geneseed 4.10.0 → 4.14.0

package/CHANGELOG.md

@@ -8,6 +8,91 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
 ## [Unreleased]
 
+## [4.14.0] — 2026-10-22
+
+Minor: the React kit supports webpack projects as well as Vite.
+
+### Upgrade notes
+- Run `geneseed rebuild-all` to get the new kit text; nothing changes on a machine until something re-emits.
+
+### Changed
+- **The `react` kit supports webpack as well as Vite** (#368). The `react` skill reads the bundler from `package.json` and loads its side file: the new `react/webpack.md` (config, client-side routing with `historyApiFallback` and `publicPath`, `DefinePlugin` env values, a webpack build-failure table) or `react/vite.md`. The kit rules, both agents, the Jest configuration table in `react-testing` and every theme's descriptions now name both bundlers.
+
+## [4.13.0] — 2026-10-21
+
+Minor: sharper ported skills, a wiki that keeps its history, and self-improvement notes that carry their evidence.
+
+### Upgrade notes
+- Run `geneseed rebuild-all` to get the new skill and agent text; nothing changes on a machine until something re-emits. Notes already in `notebook/skill-notes/` and `notebook/agent-notes/` keep working as written; only new lines take the new format.
+
+### Changed
+- **Self-improvement notes carry their evidence and their scope** (#366). A note is now one line, `- [skill|general] <correction> — seen: <what happened, against what was expected> (<date>)`, and an agent's `spec-feedback:` line takes the same shape. `seen:` is what a correction is judged by when `geneseed diff` hands it back for folding into `src/`, and pruning drops the lines without one first. `general` marks a correction that would fix other skills or agents too, so it belongs in a law, doctrine or memory rather than one file. The `geneseed diff` report explains both markers. Agents now share one self-improvement footer (`src/agents/_self-improvement.md`) instead of 29 copies; rendered agents differ only by the new wording.
+- **The wiki writes history, not the present** (#365). Wiki claims are dated, code claims cite `owner/repo@commit`, and a correction supersedes a claim rather than rewriting it. A new report-only lint pass lists contradictions, orphans and overtaken claims without restructuring the wiki. Adapted from mattpocock/skills' chief-of-staff.
+- **The mattpocock ports are sharpened against upstream `5beb35b`** (#365):
+  - `parallel-agents`: each slice branches off the integration tip when it is dispatched and merges the tip back before returning, so a later slice no longer misses its blocker's merged work. A whole-branch review follows.
+  - `codebase-design`: an interface is designed twice, and an ADR is not silently reopened.
+  - `research` and the `researcher` agent: one read in the source that owns a claim stands on its own; any other claim still needs two sources.
+  - `ship`: the docs check moves before the push it gates.
+  - `plan`, `wayfinder`, `prototype`, `develop`, `debug`, `rule`, `brainstorm`, `handoff` and `skill-forge` get smaller fixes: slice sizing, ticket graduation, mocking only at boundaries, checking for an existing guardrail before proposing one, and trigger pruning.
+  - New credits on `parallel-agents`, `skill-forge`, `brainstorm` and `wiki`.
+
+## [4.12.0] — 2026-10-21
+
+Minor: a second opt-in kit, `react`, and the setup wizard asks about each kit on its own.
+
+### Upgrade notes
+- Nothing to rebuild unless you want the new kit. Default installs are unchanged: no kit is on. To turn it on, run `geneseed build --emit <target> --kits react` (or `--kits react,spring-boot` for both), or use **Installs → Kits** in the web console.
+
+### Added
+- **The `react` kit** (#362), for React 18 or 19 apps built with Vite, in TypeScript or JavaScript, tested with Jest and React Testing Library. Skills `react` (with side files for Vite and accessibility) and `react-testing`; agents `react-engineer` and `react-reviewer` (read-only); kit rules, and a banned-API gate that keeps `ReactDOM.render(`, `findDOMNode`, Enzyme, `react-test-renderer` and `@testing-library/react-hooks` out of kit files. Adapted from affaan-m/everything-claude-code (MIT), rewritten and condensed for Vite and Jest, with no Server Components material.
+
+### Changed
+- **The setup wizard asks one yes/no per kit** (#362). A single pick could not turn on two kits at once.
+
+### Repository
+Not in the package; how Geneseed itself is built and checked.
+- CI's golden cells run as two parallel jobs per platform, emit and CLI (#361). On Windows that leg drops from about 7 minutes in sequence to about 4. The unit suite runs at `--test-concurrency=8` on Linux and in the publish job; Windows keeps the default, where the flag bought nothing. If branch protection names the old `node-cells (<os>)` checks, they now report as `node-cells (<os>, emit)` and `node-cells (<os>, cli)`.
+- The unit suite drops three repeated full-cost runs (#363): two update-flow arms use a doctor stand-in (the real rejection and exact rollback stay in `update_git`), the packaging test counts themes in process instead of a second `doctor --all`, and `--no-deletion-gate` replays only the 67 real-loss rows. 151 s to 139 s locally, same 2012 tests.
+
+## [4.11.2] — 2026-10-21
+
+Patch: a clone install on macOS or Linux puts the `geneseed` command on your PATH.
+
+### Upgrade notes
+- Nothing to rebuild. If `geneseed` is not found in a new terminal, run `./geneseed link` from your clone and accept the offer to add `~/.local/bin` to your shell's startup file.
+
+### Fixed
+- **A clone install puts `geneseed` on your PATH on macOS and Linux** (#359). `./install` never linked the command, and `geneseed link` wrote it to `~/.local/bin`, which macOS zsh does not search, so `geneseed` was not found (reported 2026-10). `./install` now runs `link` when `geneseed` is not found yet, and `link` offers, in a terminal, to add the folder to your shell's startup file (`~/.zshrc`, or `~/.bashrc` / `~/.bash_profile` for bash). It appends one marked block, never twice; `geneseed unlink` removes it. Outside a terminal it prints the line to add, as before.
+
+## [4.11.1] — 2026-10-21
+
+Patch: the web console on a machine with only IBM Bob (or any host but OpenCode): it opens on the install you have, the first-deploy form asks a per-repo mode for its folder, and the doctor stops reading a misplaced project install as a broken bundle.
+
+### Upgrade notes
+- Restart the console after updating (`geneseed web restart`) so it serves the rebuilt UI. If a per-repo install landed in `Harness/` inside your Geneseed clone, remove it with `./geneseed uninstall --target Harness --yes`, then delete `Harness/`.
+
+### Fixed
+- **The web console works on a machine without OpenCode** (#357). It always opened on the OpenCode global dir, so with only IBM Bob installed the Overview showed the first-deploy form over a working `~/.bob`, and nothing could re-point it (the harness selector hides itself below two installs). When nothing is deployed where it looks, the console now shows the first active install it finds, a global before a project, and follows a first deploy to where it landed.
+- **The first-deploy form asks a project mode for its folder** (#357). Picking a per-repo mode (`bob`, `claude`, `opencode`, `openclaude`) sent a Build with no folder, so the files landed in `Harness/` inside the Geneseed clone, where the host never looks. The form now asks for the folder (typed or Browse…) and deploys there; Build refuses a per-repo mode it has no folder for; the portable `files` bundle is left to the CLI. To remove an install misplaced this way, run `./geneseed uninstall --target Harness --yes` in the clone, then delete `Harness/`.
+- **The doctor's committed-bundle check no longer reads a Claude, Bob or OpenClaude project install as a broken bundle** (#357). Such a tree has a `.bob/`-style data dir, not the bundle layout, so every file read "missing" (178 lines on the reported machine) and no rebuild could clear them.
+
+## [4.11.0] — 2026-10-21
+
+Minor: the self-improvement loops write to notebook notes instead of the installed skill or agent file, the web console gains a Kits section, and `./install` waits for your answers and finds tools installed for one user.
+
+### Upgrade notes
+- Run `geneseed rebuild-all` once after updating so installed skills, agents and AGENT.md carry the new self-improvement footer. Lessons the loops wrote into installed files before this release are still exported by `upgrade` into `improvements/`, as before.
+
+### Added
+- **Web console: Kits section** (#353). A top-level Kits page between Library and Loops: a list and a detail page per kit (rules, banned APIs, members linked to the Library, upstream pin and compare link, a switch per install that rebuilds through the install job). Installs → Kits shares its staging and Apply control. `GET /api/kits` now carries rules, word budget, banned APIs and credits, and the Library shows a `kit:` badge on kit members.
+
+### Changed
+- **Self-improvement writes to a sidecar, not the skill** (#354). The skill and agent loops used to edit the rendered file in place, which the doctor reported as stale and the next rebuild erased. They now write corrections to `notebook/skill-notes/<name>.md` and `notebook/agent-notes/<name>.md` (seed-once, agent-owned, never overwritten), and read them back before the skill runs or the agent is dispatched. `geneseed diff` lists the notes and `--out` exports them for back-porting into `src/`. AGENT.md names the notes paths, so the carrier ceilings rise by exactly that text (full 62_263, lean 39_156).
+
+### Fixed
+- **Setup's prompts no longer answer themselves in a real terminal** (#356). Reading `process.stdin` puts a terminal's input in non-blocking mode, and the line reader took the resulting `EAGAIN` for end of input: "Continue without one? (y/N)" printed and answered N at once, so `./install` stopped before anyone could type, and every other wizard question silently took its default. The reader now waits for the keypress.
+- **A tool installed for one user is found** (#356). Setup looked only on PATH, so an IBM Bob installed under the user's profile read as missing. It now also checks `~/.local/bin`, `~/bin`, each tool's own installer dir (`~/.opencode/bin`, `~/.claude/local`), the per-user npm prefix on Windows, and Bob's desktop app folder (`%LOCALAPPDATA%\Programs` on Windows, `/Applications` and `~/Applications` on macOS); a tool found there is listed with its path. When nothing is found, setup asks for the tool's path before offering to stop. The double-clickable `install.command` now waits for Enter before its window can close, as `install.cmd` already did.
+
 ## [4.10.0] — 2026-10-20
 
 Minor: opt-in kits (and a first one, `spring-boot`), credits for adapted content, a weekly upstream-drift check, and a web Kits tab.

package/README.md

@@ -157,7 +157,7 @@ geneseed web stop            # stop the daemon
 geneseed web status          # is it running, and where
 ```
 
-The sidebar has six pages: **Overview** (what's deployed, health, recent jobs), **Constitution** (the rules and doctrine switches), **Library** (skills, agents, the wiki), **Personal** (your rules, profile, memory, notebook), **Installs** (hosts, local edits, doctor, server) and **Docs** — this documentation, opening on the Understand track, with a map of what Geneseed put on your machine.
+The sidebar has eight pages: **Overview** (what's deployed, health, recent jobs), **Constitution** (the rules and doctrine switches), **Library** (skills, agents, the wiki), **Kits** (opt-in stack bundles), **Loops** (the loop catalogue), **Personal** (your rules, profile, memory, notebook), **Installs** (hosts, local edits, doctor, server) and **Docs** — this documentation, opening on the Understand track, with a map of what Geneseed put on your machine.
 
 It binds to `127.0.0.1` only and runs entirely offline — no npm needed at runtime; the UI build ships in `web/dist/`. Mutating actions run in the background and report back as toasts (fire-and-notify), guarded by a per-session token so other sites can't trigger them. A global **Spotlight** search in the topbar jumps to any agent, skill, rule, doc, or MCP server. Rebuild the UI after changing anything under `web/src/` with `cd web && npm install && npm run build`. If `web/dist/` is missing (fresh clone, never built), `geneseed web` offers to run that build for you — answer `Y` and it installs, builds, and starts the server; in non-interactive shells it prints the manual recipe instead.
 
@@ -334,7 +334,7 @@ geneseed rebuild-all   # re-render every registered install in its own theme + m
 ./geneseed upgrade     # just the content refresh (remembers theme + emit mode)
 ```
 
-**Local edits survive.** If the agent refined its deployed agent/skill files in place, an upgrade exports that drift to an `improvements/` file inside the install before overwriting. Details: [Upgrade](docs/guides/upgrade.md).
+**Local edits survive.** The self-improvement loops write to notes under `notebook/`, which no rebuild touches. If you or the agent edited deployed agent/skill files in place anyway, an upgrade exports that drift to an `improvements/` file inside the install before overwriting. Details: [Upgrade](docs/guides/upgrade.md).
 
 ## 📚 Documentation
 
@@ -373,12 +373,13 @@ Some skills and agents are adapted from other open-source skill collections, und
 
 - `daydream` — [glebis/claude-skills](https://github.com/glebis/claude-skills) by Gleb Kalinin (MIT): the vendored `daydream` skill.
 - `react-view-transitions` — [vercel-labs/agent-skills](https://github.com/vercel-labs/agent-skills) by Vercel Engineering (MIT): the vendored `react-view-transitions` skill.
-- `mattpocock-skills` — [mattpocock/skills](https://github.com/mattpocock/skills) by Matt Pocock (MIT): the vocabulary and procedures behind codebase-design, wayfinder, prototype, develop, handoff and research, the spec pass of geneseed-code-review, the question rounds of brainstorm, the slicing of plan, and the reproduction step of debug.
+- `mattpocock-skills` — [mattpocock/skills](https://github.com/mattpocock/skills) by Matt Pocock (MIT): the vocabulary and procedures behind codebase-design, wayfinder, prototype, develop, handoff and research, the spec pass of geneseed-code-review, the question rounds and questionnaire of brainstorm, the slicing of plan, the reproduction step of debug, the integration-branch rules of parallel-agents, the trigger-pruning of skill-forge, and the dated-history rule of wiki.
 - `mattpocock-skills-frozen` — [mattpocock/skills](https://github.com/mattpocock/skills) by Matt Pocock (MIT), pinned at 391a2701, the last commit carrying `resolving-merge-conflicts` (deleted upstream since): the merge-conflict step of git-history, from a skill upstream has since deleted, so the weekly drift check skips it.
 - `mattpocock-skills-2509` — [mattpocock/skills](https://github.com/mattpocock/skills) by Matt Pocock (MIT), a second key for the same repo, at the same pin as `mattpocock-skills` today (5beb35b0): the PR body of ship and the guardrail clause of rule.
 - `superpowers` — [obra/superpowers](https://github.com/obra/superpowers) by Jesse Vincent (MIT): the core of debug, the size step and builder check of brainstorm, the plan rules of plan, the reviewer brief behind geneseed-code-review and the reviewer agent, the review-handling steps of review-response, and the ruling format of pipeline and parallel-agents.
 - `vibe-wise` — [nykooi1/vibe-wise](https://github.com/nykooi1/vibe-wise) by Noah Kim (MIT): the state file, levels and checkpoints of learn-mode.
 - `piomin-spring-boot` — [piomin/claude-ai-spring-boot](https://github.com/piomin/claude-ai-spring-boot) by Piotr Mińkowski (Apache-2.0): the Spring Boot kit's skills and agents, rewritten and condensed for Boot 4.
+- `everything-claude-code` — [affaan-m/everything-claude-code](https://github.com/affaan-m/everything-claude-code) by Affaan Mustafa (MIT): the React kit's skills and agents, rewritten and condensed for Vite and Jest.
 
 ## 📄 License
 

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical references, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **4.10.0**.
+> string. Current label: **4.14.0**.
 
 ## Capabilities
 

package/docs/concepts/kits.md

@@ -26,10 +26,22 @@ The first kit is `spring-boot`, for Spring Boot 4 (Spring Framework 7, Java 21+)
 
 The kit is adapted from [piomin/claude-ai-spring-boot](https://github.com/piomin/claude-ai-spring-boot) by Piotr Mińkowski (Apache-2.0), rewritten and condensed for Boot 4. Each of its skill folders ships `LICENSE-piomin-spring-boot.txt`, and each agent carries a credit line.
 
+The second kit is `react`, for React 18 or 19 apps built with Vite or webpack, in TypeScript or JavaScript, tested with Jest and React Testing Library. It adds four members:
+
+| Member | Kind | What it is for |
+|---|---|---|
+| `react` | skill | Components, hooks, state placement, data fetching, TypeScript or JavaScript, React security; side files for Vite and for webpack (config, client-side routing, env variables, build failures), read by whichever the project uses, and accessibility |
+| `react-testing` | skill | Jest and Testing Library: role queries, `userEvent`, MSW network mocks, `jest-axe`, and the Jest configuration a Vite or webpack project needs |
+| `react-engineer` | agent | Implements a React feature, or makes a broken Vite or webpack build or Jest run green |
+| `react-reviewer` | agent | Framework-aware review: hooks, state, data fetching, accessibility, React security, tests |
+
+It is adapted from [affaan-m/everything-claude-code](https://github.com/affaan-m/everything-claude-code) by Affaan Mustafa (MIT), rewritten and condensed for Vite and Jest; the webpack side file is first-party. It has no Server Components material: a client-rendered app has no server render.
+
 ### Switching kits on and off
 
 ```bash
 geneseed build --emit claude-global --kits spring-boot
+geneseed build --emit claude-global --kits react,spring-boot
 geneseed build --emit claude-global --kits none
 ```
 
@@ -37,7 +49,7 @@ geneseed build --emit claude-global --kits none
 
 A build does exactly what its flags say. A plain `build` without `--kits` therefore turns off a kit the install has on. Before it does, it warns: `this install has kit <k>; this build turns it off — pass --kits <k> to keep it`.
 
-The setup wizard asks one question listing the kits, with the install's current kits as the default. It asks it only when at least one kit exists.
+The setup wizard asks one yes/no question per kit, each defaulting to whether the install has that kit on. It asks them only when at least one kit exists.
 
 ### What an install records
 
@@ -47,7 +59,7 @@ An install with a kit on records it in its instructions file, under the skill se
 
 `geneseed status` shows `kits: spring-boot` on the install's row, and `status --json` carries the same list.
 
-In the web console, **Installs → Kits** (`#/installs/kits`) lists every install (disabled ones read-only) with one switch per kit. Toggling stages the set; **Apply** asks for confirmation, then rebuilds that one install with exactly that set as a console job (replace, not replay). Files you edited in a kit that is now off are kept, and the row names them so you can delete them by hand.
+In the web console, **Installs → Kits** (`#/installs/kits`) lists every install (disabled ones read-only) with one switch per kit. Toggling stages the set; **Apply** asks for confirmation, then rebuilds that one install with exactly that set as a console job (replace, not replay). Files you edited in a kit that is now off are kept, and the row names them so you can delete them by hand. The top-level **Kits** page (`#/kits`) lists the kits; a kit's page (`#/kits/<kit>`) shows its rules, banned APIs and upstream credits with the same per-install switch, and the Library tags each member skill or agent with a `kit:` badge.
 
 ### What a kit adds to an install
 

package/docs/concepts/skills.md

@@ -41,7 +41,7 @@ The full list, with each description, is in the catalog.
 
 ### Skills improve themselves
 
-Every skill ends with one beat of reflection: if a step misled or a step was missing, the agent proposes the exact edit to that skill and applies it only with your assent. Most runs end with nothing to change.
+Every skill ends with one beat of reflection: if a step misled or a step was missing, the agent writes the exact correction, with your assent, into that skill's notes file, `notebook/skill-notes/<name>.md`, and reads those notes the next time the skill runs. It never edits the installed skill itself: that file is rendered from `src/`, a rebuild would overwrite the edit, and `doctor` would report it as drift. Agents work the same way through `notebook/agent-notes/`. Each note is one line that carries its evidence, `- [skill|general] <correction> — seen: <what happened, against what was expected> (<date>)`: `seen:` is what you judge the correction by before folding it in, and `general` marks one that belongs in a law, doctrine or memory rather than in that one skill. `geneseed diff` lists the notes so you can fold them back into `src/`. Most runs end with nothing to change.
 
 ### Old names keep working
 

package/docs/extending.md

@@ -513,10 +513,9 @@ enumerates skills would miss it. `src/kits/<kit>/` holds only `rules.md`.
    to a kit member (it would dangle in an install without the kit), and a kit file that links to
    another kit's member. Links run kit → core only. A kit's links to its own members do not
    protect them from `--exclude-skills`; its link to a core skill still protects that skill.
-5. **The setup wizard.** It asks its kits question only when at least one kit exists. The shipped
-   `spring-boot` kit therefore added one answer line to the stdin strings in
-   `tests/unit/wizard.test.mjs`, and the `wizard-no-kit` job holds that the question is skipped on a
-   tree with no kit.
+5. **The setup wizard.** It asks one yes/no per kit, and only when at least one kit exists. Each
+   shipped kit therefore adds one answer line to the stdin strings in `tests/unit/wizard.test.mjs`,
+   and the `wizard-no-kit` job holds that the questions are skipped on a tree with no kit.
 6. **Golden cells**: the matrix (`tests/helpers/matrix/emit.*.json`) carries kit on for `claude` and
    `opencode`, the kit-off baseline (`kits: []`, spelled `--kits none`), and three deletion cells
    (kit on to off). One deletion cell sets `edit` (a map of sandbox path to appended text) so a member

package/docs/guides/run-anywhere.md

@@ -8,7 +8,7 @@ description: "Put the geneseed command on your PATH from a clone."
 ---
 **Installed from npm? You have nothing to do.** `npm install -g geneseed` already puts `geneseed`, `geneseed-build` and `geneseed-hook` on your `PATH`.
 
-From a clone, you call the launcher inside the clone: `./geneseed` (Windows: `.\geneseed.cmd`). To type plain `geneseed` from any folder, link it.
+From a clone, you call the launcher inside the clone: `./geneseed` (Windows: `.\geneseed.cmd`). To type plain `geneseed` from any folder, link it. On macOS and Linux, `./install` does this for you when `geneseed` is not found yet.
 
 ## macOS and Linux
 
@@ -17,7 +17,7 @@ From a clone, you call the launcher inside the clone: `./geneseed` (Windows: `.\
 ./geneseed link /usr/local/bin     # or another bin folder (may ask for sudo)
 ```
 
-`link` writes a small shell launcher that runs this clone by its absolute path. It also tells you whether the target folder is on your `PATH`, and if it is not, the one line to add to your shell profile. Then:
+`link` writes a small shell launcher that runs this clone by its absolute path. If the target folder is not on your `PATH` (macOS zsh does not search `~/.local/bin`), it offers to add it to your shell's startup file: `~/.zshrc` for zsh, `~/.bashrc` for bash on Linux, `~/.bash_profile` for bash on macOS. It appends one marked block, never twice, and `geneseed unlink` removes it. Outside a terminal, or for another shell, it prints the line to add instead. Open a new terminal, then:
 
 ```
 geneseed            # the web console (or the command list), from any folder

package/docs/guides/upgrade.md

@@ -46,7 +46,7 @@ A rebuild only replaces files the install's manifest says Geneseed owns. It leav
 
 ## Local edits, and the improvements file
 
-The agent can refine its own deployed agent and skill files as it works, and so can you. A rebuild would overwrite those edits, so **setup, re-theme and upgrade export them first**. When the files they are about to overwrite differ from a fresh render, the differences are written to a markdown **improvements file** in `improvements/`, inside the install's own folder (for the OpenCode global install, `~/.config/opencode/improvements/`). The manifest does not list that folder, so rebuilds never overwrite it and uninstall never removes it.
+The agent records what it learns about a skill or agent in notes under `notebook/skill-notes/` and `notebook/agent-notes/`, which rebuilds never touch. Edits made to the deployed agent and skill files themselves, by you or by an older harness, are another matter: a rebuild would overwrite those, so **setup, re-theme and upgrade export them first**. When the files they are about to overwrite differ from a fresh render, the differences are written to a markdown **improvements file** in `improvements/`, inside the install's own folder (for the OpenCode global install, `~/.config/opencode/improvements/`). The manifest does not list that folder, so rebuilds never overwrite it and uninstall never removes it.
 
 A rebuild also refuses to overwrite a file you edited. The manifest records a fingerprint of every file Geneseed wrote; when a file no longer matches it, the rebuild leaves it alone and prints `kept your edited <file> — delete it to get Geneseed's copy back`. From then on the file is yours and later rebuilds skip it. A file the new version no longer ships is kept the same way, with `(no longer shipped)`. Line-ending changes from a git checkout do not count as edits. Installs made before fingerprints existed are overwritten as before.
 
@@ -58,7 +58,7 @@ geneseed diff --full                   # with line-level diffs
 geneseed diff --out improvements.md    # write the improvements file
 ```
 
-`diff` compares the global OpenCode install by default. Pass `--target <config dir>` to compare another install. A file you replaced with a link to your own copy (a skill folder junctioned or symlinked elsewhere, say) is listed as `linked`: Geneseed never writes through a link, so it is yours and not drift, and it stays out of the improvements file. The improvements file is self-contained. To make the changes permanent, hand it to an agent in a Geneseed clone and ask it to fold them back into `src/`. Then they survive every future build. The web console's **Changes** page exports the same file.
+`diff` compares the global OpenCode install by default. Pass `--target <config dir>` to compare another install. A file you replaced with a link to your own copy (a skill folder junctioned or symlinked elsewhere, say) is listed as `linked`: Geneseed never writes through a link, so it is yours and not drift, and it stays out of the improvements file. `diff` also lists every non-empty self-improvement note, and `--out` copies them into the improvements file; the upgrade export does not fire on notes alone, since a rebuild cannot lose them. The improvements file is self-contained. To make the changes permanent, hand it to an agent in a Geneseed clone and ask it to fold them back into `src/`. Then they survive every future build. The web console's **Changes** page exports the same file.
 
 ## Moving from a clone to npm
 

package/docs/reference/troubleshoot-install.md

@@ -97,7 +97,7 @@ reports `version "21` or higher.
 .\geneseed.cmd link
 ```
 
-On Windows, `link` writes to `%LOCALAPPDATA%\Geneseed\bin` and adds it to your user PATH — only **new** terminals see it, so close and reopen yours.
+On macOS and Linux, `link` offers to add `~/.local/bin` to your shell's startup file when it is not on your PATH; accept, then open a **new** terminal. On Windows, `link` writes to `%LOCALAPPDATA%\Geneseed\bin` and adds it to your user PATH — only **new** terminals see it, so close and reopen yours.
 
 **Confirm.**
 

package/docs/web-ui.md

@@ -114,6 +114,11 @@ streams the output of background jobs and keeps their history across reloads.
   **Promote to rule** control turns a recurring lesson into a trial rule in
   `user-rules.md` — provenance recorded, the source fact deleted so it isn't loaded
   twice — landing you on the Rules page.
+- **Kits** (`#/kits`, `#/kits/<kit>`) — the list of shipped kits and, per kit, a detail page
+  with its rules, word budget, banned APIs, upstream credits and one switch per install.
+  `GET /api/kits` carries `rules`, `rulesWordBudget`, `banned` and `credits` per kit; the
+  catalog and item endpoints for skills and agents carry `kit` (the owning kit or `null`),
+  which the Library shows as a `kit:` badge.
 - **Loops** (`#/loops`) — the loop catalogue `geneseed loop` runs from, read-only, laid out
   like the Library: a rail of sections (**Templates**, **Bricks**, **Active**, each with its
   count; `#/loops/<section>/<item>` opens an entry), with the selected section's groups
@@ -194,7 +199,7 @@ streams the output of background jobs and keeps their history across reloads.
     card (shown once a global install exists) manages sovereign repos — folders where every
     global harness goes dormant (hooks stay silent, the global preamble never loads);
     add or remove one here, the web mirror of `harness exclude add|remove|list`.
-- **Kits** (`#/installs/kits`) — every install (disabled ones read-only) as a card with one switch per kit.
+- **Kits** (`#/installs/kits`) — every install (disabled ones read-only) as a panel with one switch per kit.
   Toggling only stages the set; **Apply** asks first, then rebuilds that install with
   exactly that set as a console job. Files you edited in a kit that is now off are kept,
   and the row lists them.

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "4.10.0"
+  "version": "4.14.0"
 }

package/js/hosts/link.mjs

@@ -74,6 +74,7 @@
 import {
   chmodSync, existsSync, lstatSync, mkdirSync, readlinkSync, rmSync,
 } from 'node:fs';
+import { isatty } from 'node:tty';
 import { spawnSync } from 'node:child_process';
 import path from 'node:path';
 import os from 'node:os';
@@ -81,12 +82,84 @@ import os from 'node:os';
 import { ROOT } from '../build/source.mjs';
 import { readMaybe } from './installs.mjs';
 import { printOut, printErr, writeText } from '../lib/fs.mjs';
+import { confirm } from '../lib/prompt.mjs';
 import { toPlatformPath, which } from '../lib/paths.mjs';
 
 const IS_WIN = process.platform === 'win32';
 /** What `cmdUnlink` recognises a written Unix launcher by — see `isOurLauncher`. */
 const SHIM_MARKER = 'GENESEED_LINK_SHIM';
 
+/** The lines that open and close the PATH block `link` writes into a shell startup file. */
+const RC_BEGIN = '# >>> geneseed >>> (added by `geneseed link`; `geneseed unlink` removes it)';
+const RC_END = '# <<< geneseed <<<';
+
+/**
+ * The startup file to put the bin dir on PATH in, for this login shell — or null when it is
+ * not one we know how to edit (fish, csh, none), where `link` prints the line instead.
+ *
+ * zsh reads `$ZDOTDIR/.zshrc` (default `~`). bash reads `~/.bashrc` on Linux, but macOS
+ * Terminal opens LOGIN shells, which read `~/.bash_profile` and not `~/.bashrc`. Pure, for the
+ * test: nothing here may touch the real user's files.
+ */
+export function shellRcFile({
+  shell = process.env.SHELL || '', home = os.homedir(), zdotdir = process.env.ZDOTDIR,
+  platform = process.platform,
+} = {}) {
+  const name = path.basename(shell);
+  if (name === 'zsh') return path.join(zdotdir || home, '.zshrc');
+  if (name === 'bash') return path.join(home, platform === 'darwin' ? '.bash_profile' : '.bashrc');
+  return null;
+}
+
+/**
+ * `text` with the PATH block for `dir` appended, or unchanged when a block is already there.
+ *
+ * The dir goes inside double quotes with `\`, `"`, `$` and backtick escaped, so a home path
+ * holding any of them stays one literal word to the shell rather than becoming code.
+ */
+export function withPathBlock(text, dir) {
+  if (text.includes(RC_BEGIN)) return text;
+  const quoted = dir.replace(/[\\"$`]/g, (c) => `\\${c}`);
+  const sep = text === '' || text.endsWith('\n') ? '' : '\n';
+  return `${text}${sep}${RC_BEGIN}\nexport PATH="${quoted}:$PATH"\n${RC_END}\n`;
+}
+
+/** `text` without the PATH block `withPathBlock` wrote; unchanged when there is none. */
+export function withoutPathBlock(text) {
+  const start = text.indexOf(RC_BEGIN);
+  if (start < 0) return text;
+  const end = text.indexOf(RC_END, start);
+  if (end < 0) return text;
+  let stop = end + RC_END.length;
+  if (text[stop] === '\n') stop += 1;
+  return text.slice(0, start) + text.slice(stop);
+}
+
+/**
+ * Put `dir` on PATH for future shells, ASKING first — macOS zsh does not search
+ * `~/.local/bin`, so a linked `geneseed` was not found (reported 2026-10). Only in a terminal:
+ * the web console's button and every test run without one, and get the printed line instead,
+ * so no gate can edit the developer's own startup file. Returns whether it wrote.
+ */
+function offerShellPath(dir) {
+  const rc = shellRcFile();
+  if (!rc || !isatty(0)) return false;
+  const text = readMaybe(rc) ?? '';
+  if (text.includes(RC_BEGIN)) {
+    printOut(`geneseed: ${rc} already adds it — open a NEW terminal, then run 'geneseed'.\n`);
+    return true;
+  }
+  if (!confirm(`geneseed: add '${dir}' to your PATH in ${rc}?`, true)) return false;
+  try {
+    writeText(rc, withPathBlock(text, dir));
+  } catch (e) {
+    printErr(`geneseed: could not write ${rc} (${asOsError(e)})\n`);
+    return false;
+  }
+  printOut(`geneseed: added it to ${rc} — open a NEW terminal, then run 'geneseed'.\n`);
+  return true;
+}
+
 /** `_harness_lifecycle._win_bin_dir`. */
 function winBinDir() {
   // `os.environ.get(...) or str(Path.home())` — an EMPTY LOCALAPPDATA falls back too,
@@ -267,7 +340,7 @@ export function cmdLink(args) {
   printOut(`geneseed: linked ${dest} -> ${entry}\n`);
   if ((process.env.PATH || '').split(path.delimiter).includes(targetDir)) {
     printOut(`geneseed: '${targetDir}' is on PATH — run 'geneseed' from anywhere.\n`);
-  } else {
+  } else if (!offerShellPath(targetDir)) {
     printOut(`geneseed: NOTE '${targetDir}' is not on your PATH. Add it, e.g.:\n`);
     printOut(`  echo 'export PATH="${targetDir}:$PATH"' >> ~/.zshrc   # or ~/.bashrc\n`);
   }
@@ -311,6 +384,20 @@ export function cmdUnlink() {
       } catch { /* `except OSError: pass` */ }
     }
   }
+  // The PATH block `link` may have written, from each startup file it could have chosen.
+  const home = os.homedir();
+  const rcs = new Set([shellRcFile({ shell: 'zsh' }), path.join(home, '.bashrc'),
+    path.join(home, '.bash_profile')]);
+  for (const rc of rcs) {
+    const text = readMaybe(rc);
+    if (text === null || withoutPathBlock(text) === text) continue;
+    try {
+      writeText(rc, withoutPathBlock(text));
+      printOut(`geneseed: removed the PATH line from ${rc}\n`);
+    } catch (e) {
+      printErr(`geneseed: could not edit ${rc} (${asOsError(e)})\n`);
+    }
+  }
   if (!removed) printOut('geneseed: no linked launcher found on PATH\n');
   return 0;
 }

package/js/inspect/checks-build.mjs

@@ -10,7 +10,7 @@ import path from 'node:path';
 import { stripCapabilityLinks } from '../build/emit-common.mjs';
 import { STRUCTURE, renderAll } from '../build/render.mjs';
 import { CONFIG, CREDIT_RE, makeCfg } from '../build/source.mjs';
-import { hostCatalogsNatively, resolvePath } from '../hosts/hosts.mjs';
+import { CLAUDE_STYLE, hostCatalogsNatively, resolvePath } from '../hosts/hosts.mjs';
 import { EMIT_HOST_SCOPE, footprintOfDir, themeFiles } from '../hosts/installs.mjs';
 import { isVendoredPath } from '../hosts/native.mjs';
 import { PALETTE_ROLES, colorThemeFiles } from '../hosts/opencode.mjs';
@@ -217,7 +217,13 @@ export function renderedProblems(bundle) {
   else themeName = 'neutral';
   let emit;
   try { emit = readText(path.join(bundle, '.geneseed-emit')).trim(); } catch { emit = ''; }
-  const host = (EMIT_HOST_SCOPE.get(emit) ?? ['', ''])[0];
+  const [host, scope] = EMIT_HOST_SCOPE.get(emit) ?? ['', ''];
+  // A Claude-shaped PROJECT install is not a bundle: its tree is `AGENTS.md`/`CLAUDE.md` plus a
+  // `.bob/`/`.claude/`/`.openclaude/` data dir, so every rendered file reads "missing" and no
+  // rebuild can clear it. The console's onboarding once put a Bob project install exactly here
+  // (`./Harness` under the checkout, reported 2026-10: 178 such lines). Its own drift is
+  // `geneseed diff`'s and `status`'s to report, not this committed-bundle check's.
+  if (scope === 'project' && CLAUDE_STYLE.includes(host)) return [];
   let items;
   try {
     // THE FIRST CALLER IN THE PORT THAT CATCHES A REFUSAL, and that is why the stderr is

package/js/inspect/cost.mjs

@@ -35,7 +35,7 @@ import { isFile, readText } from '../lib/fs.mjs';
  * console draws it on the cost chart, so it lives here, once, where both read it. Raise it by
  * exactly the measured overrun and say why in that test's docblock, which keeps its history.
  */
-export const CARRIER_CEILING = { full: 62_219, lean: 39_111 };
+export const CARRIER_CEILING = { full: 62_263, lean: 39_156 };
 
 /**
  * A frontmatter value as the host shows it. The emit writes descriptions JSON-escaped

package/js/inspect/diff.mjs

@@ -321,8 +321,38 @@ export function diffCollect({
 /** The records that are drift: everything but a `linked` path, which is the user's own. */
 export const drifted = (files) => files.filter((f) => f.status !== 'linked');
 
+/** Where the self-improvement loops write, relative to an install's `notebook/`. */
+export const NOTES_DIRS = ['skill-notes', 'agent-notes'];
+
+/**
+ * The self-improvement notes an install has accumulated, as `{rel, body}` sorted by `rel`.
+ *
+ * WHY THESE ARE NOT DRIFT. The loops used to edit the rendered skill and agent files in place,
+ * which the doctor reported as stale and the next rebuild erased. They now write a sidecar
+ * under the notebook — seed-once and agent-owned, never in the manifest, so no rebuild touches
+ * it. That makes the notes the back-port QUEUE rather than an endangered edit: `diff` lists
+ * them and `--out` carries them so they can reach `src/`, but the upgrade export does not
+ * fire on them alone, because there is nothing for the rebuild to destroy. Empty files are
+ * skipped — an agent that cleared its notes has nothing to back-port.
+ */
+export function collectNotes(dir) {
+  const notes = [];
+  for (const sub of NOTES_DIRS) {
+    const d = path.join(dir, 'notebook', sub);
+    let names;
+    try { names = readdirSync(d); } catch { continue; }
+    for (const n of names.filter((x) => x.endsWith('.md')).sort()) {
+      const a = path.join(d, n);
+      if (!isFile(a)) continue;
+      const body = readText(a);
+      if (body.trim()) notes.push({ rel: `notebook/${sub}/${n}`, body });
+    }
+  }
+  return notes;
+}
+
 /** `_harness_diff._improvements_md` — pure; `when` is the caller's timestamp. */
-export function improvementsMd(target, theme, allFiles, when) {
+export function improvementsMd(target, theme, allFiles, when, notes = []) {
   // A linked path is never a back-port item: the file is the user's, not a local edit of ours.
   const files = drifted(allFiles);
   const edited = files.filter((f) => f.status === 'edited');
@@ -337,8 +367,8 @@ export function improvementsMd(target, theme, allFiles, when) {
     `- ${edited.length} edited · ${added.length} added in deployed · `
       + `${missing.length} missing from deployed`,
     '',
-    'The deployed harness drifted from a fresh render of `src/` — typically the',
-    'self-improvement loops editing agent/skill files in place. Hand this file to',
+    'The deployed harness drifted from a fresh render of `src/` — typically',
+    'agent/skill files edited in place, by hand or by an older harness. Hand this file to',
     'an agent in the Geneseed source repo and ask it to fold the changes below',
     'back into `src/`. Diffs read source -> deployed; the expected copy was',
     'rendered in the deployed theme, so only genuine local edits appear.',
@@ -352,6 +382,17 @@ export function improvementsMd(target, theme, allFiles, when) {
   for (const f of files) {
     lines.push(`## \`${f.rel}\`  (${label[f.status]})`, '', '```diff', ...f.diff, '```', '');
   }
+  // Only when there are notes, so a report without them stays byte-identical.
+  if (notes.length) {
+    lines.push('# Self-improvement notes', '',
+      'Corrections the agent recorded against a skill or agent instead of editing it.',
+      'Fold each one into the matching file under `src/`, then clear the note. Judge it by',
+      'its `seen:` evidence — a line without one is a claim, not a lesson — and weigh a',
+      '`[general]` line as a law, doctrine or memory rather than an edit to that one file.', '');
+    for (const n of notes) {
+      lines.push(`## \`${n.rel}\``, '', '```markdown', ...splitLines(n.body), '```', '');
+    }
+  }
   return `${lines.join('\n')}\n`;
 }
 
@@ -385,7 +426,9 @@ function stamp(d) {
  * the same instant, so a run that crosses a second boundary cannot name a file one second
  * away from what it says inside.
  */
-export function writeImprovements(target, theme, files, outPath = null) {
+export function writeImprovements(
+  target, theme, files, outPath = null, notes = collectNotes(target),
+) {
   const now = stamp(new Date());
   // `Path(out_path).expanduser()` — again NOT resolved, and again observable: the path is
   // printed, so `--out p.md` reports `p.md`.
@@ -393,7 +436,7 @@ export function writeImprovements(target, theme, files, outPath = null) {
     ? expanduser(outPath)
     : path.join(target, 'improvements', now.file);
   mkdirSync(path.dirname(p), { recursive: true });
-  writeText(p, improvementsMd(target, theme, files, now.when));
+  writeText(p, improvementsMd(target, theme, files, now.when, notes));
   return p;
 }
 
@@ -477,18 +520,21 @@ export function cmdDiff(args) {
     + `${missing.length} missing-from-deployed\n`);
   // Its own line, printed only when there is one, so the summary above is unchanged otherwise.
   if (linked.length) printOut(`[diff] ${linked.length} linked (yours, left alone)\n`);
+  const notes = collectNotes(target);
+  if (notes.length) printOut(`[diff] ${notes.length} self-improvement note(s) to back-port\n`);
   for (const f of edited) printOut(`  ~ ${f.rel}   (edited in deployed — review to back-port)\n`);
   for (const f of added) printOut(`  + ${f.rel}   (only in deployed — your addition)\n`);
   for (const f of missing) printOut(`  - ${f.rel}   (in source, not deployed — re-emit to add)\n`);
   for (const f of linked) printOut(`  = ${f.rel}   (a link — yours, left alone)\n`);
+  for (const n of notes) printOut(`  * ${n.rel}   (self-improvement note — review to back-port)\n`);
   if (args.out) {
-    if (drifted(files).length) {
+    if (drifted(files).length || notes.length) {
       // Bare `--out` is argparse's `nargs="?"` const: True, meaning "the default timestamped
       // path". `parse()` gives a flag `true` and an option a string, so the two arrive
       // distinguishable here without a third kind of entry in the VERBS table.
       const outPath = args.out === true ? null : args.out;
       printOut(`[diff] improvements file written: ${
-        writeImprovements(target, theme, files, outPath)}\n`);
+        writeImprovements(target, theme, files, outPath, notes)}\n`);
     } else {
       printOut('[diff] no differences — nothing written.\n');
     }

package/js/inspect/inventory.mjs

@@ -97,6 +97,7 @@ export const SKILL_CLASS = {
   'frontend-design': 'build', prototype: 'build', deck: 'build',
   'forge-mcp': 'build', bruno: 'build', worktree: 'build',
   'spring-boot': 'build', 'spring-data-jpa': 'build', 'spring-testing': 'build',
+  react: 'build', 'react-testing': 'build',
   'geneseed-code-review': 'review', 'fresh-eyes': 'review', 'security-audit': 'review',
   'roast-me': 'review', 'review-response': 'review', ponytail: 'review',
   commit: 'ship', ship: 'ship', release: 'ship', handoff: 'ship',

package/js/lib/prompt.mjs

@@ -12,6 +12,9 @@ import { readSync } from 'node:fs';
 import { printOut } from './fs.mjs';
 import { parseIntStrict } from './text.mjs';
 
+/** A cell to `Atomics.wait` on: the synchronous pause between `readLine`'s EAGAIN retries. */
+const PAUSE = new Int32Array(new SharedArrayBuffer(4));
+
 /**
  * `_harness_setup._ask` — `input(f"{prompt}{suffix}: ").strip()`, or the default at EOF.
  *
@@ -71,14 +74,28 @@ export function promptLine(prompt) {
  * the wizard's first non-ASCII answer is what exposed it, and the corpus caught it on the
  * first run. Scanning for the terminators a byte at a time is still correct: `\n` and `\r`
  * are ASCII, and no continuation byte of a UTF-8 sequence is below 0x80.
+ *
+ * EAGAIN IS "NOTHING TYPED YET", NOT EOF. Touching `process.stdin` — even `.isTTY`, which
+ * `cmdSetup` reads first — makes libuv put a terminal fd 0 in non-blocking mode, and from then
+ * on `readSync` throws EAGAIN until a key is pressed. Caught as EOF, every prompt took its
+ * default the instant it printed: setup's "Continue without one? (y/N)" answered itself N and
+ * the install stopped before anyone could type (reported 2026-10, reproduced under a pty). So
+ * it waits 20 ms and reads again; any other error is still the end of input. `read` is the
+ * test seam.
  */
-function readLine() {
+export function readLine(read = readSync) {
   const buf = Buffer.alloc(1);
   const bytes = [];
   let eof = false;
   for (;;) {
     let n = 0;
-    try { n = readSync(0, buf, 0, 1, null); } catch { eof = true; break; }
+    try {
+      n = read(0, buf, 0, 1, null);
+    } catch (e) {
+      if (e && e.code === 'EAGAIN') { Atomics.wait(PAUSE, 0, 0, 20); continue; }
+      eof = true;
+      break;
+    }
     if (n === 0) { eof = true; break; }
     if (buf[0] === 0x0a) break;
     if (buf[0] !== 0x0d) bytes.push(buf[0]);