geneseed 4.9.1 → 4.9.2

package/js/inspect/diff.mjs

@@ -35,11 +35,15 @@
  *     directly rather than by comparison, because a check made tolerant of a value owes one
  *     somewhere else.
  */
+import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, statSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
-import { emitGlobalInto } from '../build/driver.mjs';
+import { PRIMARY_AGENT_SRC, emitGlobalInto } from '../build/driver.mjs';
+import { rglobFiles } from '../build/emit-common.mjs';
+import { CONFIG, makeCfg } from '../build/source.mjs';
+import { sourceFingerprint } from '../build/version.mjs';
 import {
   GLOBAL_MANIFEST, VERSION_MARKER, expanduser, opencodeConfigDir, resolvePath,
 } from '../hosts/hosts.mjs';
@@ -53,6 +57,7 @@ import {
 import { unifiedDiff, splitLines } from '../lib/udiff.mjs';
 import { printOut, printErr, readText, writeText, isFile } from '../lib/fs.mjs';
 import { toPlatformPath } from '../lib/paths.mjs';
+import { relPosix } from '../lib/text.mjs';
 
 /**
  * `_harness_core._T0` — this process's start, in epoch seconds.
@@ -121,6 +126,81 @@ export function withStdoutSwallowed(fn) {
   }
 }
 
+/** A manifest's `rel`, spelled the way the expected snapshot keys it. */
+const posixRel = (rel) => rel.split('\\').join('/');
+
+/**
+ * Render the `expected` tree for `host` at `axes` into a temp dir and SNAPSHOT it — every file,
+ * not only the owned ones, because a rel the DEPLOYED manifest claims is looked up here too and
+ * its presence decides "edited" against "added". The temp dir is gone before this returns.
+ *
+ * The one place a render depends on WHERE it is installed: a global Bob emit writes each
+ * folder skill's absolute directory into its SKILL.md (see `writeNativeLayer`), so the
+ * reference render names the temp tree. Mapped back to the deployed dir here, or every such
+ * skill reads as edited. A deployment that has since MOVED still differs, and that is real
+ * drift — its skills point at a directory that is no longer theirs. A side-file pointer (and a
+ * global OpenCode command's) spells the same directory `/`-separated, so that spelling is
+ * mapped too.
+ */
+function renderExpected(host, axes, deployedDir) {
+  const tmp = mkdtempSync(path.join(os.tmpdir(), 'geneseed-diff-'));
+  try {
+    const expected = path.join(tmp, 'expected');
+    withStdoutSwallowed(() => emitGlobalInto(host, {
+      ...axes, out: path.join(tmp, 'bundle'), cfgDir: expected,
+    }));
+    const posix = (p) => p.split(path.sep).join('/');
+    const texts = new Map();
+    for (const p of rglobFiles(expected)) {
+      texts.set(relPosix(expected, p), readText(p).split(expected).join(deployedDir)
+        .split(posix(expected)).join(posix(deployedDir)));
+    }
+    return { owned: ownedSet(expected), texts };
+  } finally {
+    // `tempfile.TemporaryDirectory()`'s cleanup, which runs on the exception path too.
+    rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+/**
+ * A memo for `diffCollect`'s `expected` render — opt-in, so `geneseed diff` and every other
+ * caller still renders afresh. The web console passes one: `/api/overview` and `/api/fleet`
+ * both diff the selected install on every refresh, and the render is ~0.6 s of each.
+ *
+ * ONLY THE RENDER IS MEMOISED, NEVER THE RESULT: the compare against the deployed tree runs on
+ * every call, because catching a hand edit there is the whole point of the drift figure.
+ * One entry per deployed dir, at most `cap` of them (least recently used goes first); `renders`
+ * counts real renders, for the tests.
+ */
+export function renderMemo(cap = 4) {
+  return { cap, renders: 0, entries: new Map() };
+}
+
+/**
+ * The memoised `renderExpected`. The key is everything the render reads: the source
+ * fingerprint, the two render inputs it does not hash (`harness.config.json` and the
+ * orchestrator agent), the host and every axis. A deployed dir whose key changed is
+ * re-rendered in place, and a fingerprint change drops every entry from the old source.
+ */
+function memoExpected(memo, host, axes, deployedDir, sourceFp) {
+  const fp = sourceFp ?? sourceFingerprint(makeCfg());
+  const extra = createHash('sha256');
+  for (const p of [CONFIG, PRIMARY_AGENT_SRC]) extra.update(`${readMaybe(p) ?? ''}\0`);
+  const key = JSON.stringify([fp, extra.digest('hex'), host, axes]);
+  const hit = memo.entries.get(deployedDir);
+  memo.entries.delete(deployedDir);
+  if (hit && hit.key === key) {
+    memo.entries.set(deployedDir, hit);
+    return hit.exp;
+  }
+  for (const [d, e] of memo.entries) if (e.fp !== fp) memo.entries.delete(d);
+  const exp = renderExpected(host, axes, deployedDir);
+  memo.renders += 1;
+  memo.entries.set(deployedDir, { key, fp, exp });
+  while (memo.entries.size > memo.cap) memo.entries.delete(memo.entries.keys().next().value);
+  return exp;
+}
+
 /**
  * `_harness_diff._diff_collect` — returns `{target, theme, files}`, with `files === null` for
  * "nothing to compare here".
@@ -140,7 +220,9 @@ export function withStdoutSwallowed(fn) {
  * choice, which is the same defect with teeth. `rebuild-all` never had it: it reads
  * `postureOfDir`/`modeOfDir` per install root, and this now asks the same two questions.
  */
-export function diffCollect({ target = null, theme = null, emit = null, footprint = null } = {}) {
+export function diffCollect({
+  target = null, theme = null, emit = null, footprint = null, memo = null, sourceFp = null,
+} = {}) {
   // `Path(target).expanduser()` — expanded and NOT resolved, which is the opposite of
   // `cmd_version`'s `.expanduser().resolve()` two files over. It is observable: `target` is
   // printed on the summary line, so `--target .` reports `.` here and an absolute path
@@ -165,69 +247,58 @@ export function diffCollect({ target = null, theme = null, emit = null, footprin
 
   const fp = footprint || footprintOfDir(dir);
 
+  // Every input the render reads off the deployment, in ONE object: it is what the render is
+  // called with AND what the memo keys on, so the two cannot drift apart.
+  const axes = {
+    theme: themeName, footprint: fp,
+    // The third register read off the deployment, for the same reason as the other two: an
+    // install built with `--doctrines craft` compared against an `expected` rendered at all
+    // four reports its entire doctrines section — and its `Active packs:` line — as drift.
+    // `null` (no marker) means unknown and renders at all four, which `doctrinesForBuild`
+    // makes explicit rather than leaving to `makeCfg`'s parameter default two layers down.
+    posture: postureOfDir(dir), mode: modeOfDir(dir), doctrines: doctrinesForBuild(dir),
+    // The loop skill's preset, or its `Default trust preset:` line reads as edited.
+    trust: trustOfDir(dir, host),
+    // The excluded rules, or an install built `--exclude-rules "process 5"` reads its
+    // carrier as drift: `expected` would re-state the rule the deployment took away.
+    excludeRules: excludedRulesOfDir(dir),
+    // The excluded skills, or every skill the install left out reads as deleted.
+    excludeSkills: excludedSkillsOfDir(dir),
+    // The gate switches, or a disarmed install reads its `<gate>: off` line as drift.
+    ...gatesOfDir(dir),
+  };
+  const deployedDir = resolvePath(dir);
+  const exp = memo
+    ? memoExpected(memo, host, axes, deployedDir, sourceFp)
+    : renderExpected(host, axes, deployedDir);
+
   const files = [];
-  const tmp = mkdtempSync(path.join(os.tmpdir(), 'geneseed-diff-'));
-  try {
-    const expected = path.join(tmp, 'expected');
-    withStdoutSwallowed(() => emitGlobalInto(host, {
-      theme: themeName, out: path.join(tmp, 'bundle'), cfgDir: expected, footprint: fp,
-      // The third register read off the deployment, for the same reason as the other two: an
-      // install built with `--doctrines craft` compared against an `expected` rendered at all
-      // four reports its entire doctrines section — and its `Active packs:` line — as drift.
-      // `null` (no marker) means unknown and renders at all four, which `doctrinesForBuild`
-      // makes explicit rather than leaving to `makeCfg`'s parameter default two layers down.
-      posture: postureOfDir(dir), mode: modeOfDir(dir), doctrines: doctrinesForBuild(dir),
-      // The loop skill's preset, or its `Default trust preset:` line reads as edited.
-      trust: trustOfDir(dir, host),
-      // The excluded rules, or an install built `--exclude-rules "process 5"` reads its
-      // carrier as drift: `expected` would re-state the rule the deployment took away.
-      excludeRules: excludedRulesOfDir(dir),
-      // The excluded skills, or every skill the install left out reads as deleted.
-      excludeSkills: excludedSkillsOfDir(dir),
-      // The gate switches, or a disarmed install reads its `<gate>: off` line as drift.
-      ...gatesOfDir(dir),
-    }));
-    // The one place a render depends on WHERE it is installed: a global Bob emit writes each
-    // folder skill's absolute directory into its SKILL.md (see `writeNativeLayer`), so the
-    // reference render names the temp tree. Mapped back to the deployed dir before comparing,
-    // or every such skill reads as edited. A deployment that has since MOVED still differs,
-    // and that is real drift — its skills point at a directory that is no longer theirs.
-    // A side-file pointer (and a global OpenCode command's) spells the same directory
-    // `/`-separated, so that spelling is mapped too.
-    const deployedDir = resolvePath(dir);
-    const posix = (p) => p.split(path.sep).join('/');
-    const rels = [...new Set([...ownedSet(dir), ...ownedSet(expected)])].sort();
-    for (const rel of rels) {
-      const a = path.join(dir, rel);
-      const b = path.join(expected, rel);
-      if (isFile(a) && isFile(b)) {
-        // `read_text(errors="replace")` — Node's utf8 decoder substitutes U+FFFD for the
-        // same bytes, and `readText` folds the line endings the way `Path.read_text` does.
-        const ta = readText(a);
-        const tb = readText(b).split(expected).join(deployedDir)
-          .split(posix(expected)).join(posix(deployedDir));
-        if (cmpKey(rel, ta) !== cmpKey(rel, tb)) {
-          const diff = unifiedDiff(splitLines(tb), splitLines(ta), {
-            fromfile: `source/${rel}`, tofile: `deployed/${rel}`, lineterm: '',
-          });
-          files.push({ rel, status: 'edited', diff });
-        }
-      } else if (isFile(a)) {
-        const body = splitLines(readText(a));
-        files.push({
-          rel,
-          status: 'added',
-          diff: ['(only in deployed — your addition)', '', ...body.map((ln) => `+${ln}`)],
-        });
-      } else {
-        files.push({
-          rel, status: 'missing', diff: ['(in source, not deployed — re-emit to add)'],
+  const rels = [...new Set([...ownedSet(dir), ...exp.owned])].sort();
+  for (const rel of rels) {
+    const a = path.join(dir, rel);
+    const tb = exp.texts.get(posixRel(rel));
+    if (isFile(a) && tb !== undefined) {
+      // `read_text(errors="replace")` — Node's utf8 decoder substitutes U+FFFD for the
+      // same bytes, and `readText` folds the line endings the way `Path.read_text` does.
+      const ta = readText(a);
+      if (cmpKey(rel, ta) !== cmpKey(rel, tb)) {
+        const diff = unifiedDiff(splitLines(tb), splitLines(ta), {
+          fromfile: `source/${rel}`, tofile: `deployed/${rel}`, lineterm: '',
         });
+        files.push({ rel, status: 'edited', diff });
       }
+    } else if (isFile(a)) {
+      const body = splitLines(readText(a));
+      files.push({
+        rel,
+        status: 'added',
+        diff: ['(only in deployed — your addition)', '', ...body.map((ln) => `+${ln}`)],
+      });
+    } else {
+      files.push({
+        rel, status: 'missing', diff: ['(in source, not deployed — re-emit to add)'],
+      });
     }
-  } finally {
-    // `tempfile.TemporaryDirectory()`'s cleanup, which runs on the exception path too.
-    rmSync(tmp, { recursive: true, force: true });
   }
   // Already sorted by `rel` above; the Python sorts again after the loop and so does this,
   // because the two sorts are over different things — that one is over the RECORDS, and a

package/js/inspect/validate.mjs

@@ -130,8 +130,8 @@ export function cmdValidate(args) {
     const opts = {
       theme: args.theme, footprint: args.footprint, posture: args.posture, mode: args.mode,
       trust: args.trust, doctrines: args.doctrines, excludeRules: args.excludeRules,
-      excludeSkills: args.excludeSkills, deletionGate: args.noDeletionGate ? false : null,
-      secretsGate: args.noSecretsGate ? false : null, doneGate: args.noDoneGate ? false : null,
+      excludeSkills: args.excludeSkills,
+      ...Object.fromEntries(GATE_SWITCHES.map((g) => [g.key, args[g.arg] ? false : null])),
     };
     let scanDirs;
     try {

package/js/lib/fs.mjs

@@ -29,8 +29,32 @@
  */
 import {
   appendFileSync, writeFileSync, readFileSync, copyFileSync, statSync, utimesSync,
+  openSync, fstatSync, readSync, closeSync,
 } from 'node:fs';
 import { EOL } from 'node:os';
+import { resolve } from 'node:path';
+
+/**
+ * What `writeText` wrote while an emit has armed this (`withWriteRecord` below, around the
+ * three manifest-writing emits in `js/build/driver.mjs`): resolved path ->
+ * `{ text, size, mtimeMs }`, the translated text and a stat taken right after the write.
+ * `ownedHashes` (`js/hosts/owned.mjs`) hashes that text instead of reading the file back —
+ * the read-back was ~25% of `doctor --all` — and only while the file's size and mtime still
+ * match, so a later rewrite by any writer that does not record (a raw `writeFileSync`, a
+ * rename) falls back to the read. `copyFile` and `appendText` drop the entry outright.
+ * `null`, the default, records nothing: no other caller pays the stat or retains the text.
+ */
+export const textWrites = { map: null };
+
+/**
+ * Run one emit with `textWrites` armed, and disarm it on EVERY exit: an emit that throws inside
+ * a long-lived process (the web daemon emits in-process) would otherwise leave every later
+ * `writeText` paying a stat and keeping its text in memory.
+ */
+export function withWriteRecord(fn) {
+  textWrites.map = new Map();
+  try { return fn(); } finally { textWrites.map = null; }
+}
 /**
  * `Path.write_text(text, encoding="utf-8")`.
  *
@@ -49,7 +73,12 @@ import { EOL } from 'node:os';
  * The same vendored skill folder can contain files from both categories.
  */
 export function writeText(path, text) {
-  writeFileSync(path, EOL === '\n' ? text : text.replaceAll('\n', EOL), 'utf8');
+  const out = EOL === '\n' ? text : text.replaceAll('\n', EOL);
+  writeFileSync(path, out, 'utf8');
+  if (textWrites.map) {
+    const st = statSync(path);
+    textWrites.map.set(resolve(path), { text: out, size: st.size, mtimeMs: st.mtimeMs });
+  }
 }
 
 /**
@@ -62,6 +91,7 @@ export function writeText(path, text) {
  * invisible in an editor and a whole-file difference to the gate.
  */
 export function appendText(path, text) {
+  textWrites.map?.delete(resolve(path));
   appendFileSync(path, EOL === '\n' ? text : text.replaceAll('\n', EOL), 'utf8');
 }
 
@@ -79,6 +109,46 @@ export function readText(path) {
   return readFileSync(path, 'utf8').replaceAll('\r\n', '\n').replaceAll('\r', '\n');
 }
 
+/**
+ * The last `bytes` of a file, decoded as `readText` decodes it, and the byte offset the window
+ * began at (0: the whole file). A window that starts mid-line drops that partial line, cut at a
+ * newline BYTE before decoding — so a multibyte character the window split falls in the dropped
+ * part, and a `\r\n` split between its two bytes leaves only an empty line. One byte before the
+ * window is read too, so a window that starts exactly on a line keeps it. Throws as
+ * `readFileSync` does (missing, unreadable, a directory).
+ */
+export function readTail(path, bytes) {
+  const fd = openSync(path, 'r');
+  try {
+    const st = fstatSync(fd);
+    // Windows opens a directory without complaint and reports size 0: refuse it as readFileSync does.
+    if (st.isDirectory()) {
+      throw Object.assign(new Error(`EISDIR: illegal operation on a directory, read '${path}'`),
+        { code: 'EISDIR' });
+    }
+    const size = st.size;
+    const start = Math.max(0, size - bytes);
+    const from = start > 0 ? start - 1 : 0;
+    const buf = Buffer.alloc(size - from);
+    let got = 0;
+    while (got < buf.length) {
+      const n = readSync(fd, buf, got, buf.length - got, from + got);
+      if (!n) break;
+      got += n;
+    }
+    let cut = 0;
+    if (start > 0) {
+      const read = buf.subarray(0, got);
+      const ends = [read.indexOf(0x0a), read.indexOf(0x0d)].filter((i) => i !== -1);
+      cut = ends.length ? Math.min(...ends) + 1 : got;   // no line end: nothing whole to decode
+    }
+    const text = buf.toString('utf8', cut, got).replaceAll('\r\n', '\n').replaceAll('\r', '\n');
+    return { text, start };
+  } finally {
+    closeSync(fd);
+  }
+}
+
 /**
  * `shutil.copy2(src, dest)`.
  *
@@ -94,6 +164,7 @@ export function readText(path) {
  * mode the Python side has and nothing depends on. Mode is not copied here.
  */
 export function copyFile(src, dest) {
+  textWrites.map?.delete(resolve(dest));
   copyFileSync(src, dest);
   const st = statSync(src);
   utimesSync(dest, st.atime, st.mtime);
@@ -216,7 +287,7 @@ export function withPlatformNewlines(fn) {
  */
 const NOT_THERE = new Set(['ENOENT', 'ENOTDIR', 'ELOOP', 'EBADF']);
 
-function statOrNull(p) {
+export function statOrNull(p) {
   try {
     return statSync(p);
   } catch (e) {

package/js/maintain/setup.mjs

@@ -46,13 +46,13 @@ import path from 'node:path';
 
 import { main as driverMain, resolveOut } from '../build/driver.mjs';
 import { playLine } from '../ui/anim.mjs';
-import { discoverNames, PACK_ORDER } from '../build/source.mjs';
+import { discoverNames, GATE_SWITCHES, PACK_ORDER } from '../build/source.mjs';
 import { exportImprovements } from '../inspect/diff.mjs';
 import { cmdDoctor } from '../inspect/doctor.mjs';
 import { setupBuildArgs } from '../build/generate.mjs';
 import { GLOBAL_MANIFEST, HOSTS, opencodeConfigDir } from '../hosts/hosts.mjs';
 import {
-  claudeCfg, defaultMode, defaultPosture, defaultTheme, EMIT_HOST_SCOPE, installedDefaults,
+  claudeCfg, defaultMode, defaultPosture, defaultTheme, EMIT_HOST_SCOPE, gatesOfDir, installedDefaults,
   readJsonMaybe, themeFiles,
 } from '../hosts/installs.mjs';
 import { printOut, printErr } from '../lib/fs.mjs';
@@ -242,6 +242,24 @@ function askDoctrines(deployed = null) {
  * whole, `null` included, because `askDoctrines` distinguishes "no carrier said" from "a
  * carrier said none" and the two open the question differently.
  */
+/**
+ * The gate switches of the one install a setup answer re-runs: the chosen emit's global config
+ * dir, or the project/bundle root it names. Never another host's install — carrying its `off`
+ * across would disarm a gate nobody switched off here. FAILS CLOSED: no install there, or a dir
+ * that cannot be resolved, reads as all armed (`gatesOfDir` already fails closed per line).
+ */
+function targetGates(emit, out) {
+  const [host, scope] = EMIT_HOST_SCOPE.get(emit) ?? [];
+  try {
+    if (!host) return gatesOfDir(resolveOut(out || 'Harness'));
+    const dir = scope === 'global'
+      ? HOSTS.find((h) => h.host === host).configDir() : resolveOut(out || '.');
+    return gatesOfDir(dir, host);
+  } catch {
+    return Object.fromEntries(GATE_SWITCHES.map((g) => [g.key, true]));
+  }
+}
+
 export function collectSetupLines() {
   printOut('Geneseed setup — answer a few questions; nothing is written until you confirm.\n');
   const inst = installedDefaults();
@@ -279,14 +297,20 @@ export function collectSetupLines() {
   const excludeRules = inst.excludeRules?.length ? inst.excludeRules : null;
   // Skills left out are preserved the same way, and elide when there are none.
   const excludeSkills = inst.excludeSkills?.length ? inst.excludeSkills : null;
+  // The gate switches too: a re-run that dropped them would re-arm every gate its owner switched
+  // off. Read off the install THIS answer targets, never the machine walk above (`targetGates`).
+  // `setupBuildArgs` elides an armed gate, so an all-armed install prints what it always did.
+  const gates = targetGates(emit, out);
+  const gated = Object.values(gates).some((on) => on === false);
   printOut(`\nAbout to run:  geneseed build ${
     setupBuildArgs(theme, emit, out, root, footprint, posture, mode, doctrines, allPacks,
-      excludeRules, undefined, excludeSkills).join(' ')}\n`);
+      excludeRules, undefined, excludeSkills, gates).join(' ')}\n`);
   if (!confirm('Proceed?', true)) return null;
-  // The key only when there is something to carry, so a selection that excludes no skill is
-  // the same object it was before the flag existed.
+  // The key only when there is something to carry, so a selection that excludes no skill and
+  // switches off no gate is the same object it was before either existed.
   return {
     theme, posture, mode, doctrines, excludeRules, ...(excludeSkills ? { excludeSkills } : {}),
+    ...(gated ? { gates } : {}),
     emit, out, root, footprint,
   };
 }
@@ -470,7 +494,7 @@ export function setupLines() {
   }
   const {
     theme, emit, out, root, footprint = 'lean', posture = 'peer', mode = 'direct',
-    doctrines = null, excludeRules = null, excludeSkills = null,
+    doctrines = null, excludeRules = null, excludeSkills = null, gates = {},
   } = sel;
   if (emit === 'opencode-global') {
     // The build below overwrites the deployed global harness, and the self-improvement loops
@@ -489,7 +513,7 @@ export function setupLines() {
   // runs must carry the pack selection the plan line just previewed, or the wizard would print
   // one command and run another.
   const argv = setupBuildArgs(theme, emit, out, root, footprint, posture, mode, doctrines,
-    doctrineOptions().map(([n]) => n), excludeRules, undefined, excludeSkills);
+    doctrineOptions().map(([n]) => n), excludeRules, undefined, excludeSkills, gates);
   printOut(`Running:  geneseed build ${argv.join(' ')}\n`);
   const rc = driverMain(argv);
   if (rc !== 0) {

package/js/maintain/uninstall.mjs

@@ -1179,7 +1179,7 @@ function remergeClaudeHooks(cfg, root = cfg, host = 'claude') {
   const gates = Object.fromEntries(Object.keys(atRoot).map((k) => [k, atRoot[k] && atCfg[k]]));
   const [, claims] = mergeClaudeSettings(settingsFile(cfg, managed),
     managed.settings_hooks ?? null, hookRunnerEntry(), doctrines, excluded, host, cfg,
-    gates.deletionGate, gates);
+    gates);
   // `and data` — a manifest that did not parse is not one to write back.
   if (!deepEquals(claims, managed.settings_hooks ?? null) && Object.keys(data).length > 0) {
     managed.settings_hooks = claims;

package/js/maintain/update.mjs

@@ -632,7 +632,7 @@ export async function installAxes(dir, { installProfile, setupBuildArgs }, notif
   if (legacyProcessCarrierOfDir(String(dir), 'opencode')) return null;
   const p = installProfile('opencode', 'global', String(dir), notify);
   return setupBuildArgs('', 'files', null, null, p.footprint, p.posture, p.mode, p.doctrines,
-    undefined, p.excludeRules, p.trust, p.excludeSkills, p.deletionGate, p).slice(4);
+    undefined, p.excludeRules, p.trust, p.excludeSkills, p).slice(4);
 }
 
 /**

package/js/web/actions.mjs

@@ -38,7 +38,7 @@ import {
 } from '../build/source.mjs';
 import { withStdoutSwallowed } from '../inspect/diff.mjs';
 import { excludeAdd, excludeRemove } from '../inspect/excludes.mjs';
-import { setupBuildArgs } from '../build/generate.mjs';
+import { installProfile, setupBuildArgs } from '../build/generate.mjs';
 import { DEFAULT_PRESET, PRESETS } from '../loop/score.mjs';
 import { activeLoops, setLoopPreset } from '../loop/registry.mjs';
 import {
@@ -61,6 +61,7 @@ import { stripWhitespace } from '../lib/text.mjs';
 import { memoryDelete } from '../maintain/memory.mjs';
 import { installDeactivate, installReactivate, installUninstall } from '../maintain/uninstall.mjs';
 import { emitChoices, themeChoices, viewCfg } from './api.mjs';
+import { actionCommands } from './jobs.mjs';
 import { NotFound, deployed, memoryDir } from './catalog.mjs';
 
 /** One body field, `dflt` when the body is not an object or does not carry the key. */
@@ -439,6 +440,38 @@ export function buildOverride(state, body) {
   return [themes.has(t) ? t : state.theme, emits.has(e) ? e : state.emit];
 }
 
+/**
+ * The job steps for a Build POST.
+ *
+ * A DEPLOYED INSTALL REBUILT IN ITS OWN EMIT TAKES THE ARGV ITS PROFILE OWNS (`installProfile`,
+ * the one reader `rebuild-all`, `status` and `upgrade` share), with only the theme the picker
+ * chose swapped in. This path used to re-assemble the axes it happened to carry — no gate
+ * switches, `--exclude-rules none`, no excluded skills — so a console Build silently re-armed
+ * every switched-off gate and handed back every rule and skill its owner had left out.
+ *
+ * Nothing deployed (the first-deploy Onboarding form) or a re-target to another emit has no
+ * install of that emit to honour — a re-target is a FRESH target, by decision (2026-10-18), so it
+ * deliberately carries none of this install's switches or exclusions — and keeps the defaults it
+ * always had: footprint, posture
+ * and mode off the viewed dir, and ALL packs when unknown — never `harness.config.json`, which
+ * would drop the consent gate.
+ */
+export function buildActionCmds(state, body) {
+  const [theme, emit] = buildOverride(state, body);
+  const [host, scope] = EMIT_HOST_SCOPE.get(state.emit || '') ?? [];
+  if (host && deployed(state) && emit === state.emit) {
+    // `setupBuildArgs` always leads with `--theme <theme>`, so the swap is the head alone.
+    // `state.root`, not `target`: a project install's markers live at the repo root.
+    const [, , ...rest] = installProfile(host, scope, state.root).argv;
+    return actionCommands('build', { buildArgv: ['--theme', theme, ...rest] });
+  }
+  return actionCommands('build', {
+    theme, emit, footprint: state.footprint, posture: state.posture, mode: state.mode,
+    trust: state.trust,
+    doctrines: doctrinesForBuild(state.target),
+  });
+}
+
 /**
  * The global emit matching a deployed install's `.geneseed-emit`, so the EXPECTED render
  * uses the install's own host dialect.
@@ -595,7 +628,7 @@ export function apiInstallCmd(state, body) {
   const gates = bodyGates(body, root, host);
   const out = scope === 'global' ? null : String(root);
   const argv = setupBuildArgs(theme || 'neutral', emit, out, out, fp, pos, mode, doctrines,
-    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root, host), gates.deletionGate, gates);
+    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root, host), gates);
   return { cmd: [process.execPath, path.join(ROOT, 'bin', 'build-driver.mjs'), ...argv] };
 }
 
@@ -697,6 +730,6 @@ export function apiDeployCmd(state, body) {
   const gates = bodyGates(body, root, host);
   // project-scope emit name == host name (opencode / claude / bob / openclaude)
   const argv = setupBuildArgs(theme || 'neutral', host, root, root, fp, pos, mode, doctrines,
-    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root, host), gates.deletionGate, gates);
+    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root, host), gates);
   return { cmd: [process.execPath, path.join(ROOT, 'bin', 'build-driver.mjs'), ...argv] };
 }

package/js/web/api.mjs

@@ -15,7 +15,7 @@ import { CONFIG, ROOT, THEMES, discoverNames, makeCfg } from '../build/source.mj
 import { readVersion, sourceFingerprint } from '../build/version.mjs';
 import { sourceReleaseVersion } from '../hosts/opencode.mjs';
 import { alwaysOnCost } from '../inspect/cost.mjs';
-import { diffCollect } from '../inspect/diff.mjs';
+import { diffCollect, renderMemo } from '../inspect/diff.mjs';
 import { excludesSnapshot } from '../inspect/excludes.mjs';
 import { CLAUDE_STYLE, HOSTS, VERSION_MARKER, resolvePath } from '../hosts/hosts.mjs';
 import {
@@ -130,6 +130,12 @@ export function* activeInstalls(targets) {
   }
 }
 
+/**
+ * The state's memo of `expected` renders, made on first use: overview and fleet diff the same
+ * install on every refresh, and only the compare has to run again (see `renderMemo`).
+ */
+const memoOf = (state) => (state.renderMemo ??= renderMemo());
+
 /** The edited/added/missing tally of a `diffCollect` file list. */
 const driftCounts = (files) => ({
   edited: files.filter((f) => f.status === 'edited').length,
@@ -179,8 +185,9 @@ export function apiInstalls(state) {
  *
  * Its own route, not more fields on `/api/installs`: the sidebar refetches that list on every
  * data revision, and the drift check below re-renders a whole emit per global install.
- * ponytail: one `diffCollect` render per global install per request, fine for the handful a
- * machine carries; cache per (root, build mtime) if a fleet ever grows past that.
+ * Each global install's `expected` render is memoised on the state (`renderMemo`, keyed on the
+ * source fingerprint computed once per request and every axis), so a refresh re-runs only the
+ * compare; the memo holds a handful of installs, enough for any machine seen so far.
  *
  * Each row reads ITS OWN `.geneseed-version`. `statusData().installed_fp` is the first carrier
  * a fixed walk finds, which describes the wrong install as soon as two hosts are deployed.
@@ -197,7 +204,7 @@ export function apiFleet(state) {
     let drift = null;
     if (st === 'active') {
       try {
-        const { files } = diffCollect({ target: dir });
+        const { files } = diffCollect({ target: dir, memo: memoOf(state), sourceFp });
         if (files !== null) drift = driftCounts(files);
       } catch { /* an install that cannot be re-rendered reports no drift figure, not zero */ }
     }
@@ -226,7 +233,7 @@ export function apiOverview(state) {
   let diff = null;
   if (deployed(state)) {
     const { files } = diffCollect({
-      target: state.target, theme: state.theme, emit: state.emit });
+      target: state.target, theme: state.theme, emit: state.emit, memo: memoOf(state) });
     if (files !== null) diff = driftCounts(files);
   }
   let buildTime = null;

package/js/web/handler.mjs

@@ -11,11 +11,10 @@
  * declared next door in `routes.mjs`; the daemon that starts it is in `daemon.mjs`.
  */
 import { resolvePath } from '../hosts/hosts.mjs';
-import { doctrinesForBuild } from '../hosts/installs.mjs';
 import { isTruthy, jsonDumpsCompact } from '../lib/json.mjs';
 import { parseIntStrict, percentDecode } from '../lib/text.mjs';
 import { preflight } from '../maintain/update.mjs';
-import { apiDeployCmd, apiInstallCmd, apiPickFolder, apiRestore, buildOverride, mcpTargetPaths } from './actions.mjs';
+import { apiDeployCmd, apiInstallCmd, apiPickFolder, apiRestore, buildActionCmds, mcpTargetPaths } from './actions.mjs';
 import { NotFound } from './catalog.mjs';
 import { openUrl, requestRestart } from './daemon.mjs';
 import { apiDocs, apiDocsPage } from './docs.mjs';
@@ -301,20 +300,9 @@ export function makeHandler(state, jm, token, dist, holder = null) {
       if (jid === null) return sendJson(res, { error: 'busy' }, 409, ae);
       return sendJson(res, { job_id: jid }, 202, ae);
     }
-    // Build can be re-themed/re-targeted from the UI picker; the other actions self-resolve
-    // the deployed theme downstream. Footprint, posture and mode always follow the current
-    // install, so a re-theme preserves lean/full, the register and the operating mode.
-    const [theme, emit] = action === 'build'
-      ? buildOverride(state, body) : [state.theme, state.emit];
-    // The pack selection follows the install like footprint/posture/mode, and is read here
-    // rather than left to the table's default: a console Build must re-emit the constitution
-    // the deployment already carries. Unknown (no `Active packs:` marker) resolves to ALL
-    // packs — never to `harness.config.json`, which would drop the consent gate.
-    const cmds = actionCommands(action, {
-      theme, emit, footprint: state.footprint, posture: state.posture, mode: state.mode,
-      trust: state.trust,
-      doctrines: doctrinesForBuild(state.target),
-    });
+    // Build resolves its argv off the install (`buildActionCmds`); the other actions take no
+    // axes and self-resolve the deployed theme downstream.
+    const cmds = action === 'build' ? buildActionCmds(state, body) : actionCommands(action);
     if (!isTruthy(cmds)) {
       return sendJson(res, { error: `unknown action ${action}` }, 404, ae);
     }

package/js/web/jobs.mjs

@@ -421,14 +421,16 @@ export const INLINE_ACTIONS = ['restore', 'install', 'deploy'];
  * `harness.config.json` exactly as the pack list does, so `{"excludeRules":["process.5"]}`
  * there would take the consent gate out of a console Build that never asked for it. `[]` is
  * spelled `--exclude-rules none` and says "exclude nothing" out loud.
+ *
+ * `buildArgv`, when given, is used whole and the axes above are ignored: it is the argv a
+ * deployed install's profile owns (`buildActionCmds`), switches and exclusions included.
  */
 function actionTable({
   theme = 'neutral', emit = 'opencode-global', footprint = 'full',
   posture = 'peer', mode = 'direct', doctrines = [...PACK_ORDER], excludeRules = [],
-  trust = DEFAULT_PRESET,
+  trust = DEFAULT_PRESET, buildArgv = setupBuildArgs(theme, emit, null, null, footprint, posture,
+    mode, doctrines, PACK_ORDER, excludeRules, trust),
 } = {}) {
-  const buildArgv = setupBuildArgs(theme, emit, null, null, footprint, posture, mode,
-    doctrines, PACK_ORDER, excludeRules, trust);
   return {
     doctor: [[NODE(), CLI(), 'doctor']],
     build: [[NODE(), GEN(), ...buildArgv]],