object because the order is observable output, not an
  * implementation detail: `harness exclude add` walks it and prints one message per host, so
- * a reordering is a diff in stderr. (`emit_global` and `native_catalog` stay out;
- * `bin/build-driver.mjs` receives those decisions from its own dispatch rather than reading a
- * table.)
+ * a reordering is a diff in stderr.
  *
  * `projectMarker` joined in P5f. `_install_targets` asks "does this cwd carry a project
  * install of host H", and `_claude_cfg` asks "which subdir holds a project install's
@@ -232,13 +235,16 @@ export function openclaudeConfigDir() {
  * `family` joined in 2026-10: `'claude'` for every host emitted through the Claude-shaped
  * engine — one manifest shape, one `settings.json` hook wiring, one strict-JSON `mcpServers`
  * config, one reversal. The list had been spelled out by hand in ten places, one of which
- * ignored the named constant right above it; a fifth host is now one row here.
+ * ignored the named constant right above it.
+ *
+ * `catalog` — does the host list every skill and agent to the model by itself? See
+ * `hostCatalogsNatively` below for what it decides and why it is split per kind.
  */
 export const HOSTS = [
-  { host: 'opencode', family: 'opencode', configDir: opencodeConfigDir, projectMarker: '.opencode', agentFile: 'AGENT.md' },
-  { host: 'claude', family: 'claude', configDir: claudeConfigDir, projectMarker: '.claude', agentFile: 'CLAUDE.md' },
-  { host: 'bob', family: 'claude', configDir: bobConfigDir, projectMarker: '.bob', agentFile: 'AGENTS.md' },
-  { host: 'openclaude', family: 'claude', configDir: openclaudeConfigDir, projectMarker: '.openclaude', agentFile: 'CLAUDE.md' },
+  { host: 'opencode', family: 'opencode', configDir: opencodeConfigDir, projectMarker: '.opencode', agentFile: 'AGENT.md', catalog: { skills: true, agents: true } },
+  { host: 'claude', family: 'claude', configDir: claudeConfigDir, projectMarker: '.claude', agentFile: 'CLAUDE.md', catalog: { skills: true, agents: true } },
+  { host: 'bob', family: 'claude', configDir: bobConfigDir, projectMarker: '.bob', agentFile: 'AGENTS.md', catalog: { skills: true, agents: false } },
+  { host: 'openclaude', family: 'claude', configDir: openclaudeConfigDir, projectMarker: '.openclaude', agentFile: 'CLAUDE.md', catalog: { skills: true, agents: true } },
 ];
 
 /** The Claude-STYLE hosts (`family: 'claude'`), in `HOSTS` order. Test with `.includes(host)`. */
@@ -248,12 +254,11 @@ export const CLAUDE_STYLE = HOSTS.filter((h) => h.family === 'claude').map((h) =
  * `_build_global.host_catalogs_natively` — does `host` list every skill and agent to the
  * model by itself?
  *
- * The third column of `HOSTS`, and the reason the docblock above no longer says
- * `native_catalog` stays out: `doctor`'s `_rendered_problems` has to know, because a host
+ * `HOSTS`' `catalog` column. `doctor`'s `_rendered_problems` has to know, because a host
  * that catalogues natively gets AGENT.md's tables collapsed to a pointer and comparing the
  * portable shape against its bundle reports AGENT.md stale on every run forever. It is a
- * column and not a set literal so that the capability is still declared in exactly one place
- * — the Python's own reason for the helper.
+ * column and not a set literal so that the capability is declared in exactly one place
+ * — the Python's own reason for the helper. The driver reads it through this function too.
  *
  * Unknown host -> false, which is the shape that KEEPS the tables. The value arrives from a
  * user-editable `.geneseed-emit` marker, so an unrecognised one must degrade to the portable
@@ -264,19 +269,12 @@ export const CLAUDE_STYLE = HOSTS.filter((h) => h.family === 'claude').map((h) =
  * single boolean was wrong both ways: `false` shipped the §4 Skills table on top of a
  * catalogue Bob already had (~1.7k tokens twice), `true` would have stripped the §3 Agents
  * table that is Bob's ONLY agent catalogue. Each CATALOG block in AGENT.md names its kind and
- * resolves against its own flag. Mirrored in
- * `bin/build-driver.mjs` (which cannot import this module's spawning neighbours).
+ * resolves against its own flag.
+ *
+ * Returns `{ skills, agents }` for a known host, `false` for an unknown one.
  */
-const NATIVE_CATALOG = {
-  opencode: { skills: true, agents: true },
-  claude: { skills: true, agents: true },
-  bob: { skills: true, agents: false },
-  openclaude: { skills: true, agents: true },
-};
-
-/** `{ skills, agents }` for a known host, `false` for an unknown one. */
 export function hostCatalogsNatively(host) {
-  return NATIVE_CATALOG[host] || false;
+  return HOSTS.find((h) => h.host === host)?.catalog || false;
 }
 
 /** `_harness_learn.MEMORY_DIR_NAMES` — the neutral name and the imperial theme's. */

package/js/hosts/installs.mjs

@@ -35,7 +35,7 @@
 import { existsSync, readdirSync } from 'node:fs';
 import path from 'node:path';
 
-import { CONFIG, PACK_ORDER, THEMES, discoverNames } from '../build/source.mjs';
+import { CONFIG, PACK_ORDER, THEMES, discoverNames, knownSkillIds } from '../build/source.mjs';
 import { CLAUDE_STYLE, GLOBAL_MANIFEST, HOSTS, resolvePath } from './hosts.mjs';
 import { registryRoots } from '../inspect/registry.mjs';
 import { printErr, readText, isFile, isDir } from '../lib/fs.mjs';
@@ -107,8 +107,8 @@ export const defaultMode = () => configuredDefault('mode', 'direct');
  * `_build_render.theme_files` — shipped themes, `_`-prefixed scaffolds excluded.
  *
  * `dir` defaults to the checkout's own `themes/`, which is every caller but one: P2's
- * `syncThemes` is driven over a FIXTURE directory by the cross-implementation corpus in
- * `tests/test_maintainer_tools_parity.py`, because the tool it belongs to rewrites committed
+ * `syncThemes` is driven over a FIXTURE directory by the corpus in
+ * `tests/unit/maintainer_tools.test.mjs`, because the tool it belongs to rewrites committed
  * files and cannot be gated against the real ones. A parameter, not a second enumeration —
  * a scaffold mistaken for a theme is exactly what this function exists to prevent, once.
  *
@@ -162,12 +162,26 @@ function firstCarrier(d, probe, fallback = null) {
   return fallback;
 }
 
-/** `_harness_setup._theme_of_dir` — the marker, else the sigil in one of five carriers. */
+/**
+ * A marker value that can only name a file directly in the themes dir: no separator, no `..`,
+ * and not a `_`-prefixed scaffold.
+ */
+const THEME_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+
+/**
+ * `_harness_setup._theme_of_dir` — the marker, else the sigil in one of five carriers.
+ *
+ * The marker's value becomes `<themes>/<name>.json` in `loadTheme`, so a path in it
+ * (`../harness.config`) loaded any `.json` as a theme. A value that is not a plain name falls
+ * through to the sigil scan, as a missing marker does. A plain name that is not shipped is
+ * still RETURNED: `loadTheme` then refuses it loudly, which `status`/`rebuild-all`/`migrate`
+ * cells pin ("unknown theme 'nosuchtheme'"), rather than a typo going unnoticed.
+ */
 export function themeOfDir(d) {
   const marker = path.join(d, '.geneseed-theme');
   if (isFile(marker)) {
     const name = (readMaybe(marker) ?? '').trim();
-    if (name) return name;
+    if (THEME_NAME_RE.test(name)) return name;
   }
   return firstCarrier(d, (carrierPath) => themeFromAgent(carrierPath) || undefined);
 }
@@ -210,7 +224,7 @@ export function footprintOfDir(d) {
  * the string, so a posture file named `Foreman` renders `**Foreman**` and one named `FOREMAN`
  * would be scanned for as `**Foreman**` by both implementations only if this reproduces the
  * lowercasing. Every shipped name is already lowercase, which is exactly why the difference
- * would go unnoticed — the corpus in `tests/test_pure_function_parity.py` is what covers it.
+ * would go unnoticed — the former Python corpus covered it, and no test drives it now.
  */
 export function capitalize(s) {
   return s.length ? s[0].toUpperCase() + s.slice(1).toLowerCase() : s;
@@ -239,10 +253,15 @@ export const modeOfDir = (d) => leadOfDir(d, discoverNames('modes', 'direct'));
  * `Default trust preset: **<Label>**` line, and this scans the places an emit lands it: the
  * native layer (`skills/loop/SKILL.md`, in the root itself for a global install and under the
  * host's `projectMarker` for a project one) and the plain bundle (`skills/loop.md`).
+ *
+ * `host` narrows the project dirs to that host's own: in a repo carrying `.opencode/` AND
+ * `.claude/`, the Claude row otherwise read OpenCode's preset, since OpenCode comes first in
+ * `HOSTS`. Without it every host's dir is tried, in `HOSTS` order — the caller that has no host.
  */
 const TRUST_RE = /^Default trust preset: \*\*(Prudent|Balanced|Aggressive)\*\*/m;
-export function trustOfDir(d) {
-  for (const base of ['', ...HOSTS.map((h) => h.projectMarker)]) {
+export function trustOfDir(d, host = null) {
+  const rows = host === null ? HOSTS : HOSTS.filter((h) => h.host === host);
+  for (const base of ['', ...rows.map((h) => h.projectMarker)]) {
     for (const rel of [['skills', 'loop', 'SKILL.md'], ['skills', 'loop.md']]) {
       const m = TRUST_RE.exec(readMaybe(path.join(d, base, ...rel)) ?? '');
       if (m) return m[1].toLowerCase();
@@ -389,6 +408,28 @@ export function excludedRulesOfDir(d) {
   }, []);
 }
 
+/** `Excluded skills: bruno-test-writer, daydream` — written only when something is excluded. */
+const EXCLUDED_SKILLS_RE = /^Excluded skills:[ \t]*(.+?)[ \t]*$/m;
+
+/**
+ * The skills a DEPLOYED install left out, read back so `upgrade`, `rebuild-all` and `diff`
+ * re-render the same set. Same semantics as `excludedRulesOfDir`: a missing line is `[]`
+ * (nothing excluded), and a name this checkout does not ship condemns the whole line to `[]`
+ * — re-admitting a skill is the safe direction, and the flag would refuse the name anyway.
+ */
+export function excludedSkillsOfDir(d) {
+  return firstCarrier(d, (carrierPath) => {
+    const text = readMaybe(carrierPath);
+    if (text === null) return undefined;
+    const m = EXCLUDED_SKILLS_RE.exec(text);
+    if (!m) return undefined;
+    const names = m[1].split(',').map((s) => s.trim()).filter(Boolean);
+    const known = knownSkillIds();
+    if (!names.every((n) => known.includes(n))) return [];
+    return [...new Set(names)].sort();
+  }, []);
+}
+
 // ---- what host a deployed dir belongs to (`_harness_mcp`) ---------------------------------
 
 /** `_harness_mcp._claude_read_manifest`. */
@@ -406,13 +447,13 @@ export function manifestIsClaude(cfgDir) {
   return isDict(claudeReadManifest(cfgDir).managed);
 }
 
-/** `_harness_mcp._EMIT_HOST_SCOPE` — a marker's emit name fixes (host, scope). */
-export const EMIT_HOST_SCOPE = new Map([
-  ['opencode', ['opencode', 'project']], ['opencode-global', ['opencode', 'global']],
-  ['claude', ['claude', 'project']], ['claude-global', ['claude', 'global']],
-  ['bob', ['bob', 'project']], ['bob-global', ['bob', 'global']],
-  ['openclaude', ['openclaude', 'project']], ['openclaude-global', ['openclaude', 'global']],
-]);
+/**
+ * `_harness_mcp._EMIT_HOST_SCOPE` — a marker's emit name fixes (host, scope). Derived from
+ * `HOSTS`, whose emit names are `<host>` and `<host>-global`, so a new host is one row there.
+ */
+export const EMIT_HOST_SCOPE = new Map(HOSTS.flatMap(({ host }) => [
+  [host, [host, 'project']], [`${host}-global`, [host, 'global']],
+]));
 
 /** `_harness_mcp._emit_host_scope_of` — `root`'s own marker, resolved, or null. */
 export function emitHostScopeOf(root) {
@@ -535,7 +576,7 @@ export function installTargets() {
 export function installedDefaults() {
   const found = {
     theme: null, posture: null, mode: null, emit: null, footprint: null, doctrines: null,
-    excludeRules: null,
+    excludeRules: null, excludeSkills: null,
   };
   const candidates = [];
   for (const { host, configDir } of HOSTS) {
@@ -577,6 +618,7 @@ export function installedDefaults() {
     // pre-selects. The cost of that choice is that "excludes nothing" and "no carrier" are
     // indistinguishable here, which is exactly what the marker itself already says.
     if (!found.excludeRules?.length) found.excludeRules = excludedRulesOfDir(base);
+    if (!found.excludeSkills?.length) found.excludeSkills = excludedSkillsOfDir(base);
   }
   return found;
 }

package/js/hosts/link.mjs

@@ -57,8 +57,8 @@
  * never needs to:
  *
  *   * `winUserPathScript` is PURE — the escaping, the split and the idempotence live there
- *     and `tests/test_win_user_path.py` runs it over a corpus (apostrophes, trailing
- *     separators, UNC roots) against the Python twin, byte for byte.
+ *     and `tests/unit/win_user_path.test.mjs` runs it over a corpus of hazards (apostrophes,
+ *     typographic quotes, trailing separators, UNC roots) and asserts each property absolutely.
  *   * `cmdLink` SHORT-CIRCUITS when the bin dir is already on `PATH`, so a cell that seeds
  *     `PATH` with its own sandboxed bin dir exercises the whole verb and never spawns.
  *   * `cmdUnlink` has no such short-circuit, so its cells seed a `PATH` with no `powershell`
@@ -81,9 +81,11 @@ import os from 'node:os';
 import { ROOT } from '../build/source.mjs';
 import { readMaybe } from './installs.mjs';
 import { printOut, printErr, writeText } from '../lib/fs.mjs';
-import { toPlatformPath } from '../lib/paths.mjs';
+import { toPlatformPath, which } from '../lib/paths.mjs';
 
 const IS_WIN = process.platform === 'win32';
+/** What `cmdUnlink` recognises a written Unix launcher by — see `isOurLauncher`. */
+const SHIM_MARKER = 'GENESEED_LINK_SHIM';
 
 /** `_harness_lifecycle._win_bin_dir`. */
 function winBinDir() {
@@ -97,12 +99,18 @@ function winBinDir() {
  * `_harness_lifecycle._win_user_path_script` — the PowerShell one-liner, built but not run.
  *
  * Every quoting hazard in this verb is in this string, which is why it is a separate
- * function on both sides: `''` is PowerShell's single-quote escape, the `;` split drops
+ * function: `''` is PowerShell's single-quote escape, the `;` split drops
  * empty segments so a trailing separator cannot append an empty entry, and `-notcontains`
  * is what makes `link` idempotent.
+ *
+ * THE ESCAPE COVERS FIVE CHARACTERS, NOT ONE. PowerShell also reads the typographic quotes
+ * U+2018–U+201B as single quotes, so one of them left bare in a directory name closes the
+ * string exactly as `'` does and turns the rest of the path into code. Each is doubled with
+ * ITSELF — `‘‘` is the escape for `‘` — which is what PowerShell's own `CodeGeneration.
+ * EscapeSingleQuotedStringContent` does.
  */
 export function winUserPathScript(action, directory) {
-  const d = directory.replaceAll("'", "''");   // PS single-quote escape (O'Brien)
+  const d = directory.replace(/['‘-‛]/g, '$&$&');   // PS single-quote escape (O'Brien)
   if (action === 'add') {
     return `$d='${d}';`
       + "$p=[Environment]::GetEnvironmentVariable('Path','User');"
@@ -134,13 +142,56 @@ export function winUserPathScript(action, directory) {
  * false rather than crashing the verb.
  */
 function winUserPath(action, directory) {
-  const r = spawnSync('powershell',
+  // `which`, never a bare name: Windows resolves a bare name against the cwd first, and
+  // `which` never searches the cwd implicitly (see its docblock).
+  const ps = which('powershell');
+  if (!ps) return false;
+  const r = spawnSync(ps,
     ['-NoProfile', '-Command', winUserPathScript(action, directory)],
     { stdio: 'inherit', windowsHide: true });
   if (r.error) return false;
   return r.status === 0;
 }
 
+/**
+ * Is `dir` one of the ENTRIES of a Windows PATH string?
+ *
+ * Entry-wise, not a substring test: `…\Geneseed\bin` is a substring of `…\Geneseed\bin2` and of
+ * `…\Geneseed\bin\old`, and a substring hit skipped the registry write while the shim's own dir
+ * stayed off PATH. Trailing separators and case are both noise on Windows.
+ */
+export function winPathHas(pathEnv, dir) {
+  const norm = (s) => s.replace(/[\\/]+$/, '').toLowerCase();
+  const want = norm(dir);
+  return pathEnv.split(';').some((e) => e && norm(e) === want);
+}
+
+/**
+ * The Unix launcher's text. Single-quoted, never double: inside `"…"` the shell still expands
+ * `$`, backticks and `\`, so an install path holding any of them ran as code each time
+ * `geneseed` started. `'\''` is the one escape single quotes need.
+ */
+export function unixShimText(exe, entry) {
+  const q = (s) => `'${s.replaceAll("'", "'\\''")}'`;
+  return `#!/bin/sh\n# ${SHIM_MARKER}\nexec ${q(exe)} ${q(entry)} "$@"\n`;
+}
+
+/**
+ * Is the file at `f` a launcher `geneseed link` made? Two shapes exist on disk. (a) A symlink,
+ * judged by `os.readlink(f)` raw, then `.name` — NOT a resolved path: the question is whether
+ * the link's own target BASENAME is `geneseed`, so a symlink pointing at some other program
+ * that happens to sit in a `geneseed` directory is left alone. That is every install made
+ * before the shim. (b) A regular file carrying the marker — never "any regular file called
+ * geneseed", which would be npm's own bin link or a stranger's program.
+ *
+ * ONE OWNER FOR BOTH VERBS. `unlink` always refused what is not ours; `link` used to delete
+ * whatever sat at its destination before writing, so the two disagreed about the same file.
+ */
+function isOurLauncher(f) {
+  if (isSymlink(f)) return path.basename(readlinkSync(f)) === 'geneseed';
+  return existsSync(f) && (readMaybe(f) ?? '').includes(SHIM_MARKER);
+}
+
 /** `_harness_lifecycle.cmd_link` — put `geneseed` on PATH so it runs from any directory. */
 export function cmdLink(args) {
   const here = ROOT;
@@ -159,8 +210,7 @@ export function cmdLink(args) {
       return 1;
     }
     printOut(`geneseed: wrote shim ${shim}\n`);
-    const on_path = (process.env.PATH || '').toLowerCase().includes(bindir.toLowerCase());
-    if (on_path || winUserPath('add', bindir)) {
+    if (winPathHas(process.env.PATH || '', bindir) || winUserPath('add', bindir)) {
       printOut(`geneseed: '${bindir}' is on your user PATH — open a NEW terminal, then run \`geneseed\`.\n`);
     } else {
       printOut(`geneseed: add '${bindir}' to your PATH manually, then run \`geneseed\` from anywhere.\n`);
@@ -174,8 +224,8 @@ export function cmdLink(args) {
   // PATH=` line) as well as comparing it against `PATH.split(os.pathsep)`, so an argument
   // that is not already normalised diverges in three places at once. A trailing slash is the
   // cheapest one: `str(Path('/x/bin/'))` is `/x/bin` and the raw string is not.
-  // `harness_golden`'s `link/an-explicit-dir-argument-is-used-instead-of-the-default` passes
-  // one, and it is the cell that found this.
+  // The retired cell `link/an-explicit-dir-argument-is-used-instead-of-the-default` passed
+  // one, and it is what found this.
   let targetDir = args.dir ? toPlatformPath(args.dir) : null;
   if (targetDir === null) {
     const local = path.join(os.homedir(), '.local', 'bin');
@@ -191,16 +241,23 @@ export function cmdLink(args) {
   try {
     mkdirSync(targetDir, { recursive: true });
     // `dest.is_symlink() or dest.exists()` — the first half is what catches a BROKEN
-    // symlink, which `existsSync` follows and reports absent.
-    if (isSymlink(dest) || existsSync(dest)) rmSync(dest, { force: true });
+    // symlink, which `existsSync` follows and reports absent. Only OUR launcher is replaced:
+    // anything else there — npm's own bin link, a stranger's program — is refused, the same
+    // judgement `cmdUnlink` makes about the same file.
+    if (isSymlink(dest) || existsSync(dest)) {
+      if (!isOurLauncher(dest)) {
+        printErr(`geneseed: ${dest} exists and is not a launcher geneseed wrote — leaving it `
+          + 'alone. Remove it yourself, or pick another dir: geneseed link <dir>\n');
+        return 1;
+      }
+      rmSync(dest, { force: true });
+    }
     // A WRITTEN SHIM, not a symlink to `ROOT/geneseed`. The bash launcher execs a Python
     // interpreter, so symlinking it puts Python on PATH from the Node verb. The Windows
-    // arm above has always written a shim; this is the same shape. `GENESEED_LINK_SHIM`
-    // is the marker `cmdUnlink` recognises — without it, unlink cannot tell our file from
+    // arm above has always written a shim; this is the same shape. `SHIM_MARKER`
+    // is what `cmdUnlink` recognises — without it, unlink cannot tell our file from
     // a stranger's and would have to refuse every regular file, which is a no-op.
-    writeText(dest, '#!/bin/sh\n'
-      + '# GENESEED_LINK_SHIM\n'
-      + `exec "${process.execPath}" "${entry}" "$@"\n`);
+    writeText(dest, unixShimText(process.execPath, entry));
     chmodSync(dest, 0o755);
   } catch (e) {
     printErr(`geneseed: could not write ${dest} (${asOsError(e)}) — pick a writable dir: `
@@ -246,15 +303,7 @@ export function cmdUnlink() {
     if (seen.has(d)) continue;
     seen.add(d);
     const f = path.join(d, 'geneseed');
-    // TWO shapes, because two shapes exist on disk. (a) `os.readlink(f)` raw, then `.name`
-    // — NOT a resolved path: the reference asks whether the link's own target BASENAME is
-    // `geneseed`, so a symlink pointing at some other program that happens to sit in a
-    // `geneseed` directory is left alone. That is every install made before the shim.
-    // (b) a regular file we wrote, identified by its marker — never "any regular file
-    // called geneseed", which would delete a stranger's program.
-    const ours = (isSymlink(f) && path.basename(readlinkSync(f)) === 'geneseed')
-      || (!isSymlink(f) && existsSync(f) && (readMaybe(f) ?? '').includes('GENESEED_LINK_SHIM'));
-    if (ours) {
+    if (isOurLauncher(f)) {
       try {
         rmSync(f);
         printOut(`geneseed: removed ${f}\n`);

package/js/hosts/memory-files.mjs

@@ -74,18 +74,25 @@ function globMd(dir) {
     && isFile(path.join(dir, n)));
 }
 
+/** Stems that name the store's own files, never a fact — `MEMORY` is the index itself. */
+const RESERVED_STEMS = new Set(['memory', 'readme']);
+
 /** `_existing_slugs` — slugs already stored, so learn never re-emits a known fact. */
 export function existingSlugs(memDir) {
-  const skip = new Set(['memory', 'readme']);
-  return new Set(globMd(memDir).map(stem).filter((s) => !skip.has(s.toLowerCase())));
+  return new Set(globMd(memDir).map(stem).filter((s) => !RESERVED_STEMS.has(s.toLowerCase())));
 }
 
 /**
  * `_write_memories` — split the model output into files, write each NEW one, and append a
  * pointer line to MEMORY.md. `existing` is MUTATED, so a reply carrying the same slug
  * twice writes it once.
+ *
+ * A reserved stem is refused (`name: MEMORY` would overwrite the index), and names compare
+ * LOWERCASE: on Windows and macOS `User-Prefs.md` and `user-prefs.md` are one file, so a
+ * case variant of a stored slug would overwrite it.
  */
 export function writeMemories(modelOutput, memDir, existing) {
+  const taken = new Set([...existing].map((s) => s.toLowerCase()));
   const written = [];
   const indexLines = [];
   for (let chunk of modelOutput.split(FILE_SEP_RE)) {
@@ -93,9 +100,11 @@ export function writeMemories(modelOutput, memDir, existing) {
     if (!chunk || chunk.toUpperCase() === 'NOTHING') continue;
     const [fm] = frontmatter(chunk);
     const name = fmGet(fm, 'name').trim();
-    if (!MEMORY_SLUG_RE.test(name) || existing.has(name)) continue;
+    const key = name.toLowerCase();
+    if (!MEMORY_SLUG_RE.test(name) || RESERVED_STEMS.has(key) || taken.has(key)) continue;
     writeText(path.join(memDir, `${name}.md`), `${chunk.replace(/\n+$/, '')}\n`);
     existing.add(name);
+    taken.add(key);
     written.push(name);
     const desc = fmGet(fm, 'description').trim();
     indexLines.push(`- [${name}](${name}.md)${desc ? ` \u2014 ${desc}` : ''}`);
@@ -147,7 +156,7 @@ export function memoryDropIndex(memDir, name) {
  * the user's to keep).
  */
 export function consolidateMemory(memDir) {
-  const skip = new Set(['memory', 'readme']);
+  const skip = RESERVED_STEMS;
   const facts = new Map();
   for (const name of sortPaths(globMd(memDir))) {
     const s = stem(name);