@lmzhen/dsh-evolution-commands 0.17.1 → 0.18.0

package/lib/index.js

@@ -2,8 +2,8 @@ import { createRequire } from "node:module";
 import z from "@deepseek-ai/schemastery";
 import { effectiveSessionPolicy } from "@lmzhen/dsh-evolution-approval";
 import { createUserMessage } from "@deepseek-ai/dsh-llm";
-import { DEFAULT_SKILL_LIMITS, MAX_TIMER_DELAY_MS, PARAM_EXPOSURE, PARAM_GROUP_LABELS, appendEvolutionEvent, applyNamespaceMigration, assertSkillsRootAliasRetired, buildLearnPrompt, canonicalWriteId, clampedNumber, classifyNamespaceMigration, composePresetEntry, elapsedSince, errorText, eventsFile, evolutionRoot, isDeprecatedParamId, isMissingPath, mergePresetRow, newSkillLibrary, paramSettingsId, partitionVersions, planNamespaceMigration, policyStageLimits, presetPatchText, presetRowBlock, presetRowBody, presetRowId, resolveBasePresetPatch, resolveParamId, resolveRootConfig, scopedProbeReport } from "@lmzhen/dsh-evolution-core";
-import { buildEnrichment, buildMaintainFacts, runMaintain, snapshotFromLibrary } from "@lmzhen/dsh-evolution-maintenance";
+import { DEFAULT_SKILL_LIMITS, MAX_TIMER_DELAY_MS, PARAM_EXPOSURE, PARAM_GROUP_LABELS, absentHostServices, appendEvolutionEvent, applyNamespaceMigration, assertSkillsRootAliasRetired, buildLearnPrompt, canonicalWriteId, clampedNumber, classifyNamespaceMigration, composePresetEntry, elapsedSince, errorText, eventsFile, evolutionRoot, isDeprecatedParamId, isMissingPath, mergePresetRow, newSkillLibrary, paramSettingsId, partitionVersions, planNamespaceMigration, policyStageLimits, presetPatchText, presetRowBlock, presetRowBody, presetRowId, resolveBasePresetPatch, resolveParamId, resolveRootConfig, scopedProbeReport } from "@lmzhen/dsh-evolution-core";
+import { buildEnrichment, buildMaintainFacts, enrichmentSnapshotOptions, runMaintain, snapshotFromLibrary } from "@lmzhen/dsh-evolution-maintenance";
 import { copyFileSync, existsSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -235,7 +235,7 @@ async function readPlatformView(ctx) {
 */
 /** The patch file name inside a profile directory (`packages/boot/app-boot/src/profile.ts`,
 * `PROFILE_PATCH_FILENAME`). */
-const PROFILE_PATCH_FILENAME$1 = "cordis.patch.yml";
+const PROFILE_PATCH_FILENAME = "cordis.patch.yml";
 /**
 * The profile patch this process writes into, or undefined outside a profile.
 *
@@ -251,11 +251,33 @@ function presetProfileTarget(ctx) {
 	return {
 		profile: profile.name,
 		profileDir: profile.dir,
-		patchPath: typeof profile.patchPath === "string" && profile.patchPath !== "" ? profile.patchPath : join(profile.dir, PROFILE_PATCH_FILENAME$1),
+		patchPath: typeof profile.patchPath === "string" && profile.patchPath !== "" ? profile.patchPath : join(profile.dir, PROFILE_PATCH_FILENAME),
 		bundles: Array.isArray(profile.startedBundles) ? profile.startedBundles : []
 	};
 }
 /**
+* The ONE host-side answer to "can this base be used here?".
+*
+* Both host entry points ask it: `/evolution preset install` refuses a base through this function,
+* and `/evolution doctor` enumerates the installable bases through it, with the SAME probe — the
+* runtime's own answer (`ctx.get(<service>)`), which is exactly the reason a later mount would
+* refuse. A doctor that infers the answer from bundle names instead (it did until v46 S2.8) can
+* disagree with the write entry it tells the operator to run: a deployment that mounts the web-app
+* bundle while the service's own row is disabled installs nothing, yet reads as installable. The
+* source-checkout installer runs outside the host and cannot read the service store; it asks the
+* target profile's bundle rows instead and says so (`install-layered.mjs`'s
+* `baseUnavailableReason`).
+* @param entry - the table row.
+* @param servicePresent - whether a service name resolves in this deployment.
+* @returns the refusal text, or undefined when the base is usable here.
+*/
+function baseRefusalReason(entry, servicePresent) {
+	if (typeof entry.unsupported === "string" && entry.unsupported !== "") return `Base "${entry.name}" is registered as UNSUPPORTED: ${entry.unsupported}`;
+	const service = entry.requires?.service;
+	if (typeof service !== "string" || service === "") return void 0;
+	return servicePresent(service) ? void 0 : `Base "${entry.name}" requires the "${service}" service, which this deployment does not provide — the generated preset would refuse to mount.`;
+}
+/**
 * Resolve the platform base preset patch one `--base` composes.
 *
 * The module graph is probed FIRST: a desktop/Electron host resolves the bundle package inside
@@ -381,7 +403,7 @@ function paramDivergences(platform) {
 		issues.push(`user override: ${entryId} sets ${keys.length} parameter(s) — ${shown.join(", ")}${more}`);
 		for (const key of keys) {
 			if (!isDeprecatedParamId(key)) continue;
-			issues.push(`deprecated name: ${entryId} still writes "${key}" — write "${resolveParamId(key)}" instead (writes refuse the alias; it is removed in 0.7.0)`);
+			issues.push(`deprecated name: ${entryId} still writes "${key}" — write "${resolveParamId(key)}" instead (writes refuse the alias; removal was planned for 0.7.0 and is deferred — the alias still ships)`);
 		}
 	}
 	if (platform.plugins === void 0) {
@@ -549,9 +571,19 @@ function readAgentPresetBases$1(path) {
 		return null;
 	}
 }
-/** The profile patch file name (`packages/boot/app-boot/src/profile.ts`,
-* `PROFILE_PATCH_FILENAME`). */
-const PROFILE_PATCH_FILENAME = "cordis.patch.yml";
+/** The bundle rows one profile manifest mounts (scope-agnostic, as written) — the target a preset
+* recompute resolves its platform base patch through.
+* @param profileDir - the profile directory.
+* @returns the bundle names; empty when the manifest is missing or torn.
+*/
+function profileBundles(profileDir) {
+	try {
+		const bundles = JSON.parse(readFileSync(join(profileDir, "package.json"), "utf8")).dsh?.profile?.bundles;
+		return Array.isArray(bundles) ? bundles.filter((name) => typeof name === "string") : [];
+	} catch {
+		return [];
+	}
+}
 /** Every profile directory under one DSH_HOME, by name.
 * @param home - resolved DSH_HOME.
 * @returns `{ profile, dir }` per directory under `profiles/` that carries a manifest.
@@ -577,16 +609,15 @@ function profileDirectories(home) {
 	}
 	return out;
 }
-/** The bundle rows one profile manifest mounts (scope-agnostic, as written).
-* @param profileDir - the profile directory.
-* @returns the bundle names; empty when the manifest is missing or torn.
+/** One optional file's text, or `''` when it is absent or unreadable.
+* @param path - the file to read.
+* @returns the text.
 */
-function profileBundles(profileDir) {
+function readTextOrEmpty(path) {
 	try {
-		const bundles = JSON.parse(readFileSync(join(profileDir, "package.json"), "utf8")).dsh?.profile?.bundles;
-		return Array.isArray(bundles) ? bundles.filter((name) => typeof name === "string") : [];
+		return readFileSync(path, "utf8");
 	} catch {
-		return [];
+		return "";
 	}
 }
 /** The profile patch text, or `''` when the profile has none.
@@ -594,33 +625,42 @@ function profileBundles(profileDir) {
 * @returns the patch text.
 */
 function profilePatchText(profileDir) {
-	try {
-		return readFileSync(join(profileDir, PROFILE_PATCH_FILENAME), "utf8");
-	} catch {
-		return "";
-	}
+	return readTextOrEmpty(join(profileDir, PROFILE_PATCH_FILENAME));
 }
-/** Whether a base's `requires.service` precondition is met by one profile's bundles — the same
-* judgement the installer applies (`baseUnavailableReason`), read from the same rows.
+/** Every USER-layer patch text that can carry a family preset row: each profile's own patch, then
+* the home layer (`<home>/cordis.patch.yml`), which the platform composes AFTER the profile layer
+* (`readProfilePatches` in `packages/boot/app-boot/src/profile-context.ts`). A row written there
+* mounts exactly like one in the profile patch, so a probe reading only the per-profile patches
+* reports a home-layer install as no install at all.
+* @param home - resolved DSH_HOME.
+* @returns the patch texts that exist, in profile-then-home order.
+*/
+function userPatchTexts(home) {
+	const texts = profileDirectories(home).map(({ dir }) => profilePatchText(dir));
+	texts.push(readTextOrEmpty(join(home, PROFILE_PATCH_FILENAME)));
+	return texts.filter((text) => text !== "");
+}
+/** Whether a base's `requires.service` precondition is met HERE — the SAME function and the SAME
+* probe `/evolution preset install` refuses through (`baseRefusalReason` over the runtime's own
+* service store), so the doctor and the write entry cannot reach different conclusions about one
+* deployment.
 * @param base - the table row.
-* @param bundles - the profile's bundle names.
+* @param servicePresent - whether a service name resolves in this runtime.
 * @returns true when the base can be installed here.
 */
-function baseInstallable(base, bundles) {
-	if (typeof base.unsupported === "string") return false;
-	const service = base.requires?.service;
-	if (typeof service !== "string" || service === "") return true;
-	return bundles.some((name) => name.trim().endsWith("dsh-web-app"));
+function baseInstallable(base, servicePresent) {
+	return baseRefusalReason(base, servicePresent) === void 0;
 }
 /**
-* S1-F1: ids of the family's INSTALLED preset rows — every declared preset row in a profile patch
-* that can actually carry the family model rows.
+* S1-F1: ids of the family's INSTALLED preset rows — every declared preset row in a USER patch
+* layer that can actually carry the family model rows.
 *
-* The artifact is a declared preset ROW in a profile's own patch layer, so this probe reads that
-* file (`PROFILE_PATCH_FILENAME`) in every profile of the home. A probe narrowed to one base id
-* leaves a `--base ptc|cordis` install invisible: installForm then degrades to `none`/`host` and
-* the action ladder recommends installing `evolution-all` on top — the exact double-mount the
-* doctor exists to prevent.
+* The artifact is a declared preset ROW in a user patch layer, so this probe reads every profile's
+* own patch AND the home layer (`userPatchTexts`). A probe narrowed to one base id leaves a
+* `--base ptc|cordis` install invisible; one narrowed to the profile layer alone (it was until v46
+* S2.8/T4-07) leaves a home-layer install invisible — either way installForm degrades to
+* `none`/`host` and the action ladder recommends installing `evolution-all` on top, the exact
+* double-mount the doctor exists to prevent.
 *
 * A row counts only when the base table names its id as a SUPPORTED family base (the `unsupported`
 * minimal base carries no model rows and cannot double-mount anything). When the table itself
@@ -633,8 +673,7 @@ function installedLayeredPresetIds(home) {
 	const basesPath = resolveAgentPresetAsset("bases.json");
 	const bases = basesPath === null ? null : readAgentPresetBases$1(basesPath);
 	const ids = /* @__PURE__ */ new Set();
-	for (const { dir } of profileDirectories(home)) {
-		const text = profilePatchText(dir);
+	for (const text of userPatchTexts(home)) {
 		if (text === "") continue;
 		if (bases === null) {
 			for (const match of text.matchAll(/^\s*- id:\s*(preset-[a-z0-9-]+)\s*$/gm)) if (match[1]?.startsWith(`preset-evolution`)) ids.add(match[1].slice(7));
@@ -657,9 +696,10 @@ function installedLayeredPresetIds(home) {
 * installer about what "fresh" means. Read-only by contract: the snapshot is
 * never rewritten.
 * @param home - resolved DSH_HOME.
+* @param servicePresent - whether a service name resolves in this runtime (the write entry's probe).
 * @returns one row per profile × installable base of the family bases.json.
 */
-function probePresetFreshness(home) {
+function probePresetFreshness(home, servicePresent) {
 	const basesPath = resolveAgentPresetAsset("bases.json");
 	const deltaPath = resolveAgentPresetAsset("agent.cordis.yml");
 	const bases = basesPath === null ? null : readAgentPresetBases$1(basesPath);
@@ -690,7 +730,7 @@ function probePresetFreshness(home) {
 		const text = profilePatchText(dir);
 		const bundles = profileBundles(dir);
 		for (const base of bases) {
-			if (!baseInstallable(base, bundles)) continue;
+			if (!baseInstallable(base, servicePresent)) continue;
 			const block = presetRowBlock(text, presetRowId(base.id));
 			if (block === null) {
 				rows.push({
@@ -807,7 +847,8 @@ async function diagnose(ctx, options = {}) {
 		conflicts.push(scope === "profiles-dir" ? `the home profiles directory could not be enumerated (${detail}) — bundle-based install-form and conflict checks are DEGRADED and may miss installed bundles` : `a profile manifest could not be read or parsed (${detail}) — this profile's bundle rows are UNKNOWN, so the install-form and conflict checks are DEGRADED and may miss installed bundles`);
 	});
 	const has = (name) => ctx.get(name) !== void 0;
-	const presetFreshness = probePresetFreshness(home);
+	const capabilityAbsence = absentHostServices(has);
+	const presetFreshness = probePresetFreshness(home, has);
 	const platform = await readPlatformView(ctx);
 	const familyBundleRows = platform.bundles?.filter((row) => tailOf(row.name).startsWith("dsh-evolution-"));
 	const runtimeBundles = familyBundleRows === void 0 ? void 0 : familyBundleRows.filter((row) => row.enabled).map((row) => row.name);
@@ -838,7 +879,9 @@ async function diagnose(ctx, options = {}) {
 	};
 	let pendingCount = null;
 	let executingCount = null;
+	let pendingTtlMs = null;
 	const approvalService = ctx.get("evolutionApproval");
+	if (typeof approvalService?.ttlMs === "number" && Number.isFinite(approvalService.ttlMs)) pendingTtlMs = approvalService.ttlMs;
 	const approvalList = approvalService?.list?.bind(approvalService);
 	if (approvalList !== void 0) try {
 		const pendingProbe = await probeBounded(() => approvalList("pending"), "approval pending listing");
@@ -867,8 +910,10 @@ async function diagnose(ctx, options = {}) {
 	else if (installForm === "layered") actions.push("Variant form (session opt-in): model tools follow the Evolution preset, and a session on a platform original preset carries no family rows; add @lmzhen/dsh-evolution-all instead if every session should have them.");
 	const env = envIssues();
 	if (env.length > 0) actions.push("Fix the DSH_EVOLUTION_* variable listed above.");
+	if (capabilityAbsence.length > 0) actions.push(`The family probes ${capabilityAbsence.length} platform capability/ies this deployment does not mount (${capabilityAbsence.map((entry) => entry.service).join(", ")}) — mount the rows that carry the ones you need; the features they gate are listed above.`);
 	if (services.review && !services.curator) actions.push("Curator service is not mounted — automatic curation is off; verify the host/all bundle row set is complete.");
 	if (pendingCount === null && services.approval) actions.push("Approval service is mounted but pending listing failed — check the evolution state service.");
+	if (pendingTtlMs !== null && pendingTtlMs > 0) actions.push(`Staged writes expire after ${pendingTtlMs} ms (evolution-approval.pendingTtlMs): an expired write is closed as rejected and is never executed.`);
 	const presetIssueRows = presetIssues(platform.presets);
 	if (presetIssueRows.length > 0) actions.push("Resolve the agent-preset finding above: a broken preset composes no session, and a row two presets declare is resolved by layer order (keep the declaration in one preset).");
 	const legacy = await legacyMigrationRow(ctx, home);
@@ -898,6 +943,7 @@ async function diagnose(ctx, options = {}) {
 		paramIssues,
 		queryIssues,
 		services,
+		capabilityAbsence,
 		pendingCount,
 		executingCount,
 		presetFreshness,
@@ -1036,6 +1082,7 @@ function renderDoctorText(report) {
 		report.dormantBundles.length === 0 ? null : `installed but not selected: ${report.dormantBundles.join(", ")} — the Plugins page lists them; this runtime mounts neither`,
 		`bundles (all profiles): ${report.bundles.length > 0 ? report.bundles.join(", ") : "(none)"}`,
 		`services: review=${report.services.review} (${report.serviceSource === "platform" ? "the live row, this runtime" : "inferred from bundles, all profiles"}) curator=${report.services.curator} approval=${report.services.approval} skillUsage=${report.services.skillUsage} io=${report.services.io}`,
+		report.capabilityAbsence.length === 0 ? null : `capability absence (${report.capabilityAbsence.length}): ${report.capabilityAbsence.map((entry) => `${entry.service} — ${entry.feature}`).join("; ")}`,
 		scopedProbeLine(report.scopedProbe),
 		legacyLine(report.legacy),
 		`pending: ${report.pendingCount === null ? "unknown" : report.pendingCount}`,
@@ -1348,580 +1395,568 @@ function apply(ctx, rawConfig = {}) {
 	let maintainInFlightSince = 0;
 	ctx.inject(["commands"], (commandCtx) => {
 		const commands = commandCtx.commands;
-		const evolutionCommand = {
-			name: "evolution",
-			description: "自进化：状态与待批准写入",
-			recordInput: false,
-			input: { hint: renderHint() },
-			run: async (invocation) => {
-				const rawInputTrimmed = invocation.rawInput.trim();
-				const input = rawInputTrimmed.replace(/\s+/g, " ");
-				const ok = (text) => ({
-					kind: "success",
-					text
+		const commandBody = { run: async (invocation) => {
+			const rawInputTrimmed = invocation.rawInput.trim();
+			const input = rawInputTrimmed.replace(/\s+/g, " ");
+			const ok = (text) => ({
+				kind: "success",
+				text
+			});
+			const err = (text) => ({
+				kind: "error",
+				text
+			});
+			const invocationAgent = invocation.agent;
+			const agentMissing = (need) => invocationAgent === void 0 ? err(errorText("e-305-this-invocation-carries-no", { a1: need })) : void 0;
+			const unreplayableWriteRefusal = (what) => {
+				if (approval === void 0) return void 0;
+				const session = invocationAgent?.session;
+				const sessionPolicy = effectiveSessionPolicy(ctx, session);
+				if (!(approval.isEnabled !== false && sessionPolicy !== "never" && approval.stageForeground !== false)) return void 0;
+				return err(errorText("e-306-this-deployment-stages-foreground", { a1: what }));
+			};
+			const approval = ctx.get("evolutionApproval");
+			const pendingMatch = /^pending(?: --detail)?$/.exec(input);
+			if (pendingMatch) {
+				if (!approval) return err(errorText("e-301-approval-service-not-mounted"));
+				const listed = [...await approval.list("pending"), ...await approval.list("executing")];
+				const pending = [...new Map(listed.map((row) => [row.id, row])).values()];
+				const ttlMs = typeof approval.ttlMs === "number" && Number.isFinite(approval.ttlMs) ? approval.ttlMs : 0;
+				const ttlNote = ttlMs > 0 ? `\n(staged writes expire after ${ttlMs} ms: an expired write is closed as REJECTED and is never executed — stage it again if it is still wanted)` : "\n(staged writes never expire — the window waits for a decision; set the evolution-approval row pendingTtlMs to bound it)";
+				if (pending.length === 0) return ok("No pending evolution writes." + ttlNote);
+				const detailed = pendingMatch[0] === "pending --detail";
+				const nowMs = Date.now();
+				const attribution = (p) => {
+					const age = elapsedSince(p.createdAt, nowMs);
+					const unit = age.n === 1 ? age.unit.replace(/s$/u, "") : age.unit;
+					return `  ·  ${age.unit === "now" ? "just now" : `${age.n} ${unit} ago`}${p.origin === void 0 ? "" : `  from ${p.origin}`}${p.sessionId === void 0 ? "" : ` (session ${p.sessionId.slice(0, 8)})`}`;
+				};
+				return ok(pending.map((p) => {
+					if (!detailed) return `${p.id}  ${p.kind}  ${p.status === "executing" ? "EXECUTING " : ""}${p.summary}${attribution(p)}`;
+					const status = p.status === "executing" ? "EXECUTING" : p.status;
+					const line = `${p.id}  ${p.kind}  ${status}  ${p.summary}${attribution(p)}`;
+					return p.args === void 0 ? line : `${line}\n  staged args: ${safeStagedArgs(p.args)}`;
+				}).join("\n") + (pending.some((p) => p.status === "executing") ? "\n(EXECUTING: a previous approve may have crashed after running; verify the write manually, then reject — approve will not re-run it)" : "") + ttlNote);
+			}
+			if (input.startsWith("approve ")) {
+				const id = input.slice(8).trim();
+				const result = approval ? await approval.approve(id) : {
+					ok: false,
+					message: errorText("e-301-approval-service-not-mounted-2")
+				};
+				return result.ok ? ok(result.message) : err(result.message);
+			}
+			if (input.startsWith("reject ")) {
+				const id = input.slice(7).trim();
+				const result = approval ? await approval.reject(id) : {
+					ok: false,
+					message: errorText("e-301-approval-service-not-mounted-2")
+				};
+				return result.ok ? ok(result.message) : err(result.message);
+			}
+			if (input.startsWith("release ")) {
+				const id = input.slice(8).trim();
+				if (!approval) return err(errorText("e-301-approval-service-not-mounted-2"));
+				if (!approval.release) return err(errorText("e-304-the-mounted-approval-service"));
+				const result = await approval.release(id);
+				return result.ok ? ok(result.message) : err(result.message);
+			}
+			if (input === "curator run") {
+				const curator = ctx.get("evolutionCurator");
+				if (!curator) return err(errorText("e-302-curator-service-not-mounted"));
+				const result = await curator.run({ ignoreGates: true });
+				if (result.skipped !== void 0) return ok(`Curator run skipped (${result.skipped}): no curation pass was executed.\nrunId=${result.report.runId}`);
+				return ok(`Curator run complete: ${result.stale.length} stale, ${result.archived.length} archived, ${result.errors.length} failed.\nrunId=${result.report.runId}${result.report.snapshotPath ? `\nsnapshot=${result.report.snapshotPath}` : ""}`);
+			}
+			if (input === "curator pause" || input === "curator resume") {
+				const curator = ctx.get("evolutionCurator");
+				if (!curator) return err(errorText("e-302-curator-service-not-mounted"));
+				const paused = input === "curator pause";
+				await curator.setPaused(paused);
+				const notPersisted = ctx.get("evolutionState") !== void 0 ? "" : "\nNOTE: no evolution state service is mounted — this setting is NOT persisted and will not survive this process.";
+				return ok((paused ? "Curator automatic curation paused. Manual /evolution curator run is unaffected; resume with /evolution curator resume." : "Curator automatic curation resumed. The next scheduled pass waits one interval (first-run defer semantics).") + notPersisted);
+			}
+			if (input === "curator status") {
+				const curator = ctx.get("evolutionCurator");
+				if (!curator) return err(errorText("e-302-curator-service-not-mounted"));
+				const state = await curator.status();
+				if (!state) return ok("No curator state yet: the first automatic pass is deferred until the interval elapses.");
+				const lastRun = typeof state.lastRunAt === "number" && Number.isFinite(state.lastRunAt) && state.lastRunAt > 0 ? new Date(state.lastRunAt).toISOString() : "unknown";
+				return ok([
+					`paused=${state.paused}`,
+					`runs=${state.runCount}`,
+					`lastRun=${lastRun}`,
+					`summary=${state.lastSummary}`
+				].join("\n"));
+			}
+			if (input === "mutations") {
+				const curator = ctx.get("evolutionCurator");
+				if (!curator) return err(errorText("e-302-curator-service-not-mounted"));
+				const records = await curator.skills.listMutations();
+				const usable = Array.isArray(records) ? records.filter((row) => typeof row === "object" && row !== null && typeof row.at === "string" && typeof row.skillName === "string" && typeof row.action === "string" && typeof row.summary === "string") : [];
+				if (usable.length === 0) return ok("No mutation records yet.");
+				const recent = usable.slice(-5).reverse().map((record) => `${record.at.slice(0, 19)}  ${record.skillName}  ${record.action}  ${record.summary}`);
+				return ok(`Mutations: ${usable.length} recorded (recent 5):\n${recent.join("\n")}`);
+			}
+			if (input === "curator scope") {
+				const curator = ctx.get("evolutionCurator");
+				if (!curator) return err(errorText("e-302-curator-service-not-mounted"));
+				const view = await curator.scopeView();
+				const line = (label, names) => `${label}: ${names.length}${names.length === 0 ? "" : `\n  ${names.join(", ")}`}`;
+				return ok([
+					`Lifecycle scope at ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`,
+					line("Managed (may transition)", view.managed),
+					line("Watched (stale / quality-warned)", view.watched),
+					line("Quality-warned", view.qualityWarned),
+					line("Exempted (exclude / referenced)", view.exempted),
+					line("Protected (pinned / bundled / hub / builtin)", view.protected)
+				].join("\n"));
+			}
+			if (input === "curator report") {
+				const curator = ctx.get("evolutionCurator");
+				if (!curator) return err(errorText("e-302-curator-service-not-mounted"));
+				const report = await curator.latestReport();
+				if (!report) return ok("No curator report available.");
+				if (typeof report !== "object" || typeof report.runId !== "string" || typeof report.startedAt !== "string" || !Array.isArray(report.archived) || !Array.isArray(report.failed)) return err("Report file unreadable.");
+				const reportAny = report;
+				const nameOf = (item) => typeof item === "object" && item !== null && typeof item.name === "string" ? item.name : "?";
+				const reasonOf = (item) => typeof item === "object" && item !== null && typeof item.reason === "string" ? item.reason : "?";
+				const aborted = typeof reportAny.aborted === "string" ? reportAny.aborted : void 0;
+				const unattributed = Array.isArray(reportAny.unattributed) ? reportAny.unattributed.length : 0;
+				return ok([
+					`runId=${reportAny.runId}`,
+					`startedAt=${reportAny.startedAt}`,
+					`archived=${reportAny.archived.map(nameOf).join(", ") || "(none)"}`,
+					`failed=${reportAny.failed.map((item) => `${nameOf(item)}: ${reasonOf(item)}`).join(", ") || "(none)"}`,
+					...aborted === void 0 ? [] : [`aborted=${aborted}`],
+					...unattributed === 0 ? [] : [`unattributed=${unattributed}`]
+				].join("\n"));
+			}
+			if (input === "restore" || input.startsWith("restore ")) {
+				const tail = input.slice(7).trim();
+				if (tail !== "") return err(`\`restore\` takes no arguments (got "${tail}"). Use \`restore\` for a whole-tree rollback, or \`skill restore <name>\` for one skill.`);
+				const restoreRefusal = unreplayableWriteRefusal("restore");
+				if (restoreRefusal) return restoreRefusal;
+				const curator = ctx.get("evolutionCurator");
+				const result = curator ? await curator.restoreSnapshot() : {
+					ok: false,
+					message: errorText("e-302-curator-service-not-mounted")
+				};
+				return result.ok ? ok(result.message) : err(result.message);
+			}
+			if (input.startsWith("consolidate ")) {
+				const consolidateRefusal = unreplayableWriteRefusal("consolidate");
+				if (consolidateRefusal) return consolidateRefusal;
+				const planTail = /\s--plan\s+(\S+)\s*$/.exec(input) ?? null;
+				const planRunId = planTail?.[1] ?? void 0;
+				const [target, ...sources] = (planTail ? input.slice(0, planTail.index) : input).slice(12).trim().split(/\s+/).filter(Boolean);
+				if (!target || sources.length === 0) return err("Usage: /evolution consolidate <target> <source...>");
+				const curator = ctx.get("evolutionCurator");
+				const result = curator ? await curator.consolidate(target, sources) : {
+					ok: false,
+					message: errorText("e-302-curator-service-not-mounted")
+				};
+				if (!result.ok) return err(result.message);
+				return ok(planRunId ? `${result.message}\n[audit] plan=${planRunId}` : result.message);
+			}
+			if (input.startsWith("skill restore ")) {
+				const name = input.slice(14).trim();
+				if (!name) return err("Usage: /evolution skill restore <name>");
+				const skillRestoreRefusal = unreplayableWriteRefusal("skill restore");
+				if (skillRestoreRefusal) return skillRestoreRefusal;
+				const curator = ctx.get("evolutionCurator");
+				const result = curator ? await curator.restore(name) : {
+					ok: false,
+					message: errorText("e-302-curator-service-not-mounted")
+				};
+				return result.ok ? ok(result.message) : err(result.message);
+			}
+			if (input.startsWith("skill history ")) {
+				const name = input.slice(14).trim();
+				if (!name) return err("Usage: /evolution skill history <name>");
+				const curator = ctx.get("evolutionCurator");
+				if (!curator) return err(errorText("e-302-curator-service-not-mounted"));
+				const versions = await curator.history(name);
+				if (versions.length === 0) return ok(`No content versions are recorded for "${name}" yet — they appear after the next write through skill_manage.`);
+				const groups = partitionVersions(versions);
+				const row = (entry) => `v${entry.v}\t${entry.at}\t${entry.action}\t${entry.chars} chars\t${entry.hash.slice(0, 12)}`;
+				const lines = [`Content versions for "${name}" (oldest first, ${groups.content.length} of at most the retained count):`, ...groups.content.map(row)];
+				if (groups.support.length > 0) lines.push("Support-file versions (history only — undo restores SKILL.md, not these bytes):", ...groups.support.map(row));
+				return ok(lines.join("\n"));
+			}
+			if (input.startsWith("skill undo ")) {
+				const rest = input.slice(11).trim();
+				const toMatch = /--to\s+v?(\d+)\s*$/.exec(rest);
+				const name = (toMatch?.index === void 0 ? rest : rest.slice(0, toMatch.index)).trim();
+				if (!name) return err("Usage: /evolution skill undo <name> [--to v<N>]");
+				const skillUndoRefusal = unreplayableWriteRefusal("skill undo");
+				if (skillUndoRefusal) return skillUndoRefusal;
+				const curator = ctx.get("evolutionCurator");
+				const target = toMatch?.[1] === void 0 ? void 0 : Number(toMatch[1]);
+				const result = curator ? await (target === void 0 ? curator.undo(name) : curator.undo(name, target)) : {
+					ok: false,
+					message: errorText("e-302-curator-service-not-mounted")
+				};
+				return result.ok ? ok(result.message) : err(result.message);
+			}
+			if (input === "skills health") {
+				const curator = ctx.get("evolutionCurator");
+				if (!curator) return err(errorText("e-302-curator-service-not-mounted"));
+				const [rows, observed] = await Promise.all([curator.healthView(), curator.usageObserved()]);
+				const banner = observed ? "" : "Usage observation not yet established — churn (write-ghost) rows are suppressed.";
+				const line = (row) => `${row.verdict.padEnd(18)} ${row.name}${row.reasons.length > 0 ? ` — ${row.reasons.join("; ")}` : ""}`;
+				if (rows.length === 0) return ok(banner ? `Structure health: all skills healthy. ${banner}` : "Structure health: all skills healthy.");
+				return ok([banner ? `Structure health (${rows.length} degraded): ${banner}` : `Structure health (${rows.length} degraded):`, ...rows.map(line)].join("\n"));
+			}
+			if (input === "skills refresh") {
+				ctx.emit("evolution/skills-refresh");
+				return ok("Skill catalog refresh requested: caches dropped, catalog re-read on next lookup.");
+			}
+			if (input === "learn" || input.startsWith("learn ")) {
+				const request = rawInputTrimmed === "learn" ? "" : rawInputTrimmed.slice(6).trim();
+				const message = createUserMessage({
+					content: [{
+						type: "text",
+						text: buildLearnPrompt(request)
+					}],
+					source: {
+						kind: "evolution-commands",
+						form: "notice",
+						summary: "learn request"
+					}
 				});
-				const err = (text) => ({
-					kind: "error",
-					text
+				const missingAgent = agentMissing("learn");
+				if (missingAgent) return missingAgent;
+				const agent = invocationAgent;
+				let woke = false;
+				if (typeof agent.followup === "function") {
+					agent.followup(message);
+					woke = true;
+				} else if (typeof agent.inject === "function") agent.inject(message);
+				else return err(errorText("e-305-the-invocation-agent-exposes"));
+				const eventIo = ctx.get("evolutionIo")?.provider();
+				if (eventIo) appendEvolutionEvent(eventIo, eventsFile(evolutionRoot()), {
+					type: "learn",
+					source: "manual",
+					...request ? { request } : {}
+				}).catch((error) => {
+					ctx.logger.warn(`evolution-commands: failed to record learn event: ${String(error)}`);
 				});
-				const invocationAgent = invocation.agent;
-				const agentMissing = (need) => invocationAgent === void 0 ? err(errorText("e-305-this-invocation-carries-no", { a1: need })) : void 0;
-				const unreplayableWriteRefusal = (what) => {
-					if (approval === void 0) return void 0;
-					const session = invocationAgent?.session;
-					const sessionPolicy = effectiveSessionPolicy(ctx, session);
-					if (!(approval.isEnabled !== false && sessionPolicy !== "never" && approval.stageForeground !== false)) return void 0;
-					return err(errorText("e-306-this-deployment-stages-foreground", { a1: what }));
-				};
-				const approval = ctx.get("evolutionApproval");
-				const pendingMatch = /^pending(?: --detail)?$/.exec(input);
-				if (pendingMatch) {
-					if (!approval) return err(errorText("e-301-approval-service-not-mounted"));
-					const listed = [...await approval.list("pending"), ...await approval.list("executing")];
-					const pending = [...new Map(listed.map((row) => [row.id, row])).values()];
-					if (pending.length === 0) return ok("No pending evolution writes.");
-					const detailed = pendingMatch[0] === "pending --detail";
-					const nowMs = Date.now();
-					const attribution = (p) => {
-						const age = elapsedSince(p.createdAt, nowMs);
-						const unit = age.n === 1 ? age.unit.replace(/s$/u, "") : age.unit;
-						return `  ·  ${age.unit === "now" ? "just now" : `${age.n} ${unit} ago`}${p.origin === void 0 ? "" : `  from ${p.origin}`}${p.sessionId === void 0 ? "" : ` (session ${p.sessionId.slice(0, 8)})`}`;
-					};
-					return ok(pending.map((p) => {
-						if (!detailed) return `${p.id}  ${p.kind}  ${p.status === "executing" ? "EXECUTING " : ""}${p.summary}${attribution(p)}`;
-						const status = p.status === "executing" ? "EXECUTING" : p.status;
-						const line = `${p.id}  ${p.kind}  ${status}  ${p.summary}${attribution(p)}`;
-						return p.args === void 0 ? line : `${line}\n  staged args: ${safeStagedArgs(p.args)}`;
-					}).join("\n") + (pending.some((p) => p.status === "executing") ? "\n(EXECUTING: a previous approve may have crashed after running; verify the write manually, then reject — approve will not re-run it)" : ""));
-				}
-				if (input.startsWith("approve ")) {
-					const id = input.slice(8).trim();
-					const result = approval ? await approval.approve(id) : {
-						ok: false,
-						message: errorText("e-301-approval-service-not-mounted-2")
-					};
-					return result.ok ? ok(result.message) : err(result.message);
-				}
-				if (input.startsWith("reject ")) {
-					const id = input.slice(7).trim();
-					const result = approval ? await approval.reject(id) : {
-						ok: false,
-						message: errorText("e-301-approval-service-not-mounted-2")
-					};
-					return result.ok ? ok(result.message) : err(result.message);
-				}
-				if (input.startsWith("release ")) {
-					const id = input.slice(8).trim();
-					if (!approval) return err(errorText("e-301-approval-service-not-mounted-2"));
-					if (!approval.release) return err(errorText("e-304-the-mounted-approval-service"));
-					const result = await approval.release(id);
-					return result.ok ? ok(result.message) : err(result.message);
-				}
-				if (input === "curator run") {
-					const curator = ctx.get("evolutionCurator");
-					if (!curator) return err(errorText("e-302-curator-service-not-mounted"));
-					const result = await curator.run({ ignoreGates: true });
-					if (result.skipped !== void 0) return ok(`Curator run skipped (${result.skipped}): no curation pass was executed.\nrunId=${result.report.runId}`);
-					return ok(`Curator run complete: ${result.stale.length} stale, ${result.archived.length} archived, ${result.errors.length} failed.\nrunId=${result.report.runId}${result.report.snapshotPath ? `\nsnapshot=${result.report.snapshotPath}` : ""}`);
-				}
-				if (input === "curator pause" || input === "curator resume") {
-					const curator = ctx.get("evolutionCurator");
-					if (!curator) return err(errorText("e-302-curator-service-not-mounted"));
-					const paused = input === "curator pause";
-					await curator.setPaused(paused);
-					const notPersisted = ctx.get("evolutionState") !== void 0 ? "" : "\nNOTE: no evolution state service is mounted — this setting is NOT persisted and will not survive this process.";
-					return ok((paused ? "Curator automatic curation paused. Manual /evolution curator run is unaffected; resume with /evolution curator resume." : "Curator automatic curation resumed. The next scheduled pass waits one interval (first-run defer semantics).") + notPersisted);
-				}
-				if (input === "curator status") {
-					const curator = ctx.get("evolutionCurator");
-					if (!curator) return err(errorText("e-302-curator-service-not-mounted"));
-					const state = await curator.status();
-					if (!state) return ok("No curator state yet: the first automatic pass is deferred until the interval elapses.");
-					const lastRun = typeof state.lastRunAt === "number" && Number.isFinite(state.lastRunAt) && state.lastRunAt > 0 ? new Date(state.lastRunAt).toISOString() : "unknown";
-					return ok([
-						`paused=${state.paused}`,
-						`runs=${state.runCount}`,
-						`lastRun=${lastRun}`,
-						`summary=${state.lastSummary}`
-					].join("\n"));
-				}
-				if (input === "mutations") {
-					const curator = ctx.get("evolutionCurator");
-					if (!curator) return err(errorText("e-302-curator-service-not-mounted"));
-					const records = await curator.skills.listMutations();
-					const usable = Array.isArray(records) ? records.filter((row) => typeof row === "object" && row !== null && typeof row.at === "string" && typeof row.skillName === "string" && typeof row.action === "string" && typeof row.summary === "string") : [];
-					if (usable.length === 0) return ok("No mutation records yet.");
-					const recent = usable.slice(-5).reverse().map((record) => `${record.at.slice(0, 19)}  ${record.skillName}  ${record.action}  ${record.summary}`);
-					return ok(`Mutations: ${usable.length} recorded (recent 5):\n${recent.join("\n")}`);
-				}
-				if (input === "curator scope") {
-					const curator = ctx.get("evolutionCurator");
-					if (!curator) return err(errorText("e-302-curator-service-not-mounted"));
-					const view = await curator.scopeView();
-					const line = (label, names) => `${label}: ${names.length}${names.length === 0 ? "" : `\n  ${names.join(", ")}`}`;
-					return ok([
-						`Lifecycle scope at ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`,
-						line("Managed (may transition)", view.managed),
-						line("Watched (stale / quality-warned)", view.watched),
-						line("Quality-warned", view.qualityWarned),
-						line("Exempted (exclude / referenced)", view.exempted),
-						line("Protected (pinned / bundled / hub / builtin)", view.protected)
-					].join("\n"));
-				}
-				if (input === "curator report") {
-					const curator = ctx.get("evolutionCurator");
-					if (!curator) return err(errorText("e-302-curator-service-not-mounted"));
-					const report = await curator.latestReport();
-					if (!report) return ok("No curator report available.");
-					if (typeof report !== "object" || typeof report.runId !== "string" || typeof report.startedAt !== "string" || !Array.isArray(report.archived) || !Array.isArray(report.failed)) return err("Report file unreadable.");
-					const reportAny = report;
-					const nameOf = (item) => typeof item === "object" && item !== null && typeof item.name === "string" ? item.name : "?";
-					const reasonOf = (item) => typeof item === "object" && item !== null && typeof item.reason === "string" ? item.reason : "?";
-					const aborted = typeof reportAny.aborted === "string" ? reportAny.aborted : void 0;
-					const unattributed = Array.isArray(reportAny.unattributed) ? reportAny.unattributed.length : 0;
-					return ok([
-						`runId=${reportAny.runId}`,
-						`startedAt=${reportAny.startedAt}`,
-						`archived=${reportAny.archived.map(nameOf).join(", ") || "(none)"}`,
-						`failed=${reportAny.failed.map((item) => `${nameOf(item)}: ${reasonOf(item)}`).join(", ") || "(none)"}`,
-						...aborted === void 0 ? [] : [`aborted=${aborted}`],
-						...unattributed === 0 ? [] : [`unattributed=${unattributed}`]
-					].join("\n"));
-				}
-				if (input === "restore" || input.startsWith("restore ")) {
-					const tail = input.slice(7).trim();
-					if (tail !== "") return err(`\`restore\` takes no arguments (got "${tail}"). Use \`restore\` for a whole-tree rollback, or \`skill restore <name>\` for one skill.`);
-					const restoreRefusal = unreplayableWriteRefusal("restore");
-					if (restoreRefusal) return restoreRefusal;
-					const curator = ctx.get("evolutionCurator");
-					const result = curator ? await curator.restoreSnapshot() : {
-						ok: false,
-						message: errorText("e-302-curator-service-not-mounted")
-					};
-					return result.ok ? ok(result.message) : err(result.message);
-				}
-				if (input.startsWith("consolidate ")) {
-					const consolidateRefusal = unreplayableWriteRefusal("consolidate");
-					if (consolidateRefusal) return consolidateRefusal;
-					const planTail = /\s--plan\s+(\S+)\s*$/.exec(input) ?? null;
-					const planRunId = planTail?.[1] ?? void 0;
-					const [target, ...sources] = (planTail ? input.slice(0, planTail.index) : input).slice(12).trim().split(/\s+/).filter(Boolean);
-					if (!target || sources.length === 0) return err("Usage: /evolution consolidate <target> <source...>");
-					const curator = ctx.get("evolutionCurator");
-					const result = curator ? await curator.consolidate(target, sources) : {
-						ok: false,
-						message: errorText("e-302-curator-service-not-mounted")
-					};
-					if (!result.ok) return err(result.message);
-					return ok(planRunId ? `${result.message}\n[audit] plan=${planRunId}` : result.message);
-				}
-				if (input.startsWith("skill restore ")) {
-					const name = input.slice(14).trim();
-					if (!name) return err("Usage: /evolution skill restore <name>");
-					const skillRestoreRefusal = unreplayableWriteRefusal("skill restore");
-					if (skillRestoreRefusal) return skillRestoreRefusal;
-					const curator = ctx.get("evolutionCurator");
-					const result = curator ? await curator.restore(name) : {
-						ok: false,
-						message: errorText("e-302-curator-service-not-mounted")
-					};
-					return result.ok ? ok(result.message) : err(result.message);
-				}
-				if (input.startsWith("skill history ")) {
-					const name = input.slice(14).trim();
-					if (!name) return err("Usage: /evolution skill history <name>");
-					const curator = ctx.get("evolutionCurator");
-					if (!curator) return err(errorText("e-302-curator-service-not-mounted"));
-					const versions = await curator.history(name);
-					if (versions.length === 0) return ok(`No content versions are recorded for "${name}" yet — they appear after the next write through skill_manage.`);
-					const groups = partitionVersions(versions);
-					const row = (entry) => `v${entry.v}\t${entry.at}\t${entry.action}\t${entry.chars} chars\t${entry.hash.slice(0, 12)}`;
-					const lines = [`Content versions for "${name}" (oldest first, ${groups.content.length} of at most the retained count):`, ...groups.content.map(row)];
-					if (groups.support.length > 0) lines.push("Support-file versions (history only — undo restores SKILL.md, not these bytes):", ...groups.support.map(row));
-					return ok(lines.join("\n"));
-				}
-				if (input.startsWith("skill undo ")) {
-					const rest = input.slice(11).trim();
-					const toMatch = /--to\s+v?(\d+)\s*$/.exec(rest);
-					const name = (toMatch?.index === void 0 ? rest : rest.slice(0, toMatch.index)).trim();
-					if (!name) return err("Usage: /evolution skill undo <name> [--to v<N>]");
-					const skillUndoRefusal = unreplayableWriteRefusal("skill undo");
-					if (skillUndoRefusal) return skillUndoRefusal;
-					const curator = ctx.get("evolutionCurator");
-					const target = toMatch?.[1] === void 0 ? void 0 : Number(toMatch[1]);
-					const result = curator ? await (target === void 0 ? curator.undo(name) : curator.undo(name, target)) : {
-						ok: false,
-						message: errorText("e-302-curator-service-not-mounted")
-					};
-					return result.ok ? ok(result.message) : err(result.message);
-				}
-				if (input === "skills health") {
-					const curator = ctx.get("evolutionCurator");
-					if (!curator) return err(errorText("e-302-curator-service-not-mounted"));
-					const [rows, observed] = await Promise.all([curator.healthView(), curator.usageObserved()]);
-					const banner = observed ? "" : "Usage observation not yet established — churn (write-ghost) rows are suppressed.";
-					const line = (row) => `${row.verdict.padEnd(18)} ${row.name}${row.reasons.length > 0 ? ` — ${row.reasons.join("; ")}` : ""}`;
-					if (rows.length === 0) return ok(banner ? `Structure health: all skills healthy. ${banner}` : "Structure health: all skills healthy.");
-					return ok([banner ? `Structure health (${rows.length} degraded): ${banner}` : `Structure health (${rows.length} degraded):`, ...rows.map(line)].join("\n"));
-				}
-				if (input === "skills refresh") {
-					ctx.emit("evolution/skills-refresh");
-					return ok("Skill catalog refresh requested: caches dropped, catalog re-read on next lookup.");
-				}
-				if (input === "learn" || input.startsWith("learn ")) {
-					const request = rawInputTrimmed === "learn" ? "" : rawInputTrimmed.slice(6).trim();
-					const message = createUserMessage({
-						content: [{
-							type: "text",
-							text: buildLearnPrompt(request)
-						}],
-						source: {
-							kind: "evolution-commands",
-							form: "notice",
-							summary: "learn request"
-						}
-					});
-					const missingAgent = agentMissing("learn");
-					if (missingAgent) return missingAgent;
-					const agent = invocationAgent;
-					let woke = false;
-					if (typeof agent.followup === "function") {
-						agent.followup(message);
-						woke = true;
-					} else if (typeof agent.inject === "function") agent.inject(message);
-					else return err(errorText("e-305-the-invocation-agent-exposes"));
-					const eventIo = ctx.get("evolutionIo")?.provider();
-					if (eventIo) appendEvolutionEvent(eventIo, eventsFile(evolutionRoot()), {
-						type: "learn",
-						source: "manual",
-						...request ? { request } : {}
-					}).catch((error) => {
-						ctx.logger.warn(`evolution-commands: failed to record learn event: ${String(error)}`);
-					});
-					return woke ? ok("Learning request sent to this session. Follow it now.") : ok("Learning request queued for this session — this host exposes no wake-up channel, so it is read on your next message.");
-				}
-				if (input === "maintain --facts") {
-					const ioRegistry = ctx.get("evolutionIo");
-					if (!ioRegistry) return err("Evolution IO registry not mounted — maintenance facts unavailable.");
+				return woke ? ok("Learning request sent to this session. Follow it now.") : ok("Learning request queued for this session — this host exposes no wake-up channel, so it is read on your next message.");
+			}
+			if (input === "maintain --facts") {
+				const ioRegistry = ctx.get("evolutionIo");
+				if (!ioRegistry) return err("Evolution IO registry not mounted — maintenance facts unavailable.");
+				const library = newSkillLibrary({
+					config: { root: skillsRootValue },
+					io: ioRegistry.provider()
+				});
+				const enrichment = await buildEnrichment(ctx, library);
+				const readFailures = [];
+				const snapshots = await snapshotFromLibrary(library, {
+					...enrichmentSnapshotOptions(enrichment),
+					onReadError: (name, error) => {
+						readFailures.push(name);
+						ctx.logger.warn(`evolution-maintenance: skipping unreadable skill "${name}": ${error instanceof Error ? error.message : String(error)}`);
+					}
+				});
+				if (snapshots.length === 0 && readFailures.length > 0) return err(`maintenance scan could not read ${readFailures.length} listed skill(s) (${readFailures.slice(0, 10).join(", ")}${readFailures.length > 10 ? ", …" : ""}) and read no skill at all — the library was NOT audited; fix the unreadable skills (or their directory names) and run the scan again`);
+				if (snapshots.length === 0 && skillsRootValue !== "" && !await ioRegistry.provider().exists(skillsRootValue)) return err(`maintenance scan found an empty skill library, but the configured skill root does not exist (${skillsRootValue}) — point the skillsRoot config at a real directory (a literal \`~\` is not expanded) and run the scan again`);
+				if (snapshots.length === 0) return ok("Maintenance scan: empty skill library. Nothing to do.");
+				const { facts } = buildMaintainFacts(snapshots, enrichment.usageObservedValue, void 0);
+				return ok(`Maintenance facts (0-token preview):\n${facts}`);
+			}
+			const maintainArgs = /^maintain(?:\s+--timeout[ =](\d+))?\s*$/.exec(input);
+			if (maintainArgs) {
+				const runTimeoutMs = maintainArgs[1] ? Number(maintainArgs[1]) : config.maintainTimeoutMs ?? 6e5;
+				if (!Number.isSafeInteger(runTimeoutMs) || runTimeoutMs <= 0 || runTimeoutMs > MAX_TIMER_DELAY_MS) return err(maintainArgs[1] ? `Invalid --timeout value: expected a positive integer number of milliseconds up to ${MAX_TIMER_DELAY_MS} (e.g. /evolution maintain --timeout 600000).` : `The maintainTimeoutMs config is invalid: expected a positive integer number of milliseconds up to ${MAX_TIMER_DELAY_MS}. Fix the evolution-commands row config (maintainTimeoutMs), then retry.`);
+				if (maintainInFlightSince > 0) return err(`Maintenance scan is already running (since ~${Math.max(1, Math.round((Date.now() - maintainInFlightSince) / 1e3))}s ago) — re-submitting now would cancel it. Wait for it to settle; the result appears when it finishes.`);
+				const cooldownMs = clampedNumber(config.maintainCooldownMs, 3e4, { min: 0 });
+				const sinceLast = Date.now() - lastMaintainAt;
+				if (cooldownMs > 0 && sinceLast < cooldownMs) return err(`Maintenance cooldown active (${Math.ceil((cooldownMs - sinceLast) / 1e3)}s)${lastMaintainRunId === "" ? "" : ` — latest scan ${lastMaintainRunId}`}; re-running now would spend another model call.`);
+				const ioRegistry = ctx.get("evolutionIo");
+				const subagents = ctx.get("subagents");
+				if (!ioRegistry) return err("Evolution IO registry not mounted — maintenance scan unavailable.");
+				if (!subagents) return err("Subagents service not mounted — maintenance scan unavailable.");
+				try {
+					maintainInFlightSince = Date.now();
 					const library = newSkillLibrary({
 						config: { root: skillsRootValue },
 						io: ioRegistry.provider()
 					});
 					const enrichment = await buildEnrichment(ctx, library);
-					const readFailures = [];
-					const snapshots = await snapshotFromLibrary(library, {
-						descriptions: enrichment.descriptions,
-						supportFiles: enrichment.supportFiles,
-						quality: enrichment.quality,
-						protected: enrichment.protected,
-						catalogInvalid: enrichment.catalogInvalid,
-						demand: enrichment.demand,
-						liveness: enrichment.liveness,
-						supportChars: enrichment.supportChars,
-						onReadError: (name, error) => {
-							readFailures.push(name);
-							ctx.logger.warn(`evolution-maintenance: skipping unreadable skill "${name}": ${error instanceof Error ? error.message : String(error)}`);
-						}
+					const outcome = await runMaintain({
+						library,
+						subagents,
+						parent: invocation.agent,
+						evolutionPolicy: { get: () => ctx.get("evolutionPolicy")?.get() },
+						tools: { get: (name) => ctx.get("tools")?.get(name) },
+						logger: { warn: (message) => {
+							ctx.logger.warn(message);
+						} },
+						rootExists: skillsRootValue === "" ? void 0 : () => ioRegistry.provider().exists(skillsRootValue),
+						skillRoot: skillsRootValue
+					}, {
+						timeoutMs: runTimeoutMs,
+						signal: invocation.signal,
+						enrichment: () => enrichment
+					});
+					if (outcome.ok) lastMaintainRunId = outcome.runId ?? "";
+					if (!outcome.ok) return err(outcome.error ?? "Maintenance scan failed.");
+					appendEvolutionEvent(ioRegistry.provider(), eventsFile(evolutionRoot()), {
+						type: "maintain",
+						source: "manual",
+						runId: outcome.runId,
+						verdict: outcome.verdict,
+						recommendations: outcome.recommendationCount
+					}).catch((error) => {
+						ctx.logger.warn(`evolution-commands: failed to record maintain event: ${String(error)}`);
 					});
-					if (snapshots.length === 0 && readFailures.length > 0) return err(`maintenance scan could not read ${readFailures.length} listed skill(s) (${readFailures.slice(0, 10).join(", ")}${readFailures.length > 10 ? ", …" : ""}) and read no skill at all — the library was NOT audited; fix the unreadable skills (or their directory names) and run the scan again`);
-					if (snapshots.length === 0 && skillsRootValue !== "" && !await ioRegistry.provider().exists(skillsRootValue)) return err(`maintenance scan found an empty skill library, but the configured skill root does not exist (${skillsRootValue}) — point the skillsRoot config at a real directory (a literal \`~\` is not expanded) and run the scan again`);
-					if (snapshots.length === 0) return ok("Maintenance scan: empty skill library. Nothing to do.");
-					const { facts } = buildMaintainFacts(snapshots, enrichment.usageObservedValue, void 0);
-					return ok(`Maintenance facts (0-token preview):\n${facts}`);
+					return ok(`Maintenance scan ${outcome.runId}:\n${outcome.text ?? ""}`);
+				} catch (error) {
+					return err(`Maintenance scan failed: ${error instanceof Error ? error.message : String(error)}`);
+				} finally {
+					maintainInFlightSince = 0;
+					lastMaintainAt = Date.now();
 				}
-				const maintainArgs = /^maintain(?:\s+--timeout[ =](\d+))?\s*$/.exec(input);
-				if (maintainArgs) {
-					const runTimeoutMs = maintainArgs[1] ? Number(maintainArgs[1]) : config.maintainTimeoutMs ?? 6e5;
-					if (!Number.isSafeInteger(runTimeoutMs) || runTimeoutMs <= 0 || runTimeoutMs > MAX_TIMER_DELAY_MS) return err(maintainArgs[1] ? `Invalid --timeout value: expected a positive integer number of milliseconds up to ${MAX_TIMER_DELAY_MS} (e.g. /evolution maintain --timeout 600000).` : `The maintainTimeoutMs config is invalid: expected a positive integer number of milliseconds up to ${MAX_TIMER_DELAY_MS}. Fix the evolution-commands row config (maintainTimeoutMs), then retry.`);
-					if (maintainInFlightSince > 0) return err(`Maintenance scan is already running (since ~${Math.max(1, Math.round((Date.now() - maintainInFlightSince) / 1e3))}s ago) — re-submitting now would cancel it. Wait for it to settle; the result appears when it finishes.`);
-					const cooldownMs = clampedNumber(config.maintainCooldownMs, 3e4, { min: 0 });
-					const sinceLast = Date.now() - lastMaintainAt;
-					if (cooldownMs > 0 && sinceLast < cooldownMs) return err(`Maintenance cooldown active (${Math.ceil((cooldownMs - sinceLast) / 1e3)}s)${lastMaintainRunId === "" ? "" : ` — latest scan ${lastMaintainRunId}`}; re-running now would spend another model call.`);
-					const ioRegistry = ctx.get("evolutionIo");
-					const subagents = ctx.get("subagents");
-					if (!ioRegistry) return err("Evolution IO registry not mounted — maintenance scan unavailable.");
-					if (!subagents) return err("Subagents service not mounted — maintenance scan unavailable.");
+			}
+			if (/^maintain\b/.test(input)) return err("Unknown maintain arguments: expected bare `maintain`, `maintain --timeout <ms>` or `maintain --timeout=<ms>` (a positive integer). Got: " + input);
+			const presetInstall = /^preset install(?: --base (\S+))?$/.exec(input);
+			if (presetInstall !== null || /^preset\b/.test(input)) {
+				if (presetInstall === null) return err("Unknown preset arguments: expected `preset install` or `preset install --base <name>[,<name>...]` (the names live in the agent package's bases.json). Got: " + input);
+				{
+					let installedBundles;
 					try {
-						maintainInFlightSince = Date.now();
-						const library = newSkillLibrary({
-							config: { root: skillsRootValue },
-							io: ioRegistry.provider()
-						});
-						const enrichment = await buildEnrichment(ctx, library);
-						const outcome = await runMaintain({
-							library,
-							subagents,
-							parent: invocation.agent,
-							evolutionPolicy: { get: () => ctx.get("evolutionPolicy")?.get() },
-							tools: { get: (name) => ctx.get("tools")?.get(name) },
-							logger: { warn: (message) => {
-								ctx.logger.warn(message);
-							} },
-							rootExists: skillsRootValue === "" ? void 0 : () => ioRegistry.provider().exists(skillsRootValue),
-							skillRoot: skillsRootValue
-						}, {
-							timeoutMs: runTimeoutMs,
-							signal: invocation.signal,
-							descriptions: () => enrichment.descriptions,
-							supportFiles: () => enrichment.supportFiles,
-							quality: () => enrichment.quality,
-							protected: () => enrichment.protected,
-							catalogInvalid: () => enrichment.catalogInvalid,
-							usageObserved: () => enrichment.usageObservedValue,
-							demand: () => enrichment.demand,
-							liveness: () => enrichment.liveness,
-							supportChars: () => enrichment.supportChars
-						});
-						if (outcome.ok) lastMaintainRunId = outcome.runId ?? "";
-						if (!outcome.ok) return err(outcome.error ?? "Maintenance scan failed.");
-						appendEvolutionEvent(ioRegistry.provider(), eventsFile(evolutionRoot()), {
-							type: "maintain",
-							source: "manual",
-							runId: outcome.runId,
-							verdict: outcome.verdict,
-							recommendations: outcome.recommendationCount
-						}).catch((error) => {
-							ctx.logger.warn(`evolution-commands: failed to record maintain event: ${String(error)}`);
+						installedBundles = collectEvolutionBundles(evolutionRoot(), (error) => {
+							throw error;
 						});
-						return ok(`Maintenance scan ${outcome.runId}:\n${outcome.text ?? ""}`);
-					} catch (error) {
-						return err(`Maintenance scan failed: ${error instanceof Error ? error.message : String(error)}`);
-					} finally {
-						maintainInFlightSince = 0;
-						lastMaintainAt = Date.now();
+					} catch (enumerationError) {
+						return err(`Refusing to install the layered Evolution preset: the home profile directory or one of its profile manifests could not be read (${enumerationError instanceof Error ? enumerationError.message : String(enumerationError)}) — the all/preset double-mount check could not run. Resolve access to the profiles directory and retry, or install via the layered installer, which enforces the same exclusion up front.`);
 					}
+					const allBundle = installedBundles.find((name) => name === "dsh-evolution-all" || name.endsWith("/dsh-evolution-all"));
+					const presetBundle = installedBundles.find((name) => name === "dsh-evolution-preset" || name.endsWith("/dsh-evolution-preset"));
+					if (allBundle || presetBundle) return err(`Refusing to install the layered Evolution preset: "${allBundle ?? presetBundle}" is installed in this home — its model rows (tool-memory / tool-skill-manage / tool-session-query / skill-catalog) would double-mount with the preset's and the profile fails loud at startup. Keep ONE: remove the ${allBundle ? "evolution-all bundle" : "evolution-preset bundle"} before installing the layered preset (see /evolution doctor).`);
 				}
-				if (/^maintain\b/.test(input)) return err("Unknown maintain arguments: expected bare `maintain`, `maintain --timeout <ms>` or `maintain --timeout=<ms>` (a positive integer). Got: " + input);
-				const presetInstall = /^preset install(?: --base (\S+))?$/.exec(input);
-				if (presetInstall !== null || /^preset\b/.test(input)) {
-					if (presetInstall === null) return err("Unknown preset arguments: expected `preset install` or `preset install --base <name>[,<name>...]` (the names live in the agent package's bases.json). Got: " + input);
-					{
-						let installedBundles;
-						try {
-							installedBundles = collectEvolutionBundles(evolutionRoot(), (error) => {
-								throw error;
-							});
-						} catch (enumerationError) {
-							return err(`Refusing to install the layered Evolution preset: the home profile directory or one of its profile manifests could not be read (${enumerationError instanceof Error ? enumerationError.message : String(enumerationError)}) — the all/preset double-mount check could not run. Resolve access to the profiles directory and retry, or install via the layered installer, which enforces the same exclusion up front.`);
-						}
-						const allBundle = installedBundles.find((name) => name === "dsh-evolution-all" || name.endsWith("/dsh-evolution-all"));
-						const presetBundle = installedBundles.find((name) => name === "dsh-evolution-preset" || name.endsWith("/dsh-evolution-preset"));
-						if (allBundle || presetBundle) return err(`Refusing to install the layered Evolution preset: "${allBundle ?? presetBundle}" is installed in this home — its model rows (tool-memory / tool-skill-manage / tool-session-query / skill-catalog) would double-mount with the preset's and the profile fails loud at startup. Keep ONE: remove the ${allBundle ? "evolution-all bundle" : "evolution-preset bundle"} before installing the layered preset (see /evolution doctor).`);
+				try {
+					const source = resolveAgentPresetDir(import.meta.url);
+					const table = readAgentPresetBases(source);
+					const requestedRaw = presetInstall[1] ?? table.defaultBase;
+					const requested = [...new Set(requestedRaw.split(",").map((part) => part.trim()).filter((part) => part !== ""))];
+					if (requested.length === 0) return err(`No agent-preset base named — ${join(source, "bases.json")} lists ${table.entries.map((entry) => entry.name).join(", ")}`);
+					const selected = [];
+					for (const name of requested) {
+						const entry = table.entries.find((candidate) => candidate.name === name);
+						if (entry === void 0) return err(`Unknown agent-preset base "${name}" — ${join(source, "bases.json")} lists ${table.entries.map((candidate) => candidate.name).join(", ")}`);
+						selected.push(entry);
 					}
-					try {
-						const source = resolveAgentPresetDir(import.meta.url);
-						const table = readAgentPresetBases(source);
-						const requestedRaw = presetInstall[1] ?? table.defaultBase;
-						const requested = [...new Set(requestedRaw.split(",").map((part) => part.trim()).filter((part) => part !== ""))];
-						if (requested.length === 0) return err(`No agent-preset base named — ${join(source, "bases.json")} lists ${table.entries.map((entry) => entry.name).join(", ")}`);
-						const selected = [];
-						for (const name of requested) {
-							const entry = table.entries.find((candidate) => candidate.name === name);
-							if (entry === void 0) return err(`Unknown agent-preset base "${name}" — ${join(source, "bases.json")} lists ${table.entries.map((candidate) => candidate.name).join(", ")}`);
-							selected.push(entry);
-						}
-						const deltaPath = join(source, "agent.cordis.yml");
-						if (!existsSync(deltaPath)) return err(`Preset file missing from ${source} — is the dsh-evolution-agent-preset package installed?`);
-						const profile = presetProfileTarget(ctx);
-						if (profile === void 0) return err("No profile is mounted in this process, so there is no profile patch to write the preset row into — run the command in a session started by `dsh --profile <name>`.");
-						const delta = readFileSync(deltaPath, "utf8");
-						const current = existsSync(profile.patchPath) ? readFileSync(profile.patchPath, "utf8") : "";
-						let merged = current;
-						const written = [];
-						for (const base of selected) {
-							if (typeof base.unsupported === "string") return err(`Base "${base.name}" is registered as UNSUPPORTED: ${base.unsupported}`);
-							const requiredService = base.requires?.service;
-							if (typeof requiredService === "string" && ctx.get(requiredService) === void 0) return err(`Base "${base.name}" requires the "${requiredService}" service, which this deployment does not provide — the generated preset would refuse to mount.`);
-							const basePatch = resolvePresetBasePatch(base.name, profile);
-							const rowId = presetRowId(base.id);
-							const entryText = composePresetEntry(readFileSync(basePatch, "utf8"), delta, {
-								rowId,
-								id: base.id,
-								name: base.display.name,
-								description: base.display.description,
-								order: base.display.order
-							});
-							const next = mergePresetRow(merged, entryText, rowId);
-							written.push(next === merged ? `${base.name} → ${profile.patchPath} (already current)` : `${base.name} → ${rowId} in ${profile.patchPath}`);
-							merged = next;
-						}
-						if (merged !== current) atomicWriteFiles(dirname(profile.patchPath), [{
-							name: PROFILE_PATCH_FILENAME$1,
-							content: presetPatchText(merged)
-						}], void 0, (message) => {
-							ctx.logger.warn(message);
+					const deltaPath = join(source, "agent.cordis.yml");
+					if (!existsSync(deltaPath)) return err(`Preset file missing from ${source} — is the dsh-evolution-agent-preset package installed?`);
+					const profile = presetProfileTarget(ctx);
+					if (profile === void 0) return err("No profile is mounted in this process, so there is no profile patch to write the preset row into — run the command in a session started by `dsh --profile <name>`.");
+					const delta = readFileSync(deltaPath, "utf8");
+					const current = existsSync(profile.patchPath) ? readFileSync(profile.patchPath, "utf8") : "";
+					let merged = current;
+					const written = [];
+					for (const base of selected) {
+						const refusal = baseRefusalReason(base, (name) => ctx.get(name) !== void 0);
+						if (refusal !== void 0) return err(refusal);
+						const basePatch = resolvePresetBasePatch(base.name, profile);
+						const rowId = presetRowId(base.id);
+						const entryText = composePresetEntry(readFileSync(basePatch, "utf8"), delta, {
+							rowId,
+							id: base.id,
+							name: base.display.name,
+							description: base.display.description,
+							order: base.display.order
 						});
-						return ok(`Evolution agent preset row installed (${written.join("; ")}). Restart the session switcher to select it.`);
-					} catch (error) {
-						return err(`Preset install failed: ${error instanceof Error ? error.message : String(error)}`);
+						const next = mergePresetRow(merged, entryText, rowId);
+						written.push(next === merged ? `${base.name} → ${profile.patchPath} (already current)` : `${base.name} → ${rowId} in ${profile.patchPath}`);
+						merged = next;
 					}
+					if (merged !== current) atomicWriteFiles(dirname(profile.patchPath), [{
+						name: PROFILE_PATCH_FILENAME,
+						content: presetPatchText(merged)
+					}], void 0, (message) => {
+						ctx.logger.warn(message);
+					});
+					return ok(`Evolution agent preset row installed (${written.join("; ")}). Restart the session switcher to select it.`);
+				} catch (error) {
+					return err(`Preset install failed: ${error instanceof Error ? error.message : String(error)}`);
 				}
-				if (input.startsWith("restructure ")) {
-					const planTail = /\s--plan\s+(\S+)\s*$/.exec(rawInputTrimmed) ?? null;
-					const planRunId = planTail?.[1] ?? void 0;
-					const rest = planTail ? rawInputTrimmed.slice(0, planTail.index) : rawInputTrimmed;
-					const match = /^restructure\s+(\S+)\s+"([^"]+)"\s+(\S+)$/.exec(rest);
-					if (!match) return err("Usage: /evolution restructure <name> \"<## heading>\" <to_file>");
-					const name = match[1] ?? "";
-					const heading = match[2] ?? "";
-					const toFile = match[3] ?? "";
-					if (!toFile.startsWith("references/")) return err("to_file must live under references/ (log/detail destination).");
-					const ioRegistry = ctx.get("evolutionIo");
-					if (!ioRegistry) return err("Evolution IO registry not mounted — restructure unavailable.");
-					if (approval) {
-						const session = invocationAgent?.session;
-						const sessionPolicy = effectiveSessionPolicy(ctx, session);
-						const stagesForeground = approval.isEnabled !== false && sessionPolicy !== "never" && approval.stageForeground !== false;
-						if (stagesForeground && session === void 0) return err(errorText("e-306-this-deployment-stages-foreground-2"));
-						if (stagesForeground && !approval.hasRunner("skill")) return err("Restructure cannot be staged: no skill replay runner is registered — mount the tool-skill-manage row (evolution-agent preset, or evolution-all) or disable evolution-approval.");
-						const decision = await approval.request({
-							kind: "skill",
-							summary: `/evolution restructure ${name}${planRunId ? ` (plan ${planRunId})` : ""}`,
-							args: {
-								operation: {
-									action: "restructure",
-									name,
-									restructure: [{
-										heading,
-										to_file: toFile
-									}]
-								},
-								origin: "foreground",
-								libraryOrigin: "foreground"
+			}
+			if (input.startsWith("restructure ")) {
+				const planTail = /\s--plan\s+(\S+)\s*$/.exec(rawInputTrimmed) ?? null;
+				const planRunId = planTail?.[1] ?? void 0;
+				const rest = planTail ? rawInputTrimmed.slice(0, planTail.index) : rawInputTrimmed;
+				const match = /^restructure\s+(\S+)\s+"([^"]+)"\s+(\S+)$/.exec(rest);
+				if (!match) return err("Usage: /evolution restructure <name> \"<## heading>\" <to_file>");
+				const name = match[1] ?? "";
+				const heading = match[2] ?? "";
+				const toFile = match[3] ?? "";
+				if (!toFile.startsWith("references/")) return err("to_file must live under references/ (log/detail destination).");
+				const ioRegistry = ctx.get("evolutionIo");
+				if (!ioRegistry) return err("Evolution IO registry not mounted — restructure unavailable.");
+				if (approval) {
+					const session = invocationAgent?.session;
+					const sessionPolicy = effectiveSessionPolicy(ctx, session);
+					const stagesForeground = approval.isEnabled !== false && sessionPolicy !== "never" && approval.stageForeground !== false;
+					if (stagesForeground && session === void 0) return err(errorText("e-306-this-deployment-stages-foreground-2"));
+					if (stagesForeground && !approval.hasRunner("skill")) return err("Restructure cannot be staged: no skill replay runner is registered — mount the tool-skill-manage row (evolution-agent preset, or evolution-all) or disable evolution-approval.");
+					const decision = await approval.request({
+						kind: "skill",
+						summary: `/evolution restructure ${name}${planRunId ? ` (plan ${planRunId})` : ""}`,
+						args: {
+							operation: {
+								action: "restructure",
+								name,
+								restructure: [{
+									heading,
+									to_file: toFile
+								}]
 							},
 							origin: "foreground",
-							...session !== void 0 ? {
-								sessionId: session.id,
-								session
-							} : {},
-							...sessionPolicy !== void 0 ? { sessionPolicy } : {}
-						});
-						if (decision.action === "staged") return ok(`${decision.message}${planRunId ? `\n[audit] plan=${planRunId}` : ""}`);
-					}
-					const result = await newSkillLibrary({
-						config: { root: skillsRootValue },
-						io: ioRegistry.provider(),
-						ctx,
-						threatExemptLabels: config.threatExemptLabels,
-						limits: {
-							...DEFAULT_SKILL_LIMITS,
-							...policyStageLimits(ctx.get("evolutionPolicy")?.get?.())
-						}
-					}).restructure(name, [{
-						heading,
-						toFile
-					}], "foreground");
-					if (!result.ok) return err(result.message);
-					await ctx.get("skillUsage")?.record?.(name, "patch");
-					return ok(planRunId ? `${result.message}\n[audit] plan=${planRunId}` : result.message);
-				}
-				if (input === "replay") {
-					const replay = ctx.get("evolutionReplay");
-					if (!replay) return err(errorText("e-303-replay-service-not-mounted"));
-					return ok(replay.compare().report);
-				}
-				const paramsMatch = /^params(?: --group ([a-z-]+))?(?: --json)?$/.exec(input);
-				if (paramsMatch) {
-					const provider = ctx.get("settings");
-					const sections = /* @__PURE__ */ new Map();
-					if (provider?.describe !== void 0) try {
-						for (const descriptor of provider.describe({ redactSecrets: false })) {
-							const section = {};
-							if (descriptor.user !== void 0) section.user = descriptor.user;
-							const resolved = descriptor.value;
-							if (typeof resolved === "object" && resolved !== null) section.value = resolved;
-							sections.set(descriptor.ns, section);
-						}
-					} catch (error) {
-						return err(errorText("e-307-the-settings-service-could", { a1: error instanceof Error ? error.message : String(error) }));
-					}
-					const rows = paramSurfaceRows(sections, PARAM_EXPOSURE);
-					const group = paramsMatch[1];
-					const selected = group === void 0 ? rows : rows.filter((row) => row.group === group);
-					if (group !== void 0 && selected.length === 0) return err(errorText("e-308-unknown-parameter-group-group", {
-						a1: group,
-						a2: paramGroups(PARAM_EXPOSURE).join(", ")
-					}));
-					if (input.endsWith("--json")) return ok(renderParamJson(selected));
-					return ok(renderParamRows(selected, { providerMounted: provider !== void 0 }));
+							libraryOrigin: "foreground"
+						},
+						origin: "foreground",
+						...session !== void 0 ? {
+							sessionId: session.id,
+							session
+						} : {},
+						...sessionPolicy !== void 0 ? { sessionPolicy } : {}
+					});
+					if (decision.action === "staged") return ok(`${decision.message}${planRunId ? `\n[audit] plan=${planRunId}` : ""}`);
 				}
-				const policySetMatch = /^policy set ([A-Za-z][A-Za-z0-9.-]*) (.+?)(?: --expect (\d+))?$/.exec(input);
-				if (policySetMatch) {
-					const provider = ctx.get("settings");
-					if (provider?.update === void 0 || provider.describe === void 0) return err(errorText("e-311-no-settings-service-is"));
-					const rawId = policySetMatch[1] ?? "";
-					const rawValue = policySetMatch[2] ?? "";
-					let id;
-					try {
-						id = canonicalWriteId(rawId);
-					} catch (error) {
-						return err(errorText("e-312-error-instanceof-Error-error", { a1: error instanceof Error ? error.message : String(error) }));
+				const result = await newSkillLibrary({
+					config: { root: skillsRootValue },
+					io: ioRegistry.provider(),
+					ctx,
+					threatExemptLabels: config.threatExemptLabels,
+					limits: {
+						...DEFAULT_SKILL_LIMITS,
+						...policyStageLimits(ctx.get("evolutionPolicy")?.get?.())
 					}
-					const entry = PARAM_EXPOSURE.find((candidate) => candidate.id === id);
-					if (entry === void 0) return err(errorText("e-313-unknown-parameter-id-evolution", { a1: id }));
-					if (entry.tier !== "E3") return err(errorText("e-314-id-is-a-deployment", {
-						a1: id,
-						a2: entry.tier,
-						a3: entry.owner
-					}));
-					const namespace = paramSettingsId(entry.owner);
-					if (namespace === void 0) return err(errorText("e-315-id-has-no-user", {
-						a1: id,
-						a2: entry.owner
-					}));
-					let descriptor;
-					try {
-						descriptor = provider.describe({ redactSecrets: false }).find((candidate) => candidate.ns === namespace);
-					} catch (error) {
-						return err(errorText("e-307-the-settings-service-could-2", { a1: error instanceof Error ? error.message : String(error) }));
-					}
-					if (descriptor === void 0) return err(errorText("e-316-namespace-namespace-is-not", {
-						a1: namespace,
-						a2: entry.owner
-					}));
-					const current = descriptor.value;
-					const resolved = typeof current === "object" && current !== null ? current : void 0;
-					const expectedRaw = policySetMatch[3];
-					const expected = expectedRaw === void 0 ? descriptor.revision : Number(expectedRaw);
-					if (expectedRaw !== void 0 && descriptor.revision !== void 0 && Number(expectedRaw) !== descriptor.revision) return err(errorText("e-309-revision-conflict-you-sent", {
-						a1: expectedRaw,
-						a2: descriptor.revision
-					}));
-					const value = parseParamValue(rawValue);
-					try {
-						await provider.update(namespace, { [id]: value }, expected);
-					} catch (error) {
-						const code = error?.code;
-						const message = error instanceof Error ? error.message : String(error);
-						if (code === "SETTINGS_CONFLICT") return err(errorText("e-309-revision-conflict-message-Re", { a1: message }));
-						return err(errorText("e-310-the-settings-service-refused", { a1: message }));
+				}).restructure(name, [{
+					heading,
+					toFile
+				}], "foreground");
+				if (!result.ok) return err(result.message);
+				await ctx.get("skillUsage")?.record?.(name, "patch");
+				return ok(planRunId ? `${result.message}\n[audit] plan=${planRunId}` : result.message);
+			}
+			if (input === "replay") {
+				const replay = ctx.get("evolutionReplay");
+				if (!replay) return err(errorText("e-303-replay-service-not-mounted"));
+				return ok(replay.compare().report);
+			}
+			const paramsMatch = /^params(?: --group ([a-z-]+))?(?: --json)?$/.exec(input);
+			if (paramsMatch) {
+				const provider = ctx.get("settings");
+				const sections = /* @__PURE__ */ new Map();
+				if (provider?.describe !== void 0) try {
+					for (const descriptor of provider.describe({ redactSecrets: false })) {
+						const section = {};
+						if (descriptor.user !== void 0) section.user = descriptor.user;
+						const resolved = descriptor.value;
+						if (typeof resolved === "object" && resolved !== null) section.value = resolved;
+						sections.set(descriptor.ns, section);
 					}
-					return ok(renderPolicySet({
-						id,
-						namespace,
-						applies: entry.applies,
-						before: descriptor.user?.[id] ?? resolved?.[id],
-						after: value,
-						wasOverridden: descriptor.user !== void 0 && Object.hasOwn(descriptor.user, id)
-					}));
+				} catch (error) {
+					return err(errorText("e-307-the-settings-service-could", { a1: error instanceof Error ? error.message : String(error) }));
 				}
-				if (input === "migrate") {
-					const attempt = await migrateFromContext(ctx);
-					if (!attempt.ok) {
-						if (attempt.problem === "settings") return err(errorText("e-311-no-settings-service-is"));
-						if (attempt.problem === "home") return err(errorText("e-320-the-profile-home-is-not"));
-						return err(errorText("e-321-no-io-provider-is"));
-					}
-					return ok(renderNamespaceMigration(attempt.outcome));
+				const rows = paramSurfaceRows(sections, PARAM_EXPOSURE);
+				const group = paramsMatch[1];
+				const selected = group === void 0 ? rows : rows.filter((row) => row.group === group);
+				if (group !== void 0 && selected.length === 0) return err(errorText("e-308-unknown-parameter-group-group", {
+					a1: group,
+					a2: paramGroups(PARAM_EXPOSURE).join(", ")
+				}));
+				if (input.endsWith("--json")) return ok(renderParamJson(selected));
+				return ok(renderParamRows(selected, { providerMounted: provider !== void 0 }));
+			}
+			const policySetMatch = /^policy set ([A-Za-z][A-Za-z0-9.-]*) (.+?)(?: --expect (\d+))?$/.exec(input);
+			if (policySetMatch) {
+				const provider = ctx.get("settings");
+				if (provider?.update === void 0 || provider.describe === void 0) return err(errorText("e-311-no-settings-service-is"));
+				const rawId = policySetMatch[1] ?? "";
+				const rawValue = policySetMatch[2] ?? "";
+				let id;
+				try {
+					id = canonicalWriteId(rawId);
+				} catch (error) {
+					return err(errorText("e-312-error-instanceof-Error-error", { a1: error instanceof Error ? error.message : String(error) }));
 				}
-				if (input === "doctor" || input === "doctor --json") {
-					const report = await diagnose(ctx, { home: evolutionRoot() });
-					if (input === "doctor --json") return ok(JSON.stringify(report, null, 2));
-					return ok(renderDoctorText(report));
+				const entry = PARAM_EXPOSURE.find((candidate) => candidate.id === id);
+				if (entry === void 0) return err(errorText("e-313-unknown-parameter-id-evolution", { a1: id }));
+				if (entry.tier !== "E3") return err(errorText("e-314-id-is-a-deployment", {
+					a1: id,
+					a2: entry.tier,
+					a3: entry.owner
+				}));
+				const namespace = paramSettingsId(entry.owner);
+				if (namespace === void 0) return err(errorText("e-315-id-has-no-user", {
+					a1: id,
+					a2: entry.owner
+				}));
+				let descriptor;
+				try {
+					descriptor = provider.describe({ redactSecrets: false }).find((candidate) => candidate.ns === namespace);
+				} catch (error) {
+					return err(errorText("e-307-the-settings-service-could-2", { a1: error instanceof Error ? error.message : String(error) }));
 				}
-				return ok(`自进化：记忆、技能、会话回顾、技能整理——状态、待批准写入与维护。\n${renderHelpText()}`);
-			},
-			handler: (invocation) => evolutionCommand.run(invocation).catch((error) => ({
+				if (descriptor === void 0) return err(errorText("e-316-namespace-namespace-is-not", {
+					a1: namespace,
+					a2: entry.owner
+				}));
+				const current = descriptor.value;
+				const resolved = typeof current === "object" && current !== null ? current : void 0;
+				const expectedRaw = policySetMatch[3];
+				const expected = expectedRaw === void 0 ? descriptor.revision : Number(expectedRaw);
+				if (expectedRaw !== void 0 && descriptor.revision !== void 0 && Number(expectedRaw) !== descriptor.revision) return err(errorText("e-309-revision-conflict-you-sent", {
+					a1: expectedRaw,
+					a2: descriptor.revision
+				}));
+				const value = parseParamValue(rawValue);
+				try {
+					await provider.update(namespace, { [id]: value }, expected);
+				} catch (error) {
+					const code = error?.code;
+					const message = error instanceof Error ? error.message : String(error);
+					if (code === "SETTINGS_CONFLICT") return err(errorText("e-309-revision-conflict-message-Re", { a1: message }));
+					return err(errorText("e-310-the-settings-service-refused", { a1: message }));
+				}
+				return ok(renderPolicySet({
+					id,
+					namespace,
+					applies: entry.applies,
+					before: descriptor.user?.[id] ?? resolved?.[id],
+					after: value,
+					wasOverridden: descriptor.user !== void 0 && Object.hasOwn(descriptor.user, id)
+				}));
+			}
+			if (input === "migrate") {
+				const attempt = await migrateFromContext(ctx);
+				if (!attempt.ok) {
+					if (attempt.problem === "settings") return err(errorText("e-311-no-settings-service-is"));
+					if (attempt.problem === "home") return err(errorText("e-320-the-profile-home-is-not"));
+					return err(errorText("e-321-no-io-provider-is"));
+				}
+				return ok(renderNamespaceMigration(attempt.outcome));
+			}
+			if (input === "doctor" || input === "doctor --json") {
+				const report = await diagnose(ctx, { home: evolutionRoot() });
+				if (input === "doctor --json") return ok(JSON.stringify(report, null, 2));
+				return ok(renderDoctorText(report));
+			}
+			if (input === "" || input === "help") return ok(`自进化：记忆、技能、会话回顾、技能整理——状态、待批准写入与维护。\n${renderHelpText()}`);
+			return err(`/evolution ${input} is not a subcommand this build answers (a known subcommand whose argument is missing lands here too).\n${renderHint()}`);
+		} };
+		/** The registered definition: declared members only (A46). */
+		const evolutionCommand = {
+			name: "evolution",
+			description: "自进化：状态与待批准写入",
+			recordInput: false,
+			input: { hint: renderHint() },
+			handler: (invocation) => commandBody.run(invocation).catch((error) => ({
 				kind: "error",
 				text: `evolution: command failed: ${error instanceof Error ? error.message : String(error)}\nRun /evolution doctor to inspect services and state files; a corrupted state file is quarantined as <file>.corrupt for inspection.`
 			}))
@@ -1929,22 +1964,44 @@ function apply(ctx, rawConfig = {}) {
 		commandCtx.effect(() => commands.register(evolutionCommand));
 	});
 	let migrationRunning = false;
+	/**
+	* A trigger that arrived while an attempt was in flight (T4-12/A54).
+	*
+	* The guard used to SWALLOW it, and the comment above claimed a failed attempt "re-arms the
+	* guard for the next trigger" — but both triggers are lifecycle moments that have already
+	* passed by then, so there was no next trigger: one failed attempt (a slow or unreadable legacy
+	* document is enough) ended the automatic migration for that boot, leaving only a warning that
+	* suggests running the command by hand. The trigger is queued here and consumed at the attempt's
+	* settle point instead.
+	*/
+	let migrationQueued = false;
+	/** The attempt failed: re-arm the guard, and run the queued trigger NOW (its only chance left). */
+	const settleFailure = () => {
+		migrationRunning = false;
+		if (!migrationQueued) return;
+		migrationQueued = false;
+		runMigrationOnce();
+	};
 	const runMigrationOnce = () => {
-		if (migrationRunning) return;
+		if (migrationRunning) {
+			migrationQueued = true;
+			return;
+		}
 		migrationRunning = true;
 		(async () => {
 			try {
 				const attempt = await migrateFromContext(ctx);
 				if (!attempt.ok) {
-					migrationRunning = false;
 					ctx.logger.warn("evolution-commands: the legacy settings migration cannot run here (no %s) — run /evolution migrate after that service is mounted", attempt.problem);
+					settleFailure();
 					return;
 				}
 				const { outcome } = attempt;
 				if (outcome.source !== void 0 && outcome.report !== void 0 && outcome.report.written.length > 0) ctx.logger.info("evolution-commands: migrated the legacy settings document (%s)", renderNamespaceMigration(outcome));
+				migrationQueued = false;
 			} catch (error) {
-				migrationRunning = false;
 				ctx.logger.warn("evolution-commands: the legacy settings migration did not run — %s", error instanceof Error ? error.message : String(error));
+				settleFailure();
 			}
 		})();
 	};