@lmzhen/dsh-evolution-commands 0.21.0 → 0.23.0

package/lib/index.js

@@ -2,9 +2,10 @@ import { createRequire } from "node:module";
 import z from "@deepseek-ai/schemastery";
 import { effectiveSessionPolicy } from "@lmzhen/dsh-evolution-approval";
 import { createUserMessage } from "@deepseek-ai/dsh-llm";
-import { DEFAULT_SKILL_LIMITS, MAX_TIMER_DELAY_MS, PARAM_EXPOSURE, PARAM_GROUP_LABELS, absentHostServices, appendEvolutionEvent, applyNamespaceMigration, assertSkillsRootAliasRetired, buildLearnPrompt, canonicalWriteId, clampedNumber, classifyNamespaceMigration, composePresetEntry, elapsedSince, errorText, eventsFile, evolutionHome, evolutionRoot, isDeprecatedParamId, isMissingPath, isPresent, isUnknown, mergePresetRow, newRunRegistry, newSkillLibrary, paramSettingsId, partitionVersions, planNamespaceMigration, policyStageLimits, presetPatchText, presetRowBlock, presetRowBody, presetRowId, probeText, reportsSweepLockTarget, resolveBasePresetPatch, resolveParamId, resolveRootConfig, scopedProbeReport, sweepReports, transactIo } from "@lmzhen/dsh-evolution-core";
+import { DEFAULT_SKILL_LIMITS, MAX_TIMER_DELAY_MS, PARAM_EXPOSURE, PARAM_GROUP_LABELS, absentHostServices, appendEvolutionEvent, applyNamespaceMigration, asRecord, assertSkillsRootAliasRetired, atomicWriteFiles, buildLearnPrompt, canonicalWriteId, clampedNumber, classifyNamespaceMigration, composePresetEntry, elapsedSince, errorText, eventsFile, evolutionHome, evolutionRoot, isDeprecatedParamId, isPresent, isRecord, isUnknown, liveBool, mergePresetRow, newRunRegistry, newSkillLibrary, paramSettingsId, partitionVersions, planNamespaceMigration, policyStageLimits, presetPatchText, presetRowBlock, presetRowBody, presetRowId, probeText, reportsSweepLockTarget, resolveBasePresetPatch, resolveParamId, resolveRootConfig, scopedProbeReport, sweepReports, transactIo } from "@lmzhen/dsh-evolution-core";
 import { buildEnrichment, buildMaintainFacts, enrichmentSnapshotOptions, runMaintain, snapshotFromLibrary } from "@lmzhen/dsh-evolution-maintenance";
-import { copyFileSync, existsSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { preferProvider } from "@lmzhen/dsh-evolution-io";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 //#region lib/types/migration.js
@@ -194,7 +195,7 @@ async function objectOf(read) {
 	if (read === void 0) return void 0;
 	try {
 		const value = await read();
-		return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+		return isRecord(value) ? value : void 0;
 	} catch {
 		return;
 	}
@@ -235,7 +236,7 @@ async function readPlatformView(ctx) {
 */
 /** The patch file name inside a profile directory (`packages/boot/app-boot/src/profile.ts`,
 * `PROFILE_PATCH_FILENAME`). */
-const PROFILE_PATCH_FILENAME = "cordis.patch.yml";
+const PROFILE_PATCH_FILENAME$1 = "cordis.patch.yml";
 /**
 * The profile patch this process writes into, or undefined outside a profile.
 *
@@ -251,7 +252,7 @@ function presetProfileTarget(ctx) {
 	return {
 		profile: profile.name,
 		profileDir: profile.dir,
-		patchPath: typeof profile.patchPath === "string" && profile.patchPath !== "" ? profile.patchPath : join(profile.dir, PROFILE_PATCH_FILENAME),
+		patchPath: typeof profile.patchPath === "string" && profile.patchPath !== "" ? profile.patchPath : join(profile.dir, PROFILE_PATCH_FILENAME$1),
 		bundles: Array.isArray(profile.startedBundles) ? profile.startedBundles : []
 	};
 }
@@ -314,6 +315,135 @@ function moduleGraphPath(specifier) {
 	return fileURLToPath(resolve(specifier));
 }
 //#endregion
+//#region lib/types/profiles.js
+/**
+* The ONE reader of `<home>/profiles` (G3, 0.22).
+*
+* Two very different questions used to share one bare helper: diagnostics want EVERY profile under
+* the home (doctor's cross-profile summary), while the preset-install exclusion must only ever look
+* at THIS plane — a leftover profile from the other plane's home used to make the exclusion refuse a
+* legitimate install (the two-plane split made that reachable: `~/.dsh/profiles/web` sat next
+* to `profiles/desktop`). The directory is therefore read here and nowhere else:
+* `scanProfiles` is the single `readdirSync` of it, `homeProfiles` answers the diagnostic
+* question, and `installExclusionTarget` answers the write-path one — fail-closed, because an
+* unreadable home must never read as "nothing is installed".
+*
+* @module evolution-commands/src/profiles
+*/
+/** The patch file name inside a profile directory (the platform's own spelling). */
+const PROFILE_PATCH_FILENAME = "cordis.patch.yml";
+/** The ONLY directory read of `<home>/profiles` in the family.
+* `profiles/node_modules` is a platform-created directory that never carries a manifest (S2.1), dot-entries
+* are not profiles, and a directory without `package.json` is not one either.
+* @param home - the resolved DSH home.
+* @returns the scanned entries, or the enumeration error (never a silent empty list).
+*/
+function scanProfiles(home) {
+	const root = join(home, "profiles");
+	if (!existsSync(root)) return {
+		kind: "scanned",
+		profiles: []
+	};
+	let entries;
+	try {
+		entries = readdirSync(root, { withFileTypes: true });
+	} catch (error) {
+		return {
+			kind: "unreadable",
+			error
+		};
+	}
+	const profiles = [];
+	for (const entry of entries) {
+		if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
+		if (entry.name === "node_modules") continue;
+		const dir = join(root, entry.name);
+		if (!existsSync(join(dir, "package.json"))) continue;
+		profiles.push({
+			profile: entry.name,
+			dir
+		});
+	}
+	return {
+		kind: "scanned",
+		profiles
+	};
+}
+/** Every profile directory under one home, by name — the DIAGNOSTIC question (doctor's cross-profile
+* summary). An unreadable home answers the empty list here because doctor reports the failure on its
+* own DEGRADED row; a write path must ask {@link installExclusionTarget} instead.
+* @param home - the resolved DSH home.
+* @returns one entry per profile directory carrying a manifest.
+*/
+function homeProfiles(home) {
+	const scan = scanProfiles(home);
+	return scan.kind === "scanned" ? scan.profiles : [];
+}
+/** The bundle names one profile's manifest declares.
+* @param profileDir - the profile directory.
+* @param onError - called with the read/parse failure; a torn manifest is NOT "no bundles".
+* @returns the declared bundle names (empty when the manifest is absent).
+*/
+function profileBundles(profileDir, onError) {
+	try {
+		const bundles = JSON.parse(readFileSync(join(profileDir, "package.json"), "utf8")).dsh?.profile?.bundles;
+		return Array.isArray(bundles) ? bundles.filter((name) => typeof name === "string") : [];
+	} catch (error) {
+		onError?.(error);
+		return [];
+	}
+}
+/** One optional file's text, or `''` when it is absent or unreadable.
+* @param path - the file to read.
+* @returns the text.
+*/
+function readTextOrEmpty(path) {
+	try {
+		return readFileSync(path, "utf8");
+	} catch {
+		return "";
+	}
+}
+/** The profile's own patch text, or `''` when it has none.
+* @param profileDir - the profile directory.
+* @returns the patch text.
+*/
+function profilePatchText(profileDir) {
+	return readTextOrEmpty(join(profileDir, PROFILE_PATCH_FILENAME));
+}
+/** Where the preset-install exclusion must look: THIS plane only, or an explicit refusal.
+*
+* The write path does NOT scan the home: the mounted profile is the whole question (its started
+* bundles plus the ones its own manifest declares — either can double-mount), and a question that
+* cannot be answered still REFUSES. That is what makes a leftover profile from the other plane
+* harmless here: it is not this plane's profile, so it is never consulted.
+* @param mounted - the mounted profile, or undefined outside a profile (a bare library mount).
+* @returns the profile to judge with its bundle rows, or the reason a refusal is mandatory.
+*/
+function installExclusionTarget(mounted) {
+	if (mounted === void 0 || mounted.dir === "") return {
+		kind: "undecidable",
+		reason: "no profile is mounted in this process, so the double-mount question cannot be answered here"
+	};
+	let manifestFailure;
+	const declared = profileBundles(mounted.dir, (error) => {
+		manifestFailure = error;
+	});
+	const manifestCode = manifestFailure?.code;
+	if (manifestFailure !== void 0 && manifestCode !== "ENOENT") return {
+		kind: "undecidable",
+		reason: "the mounted profile manifest could not be read"
+	};
+	return {
+		kind: "mounted",
+		profile: {
+			profile: mounted.profile,
+			dir: mounted.dir
+		},
+		bundles: [...mounted.bundles, ...declared]
+	};
+}
+//#endregion
 //#region lib/types/doctor.js
 /**
 * `/evolution doctor` — read-only self-check (0.3.55, WB2).
@@ -450,7 +580,7 @@ function liveRowTails(plugins) {
 * @returns the mapping, or undefined for anything else.
 */
 function asMapping(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+	return asRecord(value);
 }
 /** Profile bundle rows for evolution-family packages across all profiles.
 *
@@ -460,22 +590,16 @@ function asMapping(value) {
 * list alone, and treating it as "no bundles" is exactly the fail-open state
 * the double-mount exclusion exists to prevent. */
 function collectEvolutionBundles(home, onReadError) {
-	const profilesDir = join(home, "profiles");
-	if (!existsSync(profilesDir)) return [];
-	const bundles = [];
-	let profileEntries;
-	try {
-		profileEntries = readdirSync(profilesDir, { withFileTypes: true });
-	} catch (error) {
-		onReadError?.(error, "profiles-dir");
-		return bundles;
+	const scan = scanProfiles(home);
+	if (scan.kind === "unreadable") {
+		onReadError?.(scan.error, "profiles-dir");
+		return [];
 	}
-	for (const profile of profileEntries) {
-		if (!profile.isDirectory()) continue;
-		if (profile.name === "node_modules" || profile.name.startsWith(".")) continue;
+	const bundles = [];
+	for (const { dir } of scan.profiles) {
 		let raw;
 		try {
-			raw = readFileSync(join(profilesDir, profile.name, "package.json"), "utf8");
+			raw = readFileSync(join(dir, "package.json"), "utf8");
 		} catch (error) {
 			if (error?.code === "ENOENT") continue;
 			onReadError?.(error, "profile-manifest");
@@ -579,62 +703,6 @@ function readAgentPresetBases$1(path) {
 		return null;
 	}
 }
-/** The bundle rows one profile manifest mounts (scope-agnostic, as written) — the target a preset
-* recompute resolves its platform base patch through.
-* @param profileDir - the profile directory.
-* @returns the bundle names; empty when the manifest is missing or torn.
-*/
-function profileBundles(profileDir) {
-	try {
-		const bundles = JSON.parse(readFileSync(join(profileDir, "package.json"), "utf8")).dsh?.profile?.bundles;
-		return Array.isArray(bundles) ? bundles.filter((name) => typeof name === "string") : [];
-	} catch {
-		return [];
-	}
-}
-/** Every profile directory under one DSH_HOME, by name.
-* @param home - resolved DSH_HOME.
-* @returns `{ profile, dir }` per directory under `profiles/` that carries a manifest.
-*/
-function profileDirectories(home) {
-	const out = [];
-	const root = join(home, "profiles");
-	let entries;
-	try {
-		entries = readdirSync(root, { withFileTypes: true });
-	} catch {
-		return out;
-	}
-	for (const entry of entries) {
-		if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
-		if (entry.name === "node_modules") continue;
-		const dir = join(root, entry.name);
-		if (!existsSync(join(dir, "package.json"))) continue;
-		out.push({
-			profile: entry.name,
-			dir
-		});
-	}
-	return out;
-}
-/** One optional file's text, or `''` when it is absent or unreadable.
-* @param path - the file to read.
-* @returns the text.
-*/
-function readTextOrEmpty(path) {
-	try {
-		return readFileSync(path, "utf8");
-	} catch {
-		return "";
-	}
-}
-/** The profile patch text, or `''` when the profile has none.
-* @param profileDir - the profile directory.
-* @returns the patch text.
-*/
-function profilePatchText(profileDir) {
-	return readTextOrEmpty(join(profileDir, PROFILE_PATCH_FILENAME));
-}
 /** Every USER-layer patch text that can carry a family preset row: each profile's own patch, then
 * the home layer (`<home>/cordis.patch.yml`), which the platform composes AFTER the profile layer
 * (`readProfilePatches` in `packages/boot/app-boot/src/profile-context.ts`). A row written there
@@ -644,7 +712,7 @@ function profilePatchText(profileDir) {
 * @returns the patch texts that exist, in profile-then-home order.
 */
 function userPatchTexts(home) {
-	const texts = profileDirectories(home).map(({ dir }) => profilePatchText(dir));
+	const texts = homeProfiles(home).map(({ dir }) => profilePatchText(dir));
 	texts.push(readTextOrEmpty(join(home, PROFILE_PATCH_FILENAME)));
 	return texts.filter((text) => text !== "");
 }
@@ -718,7 +786,7 @@ function probePresetFreshness(home, servicePresent) {
 	} catch (error) {
 		deltaFailure = `${deltaPath} could not be read (${error instanceof Error ? error.message : String(error)})`;
 	}
-	const profiles = profileDirectories(home);
+	const profiles = homeProfiles(home);
 	if (bases === null) {
 		const tablePath = basesPath ?? `${AGENT_PRESET_PACKAGE}/bases.json`;
 		return profiles.flatMap(({ profile, dir }) => {
@@ -849,6 +917,7 @@ async function legacyMigrationRow(ctx, home) {
 }
 async function diagnose(ctx, options = {}) {
 	const home = options.home ?? evolutionRoot();
+	const mounted = options.mounted;
 	const conflicts = [];
 	const bundles = collectEvolutionBundles(home, (error, scope) => {
 		const detail = error instanceof Error ? error.message : String(error);
@@ -944,6 +1013,7 @@ async function diagnose(ctx, options = {}) {
 		installForm,
 		deploymentForm,
 		bundles,
+		foreignProfiles: homeProfiles(home).filter(({ profile, dir }) => mounted === void 0 || profile !== mounted.profile && dir !== mounted.dir).map(({ profile }) => profile),
 		conflicts,
 		envIssues: env,
 		memoryIssues,
@@ -1102,6 +1172,7 @@ function renderDoctorText(report) {
 		lines.push(`preset:   ${row.base} → ${row.destination}  ${verdict}`);
 	}
 	if (report.presetIssues.length > 0) lines.push("agent presets:", ...report.presetIssues.map((line) => `  ! ${line}`));
+	if (report.foreignProfiles.length > 0) lines.push("profiles-foreign: " + report.foreignProfiles.join(", ") + " — not part of this plane: /evolution preset install ignores them, while the bundles (all profiles) line above counts them");
 	if (report.conflicts.length > 0) lines.push("conflicts:", ...report.conflicts.map((line) => `  ! ${line}`));
 	if (report.envIssues.length > 0) lines.push("env:", ...report.envIssues.map((line) => `  ! ${line}`));
 	if (report.memoryIssues.length > 0) lines.push("memory:", ...report.memoryIssues.map((line) => `  ! ${line}`));
@@ -1218,9 +1289,24 @@ const SOURCE_LABELS = Object.freeze({
 });
 /** What the E-tiers mean, so the count line reads without the docs. */
 const TIER_LEGEND = "档位：E0 固定／E1 只读／E2 安装时定／E3 你可改／E4 装完固化。";
+/**
+* The source column's word for one row (F-1).
+*
+* `unregistered` covers TWO different facts: the owner publishes no settings namespace (the value
+* really cannot be written — E-315/E-316) and the settings service itself is missing (then whether
+* the value could be written is UNKNOWN). Without a provider the column must not claim "不可改", or it
+* contradicts the legend and the footer of the very same output.
+* @param row - the row's surface facts.
+* @param providerMounted - whether a settings provider answered.
+* @returns the label for the source column.
+*/
+function sourceLabel(row, providerMounted) {
+	const label = SOURCE_LABELS[row.source] ?? row.source;
+	return providerMounted || row.source !== "unregistered" ? label : "未知";
+}
 function renderParamRows(rows, options) {
 	const header = pad("参数", 36) + pad("分组", 12) + pad("档位", 6) + pad("生效", 8) + pad("来源", 10) + "当前值";
-	const body = rows.map((row) => pad(row.id, 36) + pad(PARAM_GROUP_LABELS[row.group], 12) + pad(row.tier, 6) + pad(APPLIES_LABELS[row.applies] ?? row.applies, 8) + pad(SOURCE_LABELS[row.source] ?? row.source, 10) + renderValue(row.value));
+	const body = rows.map((row) => pad(row.id, 36) + pad(PARAM_GROUP_LABELS[row.group], 12) + pad(row.tier, 6) + pad(APPLIES_LABELS[row.applies] ?? row.applies, 8) + pad(sourceLabel(row, options.providerMounted), 10) + renderValue(row.value));
 	const tiers = [
 		"E0",
 		"E1",
@@ -1277,116 +1363,160 @@ function renderParamJson(rows) {
 }
 //#endregion
 //#region lib/types/registry.js
+/** The flags the TABLE declares for one subcommand (name → `--flag`), DERIVED from its usage. */
+function flagsOf(name) {
+	const entry = COMMAND_ENTRIES.find((candidate) => entryName(candidate) === name);
+	return entry === void 0 ? [] : entryFlags(entry);
+}
+/** C7 shape, DERIVED: the subcommand name is the first token of `usage` (variants use `|`). */
+function entryName(entry) {
+	const [head = ""] = entry.usage.split(" ");
+	return head.split("|")[0] ?? "";
+}
+/** C7 shape, DERIVED: the flags a `usage` declares, in the form `--flag` (value flags keep their name). */
+function entryFlags(entry) {
+	const found = [];
+	for (const match of entry.usage.matchAll(/--[a-z][a-z-]*/g)) if (!found.includes(match[0])) found.push(match[0]);
+	return found;
+}
 const COMMAND_ENTRIES = [
 	{
+		readonly: true,
 		usage: "pending [--detail]",
 		summary: "列出暂存的写入（--detail 显示参数）"
 	},
 	{
+		readonly: false,
 		usage: "approve <id>",
 		summary: "执行一条已批准的写入"
 	},
 	{
+		readonly: false,
 		usage: "reject <id>",
 		summary: "丢弃一条暂存写入，不执行"
 	},
 	{
+		readonly: false,
 		usage: "release <id>",
 		summary: "把卡在执行中的写入放回待批窗口（先确认效果再批准 or reject)"
 	},
 	{
+		readonly: true,
 		usage: "doctor [--json]",
 		summary: "只读自检：安装形态、冲突、环境、服务（--json 供脚本用）"
 	},
 	{
+		readonly: false,
 		usage: "curator run|pause|resume|status|report|scope",
 		summary: "立即运行一次自动整理，或暂停／恢复／查看状态"
 	},
 	{
+		readonly: true,
 		usage: "mutations",
 		summary: "列出技能改动记录"
 	},
 	{
+		readonly: false,
 		usage: "restore",
 		summary: "从最近的快照恢复技能"
 	},
 	{
+		readonly: false,
 		usage: "consolidate <target> <sources...> [--plan <runId>]",
 		summary: "把若干技能合并进一个总括技能"
 	},
 	{
+		readonly: false,
 		usage: "skill restore <name>",
 		summary: "按名字恢复一个已归档的技能"
 	},
 	{
+		readonly: true,
 		usage: "skill history <name>",
 		summary: "列出某个技能的内容版本（含时间、动作、字符数、哈希前缀）"
 	},
 	{
+		readonly: false,
 		usage: "skill undo <name> [--to v<N>]",
 		summary: "把某个技能的内容回退到某一版（默认上一版；只动内容，撤销本身也记为一版）"
 	},
 	{
+		readonly: false,
 		usage: "skill pin <name>",
 		summary: "钉住一个技能：免于删除、后台审查与生命周期整理（立即生效、随时可解钉；与 skill_manage 的 pin 动作同一语义，不走审批）"
 	},
 	{
+		readonly: false,
 		usage: "skill unpin <name>",
 		summary: "解钉一个技能：撤销上面的冻结（立即生效、不走审批）"
 	},
 	{
+		readonly: true,
 		usage: "skills health",
 		summary: "技能库结构体检"
 	},
 	{
+		readonly: false,
 		usage: "skills refresh",
 		summary: "丢弃目录缓存并重新读取技能树"
 	},
 	{
+		readonly: false,
 		usage: "learn [request]",
 		summary: "向本会话发一条学习请求"
 	},
 	{
+		readonly: false,
 		usage: "maintain [--timeout=<ms> | --facts]",
 		summary: "起一次维护扫描并立即回 run id（后台跑；--facts 为 0 token 预览）"
 	},
 	{
+		readonly: true,
 		usage: "maintain status [<id>]",
 		summary: "看维护扫描：在飞的那次（含已跑多久）或某个 run 的终态"
 	},
 	{
+		readonly: true,
 		usage: "maintain report [<id>]",
 		summary: "读某个 run 的结果正文（省略 id 取本 home 最新一条；没有结果就明说，不装成空结果）"
 	},
 	{
+		readonly: false,
 		usage: "maintain handoff [<id>]",
 		summary: "把某次维护报告交给模型：注入指针与汇报协议，模型只汇报、等你确认后再动手"
 	},
 	{
+		readonly: false,
 		usage: "maintain cancel [<id>]",
 		summary: "停掉在飞的那次维护扫描（省略 id 仅当最新一条是本进程在跑的那次）"
 	},
 	{
+		readonly: false,
 		usage: "migrate",
 		summary: "把旧设置文档里家族的旧分区迁进现在的行（幂等；已迁移过就报「已一致」）"
 	},
 	{
+		readonly: false,
 		usage: "policy set <id> <value> [--expect <revision>]",
 		summary: "通过设置服务写入一个你可改的参数 (E3 only; E1/E2 stay in cordis.yml)"
 	},
 	{
+		readonly: true,
 		usage: "params [--group <name>] [--json]",
 		summary: "列出全部参数：分组、档位、生效时机、来源与当前值（--json feeds scripts)"
 	},
 	{
+		readonly: false,
 		usage: "preset install [--base <name>[,<name>...]]",
 		summary: "把自进化 Agent 预设**行**写进当前 profile 的 patch 层（`profiles/<p>/cordis.patch.yml`；bases 来自 agent 包的 bases.json）"
 	},
 	{
+		readonly: false,
 		usage: "restructure <name> \"<heading>\" <to_file> [--plan <runId>]",
 		summary: "把技能正文的一节移到 references 文件"
 	},
 	{
+		readonly: true,
 		usage: "replay",
 		summary: "比较不同会话与重启之间的计划结果（从活动记录回填）"
 	}
@@ -1404,6 +1534,137 @@ function renderHelpText() {
 	].join("\n");
 }
 //#endregion
+//#region lib/types/parse.js
+/**
+* F-4/G7.4 (C7): the ONE parser for the /evolution command surface.
+*
+* The surface used to answer each subcommand with its own regex (`^params(?: --group ([a-z-]+))?(?: --json)?$`
+* and nine siblings), so `params --json --group review` and `params --group=review` were refused as
+* "not a subcommand", while a sibling regex accepted `=` — and a mistyped group name degraded into the
+* generic error instead of the one that lists the known groups.
+*
+* This parser is order- and `=`-tolerant, matches the subcommand name case-insensitively, keeps a flag
+* VALUE's case intact (the domain layer is the one that validates it), and answers a SYNTAX failure when a
+* declared value flag is left without its value (F-3: `policy set a.b --expect 3` must not read
+* `--expect 3` as the value).
+*
+* @module @lmzhen/dsh-evolution-commands/parse
+*/
+/** The flags whose declared form takes a value (`--group <name>`, `--expect <revision>`, …). */
+/**
+* Exported so the command-table gate can tie it to the table's usage lines (P2: two declarations of
+* "which flags take a value" would otherwise be free to drift apart).
+*/
+const VALUE_FLAGS = [
+	"group",
+	"expect",
+	"base",
+	"to",
+	"timeout",
+	"plan"
+];
+/**
+* Narrow a parse result: true when it is the syntax failure rather than a command.
+* @param result - what {@link parseSubcommand} answered.
+* @returns whether the line was refused.
+*/
+function isParseFailure(result) {
+	return result.kind !== void 0;
+}
+/**
+* Split a command line into tokens: whitespace separates, and a double-quoted run is ONE token with its
+* quotes removed (the `restructure <name> "<heading>" <to_file>` form needs that; the old regexes each
+* carried their own quoting rule).
+* @param input - the text after `/evolution`.
+* @returns the tokens, in order.
+*/
+function tokenize(input) {
+	const tokens = [];
+	let current = "";
+	let quoted = false;
+	for (const char of input.trim()) {
+		if (char === String.fromCharCode(34)) {
+			quoted = !quoted;
+			continue;
+		}
+		if (!quoted && /\s/.test(char)) {
+			if (current !== "") {
+				tokens.push(current);
+				current = "";
+			}
+			continue;
+		}
+		current += char;
+	}
+	if (current !== "") tokens.push(current);
+	return tokens;
+}
+/**
+* Read one SUB-FORM line: `maintain status`, `maintain report`, … — the shape the regexes used to own.
+*
+* A sub-form matches only when: the line parses, the name matches, the first positional is the sub-form,
+* and every flag the line carries is DECLARED by the table (an undeclared flag keeps the old
+* "unknown arguments" answer instead of silently becoming a bare flag).
+* @param input - the text after `/evolution`.
+* @param name - the subcommand name the table declares (e.g. `maintain`).
+* @param sub - the sub-form word (e.g. `status`).
+* @param declaredFlags - the flags the table declares for `name` (`flagsOf(name)`).
+* @returns the parsed command, or null when this line is not that sub-form.
+*/
+function subcommandOf(input, name, sub, declaredFlags) {
+	const parsed = parseSubcommand(input);
+	if (isParseFailure(parsed) || parsed.name !== name) return null;
+	if (parsed.positionals[0] !== sub) return null;
+	for (const flag of parsed.flags.keys()) if (!declaredFlags.includes("--" + flag)) return null;
+	return parsed;
+}
+/**
+* Parse one command line into its name, flags and positionals.
+* @param input - the text after `/evolution`.
+* @returns the parsed command, or the syntax failure that refused it.
+*/
+function parseSubcommand(input) {
+	const [first, ...rest] = tokenize(input);
+	if (first === void 0) return {
+		kind: "unknown-subcommand",
+		name: ""
+	};
+	const name = first.toLowerCase();
+	const flags = /* @__PURE__ */ new Map();
+	const positionals = [];
+	for (let index = 0; index < rest.length; index += 1) {
+		const token = rest[index];
+		if (token === void 0) continue;
+		if (!token.startsWith("--")) {
+			positionals.push(token);
+			continue;
+		}
+		const equals = token.indexOf("=");
+		const flag = (equals < 0 ? token : token.slice(0, equals)).slice(2);
+		if (equals >= 0) {
+			flags.set(flag, token.slice(equals + 1));
+			continue;
+		}
+		if (!VALUE_FLAGS.includes(flag)) {
+			flags.set(flag, true);
+			continue;
+		}
+		const next = rest[index + 1];
+		if (next === void 0 || next.startsWith("--")) return {
+			kind: "missing-value",
+			name,
+			flag
+		};
+		flags.set(flag, next);
+		index += 1;
+	}
+	return {
+		name,
+		flags,
+		positionals
+	};
+}
+//#endregion
 //#region lib/types/index.js
 /**
 * Human commands for the evolution family: /evolution learn|pending|curator|restore|consolidate|skills refresh.
@@ -1565,19 +1826,6 @@ async function readRunReport(io, record) {
 		};
 	}
 }
-/**
-* Read a switch that may be a live settings reference.
-*
-* The loader hands a `.volatile()` field as `{ get() }` and the value is read at USE time; a
-* directly constructed plugin passes a plain boolean (the schema is the loader's face — the same
-* split the numeric knobs document as their second clamp layer). A single-form read is wrong
-* either way: `=== true` is never true for a reference, and `?.get()` ignores the plain value.
-* @param value - the configured switch, in either form, or undefined.
-* @returns the switch; undefined reads as off.
-*/
-function liveFlag(value) {
-	return typeof value === "boolean" ? value : value?.get() ?? false;
-}
 function apply(ctx, rawConfig = {}) {
 	const config = rawConfig;
 	assertSkillsRootAliasRetired(rawConfig);
@@ -1593,7 +1841,7 @@ function apply(ctx, rawConfig = {}) {
 		const ioRegistry = ioCtx.get("evolutionIo");
 		if (!ioRegistry) return;
 		const registry = newRunRegistry({
-			io: ioRegistry.provider(),
+			io: preferProvider(ioRegistry, ["fs"]),
 			home: evolutionHome(),
 			warn: (message) => {
 				ctx.logger.warn(message);
@@ -1634,15 +1882,15 @@ function apply(ctx, rawConfig = {}) {
 				return err(errorText("e-306-this-deployment-stages-foreground", { a1: what }));
 			};
 			const approval = ctx.get("evolutionApproval");
-			const pendingMatch = /^pending(?: --detail)?$/.exec(input);
-			if (pendingMatch) {
+			const pendingParsed = parseSubcommand(input);
+			if (!isParseFailure(pendingParsed) && pendingParsed.name === "pending") {
 				if (!approval) return err(errorText("e-301-approval-service-not-mounted"));
 				const listed = [...await approval.list("pending"), ...await approval.list("executing")];
 				const pending = [...new Map(listed.map((row) => [row.id, row])).values()];
 				const ttlMs = typeof approval.ttlMs === "number" && Number.isFinite(approval.ttlMs) ? approval.ttlMs : 0;
 				const ttlNote = ttlMs > 0 ? `\n(staged writes expire after ${ttlMs} ms: an expired write is closed as REJECTED and is never executed — stage it again if it is still wanted)` : "\n(staged writes never expire — the window waits for a decision; set the evolution-approval row pendingTtlMs to bound it)";
 				if (pending.length === 0) return ok("No pending evolution writes." + ttlNote);
-				const detailed = pendingMatch[0] === "pending --detail";
+				const detailed = pendingParsed.flags.get("detail") === true;
 				const nowMs = Date.now();
 				const attribution = (p) => {
 					const age = elapsedSince(p.createdAt, nowMs);
@@ -1825,7 +2073,7 @@ function apply(ctx, rawConfig = {}) {
 				if (!ioRegistry) return err("Evolution IO registry not mounted — skill pinning unavailable.");
 				const result = await newSkillLibrary({
 					config: { root: skillsRootValue },
-					io: ioRegistry.provider(),
+					io: preferProvider(ioRegistry, ["fs"]),
 					ctx,
 					limits: {
 						...DEFAULT_SKILL_LIMITS,
@@ -1879,12 +2127,13 @@ function apply(ctx, rawConfig = {}) {
 				});
 				return woke ? ok("Learning request sent to this session. Follow it now.") : ok("Learning request queued for this session — this host exposes no wake-up channel, so it is read on your next message.");
 			}
-			if (input === "maintain --facts") {
+			const factsParsed = parseSubcommand(input);
+			if (!isParseFailure(factsParsed) && factsParsed.name === "maintain" && factsParsed.flags.get("facts") === true && factsParsed.positionals.length === 0) {
 				const ioRegistry = ctx.get("evolutionIo");
 				if (!ioRegistry) return err("Evolution IO registry not mounted — maintenance facts unavailable.");
 				const library = newSkillLibrary({
 					config: { root: skillsRootValue },
-					io: ioRegistry.provider()
+					io: preferProvider(ioRegistry, ["fs"])
 				});
 				const enrichment = await buildEnrichment(ctx, library);
 				const readFailures = [];
@@ -1896,15 +2145,17 @@ function apply(ctx, rawConfig = {}) {
 					}
 				});
 				if (snapshots.length === 0 && readFailures.length > 0) return err(`maintenance scan could not read ${readFailures.length} listed skill(s) (${readFailures.slice(0, 10).join(", ")}${readFailures.length > 10 ? ", …" : ""}) and read no skill at all — the library was NOT audited; fix the unreadable skills (or their directory names) and run the scan again`);
-				if (snapshots.length === 0 && skillsRootValue !== "" && !await ioRegistry.provider().exists(skillsRootValue)) return err(`maintenance scan found an empty skill library, but the configured skill root does not exist (${skillsRootValue}) — point the skillsRoot config at a real directory (a literal \`~\` is not expanded) and run the scan again`);
+				if (snapshots.length === 0 && skillsRootValue !== "" && !await preferProvider(ioRegistry, ["fs"]).exists(skillsRootValue)) return err(`maintenance scan found an empty skill library, but the configured skill root does not exist (${skillsRootValue}) — point the skillsRoot config at a real directory (a literal \`~\` is not expanded) and run the scan again`);
 				if (snapshots.length === 0) return ok("Maintenance scan: empty skill library. Nothing to do.");
 				const { facts } = buildMaintainFacts(snapshots, enrichment.usageObservedValue, void 0);
 				return ok(`Maintenance facts (0-token preview):\n${facts}`);
 			}
-			const maintainArgs = /^maintain(?:\s+--timeout[ =](\d+))?\s*$/.exec(input);
-			if (maintainArgs) {
-				const runTimeoutMs = maintainArgs[1] ? Number(maintainArgs[1]) : config.maintainTimeoutMs ?? 6e5;
-				if (!Number.isSafeInteger(runTimeoutMs) || runTimeoutMs <= 0 || runTimeoutMs > MAX_TIMER_DELAY_MS) return err(maintainArgs[1] ? `Invalid --timeout value: expected a positive integer number of milliseconds up to ${MAX_TIMER_DELAY_MS} (e.g. /evolution maintain --timeout 600000).` : `The maintainTimeoutMs config is invalid: expected a positive integer number of milliseconds up to ${MAX_TIMER_DELAY_MS}. Fix the evolution-commands row config (maintainTimeoutMs), then retry.`);
+			const maintainParsed = parseSubcommand(input);
+			const maintainFlagsDeclared = [...isParseFailure(maintainParsed) ? [] : maintainParsed.flags.keys()].every((flag) => flagsOf("maintain").includes("--" + flag));
+			if (!isParseFailure(maintainParsed) && maintainParsed.name === "maintain" && maintainParsed.positionals.length === 0 && maintainFlagsDeclared) {
+				const timeoutFlag = maintainParsed.flags.get("timeout");
+				const runTimeoutMs = typeof timeoutFlag === "string" ? Number(timeoutFlag) : config.maintainTimeoutMs ?? 6e5;
+				if (!Number.isSafeInteger(runTimeoutMs) || runTimeoutMs <= 0 || runTimeoutMs > MAX_TIMER_DELAY_MS) return err(timeoutFlag !== void 0 ? `Invalid --timeout value: expected a positive integer number of milliseconds up to ${MAX_TIMER_DELAY_MS} (e.g. /evolution maintain --timeout 600000).` : `The maintainTimeoutMs config is invalid: expected a positive integer number of milliseconds up to ${MAX_TIMER_DELAY_MS}. Fix the evolution-commands row config (maintainTimeoutMs), then retry.`);
 				const registry = runs;
 				if (!registry) return err("Evolution IO registry not mounted — maintenance scan unavailable.");
 				const synced = await syncRuns(registry);
@@ -1935,7 +2186,7 @@ function apply(ctx, rawConfig = {}) {
 					try {
 						const library = newSkillLibrary({
 							config: { root: skillsRootValue },
-							io: ioRegistry.provider()
+							io: preferProvider(ioRegistry, ["fs"])
 						});
 						const enrichment = await buildEnrichment(ctx, library);
 						const outcome = await runMaintain({
@@ -1947,7 +2198,7 @@ function apply(ctx, rawConfig = {}) {
 							logger: { warn: (message) => {
 								ctx.logger.warn(message);
 							} },
-							rootExists: skillsRootValue === "" ? void 0 : () => ioRegistry.provider().exists(skillsRootValue),
+							rootExists: skillsRootValue === "" ? void 0 : () => preferProvider(ioRegistry, ["fs"]).exists(skillsRootValue),
 							skillRoot: skillsRootValue
 						}, {
 							timeoutMs: runTimeoutMs,
@@ -1956,7 +2207,7 @@ function apply(ctx, rawConfig = {}) {
 							enrichment: () => enrichment
 						});
 						const endedAt = Date.now();
-						const resultRef = await writeMaintainReport(ioRegistry.provider(), {
+						const resultRef = await writeMaintainReport(preferProvider(ioRegistry, ["fs"]), {
 							runId: handle.id,
 							...outcome.ok ? {
 								verdict: outcome.verdict,
@@ -1980,7 +2231,7 @@ function apply(ctx, rawConfig = {}) {
 							...outcome.ok ? {} : { failure: handle.signal.aborted ? "cancelled: the scan was stopped before it settled" : outcome.error ?? "Maintenance scan failed." }
 						});
 						if (outcome.ok) {
-							appendEvolutionEvent(ioRegistry.provider(), eventsFile(runRoot), {
+							appendEvolutionEvent(preferProvider(ioRegistry, ["fs"]), eventsFile(runRoot), {
 								type: "maintain",
 								source: "manual",
 								runId: handle.id,
@@ -1989,7 +2240,7 @@ function apply(ctx, rawConfig = {}) {
 							}).catch((error) => {
 								ctx.logger.warn(`evolution-commands: failed to record maintain event: ${String(error)}`);
 							});
-							if (liveFlag(config.maintainHandoffOnSettle) && resultRef !== void 0 && runAgent !== void 0) try {
+							if (liveBool(config.maintainHandoffOnSettle) && resultRef !== void 0 && runAgent !== void 0) try {
 								if (deliverHandoff(runAgent, createUserMessage({
 									content: [{
 										type: "text",
@@ -2034,12 +2285,12 @@ function apply(ctx, rawConfig = {}) {
 					`- stop:   /evolution maintain cancel ${handle.id}`
 				].join("\n"));
 			}
-			const maintainStatus = /^maintain\s+status(?:\s+(\S+))?\s*$/.exec(input);
-			if (maintainStatus) {
+			const maintainStatus = subcommandOf(input, "maintain", "status", flagsOf("maintain"));
+			if (maintainStatus !== null) {
 				const registry = runs;
 				if (!registry) return err("Evolution IO registry not mounted — run status unavailable.");
 				const synced = await syncRuns(registry);
-				const wanted = maintainStatus[1];
+				const wanted = maintainStatus.positionals[1];
 				if (wanted !== void 0) {
 					const record = registry.find(wanted);
 					if (!record) {
@@ -2055,12 +2306,12 @@ function apply(ctx, rawConfig = {}) {
 				const recent = all.filter((record) => record.state !== "running").slice(0, 5);
 				return ok([live.length === 0 ? "No maintenance run in flight." : `In flight:\n${live.map(renderRunRecord).join("\n")}`, recent.length === 0 ? "" : `Recent:\n${recent.map(renderRunRecord).join("\n")}`].filter((part) => part !== "").join("\n"));
 			}
-			const maintainReport = /^maintain\s+report(?:\s+(\S+))?\s*$/.exec(input);
-			if (maintainReport) {
+			const maintainReport = subcommandOf(input, "maintain", "report", flagsOf("maintain"));
+			if (maintainReport !== null) {
 				const registry = runs;
 				if (!registry) return err("Evolution IO registry not mounted — run results unavailable.");
 				const synced = await syncRuns(registry);
-				const wanted = maintainReport[1];
+				const wanted = maintainReport.positionals[1];
 				if (wanted === void 0 && !synced.ok) return err(unreadableIndex(synced.note));
 				const record = wanted === void 0 ? newestRun(registry) : registry.find(wanted);
 				if (!record) {
@@ -2073,17 +2324,17 @@ function apply(ctx, rawConfig = {}) {
 				if (wanted === void 0 && record.state === "running") return err(`The newest run ${record.id} is still running — its report appears when it settles; /evolution maintain status ${record.id} shows where it is.`);
 				const ioRegistry = ctx.get("evolutionIo");
 				if (!ioRegistry) return err("Evolution IO registry not mounted — run results unavailable.");
-				const probed = await readRunReport(ioRegistry.provider(), record);
+				const probed = await readRunReport(preferProvider(ioRegistry, ["fs"]), record);
 				if (probed.kind === "missing") return err(`Run ${record.id} (${record.state}) has NO result: no report was written${record.failure === void 0 ? "" : ` (${record.failure})`}.`);
 				if (probed.kind === "unknown") return err(`Run ${record.id} has a report that could not be read (${probed.reason}) — this is not "no result".`);
 				return ok(probed.text);
 			}
-			const maintainCancel = /^maintain\s+cancel(?:\s+(\S+))?\s*$/.exec(input);
-			if (maintainCancel) {
+			const maintainCancel = subcommandOf(input, "maintain", "cancel", flagsOf("maintain"));
+			if (maintainCancel !== null) {
 				const registry = runs;
 				if (!registry) return err("Evolution IO registry not mounted — run cancellation unavailable.");
 				const synced = await syncRuns(registry);
-				const wanted = maintainCancel[1];
+				const wanted = maintainCancel.positionals[1];
 				if (wanted === void 0 && !synced.ok) return err(unreadableIndex(synced.note));
 				const record = wanted === void 0 ? newestRun(registry) : registry.find(wanted);
 				if (!record) {
@@ -2100,12 +2351,12 @@ function apply(ctx, rawConfig = {}) {
 				}
 				return ok(`Maintenance run ${record.id} cancelled — the scan stops at its next checkpoint. /evolution maintain status ${record.id} shows the terminal state.`);
 			}
-			const maintainHandoff = /^maintain\s+handoff(?:\s+(\S+))?\s*$/.exec(input);
-			if (maintainHandoff) {
+			const maintainHandoff = subcommandOf(input, "maintain", "handoff", flagsOf("maintain"));
+			if (maintainHandoff !== null) {
 				const registry = runs;
 				if (!registry) return err("Evolution IO registry not mounted — the report cannot be handed over.");
 				const synced = await syncRuns(registry);
-				const wanted = maintainHandoff[1];
+				const wanted = maintainHandoff.positionals[1];
 				if (wanted === void 0 && !synced.ok) return err(unreadableIndex(synced.note));
 				const record = wanted === void 0 ? newestRun(registry) : registry.find(wanted);
 				if (!record) {
@@ -2118,7 +2369,7 @@ function apply(ctx, rawConfig = {}) {
 				if (wanted === void 0 && record.state === "running") return err(`The newest run ${record.id} is still running — its report appears when it settles; /evolution maintain status ${record.id} shows where it is.`);
 				const ioRegistry = ctx.get("evolutionIo");
 				if (!ioRegistry) return err("Evolution IO registry not mounted — the report cannot be handed over.");
-				const probed = await readRunReport(ioRegistry.provider(), record);
+				const probed = await readRunReport(preferProvider(ioRegistry, ["fs"]), record);
 				if (probed.kind === "missing") return err(`Run ${record.id} (${record.state}) has NO result: no report was written${record.failure === void 0 ? "" : ` (${record.failure})`}.`);
 				if (probed.kind === "unknown") return err(`Run ${record.id} has a report that could not be read (${probed.reason}) — this is not "no result".`);
 				const missingAgent = agentMissing("handoff");
@@ -2144,26 +2395,27 @@ function apply(ctx, rawConfig = {}) {
 				return ok(woke ? `Handed run ${record.id} to the model — report: ${reportDigestPath(record)}. It will read the file and follow the action lines.` : `Handed run ${record.id} to the model, queued — this host exposes no wake-up channel, so it is read on your next message.`);
 			}
 			if (/^maintain\b/.test(input)) return err("Unknown maintain arguments: expected `maintain`, `maintain --timeout <ms>` / `maintain --timeout=<ms>`, `maintain status [<id>]`, `maintain report [<id>]`, `maintain handoff [<id>]` or `maintain cancel [<id>]`. Got: " + input);
-			const presetInstall = /^preset install(?: --base (\S+))?$/.exec(input);
-			if (presetInstall !== null || /^preset\b/.test(input)) {
-				if (presetInstall === null) return err("Unknown preset arguments: expected `preset install` or `preset install --base <name>[,<name>...]` (the names live in the agent package's bases.json). Got: " + input);
+			const presetParsed = parseSubcommand(input);
+			const presetInstall = isParseFailure(presetParsed) || presetParsed.name !== "preset" ? null : presetParsed.positionals[0] === "install" && presetParsed.positionals.length === 1 && [...presetParsed.flags.keys()].every((flag) => flagsOf("preset").includes("--" + flag)) ? presetParsed : false;
+			if (presetInstall !== null && presetInstall !== false) {
 				{
-					let installedBundles;
-					try {
-						installedBundles = collectEvolutionBundles(evolutionRoot(), (error) => {
-							throw error;
-						});
-					} catch (enumerationError) {
-						return err(`Refusing to install the layered Evolution preset: the home profile directory or one of its profile manifests could not be read (${enumerationError instanceof Error ? enumerationError.message : String(enumerationError)}) — the all/preset double-mount check could not run. Resolve access to the profiles directory and retry, or install via the layered installer, which enforces the same exclusion up front.`);
-					}
+					const mounted = presetProfileTarget(ctx);
+					const exclusion = installExclusionTarget(mounted === void 0 ? void 0 : {
+						profile: mounted.profile,
+						dir: mounted.profileDir,
+						bundles: mounted.bundles
+					});
+					if (exclusion.kind === "undecidable") return err(`Refusing to install the layered Evolution preset: ${exclusion.reason} — the all/preset double-mount check could not run. Resolve access to this profile and retry, or install via the layered installer, which enforces the same exclusion up front.`);
+					const installedBundles = exclusion.bundles;
 					const allBundle = installedBundles.find((name) => name === "dsh-evolution-all" || name.endsWith("/dsh-evolution-all"));
 					const presetBundle = installedBundles.find((name) => name === "dsh-evolution-preset" || name.endsWith("/dsh-evolution-preset"));
-					if (allBundle || presetBundle) return err(`Refusing to install the layered Evolution preset: "${allBundle ?? presetBundle}" is installed in this home — its model rows (tool-memory / tool-skill-manage / tool-session-query / skill-catalog) would double-mount with the preset's and the profile fails loud at startup. Keep ONE: remove the ${allBundle ? "evolution-all bundle" : "evolution-preset bundle"} before installing the layered preset (see /evolution doctor).`);
+					if (allBundle || presetBundle) return err(`Refusing to install the layered Evolution preset: "${allBundle ?? presetBundle}" is installed in this profile — its model rows (tool-memory / tool-skill-manage / tool-session-query / skill-catalog) would double-mount with the preset's and the profile fails loud at startup. Keep ONE: remove the ${allBundle ? "evolution-all bundle" : "evolution-preset bundle"} before installing the layered preset (see /evolution doctor).`);
 				}
 				try {
 					const source = resolveAgentPresetDir(import.meta.url);
 					const table = readAgentPresetBases(source);
-					const requestedRaw = presetInstall[1] ?? table.defaultBase;
+					const baseFlag = presetInstall.flags.get("base");
+					const requestedRaw = typeof baseFlag === "string" ? baseFlag : table.defaultBase;
 					const requested = [...new Set(requestedRaw.split(",").map((part) => part.trim()).filter((part) => part !== ""))];
 					if (requested.length === 0) return err(`No agent-preset base named — ${join(source, "bases.json")} lists ${table.entries.map((entry) => entry.name).join(", ")}`);
 					const selected = [];
@@ -2177,45 +2429,51 @@ function apply(ctx, rawConfig = {}) {
 					const profile = presetProfileTarget(ctx);
 					if (profile === void 0) return err("No profile is mounted in this process, so there is no profile patch to write the preset row into — run the command in a session started by `dsh --profile <name>`.");
 					const delta = readFileSync(deltaPath, "utf8");
-					const current = existsSync(profile.patchPath) ? readFileSync(profile.patchPath, "utf8") : "";
-					let merged = current;
-					const written = [];
-					for (const base of selected) {
-						const refusal = baseRefusalReason(base, (name) => ctx.get(name) !== void 0);
-						if (refusal !== void 0) return err(refusal);
-						const basePatch = resolvePresetBasePatch(base.name, profile);
-						const rowId = presetRowId(base.id);
-						const entryText = composePresetEntry(readFileSync(basePatch, "utf8"), delta, {
-							rowId,
-							id: base.id,
-							name: base.display.name,
-							description: base.display.description,
-							order: base.display.order
+					const hmr = ctx.get("hmr");
+					const commit = () => {
+						const current = existsSync(profile.patchPath) ? readFileSync(profile.patchPath, "utf8") : "";
+						let merged = current;
+						const written = [];
+						for (const base of selected) {
+							const refusal = baseRefusalReason(base, (name) => ctx.get(name) !== void 0);
+							if (refusal !== void 0) return err(refusal);
+							const basePatch = resolvePresetBasePatch(base.name, profile);
+							const rowId = presetRowId(base.id);
+							const entryText = composePresetEntry(readFileSync(basePatch, "utf8"), delta, {
+								rowId,
+								id: base.id,
+								name: base.display.name,
+								description: base.display.description,
+								order: base.display.order
+							});
+							const next = mergePresetRow(merged, entryText, rowId);
+							written.push(next === merged ? `${base.name} → ${profile.patchPath} (already current)` : `${base.name} → ${rowId} in ${profile.patchPath}`);
+							merged = next;
+						}
+						if (merged !== current) atomicWriteFiles(dirname(profile.patchPath), [{
+							name: PROFILE_PATCH_FILENAME$1,
+							content: presetPatchText(merged)
+						}], void 0, (message) => {
+							ctx.logger.warn(message);
 						});
-						const next = mergePresetRow(merged, entryText, rowId);
-						written.push(next === merged ? `${base.name} → ${profile.patchPath} (already current)` : `${base.name} → ${rowId} in ${profile.patchPath}`);
-						merged = next;
-					}
-					if (merged !== current) atomicWriteFiles(dirname(profile.patchPath), [{
-						name: PROFILE_PATCH_FILENAME,
-						content: presetPatchText(merged)
-					}], void 0, (message) => {
-						ctx.logger.warn(message);
-					});
-					return ok(`Evolution agent preset row installed (${written.join("; ")}). Restart the session switcher to select it.`);
+						return ok(`Evolution agent preset row installed (${written.join("; ")}). Restart the session switcher to select it.`);
+					};
+					const runExclusive = hmr?.runExclusive;
+					if (runExclusive === void 0) return commit();
+					return await runExclusive.call(hmr, commit);
 				} catch (error) {
 					return err(`Preset install failed: ${error instanceof Error ? error.message : String(error)}`);
 				}
 			}
 			if (input.startsWith("restructure ")) {
-				const planTail = /\s--plan\s+(\S+)\s*$/.exec(rawInputTrimmed) ?? null;
-				const planRunId = planTail?.[1] ?? void 0;
-				const rest = planTail ? rawInputTrimmed.slice(0, planTail.index) : rawInputTrimmed;
-				const match = /^restructure\s+(\S+)\s+"([^"]+)"\s+(\S+)$/.exec(rest);
-				if (!match) return err("Usage: /evolution restructure <name> \"<## heading>\" <to_file>");
-				const name = match[1] ?? "";
-				const heading = match[2] ?? "";
-				const toFile = match[3] ?? "";
+				const restParsed = parseSubcommand(rawInputTrimmed);
+				if (isParseFailure(restParsed) || restParsed.name !== "restructure") return err("Usage: /evolution restructure <name> \"<## heading>\" <to_file>");
+				const name = restParsed.positionals[0] ?? "";
+				const heading = restParsed.positionals[1] ?? "";
+				const toFile = restParsed.positionals[2] ?? "";
+				if (name === "" || heading === "" || toFile === "") return err("Usage: /evolution restructure <name> \"<## heading>\" <to_file>");
+				const planFlag = restParsed.flags.get("plan");
+				const planRunId = typeof planFlag === "string" ? planFlag : void 0;
 				if (!toFile.startsWith("references/")) return err("to_file must live under references/ (log/detail destination).");
 				const ioRegistry = ctx.get("evolutionIo");
 				if (!ioRegistry) return err("Evolution IO registry not mounted — restructure unavailable.");
@@ -2251,7 +2509,7 @@ function apply(ctx, rawConfig = {}) {
 				}
 				const result = await newSkillLibrary({
 					config: { root: skillsRootValue },
-					io: ioRegistry.provider(),
+					io: preferProvider(ioRegistry, ["fs"]),
 					ctx,
 					threatExemptLabels: config.threatExemptLabels,
 					limits: {
@@ -2271,8 +2529,8 @@ function apply(ctx, rawConfig = {}) {
 				if (!replay) return err(errorText("e-303-replay-service-not-mounted"));
 				return ok(replay.compare().report);
 			}
-			const paramsMatch = /^params(?: --group ([a-z-]+))?(?: --json)?$/.exec(input);
-			if (paramsMatch) {
+			const paramsParsed = parseSubcommand(input);
+			if (!isParseFailure(paramsParsed) && paramsParsed.name === "params") {
 				const provider = ctx.get("settings");
 				const sections = /* @__PURE__ */ new Map();
 				if (provider?.describe !== void 0) try {
@@ -2287,21 +2545,23 @@ function apply(ctx, rawConfig = {}) {
 					return err(errorText("e-307-the-settings-service-could", { a1: error instanceof Error ? error.message : String(error) }));
 				}
 				const rows = paramSurfaceRows(sections, PARAM_EXPOSURE);
-				const group = paramsMatch[1];
+				const groupFlag = paramsParsed.flags.get("group");
+				const group = typeof groupFlag === "string" ? groupFlag : void 0;
 				const selected = group === void 0 ? rows : rows.filter((row) => row.group === group);
 				if (group !== void 0 && selected.length === 0) return err(errorText("e-308-unknown-parameter-group-group", {
 					a1: group,
 					a2: paramGroups(PARAM_EXPOSURE).join(", ")
 				}));
-				if (input.endsWith("--json")) return ok(renderParamJson(selected));
+				if (paramsParsed.flags.get("json") === true) return ok(renderParamJson(selected));
 				return ok(renderParamRows(selected, { providerMounted: provider !== void 0 }));
 			}
-			const policySetMatch = /^policy set ([A-Za-z][A-Za-z0-9.-]*) (.+?)(?: --expect (\d+))?$/.exec(input);
-			if (policySetMatch) {
+			const policyParsed = parseSubcommand(input);
+			if (isParseFailure(policyParsed) && policyParsed.name === "policy" && policyParsed.kind === "missing-value") return err("/evolution policy set needs a value after --" + (policyParsed.flag ?? "") + "; usage: policy set <id> <value> [--expect <revision>]");
+			if (!isParseFailure(policyParsed) && policyParsed.name === "policy" && policyParsed.positionals[0] === "set") {
 				const provider = ctx.get("settings");
 				if (provider?.update === void 0 || provider.describe === void 0) return err(errorText("e-311-no-settings-service-is"));
-				const rawId = policySetMatch[1] ?? "";
-				const rawValue = policySetMatch[2] ?? "";
+				const rawId = policyParsed.positionals[1] ?? "";
+				const rawValue = policyParsed.positionals[2] ?? "";
 				let id;
 				try {
 					id = canonicalWriteId(rawId);
@@ -2332,13 +2592,24 @@ function apply(ctx, rawConfig = {}) {
 				}));
 				const current = descriptor.value;
 				const resolved = typeof current === "object" && current !== null ? current : void 0;
-				const expectedRaw = policySetMatch[3];
+				const expectFlag = policyParsed.flags.get("expect");
+				const expectedRaw = typeof expectFlag === "string" ? expectFlag : void 0;
 				const expected = expectedRaw === void 0 ? descriptor.revision : Number(expectedRaw);
 				if (expectedRaw !== void 0 && descriptor.revision !== void 0 && Number(expectedRaw) !== descriptor.revision) return err(errorText("e-309-revision-conflict-you-sent", {
 					a1: expectedRaw,
 					a2: descriptor.revision
 				}));
 				const value = parseParamValue(rawValue);
+				const floorId = entry.relation?.atLeast;
+				if (floorId !== void 0 && typeof value === "number") {
+					const sibling = resolved?.[floorId];
+					const floor = typeof sibling === "number" ? sibling : NaN;
+					if (Number.isFinite(floor) && value < floor) return err(errorText("e-322-a-parameter-would-break-a", {
+						a1: id,
+						a2: String(floor),
+						a3: String(value)
+					}));
+				}
 				try {
 					await provider.update(namespace, { [id]: value }, expected);
 				} catch (error) {
@@ -2366,7 +2637,16 @@ function apply(ctx, rawConfig = {}) {
 				return ok(renderNamespaceMigration(attempt.outcome));
 			}
 			if (input === "doctor" || input === "doctor --json") {
-				const report = await diagnose(ctx, { home: evolutionRoot() });
+				const mountedForDoctor = presetProfileTarget(ctx);
+				const mounted = mountedForDoctor === void 0 ? {} : { mounted: {
+					profile: mountedForDoctor.profile,
+					dir: mountedForDoctor.profileDir,
+					bundles: mountedForDoctor.bundles
+				} };
+				const report = await diagnose(ctx, {
+					home: evolutionRoot(),
+					...mounted
+				});
 				if (input === "doctor --json") return ok(JSON.stringify(report, null, 2));
 				return ok(renderDoctorText(report));
 			}
@@ -2377,7 +2657,6 @@ function apply(ctx, rawConfig = {}) {
 		const evolutionCommand = {
 			name: "evolution",
 			description: "自进化：状态与待批准写入",
-			recordInput: false,
 			input: { hint: renderHint() },
 			handler: (invocation) => commandBody.run(invocation).catch((error) => ({
 				kind: "error",
@@ -2492,121 +2771,6 @@ function resolveAgentPresetDir(importMetaUrl) {
 		return overlayCandidate;
 	}
 }
-const defaultFs = {
-	writeFileSync: (path, data) => {
-		writeFileSync(path, data);
-	},
-	existsSync: (path) => existsSync(path),
-	copyFileSync: (from, to) => {
-		copyFileSync(from, to);
-	},
-	renameSync: (from, to) => {
-		renameSync(from, to);
-	},
-	rmSync: (path, options) => {
-		rmSync(path, options);
-	},
-	mtime: (path) => {
-		try {
-			return statSync(path).mtimeMs;
-		} catch (error) {
-			if (isMissingPath(error)) return null;
-			throw error;
-		}
-	}
-};
-/**
-* S6.3 (E-40): atomically replace a set of files within one directory.
-* Each file is staged to a sibling `<name>.tmp`, then renamed into place
-* (atomic on the same filesystem); a pre-existing file keeps a single
-* `<name>.bak`. A failure at ANY staging step removes the staged temps and
-* leaves the previous files untouched — a half-written target is impossible
-* up to the staging and backup phases.
-*
-* F-211: the rename COMMIT phase does not carry the same guarantee. When a
-* filesystem refuses to overwrite the destination, the code removes it and
-* retries the rename; if the retry ALSO fails the destination is gone. The
-* single `.bak` created above still holds the previous content, so the target
-* is restored from it (best-effort) before the original rename error is
-* rethrown, so a failed commit never leaves the file missing.
-*
-* V4-17: the `.bak` is refreshed to the committed content after every
-* successful commit, so a later failed commit always recovers to the most
-* recent good generation (a once-at-first-install `.bak` could otherwise
-* restore content several installs old). The recovery error names the `.bak`
-* source (and mtime when available) so the caller knows the generation it
-* restored from.
-*/
-function atomicWriteFiles(targetDir, writes, fs = defaultFs, logger = console.warn) {
-	const stage = (name) => join(targetDir, `${name}.tmp`);
-	const dupes = [...new Set(writes.map((write) => write.name).filter((name, index, all) => all.indexOf(name) !== index))];
-	if (dupes.length > 0) throw new Error(`atomicWriteFiles: duplicate input names: ${dupes.join(", ")}`);
-	try {
-		for (const { name, content } of writes) fs.writeFileSync(stage(name), content);
-		for (const { name } of writes) {
-			const finalPath = join(targetDir, name);
-			const bakPath = join(targetDir, `${name}.bak`);
-			if (fs.existsSync(finalPath) && !fs.existsSync(bakPath)) fs.copyFileSync(finalPath, bakPath);
-		}
-		const committed = [];
-		for (const { name } of writes) {
-			const finalPath = join(targetDir, name);
-			const bakPath = join(targetDir, `${name}.bak`);
-			const tmp = stage(name);
-			try {
-				fs.renameSync(tmp, finalPath);
-				committed.push(name);
-			} catch {
-				try {
-					fs.rmSync(finalPath, { force: true });
-				} catch (removeError) {
-					const already = committed.length > 0 ? `; already committed: ${committed.join(", ")}` : "";
-					throw new Error(`atomicWriteFiles: could not remove "${name}" to replace it (${removeError instanceof Error ? removeError.message : String(removeError)})${already}`);
-				}
-				try {
-					fs.renameSync(tmp, finalPath);
-					committed.push(name);
-				} catch (renameError) {
-					const already = committed.length > 0 ? `; already committed: ${committed.join(", ")}` : "";
-					if (fs.existsSync(bakPath)) {
-						try {
-							fs.copyFileSync(bakPath, finalPath);
-						} catch {
-							throw new Error(`atomicWriteFiles: "${name}" was removed but recovery from ${bakPath} failed (${renameError instanceof Error ? renameError.message : String(renameError)}); verify the file manually${already}`);
-						}
-						const bakMtime = fs.mtime?.(bakPath);
-						const when = bakMtime !== null && bakMtime !== void 0 && Number.isFinite(bakMtime) ? ` (bak mtime ${new Date(bakMtime).toISOString()})` : "";
-						throw new Error(`atomicWriteFiles: "${name}" was removed during commit and restored from the last good generation ${bakPath}${when}; original error: ${renameError instanceof Error ? renameError.message : String(renameError)}${already}`);
-					}
-					throw new Error(`${renameError instanceof Error ? renameError.message : String(renameError)}${already}`);
-				}
-			}
-		}
-		for (const { name } of writes) {
-			const finalPath = join(targetDir, name);
-			try {
-				if (fs.existsSync(finalPath)) fs.copyFileSync(finalPath, join(targetDir, `${name}.bak`));
-			} catch (refreshError) {
-				logger(`atomicWriteFiles: committed "${name}" but failed to refresh its .bak (${refreshError instanceof Error ? refreshError.message : String(refreshError)}); a later failed commit will recover to an OLDER generation`);
-			}
-		}
-	} catch (error) {
-		const cleanupFailures = [];
-		for (const { name } of writes) try {
-			fs.rmSync(stage(name), {
-				force: true,
-				recursive: true
-			});
-		} catch (cleanupError) {
-			cleanupFailures.push(`${name}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
-		}
-		if (cleanupFailures.length > 0) {
-			const original = error instanceof Error ? error.message : String(error);
-			throw new Error(`${original} (staged-temp cleanup also failed: ${cleanupFailures.join("; ")})`);
-		}
-		throw error;
-	}
-}
 /** F-328: render staged args for `pending --detail`, truncated to 500 chars.
 * args may be non-JSON (a tool produced garbage), so the render is fail-safe.
 * V4-19: a truncation is marked with `…(truncated N chars)` so the operator is