geneseed 3.19.0 → 4.0.0

package/js/maintain/uninstall.mjs

@@ -50,18 +50,20 @@ import path from 'node:path';
 import { hookRunnerEntry } from '../hosts/shim.mjs';
 import { confirm } from '../lib/prompt.mjs';
 import {
-  claudeCfg, claudeReadManifest, doctrinesOfDir, emitHostScopeOf, excludedRulesOfDir, installKind,
-  installState,
+  claudeCfg, claudeReadManifest, doctrinesOfDir, EMIT_HOST_SCOPE, emitHostScopeOf,
+  excludedRulesOfDir, installKind, installState,
   registeredTargets, DISABLED_STASH,
 } from '../hosts/installs.mjs';
 import {
-  CLAUDE_STYLE, GLOBAL_MANIFEST, HOSTS, VERSION_MARKER, expanduser, opencodeConfigDir, resolvePath,
+  CLAUDE_STYLE, GLOBAL_MANIFEST, HOSTS, VERSION_MARKER, expanduser, isHostGlobalDir, opencodeConfigDir,
+  resolvePath, settingsFile,
 } from '../hosts/hosts.mjs';
 import { mcpCommented, mcpLoad } from '../hosts/mcp.mjs';
 import {
   atomicWriteJson, managedBlockRead, managedBlockRemove, managedBlockWrite,
-  loadJsonObject, mergeClaudeSettings, opencodeTarget,
-  settingsIntegrityCheck, wireClaudeExcludes, unwireClaudeExcludes, unwireClaudeSettings,
+  loadJsonObject, mergeClaudeSettings, opencodeTarget, OPENCODE_SENTINEL, opencodeSentinelWrite,
+  settingsIntegrityCheck, wireClaudeExcludes, unwireClaudeExcludes,
+  unwireClaudeSettings,
 } from '../hosts/settings.mjs';
 import { printOut, printErr, readText, writeText, isFile, isDir, isOsError } from '../lib/fs.mjs';
 import { indexOfDeepEqual, isDict, jsonDumps, deepEquals } from '../lib/json.mjs';
@@ -212,27 +214,63 @@ function warnMarkersKept() {
 const REVERSAL_MARKERS = [GLOBAL_MANIFEST, '.geneseed-theme', '.geneseed-emit',
   '.geneseed-footprint', VERSION_MARKER];
 
+/**
+ * The CURRENT manifest's `skill_denies` — the `permission.skill` denies Geneseed itself added
+ * (`opencodeLayer` in emit-opencode.mjs records them; a deny the user wrote, even on a Geneseed
+ * skill, is never in it). Task 4 (O-1) wires one per user-only skill, and unlike the Law IV
+ * `permission.bash` gates (permanent invariants, never taken back — see
+ * `reconcileOpencodePermission`), a skill-visibility deny is reversible: once uninstalled there
+ * is no skill left to hide, and the name is the user's to reuse. No record takes back nothing.
+ */
+function skillPermissionNames(man) {
+  return Array.isArray(man.skill_denies) ? man.skill_denies.filter((n) => typeof n === 'string') : [];
+}
+
 /**
  * `_harness_mcp._unmerge_opencode_json` — drop one `instructions` entry, leave every other
  * key intact.
  *
- * A COMMENTED `.jsonc` is not rewritten and the user is told to do it by hand: rewriting it
+ * `denyNames`, Task 4 (O-1): the denies this install's manifest records writing
+ * (`skill_denies`) — remove `permission.skill[name]` for each one, but ONLY where the value is
+ * still exactly `"deny"`, and drop the `skill` object once it is empty. Ownership comes from the
+ * record, not the value; the value check on top guards a user who re-scoped a recorded name to
+ * their own `"allow"`/`"ask"`. A
+ * caller passing `[]` (every non-uninstall unwire — `installDeactivate`, same as
+ * `permission.bash`) leaves `permission.skill` untouched, so a paused install keeps the model
+ * blind to its skills rather than re-exposing them until the next `geneseed build`.
+ *
+ * The sweep runs even when the `instructions` entry is already gone — an uninstall after a
+ * deactivate, which removed the entry but kept the denies (PR #241 review) — so either half
+ * alone is a change, and only "neither" declines.
+ *
+ * A COMMENTED `.jsonc` is not rewritten and the user is told to do it by hand — the entry AND
+ * the recorded denies still set to `"deny"`, each named: rewriting it
  * would drop the comments. That branch returns False, so the caller's `unmerged` reports
  * REALITY rather than intent.
  */
-export function unmergeOpencodeJson(p, entry) {
+export function unmergeOpencodeJson(p, entry, denyNames = []) {
   const target = opencodeTarget(p);
   // Absent, unreadable (the Python's `except OSError: return False`) or not an object: decline.
   const { state, data: cfg, hadComments } = loadJsonObject(target);
   if (state !== 'ok') return false;
   const instr = cfg.instructions;
-  if (!Array.isArray(instr) || !instr.includes(entry)) return false;
+  const hasEntry = Array.isArray(instr) && instr.includes(entry);
+  // The deny sweep does NOT hang off the entry: `installDeactivate` already dropped the entry
+  // (and kept the denies), so an uninstall after a deactivate finds no entry but still owns them.
+  const skill = isDict(cfg.permission) && isDict(cfg.permission.skill) ? cfg.permission.skill : null;
+  const denies = skill ? denyNames.filter((n) => skill[n] === 'deny') : [];
+  if (!hasEntry && !denies.length) return false;
   if (path.extname(target) === '.jsonc' && hadComments) {
-    printOut(`[uninstall] ${path.basename(target)} has comments — not rewriting it. Remove `
-      + `this from its "instructions" by hand: ${jsonDumps(entry)}\n`);
+    printOut(`[uninstall] ${path.basename(target)} has comments — not rewriting it.`
+      + (hasEntry ? ` Remove this from its "instructions" by hand: ${jsonDumps(entry)}` : '')
+      + (denies.length ? ` Remove these from its "permission.skill" by hand: `
+        + `${denies.map((n) => jsonDumps(n)).join(', ')}` : '')
+      + '\n');
     return false;
   }
-  cfg.instructions = instr.filter((i) => i !== entry);
+  if (hasEntry) cfg.instructions = instr.filter((i) => i !== entry);
+  for (const name of denies) delete skill[name];
+  if (skill && denies.length && !Object.keys(skill).length) delete cfg.permission.skill;
   atomicWriteJson(target, cfg);
   return true;
 }
@@ -265,16 +303,9 @@ export function archiveStore(store) {
   return dest;
 }
 
-/**
- * `_harness_mcp._settings_file` — the file this install's hooks were actually wired into.
- *
- * `settings.local.json` for a Claude PROJECT install (personal, untracked), `settings.json`
- * everywhere else, and the manifest is the authority. Every lifecycle path must target the
- * file the EMIT wrote, or the hooks linger in one file while the claims chase another.
- */
-function settingsFile(cfg, managed) {
-  return path.join(cfg, (managed && managed.settings_file) || 'settings.json');
-}
+// `settingsFile` lives in `hosts.mjs` (the hook stand-down reads it, and must not import this
+// module); re-exported here for `migrate`.
+export { settingsFile };
 
 /** `_harness_mcp._claude_md_path` — where the manifest says the managed block lives. */
 function claudeMdPath(cfg, managed) {
@@ -343,7 +374,8 @@ export function uninstallGlobal(target, archiveMemory, host = 'opencode') {
     if (isDir(p) && isEmptyDir(p)) rmdirQuiet(p);
   }
   const unmerged = unmergeOpencodeJson(path.join(target, 'opencode.json'),
-    path.join(target, 'AGENT.md').split(path.sep).join('/'));
+    path.join(target, 'AGENT.md').split(path.sep).join('/'), skillPermissionNames(man));
+  managedBlockRemove(path.join(target, OPENCODE_SENTINEL));
   if (failed.length) warnMarkersKept();
   else for (const m of REVERSAL_MARKERS) unlinkQuiet(path.join(target, m));
   let archived = null;
@@ -403,10 +435,11 @@ function opencodeProjectUninstall(root) {
   const entry = installAgentEntry(root, 'project');
   let removed = 0;
   let failed = [];
+  let man = null;
   const oc = path.join(root, '.opencode');
   const manifestPath = path.join(oc, GLOBAL_MANIFEST);
   if (isFile(manifestPath)) {
-    const man = claudeReadManifest(oc);
+    man = claudeReadManifest(oc);
     [removed, failed] = unlinkOwned(oc, ownedOf(man), '.opencode/');
     if (failed.length) warnSurvivors(failed);
     // Survivors gate, mirroring the other two reversals: `_project_qualifies` keys off the
@@ -427,7 +460,8 @@ function opencodeProjectUninstall(root) {
   }
   const am = path.join(root, 'AGENT.md');
   if (isFile(am)) { unlinkQuiet(am); removed += 1; }
-  const unmerged = unmergeOpencodeJson(path.join(root, 'opencode.json'), entry);
+  const unmerged = unmergeOpencodeJson(path.join(root, 'opencode.json'), entry,
+    man ? skillPermissionNames(man) : []);
   const result = { removed, unmerged, archived: null };
   if (failed.length) result.failed = failed;
   return result;
@@ -519,10 +553,75 @@ export function installUninstall(root, host = 'opencode', scope = 'global', memo
     if (archived.length) out.archived = archived;
     return out;
   }
-  for (const m of ['.geneseed-emit', '.geneseed-theme', VERSION_MARKER]) {
-    unlinkQuiet(path.join(root, m));
+  // The root markers are ONE PER ROOT (`generate.mjs`'s "THE MARKER IS TRUSTED ONLY FOR ITS
+  // OWN HOST") and `registryRoots` keeps a row alive only while `.geneseed-emit` exists there
+  // — so in a repo sharing two project installs (`.claude/` + `.opencode/` at the same cwd,
+  // last deploy wins the marker), deleting it unconditionally because THIS host is being
+  // uninstalled would silently deregister the OTHER host's still-live install, regardless of
+  // which host's name the marker happened to carry.
+  //
+  // Delete every marker ONLY when nothing else is installed here. Otherwise:
+  //   - `.geneseed-emit` carries HOST IDENTITY (`EMIT_HOST_SCOPE`'s key names a (host, scope)
+  //     pair) and `installProfile`/`migrateSurvey` trust it only for the host it names
+  //     (`generate.mjs`'s own docblock). If it currently names the host just removed, REWRITE
+  //     it to the survivor's own emit name — the same string `writeMarkers` (`driver.mjs`)
+  //     would have written for that survivor — rather than deleting it and leaving the
+  //     registry row to self-prune a live install. If it already names a survivor, it is
+  //     already correct; leave it untouched.
+  //   - `.geneseed-theme` and `VERSION_MARKER` carry NO host identity — a bare theme name and
+  //     a version/fingerprint string — so there is no survivor value to rewrite them TO; the
+  //     only question is whether they are THIS host's own litter to clear. At PROJECT scope
+  //     `.geneseed-theme` here is OpenCode's alone: `driver.mjs`'s own comment says the
+  //     claude/bob/openclaude project emits never write it, and `themeOfDir`'s host-narrowing
+  //     (host-compat B1 round 3, `js/hosts/installs.mjs`) means no Claude-style sibling ever
+  //     reads it either — so delete it only when OpenCode is the host being removed, and
+  //     leave it for a Claude-style uninstall (it belongs to a surviving or absent OpenCode
+  //     install either way, never to the host that just left). `VERSION_MARKER` is written at
+  //     `cfgDir`, never bare `root`, by every PROJECT emit (`js/build/version.mjs`'s callers),
+  //     so a project root never actually carries this file regardless of host — deleting it
+  //     here is always a no-op there. At GLOBAL scope neither file is ever shared (each host
+  //     owns its own config dir), so both are always this host's own and always safe to drop.
+  // PROJECT scope uses `projectQualifies` (the same predicate `uninstallResolve` already
+  // trusts for exactly this question), never `installState`: `installState`'s OpenCode
+  // branch answers 'active' off a bare `.opencode/` DIRECTORY's existence alone, with no
+  // manifest or marker check, so an unrelated non-Geneseed `.opencode/` sitting next to a
+  // real Claude install would read as a "surviving" OpenCode install and keep the marker
+  // alive for a host that was never actually here.
+  const survivor = HOSTS.find(({ host: h }) => h !== host && (
+    scope === 'project'
+      ? projectQualifies(root, h)
+      // GLOBAL: each host owns a distinct config dir, so no two hosts' global installs ever
+      // share a root — this can only match THIS host's own global install, and by the time
+      // execution reaches here (step 3) step 1 has already unlinked THIS host's own
+      // manifest/markers, so the lookback never mistakes its own just-removed install for a
+      // surviving sibling.
+      : installState(root, h, scope) !== 'absent'
+  ));
+  if (!survivor) {
+    for (const m of ['.geneseed-emit', '.geneseed-theme', VERSION_MARKER]) {
+      unlinkQuiet(path.join(root, m));
+    }
+  } else {
+    const markerScope = emitHostScopeOf(root);
+    if (markerScope !== null && markerScope[0] === host) {
+      const survivorEmit = [...EMIT_HOST_SCOPE.entries()]
+        .find(([, hs]) => hs[0] === survivor.host && hs[1] === scope)?.[0];
+      if (survivorEmit) {
+        writeText(path.join(root, '.geneseed-emit'), `${survivorEmit}\n`);
+      } else {
+        // Defensive: every (host, scope) pair in `HOSTS` has an `EMIT_HOST_SCOPE` entry, so
+        // this should be unreachable — but silently leaving a marker naming the just-removed
+        // host would deregister the survivor exactly as before, so it is loud instead of quiet.
+        printErr(`[uninstall] WARN: could not resolve an emit name for the surviving `
+          + `${survivor.host}:${scope} install here — the shared .geneseed-emit marker still `
+          + `names ${host}, which was just removed. Re-run \`geneseed rebuild-all\` or `
+          + `re-emit ${survivor.host} to refresh it.\n`);
+      }
+    }
+    if (scope === 'global' || host === 'opencode') unlinkQuiet(path.join(root, '.geneseed-theme'));
+    unlinkQuiet(path.join(root, VERSION_MARKER));
   }
-  // 4. Tidy an emptied marker dir (.claude/.bob) so no husk lingers in the repo.
+  // 4. Tidy an emptied marker dir (.claude/.bob/.openclaude) so no husk lingers in the repo.
   if (data !== root && isDir(data) && isEmptyDir(data)) rmdirQuiet(data);
   const out = { ok: true, removed: summary.removed ?? 0, memory };
   if (archived.length) out.archived = archived;
@@ -532,8 +631,9 @@ export function installUninstall(root, host = 'opencode', scope = 'global', memo
 /**
  * `_harness_mcp._project_qualifies` — does `root` carry a REAL Geneseed project install?
  *
- * The marker dir exists, is not the host's global config dir seen from its parent (the
- * `installTargets` aliasing guard), and shows Geneseed's own tracks: the manifest, or the
+ * The marker dir exists, is not the host's global seen from its parent (`isHostGlobalDir`, the
+ * `installTargets` aliasing guard — the default `~/.claude` too, under `$CLAUDE_CONFIG_DIR`),
+ * and shows Geneseed's own tracks: the manifest, or the
  * root `.geneseed-emit` naming this host's project emit for a pre-manifest legacy install.
  * A bare non-Geneseed `.claude/` is very common and must never hijack the resolve.
  */
@@ -542,7 +642,7 @@ export function projectQualifies(root, host) {
   const cfg = path.join(root, spec.projectMarker);
   if (!isDir(cfg)) return false;
   try {
-    if (resolvePath(cfg) === resolvePath(spec.configDir())) return false;
+    if (isHostGlobalDir(host, cfg)) return false;
   } catch { /* as the Python's bare `except Exception: pass` */ }
   if (isFile(path.join(cfg, GLOBAL_MANIFEST))) return true;
   const hs = emitHostScopeOf(root);
@@ -556,7 +656,8 @@ export function projectQualifies(root, host) {
  * is NAMED like a project marker and is the global install, never `claude:project` rooted at
  * `$HOME`, so the global-config-dir case is checked before the marker-name case.
  *
- *   1. `--target` IS a host's global config dir.
+ *   1. `--target` IS a host's global (`isHostGlobalDir`: its env-resolved dir, its default
+ *      `~/<marker>`, or a dir whose emit marker names that host's `-global` emit).
  *   2. `--target` IS a project marker dir itself (…/.claude) — root is its parent.
  *   3. `--target` (as a root) carries a Geneseed project install.
  *   4. `--target` given and unrecognised — null, and the caller reports it.
@@ -566,7 +667,7 @@ export function uninstallResolve(targetArg) {
   const globalHit = (p) => {
     for (const spec of HOSTS) {
       try {
-        if (p === resolvePath(spec.configDir())) return [spec.host, 'global', p];
+        if (isHostGlobalDir(spec.host, p)) return [spec.host, 'global', p];
       } catch { continue; }
     }
     return null;
@@ -673,12 +774,17 @@ export function cmdUninstall(args) {
   const stores = ['memory', 'notebook'].filter((n) => isDir(path.join(data, n)));
   printOut(`[uninstall] target: ${root} (${host}:${scope})\n`);
   if (CLAUDE_STYLE.includes(host)) {
+    // Not always settings.json: a Claude/OpenClaude PROJECT install wires settings.local.json
+    // (host-compat B4) — read back from the manifest `settingsFile` already resolves, rather
+    // than restate the rule here a second time.
+    const cfgForSf = claudeCfg(root, scope, host);
+    const sfName = path.basename(settingsFile(cfgForSf, managedOf(claudeReadManifest(cfgForSf))));
     printOut('[uninstall] removes: agents/, skills/, markers, the '
       + `${hostSpec(host).agentFile} managed block, and Geneseed's `
-      + 'settings.json hooks/excludes (your own keys/hooks are kept).\n');
+      + `${sfName} hooks/excludes (your own keys/hooks are kept).\n`);
   } else if (scope === 'global') {
-    printOut('[uninstall] removes: AGENT.md, agents/, skills/, plugins/, markers, and the '
-      + 'opencode.json instructions entry.\n');
+    printOut('[uninstall] removes: AGENT.md, the AGENTS.md managed block, agents/, skills/, '
+      + 'plugins/, markers, and the opencode.json instructions entry.\n');
   } else {
     printOut('[uninstall] removes: AGENT.md, .opencode/, laws/, agents/, skills/, and the '
       + 'opencode.json instructions entry.\n');
@@ -949,6 +1055,8 @@ export function installDeactivate(root, host = 'opencode', scope = 'global') {
     return { ok: false, failed, rolled_back: done.length };
   }
   unmergeOpencodeJson(path.join(root, 'opencode.json'), installAgentEntry(root, kind));
+  // The sentinel goes too, or a disabled install keeps the user's ~/.claude/CLAUDE.md from loading.
+  if (kind === 'global') managedBlockRemove(path.join(root, OPENCODE_SENTINEL));
   for (const rel of done) pruneAncestors(path.dirname(path.join(root, rel)), root);
   return { ok: true, kind, moved: done.length };
 }
@@ -975,6 +1083,7 @@ export function installReactivate(root, host = 'opencode', scope = 'global') {
   if (leftovers.length) return { ok: false, failed: leftovers, moved };
   const kind = installKind(root) || 'global';
   installReaddEntry(target, installAgentEntry(root, kind));
+  if (kind === 'global') opencodeSentinelWrite(root);
   rmtreeQuiet(stash);
   return { ok: true, kind, moved };
 }
@@ -1026,11 +1135,14 @@ function remergeClaudeHooks(cfg, root = cfg, host = 'claude') {
   // unconditionally (fail-closed, so not a hole — but wrong, and it made the toggle one-way
   // for project installs). `root` first, `cfg` second: on a global install the two are the
   // same directory anyway. Both silent ⇒ `null` ⇒ the gate stays.
-  const doctrines = doctrinesOfDir(root) ?? doctrinesOfDir(cfg);
+  // Both reads are narrowed to `host`'s OWN carrier (host-compat B1): in a repo shared with
+  // another Claude-style host, an un-narrowed scan can answer with a SIBLING host's carrier —
+  // the same failure `installProfile` had, reached here because `root` is the shared repo.
+  const doctrines = doctrinesOfDir(root, host) ?? doctrinesOfDir(cfg, host);
   // Same two-carrier read for the second axis, and its own default: an absent line means
   // NOTHING excluded, so a reactivate can only ever restore a gate, never remove one.
-  const excluded = excludedRulesOfDir(root).length ? excludedRulesOfDir(root)
-    : excludedRulesOfDir(cfg);
+  const excluded = excludedRulesOfDir(root, host).length ? excludedRulesOfDir(root, host)
+    : excludedRulesOfDir(cfg, host);
   // `host` reaches the group builder: a Bob reactivate must re-wire Gemini-named groups.
   const [, claims] = mergeClaudeSettings(settingsFile(cfg, managed),
     managed.settings_hooks ?? null, hookRunnerEntry(), doctrines, excluded, host, cfg);

package/js/maintain/update.mjs

@@ -46,6 +46,7 @@ import path from 'node:path';
 import { ROOT } from '../build/source.mjs';
 import { exportImprovements, flushExportNotes } from '../inspect/diff.mjs';
 import { opencodeConfigDir } from '../hosts/hosts.mjs';
+import { legacyProcessCarrierOfDir } from '../hosts/installs.mjs';
 import { appendText, copyFile, printOut, printErr, readText, writeText } from '../lib/fs.mjs';
 import { comparePaths, toPlatformPath, which } from '../lib/paths.mjs';
 import { WHITESPACE, parseIntStrict, stripWhitespace } from '../lib/text.mjs';
@@ -617,9 +618,18 @@ async function drainStdout() {
  * Only the TAIL of the argv is kept: theme and emit are `upgrade`'s to decide (a theme argument
  * may override the marker), and `setupBuildArgs` opens with exactly those four tokens when it
  * is given no out and no root.
+ *
+ * `null` — distinct from `[]`'s "never built, nothing to carry over" — means `dir` carries a
+ * pre-comms carrier (same guard as `rebuild-all`/`migrate`/the web console, reusing
+ * `legacyProcessCarrierOfDir`): `installProfile` would read it exactly as written, and feeding
+ * that into a rebuild would write the loss back PERMANENTLY. `[]` here would be WORSE, not
+ * neutral — it resets every axis to the generator's config default, the exact failure this
+ * function exists to prevent, on top of the comms/process-address loss. `upgrade` must skip the
+ * bundle rebuild entirely on `null`, never fall through to an empty axes list.
  */
 export async function installAxes(dir, { installProfile, setupBuildArgs }, notify = null) {
   if (!existsSync(path.join(String(dir), '.geneseed-emit'))) return [];
+  if (legacyProcessCarrierOfDir(String(dir), 'opencode')) return null;
   const p = installProfile('opencode', 'global', String(dir), notify);
   return setupBuildArgs('', 'files', null, null, p.footprint, p.posture, p.mode, p.doctrines,
     undefined, p.excludeRules, p.trust, p.excludeSkills).slice(4);
@@ -756,8 +766,18 @@ export async function upgrade(ref = null, themeArg = null) {
   } catch (e) {
     log(`[geneseed] ⚠️  could not migrate the old in-folder bundle (${e && e.message ? e.message : e}) — continuing.`);
   }
-  let rc = await rebuildBundle(here, out, theme, emit, rootDir, log, axes,
-    bounceDaemonIfRunning);
+  let rc = 0;
+  if (axes === null) {
+    // `installAxes` found a pre-comms carrier at this bundle's own target — skip the rebuild
+    // entirely rather than fall through with no axes (which would reset it to the generator's
+    // config default, worse than the loss this guard exists to stop). `rebuildInstalls` below
+    // reaches the same directory through `rebuild-all`'s own, identically-reasoned skip.
+    log(`[geneseed] SKIPPED bundle rebuild: pre-comms carrier at `
+      + `${emit === 'opencode-global' ? cfg : out} (names 'process 8') — run `
+      + '`geneseed setup` for it.');
+  } else {
+    rc = await rebuildBundle(here, out, theme, emit, rootDir, log, axes, bounceDaemonIfRunning);
+  }
   if (rc !== 0) {
     log(`[geneseed][E-BUILD] ✗ the bundle build FAILED (theme: ${theme || 'default'}, emit: ${emit}).`);
     return 1;

package/js/web/actions.mjs

@@ -47,8 +47,7 @@ import {
 } from '../hosts/hosts.mjs';
 import {
   EMIT_HOST_SCOPE, doctrinesForBuild, excludedRulesOfDir, excludedSkillsOfDir, footprintOfDir,
-  installState,
-  installTargets, modeOfDir, postureOfDir, trustOfDir,
+  installState, installTargets, legacyProcessCarrierOfDir, modeOfDir, postureOfDir, trustOfDir,
 } from '../hosts/installs.mjs';
 import {
   MCP_PRESETS, isDict, mcpApply, mcpCommented, mcpInstallTargets, mcpKnownNames, mcpLoad,
@@ -605,26 +604,38 @@ export function apiInstallCmd(state, body) {
   if (installState(root, host, scope) === 'disabled') {
     return { error: 'install is disabled — reactivate it before (re)building' };
   }
+  // A LEGACY CARRIER IS REFUSED, NEVER REBUILT — same guard as `rebuild-all`/`migrate` (see
+  // `legacyProcessCarrierOfDir`'s docblock): `doctrinesForBuild`/`excludedRulesOfDir` below
+  // read a pre-comms carrier exactly as written, and this endpoint's `{cmd}` is EXECUTED by
+  // `startJob` (`js/web/handler.mjs`'s `install` action) — building that argv here would write
+  // the same permanent loss a console click away.
+  if (legacyProcessCarrierOfDir(root, host)) {
+    return { error: `${host}:${scope} (${root}) predates the comms pack (its carrier names `
+      + "'process 8') — run `geneseed setup` for it before rebuilding from the console" };
+  }
   const emit = EMIT_FOR.get(`${host} ${scope}`);
   if (emit === undefined) return { error: `no install mode for ${host}:${scope}` };
+  // Every read-back below is narrowed to `host`'s OWN carrier (host-compat B1) — see the
+  // comment at `installProfile` in `js/build/generate.mjs`.
   const { theme, footprint: fp, posture: pos, mode, trust } = bodyAxes(body, {
-    theme: state.theme, footprint: footprintOfDir(root), posture: postureOfDir(root) || 'peer',
-    mode: modeOfDir(root) || 'direct', trust: trustOfDir(root, host) || DEFAULT_PRESET });
+    theme: state.theme, footprint: footprintOfDir(root),
+    posture: postureOfDir(root, host) || 'peer',
+    mode: modeOfDir(root, host) || 'direct', trust: trustOfDir(root, host) || DEFAULT_PRESET });
   // Unspecified means "keep what this install already has", exactly as theme, footprint,
   // posture and mode above do — a rebuild through the console is not a place to silently
   // re-decide the constitution. ⚠ AND A CARRIER WITH NO `Active packs:` MARKER (a pre-2.3
   // install) MUST NOT LAND ON `harness.config.json`: `doctrinesOfDir` answers `null` there,
   // `null` elided the flag, and the generator's config fallback then narrowed the install and
   // took its consent gate with it. `doctrinesForBuild` resolves unknown to ALL packs.
-  const doctrines = bodyDoctrines(body) ?? doctrinesForBuild(root);
+  const doctrines = bodyDoctrines(body) ?? doctrinesForBuild(root, host);
   // The per-rule axis needs NO `doctrinesForBuild`-style rescue: the marker it reads is only
   // written when something is excluded, so its absence is a statement ("nothing") rather than
   // the silence a pre-2.3 carrier gives on packs. Unspecified therefore keeps the install's
   // own answer, and a pre-marker install answers the empty list — which is what it has.
-  const excludeRules = bodyExcludeRules(body) ?? excludedRulesOfDir(root);
+  const excludeRules = bodyExcludeRules(body) ?? excludedRulesOfDir(root, host);
   const out = scope === 'global' ? null : String(root);
   const argv = setupBuildArgs(theme || 'neutral', emit, out, out, fp, pos, mode, doctrines,
-    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root));
+    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root, null, host));
   return { cmd: [process.execPath, path.join(ROOT, 'bin', 'build-driver.mjs'), ...argv] };
 }
 
@@ -704,6 +715,13 @@ export function apiDeployCmd(state, body) {
   if (cfgdirs.has(root)) {
     return { error: "that's a host global config dir — use its existing row to build a global install" };
   }
+  // Same guard as `apiInstallCmd` above: a landing folder that already holds a pre-comms
+  // install must not be rebuilt through `doctrinesForBuild`/`excludedRulesOfDir` below. A
+  // fresh, never-built folder has no carrier at all, so this is a no-op for the common case.
+  if (legacyProcessCarrierOfDir(root, host)) {
+    return { error: `${root} predates the comms pack (its carrier names 'process 8') — `
+      + 'run `geneseed setup` for it before deploying over it' };
+  }
   // A fresh deploy is full, at the default register, mode and trust.
   const { theme, footprint: fp, posture: pos, mode, trust } = bodyAxes(body, {
     theme: state.theme, footprint: 'full', posture: 'peer', mode: 'direct',
@@ -714,10 +732,10 @@ export function apiDeployCmd(state, body) {
   // the flag off, the generator fell back to `harness.config.json`, and deploying onto an
   // existing all-four Claude install dropped it to one pack — measured: 6 hook groups became 5
   // and `PreToolUse::Bash` went with them. `doctrinesForBuild` resolves unknown to ALL packs.
-  const doctrines = bodyDoctrines(body) ?? doctrinesForBuild(root);
-  const excludeRules = bodyExcludeRules(body) ?? excludedRulesOfDir(root);
+  const doctrines = bodyDoctrines(body) ?? doctrinesForBuild(root, host);
+  const excludeRules = bodyExcludeRules(body) ?? excludedRulesOfDir(root, host);
   // project-scope emit name == host name (opencode / claude / bob / openclaude)
   const argv = setupBuildArgs(theme || 'neutral', host, root, root, fp, pos, mode, doctrines,
-    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root));
+    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root, null, host));
   return { cmd: [process.execPath, path.join(ROOT, 'bin', 'build-driver.mjs'), ...argv] };
 }

package/js/web/api.mjs

@@ -119,10 +119,12 @@ export function apiInstalls(state) {
     out.push({
       id: `${host}:${scope}`, host, scope, path: root,
       state: installState(root, host, scope),
-      theme: themeOfDir(root),
+      // Narrowed to this row's own host (host-compat B1): a shared repo otherwise answers
+      // every row with whichever host's carrier the host-agnostic scan favours.
+      theme: themeOfDir(root, host),
       footprint: footprintOfDir(root),
-      posture: postureOfDir(root),
-      mode: modeOfDir(root),
+      posture: postureOfDir(root, host),
+      mode: modeOfDir(root, host),
       trust: trustOfDir(root, host),
       selected: samePath(viewCfg(host, scope, root), state.target),
     });

package/js/web/catalog.mjs

@@ -185,7 +185,7 @@ export function notebookItems(state) {
 
 /**
  * The wiki manifest's names, current first. `wiki.jsonc` is the name before the `geneseed-`
- * prefix: the build renames it on the next emit, and until then it is still read — one release.
+ * prefix: the build renames it on the next emit, and until then it is still read (no end date; see `LEGACY_WIKI_FILES`).
  */
 const WIKI_NAMES = ['geneseed-wiki.jsonc', 'wiki.jsonc'];
 const WIKI_META = ['Wiki manifest', 'your machine-wide knowledge base(s)'];

package/js/web/state.mjs

@@ -10,7 +10,8 @@ import path from 'node:path';
 
 import { opencodeConfigDir } from '../hosts/hosts.mjs';
 import {
-  footprintOfDir, installedDefaults, modeOfDir, postureOfDir, themeOfDir, trustOfDir,
+  EMIT_HOST_SCOPE, footprintOfDir, installedDefaults, modeOfDir, postureOfDir, themeOfDir,
+  trustOfDir,
 } from '../hosts/installs.mjs';
 import { doctorCollect } from '../inspect/doctor.mjs';
 import { DEFAULT_PRESET } from '../loop/score.mjs';
@@ -56,18 +57,25 @@ export function webState(theme = null, target = null) {
     _inv: null,
     _doctor: null,
   };
-  // The INSTALL ROOT (== build --out). For globals it IS the data dir; a claude/bob
-  // PROJECT install keeps its data under <repo>/.claude while the markers land at <repo>/.
+  // The INSTALL ROOT (== build --out). For globals it IS the data dir; a claude/bob/openclaude
+  // PROJECT install keeps its data under <repo>/.claude|.bob|.openclaude while the markers
+  // land at <repo>/.
   st.root = st.target;
   st.theme = theme || themeOfDir(st.target) || 'neutral';
   st.emit = installedDefaults().emit || 'opencode-global';
+  // `st.emit` to `host`, the same lookup `apiInstallCmd`/`diffCollect` already make off the
+  // same map — unknown or missing falls back to OpenCode, as those two do.
+  const hostOf = () => (EMIT_HOST_SCOPE.get(st.emit || '') ?? ['opencode', 'global'])[0];
   // The install's sigils, each defaulted when its marker is absent (footprint to 'full').
-  // Read from the ROOT, where every emit writes them.
-  const readMarkers = () => {
+  // Read from the ROOT, where every emit writes them. `host`, when given, narrows the carrier
+  // scan to its own (host-compat B1) — omitted here at construction, where `st.emit` is only
+  // `installedDefaults()`'s best guess and may not be THIS target's own host; `selectView`
+  // and `refresh` below pass it once `detectEmit()` has looked at this install directly.
+  const readMarkers = (host = null) => {
     st.footprint = footprintOfDir(st.root);
-    st.posture = postureOfDir(st.root) || 'peer';
-    st.mode = modeOfDir(st.root) || 'direct';
-    st.trust = trustOfDir(st.root) || DEFAULT_PRESET;
+    st.posture = postureOfDir(st.root, host) || 'peer';
+    st.mode = modeOfDir(st.root, host) || 'direct';
+    st.trust = trustOfDir(st.root, host) || DEFAULT_PRESET;
   };
   readMarkers();
 
@@ -112,27 +120,32 @@ export function webState(theme = null, target = null) {
   /**
    * Re-point the console at another detected install's data dir.
    *
-   * `root` is the install ROOT the markers and sigils live at. It defaults to `target` and
-   * differs only for claude/bob/openclaude PROJECT installs, where the data sits under
+   * `root` is the install ROOT the markers live at. It defaults to `target` and differs only
+   * for claude/bob/openclaude PROJECT installs, where the data sits under
    * `<repo>/.claude|.bob|.openclaude` while `.geneseed-emit`/`-theme`/`-footprint` land at
    * `<repo>/` — reading them from the data dir mis-detects the install as opencode/neutral,
-   * and a Diff or a Restore would then overwrite it in the wrong dialect.
+   * and a Diff or a Restore would then overwrite it in the wrong dialect. The theme/posture/mode
+   * SIGILS are different: for claude/bob they live in the ROOT carrier (`themeOfDir` scans it);
+   * for openclaude they live ONLY in the data dir's nested `.openclaude/CLAUDE.md`, since its
+   * root carrier is deliberately left untouched (host-compat B1/I1).
    */
   st.selectView = (target, root = null) => {
     st.target = target;
     st.root = root || target;
-    st.theme = themeOfDir(st.root) || themeOfDir(st.target) || 'neutral';
     st.emit = st.detectEmit();
-    readMarkers();
+    const host = hostOf();
+    st.theme = themeOfDir(st.root, host) || themeOfDir(st.target, host) || 'neutral';
+    readMarkers(host);
     st._inv = null;
     st._doctor = null;
   };
   st.refresh = () => {
     st._inv = null;
     st._doctor = null;
-    st.theme = themeOfDir(st.root) || themeOfDir(st.target) || st.theme;
     st.emit = st.detectEmit() || st.emit;
-    readMarkers();
+    const host = hostOf();
+    st.theme = themeOfDir(st.root, host) || themeOfDir(st.target, host) || st.theme;
+    readMarkers(host);
   };
   return st;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "Every field here is argued and gated in tests/unit/package_manifest.test.mjs. `files`, `bin` and `engines` each have a test that fails when reality drifts from this file; `version` mirrors harness.config.json and is gated too. Read that docblock before editing this one.",
   "name": "geneseed",
-  "version": "3.19.0",
+  "version": "4.0.0",
   "description": "A portable, theme-able harness you implant once and use everywhere to grow a disciplined AI coding agent.",
   "keywords": [
     "ai",

package/src/agents/_template.md

@@ -1,4 +1,4 @@
-<!--
+<!-- note:
   Authoring a new agent:
   1. Reuse first — if an existing {{AGENT}}'s capability already covers the need,
      extend it instead of adding a file ({{DOCTRINE:automate-repetition}} applies to specialists too).

package/src/bricks/_template.md

@@ -1,4 +1,4 @@
-<!--
+<!-- note:
   A brick template — copy this file to `<name>.md` (kebab-case, matching the `name:` field
   below) under `bricks/` at whichever level you are authoring for: shipped (this package's
   `src/bricks/`), global ($XDG_CONFIG_HOME/geneseed/bricks/), or project (<repo>/.geneseed/bricks/).

package/src/bricks/apply.md

@@ -10,7 +10,7 @@ carries an `amend`, that supersedes the original intent — follow the amendment
 replaced.
 
 When this is a repair after `test`, act on the latest `test` note only — it is the verdict on
-the code as it stands. Fix every finding it lists in this one pass: there is no second repair.
+the code as it stands. Fix every finding it lists in this one pass: repairs are capped at two.
 
 Make no unrelated edits: no drive-by rename, no incidental cleanup, no touching a file the card
 did not declare. If the change genuinely needs a file outside the write set, stop and report that

package/src/bricks/test.md

@@ -11,7 +11,7 @@ brick only observes; a fix belongs in `apply`, not here.
 1. **Gate** — the build or compile step. If it fails, mark every check below `SKIPPED (gate
    failed)` and report.
 2. **Focused checks** — the linter and the tests the change can reach. Run every one even after a
-   failure: they check independent properties, and the one repair must see every finding at once.
+   failure: they check independent properties, and each repair must see every finding at once.
 3. **Full suite** — only when everything above passed; otherwise `SKIPPED (an earlier check failed)`.
 
 List every check with `PASS`, `FAIL`, `ERROR` or `SKIPPED (reason)` — one that did not run is