geneseed 4.9.1 → 4.9.3

package/js/hosts/native.mjs

@@ -33,6 +33,7 @@ import { writeText, copyFile, readText } from '../lib/fs.mjs';
 import { jsonDumps, parseJson, formatValue, formatRepr, isTruthy, isDict } from '../lib/json.mjs';
 import { relPosix } from '../lib/text.mjs';
 import { aliasesOf } from '../build/source.mjs';
+import { resolvePath } from './hosts.mjs';
 import { claimLeaf, ownedState } from './owned.mjs';
 // `lstripNewlines` on spec bodies is a no-op on every input the generator produces today
 // (measured: no file under `src/` and no rendered spec in any theme begins with a newline), so
@@ -497,8 +498,9 @@ export function claimer(oldOwned, cfg, manifestExisted = true, oldHashes = {}) {
   const oldSet = oldOwned !== null && oldOwned !== undefined ? new Set(oldOwned) : null;
   let headerPrinted = false;
   const editRefused = new Set();
+  const rroot = cfg != null ? resolvePath(cfg) : undefined;  // once per emit, not per leaf
   const claim = (dest) => {
-    if (cfg != null && !claimLeaf(cfg, dest, relPosix(cfg, dest))) return false;
+    if (cfg != null && !claimLeaf(cfg, dest, relPosix(cfg, dest), rroot)) return false;
     if (oldSet === null || cfg == null || !existsSync(dest)) return true;
     const rel = relPosix(cfg, dest);
     if (oldSet.has(rel)) {

package/js/hosts/owned.mjs

@@ -26,7 +26,7 @@ import path from 'node:path';
 
 import { resolvePath } from './hosts.mjs';
 import { within } from '../lib/paths.mjs';
-import { isFile } from '../lib/fs.mjs';
+import { isFile, statOrNull, textWrites } from '../lib/fs.mjs';
 
 /**
  * The manifest rels that resolve INSIDE `base` — the one security boundary every walk over
@@ -68,9 +68,13 @@ export function ownedWithin(base, rels) {
  * `resolvePath` follows the root link on both `root` and `dest`, so a leaf reached the
  * ordinary way through a linked root still resolves inside it and stays allowed — only the
  * LEAF itself being a link is refused.
+ *
+ * `rroot` is `resolvePath(root)`, passed in by a caller that claims many leaves under one root
+ * (`claimer`, once per emit) — re-resolving it per leaf was ~2.6 s of `doctor --all`. Only the
+ * ROOT is hoisted: the lstat and the leaf's own `resolvePath` below stay per call, since they
+ * are the boundary.
  */
-export function safeLeaf(root, dest) {
-  const rroot = resolvePath(root);
+export function safeLeaf(root, dest, rroot = resolvePath(root)) {
   const st = lstatSync(dest, { throwIfNoEntry: false });
   if (st) {
     if (st.isSymbolicLink()) return false;
@@ -86,8 +90,8 @@ export function safeLeaf(root, dest) {
  * callers that already have it (every one of them, since it is what they are about to push
  * into `owned`) pass it straight through instead of re-deriving it from `dest`.
  */
-export function claimLeaf(root, dest, rel) {
-  if (safeLeaf(root, dest)) return true;
+export function claimLeaf(root, dest, rel, rroot = undefined) {
+  if (safeLeaf(root, dest, rroot)) return true;
   process.stderr.write(`[geneseed] refused ${rel}: it is a link — Geneseed writes only `
     + 'regular files it owns\n');
   return false;
@@ -107,6 +111,19 @@ export function fileHash(p) {
   return createHash('sha256').update(folded, 'latin1').digest('hex');
 }
 
+/**
+ * `fileHash` of a file whose whole content is `written`, computed from the string instead of
+ * read back — `written` must be EXACTLY what went to disk as utf8 (`writeText`'s translated
+ * text, never the text before its `\n` -> `os.EOL`: an embedded `\r\n` becomes `\r\r\n` on
+ * Windows, which folds to `\r\n`, not `\n`). CR and LF are single bytes that never occur
+ * inside a multi-byte utf8 sequence, so folding the string then encoding equals encoding then
+ * folding.
+ */
+export function textHash(written) {
+  return createHash('sha256').update(Buffer.from(written.replaceAll('\r\n', '\n'), 'utf8'))
+    .digest('hex');
+}
+
 /**
  * One sha256 per entry of `owned` that is both inside `root` (through `ownedWithin`, the same
  * containment boundary every other owned-rel walk goes through) and a file that still exists —
@@ -114,12 +131,23 @@ export function fileHash(p) {
  * rather than hashed. Keys land in the same sorted order the manifest writers already give
  * `owned` itself (`[...owned].sort()`), so the hash map a re-emit produces for an unchanged
  * tree is byte-identical to the one before it — `golden.mjs --idempotent`'s whole point.
+ *
+ * A file this emit wrote through `writeText` is hashed from the text it recorded
+ * (`textWrites`, `js/lib/fs.mjs`) rather than read back, while its size and mtime still match
+ * the stat taken at write time; anything else — a copied binary, an unrecorded rewrite — is read.
+ * shortcut: a same-size rewrite by a non-`writeText` writer inside one mtime tick would keep the
+ * stale record; no emit does that today (measured across golden's cells, 0 mismatches) — route
+ * such a writer through `writeText` or drop its entry if one ever appears.
  */
 export function ownedHashes(root, owned) {
   const hashes = {};
   for (const rel of ownedWithin(root, owned).sort()) {
     const p = path.join(root, rel);
-    if (isFile(p)) hashes[rel] = fileHash(p);
+    const st = statOrNull(p);
+    if (!st?.isFile()) continue;
+    const w = textWrites.map?.get(path.resolve(p));
+    hashes[rel] = w && w.size === st.size && w.mtimeMs === st.mtimeMs ? textHash(w.text)
+      : fileHash(p);
   }
   return hashes;
 }

package/js/hosts/settings.mjs

@@ -104,7 +104,7 @@ const consentRuleOn = (d, excluded = []) =>
  *
  * `rm -rf *` WENT TOO (user ruling, 2026-10-17): a blanket ask on every recursive removal is the
  * glob-cannot-read-state problem again — the guard's `lossReason` lets an `rm` of tracked,
- * unmodified files through and blocks one git cannot restore, and its `SHELL_BLOCK_RE` still
+ * unmodified files through and blocks one git cannot restore, and its `catastrophic()` still
  * blocks `rm -rf /`, `~` and the drive-root forms outright. Same stranded-key handling as above:
  * an existing `opencode.json` keeps its `rm -rf *` key, asking, until the user deletes it.
  *
@@ -726,7 +726,9 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [],
  * remove. `default` here means unknown, and unknown keeps the gate (see `processPackOn`).
  */
 export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [], host = 'claude',
-  deletionGate = true, { secretsGate = true, doneGate = true } = {}) {
+  gates = {}) {
+  // One object keyed as `GATE_SWITCHES` keys it; only an explicit `false` disarms a gate.
+  const { secretsGate = true, doneGate = true, deletionGate = true } = gates ?? {};
   const run = hookPrefix(hookOpts);
   const mem = `--memory "${path.join(cfg, 'memory')}"`;
   // --root carries the install's own dir so a GLOBAL hook can stand down when a live, wired
@@ -932,15 +934,14 @@ function readSettingsForMerge(p, consequence) {
  * global that never stood down for a project install.
  */
 export function mergeClaudeSettings(p, priorHooks = null, hookOpts = {},
-  doctrines = null, excluded = [], host = 'claude', cfgDir = path.dirname(p), deletionGate = true,
-  gates = {}) {
+  doctrines = null, excluded = [], host = 'claude', cfgDir = path.dirname(p), gates = {}) {
   const prior = (priorHooks || []).filter(isDict);
   const loaded = readSettingsForMerge(p, 'Hooks were not wired.');
   if (!loaded) return [p, prior];
   const [config, hadComments] = loaded;
   let hooks = get(config, 'hooks');
   if (!isDict(hooks)) hooks = {};
-  const canonical = claudeHookGroups(cfgDir, hookOpts, doctrines, excluded, host, deletionGate, gates);
+  const canonical = claudeHookGroups(cfgDir, hookOpts, doctrines, excluded, host, gates);
   const canonFlat = [];
   for (const [event, groups] of Object.entries(canonical)) {
     for (const g of groups) canonFlat.push({ event, group: g });

package/js/inspect/checks-probe.mjs

@@ -185,7 +185,7 @@ export function gateProbe(targets = installTargets(), { platform = process.platf
 // ---- OpenCode: the guard plugin, probed in-process ------------------------------------------
 
 const GUARD_PLUGIN = 'geneseed-guard.js';
-/** The guard blocks catastrophic shell (`SHELL_BLOCK_RE`); destructive git is the permission
+/** The guard blocks catastrophic shell (`catastrophic()`); destructive git is the permission
  * prompt's job there, and only WARNS in the guard — so its must-refuse payload is this one. */
 const GUARD_BAD_COMMAND = 'rm -rf /';
 

package/js/inspect/cost.mjs

@@ -9,8 +9,12 @@
  *              `AGENTS.md`), CRLF folded to LF as the smoke test folds it, so the figure and
  *              `CARRIER_CEILING` are the same measurement. `readText` also folds a lone CR,
  *              which the smoke test does not, so the two agree on any carrier without one.
- * - `skills`   the name + description every native skill lists (aliases included: they are
- *              SKILL.md files the host lists like any other).
+ * - `skills`   the name + description of every native skill the MODEL lists. A user-only skill
+ *              (and every alias, which native.mjs writes user-only) stays on disk but out of
+ *              the catalogue, by each host's own mechanism (`userOnly`): the frontmatter's
+ *              `disable-model-invocation` on Claude Code and OpenClaude; on OpenCode, which
+ *              ignores that key, the `permission.skill` deny in `opencode.json`; on Bob no
+ *              SKILL.md exists for one, so there is nothing to skip.
  * - `agents`   the same for native agents; Bob has none, its agents table is in the carrier.
  * - `context`  the session files the context hook injects (untouched seeds already skipped).
  *              The per-repo project context is NOT counted: it changes with the working dir.
@@ -21,6 +25,8 @@ import { sessionFiles } from '../hosts/hooks-context.mjs';
 import { carriersFor } from '../hosts/installs.mjs';
 import { frontmatter } from '../hosts/memory-files.mjs';
 import { listDir } from '../hosts/hooks-prims.mjs';
+import { loadJsonObject, opencodeTarget } from '../hosts/settings.mjs';
+import { isDict } from '../lib/json.mjs';
 import { isFile, readText } from '../lib/fs.mjs';
 
 /**
@@ -44,14 +50,39 @@ function fmValue(raw) {
   return raw;
 }
 
-/** name + description of one spec file; `fallbackName` for agents, whose name is the file stem. */
-function listedChars(file, fallbackName) {
+/**
+ * name + description of one spec file; `fallbackName` for agents, whose name is the file stem.
+ * `hidden(fm)` answers true for a file the host keeps out of the model's catalogue: it counts 0.
+ * @param {string} file
+ * @param {string} fallbackName
+ * @param {(fm: Map<string, string>) => boolean} [hidden]
+ */
+function listedChars(file, fallbackName, hidden = () => false) {
   let fm;
   try { [fm] = frontmatter(readText(file)); } catch { return 0; }
+  if (hidden(fm)) return 0;
   const name = fmValue(fm.get('name')) || fallbackName;
   return name.length + fmValue(fm.get('description')).length;
 }
 
+/**
+ * How `host` hides a skill from the model, mirroring `writeNativeLayer` (js/hosts/native.mjs).
+ * OpenCode reads the deny where `mcpConfigFor` finds its config (`opencode.json(c)` at the
+ * root); a blanket non-object `permission.skill` is the user's own policy and hides nothing
+ * by name, so nothing is skipped. Bob documents no such key: nothing is skipped either.
+ */
+function userOnlyTest(host, root) {
+  if (host === 'claude' || host === 'openclaude') {
+    return (_name, fm) => fm.get('disable-model-invocation') === 'true';
+  }
+  if (host === 'opencode') {
+    const { data } = loadJsonObject(opencodeTarget(path.join(root, 'opencode.json')));
+    const skill = isDict(data) && isDict(data.permission) ? data.permission.skill : null;
+    return (name) => isDict(skill) && skill[name] === 'deny';
+  }
+  return () => false;
+}
+
 /**
  * `root` is the install's root (`installTargets`), `dir` its data dir (`viewCfg`), which holds
  * `skills/`, `agents/` and the session files. Every part that cannot be read counts 0; a missing
@@ -64,9 +95,10 @@ export function alwaysOnCost({ host, root, dir, footprint }) {
 
   let skills = 0;
   const skillsDir = path.join(dir, 'skills');
+  const userOnly = userOnlyTest(host, root);
   for (const name of listDir(skillsDir)) {
     const f = path.join(skillsDir, name, 'SKILL.md');
-    if (isFile(f)) skills += listedChars(f, name);
+    if (isFile(f)) skills += listedChars(f, name, (fm) => userOnly(name, fm));
   }
   let agents = 0;
   if (host !== 'bob') {

package/js/inspect/diff.mjs

@@ -35,11 +35,15 @@
  *     directly rather than by comparison, because a check made tolerant of a value owes one
  *     somewhere else.
  */
+import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, statSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
-import { emitGlobalInto } from '../build/driver.mjs';
+import { PRIMARY_AGENT_SRC, emitGlobalInto } from '../build/driver.mjs';
+import { rglobFiles } from '../build/emit-common.mjs';
+import { CONFIG, makeCfg } from '../build/source.mjs';
+import { sourceFingerprint } from '../build/version.mjs';
 import {
   GLOBAL_MANIFEST, VERSION_MARKER, expanduser, opencodeConfigDir, resolvePath,
 } from '../hosts/hosts.mjs';
@@ -50,9 +54,11 @@ import {
   trustOfDir,
   readJsonMaybe, readMaybe, themeOfDir,
 } from '../hosts/installs.mjs';
+import { safeLeaf } from '../hosts/owned.mjs';
 import { unifiedDiff, splitLines } from '../lib/udiff.mjs';
 import { printOut, printErr, readText, writeText, isFile } from '../lib/fs.mjs';
 import { toPlatformPath } from '../lib/paths.mjs';
+import { relPosix } from '../lib/text.mjs';
 
 /**
  * `_harness_core._T0` — this process's start, in epoch seconds.
@@ -121,6 +127,81 @@ export function withStdoutSwallowed(fn) {
   }
 }
 
+/** A manifest's `rel`, spelled the way the expected snapshot keys it. */
+const posixRel = (rel) => rel.split('\\').join('/');
+
+/**
+ * Render the `expected` tree for `host` at `axes` into a temp dir and SNAPSHOT it — every file,
+ * not only the owned ones, because a rel the DEPLOYED manifest claims is looked up here too and
+ * its presence decides "edited" against "added". The temp dir is gone before this returns.
+ *
+ * The one place a render depends on WHERE it is installed: a global Bob emit writes each
+ * folder skill's absolute directory into its SKILL.md (see `writeNativeLayer`), so the
+ * reference render names the temp tree. Mapped back to the deployed dir here, or every such
+ * skill reads as edited. A deployment that has since MOVED still differs, and that is real
+ * drift — its skills point at a directory that is no longer theirs. A side-file pointer (and a
+ * global OpenCode command's) spells the same directory `/`-separated, so that spelling is
+ * mapped too.
+ */
+function renderExpected(host, axes, deployedDir) {
+  const tmp = mkdtempSync(path.join(os.tmpdir(), 'geneseed-diff-'));
+  try {
+    const expected = path.join(tmp, 'expected');
+    withStdoutSwallowed(() => emitGlobalInto(host, {
+      ...axes, out: path.join(tmp, 'bundle'), cfgDir: expected,
+    }));
+    const posix = (p) => p.split(path.sep).join('/');
+    const texts = new Map();
+    for (const p of rglobFiles(expected)) {
+      texts.set(relPosix(expected, p), readText(p).split(expected).join(deployedDir)
+        .split(posix(expected)).join(posix(deployedDir)));
+    }
+    return { owned: ownedSet(expected), texts };
+  } finally {
+    // `tempfile.TemporaryDirectory()`'s cleanup, which runs on the exception path too.
+    rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+/**
+ * A memo for `diffCollect`'s `expected` render — opt-in, so `geneseed diff` and every other
+ * caller still renders afresh. The web console passes one: `/api/overview` and `/api/fleet`
+ * both diff the selected install on every refresh, and the render is ~0.6 s of each.
+ *
+ * ONLY THE RENDER IS MEMOISED, NEVER THE RESULT: the compare against the deployed tree runs on
+ * every call, because catching a hand edit there is the whole point of the drift figure.
+ * One entry per deployed dir, at most `cap` of them (least recently used goes first); `renders`
+ * counts real renders, for the tests.
+ */
+export function renderMemo(cap = 4) {
+  return { cap, renders: 0, entries: new Map() };
+}
+
+/**
+ * The memoised `renderExpected`. The key is everything the render reads: the source
+ * fingerprint, the two render inputs it does not hash (`harness.config.json` and the
+ * orchestrator agent), the host and every axis. A deployed dir whose key changed is
+ * re-rendered in place, and a fingerprint change drops every entry from the old source.
+ */
+function memoExpected(memo, host, axes, deployedDir, sourceFp) {
+  const fp = sourceFp ?? sourceFingerprint(makeCfg());
+  const extra = createHash('sha256');
+  for (const p of [CONFIG, PRIMARY_AGENT_SRC]) extra.update(`${readMaybe(p) ?? ''}\0`);
+  const key = JSON.stringify([fp, extra.digest('hex'), host, axes]);
+  const hit = memo.entries.get(deployedDir);
+  memo.entries.delete(deployedDir);
+  if (hit && hit.key === key) {
+    memo.entries.set(deployedDir, hit);
+    return hit.exp;
+  }
+  for (const [d, e] of memo.entries) if (e.fp !== fp) memo.entries.delete(d);
+  const exp = renderExpected(host, axes, deployedDir);
+  memo.renders += 1;
+  memo.entries.set(deployedDir, { key, fp, exp });
+  while (memo.entries.size > memo.cap) memo.entries.delete(memo.entries.keys().next().value);
+  return exp;
+}
+
 /**
  * `_harness_diff._diff_collect` — returns `{target, theme, files}`, with `files === null` for
  * "nothing to compare here".
@@ -140,7 +221,9 @@ export function withStdoutSwallowed(fn) {
  * choice, which is the same defect with teeth. `rebuild-all` never had it: it reads
  * `postureOfDir`/`modeOfDir` per install root, and this now asks the same two questions.
  */
-export function diffCollect({ target = null, theme = null, emit = null, footprint = null } = {}) {
+export function diffCollect({
+  target = null, theme = null, emit = null, footprint = null, memo = null, sourceFp = null,
+} = {}) {
   // `Path(target).expanduser()` — expanded and NOT resolved, which is the opposite of
   // `cmd_version`'s `.expanduser().resolve()` two files over. It is observable: `target` is
   // printed on the summary line, so `--target .` reports `.` here and an absolute path
@@ -165,69 +248,66 @@ export function diffCollect({ target = null, theme = null, emit = null, footprin
 
   const fp = footprint || footprintOfDir(dir);
 
+  // Every input the render reads off the deployment, in ONE object: it is what the render is
+  // called with AND what the memo keys on, so the two cannot drift apart.
+  const axes = {
+    theme: themeName, footprint: fp,
+    // The third register read off the deployment, for the same reason as the other two: an
+    // install built with `--doctrines craft` compared against an `expected` rendered at all
+    // four reports its entire doctrines section — and its `Active packs:` line — as drift.
+    // `null` (no marker) means unknown and renders at all four, which `doctrinesForBuild`
+    // makes explicit rather than leaving to `makeCfg`'s parameter default two layers down.
+    posture: postureOfDir(dir), mode: modeOfDir(dir), doctrines: doctrinesForBuild(dir),
+    // The loop skill's preset, or its `Default trust preset:` line reads as edited.
+    trust: trustOfDir(dir, host),
+    // The excluded rules, or an install built `--exclude-rules "process 5"` reads its
+    // carrier as drift: `expected` would re-state the rule the deployment took away.
+    excludeRules: excludedRulesOfDir(dir),
+    // The excluded skills, or every skill the install left out reads as deleted.
+    excludeSkills: excludedSkillsOfDir(dir),
+    // The gate switches, or a disarmed install reads its `<gate>: off` line as drift.
+    ...gatesOfDir(dir),
+  };
+  const deployedDir = resolvePath(dir);
+  const exp = memo
+    ? memoExpected(memo, host, axes, deployedDir, sourceFp)
+    : renderExpected(host, axes, deployedDir);
+
   const files = [];
-  const tmp = mkdtempSync(path.join(os.tmpdir(), 'geneseed-diff-'));
-  try {
-    const expected = path.join(tmp, 'expected');
-    withStdoutSwallowed(() => emitGlobalInto(host, {
-      theme: themeName, out: path.join(tmp, 'bundle'), cfgDir: expected, footprint: fp,
-      // The third register read off the deployment, for the same reason as the other two: an
-      // install built with `--doctrines craft` compared against an `expected` rendered at all
-      // four reports its entire doctrines section — and its `Active packs:` line — as drift.
-      // `null` (no marker) means unknown and renders at all four, which `doctrinesForBuild`
-      // makes explicit rather than leaving to `makeCfg`'s parameter default two layers down.
-      posture: postureOfDir(dir), mode: modeOfDir(dir), doctrines: doctrinesForBuild(dir),
-      // The loop skill's preset, or its `Default trust preset:` line reads as edited.
-      trust: trustOfDir(dir, host),
-      // The excluded rules, or an install built `--exclude-rules "process 5"` reads its
-      // carrier as drift: `expected` would re-state the rule the deployment took away.
-      excludeRules: excludedRulesOfDir(dir),
-      // The excluded skills, or every skill the install left out reads as deleted.
-      excludeSkills: excludedSkillsOfDir(dir),
-      // The gate switches, or a disarmed install reads its `<gate>: off` line as drift.
-      ...gatesOfDir(dir),
-    }));
-    // The one place a render depends on WHERE it is installed: a global Bob emit writes each
-    // folder skill's absolute directory into its SKILL.md (see `writeNativeLayer`), so the
-    // reference render names the temp tree. Mapped back to the deployed dir before comparing,
-    // or every such skill reads as edited. A deployment that has since MOVED still differs,
-    // and that is real drift — its skills point at a directory that is no longer theirs.
-    // A side-file pointer (and a global OpenCode command's) spells the same directory
-    // `/`-separated, so that spelling is mapped too.
-    const deployedDir = resolvePath(dir);
-    const posix = (p) => p.split(path.sep).join('/');
-    const rels = [...new Set([...ownedSet(dir), ...ownedSet(expected)])].sort();
-    for (const rel of rels) {
-      const a = path.join(dir, rel);
-      const b = path.join(expected, rel);
-      if (isFile(a) && isFile(b)) {
-        // `read_text(errors="replace")` — Node's utf8 decoder substitutes U+FFFD for the
-        // same bytes, and `readText` folds the line endings the way `Path.read_text` does.
-        const ta = readText(a);
-        const tb = readText(b).split(expected).join(deployedDir)
-          .split(posix(expected)).join(posix(deployedDir));
-        if (cmpKey(rel, ta) !== cmpKey(rel, tb)) {
-          const diff = unifiedDiff(splitLines(tb), splitLines(ta), {
-            fromfile: `source/${rel}`, tofile: `deployed/${rel}`, lineterm: '',
-          });
-          files.push({ rel, status: 'edited', diff });
-        }
-      } else if (isFile(a)) {
-        const body = splitLines(readText(a));
-        files.push({
-          rel,
-          status: 'added',
-          diff: ['(only in deployed — your addition)', '', ...body.map((ln) => `+${ln}`)],
-        });
-      } else {
-        files.push({
-          rel, status: 'missing', diff: ['(in source, not deployed — re-emit to add)'],
+  const rels = [...new Set([...ownedSet(dir), ...exp.owned])].sort();
+  for (const rel of rels) {
+    const a = path.join(dir, rel);
+    const tb = exp.texts.get(posixRel(rel));
+    let rec = null;
+    if (isFile(a) && tb !== undefined) {
+      // `read_text(errors="replace")` — Node's utf8 decoder substitutes U+FFFD for the
+      // same bytes, and `readText` folds the line endings the way `Path.read_text` does.
+      const ta = readText(a);
+      if (cmpKey(rel, ta) !== cmpKey(rel, tb)) {
+        const diff = unifiedDiff(splitLines(tb), splitLines(ta), {
+          fromfile: `source/${rel}`, tofile: `deployed/${rel}`, lineterm: '',
         });
+        rec = { rel, status: 'edited', diff };
       }
+    } else if (isFile(a)) {
+      const body = splitLines(readText(a));
+      rec = {
+        rel,
+        status: 'added',
+        diff: ['(only in deployed — your addition)', '', ...body.map((ln) => `+${ln}`)],
+      };
+    } else {
+      rec = { rel, status: 'missing', diff: ['(in source, not deployed — re-emit to add)'] };
     }
-  } finally {
-    // `tempfile.TemporaryDirectory()`'s cleanup, which runs on the exception path too.
-    rmSync(tmp, { recursive: true, force: true });
+    if (rec === null) continue;
+    // A path that is, or sits under, a link the emit refused to write through (a skill dir the
+    // user junctioned to their own copy) is theirs: no rebuild can clear it, so it is not drift.
+    // `safeLeaf` is the claimer's own test, so "linked" here is exactly "refused" there — and
+    // it runs only on a path that differs, because it lstats and resolves.
+    if (!safeLeaf(dir, a, deployedDir)) {
+      rec = { rel, status: 'linked', diff: ['(a link — yours; Geneseed leaves it alone)'] };
+    }
+    files.push(rec);
   }
   // Already sorted by `rel` above; the Python sorts again after the loop and so does this,
   // because the two sorts are over different things — that one is over the RECORDS, and a
@@ -236,8 +316,13 @@ export function diffCollect({ target = null, theme = null, emit = null, footprin
   return { target: dir, theme: themeName, files };
 }
 
+/** The records that are drift: everything but a `linked` path, which is the user's own. */
+export const drifted = (files) => files.filter((f) => f.status !== 'linked');
+
 /** `_harness_diff._improvements_md` — pure; `when` is the caller's timestamp. */
-export function improvementsMd(target, theme, files, when) {
+export function improvementsMd(target, theme, allFiles, when) {
+  // A linked path is never a back-port item: the file is the user's, not a local edit of ours.
+  const files = drifted(allFiles);
   const edited = files.filter((f) => f.status === 'edited');
   const added = files.filter((f) => f.status === 'added');
   const missing = files.filter((f) => f.status === 'missing');
@@ -327,7 +412,8 @@ export function exportImprovements(target = null, theme = null, outPath = null)
   const collected = diffCollect({ target, theme });
   // Python's `if not files` — null AND the empty list both return, which is why the caller
   // gets `files` back rather than a bare path and can tell the two apart itself.
-  if (!collected.files || collected.files.length === 0) return [null, collected.files];
+  // A linked path alone is not drift, or every update would export an empty report.
+  if (!collected.files || drifted(collected.files).length === 0) return [null, collected.files];
   return [writeImprovements(collected.target, collected.theme, collected.files, outPath),
     collected.files];
 }
@@ -383,14 +469,18 @@ export function cmdDiff(args) {
   const edited = files.filter((f) => f.status === 'edited');
   const added = files.filter((f) => f.status === 'added');
   const missing = files.filter((f) => f.status === 'missing');
+  const linked = files.filter((f) => f.status === 'linked');
   printOut(`[diff] deployed ${target}  vs  source (theme: ${theme})\n`);
   printOut(`[diff] ${edited.length} edited, ${added.length} added-in-deployed, `
     + `${missing.length} missing-from-deployed\n`);
+  // Its own line, printed only when there is one, so the summary above is unchanged otherwise.
+  if (linked.length) printOut(`[diff] ${linked.length} linked (yours, left alone)\n`);
   for (const f of edited) printOut(`  ~ ${f.rel}   (edited in deployed — review to back-port)\n`);
   for (const f of added) printOut(`  + ${f.rel}   (only in deployed — your addition)\n`);
   for (const f of missing) printOut(`  - ${f.rel}   (in source, not deployed — re-emit to add)\n`);
+  for (const f of linked) printOut(`  = ${f.rel}   (a link — yours, left alone)\n`);
   if (args.out) {
-    if (files.length) {
+    if (drifted(files).length) {
       // Bare `--out` is argparse's `nargs="?"` const: True, meaning "the default timestamped
       // path". `parse()` gives a flag `true` and an option a string, so the two arrive
       // distinguishable here without a third kind of entry in the VERBS table.

package/js/inspect/validate.mjs

@@ -130,8 +130,8 @@ export function cmdValidate(args) {
     const opts = {
       theme: args.theme, footprint: args.footprint, posture: args.posture, mode: args.mode,
       trust: args.trust, doctrines: args.doctrines, excludeRules: args.excludeRules,
-      excludeSkills: args.excludeSkills, deletionGate: args.noDeletionGate ? false : null,
-      secretsGate: args.noSecretsGate ? false : null, doneGate: args.noDoneGate ? false : null,
+      excludeSkills: args.excludeSkills,
+      ...Object.fromEntries(GATE_SWITCHES.map((g) => [g.key, args[g.arg] ? false : null])),
     };
     let scanDirs;
     try {

package/js/lib/fs.mjs

@@ -29,8 +29,32 @@
  */
 import {
   appendFileSync, writeFileSync, readFileSync, copyFileSync, statSync, utimesSync,
+  openSync, fstatSync, readSync, closeSync,
 } from 'node:fs';
 import { EOL } from 'node:os';
+import { resolve } from 'node:path';
+
+/**
+ * What `writeText` wrote while an emit has armed this (`withWriteRecord` below, around the
+ * three manifest-writing emits in `js/build/driver.mjs`): resolved path ->
+ * `{ text, size, mtimeMs }`, the translated text and a stat taken right after the write.
+ * `ownedHashes` (`js/hosts/owned.mjs`) hashes that text instead of reading the file back —
+ * the read-back was ~25% of `doctor --all` — and only while the file's size and mtime still
+ * match, so a later rewrite by any writer that does not record (a raw `writeFileSync`, a
+ * rename) falls back to the read. `copyFile` and `appendText` drop the entry outright.
+ * `null`, the default, records nothing: no other caller pays the stat or retains the text.
+ */
+export const textWrites = { map: null };
+
+/**
+ * Run one emit with `textWrites` armed, and disarm it on EVERY exit: an emit that throws inside
+ * a long-lived process (the web daemon emits in-process) would otherwise leave every later
+ * `writeText` paying a stat and keeping its text in memory.
+ */
+export function withWriteRecord(fn) {
+  textWrites.map = new Map();
+  try { return fn(); } finally { textWrites.map = null; }
+}
 /**
  * `Path.write_text(text, encoding="utf-8")`.
  *
@@ -49,7 +73,12 @@ import { EOL } from 'node:os';
  * The same vendored skill folder can contain files from both categories.
  */
 export function writeText(path, text) {
-  writeFileSync(path, EOL === '\n' ? text : text.replaceAll('\n', EOL), 'utf8');
+  const out = EOL === '\n' ? text : text.replaceAll('\n', EOL);
+  writeFileSync(path, out, 'utf8');
+  if (textWrites.map) {
+    const st = statSync(path);
+    textWrites.map.set(resolve(path), { text: out, size: st.size, mtimeMs: st.mtimeMs });
+  }
 }
 
 /**
@@ -62,6 +91,7 @@ export function writeText(path, text) {
  * invisible in an editor and a whole-file difference to the gate.
  */
 export function appendText(path, text) {
+  textWrites.map?.delete(resolve(path));
   appendFileSync(path, EOL === '\n' ? text : text.replaceAll('\n', EOL), 'utf8');
 }
 
@@ -79,6 +109,46 @@ export function readText(path) {
   return readFileSync(path, 'utf8').replaceAll('\r\n', '\n').replaceAll('\r', '\n');
 }
 
+/**
+ * The last `bytes` of a file, decoded as `readText` decodes it, and the byte offset the window
+ * began at (0: the whole file). A window that starts mid-line drops that partial line, cut at a
+ * newline BYTE before decoding — so a multibyte character the window split falls in the dropped
+ * part, and a `\r\n` split between its two bytes leaves only an empty line. One byte before the
+ * window is read too, so a window that starts exactly on a line keeps it. Throws as
+ * `readFileSync` does (missing, unreadable, a directory).
+ */
+export function readTail(path, bytes) {
+  const fd = openSync(path, 'r');
+  try {
+    const st = fstatSync(fd);
+    // Windows opens a directory without complaint and reports size 0: refuse it as readFileSync does.
+    if (st.isDirectory()) {
+      throw Object.assign(new Error(`EISDIR: illegal operation on a directory, read '${path}'`),
+        { code: 'EISDIR' });
+    }
+    const size = st.size;
+    const start = Math.max(0, size - bytes);
+    const from = start > 0 ? start - 1 : 0;
+    const buf = Buffer.alloc(size - from);
+    let got = 0;
+    while (got < buf.length) {
+      const n = readSync(fd, buf, got, buf.length - got, from + got);
+      if (!n) break;
+      got += n;
+    }
+    let cut = 0;
+    if (start > 0) {
+      const read = buf.subarray(0, got);
+      const ends = [read.indexOf(0x0a), read.indexOf(0x0d)].filter((i) => i !== -1);
+      cut = ends.length ? Math.min(...ends) + 1 : got;   // no line end: nothing whole to decode
+    }
+    const text = buf.toString('utf8', cut, got).replaceAll('\r\n', '\n').replaceAll('\r', '\n');
+    return { text, start };
+  } finally {
+    closeSync(fd);
+  }
+}
+
 /**
  * `shutil.copy2(src, dest)`.
  *
@@ -94,6 +164,7 @@ export function readText(path) {
  * mode the Python side has and nothing depends on. Mode is not copied here.
  */
 export function copyFile(src, dest) {
+  textWrites.map?.delete(resolve(dest));
   copyFileSync(src, dest);
   const st = statSync(src);
   utimesSync(dest, st.atime, st.mtime);
@@ -216,7 +287,7 @@ export function withPlatformNewlines(fn) {
  */
 const NOT_THERE = new Set(['ENOENT', 'ENOTDIR', 'ELOOP', 'EBADF']);
 
-function statOrNull(p) {
+export function statOrNull(p) {
   try {
     return statSync(p);
   } catch (e) {