geneseed 3.2.0 → 3.4.0

package/js/hosts/opencode.mjs

@@ -78,6 +78,20 @@ const AGENT_OVERRIDES_STUB = {
     + 'Host-specific; git-ignored. A future TUI screen edits this — rebuild to apply.'
   ),
   agents: {},
+  // Inert: `loadAgentOverrides` reads `agents` only. This is the starting point the README
+  // used to describe in prose — the seats whose work is read-and-summarise, where a smaller
+  // model loses little and a council convenes 3–6 of them at once.
+  _recommended: {
+    _comment: (
+      'Cheap-tier seats: copy the ones you want into "agents" with your host\'s cheap '
+      + 'model id (OpenCode: "anthropic/claude-haiku-4-5"; Claude Code / Copilot: "haiku"). '
+      + 'Read-and-summarise work — a council convenes several at once, so this is where '
+      + 'the savings compound. Nothing applies until you copy it.'
+    ),
+    'cheap-tier': ['explorer', 'researcher', 'tester', 'advocate', 'skeptic', 'pragmatist',
+      'steward', 'visionary', 'user-advocate', 'framer', 'empiricist', 'operator',
+      'historian'],
+  },
 };
 
 /** Mirrors `_build_emit.COMMAND_SET` — the hot skills worth a one-keystroke trigger. */

package/js/hosts/settings.mjs

@@ -667,11 +667,34 @@ export function hookPrefix({ runner, entry, platform = process.platform } = {})
  * belongs in — the user's call — not how work is run, so it is not the process pack's to
  * remove. `default` here means unknown, and unknown keeps the gate (see `processPackOn`).
  */
-export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = []) {
+export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [], host = 'claude') {
   const run = hookPrefix(hookOpts);
   const mem = `--memory "${path.join(cfg, 'memory')}"`;
   // --root carries the install's own dir so a GLOBAL hook can stand down when a project
   // install of the same host sits at/above cwd (project-bypasses-global).
+  if (host === 'bob') {
+    // BOB'S OWN HOOK CONTRACT, per its hooks doc and 2.0.2 changelog (docs/reviews/
+    // bob-global-injection-2026-09.md): FIVE events — SessionStart, UserPromptSubmit,
+    // PreToolUse, PostToolUse, Stop — Claude's names, but NOT Claude's protocol. stdout is
+    // read as context on SessionStart only; on PreToolUse it is ignored and the one way to
+    // refuse a call is EXIT CODE 2. The groups this emit wrote before were Claude's whole
+    // set: `SubagentStop`/`PreCompact` are not Bob events, and the gates answered with a
+    // stdout JSON Bob never reads — permissive on every call. `--host bob` makes the gates
+    // speak exit codes (js/hosts/hooks.mjs). No matcher on PreToolUse: Bob's tool names
+    // are undocumented (its IDE and Shell differ), so `tool-gate` reads the payload's shape
+    // instead. Which tool payload fields Bob sends is equally undocumented; the gates read
+    // Claude's (`command`, `file_path`/`path`, `content`/`new_string`) and defer on anything
+    // else. Unverified live: no Bob install on the authoring machine.
+    const b = ' --host bob';
+    return {
+      SessionStart: [{ hooks: [{ type: 'command', command: `${run} context --root "${cfg}"${b} || exit 0` }] }],
+      // One group, both gates: process 5's consent is a stderr line here (Bob has no ask
+      // tier), so the pack toggle that drops Claude's git-gate group has nothing to drop —
+      // `tool-gate` only ever EXITS 2 for Laws I and IV, which every build carries.
+      PreToolUse: [{ hooks: [{ type: 'command', command: `${run} tool-gate --root "${cfg}"${b}` }] }],
+      Stop: [{ hooks: [{ type: 'command', command: `${run} learn ${mem} || exit 0` }] }],
+    };
+  }
   const context = `${run} context --root "${cfg}" || exit 0`;
   const gate = `${run} git-gate --root "${cfg}"`;
   const ruleGate = `${run} rule-gate --root "${cfg}"`;
@@ -687,7 +710,10 @@ export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [])
     ],
     SessionStart: [
       { matcher: 'startup|clear', hooks: [{ type: 'command', command: context }] },
-      { matcher: 'resume', hooks: [{ type: 'command', command: context }] },
+      // `compact` too: auto-compaction keeps the instruction file (the host re-reads it) but
+      // summarises away the eagerly injected context, memory index and notebook TOC. Re-seed
+      // them the way a resume does — the static AGENT.md is NOT re-printed.
+      { matcher: 'resume|compact', hooks: [{ type: 'command', command: context }] },
     ],
     // `|| exit 0` (not `|| true`): hooks run under cmd.exe on native Windows, where `true`
     // is not a command and the swallow-failures intent would invert into a 9009 error.
@@ -695,9 +721,151 @@ export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [])
     // Same command as Stop: `learn` reads the payload's hook_event_name and routes a
     // SubagentStop to the per-agent lesson path.
     SubagentStop: [{ hooks: [{ type: 'command', command: learn }] }],
+    // And once more BEFORE compaction. `learn` distils the tail of the transcript (the newest
+    // MAX_NOTES_CHARS), so per-turn Stop is a sliding window over the session — and
+    // compaction is the one moment that window is about to be summarised away for good.
+    // The payload carries `transcript_path` like Stop's; the SessionStart `compact` matcher
+    // re-seeds context AFTER, this captures memory BEFORE. Same `|| exit 0`: never block.
+    PreCompact: [{ hooks: [{ type: 'command', command: learn }] }],
+  };
+}
+
+/**
+ * Geneseed's Copilot hooks, keyed by Copilot's event names.
+ *
+ * COPILOT'S SETTINGS ARE NOT CLAUDE'S. `~/.copilot/settings.json` carries `hooks` as a map of
+ * event → ONE `{command, shell?, timeout?}` object, not event → list of matcher groups, so
+ * nothing in `claudeHookGroups`/`mergeClaudeSettings` can be reused for it: there is no
+ * array to append to, and a second Geneseed group per event is not expressible. Two hooks:
+ *
+ *   * `sessionStart` → `context --host copilot`: the same project-context injection Claude
+ *     gets, in Copilot's `{"additionalContext"}` envelope.
+ *   * `toolCall` → `tool-gate --host copilot`: both gates behind the one command the event
+ *     allows, block-only for Laws I/IV, warn for the rest (js/hosts/hooks.mjs's header).
+ *
+ * No `sessionEnd`/`agentStop` → `learn`: Copilot's payloads for those carry no
+ * `transcript_path`, so `learn` would have nothing to distil. The memory write-back stays on
+ * the preamble for this host, as before.
+ *
+ * `|| exit 0` on the non-gate, as in `claudeHookGroups` and for the same reason.
+ */
+export function copilotHooks(cfg, hookOpts) {
+  const run = hookPrefix(hookOpts);
+  return {
+    sessionStart: { command: `${run} context --root "${cfg}" --host copilot || exit 0` },
+    toolCall: { command: `${run} tool-gate --root "${cfg}" --host copilot` },
   };
 }
 
+/**
+ * Wire Copilot's hooks into `p` — returns the complete current claim set, `[{event, hook}]`.
+ *
+ * ONE SLOT PER EVENT MEANS A FOREIGN HOOK CANNOT BE JOINED, ONLY DISPLACED — and displacing
+ * a hook the user wrote is not Geneseed's to do. A slot is taken when it holds a hook that
+ * is neither canonical nor a claim recorded by a previous emit; that event is skipped with a
+ * warning and never claimed. A recorded stale claim (a moved shim) is replaced, as the Claude
+ * merge prunes stale groups. Comments in the file mean it is not rewritten, as everywhere.
+ */
+export function mergeCopilotSettings(p, priorHooks = null, hookOpts = {}) {
+  const prior = (priorHooks || []).filter(isDict);
+  let config = {};
+  let hadComments = false;
+  if (existsSync(p)) {
+    try {
+      const [loaded, hc] = readJsonc(readText(p));
+      hadComments = hc;
+      if (isDict(loaded)) config = loaded;
+    } catch (e) {
+      if (!isOsError(e)) throw e;
+    }
+  }
+  let hooks = get(config, 'hooks');
+  if (!isDict(hooks)) hooks = {};
+  const canonical = copilotHooks(path.dirname(p), hookOpts);
+  const claims = [];
+  let changed = false;
+  for (const [event, hook] of Object.entries(canonical)) {
+    const cur = get(hooks, event);
+    const recorded = prior.find((r) => get(r, 'event') === event);
+    if (isDict(cur) && deepEquals(cur, hook)) { claims.push({ event, hook }); continue; }
+    if (isDict(cur) && !(recorded && deepEquals(recorded.hook, cur))) {
+      process.stderr.write(`[geneseed] ${path.basename(p)}: hooks.${event} is already set and `
+        + 'is not Geneseed\'s — left alone, so this event is not wired.\n');
+      continue;
+    }
+    hooks[event] = hook;
+    claims.push({ event, hook });
+    changed = true;
+  }
+  // A recorded claim whose event is no longer canonical: unwire it, or it fires forever.
+  for (const rec of prior) {
+    const event = get(rec, 'event');
+    if (event in canonical) continue;
+    if (deepEquals(get(hooks, event), get(rec, 'hook'))) { delete hooks[event]; changed = true; }
+  }
+  if (!changed) return [p, claims];
+  if (hadComments) {
+    process.stderr.write(`[geneseed] ${path.basename(p)} has comments — not rewriting it `
+      + "(your edits are kept). Add Geneseed's hooks by hand from adapters/copilot/README.md.\n");
+    return [p, prior];
+  }
+  if (Object.keys(hooks).length) config.hooks = hooks;
+  else delete config.hooks;
+  atomicWriteJson(p, config);
+  return [p, claims];
+}
+
+/** Remove exactly the recorded Copilot hooks from `p`. True when the file was rewritten. */
+export function unwireCopilotSettings(p, recorded) {
+  if (!existsSync(p) || !recorded || !recorded.length) return false;
+  let loaded;
+  let hadComments;
+  try {
+    [loaded, hadComments] = readJsonc(readText(p));
+  } catch (e) {
+    if (!isOsError(e)) throw e;
+    return false;
+  }
+  if (hadComments || !isDict(loaded)) return false;
+  const hooks = get(loaded, 'hooks');
+  if (!isDict(hooks)) return false;
+  for (const rec of recorded) {
+    const event = get(rec, 'event');
+    if (deepEquals(get(hooks, event), get(rec, 'hook'))) delete hooks[event];
+  }
+  if (!Object.keys(hooks).length) delete loaded.hooks;
+  try {
+    atomicWriteJson(p, loaded);
+  } catch (e) {
+    if (!isOsError(e)) throw e;
+    return false;
+  }
+  return true;
+}
+
+/**
+ * The Copilot twin of `settingsIntegrityCheck`: every recorded hook present (or absent) in
+ * the file it was claimed against. Same contract — problems as strings, each also WARNed on
+ * stderr, empty when clean — so a merge that did not stick is loud at emit time rather than
+ * a hook that quietly never fires.
+ */
+export function copilotIntegrityCheck(p, recorded, expect = 'present') {
+  const problems = [];
+  const hooks = existsSync(p) ? (() => {
+    try { return get(readJsonc(readText(p))[0], 'hooks'); } catch { return null; }
+  })() : null;
+  for (const rec of (recorded || []).filter(isDict)) {
+    const hit = deepEquals(get(hooks, rec.event), rec.hook);
+    if (expect === 'present' && !hit) {
+      problems.push(`${p}: recorded Copilot hook missing — event=${rec.event}`);
+    } else if (expect === 'absent' && hit) {
+      problems.push(`${p}: recorded Copilot hook still present after unwire — event=${rec.event}`);
+    }
+  }
+  for (const x of problems) process.stderr.write(`[geneseed] WARN: ${x}\n`);
+  return problems;
+}
+
 /**
  * `_build_settings._merge_claude_settings` — returns `[target, managed]`.
  *
@@ -710,7 +878,7 @@ export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [])
  * `scope` is accepted and unused, exactly as in the Python.
  */
 export function mergeClaudeSettings(p, _scope = 'global', priorHooks = null, hookOpts = {},
-  doctrines = null, excluded = []) {
+  doctrines = null, excluded = [], host = 'claude') {
   const prior = (priorHooks || []).filter(isDict);
   let config = {};
   let hadComments = false;
@@ -730,7 +898,7 @@ export function mergeClaudeSettings(p, _scope = 'global', priorHooks = null, hoo
   }
   let hooks = get(config, 'hooks');
   if (!isDict(hooks)) hooks = {};
-  const canonical = claudeHookGroups(path.dirname(p), hookOpts, doctrines, excluded);
+  const canonical = claudeHookGroups(path.dirname(p), hookOpts, doctrines, excluded, host);
   const canonFlat = [];
   for (const [event, groups] of Object.entries(canonical)) {
     for (const g of groups) canonFlat.push({ event, group: g });
@@ -771,7 +939,7 @@ export function mergeClaudeSettings(p, _scope = 'global', priorHooks = null, hoo
     return [p, prior];
   }
   // The `else` is DEAD on both sides and reproduced rather than dropped: `canonical` always
-  // carries four events, so by the time control reaches here `hooks` is never empty. A
+  // carries at least three events, so by the time control reaches here `hooks` is never empty. A
   // mutation keeping the empty block instead of deleting it is the one of thirty-three that
   // stays green, and it stays green because there is nothing to detect — recorded the way
   // `themed_rel` is, so "the gate cannot see it" and "there is nothing to see" keep their

package/js/inspect/excludes.mjs

@@ -1,7 +1,7 @@
 /**
  * The sovereign-repo exclusion WRITER.
  *
- * THE READER WAS ALREADY HERE. `js/hosts/hooks.mjs` has carried `sovereignBypass`, `EXCLUDES_FILE`
+ * THE READER WAS ALREADY HERE. `js/hosts/hosts.mjs` (since 2026-09; `hooks.mjs` before) has carried `sovereignBypass`, `EXCLUDES_FILE`
  * and `EXCLUDE_DIRS` since P5a: every hook call reads `excludes.json` and stands down when
  * cwd is under an excluded folder. This module is the other half — `harness exclude
  * add|remove|list`, which maintains that file across every global install and wires the

package/js/inspect/inventory.mjs

@@ -90,21 +90,26 @@ export const LAW_CLASSES = ['security', 'process', 'verify', 'craft', 'context',
 
 /** `_harness_tui.SKILL_CLASS` — each skill's category, keyed by file stem. */
 export const SKILL_CLASS = {
-  brainstorm: 'design', clarify: 'design', plan: 'design', council: 'design',
+  brainstorm: 'design', plan: 'design', council: 'design',
   workflow: 'design', 'parallel-agents': 'design', pipeline: 'design',
   'codebase-design': 'design', 'domain-modeling': 'design', wayfinder: 'design',
   tickets: 'design',
-  tdd: 'build', develop: 'build', refactor: 'build', debug: 'build', migrate: 'build',
+  develop: 'build', refactor: 'build', debug: 'build', migrate: 'build',
   'frontend-design': 'build', 'opencode-theme': 'build', prototype: 'build',
-  'forge-mcp': 'build',
-  'geneseed-code-review': 'review', 'fresh-eyes': 'review', 'gap-detector': 'review',
+  'forge-mcp': 'build', 'bruno-collection-generator': 'build', 'bruno-test-writer': 'build',
+  worktree: 'build', 'ci-fix': 'build', 'deps-audit': 'build',
+  'geneseed-code-review': 'review', 'fresh-eyes': 'review', 'security-audit': 'review',
   'roast-me': 'review', 'review-response': 'review', ponytail: 'review',
   commit: 'ship', ship: 'ship', release: 'ship', handoff: 'ship', 'git-rescue': 'ship',
-  'repo-map': 'understand', 'git-archaeology': 'understand', decode: 'understand',
+  'repo-map': 'understand', 'git-archaeology': 'understand',
   research: 'understand', ingest: 'understand', 'document-project': 'understand',
-  wiki: 'understand', prose: 'understand', geneseed: 'understand', rule: 'understand',
-  profile: 'understand', herdr: 'understand',
-  'crash-course': 'learn', drill: 'learn', feynman: 'learn', 'learning-path': 'learn',
+  prose: 'understand',
+  // `harness` — skills about the agent's own apparatus (its harness, memory, rules,
+  // knowledge base, terminal) rather than about the user's code. They sat under
+  // `understand` before, which made that class a grab-bag.
+  wiki: 'harness', geneseed: 'harness', rule: 'harness', profile: 'harness',
+  herdr: 'harness', 'skill-forge': 'harness', 'consolidate-memory': 'harness',
+  teach: 'learn', quiz: 'learn',
 };
 
 /** `k in dict` — own keys only, where `k in obj` also finds `Object.prototype` members. */

package/js/inspect/status.mjs

@@ -54,7 +54,7 @@
  * is inside the sandbox. It is reachable now; no cell seeds a manifest without an emit
  * marker, so it is still gated only by the corpus, and that is a gap rather than a wall.
  */
-import { existsSync, readdirSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 
 import { THEMES, ROOT, makeCfg } from '../build/source.mjs';
@@ -62,7 +62,7 @@ import { tuiInventory } from './inventory.mjs';
 import { readVersion, sourceFingerprint } from '../build/version.mjs';
 import {
   claudeConfigDir, bobConfigDir, copilotConfigDir, opencodeConfigDir, resolvePath,
-  resolveMemoryDir,
+  resolveMemoryDir, sovereignBypass,
 } from '../hosts/hosts.mjs';
 // P5f moved the install DETECTORS out of this file — `diff` renders its expected copy in the
 // deployed theme and footprint, and `rebuild-all` re-emits in the deployed everything, so
@@ -175,6 +175,41 @@ export function accentFor(theme) {
 
 // ---- the panel ----------------------------------------------------------------------------
 
+/**
+ * The gates, as seen from THIS cwd across every install on the machine.
+ *
+ * Two facts the panel could not show before. `standing_down` names each install whose
+ * `excludes.json` silences all three gates for the current directory — a bypass that until
+ * now had no visible surface anywhere, so a user could not tell an armed gate from one they
+ * had switched off months ago. `asks` counts the gate ledger (`notebook/gates.jsonl`, written
+ * by `js/hosts/hooks.mjs` on every ask) by rule; it is the only evidence of whether the gates
+ * do anything, and the input to the decision of whether to build more of them. Unreadable
+ * ledgers and malformed lines are skipped, not reported: this is a display read.
+ */
+export function gateSummary(cfgDirs) {
+  const standingDown = [];
+  const asks = {};
+  let total = 0;
+  for (const cfg of cfgDirs) {
+    if (sovereignBypass(cfg)) standingDown.push(String(cfg));
+    let raw;
+    try {
+      raw = readFileSync(path.join(cfg, 'notebook', 'gates.jsonl'), 'utf8');
+    } catch {
+      continue;
+    }
+    for (const line of raw.split('\n')) {
+      if (!line.trim()) continue;
+      let entry;
+      try { entry = JSON.parse(line); } catch { continue; }
+      const rule = entry && typeof entry.rule === 'string' ? entry.rule : 'unknown';
+      asks[rule] = (asks[rule] || 0) + 1;
+      total += 1;
+    }
+  }
+  return { standing_down: standingDown, asks, total };
+}
+
 /** `_harness_status._status_data`. */
 export function statusData() {
   const inst = installedDefaults();
@@ -226,6 +261,7 @@ export function statusData() {
     version_verdict: versionVerdict(installedFp, sourceFp),
     agent_md: agentMd ? String(agentMd) : null,
     agent_md_present: Boolean(agentMd && existsSync(agentMd)),
+    gates: gateSummary([...(cfgDir ? [cfgDir] : []), ...otherCfg]),
   };
 }
 
@@ -295,6 +331,18 @@ export function statusLines(d, color = false) {
     rows.push(['AGENT.md',
       `${d.agent_md}  (${d.agent_md_present ? 'present' : 'MISSING'})`]);
   }
+  // Conditional for the same recording reason as `constitution` above: the 30 recorded
+  // panels carry no `gates` key and must render unchanged.
+  if (d.gates) {
+    const g = d.gates;
+    const armed = g.standing_down.length
+      ? `STANDING DOWN for this cwd (excludes.json in ${g.standing_down.join(', ')})`
+      : 'armed';
+    const byRule = Object.entries(g.asks).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+      .map(([k, v]) => `${k} ${v}`).join(', ');
+    rows.push(['gates', `${armed}  ${DOT}  ${g.total} ask${g.total === 1 ? '' : 's'}`
+      + (byRule ? ` (${byRule})` : '')]);
+  }
 
   const labelW = Math.max(...rows.map(([k]) => codePointLength(k)));
   const body = rows.map(([k, v]) => `  ${padEndToWidth(k, labelW)}   ${v}`);

package/js/maintain/uninstall.mjs

@@ -59,9 +59,10 @@ import {
 } from '../hosts/hosts.mjs';
 import { mcpCommented } from '../hosts/mcp.mjs';
 import {
-  managedBlockRead, managedBlockRemove, managedBlockWrite, mergeClaudeSettings,
-  opencodeTarget, readJsonc, settingsIntegrityCheck, wireClaudeExcludes,
-  unwireClaudeExcludes, unwireClaudeSettings,
+  copilotIntegrityCheck, managedBlockRead, managedBlockRemove, managedBlockWrite,
+  mergeClaudeSettings, mergeCopilotSettings, opencodeTarget, readJsonc,
+  settingsIntegrityCheck, wireClaudeExcludes, unwireClaudeExcludes, unwireClaudeSettings,
+  unwireCopilotSettings,
 } from '../hosts/settings.mjs';
 import { printOut, printErr, readText, writeText, isFile, isDir, isOsError } from '../lib/fs.mjs';
 import { indexOfDeepEqual, jsonDumps, jsonDumpsIndent, deepEquals } from '../lib/json.mjs';
@@ -294,8 +295,12 @@ export function claudeUninstall(cfg, archiveMemory) {
   if (failed.length) warnSurvivors(failed);
   const hooks = managed.settings_hooks || [];
   const sf = settingsFile(cfg, managed);
-  const unwired = unwireClaudeSettings(sf, hooks);
+  // Two shapes, two unwires: a Copilot install records `copilot_hooks` (event → one hook)
+  // and never `settings_hooks`, so exactly one of these does anything.
+  const unwired = unwireClaudeSettings(sf, hooks)
+    | unwireCopilotSettings(sf, managed.copilot_hooks || []);
   unwireClaudeExcludes(sf, managed.settings_excludes || []);
+  copilotIntegrityCheck(sf, managed.copilot_hooks || [], 'absent');
   // The unwire is VERIFIED, not assumed: a commented settings file is never rewritten, so a
   // supposedly-uninstalled repo could keep firing Geneseed's hooks. Loud, never fatal.
   settingsIntegrityCheck(sf, managed, 'absent');
@@ -692,9 +697,10 @@ export function cmdUninstall(args) {
   const stores = ['memory', 'notebook'].filter((n) => isDir(path.join(data, n)));
   printOut(`[uninstall] target: ${root} (${host}:${scope})\n`);
   if (host === 'copilot') {
-    printOut('[uninstall] removes: agents/, skills/, markers, and the '
-      + `${hostSpec(host).agentFile} managed block (Copilot has no `
-      + 'settings.json/hooks to unwire; your own .github files are kept).\n');
+    printOut('[uninstall] removes: agents/, skills/, markers, the '
+      + `${hostSpec(host).agentFile} managed block, and Geneseed's `
+      + '~/.copilot/settings.json hooks on a global install (your own keys/hooks and '
+      + '.github files are kept).\n');
   } else if (host === 'claude' || host === 'bob') {
     printOut('[uninstall] removes: agents/, skills/, markers, the '
       + `${hostSpec(host).agentFile} managed block, and Geneseed's `
@@ -1049,9 +1055,27 @@ function cleanHostStash(cfg, host = 'claude') {
  * file and swallows its own OSError, exactly as the reference does — a failed bookkeeping
  * write must not fail the reactivate that has already moved every file back.
  */
-function remergeClaudeHooks(cfg, root = cfg) {
+function remergeClaudeHooks(cfg, root = cfg, host = 'claude') {
   const data = claudeReadManifest(cfg);
   const managed = managedOf(data);
+  // A Copilot install: its own merge, its own claim key, and none of the pack/exclude axes
+  // below — the Copilot gate is not pack-conditional (see `copilotHooks`). Without this
+  // branch a Copilot reactivate would write CLAUDE-shaped hook groups into
+  // ~/.copilot/settings.json, which Copilot cannot read.
+  if (Array.isArray(managed.copilot_hooks)) {
+    const [, claims] = mergeCopilotSettings(settingsFile(cfg, managed), managed.copilot_hooks,
+      hookRunnerEntry());
+    if (!deepEquals(claims, managed.copilot_hooks) && Object.keys(data).length > 0) {
+      managed.copilot_hooks = claims;
+      data.managed = managed;
+      const tmp = path.join(cfg, `${GLOBAL_MANIFEST}.tmp`);
+      try {
+        writeText(tmp, `${jsonDumpsIndent(data)}\n`);
+        renameSync(tmp, path.join(cfg, GLOBAL_MANIFEST));
+      } catch { /* except OSError: pass */ }
+    }
+    return;
+  }
   // `hookOpts` is the one argument `mergeClaudeSettings` will not default, and it is right
   // not to: there is no computable fallback for the runner/entry the shim bakes. The
   // emitter's own originator is imported rather than restated — a reactivate that wired a
@@ -1072,8 +1096,9 @@ function remergeClaudeHooks(cfg, root = cfg) {
   // NOTHING excluded, so a reactivate can only ever restore a gate, never remove one.
   const excluded = excludedRulesOfDir(root).length ? excludedRulesOfDir(root)
     : excludedRulesOfDir(cfg);
+  // `host` reaches the group builder: a Bob reactivate must re-wire Gemini-named groups.
   const [, claims] = mergeClaudeSettings(settingsFile(cfg, managed), 'global',
-    managed.settings_hooks ?? null, hookRunnerEntry(), doctrines, excluded);
+    managed.settings_hooks ?? null, hookRunnerEntry(), doctrines, excluded, host);
   // `and data` — a manifest that did not parse is not one to write back.
   if (!deepEquals(claims, managed.settings_hooks ?? null) && Object.keys(data).length > 0) {
     managed.settings_hooks = claims;
@@ -1107,10 +1132,12 @@ function claudeDeactivate(root, scope = 'global', host = 'claude') {
     return { ok: false, failed, rolled_back: done.length };
   }
   unwireClaudeSettings(settingsFile(cfg, managed), managed.settings_hooks || []);
+  unwireCopilotSettings(settingsFile(cfg, managed), managed.copilot_hooks || []);
   unwireClaudeExcludes(settingsFile(cfg, managed), managed.settings_excludes || []);
   // The same integrity check the uninstall path runs: a deactivate that silently failed to
   // unwire would leave hooks firing in a repo the user believes is off.
   settingsIntegrityCheck(settingsFile(cfg, managed), managed, 'absent');
+  copilotIntegrityCheck(settingsFile(cfg, managed), managed.copilot_hooks || [], 'absent');
   const cm = claudeMdPath(cfg, managed);
   const block = managedBlockRead(cm);
   mkdirSync(stash, { recursive: true });   // presence == disabled, even if nothing moved
@@ -1147,7 +1174,7 @@ function claudeReactivate(root, scope = 'global', host = 'claude') {
       && isFile(path.join(cfg, 'rules', 'geneseed.md'));
   }
   if (relive) {
-    remergeClaudeHooks(cfg, root);   // ensure the hooks are present (and the claims exact)
+    remergeClaudeHooks(cfg, root, host);   // ensure the hooks are present (and the claims exact)
     cleanHostStash(cfg, host);
     return { ok: true,
       note: 'install was re-created while disabled; discarded the stashed snapshot' };
@@ -1165,7 +1192,7 @@ function claudeReactivate(root, scope = 'global', host = 'claude') {
   if (existsSync(blockFile)) {
     managedBlockWrite(claudeMdPath(cfg, managed), readText(blockFile));
   }
-  remergeClaudeHooks(cfg, root);
+  remergeClaudeHooks(cfg, root, host);
   wireClaudeExcludes(settingsFile(cfg, managed), managed.settings_excludes || []);
   cleanHostStash(cfg, host);
   return { ok: true, kind: host, moved };

package/js/maintain/update.mjs

@@ -33,8 +33,8 @@
  *
  * ALSO HERE, SINCE P8b: `syncSelf`/`cmdSyncSelf` and the bootstrap step runner
  * (`cmdBootstrap`, `bootstrapPlain`) at the bottom of this file. Still NOT here: `main`, the
- * launchers' self-heal entry. `NOT_PORTED_ACTIONS` in `js/web/jobs.mjs` is empty now — every
- * action row crosses. `parseOrigin` is ported in full here even though only `upgrade`
+ * launchers' self-heal entry. Every web action row crosses — see `js/web/jobs.mjs`.
+ * `parseOrigin` is ported in full here even though only `upgrade`
  * needs its fallback, because P8c's docs `about` kind needs the slug half and splitting one
  * pure function across two phases is how a second classifier gets written.
  */

package/js/web/actions.mjs

@@ -10,10 +10,10 @@
  *
  * ---------------------------------------------------------------------------------------
  * `apiPickFolder` CROSSED 2026-08-27 — a user override of the permanent decline this section
- * used to record. `js/web/routes.mjs`'s `DECLINED_POST` still carries the history of that
- * decision (why a folder dialog looked permanently un-portable) and is now empty because of
- * it. See `apiPickFolder`'s own docblock, below, for the argv, the async-spawn reasoning, and
- * why it dispatches inline from `js/web/handler.mjs` rather than through `POST_ROUTES`.
+ * used to record (why a folder dialog looked permanently un-portable lives in git history,
+ * under `DECLINED_POST` in `js/web/routes.mjs`). See `apiPickFolder`'s own docblock, below,
+ * for the argv, the async-spawn reasoning, and why it dispatches inline from
+ * `js/web/handler.mjs` rather than through `POST_ROUTES`.
  *
  * ---------------------------------------------------------------------------------------
  * `apiInstallToggle` is a thin endpoint over an engine that lives elsewhere on purpose.
@@ -223,10 +223,10 @@ function runPicker(cmd, args, done, resultOf) {
 
 /**
  * `/api/pick-folder` — the OS-NATIVE folder chooser, opened ON THE DAEMON HOST. `done` is
- * called with `{path}` on OK, `{cancelled: true}` on cancel, or `{error}` — the shape
- * `web/src/api/installs.js`'s `pickFolder()` already expects, unchanged since the endpoint was
- * DECLINED (see this file's header and `js/web/routes.mjs`'s `DECLINED_POST` for that history,
- * overridden by the user 2026-08-27).
+ * called with `{path}` on OK, `{cancelled: true}` on cancel, or `{error}` — the shape the
+ * client's `pickFolder()` (in `web/src/api/index.js`) already expects, unchanged since the
+ * endpoint was DECLINED (see this file's header for that history, overridden by the user
+ * 2026-08-27).
  *
  * ASYNC, NEVER `spawnSync`: a folder dialog stays open until a human answers it — seconds to
  * minutes — and a synchronous spawn would block this single-threaded server's event loop for

package/js/web/api.mjs

@@ -37,7 +37,6 @@ import { stripWhitespace, percentDecode } from '../lib/text.mjs';
 import { readJsonc } from '../hosts/settings.mjs';
 import { apiActivity, apiActivityDetail } from './activity.mjs';
 import { apiMcp, apiRules } from './actions.mjs';
-import { apiGraph } from './graph.mjs';
 
 /** A requested catalog section or item that does not exist. */
 export class NotFound extends Error {}
@@ -342,7 +341,7 @@ export const WIKI_FILE_CAP = 5000;
  * (`js/hosts/hosts.mjs`'s docblock). None of them may let that escape: `js/web/handler.mjs`
  * wraps the whole GET in a blanket `catch` → a JSON 500, so an unguarded refusal would turn
  * ONE bad line in a file the user hand-edits into a dead Knowledge section. That is the same
- * argument `sovereignBypass` makes in `js/hosts/hooks.mjs` — contain the refusal per entry
+ * argument `sovereignBypass` makes in `js/hosts/hosts.mjs` — contain the refusal per entry
  * and take the site's OWN degrade — and each of the three already has one: `[]`, `continue`,
  * `continue`-into-404.
  *
@@ -498,7 +497,6 @@ function flatName(name) {
   }
 }
 
-/** `js/web/graph.mjs` is a second reader of this pattern. */
 export const WIKILINK_RE = /\[\[([^\]]+)\]\]/g;
 
 /**
@@ -874,8 +872,8 @@ const RECENT_LIMIT = 8;
 /**
  * THE NEWEST FILE-BACKED ENTRIES ACROSS THE HARNESS — the "freshly grown" card's whole payload.
  *
- * A GET added after the reference surface was frozen (`GET_BEYOND_REF` in `routes.mjs`), and
- * the first one. It exists because NOTHING else in this API carries a per-entry date: every
+ * The first GET added after the Python→Node port froze its reference surface. It exists
+ * because NOTHING else in this API carries a per-entry date: every
  * catalog row is `{name, title, desc, source}` and the only two timestamps on the whole surface are
  * `overview.build_time` and `doctor.checked_at`. A client cannot stat a path, so "what changed
  * lately" was unanswerable without a server that looks.
@@ -954,13 +952,11 @@ export const PREFIX_ROUTES = [
 /**
  * A literal path to `api_X(state)`, table-keyed rather than a chain of `if`s — the reason
  * it is a table is `tests/unit/web_server.test.mjs`'s cross-check, which requires this
- * table plus `PREFIX_ROUTES`, `PORTED_INLINE` and `NOT_PORTED` to equal `REF_GET`, a frozen
- * record of every GET this daemon has ever needed to answer.
+ * table plus `PREFIX_ROUTES` and `GET_INLINE` to equal a surface list written out in the
+ * test, so a route cannot appear or vanish unenumerated.
  */
 export const STATE_ROUTES = {
   '/api/overview': apiOverview,
-  // Added after the reference surface was frozen — declared in `GET_BEYOND_REF`, which
-  // keeps the partition gate's set equality honest instead of forging `REF_GET`.
   '/api/recent': apiRecent,
   '/api/themes': apiThemes,
   '/api/setup': apiSetup,
@@ -969,7 +965,6 @@ export const STATE_ROUTES = {
   '/api/excludes': apiExcludes,
   '/api/profile': apiProfile,
   '/api/diff': apiDiff,
-  '/api/graph': apiGraph,
   '/api/activity': apiActivity,
   // `/api/rules` must exist as a PAIR with its POST: `apiRulesMutate` splices `parseRules`'
   // line indices, and the fingerprint every mutation must send back is what this GET