geneseed 4.9.0 → 4.9.2

package/js/build/driver.mjs

@@ -40,7 +40,7 @@ import { emitClaudeRender } from './emit-claude.mjs';
 import { emitOpencodeRender, emitOpencodeGlobalRender } from './emit-opencode.mjs';
 import { settingsIntegrityCheck } from '../hosts/settings.mjs';
 import { hookRunnerEntry } from '../hosts/shim.mjs';
-import { writeText, withPlatformNewlines, isFile } from '../lib/fs.mjs';
+import { writeText, withPlatformNewlines, isFile, withWriteRecord } from '../lib/fs.mjs';
 import { parseJson, jsonDumpsIndent } from '../lib/json.mjs';
 import { relPosix } from '../lib/text.mjs';
 // P5c moved these out of this file: `bin/geneseed-cli.mjs` needs the same four resolvers to
@@ -58,7 +58,7 @@ import {
 // status` renders to count, so `bin/geneseed-cli.mjs` needs the same checkout paths and the
 // same cfg. golden.py's 259 cells all build one, which is what made the move safe.
 import {
-  ROOT, makeCfg,
+  GATE_SWITCHES, ROOT, makeCfg,
 } from './source.mjs';
 
 // P5f moved these, for the same arithmetic a third time: `harness rebuild-all` reads the
@@ -75,8 +75,11 @@ import { configDefaults, die, parseArgs } from './args.mjs';
 export { parseDriverArgs } from './args.mjs';
 
 
-/** `_build_emit.PRIMARY_AGENT_SRC`. */
-const PRIMARY_AGENT_SRC = path.join(ROOT, 'adapters', 'opencode', 'agents', 'orchestrator.md');
+/**
+ * `_build_emit.PRIMARY_AGENT_SRC`. Exported for `diffCollect`'s render memo: a render input
+ * `sourceFingerprint` does not hash, so the memo keys on its bytes itself.
+ */
+export const PRIMARY_AGENT_SRC = path.join(ROOT, 'adapters', 'opencode', 'agents', 'orchestrator.md');
 
 /** `_build_render.resolve_out` — absolute, or relative to the CURRENT WORKING DIRECTORY
  *  (not to ROOT), so the harness renders straight into any repository.
@@ -555,9 +558,9 @@ const claudeShaped = (name) => (cfg, args, out) => {
   const claudeMd = path.join(configDir || carrierInLayer ? cfgDir : root, carrier);
   const hookOpts = hookRunnerEntry();
   before?.();
-  const r = emitClaudeCore(cfg, args, {
+  const r = withWriteRecord(() => emitClaudeCore(cfg, args, {
     cfgDir, claudeMd, scope: configDir ? 'global' : 'project', host, out, hookOpts,
-  });
+  }));
   process.stdout.write(summary(root ?? cfgDir, r));
   return configDir ? cfgDir : undefined;
 };
@@ -604,7 +607,7 @@ function writeMarkers(markerDir, emit, footprint) {
  * but this argument would overwrite the live install `diff` is only reading.
  */
 const GLOBAL_EMITS = {
-  opencode: emitOpencodeGlobal,
+  opencode: (...a) => withWriteRecord(() => emitOpencodeGlobal(...a)),
   claude: claudeShaped('claude-global'),
   bob: claudeShaped('bob-global'),
   openclaude: claudeShaped('openclaude-global'),
@@ -633,7 +636,7 @@ const PROJECT_EMITS = {
   // P2. `opencode` joins the three for `cmdValidate`, which has to be able to render EVERY
   // `--emit` choice into its sandbox and not only the three doctor already scans. Its call
   // shape is the Claude-shaped emits' exactly — `(cfg, args, out)` — so the row is the whole change.
-  opencode: emitOpencode,
+  opencode: (...a) => withWriteRecord(() => emitOpencode(...a)),
 };
 
 /**
@@ -648,24 +651,21 @@ const PROJECT_EMITS = {
  * carry straight past the parameter default.
  */
 function axesCfg({
-  posture, mode, trust, doctrines, excludeRules, excludeSkills,
-  deletionGate = null, secretsGate = null, doneGate = null,
+  posture, mode, trust, doctrines, excludeRules, excludeSkills, ...gates
 }) {
   return makeCfg({
     ...(posture ? { posture } : {}), ...(mode ? { mode } : {}), ...(trust ? { trust } : {}),
     ...(doctrines ? { doctrines } : {}), ...(excludeRules ? { excludeRules } : {}),
     ...(excludeSkills ? { excludeSkills } : {}),
-    // Only an explicit `false` disarms; `null` (no opinion) keeps the gate.
-    ...(deletionGate === false ? { noDeletionGate: true } : {}),
-    ...(secretsGate === false ? { noSecretsGate: true } : {}),
-    ...(doneGate === false ? { noDoneGate: true } : {}),
+    // The gate switches (`GATE_SWITCHES` keys): only an explicit `false` disarms; `null` (no
+    // opinion) keeps the gate.
+    ...Object.fromEntries(GATE_SWITCHES.filter((g) => gates[g.key] === false).map((g) => [g.arg, true])),
   });
 }
 
 export function emitProjectInto(host, {
   theme, out, root, footprint = 'full', posture = null, mode = null, trust = null,
-  doctrines = null, excludeRules = null, excludeSkills = null, deletionGate = null,
-  secretsGate = null, doneGate = null,
+  doctrines = null, excludeRules = null, excludeSkills = null, ...gates
 }) {
   const emit = PROJECT_EMITS[host];
   // The axes ride the same rail into every `*Into`, and for the same reason: a drift reader
@@ -674,7 +674,7 @@ export function emitProjectInto(host, {
   // checked an all-packs render nobody asked for.
   return withPlatformNewlines(() => emit(
     axesCfg({
-      posture, mode, trust, doctrines, excludeRules, excludeSkills, deletionGate, secretsGate, doneGate }),
+      posture, mode, trust, doctrines, excludeRules, excludeSkills, ...gates }),
     { theme, footprint, root }, out,
   ));
 }
@@ -689,16 +689,16 @@ export function emitProjectInto(host, {
  */
 export function buildInto({
   theme, out, footprint = 'lean', posture = null, mode = null, trust = null, doctrines = null,
-  excludeRules = null, excludeSkills = null, deletionGate = null, secretsGate = null, doneGate = null,
+  excludeRules = null, excludeSkills = null, ...gates
 }) {
   return withPlatformNewlines(() => build(axesCfg({
-    posture, mode, trust, doctrines, excludeRules, excludeSkills, deletionGate, secretsGate, doneGate }),
+    posture, mode, trust, doctrines, excludeRules, excludeSkills, ...gates }),
     theme, out, { footprint, nativeCatalog: false }));
 }
 
 export function emitGlobalInto(host, {
   theme, out, cfgDir, footprint, posture = null, mode = null, doctrines = null, trust = null,
-  excludeRules = null, excludeSkills = null, deletionGate = null, secretsGate = null, doneGate = null,
+  excludeRules = null, excludeSkills = null, ...gates
 }) {
   // `build.HOSTS.get(host, build.HOSTS["opencode"])` — an unknown host falls back rather than
   // raising, because the host comes from a marker file a user can edit.
@@ -715,7 +715,7 @@ export function emitGlobalInto(host, {
   // the same scar the footprint left in `diffCollect`, one axis over each time.
   return withPlatformNewlines(() => emit(
     axesCfg({
-      posture, mode, trust, doctrines, excludeRules, excludeSkills, deletionGate, secretsGate, doneGate }),
+      posture, mode, trust, doctrines, excludeRules, excludeSkills, ...gates }),
     { theme, footprint, root: null, cfgDir }, out,
   ));
 }

package/js/build/emit-claude.mjs

@@ -182,7 +182,7 @@ export function emitClaudeRender(cfg, job) {
   // WIRE — see `claudeWire` below. One child per emit, so the two halves are two
   // functions rather than two spawns; the seam between them is a call, not a process.
   const managed = claudeWire(job, claudeMdText, agentText !== null, cfg.doctrines,
-    cfg.excludeRules, cfg.deletionGate, { secretsGate: cfg.secretsGate, doneGate: cfg.doneGate });
+    cfg.excludeRules, cfg);
 
   return {
     owned,
@@ -216,7 +216,7 @@ export function emitClaudeRender(cfg, job) {
  * always a string, so `''` is the only falsy value either language sees.
  */
 function claudeWire(job, claudeMdText, hasAgentText, doctrines = null, excludeRules = [],
-  deletionGate = true, gates = {}) {
+  gates = {}) {
   phaseLog('WIRE');
   const { cfgDir, claudeMd, scope, host, oldManaged, preambleExclude, hookOpts } = job;
   const old = oldManaged && typeof oldManaged === 'object' && !Array.isArray(oldManaged)
@@ -280,7 +280,7 @@ function claudeWire(job, claudeMdText, hasAgentText, doctrines = null, excludeRu
   // DECIDES the install's packs, so the marker on disk is still the previous build's.
   const [, managedHooks] = mergeClaudeSettings(
     settingsPath, oldSf === settingsName ? get(old, 'settings_hooks') : null, hookOpts,
-    doctrines, excludeRules, host, cfgDir, deletionGate, gates,
+    doctrines, excludeRules, host, cfgDir, gates,
   );
   managed.settings_hooks = managedHooks;
 

package/js/build/generate.mjs

@@ -141,8 +141,7 @@ export function cmdBuild(args) {
  */
 export function setupBuildArgs(theme, emit, out = null, root = null, footprint = 'lean',
   posture = 'peer', mode = 'direct', doctrines = null, allPacks = PACK_ORDER,
-  excludeRules = null, trust = DEFAULT_PRESET, excludeSkills = null, deletionGate = true,
-  { secretsGate = true, doneGate = true } = {}) {
+  excludeRules = null, trust = DEFAULT_PRESET, excludeSkills = null, gates = {}) {
   const argv = ['--theme', theme, '--emit', emit];
   if (!emit.endsWith('-global')) {
     if (out) argv.push('--out', out);
@@ -172,9 +171,9 @@ export function setupBuildArgs(theme, emit, out = null, root = null, footprint =
   if (excludeSkills?.length) argv.push('--exclude-skills', excludeSkills.join(','));
   // The gate switches elide when armed: the driver's default IS armed (no config key feeds
   // them), so only an explicit `false` speaks, and every armed argv stays the bytes it was.
+  // `gates` is one object keyed as `GATE_SWITCHES` keys it (`gatesOfDir`, a profile, a body).
   // Law order, so a Law IV-only install still ends on `--no-deletion-gate` as it did.
-  const gates = { secretsGate, doneGate, deletionGate };
-  for (const g of GATE_SWITCHES) if (gates[g.key] === false) argv.push(g.flag);
+  for (const g of GATE_SWITCHES) if (gates?.[g.key] === false) argv.push(g.flag);
   return argv;
 }
 
@@ -238,7 +237,7 @@ export function installProfile(host, scope, root, notify = null) {
   const gates = gatesOfDir(root, host);
   const out = scope === 'global' ? null : root;
   const argv = setupBuildArgs(theme, emit, out, out, footprint, posture, mode, doctrines,
-    PACK_ORDER, excludeRules, trust, excludeSkills, gates.deletionGate, gates);
+    PACK_ORDER, excludeRules, trust, excludeSkills, gates);
   // A GLOBAL ROW NAMES ITS OWN DIR. `root` came from the host's config-dir resolver, which
   // honours env overrides (`OPENCODE_CONFIG_DIR`, `CLAUDE_CONFIG_DIR`…); without the flag the
   // same argv run from a shell lacking that variable re-emits into the DEFAULT dir — a second

package/js/build/source.mjs

@@ -385,6 +385,19 @@ export function resolveSkillNames(names, {
   return { ids: [...new Set(ids)].sort(), notices, unknown };
 }
 
+/**
+ * The laws whose hook gate an install can switch off, in law order: the cfg/profile key, the
+ * build flag, the carrier marker (`<marker>: off`, written only when off) and the law. ONE
+ * table, so the flag, the marker, the rebuild argv, the read-back and `status` cannot drift
+ * apart. Every gate is ARMED by default and the law's text binds either way. The deletion row
+ * is #319's, unchanged: existing installs carry its flag and marker.
+ */
+export const GATE_SWITCHES = [
+  { key: 'secretsGate', flag: '--no-secrets-gate', arg: 'noSecretsGate', marker: 'Secrets gate', law: 'I' },
+  { key: 'doneGate', flag: '--no-done-gate', arg: 'noDoneGate', marker: 'Done gate', law: 'III' },
+  { key: 'deletionGate', flag: '--no-deletion-gate', arg: 'noDeletionGate', marker: 'Deletion gate', law: 'IV' },
+];
+
 /**
  * `_build_core.js_cfg()`, originated rather than received.
  *
@@ -399,8 +412,7 @@ export function resolveSkillNames(names, {
  */
 export function makeCfg({
   posture = 'peer', mode = 'direct', trust = DEFAULT_PRESET, doctrines = PACK_ORDER,
-  excludeRules = [], excludeSkills = [], noDeletionGate = false, noSecretsGate = false,
-  noDoneGate = false,
+  excludeRules = [], excludeSkills = [], ...switches
 } = {}) {
   return {
     root: ROOT,
@@ -428,25 +440,9 @@ export function makeCfg({
     excludeRules: Array.isArray(excludeRules) ? [...excludeRules] : [],
     // Skill names left out of this install — same "unspecified takes nothing away" default.
     excludeSkills: Array.isArray(excludeSkills) ? [...excludeSkills] : [],
-    // Law IV's deletion gate (`--no-deletion-gate`). Armed unless switched off in so many words:
-    // only a literal `true` disarms, so every caller that never heard of the switch keeps it.
-    deletionGate: noDeletionGate !== true,
-    // Law I's secret scan (`--no-secrets-gate`) and Law III's done gate (`--no-done-gate`), the
-    // same contract (user decision 2026-10-18; see GATE_SWITCHES).
-    secretsGate: noSecretsGate !== true,
-    doneGate: noDoneGate !== true,
+    // The gate switches (`GATE_SWITCHES`: `secretsGate`, `doneGate`, `deletionGate`), each armed
+    // unless its `no*` arg says so in so many words: only a literal `true` disarms, so every
+    // caller that never heard of a switch keeps the gate.
+    ...Object.fromEntries(GATE_SWITCHES.map((g) => [g.key, switches[g.arg] !== true])),
   };
 }
-
-/**
- * The laws whose hook gate an install can switch off, in law order: the cfg/profile key, the
- * build flag, the carrier marker (`<marker>: off`, written only when off) and the law. ONE
- * table, so the flag, the marker, the rebuild argv, the read-back and `status` cannot drift
- * apart. Every gate is ARMED by default and the law's text binds either way. The deletion row
- * is #319's, unchanged: existing installs carry its flag and marker.
- */
-export const GATE_SWITCHES = [
-  { key: 'secretsGate', flag: '--no-secrets-gate', arg: 'noSecretsGate', marker: 'Secrets gate', law: 'I' },
-  { key: 'doneGate', flag: '--no-done-gate', arg: 'noDoneGate', marker: 'Done gate', law: 'III' },
-  { key: 'deletionGate', flag: '--no-deletion-gate', arg: 'noDeletionGate', marker: 'Deletion gate', law: 'IV' },
-];

package/js/hosts/gitref.mjs

@@ -12,9 +12,11 @@
  * `child_process` ban like every other closure that feeds `bin/geneseed-cli.mjs` — may ever
  * import. A module that is fs/path only is importable from anywhere.
  *
- * The OpenCode guard plugin once kept a standalone twin of this for its `permission.ask`
- * loop exemption; upstream never calls that hook, so the twin was deleted (OpenCode verdict
- * I-2). This module has no copy to keep in step.
+ * The OpenCode guard plugin (`adapters/opencode/plugins/geneseed-guard.js`) is copied whole
+ * into an install and cannot import this, so it carries twins of `gitRootOf`, `gitDirOf`,
+ * `gitCommonDirOf`, `currentBranch`, `protectedBranches` and `stashExists` for its Law IV and
+ * protected-checks gates. `tests/plugins/guard.test.mjs` compares each with the original here;
+ * change one, change both.
  */
 import { existsSync, statSync, lstatSync, readFileSync, readdirSync, openSync, readSync, closeSync } from 'node:fs';
 import path from 'node:path';

package/js/hosts/hooks-done.mjs

@@ -28,6 +28,11 @@
  *     result is not `is_error` — every non-zero exit, denial and timeout carries it (checked on
  *     14 000+ real Claude Code results, 2026-10-17).
  *
+ * READ FROM THE END (constant-cost Stop). Only the current turn matters, so the transcript is read
+ * backward in growing windows (`tailReader`) until the turn's opening prompt is inside one; a
+ * turn longer than every window falls back to the whole file. Never judged on a truncated turn:
+ * a window without a prompt answers "read more", not "no edit".
+ *
  * At most one block per turn: `stop_hook_active` is true when this Stop follows a block, and the
  * gate then lets the turn end and leaves a ledger line, so a gate that cries wolf gets found.
  */
@@ -37,7 +42,7 @@ import { readText, printOut as out, printErr as err } from '../lib/fs.mjs';
 import { within } from '../lib/paths.mjs';
 import { gitRootOf } from './gitref.mjs';
 import { DONE_LIST, recordGate } from './hooks.mjs';
-import { splitLines } from './hooks-prims.mjs';
+import { splitLines, tailReader } from './hooks-prims.mjs';
 
 const EDIT_TOOLS = new Set(['Write', 'Edit', 'NotebookEdit', 'MultiEdit']);
 const SHELL_TOOLS = new Set(['Bash', 'PowerShell']);
@@ -102,18 +107,24 @@ function isPrompt(obj) {
 /**
  * The decision, over transcript TEXT: the checks that have not passed since the turn's last
  * edit, or [] when the turn may end (no edit, or every check passed after it). Exported for the
- * unit tier — a transcript is text no CLI cell can vary cheaply.
+ * unit tier — a transcript is text no CLI cell can vary cheaply. `whole` false means the text
+ * is only the file's tail: with no prompt in it the turn may start earlier, so the answer is
+ * null ("read more") — a turn judged from its middle could miss its edit and wrongly pass.
  */
-export function doneDecide(transcript, checks, root, cwd = root) {
+export function doneDecide(transcript, checks, root, cwd = root, whole = true) {
   const entries = [];
   for (const line of splitLines(transcript)) {
     if (!line.trim()) continue;
     try { entries.push(JSON.parse(line)); } catch { /* a torn last line is not evidence */ }
   }
-  let start = 0;
+  let start = -1;
   for (let i = entries.length - 1; i >= 0; i -= 1) {
     if (isPrompt(entries[i])) { start = i + 1; break; }
   }
+  if (start === -1) {
+    if (!whole) return null;
+    start = 0;
+  }
   const calls = [];                      // tool_use blocks, in order
   const results = new Map();             // tool_use_id -> is_error
   for (const obj of entries.slice(start)) {
@@ -147,9 +158,10 @@ export function doneDecide(transcript, checks, root, cwd = root) {
  * The Stop-side wrapper `cmdLearn` calls first. Returns true when it printed a block (the turn
  * goes on, so `learn` must not distil yet); false in every other case, with nothing on stdout.
  * `install` is the root `cmdLearn` already derived from `--memory` (null without one), so the
- * ledger lands in the same root its sovereignty check read.
+ * ledger lands in the same root its sovereignty check read. `read` is `cmdLearn`'s per-Stop
+ * transcript reader, so the distillation after an allow reuses the windows read here.
  */
-export function doneGate(meta, args, install) {
+export function doneGate(meta, args, install, read = tailReader()) {
   try {
     const cwd = typeof meta.cwd === 'string' && meta.cwd ? meta.cwd : process.cwd();
     const root = gitRootOf(cwd);
@@ -160,15 +172,15 @@ export function doneGate(meta, args, install) {
       err(`[done-gate] no transcript${args.host === 'bob' ? ' (bob)' : ''} — turn not judged.\n`);
       return false;
     }
-    let transcript;
+    let missing;
     try {
-      transcript = readText(meta.transcript_path);
+      missing = read(meta.transcript_path,
+        (text, whole) => doneDecide(text, checks, root, cwd, whole));
     } catch {
       // No ask tier on Stop: blocking on an unreadable transcript would trap the user.
       err('[done-gate] transcript unreadable — turn not judged.\n');
       return false;
     }
-    const missing = doneDecide(transcript, checks, root, cwd);
     if (!missing.length) return false;
     if (meta.stop_hook_active === true) {
       recordGate(install, 'done-gate-cap', 'law-3');

package/js/hosts/hooks-learn.mjs

@@ -12,7 +12,7 @@ import { NO_WINDOW } from '../lib/proc.mjs';
 import {
   globalHookStandingDown, hookProjectDir, resolveMemoryDir, sovereignBypass,
 } from './hosts.mjs';
-import { readStdin, splitLines, splitWords } from './hooks-prims.mjs';
+import { readStdin, splitLines, splitWords, tailReader } from './hooks-prims.mjs';
 import { doneGate } from './hooks-done.mjs';
 import {
   existingSlugs, readFacts, writeMemories, consolidateMemory, appendAgentLesson,
@@ -94,15 +94,26 @@ function contentText(content) {
   return '';
 }
 
-/** Render a Claude-Code-style JSONL transcript into `role: text` notes. */
-function flattenTranscript(p) {
-  let raw;
+/**
+ * Render a Claude-Code-style JSONL transcript into `role: text` notes, read from the END: the
+ * window grows until its notes hold twice MAX_NOTES_CHARS UTF-16 units (so at least
+ * MAX_NOTES_CHARS code points) or it is the whole file. The window's notes are a suffix of the
+ * whole file's, so the tail `cmdLearn` keeps is the one a full read would give — and a tail of
+ * tool output, which flattens to nothing, just reads further back.
+ */
+function flattenTranscript(p, read) {
   try {
     // `errors="replace"`: Node's utf8 decoder already substitutes U+FFFD.
-    raw = readText(p);
+    return read(p, (raw, whole) => {
+      const flat = flattenText(raw);
+      return whole || flat.length >= 2 * MAX_NOTES_CHARS ? flat : null;
+    });
   } catch {
     return '';
   }
+}
+
+function flattenText(raw) {
   const acc = [];
   for (let line of splitLines(raw)) {
     line = line.trim();
@@ -152,11 +163,11 @@ function flattenTranscript(p) {
  * store, a transcript payload that is not JSON. Those are decisions over text, and the corpus
  * reaches none of them.
  */
-export function readNotes(raw, meta = hookMeta(raw)) {
+export function readNotes(raw, meta = hookMeta(raw), read = tailReader()) {
   if (!raw.trim()) return '';
   const tp = meta.agent_transcript_path || meta.transcript_path;
   if (!tp) return raw;
-  const flat = flattenTranscript(tp);
+  const flat = flattenTranscript(tp, read);
   const lastMsg = typeof meta.last_assistant_message === 'string'
     ? meta.last_assistant_message.trim() : '';
   if (!flat) return lastMsg || flat;
@@ -314,7 +325,9 @@ export function cmdLearn(args) {
   // means the turn goes on, so there is nothing to distil yet: the next Stop will.
   // `--no-done-gate` (the install switched Law III's gate off) skips the check, never the
   // distillation below.
-  if (hookEvent === 'Stop' && !args.file && !args.noDoneGate && doneGate(meta, args, install)) return 0;
+  // One reader for this Stop: an allowed turn's distillation reuses the windows the gate read.
+  const read = tailReader();
+  if (hookEvent === 'Stop' && !args.file && !args.noDoneGate && doneGate(meta, args, install, read)) return 0;
 
   // I2 (Bob): its Stop payload never carries `transcript_path`, so there is never a transcript
   // to distil — and the bare envelope itself is not notes text (that would waste a model call
@@ -334,7 +347,7 @@ export function cmdLearn(args) {
 
   // B3: a real hook call with `$GENESEED_LLM` unset has nothing to send a prompt to — stdout on
   // Stop/SubagentStop/PreCompact reaches only the debug log, never the user (docs `hooks.md`) —
-  // so reading and flattening the transcript (up to 16 KB, every turn) just to print it nowhere
+  // so reading and flattening the transcript (a 2 MB tail or more, every turn) just to print it nowhere
   // is pure waste. Checked BEFORE `readNotes`, which is what does that read. A manual
   // invocation keeps printing the prompt on an unset `$GENESEED_LLM` — that is the documented,
   // deliberate behaviour (docs/reference/env-context.md) for someone running `learn` by hand to
@@ -345,7 +358,7 @@ export function cmdLearn(args) {
     return 0;
   }
 
-  let notes = readNotes(raw, meta);
+  let notes = readNotes(raw, meta, read);
   if (!notes.trim()) {
     err('[learn] no notes or transcript content \u2014 nothing to distil.\n');
     return 0;

package/js/hosts/hooks-prims.mjs

@@ -10,6 +10,7 @@
 import { statSync, readFileSync, readdirSync } from 'node:fs';
 import path from 'node:path';
 import { comparePaths } from '../lib/paths.mjs';
+import { readTail } from '../lib/fs.mjs';
 
 // ---- Python path and text primitives -------------------------------------------------
 // Small, and each one is here because a JS-idiomatic equivalent differs observably.
@@ -75,6 +76,30 @@ export function splitLines(text) {
   return parts;
 }
 
+/** The first window a Stop reads from a transcript's end; real transcripts reach 50 MB. */
+export const TAIL_BYTES = 2 * 1024 * 1024;
+
+/**
+ * A transcript reader for ONE hook invocation: `read(file, judge)` hands `judge(text, whole)`
+ * the file's last `bytes`, then a window four times larger, until `judge` answers (anything
+ * but null) or the window holds the whole file — where it must answer. Each window is read once
+ * per reader, so the done gate and `learn` share one read when both run on the same Stop.
+ * A read error (missing, unreadable) throws to the caller, uncached. Never a module-level cache:
+ * the host appends between Stops, and a test rewrites the same path.
+ */
+export function tailReader(bytes = TAIL_BYTES) {
+  const seen = new Map();
+  return (file, judge) => {
+    for (let n = bytes; ; n *= 4) {
+      const key = `${n}:${file}`;
+      if (!seen.has(key)) seen.set(key, readTail(file, n));
+      const { text, start } = seen.get(key);
+      const answer = judge(text, start === 0);
+      if (answer !== null || start === 0) return answer;
+    }
+  };
+}
+
 /** `str.split()` with no argument — runs of whitespace, ends stripped, no empties. */
 export function splitWords(s) {
   return s.split(/\s+/).filter(Boolean);

package/js/hosts/hooks.mjs

@@ -58,7 +58,7 @@ import {
   GATE_LEDGER, globalHookStandingDown, hookProjectDir, resolvePath, sovereignBypass,
 } from './hosts.mjs';
 import { currentBranch, gitRootOf, loopLaunched } from './gitref.mjs';
-import { LOSS_CANDIDATE_RE, lossReason } from './loss.mjs';
+import { LOSS_CANDIDATE_RE, lossReason, stripStructure } from './loss.mjs';
 import { selfAndParents, readStdin } from './hooks-prims.mjs';
 import { recordUse } from './usage.mjs';
 
@@ -349,13 +349,14 @@ const SCAN_WORD_RE = /\b(?:find|du|tree|rg|fd|where\.exe|grep|egrep|ls|dir|get-c
 const SCAN_TOKEN_RE = /(?:[^\s"']+|"[^"]*"?|'[^']*'?)+/g;
 const SCAN_WRAPPERS = new Set(['sudo', 'command', '\\builtin', 'time', 'nice']);
 // One left-to-right pass: a comment (`#` starting a word, to the end of the line — an apostrophe
-// in it is no quote), a quoted run (kept whole, so its `;`/`|` is data), a separator, or a
+// in it is no quote), a quoted run (kept whole, so its `;`/`|` is data), a separator (a lone `&`
+// backgrounds a command and runs the next, but `2>&1`, `<&3`, `&>` and `|&` are not one), or a
 // heredoc opener (`<<TAG`, `<<-TAG`, `<< 'TAG'`, `<<"TAG"` — never the here-string `<<<`).
 // Every alternative consumes at least one character, and none can backtrack past its start.
-const SCAN_SPLIT_RE = /(?<![^\s;|&(])#[^\n]*|"[^"]*"?|'[^']*'?|\|\||&&|[|;\n]|(?<!<)<<(?!<)(-?)[ \t]*(["']?)([A-Za-z_]\w*)\2/g;
+const SCAN_SPLIT_RE = /(?<![^\s;|&(])#[^\n]*|"[^"]*"?|'[^']*'?|\|\||&&|[|;\n]|(?<![&<>|])&(?![&>])|(?<!<)<<(?!<)(-?)[ \t]*(["']?)([A-Za-z_]\w*)\2/g;
 
 /**
- * The command cut at `|`/`;`/`&&`/`||`/newline OUTSIDE quotes, with every heredoc body (the
+ * The command cut at `|`/`;`/`&`/`&&`/`||`/newline OUTSIDE quotes, with every heredoc body (the
  * lines after `<<TAG` up to the `TAG` line; `<<-` lets it be tab-indented) dropped: both are data.
  * Without this, `git commit -F - <<'EOF'` — the mandated multi-line commit form — or a quoted
  * `-m "fix; find / loop"` whose text merely names a root scan reads as one, which on Bob and
@@ -401,7 +402,8 @@ export function rootScan(command) {
   if (!SCAN_WORD_RE.test(command)) return null;
   for (const seg of scanSegments(command)) {
     // Tokens keep their quotes until the root test, so a quoted `"a:"` can be told from a bare `C:`.
-    let toks = (seg.match(SCAN_TOKEN_RE) || []).filter((t) => !/^\w+=/.test(t));
+    // `(find / …)`, `then find / …`: the grammar around the command is not its program.
+    let toks = stripStructure(seg.match(SCAN_TOKEN_RE) || []).filter((t) => !/^\w+=/.test(t));
     while (toks.length && SCAN_WRAPPERS.has(unquote(toks[0]))) toks = toks.slice(1);
     if (!toks.length) continue;
     // The program word without its path (either slash) or an `.exe` suffix: `C:\tools\rg.exe`.
@@ -427,6 +429,8 @@ export function rootScan(command) {
   return null;
 }
 const unquote = (t) => t.replace(/^["']+|["']+$/g, '');
+// The segments `lossReason` reads: raw tokens, quotes still on — also how it cuts a `$(…)` body.
+const lossSegments = (s) => scanSegments(s).map((seg) => seg.match(SCAN_TOKEN_RE) || []);
 // A QUOTED token is data — a grep pattern (`grep -rn "/" src`), a path named in a search
 // (`rg "/mnt/c" README.md`) — never a root target; only an unquoted root is one.
 const rootArg = (t) => !/^["']/.test(t) && FS_ROOT_RE.test(t);
@@ -439,8 +443,8 @@ function gitDecide(args, payload) {
   if (!args.noDeletionGate && LOSS_CANDIDATE_RE.test(command)) {
     // A pass here FALLS THROUGH: a force push to a feature branch loses nothing, but it is still
     // a push, and process 5 below still asks for it.
-    const loss = lossReason(scanSegments(command).map((seg) => seg.match(SCAN_TOKEN_RE) || []),
-      (payload && payload.cwd) || process.cwd());
+    const loss = lossReason(lossSegments(command), (payload && payload.cwd) || process.cwd(),
+      { split: lossSegments });
     if (loss) {
       return ask(args, 'git-gate', 'law-4', `Geneseed (Deletion Is Deliberate) \u2014 ${loss}. `
         + 'Confirm this specific command, or leave the data in place.');
@@ -521,8 +525,13 @@ export const DONE_LIST = '.geneseed/done-checks.txt';
  * not seen here; CI running the checks is the boundary that holds against that.
  */
 function protectedCheck(p) {
+  return protectedIn(path.resolve(p)) ?? protectedIn(resolvePath(p));
+}
+// One reading of the target. `protectedCheck` takes two — the path as written and the path with
+// links followed — so a link from outside into a protected folder and a protected folder that
+// links out of the repo are both caught: following links never loosens the gate.
+function protectedIn(target) {
   try {
-    const target = resolvePath(p);
     const root = gitRootOf(path.dirname(target));
     if (!root) return null;
     if (normcase(path.relative(root, target)) === normcase(DONE_LIST)) return DONE_LIST;

package/js/hosts/installs.mjs

@@ -609,9 +609,6 @@ export function gatesOfDir(d, host = null) {
   return Object.fromEntries(GATE_SWITCHES.map((g) => [g.key, gateOfDir(d, g.marker, host)]));
 }
 
-/** Law IV's switch alone (#319's reader, kept for its callers). */
-export const deletionGateOfDir = (d, host = null) => gateOfDir(d, 'Deletion gate', host);
-
 // ---- what host a deployed dir belongs to (`_harness_mcp`) ---------------------------------
 
 /** `_harness_mcp._claude_read_manifest`. */
@@ -838,7 +835,11 @@ export function installsReferencingShim(shimPath = hookShimPath(), targets = ins
 // ---- what this machine installed (`_harness_setup._installed_defaults`) --------------------
 
 /**
- * `_harness_setup._installed_defaults` — all six keys.
+ * `_harness_setup._installed_defaults` — eight keys: `theme`, `posture`, `mode`, `emit`,
+ * `footprint`, `doctrines`, `excludeRules`, `excludeSkills`. NOT the gate switches: a walk
+ * across every install on the machine would carry one host's `off` into another's re-run, and
+ * for a gate that disarms a boundary its owner never switched off — `setup` reads them off the
+ * one install it is re-running (`targetGates` in js/maintain/setup.mjs).
  *
  * It carried only `theme` and `emit` for four phases because those are the two `status`
  * prints and the two `doctor` reads, and the port's keep-vs-delete rule is "part of an