geneseed 4.9.0 → 4.9.2

package/CHANGELOG.md

@@ -8,6 +8,46 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
 ## [Unreleased]
 
+## [4.9.2] — 2026-10-18
+
+Patch: the review pass — faster emits, console and Stop; Build and setup keep your gate switches; protected checks follow links both ways.
+
+### Upgrade notes
+- Run `geneseed rebuild-all` once after updating so installed hooks and OpenCode plugins pick up the changes.
+
+### Changed
+- **A Stop no longer parses the whole transcript.** The done gate and `learn` each read the full session transcript on every Stop (real ones reach 50 MB), and an armed install with `GENESEED_LLM` set read it twice. Both now read backward from the end, in windows that start at 2 MB and grow fourfold: the done gate until the window holds the prompt that opened the turn (a turn longer than every window falls back to the whole file, so it is never judged on a truncated turn), `learn` until its notes hold the 16 000 characters it keeps, so the notes are the ones a full read gives. One Stop reads each window once, shared by both. On a generated 50 MB transcript (old and new interleaved, median of 10) the armed gate alone runs about 3× faster and gate + learn about 3× faster, and both now cost about the same as on a 1 KB transcript: a Stop no longer grows with the session.
+- **The console stops re-rendering an install to measure its drift on every refresh.** The overview and the fleet table each rendered the selected install's expected tree afresh (~0.6 s per install per call); the render is now memoised per install, keyed on the source fingerprint and every axis the install was built with (theme, footprint, posture, mode, packs, trust, excluded rules and skills, gate switches), and re-done the moment any of them changes. The comparison against the deployed tree still runs on every call, so a hand edit shows at once. Measured on a two-install sandbox: overview ~0.75 s → ~0.2 s, fleet ~1.5 s → ~0.32 s after the first refresh. `geneseed diff` is unchanged.
+- **Emits no longer read back what they just wrote to hash it.** The owned-file hashes in `.geneseed-manifest.json` are now computed from the text `writeText` recorded at write time (a copied binary, or a file rewritten since by any other writer, is still read), and the claim-on-create closure (`claimer`) resolves the config root once per emit instead of once per file. The per-file symlink and hard-link checks are unchanged, and manifests are byte-identical to before. A global re-emit runs about a quarter faster (measured on Windows: claude-global 560 → 424 ms, opencode-global 716 → 542 ms, median of 7).
+- **The console reads user-rules.md once, under one key, and a rules or profile write reloads only its own file.** Personal's cards, the Overview's ledger and the Constitution page's "Your rules" tier share one cached `/api/rules` read (`web/src/hooks/useRules.js`), so a rule written on Personal shows on the other two at once. Each visit to one of those pages paints the cached copy and refetches it once, so a rule an agent session wrote shows without waiting for a build. On Personal, a rules write no longer refetches the profile and a profile save no longer refetches the rules. A memory fact promoted to a rule from the Library drops the cached copy, so the Rules tab it lands on shows the new rule. Install changes (build, toggle, switch, edits) still refresh the whole console.
+
+### Fixed
+- **Protected checks follow links in both directions on every host.** Both the Claude/Bob hook and the OpenCode guard now read a write's target twice: as written, and with symlinks and junctions followed (the hook's `resolvePath`). A hit on either reading asks (Claude) or blocks (Bob, OpenCode). A write through a link from outside a repo into one of its protected folders is now caught on OpenCode, where before it passed; a protected folder inside a repo that links out of it is now caught by the hook, where before it passed. Ordinary repos are unchanged. The guard's git readers are now pinned to `js/hosts/gitref.mjs` by a test.
+- **The console's always-on cost no longer counts skills the model never sees.** The skill part of each install's cost counted every `SKILL.md`, including user-only skills and aliases the host keeps out of the model's catalogue. It now skips them the way each host does: on their `disable-model-invocation: true` frontmatter for Claude Code and OpenClaude, and on the `permission.skill` deny in `opencode.json(c)` for OpenCode, which ignores that frontmatter key. Bob writes no `SKILL.md` for a user-only skill, so nothing changes there. Measured on a fresh claude-global lean emit, the skill part drops from 12,982 to 10,837 characters (opencode-global: 12,548 to 11,825). The root-file ceiling is unaffected.
+- **The console's Build no longer re-arms switched-off gates or restores excluded rules and skills.** Rebuilding a deployed install from the console (the theme picker) assembled its own argv: no gate switches, `--exclude-rules none` and no excluded skills. It now takes the argv the install's own profile gives `rebuild-all` and `status`, with only the picked theme swapped in. A global install's Build also names its own `--config-dir`, and a project install's its own `--out`/`--root`.
+- **Re-running `geneseed setup` no longer re-arms switched-off gates.** The wizard kept an install's excluded rules and skills but read none of its `Secrets gate:` / `Done gate:` / `Deletion gate:` lines, so holding Enter through a re-run switched every gate back on. It now carries them into the build like the exclusions, without asking about them.
+
+## [4.9.1] — 2026-10-18
+
+Patch: Deletion Is Deliberate and the root-scan check no longer fail open behind shell structure; the console stops re-running the doctor on every change.
+
+### Upgrade notes
+- Run `geneseed rebuild-all` once after updating so installed hooks and OpenCode plugins pick up the fix.
+
+### Fixed
+- **Deletion Is Deliberate and the root-scan check no longer fail open when shell structure hides the program word.** `true & git reset --hard`, `(git reset --hard)`, `if …; then git reset --hard; fi`, `{ rm x; }`, `echo $(rm x)`, `` echo `rm x` ``, `sudo -u root rm x`, `env -u FOO rm x`, `nice -n 5 rm x`, `timeout 5 rm x`, `true & find / …` and `(find / …)` passed where the plain form asks. The `reset --hard` forms had regressed in 4.7.0. Several changes close it, on Claude Code, OpenClaude and Bob (`git-gate`/`tool-gate`) and in the OpenCode guard:
+  - A lone `&` now separates commands. `2>&1`, `<&3`, `&>` and `|&` still do not.
+  - Leading `(`, `{`, `!`, `then`, `do` and `else` are stripped before the program word, and so are closing `)`/`}`.
+  - A command substitution is judged as a command of its own.
+  - Wrappers drop their value-taking flags. `timeout` is now a wrapper.
+  - A removal that names no path asks: `… | Remove-Item`, `ri -Force`.
+  - `find -delete` asks, and `unlink` counts as a removal.
+  - Behind all of these, a removal word written unquoted after a program the gate does not read asks ("could not verify"). That covers a wrapper it does not know (`setsid rm x`), a wrapper flag of unknown arity, `ForEach-Object { Remove-Item $_ }` and `case … rm …`. So does `ssh host rm x`. The exceptions are programs whose `rm` is their own subcommand (npm, pnpm, yarn, bun, cargo, brew, docker, podman) and programs that never run their arguments (echo, printf, the grep family, `which`, `type`, `man`, `Get-Command`, `Get-Help`).
+  - Proven-safe forms still pass: a clean tree, a tracked clean file, a quoted pattern, and a `$(cat <<'EOF' … EOF)` commit message.
+
+### Changed
+- **The console stops re-running the doctor when nothing it checks has changed.** A memory delete no longer drops the cached verdict (~3.6 s saved on the next overview); a finished job, an install toggle and a view switch still do. The Doctor page, the Greenhouse and Operator HUD lenses now read the cached run (groups and themes included) instead of running every check on each visit; the page's *Re-run checks* button asks for a fresh run (`GET /api/doctor?fresh=1`). The server warms the cache right after it starts listening, so an overview requested a few seconds later answers in ~0.15 s rather than ~3.8 s.
+
 ## [4.9.0] — 2026-10-18
 
 Minor: on/off switches for the Sealed Secrets and done gates, and the console calls the laws Dictates.

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical references, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **4.9.0**.
+> string. Current label: **4.9.2**.
 
 ## Capabilities
 

package/adapters/opencode/plugins/geneseed-context.js

@@ -64,7 +64,9 @@ const PLUGIN_DIR = path.dirname(fileURLToPath(import.meta.url))
 // Sovereign-repo bypass — twin of the harness's own `sovereignBypass()`.
 // <cfg>/excludes.json (user-owned, managed by `harness exclude`) lists folders where
 // this GLOBAL install goes dormant. Any error degrades to "not excluded".
-const norm = (p) => {
+// Twin of js/hosts/hosts.mjs `resolvePath`: the absolute path with symlinks and junctions
+// followed, the way the Claude/Bob hook resolves one. `norm` folds its case for matching.
+function resolvePath(p) {
   // Expand a leading "~" / "~/…" to the home dir — a hand-edited excludes.json entry
   // like "~/vault" must resolve the same way here as it does for the Claude/Bob
   // hook guard.
@@ -83,6 +85,10 @@ const norm = (p) => {
     tail.unshift(path.basename(cur))
     cur = up
   }
+  return s
+}
+const norm = (p) => {
+  const s = resolvePath(p)
   return process.platform === "win32" ? s.toLowerCase() : s
 }
 // A linked git worktree of an excluded repo is excluded too, wherever it sits on disk — twin of

package/adapters/opencode/plugins/geneseed-guard.js

@@ -59,7 +59,9 @@ const PLUGIN_DIR = path.dirname(fileURLToPath(import.meta.url))
 // Sovereign-repo bypass — twin of the harness's own `sovereignBypass()`.
 // <cfg>/excludes.json (user-owned, managed by `harness exclude`) lists folders where
 // this GLOBAL install goes dormant. Any error degrades to "not excluded".
-const norm = (p) => {
+// Twin of js/hosts/hosts.mjs `resolvePath`: the absolute path with symlinks and junctions
+// followed, the way the Claude/Bob hook resolves one. `norm` folds its case for matching.
+function resolvePath(p) {
   // Expand a leading "~" / "~/…" to the home dir — a hand-edited excludes.json entry
   // like "~/vault" must resolve the same way here as it does for the Claude/Bob
   // hook guard.
@@ -78,6 +80,10 @@ const norm = (p) => {
     tail.unshift(path.basename(cur))
     cur = up
   }
+  return s
+}
+const norm = (p) => {
+  const s = resolvePath(p)
   return process.platform === "win32" ? s.toLowerCase() : s
 }
 // A linked git worktree of an excluded repo is excluded too, wherever it sits on disk — twin of
@@ -234,8 +240,9 @@ const SHELL_BLOCK_RE = [
 // the Bob behaviour — and `GENESEED_GUARD=warn` downgrades it to a log line.
 //
 // The fs-only readers below are the twins of js/hosts/gitref.mjs (gitRootOf, gitDirOf,
-// gitCommonDirOf, currentBranch, protectedBranches, stashExists); the block between the twin
-// markers is js/hosts/loss.mjs verbatim, and tests/plugins/guard.test.mjs diffs it.
+// gitCommonDirOf, currentBranch, protectedBranches, stashExists) — tests/plugins/guard.test.mjs
+// compares each with its gitref.mjs original, quotes, semicolons and layout aside; the block
+// between the twin markers is js/hosts/loss.mjs verbatim, and the same file diffs it.
 function gitRootOf(cwd) {
   try {
     let dir = path.resolve(cwd)
@@ -297,16 +304,31 @@ function stashExists(root) {
  * a superset of what the parse acts on.
  */
 const LOSS_CANDIDATE_RE =
-  /\bgit\b[^\n]*\b(?:reset|clean|branch|checkout|switch|restore|stash|reflog|gc|push)\b|(?:^|[\s;&|("'])(?:rm|rmdir|del|erase|remove-item|ri|rd)(?:\.exe)?(?=[\s;&|)"']|$)/im;
+  /\bgit\b[^\n]*\b(?:reset|clean|branch|checkout|switch|restore|stash|reflog|gc|push)\b|(?:^|[\s;&|("'`])(?:rm|rmdir|unlink|del|erase|remove-item|ri|rd)(?:\.exe)?(?=[\s;&|)"'`]|$)|(?:^|\s)-delete(?=\s|$)/im;
 
 class Unverified extends Error {}
 const unverified = (why) => { throw new Unverified(why); };
 
-const RM_PROGS = new Set(['rm', 'rmdir', 'del', 'erase', 'remove-item', 'ri', 'rd']);
+const RM_PROGS = new Set(['rm', 'rmdir', 'unlink', 'del', 'erase', 'remove-item', 'ri', 'rd']);
 // cmd.exe's own removal verbs take `/s` `/q` switches, which are not paths.
 const CMD_SWITCH_PROGS = new Set(['rmdir', 'del', 'erase', 'rd']);
 const CD_PROGS = new Set(['cd', 'pushd', 'chdir', 'set-location', 'sl']);
-const WRAPPERS = new Set(['sudo', 'doas', 'command', 'builtin', '\\builtin', 'time', 'nice', 'nohup', 'exec', 'env']);
+// A wrapper runs the command after its own flags: `<short flags taking a value>|<short flags taking
+// none>`. A flag in neither list (`env -S` runs a string, `env -C`/`sudo -D` change directory,
+// `command -v` only looks up) is not guessed at — the segment asks if it names a removal.
+const WRAPPERS = new Map([['sudo', 'ughpCUrtT|AbEHiknPSs'], ['doas', 'uC|ns'], ['command', '|p'],
+  ['builtin', '|'], ['\\builtin', '|'], ['time', 'fo|pav'], ['nice', 'n|'], ['nohup', '|'],
+  ['exec', 'a|cl'], ['env', 'u|i0v'], ['timeout', 'sk|v'], ['ionice', 'cn|t'], ['stdbuf', 'ioe|']]);
+const WRAPPER_LONG = new Set(['--preserve-status', '--foreground', '--verbose', '--login', '--preserve-env',
+  '--non-interactive', '--ignore-environment', '--null']);
+// Shell grammar that may stand before the program word (`(cd x && rm y)`, `if …; then rm y; fi`).
+const STRUCTURE = new Set(['(', '((', '{', '!', 'if', 'then', 'elif', 'else', 'do', 'while', 'until']);
+// The only programs this reader does not parse that may still name a removal word and pass: their
+// `rm`/`del` is their own subcommand (a package, a container), or they never run their arguments
+// (a substitution in one is judged on its own). Any other program over a removal word asks.
+const INERT = new Set(['npm', 'pnpm', 'yarn', 'bun', 'cargo', 'brew', 'docker', 'podman', 'echo', 'printf',
+  'grep', 'egrep', 'fgrep', 'rg', 'findstr', 'select-string', 'which', 'where', 'type', 'man', 'get-command',
+  'get-help']);
 // Programs that run ANOTHER command from their arguments or stdin: what they would remove is
 // not on this command line in a form the parse can read, so a removal word inside one asks.
 const INDIRECT = new Set(['bash', 'sh', 'zsh', 'dash', 'ksh', 'fish', 'pwsh', 'powershell', 'cmd',
@@ -671,6 +693,8 @@ function rmAct(prog, args, dir) {
     if (opts && CMD_SWITCH_PROGS.has(prog) && /^\/[a-zA-Z?]$/.test(a)) continue;
     targets.push(a);
   }
+  // `… | Remove-Item`, `ri -Force`: the paths come from the pipe, which this reader cannot see.
+  if (!targets.length) unverified(`\`${prog}\` names no path, so what it removes comes from elsewhere`);
   const groups = new Map();
   for (const t of targets) {
     const shown = t.replace(OPAQUE, '');
@@ -712,6 +736,69 @@ function rmAct(prog, args, dir) {
 /** The program word, stripped of its path and `.exe`, lowercased (PowerShell and cmd are case-blind). */
 const progOf = (w) => w.split(/[\\/]/).pop().toLowerCase().replace(/\.exe$/, '');
 
+/**
+ * A segment's RAW tokens with the shell grammar around its command dropped: leading `(`, `{`,
+ * `!`, `then`, `do`… (a `(` glued to the first word too) and a closing `)`/`}`. Without it
+ * `(git reset --hard)` has `(git` for its program and `--hard)` for its flag. `rootScan`
+ * shares it, so `(find / …)` is a scan.
+ */
+function stripStructure(raw) {
+  const t = raw.slice();
+  while (t.length) {
+    if (STRUCTURE.has(t[0])) t.shift();
+    else if (/^\(+./.test(t[0])) t[0] = t[0].replace(/^\(+/, '');
+    else break;
+  }
+  while (t.length && (t[t.length - 1] === '}' || /^\)+$/.test(t[t.length - 1]))) t.pop();
+  if (t.length) t[t.length - 1] = t[t.length - 1].replace(/\)+$/, '');
+  return t;
+}
+
+/**
+ * The bodies of the command substitutions in `text` (`$(…)`, backticks, `<(…)`, `>(…)`) —
+ * single quotes hide them, double quotes do not. An unclosed one runs to the end of the text:
+ * the splitter already cut an unquoted `$(a; b)` at its `;`.
+ */
+function substitutions(text) {
+  const out = [];
+  let sq = false; let dq = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (sq) { if (c === "'") sq = false; continue; }
+    if (c === "'" && !dq) { sq = true; continue; }
+    if (c === '"') { dq = !dq; continue; }
+    if (c === '`') {
+      const end = text.indexOf('`', i + 1);
+      out.push(text.slice(i + 1, end < 0 ? text.length : end));
+      i = end < 0 ? text.length : end;
+    } else if ('$<>'.includes(c) && text[i + 1] === '(') {
+      let depth = 1; let j = i + 2;
+      for (; j < text.length && depth; j++) depth += text[j] === '(' ? 1 : text[j] === ')' ? -1 : 0;
+      out.push(text.slice(i + 2, depth ? text.length : j - 1));
+      i = j - 1;
+    }
+  }
+  return out;
+}
+
+/** `w` past wrapper `name`'s own flags (and `timeout`'s duration), or null when a flag is unknown. */
+function pastWrapper(name, w) {
+  const [takes, plain] = WRAPPERS.get(name).split('|');
+  let i = 0;
+  for (; i < w.length && w[i].length > 1 && w[i].startsWith('-'); i++) {
+    const a = w[i];
+    if (a === '--') { i += 1; break; }
+    if (a.startsWith('--')) { if (a.includes('=') || WRAPPER_LONG.has(a)) continue; return null; }
+    if (name === 'nice' && /^-\d+$/.test(a)) continue;
+    for (let j = 1; j < a.length; j++) {
+      if (takes.includes(a[j])) { if (j === a.length - 1) i += 1; break; }   // the value: the rest, or the next word
+      if (!plain.includes(a[j])) return null;
+    }
+  }
+  if (name === 'timeout' && /^\d/.test(w[i] || '')) i += 1;
+  return w.slice(i);
+}
+
 /**
  * The verdict for a whole command, given its segments as RAW token arrays (quotes still on —
  * `js/hosts/hooks.mjs` cuts and tokenises with the same lexer `rootScan` uses, so a quoted
@@ -722,19 +809,33 @@ const progOf = (w) => w.split(/[\\/]/).pop().toLowerCase().replace(/\.exe$/, '')
  * each host's ceiling for a crashed gate (docs/adr/0007-gates-fail-closed-per-host-ceiling.md).
  * `always: false` skips the two acts that lose data in every state (`reflog expire`, `gc --prune`)
  * — the OpenCode guard passes it, because a static `permission.bash` glob already asks for those.
+ * `split` cuts a command substitution's body into segments the same way (both callers pass their
+ * splitter); without it, a substitution that names a removal asks.
+ * @param {string[][]} segments
+ * @param {string} cwd
+ * @param {{ always?: boolean, split?: (text: string) => string[][] }} [options]
  */
-function lossReason(segments, cwd, { always = true } = {}) {
-  let dir = cwd;
-  try {
-    for (const raw of segments) {
+function lossReason(segments, cwd, { always = true, split } = {}) {
+  /** The first loss among `segs`, run from `start`; a substitution body is judged as a command. */
+  const judge = (segs, start, depth = 0) => {
+    let dir = start;
+    for (const raw of segs.map(stripStructure)) {
+      const text = raw.join(' ');
+      const named = LOSS_CANDIDATE_RE.test(text);
+      for (const body of named ? substitutions(text) : []) {
+        if (!LOSS_CANDIDATE_RE.test(body)) continue;
+        // Bounded: `$($($(…` nested past any real command would rescan the text once per level.
+        if (!split || depth >= 4) unverified('a command substitution names a removal');
+        const v = judge(split(body), dir, depth + 1);
+        if (v) return v;
+      }
       let w = words(raw);
-      while (w.length && (/^\w+=/.test(w[0]) || WRAPPERS.has(progOf(w[0])))) {
+      while (w && w.length && (/^\w+=/.test(w[0]) || WRAPPERS.has(progOf(w[0])))) {
         const wrapper = progOf(w[0]);
-        w = w.slice(1);
-        // A wrapper's own flags (`sudo -u x`, `env -i`) are not the program.
-        if (wrapper !== 'command' && wrapper !== 'exec') while (w.length && w[0].startsWith('-')) w = w.slice(1);
+        w = /^\w+=/.test(w[0]) ? w.slice(1) : pastWrapper(wrapper, w.slice(1));
+        if (!w && named) unverified(`\`${wrapper}\` takes a flag the gate does not know`);
       }
-      if (!w.length) continue;
+      if (!w || !w.length) continue;
       const prog = progOf(w[0]);
       const args = w.slice(1);
       if (CD_PROGS.has(prog)) {
@@ -747,10 +848,18 @@ function lossReason(segments, cwd, { always = true } = {}) {
       else if (RM_PROGS.has(prog)) verdict = rmAct(prog, args, dir);
       else if (INDIRECT.has(prog) && LOSS_CANDIDATE_RE.test(args.join(' '))) {
         unverified(`\`${prog}\` runs a command the gate cannot read`);
+      } else if (named && !INERT.has(prog)
+        && LOSS_CANDIDATE_RE.test(raw.map((t) => t.replace(/"[^"]*"?|'[^']*'?/g, ' ')).join(' '))) {
+        // A program this reader does not know (a wrapper, a loop, shell syntax) over an unquoted
+        // removal word: it may run it, so it is not proven safe. A quoted word is data.
+        unverified(`\`${w[0].replace(OPAQUE, '')}\` is not a program the gate reads, and a removal follows it`);
       }
       if (verdict) return verdict;
     }
     return null;
+  };
+  try {
+    return judge(segments, cwd);
   } catch (e) {
     if (!(e instanceof Unverified)) throw e;
     return `the gate could not verify what this command would lose (${e.message})`;
@@ -776,9 +885,9 @@ const FS_ROOT_RE = /^(?:\/|\/[a-z]\/?|\/mnt\/[a-z]\/?|[a-z]:[\\/]?)\*?$/i
 const SCAN_WORD_RE = /\b(?:find|du|tree|rg|fd|where\.exe|grep|egrep|ls|dir|get-childitem|gci)\b/i
 const SCAN_TOKEN_RE = /(?:[^\s"']+|"[^"]*"?|'[^']*'?)+/g
 const SCAN_WRAPPERS = new Set(["sudo", "command", "\\builtin", "time", "nice"])
-// A comment (`#` starting a word), a quoted run (its `;`/`|` is data), a separator, or a heredoc
-// opener (never the `<<<` here-string).
-const SCAN_SPLIT_RE = /(?<![^\s;|&(])#[^\n]*|"[^"]*"?|'[^']*'?|\|\||&&|[|;\n]|(?<!<)<<(?!<)(-?)[ \t]*(["']?)([A-Za-z_]\w*)\2/g
+// A comment (`#` starting a word), a quoted run (its `;`/`|` is data), a separator (a lone `&`
+// too, never the one in `2>&1`/`<&3`/`&>`/`|&`), or a heredoc opener (never the `<<<` here-string).
+const SCAN_SPLIT_RE = /(?<![^\s;|&(])#[^\n]*|"[^"]*"?|'[^']*'?|\|\||&&|[|;\n]|(?<![&<>|])&(?![&>])|(?<!<)<<(?!<)(-?)[ \t]*(["']?)([A-Za-z_]\w*)\2/g
 // Cut at separators OUTSIDE quotes and drop every heredoc body (to its TAG line; `<<-` allows
 // tabs): a commit message that names a root scan is data, not a command to block.
 function scanSegments(command) {
@@ -812,7 +921,8 @@ function rootScan(command) {
   if (!SCAN_WORD_RE.test(command)) return null
   for (const seg of scanSegments(command)) {
     // Quotes kept until the root test, so a quoted "a:" is told from a bare C:.
-    let toks = (seg.match(SCAN_TOKEN_RE) || []).filter((t) => !/^\w+=/.test(t))
+    // `(find / …)`, `then find / …`: the grammar around the command is not its program.
+    let toks = stripStructure(seg.match(SCAN_TOKEN_RE) || []).filter((t) => !/^\w+=/.test(t))
     while (toks.length && SCAN_WRAPPERS.has(unquote(toks[0]))) toks = toks.slice(1)
     if (!toks.length) continue
     // The program word without its path (either slash) or an `.exe` suffix.
@@ -1075,19 +1185,20 @@ function ruleStoreTarget(p) {
 // must not edit in `.geneseed/protected-checks.txt` at its git root, one repo-relative path per
 // line; the list protects itself. Found from the WRITE TARGET up to the first `.git`, re-read on
 // every write (a short file, read only on a write call). No ask tier here, so a hit is a deny.
+// The target is read twice — as written, and with links followed — and a hit on either is a hit:
+// a link from outside into a protected folder and a protected folder that links out are both
+// caught, so following links never loosens the gate.
 const SENSOR_LIST = ".geneseed/protected-checks.txt"
 // The done gate's list (#289, js/hosts/hooks-done.mjs) protects itself the same way, with or
 // without a protected-checks list: emptying it would disarm the gate. Twin of js/hosts/hooks.mjs.
 const DONE_LIST = ".geneseed/done-checks.txt"
 function protectedCheck(p) {
+  return protectedIn(path.resolve(p)) ?? protectedIn(resolvePath(p))
+}
+function protectedIn(target) {
   try {
-    const target = path.resolve(p)
-    let root = path.dirname(target)
-    while (!existsSync(path.join(root, ".git"))) {
-      const up = path.dirname(root)
-      if (up === root) return null
-      root = up
-    }
+    const root = gitRootOf(path.dirname(target))
+    if (!root) return null
     const fold = (s) => nocase(s.replace(/\\/g, "/"))
     const rel = fold(path.relative(root, target))
     if (rel === fold(DONE_LIST)) return DONE_LIST
@@ -1218,7 +1329,8 @@ export const GeneseedGuard = async (ctx) => {
           if (c && !DELETION_GATE_OFF && LOSS_CANDIDATE_RE.test(c)) {
             // OpenCode's bash tool may run in `workdir`, resolved against the session directory.
             const wd = typeof args.workdir === "string" && args.workdir ? path.resolve(cwd, args.workdir) : cwd
-            const loss = lossReason(scanSegments(c).map((seg) => seg.match(SCAN_TOKEN_RE) || []), wd, { always: false })
+            const cut = (t) => scanSegments(t).map((seg) => seg.match(SCAN_TOKEN_RE) || [])
+            const loss = lossReason(cut(c), wd, { always: false, split: cut })
             if (loss) { await deny(`${loss} (Deletion Is Deliberate) — confirm with the user first`, "law-4"); return }
           }
         }

package/adapters/opencode/plugins/geneseed-learn.js

@@ -46,7 +46,9 @@ const PLUGIN_DIR = path.dirname(fileURLToPath(import.meta.url))
 // Sovereign-repo bypass — twin of the harness's own `sovereignBypass()`.
 // <cfg>/excludes.json (user-owned, managed by `harness exclude`) lists folders where
 // this GLOBAL install goes dormant. Any error degrades to "not excluded".
-const norm = (p) => {
+// Twin of js/hosts/hosts.mjs `resolvePath`: the absolute path with symlinks and junctions
+// followed, the way the Claude/Bob hook resolves one. `norm` folds its case for matching.
+function resolvePath(p) {
   // Expand a leading "~" / "~/…" to the home dir — a hand-edited excludes.json entry
   // like "~/vault" must resolve the same way here as it does for the Claude/Bob
   // hook guard.
@@ -65,6 +67,10 @@ const norm = (p) => {
     tail.unshift(path.basename(cur))
     cur = up
   }
+  return s
+}
+const norm = (p) => {
+  const s = resolvePath(p)
   return process.platform === "win32" ? s.toLowerCase() : s
 }
 // A linked git worktree of an excluded repo is excluded too, wherever it sits on disk — twin of

package/docs/concepts/hooks.md

@@ -48,7 +48,7 @@ Geneseed writes its hooks into the host's settings file. Every hook calls one pr
 - A write to `.geneseed/done-checks.txt`, the done gate's own list (below), gets the same *External Gate* prompt: emptying it would disarm the gate.
 - Ordinary edits pass untouched.
 
-**The done gate.** Runs when a turn ends, inside `learn` and before it calls any model. A project opts in with `.geneseed/done-checks.txt` at its git root: one command per line, `#` for comments — the checks that prove the work, for example `npm run lint` and `node --test`. If the turn edited a file under that root and a listed check has not passed since the last edit, the turn does not end: the agent is told which checks are owed, citing *Verify Before Asserting*. A check counts when it ran as a shell command, unpiped (`npm test | tail` exits with `tail`'s code, so it proves nothing), and its result was not an error. The gate never runs a check itself. It blocks at most once per turn; the second stop ends the turn and leaves a line in the gate ledger. Only file-write tools count as edits: a shell `sed -i` or redirect is not seen. Without the file, nothing changes. On OpenCode the gate is a reminder on the next request (OpenCode 1 only); on Bob, whose Stop carries no transcript, the turn is not judged and a log line says so. An install built `--no-done-gate` wires `learn` with that flag: the check is skipped, learning still runs ([Exclusions](exclusions.md)).
+**The done gate.** Runs when a turn ends, inside `learn` and before it calls any model. A project opts in with `.geneseed/done-checks.txt` at its git root: one command per line, `#` for comments — the checks that prove the work, for example `npm run lint` and `node --test`. If the turn edited a file under that root and a listed check has not passed since the last edit, the turn does not end: the agent is told which checks are owed, citing *Verify Before Asserting*. A check counts when it ran as a shell command, unpiped (`npm test | tail` exits with `tail`'s code, so it proves nothing), and its result was not an error. The gate never runs a check itself. It reads the transcript from its end, back only to the prompt that opened the turn, so its cost does not grow with the session. It blocks at most once per turn; the second stop ends the turn and leaves a line in the gate ledger. Only file-write tools count as edits: a shell `sed -i` or redirect is not seen. Without the file, nothing changes. On OpenCode the gate is a reminder on the next request (OpenCode 1 only); on Bob, whose Stop carries no transcript, the turn is not judged and a log line says so. An install built `--no-done-gate` wires `learn` with that flag: the check is skipped, learning still runs ([Exclusions](exclusions.md)).
 
 **learn.** Takes the tail of the transcript and asks a model to distil what is worth keeping into one-fact-per-file entries under `memory/`. It is shown the facts already stored, so it updates one with the merged text rather than writing a twin (the old version is kept in `memory/archive/`), and moves one the session proved obsolete into `memory/archive/`. It needs `GENESEED_LLM` set to a model command, for example:
 

package/docs/web-ui.md

@@ -165,8 +165,9 @@ streams the output of background jobs and keeps their history across reloads.
   added / missing files with per-file expansion and coloured unified-diff lines. Select
   files to **export an `improvements.md`** back-port, or **restore** them to source.
 - **Doctor** (`#/doctor`) — runs the same health engine as the `doctor` command (every
-  theme, parity, links, authoring gates, drift), grouping any problems per check. Re-run
-  on demand.
+  theme, parity, links, authoring gates, drift), grouping any problems per check. It shows
+  the server's last run — warmed at start, redone after a job, an install toggle or a view
+  switch — and **Re-run checks** runs every check again on demand.
 
 ### 🎨 Setup
 

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "4.9.0"
+  "version": "4.9.2"
 }

package/js/README.md

@@ -1,6 +1,6 @@
 # `js/` — the module map
 
-Sixty-nine modules in eight folders. This page is the address book: **what each one owns**, and
+Every module under `js/`, in eight folders. This page is the address book: **what each one owns**, and
 **which file to open first** for a given task. It is not documentation of behaviour — every module
 has a docblock for that, and the docblock is the thing to read before editing.
 
@@ -26,8 +26,28 @@ js/ui/        what it prints at a terminal
 js/web/       the `geneseed web` console
 ```
 
-Dependency direction is one-way: `lib/` ← everything; `build/` ← `hosts/`; `inspect/` and `web/`
-read what `build/` produced. Nothing in `lib/` imports anything above it.
+**Dependency direction is only partly one-way, and no test or doctor arm enforces any of it.**
+`lib/` is the one true leaf: it imports only Node builtins and itself, and every other folder
+imports it. A few modules sit just above it and are read from almost everywhere: `build/source.mjs`
+(the source paths, the rule canon, `aliasesOf`), `hosts/hosts.mjs` (the host config dirs) and
+`loop/score.mjs` (builtins only, by its docblock). Above those, the folders are domains, not
+layers. These pairs import each other (relative imports between folders, measured 2026-10):
+
+| pair | edges A→B / B→A | the smaller direction |
+|---|---|---|
+| build ↔ hosts | 24 / 5 | hosts reads `build/source.mjs` (`installs`, `link`, `native`, `opencode`) and `build/version.mjs` (`opencode`) |
+| build ↔ inspect | 2 / 23 | `build/driver.mjs` records deploy roots in `inspect/registry.mjs`; `build/catalog.mjs` reads `inspect/inventory.mjs` |
+| build ↔ loop | 4 / 1 | `loop/catalog.mjs` reads `build/source.mjs` |
+| build ↔ ui | 2 / 1 | `ui/cli.mjs` reads `ROOT` from `build/source.mjs` |
+| build ↔ web | 1 / 9 | `build/generate.mjs` lazily imports `web/daemon.mjs` to restart a stale console after `rebuild-all` |
+| hosts ↔ inspect | 1 / 36 | `hosts/installs.mjs` reads `inspect/registry.mjs`'s deploy roots |
+| ui ↔ web | 1 / 1 | `ui/menu.mjs` starts the daemon; `web/docs.mjs` renders `ui/cli.mjs`'s CLI reference |
+| maintain ↔ web | 1 / 6 | `maintain/update.mjs` lazily imports `web/daemon.mjs` for the same restart |
+
+The only gates over the import graph are the transitive closure walks in
+`tests/unit/hook_cli.test.mjs`. They pin which modules the generator and CLI entries may pull
+`child_process` into, not which folder imports which. Adding a cross-folder import is therefore a
+review question, not a test failure.
 
 ---
 
@@ -108,7 +128,7 @@ Everything that inspects an already-built or already-deployed harness and report
 | `checks-constitution.mjs` | The constitution: rule declarations and citations, LEAN blocks, `HOOK_PINNED`, theme vocabulary, the console's `LAW_META`/`DOCTRINE_META` |
 | `checks-counts.mjs` | The hand-written counts: AGENT.md tables, README badges and prose, `SHIPPED.md`, held against `src/` |
 | `scan.mjs` | The shared walk/sort/strip/test primitives every `checks-*` uses. Owns no judgement itself |
-| `validate.mjs` | The `--validate-only` verb: renders a sandbox, scans it for tokens and dead links, own exit contract |
+| `validate.mjs` | The `validate` verb (the generator's old `--validate-only`): renders a sandbox, scans it for tokens and dead links, own exit contract |
 | `inventory.mjs` | The one catalog walk and its taxonomy tables, read by status, the TUI and the web console |
 | `status.mjs` | `geneseed status` and `version` — the panel data, counts, accent colour, version verdict |
 | `cost.mjs` | What one install injects every session, by part (root file, skill and agent lists, session files), in characters; owns `CARRIER_CEILING`, which the smoke test gates and the console draws |
@@ -182,15 +202,16 @@ Verbs that change an install that already exists, as opposed to rendering one.
 | module | owns |
 |---|---|
 | `update.mjs` | `upgrade`/`sync-self`/`bootstrap` — git pull, doctor gate, rebuild, each via a respawn |
-| `setup.mjs` | The install wizard, and the CLI's only synchronous stdin readers (`ask`/`confirm`/`askChoice`) |
+| `setup.mjs` | The install wizard. Its prompts go through `js/lib/prompt.mjs`'s stdin readers |
 | `uninstall.mjs` | Removes or disables an install: manifest-driven reversal, plus stash deactivate/reactivate |
 | `migrate.mjs` | `geneseed migrate` — all-or-nothing re-emit moving installs onto the npm install shape |
 | `memory.mjs` | `geneseed memory list|rm` — CLI-side fact removal (archive by default, `--purge` deletes), twin of the web delete endpoint |
 
 **Before editing:** `update.mjs` is the one module that MUST spawn rather than import — the code on
 disk is replaced mid-run, so an in-process call would validate the *old* source and then render it.
-`setup.mjs` is the whole program's stdin layer, not just setup's. `memory.mjs` hard-unlinks user
-facts with no archive path.
+The stdin readers are not here: they live in `js/lib/prompt.mjs`, shared by `setup.mjs`,
+`uninstall.mjs` and `js/web/server.mjs`. `memory.mjs` deletes user facts: `rm` moves a fact into
+`archive/` by default, but `--purge` unlinks it and nothing can bring it back.
 
 ## `js/ui/` — the terminal
 
@@ -243,9 +264,9 @@ and inline lists are held against a surface list written out in
 | a law (invariant) | `src/laws/universal.md` — `### {{LAW:<id>}} <Principle>`; cite by id, never by number | `docs/extending.md` §2c. Author both LEAN halves: the lean footprint ships nothing else |
 | to remove or retire a rule | `docs/extending.md` §2e | `RETIRED_RULE_IDS` in `js/build/source.mjs` — a retired id is never reused |
 | a skill or an agent | `src/skills/<name>.md` or `src/agents/<name>.md` | `docs/extending.md` §3 — eight steps. Write the FILE before the table row or the build aborts |
-| a doctor check | `js/inspect/checks-{build,repo,authoring}.mjs` | register with `ran(...)` in `doctor.mjs`, then a PLANTED FAULT in `tests/unit/harness.test.mjs` |
+| a doctor check | `js/inspect/checks-{build,repo,authoring,constitution,counts}.mjs`; `checks-probe.mjs` for a check that runs a live install's gates | wire it in one of two ways. Give it its own `ran(...)` group in `doctor.mjs`, as the module map and the host tables have. Or append it to `authoringProblems`, which is how the constitution and count checks run. Then add a PLANTED FAULT in `tests/unit/harness.test.mjs` (`tests/unit/doctor_probe.test.mjs` for the probe) |
 | a web endpoint | GET → `js/web/api.mjs`; POST → `js/web/actions.mjs` | declare it in `js/web/routes.mjs`; the partition test probes the real handler |
-| a CLI verb | `js/cli-table.json` — the table IS the parser | the `VERBS` row in `bin/geneseed-cli.mjs`, the row count in `cli_table.test.mjs`, `NATIVE` in **two** test files |
+| a CLI verb | `js/cli-table.json` — the table IS the parser | the `VERBS` row in `bin/geneseed-cli.mjs`, the row count in `cli_table.test.mjs`, and, for a Node-native verb with no recorded cell, `NATIVE` in `tests/unit/hook_cli.test.mjs` |
 | a hook verb | `js/hosts/hooks.mjs` (a gate) or its own `js/hosts/hooks-<verb>.mjs` | `claudeHookGroups` in `settings.mjs`, the `VERBS` row (with its `load`) in `bin/geneseed-hook.mjs`. Keep the import graph tiny |
 | a console doc page | `docs/<understand|guides|concepts|reference>/<id>.md` — the stem is the id | `docs/extending.md` §4c. Only `kind: "concept"` gets `{N_*}` substitution |
 | an OpenCode plugin | `adapters/opencode/plugins/geneseed-<name>.js` | `docs/extending.md` §4a — the `geneseed-` prefix is mechanically load-bearing |

package/js/build/args.mjs

@@ -11,7 +11,7 @@ import { parseArgs as nodeParseArgs } from 'node:util';
 import { withPlatformNewlines } from '../lib/fs.mjs';
 import path from 'node:path';
 import {
-  CONFIG, discoverNames, PACK_ORDER, knownRuleIds, knownSkillIds, linkedSkillIds, resolveSkillNames,
+  CONFIG, discoverNames, GATE_SWITCHES, PACK_ORDER, knownRuleIds, knownSkillIds, linkedSkillIds, resolveSkillNames,
 } from './source.mjs';
 // The loop engine's trust presets — the `--trust` choices. `score.mjs` imports nothing, which is
 // what lets it sit inside this module's `child_process` ban.
@@ -101,11 +101,10 @@ const VALUED = {
 };
 const FLAGS = {
   '--sync-themes': 'syncThemes', '--validate-only': 'validateOnly',
-  // Law IV's gate switch. No `harness.config.json` key feeds it, deliberately: a rebuild elides
-  // the flag when armed, so a config default could disarm an armed install on its next upgrade.
-  '--no-deletion-gate': 'noDeletionGate',
-  // Laws I and III, the same contract (`GATE_SWITCHES` in source.mjs).
-  '--no-secrets-gate': 'noSecretsGate', '--no-done-gate': 'noDoneGate',
+  // The gate switches (`GATE_SWITCHES`, law order). No `harness.config.json` key feeds them,
+  // deliberately: a rebuild elides a flag when armed, so a config default could disarm an armed
+  // install on its next upgrade.
+  ...Object.fromEntries(GATE_SWITCHES.map((g) => [g.flag, g.arg])),
   '-v': 'verbose', '--verbose': 'verbose',
 };
 
@@ -306,6 +305,8 @@ function usage() {
  * this one) refuses the whole typed token, `-bogus`, once.
  */
 export function parseArgs(argv, defaults) {
+  // Typed open: the gate rows are spread in from `GATE_SWITCHES`, and `cfgDir` is set only when given.
+  /** @type {Record<string, any>} */
   const args = {
     theme: defaults.theme, posture: defaults.posture, mode: defaults.mode,
     trust: defaults.trust,
@@ -313,8 +314,8 @@ export function parseArgs(argv, defaults) {
     excludeRules: defaults.excludeRules,
     excludeSkills: defaults.excludeSkills ?? [],
     out: 'Harness', emit: 'files', footprint: 'lean', root: null,
-    syncThemes: false, validateOnly: false, verbose: false, noDeletionGate: false,
-    noSecretsGate: false, noDoneGate: false,
+    syncThemes: false, validateOnly: false, verbose: false,
+    ...Object.fromEntries(GATE_SWITCHES.map((g) => [g.arg, false])),
   };
   const { tokens } = nodeParseArgs({
     args: argv, options: PARSE_OPTIONS, allowPositionals: true, strict: false, tokens: true,