@dzhechkov/harness-core 0.8.43 → 0.8.45

package/sbom.json

@@ -25,7 +25,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3d7cfbd07df446a36b1f8f93aeeb4d4dfb9c1d5659b0be7fb5788e130b9ff685"
+          "content": "9471b66311d4ec18259af1bb47442ba2ca145b14c62f326bdf2ba7934728c604"
         }
       ]
     },
@@ -2915,7 +2915,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "033e685536165cf7fd76ac8be8b40d7c63dbcadeb8da7c74b8848a7ee4ea0cc9"
+          "content": "57180412f3b4c03a8361ba69f1ea44402a38ddb5733039f0c34cadad80e1d8f8"
         }
       ]
     },
@@ -2925,7 +2925,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e144f314424a168aaae260a73ad9a7914cc413f598351aa989abb6714727d1f0"
+          "content": "4e82b1bfc3ceb7ff85424cceb6c5d9fec85153942fa6c05a6139e8ac7cf5f77f"
         }
       ]
     },
@@ -2935,7 +2935,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6366af45dd192850c5aaa8c38c927366cfc706ec35a28343136694f66998c474"
+          "content": "72c2dd7205ee3c83d1afa46e6de761d27b6df9faf67dc5a521cb53c8a6827cf2"
         }
       ]
     },
@@ -2945,7 +2945,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "473cb3fd816c7f444562e3c8cff515e0a74285ca701fd269a0bdeb1162a15b61"
+          "content": "93f882ebf5e4c8fe7d01167bf532fc151ab94a346d8fc32e23488c532c36f9bc"
         }
       ]
     },
@@ -3405,7 +3405,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b4a01fd697d785c473d9b66689c8d140211fc09f8379ca7fa32e41fbd36ca940"
+          "content": "e8dcc3bd0e0b7dca766b9ed8e77c3b33d349349b809ee625890f327aa62ebc77"
         }
       ]
     },
@@ -3415,7 +3415,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "87ad202b5bb3e1f6295d18a997201c1d2303343b42953843d852d2b83f9451e8"
+          "content": "d1ab2c60cc400cf9be5e2d6352eae67d9a3142808fd741ca6103a83b35afb655"
         }
       ]
     },
@@ -3425,7 +3425,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b7ef829dc678254bacf001e1ffe968b1619cb0000179362d159d46362a451b8d"
+          "content": "dd03c47fb197c268f28a39bd65ce0c571ae7ffb546edef88d1dc460654f174cc"
         }
       ]
     },
@@ -3845,7 +3845,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e4201e20636b32e62d72039533d2f6ea52da46b3daef52fd2e17e7a028a3fb9b"
+          "content": "788ec70ba0443c3d3f8e1599548f54013d4d6ae864ccac1b3406d84d55e443df"
         }
       ]
     },
@@ -3855,7 +3855,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d032d7bbd923ef86a473a37e844fe1f6e8123da2ad9f9cb60f4e868f26f4789a"
+          "content": "43ba71733350f5f91ea98ed3b94baa61fe3b454543d687524e51d8cb135d7022"
         }
       ]
     },
@@ -3865,7 +3865,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b26cf0abe736bac0ecd8c5babb2bce60e19dfb22eaaa13004cb96cf2a8c4c55a"
+          "content": "66f08674ced70cfcd60bdf14fd3dded0052535b608edb31a5be165dc10ccc777"
         }
       ]
     },
@@ -4149,6 +4149,46 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "dist/pack-artifact.d.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "ac53c92fe8be66aa73580b13e273321e229eeb9c2f7c3ce82acd4d0cebcfaae4"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/pack-artifact.d.ts.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "fc5ec05405710ec6cb543121d9c6f14ba9c5c11e5edc918e15622c9efc24bfe8"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/pack-artifact.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "6ad53e00466d96653f88ab0ec69f9a2d63552023bf5b851ce37918f44466ba8f"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/pack-artifact.js.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "3b1537b2de837841488829eaf12ee76fc405dbe12716a5b6677b2339ac5276cb"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "dist/pack-inventory.d.ts",
@@ -4485,7 +4525,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c0bce356cd6fff8aeb65022b72e180e845ff774f5b604e271447e36d6932a540"
+          "content": "fe20c556f01f1845f344886135d13357d5aea9f7260cf86d4758e82927053851"
         }
       ]
     },
@@ -4495,7 +4535,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "0615de8e3af3ceb2e65426756736b69f3b877eea278535998719504ffb59bd43"
+          "content": "2a21b1817b07e27719c559bd37d78e87659bf1249ffdb7499efba1999d49c7c2"
         }
       ]
     },
@@ -4505,7 +4545,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b1974eb772e4ea8f6684c9724095e0a95e82d6dae9eb927645a967fb12f7c5c2"
+          "content": "1ee080ccc4b13bd8a1961d31284bc686860ca704e29c3b0b687a3106ccdc13c7"
         }
       ]
     },
@@ -4635,7 +4675,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8e39c9f1d527ddaaa8b8655ee1e2fa0ee005926e25da8c3218cf0fb9cbed5502"
+          "content": "612d932b140a0bc367a772fb6122275b509ff26a6359534f1cf3ce79539def1b"
         }
       ]
     },
@@ -4645,7 +4685,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "257237bac3a1d173113b4525ea19dbb4f7984a08ad017ebdd7af164ba6cc7cfe"
+          "content": "120250c23f016ef260bd764b35ddca919da595b953fcaf7960ae228c4bdc65d2"
         }
       ]
     },
@@ -4655,7 +4695,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "16ac3f704998f295ed42c112277482d6adfb5d26e4c8a4c89781d24b63118f6f"
+          "content": "da830c806d680362a0668623dd653add234ea9968511366b178c3b1657318d05"
         }
       ]
     },
@@ -4665,7 +4705,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8143d41cd1c706713fe6d9a742b71d9a28b3519a72072ca4683837ab54732d30"
+          "content": "e08511c5f7024e8d76472a68ed930b613fffc5a859788a3cbb20cf469a638fa0"
         }
       ]
     },
@@ -4755,7 +4795,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "149d0d95689591db30c433eb84c4f6da93a100296e156a52672bc715ac832991"
+          "content": "5384d5e5b0be1dc5f41c376233a1182065edd26622ecf5608a8f73f7f04c9f81"
         }
       ]
     },
@@ -4765,7 +4805,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "93a56cbdfd3acff3e95f42695478f3f04ebed664380506fa1085dbc8f729b0b6"
+          "content": "cee754875a0f78ef1b65457f07eb33a0045469596e22f6f3f3eef4ff989401c0"
         }
       ]
     },
@@ -4775,7 +4815,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d92c3e7382fc142dd2a53b6be27de3c866be34f9916020c9eaf20bdc3eae17f0"
+          "content": "e6fe3953003c79e5ce5065053c401d322fb186f40603bf7312beb5c2fb994969"
         }
       ]
     },
@@ -4785,7 +4825,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6a45842cd3083205cbff2438c60dc3bce98b23b5a87b0586d11114dba931f40d"
+          "content": "275fd7d74bd1345ffe8fa55ffced2272985662904dc7774f6b343b06730322b0"
         }
       ]
     },
@@ -6045,7 +6085,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3b8f5dc584a26b53be9f1e68cb8fffaaf68decbe1cf4b634f78c8ec0f3725b3d"
+          "content": "3ecf9110097001cba535095de5a78cd9ca2703cfed15d921f368673b08ef6374"
         }
       ]
     },
@@ -6055,7 +6095,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8644f836c6236867d8f238cf48465506361647f11bc58b50134a7a862b7e711a"
+          "content": "ffab1105dd844f20d5f8a6c385901f9bb6c714148a2f61a4e51afab0254021b2"
         }
       ]
     },
@@ -6065,7 +6105,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3bafd2f8eb1c3305be28c42d59365dc58751d199b5e702b69c581c5df7b97560"
+          "content": "363fa3f4e716a6e450a49f9f11b9c871baad68b30c825f3cdd4b27f471731572"
         }
       ]
     },
@@ -6509,6 +6549,46 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "dist/stamped-path.d.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2bab16b2083b6771343aaf6e674661cd8b7e00851933caa7abb0b5129757851f"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/stamped-path.d.ts.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "0cae7683e286b6028c3fa170386609ec8b84f4a2b71ad159f0285fc1402bd6a3"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/stamped-path.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "95f90efd72d5068247b778cc2b740562b263ba3ae9bd8793811d9b58d02524c4"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/stamped-path.js.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "862c33d8a76abc76ef47987b1ec499ef46d73af109205c1cb0be3aeb75fe6350"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "dist/statusline.d.ts",
@@ -7639,7 +7719,7 @@
         },
         {
           "name": "dz:canonical-json-sha256-v2",
-          "value": "073fc68b426d7cf73bb6d3ba9ec163306e7c8f5945db4d12f2da993c4da15089"
+          "value": "501025e7e79122425b01afd14c2a37c59e7fb642d3606b1096f34d1530392995"
         }
       ]
     },
@@ -8379,7 +8459,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f308da21522b74a4aae4ca85a00e9a332a7497f2b3daded5d34a2f4b44d37273"
+          "content": "e4bc19a0dbb761a9155022398ed3223091366c95fb850b79f56d6722cbe57f26"
         }
       ]
     },
@@ -8499,7 +8579,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "bec4f95a59f3f1bcdafaddcc10135581ff2828f6f0b4eac02559e77f339111dd"
+          "content": "a3754701f00eba282d95ed944cdf0e88b2018bdd0713a305e220759f0f0b1202"
         }
       ]
     },
@@ -8609,7 +8689,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c938c3b14d7aa27ef8f3bc9281273f0d8454de2fadd600742c5c0f9632625196"
+          "content": "78baea4b55d0d19180040761050837a9f28bdd60112062a7d359ebfd78beed14"
         }
       ]
     },
@@ -8683,6 +8763,16 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "src/pack-artifact.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "7c7679225a5d5057ecd71f195d8dbda105a9082bc3ce257a5eddd9e47b7dadd1"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "src/pack-inventory.ts",
@@ -8769,7 +8859,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9c0aa7d6e030c5a165c8322ad8c32c7d4435a69afd0e7271272676704e6e26c6"
+          "content": "9d5a7418da2864535d5661cb6f3c2d7b8fc3e8cc98ef4e063370d841a7494abc"
         }
       ]
     },
@@ -8809,7 +8899,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5a7c2cffce4e62e4e859578b7014020670125e1ea68d4e04f2b1f6256c423b7a"
+          "content": "3d1805546b964d8bce68cc94cdf1d9dd5e7e6a558f112e73fe1faf0f1c445fd4"
         }
       ]
     },
@@ -8839,7 +8929,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4bb4dbe8a712c17a6df93ff86553a53364c66ea5a8b5caf694dc4992cb9e3e4b"
+          "content": "b0248fad94dc412820b0feae2d3cfd5796efac4d759a875c9063693bcd2c2a78"
         }
       ]
     },
@@ -9159,7 +9249,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "0f44ef0d05c0ffabffe5e0f4fb4539b67fd72f62b42206d68bc98199ea718dcd"
+          "content": "9041565e0c4f79a66edd8fed57e5e75029d1bd0c9b276fc86cbd2718b2fec6d8"
         }
       ]
     },
@@ -9283,6 +9373,16 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "src/stamped-path.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "bfb3729e414745a2d40694a244baedc56c4c2eaa6f42287e77b968d211bc54ed"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "src/statusline.ts",

package/src/index.ts

@@ -137,6 +137,7 @@ export { planLedgerBackfill, LEDGER_FILL_SOURCE, AMBIGUOUS, resolveLedgerRunId }
 export { projectSkillsOneRoot, projectSkillsProbeCommand } from './project-skills-root.js';
 export { isRepoBoundary } from './repo-boundary.js';
 export type { RepoBoundaryIo } from './repo-boundary.js';
+export { uniqueStampedPath, writeUniqueStampedFile } from './stamped-path.js';
 export type { LedgerBackfillPlan, LedgerBackfillRow, RunCostFacts } from './ledger-backfill.js';
 export type { SweepResult, DriftedSkill, SyncResult, SyncCanonicalOptions, CanonicalDefect, CanonicalDefectKind } from './skill-drift.js';
 export { benchmarkSkill, benchmarkSkills, compareSkills } from './benchmark.js';
@@ -779,6 +780,8 @@ export type {
   ChainDefectAges,
   ChainedJournal,
 } from './event-chain.js';
+export { packArtifact, readWorkspaceVersions, UnknownWorkspaceSpecError } from './pack-artifact.js';
+export type { PackArtifactResult, ExecLike } from './pack-artifact.js';
 export { decideProvenance, environmentCanMintProvenance, publishArgv, matchesPublishFilter, discoverPackages, publishPackages, bumpPatch, compareVersions, findUnpackagedSkills, findUnpublishedWorkspaceFloors, rewriteWorkspaceSpecs, orderByDependencies, syncReadmeVersion, isChangelogEntryLine, changelogRegion, planReadmeVersionSync } from './publish.js';
 export type { ReadmeVersionSyncPlan, ReadmeSyncRewrite } from './publish.js';
 export { RELEASE_LINE_RE, parseReleaseLine, findReleaseLine, rewriteReleaseLine, shortPackageName } from './release-line.js';
@@ -825,7 +828,7 @@ export type {
 } from './release.js';
 export { formatPublishError } from './publish.js';
 // Sibling-drift + packed-install-smoke gates (feature publish-sibling-drift-gate, ADR-001).
-export { detectSiblingDrift, parseNpmPackInventory } from './publish-sibling-drift.js';
+export { detectSiblingDrift, parseNpmPackInventory, formatDriftFiles } from './publish-sibling-drift.js';
 export type {
   SiblingDriftStatus,
   InventorySource,

package/src/lesson-payoff.ts

@@ -38,6 +38,7 @@ import { join } from 'node:path';
 
 import { LessonBandit, type ArmStats, type SerializedBanditState } from './lesson-bandit.js';
 import { withProjectLockSync } from './named-lock.js';
+import { uniqueStampedPath } from './stamped-path.js';
 import { readMemoryLearningConfig, type MemoryLearningConfig } from './patterns.js';
 
 // ── Paths and constants ─────────────────────────────────────────────────────────────────────────
@@ -383,7 +384,8 @@ function mutateBanditState(
         // Preserve the evidence before overwriting it — never delete, never "repair". This is the
         // ONE place a corrupt file is touched, and it is under the lock.
         const target = banditStatePath(projectRoot);
-        try { renameSync(target, `${target}.corrupt-${new Date().toISOString().replace(/[:.]/g, '-')}`); } catch { /* best-effort */ }
+        const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+        try { renameSync(target, uniqueStampedPath(`${target}.corrupt-`, stamp, existsSync)); } catch { /* best-effort */ }
         logBanditEvent(projectRoot, { event: 'bandit-error', ts: new Date().toISOString(), op, reason });
       }
       const bandit = LessonBandit.deserialize(state.bandit);

package/src/memory-index-check.ts

@@ -1,14 +1,22 @@
 import { Buffer } from 'node:buffer';
+import { stemToken, stems } from './stem.js';
 
 export const MEMORY_INDEX_MAX_BYTES = 24_000;
 export const MEMORY_INDEX_MAX_LINE_CHARS = 200;
 // Hook support is a lexical heuristic, not proof that a hook's meaning is preserved.
+// Shared conservative stems fold находку/находка → находк and подписью/подпись → подпис;
+// проверил ≠ проверка (verb/noun) and teacher ≠ teach remain distinct, without prefix matching.
 // Calibration history on the real index (108 judged lines): 2026-09-23 the coder measured a live
 // minimum of 0 at L83/L85/L114 and 15 lines under 0.5 — 14 were Russian hooks over English files
 // or other word forms (knowledge present), one (L76) linked the WRONG file. The lead rewrote those
-// hooks with words from their files; 2026-09-24 the live minimum is 0.5 exactly (5 lines at the
-// boundary, QE F2). The threshold stays the contract's 0.5; a hook at the boundary passes
+// hooks with words from their files; 2026-09-24 the live minimum is 0.5 exactly (QE F2 on 23.09 counted
+// 5 lines at the boundary on the then-index; re-measured 24.09 on the current index: 4 under the substring rule). The threshold stays the contract's 0.5; a hook at the boundary passes
 // (`support < min` fails), so the margin there is thin by construction.
+// Stem era (feature memory-index-hook-stems, 2026-09-24, lead on the host): with stem-to-stem support the
+// live index first showed ONE new finding — L46, support 2/6, a hook whose words the substring rule had
+// matched INSIDE other words (после/двух/ночь) — an honest downgrade, fixed in the memory file, not here;
+// after that: 0 findings, minimum 0.5 on exactly 2 lines (L18, L69 — measured with minHookSupport raised
+// just above 0.5 and counting `support 0.5` findings; the earlier "5" was a stale copy, QE F1), threshold unchanged.
 export const MEMORY_INDEX_MIN_HOOK_SUPPORT = 0.5;
 
 export type FindingKind = 'over-size' | 'long-line' | 'broken-link' | 'unindexed-file' | 'unsupported-hook' | 'duplicate-link';
@@ -35,6 +43,7 @@ export function checkMemoryIndex(input: {
   const lines = indexText === '' ? [] : indexText.split(/\r?\n/u);
   if (lines.at(-1) === '') lines.pop();
   const indexed = new Map<string, number>();
+  const stemsByFile = new Map<string, Set<string>>();
   for (const [offset, text] of lines.entries()) {
     const line = offset + 1;
     // String length measures UTF-16 code units, not bytes or Unicode code points.
@@ -58,8 +67,12 @@ export function checkMemoryIndex(input: {
     const tokens = (match[3]!.split(';', 1)[0]!.match(/[\p{L}\p{N}]{4,}/gu) ?? []).map(token => token.toLowerCase());
     // Fewer than three tokens are too short for this heuristic to judge.
     if (tokens.length < 3) continue;
-    const lowerContent = content.toLowerCase();
-    const missing = tokens.filter(token => !lowerContent.includes(token));
+    let contentStems = stemsByFile.get(file);
+    if (contentStems === undefined) {
+      contentStems = new Set(stems(content));
+      stemsByFile.set(file, contentStems);
+    }
+    const missing = tokens.filter(token => !contentStems.has(stemToken(token)));
     const supported = tokens.length - missing.length;
     const support = supported / tokens.length;
     if (support < minHookSupport) {

package/src/pack-artifact.ts

@@ -0,0 +1,109 @@
+/** One staged artifact for signing, publication and sibling drift. Linux/macOS tar. */
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { packedTarballName } from './packed-install-smoke.js';
+
+export type ExecLike = (command: string, options: { cwd: string; stdio: 'pipe'; encoding: 'utf-8'; maxBuffer: number }) => string;
+export interface PackArtifactResult {
+  readonly tgzPath: string;
+  readonly sha256: string;
+  readonly files: readonly string[];
+}
+
+export class UnknownWorkspaceSpecError extends Error {
+  constructor(dependency: string, spec: string) {
+    super(`Unknown workspace dependency spec for ${dependency}: ${spec}; supply a version and use workspace:*, workspace:^ or workspace:~`);
+    this.name = 'UnknownWorkspaceSpecError';
+  }
+}
+
+export function rewriteWorkspaceSpecs(
+  pkgJsonText: string,
+  siblingVersions: ReadonlyMap<string, string>,
+): string {
+  const pkg = JSON.parse(pkgJsonText) as Record<string, unknown>;
+  const fields = ['dependencies', 'peerDependencies', 'optionalDependencies', 'devDependencies'] as const;
+  for (const field of fields) {
+    const candidate = pkg[field];
+    if (candidate === null || typeof candidate !== 'object' || Array.isArray(candidate)) continue;
+    const table = candidate as Record<string, unknown>;
+    for (const [dep, spec] of Object.entries(table)) {
+      if (typeof spec !== 'string') continue;
+      const match = /^workspace:([*^~])$/.exec(spec);
+      const version = siblingVersions.get(dep);
+      if (match === null) {
+        if (spec.startsWith('workspace:') || spec.startsWith('catalog:')) {
+          throw new UnknownWorkspaceSpecError(dep, spec);
+        }
+        continue;
+      }
+      if (version === undefined) continue;
+      const marker = match[1]!;
+      table[dep] = marker === '*' ? version : `${marker}${version}`;
+    }
+  }
+  return JSON.stringify(pkg, null, 2) + '\n';
+}
+
+/** Current pins, read afresh so a later sign sees a sibling's new version. */
+export function readWorkspaceVersions(repoRoot: string): ReadonlyMap<string, string> {
+  const scope = join(repoRoot, 'packages', '@dzhechkov');
+  const versions = new Map<string, string>();
+  if (!existsSync(scope)) return versions;
+  for (const entry of readdirSync(scope).sort()) {
+    const manifest = join(scope, entry, 'package.json');
+    if (!existsSync(manifest)) continue;
+    const pkg = JSON.parse(readFileSync(manifest, 'utf8')) as { name?: unknown; version?: unknown };
+    if (typeof pkg.name === 'string' && typeof pkg.version === 'string') versions.set(pkg.name, pkg.version);
+  }
+  return versions;
+}
+
+// POSIX shell argument quoting: paths may contain spaces, quotes, dollars or backticks.
+
+export function packArtifact(opts: {
+  pkgDir: string;
+  destDir: string;
+  exec: ExecLike;
+  pinVersions: ReadonlyMap<string, string>;
+}): PackArtifactResult {
+  const pkgDir = resolve(opts.pkgDir);
+  const destDir = resolve(opts.destDir);
+  const manifestPath = join(pkgDir, 'package.json');
+  const original = readFileSync(manifestPath);
+  try {
+    const staged = JSON.parse(rewriteWorkspaceSpecs(original.toString('utf8'), opts.pinVersions)) as Record<string, unknown>;
+    // The public rewrite helper historically leaves a known shorthand without a pin unchanged.
+    // An artifact must never ship that unresolved value, even when its caller supplied an incomplete map.
+    for (const field of ['dependencies', 'peerDependencies', 'optionalDependencies', 'devDependencies']) {
+      const table = staged[field];
+      if (table === null || typeof table !== 'object' || Array.isArray(table)) continue;
+      for (const [dependency, value] of Object.entries(table)) {
+        if (typeof value === 'string' && /^workspace:[*^~]$/.test(value)) {
+          throw new UnknownWorkspaceSpecError(dependency, value);
+        }
+      }
+    }
+    const scripts = staged['scripts'];
+    if (scripts !== null && typeof scripts === 'object' && !Array.isArray(scripts)) {
+      delete (scripts as Record<string, unknown>)['prepublishOnly'];
+    }
+    const name = staged['name'];
+    const version = staged['version'];
+    if (typeof name !== 'string' || typeof version !== 'string') throw new Error(`Missing package name/version in ${manifestPath}`);
+    mkdirSync(destDir, { recursive: true });
+    writeFileSync(manifestPath, JSON.stringify(staged, null, 2) + '\n');
+    const execOptions = { cwd: pkgDir, stdio: 'pipe' as const, encoding: 'utf-8' as const, maxBuffer: 64 * 1024 * 1024 };
+    // The command shape is a CONTRACT: publish's test fake admits exactly this template — double-quoted
+    // via JSON.stringify, verbatim from the publish.ts template it replaced (publish-confirm-seam.test.ts).
+    opts.exec(`npm pack . --pack-destination ${JSON.stringify(destDir)}`, execOptions);
+    const tgzPath = join(destDir, packedTarballName(name, version));
+    const listing = opts.exec(`tar -tzf ${JSON.stringify(tgzPath)}`, execOptions);
+    const files = listing.split(/\r?\n/).filter(p => p !== '' && !p.endsWith('/')).map(p => p.replace(/^package\//, '')).sort();
+    const sha256 = createHash('sha256').update(readFileSync(tgzPath)).digest('hex');
+    return { tgzPath, sha256, files };
+  } finally {
+    writeFileSync(manifestPath, original);
+  }
+}

package/src/profile.ts

@@ -512,7 +512,12 @@ export function syncProfileBlock(profile: OperatorProfile, home?: string, now?:
     let backup: string | null = null;
     if (existing !== null) {
       const stamp = (now ?? new Date()).toISOString().replace(/[:.]/g, '-');
+      // Two syncs inside one millisecond (a fast CI runner) share a stamp: MEASURED 2026-09-24 on
+      // package-story-gates (73ac1a32) — the second backup overwrote the first and the test that
+      // promises "backups accumulate rather than overwriting" read 1 file. A taken name gets a
+      // counter suffix; a backup is never written over an existing one.
       backup = `${target}.dz-profile-backup-${stamp}`;
+      for (let n = 1; existsSync(backup); n += 1) backup = `${target}.dz-profile-backup-${stamp}-${n}`;
       writeFileSync(backup, existing, { mode: 0o600 });
       chmodSync(backup, 0o600); // writeFileSync's mode applies only at creation
     }