geneseed 4.9.1 → 4.9.3

package/js/build/driver.mjs

@@ -40,7 +40,7 @@ import { emitClaudeRender } from './emit-claude.mjs';
 import { emitOpencodeRender, emitOpencodeGlobalRender } from './emit-opencode.mjs';
 import { settingsIntegrityCheck } from '../hosts/settings.mjs';
 import { hookRunnerEntry } from '../hosts/shim.mjs';
-import { writeText, withPlatformNewlines, isFile } from '../lib/fs.mjs';
+import { writeText, withPlatformNewlines, isFile, withWriteRecord } from '../lib/fs.mjs';
 import { parseJson, jsonDumpsIndent } from '../lib/json.mjs';
 import { relPosix } from '../lib/text.mjs';
 // P5c moved these out of this file: `bin/geneseed-cli.mjs` needs the same four resolvers to
@@ -58,7 +58,7 @@ import {
 // status` renders to count, so `bin/geneseed-cli.mjs` needs the same checkout paths and the
 // same cfg. golden.py's 259 cells all build one, which is what made the move safe.
 import {
-  ROOT, makeCfg,
+  GATE_SWITCHES, ROOT, makeCfg,
 } from './source.mjs';
 
 // P5f moved these, for the same arithmetic a third time: `harness rebuild-all` reads the
@@ -75,8 +75,11 @@ import { configDefaults, die, parseArgs } from './args.mjs';
 export { parseDriverArgs } from './args.mjs';
 
 
-/** `_build_emit.PRIMARY_AGENT_SRC`. */
-const PRIMARY_AGENT_SRC = path.join(ROOT, 'adapters', 'opencode', 'agents', 'orchestrator.md');
+/**
+ * `_build_emit.PRIMARY_AGENT_SRC`. Exported for `diffCollect`'s render memo: a render input
+ * `sourceFingerprint` does not hash, so the memo keys on its bytes itself.
+ */
+export const PRIMARY_AGENT_SRC = path.join(ROOT, 'adapters', 'opencode', 'agents', 'orchestrator.md');
 
 /** `_build_render.resolve_out` — absolute, or relative to the CURRENT WORKING DIRECTORY
  *  (not to ROOT), so the harness renders straight into any repository.
@@ -555,9 +558,9 @@ const claudeShaped = (name) => (cfg, args, out) => {
   const claudeMd = path.join(configDir || carrierInLayer ? cfgDir : root, carrier);
   const hookOpts = hookRunnerEntry();
   before?.();
-  const r = emitClaudeCore(cfg, args, {
+  const r = withWriteRecord(() => emitClaudeCore(cfg, args, {
     cfgDir, claudeMd, scope: configDir ? 'global' : 'project', host, out, hookOpts,
-  });
+  }));
   process.stdout.write(summary(root ?? cfgDir, r));
   return configDir ? cfgDir : undefined;
 };
@@ -604,7 +607,7 @@ function writeMarkers(markerDir, emit, footprint) {
  * but this argument would overwrite the live install `diff` is only reading.
  */
 const GLOBAL_EMITS = {
-  opencode: emitOpencodeGlobal,
+  opencode: (...a) => withWriteRecord(() => emitOpencodeGlobal(...a)),
   claude: claudeShaped('claude-global'),
   bob: claudeShaped('bob-global'),
   openclaude: claudeShaped('openclaude-global'),
@@ -633,7 +636,7 @@ const PROJECT_EMITS = {
   // P2. `opencode` joins the three for `cmdValidate`, which has to be able to render EVERY
   // `--emit` choice into its sandbox and not only the three doctor already scans. Its call
   // shape is the Claude-shaped emits' exactly — `(cfg, args, out)` — so the row is the whole change.
-  opencode: emitOpencode,
+  opencode: (...a) => withWriteRecord(() => emitOpencode(...a)),
 };
 
 /**
@@ -648,24 +651,21 @@ const PROJECT_EMITS = {
  * carry straight past the parameter default.
  */
 function axesCfg({
-  posture, mode, trust, doctrines, excludeRules, excludeSkills,
-  deletionGate = null, secretsGate = null, doneGate = null,
+  posture, mode, trust, doctrines, excludeRules, excludeSkills, ...gates
 }) {
   return makeCfg({
     ...(posture ? { posture } : {}), ...(mode ? { mode } : {}), ...(trust ? { trust } : {}),
     ...(doctrines ? { doctrines } : {}), ...(excludeRules ? { excludeRules } : {}),
     ...(excludeSkills ? { excludeSkills } : {}),
-    // Only an explicit `false` disarms; `null` (no opinion) keeps the gate.
-    ...(deletionGate === false ? { noDeletionGate: true } : {}),
-    ...(secretsGate === false ? { noSecretsGate: true } : {}),
-    ...(doneGate === false ? { noDoneGate: true } : {}),
+    // The gate switches (`GATE_SWITCHES` keys): only an explicit `false` disarms; `null` (no
+    // opinion) keeps the gate.
+    ...Object.fromEntries(GATE_SWITCHES.filter((g) => gates[g.key] === false).map((g) => [g.arg, true])),
   });
 }
 
 export function emitProjectInto(host, {
   theme, out, root, footprint = 'full', posture = null, mode = null, trust = null,
-  doctrines = null, excludeRules = null, excludeSkills = null, deletionGate = null,
-  secretsGate = null, doneGate = null,
+  doctrines = null, excludeRules = null, excludeSkills = null, ...gates
 }) {
   const emit = PROJECT_EMITS[host];
   // The axes ride the same rail into every `*Into`, and for the same reason: a drift reader
@@ -674,7 +674,7 @@ export function emitProjectInto(host, {
   // checked an all-packs render nobody asked for.
   return withPlatformNewlines(() => emit(
     axesCfg({
-      posture, mode, trust, doctrines, excludeRules, excludeSkills, deletionGate, secretsGate, doneGate }),
+      posture, mode, trust, doctrines, excludeRules, excludeSkills, ...gates }),
     { theme, footprint, root }, out,
   ));
 }
@@ -689,16 +689,16 @@ export function emitProjectInto(host, {
  */
 export function buildInto({
   theme, out, footprint = 'lean', posture = null, mode = null, trust = null, doctrines = null,
-  excludeRules = null, excludeSkills = null, deletionGate = null, secretsGate = null, doneGate = null,
+  excludeRules = null, excludeSkills = null, ...gates
 }) {
   return withPlatformNewlines(() => build(axesCfg({
-    posture, mode, trust, doctrines, excludeRules, excludeSkills, deletionGate, secretsGate, doneGate }),
+    posture, mode, trust, doctrines, excludeRules, excludeSkills, ...gates }),
     theme, out, { footprint, nativeCatalog: false }));
 }
 
 export function emitGlobalInto(host, {
   theme, out, cfgDir, footprint, posture = null, mode = null, doctrines = null, trust = null,
-  excludeRules = null, excludeSkills = null, deletionGate = null, secretsGate = null, doneGate = null,
+  excludeRules = null, excludeSkills = null, ...gates
 }) {
   // `build.HOSTS.get(host, build.HOSTS["opencode"])` — an unknown host falls back rather than
   // raising, because the host comes from a marker file a user can edit.
@@ -715,7 +715,7 @@ export function emitGlobalInto(host, {
   // the same scar the footprint left in `diffCollect`, one axis over each time.
   return withPlatformNewlines(() => emit(
     axesCfg({
-      posture, mode, trust, doctrines, excludeRules, excludeSkills, deletionGate, secretsGate, doneGate }),
+      posture, mode, trust, doctrines, excludeRules, excludeSkills, ...gates }),
     { theme, footprint, root: null, cfgDir }, out,
   ));
 }

package/js/build/emit-claude.mjs

@@ -182,7 +182,7 @@ export function emitClaudeRender(cfg, job) {
   // WIRE — see `claudeWire` below. One child per emit, so the two halves are two
   // functions rather than two spawns; the seam between them is a call, not a process.
   const managed = claudeWire(job, claudeMdText, agentText !== null, cfg.doctrines,
-    cfg.excludeRules, cfg.deletionGate, { secretsGate: cfg.secretsGate, doneGate: cfg.doneGate });
+    cfg.excludeRules, cfg);
 
   return {
     owned,
@@ -216,7 +216,7 @@ export function emitClaudeRender(cfg, job) {
  * always a string, so `''` is the only falsy value either language sees.
  */
 function claudeWire(job, claudeMdText, hasAgentText, doctrines = null, excludeRules = [],
-  deletionGate = true, gates = {}) {
+  gates = {}) {
   phaseLog('WIRE');
   const { cfgDir, claudeMd, scope, host, oldManaged, preambleExclude, hookOpts } = job;
   const old = oldManaged && typeof oldManaged === 'object' && !Array.isArray(oldManaged)
@@ -280,7 +280,7 @@ function claudeWire(job, claudeMdText, hasAgentText, doctrines = null, excludeRu
   // DECIDES the install's packs, so the marker on disk is still the previous build's.
   const [, managedHooks] = mergeClaudeSettings(
     settingsPath, oldSf === settingsName ? get(old, 'settings_hooks') : null, hookOpts,
-    doctrines, excludeRules, host, cfgDir, deletionGate, gates,
+    doctrines, excludeRules, host, cfgDir, gates,
   );
   managed.settings_hooks = managedHooks;
 

package/js/build/generate.mjs

@@ -141,8 +141,7 @@ export function cmdBuild(args) {
  */
 export function setupBuildArgs(theme, emit, out = null, root = null, footprint = 'lean',
   posture = 'peer', mode = 'direct', doctrines = null, allPacks = PACK_ORDER,
-  excludeRules = null, trust = DEFAULT_PRESET, excludeSkills = null, deletionGate = true,
-  { secretsGate = true, doneGate = true } = {}) {
+  excludeRules = null, trust = DEFAULT_PRESET, excludeSkills = null, gates = {}) {
   const argv = ['--theme', theme, '--emit', emit];
   if (!emit.endsWith('-global')) {
     if (out) argv.push('--out', out);
@@ -172,9 +171,9 @@ export function setupBuildArgs(theme, emit, out = null, root = null, footprint =
   if (excludeSkills?.length) argv.push('--exclude-skills', excludeSkills.join(','));
   // The gate switches elide when armed: the driver's default IS armed (no config key feeds
   // them), so only an explicit `false` speaks, and every armed argv stays the bytes it was.
+  // `gates` is one object keyed as `GATE_SWITCHES` keys it (`gatesOfDir`, a profile, a body).
   // Law order, so a Law IV-only install still ends on `--no-deletion-gate` as it did.
-  const gates = { secretsGate, doneGate, deletionGate };
-  for (const g of GATE_SWITCHES) if (gates[g.key] === false) argv.push(g.flag);
+  for (const g of GATE_SWITCHES) if (gates?.[g.key] === false) argv.push(g.flag);
   return argv;
 }
 
@@ -238,7 +237,7 @@ export function installProfile(host, scope, root, notify = null) {
   const gates = gatesOfDir(root, host);
   const out = scope === 'global' ? null : root;
   const argv = setupBuildArgs(theme, emit, out, out, footprint, posture, mode, doctrines,
-    PACK_ORDER, excludeRules, trust, excludeSkills, gates.deletionGate, gates);
+    PACK_ORDER, excludeRules, trust, excludeSkills, gates);
   // A GLOBAL ROW NAMES ITS OWN DIR. `root` came from the host's config-dir resolver, which
   // honours env overrides (`OPENCODE_CONFIG_DIR`, `CLAUDE_CONFIG_DIR`…); without the flag the
   // same argv run from a shell lacking that variable re-emits into the DEFAULT dir — a second

package/js/build/source.mjs

@@ -385,6 +385,19 @@ export function resolveSkillNames(names, {
   return { ids: [...new Set(ids)].sort(), notices, unknown };
 }
 
+/**
+ * The laws whose hook gate an install can switch off, in law order: the cfg/profile key, the
+ * build flag, the carrier marker (`<marker>: off`, written only when off) and the law. ONE
+ * table, so the flag, the marker, the rebuild argv, the read-back and `status` cannot drift
+ * apart. Every gate is ARMED by default and the law's text binds either way. The deletion row
+ * is #319's, unchanged: existing installs carry its flag and marker.
+ */
+export const GATE_SWITCHES = [
+  { key: 'secretsGate', flag: '--no-secrets-gate', arg: 'noSecretsGate', marker: 'Secrets gate', law: 'I' },
+  { key: 'doneGate', flag: '--no-done-gate', arg: 'noDoneGate', marker: 'Done gate', law: 'III' },
+  { key: 'deletionGate', flag: '--no-deletion-gate', arg: 'noDeletionGate', marker: 'Deletion gate', law: 'IV' },
+];
+
 /**
  * `_build_core.js_cfg()`, originated rather than received.
  *
@@ -399,8 +412,7 @@ export function resolveSkillNames(names, {
  */
 export function makeCfg({
   posture = 'peer', mode = 'direct', trust = DEFAULT_PRESET, doctrines = PACK_ORDER,
-  excludeRules = [], excludeSkills = [], noDeletionGate = false, noSecretsGate = false,
-  noDoneGate = false,
+  excludeRules = [], excludeSkills = [], ...switches
 } = {}) {
   return {
     root: ROOT,
@@ -428,25 +440,9 @@ export function makeCfg({
     excludeRules: Array.isArray(excludeRules) ? [...excludeRules] : [],
     // Skill names left out of this install — same "unspecified takes nothing away" default.
     excludeSkills: Array.isArray(excludeSkills) ? [...excludeSkills] : [],
-    // Law IV's deletion gate (`--no-deletion-gate`). Armed unless switched off in so many words:
-    // only a literal `true` disarms, so every caller that never heard of the switch keeps it.
-    deletionGate: noDeletionGate !== true,
-    // Law I's secret scan (`--no-secrets-gate`) and Law III's done gate (`--no-done-gate`), the
-    // same contract (user decision 2026-10-18; see GATE_SWITCHES).
-    secretsGate: noSecretsGate !== true,
-    doneGate: noDoneGate !== true,
+    // The gate switches (`GATE_SWITCHES`: `secretsGate`, `doneGate`, `deletionGate`), each armed
+    // unless its `no*` arg says so in so many words: only a literal `true` disarms, so every
+    // caller that never heard of a switch keeps the gate.
+    ...Object.fromEntries(GATE_SWITCHES.map((g) => [g.key, switches[g.arg] !== true])),
   };
 }
-
-/**
- * The laws whose hook gate an install can switch off, in law order: the cfg/profile key, the
- * build flag, the carrier marker (`<marker>: off`, written only when off) and the law. ONE
- * table, so the flag, the marker, the rebuild argv, the read-back and `status` cannot drift
- * apart. Every gate is ARMED by default and the law's text binds either way. The deletion row
- * is #319's, unchanged: existing installs carry its flag and marker.
- */
-export const GATE_SWITCHES = [
-  { key: 'secretsGate', flag: '--no-secrets-gate', arg: 'noSecretsGate', marker: 'Secrets gate', law: 'I' },
-  { key: 'doneGate', flag: '--no-done-gate', arg: 'noDoneGate', marker: 'Done gate', law: 'III' },
-  { key: 'deletionGate', flag: '--no-deletion-gate', arg: 'noDeletionGate', marker: 'Deletion gate', law: 'IV' },
-];

package/js/hosts/gitref.mjs

@@ -12,9 +12,11 @@
  * `child_process` ban like every other closure that feeds `bin/geneseed-cli.mjs` — may ever
  * import. A module that is fs/path only is importable from anywhere.
  *
- * The OpenCode guard plugin once kept a standalone twin of this for its `permission.ask`
- * loop exemption; upstream never calls that hook, so the twin was deleted (OpenCode verdict
- * I-2). This module has no copy to keep in step.
+ * The OpenCode guard plugin (`adapters/opencode/plugins/geneseed-guard.js`) is copied whole
+ * into an install and cannot import this, so it carries twins of `gitRootOf`, `gitDirOf`,
+ * `gitCommonDirOf`, `currentBranch`, `protectedBranches` and `stashExists` for its Law IV and
+ * protected-checks gates. `tests/plugins/guard.test.mjs` compares each with the original here;
+ * change one, change both.
  */
 import { existsSync, statSync, lstatSync, readFileSync, readdirSync, openSync, readSync, closeSync } from 'node:fs';
 import path from 'node:path';

package/js/hosts/hooks-done.mjs

@@ -28,6 +28,11 @@
  *     result is not `is_error` — every non-zero exit, denial and timeout carries it (checked on
  *     14 000+ real Claude Code results, 2026-10-17).
  *
+ * READ FROM THE END (constant-cost Stop). Only the current turn matters, so the transcript is read
+ * backward in growing windows (`tailReader`) until the turn's opening prompt is inside one; a
+ * turn longer than every window falls back to the whole file. Never judged on a truncated turn:
+ * a window without a prompt answers "read more", not "no edit".
+ *
  * At most one block per turn: `stop_hook_active` is true when this Stop follows a block, and the
  * gate then lets the turn end and leaves a ledger line, so a gate that cries wolf gets found.
  */
@@ -37,7 +42,7 @@ import { readText, printOut as out, printErr as err } from '../lib/fs.mjs';
 import { within } from '../lib/paths.mjs';
 import { gitRootOf } from './gitref.mjs';
 import { DONE_LIST, recordGate } from './hooks.mjs';
-import { splitLines } from './hooks-prims.mjs';
+import { splitLines, tailReader } from './hooks-prims.mjs';
 
 const EDIT_TOOLS = new Set(['Write', 'Edit', 'NotebookEdit', 'MultiEdit']);
 const SHELL_TOOLS = new Set(['Bash', 'PowerShell']);
@@ -102,18 +107,24 @@ function isPrompt(obj) {
 /**
  * The decision, over transcript TEXT: the checks that have not passed since the turn's last
  * edit, or [] when the turn may end (no edit, or every check passed after it). Exported for the
- * unit tier — a transcript is text no CLI cell can vary cheaply.
+ * unit tier — a transcript is text no CLI cell can vary cheaply. `whole` false means the text
+ * is only the file's tail: with no prompt in it the turn may start earlier, so the answer is
+ * null ("read more") — a turn judged from its middle could miss its edit and wrongly pass.
  */
-export function doneDecide(transcript, checks, root, cwd = root) {
+export function doneDecide(transcript, checks, root, cwd = root, whole = true) {
   const entries = [];
   for (const line of splitLines(transcript)) {
     if (!line.trim()) continue;
     try { entries.push(JSON.parse(line)); } catch { /* a torn last line is not evidence */ }
   }
-  let start = 0;
+  let start = -1;
   for (let i = entries.length - 1; i >= 0; i -= 1) {
     if (isPrompt(entries[i])) { start = i + 1; break; }
   }
+  if (start === -1) {
+    if (!whole) return null;
+    start = 0;
+  }
   const calls = [];                      // tool_use blocks, in order
   const results = new Map();             // tool_use_id -> is_error
   for (const obj of entries.slice(start)) {
@@ -147,9 +158,10 @@ export function doneDecide(transcript, checks, root, cwd = root) {
  * The Stop-side wrapper `cmdLearn` calls first. Returns true when it printed a block (the turn
  * goes on, so `learn` must not distil yet); false in every other case, with nothing on stdout.
  * `install` is the root `cmdLearn` already derived from `--memory` (null without one), so the
- * ledger lands in the same root its sovereignty check read.
+ * ledger lands in the same root its sovereignty check read. `read` is `cmdLearn`'s per-Stop
+ * transcript reader, so the distillation after an allow reuses the windows read here.
  */
-export function doneGate(meta, args, install) {
+export function doneGate(meta, args, install, read = tailReader()) {
   try {
     const cwd = typeof meta.cwd === 'string' && meta.cwd ? meta.cwd : process.cwd();
     const root = gitRootOf(cwd);
@@ -160,15 +172,15 @@ export function doneGate(meta, args, install) {
       err(`[done-gate] no transcript${args.host === 'bob' ? ' (bob)' : ''} — turn not judged.\n`);
       return false;
     }
-    let transcript;
+    let missing;
     try {
-      transcript = readText(meta.transcript_path);
+      missing = read(meta.transcript_path,
+        (text, whole) => doneDecide(text, checks, root, cwd, whole));
     } catch {
       // No ask tier on Stop: blocking on an unreadable transcript would trap the user.
       err('[done-gate] transcript unreadable — turn not judged.\n');
       return false;
     }
-    const missing = doneDecide(transcript, checks, root, cwd);
     if (!missing.length) return false;
     if (meta.stop_hook_active === true) {
       recordGate(install, 'done-gate-cap', 'law-3');

package/js/hosts/hooks-learn.mjs

@@ -12,7 +12,7 @@ import { NO_WINDOW } from '../lib/proc.mjs';
 import {
   globalHookStandingDown, hookProjectDir, resolveMemoryDir, sovereignBypass,
 } from './hosts.mjs';
-import { readStdin, splitLines, splitWords } from './hooks-prims.mjs';
+import { readStdin, splitLines, splitWords, tailReader } from './hooks-prims.mjs';
 import { doneGate } from './hooks-done.mjs';
 import {
   existingSlugs, readFacts, writeMemories, consolidateMemory, appendAgentLesson,
@@ -94,15 +94,26 @@ function contentText(content) {
   return '';
 }
 
-/** Render a Claude-Code-style JSONL transcript into `role: text` notes. */
-function flattenTranscript(p) {
-  let raw;
+/**
+ * Render a Claude-Code-style JSONL transcript into `role: text` notes, read from the END: the
+ * window grows until its notes hold twice MAX_NOTES_CHARS UTF-16 units (so at least
+ * MAX_NOTES_CHARS code points) or it is the whole file. The window's notes are a suffix of the
+ * whole file's, so the tail `cmdLearn` keeps is the one a full read would give — and a tail of
+ * tool output, which flattens to nothing, just reads further back.
+ */
+function flattenTranscript(p, read) {
   try {
     // `errors="replace"`: Node's utf8 decoder already substitutes U+FFFD.
-    raw = readText(p);
+    return read(p, (raw, whole) => {
+      const flat = flattenText(raw);
+      return whole || flat.length >= 2 * MAX_NOTES_CHARS ? flat : null;
+    });
   } catch {
     return '';
   }
+}
+
+function flattenText(raw) {
   const acc = [];
   for (let line of splitLines(raw)) {
     line = line.trim();
@@ -152,11 +163,11 @@ function flattenTranscript(p) {
  * store, a transcript payload that is not JSON. Those are decisions over text, and the corpus
  * reaches none of them.
  */
-export function readNotes(raw, meta = hookMeta(raw)) {
+export function readNotes(raw, meta = hookMeta(raw), read = tailReader()) {
   if (!raw.trim()) return '';
   const tp = meta.agent_transcript_path || meta.transcript_path;
   if (!tp) return raw;
-  const flat = flattenTranscript(tp);
+  const flat = flattenTranscript(tp, read);
   const lastMsg = typeof meta.last_assistant_message === 'string'
     ? meta.last_assistant_message.trim() : '';
   if (!flat) return lastMsg || flat;
@@ -314,7 +325,9 @@ export function cmdLearn(args) {
   // means the turn goes on, so there is nothing to distil yet: the next Stop will.
   // `--no-done-gate` (the install switched Law III's gate off) skips the check, never the
   // distillation below.
-  if (hookEvent === 'Stop' && !args.file && !args.noDoneGate && doneGate(meta, args, install)) return 0;
+  // One reader for this Stop: an allowed turn's distillation reuses the windows the gate read.
+  const read = tailReader();
+  if (hookEvent === 'Stop' && !args.file && !args.noDoneGate && doneGate(meta, args, install, read)) return 0;
 
   // I2 (Bob): its Stop payload never carries `transcript_path`, so there is never a transcript
   // to distil — and the bare envelope itself is not notes text (that would waste a model call
@@ -334,7 +347,7 @@ export function cmdLearn(args) {
 
   // B3: a real hook call with `$GENESEED_LLM` unset has nothing to send a prompt to — stdout on
   // Stop/SubagentStop/PreCompact reaches only the debug log, never the user (docs `hooks.md`) —
-  // so reading and flattening the transcript (up to 16 KB, every turn) just to print it nowhere
+  // so reading and flattening the transcript (a 2 MB tail or more, every turn) just to print it nowhere
   // is pure waste. Checked BEFORE `readNotes`, which is what does that read. A manual
   // invocation keeps printing the prompt on an unset `$GENESEED_LLM` — that is the documented,
   // deliberate behaviour (docs/reference/env-context.md) for someone running `learn` by hand to
@@ -345,7 +358,7 @@ export function cmdLearn(args) {
     return 0;
   }
 
-  let notes = readNotes(raw, meta);
+  let notes = readNotes(raw, meta, read);
   if (!notes.trim()) {
     err('[learn] no notes or transcript content \u2014 nothing to distil.\n');
     return 0;

package/js/hosts/hooks-prims.mjs

@@ -10,6 +10,7 @@
 import { statSync, readFileSync, readdirSync } from 'node:fs';
 import path from 'node:path';
 import { comparePaths } from '../lib/paths.mjs';
+import { readTail } from '../lib/fs.mjs';
 
 // ---- Python path and text primitives -------------------------------------------------
 // Small, and each one is here because a JS-idiomatic equivalent differs observably.
@@ -75,6 +76,30 @@ export function splitLines(text) {
   return parts;
 }
 
+/** The first window a Stop reads from a transcript's end; real transcripts reach 50 MB. */
+export const TAIL_BYTES = 2 * 1024 * 1024;
+
+/**
+ * A transcript reader for ONE hook invocation: `read(file, judge)` hands `judge(text, whole)`
+ * the file's last `bytes`, then a window four times larger, until `judge` answers (anything
+ * but null) or the window holds the whole file — where it must answer. Each window is read once
+ * per reader, so the done gate and `learn` share one read when both run on the same Stop.
+ * A read error (missing, unreadable) throws to the caller, uncached. Never a module-level cache:
+ * the host appends between Stops, and a test rewrites the same path.
+ */
+export function tailReader(bytes = TAIL_BYTES) {
+  const seen = new Map();
+  return (file, judge) => {
+    for (let n = bytes; ; n *= 4) {
+      const key = `${n}:${file}`;
+      if (!seen.has(key)) seen.set(key, readTail(file, n));
+      const { text, start } = seen.get(key);
+      const answer = judge(text, start === 0);
+      if (answer !== null || start === 0) return answer;
+    }
+  };
+}
+
 /** `str.split()` with no argument — runs of whitespace, ends stripped, no empties. */
 export function splitWords(s) {
   return s.split(/\s+/).filter(Boolean);

package/js/hosts/hooks.mjs

@@ -58,7 +58,7 @@ import {
   GATE_LEDGER, globalHookStandingDown, hookProjectDir, resolvePath, sovereignBypass,
 } from './hosts.mjs';
 import { currentBranch, gitRootOf, loopLaunched } from './gitref.mjs';
-import { LOSS_CANDIDATE_RE, lossReason, stripStructure } from './loss.mjs';
+import { LOSS_CANDIDATE_RE, catastrophic, lossReason, stripStructure } from './loss.mjs';
 import { selfAndParents, readStdin } from './hooks-prims.mjs';
 import { recordUse } from './usage.mjs';
 
@@ -438,8 +438,18 @@ const rootArg = (t) => !/^["']/.test(t) && FS_ROOT_RE.test(t);
 function gitDecide(args, payload) {
   const command = ((payload && payload.tool_input) || {}).command;
   if (typeof command !== 'string') return 0;
-  // `--no-deletion-gate`: the install switched Law IV's boundary off (user decision,
-  // 2026-10-17). Only this check stands down — ops 2 and process 5 below still run.
+  // Law IV's catastrophic class (a root, a drive, the home dir, a disk): no state makes it safe,
+  // so it runs BEFORE the switch below and whatever it says (user decision, 2026-10-18). On
+  // Claude an ask is the strongest verdict the hook has; on Bob, `law-4` exits 2.
+  const doomed = catastrophic(command, lossSegments);
+  if (doomed) {
+    return ask(args, 'git-gate', 'law-4', `Geneseed (Deletion Is Deliberate) \u2014 \`${doomed.slice(0, 80)}\` `
+      + 'would destroy a filesystem root, a drive, the home directory or a whole disk, which nothing '
+      + 'could restore. This check stands even with the deletion gate off.');
+  }
+  // `--no-deletion-gate`: the install switched Law IV's real-loss boundary off (user decision,
+  // 2026-10-17). Only this check stands down — the catastrophic class above, ops 2 and process 5
+  // below still run.
   if (!args.noDeletionGate && LOSS_CANDIDATE_RE.test(command)) {
     // A pass here FALLS THROUGH: a force push to a feature branch loses nothing, but it is still
     // a push, and process 5 below still asks for it.
@@ -525,8 +535,13 @@ export const DONE_LIST = '.geneseed/done-checks.txt';
  * not seen here; CI running the checks is the boundary that holds against that.
  */
 function protectedCheck(p) {
+  return protectedIn(path.resolve(p)) ?? protectedIn(resolvePath(p));
+}
+// One reading of the target. `protectedCheck` takes two — the path as written and the path with
+// links followed — so a link from outside into a protected folder and a protected folder that
+// links out of the repo are both caught: following links never loosens the gate.
+function protectedIn(target) {
   try {
-    const target = resolvePath(p);
     const root = gitRootOf(path.dirname(target));
     if (!root) return null;
     if (normcase(path.relative(root, target)) === normcase(DONE_LIST)) return DONE_LIST;

package/js/hosts/installs.mjs

@@ -609,9 +609,6 @@ export function gatesOfDir(d, host = null) {
   return Object.fromEntries(GATE_SWITCHES.map((g) => [g.key, gateOfDir(d, g.marker, host)]));
 }
 
-/** Law IV's switch alone (#319's reader, kept for its callers). */
-export const deletionGateOfDir = (d, host = null) => gateOfDir(d, 'Deletion gate', host);
-
 // ---- what host a deployed dir belongs to (`_harness_mcp`) ---------------------------------
 
 /** `_harness_mcp._claude_read_manifest`. */
@@ -838,7 +835,11 @@ export function installsReferencingShim(shimPath = hookShimPath(), targets = ins
 // ---- what this machine installed (`_harness_setup._installed_defaults`) --------------------
 
 /**
- * `_harness_setup._installed_defaults` — all six keys.
+ * `_harness_setup._installed_defaults` — eight keys: `theme`, `posture`, `mode`, `emit`,
+ * `footprint`, `doctrines`, `excludeRules`, `excludeSkills`. NOT the gate switches: a walk
+ * across every install on the machine would carry one host's `off` into another's re-run, and
+ * for a gate that disarms a boundary its owner never switched off — `setup` reads them off the
+ * one install it is re-running (`targetGates` in js/maintain/setup.mjs).
  *
  * It carried only `theme` and `emit` for four phases because those are the two `status`
  * prints and the two `doctor` reads, and the port's keep-vs-delete rule is "part of an

package/js/hosts/loss.mjs

@@ -625,4 +625,102 @@ export function lossReason(segments, cwd, { always = true, split } = {}) {
     return `the gate could not verify what this command would lose (${e.message})`;
   }
 }
+
+/**
+ * THE CATASTROPHIC CLASS — what no state can make safe: a recursive removal of a filesystem root,
+ * a drive root or the home directory, a device format or raw-disk overwrite, a fork bomb. Unlike
+ * `lossReason` it reads no state, and it stands whatever the deletion gate's switch says (user
+ * decision 2026-10-18): `--no-deletion-gate` silences the real-loss check, never this one. Judged
+ * in PROGRAM position, segment by segment after `stripStructure` and the wrappers, so `true & rm
+ * -rf /`, `sudo rm -rf /`, `(rm -rf /)` and `rm -rf /;` are caught and a commit message that only
+ * names `rm -rf /` is not. A shell or `eval` (`bash -c '…'`, `pwsh -Command …`) and a `$(…)` body
+ * are judged as commands of their own, and so is what a shell reads on stdin: a heredoc or
+ * here-string fed to `bash`/`sh`/`pwsh`/`cmd`… (`bash <<'EOF'` over `rm -rf /`). One fed to any
+ * other program (`cat <<EOF`, `git commit -F - <<EOF`) is data. The fork bomb spans `|`/`&`/`;`, so
+ * it is tested on the whole command. `split` cuts a command into raw-token segments, as for
+ * `lossReason`. Returns the offending text, or null.
+ */
+const CATASTROPHIC_CANDIDATE_RE = /(?:^|[^\w-])(?:rm|rmdir|rd|del|erase|remove-item|ri|mkfs(?:\.\w+)?|dd|format)(?:\.exe)?(?![\w-])|:\(\)/i;
+const FORK_BOMB_RE = /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/;
+// `/`, a Git Bash or WSL drive (`/c`, `/mnt/c`), a Windows drive (`C:`, `C:\`), the home dir — globbed or not.
+const ROOT_TARGET_RE = /^(?:\/|~[\\/]?|\$\{?HOME\}?[\\/]?|\/[a-z]\/?|\/mnt\/[a-z]\/?|[a-z]:[\\/]?)\*?$/i;
+const RM_RECURSE_RE = /^(?:-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)$/;
+// PowerShell's `-Recurse` (or any prefix of it) and cmd.exe's `/s`, alone or glued (`/s/q`).
+const PS_CMD_RECURSE_RE = /^(?:-r(?:e(?:c(?:u(?:r(?:s(?:e)?)?)?)?)?)?|(?:\/[a-z]+)*\/s(?:\/[a-z]+)*)$/i;
+const leadingFlags = (w) => { let i = 0; while (i < w.length && /^[-/][\w-]+$/.test(w[i])) i += 1; return w.slice(i); };
+// The programs that run what they read on stdin as commands.
+const STDIN_SHELLS = new Set(['bash', 'sh', 'zsh', 'dash', 'ksh', 'fish', 'pwsh', 'powershell', 'cmd']);
+// The same lexer as the splitter's (a comment, a quoted run, a heredoc opener, a newline), so the
+// openers it finds are the ones left in the segments' tokens, in the same order.
+const HEREDOC_SCAN_RE = /(?<![^\s;|&(])#[^\n]*|"[^"]*"?|'[^']*'?|(?<!<)<<(?!<)(-?)[ \t]*(["']?)([A-Za-z_]\w*)\2|\n/g;
+/** Every heredoc body in `command`, in opener order; an unterminated one runs to the end, as in bash. */
+function heredocBodies(command) {
+  const out = [];
+  const tags = [];
+  const re = new RegExp(HEREDOC_SCAN_RE);
+  let m;
+  while ((m = re.exec(command))) {
+    if (m[3]) { tags.push([m[1], m[3]]); continue; }
+    if (m[0] !== '\n' || !tags.length) continue;
+    let start = re.lastIndex;
+    while (tags.length) {
+      const [dash, tag] = tags.shift();
+      const body = [];
+      while (start < command.length) {
+        const end = command.indexOf('\n', start);
+        const line = command.slice(start, end < 0 ? command.length : end).replace(/\r$/, '');
+        start = end < 0 ? command.length : end + 1;
+        if ((dash ? line.replace(/^\t+/, '') : line) === tag) break;
+        body.push(line);
+      }
+      out.push(body.join('\n'));
+    }
+    re.lastIndex = start;
+  }
+  return out;
+}
+export function catastrophic(command, split, depth = 0) {
+  if (!CATASTROPHIC_CANDIDATE_RE.test(command)) return null;
+  if (FORK_BOMB_RE.test(command)) return command.trim();
+  const bodies = command.includes('<<') ? heredocBodies(command) : [];
+  let next = 0;
+  for (const raw of split(command).map(stripStructure)) {
+    const text = raw.join(' ');
+    // What this segment feeds on stdin: each heredoc opener takes the next body, a here-string its word.
+    const fed = [];
+    raw.forEach((t, i) => {
+      if (t.startsWith('<<<')) fed.push(word(t.length > 3 ? t.slice(3) : raw[i + 1] || '').replace(OPAQUE, ''));
+      else if (t.startsWith('<<')) fed.push(bodies[next++] ?? '');
+    });
+    for (const body of depth < 4 ? substitutions(text) : []) {
+      const v = catastrophic(body, split, depth + 1);
+      if (v) return v;
+    }
+    let w = words(raw).map((t) => t.replace(OPAQUE, ''));
+    while (w.length && (/^\w+=/.test(w[0]) || WRAPPERS.has(progOf(w[0])))) {
+      w = /^\w+=/.test(w[0]) ? w.slice(1) : pastWrapper(progOf(w[0]), w.slice(1)) || leadingFlags(w.slice(1));
+    }
+    if (!w.length) continue;
+    const prog = progOf(w[0]);
+    for (const body of STDIN_SHELLS.has(prog) && depth < 4 ? fed : []) {
+      const v = catastrophic(body, split, depth + 1);
+      if (v) return v;
+    }
+    const args = w.slice(1).map((a) => a.replace(/^-(?:literal)?path[=:]/i, ''));
+    // cmd.exe's `/s` `/q` are switches, not the Git Bash drives `/s` `/q`.
+    const root = () => args.some((a) => ROOT_TARGET_RE.test(a) && !(CMD_SWITCH_PROGS.has(prog) && /^\/[a-z]$/i.test(a)));
+    let hit = false;
+    if (prog === 'rm') hit = args.some((a) => RM_RECURSE_RE.test(a)) && root();
+    else if (RM_PROGS.has(prog)) hit = args.some((a) => PS_CMD_RECURSE_RE.test(a)) && root();
+    else if (/^mkfs(?:\.\w+)?$/.test(prog)) hit = args.some((a) => a.startsWith('/dev/'));
+    else if (prog === 'dd') hit = args.some((a) => /^of=\/dev\/(?:sd|nvme|hd|disk)/.test(a));
+    else if (prog === 'format') hit = args.some((a) => /^[a-z]:/i.test(a));
+    else if (INDIRECT.has(prog) && depth < 4) {
+      const v = catastrophic(leadingFlags(w.slice(1)).join(' '), split, depth + 1);
+      if (v) return v;
+    }
+    if (hit) return text.trim();
+  }
+  return null;
+}
 // ---- loss twin: END