geneseed 4.7.0 → 4.9.0

package/js/build/generate.mjs

@@ -35,12 +35,12 @@ import { existsSync, mkdirSync, statSync } from 'node:fs';
 import path from 'node:path';
 
 import { main as driverMain } from './driver.mjs';
-import { makeCfg, PACK_ORDER } from './source.mjs';
+import { GATE_SWITCHES, makeCfg, PACK_ORDER } from './source.mjs';
 import { DEFAULT_PRESET } from '../loop/score.mjs';
 import { opencodeConfigDir, resolvePath } from '../hosts/hosts.mjs';
 import {
   EMIT_HOST_SCOPE, defaultMode, defaultPosture, defaultTheme, doctrinesForBuild,
-  excludedRulesOfDir, excludedSkillsOfDir, footprintOfDir, installState, installTargets,
+  excludedRulesOfDir, excludedSkillsOfDir, footprintOfDir, gatesOfDir, installState, installTargets,
   legacyProcessCarrierOfDir, modeOfDir, postureOfDir, readMaybe, themeOfDir, trustOfDir,
 } from '../hosts/installs.mjs';
 import { colorThemeFiles, colorThemeJson, PALETTE_ROLES } from '../hosts/opencode.mjs';
@@ -102,6 +102,9 @@ const BUILD_FORWARD = [
 export function cmdBuild(args) {
   const argv = [];
   for (const [key, flag] of BUILD_FORWARD) if (args[key] != null) argv.push(flag, args[key]);
+  // The bare switches `build` forwards (the gate switches): they take no value, so they are
+  // not BUILD_FORWARD rows.
+  for (const g of GATE_SWITCHES) if (args[g.arg]) argv.push(g.flag);
   return driverMain(argv);
 }
 
@@ -138,7 +141,8 @@ export function cmdBuild(args) {
  */
 export function setupBuildArgs(theme, emit, out = null, root = null, footprint = 'lean',
   posture = 'peer', mode = 'direct', doctrines = null, allPacks = PACK_ORDER,
-  excludeRules = null, trust = DEFAULT_PRESET, excludeSkills = null) {
+  excludeRules = null, trust = DEFAULT_PRESET, excludeSkills = null, deletionGate = true,
+  { secretsGate = true, doneGate = true } = {}) {
   const argv = ['--theme', theme, '--emit', emit];
   if (!emit.endsWith('-global')) {
     if (out) argv.push('--out', out);
@@ -166,6 +170,11 @@ export function setupBuildArgs(theme, emit, out = null, root = null, footprint =
   // feeds it), so the flag's absence and `none` are the same answer, and every argv that
   // excludes nothing stays the bytes it was before the flag existed.
   if (excludeSkills?.length) argv.push('--exclude-skills', excludeSkills.join(','));
+  // The gate switches elide when armed: the driver's default IS armed (no config key feeds
+  // them), so only an explicit `false` speaks, and every armed argv stays the bytes it was.
+  // Law order, so a Law IV-only install still ends on `--no-deletion-gate` as it did.
+  const gates = { secretsGate, doneGate, deletionGate };
+  for (const g of GATE_SWITCHES) if (gates[g.key] === false) argv.push(g.flag);
   return argv;
 }
 
@@ -224,9 +233,12 @@ export function installProfile(host, scope, root, notify = null) {
   const excludeRules = excludedRulesOfDir(root, host);
   // Skills left out stay left out: an upgrade that forgot them would put them all back.
   const excludeSkills = excludedSkillsOfDir(root, host, notify);
+  // The gate switches: a rebuild that forgot one would silently re-arm (or, read wrong, disarm)
+  // the install. A missing marker reads as armed.
+  const gates = gatesOfDir(root, host);
   const out = scope === 'global' ? null : root;
   const argv = setupBuildArgs(theme, emit, out, out, footprint, posture, mode, doctrines,
-    PACK_ORDER, excludeRules, trust, excludeSkills);
+    PACK_ORDER, excludeRules, trust, excludeSkills, gates.deletionGate, gates);
   // A GLOBAL ROW NAMES ITS OWN DIR. `root` came from the host's config-dir resolver, which
   // honours env overrides (`OPENCODE_CONFIG_DIR`, `CLAUDE_CONFIG_DIR`…); without the flag the
   // same argv run from a shell lacking that variable re-emits into the DEFAULT dir — a second
@@ -234,7 +246,8 @@ export function installProfile(host, scope, root, notify = null) {
   if (scope === 'global') argv.push('--config-dir', root);
   return {
     host, scope, root, state: installState(root, host, scope),
-    emit, theme, footprint, posture, mode, trust, doctrines, excludeRules, excludeSkills, argv,
+    emit, theme, footprint, posture, mode, trust, doctrines, excludeRules, excludeSkills,
+    ...gates, argv,
   };
 }
 

package/js/build/render.mjs

@@ -34,7 +34,7 @@ import { readText } from '../lib/fs.mjs';
 import { parseJson } from '../lib/json.mjs';
 import { normcase, comparePaths } from '../lib/paths.mjs';
 // `js/build/source.mjs` imports nothing but node builtins, so this direction cannot cycle.
-import { PACK_ORDER, readPackText, resolveRuleIds, ruleCanon } from './source.mjs';
+import { GATE_SWITCHES, PACK_ORDER, readPackText, resolveRuleIds, ruleCanon } from './source.mjs';
 import { DEFAULT_PRESET } from '../loop/score.mjs';
 
 /** Document STRUCTURE is theme-INDEPENDENT — mirrors `_build_render.STRUCTURE`. */
@@ -444,6 +444,12 @@ export function effectiveTheme(cfg, themeName, { footprint = 'full', lawsPrefix
   const skipped = [...(cfg.excludeSkills ?? [])].sort();
   // It fills a template line of its own, so its value carries the blank line around it.
   theme.EXCLUDED_SKILLS_LINE = skipped.length ? `\nExcluded skills: ${skipped.join(', ')}\n` : '';
+  // The gate switches (`GATE_SWITCHES`: Laws I, III, IV), under the same contract: a line is
+  // written only when its gate is OFF, so a default build stays byte-identical and a missing
+  // line reads back as armed (`gatesOfDir`). The OpenCode plugins read these lines at load, so
+  // their wording is a parsed contract.
+  theme.GATE_LINES = GATE_SWITCHES.filter((g) => cfg[g.key] === false)
+    .map((g) => `\n${g.marker}: off`).join('');
   return theme;
 }
 

package/js/build/source.mjs

@@ -399,7 +399,8 @@ export function resolveSkillNames(names, {
  */
 export function makeCfg({
   posture = 'peer', mode = 'direct', trust = DEFAULT_PRESET, doctrines = PACK_ORDER,
-  excludeRules = [], excludeSkills = [],
+  excludeRules = [], excludeSkills = [], noDeletionGate = false, noSecretsGate = false,
+  noDoneGate = false,
 } = {}) {
   return {
     root: ROOT,
@@ -427,5 +428,25 @@ export function makeCfg({
     excludeRules: Array.isArray(excludeRules) ? [...excludeRules] : [],
     // Skill names left out of this install — same "unspecified takes nothing away" default.
     excludeSkills: Array.isArray(excludeSkills) ? [...excludeSkills] : [],
+    // Law IV's deletion gate (`--no-deletion-gate`). Armed unless switched off in so many words:
+    // only a literal `true` disarms, so every caller that never heard of the switch keeps it.
+    deletionGate: noDeletionGate !== true,
+    // Law I's secret scan (`--no-secrets-gate`) and Law III's done gate (`--no-done-gate`), the
+    // same contract (user decision 2026-10-18; see GATE_SWITCHES).
+    secretsGate: noSecretsGate !== true,
+    doneGate: noDoneGate !== true,
   };
 }
+
+/**
+ * The laws whose hook gate an install can switch off, in law order: the cfg/profile key, the
+ * build flag, the carrier marker (`<marker>: off`, written only when off) and the law. ONE
+ * table, so the flag, the marker, the rebuild argv, the read-back and `status` cannot drift
+ * apart. Every gate is ARMED by default and the law's text binds either way. The deletion row
+ * is #319's, unchanged: existing installs carry its flag and marker.
+ */
+export const GATE_SWITCHES = [
+  { key: 'secretsGate', flag: '--no-secrets-gate', arg: 'noSecretsGate', marker: 'Secrets gate', law: 'I' },
+  { key: 'doneGate', flag: '--no-done-gate', arg: 'noDoneGate', marker: 'Done gate', law: 'III' },
+  { key: 'deletionGate', flag: '--no-deletion-gate', arg: 'noDeletionGate', marker: 'Deletion gate', law: 'IV' },
+];

package/js/cli-table.json

@@ -237,6 +237,51 @@
           "is_flag": false,
           "type": null,
           "hidden": false
+        },
+        {
+          "names": [
+            "--no-secrets-gate"
+          ],
+          "dest": "no_secrets_gate",
+          "metavar": null,
+          "help": "switch Law I's secret scan off for this install: a credential-shaped write stops being refused (Sealed Secrets' text still binds); written to the carrier as 'Secrets gate: off' and replayed by rebuilds",
+          "choices": null,
+          "default": false,
+          "required": false,
+          "nargs": "0",
+          "is_flag": true,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": [
+            "--no-done-gate"
+          ],
+          "dest": "no_done_gate",
+          "metavar": null,
+          "help": "switch Law III's done gate off for this install: a turn may end with the project's declared checks unproven (Verify Before Asserting's text still binds); written to the carrier as 'Done gate: off' and replayed by rebuilds",
+          "choices": null,
+          "default": false,
+          "required": false,
+          "nargs": "0",
+          "is_flag": true,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": [
+            "--no-deletion-gate"
+          ],
+          "dest": "no_deletion_gate",
+          "metavar": null,
+          "help": "switch Law IV's deletion gate off for this install: the real-loss checks stop asking (Deletion Is Deliberate's text still binds); written to the carrier as 'Deletion gate: off' and replayed by rebuilds",
+          "choices": null,
+          "default": false,
+          "required": false,
+          "nargs": "0",
+          "is_flag": true,
+          "type": null,
+          "hidden": false
         }
       ],
       "mutex": []
@@ -581,6 +626,21 @@
           "is_flag": true,
           "type": null,
           "hidden": false
+        },
+        {
+          "names": [
+            "--no-deletion-gate"
+          ],
+          "dest": "no_deletion_gate",
+          "metavar": null,
+          "help": "skip the Deletion Is Deliberate real-loss check (set by the emit when the install was built --no-deletion-gate); the root-scan and consent asks still run",
+          "choices": null,
+          "default": false,
+          "required": false,
+          "nargs": "0",
+          "is_flag": true,
+          "type": null,
+          "hidden": false
         }
       ],
       "mutex": []
@@ -642,6 +702,21 @@
           "is_flag": true,
           "type": null,
           "hidden": false
+        },
+        {
+          "names": [
+            "--no-done-gate"
+          ],
+          "dest": "no_done_gate",
+          "metavar": null,
+          "help": "skip the done gate on Stop (set by the emit when the install was built --no-done-gate); learning still runs",
+          "choices": null,
+          "default": false,
+          "required": false,
+          "nargs": "0",
+          "is_flag": true,
+          "type": null,
+          "hidden": false
         }
       ],
       "mutex": []
@@ -1120,6 +1195,21 @@
           "is_flag": false,
           "type": null,
           "hidden": false
+        },
+        {
+          "names": [
+            "--no-secrets-gate"
+          ],
+          "dest": "no_secrets_gate",
+          "metavar": null,
+          "help": "skip the Sealed Secrets credential scan (set by the emit when the install was built --no-secrets-gate); the protected checks and the persist check still run",
+          "choices": null,
+          "default": false,
+          "required": false,
+          "nargs": "0",
+          "is_flag": true,
+          "type": null,
+          "hidden": false
         }
       ],
       "mutex": []
@@ -1382,6 +1472,36 @@
           "is_flag": false,
           "type": null,
           "hidden": false
+        },
+        {
+          "names": [
+            "--no-deletion-gate"
+          ],
+          "dest": "no_deletion_gate",
+          "metavar": null,
+          "help": "skip the Deletion Is Deliberate real-loss check (set by the emit when the install was built --no-deletion-gate); Sealed Secrets, the root-scan check and the protected checks still refuse",
+          "choices": null,
+          "default": false,
+          "required": false,
+          "nargs": "0",
+          "is_flag": true,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": [
+            "--no-secrets-gate"
+          ],
+          "dest": "no_secrets_gate",
+          "metavar": null,
+          "help": "skip the Sealed Secrets credential scan (set by the emit when the install was built --no-secrets-gate); the deletion, root-scan and protected checks still refuse",
+          "choices": null,
+          "default": false,
+          "required": false,
+          "nargs": "0",
+          "is_flag": true,
+          "type": null,
+          "hidden": false
         }
       ],
       "mutex": []

package/js/hosts/gitref.mjs

@@ -16,7 +16,7 @@
  * loop exemption; upstream never calls that hook, so the twin was deleted (OpenCode verdict
  * I-2). This module has no copy to keep in step.
  */
-import { existsSync, statSync, lstatSync, readFileSync, openSync, readSync, closeSync } from 'node:fs';
+import { existsSync, statSync, lstatSync, readFileSync, readdirSync, openSync, readSync, closeSync } from 'node:fs';
 import path from 'node:path';
 
 /**
@@ -94,6 +94,52 @@ export function currentBranch(cwd) {
   }
 }
 
+/**
+ * The SHARED `.git` directory for `root`: the gitdir itself in a main worktree, the one its
+ * `commondir` names in a linked worktree. Refs under `refs/remotes/`, `refs/stash` and
+ * `packed-refs` live there, not in a worktree's private gitdir. Throws like `gitDirOf`.
+ */
+export function gitCommonDirOf(root) {
+  const gitdir = gitDirOf(root);
+  try {
+    return path.resolve(gitdir, readFileSync(path.join(gitdir, 'commondir'), 'utf8').trim());
+  } catch {
+    return gitdir;
+  }
+}
+
+/**
+ * The branch names Deletion Is Deliberate treats as protected in `root`'s repository: `main`,
+ * `master`, and every remote's default branch — the target of each `refs/remotes/<r>/HEAD`
+ * symref (git writes those loose, never packed). A remote whose HEAD cannot be read simply adds
+ * nothing; `main`/`master` are always in. Throws when the gitdir itself cannot be found, so a
+ * caller can tell "no remote default" from "no repository".
+ */
+export function protectedBranches(root) {
+  const names = new Set(['main', 'master']);
+  const remotes = path.join(gitCommonDirOf(root), 'refs', 'remotes');
+  let dirs = [];
+  try { dirs = readdirSync(remotes); } catch { /* no remotes */ }
+  for (const r of dirs) {
+    try {
+      const m = /^ref:\s*refs\/remotes\/[^/]+\/(.+?)\s*$/m.exec(readFileSync(path.join(remotes, r, 'HEAD'), 'utf8'));
+      if (m) names.add(m[1]);
+    } catch { /* this remote has no HEAD symref */ }
+  }
+  return names;
+}
+
+/** Whether `root`'s repository holds a stash — `refs/stash` loose or in `packed-refs`. Throws like `gitDirOf`. */
+export function stashExists(root) {
+  const common = gitCommonDirOf(root);
+  if (existsSync(path.join(common, 'refs', 'stash'))) return true;
+  try {
+    return /^[0-9a-f]+ refs\/stash$/m.test(readFileSync(path.join(common, 'packed-refs'), 'utf8'));
+  } catch {
+    return false;
+  }
+}
+
 const LOOP_STATE_MARKER = '<!-- loop-state:begin -->';
 
 /**

package/js/hosts/hooks-done.mjs

@@ -10,6 +10,10 @@
  * last-writer-wins: an older `geneseed-hook` would refuse a new verb or flag, and the Stop
  * command's `|| exit 0` would then skip learning too, silently. Arming on a project FILE keeps
  * every emitted settings file byte-identical, so a stale shim only means "no done gate".
+ * The ONE flag is the off switch, `--no-done-gate` (user decision 2026-10-18): it is emitted
+ * only on an install built with the gate off, so armed settings stay byte-identical — but on
+ * such an install a stale shim refuses the flag and that install loses LEARNING too, not just a
+ * gate it already switched off. Hence "run rebuild-all before switching it off" (exclusions.md).
  *
  * WHY STDOUT JSON AND NOT EXIT 2. The emitted Stop command ends in `|| exit 0`, which swallows
  * a 2. `{"decision":"block"}` on exit 0 is the one signal that survives the existing wiring.

package/js/hosts/hooks-learn.mjs

@@ -312,7 +312,9 @@ export function cmdLearn(args) {
 
   // The done gate (#289) judges the turn BEFORE anything here spawns, and only on Stop. A block
   // means the turn goes on, so there is nothing to distil yet: the next Stop will.
-  if (hookEvent === 'Stop' && !args.file && doneGate(meta, args, install)) return 0;
+  // `--no-done-gate` (the install switched Law III's gate off) skips the check, never the
+  // distillation below.
+  if (hookEvent === 'Stop' && !args.file && !args.noDoneGate && doneGate(meta, args, install)) return 0;
 
   // I2 (Bob): its Stop payload never carries `transcript_path`, so there is never a transcript
   // to distil — and the bare envelope itself is not notes text (that would waste a model call

package/js/hosts/hooks.mjs

@@ -58,6 +58,7 @@ import {
   GATE_LEDGER, globalHookStandingDown, hookProjectDir, resolvePath, sovereignBypass,
 } from './hosts.mjs';
 import { currentBranch, gitRootOf, loopLaunched } from './gitref.mjs';
+import { LOSS_CANDIDATE_RE, lossReason } from './loss.mjs';
 import { selfAndParents, readStdin } from './hooks-prims.mjs';
 import { recordUse } from './usage.mjs';
 
@@ -71,45 +72,13 @@ import { recordUse } from './usage.mjs';
 // one line and a `commit` on the next are two commands, not one.
 const GIT_GATE_RE = /\bgit\b[^\n]*\b(?:commit|push)\b/;
 
-// Law IV's boundary half: the git verbs that rewrite or discard history. Law IX (now rigor 5)
-// says a rule in a prompt is a request and a rule at a boundary is a constraint; before this
-// regex the harness enforced one doctrine rule and no law. `checkout --` is listed because it
-// reverts to the INDEX and eats unstaged work; `checkout <branch>` is not. `clean -f` matches
-// any flag cluster carrying `f` (`-fd`, `-xf`), in any position (`clean -d -f`), and never `-n`.
-// `reset`, `clean` and `push` take their flags ANYWHERE after the verb (`reset -q --hard`,
-// `push -f origin main`), so each reads `[^\n]*` up to the flag rather than requiring it next.
-// A forced push is `--force*`, a `-f` cluster, or a `+refspec` (`push origin +main`) — the last
-// is a force push with no flag at all. `push --force*` trips this gate rather than process 5's
-// so the stronger reason is the one the user reads.
-//
-// B5 (claude-code.md / claude-verdict.md) found the long/modern spellings of the same acts
-// still passed: `clean --force` (the long flag, not a `-f` cluster), `branch --delete --force`
-// (the long form of `-D`, EITHER flag order — `--force --delete` is the same act; an un-forced
-// `--delete` refuses on an unmerged branch exactly like `-d`, so it stays OUT; `-D --force`/
-// `--delete -f`/`-d --force`/`-df` are the SAME act again and are a known ceiling this does not
-// chase — add them if a probe ever shows one in real use), `checkout -f`/`--force` and
-// `switch -f`/`--force`/`--discard-changes`
-// (git's own `-h` lists `-f, --force` AND a separate `--discard-changes` for switch — both
-// discard uncommitted work the same way `checkout --` does), `reflog expire` and `gc
-// --prune=now` (delete the reflog/dangling-commit safety net recovery depends on), and `push
-// :branch`/`push --delete` (deletes a remote branch — the colon form needs a space before the
-// `:` so `push origin HEAD:main`, an ordinary refspec, is not caught).
-//
-// `worktree remove --force`/`-f` is deliberately NOT here (user decision, 2026-10-17): removing
-// a worktree is routine agent housekeeping, so it passes like a plain `worktree remove`. The
-// OpenCode guard's `SHELL_WARN_RE` and `LAW_IV_BASH` (js/hosts/settings.mjs) dropped it too.
-//
-// `restore` and `stash drop`/`stash clear` are carved OUT of the shared `\bgit\b[^\n]*\b(…)`
-// wrapper above and anchored to the verb position instead (`git`, an optional `-C <path>`, then
-// the verb immediately): every other arm here needs a flag that is vanishingly unlikely in a
-// commit message or a filename, but "restore" needs no flag at all and "drop"/"clear" are
-// ordinary English, so `git commit -m "restore working behavior"` or `git stash push -m "clear
-// old state"` would otherwise trip Law IV on the MESSAGE TEXT, not the command. Anchoring to
-// the verb position is also what lets `restore` ask for `--staged --worktree` together (that
-// combination DOES discard working-tree changes, unlike `--staged` alone) while still deferring
-// on `--staged` alone.
-const DESTRUCTIVE_GIT_RE =
-  /\bgit\b[^\n]*\b(?:reset\b[^\n]*\s--hard\b|clean\b[^\n]*\s(?:-[a-zA-Z]*f|--force\b)|branch\b[^\n]*\s(?:-D\b|--delete\b[^\n]*--force\b|--force\b[^\n]*--delete\b)|checkout\s+--\s|checkout\b[^\n]*\s(?:-[a-zA-Z]*f\b|--force\b)|switch\b[^\n]*\s(?:-[a-zA-Z]*f\b|--force\b|--discard-changes\b)|reflog\b[^\n]*\bexpire\b|gc\b[^\n]*--prune\b|push\b[^\n]*(?:\s--force|\s-[a-zA-Z]*f\b|\s\+\S|\s--delete\b|\s:\S))|\bgit(?:\s+-C\s+\S+)*\s+restore\b(?:(?![^\n]*--staged\b)|(?=[^\n]*--staged\b)(?=[^\n]*--worktree\b))|\bgit(?:\s+-C\s+\S+)*\s+stash\s+(?:drop|clear)\b/;
+// Law IV's boundary half lives in `./loss.mjs`: it asks only when a command would really lose
+// data — a protected branch deleted or force-pushed, an unpushed unmerged branch deleted,
+// uncommitted work discarded on a tree that holds some, a stash dropped while one exists, the
+// reflog or unreachable commits pruned, a removal of what git cannot restore — and fails closed
+// when it cannot tell (user decision, 2026-10-17, replacing the form-only `DESTRUCTIVE_GIT_RE`).
+// `LOSS_CANDIDATE_RE` is the cheap prefilter: an ordinary command fails it and never reaches the
+// parse or the one `git` spawn behind it. `worktree remove --force` stays out, as before.
 
 // `loopExempt` — a WHITELIST, not the blacklist this replaced. A false ask costs one prompt; a
 // false allow publishes. So the exemption holds only when the ENTIRE command is built from
@@ -465,9 +434,17 @@ const rootArg = (t) => !/^["']/.test(t) && FS_ROOT_RE.test(t);
 function gitDecide(args, payload) {
   const command = ((payload && payload.tool_input) || {}).command;
   if (typeof command !== 'string') return 0;
-  if (DESTRUCTIVE_GIT_RE.test(command)) {
-    return ask(args, 'git-gate', 'law-4', 'Geneseed (Deletion Is Deliberate) \u2014 a history-rewriting or '
-      + 'discarding git act needs confirmation bound to this specific command');
+  // `--no-deletion-gate`: the install switched Law IV's boundary off (user decision,
+  // 2026-10-17). Only this check stands down — ops 2 and process 5 below still run.
+  if (!args.noDeletionGate && LOSS_CANDIDATE_RE.test(command)) {
+    // A pass here FALLS THROUGH: a force push to a feature branch loses nothing, but it is still
+    // a push, and process 5 below still asks for it.
+    const loss = lossReason(scanSegments(command).map((seg) => seg.match(SCAN_TOKEN_RE) || []),
+      (payload && payload.cwd) || process.cwd());
+    if (loss) {
+      return ask(args, 'git-gate', 'law-4', `Geneseed (Deletion Is Deliberate) \u2014 ${loss}. `
+        + 'Confirm this specific command, or leave the data in place.');
+    }
   }
   // Before `--no-consent`: that flag drops the process pack's rule, not this one.
   const scan = rootScan(command);
@@ -592,7 +569,9 @@ function ruleDecide(args, payload) {
   const edits = Array.isArray(ti.edits) ? ti.edits.map((e) => e && e.new_string) : [];
   const body = [ti.content, ti.new_string, ti.new_source, diffReplaced(ti.diff), ti.replace, ...edits]
     .filter((v) => typeof v === 'string').join('\n');
-  if (body && !DOTENV_RE.test(p) && SECRET_RE.test(body)) {
+  // `--no-secrets-gate`: the install switched Law I's scan off (user decision 2026-10-18). Only
+  // this check stands down; the protected checks and process 1 below still run.
+  if (!args.noSecretsGate && body && !DOTENV_RE.test(p) && SECRET_RE.test(body)) {
     return ask(args, 'rule-gate', 'law-1', `Geneseed (Sealed Secrets) — ${p} would carry a `
       + 'credential-shaped string. Secrets live in .env or a secret manager, never in a '
       + 'tracked file.');

package/js/hosts/installs.mjs

@@ -35,7 +35,9 @@
 import { existsSync, readdirSync } from 'node:fs';
 import path from 'node:path';
 
-import { CONFIG, PACK_ORDER, THEMES, discoverNames, resolveSkillNames } from '../build/source.mjs';
+import {
+  CONFIG, GATE_SWITCHES, PACK_ORDER, THEMES, discoverNames, resolveSkillNames,
+} from '../build/source.mjs';
 import {
   CLAUDE_STYLE, DISABLED_STASH, GLOBAL_MANIFEST, HOSTS, isHostGlobalDir, liveRecordedHooks,
   resolvePath,
@@ -583,6 +585,33 @@ export function excludedSkillsOfDir(d, host = null, notify = null) {
   }, [], host);
 }
 
+/**
+ * Whether a DEPLOYED install keeps one law's hook gate armed — `true` (armed) or `false` (its
+ * `<marker>: off` line, written by a build with that gate's `--no-*-gate` flag; `GATE_SWITCHES`).
+ * Read back so `upgrade`, `rebuild-all`, `diff` and the console re-render the same switch.
+ * FAILS CLOSED: a missing line, a missing carrier, or any value but exactly `off` reads as
+ * armed, because the line is only ever written when the gate is off and a gate is the thing a
+ * misread must never take away.
+ */
+function gateOfDir(d, marker, host = null) {
+  const re = new RegExp(`^${marker}:[ \\t]*(.+?)[ \\t]*$`, 'm');
+  return firstCarrier(d, (carrierPath) => {
+    const text = readMaybe(carrierPath);
+    if (text === null) return undefined;
+    const m = re.exec(text);
+    if (!m) return undefined;
+    return m[1] !== 'off';
+  }, true, host);
+}
+
+/** Every switchable gate of a deployed install, keyed as `makeCfg` and `installProfile` key them. */
+export function gatesOfDir(d, host = null) {
+  return Object.fromEntries(GATE_SWITCHES.map((g) => [g.key, gateOfDir(d, g.marker, host)]));
+}
+
+/** Law IV's switch alone (#319's reader, kept for its callers). */
+export const deletionGateOfDir = (d, host = null) => gateOfDir(d, 'Deletion gate', host);
+
 // ---- what host a deployed dir belongs to (`_harness_mcp`) ---------------------------------
 
 /** `_harness_mcp._claude_read_manifest`. */