geneseed 4.1.0 → 4.3.0

package/js/inspect/cost.mjs

@@ -0,0 +1,83 @@
+/**
+ * WHAT ONE INSTALL COSTS EVERY SESSION, read off the files it emitted — the Overview's
+ * always-on figure. Characters, not tokens: the console shows ≈ chars ÷ 4 and says it is an
+ * estimate, because a tokenizer would be a vendored dependency for a number that only has to
+ * be honest about its size.
+ *
+ * Four parts, each the thing the host loads before the user types:
+ * - `carrier`  the root instruction file (`AGENT.md`, `CLAUDE.md`, Bob's `rules/geneseed.md` or
+ *              `AGENTS.md`), CRLF decoded exactly as the smoke test decodes it, so the figure
+ *              and `CARRIER_CEILING` are the same measurement.
+ * - `skills`   the name + description every native skill lists (aliases included: they are
+ *              SKILL.md files the host lists like any other).
+ * - `agents`   the same for native agents; Bob has none, its agents table is in the carrier.
+ * - `context`  the session files the context hook injects (untouched seeds already skipped).
+ *              The per-repo project context is NOT counted: it changes with the working dir.
+ */
+import path from 'node:path';
+
+import { sessionFiles } from '../hosts/hooks-context.mjs';
+import { carriersFor } from '../hosts/installs.mjs';
+import { frontmatter } from '../hosts/memory-files.mjs';
+import { listDir } from '../hosts/hooks-prims.mjs';
+import { isFile, readText } from '../lib/fs.mjs';
+
+/**
+ * THE ANTI-BLOAT CEILING on the carrier, per footprint — the most a root file may weigh with
+ * every doctrine pack active. `tests/unit/emit_smoke.test.mjs` gates every emit against it and the
+ * console draws it on the cost chart, so it lives here, once, where both read it. Raise it by
+ * exactly the measured overrun and say why in that test's docblock, which keeps its history.
+ */
+export const CARRIER_CEILING = { full: 62_076, lean: 38_890 };
+
+const decode = (p) => readText(p).split('\r\n').join('\n');
+
+/**
+ * A frontmatter value as the host shows it. The emit writes descriptions JSON-escaped
+ * (`—` for one em dash), and `frontmatter()` has already stripped the quotes, so the
+ * escapes are decoded here or one character counts as six.
+ */
+function fmValue(raw) {
+  if (!raw) return '';
+  if (raw.includes('\\')) {
+    try { return JSON.parse(`"${raw}"`); } catch { /* not a JSON escape after all: count as written */ }
+  }
+  return raw;
+}
+
+/** name + description of one spec file; `fallbackName` for agents, whose name is the file stem. */
+function listedChars(file, fallbackName) {
+  let fm;
+  try { [fm] = frontmatter(decode(file)); } catch { return 0; }
+  const name = fmValue(fm.get('name')) || fallbackName;
+  return name.length + fmValue(fm.get('description')).length;
+}
+
+/**
+ * `root` is the install's root (`installTargets`), `dir` its data dir (`viewCfg`), which holds
+ * `skills/`, `agents/` and the session files. Every part that cannot be read counts 0; a missing
+ * carrier answers `null` for the whole cost, so the console shows "not measured", not a tiny bar.
+ */
+export function alwaysOnCost({ host, root, dir, footprint }) {
+  const carrierPath = carriersFor(host).map((rel) => path.join(root, rel)).find(isFile);
+  if (!carrierPath) return null;
+  const carrier = decode(carrierPath).length;
+
+  let skills = 0;
+  const skillsDir = path.join(dir, 'skills');
+  for (const name of listDir(skillsDir)) {
+    const f = path.join(skillsDir, name, 'SKILL.md');
+    if (isFile(f)) skills += listedChars(f, name);
+  }
+  let agents = 0;
+  if (host !== 'bob') {
+    const agentsDir = path.join(dir, 'agents');
+    for (const name of listDir(agentsDir)) {
+      if (name.endsWith('.md')) agents += listedChars(path.join(agentsDir, name), name.slice(0, -3));
+    }
+  }
+  let context = 0;
+  try { for (const s of sessionFiles(dir)) context += s.text.length; } catch { /* none */ }
+
+  return { carrier, skills, agents, context, ceiling: CARRIER_CEILING[footprint] ?? null };
+}

package/js/inspect/doctor.mjs

@@ -42,7 +42,7 @@ import { authoringProblems, loopProblems } from './checks-authoring.mjs';
 import {
   checkBuild, colorThemeProblems, renderedProblems, themeParityProblems,
 } from './checks-build.mjs';
-import { moduleMapProblems, scorecardProblems, shimProblems } from './checks-repo.mjs';
+import { hostMatrixProblems, moduleMapProblems, scorecardProblems, shimProblems } from './checks-repo.mjs';
 import { NOTE, isDoctorNote, sortedProblems, sortedUnique, stemOf, withTempDir } from './scan.mjs';
 
 /**
@@ -249,6 +249,7 @@ export function doctorCollect({
   problems = problems.concat(ran('openclaude_dual', 'OpenClaude dual harness',
     openclaudeDualHarnessNotes()));
   problems = problems.concat(ran('map', 'Module map', moduleMapProblems()));
+  problems = problems.concat(ran('host_matrix', 'Host tables', hostMatrixProblems()));
   problems = problems.concat(ran('scorecard', 'Scorecard floor', scorecardProblems()));
   // P10c's `cli` check is GONE, and the reason is not that it stopped mattering. It hashed
   // `rituals/harness.py` and compared that against a digest baked into `cli.json`, to catch a

package/js/inspect/inventory.mjs

@@ -106,7 +106,7 @@ export const SKILL_CLASS = {
   // knowledge base, terminal) rather than about the user's code. They sat under
   // `understand` before, which made that class a grab-bag.
   wiki: 'harness', geneseed: 'harness', rule: 'harness', profile: 'harness',
-  herdr: 'harness', 'skill-forge': 'harness',
+  'skill-forge': 'harness',
   teach: 'learn', quiz: 'learn', 'learn-mode': 'learn',
 };
 

package/js/maintain/uninstall.mjs

@@ -59,6 +59,7 @@ import {
   resolvePath, settingsFile,
 } from '../hosts/hosts.mjs';
 import { mcpCommented, mcpLoad } from '../hosts/mcp.mjs';
+import { hashesOf, ownedState, ownedWithin } from '../hosts/owned.mjs';
 import {
   atomicWriteJson, managedBlockRead, managedBlockRemove, managedBlockWrite,
   loadJsonObject, mergeClaudeSettings, opencodeTarget, OPENCODE_SENTINEL, opencodeSentinelWrite,
@@ -67,7 +68,7 @@ import {
 } from '../hosts/settings.mjs';
 import { printOut, printErr, readText, writeText, isFile, isDir, isOsError } from '../lib/fs.mjs';
 import { indexOfDeepEqual, isDict, jsonDumps, deepEquals } from '../lib/json.mjs';
-import { comparePaths, isAbsolutePath, within } from '../lib/paths.mjs';
+import { comparePaths, isAbsolutePath } from '../lib/paths.mjs';
 
 const hostSpec = (host) => HOSTS.find((h) => h.host === host);
 
@@ -145,7 +146,7 @@ function pruneAncestors(start, stop) {
 
 /**
  * The manifest's `owned` list, unlinked one by one with the ancestor prune, returning
- * `[removed, failed]`.
+ * `[removed, failed, kept]`.
  *
  * The third copy of this loop in `_harness_mcp.py` and the reason it is one function here:
  * `_uninstall_global` (rooted at the target), `_claude_uninstall` (rooted at the cfg dir) and
@@ -157,15 +158,28 @@ function pruneAncestors(start, stop) {
  * `ownedWithin` first, the same containment boundary deactivate draws: the manifest is a file
  * on disk, and without it an `owned` entry of `../../.bashrc` was unlinked — and the prune
  * then climbed from ITS parent, which never meets `base`, removing empty directories as it went.
- * @returns {[number, string[]]}
+ *
+ * Task 5 (O-1's uninstall half): `hashes` is the manifest's recorded `hashes` map (`hashesOf`,
+ * `{}` for an older manifest — the constraint that keeps a hash-less install's behaviour
+ * unchanged). Unless `force`, a rel whose `ownedState` reads `'modified'` is left on disk rather
+ * than unlinked and lands in `kept`, not `failed` — it is not an error, the file just is not
+ * Geneseed's to delete any more once the user has edited it. `'unknown'` and `'missing'` are
+ * NOT `'modified'` and are unlinked exactly as before, so an older, hash-less manifest's
+ * uninstall is byte-identical to today's.
+ * @returns {[number, string[], string[]]}
  */
-function unlinkOwned(base, owned, label = '') {
+function unlinkOwned(base, owned, label = '', hashes = {}, force = false) {
   let removed = 0;
   const failed = [];
+  const kept = [];
   for (const rel of ownedWithin(base, owned)) {
     const victim = path.join(base, rel);
     try {
       if (isFile(victim)) {
+        if (!force && ownedState(base, rel, hashes) === 'modified') {
+          kept.push(`${label}${rel}`);
+          continue;
+        }
         unlinkSync(victim);
         removed += 1;
         pruneAncestors(path.dirname(victim), base);
@@ -178,24 +192,7 @@ function unlinkOwned(base, owned, label = '') {
       failed.push(`${label}${rel} (${e && e.message ? e.message : e})`);
     }
   }
-  return [removed, failed];
-}
-
-/**
- * The manifest rels that resolve INSIDE `base` — the one security boundary every walk over
- * `owned` goes through (uninstall, both deactivates).
- *
- * `path.resolve(rroot, r)` and NOT `path.join`, which is the one line here that is a security
- * boundary rather than a translation. The Python is `(rroot / r).resolve()`, and pathlib's
- * `/` REPLACES the base when the right operand is absolute — so a manifest entry naming
- * `C:/evil.md` resolves outside the root and `_within` rejects it. `path.join` would have
- * concatenated it into `<root>/C:/evil.md`, which passes containment and would then be acted
- * on. `path.resolve` has pathlib's semantics for exactly this case, and collapses `..`
- * besides, which is why the guard runs on the resolved path rather than the lexical one.
- */
-function ownedWithin(base, rels) {
-  const rroot = resolvePath(base);
-  return rels.filter((r) => r && within(resolvePath(path.resolve(rroot, r)), rroot));
+  return [removed, failed, kept];
 }
 
 /** The two WARNs every reversal prints when an owned file survives. Identical in all three. */
@@ -204,6 +201,19 @@ function warnSurvivors(failed) {
     + `${failed.length} owned file(s): ${failed.join(', ')}\n`);
 }
 
+/**
+ * The message a reversal prints for every rel `unlinkOwned` left on disk because the user had
+ * edited it and `--force` was not given. Separate from `warnSurvivors`: a kept file is not an
+ * error (nothing failed) — it is the user's now, exactly like a refused claim on re-emit, and
+ * the uninstall completes around it. So the hint is `--force` on the uninstall itself, not a
+ * retry: once it completes there is no install left to rerun against.
+ */
+function warnKept(kept) {
+  printErr(`[uninstall] kept ${kept.length} file(s) you edited: ${kept.join(', ')}`
+    + ' — they are yours now (uninstall with --force to delete edited files too)\n');
+}
+
+/** Only a FAILED unlink keeps the manifest and markers — a kept edit never does. */
 function warnMarkersKept() {
   printErr('[uninstall] WARN: the manifest and markers were KEPT so '
     + '`geneseed uninstall` can be retried once the file(s) are '
@@ -332,11 +342,12 @@ function ownedOf(man) {
  * 'absent' and the retry the WARN promises would bounce off `cmdUninstall`'s own gate,
  * stranding the leftovers forever.
  */
-export function claudeUninstall(cfg, archiveMemory) {
+export function claudeUninstall(cfg, archiveMemory, force = false) {
   const man = claudeReadManifest(cfg);
   const managed = managedOf(man);
-  const [removed, failed] = unlinkOwned(cfg, ownedOf(man));
+  const [removed, failed, kept] = unlinkOwned(cfg, ownedOf(man), '', hashesOf(man), force);
   if (failed.length) warnSurvivors(failed);
+  if (kept.length) warnKept(kept);
   const hooks = managed.settings_hooks || [];
   const sf = settingsFile(cfg, managed);
   const unwired = unwireClaudeSettings(sf, hooks);
@@ -354,7 +365,7 @@ export function claudeUninstall(cfg, archiveMemory) {
     archived = archiveStore(path.join(cfg, 'memory'));
   }
   // `unmerged` reports REALITY: hooks were recorded AND the unwire actually rewrote the file.
-  return { removed, unmerged: Boolean(hooks.length) && unwired, archived, failed };
+  return { removed, unmerged: Boolean(hooks.length) && unwired, archived, failed, kept };
 }
 
 /**
@@ -364,11 +375,12 @@ export function claudeUninstall(cfg, archiveMemory) {
  * install and an OpenCode one can share one entry point: the Claude family has no
  * opencode.json to unmerge and a settings.json plus a managed block instead.
  */
-export function uninstallGlobal(target, archiveMemory, host = 'opencode') {
-  if (CLAUDE_STYLE.includes(host)) return claudeUninstall(target, archiveMemory);
+export function uninstallGlobal(target, archiveMemory, host = 'opencode', force = false) {
+  if (CLAUDE_STYLE.includes(host)) return claudeUninstall(target, archiveMemory, force);
   const man = claudeReadManifest(target);
-  const [removed, failed] = unlinkOwned(target, ownedOf(man));
+  const [removed, failed, kept] = unlinkOwned(target, ownedOf(man), '', hashesOf(man), force);
   if (failed.length) warnSurvivors(failed);
+  if (kept.length) warnKept(kept);
   for (const d of ['agents', 'skills', 'plugins']) {
     const p = path.join(target, d);
     if (isDir(p) && isEmptyDir(p)) rmdirQuiet(p);
@@ -382,7 +394,7 @@ export function uninstallGlobal(target, archiveMemory, host = 'opencode') {
   if (archiveMemory && isDir(path.join(target, 'memory'))) {
     archived = archiveStore(path.join(target, 'memory'));
   }
-  return { removed, unmerged, archived, failed };
+  return { removed, unmerged, archived, failed, kept };
 }
 
 /**
@@ -431,19 +443,22 @@ export function installAgentEntryOf(instr) {
  * describing a file that no longer exists, which the fallback would then paper over with the
  * canonical spelling — and a bundle sub-dir layout would be left wired.
  */
-function opencodeProjectUninstall(root) {
+function opencodeProjectUninstall(root, force = false) {
   const entry = installAgentEntry(root, 'project');
   let removed = 0;
   let failed = [];
+  let kept = [];
   let man = null;
   const oc = path.join(root, '.opencode');
   const manifestPath = path.join(oc, GLOBAL_MANIFEST);
   if (isFile(manifestPath)) {
     man = claudeReadManifest(oc);
-    [removed, failed] = unlinkOwned(oc, ownedOf(man), '.opencode/');
+    [removed, failed, kept] = unlinkOwned(oc, ownedOf(man), '.opencode/', hashesOf(man), force);
     if (failed.length) warnSurvivors(failed);
+    if (kept.length) warnKept(kept);
     // Survivors gate, mirroring the other two reversals: `_project_qualifies` keys off the
     // manifest, so deleting it while an owned file survives makes the install unfindable.
+    // A kept (edited) file is not a survivor: it is the user's now, not this install's.
     if (!failed.length) {
       unlinkQuiet(manifestPath);
       if (isDir(oc) && isEmptyDir(oc)) rmdirQuiet(oc);
@@ -464,6 +479,7 @@ function opencodeProjectUninstall(root) {
     man ? skillPermissionNames(man) : []);
   const result = { removed, unmerged, archived: null };
   if (failed.length) result.failed = failed;
+  if (kept.length) result.kept = kept;
   return result;
 }
 
@@ -506,8 +522,16 @@ export function ownedDirsFor(root, host, scope, data) {
  * plugins), so a locked owned file OUTSIDE those (Bob's `rules/geneseed.md`) would slip the
  * gate while the reversal kept its manifest, and deleting the root markers here would then
  * contradict that "KEPT" promise. The reversal's own `failed` list closes that hole.
+ *
+ * A KEPT file (Task 5: the user edited it, no `--force`) is the opposite case: it is the
+ * user's now, exactly like a refused claim on re-emit, so it must NOT hold the install open —
+ * a manifest kept for it left the install 'active' and the next `rebuild-all`/`update`
+ * re-wired hooks into a repo the user had uninstalled. So a watched directory whose only
+ * remaining files are kept ones is not a survivor, and `kept` never gates the markers; it is
+ * returned so a caller (the web's remove) can name the files and the `--force` way out.
  */
-export function installUninstall(root, host = 'opencode', scope = 'global', memory = 'keep') {
+export function installUninstall(root, host = 'opencode', scope = 'global', memory = 'keep',
+  force = false) {
   if (!['keep', 'archive', 'delete'].includes(memory)) memory = 'keep';
   if (installState(root, host, scope) === 'absent') {
     return { ok: false, error: 'nothing installed here' };
@@ -517,13 +541,13 @@ export function installUninstall(root, host = 'opencode', scope = 'global', memo
   //    install's, and they go with it.
   let summary;
   if (CLAUDE_STYLE.includes(host)) {
-    summary = claudeUninstall(data, false);
+    summary = claudeUninstall(data, false, force);
     rmtreeQuiet(path.join(data, DISABLED_STASH, host));
   } else if (installKind(root) === 'global') {
-    summary = uninstallGlobal(root, false, 'opencode');
+    summary = uninstallGlobal(root, false, 'opencode', force);
     rmtreeQuiet(path.join(root, DISABLED_STASH));
   } else {
-    summary = opencodeProjectUninstall(root);
+    summary = opencodeProjectUninstall(root, force);
     rmtreeQuiet(path.join(root, DISABLED_STASH));
   }
   // 2. Memory + notebook, independent of the owned-file removal above.
@@ -536,7 +560,14 @@ export function installUninstall(root, host = 'opencode', scope = 'global', memo
   }
   // 3. The root markers, but only once the reversal's dirs are actually gone.
   const failed = summary.failed || [];
-  const survivors = ownedDirsFor(root, host, scope, data).filter((d) => existsSync(d));
+  const kept = summary.kept || [];
+  // `kept` rels are spelled relative to the reversal's own base: the cfg dir for the Claude
+  // family, the root for OpenCode (whose project reversal already prefixes `.opencode/`).
+  const keptAbs = new Set(kept.map((r) => path.join(CLAUDE_STYLE.includes(host) ? data : root, r)));
+  const survivors = ownedDirsFor(root, host, scope, data).filter((d) => existsSync(d)
+    && !(keptAbs.size && readdirSync(d, { recursive: true, withFileTypes: true })
+      .every((e) => e.isDirectory() || keptAbs.has(path.join(e.parentPath, e.name)))));
+  const withKept = (o) => (kept.length ? { ...o, kept } : o);
   if (survivors.length || failed.length) {
     if (survivors.length && !failed.length) {
       // With `failed` set the reversal already warned twice — no third overlapping WARN.
@@ -544,12 +575,15 @@ export function installUninstall(root, host = 'opencode', scope = 'global', memo
         + `${survivors.join(', ')}. The install marker was KEPT so you can retry `
         + '`geneseed uninstall` once the file(s) are unlocked/removable.\n');
     }
-    const out = {
+    // `incomplete` names every reason the root markers stayed — directory survivors and a
+    // failed unlink — deduped.
+    const named = survivors.concat(failed);
+    const out = withKept({
       ok: true,
       removed: summary.removed ?? 0,
       memory,
-      incomplete: survivors.concat(failed.filter((f) => !survivors.includes(f))),
-    };
+      incomplete: named.filter((f, i) => named.indexOf(f) === i),
+    });
     if (archived.length) out.archived = archived;
     return out;
   }
@@ -623,7 +657,7 @@ export function installUninstall(root, host = 'opencode', scope = 'global', memo
   }
   // 4. Tidy an emptied marker dir (.claude/.bob/.openclaude) so no husk lingers in the repo.
   if (data !== root && isDir(data) && isEmptyDir(data)) rmdirQuiet(data);
-  const out = { ok: true, removed: summary.removed ?? 0, memory };
+  const out = withKept({ ok: true, removed: summary.removed ?? 0, memory });
   if (archived.length) out.archived = archived;
   return out;
 }
@@ -806,7 +840,7 @@ export function cmdUninstall(args) {
     }
   }
   const memory = args.archiveMemory ? 'archive' : 'keep';
-  const s = installUninstall(root, host, scope, memory);
+  const s = installUninstall(root, host, scope, memory, Boolean(args.force));
   if (!(s.ok ?? true)) {
     printErr(`[uninstall] failed: ${s.error || 'unknown error'}\n`);
     return 1;
@@ -820,7 +854,8 @@ export function cmdUninstall(args) {
       + 'the install marker was kept — retry `geneseed uninstall` once they\'re '
       + `removable. ${cfgfile} updated where needed; memory/notebook ${mem}.\n`);
   } else {
-    printOut(`[uninstall] done — removed ${s.removed} file(s); ${cfgfile} updated where `
+    const keptNote = s.kept ? `, kept ${s.kept.length} you edited` : '';
+    printOut(`[uninstall] done — removed ${s.removed} file(s)${keptNote}; ${cfgfile} updated where `
       + `needed; memory/notebook ${mem}. Start a new session to apply.\n`);
   }
   if (scope === 'global') printSurvivingProjectInventory(root);

package/js/web/api.mjs

@@ -1,6 +1,6 @@
 /**
  * The web console's dashboard and settings reads — `overview`, `recent`, `themes`, `setup`,
- * `doctor`, `diff`, `installs`, `excludes` and the two `loops` reads.
+ * `doctor`, `diff`, `installs`, `fleet`, `update`, `excludes` and the two `loops` reads.
  *
  * WHAT IS NOT HERE, AND WHERE IT WENT: the Library read model (catalog sections, items, wiki,
  * memory, `NotFound`) is `catalog.mjs`; the `WebState` every endpoint reads from is `state.mjs`;
@@ -11,12 +11,14 @@
 import { statSync } from 'node:fs';
 import path from 'node:path';
 
-import { CONFIG, ROOT, THEMES, discoverNames } from '../build/source.mjs';
+import { CONFIG, ROOT, THEMES, discoverNames, makeCfg } from '../build/source.mjs';
+import { readVersion, sourceFingerprint } from '../build/version.mjs';
 import { sourceReleaseVersion } from '../hosts/opencode.mjs';
+import { alwaysOnCost } from '../inspect/cost.mjs';
 import { diffCollect } from '../inspect/diff.mjs';
 import { doctorCollect } from '../inspect/doctor.mjs';
 import { excludesSnapshot } from '../inspect/excludes.mjs';
-import { CLAUDE_STYLE, HOSTS, resolvePath } from '../hosts/hosts.mjs';
+import { CLAUDE_STYLE, HOSTS, VERSION_MARKER, resolvePath } from '../hosts/hosts.mjs';
 import {
   footprintOfDir, installState, installTargets, modeOfDir, trustOfDir,
   postureOfDir, readJsonMaybe, themeOfDir,
@@ -32,6 +34,7 @@ import {
   configItems, deployed, dget, memoryItems, notebookItems, wikiItems,
 } from './catalog.mjs';
 import { stampMinute } from './state.mjs';
+import { updateStatus } from './update-check.mjs';
 
 /**
  * `js/web/docs.mjs` imports these three from HERE, and that file is outside this split — so
@@ -141,6 +144,63 @@ export function apiInstalls(state) {
 }
 
 
+/**
+ * EVERY INSTALLED HARNESS ON THE MACHINE, EACH JUDGED ON ITS OWN — the Overview's fleet table.
+ *
+ * Installed means `active` or `disabled`: a host with nothing installed is not listed, because
+ * installing belongs to the Installs page with its other settings (user, 2026-10-13).
+ *
+ * Its own route, not more fields on `/api/installs`: the sidebar refetches that list on every
+ * data revision, and the drift check below re-renders a whole emit per global install.
+ * ponytail: one `diffCollect` render per global install per request, fine for the handful a
+ * machine carries; cache per (root, build mtime) if a fleet ever grows past that.
+ *
+ * Each row reads ITS OWN `.geneseed-version`. `statusData().installed_fp` is the first carrier
+ * a fixed walk finds, which describes the wrong install as soon as two hosts are deployed.
+ * Every unknown stays `null` — `verdict: 'unknown'`, `drift: null` — never a reassuring zero.
+ */
+export function apiFleet(state) {
+  const sourceFp = sourceFingerprint(makeCfg());
+  const installs = [];
+  for (const [host, scope, root] of installTargets()) {
+    const st = installState(root, host, scope);
+    if (st !== 'active' && st !== 'disabled') continue;
+    const dir = viewCfg(host, scope, root);
+    const fp = readVersion(dir);
+    let drift = null;
+    if (st === 'active') {
+      try {
+        const { files } = diffCollect({ target: dir });
+        if (files !== null) {
+          drift = {
+            edited: files.filter((f) => f.status === 'edited').length,
+            added: files.filter((f) => f.status === 'added').length,
+            missing: files.filter((f) => f.status === 'missing').length,
+          };
+        }
+      } catch { /* an install that cannot be re-rendered reports no drift figure, not zero */ }
+    }
+    let built = null;
+    try { built = Math.floor(statSync(path.join(dir, VERSION_MARKER)).mtimeMs / 1000); } catch { /* never built */ }
+    installs.push({
+      id: `${host}:${scope}:${root}`, host, scope, path: root, state: st,
+      theme: themeOfDir(root, host),
+      footprint: footprintOfDir(root),
+      installed_fp: fp,
+      verdict: fp === null ? 'unknown' : fp === sourceFp ? 'synced' : 'behind',
+      // A project install has no drift check at all (`diffCollect` answers `files: null`), which
+      // the console must say as "not checkable" — so the fact travels apart from the figure.
+      diffable: drift !== null,
+      drift,
+      built_epoch: built,
+      // What this install injects every session, by part (characters); null when its carrier
+      // is missing, so the console says "not measured" rather than drawing an empty bar.
+      cost: alwaysOnCost({ host, root, dir, footprint: footprintOfDir(root) }),
+    });
+  }
+  return { installs, source_fp: sourceFp, doctor: state.doctor };
+}
+
 /** The dashboard aggregate. */
 export function apiOverview(state) {
   const inv = state.inventory;
@@ -354,6 +414,9 @@ export function apiLoopsActive() {
 }
 
 /** The source's release label, or null when it cannot be read. */
+/** Is a newer release on npm than the source this console serves? See update-check.mjs. */
+export const apiUpdate = (state) => updateStatus(state, releaseLabel());
+
 function releaseLabel() {
   const v = sourceReleaseVersion({ config: CONFIG });
   return v && v !== '0.0.0' ? v : null;

package/js/web/gates-api.mjs

@@ -0,0 +1,44 @@
+/**
+ * GET /api/gates — gate asks per rule per day over the last 30 days, across every installed
+ * harness: the Overview's "Gates" sparklines. The ledger (`notebook/gates.jsonl`, written by
+ * js/hosts/hooks.mjs and the OpenCode guard plugin) already stamps each ask with an ISO `ts`
+ * and a `rule` (`law-1`, `process-1`, `wiki`…); this only reads it. `gateSummary` keeps its
+ * count-only shape for the CLI's status panel.
+ *
+ * `{ days: ['YYYY-MM-DD' × 30], rules: [{ rule, n, per_day[30] }] }`, busiest rule first.
+ * Garbage lines are skipped; nothing here writes (the writers already trim at 1000 lines).
+ */
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+
+import { GATE_LEDGER } from '../hosts/hosts.mjs';
+import { installState, installTargets } from '../hosts/installs.mjs';
+import { viewCfg } from './api.mjs';
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+const WINDOW = 30;
+
+export function gateDays({ now = Date.now(), targets = installTargets() } = {}) {
+  const days = Array.from({ length: WINDOW }, (_, i) =>
+    new Date(now - (WINDOW - 1 - i) * DAY_MS).toISOString().slice(0, 10));
+  const index = new Map(days.map((d, i) => [d, i]));
+  const by = new Map();
+  for (const [host, scope, root] of targets) {
+    if (installState(root, host, scope) !== 'active') continue;
+    let raw;
+    try { raw = readFileSync(path.join(viewCfg(host, scope, root), GATE_LEDGER), 'utf8'); } catch { continue; }
+    for (const line of raw.split('\n')) {
+      let e;
+      try { e = JSON.parse(line); } catch { continue; }
+      const i = typeof e?.ts === 'string' ? index.get(e.ts.slice(0, 10)) : undefined;
+      if (i === undefined || typeof e.rule !== 'string') continue;
+      const row = by.get(e.rule) || { rule: e.rule, n: 0, per_day: new Array(WINDOW).fill(0) };
+      row.n += 1;
+      row.per_day[i] += 1;
+      by.set(e.rule, row);
+    }
+  }
+  return { days, rules: [...by.values()].sort((a, b) => b.n - a.n || a.rule.localeCompare(b.rule)) };
+}
+
+export const apiGates = () => gateDays();

package/js/web/routes.mjs

@@ -21,10 +21,12 @@ import { percentDecode } from '../lib/text.mjs';
 import { apiExcludesMutate, apiInstallToggle, apiLoopsPresetMutate, apiMcp, apiMemoryDelete, apiSelectView } from './actions.mjs';
 import { apiActivity, apiActivityDetail, apiActivityToggle } from './activity.mjs';
 import {
-  apiDiff, apiDoctor, apiExcludes, apiInstalls, apiLoops, apiLoopsActive, apiOverview,
-  apiRecent, apiSetup, apiThemes,
+  apiDiff, apiDoctor, apiExcludes, apiFleet, apiInstalls, apiLoops, apiLoopsActive, apiOverview,
+  apiRecent, apiSetup, apiThemes, apiUpdate,
 } from './api.mjs';
 import { NotFound, apiCatalog, apiItem } from './catalog.mjs';
+import { apiUsage } from './usage-api.mjs';
+import { apiGates } from './gates-api.mjs';
 import { apiProfile, apiProfileSave, apiRules, apiRulesMutate, apiRulesPromote } from './user-files.mjs';
 
 /**
@@ -146,6 +148,10 @@ export const STATE_ROUTES = {
   '/api/setup': apiSetup,
   '/api/doctor': apiDoctor,
   '/api/installs': apiInstalls,
+  '/api/fleet': apiFleet,
+  '/api/update': apiUpdate,
+  '/api/usage': apiUsage,
+  '/api/gates': apiGates,
   '/api/excludes': apiExcludes,
   '/api/profile': apiProfile,
   '/api/diff': apiDiff,

package/js/web/update-check.mjs

@@ -0,0 +1,61 @@
+/**
+ * IS A NEWER GENESEED RELEASED? — the Overview's "4.2.0 available" chip.
+ *
+ * Route handlers answer synchronously, so this never waits on the network: it answers from the
+ * last result it holds and, when that is missing or a day old, starts ONE background fetch whose
+ * answer the next poll reads. The console refetches after every mutation and on mount, so the
+ * chip appears within a poll or two of the daemon starting.
+ *
+ * Every failure is `latest: null` and says nothing more: a corporate proxy, an offline laptop and
+ * a registry outage all read "update check unavailable", never an error. `GENESEED_NO_UPDATE_CHECK`
+ * turns the fetch off for a machine that must not phone out at all.
+ *
+ * ponytail: the cache lives on the daemon's state, in memory. A restart costs one more request;
+ * a disk cache would be a file to version for a figure that is free to re-ask.
+ */
+const DAY_MS = 24 * 60 * 60 * 1000;
+/** A failed ask is retried sooner than a good answer is refreshed: a proxy hiccup is not a day. */
+const RETRY_MS = 60 * 60 * 1000;
+const REGISTRY = 'https://registry.npmjs.org/geneseed/latest';
+
+/** x.y.z only; a pre-release tag or a malformed label compares as nothing newer. */
+export function semverGreater(a, b) {
+  const parse = (v) => (/^(\d+)\.(\d+)\.(\d+)$/.exec(String(v || '').trim()) || []).slice(1).map(Number);
+  const x = parse(a);
+  const y = parse(b);
+  if (x.length !== 3 || y.length !== 3) return false;
+  for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return x[i] > y[i];
+  return false;
+}
+
+async function npmLatest() {
+  const res = await fetch(REGISTRY, { signal: AbortSignal.timeout(3000) });
+  if (!res.ok) return null;
+  const body = await res.json();
+  return typeof body?.version === 'string' ? body.version : null;
+}
+
+/**
+ * `{ current, latest, available, checked_at }`. `available` is true only when `latest` is
+ * semver-greater than `current`, so a checkout ahead of the last release never shows one;
+ * null when either side is unknown. `fetcher` and `now` are injectable for the tests, which
+ * must never reach the network.
+ */
+export function updateStatus(state, current, { fetcher = npmLatest, now = Date.now() } = {}) {
+  const c = state._update || (state._update = { latest: null, checked_at: null, inflight: false });
+  const stale = c.checked_at === null
+    || now - c.checked_at > (c.latest === null ? RETRY_MS : DAY_MS);
+  // Under `node --test` (NODE_TEST_CONTEXT) the real registry is never asked: the route probes in
+  // tests/unit/web_server.test.mjs reach this handler, and a suite must not depend on the network.
+  const off = process.env.GENESEED_NO_UPDATE_CHECK
+    || (fetcher === npmLatest && process.env.NODE_TEST_CONTEXT);
+  if (stale && !c.inflight && !off) {
+    c.inflight = true;
+    Promise.resolve()
+      .then(fetcher)
+      .then((v) => { c.latest = v ?? null; }, () => { c.latest = null; })
+      .finally(() => { c.checked_at = now; c.inflight = false; });
+  }
+  const available = current && c.latest ? semverGreater(c.latest, current) : null;
+  return { current: current ?? null, latest: c.latest, available, checked_at: c.checked_at };
+}