geneseed 4.4.1 → 4.5.0

package/CHANGELOG.md

@@ -8,6 +8,24 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
 ## [Unreleased]
 
+## [4.5.0] — 2026-10-17
+
+Minor: gates that are proven, not just present — a done gate at turn end, `doctor --probe`, and Bob's refusals restored on Windows.
+
+### Upgrade notes
+- Run `geneseed rebuild-all` once after updating: it rewrites the Windows hook shim (Bob's gates block again) and re-emits the rule skill.
+- The done gate is off until a project lists its checks in `.geneseed/done-checks.txt`.
+
+### Added
+- **Done gate (#289).** A project that lists its checks in `.geneseed/done-checks.txt` gets *Verify Before Asserting* enforced when a turn ends: on Claude Code and OpenClaude, a turn that edited files cannot end until every listed check has passed, unpiped, after the last edit (at most one block per turn). OpenCode 1 gets a reminder on the next request; Bob and OpenCode 2 are not judged and log so. The gate lives inside `learn`, before its model call, so the emitted settings are unchanged. The list protects itself through *External Gate*.
+- **`geneseed doctor --probe`.** This is opt-in. For each live Claude Code, OpenClaude and Bob install, it runs the installed gate command exactly as the host's settings spell it, through the host's own shell. It sends `git reset --hard HEAD`, which the gate must refuse, and `git status`, which it must let through. A gate that allows both, refuses both, or does not run is a doctor failure. The probe runs under your terminal's environment, not the host app's. Its asks are kept out of the gate ledger (`GENESEED_GATE_PROBE`). The OpenCode guard plugin is probed in-process: the installed file is imported and its hook called through both plugin APIs, with `rm -rf /` as the call it must refuse, and `GENESEED_GUARD=off|warn` reported as a note. The PowerShell-fallback warning now suggests running the probe (#290).
+
+### Changed
+- **A stated rule keeps the user's own words.** The rule skill now writes `source: user <date> "<their sentence>"` for a rule the user stated, so a stale rule can be told from a changed mind. Its review flow gains two cases: a rule the user's later words contradict, and a rule only checked by reading that was broken twice (#288).
+
+### Fixed
+- **Bob gates now block on Windows.** The hook shim (`~/.geneseed/bin/geneseed-hook.cmd`) ended with a bare `exit /b`, which returns 0 under `cmd /c` whatever the gate exited. As a result, Bob's exit-2 refusals (Laws I and IV, protected checks, root scans) went through. The shim now ends with `exit /b %ERRORLEVEL%`. Claude Code and OpenClaude were not affected, because their gates answer through stdout and exit 0. Run `geneseed rebuild-all` once to rewrite the shim (#290).
+
 ## [4.4.1] — 2026-10-16
 
 A presentation skill.

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical references, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **4.4.1**.
+> string. Current label: **4.5.0**.
 
 ## Capabilities
 

package/adapters/opencode/plugins/geneseed-context.js

@@ -877,6 +877,76 @@ async function alreadyInjected(client, sid) {
   return false
 }
 
+// ---- The done gate (#289): the OpenCode twin of js/hosts/hooks-done.mjs ----------------
+// OpenCode has no turn-end event a plugin can block on, so its ceiling is a reminder: on the
+// request AFTER a turn that edited files without the project's declared checks passing
+// (`.geneseed/done-checks.txt`), one invisible user message says which checks are owed. Only V1
+// (`messages.transform`, whose tool parts carry `state.status` and the shell's
+// `metadata.exit`); OpenCode 2's message shape for tool calls is unverified, so V2 is not
+// judged and says so once. Fails open on every shape it does not recognise (ADR 0007).
+// `runsUnpiped` is a hand-mirrored twin; tests/plugins/context_done.test.mjs runs both on one table.
+const DONE_LIST = ".geneseed/done-checks.txt"
+const DONE_EDIT_TOOLS = new Set(["edit", "write", "patch", "apply_patch", "multiedit"])
+const DONE_SHELL_TOOLS = new Set(["bash", "shell"])
+
+async function readDoneChecks(root) {
+  try {
+    const text = await fs.readFile(path.join(root, DONE_LIST), "utf8")
+    return text.split(/\r?\n/).map((l) => l.trim().replace(/\s+/g, " ")).filter((l) => l && !l.startsWith("#"))
+  } catch {
+    return []
+  }
+}
+
+function runsUnpiped(command, line) {
+  const cmd = String(command).replace(/[ \t]+/g, " ")
+  for (let i = cmd.indexOf(line); i !== -1; i = cmd.indexOf(line, i + 1)) {
+    const rest = cmd.slice(i + line.length)
+    let piped = false
+    for (let j = 0; j < rest.length; j += 1) {
+      const two = rest.slice(j, j + 2)
+      if (two === "&&" || two === "||" || rest[j] === ";" || rest[j] === "\n") break
+      if (rest[j] === "|") { piped = true; break }
+    }
+    if (!piped) return true
+  }
+  return false
+}
+
+// The checks still owed, judged over the previous turn and the current one: a reminder lasts
+// one turn, not the whole session. Our own injected messages (`geneseed-*` ids) open no turn.
+function doneOwed(messages, checks, root) {
+  const prompts = []
+  messages.forEach((m, i) => {
+    if (m?.info?.role === "user" && !String(m.info.id ?? "").startsWith("geneseed-")) prompts.push(i)
+  })
+  const from = prompts.length >= 2 ? prompts[prompts.length - 2] : 0
+  const tools = []
+  for (const m of messages.slice(from)) {
+    for (const p of m?.parts ?? []) if (p?.type === "tool" && p.state) tools.push(p)
+  }
+  let lastEdit = -1
+  tools.forEach((p, i) => {
+    if (!DONE_EDIT_TOOLS.has(String(p.tool).toLowerCase()) || p.state.status === "error") return
+    const fp = p.state.input?.filePath ?? p.state.input?.file_path
+    if (typeof fp === "string" && fp) {
+      const rel = path.relative(root, path.resolve(root, fp))
+      if (rel.startsWith("..") || path.isAbsolute(rel)) return
+    }
+    lastEdit = i
+  })
+  if (lastEdit === -1) return []
+  const passed = new Set()
+  for (const p of tools.slice(lastEdit + 1)) {
+    const command = DONE_SHELL_TOOLS.has(String(p.tool).toLowerCase()) && p.state.input?.command
+    if (typeof command !== "string" || p.state.status !== "completed") continue
+    const exit = p.state.metadata?.exit
+    if (typeof exit === "number" && exit !== 0) continue
+    for (const check of checks) if (runsUnpiped(command, check)) passed.add(check)
+  }
+  return checks.filter((c) => !passed.has(c))
+}
+
 export const GeneseedContext = async (ctx) => {
   const { client } = ctx
   const done = new Set()
@@ -1002,6 +1072,27 @@ export const GeneseedContext = async (ctx) => {
     // detects that and takes over with the visible delivery.
     "experimental.chat.messages.transform": async (_input, output) => {
       transformSeen = true                  // the hook exists on this build
+      // The done gate's reminder: FIRST, and independent of the context block:
+      // INJECT_OFF and the visible delivery leave it on, and no early return below can skip it.
+      // Its own function, so its early returns end the reminder, never the context injection.
+      await (async () => {
+        if (!output || !Array.isArray(output.messages) || !output.messages.length) return
+        const sid = output.messages[0]?.info?.sessionID
+        if (await sovereignBypass(root) || await skipSession(sid)) return
+        const checks = await readDoneChecks(root)
+        if (!checks.length) return
+        const owed = doneOwed(output.messages, checks, root)
+        if (!owed.length) return
+        const stamp = Date.now()
+        output.messages.unshift({
+          info: { id: `geneseed-done-${stamp}`, role: "user", sessionID: sid, time: { created: stamp } },
+          parts: [{ id: `geneseed-done-part-${stamp}`, type: "text", text:
+            "Geneseed (Verify Before Asserting) — files were edited, and these checks from "
+            + `${DONE_LIST} have not passed since the last edit: ${owed.join("; ")}. Run them unpiped `
+            + "before reporting the work done, or say plainly that they were not run and why." }],
+        })
+        log("transform: done-gate reminder injected")
+      })().catch((err) => log(`done-gate error: ${err?.message ?? err}`))
       if (INJECT_OFF || !TRANSFORM || fallbackVisible) return
       if (await sovereignBypass(root)) return
       try {
@@ -1072,6 +1163,11 @@ async function setupV2(ctx) {
     }
   }
 
+  // The done gate is not judged on OpenCode 2 (see `doneOwed`): said once, where its log goes.
+  if ((await readDoneChecks(root).catch(() => [])).length) {
+    console.error(`[geneseed-context] done gate: ${DONE_LIST} found, but OpenCode 2 turns are not judged.`)
+  }
+
   if (!VISIBLE) {
     await ctx.session.hook("context", async (event) => {
       if (INJECT_OFF) return

package/adapters/opencode/plugins/geneseed-guard.js

@@ -128,6 +128,9 @@ function log(msg) { console.error(`[geneseed-guard] ${msg}`) }
 // at the newest MAX_LEDGER_LINES like the hook's; never throws, never decides.
 const MAX_LEDGER_LINES = 1000
 async function ledger(rule) {
+  // `geneseed doctor --probe` blocks on purpose; its blocks are not the user's (the twin of
+  // the same line in js/hosts/hooks.mjs). The record only — never the decision.
+  if (process.env.GENESEED_GATE_PROBE) return
   try {
     const bases = []
     if (process.env.GENESEED_HARNESS) bases.push(process.env.GENESEED_HARNESS)
@@ -545,6 +548,9 @@ function ruleStoreTarget(p) {
 // line; the list protects itself. Found from the WRITE TARGET up to the first `.git`, re-read on
 // every write (a short file, read only on a write call). No ask tier here, so a hit is a deny.
 const SENSOR_LIST = ".geneseed/protected-checks.txt"
+// The done gate's list (#289, js/hosts/hooks-done.mjs) protects itself the same way, with or
+// without a protected-checks list: emptying it would disarm the gate. Twin of js/hosts/hooks.mjs.
+const DONE_LIST = ".geneseed/done-checks.txt"
 function protectedCheck(p) {
   try {
     const target = path.resolve(p)
@@ -554,9 +560,10 @@ function protectedCheck(p) {
       if (up === root) return null
       root = up
     }
-    const text = readFileSync(path.join(root, SENSOR_LIST), "utf8")
     const fold = (s) => nocase(s.replace(/\\/g, "/"))
     const rel = fold(path.relative(root, target))
+    if (rel === fold(DONE_LIST)) return DONE_LIST
+    const text = readFileSync(path.join(root, SENSOR_LIST), "utf8")
     const entries = [SENSOR_LIST, ...text.split(/\r?\n/).map((l) => l.trim().replace(/[\\/]+$/, ""))
       .filter((l) => l && !l.startsWith("#"))]
     return entries.find((e) => rel === fold(e) || rel.startsWith(fold(e) + "/")) ?? null
@@ -635,7 +642,7 @@ export const GeneseedGuard = async (ctx) => {
             if (SECRET_RE.some((re) => re.test(p))) { await deny(`write to secret/key file ${p} (Sealed Secrets)`, "law-1"); return }
             if (SECRET_WARN_RE.some((re) => re.test(p))) log(`WARN: writing ${p} — keep secrets out of tracked files (Sealed Secrets)`)
             const sensor = protectedCheck(p)
-            if (sensor) { await deny(`${p} is a protected check (${sensor}, listed in ${SENSOR_LIST}) — a check the agent can edit is not a check (External Gate)`, "rigor-5"); return }
+            if (sensor) { await deny(`${p} is a protected check (${sensor === DONE_LIST ? "the done gate list itself" : `${sensor}, listed in ${SENSOR_LIST}`}) — a check the agent can edit is not a check (External Gate)`, "rigor-5"); return }
             const store = ruleStoreTarget(p)
             if (store && !RULE_STORE_BUMPED.has(p)) {
               RULE_STORE_BUMPED.add(p)

package/docs/concepts/enforcement-table.md

@@ -13,8 +13,8 @@ few rules are enforced; the rest are asked on every host, through the root rules
 
 Derived from the code, not from this project's own planning notes: `js/hosts/hooks.mjs`'s
 `BLOCK_RULES` and gate functions, `HOOK_PINNED` in `js/inspect/checks-constitution.mjs`,
-`LAW_IV_BASH` and `CONSENT_RULE` in `js/hosts/settings.mjs`, and
-`adapters/opencode/plugins/geneseed-guard.js`. `HOOK_PINNED` is what keeps this table from
+`LAW_IV_BASH` and `CONSENT_RULE` in `js/hosts/settings.mjs`, `js/hosts/hooks-done.mjs`, and
+`adapters/opencode/plugins/geneseed-guard.js` and `geneseed-context.js`. `HOOK_PINNED` is what keeps this table from
 silently guarding the wrong rule after a renumber. See [ADR 0005](../adr/0005-stable-rule-ids.md).
 
 ### The enforced rules
@@ -26,6 +26,7 @@ silently guarding the wrong rule after a renumber. See [ADR 0005](../adr/0005-st
 | `persist-insight` | process | ask: rule-gate (a write to `user-rules.md` or the memory store) | same as Claude Code | ask once: guard plugin (refuses the *first* write to that path; a re-issued write goes through) | log only (warning, call goes through) |
 | `consent-before-push` | process | ask: git-gate (every `git commit`/`git push`). Togglable: build without the process pack, or drop this rule alone with `--exclude-rules` (see [Exclusions](exclusions.md)). Only this question drops; the `deletion-is-deliberate` gate stays. | same as Claude Code | ask: permission prompt (`git commit*`/`git push*`), wired only when the process pack is on; a `loop/*` push is statically allowed | log only |
 | `external-gate` | rigor | ask: rule-gate (a write under a project's `.geneseed/protected-checks.txt` list) | same as Claude Code | block: guard plugin (same list) | block (exit 2) |
+| `verify-before-asserting` | law | block at Stop, once per turn: the done gate in `learn` (a turn that edited files, while a check in the project's `.geneseed/done-checks.txt` has not passed since the last edit). Opt-in per project | same as Claude Code (**unverified live**: a frozen fork, and no check runs a model turn) | remind: context plugin, on the next request (OpenCode 1 only; OpenCode 2 is not judged, and logs so) | not judged: Stop carries no transcript (log line) |
 | `commands-must-return` | ops | ask: git-gate (a recursive scan rooted at a filesystem root: `find /`, `du`, `grep -r`, `rg`, `Get-ChildItem -Recurse` at `/`, `/c`, `C:\`) | same as Claude Code | block: guard plugin (same root-scan pattern) | block (exit 2) |
 
 Bob has no "ask" tier (see [ADR 0007](../adr/0007-gates-fail-closed-per-host-ceiling.md)), so a
@@ -37,12 +38,17 @@ mechanisms: its own permission prompt (`opencode.json`, static globs) and the gu
 See [ADR 0008](../adr/0008-host-parity-ceiling-of-the-weakest-host.md) for why a gate that only
 one host can run still ships for every host it can.
 
+A gate that is registered but broken looks exactly like a working one. `geneseed doctor --probe`
+runs the installed Claude Code, OpenClaude and Bob gates through each host's own shell, and calls
+the OpenCode guard plugin in-process, on one call each must refuse and one it must let through
+([Doctor findings](../reference/troubleshoot-doctor.md)).
+
 ### Everything else: asked only, on every host
 
 Every other rule carries no gate on any host. A human reads them because the model was told to
 follow them, not because a tool call was ever inspected.
 
-**Laws** — `one-intent-one-act` · `verify-before-asserting` · `surface-failures` ·
+**Laws** — `one-intent-one-act` · `verify-before-asserting` (in a project without a done list) · `surface-failures` ·
 `data-not-orders` · `least-privilege` · `cure-the-cause` · `echo-the-intent`.
 
 **Doctrine: process** — `plan-before-acting` · `context-economy` · `read-the-docs-first` ·

package/docs/concepts/hooks.md

@@ -37,8 +37,11 @@ Geneseed writes its hooks into the host's settings file. Every hook calls one pr
 - Content that looks like a credential (a cloud access key, a GitHub or Anthropic token, a Slack token, a private-key block) going into any file other than `.env*` gets a prompt citing *Sealed Secrets*.
 - A write to `user-rules.md`, `MEMORY.md` or a file in the install's `memory/` gets a prompt citing *Persist Insight*: whether something is a standing rule or a fact to remember is your call, settled through the `rule` [skill](skills.md).
 - A write to a check the project protects gets a prompt citing *External Gate* (on Bob, it is blocked). A project opts in with `.geneseed/protected-checks.txt` at its git root: one repo-relative file or folder per line, `#` for comments — the checks and tests the agent is judged by. A check the agent can edit is not a check. The list protects itself. Only file-write tools are seen: a shell `sed -i` or redirect is not, so run the same checks in CI as the boundary that holds.
+- A write to `.geneseed/done-checks.txt`, the done gate's own list (below), gets the same *External Gate* prompt: emptying it would disarm the gate.
 - Ordinary edits pass untouched.
 
+**The done gate.** Runs when a turn ends, inside `learn` and before it calls any model. A project opts in with `.geneseed/done-checks.txt` at its git root: one command per line, `#` for comments — the checks that prove the work, for example `npm run lint` and `node --test`. If the turn edited a file under that root and a listed check has not passed since the last edit, the turn does not end: the agent is told which checks are owed, citing *Verify Before Asserting*. A check counts when it ran as a shell command, unpiped (`npm test | tail` exits with `tail`'s code, so it proves nothing), and its result was not an error. The gate never runs a check itself. It blocks at most once per turn; the second stop ends the turn and leaves a line in the gate ledger. Only file-write tools count as edits: a shell `sed -i` or redirect is not seen. Without the file, nothing changes. On OpenCode the gate is a reminder on the next request (OpenCode 1 only); on Bob, whose Stop carries no transcript, the turn is not judged and a log line says so.
+
 **learn.** Takes the tail of the transcript and asks a model to distil what is worth keeping into one-fact-per-file entries under `memory/`. It is shown the facts already stored, so it updates one with the merged text rather than writing a twin (the old version is kept in `memory/archive/`), and moves one the session proved obsolete into `memory/archive/`. It needs `GENESEED_LLM` set to a model command, for example:
 
 ```bash

package/docs/extending.md

@@ -125,7 +125,7 @@ Notes that matter:
 
 ### The gates CI does not run
 
-- **The mutation matrix itself.** `tests/mutate.mjs` — 33 rows, each a one-string edit to a
+- **The mutation matrix itself.** `tests/mutate.mjs` — 35 rows, each a one-string edit to a
   product file with a written argument for which gate should catch it. The full run is **in no
   workflow** and should not be: it mutates the product tree 33 times and runs a gate per edit.
   Run `node tests/mutate.mjs --all` (or `--only M7`) by hand when you change something a gate is

package/docs/reference/plugin-context.md

@@ -17,6 +17,8 @@ One of the [OpenCode plugins](opencode-plugins.md). Its switches are also listed
 
 **When it runs.** On every request: the context rides invisibly in the request's message list, so it also survives compaction. If your OpenCode build lacks that (experimental) hook, the plugin notices and falls back to one visible message at session start, re-pushed when the session compacts.
 
+**The done gate's reminder.** In a project with `.geneseed/done-checks.txt` (see [Hooks](../concepts/hooks.md)), a request that follows a turn which edited files without every listed check passing since gets one more invisible message naming the checks owed. OpenCode has no turn-end event a plugin can block on, so this is a reminder, not a block. OpenCode 1 only: on OpenCode 2 the turn is not judged, and the plugin logs that once. `GENESEED_CONTEXT_INJECT=off` does not turn it off; removing the file does.
+
 **What you see.** Normally nothing — the context is there, but not shown. With the visible fallback, a `PROJECT CONTEXT` block at the top of the session.
 
 **Switches.**

package/docs/reference/troubleshoot-doctor.md

@@ -35,6 +35,37 @@ If the drift is your own edits, export them first — `geneseed diff` (or the co
 
 **Confirm.** `geneseed doctor` no longer reports the bundle.
 
+## `[probe] … registered but not refusing` / `refuses everything` / `does not run`
+
+> `[probe] ~/.claude: git-gate under Git Bash registered but not refusing — …`
+
+These come only from `geneseed doctor --probe`. It runs each installed gate exactly as the host's
+settings spell it, through the host's own shell, on `git reset --hard HEAD` (which must be refused)
+and `git status` (which must go through). An OpenCode install's guard plugin has no command to
+run: the probe imports it and calls its hook through both plugin APIs (V1 and V2), with `rm -rf /`
+as the call it must refuse. `GENESEED_GUARD=off` or `warn` in your terminal makes that a note,
+not a failure.
+
+**Cause.**
+- **Not refusing:** the gate launches but lets a destructive call through. Usually something in
+  the install tells it to stand down: an exclusion covering the temp folder, or a command that
+  lost its `--host bob`.
+- **Refuses everything:** the gate asks on every call. This is typically the hooks emitted for
+  one shell and run under another.
+- **Does not run:** the shim or its runner is gone, or the shell is missing.
+
+**Fix.**
+
+```bash
+geneseed rebuild-all
+```
+
+**Confirm.** `geneseed doctor --probe` prints `[probe] N gate(s) refused a destructive call and let
+a safe one through`.
+
+The probe runs under *this terminal's* environment (PATH, HOME), not the host app's. A host started
+with a different environment can still break a gate that passes here.
+
 ## `registry.json unreadable` / `registry.json is not valid JSON`
 
 > `[authoring] registry.json unreadable: …`

package/docs/understand/enforced-vs-asked.md

@@ -27,6 +27,7 @@ On Claude Code and OpenClaude the hooks never block silently. They make the host
 - **A scan of a whole filesystem**: a recursive `find`, `du`, `grep -r`, `rg` or `Get-ChildItem -Recurse` rooted at `/`, `/c` or `C:\`, which in Git Bash walks every drive for hours. Wired in every build.
 - **Credentials**: a write or edit whose content looks like a real key (AWS, GitHub, Anthropic, Slack, or a private-key block), anywhere except a `.env` file.
 - **Your rules and memory**: any write by the agent to `user-rules.md` or to the memory store. Whether something is a standing rule or a fact to remember is your call.
+- **Ending a turn without the proof**: only in a project that lists its checks in `.geneseed/done-checks.txt`. A turn that edited files cannot end until every listed check has passed since the last edit. The agent is stopped once, then the turn may end.
 
 If a gate crashes, it asks instead of letting the call through. If it cannot start at all (a deleted or broken shim) or times out, Claude Code blocks the call instead: see [Troubleshoot hooks](../reference/troubleshoot-hooks.md) to recover. Other shell commands, `rm -rf` included, go through Claude Code's normal permission flow.
 

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "4.4.1"
+  "version": "4.5.0"
 }

package/js/README.md

@@ -71,6 +71,7 @@ user co-owns, and the hook verbs those emitted configs then run.
 | `hosts.mjs` | The four host config dirs (opencode/claude/bob/openclaude), their `family` (`CLAUDE_STYLE`), plus `resolvePath`/`expanduser` |
 | `hooks.mjs` | The gate verbs, run on every tool call: `git-gate`, `rule-gate`, `tool-gate` (the two gates fused, for Bob), plus `ask`/the gate ledger/`guardGate`. `--host` picks the verdict dialect |
 | `hooks-context.mjs` | The `context` verb — SessionStart: session files plus the repo's context docs |
+| `hooks-done.mjs` | The done gate (#289): on Stop, inside `learn` and before its spawn, blocks a turn that edited files until `.geneseed/done-checks.txt`'s checks passed after the last edit |
 | `hooks-learn.mjs` | The `learn` verb — Stop/SubagentStop/PreCompact distiller; the hook path's ONE spawn (`$GENESEED_LLM`) |
 | `hooks-prims.mjs` | The Python path/text primitives the hook verbs share (`splitLines`, `readStdin`, a never-throwing `isFile`) |
 | `usage.mjs` | The usage counter `tool-gate` runs: one `{day, kind, name}` line per Skill or subagent call into `notebook/usage.jsonl`. Hook path: builtins only, silent, never throws |
@@ -101,7 +102,8 @@ Everything that inspects an already-built or already-deployed harness and report
 | `doctor.mjs` | The `geneseed doctor` **driver** only: picks themes, runs the checks, prints the verdict |
 | `checks-build.mjs` | Gates over what the build PRODUCED: links, tokens, theme parity, OpenCode colours, bundle drift |
 | `checks-repo.mjs` | Gates over the repo's own records: `registry.json`, committed secrets, the hook shim, vendored pins |
-| `checks-authoring.mjs` | `authoringProblems`, the aggregate self-consistency gate: spec purpose lines, the learn-prompt literal, `node --check` over the plugins (the doctor's one spawn), then the groups below |
+| `checks-authoring.mjs` | `authoringProblems`, the aggregate self-consistency gate: spec purpose lines, the learn-prompt literal, `node --check` over the plugins (the doctor's one default spawn), then the groups below |
+| `checks-probe.mjs` | `doctor --probe` (opt-in): runs each live install's own gate command through the host's shell on a must-refuse and a must-pass payload — the doctor's second spawn; the OpenCode guard plugin is imported and called in-process instead, through both plugin APIs |
 | `checks-constitution.mjs` | The constitution: rule declarations and citations, LEAN blocks, `HOOK_PINNED`, theme vocabulary, the console's `LAW_META`/`DOCTRINE_META` |
 | `checks-counts.mjs` | The hand-written counts: AGENT.md tables, README badges and prose, `SHIPPED.md`, held against `src/` |
 | `scan.mjs` | The shared walk/sort/strip/test primitives every `checks-*` uses. Owns no judgement itself |

package/js/cli-table.json

@@ -473,6 +473,21 @@
           "is_flag": true,
           "type": null,
           "hidden": false
+        },
+        {
+          "names": [
+            "--probe"
+          ],
+          "dest": "probe",
+          "metavar": null,
+          "help": "also run each installed gate on a destructive and a safe payload: it must refuse the first and let the second through. Claude Code, OpenClaude and Bob gates run as their settings spell them, through the host's shell; the OpenCode guard plugin is imported and called in-process (runs under this terminal's environment, not the host app's)",
+          "choices": null,
+          "default": false,
+          "required": false,
+          "nargs": "0",
+          "is_flag": true,
+          "type": null,
+          "hidden": false
         }
       ],
       "mutex": []

package/js/hosts/hooks-done.mjs

@@ -0,0 +1,169 @@
+/**
+ * The done gate — Verify Before Asserting's boundary half, at the moment a turn ends (#289).
+ *
+ * Every other gate sits before an act. This one sits at Stop: a turn that edited files under a
+ * project which lists its proof in `.geneseed/done-checks.txt` may not end until every listed
+ * check has run AND passed after the last edit. The gate never runs a check itself — the hook
+ * path starts no process of its own (ADR 0002) — it reads the turn's own tool calls in the transcript.
+ *
+ * WHY IT RIDES `learn` AND NOT A VERB OR A FLAG OF ITS OWN (ADR 0010). The machine-wide shim is
+ * last-writer-wins: an older `geneseed-hook` would refuse a new verb or flag, and the Stop
+ * command's `|| exit 0` would then skip learning too, silently. Arming on a project FILE keeps
+ * every emitted settings file byte-identical, so a stale shim only means "no done gate".
+ *
+ * WHY STDOUT JSON AND NOT EXIT 2. The emitted Stop command ends in `|| exit 0`, which swallows
+ * a 2. `{"decision":"block"}` on exit 0 is the one signal that survives the existing wiring.
+ * Allowing prints NOTHING — on Stop a stray stdout byte is read as a verdict.
+ *
+ * WHAT COUNTS (shortcut: write tools only; a shell `sed -i` or redirect is not an edit here —
+ * seeing those would need `git status`, a spawn. Same limit as `protected-checks.txt`):
+ *   - an edit is a Write/Edit/NotebookEdit/MultiEdit whose target is under the project root and
+ *     whose result is not an error (a denied write changed nothing);
+ *   - a pass is a Bash/PowerShell call whose command contains the declared line UNPIPED (a pipe
+ *     takes the exit code of its last stage: `npm test | tail` exits 0 on a red suite) and whose
+ *     result is not `is_error` — every non-zero exit, denial and timeout carries it (checked on
+ *     14 000+ real Claude Code results, 2026-10-17).
+ *
+ * At most one block per turn: `stop_hook_active` is true when this Stop follows a block, and the
+ * gate then lets the turn end and leaves a ledger line, so a gate that cries wolf gets found.
+ */
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { readText, printOut as out, printErr as err } from '../lib/fs.mjs';
+import { within } from '../lib/paths.mjs';
+import { gitRootOf } from './gitref.mjs';
+import { DONE_LIST, recordGate } from './hooks.mjs';
+import { splitLines } from './hooks-prims.mjs';
+
+const EDIT_TOOLS = new Set(['Write', 'Edit', 'NotebookEdit', 'MultiEdit']);
+const SHELL_TOOLS = new Set(['Bash', 'PowerShell']);
+
+/** The declared checks, one per line, `#` comments; null when the project has no list. */
+export function readDoneChecks(root) {
+  const file = path.join(root, DONE_LIST);
+  if (!existsSync(file)) return null;
+  try {
+    return splitLines(readText(file)).map((l) => l.trim().replace(/\s+/g, ' '))
+      .filter((l) => l && !l.startsWith('#'));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * True when `command` runs `line` with no pipe after it in the same segment. A segment ends at
+ * `&&`, `||`, `;` or a newline; a single `|` before that end is a pipe. Whitespace is collapsed
+ * on both sides. shortcut: quotes are not parsed — a `|` inside a quoted argument after the
+ * check reads as a pipe, which only ever refuses a pass, never grants one.
+ */
+export function runsUnpiped(command, line) {
+  const cmd = String(command).replace(/[ \t]+/g, ' ');
+  for (let i = cmd.indexOf(line); i !== -1; i = cmd.indexOf(line, i + 1)) {
+    const rest = cmd.slice(i + line.length);
+    let piped = false;
+    for (let j = 0; j < rest.length; j += 1) {
+      const two = rest.slice(j, j + 2);
+      if (two === '&&' || two === '||' || rest[j] === ';' || rest[j] === '\n') break;
+      if (rest[j] === '|') { piped = true; break; }
+    }
+    if (!piped) return true;
+  }
+  return false;
+}
+
+/** A user line that opens a turn: the user typed it, it is not a tool result or a meta note. */
+function isPrompt(obj) {
+  if (obj.type !== 'user' || obj.isMeta || obj.isSidechain) return false;
+  const c = obj.message && obj.message.content;
+  if (typeof c === 'string') return true;
+  return Array.isArray(c) && c.length > 0 && !c.some((b) => b && b.type === 'tool_result');
+}
+
+/**
+ * The decision, over transcript TEXT: the checks that have not passed since the turn's last
+ * edit, or [] when the turn may end (no edit, or every check passed after it). Exported for the
+ * unit tier — a transcript is text no CLI cell can vary cheaply.
+ */
+export function doneDecide(transcript, checks, root, cwd = root) {
+  const entries = [];
+  for (const line of splitLines(transcript)) {
+    if (!line.trim()) continue;
+    try { entries.push(JSON.parse(line)); } catch { /* a torn last line is not evidence */ }
+  }
+  let start = 0;
+  for (let i = entries.length - 1; i >= 0; i -= 1) {
+    if (isPrompt(entries[i])) { start = i + 1; break; }
+  }
+  const calls = [];                      // tool_use blocks, in order
+  const results = new Map();             // tool_use_id -> is_error
+  for (const obj of entries.slice(start)) {
+    if (obj.isSidechain) continue;
+    const content = obj.message && obj.message.content;
+    if (!Array.isArray(content)) continue;
+    for (const b of content) {
+      if (!b || typeof b !== 'object') continue;
+      if (b.type === 'tool_use') calls.push(b);
+      else if (b.type === 'tool_result') results.set(b.tool_use_id, b.is_error === true);
+    }
+  }
+  let lastEdit = -1;
+  calls.forEach((c, i) => {
+    if (!EDIT_TOOLS.has(c.name) || results.get(c.id) === true) return;
+    const p = c.input && (c.input.file_path || c.input.notebook_path || c.input.path);
+    if (typeof p === 'string' && p && within(path.resolve(cwd, p), root)) lastEdit = i;
+  });
+  if (lastEdit === -1) return [];
+  const passed = new Set();
+  calls.slice(lastEdit + 1).forEach((c) => {
+    const command = SHELL_TOOLS.has(c.name) && c.input && c.input.command;
+    // A call with no result yet (the host has not flushed it) is not a pass.
+    if (typeof command !== 'string' || results.get(c.id) !== false) return;
+    for (const check of checks) if (runsUnpiped(command, check)) passed.add(check);
+  });
+  return checks.filter((c) => !passed.has(c));
+}
+
+/**
+ * The Stop-side wrapper `cmdLearn` calls first. Returns true when it printed a block (the turn
+ * goes on, so `learn` must not distil yet); false in every other case, with nothing on stdout.
+ */
+export function doneGate(meta, args) {
+  try {
+    const cwd = typeof meta.cwd === 'string' && meta.cwd ? meta.cwd : process.cwd();
+    const root = gitRootOf(cwd);
+    const checks = root ? readDoneChecks(root) : null;
+    if (!checks || !checks.length) return false;
+    // Bob's Stop payload carries no transcript (learn's I2): nothing to judge, and it says so.
+    if (args.host === 'bob' || typeof meta.transcript_path !== 'string') {
+      err(`[done-gate] no transcript${args.host === 'bob' ? ' (bob)' : ''} — turn not judged.\n`);
+      return false;
+    }
+    let transcript;
+    try {
+      transcript = readText(meta.transcript_path);
+    } catch {
+      // No ask tier on Stop: blocking on an unreadable transcript would trap the user.
+      err('[done-gate] transcript unreadable — turn not judged.\n');
+      return false;
+    }
+    const missing = doneDecide(transcript, checks, root, cwd);
+    if (!missing.length) return false;
+    const install = args.memory ? path.dirname(args.memory) : null;
+    if (meta.stop_hook_active === true) {
+      recordGate(install, 'done-gate-cap', 'law-3');
+      err(`[done-gate] cap reached — turn ends with unproven checks: ${missing.join('; ')}\n`);
+      return false;
+    }
+    recordGate(install, 'done-gate', 'law-3');
+    out(`${JSON.stringify({
+      decision: 'block',
+      reason: 'Geneseed (Verify Before Asserting) — this turn edited files, and these '
+        + `checks from ${DONE_LIST} have not passed since the last edit: ${missing.join('; ')}. `
+        + 'Run them unpiped, or say plainly that they were not run and why.',
+    })}\n`);
+    return true;
+  } catch (e) {
+    err(`[done-gate] skipped: ${e && e.message}\n`);
+    return false;
+  }
+}

package/js/hosts/hooks-learn.mjs

@@ -13,6 +13,7 @@ import {
   globalHookStandingDown, hookProjectDir, resolveMemoryDir, sovereignBypass,
 } from './hosts.mjs';
 import { readStdin, splitLines, splitWords } from './hooks-prims.mjs';
+import { doneGate } from './hooks-done.mjs';
 import {
   existingSlugs, readFacts, writeMemories, consolidateMemory, appendAgentLesson,
 } from './memory-files.mjs';
@@ -309,6 +310,10 @@ export function cmdLearn(args) {
   const hookEvent = typeof meta.hook_event_name === 'string' ? meta.hook_event_name
     : (typeof meta.event === 'string' ? meta.event : null);
 
+  // The done gate (#289) judges the turn BEFORE anything here spawns, and only on Stop. A block
+  // means the turn goes on, so there is nothing to distil yet: the next Stop will.
+  if (hookEvent === 'Stop' && !args.file && doneGate(meta, args)) return 0;
+
   // I2 (Bob): its Stop payload never carries `transcript_path`, so there is never a transcript
   // to distil — and the bare envelope itself is not notes text (that would waste a model call
   // on `{"event":"Stop","session_id":"s"}`). Scoped to `--host bob`: every other host's Stop/

package/js/hosts/hooks.mjs

@@ -255,8 +255,12 @@ const BLOCK_RULES = new Set(['law-1', 'law-4', 'rigor-5', 'ops-2']);
  * information a trimmed file loses. The re-read happens on the ask path only.
  */
 const MAX_LEDGER_LINES = 1000;
+// Exported for the done gate (`./hooks-done.mjs`), which records from Stop, not from `ask`.
+export function recordGate(root, verb, rule) { ledger(root, verb, rule); }
 function ledger(root, verb, rule) {
-  if (!root) return;
+  // `doctor --probe` asks on purpose; its asks are not the user's. Read here, on the rare ask
+  // path only: the variable silences the RECORD, never the decision.
+  if (!root || process.env.GENESEED_GATE_PROBE) return;
   try {
     const file = path.join(root, GATE_LEDGER);
     appendFileSync(file, `${JSON.stringify({
@@ -533,11 +537,15 @@ const DOTENV_RE = /(^|[\\/])\.env(\.[^\\/]*)?$/;
  * not seen here; CI running the checks is the boundary that holds against that.
  */
 export const SENSOR_LIST = '.geneseed/protected-checks.txt';
+// The done gate's list (`./hooks-done.mjs`, #289) protects itself too, with or without a
+// protected-checks list: emptying it would disarm the gate it feeds.
+export const DONE_LIST = '.geneseed/done-checks.txt';
 function protectedCheck(p) {
   try {
     const target = resolvePath(p);
     const root = gitRootOf(path.dirname(target));
     if (!root) return null;
+    if (normcase(path.relative(root, target)) === normcase(DONE_LIST)) return DONE_LIST;
     const text = readFileSync(path.join(root, SENSOR_LIST), 'utf8');
     // `normcase` folds case AND slashes on Windows, so both sides go through it, the trailing
     // separator of the prefix included.
@@ -579,7 +587,8 @@ function ruleDecide(args, payload) {
   const sensor = protectedCheck(p);
   if (sensor) {
     return ask(args, 'rule-gate', 'rigor-5', `Geneseed (External Gate) — ${p} is a protected `
-      + `check (${sensor}, listed in ${SENSOR_LIST}). A check the agent can edit is not a `
+      + `check (${sensor === DONE_LIST ? 'the done gate list itself'
+        : `${sensor}, listed in ${SENSOR_LIST}`}). A check the agent can edit is not a `
       + 'check: fix the code, not the check, unless the user asks for this edit.');
   }
   const target = ruleGateTarget(p, args.root);

package/js/hosts/installs.mjs

@@ -763,7 +763,8 @@ export function hookShellProblems(targets = installTargets(), platform = process
     out.push(was === 'bash'
       ? `[hooks] ${cfg}: hooks were emitted for Git Bash, which is no longer found, so Claude `
         + 'Code runs them under PowerShell where context/learn fail open (no effect) and '
-        + 'git-gate/rule-gate now BLOCK every call instead of gating it - run: geneseed rebuild-all'
+        + 'git-gate/rule-gate now BLOCK every call instead of gating it - run: geneseed rebuild-all, '
+        + 'then confirm with: geneseed doctor --probe'
       : `[note] ${cfg}: hooks were emitted for PowerShell, but Git Bash is now found - they work, `
         + 'and pay PowerShell startup on every call; geneseed rebuild-all switches them back');
   }

package/js/hosts/shim.mjs

@@ -118,14 +118,18 @@ export function shimDead() {
  */
 export function hookShimBody(runner, entry, platform = process.platform) {
   if (platform === 'win32') {
-    // Bare `exit /b` propagates the LIVE errorlevel; `%ERRORLEVEL%` would expand at parse
-    // time and return a stale one. Never plain `exit` — that kills the parent cmd.exe, so
+    // `exit /b %ERRORLEVEL%`, on its OWN line. A bare `exit /b` was here, on the claim that it
+    // propagates the live errorlevel, and that is false under `cmd /d /s /c` — Bob's hook
+    // shell, and Node's `shell: true`: the batch returned 0 after the gate exited 2, so every
+    // Bob block on Windows went through (#290; measured, see hook_form.test.mjs). `%ERRORLEVEL%`
+    // expands when ITS line is parsed, which is after the runner line has finished, so the value
+    // is the runner's, not a stale one. Never plain `exit` — that kills the parent cmd.exe, so
     // the emitted `|| exit 0` would never get to evaluate.
     return '@echo off\r\n'
       + 'rem Generated by Geneseed - do not edit. Rewritten on every emit.\r\n'
       + 'setlocal\r\n'
       + `"${runner}" "${entry}" %*\r\n`
-      + 'exit /b\r\n';
+      + 'exit /b %ERRORLEVEL%\r\n';
   }
   return '#!/bin/sh\n'
     + '# Generated by Geneseed - do not edit. Rewritten on every emit.\n'
@@ -281,18 +285,27 @@ const GIT_BASH_NAMES = new Set(['bash.exe', 'sh.exe', 'bash', 'sh']);
  */
 export function claudeHookShell(env = process.env, platform = process.platform) {
   if (platform !== 'win32') return 'bash';
+  return claudeGitBashPath(env) ? 'bash' : 'powershell';
+}
+
+/**
+ * The Git Bash `claudeHookShell` finds on Windows, as a path — or null. One rule, two readers:
+ * the emit only needs to know WHETHER, `doctor --probe` (`js/inspect/checks-probe.mjs`) needs
+ * the file itself, to run a gate through the same shell Claude would.
+ */
+export function claudeGitBashPath(env = process.env) {
   const read = (name) => Object.entries(env).find(([k]) => k.toUpperCase() === name)?.[1];
   const isFile = (p) => { try { return statSync(p).isFile(); } catch { return false; } };
   const forced = read('CLAUDE_CODE_GIT_BASH_PATH');
   if (forced && GIT_BASH_NAMES.has(path.basename(forced).toLowerCase()) && isFile(forced)) {
-    return 'bash';
+    return forced;
   }
   for (const raw of (read('PATH') || '').split(';')) {
     const dir = raw.replace(/"/g, '');
-    if (dir && isFile(path.join(dir, 'git.exe'))
-      && isFile(path.join(dir, '..', 'bin', 'bash.exe'))) return 'bash';
+    const bash = dir ? path.join(dir, '..', 'bin', 'bash.exe') : '';
+    if (dir && isFile(path.join(dir, 'git.exe')) && isFile(bash)) return path.resolve(bash);
   }
-  return 'powershell';
+  return null;
 }
 
 /**

package/js/inspect/checks-constitution.mjs

@@ -170,12 +170,12 @@ const DOCTRINE_TOKEN_RE = /\{\{DOCTRINE(?:\}\}|:)/;
  * The rules the hooks enforce at the tool boundary, and the address each is bound to there. The
  * hook path cannot afford to read the canon on every tool call, so its gate-ledger keys
  * (`law-1`, `law-4`, `process-1`, `process-5`, `rigor-5`, `ops-2` in `js/hosts/hooks.mjs` and the OpenCode guard
- * plugin), `CONSENT_RULE` in `js/hosts/settings.mjs` and the console's `HOOK_GATED` stay
+ * plugin; `law-3` in the done gate, `js/hosts/hooks-done.mjs`), `CONSENT_RULE` in `js/hosts/settings.mjs` and the console's `HOOK_GATED` stay
  * number-keyed — and this pin is what turns a renumber that moves one of these rules into a
  * doctor failure instead of a gate silently guarding its neighbour.
  */
 export const HOOK_PINNED = {
-  'sealed-secrets': 'I', 'deletion-is-deliberate': 'IV',
+  'sealed-secrets': 'I', 'verify-before-asserting': 'III', 'deletion-is-deliberate': 'IV',
   'persist-insight': 'process 1', 'consent-before-push': 'process 5', 'external-gate': 'rigor 5',
   'commands-must-return': 'ops 2',
 };

package/js/inspect/checks-probe.mjs

@@ -0,0 +1,295 @@
+/**
+ * `geneseed doctor --probe` — prove each installed gate still REFUSES, not just that it exists.
+ *
+ * A gate that is registered, launches and then allows everything looks exactly like a working
+ * one: `onFailure: "block"` (ADR 0007) covers a gate that never starts, `shimProblems` covers the
+ * shim's paths and `hookShellProblems` infers shell drift — none of them observes a verdict. So
+ * this runs each live install's own gate command, AS ITS SETTINGS SPELL IT, through the shell
+ * the host would use, on two canned payloads: one Law IV call that every build must refuse
+ * (`git reset --hard HEAD`, also in Bob's `BLOCK_RULES`) and one that must pass (`git status`).
+ * Both directions are judged, because "allows everything" and "refuses everything" (the
+ * PowerShell-fallback case `hookShellProblems` can only infer) are both broken gates.
+ *
+ * WHY THIS SPAWNS, and why it is opt-in. ADR 0002 allows a CLI spawn only as a declared row of
+ * `ALLOWED_SPAWNS` (`tests/unit/hook_cli.test.mjs`); this is the row that runs INSTALLED code
+ * rather than the checkout's, which is why it waits for `--probe` instead of riding every
+ * `doctor`. It runs only a command that `liveRecordedHooks` returns — recorded in our own
+ * manifest AND live in the settings — and that still carries `geneseed-hook`, a gate verb and
+ * `--root`; anything else is reported and never run. Nothing the payloads name is executed:
+ * the gate only reads them, from an empty temp dir.
+ *
+ * WHAT A PASS DOES NOT CLAIM. The probe runs under doctor's environment — this terminal's PATH
+ * and HOME — not the host app's. A host launched with a different environment (an empty HOME, a
+ * PATH without the shell's tools) can still break a gate that passes here.
+ *
+ * `GENESEED_GATE_PROBE=1` keeps the probe's asks out of the gate ledger (`ledger()` in
+ * `js/hosts/hooks.mjs`), so `status` never counts a doctor run as a refusal.
+ */
+import { existsSync, mkdtempSync, rmSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { liveRecordedHooks } from '../hosts/hosts.mjs';
+import { claudeCfg, installState, installTargets } from '../hosts/installs.mjs';
+import { SHIM_MARK, claudeGitBashPath } from '../hosts/shim.mjs';
+import { which } from '../lib/paths.mjs';
+import { NO_WINDOW } from '../lib/proc.mjs';
+import { NOTE, withTempDir } from './scan.mjs';
+import { spawnSync } from 'node:child_process';
+
+/**
+ * The gate that refuses Law IV on each host (`claudeHookGroups`, `js/hosts/settings.mjs`). On
+ * Claude and OpenClaude it is `git-gate`; `tool-gate` there only counts Skill/Agent calls. Bob
+ * runs everything through `tool-gate --host bob`. OpenCode's guard is an in-process plugin with
+ * no command: `guardProbe` below imports it instead.
+ */
+export const PROBED_VERB = { claude: 'git-gate', openclaude: 'git-gate', bob: 'tool-gate' };
+
+export const BAD_COMMAND = 'git reset --hard HEAD';
+export const GOOD_COMMAND = 'git status';
+
+const PROBE_TIMEOUT_MS = 20_000;
+
+/** A PreToolUse payload in Claude's shape — the shape every probed host's gate reads. */
+export function probePayload(command, cwd) {
+  return JSON.stringify({
+    session_id: 'geneseed-probe', hook_event_name: 'PreToolUse', tool_name: 'Bash',
+    tool_input: { command }, cwd,
+  });
+}
+
+/**
+ * The shell a host runs this handler under, as `{ exe, argv, label, verbatim }` — or null when
+ * that shell is not on this machine. Mirrors the emit's own rule: an explicit
+ * `shell: "powershell"` wins; Bob runs `cmd /c` on Windows; Claude/OpenClaude run Git Bash
+ * there (`claudeGitBashPath`, the rule `claudeHookShell` uses); `sh -c` everywhere else.
+ */
+export function probeShell(host, handler, platform = process.platform, env = process.env) {
+  const cmd = handler.command;
+  if (handler.shell === 'powershell') {
+    const ps = which('powershell') || which('pwsh');
+    return ps ? { exe: ps, argv: ['-NoProfile', '-NonInteractive', '-Command', cmd], label: 'PowerShell' }
+      : null;
+  }
+  if (platform !== 'win32') return { exe: which('sh') || '/bin/sh', argv: ['-c', cmd], label: 'sh' };
+  if (host === 'bob') {
+    // `/s /c "<cmd>"` with verbatim arguments: cmd strips the outer quotes and keeps the
+    // command's own quoting. Node's default quoting would turn its `"` into `\"`, which cmd
+    // does not unescape.
+    const cmdExe = env.ComSpec || env.COMSPEC || which('cmd');
+    return cmdExe ? { exe: cmdExe, argv: ['/d', '/s', '/c', `"${cmd}"`], label: 'cmd', verbatim: true }
+      : null;
+  }
+  const bash = claudeGitBashPath(env);
+  return bash ? { exe: bash, argv: ['-c', cmd], label: 'Git Bash' } : null;
+}
+
+const ASK_RE = /"permissionDecision":\s*"(?:ask|deny)"/;
+
+/** Did the gate refuse? Exit 2 on Bob; on Claude-shaped hosts exit 2 or an ask/deny verdict. */
+export function refused(host, r) {
+  if (host === 'bob') return r.status === 2;
+  return r.status === 2 || (r.status === 0 && ASK_RE.test(r.stdout || ''));
+}
+
+/**
+ * The verdict for one gate, from its two runs — null when the gate is sound, or the problem.
+ * Pure, so the whole verdict table is pinned without spawning.
+ */
+export function probeVerdict(host, bad, good) {
+  for (const r of [bad, good]) {
+    if (r.status !== 0 && r.status !== 2) {
+      const why = r.error ? r.error : `exit ${r.status}`;
+      const tail = (r.stderr || '').trim().split(/\r?\n/).pop();
+      return `does not run (${why}${tail ? `: ${tail}` : ''})${host === 'claude'
+        ? ' — Claude blocks every matching call while this lasts (onFailure: block)'
+        : ' — the host lets every call through while this lasts'}`;
+    }
+  }
+  if (!refused(host, bad)) return `registered but not refusing — \`${BAD_COMMAND}\` went through`;
+  if (refused(host, good)) return `refuses everything — \`${GOOD_COMMAND}\` was refused too`;
+  return null;
+}
+
+/** Is this recorded command one of ours for `verb`? A gate verb, `--root`, and our shim. */
+export function isOurGate(command, verb) {
+  return command.includes(` ${verb} --root`) && command.includes(SHIM_MARK);
+}
+
+/** One spawn of one handler on one payload. THE ONE SPAWN of this module. */
+function runOnce(shell, payload, cwd, env) {
+  const r = spawnSync(shell.exe, shell.argv, {
+    input: payload, cwd, env, encoding: 'utf-8', timeout: PROBE_TIMEOUT_MS,
+    windowsVerbatimArguments: Boolean(shell.verbatim), ...NO_WINDOW,
+  });
+  const e = /** @type {NodeJS.ErrnoException | undefined} */ (r.error);
+  const error = e ? (e.code === 'ETIMEDOUT' ? 'timed out' : e.message) : null;
+  return { status: r.status, stdout: r.stdout, stderr: r.stderr, error };
+}
+
+/**
+ * Probe every live Claude-shaped install. Returns `{ problems, probed }`: `problems` in
+ * doctor's line format, `probed` the labels of the gates that ran and behaved.
+ * `targets`, `platform` and `env` are parameters so a test hands it a sandboxed install.
+ */
+export function gateProbe(targets = installTargets(), { platform = process.platform, env = process.env } = {}) {
+  const problems = [];
+  const probed = [];
+  for (const [host, scope, root] of targets) {
+    const verb = PROBED_VERB[host];
+    if (!verb || installState(root, host, scope) !== 'active') continue;
+    const cfg = claudeCfg(root, scope, host);
+    const gates = liveRecordedHooks(cfg)
+      .filter(([event, h]) => event === 'PreToolUse' && h.command.includes(` ${verb} --root`));
+    if (!gates.length) {
+      problems.push(`[probe] ${cfg}: no live ${verb} hook in its settings — nothing refuses `
+        + 'a destructive call at the boundary — run: geneseed rebuild-all');
+      continue;
+    }
+    for (const [, handler] of gates) {
+      const label = `[probe] ${cfg}: ${verb}`;
+      if (!isOurGate(handler.command, verb)) {
+        problems.push(`${label} not probed — its command does not run ${SHIM_MARK}, and doctor `
+          + 'runs nothing else from a settings file');
+        continue;
+      }
+      const shell = probeShell(host, handler, platform, env);
+      if (!shell) {
+        problems.push(`${label} does not run — the shell ${host} would use is not on this machine`);
+        continue;
+      }
+      const verdict = withTempDir((tmp) => {
+        const runEnv = { ...env, GENESEED_GATE_PROBE: '1', CLAUDE_PROJECT_DIR: tmp };
+        const bad = runOnce(shell, probePayload(BAD_COMMAND, tmp), tmp, runEnv);
+        const good = runOnce(shell, probePayload(GOOD_COMMAND, tmp), tmp, runEnv);
+        return probeVerdict(host, bad, good);
+      }, 'geneseed-probe-');
+      if (verdict) problems.push(`${label} under ${shell.label} ${verdict}`);
+      else probed.push(`${path.normalize(cfg)} (${verb}, ${shell.label})`);
+    }
+  }
+  return { problems, probed };
+}
+
+// ---- OpenCode: the guard plugin, probed in-process ------------------------------------------
+
+export const GUARD_PLUGIN = 'geneseed-guard.js';
+/** The guard blocks catastrophic shell (`SHELL_BLOCK_RE`); destructive git is the permission
+ * prompt's job there, and only WARNS in the guard — so its must-refuse payload is this one. */
+export const GUARD_BAD_COMMAND = 'rm -rf /';
+
+/** The guard plugin of an OpenCode install: `<global>/plugins/` or `<repo>/.opencode/plugins/`
+ * (`emitOpencodeInto` copies the plugins to `<dir>/plugins`). */
+export function guardPluginPath(root, scope) {
+  return path.join(scope === 'global' ? root : path.join(root, '.opencode'), 'plugins', GUARD_PLUGIN);
+}
+
+/** Run `fn` with stderr swallowed and `GENESEED_GATE_PROBE` set, both restored after. */
+async function quietProbe(fn) {
+  const write = process.stderr.write;
+  const saved = process.env.GENESEED_GATE_PROBE;
+  process.stderr.write = () => true;
+  process.env.GENESEED_GATE_PROBE = '1';
+  try { return await fn(); } finally {
+    process.stderr.write = write;
+    if (saved === undefined) delete process.env.GENESEED_GATE_PROBE;
+    else process.env.GENESEED_GATE_PROBE = saved;
+  }
+}
+
+/**
+ * Both plugin APIs, each on both payloads: `{ v1: [badRefused, goodRefused], v2: [...] }`.
+ * V1 (`server`) refuses by THROWING `[geneseed-guard] …`; V2 (`setup`) by RENAMING the call
+ * (`setupV2`'s docblock). An unexpected throw is not a refusal — it is rethrown, and the caller
+ * reports the guard as broken.
+ */
+export async function runGuard(mod, cwd) {
+  const v1 = async (command) => {
+    const hooks = await mod.server({ worktree: cwd, directory: cwd });
+    try {
+      await hooks['tool.execute.before']({ tool: 'bash' }, { args: { command } });
+      return false;
+    } catch (e) {
+      if (String(e?.message || '').startsWith('[geneseed-guard]')) return true;
+      throw e;
+    }
+  };
+  const v2 = async (command) => {
+    /** @type {((event: { tool: string }) => Promise<void>) | null} */
+    let hook = null;
+    await mod.setup({
+      location: { project: { directory: cwd }, directory: cwd },
+      tool: { hook: (name, fn) => { if (name === 'execute.before') hook = fn; } },
+    });
+    if (!hook) throw new Error('setup registered no execute.before hook');
+    const event = { tool: 'bash', input: { command } };
+    await hook(event);
+    return event.tool !== 'bash';
+  };
+  return {
+    v1: [await v1(GUARD_BAD_COMMAND), await v1(GOOD_COMMAND)],
+    v2: [await v2(GUARD_BAD_COMMAND), await v2(GOOD_COMMAND)],
+  };
+}
+
+/** The verdict for one API's pair — null when sound. */
+export function guardVerdict([badRefused, goodRefused]) {
+  if (!badRefused) return `registered but not refusing — \`${GUARD_BAD_COMMAND}\` went through`;
+  if (goodRefused) return `refuses everything — \`${GOOD_COMMAND}\` was refused too`;
+  return null;
+}
+
+/**
+ * Probe every live OpenCode install's guard plugin by importing it into this process and
+ * calling its hooks — no spawn. Proves the installed FILE and its logic under Node, not under
+ * OpenCode's runtime (the weekly host canary proves the plugin loads there). Returns
+ * `{ problems, probed }` like `gateProbe`; a guard this environment switched off
+ * (`GENESEED_GUARD=off|warn`) is a NOTE, not a failure — that switch is the user's.
+ *
+ * Only a file named `geneseed-guard.js` in an install `installState` recognises is imported,
+ * and only one whose default export is `{ id: 'geneseed-guard', server, setup }`.
+ */
+export async function guardProbe(targets = installTargets(), env = process.env) {
+  const problems = [];
+  const probed = [];
+  for (const [host, scope, root] of targets) {
+    if (host !== 'opencode' || installState(root, host, scope) !== 'active') continue;
+    const file = guardPluginPath(root, scope);
+    const label = `[probe] ${file}`;
+    if (!existsSync(file)) {
+      problems.push(`${label}: no guard plugin — nothing refuses a catastrophic command at the `
+        + 'boundary — run: geneseed rebuild-all');
+      continue;
+    }
+    const mode = String(env.GENESEED_GUARD || 'on').toLowerCase();
+    if (['off', '0', 'false', 'no', 'warn'].includes(mode)) {
+      problems.push(`${NOTE}${label}: not probed — GENESEED_GUARD=${mode} in this environment `
+        + 'switches the guard off');
+      continue;
+    }
+    let verdicts;
+    try {
+      const mod = (await import(pathToFileURL(file).href)).default;
+      if (mod?.id !== 'geneseed-guard' || typeof mod.server !== 'function' || typeof mod.setup !== 'function') {
+        problems.push(`${label}: not probed — it does not export the Geneseed guard `
+          + '({ id, server, setup }) — run: geneseed rebuild-all');
+        continue;
+      }
+      verdicts = await withTempDirAsync((tmp) => quietProbe(() => runGuard(mod, tmp)));
+    } catch (e) {
+      problems.push(`${label}: does not run (${e?.message || e})`);
+      continue;
+    }
+    const bad = [['V1', guardVerdict(verdicts.v1)], ['V2', guardVerdict(verdicts.v2)]]
+      .filter(([, v]) => v);
+    for (const [api, v] of bad) problems.push(`${label}: guard (OpenCode ${api} hook) ${v}`);
+    if (!bad.length) probed.push(`${path.normalize(file)} (guard, in-process)`);
+  }
+  return { problems, probed };
+}
+
+/** `withTempDir` for an async body: the dir outlives the promise, then goes. */
+async function withTempDirAsync(fn) {
+  const tmp = mkdtempSync(path.join(os.tmpdir(), 'geneseed-probe-'));
+  try { return await fn(tmp); } finally { rmSync(tmp, { recursive: true, force: true }); }
+}

package/js/inspect/doctor.mjs

@@ -39,6 +39,7 @@ import {
 import { validateIsVendored } from '../hosts/native.mjs';
 import { printOut } from '../lib/fs.mjs';
 import { authoringProblems, loopProblems } from './checks-authoring.mjs';
+import { gateProbe, guardProbe } from './checks-probe.mjs';
 import {
   checkBuild, colorThemeProblems, renderedProblems, themeParityProblems,
 } from './checks-build.mjs';
@@ -188,6 +189,7 @@ export function claudeBobEmitProblems(themeName) {
  */
 export function doctorCollect({
   theme = null, allThemes = false, bundle = null, noBundle = false, groups = null,
+  probe = false, probed = null, extraProbeProblems = [],
 } = {}) {
   const available = themeFiles().map(stemOf);
   if (!available.length) return [[], ['[doctor] no themes found']];
@@ -208,6 +210,11 @@ export function doctorCollect({
   // placed after them could only ever observe the freshly repaired file and would be dead
   // code that always reports clean. Reported in its usual slot further down.
   const shimProbs = shimProblems();
+  // `--probe` (js/inspect/checks-probe.mjs) runs the installed gates THROUGH the shim, so it is
+  // sampled here for the same reason: after the emits it could only meet a repaired shim.
+  // `probed` collects the gates that behaved, for `cmdDoctor`'s summary line.
+  const probeRun = probe ? gateProbe() : null;
+  if (probeRun && probed) probed.push(...probeRun.probed);
   let problems = [];
   withTempDir((tmp) => {
     for (const themeName of themes) {
@@ -237,6 +244,9 @@ export function doctorCollect({
   // misbehave under PowerShell (Task 15) — context/learn fail open, and since Task 1 the two
   // gates fail CLOSED instead (`onFailure: "block"`). The reverse direction is a note.
   problems = problems.concat(ran('hook_shell', 'Hook shell', hookShellProblems()));
+  if (probeRun) {
+    problems = problems.concat(ran('probe', 'Gate probe', [...probeRun.problems, ...extraProbeProblems]));
+  }
   // A machine check like the shim's: OPENCODE_CONFIG_DIR adds a dir, it does not replace one.
   const shadow = opencodeShadowedInstall();
   problems = problems.concat(ran('opencode_dirs', 'OpenCode config dirs', shadow
@@ -281,9 +291,19 @@ function captureBoth(fn) {
  * maintainer sweep. The cross-theme parity check runs in every mode.
  */
 export function cmdDoctor(args) {
+  // `--probe` alone is asynchronous: the OpenCode guard is probed by importing the installed
+  // plugin (`guardProbe`), and `import()` has no synchronous form. Every other path stays
+  // synchronous, because `validate` and `setup` call this and read its number directly.
+  if (args.probe) return guardProbe().then((guard) => doctorReport(args, guard));
+  return doctorReport(args, null);
+}
+
+function doctorReport(args, guard) {
+  const probed = guard ? [...guard.probed] : [];
   const [themes, collected] = doctorCollect({
     theme: args.theme, allThemes: Boolean(args.all), bundle: args.bundle,
-    noBundle: Boolean(args.noBundle),
+    noBundle: Boolean(args.noBundle), probe: Boolean(args.probe), probed,
+    extraProbeProblems: guard ? guard.problems : [],
   });
   if (!themes.length) {
     printOut(`${collected.length ? collected[0] : '[doctor] no themes found'}\n`);
@@ -303,6 +323,12 @@ export function cmdDoctor(args) {
   const note = scoped
     ? `  (scoped to installed theme '${themes[0]}'; run with --all to sweep every theme)` : '';
   for (const n of notes) printOut(`${n}\n`);
+  // The probe's line on success, and the limit it cannot see past, said every time.
+  if (args.probe) {
+    printOut(`[probe] ${probed.length} gate(s) refused a destructive call and let a safe one `
+      + `through${probed.length ? `: ${probed.join(', ')}` : ''} — under this terminal's `
+      + 'environment, not the host app\'s\n');
+  }
   if (problems.length) {
     printOut(`[doctor] ${problems.length} problem(s) across ${themes.length} theme(s):\n`);
     for (const p of problems) printOut(`  - ${p}\n`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "Every field here is argued and gated in tests/unit/package_manifest.test.mjs. `files`, `bin` and `engines` each have a test that fails when reality drifts from this file; `version` mirrors harness.config.json and is gated too. Read that docblock before editing this one.",
   "name": "geneseed",
-  "version": "4.4.1",
+  "version": "4.5.0",
   "description": "A portable, theme-able harness you implant once and use everywhere to grow a disciplined AI coding agent.",
   "keywords": [
     "ai",

package/src/skills/rule.md

@@ -73,7 +73,11 @@ re-derived. Then take exactly one branch.
    rebuild would have seeded it.
 6. **Draft in the file's own format**: the next free `## R<n> — Title` heading, an
    optional `(scope: user|project | source: …)` metadata line, then the rule in one
-   short paragraph, plain and testable. For a promotion from {{MEMORY}}, set
+   short paragraph, plain and testable. For a rule the user stated, `source:` keeps
+   their own words and the day they said them — `source: user 2026-10-16 "never push
+   red"` — one sentence at most: it is what later tells a stale rule from a changed
+   mind. The metadata line splits on `|`, so write any `|` inside the quote as `/` and
+   say so when you show the draft. For a promotion from {{MEMORY}}, set
    `source:` to the memory's name and add `trial until:` about a month out — a
    promoted rule starts on probation.
 7. Show the exact text to the user and wait for explicit consent ({{LAW:deletion-is-deliberate}}) before
@@ -90,7 +94,12 @@ the user picks "rule" out of impatience and the set inflates.
 **Review flow** (on request, or when a `trial until:` date has passed): for each rule
 due, ask whether it actually fired since adoption — graduate it (drop the trial
 marker), demote it back to a {{MEMORY}} fact, or delete it. Same consent gate as
-adoption.
+adoption. Two more cases are due at any time:
+- **Contradicted.** The user's later words contradict a rule: the rule is the suspect.
+  Quote both — its `source:` and the new words — and ask which stands.
+- **Broken while only read.** A rule nothing checks but reading it, broken twice
+  anyway, is step 1's mechanical case: propose the hook or check rather than
+  rewording it.
 
 **Consolidation flow** → read [rule/consolidate.md](rule/consolidate.md) and follow it.