@lmzhen/dsh-evolution-core 0.1.0-rc.5 → 0.1.0-rc.50

package/lib/index.js

@@ -1,5 +1,5 @@
-import { dirname, join } from "node:path";
-import { cp, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { cp, lstat, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { createHash, randomBytes } from "node:crypto";
 import { homedir } from "node:os";
 import { readFileSync } from "node:fs";
@@ -11,6 +11,20 @@ import { readFileSync } from "node:fs";
 * Native DSH packages pass `ctx.evolutionIo.provider()`; standalone consumers
 * (and the facade's own tests) can use `nodeEvolutionIo`.
 */
+/**
+* Run `task` inside `io.transact` when the backend provides it; otherwise fall
+* back to a plain read → task → write/remove sequence (no cross-process lock —
+* callers keep their single-process serialize chain as the second layer).
+*/
+async function transactIo(io, path, task) {
+	if (io.transact) {
+		await io.transact(path, task);
+		return;
+	}
+	const next = await task(await io.readText(path));
+	if (next === null) await io.remove(path);
+	else await io.writeText(path, next);
+}
 /** Lazy adapter over an IO provider registry, shared by every evolution consumer. */
 function evolutionIoAdapter(provider) {
 	return {
@@ -20,23 +34,95 @@ function evolutionIoAdapter(provider) {
 		list: (path) => provider().list(path),
 		exists: (path) => provider().exists(path),
 		rename: (path, destination) => provider().rename(path, destination),
-		copy: (path, destination) => provider().copy(path, destination)
+		copy: (path, destination) => provider().copy(path, destination),
+		size: (path) => {
+			const io = provider();
+			return io.size ? io.size(path) : Promise.resolve(null);
+		},
+		transact: (path, task) => {
+			const io = provider();
+			return io.transact ? io.transact(path, task) : transactIo(io, path, task);
+		},
+		isSymlink: (path) => {
+			const io = provider();
+			return io.isSymlink ? io.isSymlink(path) : Promise.resolve(null);
+		}
 	};
 }
 function nodeEvolutionIo() {
+	const isMissing = (error) => {
+		const code = error?.code;
+		return code === "ENOENT" || code === "ENOTDIR";
+	};
+	/**
+	* Cross-process write lock (claw `withFileLock` parity): an O_EXCL lock file
+	* guards the atomic write; a >5s-old lock is treated as stale and taken
+	* over. After the retry budget the write proceeds unlocked — the lock is a
+	* best-effort accommodation for multi-process deployments, never a read of
+	* availability.
+	*/
+	const withWriteLock = async (path, task) => {
+		const lock = `${path}.lock`;
+		for (let attempt = 0; attempt < 10; attempt += 1) try {
+			await writeFile(lock, String(process.pid), { flag: "wx" });
+			try {
+				return await task();
+			} finally {
+				await rm(lock, { force: true }).catch(() => {});
+			}
+		} catch (error) {
+			if (error?.code !== "EEXIST") throw error;
+			try {
+				const st = await stat(lock);
+				if (Date.now() - st.mtimeMs > 5e3) {
+					try {
+						await rm(lock, { force: true });
+					} catch {}
+					continue;
+				}
+			} catch {
+				continue;
+			}
+			await new Promise((resolve) => setTimeout(resolve, 50));
+		}
+		return await task();
+	};
 	return {
 		async readText(path) {
 			try {
 				return await readFile(path, "utf8");
-			} catch {
-				return null;
+			} catch (error) {
+				if (isMissing(error)) return null;
+				throw error;
 			}
 		},
 		async writeText(path, content) {
 			await mkdir(dirname(path), { recursive: true });
-			const tmp = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
-			await writeFile(tmp, content, "utf8");
-			await rename(tmp, path);
+			await withWriteLock(path, async () => {
+				const tmp = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+				await writeFile(tmp, content, "utf8");
+				await rename(tmp, path);
+			});
+		},
+		async transact(path, task) {
+			await mkdir(dirname(path), { recursive: true });
+			await withWriteLock(path, async () => {
+				let current;
+				try {
+					current = await readFile(path, "utf8");
+				} catch (error) {
+					if (isMissing(error)) current = null;
+					else throw error;
+				}
+				const next = await task(current);
+				if (next === null) {
+					await rm(path, { force: true });
+					return;
+				}
+				const tmp = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+				await writeFile(tmp, next, "utf8");
+				await rename(tmp, path);
+			});
 		},
 		async remove(path) {
 			await rm(path, {
@@ -47,16 +133,18 @@ function nodeEvolutionIo() {
 		async list(path) {
 			try {
 				return await readdir(path);
-			} catch {
-				return [];
+			} catch (error) {
+				if (isMissing(error)) return [];
+				throw error;
 			}
 		},
 		async exists(path) {
 			try {
 				await stat(path);
 				return true;
-			} catch {
-				return false;
+			} catch (error) {
+				if (isMissing(error)) return false;
+				throw error;
 			}
 		},
 		async rename(path, destination) {
@@ -69,13 +157,24 @@ function nodeEvolutionIo() {
 				recursive: true,
 				force: true
 			});
+		},
+		async size(path) {
+			try {
+				return (await stat(path)).size;
+			} catch (error) {
+				if (isMissing(error)) return null;
+				throw error;
+			}
+		},
+		async isSymlink(path) {
+			try {
+				return (await lstat(path)).isSymbolicLink();
+			} catch {
+				return null;
+			}
 		}
 	};
 }
-/** Absolute path helper kept separate so stores stay platform-correct. */
-function childPath(parent, ...parts) {
-	return join(parent, ...parts);
-}
 //#endregion
 //#region lib/types/usage.js
 /**
@@ -100,22 +199,65 @@ function emptyRecord() {
 		archived_at: null
 	};
 }
-async function loadUsage(root, io = nodeEvolutionIo()) {
+const isTimestamp = (value) => value === null || typeof value === "string";
+/**
+* Field-level normalization for one sidecar record (rc.42 audit P2-3): the
+* spread used to copy any junk through verbatim, so a corrupted file could
+* carry `use_count: "3"` into the quality math and lifecycle comparisons as
+* NaN. Every field falls back to its `emptyRecord()` baseline unless it has
+* exactly the declared type; an invalid `created_at` anchors the age clock at
+* now (first-sight defer semantics for a record whose age is unknowable).
+* Pure — exported for unit tests; `loadUsage` is the production caller.
+*/
+function normalizeUsageRecord(record) {
+	const base = emptyRecord();
+	if (!record || typeof record !== "object" || Array.isArray(record)) return base;
+	const raw = record;
+	const num = (value, fallback) => typeof value === "number" && Number.isFinite(value) ? value : fallback;
+	const bool = (value, fallback) => typeof value === "boolean" ? value : fallback;
+	return {
+		created_by: typeof raw.created_by === "string" ? raw.created_by : null,
+		use_count: num(raw.use_count, base.use_count),
+		view_count: num(raw.view_count, base.view_count),
+		patch_count: num(raw.patch_count, base.patch_count),
+		last_used_at: isTimestamp(raw.last_used_at) ? raw.last_used_at : base.last_used_at,
+		last_viewed_at: isTimestamp(raw.last_viewed_at) ? raw.last_viewed_at : base.last_viewed_at,
+		last_patched_at: isTimestamp(raw.last_patched_at) ? raw.last_patched_at : base.last_patched_at,
+		created_at: typeof raw.created_at === "string" ? raw.created_at : base.created_at,
+		state: raw.state === "stale" || raw.state === "archived" ? raw.state : "active",
+		pinned: bool(raw.pinned, base.pinned),
+		archived_at: isTimestamp(raw.archived_at) ? raw.archived_at : base.archived_at,
+		quality_score: typeof raw.quality_score === "number" && Number.isFinite(raw.quality_score) ? raw.quality_score : void 0,
+		quality_warn: typeof raw.quality_warn === "boolean" ? raw.quality_warn : void 0
+	};
+}
+/** Parse a raw usage sidecar; malformed content reads as empty (best-effort telemetry). */
+function parseUsage(raw) {
 	const map = /* @__PURE__ */ new Map();
-	const raw = await io.readText(usageFile(root));
-	if (raw !== null) try {
+	if (raw === null) return map;
+	try {
 		const parsed = JSON.parse(raw);
-		for (const [name, record] of Object.entries(parsed)) {
-			const base = emptyRecord();
-			map.set(name, {
-				...base,
-				...record,
-				state: record.state === "stale" || record.state === "archived" ? record.state : "active"
-			});
-		}
+		for (const [name, record] of Object.entries(parsed)) map.set(name, normalizeUsageRecord(record));
 	} catch {}
 	return map;
 }
+async function loadUsage(root, io = nodeEvolutionIo()) {
+	return parseUsage(await io.readText(usageFile(root)));
+}
+/**
+* Atomic read-modify-write on the usage sidecar (rc.50 P2-2): `task` receives
+* the map parsed from the current on-disk state and may mutate it; the result
+* is persisted inside the same transact so a second process sharing DSH_HOME
+* cannot interleave its RMW and lose a counter update. Callers keep their own
+* single-process serialize chain as the second layer.
+*/
+async function mutateUsage(root, io, task) {
+	await transactIo(io, usageFile(root), async (current) => {
+		const map = parseUsage(current);
+		await task(map);
+		return JSON.stringify(Object.fromEntries(map.entries()), null, 2);
+	});
+}
 async function saveUsage(root, map, io = nodeEvolutionIo()) {
 	const obj = Object.fromEntries(map.entries());
 	await io.writeText(usageFile(root), JSON.stringify(obj, null, 2));
@@ -155,15 +297,169 @@ function latestActivityAt(record) {
 	if (values.length === 0) return null;
 	return values.sort().reverse()[0] ?? null;
 }
+/**
+* Curator suppression sidecar: built-in skills the curator has archived stay
+* suppressed across re-seeds, so the lifecycle never fights a re-created
+* bundled skill. Best-effort load/save, mirroring the usage sidecar posture.
+* Versioned shape ({ version, names }) with legacy plain-array compat.
+*/
+const SUPPRESSED_FILE_VERSION = 1;
+function suppressedFile(root) {
+	return join(root, ".curator-suppressed.json");
+}
+async function loadSuppressedNames(root, io = nodeEvolutionIo()) {
+	return parseSuppressed(await io.readText(suppressedFile(root)));
+}
+function parseSuppressed(raw) {
+	if (raw === null) return /* @__PURE__ */ new Set();
+	try {
+		const parsed = JSON.parse(raw);
+		const names = Array.isArray(parsed) ? parsed : typeof parsed === "object" && parsed !== null && Array.isArray(parsed.names) ? parsed.names : [];
+		return new Set(names.filter((entry) => typeof entry === "string"));
+	} catch {
+		return /* @__PURE__ */ new Set();
+	}
+}
+async function saveSuppressedNames(root, names, io = nodeEvolutionIo()) {
+	await io.writeText(suppressedFile(root), JSON.stringify({
+		version: 1,
+		names: [...names].sort()
+	}, null, 2));
+}
+/**
+* Atomic read-modify-write on the suppression sidecar (rc.50 P2-2): `task`
+* receives the set parsed from the current on-disk state and may mutate it;
+* the result is persisted inside the same transact so a second process
+* sharing DSH_HOME cannot interleave its RMW. Best-effort posture unchanged.
+*/
+async function updateSuppressedNames(root, io, task) {
+	await transactIo(io, suppressedFile(root), async (current) => {
+		const names = parseSuppressed(current);
+		await task(names);
+		return JSON.stringify({
+			version: 1,
+			names: [...names].sort()
+		}, null, 2);
+	});
+}
+//#endregion
+//#region lib/types/constants.js
+/**
+* Shared constants for the dsh-evolution plugin family.
+*
+* Two classes of value live here, deliberately separated by section so future
+* edits do not blur the semantic boundary:
+*
+* 1. **Fixed protocol/format/security invariants** — changing these breaks an
+*    on-disk format, a naming/format contract, a path-security boundary, or a
+*    cross-component invariant. They are NOT exposed as deployment config.
+*
+* 2. **Cross-package shared tunable defaults** — the same semantic default is
+*    read (with a config override path) by more than one package (e.g.
+*    `evolution-policy` and `evolution-curator` both default `staleAfterDays`
+*    to 30). Centralizing them here means one authoritative default: a config
+*    override still applies per package, but the fallback is single-sourced.
+*
+* Package-private tunables (used by exactly one package) stay in that package,
+* not here — see evolution-replay's `DEFAULT_WEIGHTS` and evolution-feedback's
+* threshold, which are intentionally left where they are used.
+* @module @lmzhen/dsh-evolution-core
+*/
+/** Skill frontmatter `name` validated for the file name (lowercase + hyphen). */
+const SKILL_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
+/** Allowed skill support-file subdirectories (path-traversal boundary). */
+const SUPPORT_DIRS = [
+	"references",
+	"templates",
+	"scripts",
+	"assets"
+];
+/** Delimiter between durable memory entries (on-disk storage format). */
+const ENTRY_DELIMITER = "\n§\n";
+/** Built-in skill names the curator must never lifecycle-manage. */
+const PROTECTED_BUILTIN_SKILLS = new Set(["plan"]);
+const MAX_SKILL_NAME_LENGTH = 64;
+const MAX_DESCRIPTION_LENGTH = 1024;
+const MAX_SKILL_CONTENT_CHARS = 1e5;
+const MAX_SKILL_FILE_BYTES = 1048576;
+const DEFAULT_REVIEW_MEMORY_INTERVAL = 10;
+const DEFAULT_REVIEW_SKILL_INTERVAL = 10;
+/** Skill-review completion channel trigger mode: 'cadence' | 'completion' | 'both'. */
+const DEFAULT_SKILL_REVIEW_TRIGGER = "both";
+/** Cumulative session tool calls before a session counts as "proven long" for the completion channel. */
+const DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS = 20;
+const DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS = 3;
+const DEFAULT_SUBSTANTIVE_MIN_USER_CHARS = 200;
+const DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS = 500;
+const DEFAULT_MAX_OPS_PER_PLAN = 32;
+const DEFAULT_CURATOR_INTERVAL_HOURS = 168;
+const DEFAULT_MIN_IDLE_HOURS = 2;
+const DEFAULT_STALE_AFTER_DAYS = 30;
+const DEFAULT_ARCHIVE_AFTER_DAYS = 90;
+const DEFAULT_MEMORY_CHAR_LIMIT = 2200;
+const DEFAULT_USER_CHAR_LIMIT = 1375;
+/** Consolidation-failure backoff cap, shared by MemoryStore and memory-files' Config default. */
+const DEFAULT_CONSOLIDATION_FAILURES = 3;
+const DEFAULT_SKILL_CONTENT_CHARS = 1e5;
+//#endregion
+//#region lib/types/gates.js
+/**
+* The control-plane protection sets, held once and queried everywhere
+* (decision B, rc.44 plan M2): the lifecycle engine, the scope view, the LLM
+* nomination gate and the control-plane consolidate all answer "is this name
+* off limits — and why" from the same instance, so the gate sets can never
+* drift apart the way the three pre-rc.46 implementations did.
+*
+* Scope boundary: a GateSet covers NAME-SET protections only. Marker-based
+* protections (pinned / bundled / hub-installed) are file markers resolved by
+* `SkillLibrary.writeProtection` / `deleteProtection` — they depend on the
+* filesystem and the write origin, not on a name list.
+* @module @lmzhen/dsh-evolution-core
+*/
+var EvolutionGateSet = class {
+	exclude;
+	referenced;
+	suppressed;
+	constructor(inputs = {}) {
+		this.exclude = inputs.exclude ?? /* @__PURE__ */ new Set();
+		this.referenced = inputs.referenced ?? /* @__PURE__ */ new Set();
+		this.suppressed = inputs.suppressed ?? /* @__PURE__ */ new Set();
+	}
+	/**
+	* The first protection blocking this name, or null. Any hit blocks — the
+	* order is diagnostic only, so a name in two sets reports the first.
+	*/
+	blockReason(name) {
+		if (this.exclude.has(name)) return "excluded";
+		if (this.referenced.has(name)) return "referenced";
+		if (this.suppressed.has(name)) return "suppressed";
+		if (PROTECTED_BUILTIN_SKILLS.has(name)) return "protected-builtin";
+		return null;
+	}
+	isBlocked(name) {
+		return this.blockReason(name) !== null;
+	}
+};
+/** Build a GateSet from the curator-style config field names. */
+function createGateSet(config) {
+	return new EvolutionGateSet({
+		exclude: config.excludeSkillNames,
+		referenced: config.referencedSkillNames,
+		suppressed: config.suppressedNames
+	});
+}
 //#endregion
 //#region lib/types/curator.js
 /**
 * Deterministic skill curator: active → stale → archived transitions.
-* Pure function; file moves are performed by SkillLibrary.
+* Pure function with one deliberate side effect: records in the passed
+* `usage` map are MUTATED (state/archived_at) to carry the transition — the
+* caller owns the map and decides whether to clone first (dry-run) or persist
+* after. File moves are performed by SkillLibrary.
 */
-const PROTECTED_BUILTIN_SKILLS = new Set(["plan"]);
 function buildCuratorRunReport(input) {
 	return {
+		schemaVersion: 1,
 		runId: input.runId,
 		startedAt: input.startedAt,
 		finishedAt: input.finishedAt,
@@ -172,25 +468,144 @@ function buildCuratorRunReport(input) {
 		archiveCandidates: [...input.archiveCandidates],
 		archived: [...input.archived],
 		failed: [...input.failed],
-		...input.snapshotPath === void 0 ? {} : { snapshotPath: input.snapshotPath }
+		...input.snapshotPath === void 0 ? {} : { snapshotPath: input.snapshotPath },
+		...input.llmReviewEnabled === void 0 ? {} : { llmReviewEnabled: input.llmReviewEnabled }
+	};
+}
+/**
+* Render a curator run report as a compact human-readable markdown digest
+* (G6): run metadata first, then the notable sections (archived / failed /
+* stale candidates / LLM nominations).
+*/
+function renderCuratorReportMarkdown(report) {
+	const lines = [
+		`# Curator run ${report.runId}`,
+		"",
+		`- **Started** ${report.startedAt}`,
+		`- **Finished** ${report.finishedAt}`,
+		`- **Stale candidates**: ${report.staleCandidates.length}`,
+		`- **LLM nominations**: ${report.llmNominations.length}`,
+		`- **Archived**: ${report.archived.length}`,
+		`- **Failed**: ${report.failed.length}`,
+		...report.snapshotPath === void 0 ? [] : [`- **Snapshot**: ${report.snapshotPath}`],
+		...report.llmReviewEnabled === void 0 ? [] : [`- **llmReview**: ${report.llmReviewEnabled}`]
+	];
+	const section = (title, items) => items.length === 0 ? [] : [
+		"",
+		`## ${title}`,
+		"",
+		...items.map((item) => `- ${item}`)
+	];
+	return [
+		...lines,
+		...section("Archived", report.archived.map((item) => `${item.name} (${item.reason})`)),
+		...section("Failed", report.failed.map((item) => `${item.name}: ${item.reason}`)),
+		...section("Stale candidates", report.staleCandidates),
+		...section("LLM nominations", report.llmNominations),
+		""
+	].join("\n");
+}
+const NOMINATION_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
+/**
+* Parse the curator LLM's YAML nomination block (consolidations + prunings).
+* Line-oriented and lenient by design: the LLM output is advisory, every name
+* is re-validated against the tree before any file move happens downstream.
+*/
+function parseCuratorNominations(text) {
+	const prunings = [];
+	const consolidations = [];
+	let section = null;
+	let currentFrom = "";
+	for (const line of text.split("\n")) {
+		const consolidated = /^\s*-\s*from:\s*([a-z0-9][a-z0-9-]*)\s*$/.exec(line);
+		if (consolidated) {
+			section = "consolidations";
+			currentFrom = consolidated[1] ?? "";
+			continue;
+		}
+		const into = /^\s*into:\s*([a-z0-9][a-z0-9-]*)\s*$/.exec(line);
+		if (into) {
+			const intoName = into[1] ?? "";
+			if (section === "consolidations" && currentFrom !== "" && currentFrom !== intoName) consolidations.push({
+				from: currentFrom,
+				into: intoName
+			});
+			currentFrom = "";
+			continue;
+		}
+		const pruned = /^\s*-\s*name:\s*([a-z0-9][a-z0-9-]*)\s*$/.exec(line);
+		if (pruned) {
+			section = "prunings";
+			const name = pruned[1];
+			if (name) prunings.push(name);
+		}
+	}
+	const valid = (name) => NOMINATION_NAME_RE.test(name);
+	return {
+		prunings: prunings.filter(valid),
+		consolidations: consolidations.filter((item) => valid(item.from) && valid(item.into))
+	};
+}
+/**
+* The lifecycle-candidate gate, shared by the transition engine and the scope
+* view so the two can never disagree: records failing ANY of these gates are
+* outside the managed scope.
+*/
+function lifecycleCandidate(name, record, config, bundled, gates = createGateSet(config)) {
+	if (record.pinned) return false;
+	if (gates.isBlocked(name)) return false;
+	if (!(record.created_by === "agent" || config.manageUnmanaged === true) && !(config.pruneBuiltins === true && bundled)) return false;
+	if (record.state === "archived") return false;
+	return true;
+}
+/**
+* Read-only scope classification, derived from the SAME gate the transition
+* engine uses (`lifecycleCandidate`), so the view always predicts what a
+* curator pass may touch. `protectedNames` carries the marker info the usage
+* records lack (bundled / hub-installed / pinned from `SkillLibrary.list()`).
+*/
+function computeScopeView(usage, config, protectedNames, gates) {
+	const managed = [];
+	const watched = [];
+	const qualityWarned = [];
+	const exempted = [];
+	const protectedSet = /* @__PURE__ */ new Set();
+	const gateSet = gates ?? createGateSet(config);
+	for (const [name, record] of usage) {
+		if (gateSet.exclude.has(name) || gateSet.referenced.has(name)) {
+			exempted.push(name);
+			continue;
+		}
+		const bundled = config.bundledNames?.has(name) === true;
+		const suppressed = gateSet.suppressed.has(name);
+		if (record.pinned || bundled || suppressed || protectedNames?.has(name) === true) protectedSet.add(name);
+		if (lifecycleCandidate(name, record, config, bundled, gateSet)) {
+			managed.push(name);
+			if (record.state === "stale" || record.quality_warn === true) watched.push(name);
+			if (record.quality_warn === true) qualityWarned.push(name);
+		}
+	}
+	return {
+		managed: managed.sort(),
+		watched: watched.sort(),
+		qualityWarned: qualityWarned.sort(),
+		exempted: exempted.sort(),
+		protected: [...protectedSet].sort()
 	};
 }
 function daysSince(iso, created, now) {
 	return (now - new Date(iso ?? created).getTime()) / 864e5;
 }
-function computeLifecycleTransitions(usage, config, now = /* @__PURE__ */ new Date()) {
+function computeLifecycleTransitions(usage, config, now = /* @__PURE__ */ new Date(), gates) {
 	const result = {
 		transitions: [],
 		archive: [],
 		reactivate: [],
 		markStale: []
 	};
+	const gateSet = gates ?? createGateSet(config);
 	for (const [name, record] of usage) {
-		if (record.pinned) continue;
-		if (config.excludeSkillNames?.has(name)) continue;
-		if (record.created_by !== "agent" && config.manageUnmanaged !== true) continue;
-		if (PROTECTED_BUILTIN_SKILLS.has(name)) continue;
-		if (record.state === "archived") continue;
+		if (!lifecycleCandidate(name, record, config, config.bundledNames?.has(name) === true, gateSet)) continue;
 		const age = daysSince(null, record.created_at, now.getTime());
 		if (record.use_count === 0 && age < config.staleAfterDays) continue;
 		const idle = daysSince(latestActivityAt(record), record.created_at, now.getTime());
@@ -242,6 +657,225 @@ function computeLifecycleTransitions(usage, config, now = /* @__PURE__ */ new Da
 	return result;
 }
 //#endregion
+//#region lib/types/prompts.js
+/**
+* Review and curation prompts adapted from Hermes Agent
+* `agent/background_review.py`, `agent/curator.py`, and
+* `agent/learn_prompt.py`, with tool names translated to the DSH-native
+* catalog (`memory`, `skill_manage`, `skill`, `bash`, `str_replace_editor`).
+*
+* Every prompt is pinned in a versioned bundle. Review workers verify the
+* bundle digest before spending a model call, so a partially-patched
+* deployment fails closed instead of silently running a truncated prompt.
+*/
+/**
+* Prompt bundle identity. Bump both id and version whenever a prompt's text
+* changes semantically: the bundle digest is the fail-closed signal for
+* review workers, so a stale id across deployments must be distinguishable.
+*/
+const PROMPT_BUNDLE_ID = "dsh-evolution@3";
+const PROMPT_BUNDLE_VERSION = 3;
+const MEMORY_REVIEW_PROMPT = `[Auto-review — Memory]
+Review the conversation above and consider saving to memory if appropriate.
+
+Focus on:
+1. Has the user revealed things about themselves — persona, desires, preferences, or personal details worth remembering?
+2. Has the user expressed expectations about how you should behave, their work style, or ways they want you to operate?
+
+If something stands out, save it using the memory tool.
+If nothing is worth saving, just say "Nothing to save." and stop.`;
+const SKILL_REVIEW_PROMPT = `[Auto-review — Skills]
+Review the conversation above and update the skill library. Be ACTIVE — most sessions produce at least one skill update, even if small.
+
+Target shape: CLASS-LEVEL skills with a rich SKILL.md and a references/ directory for session-specific detail. Not a flat list of narrow one-session skills.
+
+Signals that warrant action:
+- The user corrected your style, tone, format, verbosity, workflow, or approach.
+- A non-trivial technique, fix, workaround, or debugging path emerged.
+- A loaded skill turned out wrong, missing, or outdated — patch it now.
+
+Only update skills you loaded or read in THIS session; never touch skills you have not read.
+
+Preference order:
+1. Patch a skill that was loaded or read this session.
+2. Patch an existing umbrella skill.
+3. Add references/, templates/, or scripts/ support under an existing skill.
+4. Create a new class-level umbrella skill only when nothing fits.
+
+Protected skills (bundled/hub-installed) must not be edited. Pinned skills are read-only to the background review: the pinned write guard refuses background changes, so only the foreground may update or archive them.
+
+Do NOT capture:
+- Environment-dependent failures (missing binaries, unconfigured credentials).
+- Negative claims about tools ("browser tools do not work").
+- Transient errors that resolved during the session.
+- One-off task narratives.
+
+If a tool failed because of setup state, capture the FIX under an existing setup skill — never "this tool does not work" as a standalone constraint.
+
+"Nothing to save." is a real option but should NOT be the default.`;
+const COMBINED_REVIEW_PROMPT = `[Auto-review]
+Review the conversation above and update two things.
+
+**Memory**: who the user is. Save durable user preferences, personal details, and expectations with the memory tool.
+
+**Skills**: how to do this class of task. Be ACTIVE. Only update skills you loaded or read in THIS session. Follow the same class-level umbrella policy, preference order, protected-skill rules, and do-not-capture list as a skill review.
+
+Act on whichever dimension has real signal. If genuinely nothing stands out on either, say "Nothing to save." and stop — but don't reach for that conclusion as a default.`;
+const CURATOR_PROMPT = `You are the skill curator. Maintain a healthy, class-level skill library, not a flat pile of narrow one-session skills.
+
+The goal is a LIBRARY OF CLASS-LEVEL INSTRUCTIONS. A skill collection of many narrow skills where each captures one session's specific bug is a FAILURE of the library. An agent searching skills matches on descriptions, not exact names; one broad umbrella with labeled subsections beats five narrow siblings for discoverability.
+
+Right target shape: class-level skills with rich SKILL.md + references/, templates/, scripts/ support files for session-specific detail.
+
+Hard rules:
+1. NEVER hard-delete a skill. Archive (moving to .archive/) is the maximum destructive action; archives are recoverable, deletion is not.
+2. Do not touch bundled, hub-installed, pinned, or scheduled-task-referenced (\`referenced\`) skills. Referenced skills MAY be consolidated into an umbrella, but never simply pruned.
+3. Do not archive recently-created or never-used skills without strong evidence. "use=0" is NOT evidence either way — it only means the trigger has not come up yet.
+4. Do NOT reject consolidation on the grounds that "each skill has a distinct trigger". The right bar is: would a human maintainer write this as N separate skills, or one skill with N labeled subsections? When the answer is the latter, merge.
+5. Judge overlap on CONTENT, not on usage counters.
+6. Before archiving a merged skill, ensure its unique content was preserved in the umbrella.
+
+How to work:
+1. Scan the candidate list. Identify PREFIX CLUSTERS — skills sharing a first word or domain keyword (expect 10-25 clusters).
+2. For each cluster with 2+ members, ask "what is the UMBRELLA CLASS these skills serve?" and consolidate:
+   a. MERGE INTO AN EXISTING UMBRELLA (patch a labeled section for each sibling's unique insight, then archive the siblings).
+   b. CREATE A NEW UMBRELLA SKILL.md covering the shared workflow with short labeled subsections, then archive the absorbed siblings.
+   c. DEMOTE session-specific detail to references/, templates/, or scripts/ under the umbrella.
+3. Keep the umbrella body tight and scannable: exact commands, verbatim paths, ~100-200 lines; never invent flags or APIs.
+
+Produce a YAML summary with exactly this shape:
+consolidations:
+  - from: <old-skill-name>
+    into: <umbrella-skill-name>
+    reason: <one short sentence>
+prunings:
+  - name: <skill-name>
+    reason: <one short sentence>
+Nominate a pruning only when archival is clearly safe (stale AND genuinely obsolete or fully absorbed elsewhere).`;
+const CURATOR_DRY_RUN_BANNER = `═══════════════════════════════════════════════════════════════
+DRY-RUN — REPORT ONLY. DO NOT MUTATE THE SKILL LIBRARY.
+═══════════════════════════════════════════════════════════════
+
+This is a PREVIEW pass. Follow every instruction above EXCEPT:
+  • Do NOT call skill_manage with action=create, update, patch, delete, write_file, or remove_file.
+  • Do NOT move, copy, or rewrite any file under the skills tree.
+
+Your output IS the deliverable: produce the exact same human-readable summary and YAML block you would on a live run, describing the actions you WOULD take. A reviewer will decide whether to approve a live run.
+
+If you accidentally take a mutating action, say so explicitly in the summary.`;
+const COMPLETION_SKILL_REVIEW_PROMPT = `[Auto-review — Skills · task complete]
+Your current task now appears complete. Before wrapping up, review the approach and update the skill library via skill_manage.
+
+Follow the skills review policy: be ACTIVE, prefer class-level umbrellas, patch ONLY skills loaded or read this session, and capture non-trivial techniques and user corrections. Do NOT capture environment-dependent failures, negative claims about tools, or one-off task narratives.
+
+Do NOT modify output files or re-run the task. If you are still mid-task, ignore this.`;
+function reviewPrompt(kind) {
+	if (kind === "memory") return MEMORY_REVIEW_PROMPT;
+	if (kind === "skill") return SKILL_REVIEW_PROMPT;
+	return COMBINED_REVIEW_PROMPT;
+}
+function sha256(text) {
+	return createHash("sha256").update(text).digest("hex");
+}
+function createPromptBundle(prompts) {
+	const canonical = JSON.stringify({
+		id: PROMPT_BUNDLE_ID,
+		version: 3,
+		prompts: Object.fromEntries(Object.entries(prompts).sort())
+	});
+	return Object.freeze({
+		id: PROMPT_BUNDLE_ID,
+		version: 3,
+		prompts: Object.freeze({ ...prompts }),
+		sha256: sha256(canonical)
+	});
+}
+const PROMPT_BUNDLE = createPromptBundle({
+	memory: MEMORY_REVIEW_PROMPT,
+	skill: SKILL_REVIEW_PROMPT,
+	combined: COMBINED_REVIEW_PROMPT,
+	curator: CURATOR_PROMPT,
+	completion: COMPLETION_SKILL_REVIEW_PROMPT
+});
+function verifyPromptBundle(bundle = PROMPT_BUNDLE) {
+	if (bundle.id !== "dsh-evolution@3" || bundle.version !== 3) return false;
+	const canonical = JSON.stringify({
+		id: PROMPT_BUNDLE_ID,
+		version: 3,
+		prompts: Object.fromEntries(Object.entries(bundle.prompts).sort())
+	});
+	return bundle.sha256 === sha256(canonical);
+}
+const DSH_AUTHORING_STANDARDS = `Follow the Hermes skill-authoring standards, translated to DSH tools.
+
+Frontmatter:
+- name: lowercase-hyphenated, <=64 chars, no spaces.
+- description: ONE sentence, <=60 characters, ends with a period. State the capability, not the implementation. No marketing words. Do NOT repeat the skill name. Count the characters before saving.
+- version: 0.1.0
+- author: always the literal value "Hermes". NEVER fill it from the environment, git config, or any identity you can probe.
+- platforms: declare [macos], [linux], and/or [windows] only when the skill is genuinely OS-bound; omit for portable skills.
+- metadata.hermes.tags: a few Capitalized, Relevant, Tags.
+- metadata.hermes.related_skills: [a, b] — name sibling skills this one builds on or is referenced by (optional; feeds the quality references factor).
+
+Body section order (omit only when empty):
+1. "# <Human Title>" then a 2-3 sentence intro: what it does, what it does NOT do, key dependency stance.
+2. "## When to Use" — concrete trigger phrases.
+3. "## Prerequisites" — exact env vars, install steps, credentials.
+4. "## How to Run" — canonical invocation framed through DSH tools.
+5. "## Quick Reference" — flat command/endpoint list.
+6. "## Procedure" — numbered steps with copy-paste-exact commands.
+7. "## Pitfalls" — known limits and rate limits.
+8. "## Verification" — one check proving the skill worked.
+
+DSH-tool framing:
+- Reference DSH tools by name in backticks: \`bash\`, \`str_replace_editor\`, \`write\`, \`skill\`, \`skill_manage\`, \`memory\`.
+- Do not name wrapped shell utilities when a DSH tool already covers them.
+- Larger scripts belong under \`scripts/\` (written with \`skill_manage write_file\`) and are referenced from SKILL.md by relative path.
+
+Quality bar:
+- Prefer verbatim flags, paths, and APIs from the source. Never invent them.
+- Keep it tight: ~100 lines simple, ~200 complex.
+- No router/index/hub skills that only point at other skills.
+- References go in \`references/\`, templates in \`templates/\`.`;
+//#endregion
+//#region lib/types/learn-prompt.js
+/**
+* Open-ended `/evolution learn` prompt builder.
+*
+* `learn` is open-ended: the user can name anything they can describe — a
+* directory of code, an API doc URL, a workflow they just walked the agent
+* through, or pasted notes. The prompt instructs the live agent to gather the
+* named sources with its existing tools, then author a single SKILL.md via
+* `skill_manage` following `DSH_AUTHORING_STANDARDS`. There is no separate
+* distillation engine and no model-tool footprint.
+*/
+/**
+* Build the agent prompt for an open-ended `/evolution learn` request.
+*
+* @param userRequest free-text the user gave after `/evolution learn`; an
+*   empty string falls back to "the workflow we just went through".
+* @returns a complete instruction the agent runs as a normal turn.
+*/
+function buildLearnPrompt(userRequest) {
+	return [
+		"[/learn] The user wants you to learn a reusable skill from the request below, and save it.",
+		"",
+		"THE REQUEST:",
+		userRequest.trim() || "the workflow we just went through in this conversation — review the steps taken and distill them into a reusable skill",
+		"",
+		"The request is open-ended and may mix two kinds of content, in any order: SOURCES to gather (directories, file paths, URLs, \"what we just did\", pasted notes) AND REQUIREMENTS that shape the skill (what to focus on, what to leave out, scope, naming, the angle to take). Treat EVERY part of the request as load-bearing. In particular, prose that comes after a path or link is NOT incidental — it is the user telling you what they want from that source. A request like `<url> focus on the auth flow, skip the deprecated endpoints` means: gather the URL AND honor \"focus on auth, skip deprecated\" as authoring requirements. Never fetch the first source and ignore the rest.",
+		"",
+		"Do this:",
+		"1. Gather every source the user named, using the tools you already have — reads and searches for local files or directories, web access for URLs, this conversation history if they referred to something you just did, and the text they pasted as-is. If the request is ambiguous about scope, make a reasonable choice and note it; do not stall.",
+		"2. Author ONE SKILL.md, applying every requirement, focus, and constraint in the request — these govern what the SKILL.md covers and emphasizes, not just which sources you read.",
+		"3. Save it with the `skill_manage` tool (action=\"create\"). Pick a sensible category. If the procedure needs a non-trivial script, add it under the skill's `scripts/` with `skill_manage` write_file and reference it by relative path.",
+		"",
+		DSH_AUTHORING_STANDARDS,
+		"",
+		"When done, tell the user the skill name, its category, and a one-line summary of what it captured."
+	].join("\n");
+}
+//#endregion
 //#region lib/types/threats.js
 /**
 * Threat scanning for agent-authored memory and skill content.
@@ -417,10 +1051,12 @@ const SCOPE_ORDER = {
 	context: 2,
 	strict: 3
 };
+const NO_SCAN_OPTIONS = {};
 /**
 * Scan text at `scope`. Patterns are cumulative: `strict` includes all scopes.
+* `options.excludeLabels` removes matching patterns without changing `scope`.
 */
-function scanThreats(text, scope = "strict", maxScanChars = 65536) {
+function scanThreats(text, scope = "strict", maxScanChars = 65536, options = NO_SCAN_OPTIONS) {
 	const findings = [];
 	if (ZERO_WIDTH_CHARS.test(text)) findings.push({
 		label: "unicode_zero_width",
@@ -433,8 +1069,10 @@ function scanThreats(text, scope = "strict", maxScanChars = 65536) {
 		scope
 	});
 	const normalized = text.normalize("NFKC").slice(0, maxScanChars);
+	const excluded = new Set(options.excludeLabels ?? []);
 	for (const pattern of PATTERNS) {
 		if (SCOPE_ORDER[pattern.scope] > SCOPE_ORDER[scope]) continue;
+		if (excluded.has(pattern.label)) continue;
 		if (pattern.regex.test(normalized)) findings.push({
 			label: pattern.label,
 			category: pattern.category,
@@ -444,24 +1082,24 @@ function scanThreats(text, scope = "strict", maxScanChars = 65536) {
 	return findings;
 }
 /** Blocking policy: any hit blocks. `severity` is deliberately not a gate. */
-function evaluateThreat(text, scope = "strict", maxScanChars = 65536) {
-	const findings = scanThreats(text, scope, maxScanChars);
+function evaluateThreat(text, scope = "strict", maxScanChars = 65536, options = NO_SCAN_OPTIONS) {
+	const findings = scanThreats(text, scope, maxScanChars, options);
 	return {
 		blocked: findings.length > 0,
 		findings
 	};
 }
 /** User-facing block message for memory writes. */
-function scanMemoryThreats(text, maxScanChars = 65536) {
-	const { blocked, findings } = evaluateThreat(text, "strict", maxScanChars);
+function scanMemoryThreats(text, maxScanChars = 65536, options = NO_SCAN_OPTIONS) {
+	const { blocked, findings } = evaluateThreat(text, "strict", maxScanChars, options);
 	if (!blocked) return null;
 	const pattern = findings.find((f) => f.category !== "unicode_obfuscation");
 	if (pattern) return `Blocked by security scan (${pattern.label}). Rephrase without instruction-like language.`;
 	return "Blocked by security scan: invisible or potentially malicious Unicode detected.";
 }
 /** User-facing block message for skill content writes. */
-function scanContentThreats(text, maxScanChars = 65536) {
-	const { blocked, findings } = evaluateThreat(text, "strict", maxScanChars);
+function scanContentThreats(text, maxScanChars = 65536, options = NO_SCAN_OPTIONS) {
+	const { blocked, findings } = evaluateThreat(text, "strict", maxScanChars, options);
 	if (!blocked) return null;
 	return `Blocked by security scan (${findings[0]?.label ?? "unknown"}). This content appears to contain potentially malicious instructions.`;
 }
@@ -471,7 +1109,39 @@ function scanContentThreats(text, maxScanChars = 65536) {
 * File-backed durable memory with Hermes-compatible semantics.
 * Stores are MEMORY.md and USER.md under $DSH_HOME/memories (~/.dsh/memories).
 */
-const ENTRY_DELIMITER = "\n§\n";
+/**
+* Read-guard factor: a memory file larger than this multiple of its target's
+* char limit is treated as externally corrupted and skipped instead of being
+* read whole (aligned with claw `tools/memory.ts` size guard, which uses the
+* same 10× bound around a file that should never exceed the store limit).
+*/
+const READ_GUARD_FACTOR = 10;
+/**
+* Consolidation-failure backoff window (package-private, rc.42 audit P2-1):
+* only failures inside the window count toward `maxConsolidationFailures`.
+* The store cannot observe turn boundaries, so the model-facing "this turn"
+* phrasing is approximated with ten minutes — generous enough to cover one
+* turn's retry loop, short enough that a failure yesterday never makes today's
+* first refusal say "stop retrying".
+*/
+const FAILURE_WINDOW_MS = 10 * 6e4;
+/**
+* Recoverable-error preview bounds (B-line G5, Hermes `_previews` parity):
+* failed replace/remove/batch calls echo the current entries so the model can
+* self-recover without re-reading the store. Bounded to five entries of eighty
+* characters each; package-private because it is an error-message shape, not a
+* behavior switch.
+*/
+const ERROR_PREVIEW_ENTRIES = 5;
+const ERROR_PREVIEW_WIDTH = 80;
+function previewEntries(entries) {
+	if (entries.length === 0) return "";
+	const shown = entries.slice(0, ERROR_PREVIEW_ENTRIES).map((entry) => {
+		return `- ${entry.length > ERROR_PREVIEW_WIDTH ? `${entry.slice(0, ERROR_PREVIEW_WIDTH)}…` : entry}`;
+	});
+	const more = entries.length > ERROR_PREVIEW_ENTRIES ? `\n  (+${entries.length - ERROR_PREVIEW_ENTRIES} more)` : "";
+	return `\n\nCurrent entries (preview):\n${shown.join("\n")}${more}`;
+}
 function memoryRoot(env = process.env) {
 	return join(env.DSH_HOME ?? join(homedir(), ".dsh"), "memories");
 }
@@ -495,6 +1165,7 @@ var MemoryStore = class {
 	maxFailures;
 	io;
 	failureCount = 0;
+	lastFailureAt = 0;
 	constructor(options = {}) {
 		this.io = options.io ?? nodeEvolutionIo();
 		this.memoryLimit = options.memoryCharLimit ?? 2200;
@@ -506,7 +1177,24 @@ var MemoryStore = class {
 	limitFor(target) {
 		return target === "memory" ? this.memoryLimit : this.userLimit;
 	}
+	/**
+	* Read-guard probe: `{ size, limit }` when the on-disk file exceeds
+	* `limit * READ_GUARD_FACTOR` bytes, `null` when it is absent, unknown
+	* (backend without a size probe), under the bound, or the target has no
+	* limit configured.
+	*/
+	async oversizedFile(target) {
+		const size = await this.io.size?.(fileFor(this.root, target));
+		if (size === null || size === void 0) return null;
+		const limit = this.limitFor(target);
+		if (limit <= 0) return null;
+		return size > limit * READ_GUARD_FACTOR ? {
+			size,
+			limit
+		} : null;
+	}
 	async read(target) {
+		if (await this.oversizedFile(target)) return [];
 		const raw = await this.io.readText(fileFor(this.root, target));
 		return raw === null ? [] : [...new Set(normalizeEntries(raw))];
 	}
@@ -517,24 +1205,86 @@ var MemoryStore = class {
 		this.failureCount = 0;
 	}
 	failure(target, message, entries) {
+		if (Date.now() - this.lastFailureAt > FAILURE_WINDOW_MS) this.failureCount = 0;
+		this.lastFailureAt = Date.now();
 		this.failureCount += 1;
 		const chars = entries.join(ENTRY_DELIMITER).length;
 		if (this.failureCount > this.maxFailures) return {
 			ok: false,
-			message: `Memory consolidation failed ${this.failureCount} times this turn. Stop retrying memory calls and continue with the user's task.`,
+			message: `Memory consolidation failed ${this.failureCount} times this turn. Stop retrying memory calls and continue with the user's task.${previewEntries(entries)}`,
 			entries,
 			chars,
 			limit: this.limitFor(target)
 		};
 		return {
 			ok: false,
-			message,
+			message: `${message}${previewEntries(entries)}`,
 			entries,
 			chars,
 			limit: this.limitFor(target)
 		};
 	}
+	/**
+	* StorageHint percentage must clamp at 100 like the render header: a drifted
+	* entry can push chars past the limit, and "Storage at 125%" contradicts the
+	* clamped usage indicator.
+	*/
+	storageHint(target, chars) {
+		const limit = this.limitFor(target);
+		if (limit <= 0) return "";
+		const percent = Math.min(100, Math.floor(chars * 100 / limit));
+		return percent >= 80 ? ` ⚠️ Storage at ${percent}% (${chars}/${limit} chars).` : "";
+	}
+	/**
+	* Best-effort raw-copy backup of the on-disk file to `<file>.bak.<stamp>`
+	* before a refusal, so an externally modified (or oversized) file stays
+	* recoverable. Copies bytes instead of reading them so a pathologically
+	* large file is never loaded just to back it up. Failure to back up does
+	* not change the refusal semantics.
+	*/
+	async backupFile(target) {
+		const path = fileFor(this.root, target);
+		const unique = `${(/* @__PURE__ */ new Date()).toISOString().replace(/[-:T]/g, "").slice(0, 14)}-${Math.random().toString(36).slice(2, 8)}`;
+		try {
+			await this.io.copy(path, `${path}.bak.${unique}`);
+			return `${path}.bak.${unique}`;
+		} catch {
+			return null;
+		}
+	}
+	/**
+	* Read-guard refusal for write paths. Returns the refusal result when the
+	* target file is oversized, `null` otherwise. The file is skipped for
+	* reading (never loaded), backed up by raw copy, and the model is told to
+	* fix it manually — mirroring the drift refusal so corrupted state is never
+	* silently overwritten.
+	*/
+	async oversizedRefusal(target) {
+		const oversized = await this.oversizedFile(target);
+		if (!oversized) return null;
+		const backup = await this.backupFile(target);
+		const suffix = backup ? ` A backup was saved to ${basename(backup)}.` : "";
+		return {
+			ok: false,
+			message: `Memory file is ${oversized.size} bytes (limit ${oversized.limit * READ_GUARD_FACTOR}) — skipping read.${suffix} Fix the file manually, then retry.`,
+			entries: [],
+			chars: 0,
+			limit: this.limitFor(target)
+		};
+	}
 	async add(target, facts) {
+		const refusal = await this.oversizedRefusal(target);
+		if (refusal) return refusal;
+		if (await this.detectDrift(target)) {
+			const backup = await this.backupFile(target);
+			return {
+				ok: false,
+				message: `External drift detected in memory file.${backup ? ` A backup was saved to ${basename(backup)}.` : ""} Resolve the drift before retrying.`,
+				entries: [],
+				chars: 0,
+				limit: this.limitFor(target)
+			};
+		}
 		const content = facts.trim();
 		if (!content) return {
 			ok: false,
@@ -556,7 +1306,7 @@ var MemoryStore = class {
 			this.resetFailures();
 			return {
 				ok: true,
-				message: "Entry already exists (no duplicate added).",
+				message: `Entry already exists (no duplicate added).${this.storageHint(target, entries.join(ENTRY_DELIMITER).length)}`,
 				entries,
 				chars: entries.join(ENTRY_DELIMITER).length,
 				limit: this.limitFor(target)
@@ -564,12 +1314,13 @@ var MemoryStore = class {
 		}
 		const next = [...entries, this.addDatePrefix ? `## ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}\n${content}` : content];
 		const total = next.join(ENTRY_DELIMITER).length;
-		if (total > this.limitFor(target)) return this.failure(target, `Adding this entry would exceed the ${this.limitFor(target)} char limit. Consolidate or remove stale entries, then retry.`, entries);
+		const addLimit = this.limitFor(target);
+		if (addLimit > 0 && total > addLimit) return this.failure(target, `Adding this entry would exceed the ${addLimit} char limit. Consolidate or remove stale entries, then retry.`, entries);
 		await this.write(target, next);
 		this.resetFailures();
 		return {
 			ok: true,
-			message: "Entry added.",
+			message: `Entry added.${this.storageHint(target, total)}`,
 			entries: next,
 			chars: total,
 			limit: this.limitFor(target)
@@ -583,13 +1334,18 @@ var MemoryStore = class {
 	}
 	async mutate(target, oldText, action, facts) {
 		const needle = oldText.trim();
-		if (!needle) return {
-			ok: false,
-			message: "old_text cannot be empty.",
-			entries: [],
-			chars: 0,
-			limit: this.limitFor(target)
-		};
+		if (!needle) {
+			const current = await this.read(target);
+			return {
+				ok: false,
+				message: `old_text cannot be empty.${previewEntries(current)}`,
+				entries: current,
+				chars: current.join(ENTRY_DELIMITER).length,
+				limit: this.limitFor(target)
+			};
+		}
+		const refusal = await this.oversizedRefusal(target);
+		if (refusal) return refusal;
 		const content = action === "replace" ? (facts ?? "").trim() : "";
 		if (action === "replace" && !content) return {
 			ok: false,
@@ -608,13 +1364,16 @@ var MemoryStore = class {
 				limit: this.limitFor(target)
 			};
 		}
-		if (await this.detectDrift(target)) return {
-			ok: false,
-			message: "External drift detected in memory file. Resolve the drift before retrying.",
-			entries: [],
-			chars: 0,
-			limit: this.limitFor(target)
-		};
+		if (await this.detectDrift(target)) {
+			const backup = await this.backupFile(target);
+			return {
+				ok: false,
+				message: `External drift detected in memory file.${backup ? ` A backup was saved to ${basename(backup)}.` : ""} Resolve the drift before retrying.`,
+				entries: [],
+				chars: 0,
+				limit: this.limitFor(target)
+			};
+		}
 		const entries = await this.read(target);
 		const matches = entries.map((entry, index) => ({
 			entry,
@@ -633,12 +1392,13 @@ var MemoryStore = class {
 		if (action === "remove") next.splice(index, 1);
 		else next[index] = content;
 		const total = next.join(ENTRY_DELIMITER).length;
-		if (total > this.limitFor(target)) return this.failure(target, `Resulting memory would exceed the ${this.limitFor(target)} char limit.`, entries);
+		const mutateLimit = this.limitFor(target);
+		if (mutateLimit > 0 && total > mutateLimit) return this.failure(target, `Resulting memory would exceed the ${mutateLimit} char limit.`, entries);
 		await this.write(target, next);
 		this.resetFailures();
 		return {
 			ok: true,
-			message: `Entry ${action === "remove" ? "removed" : "replaced"}.`,
+			message: `Entry ${action === "remove" ? "removed" : "replaced"}.${this.storageHint(target, total)}`,
 			entries: next,
 			chars: total,
 			limit: this.limitFor(target)
@@ -652,13 +1412,18 @@ var MemoryStore = class {
 			chars: 0,
 			limit: this.limitFor(target)
 		};
-		if (await this.detectDrift(target)) return {
-			ok: false,
-			message: "External drift detected in memory file. Resolve the drift before retrying.",
-			entries: [],
-			chars: 0,
-			limit: this.limitFor(target)
-		};
+		const refusal = await this.oversizedRefusal(target);
+		if (refusal) return refusal;
+		if (await this.detectDrift(target)) {
+			const backup = await this.backupFile(target);
+			return {
+				ok: false,
+				message: `External drift detected in memory file.${backup ? ` A backup was saved to ${basename(backup)}.` : ""} Resolve the drift before retrying.`,
+				entries: [],
+				chars: 0,
+				limit: this.limitFor(target)
+			};
+		}
 		const entries = await this.read(target);
 		const working = [...entries];
 		for (const [index, op] of operations.entries()) {
@@ -667,7 +1432,7 @@ var MemoryStore = class {
 				const body = (op.facts ?? "").trim();
 				if (!body) return {
 					ok: false,
-					message: `Operation ${position} (add): facts is required. No operations were applied.`,
+					message: `Operation ${position} (add): facts is required. No operations were applied.${previewEntries(entries)}`,
 					entries,
 					chars: entries.join(ENTRY_DELIMITER).length,
 					limit: this.limitFor(target)
@@ -686,7 +1451,7 @@ var MemoryStore = class {
 			const needle = (op.old_text ?? "").trim();
 			if (!needle) return {
 				ok: false,
-				message: `Operation ${position} (${op.action}): old_text is required. No operations were applied.`,
+				message: `Operation ${position} (${op.action}): old_text is required. No operations were applied.${previewEntries(entries)}`,
 				entries,
 				chars: entries.join(ENTRY_DELIMITER).length,
 				limit: this.limitFor(target)
@@ -698,7 +1463,7 @@ var MemoryStore = class {
 			if (matches.length === 0) return this.failure(target, `Operation ${position}: no entry matching "${needle}" found. No operations were applied.`, entries);
 			if (new Set(matches.map((m) => m.entry)).size > 1) return {
 				ok: false,
-				message: `Operation ${position}: "${needle}" matched multiple distinct entries. No operations were applied.`,
+				message: `Operation ${position}: "${needle}" matched multiple distinct entries. No operations were applied.${previewEntries(entries)}`,
 				entries,
 				chars: entries.join(ENTRY_DELIMITER).length,
 				limit: this.limitFor(target)
@@ -709,7 +1474,7 @@ var MemoryStore = class {
 				const body = (op.facts ?? "").trim();
 				if (!body) return {
 					ok: false,
-					message: `Operation ${position} (replace): facts is required.`,
+					message: `Operation ${position} (replace): facts is required.${previewEntries(entries)}`,
 					entries,
 					chars: entries.join(ENTRY_DELIMITER).length,
 					limit: this.limitFor(target)
@@ -726,12 +1491,13 @@ var MemoryStore = class {
 			}
 		}
 		const total = working.join(ENTRY_DELIMITER).length;
-		if (total > this.limitFor(target)) return this.failure(target, `Batch result (${total} chars) exceeds the ${this.limitFor(target)} limit. Remove or shorten more entries in the same batch.`, entries);
+		const batchLimit = this.limitFor(target);
+		if (batchLimit > 0 && total > batchLimit) return this.failure(target, `Batch result (${total} chars) exceeds the ${batchLimit} limit. Remove or shorten more entries in the same batch.`, entries);
 		await this.write(target, working);
 		this.resetFailures();
 		return {
 			ok: true,
-			message: `Applied ${operations.length} operation(s).`,
+			message: `Applied ${operations.length} operation(s).${this.storageHint(target, total)}`,
 			entries: working,
 			chars: total,
 			limit: this.limitFor(target)
@@ -741,172 +1507,239 @@ var MemoryStore = class {
 		const memory = await this.read("memory");
 		const user = await this.read("user");
 		const parts = [];
-		for (const [target, entries] of [["Memory", memory], ["User Profile", user]]) {
+		for (const [target, label, entries] of [[
+			"memory",
+			"Memory",
+			memory
+		], [
+			"user",
+			"User Profile",
+			user
+		]]) {
+			const oversized = entries.length === 0 ? await this.oversizedFile(target) : null;
+			if (oversized) {
+				parts.push(`## ${label} — file skipped: ${oversized.size} bytes (limit ${oversized.limit * READ_GUARD_FACTOR}); not read`);
+				continue;
+			}
 			const safe = entries.filter((entry) => !scanMemoryThreats(entry));
 			if (safe.length > 0) {
 				const body = safe.join(ENTRY_DELIMITER);
+				const limit = this.limitFor(target);
+				const pct = limit > 0 ? Math.min(100, Math.floor(body.length * 100 / limit)) : 0;
 				const note = safe.length === entries.length ? "" : ` (${entries.length - safe.length} threat-matched entries filtered)`;
-				parts.push(`## ${target} (${safe.length} entries)${note}\n${body}`);
+				parts.push(`## ${label} (${safe.length} entries) [${pct}% — ${body.length}/${limit} chars]${note}\n${body}`);
 			}
 		}
 		return parts.join("\n\n");
 	}
-	async snapshot() {
-		const [memory, user] = await Promise.all([this.read("memory"), this.read("user")]);
-		return {
-			memory,
-			user
-		};
-	}
-	async restoreSnapshot(snapshot) {
-		await this.write("memory", snapshot.memory);
-		await this.write("user", snapshot.user);
-	}
-	async detectDrift(target) {
-		const raw = await this.io.readText(fileFor(this.root, target));
-		if (raw === null) return false;
-		return normalizeEntries(raw).join(ENTRY_DELIMITER) !== raw.trim();
-	}
-};
-//#endregion
-//#region lib/types/prompts.js
-/**
-* Review and curation prompts adapted from Hermes Agent
-* `agent/background_review.py`, `agent/curator.py`, and
-* `agent/learn_prompt.py`, with tool names translated to the DSH-native
-* catalog (`memory`, `skill_manage`, `skill`, `bash`, `str_replace_editor`).
-*
-* Every prompt is pinned in a versioned bundle. Review workers verify the
-* bundle digest before spending a model call, so a partially-patched
-* deployment fails closed instead of silently running a truncated prompt.
-*/
-const PROMPT_BUNDLE_ID = "dsh-evolution@1";
-const MEMORY_REVIEW_PROMPT = `[Auto-review — Memory]
-Review the conversation above and consider saving to memory if appropriate.
-
-Focus on:
-1. Has the user revealed things about themselves — persona, desires, preferences, or personal details worth remembering?
-2. Has the user expressed expectations about how you should behave, their work style, or ways they want you to operate?
-
-If something stands out, save it using the memory tool.
-If nothing is worth saving, just say "Nothing to save." and stop.`;
-const SKILL_REVIEW_PROMPT = `[Auto-review — Skills]
-Review the conversation above and update the skill library. Be ACTIVE — most sessions produce at least one skill update, even if small.
-
-Target shape: CLASS-LEVEL skills with a rich SKILL.md and a references/ directory for session-specific detail. Not a flat list of narrow one-session skills.
-
-Signals that warrant action:
-- The user corrected your style, tone, format, verbosity, workflow, or approach.
-- A non-trivial technique, fix, workaround, or debugging path emerged.
-- A loaded skill turned out wrong, missing, or outdated — patch it now.
-
-Preference order:
-1. Patch a skill that was loaded or read this session.
-2. Patch an existing umbrella skill.
-3. Add references/, templates/, or scripts/ support under an existing skill.
-4. Create a new class-level umbrella skill only when nothing fits.
-
-Protected skills (bundled/hub-installed) must not be edited. Pinned skills may be patched but not archived.
-
-Do NOT capture:
-- Environment-dependent failures (missing binaries, unconfigured credentials).
-- Negative claims about tools ("browser tools do not work").
-- Transient errors that resolved during the session.
-- One-off task narratives.
-
-If a tool failed because of setup state, capture the FIX under an existing setup skill — never "this tool does not work" as a standalone constraint.
-
-"Nothing to save." is a real option but should NOT be the default.`;
-const COMBINED_REVIEW_PROMPT = `[Auto-review]
-Review the conversation above and update two things.
-
-**Memory**: who the user is. Save durable user preferences, personal details, and expectations with the memory tool.
-
-**Skills**: how to do this class of task. Be ACTIVE. Follow the same class-level umbrella policy, preference order, protected-skill rules, and do-not-capture list as a skill review.
-
-Act on whichever dimension has real signal. If genuinely nothing stands out on either, say "Nothing to save." and stop — but don't reach for that conclusion as a default.`;
-const CURATOR_PROMPT = `You are the skill curator. Maintain a healthy, class-level skill library.
-
-Rules:
-1. NEVER hard-delete a skill. Archive is the maximum destructive action.
-2. Do not touch bundled, hub-installed, or pinned skills.
-3. Do not archive recently-created or never-used skills without strong evidence.
-4. Prefer merging narrow skills into class-level umbrellas.
-5. Before archiving a merged skill, ensure its unique content was preserved.
-
-Produce a YAML summary:
-consolidations:
-  - from: <old-skill-name>
-    into: <umbrella-skill-name>
-    reason: <one short sentence>
-prunings:
-  - name: <skill-name>
-    reason: <one short sentence>`;
-function reviewPrompt(kind) {
-	if (kind === "memory") return MEMORY_REVIEW_PROMPT;
-	if (kind === "skill") return SKILL_REVIEW_PROMPT;
-	return COMBINED_REVIEW_PROMPT;
+	/**
+	* Detect on-disk drift: true when the file is not in the canonical
+	* `render(normalizeEntries(raw))` form. This catches structural anomalies
+	* the writer would quietly normalize away (empty/`§`-only entries, stray
+	* blank lines, leading/trailing delimiters) that indicate the file was
+	* edited outside MemoryStore. Purely single-canonical content reaches the
+	* same serialization and returns false, so a normal write is never flagged.
+	*
+	* An absent, empty, or whitespace-only file is the "never written" state
+	* (rc.42 audit P1-6): it parses to zero entries, so the canonical form
+	* `'\n'` can never byte-match it and every write path was permanently
+	* refused with "External drift detected" — including the repairs the model
+	* would need to make. Such files are adopted instead of flagged.
+	*/
+	async detectDrift(target) {
+		if (await this.oversizedFile(target)) return true;
+		const raw = await this.io.readText(fileFor(this.root, target));
+		if (raw === null || raw.trim() === "") return false;
+		const entries = normalizeEntries(raw);
+		const limit = this.limitFor(target);
+		if (limit > 0 && entries.some((entry) => entry.length > limit)) return true;
+		return render(entries) !== raw;
+	}
+};
+//#endregion
+//#region lib/types/mutations.js
+/**
+* Curator/author audit trail: `.mutations.json` records every skill mutation
+* with before/after content hashes so any automated edit is reviewable and
+* replayable. Best-effort persistence, mirroring the usage sidecar posture.
+* @module @lmzhen/dsh-evolution-core
+*/
+const DEFAULT_MUTATION_CAP = 500;
+/** Version of the `.mutations.json` file shape; writers always emit the current one. */
+const MUTATIONS_FILE_VERSION = 1;
+function mutationsFile(root) {
+	return join(root, ".mutations.json");
 }
-function sha256(text) {
-	return createHash("sha256").update(text).digest("hex");
+function contentHash(content) {
+	return createHash("sha256").update(content).digest("hex");
 }
-function createPromptBundle(prompts) {
-	const canonical = JSON.stringify({
-		id: PROMPT_BUNDLE_ID,
-		version: 1,
-		prompts: Object.fromEntries(Object.entries(prompts).sort())
-	});
-	return Object.freeze({
-		id: PROMPT_BUNDLE_ID,
-		version: 1,
-		prompts: Object.freeze({ ...prompts }),
-		sha256: sha256(canonical)
-	});
+/**
+* Parse a raw mutations sidecar; malformed content reads as empty (auditing is
+* best-effort). Versioned shape ({ version, records }) with legacy
+* plain-array compat, plus a field-level guard for records without the
+* required identity/timestamp fields (rc.42 audit P2-3).
+*/
+function parseMutationRecords(raw) {
+	if (raw === null) return [];
+	try {
+		const parsed = JSON.parse(raw);
+		return (Array.isArray(parsed) ? parsed : typeof parsed === "object" && parsed !== null && Array.isArray(parsed.records) ? parsed.records : []).filter((entry) => typeof entry === "object" && entry !== null && typeof entry.skillName === "string" && typeof entry.action === "string" && typeof entry.at === "string");
+	} catch {
+		return [];
+	}
 }
-const PROMPT_BUNDLE = createPromptBundle({
-	memory: MEMORY_REVIEW_PROMPT,
-	skill: SKILL_REVIEW_PROMPT,
-	combined: COMBINED_REVIEW_PROMPT,
-	curator: CURATOR_PROMPT
-});
-function verifyPromptBundle(bundle = PROMPT_BUNDLE) {
-	const canonical = JSON.stringify({
-		id: bundle.id,
-		version: bundle.version,
-		prompts: Object.fromEntries(Object.entries(bundle.prompts).sort())
+async function loadMutations(root, io = nodeEvolutionIo()) {
+	return parseMutationRecords(await io.readText(mutationsFile(root)));
+}
+/** Append one record, trim to `cap`, and write atomically (versioned shape). */
+async function recordMutation(root, io, record, cap = 500) {
+	await transactIo(io, mutationsFile(root), (current) => {
+		const existing = parseMutationRecords(current);
+		existing.push(record);
+		const trimmed = existing.length > cap ? existing.slice(existing.length - cap) : existing;
+		return Promise.resolve(JSON.stringify({
+			version: 1,
+			records: trimmed
+		}, null, 2));
 	});
-	return bundle.sha256 === sha256(canonical);
 }
-const DSH_AUTHORING_STANDARDS = `Follow the Hermes skill-authoring standards, translated to DSH tools.
-
-Frontmatter:
-- name: lowercase-hyphenated, <=64 chars, no spaces.
-- description: ONE sentence, <=60 characters, ends with a period. State the capability, not the implementation. No marketing words. Do NOT repeat the skill name. Count the characters before saving.
-- version: 0.1.0
-- author: always the literal value "Hermes". NEVER fill it from the environment, git config, or any identity you can probe.
-- platforms: declare [macos], [linux], and/or [windows] only when the skill is genuinely OS-bound; omit for portable skills.
-- metadata.hermes.tags: a few Capitalized, Relevant, Tags.
-
-Body section order (omit only when empty):
-1. "# <Human Title>" then a 2-3 sentence intro: what it does, what it does NOT do, key dependency stance.
-2. "## When to Use" — concrete trigger phrases.
-3. "## Prerequisites" — exact env vars, install steps, credentials.
-4. "## How to Run" — canonical invocation framed through DSH tools.
-5. "## Quick Reference" — flat command/endpoint list.
-6. "## Procedure" — numbered steps with copy-paste-exact commands.
-7. "## Pitfalls" — known limits and rate limits.
-8. "## Verification" — one check proving the skill worked.
-
-DSH-tool framing:
-- Reference DSH tools by name in backticks: \`bash\`, \`str_replace_editor\`, \`write\`, \`skill\`, \`skill_manage\`, \`memory\`.
-- Do not name wrapped shell utilities when a DSH tool already covers them.
-- Larger scripts belong under \`scripts/\` (written with \`skill_manage write_file\`) and are referenced from SKILL.md by relative path.
-
-Quality bar:
-- Prefer verbatim flags, paths, and APIs from the source. Never invent them.
-- Keep it tight: ~100 lines simple, ~200 complex.
-- No router/index/hub skills that only point at other skills.
-- References go in \`references/\`, templates in \`templates/\`.`;
+//#endregion
+//#region lib/types/quality.js
+/**
+* Quality scoring and near-duplicate detection for the curated skill library.
+*
+* Pure functions over data inputs so the scoring policy is unit-testable and
+* the same math feeds the usage sidecar, the `skill_manage review` surface and
+* the learning graph. Weights follow the Hermes/hermes-claw six-factor model;
+* mutation maturity is a documented DSH approximation (single per-month patch
+* trend ratio replaces the claw timestamp-trend formula, since DSH usage
+* records only carry the last patched timestamp).
+* @module @lmzhen/dsh-evolution-core
+*/
+const QUALITY_WEIGHTS = {
+	usageFrequency: .25,
+	stability: .2,
+	recency: .2,
+	references: .1,
+	mutationMaturity: .2,
+	richness: .05
+};
+/** Score below which a skill is flagged for review. */
+const LOW_QUALITY_THRESHOLD = .3;
+function clamp01(value) {
+	return Math.max(0, Math.min(1, value));
+}
+function daysBetween(from, now) {
+	return Math.max(0, (now.getTime() - new Date(from).getTime()) / 864e5);
+}
+function computeQualityScores(input) {
+	const now = input.now ?? /* @__PURE__ */ new Date();
+	const scores = /* @__PURE__ */ new Map();
+	for (const [name, record] of input.usage) {
+		const ageDays = Math.max(1, daysBetween(record.created_at, now));
+		const idleDays = daysBetween(latestActivityAt(record) ?? record.created_at, now);
+		const patchCount = record.patch_count;
+		const useCount = record.use_count;
+		const usageFrequency = clamp01(useCount / ageDays);
+		const stability = useCount === 0 ? 1 : clamp01(1 - patchCount / useCount);
+		const recency = idleDays < 30 ? 1 : clamp01(1 - (idleDays - 30) / 150);
+		const references = clamp01((input.referenceCounts?.get(name) ?? 0) / 3);
+		const mutationMaturity = patchCount === 0 ? .3 : patchCount === 1 ? .4 : clamp01((patchCount - 1) / Math.max(1, ageDays / 30));
+		const richness = clamp01((input.supportDirs?.get(name) ?? 0) * .175);
+		const factors = {
+			usageFrequency,
+			stability,
+			recency,
+			references,
+			mutationMaturity,
+			richness
+		};
+		const score = usageFrequency * QUALITY_WEIGHTS.usageFrequency + stability * QUALITY_WEIGHTS.stability + recency * QUALITY_WEIGHTS.recency + references * QUALITY_WEIGHTS.references + mutationMaturity * QUALITY_WEIGHTS.mutationMaturity + richness * QUALITY_WEIGHTS.richness;
+		scores.set(name, {
+			score,
+			factors,
+			warn: score < LOW_QUALITY_THRESHOLD
+		});
+	}
+	return scores;
+}
+function normalize(content) {
+	return content.toLowerCase().replace(/\s+/g, " ").trim();
+}
+function contentHash$1(content) {
+	return createHash("sha256").update(normalize(content)).digest("hex");
+}
+function tokenize(content) {
+	return new Set(normalize(content).split(/[^a-z0-9\u4e00-\u9fff]+/).filter(Boolean));
+}
+function jaccard(a, b) {
+	if (a.size === 0 || b.size === 0) return 0;
+	let intersection = 0;
+	for (const token of a) if (b.has(token)) intersection += 1;
+	return intersection / (a.size + b.size - intersection);
+}
+/**
+* Two-phase near-duplicate clustering: exact normalized-hash groups first,
+* then token-Jaccard edges at {@link DEDUP_SIMILARITY_THRESHOLD} with a token
+* ratio guard, union-find across the whole set.
+*/
+function computeDedupGroups(input) {
+	const threshold = input.threshold ?? .95;
+	const names = [...input.contents.keys()];
+	const hashes = /* @__PURE__ */ new Map();
+	for (const name of names) {
+		const hash = contentHash$1(input.contents.get(name) ?? "");
+		const bucket = hashes.get(hash);
+		if (bucket) bucket.push(name);
+		else hashes.set(hash, [name]);
+	}
+	const parent = /* @__PURE__ */ new Map();
+	const find = (x) => {
+		const root = parent.get(x) ?? x;
+		if (root !== x) parent.set(x, find(root));
+		return parent.get(x) ?? x;
+	};
+	const union = (a, b) => {
+		const [ra, rb] = [find(a), find(b)];
+		if (ra !== rb) parent.set(rb, ra);
+	};
+	for (const [hash, bucketNames] of hashes) {
+		const first = bucketNames[0];
+		if (first === void 0 || bucketNames.length === 1) continue;
+		for (let index = 1; index < bucketNames.length; index += 1) {
+			const peer = bucketNames[index];
+			if (peer) union(first, peer);
+		}
+	}
+	const tokens = /* @__PURE__ */ new Map();
+	const tokenSet = (name) => {
+		let set = tokens.get(name);
+		if (!set) {
+			set = tokenize(input.contents.get(name) ?? "");
+			tokens.set(name, set);
+		}
+		return set;
+	};
+	for (let index = 0; index < names.length; index += 1) {
+		const a = names[index];
+		if (a === void 0) continue;
+		for (let other = index + 1; other < names.length; other += 1) {
+			const b = names[other];
+			if (b === void 0) continue;
+			const [ta, tb] = [tokenSet(a), tokenSet(b)];
+			if (Math.max(ta.size, tb.size) / Math.max(1, Math.min(ta.size, tb.size)) > 5) continue;
+			if (jaccard(ta, tb) >= threshold) union(a, b);
+		}
+	}
+	const groups = /* @__PURE__ */ new Map();
+	for (const name of names) {
+		const root = find(name);
+		const group = groups.get(root);
+		if (group) group.push(name);
+		else groups.set(root, [name]);
+	}
+	return [...groups.values()].filter((group) => group.length > 1);
+}
 //#endregion
 //#region lib/types/signals.js
 /**
@@ -994,26 +1827,41 @@ function foldTurn(session, fromSeq) {
 * it created unless a `.hermes-managed` marker opts a skill in. Archival is a
 * move to `.archive/` — never a hard delete.
 */
-const SKILL_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
-const MAX_SKILL_NAME_LENGTH = 64;
-const MAX_DESCRIPTION_LENGTH = 1024;
-const MAX_SKILL_CONTENT_CHARS = 1e5;
-const MAX_SKILL_FILE_BYTES = 1048576;
 const DEFAULT_SKILL_LIMITS = {
 	maxNameLength: 64,
 	maxDescriptionLength: MAX_DESCRIPTION_LENGTH,
 	maxSkillContentChars: MAX_SKILL_CONTENT_CHARS,
 	maxSkillFileBytes: MAX_SKILL_FILE_BYTES
 };
-const SUPPORT_DIRS = [
-	"references",
-	"templates",
-	"scripts",
-	"assets"
-];
+/** Extra file name carried inside a snapshot's `extras/` directory. */
+const SNAPSHOT_EXTRA_NAME_RE = /^[a-z0-9][a-z0-9._-]*$/;
 function skillsRoot(env = process.env) {
 	return join(env.DSH_HOME ?? join(homedir(), ".dsh"), "skills");
 }
+/**
+* Map a requesting session onto the two origin surfaces (rc.44 plan M2-2.3):
+* the APPROVAL surface treats every delegated subagent as the autonomous
+* review channel, while the LIBRARY surface keeps the Hermes distinction -
+* the review fork is 'background_review' (the pinned guard blocks its
+* writes) and any other subagent is 'subagent' (agent-authored, not
+* review-channel). `isReview` marks the caller as the background review
+* pipeline itself. Single source: the two tools and the review executor all
+* read this table instead of re-deriving it.
+*/
+function resolveOrigins(headerOrigin, isReview = false) {
+	if (isReview) return {
+		approval: "background_review",
+		library: "background_review"
+	};
+	if (headerOrigin === "subagent") return {
+		approval: "background_review",
+		library: "subagent"
+	};
+	return {
+		approval: "foreground",
+		library: "foreground"
+	};
+}
 function skillDir(root, name) {
 	return join(root, name);
 }
@@ -1040,6 +1888,26 @@ function parseFrontmatter(content) {
 		body
 	};
 }
+/**
+* Skill names referenced by a SKILL.md's `related_skills` frontmatter
+* (B-line G3, rc.44): the single parsing source for the quality references
+* factor and the learning-graph edges. The DSH frontmatter parser keeps the
+* YAML value as a string (`"[a, b]"`), so names are scanned out of it; each
+* must satisfy the skill-name shape and the referencing skill itself is
+* excluded. Pure and deduplicated.
+*/
+function relatedSkillNames(content, exclude) {
+	const parsed = parseFrontmatter(content);
+	if (!parsed) return [];
+	const raw = parsed.frontmatter["related_skills"];
+	if (typeof raw !== "string") return [];
+	const names = /* @__PURE__ */ new Set();
+	for (const match of Array.from(raw.matchAll(/[a-z0-9][a-z0-9-]*/g))) {
+		const target = match[0];
+		if (target && SKILL_NAME_RE.test(target) && target !== exclude) names.add(target);
+	}
+	return [...names];
+}
 function validateFrontmatter(content, expectedName, limits = DEFAULT_SKILL_LIMITS) {
 	const parsed = parseFrontmatter(content);
 	if (!parsed) return "SKILL.md must start and end with YAML frontmatter and include a body.";
@@ -1069,65 +1937,274 @@ function validateSupportPath(filePath) {
 	if (parts.length < 2) return "Provide a file name, not just a directory.";
 	return null;
 }
+/**
+* Index of `pattern` inside `content`, treating whitespace runs (spaces/tabs)
+* as flexible and literal escape sequences (`\n`, `\t`, `\r`) as their real
+* characters: a PATTERN whitespace run matches any content run of any length
+* (even empty), while extra whitespace that only exists in the content is not
+* skipped — the flexibility is one-sided on the pattern, and a backslash-
+* escaped char in the pattern matches the real char in the content
+* (model-copy drift). Returns the [start, end) range in the ORIGINAL content
+* so a patch can replace exactly the matched span and keep every other byte
+* intact. Returns null when no fuzzy match exists.
+*/
+function fuzzyIndexOf(content, pattern, from = 0) {
+	const isSpace = (char) => char !== void 0 && /[ \t]/.test(char);
+	const escaped = (char) => {
+		if (char === "n") return "\n";
+		if (char === "t") return "	";
+		if (char === "r") return "\r";
+		return null;
+	};
+	for (let start = from; start < content.length; start += 1) {
+		let contentIndex = start;
+		let patternIndex = 0;
+		while (patternIndex < pattern.length && contentIndex < content.length) {
+			const patternChar = pattern[patternIndex];
+			const contentChar = content[contentIndex];
+			if (isSpace(patternChar)) {
+				while (patternIndex < pattern.length && isSpace(pattern[patternIndex])) patternIndex += 1;
+				while (contentIndex < content.length && isSpace(content[contentIndex])) contentIndex += 1;
+				continue;
+			}
+			const escapedChar = patternChar === "\\" ? escaped(pattern[patternIndex + 1]) : null;
+			if (escapedChar !== null && contentChar === escapedChar) {
+				patternIndex += 2;
+				contentIndex += 1;
+				continue;
+			}
+			if (patternChar === contentChar) {
+				contentIndex += 1;
+				patternIndex += 1;
+				continue;
+			}
+			break;
+		}
+		if (patternIndex === pattern.length) return [start, contentIndex];
+	}
+	return null;
+}
+/** Trim leading whitespace of the first line and trailing whitespace of the last line. */
+function trimPatternBoundaries(pattern) {
+	const from = pattern.search(/\S/);
+	const trimmed = from < 0 ? pattern : pattern.slice(from);
+	const trailing = trimmed.search(/\s+$/);
+	return trailing < 0 ? trimmed : trimmed.slice(0, trailing);
+}
+/** Replace only the fuzzy-matched span, preserving all surrounding bytes. */
+function fuzzyReplace(content, oldString, newString, replaceAll) {
+	let current = content;
+	let scanFrom = 0;
+	for (;;) {
+		const match = fuzzyIndexOf(current, oldString, scanFrom);
+		if (match === null) return current;
+		const [start, end] = match;
+		const next = current.slice(0, start) + newString + current.slice(end);
+		if (!replaceAll) return next;
+		current = next;
+		scanFrom = start + newString.length;
+	}
+}
 function fuzzyPatch(content, oldString, newString, replaceAll = false) {
+	if (oldString === "") return null;
 	if (content.includes(oldString)) return replaceAll ? content.split(oldString).join(newString) : content.replace(oldString, newString);
-	const trimmed = content.replaceAll(/[ 	]+$/gm, "");
-	if (trimmed.includes(oldString)) return trimmed.replace(oldString, newString);
-	const whitespace = content.replaceAll(/[ 	]+/g, " ");
-	if (whitespace.includes(oldString)) return whitespace.replace(oldString, newString);
+	const boundary = trimPatternBoundaries(oldString);
+	if (boundary === "") return null;
+	if (boundary !== oldString) {
+		if (fuzzyIndexOf(content, boundary) !== null) {
+			const patched = fuzzyReplace(content, boundary, newString, replaceAll);
+			return patched === content ? null : patched;
+		}
+	}
+	if (fuzzyIndexOf(content, oldString) !== null) {
+		const patched = fuzzyReplace(content, oldString, newString, replaceAll);
+		return patched === content ? null : patched;
+	}
 	return null;
 }
 var SkillLibrary = class {
 	root;
 	limits;
 	io;
-	constructor(root = skillsRoot(), io = nodeEvolutionIo(), limits = DEFAULT_SKILL_LIMITS) {
+	onMutation;
+	constructor(root = skillsRoot(), io = nodeEvolutionIo(), limits = DEFAULT_SKILL_LIMITS, onMutation) {
 		this.root = root;
 		this.io = io;
 		this.limits = limits;
+		this.onMutation = onMutation;
+	}
+	/** Notify the mutation observer after a successful write; observers must never fail the mutation. */
+	notifyMutation(event) {
+		try {
+			this.onMutation?.(event);
+		} catch {}
 	}
 	async list() {
 		const summaries = [];
 		for (const name of await listNames(this.root, this.io)) {
-			const dir = skillDir(this.root, name);
+			const dir = this.dirOf(name);
 			const md = await this.io.readText(join(dir, "SKILL.md"));
 			if (!md) continue;
 			const parsed = parseFrontmatter(md);
-			const protectedBy = await this.deleteProtection(name);
-			const managed = await this.io.exists(markerPath(dir, "hermes-managed"));
+			let entries = [];
+			try {
+				entries = await this.io.list(dir);
+			} catch {}
+			const has = (marker) => entries.includes(marker);
+			const protectedBy = has("bundled") ? "bundled" : has("hub-installed") ? "hub-installed" : has("pinned") ? "pinned" : null;
 			summaries.push({
 				name,
 				description: parsed?.frontmatter.description ?? "",
 				path: dir,
 				protectedBy,
-				managed,
+				managed: has("hermes-managed"),
 				archived: false
 			});
 		}
 		return summaries;
 	}
-	async read(name) {
-		return this.io.readText(join(skillDir(this.root, name), "SKILL.md"));
+	async read(rawName) {
+		const name = rawName.trim();
+		if (this.badName(name) !== null) return null;
+		return this.io.readText(join(this.dirOf(name), "SKILL.md"));
+	}
+	/**
+	
+	* Single path-building choke point (rc.42 audit P2-5): every directory path
+	
+	* is built from the TRIMMED name, so a name that passes `badName` (which
+	
+	* trims before validating) can never mint a second, whitespace-padded
+	
+	* directory next to the real one. Callers keep passing raw user input.
+	
+	*/
+	dirOf(name) {
+		return skillDir(this.root, name.trim());
+	}
+	/** Name-format guard shared by every path-building mutator/reader. */
+	badName(name) {
+		const normalized = name.trim();
+		if (!SKILL_NAME_RE.test(normalized) || normalized.length > this.limits.maxNameLength) return `Invalid skill name "${normalized}". Use lowercase letters, digits, and hyphens (<= ${this.limits.maxNameLength}).`;
+		return null;
 	}
-	async writeProtection(name) {
-		const dir = skillDir(this.root, name);
+	async writeProtection(rawName, origin = "foreground") {
+		const name = rawName.trim();
+		const dir = this.dirOf(name);
 		for (const marker of ["bundled", "hub-installed"]) if (await this.io.exists(markerPath(dir, marker))) return marker;
+		if (origin === "background_review" && await this.io.exists(markerPath(dir, "pinned"))) return "pinned";
 		return null;
 	}
-	async deleteProtection(name) {
-		const dir = skillDir(this.root, name);
-		for (const marker of [
+	async deleteProtection(rawName, options = {}) {
+		const name = rawName.trim();
+		const dir = this.dirOf(name);
+		const markers = options.allowBundled ? ["hub-installed", "pinned"] : [
 			"bundled",
 			"hub-installed",
 			"pinned"
-		]) if (await this.io.exists(markerPath(dir, marker))) return marker;
+		];
+		for (const marker of markers) if (await this.io.exists(markerPath(dir, marker))) return marker;
 		return null;
 	}
-	async isManaged(name) {
-		const dir = skillDir(this.root, name);
+	async isManaged(rawName) {
+		const name = rawName.trim();
+		const dir = this.dirOf(name);
 		return await this.io.exists(markerPath(dir, "hermes-managed"));
 	}
-	async create(name, content, origin) {
+	/** Whether the skill carries the bundled marker (curator prune-builtins eligibility). */
+	async isBundled(rawName) {
+		const name = rawName.trim();
+		if (this.badName(name) !== null) return false;
+		const dir = this.dirOf(name);
+		return await this.io.exists(markerPath(dir, "bundled"));
+	}
+	/** Whether the skill carries the pinned marker (the marker is the factual source; usage.pinned mirrors it). */
+	async isPinned(rawName) {
+		const name = rawName.trim();
+		if (this.badName(name) !== null) return false;
+		const dir = this.dirOf(name);
+		return await this.io.exists(markerPath(dir, "pinned"));
+	}
+	/** Count non-empty support subdirectories (richness input for quality scoring). */
+	async countSupportDirs(rawName) {
+		const name = rawName.trim();
+		if (this.badName(name) !== null) return 0;
+		const dir = this.dirOf(name);
+		let entries;
+		try {
+			entries = await this.io.list(dir);
+		} catch {
+			return 0;
+		}
+		let count = 0;
+		for (const subdir of SUPPORT_DIRS) {
+			if (!entries.includes(subdir)) continue;
+			try {
+				if ((await this.io.list(join(dir, subdir))).some((file) => file !== ".gitkeep")) count += 1;
+			} catch {}
+		}
+		return count;
+	}
+	/** Best-effort audit trail entry; never blocks the mutation. */
+	async audit(skillName, action, before, after, summary) {
+		try {
+			await recordMutation(this.root, this.io, {
+				skillName,
+				action,
+				...before === null ? {} : { beforeHash: contentHash(before) },
+				...after === null ? {} : { afterHash: contentHash(after) },
+				summary,
+				at: (/* @__PURE__ */ new Date()).toISOString()
+			});
+		} catch {}
+	}
+	/** Recent mutation audit records (read-only inspection surface). */
+	async listMutations() {
+		return await loadMutations(this.root, this.io);
+	}
+	/**
+	* Pin or unpin a skill (`.pinned` marker). Pinned skills are protected from
+	* deletion, from background-review writes, and from the lifecycle — a
+	* protective mutation, so the autonomous pipeline may never call it. The
+	* marker write is the only state change; content is untouched.
+	*/
+	async setPinned(name, pinned, origin = "foreground") {
+		const normalized = name.trim();
+		if (!SKILL_NAME_RE.test(normalized) || normalized.length > this.limits.maxNameLength) return {
+			ok: false,
+			message: `Invalid skill name "${normalized}". Use lowercase letters, digits, and hyphens (<= ${this.limits.maxNameLength}).`
+		};
+		if (origin === "background_review") return {
+			ok: false,
+			message: "Only the foreground (user or the main agent) may pin or unpin skills."
+		};
+		const dir = this.dirOf(normalized);
+		const marker = markerPath(dir, "pinned");
+		const existing = await this.io.exists(marker);
+		if (pinned && existing) return {
+			ok: true,
+			message: `Skill "${normalized}" is already pinned.`,
+			path: dir
+		};
+		if (!pinned && !existing) return {
+			ok: true,
+			message: `Skill "${normalized}" is not pinned; nothing to do.`,
+			path: dir
+		};
+		if (!await this.io.exists(join(dir, "SKILL.md"))) return {
+			ok: false,
+			message: `Skill "${normalized}" not found.`
+		};
+		if (pinned) await this.io.writeText(marker, "");
+		else await this.io.remove(marker);
+		await this.audit(normalized, pinned ? "pin" : "unpin", null, null, pinned ? "pinned" : "unpinned");
+		return {
+			ok: true,
+			message: pinned ? `Skill "${normalized}" pinned: protected from deletion, background review, and the lifecycle.` : `Skill "${normalized}" unpinned.`,
+			path: dir
+		};
+	}
+	async create(name, content, origin = "foreground") {
 		const normalized = name.trim();
 		if (!SKILL_NAME_RE.test(normalized) || normalized.length > this.limits.maxNameLength) return {
 			ok: false,
@@ -1143,26 +2220,39 @@ var SkillLibrary = class {
 			ok: false,
 			message: threat
 		};
-		const dir = skillDir(this.root, normalized);
+		const dir = this.dirOf(normalized);
 		if (await this.io.exists(join(dir, "SKILL.md"))) return {
 			ok: false,
 			message: `Skill "${normalized}" already exists.`
 		};
 		await this.io.writeText(join(dir, "SKILL.md"), content.trimEnd() + "\n");
-		if (origin === "background_review") await this.io.writeText(markerPath(dir, "hermes-managed"), "");
+		if (origin !== "foreground") await this.io.writeText(markerPath(dir, "hermes-managed"), "");
+		await this.audit(normalized, "create", null, content, "created");
+		this.notifyMutation({
+			action: "create",
+			name: normalized,
+			filePath: dir
+		});
 		return {
 			ok: true,
 			message: `Skill "${normalized}" created.`,
 			path: dir
 		};
 	}
-	async update(name, content) {
-		const dir = skillDir(this.root, name);
-		if (!await this.io.readText(join(dir, "SKILL.md"))) return {
+	async update(rawName, content, origin = "foreground") {
+		const name = rawName.trim();
+		const badName = this.badName(name);
+		if (badName) return {
+			ok: false,
+			message: badName
+		};
+		const dir = this.dirOf(name);
+		const md = await this.io.readText(join(dir, "SKILL.md"));
+		if (!md) return {
 			ok: false,
 			message: `Skill "${name}" not found.`
 		};
-		const protection = await this.writeProtection(name);
+		const protection = await this.writeProtection(name, origin);
 		if (protection) return {
 			ok: false,
 			message: `Skill "${name}" is protected (${protection}).`
@@ -1178,20 +2268,32 @@ var SkillLibrary = class {
 			message: threat
 		};
 		await this.io.writeText(join(dir, "SKILL.md"), content.trimEnd() + "\n");
+		await this.audit(name, "update", md, content, "updated");
+		this.notifyMutation({
+			action: "update",
+			name,
+			filePath: dir
+		});
 		return {
 			ok: true,
 			message: `Skill "${name}" updated.`,
 			path: dir
 		};
 	}
-	async patch(name, oldString, newString, filePath = "", replaceAll = false) {
-		const dir = skillDir(this.root, name);
+	async patch(rawName, oldString, newString, filePath = "", replaceAll = false, origin = "foreground") {
+		const name = rawName.trim();
+		const badName = this.badName(name);
+		if (badName) return {
+			ok: false,
+			message: badName
+		};
+		const dir = this.dirOf(name);
 		const skillMd = join(dir, "SKILL.md");
 		if (!await this.io.exists(skillMd)) return {
 			ok: false,
 			message: `Skill "${name}" not found.`
 		};
-		const protection = await this.writeProtection(name);
+		const protection = await this.writeProtection(name, origin);
 		if (protection) return {
 			ok: false,
 			message: `Skill "${name}" is protected (${protection}).`
@@ -1213,7 +2315,7 @@ var SkillLibrary = class {
 			message: `File not found: ${patchLabel}`
 		};
 		const patched = fuzzyPatch(md, oldString, newString, replaceAll);
-		if (!patched) return {
+		if (patched === null) return {
 			ok: false,
 			message: `Could not find old_string in "${name}/${patchLabel}". Use update for a full rewrite.`
 		};
@@ -1238,40 +2340,68 @@ var SkillLibrary = class {
 			message: threat
 		};
 		await this.io.writeText(target, patched.trimEnd() + "\n");
+		await this.audit(name, "patch", md, patched, `patched ${patchLabel}`);
+		this.notifyMutation({
+			action: "patch",
+			name,
+			filePath: dir
+		});
 		return {
 			ok: true,
 			message: `Skill "${name}" patched (${patchLabel}).`,
 			path: dir
 		};
 	}
-	async archive(name, absorbedInto = "") {
-		const dir = skillDir(this.root, name);
-		if (!await this.io.readText(join(dir, "SKILL.md"))) return {
+	async archive(rawName, options = {}) {
+		const name = rawName.trim();
+		const badName = this.badName(name);
+		if (badName) return {
+			ok: false,
+			message: badName
+		};
+		const dir = this.dirOf(name);
+		const md = await this.io.readText(join(dir, "SKILL.md"));
+		if (!md) return {
 			ok: false,
 			message: `Skill "${name}" not found.`
 		};
-		const protection = await this.deleteProtection(name);
+		const protection = await this.deleteProtection(name, options.allowBundled === void 0 ? {} : { allowBundled: options.allowBundled });
 		if (protection) return {
 			ok: false,
 			message: `Skill "${name}" is protected (${protection}).`
 		};
-		if (absorbedInto) {
-			if (!await this.io.readText(join(skillDir(this.root, absorbedInto), "SKILL.md"))) return {
+		if (options.absorbedInto) {
+			if (!await this.io.readText(join(this.dirOf(options.absorbedInto), "SKILL.md"))) return {
 				ok: false,
-				message: `absorbed_into="${absorbedInto}" does not exist.`
+				message: `absorbed_into="${options.absorbedInto}" does not exist.`
 			};
 		}
 		const archiveRoot = join(this.root, ".archive");
-		let dest = join(archiveRoot, name);
-		if (await this.io.exists(dest)) dest = join(archiveRoot, `${name}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[-:T]/g, "").slice(0, 14)}`);
+		let dest = join(archiveRoot, name.trim());
+		if (await this.io.exists(dest)) {
+			const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:T]/g, "").slice(0, 14);
+			dest = join(archiveRoot, `${name.trim()}-${stamp}`);
+		}
+		if (this.io.isSymlink) {
+			if (await this.io.isSymlink(dir) === true) return {
+				ok: false,
+				message: `Skill "${name}" is a symlink; refusing to archive it.`
+			};
+		}
 		try {
 			await this.io.rename(dir, dest);
 		} catch {
 			await this.io.copy(dir, dest);
 			await this.io.remove(dir);
 		}
-		const reason = absorbedInto ? `Consolidated into ${absorbedInto}` : "Archived by self-evolution curator";
+		const reason = options.reason ?? (options.absorbedInto ? `Consolidated into ${options.absorbedInto}` : "Archived by self-evolution curator");
 		await this.io.writeText(join(dest, ".archive-reason"), `${(/* @__PURE__ */ new Date()).toISOString()}: ${reason}\n`);
+		await this.audit(name, "archive", md, null, reason);
+		this.notifyMutation({
+			action: "archive",
+			name,
+			archivedPath: dest
+		});
 		return {
 			ok: true,
 			message: `Skill "${name}" archived to .archive.`,
@@ -1283,26 +2413,27 @@ var SkillLibrary = class {
 	* an absorbed-into marker. Hermes-style consolidation: overlapping skills
 	* collapse into one, and the originals stay recoverable under `.archive/`.
 	*/
-	async consolidate(target, sources) {
-		const normalizedSources = [...new Set(sources)].filter((name) => name !== target);
+	async consolidate(target, sources, origin = "foreground") {
+		const targetName = target.trim();
+		const normalizedSources = [...new Set(sources.map((name) => name.trim()))].filter((name) => name !== targetName);
 		if (normalizedSources.length === 0) return {
 			ok: false,
 			message: "Consolidation requires at least one distinct source skill."
 		};
-		for (const name of [target, ...normalizedSources]) if (!SKILL_NAME_RE.test(name)) return {
+		for (const name of [targetName, ...normalizedSources]) if (!SKILL_NAME_RE.test(name)) return {
 			ok: false,
 			message: `Invalid skill name "${name}". Use lowercase letters, digits, and hyphens.`
 		};
-		const targetDir = skillDir(this.root, target);
+		const targetDir = this.dirOf(targetName);
 		const targetMd = await this.io.readText(join(targetDir, "SKILL.md"));
 		if (!targetMd) return {
 			ok: false,
-			message: `Skill "${target}" not found.`
+			message: `Skill "${targetName}" not found.`
 		};
-		const targetProtection = await this.writeProtection(target);
+		const targetProtection = await this.writeProtection(targetName, origin);
 		if (targetProtection) return {
 			ok: false,
-			message: `Skill "${target}" is protected (${targetProtection}).`
+			message: `Skill "${targetName}" is protected (${targetProtection}).`
 		};
 		const parts = [];
 		for (const source of normalizedSources) {
@@ -1311,7 +2442,7 @@ var SkillLibrary = class {
 				ok: false,
 				message: `Skill "${source}" is protected (${protection}).`
 			};
-			const sourceMd = await this.io.readText(join(skillDir(this.root, source), "SKILL.md"));
+			const sourceMd = await this.io.readText(join(this.dirOf(source), "SKILL.md"));
 			if (!sourceMd) return {
 				ok: false,
 				message: `Skill "${source}" not found.`
@@ -1324,7 +2455,7 @@ var SkillLibrary = class {
 			parts.push(`\n<!-- consolidated from ${source} at ${(/* @__PURE__ */ new Date()).toISOString()} -->\n${parsed.body.trim()}`);
 		}
 		const merged = targetMd.trimEnd() + parts.join("\n") + "\n";
-		const validation = validateFrontmatter(merged, target, this.limits);
+		const validation = validateFrontmatter(merged, targetName, this.limits);
 		if (validation) return {
 			ok: false,
 			message: `Consolidation rejected: ${validation}`
@@ -1334,14 +2465,30 @@ var SkillLibrary = class {
 			ok: false,
 			message: threat
 		};
-		await this.io.writeText(join(targetDir, "SKILL.md"), merged);
-		for (const source of normalizedSources) {
-			const archived = await this.archive(source, target);
-			if (!archived.ok) return archived;
+		const archived = [];
+		try {
+			for (const source of normalizedSources) {
+				const result = await this.archive(source, { absorbedInto: targetName });
+				if (!result.ok) throw new Error(result.message);
+				archived.push(source);
+			}
+			await this.io.writeText(join(targetDir, "SKILL.md"), merged);
+		} catch (error) {
+			await this.io.writeText(join(targetDir, "SKILL.md"), targetMd).catch(() => {});
+			for (const source of archived.reverse()) await this.restoreFromArchive(source).catch(() => {});
+			return {
+				ok: false,
+				message: `Consolidation failed and was rolled back: ${error instanceof Error ? error.message : String(error)}`
+			};
 		}
+		this.notifyMutation({
+			action: "consolidate",
+			name: targetName,
+			filePath: targetDir
+		});
 		return {
 			ok: true,
-			message: `Consolidated ${normalizedSources.join(", ")} into "${target}".`,
+			message: `Consolidated ${normalizedSources.join(", ")} into "${targetName}".`,
 			path: targetDir
 		};
 	}
@@ -1350,12 +2497,13 @@ var SkillLibrary = class {
 	* recoverability: archival never deletes, and this is the control-plane
 	* path back. The `.archive-reason` marker is dropped on restore.
 	*/
-	async restoreFromArchive(name) {
+	async restoreFromArchive(rawName) {
+		const name = rawName.trim();
 		if (!SKILL_NAME_RE.test(name)) return {
 			ok: false,
 			message: `Invalid skill name "${name}". Use lowercase letters, digits, and hyphens.`
 		};
-		if (await this.io.exists(join(skillDir(this.root, name), "SKILL.md"))) return {
+		if (await this.io.exists(join(this.dirOf(name), "SKILL.md"))) return {
 			ok: false,
 			message: `Skill "${name}" already exists in the active root; refusing to overwrite.`
 		};
@@ -1375,7 +2523,13 @@ var SkillLibrary = class {
 			message: `Skill "${name}" is not in .archive.`
 		};
 		const source = join(archiveRoot, chosen);
-		const dest = skillDir(this.root, name);
+		const dest = this.dirOf(name);
+		if (this.io.isSymlink) {
+			if (await this.io.isSymlink(source) === true) return {
+				ok: false,
+				message: `Archived entry "${chosen}" is a symlink; refusing to restore it.`
+			};
+		}
 		try {
 			await this.io.rename(source, dest);
 		} catch {
@@ -1383,19 +2537,30 @@ var SkillLibrary = class {
 			await this.io.remove(source);
 		}
 		if (await this.io.exists(join(dest, ".archive-reason"))) await this.io.remove(join(dest, ".archive-reason"));
+		this.notifyMutation({
+			action: "restore",
+			name,
+			filePath: dest
+		});
 		return {
 			ok: true,
 			message: `Skill "${name}" restored from .archive.`,
 			path: dest
 		};
 	}
-	async writeSupportFile(name, filePath, content) {
-		const dir = skillDir(this.root, name);
+	async writeSupportFile(rawName, filePath, content, origin = "foreground") {
+		const name = rawName.trim();
+		const badName = this.badName(name);
+		if (badName) return {
+			ok: false,
+			message: badName
+		};
+		const dir = this.dirOf(name);
 		if (!await this.io.exists(join(dir, "SKILL.md"))) return {
 			ok: false,
 			message: `Skill "${name}" not found.`
 		};
-		const protection = await this.writeProtection(name);
+		const protection = await this.writeProtection(name, origin);
 		if (protection) return {
 			ok: false,
 			message: `Skill "${name}" is protected (${protection}).`
@@ -1415,20 +2580,33 @@ var SkillLibrary = class {
 			message: threat
 		};
 		const target = join(dir, ...filePath.replace(/\\/g, "/").split("/").filter(Boolean));
+		const existing = await this.io.readText(target).catch(() => null);
 		await this.io.writeText(target, content);
+		await this.audit(name, "write_file", existing, content, `wrote ${filePath}`);
+		this.notifyMutation({
+			action: "write_file",
+			name,
+			filePath: target
+		});
 		return {
 			ok: true,
 			message: `Support file "${filePath}" written to "${name}".`,
 			path: target
 		};
 	}
-	async removeSupportFile(name, filePath) {
-		const dir = skillDir(this.root, name);
+	async removeSupportFile(rawName, filePath, origin = "foreground") {
+		const name = rawName.trim();
+		const badName = this.badName(name);
+		if (badName) return {
+			ok: false,
+			message: badName
+		};
+		const dir = this.dirOf(name);
 		if (!await this.io.exists(join(dir, "SKILL.md"))) return {
 			ok: false,
 			message: `Skill "${name}" not found.`
 		};
-		const protection = await this.writeProtection(name);
+		const protection = await this.writeProtection(name, origin);
 		if (protection) return {
 			ok: false,
 			message: `Skill "${name}" is protected (${protection}).`
@@ -1443,24 +2621,88 @@ var SkillLibrary = class {
 			ok: false,
 			message: `File "${filePath}" not found in skill "${name}".`
 		};
+		const before = await this.io.readText(target).catch(() => null);
 		await this.io.remove(target);
+		await this.audit(name, "remove_file", before, null, `removed ${filePath}`);
+		this.notifyMutation({
+			action: "remove_file",
+			name,
+			filePath: target
+		});
 		return {
 			ok: true,
 			message: `Support file "${filePath}" removed from "${name}".`,
 			path: target
 		};
 	}
-	async snapshotAll(reason = "pre-mutation") {
-		const dest = join(join(this.root, ".backups"), `skills-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`);
+	/**
+	* Snapshot the recoverable skills state: active tree, usage/suppression
+	* sidecars, `.archive/` and caller-supplied extras. `extras` are opaque
+	* side files the Snapshot owner cares about (curator state); they are
+	* listed in the manifest and only those names are ever read back.
+	*/
+	async snapshotAll(reason = "pre-mutation", extras = []) {
+		const backupRoot = join(this.root, ".backups");
+		const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+		let dest = join(backupRoot, `skills-${stamp}`);
+		while (await this.io.exists(dest)) dest = join(backupRoot, `skills-${stamp}-${Math.random().toString(36).slice(2, 8)}`);
 		const names = await listNames(this.root, this.io);
-		for (const name of names) await this.io.copy(skillDir(this.root, name), join(dest, name));
+		await Promise.all(names.map(async (name) => {
+			await this.io.copy(this.dirOf(name), join(dest, name));
+		}));
+		const sidecars = [];
+		for (const sidecar of [usageFile(this.root), suppressedFile(this.root)]) if (await this.io.exists(sidecar)) {
+			const name = basename(sidecar);
+			await this.io.copy(sidecar, join(dest, name));
+			sidecars.push(name);
+		}
+		const archiveRoot = join(this.root, ".archive");
+		let hasArchive = false;
+		if (await this.io.exists(archiveRoot)) {
+			await this.io.copy(archiveRoot, join(dest, ".archive"));
+			hasArchive = true;
+		}
+		const validExtras = extras.filter((extra) => SNAPSHOT_EXTRA_NAME_RE.test(extra.name));
+		const extraNames = validExtras.map((extra) => extra.name);
+		await Promise.all(validExtras.map(async (extra) => {
+			await this.io.writeText(join(dest, "extras", extra.name), extra.content);
+		}));
 		await this.io.writeText(join(dest, "manifest.json"), JSON.stringify({
 			reason,
 			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-			skills: names
+			skills: names,
+			sidecars,
+			hasArchive,
+			extras: extraNames
 		}, null, 2));
+		await this.retainSnapshots(5);
 		return dest;
 	}
+	/** Read and normalize a snapshot manifest; null when the file is missing or unparsable. */
+	async readSnapshotManifest(path) {
+		const raw = await this.io.readText(join(path, "manifest.json"));
+		if (raw === null) return null;
+		try {
+			const manifest = JSON.parse(raw);
+			return {
+				reason: typeof manifest.reason === "string" ? manifest.reason : "",
+				createdAt: typeof manifest.createdAt === "string" ? manifest.createdAt : "",
+				skills: Array.isArray(manifest.skills) ? manifest.skills : [],
+				sidecars: Array.isArray(manifest.sidecars) ? manifest.sidecars : [],
+				...typeof manifest.hasArchive === "boolean" ? { hasArchive: manifest.hasArchive } : {},
+				extras: Array.isArray(manifest.extras) ? manifest.extras : []
+			};
+		} catch {
+			return null;
+		}
+	}
+	/** Keep only the newest N snapshots (Hermes keep=5 parity); oldest folded into .backups history. */
+	async retainSnapshots(keep) {
+		const snapshots = await this.listSnapshots();
+		for (const snapshot of snapshots.slice(keep)) try {
+			await this.io.remove(snapshot.path);
+		} catch {}
+	}
 	async listSnapshots() {
 		const backupRoot = join(this.root, ".backups");
 		let entries;
@@ -1472,36 +2714,82 @@ var SkillLibrary = class {
 		const out = [];
 		for (const name of entries.sort().reverse()) {
 			if (!name.startsWith("skills-")) continue;
-			try {
-				const raw = await this.io.readText(join(backupRoot, name, "manifest.json"));
-				if (raw === null) continue;
-				const manifest = JSON.parse(raw);
-				out.push({
-					path: join(backupRoot, name),
-					createdAt: manifest.createdAt ?? "",
-					reason: manifest.reason ?? ""
-				});
-			} catch {}
+			const manifest = await this.readSnapshotManifest(join(backupRoot, name));
+			if (manifest === null) continue;
+			out.push({
+				path: join(backupRoot, name),
+				createdAt: manifest.createdAt,
+				reason: manifest.reason
+			});
 		}
 		return out;
 	}
-	async restoreLatestSnapshot() {
+	/**
+	* Read the extras of a snapshot, restricted to the names declared in the
+	* manifest — an `extras/` directory is never listed directly, so unknown
+	* files cannot leak back as state on the next restore.
+	*/
+	async readSnapshotExtras(path) {
+		const manifest = await this.readSnapshotManifest(path);
+		if (manifest === null) return [];
+		const extras = [];
+		for (const name of manifest.extras) {
+			if (!SNAPSHOT_EXTRA_NAME_RE.test(name)) continue;
+			const content = await this.io.readText(join(path, "extras", name));
+			if (content !== null) extras.push({
+				name,
+				content
+			});
+		}
+		return extras;
+	}
+	/**
+	* Manifest-driven restore of the latest snapshot: active tree, sidecars,
+	* `.archive/` and (for full-state snapshots) the extras read back by the
+	* caller. `extras` are additionally written into the pre-rollback safety
+	* snapshot so the rollback itself is undoable with the same state.
+	*/
+	async restoreLatestSnapshot(extras = []) {
 		const latest = (await this.listSnapshots())[0];
 		if (!latest) return {
 			ok: false,
 			message: "No skill snapshot available."
 		};
-		await this.snapshotAll("pre-rollback");
-		for (const name of await listNames(this.root, this.io)) await this.io.remove(skillDir(this.root, name));
-		const entries = await this.io.list(latest.path);
-		for (const entry of entries) {
-			if (entry === "manifest.json") continue;
+		await this.snapshotAll("pre-rollback", extras);
+		let rootEntries;
+		try {
+			rootEntries = await this.io.list(this.root);
+		} catch {
+			rootEntries = [];
+		}
+		for (const entry of rootEntries) {
+			if (entry.startsWith(".")) continue;
+			await this.io.remove(join(this.root, entry));
+		}
+		const manifest = await this.readSnapshotManifest(latest.path);
+		if (manifest === null) for (const entry of await this.io.list(latest.path)) {
+			if (entry === "manifest.json" || entry === "extras") continue;
 			await this.io.copy(join(latest.path, entry), join(this.root, entry));
 		}
+		else {
+			for (const name of manifest.skills) await this.io.copy(join(latest.path, name), join(this.root, name));
+			for (const sidecar of manifest.sidecars) await this.io.copy(join(latest.path, sidecar), join(this.root, sidecar));
+			const archiveRoot = join(this.root, ".archive");
+			if (manifest.hasArchive === true) {
+				await this.io.remove(archiveRoot);
+				await this.io.copy(join(latest.path, ".archive"), archiveRoot);
+			} else if (manifest.hasArchive === false) await this.io.remove(archiveRoot);
+		}
+		const snapshotExtras = await this.readSnapshotExtras(latest.path);
+		this.notifyMutation({
+			action: "restore",
+			name: "snapshot"
+		});
 		return {
 			ok: true,
 			message: `Restored skill tree from ${latest.path}`,
-			path: latest.path
+			path: latest.path,
+			...snapshotExtras.length === 0 ? {} : { extras: snapshotExtras }
 		};
 	}
 };
@@ -1514,7 +2802,7 @@ var SkillLibrary = class {
 function evolutionHome(env = process.env) {
 	return join(env.DSH_HOME ?? join(homedir(), ".dsh"), "evolution");
 }
-var JsonState = class {
+var JsonState = class JsonState {
 	initial;
 	path;
 	value;
@@ -1523,14 +2811,24 @@ var JsonState = class {
 		this.path = join(evolutionHome(env), name);
 		this.value = this.loadSync();
 	}
+	/**
+	* Deep-merge persisted state over the initial defaults. Nested plain
+	* objects merge recursively (so a new default field added under an existing
+	* object is preserved), while arrays and primitives take the on-disk value
+	* wholesale. Keeps forward-compatible defaults across schema additions.
+	*/
+	static mergeDeep(initial, persisted) {
+		const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+		if (!isRecord(initial) || !isRecord(persisted)) return isRecord(persisted) ? persisted : persisted == null ? initial : persisted;
+		const out = { ...initial };
+		for (const [key, value] of Object.entries(persisted)) out[key] = key in initial ? JsonState.mergeDeep(initial[key], value) : value;
+		return out;
+	}
 	loadSync() {
 		try {
 			const raw = readFileSync(this.path, "utf8");
 			const parsed = JSON.parse(raw);
-			return {
-				...this.initial,
-				...parsed
-			};
+			return JsonState.mergeDeep(this.initial, parsed);
 		} catch {
 			return { ...this.initial };
 		}
@@ -1554,14 +2852,11 @@ var JsonState = class {
 	async reload() {
 		try {
 			const raw = await readFile(this.path, "utf8");
-			this.value = {
-				...this.initial,
-				...JSON.parse(raw)
-			};
+			this.value = JsonState.mergeDeep(this.initial, JSON.parse(raw));
 		} catch {
 			this.value = { ...this.initial };
 		}
 	}
 };
 //#endregion
-export { COMBINED_REVIEW_PROMPT, CURATOR_PROMPT, DEFAULT_SKILL_LIMITS, DSH_AUTHORING_STANDARDS, ENTRY_DELIMITER, JsonState, MAX_DESCRIPTION_LENGTH, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MEMORY_REVIEW_PROMPT, MemoryStore, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROTECTED_BUILTIN_SKILLS, SKILL_NAME_RE, SKILL_REVIEW_PROMPT, SUPPORT_DIRS, SkillLibrary, advanceReview, buildCuratorRunReport, bumpPatch, bumpUse, bumpView, childPath, computeLifecycleTransitions, emptyRecord, evaluateThreat, evolutionHome, evolutionIoAdapter, foldTurn, getRecord, latestActivityAt, loadUsage, markAgentCreated, memoryRoot, nodeEvolutionIo, observeEvent, parseFrontmatter, reviewPrompt, saveUsage, scanContentThreats, scanMemoryThreats, scanThreats, skillsRoot, usageFile, validateFrontmatter, verifyPromptBundle };
+export { COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_USER_CHAR_LIMIT, DSH_AUTHORING_STANDARDS, ENTRY_DELIMITER, EvolutionGateSet, JsonState, LOW_QUALITY_THRESHOLD, MAX_DESCRIPTION_LENGTH, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MEMORY_REVIEW_PROMPT, MUTATIONS_FILE_VERSION, MemoryStore, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, QUALITY_WEIGHTS, SKILL_NAME_RE, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, SUPPORT_DIRS, SUPPRESSED_FILE_VERSION, SkillLibrary, advanceReview, buildCuratorRunReport, buildLearnPrompt, bumpPatch, bumpUse, bumpView, computeDedupGroups, computeLifecycleTransitions, computeQualityScores, computeScopeView, contentHash, createGateSet, emptyRecord, evaluateThreat, evolutionHome, evolutionIoAdapter, foldTurn, getRecord, latestActivityAt, lifecycleCandidate, loadMutations, loadSuppressedNames, loadUsage, markAgentCreated, memoryRoot, mutateUsage, mutationsFile, nodeEvolutionIo, normalizeUsageRecord, observeEvent, parseCuratorNominations, parseFrontmatter, recordMutation, relatedSkillNames, renderCuratorReportMarkdown, resolveOrigins, reviewPrompt, saveSuppressedNames, saveUsage, scanContentThreats, scanMemoryThreats, scanThreats, skillsRoot, suppressedFile, transactIo, updateSuppressedNames, usageFile, validateFrontmatter, verifyPromptBundle };