geneseed 3.14.0 → 3.16.0

package/js/maintain/setup.mjs

@@ -31,17 +31,17 @@
  * and a cell's stdin is a pipe. So the whole wizard is unreachable from the acceptance
  * matrix in the same way `_confirm` was in P5h — except that here it is not one branch, it
  * is the verb. The `setup/*` cells therefore gate the REFUSAL, absolutely and on both sides,
- * and everything past it is gated as a CORPUS in `tests/test_pure_function_parity.py`.
+ * and everything past it is gated as a CORPUS in `tests/unit/wizard.test.mjs`.
  *
  * The corpus is a new shape and the brief predicted the reason: a corpus over a stdin reader
- * needs a SEEDED FD, not a string. `tests/fixtures/pure_probe.{py,mjs}` are run with stdin
- * redirected from a file of answers and their WHOLE stdout compared — so the prompts, the
+ * needs a SEEDED FD, not a string. `tests/fixtures/pure_probe.mjs` is run with stdin
+ * redirected from a file of answers and its WHOLE stdout compared — so the prompts, the
  * numbered menus, the default markers, the `About to run:` line and the returned selection
  * are all one byte comparison. That is a stricter gate than a cell would have been, because
  * a cell could not have varied the answers at all.
  */
 import { spawnSync } from 'node:child_process';
-import { existsSync, readSync } from 'node:fs';
+import { existsSync } from 'node:fs';
 import path from 'node:path';
 
 import { main as driverMain, resolveOut } from '../build/driver.mjs';
@@ -57,132 +57,10 @@ import {
 } from '../hosts/installs.mjs';
 import { printOut, printErr } from '../lib/fs.mjs';
 import { which } from '../lib/paths.mjs';
+import { ask, askChoice, confirm } from '../lib/prompt.mjs';
 import { parseIntStrict } from '../lib/text.mjs';
 import { NO_WINDOW } from '../lib/proc.mjs';
 
-// --------------------------------------------------------------------------------------
-// the three readers
-// --------------------------------------------------------------------------------------
-
-/**
- * `_harness_setup._ask` — `input(f"{prompt}{suffix}: ").strip()`, or the default at EOF.
- *
- * WHY IT READS A BYTE AT A TIME. Node has no synchronous line read: `readFileSync(0)` blocks
- * until EOF rather than until Enter, so a wizard built on it would hang on a real terminal
- * until the user pressed Ctrl-D. Reading fd 0 one byte at a time to the first `\n` is what
- * `input()` does, and it is the only synchronous shape that stops where Enter stops. The
- * body arrived in P5h inside `js/maintain/uninstall.mjs`'s `confirm`; `setup` is the second caller,
- * so it moved to where the Python's own owner is — `_harness_setup` — and `confirm` is built
- * on it here exactly as `_confirm` is built on `_ask` there.
- *
- * The EOF branch is the one a piped caller sees, and it agrees with Python by two different
- * routes that happen to produce one answer: `input()` RAISES `EOFError` and the `except`
- * returns the default, while a zero-length read here leaves `line` empty and `|| dflt` does
- * the same. A partial line with no trailing newline is not EOF to either — Python returns
- * the characters and so does this.
- *
- * `.trim()` is `str.strip()` in every case but U+FEFF, which JS counts as whitespace and
- * Python does not; that is a standing item of this port and not this function's to settle.
- */
-export function ask(prompt, dflt = '') {
-  const suffix = dflt ? ` [${dflt}]` : '';
-  // `input()` writes its prompt to stdout with no newline — nothing for `printOut` to
-  // translate, and it must NOT gain one.
-  process.stdout.write(`${prompt}${suffix}: `);
-  // `?? ''` because `readLine` reports EOF-with-nothing-read as null since P6h; `_ask`
-  // catches `EOFError` and returns the default, which is what the empty string produces
-  // here through `|| dflt`. The two routes to one answer are the docblock's own point.
-  const ans = (readLine() ?? '').trim();
-  return ans || dflt;
-}
-
-/**
- * `input(prompt)` with EOF told apart from an empty line — `null` where Python RAISES.
- *
- * `ask` above cannot express that difference and does not need to: its EOF and its empty
- * answer both mean "take the default". `_web_server.serve`'s npm prompt is the first
- * caller where they differ, and they differ dangerously — `""` is in its accepted set, so
- * a port that read EOF as an empty line would answer YES to "run npm install now?" on
- * every non-interactive run. The reference catches `(EOFError, KeyboardInterrupt)` and
- * answers "n"; this returns null so the caller can.
- *
- * No `.trim()`: `input()` does not strip, and both callers strip for themselves.
- */
-export function promptLine(prompt) {
-  process.stdout.write(prompt);
-  return readLine();
-}
-
-/**
- * Fd 0 to the first `\n`, dropping a `\r` before it — the CRLF a Windows console sends.
- *
- * THE BYTES ARE COLLECTED AND DECODED ONCE, and that is a fix rather than a style. The
- * version this arrived as decoded EACH BYTE on its own — `buf.toString('utf8', 0, n)` inside
- * the loop — which turns every multi-byte character into two or three U+FFFD. It was
- * invisible for a phase because its only caller was `confirm`, whose answer is `y` or `n`;
- * the wizard's first non-ASCII answer is what exposed it, and the corpus caught it on the
- * first run. Scanning for the terminators a byte at a time is still correct: `\n` and `\r`
- * are ASCII, and no continuation byte of a UTF-8 sequence is below 0x80.
- */
-function readLine() {
-  const buf = Buffer.alloc(1);
-  const bytes = [];
-  let eof = false;
-  for (;;) {
-    let n = 0;
-    try { n = readSync(0, buf, 0, 1, null); } catch { eof = true; break; }
-    if (n === 0) { eof = true; break; }
-    if (buf[0] === 0x0a) break;
-    if (buf[0] !== 0x0d) bytes.push(buf[0]);
-  }
-  // NULL ONLY FOR THE EMPTY EOF, which is the one case `input()` raises on. A partial line
-  // with no trailing newline is not EOF to Python — it returns the characters — and the
-  // `bytes.length` test is what keeps that arm returning a string here too.
-  if (eof && bytes.length === 0) return null;
-  return Buffer.from(bytes).toString('utf8');
-}
-
-/** `_harness_setup._confirm` — `_ask` with a Y/n suffix; the default on an empty answer. */
-export function confirm(prompt, dflt = true) {
-  const ans = ask(`${prompt} (${dflt ? 'Y/n' : 'y/N'})`).toLowerCase();
-  return ans === '' ? dflt : ans[0] === 'y';
-}
-
-/**
- * `_harness_setup._ask_choice` — a numbered menu; the chosen KEY, or the default.
- *
- * THREE THINGS ABOUT THE FALLBACK ORDER, all of them observable and none of them obvious:
- *
- *   * The key match lives in Python's `except ValueError`, so an answer that PARSES as an
- *     integer never reaches it. `99` against a five-option menu returns the default; it does
- *     not go looking for an option literally named `99`.
- *   * An in-range index wins, a parsed out-of-range index falls to the default, and only an
- *     UNPARSEABLE answer is matched against the keys. `parseIntStrict` is what separates the second
- *     case from the third, and it is not `Number()` — see its own docblock.
- *   * The default's index is computed with `next(...)` and no fallback, so a default that is
- *     not in `options` raises `StopIteration` on the reference. That is reachable (a
- *     deployed install can carry a theme this checkout no longer ships) and it is mirrored
- *     as a throw rather than smoothed over: the two implementations must fail in the same
- *     place, and a silent `-1` here would be a divergence dressed as robustness.
- */
-export function askChoice(prompt, options, dflt) {
-  printOut(`\n${prompt}:\n`);
-  options.forEach(([key, desc], i) => {
-    const label = desc ? `${key} — ${desc}` : key;
-    printOut(`  ${i + 1}) ${label}${key === dflt ? '   (default)' : ''}\n`);
-  });
-  const defaultIdx = options.findIndex(([k]) => k === dflt);
-  if (defaultIdx < 0) throw new Error(`StopIteration: no option named ${dflt}`);
-  const raw = ask('Choose', String(defaultIdx + 1));
-  const idx = parseIntStrict(raw);
-  if (idx !== null) {
-    if (idx >= 1 && idx <= options.length) return options[idx - 1][0];
-  } else {
-    for (const [key] of options) if (raw === key) return key;
-  }
-  return dflt;
-}
-
 // --------------------------------------------------------------------------------------
 // the option tables
 // --------------------------------------------------------------------------------------
@@ -372,7 +250,7 @@ export function collectSetupLines() {
   const mode = askChoice('Mode', modeOptions(), inst.mode || defaultMode());
   const doctrines = askDoctrines(inst.doctrines);
   const emit = askChoice('Install mode', EMIT_OPTIONS, inst.emit || 'opencode-global');
-  const footprint = askChoice('Footprint', FOOTPRINT_OPTIONS.map(([k, d]) => [k, d]),
+  const footprint = askChoice('Footprint', FOOTPRINT_OPTIONS,
     inst.footprint || 'lean');
   let out = null;
   let root = null;
@@ -399,11 +277,18 @@ export function collectSetupLines() {
   // `setupBuildArgs` spell `--exclude-rules none`, and that string would land in the
   // "About to run:" line every recorded wizard probe compares byte for byte.
   const excludeRules = inst.excludeRules?.length ? inst.excludeRules : null;
+  // Skills left out are preserved the same way, and elide when there are none.
+  const excludeSkills = inst.excludeSkills?.length ? inst.excludeSkills : null;
   printOut(`\nAbout to run:  geneseed build ${
     setupBuildArgs(theme, emit, out, root, footprint, posture, mode, doctrines, allPacks,
-      excludeRules).join(' ')}\n`);
+      excludeRules, undefined, excludeSkills).join(' ')}\n`);
   if (!confirm('Proceed?', true)) return null;
-  return { theme, posture, mode, doctrines, excludeRules, emit, out, root, footprint };
+  // The key only when there is something to carry, so a selection that excludes no skill is
+  // the same object it was before the flag existed.
+  return {
+    theme, posture, mode, doctrines, excludeRules, ...(excludeSkills ? { excludeSkills } : {}),
+    emit, out, root, footprint,
+  };
 }
 
 // --------------------------------------------------------------------------------------
@@ -430,8 +315,8 @@ export function javaMajorOk(versionOutput, minimum = 21) {
  * `_harness_setup._lsp_prereqs` — `(label, present, hint)` for what OpenCode cannot install
  * for itself. Today that is a JDK 21+ for `jdtls`; the JS-runtime servers self-download.
  *
- * THE SECOND SPAWN ON THIS ENTRY POINT, and the reason `test_the_cli_reaches_child_process_\
- * only_where_it_is_declared` became a TABLE. `js/inspect/doctor.mjs` was the sole allowed importer
+ * THE SECOND SPAWN ON THIS ENTRY POINT, and the reason `ALLOWED_SPAWNS` in
+ * `tests/unit/hook_cli.test.mjs` became a TABLE. `js/inspect/doctor.mjs` was the sole allowed importer
  * for one binding and one argv; this is the second, and the port's rule is that the second
  * instance of anything turns a special case into a table cross-checked against the source.
  * The argv is asserted literally there, so an allow-list entry cannot be reused to start an
@@ -572,7 +457,7 @@ export function setupSummaryLines(theme, emit, out, root, ok) {
  * command the reader can type, and names one that survives the deletion.
  *
  * `theme_anim.play_line` USED TO BE THE SECOND, and P7c crossed it — `js/ui/anim.mjs`, gated by
- * `_theme_anim_cases()` in `tests/test_pure_function_parity.py`. The bare `catch` around it
+ * the theme-animation jobs in `tests/unit/wizard.test.mjs`. The bare `catch` around it
  * is the reference's own, labelled there "cosmetic only — never block a successful install",
  * and it is kept for the same reason: the animation runs AFTER the build has already
  * succeeded, so nothing it can do may change the exit code.
@@ -585,7 +470,7 @@ export function setupLines() {
   }
   const {
     theme, emit, out, root, footprint = 'lean', posture = 'peer', mode = 'direct',
-    doctrines = null, excludeRules = null,
+    doctrines = null, excludeRules = null, excludeSkills = null,
   } = sel;
   if (emit === 'opencode-global') {
     // The build below overwrites the deployed global harness, and the self-improvement loops
@@ -604,7 +489,7 @@ export function setupLines() {
   // runs must carry the pack selection the plan line just previewed, or the wizard would print
   // one command and run another.
   const argv = setupBuildArgs(theme, emit, out, root, footprint, posture, mode, doctrines,
-    doctrineOptions().map(([n]) => n), excludeRules);
+    doctrineOptions().map(([n]) => n), excludeRules, undefined, excludeSkills);
   printOut(`Running:  geneseed build ${argv.join(' ')}\n`);
   const rc = driverMain(argv);
   if (rc !== 0) {

package/js/maintain/uninstall.mjs

@@ -17,9 +17,9 @@
  * 2. AN EMPTY DIRECTORY WAS INVISIBLE TO EVERY CELL. The ancestor-climb prune is a quarter of
  *    this verb and `_snapshot` could not see it: a port that unlinked the files and left
  *    `skills/<name>/` behind was byte-identical everywhere. Closed by a `<dirs>` column in
- *    `tests/harness_golden.py`'s snapshot rather than a per-cell expectation, because one
- *    entry closes it for all 219 cells written before it existed — `cmdTheme`'s statement
- *    order sat in the same hole. The ABSOLUTE half is a different axis and is the sixth
+ *    the CLI matrix's snapshot (`tests/helpers/cli_golden.mjs`) rather than a per-cell
+ *    expectation, because one entry closes it for all 219 cells written before it existed —
+ *    `cmdTheme`'s statement order sat in the same hole. The ABSOLUTE half is a different axis and is the sixth
  *    expectation kind, `expect_absent_files`.
  * 3. `--archive-memory` TOUCHES THE MEMORY STORE, the one thing here a user cannot rebuild.
  *    It is why `_archive_store` MOVES and never deletes, and why the Python's `memory=delete`
@@ -48,7 +48,7 @@ import {
 import path from 'node:path';
 
 import { hookRunnerEntry } from '../hosts/shim.mjs';
-import { confirm } from './setup.mjs';
+import { confirm } from '../lib/prompt.mjs';
 import {
   claudeCfg, claudeReadManifest, doctrinesOfDir, emitHostScopeOf, excludedRulesOfDir, installKind,
   installState,
@@ -374,7 +374,7 @@ export function installAgentEntry(root, kind) {
  * A cell can only ever observe the entries a seeded `opencode.json` holds, and the shape
  * that separates the two `is_absolute` rules is a Windows ROOTLESS path — which a cell CAN
  * seed but whose answer then only differs on one platform, in one branch, with no other
- * observable effect. `tests/test_pure_function_parity.py` drives the list directly.
+ * observable effect. The former Python corpus drove the list directly; nothing does now.
  */
 export function installAgentEntryOf(instr) {
   if (Array.isArray(instr)) {
@@ -732,9 +732,10 @@ export function cmdUninstall(args) {
 // ALL-OR-NOTHING IS THE PROPERTY, and it is the one a port breaks silently. A move that fails
 // puts every earlier move back and reports, leaving the install fully `active`; a port that
 // merely stopped on the failure would leave a half-gutted config dir that neither state
-// answers for. `tests/web_golden.py`'s `install/a-deactivate-whose-second-move-collides…`
-// drives it: a manifest naming a file AND its parent directory is the only shape a seeded
-// world can use to make the SECOND move collide.
+// answers for. `tests/unit/web_api.test.mjs`'s `deactivate rolls back on a failed move`
+// drives it with a file planted where the stash dir belongs, which fails the FIRST move; the
+// former web matrix's SECOND-move collision (a manifest naming a file AND its parent
+// directory) has no successor.
 
 /**
  * `_harness_mcp._move_tree` — move a file or dir, refusing an existing destination.
@@ -926,7 +927,7 @@ function restoreAll(stash, base, skip = null) {
  * The config edit is the LAST step and the only non-move mutation, so a move failure rolls
  * back cleanly with the `instructions` entry still intact. The prune climbs from each moved
  * file's PARENT so a `skills/<name>/` husk goes too — the half of this function no file
- * snapshot can see, and the reason `tests/web_golden.py` grew a `<dirs>` column in P6i.
+ * snapshot can see, and the reason the former web matrix grew a `<dirs>` column in P6i.
  */
 export function installDeactivate(root, host = 'opencode', scope = 'global') {
   if (CLAUDE_STYLE.includes(host)) return claudeDeactivate(root, scope, host);

package/js/maintain/update.mjs

@@ -1,10 +1,8 @@
 /**
  * Self-update: `git pull` the install's own origin, validate, rebuild.
  *
- * The verb this whole port exists for. Every other subcommand can be Python for one more
- * release; `upgrade` is the one operation a "no Python needed" install cannot delegate,
- * because a Node install that shelled out to the Python harness to update itself
- * would have Python as a hard dependency of the only command a user MUST be able to run.
+ * The one operation a user MUST always be able to run: every other verb can be broken by a bad
+ * release, and this is the verb that fetches the fix.
  *
  * WHY THIS MODULE SPAWNS, AND WHY THE ARGUMENT IS NOT THE JOB RUNNER'S. `js/web/jobs.mjs`
  * re-executes this program for ISOLATION — a synchronous verb in the daemon's event loop
@@ -15,21 +13,23 @@
  * the modules this process loaded before the merge — it would validate the old source, pass,
  * and then render the old source into the bundle, reporting success. That is not a slower
  * version of the right answer, it is the wrong one. So `runDoctor`, `rebuildBundle` and
- * `rebuildInstalls` each start a fresh interpreter over the tree as it now is, exactly as the
- * reference does, and `_ALLOWED_SPAWNS` in `tests/test_hook_cli_parity.py` carries the argv.
+ * `rebuildInstalls` each start a fresh interpreter over the tree as it now is, and
+ * `ALLOWED_SPAWNS` in `tests/unit/hook_cli.test.mjs` carries the argv. The same reason is why
+ * the two modules this file reaches lazily (`js/build/generate.mjs`, `js/web/daemon.mjs`) are
+ * loaded BEFORE the pull and not at their call sites: an `import()` after the merge would mix
+ * pulled files with the ones already cached, and a renamed export kills the upgrade mid-way.
  *
  * `git` is the fourth spawn and the plainest: there is no git library in the Node stdlib,
  * and the port will not vendor one. Every git call goes through the `gitRun` seam —
  * which-guarded, credential-redacted, and it never throws.
  *
- * WHAT THE GATE CANNOT SEE, stated rather than implied. `upgrade/*` in
- * `tests/harness_golden.py` runs each arm against a private clone of a bare origin the
- * fixture builds, so no cell can reach a network — which is a safety property and a blind
+ * WHAT THE GATE CANNOT SEE, stated rather than implied. `tests/unit/update_git.test.mjs` and
+ * `tests/unit/update_flow.test.mjs` run each arm against a private clone of a bare origin the
+ * fixture builds, so no test can reach a network — which is a safety property and a blind
  * spot at once: `git fetch --progress` over a local path prints NOTHING, so
  * `fetchStreaming`'s reader, its phase filter and its 15s heartbeat are reachable in every
- * cell and varied in none. The phase filter is gated as a corpus in
- * `tests/test_pure_function_parity.py`; the heartbeat and the hard deadline are gated by
- * neither and are declared in the P8a handoff.
+ * run and varied in none. The phase filter is gated over a recorded transcript in
+ * `tests/unit/update_git.test.mjs`; the heartbeat and the hard deadline are gated by nothing.
  *
  * ALSO HERE, SINCE P8b: `syncSelf`/`cmdSyncSelf` and the bootstrap step runner
  * (`cmdBootstrap`, `bootstrapPlain`) at the bottom of this file. Still NOT here: `main`, the
@@ -47,10 +47,9 @@ import { ROOT } from '../build/source.mjs';
 import { exportImprovements, flushExportNotes } from '../inspect/diff.mjs';
 import { opencodeConfigDir } from '../hosts/hosts.mjs';
 import { appendText, copyFile, printOut, printErr, readText, writeText } from '../lib/fs.mjs';
-import { toPlatformPath, which } from '../lib/paths.mjs';
+import { comparePaths, toPlatformPath, which } from '../lib/paths.mjs';
 import { WHITESPACE, parseIntStrict, stripWhitespace } from '../lib/text.mjs';
 import { NO_WINDOW } from '../lib/proc.mjs';
-import { bounceDaemonIfRunning } from '../web/daemon.mjs';
 
 /**
  * `_CREDS_RE` / `_redact_url_creds` — strip a `user[:token]@` userinfo out of any URL in
@@ -248,8 +247,14 @@ export function countOccurrences(s) {
 export function killTree(child) {
   try {
     if (process.platform !== 'win32') process.kill(-child.pid, 'SIGKILL');
-    else spawnSync('taskkill', ['/F', '/T', '/PID', String(child.pid)],
-      { encoding: 'utf8', timeout: 15000, ...NO_WINDOW });
+    else {
+      // `which`, never a bare name (a bare name resolves against the cwd first on Windows);
+      // no taskkill on PATH falls through to the `child.kill()` below.
+      const taskkill = which('taskkill');
+      if (!taskkill) throw new Error('taskkill not on PATH');
+      spawnSync(taskkill, ['/F', '/T', '/PID', String(child.pid)],
+        { encoding: 'utf8', timeout: 15000, ...NO_WINDOW });
+    }
   } catch {
     try { child.kill(); } catch { /* already gone */ }
   }
@@ -262,7 +267,7 @@ export function killTree(child) {
  * times and universal-newline decoding turns every `\r` repaint into its own line, so
  * without this a 30-second fetch writes a thousand lines into the install log. No cell can
  * reach it — a local-path fetch prints nothing at all — so
- * `tests/test_pure_function_parity.py` runs it over a recorded fetch transcript instead.
+ * `tests/unit/update_git.test.mjs` runs it over a recorded fetch transcript instead.
  *
  * Returns `[linesToLog, lastPhase]`, splitting the reference's loop from its side effects.
  */
@@ -366,13 +371,19 @@ export async function fetchStreaming(log = null) {
 
 /**
  * `_measure_upstream(log)` — Phase B: fetch (streamed), then classify. Returns
- * `[code, behind, err]` with `code` ∈ {ready, fetch_failed, unrelated, diverged, uptodate}.
+ * `[code, behind, err]` with `code` ∈ {ready, fetch_failed, no_upstream, unrelated, diverged,
+ * uptodate}.
+ *
+ * `no_upstream` HERE, AFTER PREFLIGHT SAID THERE WAS ONE: the fetch itself can take it away.
+ * An upstream branch deleted on the remote, fetched with `fetch.prune`, leaves `@{u}` naming
+ * nothing — both counts then fail, and read as two zeros they said "already up to date".
  */
 export async function measureUpstream(log = null) {
   const [rc, err] = await fetchStreaming(log);
   if (rc !== 0) return ['fetch_failed', 0, err];
-  const [, aheadRaw] = gitRun(['rev-list', '--count', '@{u}..HEAD']);
-  const [, behindRaw] = gitRun(['rev-list', '--count', 'HEAD..@{u}']);
+  const [arc, aheadRaw] = gitRun(['rev-list', '--count', '@{u}..HEAD']);
+  const [brc, behindRaw] = gitRun(['rev-list', '--count', 'HEAD..@{u}']);
+  if (arc !== 0 || brc !== 0) return ['no_upstream', 0, ''];
   const ahead = countOccurrences(aheadRaw);
   const behind = countOccurrences(behindRaw);
   if (ahead > 0) {
@@ -419,16 +430,31 @@ export function runDoctor(cand) {
   return [r.status === 0, universal(r.stdout) + universal(r.stderr)];
 }
 
-/** `_pull_and_validate(log)` — fast-forward to `@{u}`, then doctor-gate with exact rollback. */
+/**
+ * `_pull_and_validate(log)` — fast-forward to `@{u}`, then doctor-gate with exact rollback.
+ *
+ * `collision` ONLY WHEN GIT SAYS SO. A fast-forward can fail for other reasons — a lock file, a
+ * permission, a merge refused outright — and calling every one an untracked-file collision
+ * sent the user hunting for a file that is not there, with an info exit (3) over an error.
+ *
+ * THE ROLLBACK IS `reset --keep`, NEVER `--hard`. The doctor window lasts up to 300 s, and an
+ * edit made in the checkout meanwhile is a tracked edit `--hard` would destroy without a word.
+ * `--keep` refuses instead when such an edit touches a file the rollback must change; that
+ * refusal is reported as itself — the user is left on the pulled commit, with the command to
+ * finish the rollback — rather than as a rollback that did not happen.
+ */
 export function pullAndValidate(log) {
   const [rc0, old] = gitRun(['rev-parse', 'HEAD']);
   if (rc0 !== 0 || !old) return [false, 'not_git', 'could not read HEAD'];
   log('[geneseed] fast-forwarding to upstream ...');
   const [rc1, , err] = gitRun(['merge', '--ff-only', '@{u}'], { timeout: 60 });
   if (rc1 !== 0) {
-    return [false, 'collision',
-      'Update blocked — a new upstream file collides with a local untracked '
-      + 'file. Move or remove it, then update.\n' + err];
+    if (/would be overwritten/.test(err)) {
+      return [false, 'collision',
+        'Update blocked — a new upstream file collides with a local untracked '
+        + 'file. Move or remove it, then update.\n' + err];
+    }
+    return [false, 'merge_failed', `Update failed — could not fast-forward to upstream.\n${err}`];
   }
   const [rc2, pulled] = gitRun(['log', '--oneline', '--no-decorate', '-20', `${old}..HEAD`]);
   if (rc2 === 0 && pulled) {
@@ -439,8 +465,15 @@ export function pullAndValidate(log) {
   const [passed, output] = runDoctor(ROOT);
   log(output.replace(/\n+$/, ''));
   if (!passed) {
-    gitRun(['reset', '--hard', old], { timeout: 60 });
+    const [rc3, , rerr] = gitRun(['reset', '--keep', old], { timeout: 60 });
     for (const line of DOCTOR_LEGEND) log(line);
+    if (rc3 !== 0) {
+      return [false, 'doctor_fail',
+        'the pulled source FAILS validation, and the rollback was REFUSED — a file it must '
+        + 'restore was edited while the doctor ran, and those edits were kept. You are still '
+        + `on the pulled commit; save your edits, then roll back with: git reset --keep ${old}\n`
+        + rerr];
+    }
     return [false, 'doctor_fail',
       'the pulled source FAILS validation — rolled back to the previous commit. '
       + 'Fix the problems listed above.'];
@@ -505,8 +538,9 @@ export function markerTheme(cfg, out) {
 }
 
 /**
- * `_config_theme(here)` — the theme the LOCAL `harness.config.json` asks for, captured
- * before SYNC overwrites it with upstream's. Fallback only; a bundle marker still wins.
+ * `_config_theme(here)` — the theme the checkout's `harness.config.json` asks for. Fallback
+ * only; a bundle marker still wins. Read before the pull, but nothing local is at stake: the
+ * file is tracked and `preflight` refuses a dirty tree, so the value read is the committed one.
  */
 export function configTheme(here) {
   try {
@@ -518,11 +552,16 @@ export function configTheme(here) {
 /**
  * `_migrate_stray_bundle` — move host state (context.json, memory/) from an OLD in-folder
  * bundle to the canonical sibling `out` BEFORE rebuilding, then drop the stray.
+ *
+ * "IS `out` THE STRAY ITSELF?" IS A PATH COMPARISON, NOT A STRING ONE. `GENESEED_OUT` is typed
+ * by a user, so on Windows `c:\x\Geneseed\harness` is the same directory as the stray and was a
+ * different string: the rescue was skipped as "nothing to move into", and the `rmSync` at the
+ * bottom then deleted the LIVE bundle — memory/ and context.json with it.
  */
 export function migrateStrayBundle(here, out, log) {
   const stray = path.join(String(here), 'Harness');
   const outStr = String(out);
-  if (outStr === stray) return;
+  if (comparePaths(path.resolve(outStr), path.resolve(stray)) === 0) return;
   try { if (!statSync(stray).isDirectory()) return; } catch { return; }
   mkdirSync(outStr, { recursive: true });
   const ctx = path.join(stray, 'context.json');
@@ -559,15 +598,40 @@ async function drainStdout() {
   await new Promise((resolve) => { process.stdout.write('', resolve); });
 }
 
+/**
+ * The flags that re-emit the install at `dir` on its OWN axes — footprint, posture, mode,
+ * trust, doctrine packs, excluded rules — or `[]` when no build ever wrote a marker there.
+ *
+ * WITHOUT THEM THE REBUILD RESETS THE INSTALL. The generator's defaults are not the install's:
+ * a missing `--footprint` is `lean`, and posture, mode, packs and excluded rules come from
+ * `harness.config.json`. So a `full`, mentor, narrowed or rule-excluded install was re-emitted
+ * as the config default — markers included — and `rebuild-all` right after reads those
+ * rewritten markers back through `installProfile`, so the loss stuck. `installProfile` is the
+ * one reader of an install's axes; this takes its answer rather than growing a second one.
+ *
+ * Only the TAIL of the argv is kept: theme and emit are `upgrade`'s to decide (a theme argument
+ * may override the marker), and `setupBuildArgs` opens with exactly those four tokens when it
+ * is given no out and no root.
+ */
+export async function installAxes(dir, { installProfile, setupBuildArgs }) {
+  if (!existsSync(path.join(String(dir), '.geneseed-emit'))) return [];
+  const p = installProfile('opencode', 'global', String(dir));
+  return setupBuildArgs('', 'files', null, null, p.footprint, p.posture, p.mode, p.doctrines,
+    undefined, p.excludeRules, p.trust, p.excludeSkills).slice(4);
+}
+
 /**
  * `_rebuild_bundle` — render the bundle from the (already-updated) source and bounce a
- * running web daemon. Returns the build subprocess returncode (0 = ok).
+ * running web daemon. Returns the build subprocess returncode (0 = ok). `axes` is
+ * `installAxes` of the target, read before the pull; `bounce` is the daemon module's
+ * `bounceDaemonIfRunning`, loaded before the pull for the reason the file header gives.
  */
-export async function rebuildBundle(here, out, theme, emit, rootDir, log) {
+export async function rebuildBundle(here, out, theme, emit, rootDir, log, axes, bounce) {
   const buildArgs = ['--out', String(out)];
   if (theme) buildArgs.push('--theme', theme);
   if (emit === 'opencode') buildArgs.push('--emit', 'opencode', '--root', String(rootDir));
   else if (emit === 'opencode-global') buildArgs.push('--emit', 'opencode-global');
+  buildArgs.push(...axes);
   log(`[geneseed] rebuilding bundle -> ${out} (theme: ${theme || 'config default'}, emit: ${emit}) ...`);
   await drainStdout();
   // THE GENERATOR, RE-EXECUTED. `js/build/generate.mjs`'s `cmdBuild` calls `driverMain` in-process
@@ -580,7 +644,7 @@ export async function rebuildBundle(here, out, theme, emit, rootDir, log) {
   // If a web daemon is running, bounce it so the new source and the freshly rebuilt web/dist
   // take effect — otherwise the open PWA keeps hitting the old code. The web-job exception
   // (`upgrade/the-web-job-marker-...` gates it) lives with the helper.
-  await bounceDaemonIfRunning(theme, log);
+  await bounce(theme, log);
   return 0;
 }
 
@@ -636,6 +700,12 @@ export async function upgrade(ref = null, themeArg = null) {
     return p.kind === 'info' ? 3 : 1;
   }
 
+  // Loaded and read BEFORE the pull — see the file header for why the imports cannot wait, and
+  // `installAxes` for why the target's own axes must be carried into the rebuild.
+  const [generate, { bounceDaemonIfRunning }] = await Promise.all([
+    import('../build/generate.mjs'), import('../web/daemon.mjs')]);
+  const axes = await installAxes(emit === 'opencode-global' ? cfg : out, generate);
+
   log(`[geneseed] fetching from origin (git: ${which('git') || 'git'}, `
     + `timeout: ${fetchTimeout()}s) ...`);
   const [code, behind, err] = await measureUpstream(log);
@@ -647,6 +717,10 @@ export async function upgrade(ref = null, themeArg = null) {
       + 'Kerberos credentials). Restart it from that terminal: `geneseed web restart`.');
     return 1;
   }
+  if (code === 'no_upstream') {
+    log(`[geneseed] ${PRE_MSG.no_upstream[1]}`);
+    return 3;
+  }
   if (code === 'unrelated') {
     log('[geneseed] Upstream history was rewritten; back up local work, then re-clone '
       + 'or `git reset --hard @{u}`.');
@@ -676,7 +750,8 @@ export async function upgrade(ref = null, themeArg = null) {
   } catch (e) {
     log(`[geneseed] ⚠️  could not migrate the old in-folder bundle (${e && e.message ? e.message : e}) — continuing.`);
   }
-  let rc = await rebuildBundle(here, out, theme, emit, rootDir, log);
+  let rc = await rebuildBundle(here, out, theme, emit, rootDir, log, axes,
+    bounceDaemonIfRunning);
   if (rc !== 0) {
     log(`[geneseed][E-BUILD] ✗ the bundle build FAILED (theme: ${theme || 'default'}, emit: ${emit}).`);
     return 1;
@@ -886,13 +961,19 @@ function reexec(argv) {
  * `flushExportNotes()` runs BEFORE the handoff, deliberately: the re-exec replaces this process
  * and the update step's own improvements notice has scrolled past (or, under the reference's
  * curses arm, died with the alternate screen).
+ *
+ * A FAILED UPDATE STILL EXITS 1 AFTER THE HANDOFF. `setup` still runs — the user asked for it,
+ * and it can repair what the update could not — but its exit code used to become bootstrap's,
+ * so a script saw 0 over an update that never happened. `handoff` is the seam a test needs:
+ * the real `setup` exits 1 off a terminal, which would make the two answers indistinguishable.
  */
-export async function cmdBootstrap(args) {
+export async function cmdBootstrap(args, { handoff = reexec } = {}) {
   const failed = await bootstrapPlain();
   flushExportNotes();
   if (!args.noSetup) {
-    return reexec([process.execPath,
+    const rc = handoff([process.execPath,
       path.join(String(ROOT), 'bin', 'geneseed-cli.mjs'), 'setup']);
+    return failed ? 1 : rc;
   }
   // Scripted `bootstrap --no-setup` must not exit 0 over a failed update.
   return failed ? 1 : 0;

package/js/ui/anim.mjs

@@ -3,8 +3,8 @@
  *
  * P7c, and the one leftover of that phase that is NOT the declared curses panel. P5i ported
  * `_setup_lines` and left this out with a note — "belongs to P7 with the rest of the terminal
- * layer" — and the rest of the terminal layer turned out to be the panel, which stays
- * declared (`tests/test_tui_boundary.py` says why, and asserts it). This module is the part
+ * layer" — and the rest of the terminal layer turned out to be the panel, which was rejected
+ * (`tests/unit/no_panel.test.mjs` asserts it stays gone). This module is the part
  * that has nothing to do with curses: it draws on the ORDINARY terminal, with cursor-up
  * escapes and a sleep, and its only caller is a function that already crossed.
  *
@@ -23,16 +23,12 @@
  * needed — which is fortunate, because it is a `child_process` spawn and this port is barred
  * from those. The consequence is that the reference's `except Exception: return False` arm
  * around it has no counterpart here. That arm needs `cmd.exe` to be unlaunchable on a machine
- * that has already reached an interactive wizard, and `anim_ok` is compared over ten
- * environments in `tests/test_pure_function_parity.py` — none of which can produce it on
- * either side.
+ * that has already reached an interactive wizard.
  *
- * WHAT GATES IT. `tests/__snapshots__/primitives/{posix,win32}.json`, replayed by
- * `tests/snapshot/pure_snapshot.test.mjs`: `art_for` over every key plus the prototype-chain
- * names, `_place`/`_tile`/`_height` over their arithmetic, `anim_ok` over its whole decision
- * table, and `play_line` itself over 24 environments — captured on the reference side through
- * a real `TextIOWrapper`, so the CRLF translation is inside the recording rather than outside
- * it. There is no recorder left, so a red run means these functions moved, never the corpus.
+ * WHAT GATES IT. Little, now: the recorded snapshot corpus that replayed `art_for`, `_place`,
+ * `_tile`, `_height`, `anim_ok` and `play_line` is gone with the reference.
+ * `tests/unit/wizard.test.mjs` asserts the wizard still plays the animation, and in the right
+ * place; `tests/unit/no_panel.test.mjs` that this file is the one allowed its cursor escapes.
  */
 import { printOut } from '../lib/fs.mjs';
 import { parseIntStrict, codePointLength, padEndToWidth } from '../lib/text.mjs';
@@ -235,7 +231,7 @@ export function place(row, x, width) {
  * Python turns into an empty string and `String.repeat` turns into a RangeError, hence the
  * clamp. And `phase % len(tile)` is non-negative in Python for a positive divisor while
  * JavaScript keeps the sign of the dividend, so a negative phase indexes off the front of the
- * string instead of wrapping to the end. `_spin` had the same trap in P7b.
+ * string instead of wrapping to the end.
  */
 export function tile(tileStr, width, phase = 0) {
   if (!tileStr) return '';