geneseed 4.6.0 → 4.8.0

package/js/hosts/settings.mjs

@@ -84,55 +84,47 @@ const consentRuleOn = (d, excluded = []) =>
  * doctrine section — and a boundary that keeps asking for a rule the install did not adopt is
  * the one disagreement the tiering is not allowed to produce. (It does NOT follow that the
  * string is gone from the bundle; see `claudeHookGroups` for what D5 ships anyway and why.)
- * `rm -rf *`, the force pushes and the history-discarding git verbs (`reset --hard`,
- * `clean -f`, `branch -D`, `checkout --`) stay in EVERY build: they are Law IV's territory —
- * an always-on invariant — not the process pack's. They mirror `DESTRUCTIVE_GIT_RE` in
- * js/hosts/hooks.mjs, so Claude's git-gate and OpenCode's permission ask about the same acts;
- * before, OpenCode only logged the last four. A glob is not a regex, so the mirror is the
- * closest glob for each act rather than an exact copy: the `* ` forms catch a flag that comes
- * after other words (`push origin -f`, `reset -q --hard`, `clean -d -f`) and `git push *+*`
- * a `+refspec` force push. The regex stays the stricter reader — it also sees a flag cluster
- * with `f` not first (`clean -d -xf`), which a glob cannot say without matching `--exclude=f`.
+ * The Law IV keys stay in EVERY build: they are Law IV's territory — an always-on invariant —
+ * not the process pack's.
  *
- * B5's (claude-code.md / claude-verdict.md) long/modern spellings, added here appended (never
- * reorder: OpenCode's permission engine evaluates key order with `findLast`, so moving an
- * existing key can change which VALUE wins on a file that already disagrees with one — adding
- * only is always safe, since every key here maps to the same `'ask'`). `clean --force`, the
- * long flag; `branch --delete --force`, the long form of `-D` (both orders, since a glob has
- * no "either order" — an un-forced `--delete` already refuses on an unmerged branch exactly
- * like `-d`, so it is deliberately NOT a key here; `-D --force`/`--delete -f`/`-d --force`/
- * `-df` are the same act again and are a known ceiling this does not chase); `checkout
- * -f`/`--force` and `switch -f`/`--force`/`--discard-changes` (git's own `switch -h` lists
- * `-f, --force` and `--discard-changes` as two separate options); `worktree remove -f`/`--force` (both
- * flag-then-path and path-then-flag order); `reflog expire`; `gc --prune` (matched bare, since
- * a `--prune` with no `=now` still eventually prunes); and `push *--delete*` / `push * :*` (a
- * literal space before the colon, so `push origin HEAD:main`, an ordinary refspec, does not
- * match).
+ * LAW IV HERE IS ONLY WHAT LOSES DATA IN EVERY STATE (user decision, 2026-10-17). The gate asks
+ * only when a command would really lose data, and whether it would — a dirty tree, an untracked
+ * file, an unpushed branch, a protected target, a stash — is STATE, which a glob cannot read. So
+ * the state-aware decisions moved into the OpenCode guard plugin (`lossReason`, the twin of
+ * js/hosts/loss.mjs, which BLOCKS a real loss because `tool.execute.before` has no ask tier), and
+ * this list keeps what loses data whatever the state: the protected-branch forms below, and the
+ * two acts that delete the recovery net, `reflog expire` and `gc --prune` (matched bare and with a word before it, since a `--prune` with no `=now`
+ * still eventually prunes). Every force-push, `reset --hard`, `clean -f`, `branch -D`,
+ * `checkout`/`switch` force, `stash drop`/`clear` and remote-delete glob this list used to carry
+ * was REMOVED, the way PR #313 removed `git worktree remove -f`: removal from this list also
+ * removes the keys from `OWNED_BASH`, so an `opencode.json` written before keeps them — neither
+ * taken back nor reported as stranded, since Geneseed no longer claims them. They still ask
+ * there (fail-safe, one prompt); the user deletes them by hand (the CHANGELOG upgrade note says
+ * which). The process-5 `git push*` ask still covers every push while that rule is on.
  *
- * `git restore` is DELIBERATELY NOT HERE. Its rule is "ask unless `--staged` appears ALONE" —
- * `--staged --worktree` together still discards the working tree — and a glob has no negation,
- * so the closest glob (`git restore*`) would ask on the harmless `--staged`-alone case too. The
- * regex (`DESTRUCTIVE_GIT_RE`) gets that exactly right; `stash drop`/`clear` have the SAME
- * `restore` anchoring concern in the regex (a bare word / ordinary English, matched there only
- * in verb position) but no false-positive risk as a glob, since OpenCode matches a glob against
- * the FULL sub-command text (`opencode-verdict.md` CR-6) — `git stash drop*` cannot match a
- * DIFFERENT sub-command like `git stash push -m "clear old state"`, so they ARE glob keys here.
- * Guard-only acts (currently just `restore`) still warn via the OpenCode guard plugin's
- * `SHELL_WARN_RE` — see `adapters/opencode/plugins/geneseed-guard.js`.
+ * `rm -rf *` WENT TOO (user ruling, 2026-10-17): a blanket ask on every recursive removal is the
+ * glob-cannot-read-state problem again — the guard's `lossReason` lets an `rm` of tracked,
+ * unmodified files through and blocks one git cannot restore, and its `SHELL_BLOCK_RE` still
+ * blocks `rm -rf /`, `~` and the drive-root forms outright. Same stranded-key handling as above:
+ * an existing `opencode.json` keeps its `rm -rf *` key, asking, until the user deletes it.
+ *
+ * PROTECTED BRANCHES BY NAME are the one state-free loss a glob CAN say: a force push to, or a
+ * delete of, `main`/`master` loses work whatever the tree holds. So `PROTECTED_GLOBS` asks for
+ * those forms even when the guard plugin is off or in `warn` mode (a remote's OTHER default
+ * branch needs `refs/remotes/<r>/HEAD`, which only the guard reads). Every key ENDS in the
+ * branch name — never in a literal `" *"`, which upstream's `Wildcard.match` makes optional —
+ * so `mainline` or `HEAD:loop/x` never match, and none matches a push that is not forced or a
+ * delete. They come last, so `findLast` lets them win over the loop chain's allows.
  */
-const LAW_IV_BASH = ['git push --force*', 'git push -f*', 'git push *--force*', 'git push * -f*',
-  'git push *+*', 'git reset --hard*', 'git reset * --hard*', 'git clean -f*', 'git clean * -f*',
-  'git branch -D*', 'git checkout -- *',
-  'git clean --force*', 'git clean * --force*',
-  'git branch *--delete*--force*', 'git branch *--force*--delete*',
-  'git checkout -f*', 'git checkout * -f*', 'git checkout --force*', 'git checkout * --force*',
-  'git switch -f*', 'git switch * -f*', 'git switch --force*', 'git switch * --force*',
-  'git switch --discard-changes*', 'git switch * --discard-changes*',
-  'git worktree remove -f*', 'git worktree remove --force*',
-  'git worktree remove * -f*', 'git worktree remove * --force*',
-  'git reflog expire*', 'git gc --prune*', 'git gc * --prune*',
-  'git stash drop*', 'git stash clear*',
-  'git push *--delete*', 'git push * :*'];
+const PROTECTED_GLOBS = ['main', 'master'].flatMap((b) => [
+  `git push --force* ${b}`, `git push * --force* ${b}`, `git push -f* ${b}`, `git push * -f* ${b}`,
+  `git push --force* *:${b}`, `git push * --force* *:${b}`, `git push -f* *:${b}`, `git push * -f* *:${b}`,
+  `git push * +${b}`, `git push * +*:${b}`, `git push * +*:refs/heads/${b}`,
+  `git push * :${b}`, `git push * :refs/heads/${b}`, `git push *--delete* ${b}`,
+  `git branch -D ${b}`, `git branch * -D ${b}`,
+  `git branch *--delete*--force* ${b}`, `git branch *--force*--delete* ${b}`,
+]);
+const LAW_IV_BASH = ['git reflog expire*', 'git gc --prune*', 'git gc * --prune*', ...PROTECTED_GLOBS];
 
 /**
  * User decision (2026-10-10): a loop runs on its own `loop/*` branch, never `main`/`master`, so
@@ -147,12 +139,13 @@ const LAW_IV_BASH = ['git push --force*', 'git push -f*', 'git push *--force*',
  *
  * ORDER IS LOAD-BEARING. `PUSH_CHAIN` (which `defaultPermission` and `OWNED_BASH` both read)
  * puts these AFTER `git push*`'s ask (so a loop
- * push is not swallowed by the blanket consent ask) and BEFORE `LAW_IV_BASH` (so `findLast`
- * — OpenCode's own `permission.bash` evaluator — lets a force push, a `+refspec`, or a
- * `--delete`/bare-`:` push still ask even when the target is `loop/*`; those LAW_IV_BASH keys
- * match the same command and come later, so they win). Never move this block to before
- * `git push*` or after `LAW_IV_BASH` — either moves the `findLast` boundary the ordering above
- * depends on.
+ * push is not swallowed by the blanket consent ask) and BEFORE `LAW_IV_BASH`. Never move this
+ * block to before `git push*` or after `LAW_IV_BASH` — either moves the `findLast` boundary the
+ * ordering above depends on. Since `LAW_IV_BASH` keeps no push glob (2026-10-17), a forced or
+ * `+refspec` push to `loop/*` is no longer re-asked by Law IV: `loop/*` is never a protected
+ * branch, so it loses nothing Law IV guards. The tiers below still ask for every 2+-token prefix
+ * (`-f origin` included), and `git push*` still asks for a `+HEAD:loop/x` or `:loop/x` form,
+ * which no allow key matches.
  */
 const LOOP_PUSH_ALLOW = ['git push * HEAD:loop/*', 'git push * HEAD:refs/heads/loop/*'];
 
@@ -208,9 +201,9 @@ const LOOP_PUSH_ALLOW = ['git push * HEAD:loop/*', 'git push * HEAD:refs/heads/l
  * as a legitimate bare remote) — indistinguishable from a real remote name by token count alone,
  * and not a practical gap: a leading `-`/`--` token is parsed by git as an OPTION, never as the
  * remote, so this exact shape either errors (no remote given) or reads the refspec text itself
- * as the remote and fails to resolve it — it does not reach a working push to `main`. Still
- * caught by `LAW_IV_BASH`'s existing anywhere-in-the-command globs regardless of position
- * (`'git push *--force*'`, `'git push * -f*'`, et al.), independently of this chain.
+ * as the remote and fails to resolve it — it does not reach a working push to `main`. (Before
+ * 2026-10-17 `LAW_IV_BASH`'s force-push globs re-asked it too; they are gone, and the OpenCode
+ * guard's `lossReason` now judges a forced push by its real target.)
  */
 const LOOP_PUSH_ASK_EXTRA = ['git push * * HEAD:loop/*', 'git push * * HEAD:refs/heads/loop/*'];
 const LOOP_PUSH_ALLOW_FLAG = [
@@ -232,13 +225,18 @@ const PUSH_CHAIN = [
   [LOOP_PUSH_ASK_FLAG_EXTRA, 'ask'], [LOOP_PUSH_ASK_TRAILING, 'ask'], [LAW_IV_BASH, 'ask'],
 ];
 
-function defaultPermission(doctrines = null, excluded = []) {
-  const bash = { 'rm -rf *': 'ask' };
+// `deletionGate === false` (`--no-deletion-gate`) drops the `LAW_IV_BASH` tier and nothing else;
+// the keys stay OWNED, so an existing file reports them as stranded.
+function defaultPermission(doctrines = null, excluded = [], deletionGate = true) {
+  const bash = {};
   if (consentRuleOn(doctrines, excluded)) {
     bash['git commit*'] = 'ask';
     bash['git push*'] = 'ask';
   }
-  for (const [keys, verdict] of PUSH_CHAIN) for (const k of keys) bash[k] = verdict;
+  for (const [keys, verdict] of PUSH_CHAIN) {
+    if (keys === LAW_IV_BASH && deletionGate === false) continue;
+    for (const k of keys) bash[k] = verdict;
+  }
   return { bash };
 }
 
@@ -249,7 +247,7 @@ function defaultPermission(doctrines = null, excluded = []) {
  * has to be able to recognise a key that is Geneseed's business at all — to add it back when
  * the pack returns, and to name it when this build no longer wants it but will not remove it.
  */
-const OWNED_BASH = ['rm -rf *', 'git commit*', 'git push*',
+const OWNED_BASH = ['git commit*', 'git push*',
   ...PUSH_CHAIN.flatMap(([keys]) => keys)];
 
 /**
@@ -506,7 +504,8 @@ export function loadJsonObject(p, { strict = false } = {}) {
  * `'add'`, which is what the boolean callers this replaced meant.
  */
 function warnCommentedJsonc(target, agentPath, permission,
-  includeLsp = false, prefix = 'geneseed', doctrines = null, excluded = [], skillNames = []) {
+  includeLsp = false, prefix = 'geneseed', doctrines = null, excluded = [], skillNames = [],
+  deletionGate = true) {
   process.stdout.write(`[${prefix}] ${path.basename(target)} has comments — not rewriting `
     + 'it (your edits are kept). Add this to its "instructions" array by hand:\n');
   process.stdout.write(`[${prefix}]     ${jsonDumps(agentPath)}\n`);
@@ -515,7 +514,7 @@ function warnCommentedJsonc(target, agentPath, permission,
       ? `[${prefix}] and its "permission".bash is missing gates this build wires — `
         + 'reconcile it by hand against:\n'
       : `[${prefix}] and, for Geneseed's default ask-gates, a "permission" key:\n`);
-    for (const line of jsonDumpsIndent(defaultPermission(doctrines, excluded)).split('\n')) {
+    for (const line of jsonDumpsIndent(defaultPermission(doctrines, excluded, deletionGate)).split('\n')) {
       process.stdout.write(`[${prefix}]     ${line}\n`);
     }
     if (skillNames.length) {
@@ -566,7 +565,7 @@ export function atomicWriteJson(p, config) {
  * every path that wrote nothing — unreadable, not an object, commented `.jsonc`, write
  * failure — so the caller keeps its previous record rather than claiming denies never written. */
 export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [], skillNames = [],
-  staleSkillNames = [], result = {}) {
+  staleSkillNames = [], result = {}, deletionGate = true) {
   const target = opencodeTarget(p);
   let config = { $schema: OPENCODE_SCHEMA, instructions: [] };
   const { state, data, hadComments, error } = loadJsonObject(target);
@@ -601,7 +600,7 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [],
   let permIsObject = true;
   const added = [];
   if (addPerm) {
-    config.permission = defaultPermission(doctrines, excluded);
+    config.permission = defaultPermission(doctrines, excluded, deletionGate);
     if (skillNames.length) {
       config.permission.skill = defaultSkillPermission(skillNames);
       added.push(...skillNames);
@@ -610,7 +609,7 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [],
     const perm = get(config, 'permission');
     permIsObject = isDict(perm);
     [permChanged, stranded, opaque] = reconcileOpencodePermission(perm,
-      defaultPermission(doctrines, excluded));
+      defaultPermission(doctrines, excluded, deletionGate));
     // Independent of the `bash` shape: a `permission.bash` the build cannot wire into must
     // not also block the UNRELATED `permission.skill` key from being reconciled.
     if (permIsObject) {
@@ -630,7 +629,7 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [],
     // skill reconcile above never ran either — the unwired skill denies are folded into THIS
     // one WARN rather than going unmentioned (a dedicated `skillOpaque` needs `perm` to be a
     // dict to even look at `perm.skill`, which this case by definition is not).
-    const wanted = defaultPermission(doctrines, excluded).bash;
+    const wanted = defaultPermission(doctrines, excluded, deletionGate).bash;
     const names = [...OWNED_BASH.filter((k) => has(wanted, k)),
       ...(!permIsObject ? skillNames : [])];
     process.stderr.write(`[geneseed] WARN: "permission" in ${path.basename(target)} `
@@ -650,9 +649,9 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [],
   if (stranded.length) {
     process.stderr.write(`[geneseed] WARN: ${path.basename(target)} keeps `
       + `${stranded.map((k) => jsonDumps(k)).join(', ')} under "permission".bash — the `
-      + 'doctrine pack behind those gates is off in this build, but Geneseed cannot tell its '
-      + 'own entry from one you wrote, so it removes neither. Delete them by hand if you want '
-      + 'them gone.\n');
+      + 'rule behind those gates (a doctrine, or the deletion gate) is off in this build, but '
+      + 'Geneseed cannot tell its own entry from one you wrote, so it removes neither. Delete '
+      + 'them by hand if you want them gone.\n');
   }
   const addLsp = !has(config, 'lsp');
   if (addLsp) config.lsp = true;
@@ -673,7 +672,7 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [],
     // block to paste, split by which of the two situations the reader is actually in. It is
     // stdout, not stderr, because on this path the paste-in IS the output.
     warnCommentedJsonc(target, agentPath, addPerm ? 'add' : (permChanged && 'reconcile'),
-      addLsp, 'geneseed', doctrines, excluded, skillNames);
+      addLsp, 'geneseed', doctrines, excluded, skillNames, deletionGate);
     return target;
   }
   try {
@@ -726,7 +725,8 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [],
  * belongs in — the user's call — not how work is run, so it is not the process pack's to
  * remove. `default` here means unknown, and unknown keeps the gate (see `processPackOn`).
  */
-export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [], host = 'claude') {
+export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [], host = 'claude',
+  deletionGate = true) {
   const run = hookPrefix(hookOpts);
   const mem = `--memory "${path.join(cfg, 'memory')}"`;
   // --root carries the install's own dir so a GLOBAL hook can stand down when a live, wired
@@ -757,14 +757,17 @@ export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [],
     // else. Unverified live: no Bob install on the authoring machine. Revisit a matcher only
     // once a live Bob session can confirm both the current tool list and the regex dialect.
     const b = ' --host bob';
+    // `--no-deletion-gate` only when the install switched Law IV's gate off, so an armed
+    // install's command stays byte-identical (and an older shim never sees the flag).
+    const dg = deletionGate === false ? ' --no-deletion-gate' : '';
     return {
       SessionStart: [{ hooks: [{ type: 'command', command: `${run} context --root "${cfg}"${b} || exit 0` }] }],
       // One group, both gates: process 5's consent is a stderr line here (Bob has no ask
       // tier), so the pack toggle that drops Claude's git-gate group has nothing to drop —
-      // `tool-gate` only ever EXITS 2 for Laws I and IV, which every build carries, and for a
+      // `tool-gate` only ever EXITS 2 for Laws I and IV (IV unless built `--no-deletion-gate`), and for a
       // write under a project's own `.geneseed/protected-checks.txt` — the project opted in —
       // and for a recursive scan rooted at a whole filesystem (ops 2, the root-scan check).
-      PreToolUse: [{ hooks: [{ type: 'command', command: `${run} tool-gate --root "${cfg}"${b}` }] }],
+      PreToolUse: [{ hooks: [{ type: 'command', command: `${run} tool-gate --root "${cfg}"${b}${dg}` }] }],
       // Bob's Stop payload never carries `transcript_path` (I2) — `learn` reads `--host bob`
       // and returns immediately rather than wasting a model call on the bare envelope. KEPT
       // rather than DROPPED: the stand-down costs nothing (no transcript read, no spawn), and
@@ -781,7 +784,8 @@ export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [],
   // `--host` on `git-gate` but not on `learn`, which then exits 1 under `|| exit 0` and skips.
   const h = host === 'openclaude' ? ' --host openclaude' : '';
   const context = `${run} context --root "${cfg}"${h} || exit 0`;
-  const gate = `${run} git-gate --root "${cfg}"${h}${consentRuleOn(doctrines, excluded) ? '' : ' --no-consent'}`;
+  const gate = `${run} git-gate --root "${cfg}"${h}${consentRuleOn(doctrines, excluded) ? '' : ' --no-consent'}`
+    + (deletionGate === false ? ' --no-deletion-gate' : '');
   const ruleGate = `${run} rule-gate --root "${cfg}"`;
   const learn = `${run} learn ${mem}${h} || exit 0`;
   // Claude Code only (hooks.md, v2.1.295+; Task 1): a `command` hook that can't start, times
@@ -920,14 +924,14 @@ function readSettingsForMerge(p, consequence) {
  * global that never stood down for a project install.
  */
 export function mergeClaudeSettings(p, priorHooks = null, hookOpts = {},
-  doctrines = null, excluded = [], host = 'claude', cfgDir = path.dirname(p)) {
+  doctrines = null, excluded = [], host = 'claude', cfgDir = path.dirname(p), deletionGate = true) {
   const prior = (priorHooks || []).filter(isDict);
   const loaded = readSettingsForMerge(p, 'Hooks were not wired.');
   if (!loaded) return [p, prior];
   const [config, hadComments] = loaded;
   let hooks = get(config, 'hooks');
   if (!isDict(hooks)) hooks = {};
-  const canonical = claudeHookGroups(cfgDir, hookOpts, doctrines, excluded, host);
+  const canonical = claudeHookGroups(cfgDir, hookOpts, doctrines, excluded, host, deletionGate);
   const canonFlat = [];
   for (const [event, groups] of Object.entries(canonical)) {
     for (const g of groups) canonFlat.push({ event, group: g });

package/js/inspect/checks-probe.mjs

@@ -6,7 +6,9 @@
  * shim's paths and `hookShellProblems` infers shell drift — none of them observes a verdict. So
  * this runs each live install's own gate command, AS ITS SETTINGS SPELL IT, through the shell
  * the host would use, on two canned payloads: one Law IV call that every build must refuse
- * (`git reset --hard HEAD`, also in Bob's `BLOCK_RULES`) and one that must pass (`git status`).
+ * (`git reflog expire --expire=now --all`, Law IV in Bob's `BLOCK_RULES`) and one that must pass (`git status`).
+ * A gate wired `--no-deletion-gate` passes the Law IV call by design, so `badCommandFor` swaps in a
+ * root-wide scan (ops 2) it must still refuse — a disarmed install is not a gate that stopped working.
  * Both directions are judged, because "allows everything" and "refuses everything" (the
  * PowerShell-fallback case `hookShellProblems` can only infer) are both broken gates.
  *
@@ -44,7 +46,16 @@ import { spawnSync } from 'node:child_process';
  */
 const PROBED_VERB = { claude: 'git-gate', openclaude: 'git-gate', bob: 'tool-gate' };
 
-export const BAD_COMMAND = 'git reset --hard HEAD';
+// A Law IV act that loses data in EVERY state: since the gate asks only on real loss
+// (2026-10-17), a state-dependent act such as `reset --hard` would pass on a clean tree.
+export const BAD_COMMAND = 'git reflog expire --expire=now --all';
+// An install built `--no-deletion-gate` passes BAD_COMMAND by design, so its gate is probed on
+// what it must still refuse: a recursive scan of a whole filesystem (ops 2, in Bob's
+// `BLOCK_RULES` too).
+export const DISARMED_BAD_COMMAND = 'find / -name geneseed-probe';
+/** The must-refuse payload for one gate command, as its own flags say it is wired. */
+export const badCommandFor = (command) => (/ --no-deletion-gate(?:\s|$)/.test(command)
+  ? DISARMED_BAD_COMMAND : BAD_COMMAND);
 export const GOOD_COMMAND = 'git status';
 
 const PROBE_TIMEOUT_MS = 20_000;
@@ -95,7 +106,7 @@ export function refused(host, r) {
  * The verdict for one gate, from its two runs — null when the gate is sound, or the problem.
  * Pure, so the whole verdict table is pinned without spawning.
  */
-export function probeVerdict(host, bad, good) {
+export function probeVerdict(host, bad, good, badCommand = BAD_COMMAND) {
   for (const r of [bad, good]) {
     if (r.status !== 0 && r.status !== 2) {
       const why = r.error ? r.error : `exit ${r.status}`;
@@ -105,7 +116,7 @@ export function probeVerdict(host, bad, good) {
         : ' — the host lets every call through while this lasts'}`;
     }
   }
-  if (!refused(host, bad)) return `registered but not refusing — \`${BAD_COMMAND}\` went through`;
+  if (!refused(host, bad)) return `registered but not refusing — \`${badCommand}\` went through`;
   if (refused(host, good)) return `refuses everything — \`${GOOD_COMMAND}\` was refused too`;
   return null;
 }
@@ -159,9 +170,10 @@ export function gateProbe(targets = installTargets(), { platform = process.platf
       }
       const verdict = withTempDir((tmp) => {
         const runEnv = { ...env, GENESEED_GATE_PROBE: '1', CLAUDE_PROJECT_DIR: tmp };
-        const bad = runOnce(shell, probePayload(BAD_COMMAND, tmp), tmp, runEnv);
+        const badCommand = badCommandFor(handler.command);
+        const bad = runOnce(shell, probePayload(badCommand, tmp), tmp, runEnv);
         const good = runOnce(shell, probePayload(GOOD_COMMAND, tmp), tmp, runEnv);
-        return probeVerdict(host, bad, good);
+        return probeVerdict(host, bad, good, badCommand);
       }, 'geneseed-probe-');
       if (verdict) problems.push(`${label} under ${shell.label} ${verdict}`);
       else probed.push(`${path.normalize(cfg)} (${verb}, ${shell.label})`);

package/js/inspect/diff.mjs

@@ -44,7 +44,8 @@ import {
   GLOBAL_MANIFEST, VERSION_MARKER, expanduser, opencodeConfigDir, resolvePath,
 } from '../hosts/hosts.mjs';
 import {
-  EMIT_HOST_SCOPE, defaultTheme, doctrinesForBuild, excludedRulesOfDir, excludedSkillsOfDir,
+  EMIT_HOST_SCOPE, defaultTheme, deletionGateOfDir, doctrinesForBuild, excludedRulesOfDir,
+  excludedSkillsOfDir,
   footprintOfDir, modeOfDir, postureOfDir,
   trustOfDir,
   readJsonMaybe, readMaybe, themeOfDir,
@@ -183,6 +184,8 @@ export function diffCollect({ target = null, theme = null, emit = null, footprin
       excludeRules: excludedRulesOfDir(dir),
       // The excluded skills, or every skill the install left out reads as deleted.
       excludeSkills: excludedSkillsOfDir(dir),
+      // Law IV's gate switch, or a disarmed install reads its `Deletion gate: off` line as drift.
+      deletionGate: deletionGateOfDir(dir),
     }));
     // The one place a render depends on WHERE it is installed: a global Bob emit writes each
     // folder skill's absolute directory into its SKILL.md (see `writeNativeLayer`), so the

package/js/inspect/status.mjs

@@ -421,7 +421,9 @@ export function statusLines(d, color = false) {
     const packs = p.doctrines.length ? p.doctrines.join(',') : 'no packs';
     const excl = p.excludeRules?.length ? `excluding ${p.excludeRules.join(',')}` : 'no rules excluded';
     rows.push([`${p.host}:${p.scope}`, [p.state, p.theme, p.footprint, `${p.posture}/${p.mode}/${p.trust}`,
-      packs, excl, ...(p.excludeSkills?.length ? [`skills off: ${p.excludeSkills.join(',')}`] : [])]
+      packs, excl, ...(p.excludeSkills?.length ? [`skills off: ${p.excludeSkills.join(',')}`] : []),
+      // Elided when armed. Law IV's text still binds; only its tool-boundary gate is off.
+      ...(p.deletionGate === false ? ['deletion gate: off (Law IV text still binds)'] : [])]
       .join(` ${DOT} `) + where]);
   }
 

package/js/inspect/validate.mjs

@@ -10,7 +10,7 @@ import path from 'node:path';
 import { buildInto, emitGlobalInto, emitProjectInto } from '../build/driver.mjs';
 import { resolvePath } from '../hosts/hosts.mjs';
 import {
-  doctrinesOfDir, excludedRulesOfDir, modeOfDir, postureOfDir,
+  deletionGateOfDir, doctrinesOfDir, excludedRulesOfDir, modeOfDir, postureOfDir,
 } from '../hosts/installs.mjs';
 import { validateIsVendored } from '../hosts/native.mjs';
 import { printOut, printErr } from '../lib/fs.mjs';
@@ -33,7 +33,7 @@ export const VALIDATE_USAGE = [
   'usage: geneseed validate [-h] [--theme THEME] [--emit EMIT] [--out OUT] [--root ROOT]',
   '                         [--footprint {lean,full}] [--posture POSTURE] [--mode MODE]',
   '                         [--trust TRUST] [--doctrines DOCTRINES] [--exclude-rules RULES]',
-  '                         [--exclude-skills SKILLS] [-v]',
+  '                         [--exclude-skills SKILLS] [--no-deletion-gate] [-v]',
   '',
   "Render and emit into a throwaway sandbox, run the doctor's checks, and write nothing real.",
   "Takes the generator's render flags (see geneseed-build --help) except --sync-themes and",
@@ -128,7 +128,7 @@ export function cmdValidate(args) {
     const opts = {
       theme: args.theme, footprint: args.footprint, posture: args.posture, mode: args.mode,
       trust: args.trust, doctrines: args.doctrines, excludeRules: args.excludeRules,
-      excludeSkills: args.excludeSkills,
+      excludeSkills: args.excludeSkills, deletionGate: args.noDeletionGate ? false : null,
     };
     let scanDirs;
     try {
@@ -172,7 +172,9 @@ export function cmdValidate(args) {
     const excluded = excludedRulesOfDir(at);
     printOut(`[validate-only] rendered at posture=${postureOfDir(at) ?? '?'} `
       + `mode=${modeOfDir(at) ?? '?'} packs=${packs ? packs.join(',') || 'none' : '?'} `
-      + `excluded=${excluded.map((id) => id.replace('.', ' ')).join(', ') || 'none'}\n`);
+      + `excluded=${excluded.map((id) => id.replace('.', ' ')).join(', ') || 'none'}`
+      // Elided when armed, so an armed dry run prints the line it always did.
+      + `${deletionGateOfDir(at) ? '' : ' deletion-gate=off'}\n`);
     printOut(`[validate-only] would write ${written.length} file(s) under ${args.out}`
       + (args.root ? ` (root ${args.root})` : '')
       + ' — nothing was actually written (sandboxed).\n');

package/js/maintain/uninstall.mjs

@@ -51,7 +51,7 @@ import { hookRunnerEntry } from '../hosts/shim.mjs';
 import { confirm } from '../lib/prompt.mjs';
 import {
   claudeCfg, claudeReadManifest, doctrinesOfDir, EMIT_HOST_SCOPE, emitHostScopeOf,
-  excludedRulesOfDir, installKind, installState,
+  deletionGateOfDir, excludedRulesOfDir, installKind, installState,
   registeredTargets,
 } from '../hosts/installs.mjs';
 import {
@@ -1173,8 +1173,11 @@ function remergeClaudeHooks(cfg, root = cfg, host = 'claude') {
   const excluded = excludedRulesOfDir(root, host).length ? excludedRulesOfDir(root, host)
     : excludedRulesOfDir(cfg, host);
   // `host` reaches the group builder: a Bob reactivate must re-wire Gemini-named groups.
+  // Law IV's gate switch, the same two-carrier read: off only when a carrier says so, so a
+  // reactivate never disarms an install that did not ask for it.
+  const deletionGate = deletionGateOfDir(root, host) && deletionGateOfDir(cfg, host);
   const [, claims] = mergeClaudeSettings(settingsFile(cfg, managed),
-    managed.settings_hooks ?? null, hookRunnerEntry(), doctrines, excluded, host, cfg);
+    managed.settings_hooks ?? null, hookRunnerEntry(), doctrines, excluded, host, cfg, deletionGate);
   // `and data` — a manifest that did not parse is not one to write back.
   if (!deepEquals(claims, managed.settings_hooks ?? null) && Object.keys(data).length > 0) {
     managed.settings_hooks = claims;

package/js/maintain/update.mjs

@@ -632,7 +632,7 @@ export async function installAxes(dir, { installProfile, setupBuildArgs }, notif
   if (legacyProcessCarrierOfDir(String(dir), 'opencode')) return null;
   const p = installProfile('opencode', 'global', String(dir), notify);
   return setupBuildArgs('', 'files', null, null, p.footprint, p.posture, p.mode, p.doctrines,
-    undefined, p.excludeRules, p.trust, p.excludeSkills).slice(4);
+    undefined, p.excludeRules, p.trust, p.excludeSkills, p.deletionGate).slice(4);
 }
 
 /**

package/js/web/actions.mjs

@@ -46,7 +46,8 @@ import {
   opencodeConfigDir, resolvePath,
 } from '../hosts/hosts.mjs';
 import {
-  EMIT_HOST_SCOPE, doctrinesForBuild, excludedRulesOfDir, excludedSkillsOfDir, footprintOfDir,
+  EMIT_HOST_SCOPE, deletionGateOfDir, doctrinesForBuild, excludedRulesOfDir, excludedSkillsOfDir,
+  footprintOfDir,
   installState, installTargets, legacyProcessCarrierOfDir, modeOfDir, postureOfDir, trustOfDir,
 } from '../hosts/installs.mjs';
 import {
@@ -129,6 +130,16 @@ function bodyExcludeRules(body) {
     (n) => n.trim().replace(/[ \t]+/, '.'));
 }
 
+/**
+ * Law IV's gate switch across the trust boundary: only a real JSON boolean counts. Anything
+ * else — a string `"false"`, a number, absence — is `null`, and the caller keeps the install's
+ * own answer, so a malformed body can never disarm the gate by accident.
+ */
+function bodyDeletionGate(body) {
+  const v = bget(body, 'deletionGate');
+  return typeof v === 'boolean' ? v : null;
+}
+
 /**
  * The five scalar axes of a build request — theme, footprint, posture, mode, trust — each
  * taken from the body only when it names a value this checkout ships, else from `dflt`. The
@@ -490,6 +501,8 @@ export function apiRestore(state, files) {
       // re-states a rule whose hook gate the install deliberately left unwired.
       excludeRules: excludedRulesOfDir(target),
       excludeSkills: excludedSkillsOfDir(target),
+      // Law IV's gate switch: a restored AGENT.md must keep the install's `Deletion gate:` line.
+      deletionGate: deletionGateOfDir(target),
     }));
     for (const raw of (isTruthy(files) ? files : [])) {
       const rel = stripWhitespace(formatValue(raw).replace(/\\/g, '/')).replace(/^\/+/, '');
@@ -572,9 +585,12 @@ export function apiInstallCmd(state, body) {
   // the silence a pre-2.3 carrier gives on packs. Unspecified therefore keeps the install's
   // own answer, and a pre-marker install answers the empty list — which is what it has.
   const excludeRules = bodyExcludeRules(body) ?? excludedRulesOfDir(root, host);
+  // Law IV's gate switch (the Constitution page's toggle): a strict boolean in the body, else
+  // the install's own answer — so a pack Apply, which sends none, keeps the switch as it is.
+  const deletionGate = bodyDeletionGate(body) ?? deletionGateOfDir(root, host);
   const out = scope === 'global' ? null : String(root);
   const argv = setupBuildArgs(theme || 'neutral', emit, out, out, fp, pos, mode, doctrines,
-    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root, host));
+    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root, host), deletionGate);
   return { cmd: [process.execPath, path.join(ROOT, 'bin', 'build-driver.mjs'), ...argv] };
 }
 
@@ -673,8 +689,9 @@ export function apiDeployCmd(state, body) {
   // and `PreToolUse::Bash` went with them. `doctrinesForBuild` resolves unknown to ALL packs.
   const doctrines = bodyDoctrines(body) ?? doctrinesForBuild(root, host);
   const excludeRules = bodyExcludeRules(body) ?? excludedRulesOfDir(root, host);
+  const deletionGate = bodyDeletionGate(body) ?? deletionGateOfDir(root, host);
   // project-scope emit name == host name (opencode / claude / bob / openclaude)
   const argv = setupBuildArgs(theme || 'neutral', host, root, root, fp, pos, mode, doctrines,
-    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root, host));
+    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root, host), deletionGate);
   return { cmd: [process.execPath, path.join(ROOT, 'bin', 'build-driver.mjs'), ...argv] };
 }

package/js/web/api.mjs

@@ -20,7 +20,7 @@ import { doctorCollect } from '../inspect/doctor.mjs';
 import { excludesSnapshot } from '../inspect/excludes.mjs';
 import { CLAUDE_STYLE, HOSTS, VERSION_MARKER, resolvePath } from '../hosts/hosts.mjs';
 import {
-  footprintOfDir, installState, installTargets, modeOfDir, trustOfDir,
+  deletionGateOfDir, footprintOfDir, installState, installTargets, modeOfDir, trustOfDir,
   postureOfDir, readJsonMaybe, themeOfDir,
 } from '../hosts/installs.mjs';
 import { PRESETS } from '../loop/score.mjs';
@@ -247,7 +247,9 @@ export function apiOverview(state) {
   for (const [host, scope, root] of installTargets()) {
     try {
       if (samePath(viewCfg(host, scope, root), state.target)) {
-        install = { host, scope, path: root, footprint: footprintOfDir(root) };
+        // `deletionGate`: Law IV's gate switch, for the Constitution page's toggle on row IV.
+        install = { host, scope, path: root, footprint: footprintOfDir(root),
+          deletionGate: deletionGateOfDir(root, host) };
         break;
       }
     } catch { /* an unreadable candidate just isn't a match */ }

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "Every field here is argued and gated in tests/unit/package_manifest.test.mjs. `files`, `bin` and `engines` each have a test that fails when reality drifts from this file; `version` mirrors harness.config.json and is gated too. Read that docblock before editing this one.",
   "name": "geneseed",
-  "version": "4.6.0",
+  "version": "4.8.0",
   "description": "A portable, theme-able harness you implant once and use everywhere to grow a disciplined AI coding agent.",
   "keywords": [
     "ai",

package/src/AGENT.md.tmpl

@@ -144,7 +144,7 @@ Inactive packs still ship under `{{DIR_DOCTRINES}}/`, so a citation into one res
 
 {{DOCTRINES_BODY}}
 
-Active packs: {{DOCTRINES_LIST}}{{EXCLUDED_RULES_LINE}}
+Active packs: {{DOCTRINES_LIST}}{{EXCLUDED_RULES_LINE}}{{DELETION_GATE_LINE}}
 
 ---
 

package/src/laws/universal.md

@@ -69,24 +69,24 @@ governs the goal).
 
 ### {{LAW:deletion-is-deliberate}} Deletion Is Deliberate
 <!-- LEAN:begin -->
-Deletion of what version control cannot restore, and any irreversible or
-outward-facing act — publishing, force-push, sending data to a third party —
-requires explicit confirmation bound to that specific act, or a durable
-authorization the user gave that already covers it; a yes to one act is never
-stretched to the next. Classify every action as Create, Read, Update, or Delete
-before acting, and tier it by reversibility: a read-only or easily-reversible
-action — an edit, or a delete of what is committed and pushed to a branch —
-runs freely; an irreversible, financial, externally-visible, or
-privilege-changing one needs that confirmation. Uncommitted, unpushed, or
-untracked work is not recoverable.
+Real data loss and any irreversible, financial, privilege-changing or
+outward-facing act (publishing, sending data to a third party) need explicit
+confirmation bound to that act, or a durable authorization covering it; one
+yes never stretches to the next. Real loss: deleting what version control
+cannot restore (untracked, modified, unpushed or unmerged work), discarding
+uncommitted changes, rewriting, deleting or force-moving main, master or the
+default branch, or erasing reflog/gc data. Classify every action as Create,
+Read, Update, or Delete and tier by reversibility: what git restores — an
+edit, removing tracked clean files, force-pushing your own branch, removing a
+worktree — runs freely.
 <!-- LEAN:else -->
-Deleting what version control cannot restore, and any irreversible or
-outward-facing act — publishing, force-push, sending data to a third party —
-needs explicit confirmation bound to that act, or a durable authorization that
-covers it; one yes never stretches to the next act. A read-only or
-easily-reversed action — deleting work pushed to a branch — runs freely; an
-irreversible, financial, externally-visible, or privilege-changing one asks.
-Deleting unpushed work asks.
+Real data loss — deleting untracked, modified, unpushed, unmerged work,
+discarding uncommitted work, deleting or force-moving main, master or the
+default branch, pruning reflog/gc — and any irreversible, financial,
+privilege-changing or outward-facing act need explicit confirmation bound to
+that act, or a durable authorization covering it; one yes never stretches to
+the next. What git restores runs freely: tracked clean files, a worktree,
+force-pushing your own branch.
 <!-- LEAN:end -->
 
 ### {{LAW:surface-failures}} Surface Failures