geneseed 3.8.0 → 3.9.0

package/CHANGELOG.md

@@ -10,6 +10,45 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
 _Nothing yet._
 
+## [3.9.0] — 2026-09-30
+
+**Upgrading:** re-emit after installing. Laws IX and XI are gone and Echo the Intent is now
+**Law IX**: a note, memory or commit that says "Law IX" or "Law XI" from before this release
+means the retired External Gate (now a rigor rule) or Absence Is a Claim (folded into Verify
+Before Asserting). Nothing in the harness cites a rule by number any more.
+
+### Changed
+- **Stable rule ids.** Every law and doctrine rule is declared by a permanent id on its heading
+  (`### {{LAW:verify-before-asserting}} Verify Before Asserting`) and cited by it. The number is
+  the rule's position, computed at render time, so removing or reordering a rule rewires no
+  citation. Theme title keys are keyed by id too (`LEX_VERIFY_BEFORE_ASSERTING`,
+  `DOC_CONSENT_BEFORE_PUSH`), so a renumber never touches a theme.
+- **Citations render as principle names.** Every cross-reference in AGENT.md, the laws, the
+  doctrines, skills and agents now reads *Verify Before Asserting* rather than "Rule III" — the
+  same in every voice. The hook and guard-plugin messages name the principle too. Numbers remain
+  only on each rule's own heading.
+- The memory section of AGENT.md (always on, both footprints) tells the agent to cite a rule by
+  its principle, never its number, in anything that outlives the session.
+- **Web console redesign (Slate + Graphite).** New Overview (health, three charts, what needs
+  you), Constitution, Library, Personal and Installs pages; global and per-project installs are
+  shown apart; skill types head the Library as a full-width banner (#162). The console's flavours
+  are cut to Cultivar, Operator, Matrix and Atlas (#161). The Overview view choice now lives only
+  in the Appearance palette, not in the page header.
+
+### Removed
+- Laws IX (External Gate, a rigor rule since 3.x) and XI (Absence Is a Claim, folded into Law III),
+  both retired in place until now. Their ids are recorded in `RETIRED_RULE_IDS` and can never be
+  reused.
+
+### Added
+- **`explain-changes` folder skill — a visual walkthrough of a diff before it is committed**:
+  the agent writes a short brief (intent, risks, logical units) and
+  `scripts/render_changes.mjs` renders one offline HTML page with the exact git diff side by
+  side, then opens it. Offered by the `commit` skill and the git-gate prompt; never a gate.
+- `doctor` refuses a citation by number, an unknown id, a duplicate id, a rule heading with no id,
+  a retired id declared again, a console `LAW_META`/`DOCTRINE_META` row pinned to a different rule
+  than its number now holds, and a hook-gated rule moving away from the address its hook keys.
+
 ## [3.8.0] — 2026-09-30
 
 **Upgrading:** re-emit (or `geneseed rebuild-all`) after installing, so each install carries the

package/DESIGN.md

@@ -44,7 +44,7 @@ vault or a specific tool's hooks.
      and the prose words the docs use: the core nouns `LAW(S)`/`DOCTRINE(S)`/`ONTOLOGY`/
      `AGENT(S)`/`SKILL(S)`/`MEMORY`/`NOTEBOOK`/`VAULT`/`WIKI`, plus `TAGLINE`,
      `LOADED_SIGIL`, `EPI_*`, `BENEDICTION`, `DESC_*`, `ROAST_PERSONA`, the invariant
-     titles `LEX_I`..`LEX_XI`, the 28 doctrine-rule titles `DOC_<PACK>_<n>`, the five pack
+     titles `LEX_<ID>`, the 28 doctrine-rule titles `DOC_<ID>` (keyed by stable rule id), the five pack
      names `PACK_CRAFT`/`PACK_RIGOR`/`PACK_OPS`/`PACK_PROCESS`/`PACK_COMMS`, and the section intros
      `INTRO_*`. Each theme defines its own nouns; **neutral keeps the plain words** (Rule,
      Doctrine, Agent, Skill, Memory, Workspace), so neutral output is unchanged.
@@ -98,11 +98,13 @@ vault or a specific tool's hooks.
      and tier by reversibility; show the real forks), **Conduct** (answer what was asked,
      once). It absorbed the Pact, which is now stated *inside* Telos rather than standing
      as a peer of the rules.
-   - **Invariants** (`src/laws/universal.md`) — *what is never traded*. Eleven numbered
-     Rules, `I`..`XI`, nine in force — IX and XI are retired in place, their numbers kept so
-     existing citations resolve — headed `### {{LAW}} <roman> — {{LEX_<roman>}}`.
+   - **Invariants** (`src/laws/universal.md`) — *what is never traded*. Nine Rules, `I`..`IX`,
+     each declared `### {{LAW:<id>}} <Principle>` with a permanent id; the numeral is its
+     position, computed at render time (the retired IX and XI were removed on 2026-09-30, and
+     Echo the Intent became IX without a single citation changing).
    - **Doctrines** (`src/doctrines/{craft,rigor,ops,process,comms}.md`) — *how work is done
-     here*. Practice rules addressed by pack and number, cited as `Doctrine process 5`.
+     here*. Practice rules addressed by pack and position (`process 5`), declared and cited by
+     id the same way; a citation of any rule renders as its principle's name.
      `PACK_ORDER` (`js/build/source.mjs`) fixes the order craft → rigor → ops → process → comms, which
      is narrative and deliberately not alphabetical.
 
@@ -145,12 +147,12 @@ vault or a specific tool's hooks.
 
    | Satellite | A new invariant | A new doctrine rule | A whole new pack |
    |---|---|---|---|
-   | body | append to `src/laws/universal.md` — never insert; nothing resolves a cross-reference against the canon | append to `src/doctrines/<pack>.md`, `### {{DOCTRINE}} <pack> <n> — {{DOC_<PACK>_<n>}}`; ids must run contiguously from 1 | a new `src/doctrines/<pack>.md` with its `**Name** — lead line` |
-   | themed title | `LEX_<roman>` in all 15 theme files | `DOC_<PACK>_<n>` in all 15 theme files | `PACK_<NAME>` in all 15, plus each rule's `DOC_*` |
+   | body | `### {{LAW:<id>}} <Principle>` in `src/laws/universal.md`; citations resolve by id, so no position rewires one | `### {{DOCTRINE:<id>}} <Principle>` in `src/doctrines/<pack>.md`; the number is its position | a new `src/doctrines/<pack>.md` with its `**Name** — lead line` |
+   | themed title | `LEX_<ID>` in all 15 theme files | `DOC_<ID>` in all 15 theme files | `PACK_<NAME>` in all 15, plus each rule's `DOC_*` |
    | class | `LAW_CLASS` in `js/inspect/inventory.mjs`, one of the six in `LAW_CLASSES` | **none** — a doctrine rule's class *is* its pack, and there is no second taxonomy over it | — |
    | console copy | a `LAW_META` row in `web/src/pages/Laws.jsx` (keyed by arabic number) | a `DOCTRINE_META` row in the same file (keyed `<pack>.<n>`) | one `DOCTRINE_META` row per rule |
    | registration | the numeral is the registration | the number is the registration | the pack name in `PACK_ORDER`, `js/build/source.mjs` |
-   | renumber risk | high — appending is the only safe move | none — packs are numbered independently | none |
+   | renumber risk | none for citations (by id); `LAW_META`/`LAW_CLASS` are number-keyed and doctor-pinned, so append by preference | none for citations; `DOCTRINE_META`, exclusions and hook ledger keys are `<pack>.<n>` — append by preference | none |
    | counts | README badge + the `N universal laws` prose, `SHIPPED.md`'s triple, the web onboarding copy | **none** — the console spends the `N_PACKS` / `N_PACKS_ACTIVE` / `N_DOCTRINE_RULES` count tokens, all computed at request time | none, same reason |
    | changelog | `CHANGELOG.md` | `CHANGELOG.md` | `CHANGELOG.md` |
 
@@ -164,8 +166,9 @@ vault or a specific tool's hooks.
    Almost all of it is gated, across six named checks in `js/inspect/checks-build.mjs` —
    `themeParityProblems` (key parity across the voices), `lawMetaProblems` and
    `doctrineMetaProblems` (the console's Principle column, in both directions),
-   `constitutionProblems` (pack numbering and filing, `LEX_I..LEX_XI` as an *equality*, the
-   `DOC_*` vocabulary, and every `{{DOCTRINE}}` citation in `src/`), and
+   `constitutionProblems` (rule ids declared, unique and never retired, `LEX_*` as an *equality*,
+   the `DOC_*` vocabulary, the hook-gated addresses, and every `{{LAW:…}}`/`{{DOCTRINE:…}}`
+   citation in `src/` — a citation by number is refused), and
    `countTableProblems` / `proseMirrorProblems` (badges and prose). So `geneseed doctor
    --all` is the check; the table above only says what it will ask for. `CHANGELOG.md` has
    no gate and never has.

package/README.md

@@ -10,9 +10,9 @@
 [![Node >= 22.3](https://img.shields.io/badge/node-%3E%3D22.3-5fa04e)](package.json)
 [![zero dependencies](https://img.shields.io/badge/deps-zero-success)](package.json)
 [![Themes](https://img.shields.io/badge/themes-14-9cf)](themes/)
-[![Skills](https://img.shields.io/badge/skills-52-blueviolet)](src/skills/)
+[![Skills](https://img.shields.io/badge/skills-53-blueviolet)](src/skills/)
 [![Agents](https://img.shields.io/badge/agents-18-orange)](src/agents/)
-[![Laws](https://img.shields.io/badge/laws-11-critical)](src/laws/universal.md)
+[![Laws](https://img.shields.io/badge/laws-9-critical)](src/laws/universal.md)
 [![Plugins](https://img.shields.io/badge/plugins-7-teal)](adapters/opencode/plugins/)
 [![OpenCode · Claude Code · Bob · Copilot · OpenClaude · AGENT.md](https://img.shields.io/badge/works%20with-OpenCode%20·%20Claude%20Code%20·%20Bob%20·%20Copilot%20·%20OpenClaude%20·%20AGENT.md-1f6feb)](#-supported-harnesses)
 
@@ -163,10 +163,10 @@ The harness ships as a small set of layers, and the web console's rail is the sa
 | Layer | What it is |
 | --- | --- |
 | **🧭 Ethos** (`ontology/`) | the mind the rules govern, in four prose sections — **Telos** (the Pact: three ranked laws — protect the user, serve their intent, keep your own honesty), **Evidence** (every claim graded by how it was obtained), **Decisions** (classify and tier by reversibility, show the real forks), **Conduct** (answer what was asked, once). Always in force, never toggleable |
-| **🛡️ Rules** (`laws/`) | 11 universal laws, nine of them in force — always, never toggleable: sealed-secrets, one-intent-one-act, verify-before-assert, deletion-is-deliberate, surface-failures, data-not-orders, least-privilege, root-cause, echo-the-intent. Laws IX and XI are retired, their numbers kept so old references resolve |
+| **🛡️ Rules** (`laws/`) | 9 universal laws — always in force, never toggleable: sealed-secrets, one-intent-one-act, verify-before-asserting, deletion-is-deliberate, surface-failures, data-not-orders, least-privilege, cure-the-cause, echo-the-intent. Each rule has a permanent id; its number is only its position, and the harness cites rules by name |
 | **📐 Doctrines** (`doctrines/`) | practice packs, chosen per install at build time: **craft** (how code is written), **rigor** (how work is proven), **ops** (how the machine is operated), **process** (how a task is run), **comms** (how answers are presented). A doctrine rule may tighten a Rule, never repeal one, and the user's own `user-rules.md` outranks it. Pick with `geneseed-build --doctrines craft,rigor` (or `none`), a single rule with `--exclude-rules "process 7"`, in the setup wizard, or through the switches on the console's Constitution page; all five pack files ship on disk either way, so a citation into a pack you left out still resolves |
 | **🤖 Agents** (18) | capability specialists: `reviewer`, `tester`, `architect`, `docs`, `security`, `explorer`, `researcher`, `developer` — plus a debate **council** the `council` skill convenes: `advocate`, `skeptic`, `pragmatist`, `steward`, `visionary`, `user-advocate`, `framer`, `empiricist`, `operator`, `historian` |
-| **🛠 Skills** (52) | repeatable workflows: brainstorm · plan · **codebase-design** · **domain-modeling** · **wayfinder** · **tickets** · **develop** · **worktree** · debug · **prototype** · refactor · **ponytail** · **forge-mcp** · **bruno-collection-generator** · **bruno-test-writer** · geneseed-code-review · **fresh-eyes** · **security-audit** · **ci-fix** · **deps-audit** · **review-response** · commit · **ship** · **release** · **migrate** · **git-archaeology** · **git-rescue** · repo-map · document-project · **frontend-design** · **prose** · **ingest** · **research** · **teach** · **quiz** · handoff · roast-me · **council** · parallel-agents · **workflow** · **wiki** · **geneseed** · **rule** · **profile** · **consolidate-memory** · **skill-forge** · **opencode-theme** · **herdr** · **pipeline** · **daydream** · **react-view-transitions** · **token-report** |
+| **🛠 Skills** (53) | repeatable workflows: brainstorm · plan · **codebase-design** · **domain-modeling** · **wayfinder** · **tickets** · **develop** · **worktree** · debug · **prototype** · refactor · **ponytail** · **forge-mcp** · **bruno-collection-generator** · **bruno-test-writer** · geneseed-code-review · **fresh-eyes** · **security-audit** · **ci-fix** · **deps-audit** · **review-response** · commit · **ship** · **release** · **migrate** · **git-archaeology** · **git-rescue** · repo-map · document-project · **frontend-design** · **prose** · **ingest** · **research** · **teach** · **quiz** · handoff · roast-me · **council** · parallel-agents · **workflow** · **wiki** · **geneseed** · **rule** · **profile** · **consolidate-memory** · **skill-forge** · **opencode-theme** · **herdr** · **pipeline** · **daydream** · **react-view-transitions** · **token-report** · **explain-changes** |
 | **🔌 Plugins** (OpenCode) | `geneseed-context` injects project docs *and your machine wiki* every session (and across compaction); `geneseed-learn` distils memory at session end; `geneseed-guard` enforces the safety Laws and protected wiki folders at the tool boundary; `geneseed-workflow` registers the `workflow` tool that runs saved orchestration scripts; `geneseed-notify` sends a native OS notification when a long run finishes; `geneseed-ponytail` holds a minimal-code mode (`/ponytail lite\|full\|ultra\|off`), opt-in, injecting the laziest-that-works ruleset every turn so it doesn't drift; `geneseed-activity` streams what each session is doing to the web console's Activity view |
 | **🧠 Memory** (`memory/`) | one-fact-per-file durable knowledge, indexed by `MEMORY.md` (git-ignored, personal) |
 | **📓 Notebook** (`notebook/`) | the agent's sovereign space — any medium (code, tools, data, notes), self-ruled via a seed-once charter, always git-ignored; only its `.gitignore` is build-asserted |

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical references, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **3.8.0**.
+> string. Current label: **3.9.0**.
 
 ## Capabilities
 
@@ -29,8 +29,8 @@ Every row below is present in the tree today; "Spec" names the design record.
 | Capability | What it is | Spec |
 | --- | --- | --- |
 | **Themed generator** | One neutral `src/` → 14 themed bundles via `geneseed-build` (zero dependencies); structure stays theme-independent | [DESIGN.md](DESIGN.md) |
-| **Laws / Agents / Skills / Memory / Notebook** | 11 laws, 18 agents, 52 skills, the memory convention, and the agent's sovereign notebook | `2026-06-11-notebook-sovereign-space` · `2026-06-10-notebook-agent-own-space` |
-| **Three-tier constitution** | The governance surface splits into an always-on **Ontology** (Telos, Evidence, Decisions, Conduct — the Pact absorbed into Telos), the eleven always-on **Invariants** (IX and XI retired in place — folded into rigor 5 and Law III, numbers kept), and five toggleable **Doctrine** packs (craft, rigor, ops, process, comms) addressed `<pack> <n>`. Packs are chosen at build time with `--doctrines` or the setup wizard; the whole catalogue ships on disk either way, so a citation into an inactive pack still resolves. Precedence, in order: Ontology + Invariants, then the user's `user-rules.md`, then the active Doctrines, then `PROFILE.md`. `doctor`'s `constitutionProblems` gates pack numbering, the per-rule Principle column, every `{{DOCTRINE}}` citation in `src/`, and the rule that an always-on tier may never cite a toggleable one | `2026-08-19-three-tier-constitution-design` |
+| **Laws / Agents / Skills / Memory / Notebook** | 9 laws, 18 agents, 53 skills, the memory convention, and the agent's sovereign notebook | `2026-06-11-notebook-sovereign-space` · `2026-06-10-notebook-agent-own-space` |
+| **Three-tier constitution** | The governance surface splits into an always-on **Ontology** (Telos, Evidence, Decisions, Conduct — the Pact absorbed into Telos), the nine always-on **Invariants**, and five toggleable **Doctrine** packs (craft, rigor, ops, process, comms) addressed `<pack> <n>`. Every rule carries a permanent id; its number is its position, computed at render time, and a citation renders as the rule's principle name. Packs are chosen at build time with `--doctrines` or the setup wizard; the whole catalogue ships on disk either way, so a citation into an inactive pack still resolves. Precedence, in order: Ontology + Invariants, then the user's `user-rules.md`, then the active Doctrines, then `PROFILE.md`. `doctor`'s `constitutionProblems` gates rule ids (declared, unique, never a retired one), the per-rule Principle column, every `{{LAW:<id>}}` / `{{DOCTRINE:<id>}}` citation in `src/`, and the rule that an always-on tier may never cite a toggleable one | `2026-08-19-three-tier-constitution-design` |
 | **`doctor`** | One check: unresolved tokens, dead/non-hermetic links, theme-key parity, authoring gates, rendered-bundle drift | `2026-06-07-theme-aware-doctor-diff` |
 | **`diff` + improvements export** | Deployed-vs-source drift report; export an `improvements.md` back-port | `2026-06-12-improvements-export` |
 | **`status` / `version`** | Headless dashboard + fingerprint verdict (no TUI needed) | `2026-06-07-status-command` · `2026-06-07-version-and-uninstall` |

package/adapters/opencode/GLOBAL-HARNESS-SPEC.md

@@ -276,7 +276,7 @@ It is not one now: the invariants are a closed set of nine, and project-context
 discovery is one of the two old laws absorbed into AGENT.md's own **§9 Context**
 section, which every build carries as prose. Nothing an adapter spec writes is
 added to the invariants. The text below survives as the *instruction* tier behind
-the *injection* tier, and `{{DOCTRINE}} process 4` (Read the Docs First) is its
+the *injection* tier, and `{{DOCTRINE:read-the-docs-first}}` (Read the Docs First) is its
 nearest live citation:
 
 > **Rule (Project Context Discovery).** When project context has not already been

package/adapters/opencode/README.md

@@ -384,7 +384,7 @@ behaviour** — nothing changes the machine's current agent/model unless you opt
   `2026-06-17-opencode-color-themes` spec).
 - **Runtime guard plugin** (`geneseed-guard.js`, installed with the others). Enforces
   the safety Laws at the tool boundary: **blocks** writes to private-key/credential
-  files (Law I), catastrophic shell like `rm -rf /` (Law IV), and any mutation under
+  files (Sealed Secrets), catastrophic shell like `rm -rf /` (Deletion Is Deliberate), and any mutation under
   a declared wiki's `protected` folders (AGENT.md §8, from `wiki.jsonc`); **warns** on
   `.env` writes and force-push. `GENESEED_GUARD=off` disables it, `=warn` downgrades
   blocks to warnings. Every **block** appends one line to the install's
@@ -400,7 +400,7 @@ behaviour** — nothing changes the machine's current agent/model unless you opt
 - **Default permissions.** A fresh `opencode.json` gets a minimal policy that **asks**
   before `rm -rf *` and a force-push — those are **Rule IV**'s territory and are in every
   build — and, **on an install that built the `process` pack in**, before every
-  `git commit` and `git push` (the host-level backstop for **Doctrine process 5**: the
+  `git commit` and `git push` (the host-level backstop for **Consent Before Push**: the
   agent never records or shares code unprompted, on any branch). Build with
   `--doctrines` leaving `process` out and those two entries are simply not written.
   The whole block is added only when you have no `permission` key; an existing policy is
@@ -534,7 +534,7 @@ install `jsonc-parser` yourself — you lose OCX's dependency management and
 auto-updates, and you own the upgrade-by-re-copy. Prefer the OCX path.
 
 **Consent note.** `worktree_delete` auto-commits before removal. The harness's
-consent-before-commit rule (**Doctrine process 5**, when the `process` pack is built in)
+consent-before-commit rule (**Consent Before Push**, when the `process` pack is built in)
 is enforced for *shell* `git commit` via `opencode.json`
 permissions, but this plugin commits through its own tool path — so review what it
 will commit before invoking delete, or keep the worktree and commit yourself.

package/adapters/opencode/plugins/geneseed-guard.js

@@ -2,9 +2,9 @@
 //
 // Enforces the safety Laws at the tool boundary (`tool.execute.before`), the same
 // "enforce by injection, don't just instruct" stance as the context plugin:
-//   - Law I  (Sealed Secrets):  block writes to private-key / credential files.
-//   - Law IV (Deletion Is Deliberate):  block catastrophic shell commands.
-//   - Doctrine process 1 (rule vs memory):  speed-bump the first write to user-rules.md
+//   - Sealed Secrets:  block writes to private-key / credential files.
+//   - Deletion Is Deliberate:  block catastrophic shell commands.
+//   - Persist Insight (rule vs memory):  speed-bump the first write to user-rules.md
 //     memory file — that choice belongs to the user, via the rule skill.
 //   - Wiki (AGENT.md §8):  block mutations under a declared wiki's `protected`
 //     folders — the user's knowledge base sets its own no-go zones in wiki.jsonc.
@@ -238,7 +238,7 @@ async function protectedPrefixes() {
   return prefixes
 }
 
-// ---- the rule / memory stores (Doctrine process 1) -----------------------------
+// ---- the rule / memory stores (Persist Insight) --------------------------------
 // Whether something the user wants kept is a standing rule or a durable fact is THEIR
 // call, settled through the rule skill. `tool.execute.before` can only allow or throw —
 // it has no "ask the user" tier like the Claude/Bob rule-gate hook —
@@ -285,13 +285,13 @@ export const GeneseedGuard = async () => {
       try {
         if (hasAny(tool, WRITE_TOOLS)) {
           const p = pickPath(args)
-          if (p && SECRET_RE.some((re) => re.test(p))) { await deny(`write to secret/key file ${p} (Law I)`, "law-1"); return }
-          if (p && SECRET_WARN_RE.some((re) => re.test(p))) log(`WARN: writing ${p} — keep secrets out of tracked files (Law I)`)
+          if (p && SECRET_RE.some((re) => re.test(p))) { await deny(`write to secret/key file ${p} (Sealed Secrets)`, "law-1"); return }
+          if (p && SECRET_WARN_RE.some((re) => re.test(p))) log(`WARN: writing ${p} — keep secrets out of tracked files (Sealed Secrets)`)
           const store = p && ruleStoreTarget(p)
           if (store && !RULE_STORE_BUMPED.has(p)) {
             RULE_STORE_BUMPED.add(p)
             await deny(`writing to ${store} — a standing rule, or a fact to remember? That ` +
-                 `choice is the user's (Doctrine process 1). Settle it through the rule skill, ` +
+                 `choice is the user's (Persist Insight). Settle it through the rule skill, ` +
                  `then re-issue this write`, "process-1")
             return
           }
@@ -309,8 +309,8 @@ export const GeneseedGuard = async () => {
         // classes, and the shell check must still run after the write check.
         if (hasAny(tool, SHELL_TOOLS)) {
           const c = pickCommand(args)
-          if (c && SHELL_BLOCK_RE.some((re) => re.test(c))) { await deny(`catastrophic command (Law IV): ${c.slice(0, 80)}`, "law-4"); return }
-          if (c && SHELL_WARN_RE.some((re) => re.test(c))) log(`WARN: irreversible op — confirm intent (Law IV): ${c.slice(0, 80)}`)
+          if (c && SHELL_BLOCK_RE.some((re) => re.test(c))) { await deny(`catastrophic command (Deletion Is Deliberate): ${c.slice(0, 80)}`, "law-4"); return }
+          if (c && SHELL_WARN_RE.some((re) => re.test(c))) log(`WARN: irreversible op — confirm intent (Deletion Is Deliberate): ${c.slice(0, 80)}`)
         }
       } catch (err) {
         // Our own deny must propagate; any inspection error must never break a tool call.

package/adapters/opencode/plugins/geneseed-workflow.js

@@ -89,7 +89,7 @@ function summarize(name, result, stats, tracePath) {
 }
 
 // Kept worktrees are work awaiting review, and an overlap is a conflict awaiting ONE
-// merger (process 7) — both are said out loud, never left for the trace to hold.
+// merger (One Writer Per File) — both are said out loud, never left for the trace to hold.
 function isolationReport(stats) {
   const kept = stats.worktrees || []
   if (!kept.length) return ""

package/adapters/opencode/workflows/_runtime.js

@@ -182,8 +182,8 @@ async function runChildSession(client, { prompt, agent, model, title, directory
 
 // ---- worktree isolation ------------------------------------------------------
 // `agent(prompt, { isolation: "worktree" })` — the same option Claude Code's Workflow
-// takes. Parallel editors in one tree lose each other's writes (process 7, one writer per
-// file), so each isolated agent gets its own branch + worktree off the root's HEAD, and
+// takes. Parallel editors in one tree lose each other's writes (One Writer Per File),
+// so each isolated agent gets its own branch + worktree off the root's HEAD, and
 // the files it changed are recorded for `overlaps()`. A worktree with no change is
 // removed with its branch; one with changes is KEPT for the parent to review and merge —
 // the runtime never merges, commits, or deletes work. `git(argv, cwd)` is injected by the

package/adapters/opencode/workflows/dispatch.js

@@ -3,7 +3,7 @@
 //
 // The model-driven fallback is the parallel-agents skill; this runs the same
 // shape on rails: the script, not the model, enforces routing and the handoff
-// envelope (context in, output contract back, no commits — Doctrine process 5 stays with
+// envelope (context in, output contract back, no commits — Consent Before Push stays with
 // the caller).
 //
 // args: { goal: string, context?: string, agents?: string[] }

package/docs/extending.md

@@ -155,36 +155,43 @@ Notes that matter:
 
 ## 2 — Changing the constitution
 
-Three tiers, four different costs. The addresses are `{{LAW}} <roman>` for an invariant and
-`{{DOCTRINE}} <pack> <n>` for a doctrine rule; the ontology is cited by section name and adding a
-section to it is not a checklist, it is a design change.
+Three tiers, four different costs. Every law and doctrine rule has a **permanent id** — kebab-case,
+derived from its English principle when it is created (`verify-before-asserting`,
+`consent-before-push`) — declared by its heading, `### {{LAW:<id>}} <Principle Name>` or
+`### {{DOCTRINE:<id>}} <Principle Name>`, and cited by it: `{{LAW:<id>}}`, `{{DOCTRINE:<id>}}`.
+**The number is not stored anywhere.** `ruleCanon` in `js/build/source.mjs` computes it from the
+rule's position (Roman in `laws/universal.md`, Arabic within its pack) at render time; the heading
+renders `Rule III — <themed title>` and a citation renders as the principle's name, in italics,
+identical in every voice — the same string an agent is told to write into its memory. So adding,
+removing or reordering a rule rewires nothing. `constitutionProblems` refuses a citation by number,
+an unknown id, a duplicate id, a heading with no id, and a retired id declared again. The ontology is
+cited by section name, and adding a section to it is not a checklist, it is a design change.
 
 To count the cross-references either tier already carries, from the repo root:
 
 ```bash
-grep -rhoE "\{\{LAW\}\} [IVXL]+" src/ | wc -l
-grep -rhoE "\{\{DOCTRINE\}\} [a-z]+ [0-9]+" src/ | wc -l
+grep -rhoE "\{\{LAW:[a-z0-9-]+\}\}" src/ | wc -l
+grep -rhoE "\{\{DOCTRINE:[a-z0-9-]+\}\}" src/ | wc -l
 ```
 
-On this checkout that reports 153 and 209. Both numbers move on every wave of editing, which is
-why the commands are here and the answers are not load-bearing.
+Both numbers move on every wave of editing, which is why the commands are here and the answers are
+not.
 
 ### 2a — Adding a DOCTRINE RULE (the common case)
 
 Five files, plus the written-out rule totals in four test files. This is the slot most new
 material belongs in, and it is cheap on purpose so that the invariant slot stays scarce.
 
-1. `src/doctrines/<pack>.md` — **append** `### {{DOCTRINE}} <pack> <n> — {{DOC_<PACK>_<n>}}` plus
-   the body, wrapped in a `LEAN` block with **both halves authored** — the heading stays outside the
-   block, the full text goes in `LEAN:begin`, and the lean half is the rule *and its mechanism*, no
-   maxims (the style rule is in `src/doctrines/README.md`, and `leanBlockProblems` refuses a rule
-   with no block or an empty half). Two gates in `constitutionProblems`
-   (`js/inspect/checks-authoring.mjs`) sit on this too: the pack named in
-   the *heading* is what addresses the rule (not the filename, so a rule filed in the wrong file is
-   reported rather than silently renamed), and ids must run **contiguously from 1**, so appending
-   at the end is the only place `n` is free. Packs are numbered independently — nothing outside
-   this file renumbers.
-2. `themes/_TEMPLATE.json` — add `DOC_<PACK>_<n>`. ⚠ **This file *is* gated for this key family.**
+1. `src/doctrines/<pack>.md` — add `### {{DOCTRINE:<new-id>}} <Principle Name>` plus the body,
+   wrapped in a `LEAN` block with **both halves authored** — the heading stays outside the block,
+   the full text goes in `LEAN:begin`, and the lean half is the rule *and its mechanism*, no maxims
+   (the style rule is in `src/doctrines/README.md`, and `leanBlockProblems` refuses a rule with no
+   block or an empty half). The id is kebab-case, unique across laws **and** doctrines, and never
+   one listed in `RETIRED_RULE_IDS` (`js/build/source.mjs`). Where it goes in the file decides its
+   number; appending is still the kind move, because `excludeRules`, `DOCTRINE_META` and the
+   hook-gated addresses are keyed `<pack>.<n>` (see §2e).
+2. `themes/_TEMPLATE.json` — add `DOC_<ID>` (`consent-before-push` → `DOC_CONSENT_BEFORE_PUSH`).
+   ⚠ **This file *is* gated for this key family.**
    `themeFiles()` filters `_`-prefixed names and theme parity never sees the template, but
    `constitutionProblems` reads it alongside the fourteen voices for `DOC_*` and `LEX_*`
    specifically — because it is what `--sync-themes` seeds the *next* voice from. Every other key
@@ -199,7 +206,9 @@ material belongs in, and it is cheap on purpose so that the invariant slot stays
    is one of the two. See §7.2 before you copy a command from anywhere else. Then restyle all
    fourteen by hand: `--sync-themes` writes the template's placeholder and only *prints*
    `RESTYLE these`; a shipped placeholder passes every gate.
-4. `web/src/pages/Laws.jsx` — a `DOCTRINE_META` row keyed `'<pack>.<n>'`. Its first field is the
+4. `web/src/pages/Laws.jsx` — a `DOCTRINE_META` row keyed `'<pack>.<n>'`, whose third field is the
+   rule's id — `doctrineMetaProblems` holds that pin to the canon, so a row left behind by a
+   renumber is a failure rather than a description of the neighbour. Its first field is the
    **pack**, not one of `LAW_CLASSES`' six; `doctrineMetaProblems` requires an *equality* between
    that field and the key's own pack, which catches the copy error a six-way vocabulary cannot — a
    row pasted from the pack above it, keeping the wrong pack. Its second field is the one-line
@@ -213,19 +222,18 @@ material belongs in, and it is cheap on purpose so that the invariant slot stays
   there is no second taxonomy over it.
 - **No count in the product.** No badge, no `SHIPPED.md` triple, no prose mirror. The console spends
   `{N_PACKS}` / `{N_PACKS_ACTIVE}` / `{N_DOCTRINE_RULES}`, all computed at request time.
-- **No renumber risk.** But there *are* written-out rule totals to bump — expected values are
+- **No citation to rewire.** But there *are* written-out rule totals to bump — expected values are
   written out, never recorded — in `tests/unit/emit_smoke.test.mjs`, `harness.test.mjs`,
   `setup.test.mjs` and `web_api.test.mjs`. Each fails loudly with the new count; change the
   number *and* the comment that explains it. A rule in **craft** moves more: `setup` and
   `web_api` also pin the craft-only narrowed counts, `generate.test.mjs` excludes every craft
-  rule by address to empty the pack, and `harness.test.mjs`'s contiguity fixture plants a rule at
-  the first free craft id — the doctrine twin of §2c step 8. Grep `tests/` for the previous
+  rule by address to empty the pack. Grep `tests/` for the previous
   rule's address before trusting this list. A rule long enough to matter can also breach the
   `full` carrier ceiling in `emit_smoke` — raise it with a dated note there, as every earlier
   move did.
 
 ⚠ **Cite only downward.** An always-on tier may never reference a toggleable one:
-`constitutionProblems` refuses a `{{DOCTRINE}}` token anywhere under `src/ontology/` or
+`constitutionProblems` refuses a `{{DOCTRINE:…}}` token anywhere under `src/ontology/` or
 `src/laws/`, because a `--doctrines craft` build would then ship an invariant pointing at text its
 `AGENT.md` does not contain. Doctrine→doctrine citations are fine and stay — every pack file ships
 on disk whether or not it was built in. If the build's own default is narrowed,
@@ -248,26 +256,25 @@ Steps 1 and 9 of §2c, plus `LAW_META` if the Principle line moved. Two cautions
 Nine steps, and only the first is the rule itself. This is the expensive one, and it should be:
 the bar is in `DESIGN.md` Decision 7, and most candidates belong in a doctrine pack instead.
 
-1. `src/laws/universal.md` — **append** `### {{LAW}} <roman> — {{LEX_<roman>}}` plus the body.
-   Never insert: the `{{LAW}}` cross-references counted above live all over `src/`, plus hardcoded
-   citations in `js/hosts/hooks.mjs` and two OpenCode plugins, and **nothing resolves a cross-reference
-   against the canon**. Renumbering silently rewires every one of them.
-2. `themes/_TEMPLATE.json` — add `LEX_<roman>` in template order. Gated, as in §2a step 2:
-   `constitutionProblems` holds `LEX_I..LEX_XI` as an **equality** across all fifteen files (the
-   fourteen voices and the template), so both a missing key *and* a leftover one are reported. That
-   arm exists because the renumber left `LEX_XXII`, `LEX_XXIII`, `LEX_XXIV` and `LEX_XXXVI` behind
-   in every file and parity was silent — they were absent from nowhere.
+1. `src/laws/universal.md` — add `### {{LAW:<new-id>}} <Principle Name>` plus the body. Citations
+   are by id and resolve against the canon, so position is safe to choose — but append unless the
+   order is the point: `LAW_CLASS` and `LAW_META` are keyed by the rendered number (see §2e).
+2. `themes/_TEMPLATE.json` — add `LEX_<ID>` in template order. Gated, as in §2a step 2:
+   `constitutionProblems` holds the `LEX_*` keys as an **equality** with the declared law ids across
+   all fifteen files (the fourteen voices and the template), so both a missing key *and* a leftover
+   one are reported. That arm exists because an old renumber left `LEX_XXII`, `LEX_XXIII`,
+   `LEX_XXIV` and `LEX_XXXVI` behind in every file and parity was silent.
 3. `--sync-themes`, then restyle all fourteen by hand (§2a step 3).
 4. `LAW_CLASS` in `js/inspect/inventory.mjs` — one of the six in `LAW_CLASSES` beside it.
-5. `LAW_META` in `web/src/pages/Laws.jsx` — same class, plus the one-line Principle. Note the map
-   is keyed by **arabic** number where `universal.md` heads with a Roman numeral. **This copy
+5. `LAW_META` in `web/src/pages/Laws.jsx` — same class, the one-line Principle, and the rule's id
+   as the pin. Note the map is keyed by **arabic** number where the heading renders a Roman numeral. **This copy
    exists nowhere else**; a rule absent here renders with a blank description. It is why that one
    React file ships alone out of `web/src` in `package.json` — `doctor` regex-parses its literal.
 6. `README.md` — badge `badge/laws-N` and the `N universal laws` sentence.
 7. `SHIPPED.md` — the `N laws, N agents, N skills` triple.
-8. `tests/unit/harness.test.mjs` — the negative fixture for the `LAW_CLASS` gate plants a rule at
-   the *first free numeral*, which is `XII` now that the invariants are I..XI. Bump it, or it stops
-   being a fixture and starts being a duplicate.
+8. `tests/unit/harness.test.mjs` — the negative fixture for the `LAW_CLASS` gate appends a law and
+   expects the next numeral (`X` while there are nine), and `ROMANS` there and in `emit_smoke`
+   lists the numerals written out. Bump both.
 9. `CHANGELOG.md`, then rebuild and commit `web/dist` (step 5 touched `web/src`).
 
 ⚠ While restyling, `{{LAW}}` must stay a **single word** in every theme (and so must
@@ -288,8 +295,8 @@ the only configuration it can speak for.
 Rare, and mechanical. On top of §2a for each rule the pack carries:
 
 1. `src/doctrines/<pack>.md`, opening with its lead line — `**{{PACK_<NAME>}}** — how … .` A pack
-   file `PACK_ORDER` names but cannot read, or one carrying no `### {{DOCTRINE}} <pack> <n>`
-   heading at all, is a refusal.
+   file `PACK_ORDER` names but cannot read, or one declaring no `### {{DOCTRINE:<id>}}` rule at
+   all, is a refusal.
 2. `PACK_ORDER` in `js/build/source.mjs` — the registration, and the render order. It is **narrative,
    not alphabetical** (craft → rigor → ops → process → comms); discovery sorts alphabetically and the
    renderer refuses a `.md` under `src/doctrines/` that `PACK_ORDER` does not name, rather than
@@ -315,6 +322,31 @@ Rare, and mechanical. On top of §2a for each rule the pack carries:
 
 ---
 
+### 2e — Removing, retiring or reordering a rule
+
+Delete the rule's heading and both LEAN halves, and every rule after it renumbers on the next
+render — no citation moves, because none names a number. Then:
+
+1. `RETIRED_RULE_IDS` in `js/build/source.mjs` — add the id with what it was and where its text
+   went. `constitutionProblems` refuses a retired id declared again, so an id that meant one rule in
+   someone's notes can never come back meaning another. `liveAs` names the one tier that may still
+   declare it (Law IX's `external-gate` lives on as a rigor rule).
+2. Every citation of the removed id — the doctor names each one; point it at the rule that now
+   carries the text.
+3. Its `LEX_<ID>`/`DOC_<ID>` key in all fifteen theme files (the equality arm names each).
+4. The number-keyed tables, which the doctor checks against the canon: `LAW_CLASS`
+   (`js/inspect/inventory.mjs`), `LAW_META`/`DOCTRINE_META` (their id pins fail on every shifted
+   row), and — only if a hook-gated rule moved — `HOOK_PINNED` in `checks-authoring.mjs` names the
+   ledger keys, `CONSENT_RULE` and `HOOK_GATED` to move with it. `--exclude-rules` addresses are
+   `<pack>.<n>` too, and an install that excluded a shifted doctrine rule excludes its neighbour
+   after a re-emit: prefer appending in a pack, and say so in the CHANGELOG when you cannot.
+5. The count mirrors: README badge and prose, `SHIPPED.md`, and the written-out totals in tests.
+
+Laws IX (External Gate) and XI (Absence Is a Claim) were removed this way on 2026-09-30; Echo the
+Intent became IX.
+
+---
+
 ## 3 — Adding a SKILL or an AGENT
 
 **Order matters at the first two steps.** `missingReferencedSpecs` (in `js/build/bundle.mjs`) *aborts the
@@ -574,7 +606,7 @@ only, at best, on its presence.
 |---|---|---|
 | `§N` cross-references into `AGENT.md`'s anatomy | `src/skills/*`, `src/agents/*`, `adapters/**` | **range only.** `constitutionProblems` refuses a `§N` the template declares no section for — which catches a pointer past the end, the shape *removing* a section leaves. It cannot catch one that still resolves and now means something else, which is the shape *inserting* a section leaves, and is what actually happened when `## 2. Doctrines` pushed every later section down one. **Renumbering the anatomy means `grep -rn '§' src/ adapters/` and reading every hit.** Four satellites and a live OpenCode deny message shipped stale because the sweep stopped at `AGENT.md.tmpl` |
 | Per-law Principle lines | `web/src/pages/Laws.jsx` | presence and class only, never accuracy |
-| 588 themed constitution titles (42 keys × 14 voices) — `LEX_I..LEX_XI` (11), `DOC_<PACK>_<n>` (27), `PACK_<NAME>` (4) | `themes/*.json` | key presence only — a shipped placeholder is green. `LEX_*` and `DOC_*` are held across the template too, and in both directions; `PACK_*` only across the voices |
+| 588 themed constitution titles (42 keys × 14 voices) — `LEX_<ID>` (one per law), `DOC_<ID>` (one per doctrine rule), `PACK_<NAME>` | `themes/*.json` | key presence only — a shipped placeholder is green. `LEX_*` and `DOC_*` are held across the template too, and in both directions; `PACK_*` only across the voices |
 | The README keyword enumerations | `README.md`, `docs/web/rules.md` | nothing |
 | The plugin capability enumeration | `docs/web/model.md` | nothing (the number substitutes; the list does not) |
 | Section labels and page subtitles | `web/src/lib/sections.js`, `web/src/pages/Docs/index.jsx` | nothing |

package/docs/web/harnesses.md

@@ -13,7 +13,7 @@ The harness *content* — the constitution (Ethos, Rules, Doctrines), Agents, Sk
 | Agents · Skills · Memory | ✅ | ✅ | ✅ | ✅ | ✅ |
 | Context injection | ⚙️ plugin | 🪝 hook | 🪝 hook¹ | 📄 preamble | 🪝 hook² |
 | Memory write-back (learn) | ⚙️ plugin | 🪝 hook | 🪝 hook¹ | 📄 preamble | 🪝 hook² |
-| Git-gate consent (Doctrine process 5) | ⚙️ plugin | 🪝 hook | 🪝 hook¹ | 📄 preamble | 🪝 hook² |
+| Git-gate consent (Consent Before Push) | ⚙️ plugin | 🪝 hook | 🪝 hook¹ | 📄 preamble | 🪝 hook² |
 | Sovereign-repo excludes | ⚙️ plugin | ✅ | ✅ | ➖ | ✅ |
 | MCP server wiring | ✅ | ✅ | ✅ | ✅ | ✅ |
 | Colour themes | ✅ | ➖ | ➖ | ➖ | ➖ |
@@ -21,7 +21,7 @@ The harness *content* — the constitution (Ethos, Rules, Doctrines), Agents, Sk
 
 ✅ native · ⚙️ OpenCode plugin · 🪝 `settings.json` hook · 📄 preamble prose only · ➖ no host mechanism (harness discipline still applies). ¹ Bob honours Claude-dialect hooks best-effort — inert if unsupported, harness still holds via the preamble. ² OpenClaude is a Claude Code fork: Claude's hooks verbatim, under `~/.openclaude` or a repo's `.openclaude/`.
 
-**The git-gate row is the one capability that is not always present**, on any host. It implements **Doctrine process 5**, so it is wired only on an install that built the **process** [doctrine pack](#/docs/setup-choices) in — drop that pack and the boundary drops with it, because a gate that keeps asking for a rule the install never adopted is a gate arguing with its own harness. One asymmetry: on OpenCode that holds for a *fresh* install, but a pack-off rebuild of an install whose `opencode.json` already carries a `git commit*` entry leaves it in place and reports it — Geneseed cannot tell its own entry from one you typed, so it removes neither ([doctrine packs](#/docs/setup-choices)). The invariant-territory refusals in the same neighbourhood (`rm -rf`, a force-push) are the Rules' territory, not the pack's, and stay in every build.
+**The git-gate row is the one capability that is not always present**, on any host. It implements **Consent Before Push** (`process 5`), so it is wired only on an install that built the **process** [doctrine pack](#/docs/setup-choices) in — drop that pack and the boundary drops with it, because a gate that keeps asking for a rule the install never adopted is a gate arguing with its own harness. One asymmetry: on OpenCode that holds for a *fresh* install, but a pack-off rebuild of an install whose `opencode.json` already carries a `git commit*` entry leaves it in place and reports it — Geneseed cannot tell its own entry from one you typed, so it removes neither ([doctrine packs](#/docs/setup-choices)). The invariant-territory refusals in the same neighbourhood (`rm -rf`, a force-push) are the Rules' territory, not the pack's, and stay in every build.
 
 **No host drops an Agent, Skill, or the memory convention.** The asymmetry is otherwise entirely in *automation mechanism*: OpenCode's plugins and Claude/Bob/OpenClaude's hooks enforce a few of these rules for you at the tool boundary, where **Copilot** (no hook mechanism) enforces them through preamble discipline. The OpenCode-only extras (themes, LSP, workflow runner, primary-agent) have no analogue on a Claude-shaped host.
 

package/docs/web/plugin-guard.md

@@ -6,9 +6,9 @@ kind: "concept"
 ---
 Enforces the safety Laws at the tool boundary (`tool.execute.before`) — the same *enforce by injection, don't just instruct* stance as the context plugin. The guard ships whole on every install, whatever [doctrine packs](#/docs/setup-choices) it built in — its blocking arms are **invariant** territory, and the speed-bump below is about which store a note belongs in, which is your call either way. The one boundary that does follow a pack is the commit/push consent gate, and that lives in the permission block rather than here. High-confidence patterns only, so legitimate work is never caught:
 
-- **Blocks** — writes to private-key / credential files (**Law I**), catastrophic shell like `rm -rf /` (**Law IV**), and any mutation under a declared wiki's `protected` folders (AGENT.md §8, from `wiki.jsonc`).
+- **Blocks** — writes to private-key / credential files (**Sealed Secrets**), catastrophic shell like `rm -rf /` (**Deletion Is Deliberate**), and any mutation under a declared wiki's `protected` folders (AGENT.md §8, from `wiki.jsonc`).
 - **Warns** (logged, allowed) — `.env` writes and force-push.
-- **Speed-bumps** — the *first* write to `user-rules.md` or a memory file is refused, naming **Doctrine process 1**: a standing rule or a durable fact is the user's call, settled through the rule skill. A re-issued write goes through, so a legitimate write is never trapped. (On Claude Code and Bob the same guard is a `geneseed-hook rule-gate` hook, which can *ask* the user instead of refusing — OpenCode's `tool.execute.before` has no ask tier.)
+- **Speed-bumps** — the *first* write to `user-rules.md` or a memory file is refused, naming **Persist Insight**: a standing rule or a durable fact is the user's call, settled through the rule skill. A re-issued write goes through, so a legitimate write is never trapped. (On Claude Code and Bob the same guard is a `geneseed-hook rule-gate` hook, which can *ask* the user instead of refusing — OpenCode's `tool.execute.before` has no ask tier.)
 
 ### Install
 

package/docs/web/rules.md

@@ -13,7 +13,7 @@ The agent's standing rules come in **three tiers**, and the tier decides how a r
 
 ### Invariants — always on
 
-{N_LAWS} rules in `src/laws/universal.md`, numbered in Roman from `I`: sealed secrets, one intent per act, verify before asserting, deliberate deletion, surface failures, data not orders, least privilege, cure the cause, and the external gate. They hold in every task and every repository, they are never traded away, and no install can switch one off. Cited by numeral — `Rule IV`.
+{N_LAWS} rules in `src/laws/universal.md`, numbered in Roman from `I`: sealed secrets, one intent per act, verify before asserting, deliberate deletion, surface failures, data not orders, least privilege, cure the cause, and echo the intent. They hold in every task and every repository, they are never traded away, and no install can switch one off. Cited by name — *Deletion Is Deliberate* — never by numeral: the numeral is only the rule's position, and it moves when a rule before it is removed.
 
 ### Doctrines — chosen at build time
 

package/docs/web/themes-author.md

@@ -11,8 +11,8 @@ A theme is one JSON file under `themes/` declaring voice tokens only: `BANNER`,
 
 Every rule in the constitution gets its title from a theme key, and a theme that omits one ships a rule with a blank heading:
 
-- `LEX_I`…`LEX_IX` — one title per invariant. `doctor` holds this to an **equality**, not mere presence: a `LEX_*` outside `I`–`IX` is a title for a rule that does not exist and fails the check too.
-- `DOC_*` — one title per doctrine rule, named after its address (`DOC_CRAFT_1`, `DOC_PROCESS_5`, …). `doctor` reads the pack files under `src/doctrines/` and requires exactly the set they name — a missing one is a blank heading, an extra one is a dead key.
+- `LEX_<ID>` — one title per invariant, keyed by the law's permanent id (`LEX_VERIFY_BEFORE_ASSERTING`), never by its number. `doctor` holds this to an **equality**, not mere presence: a `LEX_*` no law declares is a title for a rule that does not exist and fails the check too.
+- `DOC_<ID>` — one title per doctrine rule, keyed by its id (`DOC_AUTOMATE_REPETITION`, `DOC_CONSENT_BEFORE_PUSH`, …). `doctor` reads the pack files under `src/doctrines/` and requires exactly the set they declare — a missing one is a blank heading, an extra one is a dead key. A title is the rule's heading only: a citation of the rule renders as its English principle name in every voice.
 - `PACK_*` — one name per pack (`PACK_CRAFT`, `PACK_RIGOR`, `PACK_OPS`, `PACK_PROCESS`, `PACK_COMMS`), used for the pack's own sub-heading.
 
 The Ethos section names are **not** theme keys: a citation reads `({{ONTOLOGY}}: {{ONT_TELOS}})`, token on both sides, so heading and reference always move together. They live in the build's fixed structure table and you neither declare nor rename them.

package/docs/web-ui.md

@@ -160,7 +160,7 @@ streams the output of background jobs and keeps their history across reloads.
     global harness goes dormant (hooks stay silent, the global preamble never loads);
     add or remove one here, the web mirror of `harness exclude add|remove|list`.
 - **Settings** (`#/settings`) — a **Console direction** picker (the visual flavour of the
-  console) with a **Dashboard layout** control (Auto follows each theme's designed Status
+  console: Cultivar, Operator, Matrix or Atlas) with a **Dashboard layout** control (Auto follows each theme's designed Status
   lens; Cultivar / Greenhouse / Operator / Journal force one regardless of skin), the
   install snapshot (deployed/target/theme/version/memory store), a Maintenance card (PATH
   link/unlink, uninstall), an offline package download, server controls (Stop), and the

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "3.8.0"
+  "version": "3.9.0"
 }

package/js/README.md

@@ -37,7 +37,7 @@ as a per-host install at project or global scope.
 
 | module | owns |
 |---|---|
-| `source.mjs` | Where the SOURCE is: `ROOT`/`SRC`/`THEMES`/`CONFIG`, `PACK_ORDER`, rule ids, the cfg object |
+| `source.mjs` | Where the SOURCE is: `ROOT`/`SRC`/`THEMES`/`CONFIG`, `PACK_ORDER`, the rule canon (stable ids → positional numbers, citations → names), the cfg object |
 | `render.mjs` | The pure text pipeline: theme load, `INCLUDE` inlining, CATALOG blocks, `{{TOKENS}}`, dest paths |
 | `bundle.mjs` | `build` — render a theme into a bundle dir, plus the source-completeness refusal. Sits UNDER both emits |
 | `emit-claude.mjs` | The Claude/Bob/Copilot/OpenClaude emit — the render half plus the settings + CLAUDE.md managed-block wire |
@@ -182,8 +182,9 @@ and inline lists are held against a surface list written out in
 
 | I want to | open first | then |
 |---|---|---|
-| a doctrine rule | `src/doctrines/<pack>.md` — APPEND, ids run contiguously | `docs/extending.md` §2a — five files, `--sync-themes`, restyle 14 voices by hand. Author BOTH LEAN halves |
-| a law (invariant) | `src/laws/universal.md` — **APPEND, never insert** | `docs/extending.md` §2c. Author both LEAN halves: the lean footprint ships nothing else |
+| a doctrine rule | `src/doctrines/<pack>.md` — `### {{DOCTRINE:<id>}} <Principle>`; the number is its position | `docs/extending.md` §2a — five files, `--sync-themes`, restyle 14 voices by hand. Author BOTH LEAN halves |
+| a law (invariant) | `src/laws/universal.md` — `### {{LAW:<id>}} <Principle>`; cite by id, never by number | `docs/extending.md` §2c. Author both LEAN halves: the lean footprint ships nothing else |
+| to remove or retire a rule | `docs/extending.md` §2e | `RETIRED_RULE_IDS` in `js/build/source.mjs` — a retired id is never reused |
 | a skill or an agent | `src/skills/<name>.md` or `src/agents/<name>.md` | `docs/extending.md` §3 — eight steps. Write the FILE before the table row or the build aborts |
 | a doctor check | `js/inspect/checks-{build,repo,authoring}.mjs` | register with `ran(...)` in `doctor.mjs`, then a PLANTED FAULT in `tests/unit/harness.test.mjs` |
 | a web endpoint | GET → `js/web/api.mjs`; POST → `js/web/actions.mjs` | declare it in `js/web/routes.mjs`; the partition test probes the real handler |