geneseed 4.4.1 → 4.6.0

package/docs/concepts/enforcement-table.md

@@ -13,8 +13,8 @@ few rules are enforced; the rest are asked on every host, through the root rules
 
 Derived from the code, not from this project's own planning notes: `js/hosts/hooks.mjs`'s
 `BLOCK_RULES` and gate functions, `HOOK_PINNED` in `js/inspect/checks-constitution.mjs`,
-`LAW_IV_BASH` and `CONSENT_RULE` in `js/hosts/settings.mjs`, and
-`adapters/opencode/plugins/geneseed-guard.js`. `HOOK_PINNED` is what keeps this table from
+`LAW_IV_BASH` and `CONSENT_RULE` in `js/hosts/settings.mjs`, `js/hosts/hooks-done.mjs`, and
+`adapters/opencode/plugins/geneseed-guard.js` and `geneseed-context.js`. `HOOK_PINNED` is what keeps this table from
 silently guarding the wrong rule after a renumber. See [ADR 0005](../adr/0005-stable-rule-ids.md).
 
 ### The enforced rules
@@ -26,6 +26,7 @@ silently guarding the wrong rule after a renumber. See [ADR 0005](../adr/0005-st
 | `persist-insight` | process | ask: rule-gate (a write to `user-rules.md` or the memory store) | same as Claude Code | ask once: guard plugin (refuses the *first* write to that path; a re-issued write goes through) | log only (warning, call goes through) |
 | `consent-before-push` | process | ask: git-gate (every `git commit`/`git push`). Togglable: build without the process pack, or drop this rule alone with `--exclude-rules` (see [Exclusions](exclusions.md)). Only this question drops; the `deletion-is-deliberate` gate stays. | same as Claude Code | ask: permission prompt (`git commit*`/`git push*`), wired only when the process pack is on; a `loop/*` push is statically allowed | log only |
 | `external-gate` | rigor | ask: rule-gate (a write under a project's `.geneseed/protected-checks.txt` list) | same as Claude Code | block: guard plugin (same list) | block (exit 2) |
+| `verify-before-asserting` | law | block at Stop, once per turn: the done gate in `learn` (a turn that edited files, while a check in the project's `.geneseed/done-checks.txt` has not passed since the last edit). Opt-in per project | same as Claude Code (**unverified live**: a frozen fork, and no check runs a model turn) | remind: context plugin, on the next request (OpenCode 1 only; OpenCode 2 is not judged, and logs so) | not judged: Stop carries no transcript (log line) |
 | `commands-must-return` | ops | ask: git-gate (a recursive scan rooted at a filesystem root: `find /`, `du`, `grep -r`, `rg`, `Get-ChildItem -Recurse` at `/`, `/c`, `C:\`) | same as Claude Code | block: guard plugin (same root-scan pattern) | block (exit 2) |
 
 Bob has no "ask" tier (see [ADR 0007](../adr/0007-gates-fail-closed-per-host-ceiling.md)), so a
@@ -37,12 +38,17 @@ mechanisms: its own permission prompt (`opencode.json`, static globs) and the gu
 See [ADR 0008](../adr/0008-host-parity-ceiling-of-the-weakest-host.md) for why a gate that only
 one host can run still ships for every host it can.
 
+A gate that is registered but broken looks exactly like a working one. `geneseed doctor --probe`
+runs the installed Claude Code, OpenClaude and Bob gates through each host's own shell, and calls
+the OpenCode guard plugin in-process, on one call each must refuse and one it must let through
+([Doctor findings](../reference/troubleshoot-doctor.md)).
+
 ### Everything else: asked only, on every host
 
 Every other rule carries no gate on any host. A human reads them because the model was told to
 follow them, not because a tool call was ever inspected.
 
-**Laws** — `one-intent-one-act` · `verify-before-asserting` · `surface-failures` ·
+**Laws** — `one-intent-one-act` · `verify-before-asserting` (in a project without a done list) · `surface-failures` ·
 `data-not-orders` · `least-privilege` · `cure-the-cause` · `echo-the-intent`.
 
 **Doctrine: process** — `plan-before-acting` · `context-economy` · `read-the-docs-first` ·

package/docs/concepts/hooks.md

@@ -37,8 +37,11 @@ Geneseed writes its hooks into the host's settings file. Every hook calls one pr
 - Content that looks like a credential (a cloud access key, a GitHub or Anthropic token, a Slack token, a private-key block) going into any file other than `.env*` gets a prompt citing *Sealed Secrets*.
 - A write to `user-rules.md`, `MEMORY.md` or a file in the install's `memory/` gets a prompt citing *Persist Insight*: whether something is a standing rule or a fact to remember is your call, settled through the `rule` [skill](skills.md).
 - A write to a check the project protects gets a prompt citing *External Gate* (on Bob, it is blocked). A project opts in with `.geneseed/protected-checks.txt` at its git root: one repo-relative file or folder per line, `#` for comments — the checks and tests the agent is judged by. A check the agent can edit is not a check. The list protects itself. Only file-write tools are seen: a shell `sed -i` or redirect is not, so run the same checks in CI as the boundary that holds.
+- A write to `.geneseed/done-checks.txt`, the done gate's own list (below), gets the same *External Gate* prompt: emptying it would disarm the gate.
 - Ordinary edits pass untouched.
 
+**The done gate.** Runs when a turn ends, inside `learn` and before it calls any model. A project opts in with `.geneseed/done-checks.txt` at its git root: one command per line, `#` for comments — the checks that prove the work, for example `npm run lint` and `node --test`. If the turn edited a file under that root and a listed check has not passed since the last edit, the turn does not end: the agent is told which checks are owed, citing *Verify Before Asserting*. A check counts when it ran as a shell command, unpiped (`npm test | tail` exits with `tail`'s code, so it proves nothing), and its result was not an error. The gate never runs a check itself. It blocks at most once per turn; the second stop ends the turn and leaves a line in the gate ledger. Only file-write tools count as edits: a shell `sed -i` or redirect is not seen. Without the file, nothing changes. On OpenCode the gate is a reminder on the next request (OpenCode 1 only); on Bob, whose Stop carries no transcript, the turn is not judged and a log line says so.
+
 **learn.** Takes the tail of the transcript and asks a model to distil what is worth keeping into one-fact-per-file entries under `memory/`. It is shown the facts already stored, so it updates one with the merged text rather than writing a twin (the old version is kept in `memory/archive/`), and moves one the session proved obsolete into `memory/archive/`. It needs `GENESEED_LLM` set to a model command, for example:
 
 ```bash

package/docs/extending.md

@@ -125,7 +125,7 @@ Notes that matter:
 
 ### The gates CI does not run
 
-- **The mutation matrix itself.** `tests/mutate.mjs` — 33 rows, each a one-string edit to a
+- **The mutation matrix itself.** `tests/mutate.mjs` — 35 rows, each a one-string edit to a
   product file with a written argument for which gate should catch it. The full run is **in no
   workflow** and should not be: it mutates the product tree 33 times and runs a gate per edit.
   Run `node tests/mutate.mjs --all` (or `--only M7`) by hand when you change something a gate is

package/docs/guides/install-clone.md

@@ -6,7 +6,7 @@ kind: "concept"
 section: "Install"
 description: "Install from a git clone when npm is out of reach, or when you want to change the harness."
 ---
-Clone the repository when npm is out of reach (for example, a corporate network with no registry access), or when you want to change the harness rather than just use it. A clone needs **git** as well as Node 22.3 or newer. git is what updates the clone.
+Clone the repository when npm is out of reach (for example, a corporate network with no registry access), or when you want to change the harness rather than just use it. A clone needs **git** as well as Node 22.7 or newer. git is what updates the clone.
 
 Each OS has a one-step installer at the root of the clone. It checks for Node and git. If one is missing, it names what to install and where to get it, then stops. **It never installs anything itself.** When the checks pass, it runs the setup wizard and offers to open the web console.
 

package/docs/guides/install.md

@@ -10,7 +10,7 @@ Geneseed builds a harness (the rules, agents, skills and hooks your AI coding to
 
 ## The 5-minute path
 
-The only prerequisite is **Node 22.3 or newer**.
+The only prerequisite is **Node 22.7 or newer**.
 
 ```
 npx geneseed setup
@@ -30,7 +30,7 @@ Next: [Verify it works](verify.md). To see what the install just wrote, read [Wh
 
 ## Prerequisites
 
-- **Node 22.3 or newer.** This is the only hard requirement. Geneseed has zero runtime dependencies, and nothing it installs needs a second interpreter.
+- **Node 22.7 or newer.** This is the only hard requirement. Geneseed has zero runtime dependencies, and nothing it installs needs a second interpreter.
 - **Your agent tool**: OpenCode (recommended), Claude Code, IBM Bob, OpenClaude, or any tool that reads a root instructions file.
 - **git**, for a clone only. A clone updates itself with `git pull`.
 - *Optional:* a document converter (MarkItDown, Pandoc or Docling) if you want the agent to read PDFs and Office files. See [Reading non-markdown docs](read-non-markdown.md).

package/docs/reference/plugin-context.md

@@ -17,6 +17,8 @@ One of the [OpenCode plugins](opencode-plugins.md). Its switches are also listed
 
 **When it runs.** On every request: the context rides invisibly in the request's message list, so it also survives compaction. If your OpenCode build lacks that (experimental) hook, the plugin notices and falls back to one visible message at session start, re-pushed when the session compacts.
 
+**The done gate's reminder.** In a project with `.geneseed/done-checks.txt` (see [Hooks](../concepts/hooks.md)), a request that follows a turn which edited files without every listed check passing since gets one more invisible message naming the checks owed. OpenCode has no turn-end event a plugin can block on, so this is a reminder, not a block. OpenCode 1 only: on OpenCode 2 the turn is not judged, and the plugin logs that once. `GENESEED_CONTEXT_INJECT=off` does not turn it off; removing the file does.
+
 **What you see.** Normally nothing — the context is there, but not shown. With the visible fallback, a `PROJECT CONTEXT` block at the top of the session.
 
 **Switches.**

package/docs/reference/troubleshoot-doctor.md

@@ -35,6 +35,37 @@ If the drift is your own edits, export them first — `geneseed diff` (or the co
 
 **Confirm.** `geneseed doctor` no longer reports the bundle.
 
+## `[probe] … registered but not refusing` / `refuses everything` / `does not run`
+
+> `[probe] ~/.claude: git-gate under Git Bash registered but not refusing — …`
+
+These come only from `geneseed doctor --probe`. It runs each installed gate exactly as the host's
+settings spell it, through the host's own shell, on `git reset --hard HEAD` (which must be refused)
+and `git status` (which must go through). An OpenCode install's guard plugin has no command to
+run: the probe imports it and calls its hook through both plugin APIs (V1 and V2), with `rm -rf /`
+as the call it must refuse. `GENESEED_GUARD=off` or `warn` in your terminal makes that a note,
+not a failure.
+
+**Cause.**
+- **Not refusing:** the gate launches but lets a destructive call through. Usually something in
+  the install tells it to stand down: an exclusion covering the temp folder, or a command that
+  lost its `--host bob`.
+- **Refuses everything:** the gate asks on every call. This is typically the hooks emitted for
+  one shell and run under another.
+- **Does not run:** the shim or its runner is gone, or the shell is missing.
+
+**Fix.**
+
+```bash
+geneseed rebuild-all
+```
+
+**Confirm.** `geneseed doctor --probe` prints `[probe] N gate(s) refused a destructive call and let
+a safe one through`.
+
+The probe runs under *this terminal's* environment (PATH, HOME), not the host app's. A host started
+with a different environment can still break a gate that passes here.
+
 ## `registry.json unreadable` / `registry.json is not valid JSON`
 
 > `[authoring] registry.json unreadable: …`

package/docs/reference/troubleshoot-install.md

@@ -12,7 +12,7 @@ Each entry gives the likely cause, the fix, and how to confirm it worked. First
 
 The one-step installer (`./install`, `install.cmd`, `install.command`) checks Node first and stops:
 
-> `xx  Node v20.11.0 is too old — Geneseed needs 22.3 or newer.`
+> `xx  Node v20.11.0 is too old — Geneseed needs 22.7 or newer.`
 
 **Cause.** No Node on PATH, or an older one — Linux distribution packages are often behind.
 
@@ -24,15 +24,15 @@ The one-step installer (`./install`, `install.cmd`, `install.command`) checks No
 node --version
 ```
 
-prints 22.3 or newer, and the installer's first line reads `ok  Node v…`.
+prints 22.7 or newer, and the installer's first line reads `ok  Node v…`.
 
-## `geneseed needs Node 22.3 or newer`
+## `geneseed needs Node 22.7 or newer`
 
 Run without the installer — `npx geneseed`, a global npm install, or a hook — on an older Node, every Geneseed command stops with one sentence:
 
-> `geneseed needs Node 22.3 or newer; this is Node 20.18.1. Install a current Node from https://nodejs.org (or your package manager), then run the command again.`
+> `geneseed needs Node 22.7 or newer; this is Node 20.18.1. Install a current Node from https://nodejs.org (or your package manager), then run the command again.`
 
-**Cause.** The `node` on PATH is older than 22.3. npm only *warns* about the engine requirement, so a global install succeeds anyway. A hook prints the same sentence and lets the tool call through rather than block it, so on Claude Code, Bob or OpenClaude the hooks are off until Node is upgraded.
+**Cause.** The `node` on PATH is older than 22.7. npm only *warns* about the engine requirement, so a global install succeeds anyway. A hook prints the same sentence and lets the tool call through rather than block it, so on Claude Code, Bob or OpenClaude the hooks are off until Node is upgraded.
 
 **Fix.** Install the current Node.js LTS (see above), open a **new** terminal, and run the command again.
 

package/docs/understand/enforced-vs-asked.md

@@ -27,6 +27,7 @@ On Claude Code and OpenClaude the hooks never block silently. They make the host
 - **A scan of a whole filesystem**: a recursive `find`, `du`, `grep -r`, `rg` or `Get-ChildItem -Recurse` rooted at `/`, `/c` or `C:\`, which in Git Bash walks every drive for hours. Wired in every build.
 - **Credentials**: a write or edit whose content looks like a real key (AWS, GitHub, Anthropic, Slack, or a private-key block), anywhere except a `.env` file.
 - **Your rules and memory**: any write by the agent to `user-rules.md` or to the memory store. Whether something is a standing rule or a fact to remember is your call.
+- **Ending a turn without the proof**: only in a project that lists its checks in `.geneseed/done-checks.txt`. A turn that edited files cannot end until every listed check has passed since the last edit. The agent is stopped once, then the turn may end.
 
 If a gate crashes, it asks instead of letting the call through. If it cannot start at all (a deleted or broken shim) or times out, Claude Code blocks the call instead: see [Troubleshoot hooks](../reference/troubleshoot-hooks.md) to recover. Other shell commands, `rm -rf` included, go through Claude Code's normal permission flow.
 

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "4.4.1"
+  "version": "4.6.0"
 }

package/js/README.md

@@ -71,6 +71,7 @@ user co-owns, and the hook verbs those emitted configs then run.
 | `hosts.mjs` | The four host config dirs (opencode/claude/bob/openclaude), their `family` (`CLAUDE_STYLE`), plus `resolvePath`/`expanduser` |
 | `hooks.mjs` | The gate verbs, run on every tool call: `git-gate`, `rule-gate`, `tool-gate` (the two gates fused, for Bob), plus `ask`/the gate ledger/`guardGate`. `--host` picks the verdict dialect |
 | `hooks-context.mjs` | The `context` verb — SessionStart: session files plus the repo's context docs |
+| `hooks-done.mjs` | The done gate (#289): on Stop, inside `learn` and before its spawn, blocks a turn that edited files until `.geneseed/done-checks.txt`'s checks passed after the last edit |
 | `hooks-learn.mjs` | The `learn` verb — Stop/SubagentStop/PreCompact distiller; the hook path's ONE spawn (`$GENESEED_LLM`) |
 | `hooks-prims.mjs` | The Python path/text primitives the hook verbs share (`splitLines`, `readStdin`, a never-throwing `isFile`) |
 | `usage.mjs` | The usage counter `tool-gate` runs: one `{day, kind, name}` line per Skill or subagent call into `notebook/usage.jsonl`. Hook path: builtins only, silent, never throws |
@@ -81,7 +82,7 @@ user co-owns, and the hook verbs those emitted configs then run.
 | `native.mjs` | Capability specs → host-native subagents and skills. The impure half of the emit |
 | `opencode.mjs` | OpenCode-only extras: colour themes, primary agent, `/commands`, plugins, overrides stub |
 | `installs.mjs` | Detects deployed installs and reads back their theme, footprint, posture, mode and loop trust preset |
-| `mcp.mjs` | MCP server presets, the per-host `mcpServers` config read/write, and toggle state |
+| `mcp.mjs` | Reads each host's MCP config (`mcpServers`, or OpenCode's `mcp`) and where it lives — read-only since 2026-10: the user edits the file, Geneseed only shows it |
 | `link.mjs` | `geneseed link`/`unlink` — the PATH shim, and the only Windows USER-Path registry edit |
 | `owned.mjs` | Manifest rel -> path on disk decisions: `ownedWithin`, the containment boundary `uninstall.mjs` and the driver's prune both go through before acting on an `owned` list entry |
 
@@ -100,8 +101,9 @@ Everything that inspects an already-built or already-deployed harness and report
 |---|---|
 | `doctor.mjs` | The `geneseed doctor` **driver** only: picks themes, runs the checks, prints the verdict |
 | `checks-build.mjs` | Gates over what the build PRODUCED: links, tokens, theme parity, OpenCode colours, bundle drift |
-| `checks-repo.mjs` | Gates over the repo's own records: `registry.json`, committed secrets, the hook shim, vendored pins |
-| `checks-authoring.mjs` | `authoringProblems`, the aggregate self-consistency gate: spec purpose lines, the learn-prompt literal, `node --check` over the plugins (the doctor's one spawn), then the groups below |
+| `checks-repo.mjs` | Gates over the repo's own records: `registry.json`, committed secrets, the hook shim, vendored pins and folder skills, skill aliases and side files, this module map, the host tables, the scorecard ratchet |
+| `checks-authoring.mjs` | `authoringProblems`, the aggregate self-consistency gate: spec purpose lines, the learn-prompt literal, `node --check` over the plugins (the doctor's one default spawn), then the groups below |
+| `checks-probe.mjs` | `doctor --probe` (opt-in): runs each live install's own gate command through the host's shell on a must-refuse and a must-pass payload — the doctor's second spawn; the OpenCode guard plugin is imported and called in-process instead, through both plugin APIs |
 | `checks-constitution.mjs` | The constitution: rule declarations and citations, LEAN blocks, `HOOK_PINNED`, theme vocabulary, the console's `LAW_META`/`DOCTRINE_META` |
 | `checks-counts.mjs` | The hand-written counts: AGENT.md tables, README badges and prose, `SHIPPED.md`, held against `src/` |
 | `scan.mjs` | The shared walk/sort/strip/test primitives every `checks-*` uses. Owns no judgement itself |
@@ -112,7 +114,8 @@ Everything that inspects an already-built or already-deployed harness and report
 | `diff.mjs` | `geneseed diff` — what a deployed install has that a fresh render of `src/` does not |
 | `excludes.mjs` | `geneseed exclude add|remove|list` — the WRITER for `excludes.json`; `hooks.mjs` only reads it |
 | `registry.mjs` | `installs.json` under XDG — the persistent deploy-root list `rebuild-all` re-emits into |
-| `scorecard.mjs` | `geneseed scorecard` — a port of the AI Harness Scorecard (upstream pinned in its docblock): the repo walk, the CI-YAML subset parser, `assessRepo`, the text/JSON renderers. Pure: no spawn, no network |
+| `scorecard.mjs` | `geneseed scorecard` — a port of the AI Harness Scorecard (upstream pinned in its docblock): the repo walk, the CI-YAML parsing, `assessRepo`, the text/JSON renderers. Pure: no spawn, no network |
+| `scorecard-yaml.mjs` | The YAML 1.1 subset the scorecard reads CI configs with, plus Python's `str()`/`bool()` over its values; `scorecard.mjs` re-exports it. Its ceiling is in its `ponytail:` note |
 | `scorecard-svg.mjs` | The scorecard as an SVG card for a README (`geneseed scorecard --svg`): grade plus one bar per pillar, deterministic so doctor can compare the committed card byte for byte |
 | `scorecard-checks.mjs` | The scorecard's 31 checks in five pillars, ported line for line — ids, points, partial scores, evidence and fixes as upstream writes them |
 
@@ -136,7 +139,7 @@ into files users have committed, so change the test that states it in the same c
 | `udiff.mjs` | `geneseed diff`'s own difflib clone — the alignment IS the printed hunks — plus `splitLines` |
 | `proc.mjs` | One constant: the `windowsHide` flag every spawn in `js/` must reuse |
 | `prompt.mjs` | The line-mode stdin readers — `ask`, `promptLine`, `confirm`, `askChoice` — read a byte at a time so they stop where Enter stops. Shared by `setup`, `uninstall` and `web` without dragging in the wizard |
-| `node-floor.mjs` | The first import of all three binaries: below Node 22.3, one sentence on stderr and exit 1 (0 in the hook) instead of a stack trace |
+| `node-floor.mjs` | The first import of all three binaries: below Node 22.7, one sentence on stderr and exit 1 (0 in the hook) instead of a stack trace |
 
 **Before editing:** parse with `parseJson`, never `JSON.parse` — the latter collapses int `1` and
 float `1.0` into one double, and that value gets written into a user's file. Do not swap in a diff

package/js/build/bundle.mjs

@@ -24,6 +24,16 @@ import {
 import { writeVersion } from './version.mjs';
 import { existsSync, mkdirSync, renameSync, rmSync } from 'node:fs';
 
+/**
+ * Seed the memory index, then move a flat one to topics — the pair every emit runs on its
+ * memory store, in that order. Here and not in `js/hosts/memory-files.mjs`: `stubs.mjs`
+ * imports that module, so the reverse import would be a cycle.
+ */
+export function ensureMemoryStore(memDir) {
+  ensureMemoryIndex(memDir);
+  migrateMemoryIndex(memDir);
+}
+
 // ---------------------------------------------------------------------------
 // Source completeness
 // ---------------------------------------------------------------------------
@@ -223,8 +233,7 @@ export function build(cfg, themeName, out, { footprint = 'full', nativeCatalog =
   ensureRulesStub(out);
   ensureProfileStub(out);
   ensureBundleGitignore(out);
-  ensureMemoryIndex(path.join(out, theme[SRC_DIR_TOKENS.memory] ?? 'memory'));
-  migrateMemoryIndex(path.join(out, theme[SRC_DIR_TOKENS.memory] ?? 'memory'));
+  ensureMemoryStore(path.join(out, theme[SRC_DIR_TOKENS.memory] ?? 'memory'));
   ensureNotebookIndex(path.join(out, theme[SRC_DIR_TOKENS.notebook] ?? 'notebook'));
   process.stdout.write(`[geneseed] built theme '${themeName}' -> ${out} (${items.length} files)\n`);
 }

package/js/build/driver.mjs

@@ -51,7 +51,7 @@ import {
   openclaudeConfigDir, hostCatalogsNatively,
 } from '../hosts/hosts.mjs';
 import {
-  hashesOf, ownedHashes, ownedState, ownedWithin,
+  hashesOf, ownedHashes, ownedState, ownedWithin, recordedDenies,
 } from '../hosts/owned.mjs';
 
 // P5d moved these out of this file for the reason P5c moved the host resolvers: `harness
@@ -257,15 +257,6 @@ function readManifest(manifestPath) {
   return { existed, doc };
 }
 
-/**
- * An OpenCode manifest's `skill_denies` — the `permission.skill` denies Geneseed itself added
- * (see `opencodeLayer`) — or `[]` when absent or malformed, which sweeps nothing.
- */
-function recordedDenies(doc) {
-  const d = doc && doc.skill_denies;
-  return Array.isArray(d) ? d.filter((n) => typeof n === 'string') : [];
-}
-
 /** The "+ primary agent, N command(s)" tail both OpenCode summary lines share. */
 function extrasTail(stats) {
   const extras = [...(stats.primary ? ['primary agent'] : []),

package/js/build/emit-claude.mjs

@@ -7,24 +7,21 @@
  */
 import path from 'node:path';
 import { VERSION_MARKER } from '../hosts/hosts.mjs';
-import { migrateMemoryIndex } from '../hosts/memory-files.mjs';
 import { claimer, loadAgentOverrides, writeNativeLayer } from '../hosts/native.mjs';
 import { ensureAgentOverridesStub, writeAliasCommands } from '../hosts/opencode.mjs';
 import {
   managedBlockRemove, managedBlockWrite, mergeClaudeSettings,
   unwireClaudeExcludes, unwireClaudeSettings, wireClaudeExcludes,
 } from '../hosts/settings.mjs';
-import { claimLeaf } from '../hosts/owned.mjs';
-import { writeText } from '../lib/fs.mjs';
 import { get, isDict, isTruthy } from '../lib/json.mjs';
 import { relPosix } from '../lib/text.mjs';
-import { assertSourceComplete, phaseLog } from './bundle.mjs';
+import { assertSourceComplete, phaseLog, ensureMemoryStore } from './bundle.mjs';
 import {
-  globalMemory, globalNotebook, shipLeanLaws, stripCapabilityLinks,
+  claimAndWrite, globalMemory, globalNotebook, shipLeanLaws, stripCapabilityLinks,
 } from './emit-common.mjs';
 import { renderAll, renderFile } from './render.mjs';
 import {
-  BOB_RULES_STUB, ensureContextStub, ensureExcludesStub, ensureMemoryIndex, ensureNotebookIndex,
+  BOB_RULES_STUB, ensureContextStub, ensureExcludesStub, ensureNotebookIndex,
   ensureProfileStub,
   ensureRulesStub, ensureWikiStub, WIKI_FILE,
 } from './stubs.mjs';
@@ -100,16 +97,8 @@ export function emitClaudeRender(cfg, job) {
   // slim shadow stub whose only job is to have the same filename.
   if (isBob && agentText !== null) {
     const rulesMd = path.join(cfgDir, 'rules', 'geneseed.md');
-    // `claimLeaf` BEFORE `mkdirSync`: `safeLeaf` walks up to the nearest EXISTING ancestor
-    // (`resolvePath`'s own contract), so it needs no directory created first — and creating
-    // `rules/` first would plant an empty directory at a linked ancestor's target the moment
-    // before the refusal fires.
-    if (claimLeaf(cfgDir, rulesMd, 'rules/geneseed.md')) {
-      mkdirSync(path.dirname(rulesMd), { recursive: true });
-      writeText(rulesMd, scope === 'project' ? BOB_RULES_STUB
-        : stripCapabilityLinks(prefixedAgentText('../') || agentText));
-      owned.push('rules/geneseed.md');
-    }
+    claimAndWrite(cfgDir, rulesMd, 'rules/geneseed.md', scope === 'project' ? BOB_RULES_STUB
+      : stripCapabilityLinks(prefixedAgentText('../') || agentText), owned);
   }
 
   ensureAgentOverridesStub(cfg, cfgDir);
@@ -146,8 +135,7 @@ export function emitClaudeRender(cfg, job) {
   }
 
   const memStatus = globalMemory(cfgDir, items, out, cfg.src);
-  ensureMemoryIndex(path.join(cfgDir, 'memory'));
-  migrateMemoryIndex(path.join(cfgDir, 'memory'));
+  ensureMemoryStore(path.join(cfgDir, 'memory'));
   const nbStatus = globalNotebook(cfgDir, items, out, cfg.src);
   ensureNotebookIndex(path.join(cfgDir, 'notebook'));
   // context.json too: the root names it as the project's own manifest, and until 2026-10 this
@@ -172,10 +160,7 @@ export function emitClaudeRender(cfg, job) {
       // `!existsSync(gi)` is exactly the case a DANGLING symlink also satisfies — it reads
       // as absent — so `claimLeaf` (which lstats) runs before the write, not instead of
       // this check.
-      if (claimLeaf(cfgDir, gi, '.gitignore')) {
-        writeText(gi, `${giLines.join('\n')}\n`);
-        owned.push('.gitignore');
-      }
+      claimAndWrite(cfgDir, gi, '.gitignore', `${giLines.join('\n')}\n`, owned);
     } else if (oldOwned.includes('.gitignore')) {
       owned.push('.gitignore');
     }

package/js/build/emit-common.mjs

@@ -63,7 +63,7 @@ export const TMPL_SPEC_RE = /\{\{DIR_(AGENTS|SKILLS)\}\}\/([A-Za-z0-9_-]+)\.md/g
  * `Path.rglob("*")` restricted to files, skipping `__pycache__` as Python's callers do.
  *
  * `recursive: true, withFileTypes: true` (Node >= 20.1, `parentPath` >= 21.4 — this repo
- * requires >= 22.3) replaces a hand-rolled walk; the order it yields is NOT the walk's
+ * requires >= 22.7) replaces a hand-rolled walk; the order it yields is NOT the walk's
  * order, but `sourceFingerprint`, this function's one caller, re-sorts every result by a
  * plain string key before it is ever observed, so no caller depends on it.
  */
@@ -184,15 +184,22 @@ export function shipLeanLaws(items, theme, cfgDir, owned, footprint) {
     // nothing to detect, not because the gate cannot see it.
     if (text !== null && parts.length && dirs.has(parts[0])) {
       const dest = path.join(cfgDir, ...parts);
-      // `claimLeaf` BEFORE `mkdirSync`, for the same reason `emitClaudeRender`'s rules stub
-      // does: `safeLeaf` needs no directory created first, and creating one ahead of the
-      // refusal would plant it at a linked ancestor's target.
-      if (claimLeaf(cfgDir, dest, rel)) {
-        mkdirSync(path.dirname(dest), { recursive: true });
-        writeText(dest, text);
-        owned.push(rel);
-      }
+      claimAndWrite(cfgDir, dest, rel, text, owned);
     }
   }
 }
 
+/**
+ * Claim-on-create one leaf: write `text` to `dest` and own `rel` only when `claimLeaf`
+ * allows it. `claimLeaf` runs BEFORE `mkdirSync`: `safeLeaf` walks up to the nearest
+ * EXISTING ancestor (`resolvePath`'s own contract), so it needs no directory created first —
+ * and creating the parent first would plant an empty directory at a linked ancestor's target
+ * the moment before the refusal fires. A leaf directly in an existing `root` makes the
+ * `mkdirSync` a no-op.
+ */
+export function claimAndWrite(root, dest, rel, text, owned) {
+  if (!claimLeaf(root, dest, rel)) return;
+  mkdirSync(path.dirname(dest), { recursive: true });
+  writeText(dest, text);
+  owned.push(rel);
+}

package/js/build/emit-opencode.mjs

@@ -8,23 +8,21 @@
  */
 import path from 'node:path';
 import { VERSION_MARKER } from '../hosts/hosts.mjs';
-import { migrateMemoryIndex } from '../hosts/memory-files.mjs';
 import { claimer, loadAgentOverrides, writeNativeLayer } from '../hosts/native.mjs';
 import {
   copyPlugins, copyWorkflows, ensureAgentOverridesStub, writeColorThemes, writeCommandLayer,
   writeAliasCommands, writePonytailCommand, writePrimaryAgent, writeTheme,
 } from '../hosts/opencode.mjs';
 import { mergeOpencodeJson, opencodeSentinelWrite } from '../hosts/settings.mjs';
-import { claimLeaf } from '../hosts/owned.mjs';
 import { isFile, readText, writeText } from '../lib/fs.mjs';
 import { relPosix } from '../lib/text.mjs';
-import { assertSourceComplete, build, phaseLog } from './bundle.mjs';
+import { assertSourceComplete, build, phaseLog, ensureMemoryStore } from './bundle.mjs';
 import {
-  globalMemory, globalNotebook, shipLeanLaws, stripCapabilityLinks,
+  claimAndWrite, globalMemory, globalNotebook, shipLeanLaws, stripCapabilityLinks,
 } from './emit-common.mjs';
 import { renderAll } from './render.mjs';
 import {
-  ensureExcludesStub, ensureMemoryIndex, ensureNotebookIndex, ensureProfileStub, ensureRulesStub,
+  ensureExcludesStub, ensureNotebookIndex, ensureProfileStub, ensureRulesStub,
   ensureWikiStub,
 } from './stubs.mjs';
 import { writeVersion } from './version.mjs';
@@ -216,10 +214,7 @@ export function emitOpencodeGlobalRender(cfg, job) {
     // store are siblings, so `memory/` resolves from AGENT.md's own location and stays
     // hermetic — no absolute path a doctor check would flag as an escape.
     const agentDest = path.join(cfgDir, 'AGENT.md');
-    if (claimLeaf(cfgDir, agentDest, 'AGENT.md')) {
-      writeText(agentDest, stripCapabilityLinks(agentText));
-      owned.push('AGENT.md');
-    }
+    claimAndWrite(cfgDir, agentDest, 'AGENT.md', stripCapabilityLinks(agentText), owned);
   }
   // Co-owned, so never in `owned` — see `opencodeSentinelWrite`.
   opencodeSentinelWrite(cfgDir);
@@ -233,8 +228,7 @@ export function emitOpencodeGlobalRender(cfg, job) {
   });
 
   const memStatus = globalMemory(cfgDir, items, out, cfg.src);
-  ensureMemoryIndex(path.join(cfgDir, 'memory'));
-  migrateMemoryIndex(path.join(cfgDir, 'memory'));
+  ensureMemoryStore(path.join(cfgDir, 'memory'));
   const nbStatus = globalNotebook(cfgDir, items, out, cfg.src);
   ensureNotebookIndex(path.join(cfgDir, 'notebook'));
   ensureWikiStub(cfgDir);

package/js/build/generate.mjs

@@ -223,7 +223,7 @@ export function installProfile(host, scope, root, notify = null) {
   // one of them. `null` (no marker) stays `null` so the argv omits the flag, as it always did.
   const excludeRules = excludedRulesOfDir(root, host);
   // Skills left out stay left out: an upgrade that forgot them would put them all back.
-  const excludeSkills = excludedSkillsOfDir(root, notify, host);
+  const excludeSkills = excludedSkillsOfDir(root, host, notify);
   const out = scope === 'global' ? null : root;
   const argv = setupBuildArgs(theme, emit, out, out, footprint, posture, mode, doctrines,
     PACK_ORDER, excludeRules, trust, excludeSkills);

package/js/cli-table.json

@@ -473,6 +473,21 @@
           "is_flag": true,
           "type": null,
           "hidden": false
+        },
+        {
+          "names": [
+            "--probe"
+          ],
+          "dest": "probe",
+          "metavar": null,
+          "help": "also run each installed gate on a destructive and a safe payload: it must refuse the first and let the second through. Claude Code, OpenClaude and Bob gates run as their settings spell them, through the host's shell; the OpenCode guard plugin is imported and called in-process (runs under this terminal's environment, not the host app's)",
+          "choices": null,
+          "default": false,
+          "required": false,
+          "nargs": "0",
+          "is_flag": true,
+          "type": null,
+          "hidden": false
         }
       ],
       "mutex": []

package/js/hosts/hooks-context.mjs

@@ -150,7 +150,7 @@ export { SESSION_FILES, SEED_SHA256 };
 const MAP_COUNT_RE = /^- \[([^\]]*)\]\(topics\/[^)]+\.md\) — (\d+) facts?$/;
 // Past this many facts a topic file stops being a quick read, and the curator splits it.
 const CURATE_TOPIC_MAX = 40;
-const CURATE_NUDGE = '[memory] A topic holds over 40 facts, or facts sit in misc: offer the user '
+const CURATE_NUDGE = `[memory] A topic holds over ${CURATE_TOPIC_MAX} facts, or facts sit in misc: offer the user `
   + 'to dispatch the memory-curator agent to merge, re-topic and archive this store.';
 export { CURATE_TOPIC_MAX, CURATE_NUDGE };
 
@@ -193,9 +193,6 @@ export function sessionFiles(hookRoot) {
   return found;
 }
 
-// Moved to `hosts.mjs` so the gates and `learn` share it; re-exported for this verb's callers.
-export { globalHookStandingDown };
-
 /** `_disp` — relative to the repo root when it sits under it, else verbatim. */
 function disp(pathStr, root) {
   // A path on another drive has no relative form, so it is printed as given. `path.relative`