geneseed 4.8.0 → 4.9.1

package/js/hosts/loss.mjs

@@ -18,14 +18,18 @@
  *     `branch -f`/`checkout -B`/`switch -C` moving a protected branch off commits nothing else
  *     holds — the same forms on a feature branch pass;
  *   - `stash drop`/`stash clear` while a stash exists; `reflog expire` and `gc --prune` always;
- *   - a file removal (`rm`, `rmdir`, `del`, `erase`, `Remove-Item`/`ri`/`rd`) of anything git
- *     cannot bring back: untracked, ignored or modified files, a repository's own `.git`, or
- *     any path outside a git repository.
+ *   - a file removal (`rm`, `rmdir`, `unlink`, `del`, `erase`, `Remove-Item`/`ri`/`rd`) of
+ *     anything git cannot bring back: untracked, ignored or modified files, a repository's own
+ *     `.git`, or any path outside a git repository.
  *
  * FAIL CLOSED. Anything this reader cannot settle — a glob or a `$variable` in a path it must
- * name, a `cd` it cannot follow, an interpreter (`sh -c`, `xargs`, `eval`) carrying a removal,
- * a git that fails, times out or is missing — asks, and the reason says it could not verify.
- * "Not proven safe" is an ask; only "proven safe" passes.
+ * name, a `cd` it cannot follow, an interpreter (`sh -c`, `xargs`, `eval`, `find -delete`)
+ * carrying a removal, a removal that names no path (`… | Remove-Item` takes its paths from the
+ * pipe), a wrapper flag whose arity it does not know, ANY program it does not read (`setsid`,
+ * `ForEach-Object`, `case`) with a removal named unquoted after it, a git that fails, times out
+ * or is missing — asks, and the reason says it could not verify. A command substitution
+ * (`$(…)`, backticks) is judged as a command of its own. "Not proven safe" is an ask; only
+ * "proven safe" passes.
  *
  * THE ONE SPAWN IN THE GATE PATH, and why it is allowed. Whether a work tree is dirty, which
  * files are untracked, and whether a branch's commits are reachable elsewhere are not readable
@@ -60,16 +64,31 @@ import { currentBranch, gitRootOf, protectedBranches, stashExists } from './gitr
  * a superset of what the parse acts on.
  */
 export const LOSS_CANDIDATE_RE =
-  /\bgit\b[^\n]*\b(?:reset|clean|branch|checkout|switch|restore|stash|reflog|gc|push)\b|(?:^|[\s;&|("'])(?:rm|rmdir|del|erase|remove-item|ri|rd)(?:\.exe)?(?=[\s;&|)"']|$)/im;
+  /\bgit\b[^\n]*\b(?:reset|clean|branch|checkout|switch|restore|stash|reflog|gc|push)\b|(?:^|[\s;&|("'`])(?:rm|rmdir|unlink|del|erase|remove-item|ri|rd)(?:\.exe)?(?=[\s;&|)"'`]|$)|(?:^|\s)-delete(?=\s|$)/im;
 
 class Unverified extends Error {}
 const unverified = (why) => { throw new Unverified(why); };
 
-const RM_PROGS = new Set(['rm', 'rmdir', 'del', 'erase', 'remove-item', 'ri', 'rd']);
+const RM_PROGS = new Set(['rm', 'rmdir', 'unlink', 'del', 'erase', 'remove-item', 'ri', 'rd']);
 // cmd.exe's own removal verbs take `/s` `/q` switches, which are not paths.
 const CMD_SWITCH_PROGS = new Set(['rmdir', 'del', 'erase', 'rd']);
 const CD_PROGS = new Set(['cd', 'pushd', 'chdir', 'set-location', 'sl']);
-const WRAPPERS = new Set(['sudo', 'doas', 'command', 'builtin', '\\builtin', 'time', 'nice', 'nohup', 'exec', 'env']);
+// A wrapper runs the command after its own flags: `<short flags taking a value>|<short flags taking
+// none>`. A flag in neither list (`env -S` runs a string, `env -C`/`sudo -D` change directory,
+// `command -v` only looks up) is not guessed at — the segment asks if it names a removal.
+const WRAPPERS = new Map([['sudo', 'ughpCUrtT|AbEHiknPSs'], ['doas', 'uC|ns'], ['command', '|p'],
+  ['builtin', '|'], ['\\builtin', '|'], ['time', 'fo|pav'], ['nice', 'n|'], ['nohup', '|'],
+  ['exec', 'a|cl'], ['env', 'u|i0v'], ['timeout', 'sk|v'], ['ionice', 'cn|t'], ['stdbuf', 'ioe|']]);
+const WRAPPER_LONG = new Set(['--preserve-status', '--foreground', '--verbose', '--login', '--preserve-env',
+  '--non-interactive', '--ignore-environment', '--null']);
+// Shell grammar that may stand before the program word (`(cd x && rm y)`, `if …; then rm y; fi`).
+const STRUCTURE = new Set(['(', '((', '{', '!', 'if', 'then', 'elif', 'else', 'do', 'while', 'until']);
+// The only programs this reader does not parse that may still name a removal word and pass: their
+// `rm`/`del` is their own subcommand (a package, a container), or they never run their arguments
+// (a substitution in one is judged on its own). Any other program over a removal word asks.
+const INERT = new Set(['npm', 'pnpm', 'yarn', 'bun', 'cargo', 'brew', 'docker', 'podman', 'echo', 'printf',
+  'grep', 'egrep', 'fgrep', 'rg', 'findstr', 'select-string', 'which', 'where', 'type', 'man', 'get-command',
+  'get-help']);
 // Programs that run ANOTHER command from their arguments or stdin: what they would remove is
 // not on this command line in a form the parse can read, so a removal word inside one asks.
 const INDIRECT = new Set(['bash', 'sh', 'zsh', 'dash', 'ksh', 'fish', 'pwsh', 'powershell', 'cmd',
@@ -434,6 +453,8 @@ function rmAct(prog, args, dir) {
     if (opts && CMD_SWITCH_PROGS.has(prog) && /^\/[a-zA-Z?]$/.test(a)) continue;
     targets.push(a);
   }
+  // `… | Remove-Item`, `ri -Force`: the paths come from the pipe, which this reader cannot see.
+  if (!targets.length) unverified(`\`${prog}\` names no path, so what it removes comes from elsewhere`);
   const groups = new Map();
   for (const t of targets) {
     const shown = t.replace(OPAQUE, '');
@@ -475,6 +496,69 @@ function rmAct(prog, args, dir) {
 /** The program word, stripped of its path and `.exe`, lowercased (PowerShell and cmd are case-blind). */
 const progOf = (w) => w.split(/[\\/]/).pop().toLowerCase().replace(/\.exe$/, '');
 
+/**
+ * A segment's RAW tokens with the shell grammar around its command dropped: leading `(`, `{`,
+ * `!`, `then`, `do`… (a `(` glued to the first word too) and a closing `)`/`}`. Without it
+ * `(git reset --hard)` has `(git` for its program and `--hard)` for its flag. `rootScan`
+ * shares it, so `(find / …)` is a scan.
+ */
+export function stripStructure(raw) {
+  const t = raw.slice();
+  while (t.length) {
+    if (STRUCTURE.has(t[0])) t.shift();
+    else if (/^\(+./.test(t[0])) t[0] = t[0].replace(/^\(+/, '');
+    else break;
+  }
+  while (t.length && (t[t.length - 1] === '}' || /^\)+$/.test(t[t.length - 1]))) t.pop();
+  if (t.length) t[t.length - 1] = t[t.length - 1].replace(/\)+$/, '');
+  return t;
+}
+
+/**
+ * The bodies of the command substitutions in `text` (`$(…)`, backticks, `<(…)`, `>(…)`) —
+ * single quotes hide them, double quotes do not. An unclosed one runs to the end of the text:
+ * the splitter already cut an unquoted `$(a; b)` at its `;`.
+ */
+function substitutions(text) {
+  const out = [];
+  let sq = false; let dq = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (sq) { if (c === "'") sq = false; continue; }
+    if (c === "'" && !dq) { sq = true; continue; }
+    if (c === '"') { dq = !dq; continue; }
+    if (c === '`') {
+      const end = text.indexOf('`', i + 1);
+      out.push(text.slice(i + 1, end < 0 ? text.length : end));
+      i = end < 0 ? text.length : end;
+    } else if ('$<>'.includes(c) && text[i + 1] === '(') {
+      let depth = 1; let j = i + 2;
+      for (; j < text.length && depth; j++) depth += text[j] === '(' ? 1 : text[j] === ')' ? -1 : 0;
+      out.push(text.slice(i + 2, depth ? text.length : j - 1));
+      i = j - 1;
+    }
+  }
+  return out;
+}
+
+/** `w` past wrapper `name`'s own flags (and `timeout`'s duration), or null when a flag is unknown. */
+function pastWrapper(name, w) {
+  const [takes, plain] = WRAPPERS.get(name).split('|');
+  let i = 0;
+  for (; i < w.length && w[i].length > 1 && w[i].startsWith('-'); i++) {
+    const a = w[i];
+    if (a === '--') { i += 1; break; }
+    if (a.startsWith('--')) { if (a.includes('=') || WRAPPER_LONG.has(a)) continue; return null; }
+    if (name === 'nice' && /^-\d+$/.test(a)) continue;
+    for (let j = 1; j < a.length; j++) {
+      if (takes.includes(a[j])) { if (j === a.length - 1) i += 1; break; }   // the value: the rest, or the next word
+      if (!plain.includes(a[j])) return null;
+    }
+  }
+  if (name === 'timeout' && /^\d/.test(w[i] || '')) i += 1;
+  return w.slice(i);
+}
+
 /**
  * The verdict for a whole command, given its segments as RAW token arrays (quotes still on —
  * `js/hosts/hooks.mjs` cuts and tokenises with the same lexer `rootScan` uses, so a quoted
@@ -485,19 +569,33 @@ const progOf = (w) => w.split(/[\\/]/).pop().toLowerCase().replace(/\.exe$/, '')
  * each host's ceiling for a crashed gate (docs/adr/0007-gates-fail-closed-per-host-ceiling.md).
  * `always: false` skips the two acts that lose data in every state (`reflog expire`, `gc --prune`)
  * — the OpenCode guard passes it, because a static `permission.bash` glob already asks for those.
+ * `split` cuts a command substitution's body into segments the same way (both callers pass their
+ * splitter); without it, a substitution that names a removal asks.
+ * @param {string[][]} segments
+ * @param {string} cwd
+ * @param {{ always?: boolean, split?: (text: string) => string[][] }} [options]
  */
-export function lossReason(segments, cwd, { always = true } = {}) {
-  let dir = cwd;
-  try {
-    for (const raw of segments) {
+export function lossReason(segments, cwd, { always = true, split } = {}) {
+  /** The first loss among `segs`, run from `start`; a substitution body is judged as a command. */
+  const judge = (segs, start, depth = 0) => {
+    let dir = start;
+    for (const raw of segs.map(stripStructure)) {
+      const text = raw.join(' ');
+      const named = LOSS_CANDIDATE_RE.test(text);
+      for (const body of named ? substitutions(text) : []) {
+        if (!LOSS_CANDIDATE_RE.test(body)) continue;
+        // Bounded: `$($($(…` nested past any real command would rescan the text once per level.
+        if (!split || depth >= 4) unverified('a command substitution names a removal');
+        const v = judge(split(body), dir, depth + 1);
+        if (v) return v;
+      }
       let w = words(raw);
-      while (w.length && (/^\w+=/.test(w[0]) || WRAPPERS.has(progOf(w[0])))) {
+      while (w && w.length && (/^\w+=/.test(w[0]) || WRAPPERS.has(progOf(w[0])))) {
         const wrapper = progOf(w[0]);
-        w = w.slice(1);
-        // A wrapper's own flags (`sudo -u x`, `env -i`) are not the program.
-        if (wrapper !== 'command' && wrapper !== 'exec') while (w.length && w[0].startsWith('-')) w = w.slice(1);
+        w = /^\w+=/.test(w[0]) ? w.slice(1) : pastWrapper(wrapper, w.slice(1));
+        if (!w && named) unverified(`\`${wrapper}\` takes a flag the gate does not know`);
       }
-      if (!w.length) continue;
+      if (!w || !w.length) continue;
       const prog = progOf(w[0]);
       const args = w.slice(1);
       if (CD_PROGS.has(prog)) {
@@ -510,10 +608,18 @@ export function lossReason(segments, cwd, { always = true } = {}) {
       else if (RM_PROGS.has(prog)) verdict = rmAct(prog, args, dir);
       else if (INDIRECT.has(prog) && LOSS_CANDIDATE_RE.test(args.join(' '))) {
         unverified(`\`${prog}\` runs a command the gate cannot read`);
+      } else if (named && !INERT.has(prog)
+        && LOSS_CANDIDATE_RE.test(raw.map((t) => t.replace(/"[^"]*"?|'[^']*'?/g, ' ')).join(' '))) {
+        // A program this reader does not know (a wrapper, a loop, shell syntax) over an unquoted
+        // removal word: it may run it, so it is not proven safe. A quoted word is data.
+        unverified(`\`${w[0].replace(OPAQUE, '')}\` is not a program the gate reads, and a removal follows it`);
       }
       if (verdict) return verdict;
     }
     return null;
+  };
+  try {
+    return judge(segments, cwd);
   } catch (e) {
     if (!(e instanceof Unverified)) throw e;
     return `the gate could not verify what this command would lose (${e.message})`;

package/js/hosts/settings.mjs

@@ -726,7 +726,7 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [],
  * remove. `default` here means unknown, and unknown keeps the gate (see `processPackOn`).
  */
 export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [], host = 'claude',
-  deletionGate = true) {
+  deletionGate = true, { secretsGate = true, doneGate = true } = {}) {
   const run = hookPrefix(hookOpts);
   const mem = `--memory "${path.join(cfg, 'memory')}"`;
   // --root carries the install's own dir so a GLOBAL hook can stand down when a live, wired
@@ -760,20 +760,25 @@ export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [],
     // `--no-deletion-gate` only when the install switched Law IV's gate off, so an armed
     // install's command stays byte-identical (and an older shim never sees the flag).
     const dg = deletionGate === false ? ' --no-deletion-gate' : '';
+    // Law I's secret scan and Law III's done gate, under the same contract (user decision
+    // 2026-10-18): each flag only when that gate is off.
+    const sg = secretsGate === false ? ' --no-secrets-gate' : '';
+    const dn = doneGate === false ? ' --no-done-gate' : '';
     return {
       SessionStart: [{ hooks: [{ type: 'command', command: `${run} context --root "${cfg}"${b} || exit 0` }] }],
       // One group, both gates: process 5's consent is a stderr line here (Bob has no ask
       // tier), so the pack toggle that drops Claude's git-gate group has nothing to drop —
-      // `tool-gate` only ever EXITS 2 for Laws I and IV (IV unless built `--no-deletion-gate`), and for a
+      // `tool-gate` only ever EXITS 2 for Laws I and IV (unless built `--no-secrets-gate` /
+      // `--no-deletion-gate`), and for a
       // write under a project's own `.geneseed/protected-checks.txt` — the project opted in —
       // and for a recursive scan rooted at a whole filesystem (ops 2, the root-scan check).
-      PreToolUse: [{ hooks: [{ type: 'command', command: `${run} tool-gate --root "${cfg}"${b}${dg}` }] }],
+      PreToolUse: [{ hooks: [{ type: 'command', command: `${run} tool-gate --root "${cfg}"${b}${sg}${dg}` }] }],
       // Bob's Stop payload never carries `transcript_path` (I2) — `learn` reads `--host bob`
       // and returns immediately rather than wasting a model call on the bare envelope. KEPT
       // rather than DROPPED: the stand-down costs nothing (no transcript read, no spawn), and
       // if Bob ever starts sending one, learning on Bob starts working with no emit change —
       // dropping the group would need a second one re-added later for the same reason.
-      Stop: [{ hooks: [{ type: 'command', command: `${run} learn ${mem}${b} || exit 0` }] }],
+      Stop: [{ hooks: [{ type: 'command', command: `${run} learn ${mem}${b}${dn} || exit 0` }] }],
     };
   }
   // OpenClaude takes Claude's whole group set and verdicts unchanged. `context` needs the host
@@ -786,8 +791,11 @@ export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [],
   const context = `${run} context --root "${cfg}"${h} || exit 0`;
   const gate = `${run} git-gate --root "${cfg}"${h}${consentRuleOn(doctrines, excluded) ? '' : ' --no-consent'}`
     + (deletionGate === false ? ' --no-deletion-gate' : '');
-  const ruleGate = `${run} rule-gate --root "${cfg}"`;
-  const learn = `${run} learn ${mem}${h} || exit 0`;
+  // `--no-secrets-gate` skips only rule-gate's credential scan (rigor 5 and process 1 still
+  // run); `--no-done-gate` only learn's done check, never the distillation. One `learn` string
+  // feeds Stop, SubagentStop and PreCompact, and the flag sits before `|| exit 0`.
+  const ruleGate = `${run} rule-gate --root "${cfg}"${secretsGate === false ? ' --no-secrets-gate' : ''}`;
+  const learn = `${run} learn ${mem}${h}${doneGate === false ? ' --no-done-gate' : ''} || exit 0`;
   // Claude Code only (hooks.md, v2.1.295+; Task 1): a `command` hook that can't start, times
   // out, or exits anything but 0 or 2 — even one whose stdout happens to be valid JSON — now
   // BLOCKS the tool call instead of sliding through as the non-blocking default. Only safe to
@@ -924,14 +932,15 @@ function readSettingsForMerge(p, consequence) {
  * global that never stood down for a project install.
  */
 export function mergeClaudeSettings(p, priorHooks = null, hookOpts = {},
-  doctrines = null, excluded = [], host = 'claude', cfgDir = path.dirname(p), deletionGate = true) {
+  doctrines = null, excluded = [], host = 'claude', cfgDir = path.dirname(p), deletionGate = true,
+  gates = {}) {
   const prior = (priorHooks || []).filter(isDict);
   const loaded = readSettingsForMerge(p, 'Hooks were not wired.');
   if (!loaded) return [p, prior];
   const [config, hadComments] = loaded;
   let hooks = get(config, 'hooks');
   if (!isDict(hooks)) hooks = {};
-  const canonical = claudeHookGroups(cfgDir, hookOpts, doctrines, excluded, host, deletionGate);
+  const canonical = claudeHookGroups(cfgDir, hookOpts, doctrines, excluded, host, deletionGate, gates);
   const canonFlat = [];
   for (const [event, groups] of Object.entries(canonical)) {
     for (const g of groups) canonFlat.push({ event, group: g });

package/js/inspect/diff.mjs

@@ -44,8 +44,8 @@ import {
   GLOBAL_MANIFEST, VERSION_MARKER, expanduser, opencodeConfigDir, resolvePath,
 } from '../hosts/hosts.mjs';
 import {
-  EMIT_HOST_SCOPE, defaultTheme, deletionGateOfDir, doctrinesForBuild, excludedRulesOfDir,
-  excludedSkillsOfDir,
+  EMIT_HOST_SCOPE, defaultTheme, doctrinesForBuild, excludedRulesOfDir,
+  excludedSkillsOfDir, gatesOfDir,
   footprintOfDir, modeOfDir, postureOfDir,
   trustOfDir,
   readJsonMaybe, readMaybe, themeOfDir,
@@ -184,8 +184,8 @@ export function diffCollect({ target = null, theme = null, emit = null, footprin
       excludeRules: excludedRulesOfDir(dir),
       // The excluded skills, or every skill the install left out reads as deleted.
       excludeSkills: excludedSkillsOfDir(dir),
-      // Law IV's gate switch, or a disarmed install reads its `Deletion gate: off` line as drift.
-      deletionGate: deletionGateOfDir(dir),
+      // The gate switches, or a disarmed install reads its `<gate>: off` line as drift.
+      ...gatesOfDir(dir),
     }));
     // The one place a render depends on WHERE it is installed: a global Bob emit writes each
     // folder skill's absolute directory into its SKILL.md (see `writeNativeLayer`), so the

package/js/inspect/doctor.mjs

@@ -25,9 +25,10 @@
  * that this tool never shells back to the generator — is asserted directly instead.
  *
  * WHAT `doctorCollect` DOES NOT REACH, MEASURED RATHER THAN ASSUMED. It takes `groups` and
- * `cmdDoctor` does not pass it: that parameter is the WEB's, and `apiDoctor` in
- * `js/web/api.mjs` is its only caller. `ran` exists for it — four lines of accumulator that
- * keep the Doctor page's per-check cards a parameter rather than a rewrite.
+ * `cmdDoctor` does not pass it: that parameter is the WEB's, and `runDoctor` in
+ * `js/web/state.mjs` (the cache `apiDoctor` serves) is its only caller. `ran` exists for it —
+ * four lines of accumulator that keep the Doctor page's per-check cards a parameter rather
+ * than a rewrite.
  */
 import path from 'node:path';
 import { emitGlobalInto, emitProjectInto, main as driverMain } from '../build/driver.mjs';

package/js/inspect/status.mjs

@@ -58,7 +58,7 @@
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 
-import { THEMES, ROOT, makeCfg } from '../build/source.mjs';
+import { GATE_SWITCHES, THEMES, ROOT, makeCfg } from '../build/source.mjs';
 import { tuiInventory } from './inventory.mjs';
 import { readVersion, sourceFingerprint } from '../build/version.mjs';
 import {
@@ -422,8 +422,9 @@ export function statusLines(d, color = false) {
     const excl = p.excludeRules?.length ? `excluding ${p.excludeRules.join(',')}` : 'no rules excluded';
     rows.push([`${p.host}:${p.scope}`, [p.state, p.theme, p.footprint, `${p.posture}/${p.mode}/${p.trust}`,
       packs, excl, ...(p.excludeSkills?.length ? [`skills off: ${p.excludeSkills.join(',')}`] : []),
-      // Elided when armed. Law IV's text still binds; only its tool-boundary gate is off.
-      ...(p.deletionGate === false ? ['deletion gate: off (Law IV text still binds)'] : [])]
+      // Each elided when armed. The law's text still binds; only its tool-boundary gate is off.
+      ...GATE_SWITCHES.filter((g) => p[g.key] === false)
+        .map((g) => `${g.marker.toLowerCase()}: off (Law ${g.law} text still binds)`)]
       .join(` ${DOT} `) + where]);
   }
 

package/js/inspect/validate.mjs

@@ -8,9 +8,10 @@
  */
 import path from 'node:path';
 import { buildInto, emitGlobalInto, emitProjectInto } from '../build/driver.mjs';
+import { GATE_SWITCHES } from '../build/source.mjs';
 import { resolvePath } from '../hosts/hosts.mjs';
 import {
-  deletionGateOfDir, doctrinesOfDir, excludedRulesOfDir, modeOfDir, postureOfDir,
+  doctrinesOfDir, excludedRulesOfDir, gatesOfDir, modeOfDir, postureOfDir,
 } from '../hosts/installs.mjs';
 import { validateIsVendored } from '../hosts/native.mjs';
 import { printOut, printErr } from '../lib/fs.mjs';
@@ -33,7 +34,8 @@ export const VALIDATE_USAGE = [
   'usage: geneseed validate [-h] [--theme THEME] [--emit EMIT] [--out OUT] [--root ROOT]',
   '                         [--footprint {lean,full}] [--posture POSTURE] [--mode MODE]',
   '                         [--trust TRUST] [--doctrines DOCTRINES] [--exclude-rules RULES]',
-  '                         [--exclude-skills SKILLS] [--no-deletion-gate] [-v]',
+  '                         [--exclude-skills SKILLS] [--no-secrets-gate] [--no-done-gate]',
+  '                         [--no-deletion-gate] [-v]',
   '',
   "Render and emit into a throwaway sandbox, run the doctor's checks, and write nothing real.",
   "Takes the generator's render flags (see geneseed-build --help) except --sync-themes and",
@@ -129,6 +131,7 @@ export function cmdValidate(args) {
       theme: args.theme, footprint: args.footprint, posture: args.posture, mode: args.mode,
       trust: args.trust, doctrines: args.doctrines, excludeRules: args.excludeRules,
       excludeSkills: args.excludeSkills, deletionGate: args.noDeletionGate ? false : null,
+      secretsGate: args.noSecretsGate ? false : null, doneGate: args.noDoneGate ? false : null,
     };
     let scanDirs;
     try {
@@ -170,11 +173,13 @@ export function cmdValidate(args) {
     const at = scanDirs[0];
     const packs = doctrinesOfDir(at);
     const excluded = excludedRulesOfDir(at);
+    const gates = gatesOfDir(at);
     printOut(`[validate-only] rendered at posture=${postureOfDir(at) ?? '?'} `
       + `mode=${modeOfDir(at) ?? '?'} packs=${packs ? packs.join(',') || 'none' : '?'} `
       + `excluded=${excluded.map((id) => id.replace('.', ' ')).join(', ') || 'none'}`
-      // Elided when armed, so an armed dry run prints the line it always did.
-      + `${deletionGateOfDir(at) ? '' : ' deletion-gate=off'}\n`);
+      // Each elided when armed, so an armed dry run prints the line it always did.
+      + `${GATE_SWITCHES.filter((g) => gates[g.key] === false)
+        .map((g) => ` ${g.marker.toLowerCase().replace(' ', '-')}=off`).join('')}\n`);
     printOut(`[validate-only] would write ${written.length} file(s) under ${args.out}`
       + (args.root ? ` (root ${args.root})` : '')
       + ' — nothing was actually written (sandboxed).\n');

package/js/maintain/uninstall.mjs

@@ -51,7 +51,7 @@ import { hookRunnerEntry } from '../hosts/shim.mjs';
 import { confirm } from '../lib/prompt.mjs';
 import {
   claudeCfg, claudeReadManifest, doctrinesOfDir, EMIT_HOST_SCOPE, emitHostScopeOf,
-  deletionGateOfDir, excludedRulesOfDir, installKind, installState,
+  excludedRulesOfDir, gatesOfDir, installKind, installState,
   registeredTargets,
 } from '../hosts/installs.mjs';
 import {
@@ -1173,11 +1173,13 @@ function remergeClaudeHooks(cfg, root = cfg, host = 'claude') {
   const excluded = excludedRulesOfDir(root, host).length ? excludedRulesOfDir(root, host)
     : excludedRulesOfDir(cfg, host);
   // `host` reaches the group builder: a Bob reactivate must re-wire Gemini-named groups.
-  // Law IV's gate switch, the same two-carrier read: off only when a carrier says so, so a
-  // reactivate never disarms an install that did not ask for it.
-  const deletionGate = deletionGateOfDir(root, host) && deletionGateOfDir(cfg, host);
+  // The gate switches, the same two-carrier read: a gate is off only when a carrier says so,
+  // so a reactivate never disarms an install that did not ask for it.
+  const [atRoot, atCfg] = [gatesOfDir(root, host), gatesOfDir(cfg, host)];
+  const gates = Object.fromEntries(Object.keys(atRoot).map((k) => [k, atRoot[k] && atCfg[k]]));
   const [, claims] = mergeClaudeSettings(settingsFile(cfg, managed),
-    managed.settings_hooks ?? null, hookRunnerEntry(), doctrines, excluded, host, cfg, deletionGate);
+    managed.settings_hooks ?? null, hookRunnerEntry(), doctrines, excluded, host, cfg,
+    gates.deletionGate, gates);
   // `and data` — a manifest that did not parse is not one to write back.
   if (!deepEquals(claims, managed.settings_hooks ?? null) && Object.keys(data).length > 0) {
     managed.settings_hooks = claims;

package/js/maintain/update.mjs

@@ -632,7 +632,7 @@ export async function installAxes(dir, { installProfile, setupBuildArgs }, notif
   if (legacyProcessCarrierOfDir(String(dir), 'opencode')) return null;
   const p = installProfile('opencode', 'global', String(dir), notify);
   return setupBuildArgs('', 'files', null, null, p.footprint, p.posture, p.mode, p.doctrines,
-    undefined, p.excludeRules, p.trust, p.excludeSkills, p.deletionGate).slice(4);
+    undefined, p.excludeRules, p.trust, p.excludeSkills, p.deletionGate, p).slice(4);
 }
 
 /**

package/js/web/actions.mjs

@@ -46,8 +46,8 @@ import {
   opencodeConfigDir, resolvePath,
 } from '../hosts/hosts.mjs';
 import {
-  EMIT_HOST_SCOPE, deletionGateOfDir, doctrinesForBuild, excludedRulesOfDir, excludedSkillsOfDir,
-  footprintOfDir,
+  EMIT_HOST_SCOPE, doctrinesForBuild, excludedRulesOfDir, excludedSkillsOfDir,
+  footprintOfDir, gatesOfDir,
   installState, installTargets, legacyProcessCarrierOfDir, modeOfDir, postureOfDir, trustOfDir,
 } from '../hosts/installs.mjs';
 import {
@@ -131,13 +131,17 @@ function bodyExcludeRules(body) {
 }
 
 /**
- * Law IV's gate switch across the trust boundary: only a real JSON boolean counts. Anything
- * else — a string `"false"`, a number, absence — is `null`, and the caller keeps the install's
- * own answer, so a malformed body can never disarm the gate by accident.
+ * The gate switches across the trust boundary (`deletionGate`, `secretsGate`, `doneGate`), each
+ * on its own: only a real JSON boolean counts. Anything else — a string `"false"`, a number,
+ * absence — falls back to the install's own answer for THAT gate, so a malformed or partial body
+ * can never disarm (or re-arm) a gate it did not name.
  */
-function bodyDeletionGate(body) {
-  const v = bget(body, 'deletionGate');
-  return typeof v === 'boolean' ? v : null;
+function bodyGates(body, root, host) {
+  const own = gatesOfDir(root, host);
+  return Object.fromEntries(Object.entries(own).map(([k, v]) => {
+    const said = bget(body, k);
+    return [k, typeof said === 'boolean' ? said : v];
+  }));
 }
 
 /**
@@ -303,7 +307,8 @@ export function apiMemoryDelete(state, name) {
   // CASE-FOLDED: this endpoint's own compared `MEMORY` exactly, so on Windows and macOS `memory`
   // resolved to MEMORY.md, passed, and deleted the index the agent reads at session start.
   if (memoryDelete(d, name) === null) throw new NotFound(name);
-  state.refresh();
+  // The doctor reads nothing in the memory store, so its cached verdict survives (`refresh`).
+  state.refresh({ doctor: false });
   return { archived: name };
 }
 
@@ -501,8 +506,8 @@ export function apiRestore(state, files) {
       // re-states a rule whose hook gate the install deliberately left unwired.
       excludeRules: excludedRulesOfDir(target),
       excludeSkills: excludedSkillsOfDir(target),
-      // Law IV's gate switch: a restored AGENT.md must keep the install's `Deletion gate:` line.
-      deletionGate: deletionGateOfDir(target),
+      // The gate switches: a restored AGENT.md must keep the install's `<gate>: off` lines.
+      ...gatesOfDir(target),
     }));
     for (const raw of (isTruthy(files) ? files : [])) {
       const rel = stripWhitespace(formatValue(raw).replace(/\\/g, '/')).replace(/^\/+/, '');
@@ -585,12 +590,12 @@ export function apiInstallCmd(state, body) {
   // the silence a pre-2.3 carrier gives on packs. Unspecified therefore keeps the install's
   // own answer, and a pre-marker install answers the empty list — which is what it has.
   const excludeRules = bodyExcludeRules(body) ?? excludedRulesOfDir(root, host);
-  // Law IV's gate switch (the Constitution page's toggle): a strict boolean in the body, else
-  // the install's own answer — so a pack Apply, which sends none, keeps the switch as it is.
-  const deletionGate = bodyDeletionGate(body) ?? deletionGateOfDir(root, host);
+  // The gate switches (the Constitution page's toggles): a strict boolean per gate in the body,
+  // else the install's own answer — so a pack Apply keeps every switch as it is.
+  const gates = bodyGates(body, root, host);
   const out = scope === 'global' ? null : String(root);
   const argv = setupBuildArgs(theme || 'neutral', emit, out, out, fp, pos, mode, doctrines,
-    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root, host), deletionGate);
+    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root, host), gates.deletionGate, gates);
   return { cmd: [process.execPath, path.join(ROOT, 'bin', 'build-driver.mjs'), ...argv] };
 }
 
@@ -689,9 +694,9 @@ export function apiDeployCmd(state, body) {
   // and `PreToolUse::Bash` went with them. `doctrinesForBuild` resolves unknown to ALL packs.
   const doctrines = bodyDoctrines(body) ?? doctrinesForBuild(root, host);
   const excludeRules = bodyExcludeRules(body) ?? excludedRulesOfDir(root, host);
-  const deletionGate = bodyDeletionGate(body) ?? deletionGateOfDir(root, host);
+  const gates = bodyGates(body, root, host);
   // project-scope emit name == host name (opencode / claude / bob / openclaude)
   const argv = setupBuildArgs(theme || 'neutral', host, root, root, fp, pos, mode, doctrines,
-    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root, host), deletionGate);
+    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root, host), gates.deletionGate, gates);
   return { cmd: [process.execPath, path.join(ROOT, 'bin', 'build-driver.mjs'), ...argv] };
 }

package/js/web/api.mjs

@@ -16,11 +16,10 @@ import { readVersion, sourceFingerprint } from '../build/version.mjs';
 import { sourceReleaseVersion } from '../hosts/opencode.mjs';
 import { alwaysOnCost } from '../inspect/cost.mjs';
 import { diffCollect } from '../inspect/diff.mjs';
-import { doctorCollect } from '../inspect/doctor.mjs';
 import { excludesSnapshot } from '../inspect/excludes.mjs';
 import { CLAUDE_STYLE, HOSTS, VERSION_MARKER, resolvePath } from '../hosts/hosts.mjs';
 import {
-  deletionGateOfDir, footprintOfDir, installState, installTargets, modeOfDir, trustOfDir,
+  footprintOfDir, gatesOfDir, installState, installTargets, modeOfDir, trustOfDir,
   postureOfDir, readJsonMaybe, themeOfDir,
 } from '../hosts/installs.mjs';
 import { PRESETS } from '../loop/score.mjs';
@@ -79,13 +78,15 @@ export function apiSetup(state) {
   };
 }
 
-/** The same engine as the `doctor` verb, grouped per check. */
-export function apiDoctor(state) {
-  const groups = [];
-  const [themes, problems] = doctorCollect({ theme: state.theme, groups });
-  state.stampDoctor(problems);
-  return { themes, ok: !problems.length, problems, groups,
-    checked_at: state.doctor.checked_at };
+/**
+ * The same engine as the `doctor` verb, grouped per check — served from the state's cached run
+ * (a lens visit or a page mount no longer pays ~3.6 s), and re-run only when `fresh` is asked
+ * for: the Doctor page's Re-run button, as `GET /api/doctor?fresh=1`.
+ */
+export function apiDoctor(state, fresh = false) {
+  if (fresh) state.runDoctor();
+  const { ok, problems, checked_at } = state.doctor;
+  return { ...state._doctorRun, ok, problems, checked_at };
 }
 
 /**
@@ -247,9 +248,10 @@ export function apiOverview(state) {
   for (const [host, scope, root] of installTargets()) {
     try {
       if (samePath(viewCfg(host, scope, root), state.target)) {
-        // `deletionGate`: Law IV's gate switch, for the Constitution page's toggle on row IV.
+        // `deletionGate`/`secretsGate`/`doneGate`: the gate switches, for the Constitution
+        // page's toggles on rows IV, I and III.
         install = { host, scope, path: root, footprint: footprintOfDir(root),
-          deletionGate: deletionGateOfDir(root, host) };
+          ...gatesOfDir(root, host) };
         break;
       }
     } catch { /* an unreadable candidate just isn't a match */ }

package/js/web/handler.mjs

@@ -130,7 +130,7 @@ export function makeHandler(state, jm, token, dist, holder = null) {
 
   function doGet(req, res, path, ae) {
     const route = STATE_ROUTES[path];
-    if (route !== undefined) return sendJson(res, route(state), 200, ae);
+    if (route !== undefined) return sendJson(res, route(state, req.url), 200, ae);
     // `pid` is what a restarting client waits on: the OLD server keeps answering this ping for
     // a moment after `/api/restart` returns, and a reload onto it fetches the old token.
     if (path === '/api/ping') {

package/js/web/routes.mjs

@@ -146,7 +146,9 @@ export const STATE_ROUTES = {
   '/api/recent': apiRecent,
   '/api/themes': apiThemes,
   '/api/setup': apiSetup,
-  '/api/doctor': apiDoctor,
+  // The one route here that reads its query: `?fresh=1` re-runs instead of serving the cache.
+  '/api/doctor': (state, url) => apiDoctor(state,
+    new URL(url || '', 'http://x').searchParams.has('fresh')),
   '/api/installs': apiInstalls,
   '/api/fleet': apiFleet,
   '/api/update': apiUpdate,

package/js/web/server.mjs

@@ -27,7 +27,7 @@ import { isFile, printOut } from '../lib/fs.mjs';
 import { which } from '../lib/paths.mjs';
 import { parseIntStrict } from '../lib/text.mjs';
 import { promptLine } from '../lib/prompt.mjs';
-import { webState } from './state.mjs';
+import { warmDoctor, webState } from './state.mjs';
 import { clearDaemon, codeStamp, openUrl, readDaemon, restartDaemon, startDaemon, statusDaemon, stopDaemon, writeDaemon } from './daemon.mjs';
 import { makeHandler } from './handler.mjs';
 import { JobManager } from './jobs.mjs';
@@ -165,6 +165,8 @@ export async function serve({ theme = null, port = 4747, openBrowser = true,
       printOut(`[web] Geneseed UI on ${url}  (theme: ${state.theme})\n`);
       printOut(daemon ? '[web] daemon ready.\n' : '[web] Ctrl-C to stop.\n');
       if (openBrowser) openUrl(url);
+      // After the record and the ready line, so `web start`'s wait loop already has its URL.
+      warmDoctor(state);
       // Node kills on SIGINT by default, which would skip this message and the record
       // cleanup in `srv.on('close', ...)` below — a foreground `--daemon-internal` server
       // stopped with Ctrl-C would otherwise leave a record pointing at a dead port.