geneseed 3.7.0 → 3.9.0

package/docs/web-ui.md

@@ -160,7 +160,7 @@ streams the output of background jobs and keeps their history across reloads.
     global harness goes dormant (hooks stay silent, the global preamble never loads);
     add or remove one here, the web mirror of `harness exclude add|remove|list`.
 - **Settings** (`#/settings`) — a **Console direction** picker (the visual flavour of the
-  console) with a **Dashboard layout** control (Auto follows each theme's designed Status
+  console: Cultivar, Operator, Matrix or Atlas) with a **Dashboard layout** control (Auto follows each theme's designed Status
   lens; Cultivar / Greenhouse / Operator / Journal force one regardless of skin), the
   install snapshot (deployed/target/theme/version/memory store), a Maintenance card (PATH
   link/unlink, uninstall), an offline package download, server controls (Stop), and the

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "3.7.0"
+  "version": "3.9.0"
 }

package/js/README.md

@@ -37,7 +37,7 @@ as a per-host install at project or global scope.
 
 | module | owns |
 |---|---|
-| `source.mjs` | Where the SOURCE is: `ROOT`/`SRC`/`THEMES`/`CONFIG`, `PACK_ORDER`, rule ids, the cfg object |
+| `source.mjs` | Where the SOURCE is: `ROOT`/`SRC`/`THEMES`/`CONFIG`, `PACK_ORDER`, the rule canon (stable ids → positional numbers, citations → names), the cfg object |
 | `render.mjs` | The pure text pipeline: theme load, `INCLUDE` inlining, CATALOG blocks, `{{TOKENS}}`, dest paths |
 | `bundle.mjs` | `build` — render a theme into a bundle dir, plus the source-completeness refusal. Sits UNDER both emits |
 | `emit-claude.mjs` | The Claude/Bob/Copilot/OpenClaude emit — the render half plus the settings + CLAUDE.md managed-block wire |
@@ -182,8 +182,9 @@ and inline lists are held against a surface list written out in
 
 | I want to | open first | then |
 |---|---|---|
-| a doctrine rule | `src/doctrines/<pack>.md` — APPEND, ids run contiguously | `docs/extending.md` §2a — five files, `--sync-themes`, restyle 14 voices by hand. Author BOTH LEAN halves |
-| a law (invariant) | `src/laws/universal.md` — **APPEND, never insert** | `docs/extending.md` §2c. Author both LEAN halves: the lean footprint ships nothing else |
+| a doctrine rule | `src/doctrines/<pack>.md` — `### {{DOCTRINE:<id>}} <Principle>`; the number is its position | `docs/extending.md` §2a — five files, `--sync-themes`, restyle 14 voices by hand. Author BOTH LEAN halves |
+| a law (invariant) | `src/laws/universal.md` — `### {{LAW:<id>}} <Principle>`; cite by id, never by number | `docs/extending.md` §2c. Author both LEAN halves: the lean footprint ships nothing else |
+| to remove or retire a rule | `docs/extending.md` §2e | `RETIRED_RULE_IDS` in `js/build/source.mjs` — a retired id is never reused |
 | a skill or an agent | `src/skills/<name>.md` or `src/agents/<name>.md` | `docs/extending.md` §3 — eight steps. Write the FILE before the table row or the build aborts |
 | a doctor check | `js/inspect/checks-{build,repo,authoring}.mjs` | register with `ran(...)` in `doctor.mjs`, then a PLANTED FAULT in `tests/unit/harness.test.mjs` |
 | a web endpoint | GET → `js/web/api.mjs`; POST → `js/web/actions.mjs` | declare it in `js/web/routes.mjs`; the partition test probes the real handler |

package/js/build/driver.mjs

@@ -166,7 +166,7 @@ const VALUED = {
   '--theme': 'theme', '--posture': 'posture', '--mode': 'mode',
   '--doctrines': 'doctrines', '--exclude-rules': 'excludeRules',
   '--out': 'out', '--target': 'out', '--emit': 'emit',
-  '--footprint': 'footprint', '--root': 'root',
+  '--footprint': 'footprint', '--root': 'root', '--config-dir': 'cfgDir',
 };
 const FLAGS = {
   '--sync-themes': 'syncThemes', '--validate-only': 'validateOnly',
@@ -1032,10 +1032,10 @@ function writeMarkers(markerDir, emit, footprint) {
  * compares it file by file. The Python spells that `HOSTS[host]["emit_global"](theme,
  * out=..., cfg=<tmp>, footprint=...)`, where `cfg` overrides the target the emit would
  * otherwise resolve. This is that call, and the override is threaded as `args.cfgDir` through
- * the four `emit*Global` bodies rather than added to `parseArgs`: `build.py` has no
- * `--cfg-dir` flag, and a flag on one driver and not the other is a divergence
- * `tests/golden.py` compares 259 times and could never see, because it drives both from the
- * same argv.
+ * the `emit*Global` bodies. The same key is also `--config-dir` on the command line: a global
+ * emit never writes to `--out` (there `out` is the legacy bundle a memory store migrates FROM,
+ * and `update` passes it for exactly that), so without the flag there was no way to preview a
+ * global install anywhere but over the live one.
  *
  * WHICH SIDE OF THE BOUNDARY THIS SITS ON. P3c's rule was that a render CHILD must never
  * resolve a config dir, because a child that did would write 135 files into the developer's
@@ -1187,6 +1187,15 @@ function run(argv) {
   }
 
   const out = resolveOut(args.out);
+  // Refused rather than ignored on a per-repo emit: an ignored target flag is how a preview
+  // lands on a live install, which is the bug this flag exists to close.
+  if (args.cfgDir !== undefined) {
+    if (!args.emit.endsWith('-global')) {
+      die(2, `argument --config-dir: only applies to a -global emit (got --emit ${args.emit}); `
+        + 'a per-repo emit writes under --out/--root');
+    }
+    args.cfgDir = resolveOut(args.cfgDir);
+  }
   const cfg = makeCfg(args);
 
   // The marker directory is the emit's TARGET, which for a global emit is the config dir it

package/js/build/generate.mjs

@@ -80,12 +80,28 @@ function sysExit(msg) {
  * Calling the driver in-process keeps that: `resolveOut` resolves against `process.cwd()`
  * the same way. `build/the-bundle-follows-cwd-not-the-checkout` is the cell.
  *
- * Every other flag is the generator's own default, read from `harness.config.json` by the
- * driver — `harness build` forwards `--theme` and nothing else, and its own `--theme`
- * carries no `choices`, so an unknown one is refused by the generator rather than here.
+ * `geneseed build` used to forward `--theme` alone, which made `setup`'s own off-TTY hint
+ * (`geneseed build --emit … --theme …`) a usage error and left every other axis reachable
+ * only through the undocumented `geneseed-build`. Values are forwarded unchecked: the driver
+ * owns the choices, so the table does not repeat them.
+ *
+ * `--validate-only` is NOT one of these: it lives on `geneseed validate` only — that verb's
+ * source-tree half is the doctor, which starts a process, and this command's whole closure
+ * (`bin/geneseed-cli.mjs` → here → `driverMain`) is under the same transitive `child_process`
+ * ban as `bin/build-driver.mjs` itself. `driver.mjs`'s `run()` refuses the flag unconditionally
+ * for exactly that reason.
  */
+const BUILD_FORWARD = [
+  ['theme', '--theme'], ['emit', '--emit'], ['footprint', '--footprint'],
+  ['posture', '--posture'], ['mode', '--mode'], ['doctrines', '--doctrines'],
+  ['excludeRules', '--exclude-rules'], ['out', '--out'], ['root', '--root'],
+  ['configDir', '--config-dir'],
+];
+
 export function cmdBuild(args) {
-  return driverMain(args.theme ? ['--theme', args.theme] : []);
+  const argv = [];
+  for (const [key, flag] of BUILD_FORWARD) if (args[key] != null) argv.push(flag, args[key]);
+  return driverMain(argv);
 }
 
 // --------------------------------------------------------------------------------------
@@ -161,6 +177,66 @@ export const DEFAULT_EMIT = new Map([
   ['openclaude global', 'openclaude-global'], ['openclaude project', 'openclaude'],
 ]);
 
+/**
+ * Everything `rebuild-all` reads back off one install, and the argv that re-emits it unchanged.
+ *
+ * EXTRACTED SO `status` SHOWS WHAT A REBUILD WOULD USE, not a second reading of the same
+ * markers that could drift from this one. An agent changing one setting takes `argv`, edits one
+ * flag and runs it; every flag it did not touch has to be the install's own, or the "one
+ * change" silently resets the rest — which is exactly the failure the seven read-backs below
+ * exist to prevent.
+ *
+ * THE MARKER IS TRUSTED ONLY FOR ITS OWN HOST. There is one `.geneseed-emit` per root and the
+ * last deploy wins, so in a dual-host repo (`.opencode/` and `.claude/` in one cwd) the other
+ * host's row would otherwise rebuild with the WRONG emit — turning a Claude install into an
+ * OpenCode one. `rebuild-all/a-dual-host-repo-rebuilds-each-row-in-its-own-emit` is the cell.
+ */
+export function installProfile(host, scope, root) {
+  const raw = readMaybe(path.join(root, '.geneseed-emit'));
+  let marker = raw === null ? '' : raw.trim();
+  if (marker && (EMIT_HOST_SCOPE.get(marker) ?? ['', ''])[0] !== host) marker = '';
+  const emit = marker || DEFAULT_EMIT.get(`${host} ${scope}`) || 'opencode-global';
+  const theme = themeOfDir(root) || defaultTheme();
+  const footprint = footprintOfDir(root);
+  const posture = postureOfDir(root) || defaultPosture();
+  const mode = modeOfDir(root) || defaultMode();
+  // A rebuild that defaulted the pack selection would re-emit an install into a constitution
+  // its owner did not choose — and in one direction that is not merely surprising: dropping
+  // the process pack takes the commit/push consent RULES out of AGENT.md while
+  // `claudeHookGroups` keeps the gate wired, or the reverse. ⚠ AND THE FALLBACK IS NOT
+  // `harness.config.json`: a pre-migration carrier has no marker, and resolving that silence
+  // out of a machine-wide config narrows every such install on its first upgrade.
+  // `doctrinesForBuild` resolves unknown to ALL packs — see its docblock.
+  const doctrines = doctrinesForBuild(root);
+  // The per-rule axis is preserved for the same reason and with sharper teeth: an upgrade that
+  // dropped it would quietly hand back every rule its owner switched off, and `process 5` is
+  // one of them. `null` (no marker) stays `null` so the argv omits the flag, as it always did.
+  const excludeRules = excludedRulesOfDir(root);
+  const out = scope === 'global' ? null : root;
+  const argv = setupBuildArgs(theme, emit, out, out, footprint, posture, mode, doctrines,
+    PACK_ORDER, excludeRules);
+  // A GLOBAL ROW NAMES ITS OWN DIR. `root` came from the host's config-dir resolver, which
+  // honours env overrides (`OPENCODE_CONFIG_DIR`, `CLAUDE_CONFIG_DIR`…); without the flag the
+  // same argv run from a shell lacking that variable re-emits into the DEFAULT dir — a second
+  // install beside the one it was meant to rebuild. Appended, so the argv's head is unchanged.
+  if (scope === 'global') argv.push('--config-dir', root);
+  return {
+    host, scope, root, state: installState(root, host, scope),
+    emit, theme, footprint, posture, mode, doctrines, excludeRules, argv,
+  };
+}
+
+/**
+ * `argv` as one pasteable command, using the `geneseed build` launcher rather than the raw
+ * generator: `geneseed-build` is only on PATH for an npm global install, while a git-clone
+ * install has only the `geneseed` launcher, and `geneseed build` now forwards every flag
+ * `setupBuildArgs` produces. Only whitespace is quoted — a path holding shell metacharacters
+ * (`$`, `&`) would need quoting by hand.
+ */
+export function rebuildCommand(argv) {
+  return ['geneseed', 'build', ...argv.map((a) => (/\s/.test(a) ? `"${a}"` : a))].join(' ');
+}
+
 /**
  * `_harness_build.cmd_rebuild_all` — re-emit every ACTIVE install in place, best-effort.
  *
@@ -172,16 +248,12 @@ export const DEFAULT_EMIT = new Map([
  * `main` converts, and `rebuild-all/one-broken-install-does-not-stop-the-rest` is the cell
  * that fails if either half is undone.
  *
- * FIVE VALUES ARE READ BACK OFF EACH INSTALL, not defaulted. Theme and emit and footprint
- * come from markers; posture and mode are detected from the `**<Name>**` lead in the
- * deployed carrier's prose, because they were never markered. A rebuild that defaulted any
- * of them would silently re-emit an install into something its owner did not choose — which
- * is the same failure mode `_footprint_of_dir`'s WARN exists to prevent, at a larger scale.
- *
- * THE MARKER IS TRUSTED ONLY FOR ITS OWN HOST. There is one `.geneseed-emit` per root and the
- * last deploy wins, so in a dual-host repo (`.opencode/` and `.claude/` in one cwd) the other
- * host's row would otherwise rebuild with the WRONG emit — turning a Claude install into an
- * OpenCode one. `rebuild-all/a-dual-host-repo-rebuilds-each-row-in-its-own-emit` is the cell.
+ * SEVEN VALUES ARE READ BACK OFF EACH INSTALL, not defaulted — see `installProfile`. Theme and
+ * emit and footprint come from markers; posture and mode are detected from the `**<Name>**`
+ * lead in the deployed carrier's prose, because they were never markered. A rebuild that
+ * defaulted any of them would silently re-emit an install into something its owner did not
+ * choose — which is the same failure mode `_footprint_of_dir`'s WARN exists to prevent, at a
+ * larger scale.
  */
 export function cmdRebuildAll() {
   const targets = installTargets().filter(([h, s, r]) => installState(r, h, s) === 'active');
@@ -191,34 +263,11 @@ export function cmdRebuildAll() {
   }
   const failures = [];
   for (const [host, scope, root] of targets) {
-    const raw = readMaybe(path.join(root, '.geneseed-emit'));
-    let marker = raw === null ? '' : raw.trim();
-    if (marker && (EMIT_HOST_SCOPE.get(marker) ?? ['', ''])[0] !== host) marker = '';
-    const emit = marker || DEFAULT_EMIT.get(`${host} ${scope}`) || 'opencode-global';
-    const theme = themeOfDir(root) || defaultTheme();
-    const footprint = footprintOfDir(root);
-    const posture = postureOfDir(root) || defaultPosture();
-    const mode = modeOfDir(root) || defaultMode();
-    const out = scope === 'global' ? null : root;
-    // SIX values now, not five. A rebuild that defaulted the pack selection would re-emit an
-    // install into a constitution its owner did not choose — and in one direction that is not
-    // merely surprising: dropping the process pack takes the commit/push consent RULES out of
-    // AGENT.md while `claudeHookGroups` keeps the gate wired, or the reverse. ⚠ AND THE
-    // FALLBACK IS NOT `harness.config.json`: a pre-migration carrier has no marker, and
-    // resolving that silence out of a machine-wide config narrows every such install on its
-    // first upgrade. `doctrinesForBuild` resolves unknown to ALL packs — see its docblock.
-    const doctrines = doctrinesForBuild(root);
-    // SEVEN. The per-rule axis is preserved for the same reason and with sharper teeth: an
-    // upgrade that dropped it would quietly hand back every rule its owner switched off, and
-    // `process 5` is one of them — the consent gate would return to a harness that had been
-    // built without it. No `doctrinesForBuild` rescue is needed here; see `apiInstallCmd`.
-    const excludeRules = excludedRulesOfDir(root);
-    const argv = setupBuildArgs(theme, emit, out, out, footprint, posture, mode, doctrines,
-      PACK_ORDER, excludeRules);
+    const p = installProfile(host, scope, root);
     const label = `${host}:${scope} (${root})`;
-    printOut(`[rebuild-all] ${label}: theme=${theme} emit=${emit} footprint=${footprint} `
-      + `posture=${posture} mode=${mode}\n`);
-    const rc = driverMain(argv);
+    printOut(`[rebuild-all] ${label}: theme=${p.theme} emit=${p.emit} footprint=${p.footprint} `
+      + `posture=${p.posture} mode=${p.mode}\n`);
+    const rc = driverMain(p.argv);
     if (rc !== 0) {
       failures.push(label);
       printErr(`[rebuild-all] FAILED ${label} (exit ${rc})\n`);

package/js/build/render.mjs

@@ -34,7 +34,7 @@ import { readText } from '../lib/fs.mjs';
 import { parseJson } from '../lib/json.mjs';
 import { normcase, comparePaths } from '../lib/paths.mjs';
 // `js/build/source.mjs` imports nothing but node builtins, so this direction cannot cycle.
-import { PACK_ORDER, readPackText } from './source.mjs';
+import { PACK_ORDER, readPackText, resolveRuleIds } from './source.mjs';
 
 /** Document STRUCTURE is theme-INDEPENDENT — mirrors `_build_render.STRUCTURE`. */
 export const STRUCTURE = {
@@ -216,7 +216,8 @@ function readSource(cfg, p) {
   let seen = SRC_TEXT.get(cfg);
   if (!seen) SRC_TEXT.set(cfg, (seen = new Map()));
   let text = seen.get(p);
-  if (text === undefined) seen.set(p, (text = readText(p)));
+  // Rule ids resolve here, once per file, so every stage after sees the addressed form.
+  if (text === undefined) seen.set(p, (text = resolveRuleIds(readText(p), cfg.src)));
   return text;
 }
 
@@ -250,7 +251,9 @@ export function renderFile(cfg, filePath, theme, footprint = 'full', lawsPrefix
 function registerBody(cfg, theme, dir, selected, fallback) {
   for (const name of [selected, fallback]) {
     const p = path.join(cfg.src, dir, `${name}.md`);
-    if (existsSync(p) && statSync(p).isFile()) return substitute(readText(p), theme).trim();
+    if (existsSync(p) && statSync(p).isFile()) {
+      return substitute(resolveRuleIds(readText(p), cfg.src), theme).trim();
+    }
   }
   return '';
 }

package/js/build/source.mjs

@@ -37,7 +37,7 @@ import path from 'node:path';
  * on raw or folded text, so one behaviour serves both.
  */
 const _packTexts = new Map();
-export function readPackText(file) {
+export function readRawText(file) {
   const key = path.resolve(file);
   const mtime = statSync(file).mtimeMs;
   const hit = _packTexts.get(key);
@@ -47,6 +47,110 @@ export function readPackText(file) {
   return text;
 }
 
+/**
+ * A doctrine pack as the render sees it: ids resolved, so the heading reads
+ * `### {{DOCTRINE}} process 5 — {{DOC_CONSENT_BEFORE_PUSH}}` again. Every reader that keys on the
+ * `<pack> <n>` address (`knownRuleIds`, the exclusion filter, the survives gate) goes through
+ * here and keeps working unchanged — the address is computed, only the source stopped typing it.
+ */
+export function readPackText(file) {
+  return resolveRuleIds(readRawText(file), path.dirname(path.dirname(file)));
+}
+
+/**
+ * STABLE RULE IDS. Every law and doctrine rule is DECLARED by its heading —
+ * `### {{LAW:verify-before-asserting}} Verify Before Asserting` — and CITED by its id —
+ * `{{LAW:verify-before-asserting}}`. The id is permanent; the number is not stored anywhere. It
+ * is the rule's position (Roman in `laws/universal.md`, Arabic within its pack), computed here
+ * at render time, so removing or reordering a rule renumbers every heading after it and rewires
+ * nothing: no citation ever named the number.
+ *
+ * WHY CITATIONS RENDER AS THE NAME, NOT THE NUMBER. A citation is the one place a number would
+ * leak into text that outlives the build — an agent reads "Law III", writes "Law III" into its
+ * memory, and the memory is wrong the day the canon moves. The rendered harness models what it
+ * asks of the agent: a rule is cited by its principle, in English, identical in every voice. The
+ * number survives only where it is structural — the rule's own heading.
+ *
+ * Retired ids live in `RETIRED_RULE_IDS` so the doctor can refuse their reuse: an id that meant
+ * one thing in someone's notes must never come back meaning another.
+ */
+const DECL_RE = /^### \{\{(LAW|DOCTRINE):([a-z0-9]+(?:-[a-z0-9]+)*)\}\}[ \t]+(\S[^\n]*?)[ \t]*$/gm;
+const CITE_RE = /\{\{(LAW|DOCTRINE):([a-z0-9-]+)\}\}/g;
+export const RULE_ID_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+
+/**
+ * Ids that no longer name a live rule, and must never be declared again. `liveAs` names the one
+ * tier that may still declare it — `external-gate` was Law IX before it became a rigor rule, so
+ * the doctrine keeps it and `{{LAW:external-gate}}` is refused; `null` means gone for good.
+ */
+export const RETIRED_RULE_IDS = {
+  'external-gate': { was: 'Law IX', liveAs: 'DOCTRINE', note: 'moved to the rigor pack' },
+  'absence-is-a-claim': { was: 'Law XI', liveAs: null, note: 'folded into verify-before-asserting' },
+};
+
+const ROMAN = [[1000, 'M'], [900, 'CM'], [500, 'D'], [400, 'CD'], [100, 'C'], [90, 'XC'],
+  [50, 'L'], [40, 'XL'], [10, 'X'], [9, 'IX'], [5, 'V'], [4, 'IV'], [1, 'I']];
+export function toRoman(n) {
+  let out = '';
+  for (const [v, r] of ROMAN) while (n >= v) { out += r; n -= v; }
+  return out;
+}
+
+/** `sealed-secrets` -> `LEX_SEALED_SECRETS`; a doctrine rule's title key is `DOC_<ID>`. */
+export const titleKey = (kind, id) =>
+  `${kind === 'LAW' ? 'LEX' : 'DOC'}_${id.toUpperCase().replaceAll('-', '_')}`;
+
+/** The files that may declare rules, in canon order: `[kind, pack|null, file]`. */
+export function canonFiles(src = SRC) {
+  return [['LAW', null, path.join(src, 'laws', 'universal.md')],
+    ...PACK_ORDER.map((p) => ['DOCTRINE', p, path.join(src, 'doctrines', `${p}.md`)])];
+}
+
+const _canons = new Map();
+/**
+ * Every declared rule, in render order: `{ kind, pack, id, name, n, label }`, where `label` is
+ * the address the heading renders (`III`, `process 5`). Memoised on the raw texts' identity —
+ * `readRawText` hands back the same string until a file's mtime moves.
+ */
+export function ruleCanon(src = SRC) {
+  const files = canonFiles(src);
+  const texts = files.map(([, , f]) => { try { return readRawText(f); } catch { return ''; } });
+  const key = path.resolve(src);
+  const hit = _canons.get(key);
+  if (hit && hit.texts.every((t, i) => t === texts[i])) return hit.canon;
+  const rules = [];
+  files.forEach(([kind, pack], i) => {
+    let n = 0;
+    for (const m of texts[i].matchAll(DECL_RE)) {
+      if (m[1] !== kind) continue;             // a wrong-tier declaration is the doctor's to name
+      n += 1;
+      rules.push({ kind, pack, id: m[2], name: m[3], n, label: kind === 'LAW' ? toRoman(n) : `${pack} ${n}` });
+    }
+  });
+  const byId = new Map();
+  for (const r of rules) if (!byId.has(r.id)) byId.set(r.id, r);
+  const canon = { rules, byId };
+  _canons.set(key, { texts, canon });
+  return canon;
+}
+
+/**
+ * Resolve every declaration and citation in `text` against the canon under `src`. An unknown id
+ * is left exactly as written — visible in the output, and named by the doctor — rather than
+ * guessed at.
+ */
+export function resolveRuleIds(text, src = SRC) {
+  if (!text.includes('{{LAW:') && !text.includes('{{DOCTRINE:')) return text;
+  const { byId } = ruleCanon(src);
+  const known = (kind, id) => { const r = byId.get(id); return r && r.kind === kind ? r : null; };
+  return text
+    .replace(DECL_RE, (whole, kind, id) => {
+      const r = known(kind, id);
+      return r ? `### {{${kind}}} ${r.label} — {{${titleKey(kind, id)}}}` : whole;
+    })
+    .replace(CITE_RE, (whole, kind, id) => { const r = known(kind, id); return r ? `*${r.name}*` : whole; });
+}
+
 /**
  * `_build_core.ROOT` — the checkout, from this file's own location (`js/..`).
  *

package/js/build/stubs.mjs

@@ -137,8 +137,13 @@ the project's own. Follow the root \`AGENTS.md\`.
 /** `_build_render.PROFILE_FILE`. */
 const PROFILE_FILE = 'PROFILE.md';
 
-/** `_build_render.PROFILE_STUB`. */
-const PROFILE_STUB = `\
+/**
+ * `_build_render.PROFILE_STUB`.
+ *
+ * Exported for the web console: `/api/profile` answers `seeded: true` while PROFILE.md is
+ * still byte-for-byte this text, which is how the Overview knows to ask for it to be filled in.
+ */
+export const PROFILE_STUB = `\
 # Your profile
 
 Who you are and how you like to work — so the agent can meet you where you are

package/js/cli-table.json

@@ -54,7 +54,7 @@
     },
     {
       "name": "build",
-      "help": "render src/ -> Harness/",
+      "help": "render the harness (same flags as geneseed-build; an omitted flag takes the generator default, not the install's — see geneseed status --json for an install's own; dry run: geneseed validate)",
       "description": "",
       "positionals": [],
       "options": [
@@ -72,6 +72,141 @@
           "is_flag": false,
           "type": null,
           "hidden": false
+        },
+        {
+          "names": [
+            "--emit"
+          ],
+          "dest": "emit",
+          "metavar": null,
+          "help": "",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": [
+            "--footprint"
+          ],
+          "dest": "footprint",
+          "metavar": null,
+          "help": "",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": [
+            "--posture"
+          ],
+          "dest": "posture",
+          "metavar": null,
+          "help": "",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": [
+            "--mode"
+          ],
+          "dest": "mode",
+          "metavar": null,
+          "help": "",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": [
+            "--doctrines"
+          ],
+          "dest": "doctrines",
+          "metavar": null,
+          "help": "",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": [
+            "--exclude-rules"
+          ],
+          "dest": "exclude_rules",
+          "metavar": null,
+          "help": "",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": [
+            "--out"
+          ],
+          "dest": "out",
+          "metavar": null,
+          "help": "",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": [
+            "--root"
+          ],
+          "dest": "root",
+          "metavar": null,
+          "help": "",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": [
+            "--config-dir"
+          ],
+          "dest": "config_dir",
+          "metavar": null,
+          "help": "the config dir a -global emit writes to (default: the host's resolved one)",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
         }
       ],
       "mutex": []
@@ -353,7 +488,7 @@
     },
     {
       "name": "git-gate",
-      "help": "PreToolUse hook: ASK before a history-discarding git act (Law IV) and before every git commit/push (process 5 backstop)",
+      "help": "PreToolUse hook: ASK before a history-discarding git act (Deletion Is Deliberate) and before every git commit/push (Consent Before Push backstop)",
       "description": "",
       "positionals": [],
       "options": [
@@ -393,7 +528,7 @@
           ],
           "dest": "no_consent",
           "metavar": null,
-          "help": "skip the process-5 commit/push ask (set by the emit when the process pack or process 5 is off); Law IV still asks",
+          "help": "skip the Consent Before Push commit/push ask (set by the emit when the process pack or that rule is off); Deletion Is Deliberate still asks",
           "choices": null,
           "default": false,
           "required": false,
@@ -631,7 +766,7 @@
     },
     {
       "name": "rule-gate",
-      "help": "PreToolUse hook: force an ASK before any write to user-rules.md or memory (process 1 backstop)",
+      "help": "PreToolUse hook: force an ASK before any write to user-rules.md or memory (Persist Insight backstop)",
       "description": "",
       "positionals": [],
       "options": [
@@ -681,7 +816,21 @@
       "help": "print the install dashboard as text (theme, mode, counts, memory, version)",
       "description": "",
       "positionals": [],
-      "options": [],
+      "options": [
+        {
+          "names": ["--json"],
+          "dest": "json",
+          "metavar": null,
+          "help": "print the status payload as JSON — every install with its settings and the geneseed build command that rebuilds it",
+          "choices": null,
+          "default": false,
+          "required": false,
+          "nargs": "0",
+          "is_flag": true,
+          "type": null,
+          "hidden": false
+        }
+      ],
       "mutex": []
     },
     {

package/js/hosts/hooks.mjs

@@ -700,14 +700,14 @@ function gitDecide(args, payload) {
   const command = ((payload && payload.tool_input) || {}).command;
   if (typeof command !== 'string') return 0;
   if (DESTRUCTIVE_GIT_RE.test(command)) {
-    return ask(args, 'git-gate', 'law-4', 'Geneseed Law IV \u2014 a history-rewriting or '
+    return ask(args, 'git-gate', 'law-4', 'Geneseed (Deletion Is Deliberate) \u2014 a history-rewriting or '
       + 'discarding git act needs confirmation bound to this specific command');
   }
   // `--no-consent`: the process pack (or process 5 alone) is off, so the commit/push ask has
   // no rule behind it — but Law IV above is universal and has already run.
   if (args.noConsent || !GIT_GATE_RE.test(command)) return 0;
-  return ask(args, 'git-gate', 'process-5', 'Geneseed Doctrine process 5 \u2014 every git '
-    + 'commit/push needs explicit approval');
+  return ask(args, 'git-gate', 'process-5', 'Geneseed (Consent Before Push) \u2014 every git '
+    + 'commit/push needs explicit approval; to see the change first, use the explain-changes skill');
 }
 export const cmdGitGate = guardGate(gitGate, 'git-gate');
 
@@ -764,13 +764,13 @@ function ruleDecide(args, payload) {
   const body = [ti.content, ti.new_string, ti.file_text, ti.new_str]
     .find((v) => typeof v === 'string') || '';
   if (body && !DOTENV_RE.test(p) && SECRET_RE.test(body)) {
-    return ask(args, 'rule-gate', 'law-1', `Geneseed Law I — ${p} would carry a `
+    return ask(args, 'rule-gate', 'law-1', `Geneseed (Sealed Secrets) — ${p} would carry a `
       + 'credential-shaped string. Secrets live in .env or a secret manager, never in a '
       + 'tracked file.');
   }
   const target = ruleGateTarget(p, args.root);
   if (!target) return 0;
-  return ask(args, 'rule-gate', 'process-1', `Geneseed Doctrine process 1 \u2014 writing to `
+  return ask(args, 'rule-gate', 'process-1', `Geneseed (Persist Insight) \u2014 writing to `
     + `${target}: a standing rule, or a fact to remember? That choice is the user's. Run the `
     + 'rule skill first.');
 }

package/js/hosts/native.mjs

@@ -34,7 +34,7 @@ import { writeText, copyFile, readText } from '../lib/fs.mjs';
 import { jsonDumps, parseJson, formatValue, formatRepr, isTruthy, isDict } from '../lib/json.mjs';
 
 /** Mirrors `_build_core.VENDORED_SKILL_DIRS`. */
-export const VENDORED_SKILL_DIRS = new Set(['react-view-transitions', 'daydream', 'token-report']);
+export const VENDORED_SKILL_DIRS = new Set(['react-view-transitions', 'daydream', 'token-report', 'explain-changes']);
 
 /**
  * `PurePath(rel).parts` — split on EITHER separator, empties dropped.