@lmzhen/dsh-evolution-core 0.26.15 → 0.27.0

package/lib/index.js

@@ -1,10 +1,15 @@
-import { parse } from "yaml";
+import { _ as scopedPackageName, c as MAINTAINER_PRESET_ID, d as RESTRICTED_TOOLS_ROW_ID, f as RESTRICTOR_MODULE, g as scopeOfNearestManifest, p as REVIEWER_PRESET_ID, s as EVOLUTION_PRESET_IDS, u as RESTRICTED_PRESET_DISPLAY } from "./ensure-MEYMj9jn.js";
+import { a as methodNotAllowed, c as asRecord, i as json, l as isRecord, n as MAX_REQUEST_BODY_BYTES, o as readJsonObject, r as hostSurface, s as registerHostRoutes, t as HOST_ROUTES } from "./http-routes-BP-S3KV-.js";
+import { w as allowRowCollisions } from "./composition-D8Y3-ROd.js";
+import { n as errorText, t as EVOLUTION_ERRORS } from "./errors-Br2-uUSK.js";
+import { createSubagentChannel, probeChannelState, subagentChannelState } from "./subagent/index.js";
+import { copyFileSync, existsSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
-import { copyFileSync, existsSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { parse } from "yaml";
 import { cp, lstat, mkdir, open, readFile, readdir, rename, rm, stat } from "node:fs/promises";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { homedir } from "node:os";
-import { fileURLToPath } from "node:url";
 import { scopeOf } from "@deepseek-ai/dsh-scope";
 import { z } from "zod";
 //#region lib/types/citations.js
@@ -204,6 +209,313 @@ function scanBodyHooks(content) {
 	};
 }
 //#endregion
+//#region lib/types/tree-write.js
+/**
+* G1/1.5 (S7-09): the TYPED critical section around a tree write.
+*
+* The control-plane lock used to wrap a whole pass, LLM call and all: an operator undo/restore waited up to
+* one `curatorReviewTimeoutMs` (~120s) for a review that was merely thinking. The fix is to give the critical
+* section a shape that a review cannot be squeezed into.
+*
+* WHAT THIS TYPE CAN AND CANNOT DO (the plan wording says "cannot be put inside the lock by TYPE" - that is
+* only half true and the half that is false is the half people rely on): a callback is a CLOSURE, so even
+* with `view` as its only parameter it can still reach `this.io` / `this.ctx` / `this.llm` from the enclosing
+* scope. TypeScript cannot stop that, and a criterion claiming it would never go red.
+*
+* What the type DOES give: new code has no other entry - the callback is handed a `SnapshotView` and nothing
+* else, so a phase that needs `io` or `llm` has to stay OUTSIDE and be passed its result in. What the type
+* CANNOT give is covered by the companion source guard (see the family gates): an `io` / `llm` / `this.`
+* / `ctx.` reference inside a `withTreeWrite` callback is a violation, and that guard is the executable form
+* of "cannot be put inside the lock".
+*
+* @module @lmzhen/dsh-evolution-core/tree-write
+*/
+/**
+* Run one tree-writing section under a caller-owned serial queue, exposing ONLY a {@link SnapshotView}.
+*
+* The queue is passed in rather than owned here: the lock belongs to whoever serializes the control plane
+* (the curator), and a second lock would be a second answer to one question.
+* @param acquire - the caller serial queue (e.g. the curator mutex), returning its release.
+* @param view - what this section sees while it holds the lock.
+* @param fn - the section. It may only use the view.
+* @returns whatever the section returns.
+*/
+async function withTreeWrite(acquire, view, fn) {
+	const release = await acquire();
+	try {
+		return await fn(view);
+	} finally {
+		release();
+	}
+}
+//#endregion
+//#region lib/types/write-authority.js
+/** The mode a deployment that configures nothing gets. */
+const DEFAULT_WRITE_CONFIRM_MODE = "auto";
+/** Seconds a timeout-mode prompt waits before the write is cancelled. */
+const DEFAULT_WRITE_CONFIRM_TIMEOUT_SECONDS = 120;
+/**
+* The batch-one migration aid: every call site becomes ONE of these instead of hand-building the
+* object - so the shape cannot drift between callers, and each site still has to say its own
+* origin out loud (origin is required here on purpose: the whole point is that no caller inherits
+* a default identity).
+*/
+function authorityFrom(input) {
+	return {
+		origin: input.origin,
+		threatExemptLabels: input.threatExemptLabels ?? [],
+		protectedNames: input.protectedNames,
+		readNames: input.readNames,
+		...input.confirm === void 0 ? {} : { confirm: input.confirm },
+		...input.confirmMode === void 0 ? {} : { confirmMode: input.confirmMode },
+		...input.confirmTimeoutSeconds === void 0 ? {} : { confirmTimeoutSeconds: input.confirmTimeoutSeconds },
+		warn: input.warn ?? (() => {})
+	};
+}
+//#endregion
+//#region lib/types/write-gates.js
+/**
+* The write-admission sequence: ONE ordered table of the reasons a skill write is refused.
+*
+* Two points read this table (design `dsh-evolution-write-gate-design.md` §3). The ADMISSION
+* point (`execute`, BEFORE the approval seam) runs every gate that applies to `'admission'`, so a
+* write that is refused is never staged and never spends the operator's attention twice. The
+* EXECUTION point (the `executeCore` funnel, reached by the direct path and by the approval
+* replay) runs the gates that apply to `'execution'`: the stored plan of a replayed write passed
+* no schema, and the protected list can change while a record sits pending, so those verdicts are
+* re-decided at the bytes.
+*
+* Order is part of the contract: a gate that can only refuse comes before one that needs a round
+* trip with the operator, so a write that is refused anyway never asks anything.
+*
+* A gate decides whether a write may be ATTEMPTED. The library decides whether it can be
+* PERFORMED — its own structured refusals (a restructure element that is not an object, a patch
+* anchor that no longer matches, an `absorbed_into` that does not exist) stay where the bytes are
+* read.
+*
+* Rule bodies live in `evolution-core` (the read-before-write rule in `skill-reads`, the
+* required-argument table in `SKILL_ACTION_REQUIRED_FIELDS`); this module owns the ORDER and the
+* applicability of each gate, which is an execution-point fact of this tool.
+* @module @lmzhen/dsh-evolution-core/write-gates
+*/
+/** The confirm question's stable id — one question per write, so an answer to an earlier prompt
+* can never be read as the answer to a later one. */
+const CONFIRM_QUESTION_ID = "evolution-skill-write";
+/** The cancel label every confirm question offers. */
+const CANCEL_LABEL = "取消";
+/** What a `timeout`-mode deadline settles with: comparable by identity against the seam's
+* boolean, so the two outcomes stay distinguishable without a mutable flag (which a linter
+* cannot follow through a timer callback, and a reader cannot either). */
+const CONFIRM_TIMED_OUT = "confirm-timed-out";
+/**
+* How the ONE confirmation behaves (registry `skillWriteConfirm`).
+*
+* `auto` writes without asking — the default, because an unattended run (a background pass, a
+* scheduled review, a headless session) must not park a tool call on a question nobody will answer.
+* `ask` waits for as long as it takes, which is the deployment that wants the gate in the loop.
+* `timeout` asks and cancels the write on its own deadline.
+*/
+/** A usable deadline: the configured value when it is a positive finite number, else the default. */
+function timeoutSecondsOf(configured) {
+	return configured !== void 0 && Number.isFinite(configured) && configured >= 1 ? Math.floor(configured) : 120;
+}
+/** The scalar fields the tool schema types as strings; the replay channel has no schema.
+* `action` is one of them: a non-string action used to fall through to the library as "Unknown
+* action" while the read gate re-defaulted it to `patch` and refused with E-318 (review
+* 2026-09-26, P2), so the shape gate refuses it by name instead. */
+const SCALAR_ARG_FIELDS = [
+	"action",
+	"name",
+	"content",
+	"old_string",
+	"new_string",
+	"file_path",
+	"file_content",
+	"absorbed_into"
+];
+/** The scalar fields the tool schema types as BOOLEANS; the replay channel has no schema either.
+* T2-V3/A28: `args.replace_all === true` answered "false" for anything else, so a staged
+* `replace_all: 'yes'` silently patched only the FIRST occurrence — a wrong count with no signal.
+* The plan channel already refuses a non-boolean `replace_all` by name (S1-C1); this is the same
+* rule on the replay channel, so the two channels cannot disagree about one flag. */
+const FLAG_ARG_FIELDS = ["replace_all"];
+/**
+* Assemble a gate context from a caller's services. The protected list is read HERE, so no caller can
+* forget it or read it from a second place.
+* @param services - the four required services plus the optional registry knobs.
+* @param request - the point asking, the arguments under test, and the write origin.
+* @returns a context the shared sequence accepts.
+*/
+function skillWriteGateContext(services, request) {
+	return {
+		point: request.point,
+		args: request.args,
+		origin: request.origin,
+		protectedNames: protectedSkillNamesOf(services.policy),
+		readNames: services.readNames,
+		confirm: services.confirm,
+		...services.confirmMode === void 0 ? {} : { confirmMode: services.confirmMode },
+		...services.confirmTimeoutSeconds === void 0 ? {} : { confirmTimeoutSeconds: services.confirmTimeoutSeconds },
+		...services.describeTarget === void 0 ? {} : { describeTarget: services.describeTarget },
+		warn: services.warn
+	};
+}
+function protectedSkillNamesOf(policy) {
+	return (policy?.get?.())?.protectedSkillNames;
+}
+/**
+* Narrow the arguments once for every gate.
+*
+* The admission point reaches the gates AFTER the schema, the replay channel BEFORE any
+* validation, so a gate reads only what it can prove: anything else counts as absent, exactly as
+* the missing-argument check already treated a non-string action.
+* @param args - the arguments as the caller sent them.
+* @returns the narrowed view.
+*/
+function gateArgsOf(args) {
+	const scalars = typeof args === "object" && args !== null ? args : {};
+	const action = scalars.action;
+	const name = scalars.name;
+	const absorbedInto = scalars.absorbed_into;
+	return {
+		action: typeof action === "string" ? action : void 0,
+		name: typeof name === "string" ? name : "",
+		absorbedInto: typeof absorbedInto === "string" && absorbedInto.trim() !== "" ? absorbedInto : void 0,
+		scalars
+	};
+}
+/** The sequence, in order. A gate whose `appliesTo` omits the asking point is skipped. */
+const GATES = [
+	{
+		id: "argument-shape",
+		appliesTo: ["admission", "execution"],
+		run: ({ view }) => {
+			for (const field of SCALAR_ARG_FIELDS) {
+				const value = view.scalars[field];
+				if (value === void 0 || value === null || typeof value === "string") continue;
+				return `skill_manage: "${field}" must be a string (got ${typeof value}); refusing the write.`;
+			}
+			for (const field of FLAG_ARG_FIELDS) {
+				const value = view.scalars[field];
+				if (value === void 0 || value === null || typeof value === "boolean") continue;
+				return `skill_manage: "${field}" must be a boolean (got ${typeof value}); refusing the write.`;
+			}
+			return null;
+		}
+	},
+	{
+		id: "missing-args",
+		appliesTo: ["admission", "execution"],
+		run: ({ view }) => {
+			const action = view.action;
+			const missing = (action === void 0 || !Object.hasOwn(SKILL_ACTION_REQUIRED_FIELDS, action) ? [] : SKILL_ACTION_REQUIRED_FIELDS[action] ?? []).filter((field) => view.scalars[field] === void 0 || view.scalars[field] === null);
+			if (missing.length === 0) return null;
+			return `skill_manage ${action} requires ${missing.join(", ")}; the tool description lists the arguments per action.`;
+		}
+	},
+	{
+		id: "policy-protection",
+		appliesTo: ["admission", "execution"],
+		run: ({ view, origin, protectedNames }) => {
+			if (origin === "foreground") return null;
+			if (view.name === "" || !protectedNames?.includes(view.name)) return null;
+			return `skill_manage: "${view.name}" is protected by the current policy (protectedSkillNames); replayed/autonomous writes are refused.`;
+		}
+	},
+	{
+		id: "read-before-write",
+		appliesTo: ["admission"],
+		run: ({ view, origin, readNames, warn }) => {
+			if (origin === "foreground") return null;
+			if (readNames === void 0) {
+				warn("skill_manage: the read-before-write check could not run for this call — the session log is not readable here, so the write is allowed.");
+				return null;
+			}
+			if (view.action === void 0) return null;
+			if (!isUnreadWrite({
+				action: view.action,
+				name: view.name
+			}, readNames)) return null;
+			return errorText("e-318-skill-write-without-a-read", { a1: view.name });
+		}
+	},
+	{
+		id: "human-confirm",
+		appliesTo: ["admission"],
+		run: async ({ view, origin, confirm, warn, confirmMode, confirmTimeoutSeconds, describeTarget }) => {
+			const action = view.action;
+			if (action === void 0 || origin !== "foreground" || view.name === "") return null;
+			if (!(action === "create" || action === "delete" && view.absorbedInto === void 0)) return null;
+			const mode = confirmMode ?? "auto";
+			if (mode === "auto") return null;
+			if (confirm === void 0) {
+				warn("skill_manage: no confirmation channel is mounted, so the write proceeds unconfirmed.");
+				return null;
+			}
+			const confirmLabel = action === "create" ? "创建" : "删除";
+			const seconds = timeoutSecondsOf(confirmTimeoutSeconds);
+			const cancel = new AbortController();
+			let timer;
+			const deadline = mode === "timeout" ? new Promise((resolve) => {
+				timer = setTimeout(() => {
+					cancel.abort();
+					resolve(CONFIRM_TIMED_OUT);
+				}, seconds * 1e3);
+				timer.unref();
+			}) : void 0;
+			const context = await describeTarget?.();
+			const details = [context?.description === void 0 || context.description === "" ? null : "功能：" + context.description, context?.versions === void 0 ? null : "已记录的内容版本数：" + String(context.versions)].filter((line) => line !== null);
+			const consequence = action === "create" ? `创建技能 "${view.name}"？会在家族目录树里新建一个技能目录。` : `删除技能 "${view.name}"？它会被归档到 .archive 并离开目录。`;
+			const asked = confirm({
+				action,
+				name: view.name,
+				confirmLabel,
+				question: {
+					id: CONFIRM_QUESTION_ID,
+					header: "确认",
+					question: details.length === 0 ? consequence : consequence + " " + details.join(" · "),
+					options: [{ label: confirmLabel }, { label: CANCEL_LABEL }]
+				},
+				...mode === "timeout" ? { signal: cancel.signal } : {}
+			});
+			let outcome;
+			try {
+				outcome = deadline === void 0 ? await asked : await Promise.race([asked, deadline]);
+			} finally {
+				if (timer !== void 0) clearTimeout(timer);
+			}
+			if (outcome === true) return null;
+			if (outcome === CONFIRM_TIMED_OUT || cancel.signal.aborted) return errorText("e-319-skill-write-confirm-timed-out", {
+				a1: view.name,
+				a2: action === "create" ? "创建" : "删除",
+				a3: String(seconds)
+			});
+			return errorText("e-317-skill-write-not-confirmed", {
+				a1: view.name,
+				a2: action === "create" ? "创建" : "删除"
+			});
+		}
+	}
+];
+/**
+* Run the sequence for one write attempt.
+* @param context - the asking point, the write, and the seams the human-facing gate needs.
+* @returns the FIRST refusal, or null when every applicable gate passed. Both points return the
+*   message as the tool result unchanged, so the two entries refuse with identical wording.
+*/
+async function runWriteGates(context) {
+	const input = {
+		...context,
+		view: gateArgsOf(context.args)
+	};
+	for (const gate of GATES) {
+		if (!gate.appliesTo.includes(context.point)) continue;
+		const refusal = await gate.run(input);
+		if (refusal !== null) return refusal;
+	}
+	return null;
+}
+//#endregion
 //#region lib/types/reference-rewrite.js
 /**
 * Reference re-homing plans (0.5.0 V1, design §16.7).
@@ -577,34 +889,6 @@ const MEMORY_GUIDANCE_SECTION_ORDER = 11e3;
 /** Order of the `evolution-skills-guidance` section (last of the two). */
 const SKILLS_GUIDANCE_SECTION_ORDER = 11100;
 //#endregion
-//#region lib/types/guards.js
-/**
-* The family's plain-object predicate, in ONE place (v46 G7.1 / audit A8).
-*
-* The audit found the same guard — "a non-null object that is not an array" — rewritten fifteen
-* times across nine packages, four times inside core itself, and with two byte-identical `asRecord`
-* copies in evolution-policy and evolution-threat. This module is the single definition; callers
-* import it instead of spelling the clause again.
-*
-* @module @lmzhen/dsh-evolution-core
-*/
-/**
-* Is this a non-null, non-array object (what JSON calls an object)?
-* @param value - the value to test.
-* @returns whether it is a plain object.
-*/
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/**
-* Read a value as a record, or undefined when it is not one.
-* @param value - the value to read.
-* @returns the value typed as a record, or undefined.
-*/
-function asRecord(value) {
-	return isRecord(value) ? value : void 0;
-}
-//#endregion
 //#region lib/types/limits.js
 /**
 * Skill content limits: the byte/char budgets every write path validates against.
@@ -2481,6 +2765,7 @@ function buildCuratorRunReport(input) {
 		...input.snapshotPath === void 0 ? {} : { snapshotPath: input.snapshotPath },
 		...input.llmReviewEnabled === void 0 ? {} : { llmReviewEnabled: input.llmReviewEnabled },
 		...input.nominationsWarnings === void 0 ? {} : { nominationsWarnings: [...input.nominationsWarnings] },
+		...input.scanWarnings === void 0 ? {} : { scanWarnings: [...input.scanWarnings] },
 		...input.wouldPrune === void 0 ? {} : { wouldPrune: input.wouldPrune === null ? null : [...input.wouldPrune] }
 	};
 }
@@ -2505,7 +2790,8 @@ function renderCuratorReportMarkdown(report) {
 		...report.routeStubs === void 0 ? [] : [`- **Stale route stubs**: ${report.routeStubs.stubs}`],
 		...report.llmReviewEnabled === void 0 ? [] : [`- **llmReview**: ${report.llmReviewEnabled}`],
 		...report.wouldPrune === void 0 ? [] : [report.wouldPrune === null ? "- **Would prune (archiveRetention=report)**: unknown (archive listing unreadable)" : `- **Would prune (archiveRetention=report)**: ${report.wouldPrune.length}`],
-		...report.nominationsWarnings === void 0 || report.nominationsWarnings.length === 0 ? [] : [`- **Nomination warnings**: ${report.nominationsWarnings.join("; ")}`]
+		...report.nominationsWarnings === void 0 || report.nominationsWarnings.length === 0 ? [] : [`- **Nomination warnings**: ${report.nominationsWarnings.join("; ")}`],
+		...report.scanWarnings === void 0 || report.scanWarnings.length === 0 ? [] : report.scanWarnings.map((warning) => "- **Dedup scan**: " + warning)
 	];
 	const section = (title, items) => items.length === 0 ? [] : [
 		"",
@@ -3179,194 +3465,6 @@ function fuzzyPatch(content, oldString, newString, replaceAll = false) {
 }
 /** Deterministic section-extraction plan facts; the caller owns the IO and the append semantics. */
 //#endregion
-//#region lib/types/http-routes.js
-/**
-* The loopback HTTP plumbing every family route surface shares (E-302-era conventions).
-*
-* WHY THIS IS IN CORE: the fence, the bounded body reader and the JSON writer are the same for every
-* family route surface, and `evolution-core` is the one package all of them already depend on. The
-* canonical platform implementation (packages/client/connection/src/api-request-trust.ts) is not part
-* of that package's published surface, so the family keeps its own copy of the RULES here — once.
-*
-* Layering: pure transport. Nothing here knows about skills, approvals, curators or route tables.
-* @module @lmzhen/dsh-evolution-core/http-routes
-*/
-/** Largest request body a family route accepts; a bigger one reads as "no body" (400 from the handler). */
-const MAX_REQUEST_BODY_BYTES = 64 * 1024;
-/** One header as a single string (a repeated header reads as absent rather than as its first value). */
-function header(request, name) {
-	const value = request.headers[name];
-	return typeof value === "string" ? value : void 0;
-}
-/** IPv4 127/8 predicate (four decimal octets, first == 127). */
-function isIPv4Loopback(value) {
-	const parts = value.split(".");
-	return parts.length === 4 && parts[0] === "127" && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255);
-}
-/** Whether a socket remote address names the loopback range (127/8, ::1, IPv4-mapped). */
-function isLoopbackAddress(address) {
-	if (address === void 0) return false;
-	const normalized = address.toLowerCase();
-	if (normalized === "::1") return true;
-	if (normalized.startsWith("::ffff:")) return isIPv4Loopback(normalized.slice(7));
-	return isIPv4Loopback(normalized);
-}
-/** Whether a hostname names the loopback authority (localhost, [::1], 127/8). */
-function isLoopbackHostname(hostname) {
-	if (hostname === "localhost" || hostname === "[::1]") return true;
-	return isIPv4Loopback(hostname);
-}
-/**
-* Whether one request may enter a family route.
-*
-* Rules, in order: the SOCKET must be loopback (authoritative — X-Forwarded-For is never trusted), the
-* Host header must name a loopback authority (DNS-rebinding defense), an explicit cross-site marker is
-* refused, and an attached Origin must be exactly this authority.
-* @param request - the request to judge.
-* @returns true when the request may proceed.
-*/
-function isLoopbackRequest(request) {
-	if (!isLoopbackAddress(request.socket?.remoteAddress)) return false;
-	const host = header(request, "host");
-	if (host === void 0) return false;
-	let hostUrl;
-	try {
-		hostUrl = new URL("http://" + host);
-	} catch {
-		return false;
-	}
-	if (!isLoopbackHostname(hostUrl.hostname)) return false;
-	if (header(request, "sec-fetch-site") === "cross-site") return false;
-	const origin = header(request, "origin");
-	if (origin === void 0) return true;
-	try {
-		return new URL(origin).host === hostUrl.host;
-	} catch {
-		return false;
-	}
-}
-/** Write one JSON response. The routes own their response lifecycle, so every path ends here. */
-function writeJson(res, status, value) {
-	const body = JSON.stringify(value);
-	res.writeHead(status, {
-		"content-type": "application/json; charset=utf-8",
-		"content-length": Buffer.byteLength(body)
-	});
-	res.end(body);
-}
-/**
-* Read one JSON request body, bounded.
-* @param req - the request.
-* @returns the parsed value, or null when the body is oversized, empty, or not JSON.
-*/
-async function readJsonBody(req) {
-	const chunks = [];
-	let size = 0;
-	for await (const chunk of req) {
-		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-		size += buffer.byteLength;
-		if (size > 65536) return null;
-		chunks.push(buffer);
-	}
-	if (size === 0) return null;
-	try {
-		return JSON.parse(Buffer.concat(chunks).toString("utf8"));
-	} catch {
-		return null;
-	}
-}
-/**
-* Read one JSON request body that must be an OBJECT.
-*
-* The three route surfaces all take named fields, so "array or scalar" is a bad request rather than a
-* shape each handler has to re-check.
-* @param req - the request.
-* @returns the body as a plain object, or null when it is absent, oversized, not JSON, or not an object.
-*/
-async function readJsonObject(req) {
-	const body = await readJsonBody(req);
-	return isRecord(body) ? body : null;
-}
-//#endregion
-//#region lib/types/env.js
-/**
-* Evolution environment-variable reading, single-source (WC, 0.3.56).
-*
-* Every `DSH_EVOLUTION_*` value the PLUGIN code reads goes through this module
-* so the trim/whitelist patterns (v10 P2-12/13) live in exactly one place and
-* the generated env reference can point at one behavior. Configuration-layer
-* reads inside patch YAML `!!js` expressions (session-query path/openAt) stay
-* in the profile config evaluation — they are NOT migrated (they are resolved
-* at cordis config time, not plugin time) but are documented in the README
-* env table. `EVOLUTION_SCOPE` is read by the source installers only
-* (`packages/scripts/install-layered.mjs`, `packages/test-support/row-contract.ts`),
-* never by plugin runtime code.
-*
-* v14 P3-1: the former `EVOLUTION_ENV_KEYS` export was deleted — nothing read
-* it, so the "generated env reference" it claimed to source was never
-* generated (the README table is maintained by hand and now lists every key).
-*/
-const ALLOW_ROW_COLLISIONS = "1";
-/** N-5 escape: `DSH_EVOLUTION_ALLOW_ROW_COLLISIONS=1` downgrades a delta-row
-* collision from fail-loud to warn+keep-both. Any other value (including an
-* EMPTY/whitespace string — a set-but-unset variable) keeps the fail-loud. */
-function allowRowCollisions(env = process.env) {
-	return env.DSH_EVOLUTION_ALLOW_ROW_COLLISIONS === ALLOW_ROW_COLLISIONS;
-}
-//#endregion
-//#region lib/types/errors.js
-/**
-* THE error-code table: E-301…E-322 with the exact text each one emits (E-317…E-319 are the
-* write-admission gates' own refusals).
-*
-* The codes used to be spelled out at 33 call sites across two packages, so one
-* code's wording could drift between the branches that answer it and nothing could
-* see the drift. Keys name the SCENARIO rather than the code, because a code
-* legitimately carries more than one text (E-301 answers pending / approve / reject
-* with different guidance); the code still leads every string, so model- and
-* user-facing output is unchanged. Interpolations are written `%aN%` and filled by
-* `errorText` from the values the call site used to interpolate inline.
-* @module @lmzhen/dsh-evolution-core
-*/
-const EVOLUTION_ERRORS = Object.freeze({
-	"e-305-this-invocation-carries-no": "E-305: 本次调用没有携带 agent —— `%a1%` 需要由会话支撑的调用（请在 GUI 或 CLI 的会话里运行）。",
-	"e-306-this-deployment-stages-foreground": "E-306: 本部署会暂存前台写入，但 `/evolution %a1%` 无法通过技能运行器回放 —— 没有可暂存的内容。请在批准策略为 'never' 的会话里运行，或在 evolution-approval 行上设置 `stageForeground: false`，然后重试该命令。",
-	"e-301-approval-service-not-mounted": "E-301: 批准服务未挂载：待批准写入无法列出或回放。挂载 evolution-approval 行（随 evolution-host/evolution-all 提供）后，运行 /evolution doctor 可查看已挂载的服务。",
-	"e-301-approval-service-not-mounted-2": "E-301: 批准服务未挂载。下一步：evolution-approval 行随 evolution-host/evolution-all 一起提供 —— 运行 /evolution doctor 查看已挂载的服务。",
-	"e-304-the-mounted-approval-service": "E-304: 已挂载的批准服务早于本能力发布 —— 请改为驳回该记录。",
-	"e-302-curator-service-not-mounted": "E-302: 策展服务未挂载。下一步：挂载 evolution-curator 行（evolution-host/evolution-all），并运行 /evolution doctor。",
-	"e-305-the-invocation-agent-exposes": "E-305: 调用 agent 既没有暴露 `followup` 也没有 `inject` —— %a1% 没有投递通道。",
-	"e-306-this-deployment-stages-foreground-2": "E-306: 本部署会暂存前台写入，但本次调用没有 agent 会话 —— `/evolution restructure` 会暂存一条没有会话归属的记录。请在 GUI 或 CLI 的会话里运行，或在 `stageForeground: false` 行上设置，然后重试该命令。",
-	"e-303-replay-service-not-mounted": "E-303: 回放服务未挂载。下一步：挂载 evolution-replay 行（evolution-host/evolution-all），并运行 /evolution doctor。",
-	"e-307-the-settings-service-could": "E-307: 设置服务无法报告它的分区（%a1%）。/evolution params 需要用户层来区分覆盖值与部署值；运行 /evolution doctor 查看已挂载的服务。",
-	"e-308-unknown-parameter-group-group": "E-308: 未知的参数分组「%a1%」—— 已知分组：%a2%。",
-	"e-311-no-settings-service-is": "E-311: 没有挂载设置服务，因此没有可写入的用户层。请挂载 settings 行（packages/settings/settings-file）后重试；本命令从不修改 cordis.yml —— 部署值属于部署。/evolution doctor 会列出已挂载的服务。",
-	"e-312-error-instanceof-Error-error": "E-312: %a1% —— /evolution params 会列出规范 id。",
-	"e-313-unknown-parameter-id-evolution": "E-313: 未知参数「%a1%」—— /evolution params 会列出每个已注册 id 及其层级与用户层。",
-	"e-314-id-is-a-deployment": "E-314: 「%a1%」是部署参数（层级 %a2%，归属 %a3%）—— 它写在 cordis.yml 的插件行或策略行上，而不是从会话写入。/evolution params 会显示每一行由谁可写。",
-	"e-315-id-has-no-user": "E-315: 「%a1%」没有用户层 —— 归属 %a2% 没有发布设置命名空间，因此该值留在部署层。",
-	"e-307-the-settings-service-could-2": "E-307: 设置服务无法报告它的分区（%a1%）。/evolution policy set 需要当前修订号才能安全写入；运行 /evolution doctor 查看已挂载的服务。",
-	"e-316-namespace-namespace-is-not": "E-316: namespace \"%a1%\" 未注册 —— 归属 %a2% 在本组合中未挂载，因此无法从这里写入它的参数。 /evolution params 会把那些行标为 'unregistered'.",
-	"e-309-revision-conflict-you-sent": "E-309: 修订冲突 —— 你提交的是 %a1%，文档当前为 %a2%。请用 /evolution params --json 重新读取后重试。",
-	"e-309-revision-conflict-message-Re": "E-309: 修订冲突 —— %a1%。请用 /evolution params --json 重新读取后重试。",
-	"e-310-the-settings-service-refused": "E-310: 设置服务拒绝了这次写入：%a1% —— 归属插件的规则优先（跨字段成对约束，或只能收紧的上限）。/evolution params 会显示当前值。",
-	"e-317-skill-write-not-confirmed": "E-317: 技能 \"%a1%\" 未被%a2% —— 确认提示被拒绝或关闭，因此没有写入任何内容。每次创建与裸删除都会出现该提示；只有操作者要求时才重复调用。",
-	"e-318-skill-write-without-a-read": "E-318: 本会话没有读取技能 \"%a1%\"，因此拒绝这次写入。请先用 `skill` 工具读取它（失败的读取不算），然后重复该写入。",
-	"e-320-the-profile-home-is-not": "E-320: 本宿主没有报告 profile home，因此无法定位旧设置文档。/evolution migrate 读取 `<profile home>/settings.yaml.imported`；请在由 profile 启动的会话里运行。",
-	"e-322-a-parameter-would-break-a": "E-322: %a1% 至少应为 %a2%，但这次写入把它设成 %a3%。未写入任何内容。",
-	"e-321-no-io-provider-is": "E-321: 没有挂载 evolution-io 提供方，因此无法读取旧设置文档。请挂载 evolution-io 行（evolution-host/evolution-all）后重试。",
-	"e-319-skill-write-confirm-timed-out": "E-319: 技能 \"%a1%\" 未被%a2% —— 确认提示在 %a3% 秒内无人应答，因此该写入被取消。没有人在场决定：把 `skillWriteConfirm` 设为 `auto` 可免提示直接写入，保留 `ask` 则一直等到有人应答，或提高 `skillWriteConfirmTimeoutSeconds`。"
-});
-/**
-* Render one table entry, substituting its interpolation slots.
-* @param id - the scenario key.
-* @param args - values for the entry's `%aN%` slots.
-* @returns the message text the call site used to spell out inline.
-*/
-function errorText(id, args = {}) {
-	return EVOLUTION_ERRORS[id].replace(/%a(\d+)%/g, (_match, n) => String(args["a" + n] ?? ""));
-}
-//#endregion
 //#region lib/types/learn-prompt.js
 /**
 * Open-ended `/evolution learn` prompt builder.
@@ -3946,24 +4044,6 @@ function render(entries) {
 function stripDatePrefix(entry) {
 	return entry.replace(/^## \d{4}-\d{2}-\d{2}\n/, "");
 }
-/**
-* Neutralize the platform's `{{name}}` prompt-variable syntax in text that is
-* about to be registered as a `systemPrompt.context` contribution.
-*
-* The platform interpolates every context/section text once per model step and
-* THROWS on an unknown or malformed reference — so one stored memory entry
-* containing `{{...}}` (a CI expression, a Jinja/Helm/Vue template, a doc
-* placeholder) used to fail `assemble()` on EVERY later pre-step of every
-* session under this DSH_HOME, while a registered name such as `{{cwd}}` was
-* silently substituted into the "memory" the model reads. Only the INJECTED
-* text is neutralized: stored entries keep their original bytes.
-*
-* @param text - rendered context text about to leave for the prompt surface.
-* @returns the same text with every `{{` split so it cannot start a reference.
-*/
-function neutralizePromptVariables(text) {
-	return text.includes("{{") ? text.replaceAll("{{", "{ {") : text;
-}
 /** F-201: does `content` carry the on-disk entry delimiter or a trailing
 * `\n§` fragment that would combine with the render terminator into a real
 * delimiter boundary? Both split the fact into multiple entries on read-back
@@ -4530,7 +4610,7 @@ var MemoryStore = class {
 				parts.push(`## ${label} (${safe.length} entries)${usage}${note}\n${body}`);
 			} else if (entries.length > 0) parts.push(`## ${label} — ${entries.length} entries withheld by the security scan; none injected`);
 		}
-		return neutralizePromptVariables(parts.join("\n\n"));
+		return parts.join("\n\n");
 	}
 	/**
 	* Detect on-disk drift for a caller that holds no locked view: `true` when the
@@ -4613,563 +4693,6 @@ async function recordMutation(root, io, record, cap = 500) {
 	});
 }
 //#endregion
-//#region lib/types/preset-composition.js
-/**
-* Build the user-root Evolution preset composition from the RUNTIME platform's
-* `standard` preset rows plus the evolution delta rows (P1-1 follow-up,
-* 0.3.15): the agent-preset registry mounts ONE composition file verbatim, so
-* a delta-only `agent.cordis.yml` would produce an agent carrying only the
-* delta rows.
-*
-* Same contract as `install-layered.mjs` `generateAgentPreset` (the source
-* install path) — installer.spec pins byte parity between the two, and both
-* apply the identical row-collision contract: a delta id that overlaps a
-* standard row id fails loud by default, and `DSH_EVOLUTION_ALLOW_ROW_COLLISIONS=1`
-* downgrades it to a warning that keeps both (the row mounts twice).
-*
-* V10-14 / 0.3.53 (P1-2): BOTH composers now inject the Hermes 60-char catalog
-* cap onto the standard-sourced `- id: tool-skill` row of the composed preset
-* (see injectCatalogDescriptionCap) — the session-visible tool-skill instance
-* mounts in the preset's own standing scope, where no profile-root patch can
-* reach it. 0.3.53 moved the injection INTO the composer so
-* `/evolution preset install` (the npm user's only preset path) gets it too;
-* install-layered applies the byte-identical rule, pinned by installer.spec.
-*
-* Row ids are read from `- id:` lines; an id present in both fragments would
-* mount twice and could shadow the platform row, so it fails loud.
-* @param standardComposition - the runtime `standard` preset composition.
-* @param deltaComposition - the evolution delta fragment.
-* @returns the composed preset composition (standard rows first, then delta).
-*/
-function composePresetComposition(standardComposition, deltaComposition) {
-	const standardIds = compositionRowIds(standardComposition);
-	const collisions = [...compositionRowIds(deltaComposition)].filter((id) => standardIds.has(id)).sort();
-	if (collisions.length > 0 && !allowRowCollisions()) throw new Error(`evolution preset composition: delta rows collide with runtime standard rows: ${collisions.join(", ")}`);
-	if (collisions.length > 0) console.warn(`evolution preset composition: warning — delta rows collide with standard rows (${collisions.join(", ")}); keeping both (DSH_EVOLUTION_ALLOW_ROW_COLLISIONS=1)`);
-	return applyRowOverrides(`${standardComposition.replace(/\s+$/, "")}\n\n${deltaComposition.trim()}\n`);
-}
-/**
-* One table, two generation paths: `row-overrides.json` at the PACKAGE ROOT
-* states what a generated preset must carry beyond the platform composition,
-* and the source installer (`scripts/install-layered.mjs`) reads the same file.
-* The path resolves from both `src/` and the built `lib/`, which is why the
-* file sits at the root and ships in `files`.
-*
-* Before 0.3.77 each side carried its own hand-kept copy of this table; they
-* happened to stay byte-identical, which is exactly the kind of agreement no
-* test can keep — the entries are now data, and a divergence is impossible.
-*/
-const ROW_OVERRIDES_URL = new URL("../row-overrides.json", import.meta.url);
-/** One cache per PATH: the installer reads the same file through its own root, and a single-slot
-* cache would hand the second caller the first caller's bytes. */
-const overridesCache = /* @__PURE__ */ new Map();
-/**
-* Read and validate the shared override table.
-* G6.1/M1: the path is a PARAMETER (default: the table beside this module). The source installer
-* runs the generated port from `scripts/`, so its own root has to be passed in — a module-relative
-* read would look for `scripts/../row-overrides.json` and fail.
-* @param path - the table to read.
-* @returns the entries, in file order. A malformed table fails LOUD: a composer
-* that silently skipped an entry would ship a preset running the platform
-* default while nothing downstream reported it.
-*/
-function loadRowOverrides(path = fileURLToPath(ROW_OVERRIDES_URL)) {
-	const cached = overridesCache.get(path);
-	if (cached !== void 0) return cached;
-	const parsed = JSON.parse(readFileSync(path, "utf8"));
-	if (!Array.isArray(parsed)) throw new Error("evolution-core: row-overrides.json must be an array of override entries");
-	const entries = [];
-	for (const [index, entry] of parsed.entries()) {
-		const candidate = entry;
-		if (candidate === null || typeof candidate !== "object" || typeof candidate.row !== "string" || candidate.row === "" || typeof candidate.key !== "string" || candidate.key === "" || !Array.isArray(candidate.lines) || candidate.lines.some((line) => typeof line !== "string") || typeof candidate.missingReason !== "string") throw new Error(`evolution-core: row-overrides.json entry ${index} is malformed (row/key/lines/missingReason are required)`);
-		entries.push({
-			row: candidate.row,
-			key: candidate.key,
-			lines: candidate.lines,
-			missingReason: candidate.missingReason
-		});
-	}
-	overridesCache.set(path, entries);
-	return entries;
-}
-/**
-* Ensure every {@link RowOverride} inside its target row.
-*
-* Key-level by construction: we INSERT the override's own lines and leave a row
-* that already carries the key byte-identical, so a re-run never doubles a key.
-* This is the deliberate opposite of the platform's patch layers, where an
-* override REPLACES `config` wholesale — the difference is why the composer can
-* add a key without erasing the platform's own config defaults.
-*/
-function applyRowOverrides(composition, overrides = loadRowOverrides()) {
-	let lines = composition.split("\n");
-	for (const override of overrides) lines = applyOneOverride(lines, override);
-	return lines.join("\n");
-}
-function applyOneOverride(lines, override) {
-	const rowRe = new RegExp("^- id:\\s*" + override.row.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "\\s*$");
-	let found = false;
-	for (let i = 0; i < lines.length; i += 1) {
-		if (!rowRe.test(lines[i] ?? "")) continue;
-		found = true;
-		let end = i;
-		let hasConfig = false;
-		for (let j = i + 1; j < lines.length; j += 1) {
-			const next = lines[j] ?? "";
-			if (next.trim() === "") break;
-			if (!/^\s/.test(next)) break;
-			if (new RegExp("^ {2}" + override.key + ":(\\s|$)").test(next)) hasConfig = true;
-			end = j;
-		}
-		if (hasConfig) continue;
-		lines.splice(end + 1, 0, ...override.lines);
-		i = end + override.lines.length;
-	}
-	if (!found) console.warn("evolution preset composition: warning — " + override.missingReason);
-	return lines;
-}
-/**
-* Row ids of a composition fragment (line scan, no YAML library).
-*
-* PLAN S5.9 (2026-09-16, audit P2-27): the id extraction accepts INDENTED
-* `- id:` rows too, so a collision hidden in a nested group is still caught —
-* the old `^- id:` anchored at column 0 and was blind to exactly the rows an
-* upstream group nesting would produce. Twin of `rowIds` in
-* `scripts/install-layered.mjs` (installer.spec pins detection parity).
-* Boundary (current, deliberate): DETECTION covers nested rows, while the
-* override INJECTION anchors (`applyOneOverride` below) still match top-level
-* rows only — the injection indent contract (`^ {2}key:`) is defined against a
-* column-0 row.
-*/
-function compositionRowIds(composition) {
-	const ids = /* @__PURE__ */ new Set();
-	for (const line of composition.split("\n")) {
-		const id = /^\s*- id:\s*(\S+)/.exec(line)?.[1];
-		if (id) ids.add(id);
-	}
-	return ids;
-}
-/** The platform package a DECLARATIVE preset row names (0.2.x replaced preset directories with it). */
-const AGENT_PRESET_PACKAGE = "@deepseek-ai/dsh-agent-preset";
-/**
-* Compose the DECLARATIVE preset row from the platform base composition and the family delta.
-*
-* 0.2.x removed the directory mechanism: `dsh-agent-preset` is an ordinary composition row whose
-* `config.plugins` carries the preset's complete child plugin list
-* (`packages/preset/agent-preset/src/index.ts`, `agent-preset-registry/src/definition.ts` — the
-* definition has NO base/extends field, which is why the platform base is merged in here).
-*
-* The composition itself is {@link composePresetComposition}: same row-collision contract and the
-* same `row-overrides.json` injection, applied while the composed rows are still at column 0 — the
-* override anchors are defined against a column-0 `- id:` row, so the indentation that puts them
-* under `plugins:` must come last.
-* @param baseComposition - the platform base preset patch/composition rows.
-* @param deltaComposition - the family delta rows.
-* @param identity - row id, preset id, display fields and order.
-* @returns the row text, newline-terminated, ready to merge into a profile patch.
-*/
-/**
-* Drop the blank lines that merely separate block-sequence items, keeping the ones INSIDE a block
-* literal (`key: |` / `>`): there a blank line is part of the value, and filtering it flattened a
-* platform base preset's multi-paragraph prompt into one paragraph (G6 review, P1).
-* @param text - the composition rows.
-* @returns the rows with the separating blank lines removed.
-*/
-function denseBlockSequence(text) {
-	const out = [];
-	let scalarIndent = -1;
-	for (const line of text.split("\n")) {
-		const trimmed = line.trim();
-		const indent = line.length - line.trimStart().length;
-		if (scalarIndent >= 0 && trimmed !== "" && indent <= scalarIndent) scalarIndent = -1;
-		if (scalarIndent < 0) {
-			const match = /^(\s*)[\w".-]+:\s*[|>]/.exec(line);
-			if (match !== null) scalarIndent = (match[1] ?? "").length;
-		}
-		if (trimmed === "" && scalarIndent < 0) continue;
-		out.push(line);
-	}
-	return out.join("\n");
-}
-function composePresetRow(baseComposition, deltaComposition, identity) {
-	const plugins = denseBlockSequence(composePresetComposition(baseComposition, deltaComposition)).split("\n").map((line) => line === "" ? "" : "      " + line).join("\n");
-	return [
-		"- id: " + identity.rowId,
-		"  name: '@deepseek-ai/dsh-agent-preset'",
-		"  config:",
-		"    id: " + identity.id,
-		"    name: " + JSON.stringify(identity.name),
-		"    description: " + JSON.stringify(identity.description),
-		"    order: " + String(identity.order),
-		"    plugins:",
-		plugins,
-		""
-	].join("\n");
-}
-/** The patch-entry key that ADDS a row: a plain entry overrides the row with the same id, so a
-* preset the platform does not ship has to arrive inside an `insert` entry
-* (the platform's own `user-patches.spec.ts` proves the override-vs-insert split). */
-const PATCH_INSERT_KEY = "insert";
-/**
-* Wrap a composed row as the patch entry a profile patch needs.
-*
-* The row {@link composePresetRow} returns starts at column 0; a patch entry's list nests it four
-* spaces deeper. Wrapping is a separate step because the same row text is also what
-* {@link mergePresetRow} matches by id, and because the composer's override anchors are defined
-* against column-0 rows.
-* @param row - the row text, as {@link composePresetRow} returns it.
-* @returns the patch entry text, newline-terminated.
-*/
-function composePresetInsert(row) {
-	return `- ${PATCH_INSERT_KEY}:\n${row.replace(/\s+$/, "").split("\n").map((line) => "    " + line).join("\n")}\n`;
-}
-/**
-* The row list a platform base preset patch carries under `config.plugins`, dedented to column 0.
-*
-* A base preset arrives as a whole patch entry — `- insert:` / `- id: preset-standard` /
-* `config:` / `plugins:` — because that is how the platform ships it
-* (`packages/bundle/web-app/presets/standard.patch.yml`). The preset's own list is the
-* SHALLOWEST `plugins:` line: a child row may carry a key by that name far deeper.
-* @param patchText - the base preset patch file's text.
-* @returns the plugin rows, dedented and newline-terminated.
-* @throws {Error} when the patch carries no `plugins:` list.
-*/
-function basePresetPlugins(patchText) {
-	const lines = patchText.split("\n");
-	let at = -1;
-	let indent = Number.POSITIVE_INFINITY;
-	for (const [index, line] of lines.entries()) {
-		const width = /^(\s*)plugins:\s*$/.exec(line)?.[1]?.length;
-		if (width === void 0) continue;
-		if (width < indent) {
-			indent = width;
-			at = index;
-		}
-	}
-	if (at < 0) throw new Error("evolution preset composition: the base preset patch carries no `plugins:` list");
-	const block = [];
-	for (const line of lines.slice(at + 1)) {
-		if (line.trim() === "") {
-			block.push(line);
-			continue;
-		}
-		if (line.length - line.trimStart().length <= indent) break;
-		block.push(line);
-	}
-	while (block.length > 0 && block[block.length - 1]?.trim() === "") block.pop();
-	const widths = block.filter((line) => line.trim() !== "").map((line) => line.length - line.trimStart().length);
-	const dedent = widths.length === 0 ? 0 : Math.min(...widths);
-	return block.map((line) => line.slice(0, dedent).trim() === "" ? line.slice(dedent) : line).join("\n") + "\n";
-}
-/** The row id a family preset occupies: the platform ships \`preset-standard\` for id `standard`
-* (`packages/bundle/web-app/presets/standard.patch.yml`), so a family preset id mirrors it. */
-function presetRowId(id) {
-	return `preset-${id}`;
-}
-/**
-* The patch entry a profile patch receives for one preset: base rows plus the family delta, wrapped
-* as \`- insert:\`.
-*
-* The two halves are also exposed on their own — {@link composePresetRow} for the row, so
-* {@link mergePresetRow} can match it by id, and {@link basePresetPlugins} to read the platform
-* base out of a shipped patch.
-* @param basePatchText - the platform base preset patch's text.
-* @param deltaComposition - the family delta rows.
-* @param identity - row id, preset id, display fields and order.
-* @returns the patch entry text, newline-terminated.
-*/
-function composePresetEntry(basePatchText, deltaComposition, identity) {
-	return composePresetInsert(composePresetRow(basePresetPlugins(basePatchText), deltaComposition, identity));
-}
-/**
-* The text of one row's own patch item, or null when the patch carries no such row.
-*
-* The comparison unit for a freshness check: this is byte-for-byte what {@link composePresetEntry}
-* writes for the same row id, whether the row sits inside an \`- insert:\` entry (installer-written)
-* or at column 0 (saved by the Web editor).
-* @param patchText - the patch text.
-* @param rowId - the row id to read.
-* @returns the item's text, newline-terminated, or null.
-*/
-function presetRowBody(block) {
-	const lines = block.split("\n");
-	if (!/^- insert:\s*$/.test(lines[0] ?? "")) return block;
-	return lines.slice(1).map((line) => line.startsWith("    ") ? line.slice(4) : line).join("\n");
-}
-/**
-* The row BODY of a patch block, whichever form it is in.
-*
-* {@link presetRowBlock} returns the enclosing item verbatim: an installer-written row sits inside
-* `- insert:` while a row the platform's Web editor saved IS that column-0 item. A comparison must
-* compare like with like — comparing the raw block against `composePresetEntry()` (which always
-* starts with `- insert:`) reported DIFFERS for every editor-saved row, forever (G6 review, P2), and
-* the remedy it printed (`re-run the installer`) was refused by the `exists; use --force` guard.
-* @param block - a block as {@link presetRowBlock} returns it.
-* @returns the row text, `- insert:` unwrapped and its four-space indent stripped.
-*/
-function presetRowBlock(patchText, rowId) {
-	const lines = patchText.split("\n");
-	const span = rowBlockSpan(lines, rowId);
-	if (span === null) return null;
-	const block = [...lines.slice(span.start, span.end)];
-	while (block.length > 0 && (block[block.length - 1] ?? "").trim() === "") block.pop();
-	return block.join("\n") + "\n";
-}
-/** The package every shipped base preset patch declares its row with
-* (`packages/bundle/web-app/presets/standard.patch.yml`). The platform's only bundle carrying
-* preset patches today; a bundle a caller mounts is probed beside it. */
-const PLATFORM_BUNDLE_PACKAGE = "@deepseek-ai/dsh-web-app";
-/**
-* What `DSH_AGENT_PRESET_ROOT` must name: a directory holding the platform base preset patches
-* under their shipped file names (`<base>.patch.yml`) — e.g. a copy of a same-version platform
-* tree's `packages/bundle/web-app/presets/`. The desktop application is the shape that needs it:
-* its platform packages live inside `resources/app.asar`, so there is no plain
-* `node_modules/@deepseek-ai/dsh-web-app/presets/` on disk for a source installer to read.
-*/
-const AGENT_PRESET_ROOT_HINT = "point DSH_AGENT_PRESET_ROOT at a directory holding <base>.patch.yml (copy it out of a same-version dsh tree: packages/bundle/web-app/presets/)";
-/**
-* Resolve the platform patch file one `--base` names.
-*
-* 0.2.x ships each base preset as a bundle patch layer
-* (`packages/bundle/web-app/presets/<base>.patch.yml`, declared in that package's
-* `dsh.bundle.patch`), so the FILE — not a preset directory — is the base a family row is composed
-* from. Candidates, in order: an explicit `DSH_AGENT_PRESET_ROOT`; a module-graph probe when the
-* caller supplies one (a desktop/Electron host resolves the bundle inside `app.asar`, where no file
-* walk can reach); the target profile's own `node_modules`; then, walking up from the caller,
-* every `presets/` directory of a checkout's bundle packages, then every
-* `@deepseek-ai/dsh-<name>/presets/` directory of an installed tree.
-*
-* A base with no patch file is REFUSED with every probed candidate listed: composing a family preset
-* from another base's rows would mount rows the user did not ask for, with nothing saying so.
-* @param base - the base name, already validated against `evolution-agent/bases.json`.
-* @param sources - the roots to probe.
-* @returns the patch file's absolute path.
-* @throws {Error} when no candidate exists.
-*/
-function resolveBasePresetPatch(base, sources) {
-	const file = `${base}.patch.yml`;
-	const explicit = sources.root?.trim();
-	if (explicit !== void 0 && explicit !== "") {
-		const path = join(explicit, file);
-		if (!existsSync(path)) throw new Error(`evolution preset composition: DSH_AGENT_PRESET_ROOT is set but ${path} does not exist — ${AGENT_PRESET_ROOT_HINT}`);
-		return path;
-	}
-	const probes = [];
-	const probe = (path) => {
-		probes.push(path);
-		return existsSync(path) ? path : void 0;
-	};
-	if (sources.resolve !== void 0) {
-		const probeSpecifier = `${PLATFORM_BUNDLE_PACKAGE}/presets/${file}`;
-		try {
-			const found = probe(sources.resolve(probeSpecifier));
-			if (found !== void 0) return found;
-		} catch {
-			probes.push(`node module graph: ${probeSpecifier}`);
-		}
-	}
-	if (sources.profileDir !== void 0 && sources.profileDir !== "") for (const name of new Set([PLATFORM_BUNDLE_PACKAGE, ...sources.bundles ?? []])) {
-		const found = probe(join(sources.profileDir, "node_modules", ...name.split("/"), "presets", file));
-		if (found !== void 0) return found;
-	}
-	for (let level = sources.fromDir; level !== dirname(level); level = dirname(level)) {
-		const bundleRoot = join(level, "packages", "bundle");
-		for (const name of listDirectories(bundleRoot)) {
-			const found = probe(join(bundleRoot, name, "presets", file));
-			if (found !== void 0) return found;
-		}
-		const scopeRoot = join(level, "node_modules", "@deepseek-ai");
-		for (const name of listDirectories(scopeRoot)) {
-			if (!name.startsWith("dsh-")) continue;
-			const found = probe(join(scopeRoot, name, "presets", file));
-			if (found !== void 0) return found;
-		}
-	}
-	for (const root of installRoots(sources.fromDir)) for (const shape of DESKTOP_RESOURCE_SHAPES) {
-		const found = probe(join(root, ...shape, "dsh", "node_modules", "@deepseek-ai", "dsh-web-app", "presets", file));
-		if (found !== void 0) return found;
-		const scanned = probeDesktopScope(join(root, ...shape), file, probes);
-		if (scanned !== void 0) return scanned;
-	}
-	throw new Error(`evolution preset composition: cannot find the runtime platform '${base}' preset patch — no candidate carries presets/${file}. A base with no runtime patch is refused rather than composed from another base: the generated preset must follow the platform it runs on. Probed (in order): ${probes.join(", ")}. On a desktop install the platform packages live inside resources/app.asar and no plain file exists — ${AGENT_PRESET_ROOT_HINT}`);
-}
-/** The Electron resource layouts a desktop installation exposes its unpacked packages under. */
-const DESKTOP_RESOURCE_SHAPES = [["resources", "app.asar.unpacked"], [
-	"resources",
-	"app",
-	"resources",
-	"app.asar.unpacked"
-]];
-/**
-* Installation directories a desktop/Electron tree may sit at, probed before the source walk.
-*
-* The default Windows desktop location plus every ancestor that carries an
-* `resources/app.asar.unpacked` directory (a script run from inside an installation).
-* @param fromDir - the caller's own directory.
-* @returns the candidate installation roots.
-*/
-function installRoots(fromDir) {
-	const roots = [];
-	const localAppData = process.env.LOCALAPPDATA;
-	if (process.platform === "win32" && localAppData !== void 0 && localAppData !== "") roots.push(join(localAppData, "Programs", "DeepSeek Harness"));
-	for (let level = fromDir; level !== dirname(level); level = dirname(level)) if (existsSync(join(level, "resources", "app.asar.unpacked"))) roots.push(level);
-	return roots;
-}
-/**
-* Probe every `@deepseek-ai/dsh-*` package under one unpacked resource root.
-* @param resourceRoot - e.g. `<install>/resources/app.asar.unpacked`.
-* @param file - the patch file name to look for.
-* @param probes - the caller's probe log, appended to for the failure report.
-* @returns the patch path when one exists.
-*/
-function probeDesktopScope(resourceRoot, file, probes) {
-	const scopeRoot = join(resourceRoot, "dsh", "node_modules", "@deepseek-ai");
-	for (const name of listDirectories(scopeRoot)) {
-		if (!name.startsWith("dsh-")) continue;
-		const path = join(scopeRoot, name, "presets", file);
-		probes.push(path);
-		if (existsSync(path)) return path;
-	}
-}
-/**
-* Subdirectories of one directory, or none when it does not exist: a missing level is an ordinary
-* miss on a candidate walk, not a failure.
-* @param dir - the directory to list.
-* @returns the directory names.
-*/
-function listDirectories(dir) {
-	try {
-		return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
-	} catch {
-		return [];
-	}
-}
-/**
-* The block of one row id: the enclosing column-0 list item and the row's own first line.
-*
-* An installer-written row sits inside `- insert:` (four spaces deeper); a row the Web editor
-* saved is that column-0 item itself. Both must be replaced whole, so the span reaches back to the
-* enclosing item and forward to the next one.
-* @param lines - the patch text's lines.
-* @param rowId - the row id to locate.
-* @returns the span, or null when the patch carries no such row.
-*/
-function rowBlockSpan(lines, rowId) {
-	const rowRe = new RegExp("^\\s*- id:\\s*" + rowId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "\\s*$");
-	const rowStart = lines.findIndex((line) => rowRe.test(line));
-	if (rowStart < 0) return null;
-	let start = rowStart;
-	while (start > 0 && !/^- /.test(lines[start] ?? "")) start -= 1;
-	let end = lines.length;
-	for (let index = start + 1; index < lines.length; index += 1) if (/^- /.test(lines[index] ?? "")) {
-		end = index;
-		break;
-	}
-	return {
-		start,
-		end,
-		rowStart
-	};
-}
-/**
-* Remove one row from a patch, taking its `- insert:` item with it when that item holds nothing
-* else (an empty insert entry is left-over structure the platform would keep parsing).
-* @param patchText - the patch text to edit.
-* @param rowId - the row id to remove.
-* @returns the patch text, newline-terminated; byte-identical when the id is absent.
-*/
-function removePresetRow(patchText, rowId) {
-	const lines = patchText.split("\n");
-	const span = rowBlockSpan(lines, rowId);
-	if (span === null) return patchText;
-	const rowLine = lines[span.rowStart] ?? "";
-	const rowIndent = rowLine.length - rowLine.trimStart().length;
-	const nested = rowIndent > 0;
-	const siblings = lines.slice(span.start + 1, span.end).filter((line) => {
-		return line.length - line.trimStart().length === rowIndent && line.trimStart().startsWith("- ");
-	}).length;
-	const cut = nested && siblings > 1 ? {
-		start: span.rowStart,
-		end: rowSiblingEnd(lines, span.rowStart, span.end)
-	} : span;
-	const kept = [...lines.slice(0, cut.start), ...lines.slice(cut.end)];
-	while (kept.length > 1 && (kept[kept.length - 1] ?? "") === "") kept.pop();
-	const text = kept.join("\n");
-	if (text === "") return "";
-	return text.endsWith("\n") ? text : text + "\n";
-}
-/**
-* The end of one nested row's own block inside a patch entry.
-* @param lines - the patch text's lines.
-* @param rowStart - the row's `- id:` line.
-* @param itemEnd - the enclosing item's end.
-* @returns the index of the next sibling row, or the item's end.
-*/
-function rowSiblingEnd(lines, rowStart, itemEnd) {
-	const indent = (lines[rowStart] ?? "").length - (lines[rowStart] ?? "").trimStart().length;
-	for (let index = rowStart + 1; index < itemEnd; index += 1) {
-		const line = lines[index] ?? "";
-		if (line.trim() === "") continue;
-		const width = line.length - line.trimStart().length;
-		if (width === indent && line.trimStart().startsWith("- ")) return index;
-		if (width < indent) return index;
-	}
-	return itemEnd;
-}
-/**
-* Merge one generated row into a composition (a profile patch) by row id.
-*
-* Idempotent by construction: an existing row with the same `- id:` is REPLACED whole — its block
-* is the enclosing column-0 list item, so an installer-written row inside `- insert:` and a
-* Web-editor-saved row at column 0 are both matched by {@link rowBlockSpan} — and anything else in
-* the patch stays byte-identical, because the patch usually carries rows this installer knows
-* nothing about. A missing row is appended.
-*
-* The platform seeds a fresh profile patch with the empty list `[]`
-* (`packages/boot/app-boot/src/profile.ts`, `PROFILE_PATCH_FILENAME`), which is a COMPLETE YAML
-* document: a block sequence appended after it is not parsable. That seed is therefore replaced, not
-* extended.
-* @param patchText - the current patch text (`''` for a fresh one).
-* @param row - the row text, as {@link composePresetRow} returns it.
-* @param rowId - the row id to replace or append.
-* @returns the merged patch text, newline-terminated.
-*/
-function mergePresetRow(patchText, row, rowId) {
-	const lines = patchText.split("\n");
-	const block = row.replace(/\s+$/, "").split("\n");
-	const span = rowBlockSpan(lines, rowId);
-	if (span === null) {
-		const seedIndex = lines.findIndex((line) => EMPTY_PATCH_SEED_RE.test(line));
-		const kept = trimTrailingBlankLines(seedIndex >= 0 ? [...lines.slice(0, seedIndex), ...lines.slice(seedIndex + 1)] : [...lines]);
-		return (kept.length === 0 ? block : [...kept, ...block]).join("\n") + "\n";
-	}
-	return trimTrailingBlankLines([
-		...lines.slice(0, span.start),
-		...block,
-		...lines.slice(span.end)
-	]).join("\n") + "\n";
-}
-/** The empty patch list the platform seeds a profile patch with; see {@link mergePresetRow}. */
-const EMPTY_PATCH_SEED = "[]";
-/** The seed in any spelling the platform accepts (`[]`, `[ ]`, `[] # empty`). */
-const EMPTY_PATCH_SEED_RE = /^\s*\[\s*\](\s*#.*)?\s*$/;
-/** Drop trailing blank lines only: a kept line's own terminator (a CRLF file's `\r`) is never touched. */
-function trimTrailingBlankLines(lines) {
-	const out = [...lines];
-	while (out.length > 0 && (out[out.length - 1] ?? "").trim() === "") out.pop();
-	return out;
-}
-/**
-* The text to write when a patch is left with no entries.
-*
-* A zero-byte patch file is not what the platform writes or parses; its own seed is the empty list.
-* @param patchText - the text {@link removePresetRow} returned.
-* @returns the platform's empty-list seed when nothing is left, the text otherwise.
-*/
-function presetPatchText(patchText) {
-	return patchText.trim() === "" ? `[]\n` : patchText;
-}
-//#endregion
 //#region lib/types/prompts.js
 /**
 * Review and curation prompts adapted from Hermes Agent
@@ -6482,7 +6005,7 @@ function renderLongRunTable() {
 /**
 * Every platform service the family reaches for with `ctx.get`, and what degrades without it.
 *
-* O-2 (v46 audit): the family probes 28 platform services optionally — the platform has no
+* O-2 (v46 audit): the family probes 25 platform services optionally — the platform has no
 * formalized "optional dependency", so an ABSENT service is a silent downgrade and the diagnostic
 * surface is the only place a reader can learn about it. `/evolution doctor` used to judge six of
 * them; this table is the single source it judges the rest from, and the arch guard cross-checks it
@@ -6492,7 +6015,7 @@ function renderLongRunTable() {
 * `client` probes run in the browser half, where the host has no view of the seats.
 * @module @lmzhen/dsh-evolution-core
 */
-/** The 28 probes, in service-name order (the guard checks this list against the tree). */
+/** The 25 probes, in service-name order (the guard checks this list against the tree). */
 const PLATFORM_SERVICE_PROBES = Object.freeze([
 	{
 		service: "agents",
@@ -6529,11 +6052,6 @@ const PLATFORM_SERVICE_PROBES = Object.freeze([
 		feature: "every durable read and write (the IO seam)",
 		side: "host"
 	},
-	{
-		service: "fs",
-		feature: "the platform filesystem the evolution-io-fs backend maps the seam onto (locks + writeText(expected) version CAS)",
-		side: "host"
-	},
 	{
 		service: "hmr",
 		feature: "the preset install read-merge-write commit (the platform HMR lock serializes it)",
@@ -6614,11 +6132,6 @@ const PLATFORM_SERVICE_PROBES = Object.freeze([
 		feature: "the storage-domain state provider",
 		side: "host"
 	},
-	{
-		service: "subagents",
-		feature: "spawning review and maintenance subagents",
-		side: "host"
-	},
 	{
 		service: "systemPrompt",
 		feature: "the protected-skills prompt variable",
@@ -6628,11 +6141,6 @@ const PLATFORM_SERVICE_PROBES = Object.freeze([
 		service: "tools",
 		feature: "tool registration and the guard seam",
 		side: "host"
-	},
-	{
-		service: "webServer",
-		feature: "the skill-history panel routes",
-		side: "host"
 	}
 ]);
 /**
@@ -7019,6 +6527,15 @@ const DISPATCH_EVENT_TYPES = [
 	PTC_DISPATCH_EVENT
 ];
 /**
+* Model-visible session frames: the message types plus the ONE dispatch vocabulary above.
+* Consumers classify through this list instead of naming event literals (rule N11).
+*/
+const MODEL_SESSION_EVENT_TYPES = [
+	"user/message",
+	"assistant/message",
+	...DISPATCH_EVENT_TYPES
+];
+/**
 * \`TypeError\` thrown when a payload that claims to be a dispatch event
 * violates the platform's event declaration. Named so a deployment can tell this
 * refusal apart from a generic failure in a log line.
@@ -9352,6 +8869,16 @@ function staleRouteStubs(indexes) {
 * re-probes after its copies so a mid-copy writer demotes to `skipped`
 * (OPT-07); the movers' probe→rename window is owned by the io.ts protocol.
 */
+/**
+* The CLASS boundary default authority (G1/1.1, Stage 2).
+*
+* The FACTORY (newSkillLibrary) requires an explicit authority and the v35 A6 register pins every
+* production construction, so a production caller cannot omit one. The class is the INTERNAL
+* boundary: arch rule N7 forbids constructing it directly in production, while ~200 test fixtures do
+* exactly that and ARE the operator, so an omitted authority reads as foreground here - named and
+* stated instead of silent.
+*/
+const CLASS_DEFAULT_AUTHORITY = authorityFrom({ origin: "foreground" });
 /** 0.3.16 (S1.13, T-6): the pointer-line prefix written into a body when a
 * section is moved to references/ — single literal, both restructure and
 * append-mode consolidation emit the same discoverability line. */
@@ -9721,6 +9248,28 @@ function planRestructureSections(body, moves) {
 		}))
 	};
 }
+/**
+* WHY MODULE SCOPE (S4.4): the serial queue must be shared ACROSS SkillLibrary instances. Six services
+* each build their own store over the SAME skill root (tool face / curator face / review face), and a
+* per-instance queue - which is what `this.serial = makeSerialQueue()` was - let two of them run
+* read->plan->commit against one tree at the same time. The mutex cannot live on an instance because
+* instances share nothing (S2-02, G1/1.4); it cannot be a file lock either, because the point is to
+* order IN-PROCESS phases before the io transact layer sees them. Keyed by root: two roots are
+* independent trees and must not wait on each other.
+*/
+const ROOT_SERIAL = /* @__PURE__ */ new Map();
+/** The ONE queue for a skill root, created on first use (module scope, see above).
+* @param root - the resolved skill root; the key, so two spellings of one directory share a queue.
+* @returns the queue every instance over this root serializes through.
+*/
+function serialForRoot(root) {
+	const key = resolve(root);
+	const existing = ROOT_SERIAL.get(key);
+	if (existing !== void 0) return existing;
+	const created = makeSerialQueue();
+	ROOT_SERIAL.set(key, created);
+	return created;
+}
 var SkillLibrary = class {
 	root;
 	limits;
@@ -9739,20 +9288,24 @@ var SkillLibrary = class {
 	/** V10-03 (P2-18): see the constructor's threatExemptLabels. Empty by
 	* default — the strict ANY-hit-blocks policy is unchanged. */
 	threatExemptLabels;
+	/** G1/1.1: default authority; a call may override (origin is per-invocation). */
+	/** G1/1.1/Stage 2: the ONE default every mutator reads. Per-call overrides still win. */
+	authority;
 	/** skill-history.ts: the content history is best-effort, so a failure must not be SILENT —
 	* but it is a deployment condition, not a per-write event, so it warns once per instance. */
 	historyWarned = false;
-	constructor(root = skillsRoot(), io = nodeEvolutionIo(), limits = DEFAULT_SKILL_LIMITS, onMutation, transact, threatExemptLabels) {
+	constructor(root = skillsRoot(), io = nodeEvolutionIo(), limits = DEFAULT_SKILL_LIMITS, onMutation, transact, threatExemptLabels, authority = CLASS_DEFAULT_AUTHORITY) {
 		this.root = root;
 		this.io = io;
 		this.limits = limits;
 		this.onMutation = onMutation;
 		this.threatExemptLabels = threatExemptLabels ?? [];
+		this.authority = authority;
 		this.transact = transact ?? (io.transact ? (ioLike, path, task) => {
 			const t = ioLike.transact;
 			return t ? t(path, task) : transactIo(ioLike, path, task);
 		} : void 0);
-		this.serial = makeSerialQueue();
+		this.serial = serialForRoot(this.root);
 	}
 	/**
 	* Run one single-file read-modify-write for a mutator. When `transact` was
@@ -9867,6 +9420,32 @@ var SkillLibrary = class {
 	* a swallowed error would silently downgrade the anchor to
 	* last-writer-wins.
 	*/
+	/**
+	* S4-01 (G0/0.7): the ONE three-state read the staging/replay anchors use.
+	*
+	* The two absorbing reads below absorb ENOENT/EISDIR and rethrow everything else, and the callers then
+	* each wrote their own try/catch to turn a rethrow into a decision - three near-copies of one posture,
+	* and the newest of them silently dropped the anchor instead of refusing. A read failure is its own
+	* state, so it gets its own name here: `unknown` with the reason, next to `present` and `absent`.
+	* Failing closed is then the CALLER decision (they refuse on unknown), not something each call site has
+	* to re-derive from a thrown error.
+	*/
+	async readSkillProbe(rawName) {
+		return await this.probeOf(() => this.read(rawName));
+	}
+	/** The support-file face of {@link readSkillProbe}. */
+	async readSupportFileProbe(rawName, filePath) {
+		return await this.probeOf(() => this.readSupportFile(rawName, filePath));
+	}
+	/** One place that turns the absorbing reads into three states. `null` is absent; a throw is unknown. */
+	async probeOf(read) {
+		try {
+			const value = await read();
+			return value === null ? probeAbsent() : probePresent(value);
+		} catch (error) {
+			return probeUnknown(probeReason(error));
+		}
+	}
 	async readSupportFile(name, filePath) {
 		const bad = this.badName(name, { allowReserved: true });
 		if (bad) throw new Error(bad);
@@ -9899,7 +9478,9 @@ var SkillLibrary = class {
 	}
 	async list(options = {}) {
 		const summaries = [];
-		for (const name of await listNames(this.root, this.io)) {
+		for (const entry of await this.io.list(this.root)) {
+			if (entry.startsWith(".")) continue;
+			const name = entry;
 			const dir = this.dirOf(name);
 			let md;
 			try {
@@ -9996,7 +9577,7 @@ var SkillLibrary = class {
 	* (P1-1/v14 — the name guard lives HERE as well as at every entry point, so
 	* no caller can build a path from an unvalidated name).
 	*/
-	async writeProtection(rawName, origin = "foreground") {
+	async writeProtection(rawName, origin = this.authority.origin) {
 		const name = rawName.trim();
 		const badName = this.badName(name);
 		if (badName) return badName;
@@ -10274,7 +9855,7 @@ var SkillLibrary = class {
 	* protective mutation, so the autonomous pipeline may never call it. The
 	* marker write is the only state change; content is untouched.
 	*/
-	async setPinned(name, pinned, origin = "foreground") {
+	async setPinned(name, pinned, origin = this.authority.origin) {
 		return await this.serial(() => this.setPinnedCore(name, pinned, origin));
 	}
 	async setPinnedCore(name, pinned, origin) {
@@ -10329,7 +9910,7 @@ var SkillLibrary = class {
 			path: dir
 		};
 	}
-	async create(name, content, origin = "foreground") {
+	async create(name, content, origin = this.authority.origin) {
 		const normalized = name.trim();
 		return await this.serial(() => this.createCore(normalized, content, origin));
 	}
@@ -10456,7 +10037,7 @@ var SkillLibrary = class {
 			...norm.changed ? { normalizedFrontmatterFields: norm.fields } : {}
 		};
 	}
-	async update(rawName, content, origin = "foreground", anchor) {
+	async update(rawName, content, origin = this.authority.origin, anchor) {
 		const name = rawName.trim();
 		return await this.serial(() => this.updateCore(name, content, origin, anchor));
 	}
@@ -10545,7 +10126,7 @@ var SkillLibrary = class {
 			};
 		}, anchor !== void 0 ? () => anchorUnverifiable(name, null) : (error) => unreadableTarget(name, error));
 	}
-	async patch(rawName, oldString, newString, filePath = "", replaceAll = false, origin = "foreground") {
+	async patch(rawName, oldString, newString, filePath = "", replaceAll = false, origin = this.authority.origin) {
 		const name = rawName.trim();
 		return await this.serial(() => this.patchCore(name, oldString, newString, filePath, replaceAll, origin));
 	}
@@ -10767,7 +10348,7 @@ var SkillLibrary = class {
 		if (typeof name !== "string") return false;
 		return name !== "" && name !== "." && name !== ".." && !name.includes("/") && !name.includes("\\") && basename(name) === name;
 	}
-	async archive(rawName, options = {}) {
+	async archive(rawName, options = {}, origin = this.authority.origin) {
 		const name = rawName.trim();
 		const badName = this.badName(name, { allowReserved: true });
 		if (badName) return {
@@ -10834,7 +10415,7 @@ var SkillLibrary = class {
 		try {
 			await this.io.writeText(join(dest, ".archive-name"), `${name}\n`);
 		} catch {}
-		await this.audit(name, "archive", md, null, reason);
+		await this.audit(name, "archive", md, null, reason, void 0, void 0, void 0, origin);
 		this.notifyMutation({
 			action: "archive",
 			name,
@@ -10934,7 +10515,7 @@ var SkillLibrary = class {
 	* still refuses, and the refusal names it. The archived source keeps whatever
 	* the body did not need.
 	*/
-	async consolidate(target, sources, origin = "foreground", options = {}) {
+	async consolidate(target, sources, origin = this.authority.origin, options = {}) {
 		const targetName = target.trim();
 		const normalizedSources = [...new Set(sources.map((name) => name.trim()))].filter((name) => name !== targetName);
 		const mode = options.mode ?? "append";
@@ -11128,7 +10709,7 @@ var SkillLibrary = class {
 	* support-directory links is refused (those links' files stay behind in the
 	* same package; the moved text belongs in references/ beside them).
 	*/
-	async restructure(rawName, moves, origin = "foreground") {
+	async restructure(rawName, moves, origin = this.authority.origin) {
 		const name = rawName.trim();
 		return await this.serial(() => this.restructureCore(name, moves, origin));
 	}
@@ -11345,7 +10926,7 @@ var SkillLibrary = class {
 			};
 			return {
 				ok: false,
-				message: `目录树变更失败：${reason}。回滚无法恢复 ${stuck.join(", ")}：请从 .backups 快照恢复这些目标（或重新应用这次变更）。`
+				message: `目录树变更失败：${reason}。回滚无法恢复 ${stuck.join(", ")}：可恢复性由当前快照决定：${await this.snapshotRecoveryAvailability()} —— 若上面不是「最新快照」，请重新应用这次变更。`
 			};
 		}
 		const unitId = plan.unitId ?? "u-" + Date.now().toString(36) + "-" + (nextUnitSeq += 1).toString(36);
@@ -11384,7 +10965,7 @@ var SkillLibrary = class {
 	* recoverability: archival never deletes, and this is the control-plane
 	* path back. The `.archive-reason` marker is dropped on restore.
 	*/
-	async restoreFromArchive(rawName) {
+	async restoreFromArchive(rawName, origin = this.authority.origin) {
 		const name = rawName.trim();
 		const bad = this.badName(name, { allowReserved: true });
 		if (bad) return {
@@ -11450,7 +11031,7 @@ var SkillLibrary = class {
 			};
 			return {
 				ok: false,
-				message: `.archive 里没有「${name}」对应的 frontmatter 名，但有 ${unreadable.length} 个名字相似的归档项：${unreadable.join(", ")}。这些归档项没有可读的 SKILL.md（或名字对不上），按名字恢复无法区分它们：请把目录改成技能名后再次恢复，或改用快照恢复。`
+				message: `.archive 里没有「${name}」对应的 frontmatter 名，但有 ${unreadable.length} 个名字相似的归档项：${unreadable.join(", ")}。这些归档项没有可读的 SKILL.md（或名字对不上），按名字恢复无法区分它们：请把目录改成技能名后再次恢复；快照这条路的当前状态是：${await this.snapshotRecoveryAvailability()}。`
 			};
 		}
 		const source = join(archiveRoot, chosen);
@@ -11472,7 +11053,7 @@ var SkillLibrary = class {
 		for (const marker of [".archive-reason", ".archive-name"]) if (await this.io.exists(join(dest, marker))) await this.io.remove(join(dest, marker));
 		const restoredProbe = await probeText(this.io, join(dest, "SKILL.md"));
 		if (isUnknown(restoredProbe)) console.warn(`evolution-skill-store: the restored SKILL.md of "${name}" could not be read back (${restoredProbe.reason}); the restore is recorded without after-bytes`);
-		await this.audit(name, "restore", null, isPresent(restoredProbe) ? restoredProbe.value : null, `restored from ${source}`);
+		await this.audit(name, "restore", null, isPresent(restoredProbe) ? restoredProbe.value : null, `restored from ${source}`, void 0, void 0, void 0, origin);
 		this.notifyMutation({
 			action: "restore",
 			name,
@@ -11484,7 +11065,7 @@ var SkillLibrary = class {
 			path: dest
 		};
 	}
-	async writeSupportFile(rawName, filePath, content, origin = "foreground", anchor) {
+	async writeSupportFile(rawName, filePath, content, origin = this.authority.origin, anchor) {
 		const name = rawName.trim();
 		return await this.serial(() => this.writeSupportFileCore(name, filePath, content, origin, anchor));
 	}
@@ -11568,7 +11149,7 @@ var SkillLibrary = class {
 			};
 		}, anchor !== void 0 ? () => anchorUnverifiable(name, filePath) : (error) => unreadableTarget(name + "/" + filePath, error));
 	}
-	async removeSupportFile(rawName, filePath, origin = "foreground", anchor, unitId) {
+	async removeSupportFile(rawName, filePath, origin = this.authority.origin, anchor, unitId) {
 		const name = rawName.trim();
 		return await this.serial(() => this.removeSupportFileCore(name, filePath, origin, anchor, unitId));
 	}
@@ -11827,6 +11408,22 @@ var SkillLibrary = class {
 		}
 	}
 	/** Keep only the newest N snapshots (Hermes keep=5 parity); older ones are removed outright. */
+	/**
+	* G3/3.4: can a snapshot actually be used right now?
+	*
+	* The recovery messages used to promise "restore it from a snapshot" without asking whether a usable
+	* snapshot exists (audit S1-01: the message promised recoverability from a chain that is five deep and
+	* whose newest member held 9 of 35 skills). Three states, like every other reading here: a fragment
+	* naming the usable snapshot, a fragment saying there is none, or a fragment saying the directory could
+	* not be read - the caller embeds whichever it gets, so the sentence is generated by the capability.
+	*/
+	async snapshotRecoveryAvailability() {
+		const listed = await this.listSnapshots();
+		if (isUnknown(listed)) return "快照目录读不出来（" + listed.reason + "）";
+		const latest = isPresent(listed) ? listed.value[0] : void 0;
+		if (!latest) return "当前没有可用快照";
+		return "最新快照 " + latest.path;
+	}
 	async retainSnapshots(keep) {
 		const listed = await this.listSnapshots();
 		if (isUnknown(listed)) {
@@ -11990,12 +11587,15 @@ var SkillLibrary = class {
 			}
 		}
 		const restoresSuppressed = manifest.sidecars.includes(".curator-suppressed.json");
-		for (const entry of rootEntries) {
-			if (entry === ".archive" || entry === ".backups" || entry === ".mutations.json") continue;
-			if (entry === ".history") continue;
-			if (entry === ".curator-suppressed.json" && restoresSuppressed) continue;
-			await this.io.remove(join(this.root, entry));
-		}
+		const declared = new Set([...manifest.skills, ...manifest.sidecars]);
+		const doomed = rootEntries.filter((entry) => {
+			if (entry === ".archive" || entry === ".backups" || entry === ".mutations.json") return false;
+			if (entry === ".history") return false;
+			if (entry === ".curator-suppressed.json" && restoresSuppressed) return false;
+			return !declared.has(entry);
+		});
+		if (doomed.length > 0) console.warn("skill-store: snapshot restore will delete " + String(doomed.length) + " live entr(y|ies) the snapshot does not declare: " + doomed.join(", "));
+		for (const entry of doomed) await this.io.remove(join(this.root, entry));
 		for (const name of manifest.skills) await this.io.copy(join(snapshotPath, name), join(this.root, name));
 		for (const sidecar of manifest.sidecars) await this.io.copy(join(snapshotPath, sidecar), join(this.root, sidecar));
 		{
@@ -12009,10 +11609,300 @@ var SkillLibrary = class {
 	}
 };
 function newSkillLibrary(options) {
-	const { config, io, limits, ctx, transact, threatExemptLabels } = options;
+	const { config, io, limits, ctx, transact, threatExemptLabels, authority } = options;
 	return new SkillLibrary(resolveSkillsRoot(config ?? {}), io, limits, ctx ? (event) => {
 		ctx.emit("evolution/skill-mutated", event);
-	} : void 0, transact, [...threatExemptLabels ?? []]);
+	} : void 0, transact, [...threatExemptLabels ?? []], authority);
+}
+//#endregion
+//#region lib/types/store-ledger.js
+/**
+* G3/3.2 (audit 06-performance.md 接缝 C): ONE declaration for every bounded store.
+*
+* Before this file the family had eight retention rules scattered across four packages and no place
+* that could answer "how long does this record live under the current policy" (S1.md 4.3): six caps
+* were named constants, three lived inline (snapshots 5, reports 20/20/10, archive 365d). Each entry
+* below states its bound AND the code that declares it, so a gate can compare the two sets.
+*
+* `declare` is an ARRAY because one store may have several declaration sites (the report buckets are
+* kept by two packages). The `inline` branch matches a CODE SNIPPET rather than a line number: line
+* numbers rot on every edit above them, a snippet survives (and a snippet that stops matching is the
+* detector the gate wants). No naming convention is assumed anywhere - that is the whole point of a
+* ledger: the list IS the declaration.
+*/
+/** The one list. A new bounded store that is not registered here is what the G3 gate refuses. */
+const STORE_LEDGER = [
+	{
+		id: "archive-entries",
+		owner: "evolution-core",
+		unit: "entries",
+		bound: "365 days, report-only by default (the removal policy is report, not delete)",
+		cutoff: "archivedAt older than the retention window",
+		trigger: "run-end",
+		artifact: "count of .archive entries and their ages",
+		declare: [{
+			kind: "inline",
+			file: "packages/evolution-core/src/skill-store.ts",
+			contains: "ARCHIVE_RETENTION_DAYS = 365",
+			value: "365 days"
+		}, {
+			kind: "named",
+			module: "evolution-core/src/limits.ts",
+			name: "DEFAULT_ARCHIVE_RETENTION_POLICY",
+			value: "report"
+		}]
+	},
+	{
+		id: "skill-snapshots",
+		owner: "evolution-core",
+		unit: "entries",
+		bound: "5 snapshots",
+		cutoff: "oldest snapshot beyond the keep window",
+		trigger: "run-end",
+		artifact: "snapshot count and total bytes",
+		declare: [{
+			kind: "inline",
+			file: "packages/evolution-core/src/skill-store.ts",
+			contains: "retainSnapshots(5)",
+			value: "5"
+		}]
+	},
+	{
+		id: "skill-versions",
+		owner: "evolution-core",
+		unit: "entries",
+		bound: "20 versions per skill",
+		cutoff: "history index entries beyond versionKeep",
+		trigger: "write",
+		artifact: "history index length per skill",
+		declare: [{
+			kind: "named",
+			module: "evolution-core/src/constants.ts",
+			name: "DEFAULT_SKILL_VERSION_KEEP",
+			value: 20
+		}]
+	},
+	{
+		id: "pending-resolved",
+		owner: "evolution-state-storage",
+		unit: "entries",
+		bound: "200 resolved pending records",
+		cutoff: "resolved records beyond the cap",
+		trigger: "write",
+		artifact: "resolved record count",
+		declare: [{
+			kind: "named",
+			module: "evolution-state-storage/src/constants.ts",
+			name: "PENDING_RESOLVED_CAP",
+			value: 200
+		}]
+	},
+	{
+		id: "review-session",
+		owner: "evolution-state-storage",
+		unit: "entries",
+		bound: "500 review session rows",
+		cutoff: "rows beyond the session cap",
+		trigger: "write",
+		artifact: "review state row count",
+		declare: [{
+			kind: "named",
+			module: "evolution-state-storage/src/constants.ts",
+			name: "REVIEW_STATE_SESSION_CAP",
+			value: 500
+		}]
+	},
+	{
+		id: "reports",
+		owner: "evolution-commands",
+		unit: "files",
+		bound: "20/20/10 files across the three report buckets",
+		cutoff: "reports beyond each bucket keep",
+		trigger: "run-end",
+		artifact: "report file count per bucket",
+		declare: [{
+			kind: "inline",
+			file: "packages/evolution-commands/src/index.ts",
+			contains: "maintain-",
+			value: "20"
+		}, {
+			kind: "inline",
+			file: "packages/evolution-curator/src/index.ts",
+			contains: "errorKeep",
+			value: "10"
+		}]
+	},
+	{
+		id: "event-archives",
+		owner: "evolution-core",
+		unit: "files",
+		bound: "10 archived event logs",
+		cutoff: "archives beyond the retention count",
+		trigger: "write",
+		artifact: "event archive count",
+		declare: [{
+			kind: "named",
+			module: "evolution-core/src/evolution-events.ts",
+			name: "EVENT_LOG_RETAIN_ARCHIVES",
+			value: 10
+		}]
+	},
+	{
+		id: "run-records",
+		owner: "evolution-core",
+		unit: "entries",
+		bound: "50 run records",
+		cutoff: "runs beyond the record cap",
+		trigger: "write",
+		artifact: "runs.json record count",
+		declare: [{
+			kind: "named",
+			module: "evolution-core/src/run-registry.ts",
+			name: "DEFAULT_RUN_RECORDS",
+			value: 50
+		}]
+	},
+	{
+		id: "support-reads",
+		owner: "evolution-core",
+		unit: "entries",
+		bound: "200 support_reads keys",
+		cutoff: "keys beyond the read-path cap",
+		trigger: "write",
+		artifact: "usage sidecar key count",
+		declare: [{
+			kind: "named",
+			module: "evolution-core/src/usage.ts",
+			name: "MAX_SUPPORT_READ_PATHS",
+			value: 200
+		}]
+	}
+];
+//#endregion
+//#region lib/types/reachability.js
+/**
+* G3/3.4: the READ-ONLY reachability reconciliation.
+*
+* Three resource domains have grown past their owners' view: content blobs whose index entries were
+* trimmed away (skill-history: "Trimming drops INDEX entries; orphan blobs stay"), report files no run
+* record points at, and snapshot directories whose manifest holds almost nothing. The audit measured
+* them once (233 blobs / 11.40 MiB / 75.4% unreachable; 52 orphan report .md; 4/5 empty snapshot trees,
+* the newest holding 9 of 35 skills); this module answers the same three questions, from the tree in
+* front of it, and NOTHING ELSE: it deletes nothing, repairs nothing, and adds no timer.
+*
+* Every path is a parameter. The reconciliation must not grow its own idea of where a domain lives -
+* the callers already know (historyRoot / the reports directory / the snapshot root), and a second
+* guess here would be a second owner of that fact.
+*/
+const HISTORY_BASELINE = "233 blobs / 11.40 MiB unreachable (75.4%)";
+const REPORTS_BASELINE = "52 orphan report .md";
+const BACKUPS_BASELINE = "4/5 empty snapshot trees; the newest held 9/35 skills";
+/** Every sha256 any skill index references, across the whole history root. */
+async function referencedBlobs(io, historyRoot) {
+	const referenced = /* @__PURE__ */ new Set();
+	const skillsDir = join(historyRoot, "skills");
+	const namesProbe = await probeList(io, skillsDir);
+	if (isUnknown(namesProbe)) return void 0;
+	const names = isPresent(namesProbe) ? namesProbe.value : [];
+	for (const name of names) {
+		const probe = await probeText(io, join(skillsDir, name, "index.json"));
+		if (isUnknown(probe)) return void 0;
+		if (!isPresent(probe)) continue;
+		for (const match of probe.value.matchAll(/[a-f0-9]{64}/g)) referenced.add(match[0]);
+	}
+	return referenced;
+}
+/**
+* The history domain: blobs on disk minus the blobs the indexes still reference.
+* @param io - the tree reader.
+* @param historyRoot - the history root (`.history`), passed in, never guessed.
+* @returns the reading, with the audit baseline quoted for comparison.
+*/
+async function historyReachability(io, historyRoot) {
+	const blobsProbe = await probeList(io, join(historyRoot, "blobs"));
+	const referenced = await referencedBlobs(io, historyRoot);
+	if (isUnknown(blobsProbe) || referenced === void 0) return {
+		domain: "history.blobs",
+		unit: "bytes",
+		total: 0,
+		reachable: 0,
+		unreachable: 0,
+		baseline: HISTORY_BASELINE,
+		unmeasured: "a blob listing or an index read failed; this domain was not measured"
+	};
+	const blobs = isPresent(blobsProbe) ? blobsProbe.value : [];
+	const reachable = blobs.filter((blob) => referenced.has(blob)).length;
+	return {
+		domain: "history.blobs",
+		unit: "bytes",
+		total: blobs.length,
+		reachable,
+		unreachable: blobs.length - reachable,
+		baseline: HISTORY_BASELINE
+	};
+}
+/**
+* The reports domain: files no run record points at. A record WITHOUT a `resultRef` still owns the
+* conventional path (`reports/maintain-<id>.json`), so that path counts as reachable - counting only
+* explicit refs would report compliant files as orphans and the number could never match the baseline.
+* @param io - the tree reader.
+* @param reportsDir - the reports directory, passed in.
+* @param runIds - every run id the run records carry.
+* @param resultRefs - every explicit resultRef those records carry.
+*/
+async function reportsReachability(io, reportsDir, runIds, resultRefs) {
+	const listed = await probeList(io, reportsDir);
+	if (isUnknown(listed)) return {
+		domain: "reports.files",
+		unit: "files",
+		total: 0,
+		reachable: 0,
+		unreachable: 0,
+		baseline: REPORTS_BASELINE,
+		unmeasured: "the reports directory could not be listed; this domain was not measured"
+	};
+	const files = isPresent(listed) ? listed.value : [];
+	const reachableNames = /* @__PURE__ */ new Set();
+	for (const ref of resultRefs) reachableNames.add(ref.slice(ref.lastIndexOf("/") + 1));
+	for (const id of runIds) reachableNames.add("maintain-" + id + ".json");
+	const reachable = files.filter((file) => reachableNames.has(file)).length;
+	return {
+		domain: "reports.files",
+		unit: "files",
+		total: files.length,
+		reachable,
+		unreachable: files.length - reachable,
+		baseline: REPORTS_BASELINE
+	};
+}
+/**
+* The backups domain: snapshot trees and how much each holds. `skillsPerSnapshot` is measured by the
+* caller (it already reads manifests); an empty tree is one whose manifest lists no skill.
+* @param io - the tree reader.
+* @param backupsRoot - the snapshot root, passed in.
+* @param skillsPerSnapshot - the caller's manifest reading, one entry per snapshot directory.
+*/
+async function backupsReachability(io, backupsRoot, skillsPerSnapshot) {
+	const listed = await probeList(io, backupsRoot);
+	if (isUnknown(listed)) return {
+		domain: "backups.trees",
+		unit: "files",
+		total: 0,
+		reachable: 0,
+		unreachable: 0,
+		baseline: BACKUPS_BASELINE,
+		unmeasured: "the snapshot root could not be listed; this domain was not measured"
+	};
+	const dirs = isPresent(listed) ? listed.value : [];
+	const empty = skillsPerSnapshot.filter((count) => count === 0).length;
+	return {
+		domain: "backups.trees",
+		unit: "files",
+		total: dirs.length,
+		reachable: dirs.length - empty,
+		unreachable: empty,
+		baseline: BACKUPS_BASELINE
+	};
 }
 //#endregion
 //#region lib/types/params.js
@@ -13983,4 +13873,51 @@ function foldUntrustedLines(text, limit) {
 	return limit > 0 ? marked.slice(0, limit) : marked;
 }
 //#endregion
-export { AGENT_PRESET_PACKAGE, AGENT_PRESET_ROOT_HINT, AUTHORING_DESCRIPTION_BAR, AUTHORING_SPLIT_LINE_CHARS, BASELINE_ACTION, CITATION_SUPPORT_DIRS, COMBINED_REVIEW_PLAN_PROMPT, COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CONTENT_SPLIT_HINT, COST_ASCII_TOKEN_HIGH, COST_ASCII_TOKEN_LOW, COST_CJK_TOKEN_HIGH, COST_CJK_TOKEN_LOW, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEDUP_MAX_PAIR_COMPARISONS, DEDUP_SIMILARITY_THRESHOLD, DEFAULT_ADMISSION, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_ARCHIVE_RETENTION_POLICY, DEFAULT_CITATION_POLICY, DEFAULT_CITATION_REF_BUDGET, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_BOOT_GRACE_SECONDS, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_CURATOR_MODEL, DEFAULT_CURATOR_REVIEW_MAX_TOKENS, DEFAULT_HEALTH_THRESHOLDS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MEMORY_REVIEW_MODEL, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_PROBE_TIMEOUT_MS, DEFAULT_REFERENCE_REWRITE_POLICY, DEFAULT_REVIEW_CONTEXT_MESSAGES, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_MESSAGE_CHARS, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_REVIEW_TIMEOUT_MS, DEFAULT_RUN_RECORDS, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_MODEL, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_SKILL_VERSION_KEEP, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_SUPPORT_FILE_CHAR_POLICY, DEFAULT_SUPPORT_READ_TOOL_NAMES, DEFAULT_THREAT_MAX_SCAN_CHARS, DEFAULT_USER_CHAR_LIMIT, DISPATCH_EVENT_TYPES, DRIFT_MAX_LINE_CHARS, DRIFT_SIGNALS_VERSION, DRIFT_SIGNAL_NOUNS, DSH_AUTHORING_STANDARDS, EMPTY_PATCH_SEED, ENTRY_DELIMITER, EVENT_ARCHIVE_PREFIX, EVENT_LOG_RETAIN_ARCHIVES, EVENT_LOG_ROTATE_AT, EVENT_LOG_VERSION, EVOLUTION_ERRORS, EVOLUTION_WRITE_TOOLS, EvolutionGateSet, FAMILY_SESSION_TOOL_NAMES, FORBIDDEN_CONTROL_KEYS, FUZZY_MAX_PATTERN_CHARS, FUZZY_MAX_WORK, HEALTH_STAMP_RE, HISTORY_DIR, HISTORY_INDEX_VERSION, HOOK_LINE_RE, INSTANCE_KEYS, KEEP_LINE_RE, LONG_RUNS, LOW_QUALITY_THRESHOLD, MAINTAIN_OUTPUT_INSTRUCTION, MAINTAIN_PROMPT, MAX_DESCRIPTION_LENGTH, MAX_REQUEST_BODY_BYTES, MAX_RESTRUCTURE_MOVES, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MAX_SUPPORT_READ_PATHS, MAX_TIMER_DELAY_MS, MEMORY_GUIDANCE_SECTION_ORDER, MEMORY_REVIEW_PROMPT, MIN_STAMP_BODY_CHARS, MUTATIONS_FILE_VERSION, MemoryStore, NAMESPACE_MIGRATIONS, NATIVE_CALL_EVENT, NATIVE_RESULT_EVENT, PARAM_ALIASES, PARAM_EXPOSURE, PARAM_GROUP_LABELS, PARAM_NAMESPACES, PATTERN_OVERLAP, PLATFORM_CATALOG_DESCRIPTION_DEFAULT, PLATFORM_ESTIMATE_CHARS_PER_TOKEN, PLATFORM_SERVICE_PROBES, POLICY_STAGE_DEFAULTS, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, PTC_DISPATCH_EVENT, PTC_DISPATCH_START_EVENT, QUALITY_WEIGHTS, READ_REQUIRED_ACTIONS, RESTRUCTURE_TARGET_RE, RETENTION_FEEDBACK_KEEP_RATIO, RETENTION_FEEDBACK_MIN_CHARS, RULES, RUNS_SCHEMA_VERSION, SKILLS_GUIDANCE, SKILLS_GUIDANCE_SECTION_ORDER, SKILL_ACTION_REQUIRED_FIELDS, SKILL_NAME_RE, SKILL_REVIEW_PLAN_PROMPT, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, SUMMARY_DUPLICATE_HINT_THRESHOLD, SUPPORT_DIRS, SUPPORT_SPRAWL_FILES, SUPPRESSED_FILE_VERSION, SkillLibrary, TEXT_DIFF_MAX_CHARS, TEXT_DIFF_MAX_LINES, THREAT_EXEMPTION_HINT, TOKEN_ASCII_WEIGHT, TOKEN_CJK_WEIGHT, ToolDispatchNormalizer, ToolDispatchPayloadError, UNTRUSTED_LINE_BREAK, UNTRUSTED_LINE_MARK, UPSTREAM_LIMIT_CHARS_PER_TOKEN, VERSION_SUMMARY_MAX_CHARS, absentHostServices, admissionVerdict, advanceReview, affinity, ageCopyKey, allowRowCollisions, anchorVerdict, appendEvolutionEvent, applyCuratorLifecycleFields, applyCuratorMetaFields, applyNamespaceMigration, applyReferenceRewrite, asRecord, assertDispatchPayload, assertSkillsRootAliasRetired, assessStructureHealth, atomicWriteFiles, authoringFeedback, basePresetPlugins, blobPath, bodyCost, buildCuratorRunReport, buildHealthBaseline, buildLearnPrompt, bumpPatch, bumpSupportRead, bumpUse, bumpView, callingScope, candidateSkills, canonicalWriteId, claimInstance, clampOnce, clampedNumber, classifyNamespaceMigration, clearReviewChannel, collectReadSkillNames, composePresetComposition, composePresetEntry, composePresetInsert, composePresetRow, compositionRowIds, computeDedupGroups, computeDriftSignals, computeLifecycleTransitions, computePrefixClusters, computeQualityScores, computeScopeView, contentHash, contentRetentionFeedback, countDispatches, countReferenceFiles, createGateSet, daysSinceIso, declaredReportStamp, denseBlockSequence, describeReferenceRewrite, diffFindings, dispatchKeyOf, dispatchStepOf, displayBodyOf, duplicateHeadings, elapsedSince, emptyRecord, entryTarget, errorText, evaluateThreat, eventsFile, evidenceKindIndex, evolutionActivityProjection, evolutionEventPayloadIssue, evolutionEvidenceProjection, evolutionHome, evolutionIoAdapter, evolutionReadsProjection, evolutionRoot, evolutionSignalsProjection, filterUnreadSkillOps, findDriftSignal, foldCuratorFields, foldToolDispatches, foldTurnEvent, foldTurnEvents, foldUntrustedLines, frontmatterBlock, frontmatterCatalogInvalid, fuzzyPatch, getRecord, h2Sections, historyIndexFile, historyRoot, identity, idleDays, initialTurnFold, installEvolutionProjections, instanceClaimKey, instanceClaimedWriteSites, instanceHolder, isAbsent, isBookkeepingFrame, isCommittedWarning, isDeprecatedParamId, isFileShapedPath, isLandmark, isLoopbackRequest, isMissingPath, isPresent, isProcessAlive, isProgramToolName, isRecord, isReviewChannelSession, isSkillReadToolName, isSkillToolName, isUnknown, isUnreadWrite, landmarkVerdict, latestActivityAt, latestVersionAt, lifecycleCandidate, lintBody, lintSkill, listDirectories, listEventArchives, liveBool, liveEnum, liveNumber, liveString, loadMutations, loadRowOverrides, loadSuppressedNames, loadUsage, loadVersionContent, loadVersions, makeSerialQueue, mapProbe, markAgentCreated, markReviewChannel, markerEntryName, memoryRoot, mergePresetRow, missingSupportPointers, mutateUsage, mutationsFile, narrowNameMatches, nearDuplicateSummaries, neutralizePromptVariables, newRunRegistry, newSkillLibrary, nextHistoryIndex, nodeEvolutionIo, normalizeFrontmatter, normalizeUsageRecord, normalizeVersionSummary, observeEvent, orderVersions, overlongLines, paramNamespace, paramRowId, paramSettingsId, parseCuratorNominations, parseEvolutionEvents, parseFrontmatter, parseHistoryIndex, partitionVersions, payloadText, persistedWriteSite, persistedWriteSites, pickWithPolicy, planNamespaceMigration, planReferenceRewrite, planRehoming, policyStageLimits, presetPatchText, presetRowBlock, presetRowBody, presetRowId, probeAbsent, probeDesktopScope, probeList, probeMtime, probePresent, probeReason, probeText, probeUnknown, projectionText, readDispatchSignal, readEvolutionEvents, readEvolutionTimeline, readHistoryIndex, readJsonBody, readJsonObject, readNumberParam, readParam, readingStats, recordMutation, recordVersions, redactSecrets, relatedSkillNames, releaseInstance, removePresetRow, renameWithRetry, renderCuratorReportMarkdown, renderLongRunTable, reportTime, reportsSweepLockTarget, resolveBasePresetPatch, resolveCitations, resolveExecOrigins, resolveOrigins, resolveParamId, resolveRootConfig, resolveSkillsRoot, resolveUnitMembers, resolveUnitMembersFromIndexes, restructureCandidates, retainEventArchives, retirementReport, reviewPrompt, rowBlockSpan, rowSiblingEnd, runsFile, saveSuppressedNames, saveUsage, scanBodyHooks, scanContentThreats, scanMemoryThreats, scanThreats, scopedProbeReport, sessionAudited, sessionEvidenceIndex, sessionLastEventTime, sessionReadNames, sessionReadSkillNames, sessionSeesFamilyTools, sessionTurnSignals, skillReadNameOf, skillRowCells, skillStateKey, skillsRoot, staleRouteStubs, supportFileReadOf, suppressedFile, sweepReports, sweepReviewChannelSessions, textDiffFacts, tokenLineFor, transactIo, transactTaskGuard, trimPatternBoundaries, trimTrailingBlankLines, unhookedSupportPointers, unitMembersAreComplete, unwrapLive, updateSuppressedNames, usageFile, usageObserved, userSetKeys, validateFrontmatter, validateRestructureTarget, valueOr, verifyPromptBundle, versionActionKind, versionRowCells, versionSummaryPrompt, versionTarget, vocabulary, writeDurableTmp, writeJson, writePathSymbols, yamlPlainScalarNeedsQuotes };
+//#region lib/types/diagnostics.js
+const DIAGNOSTICS_VIEW_SCHEMA_VERSION = 2;
+const DIAGNOSTICS_FACT_KEYS = [
+	"platform-line",
+	"family-version",
+	"install-form",
+	"preset-ids",
+	"readonly-contract",
+	"upgrade-order",
+	"fallback-map"
+];
+const DIAGNOSTICS_RUNTIME_KEYS = [
+	"subagent-channel",
+	"restricted-preset",
+	"host-surface",
+	"session-fold",
+	"platform-services",
+	"runs",
+	"platform-pairing",
+	"install-form-detected"
+];
+//#endregion
+//#region lib/types/platform-line.generated.js
+/** The frozen platform line this release targets (peers/engines/anchors derived from version+floor). */
+const PLATFORM_LINE = {
+	version: "0.2.1-rc.2",
+	floor: "0.2.1-rc.1",
+	previousAnchor: "0.2.0-rc.2",
+	peersRange: "^0.2.1-rc.1",
+	enginesRange: ">=0.2.1-rc.1 <0.2.2-0",
+	upstreamRef: "dsh-v0.2.1-rc.2"
+};
+//#endregion
+//#region lib/types/session-fold.js
+/** Frames the model authored/saw (the only frames evidence, reads and usage accounting may consume). */
+const MODEL_EVENT_TYPES = new Set(MODEL_SESSION_EVENT_TYPES);
+/** Classify one session event WITHOUT interpreting it (pure). */
+function classifySessionEvent(event) {
+	const type = typeof event.type === "string" ? event.type : "";
+	if (type.startsWith("plugin:")) return event.ignorable === true ? "plugin-record" : "unknown";
+	return MODEL_EVENT_TYPES.has(type) ? "model" : "unknown";
+}
+/** True when the event must be skipped by evidence/usage readers (tolerant, never fatal). */
+function isIgnorableEvent(event) {
+	return classifySessionEvent(event) !== "model";
+}
+//#endregion
+export { AUTHORING_DESCRIPTION_BAR, AUTHORING_SPLIT_LINE_CHARS, BASELINE_ACTION, CITATION_SUPPORT_DIRS, COMBINED_REVIEW_PLAN_PROMPT, COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CONTENT_SPLIT_HINT, COST_ASCII_TOKEN_HIGH, COST_ASCII_TOKEN_LOW, COST_CJK_TOKEN_HIGH, COST_CJK_TOKEN_LOW, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEDUP_MAX_PAIR_COMPARISONS, DEDUP_SIMILARITY_THRESHOLD, DEFAULT_ADMISSION, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_ARCHIVE_RETENTION_POLICY, DEFAULT_CITATION_POLICY, DEFAULT_CITATION_REF_BUDGET, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_BOOT_GRACE_SECONDS, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_CURATOR_MODEL, DEFAULT_CURATOR_REVIEW_MAX_TOKENS, DEFAULT_HEALTH_THRESHOLDS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MEMORY_REVIEW_MODEL, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_PROBE_TIMEOUT_MS, DEFAULT_REFERENCE_REWRITE_POLICY, DEFAULT_REVIEW_CONTEXT_MESSAGES, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_MESSAGE_CHARS, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_REVIEW_TIMEOUT_MS, DEFAULT_RUN_RECORDS, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_MODEL, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_SKILL_VERSION_KEEP, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_SUPPORT_FILE_CHAR_POLICY, DEFAULT_SUPPORT_READ_TOOL_NAMES, DEFAULT_THREAT_MAX_SCAN_CHARS, DEFAULT_USER_CHAR_LIMIT, DEFAULT_WRITE_CONFIRM_MODE, DEFAULT_WRITE_CONFIRM_TIMEOUT_SECONDS, DIAGNOSTICS_FACT_KEYS, DIAGNOSTICS_RUNTIME_KEYS, DIAGNOSTICS_VIEW_SCHEMA_VERSION, DISPATCH_EVENT_TYPES, DRIFT_MAX_LINE_CHARS, DRIFT_SIGNALS_VERSION, DRIFT_SIGNAL_NOUNS, DSH_AUTHORING_STANDARDS, ENTRY_DELIMITER, EVENT_ARCHIVE_PREFIX, EVENT_LOG_RETAIN_ARCHIVES, EVENT_LOG_ROTATE_AT, EVENT_LOG_VERSION, EVOLUTION_ERRORS, EVOLUTION_PRESET_IDS, EVOLUTION_WRITE_TOOLS, EvolutionGateSet, FAMILY_SESSION_TOOL_NAMES, FORBIDDEN_CONTROL_KEYS, FUZZY_MAX_PATTERN_CHARS, FUZZY_MAX_WORK, HEALTH_STAMP_RE, HISTORY_DIR, HISTORY_INDEX_VERSION, HOOK_LINE_RE, HOST_ROUTES, INSTANCE_KEYS, KEEP_LINE_RE, LONG_RUNS, LOW_QUALITY_THRESHOLD, MAINTAINER_PRESET_ID, MAINTAIN_OUTPUT_INSTRUCTION, MAINTAIN_PROMPT, MAX_DESCRIPTION_LENGTH, MAX_REQUEST_BODY_BYTES, MAX_RESTRUCTURE_MOVES, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MAX_SUPPORT_READ_PATHS, MAX_TIMER_DELAY_MS, MEMORY_GUIDANCE_SECTION_ORDER, MEMORY_REVIEW_PROMPT, MIN_STAMP_BODY_CHARS, MODEL_SESSION_EVENT_TYPES as MODEL_SESSION_EVENTS, MODEL_SESSION_EVENT_TYPES, MUTATIONS_FILE_VERSION, MemoryStore, NAMESPACE_MIGRATIONS, NATIVE_CALL_EVENT, NATIVE_RESULT_EVENT, PARAM_ALIASES, PARAM_EXPOSURE, PARAM_GROUP_LABELS, PARAM_NAMESPACES, PATTERN_OVERLAP, PLATFORM_CATALOG_DESCRIPTION_DEFAULT, PLATFORM_ESTIMATE_CHARS_PER_TOKEN, PLATFORM_LINE, PLATFORM_SERVICE_PROBES, POLICY_STAGE_DEFAULTS, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, PTC_DISPATCH_EVENT, PTC_DISPATCH_START_EVENT, QUALITY_WEIGHTS, READ_REQUIRED_ACTIONS, RESTRICTED_PRESET_DISPLAY, RESTRICTED_TOOLS_ROW_ID, RESTRICTOR_MODULE, RESTRUCTURE_TARGET_RE, RETENTION_FEEDBACK_KEEP_RATIO, RETENTION_FEEDBACK_MIN_CHARS, REVIEWER_PRESET_ID, RULES, RUNS_SCHEMA_VERSION, SKILLS_GUIDANCE, SKILLS_GUIDANCE_SECTION_ORDER, SKILL_ACTION_REQUIRED_FIELDS, SKILL_NAME_RE, SKILL_REVIEW_PLAN_PROMPT, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, STORE_LEDGER, SUMMARY_DUPLICATE_HINT_THRESHOLD, SUPPORT_DIRS, SUPPORT_SPRAWL_FILES, SUPPRESSED_FILE_VERSION, SkillLibrary, TEXT_DIFF_MAX_CHARS, TEXT_DIFF_MAX_LINES, THREAT_EXEMPTION_HINT, TOKEN_ASCII_WEIGHT, TOKEN_CJK_WEIGHT, ToolDispatchNormalizer, ToolDispatchPayloadError, UNTRUSTED_LINE_BREAK, UNTRUSTED_LINE_MARK, UPSTREAM_LIMIT_CHARS_PER_TOKEN, VERSION_SUMMARY_MAX_CHARS, absentHostServices, admissionVerdict, advanceReview, affinity, ageCopyKey, allowRowCollisions, anchorVerdict, appendEvolutionEvent, applyCuratorLifecycleFields, applyCuratorMetaFields, applyNamespaceMigration, applyReferenceRewrite, asRecord, assertDispatchPayload, assertSkillsRootAliasRetired, assessStructureHealth, atomicWriteFiles, authoringFeedback, authorityFrom, backupsReachability, blobPath, bodyCost, buildCuratorRunReport, buildHealthBaseline, buildLearnPrompt, bumpPatch, bumpSupportRead, bumpUse, bumpView, callingScope, candidateSkills, canonicalWriteId, claimInstance, clampOnce, clampedNumber, classifyNamespaceMigration, classifySessionEvent, clearReviewChannel, collectReadSkillNames, computeDedupGroups, computeDriftSignals, computeLifecycleTransitions, computePrefixClusters, computeQualityScores, computeScopeView, contentHash, contentRetentionFeedback, countDispatches, countReferenceFiles, createGateSet, createSubagentChannel, daysSinceIso, declaredReportStamp, describeReferenceRewrite, diffFindings, dispatchKeyOf, dispatchStepOf, displayBodyOf, duplicateHeadings, elapsedSince, emptyRecord, entryTarget, errorText, evaluateThreat, eventsFile, evidenceKindIndex, evolutionActivityProjection, evolutionEventPayloadIssue, evolutionEvidenceProjection, evolutionHome, evolutionIoAdapter, evolutionReadsProjection, evolutionRoot, evolutionSignalsProjection, filterUnreadSkillOps, findDriftSignal, foldCuratorFields, foldToolDispatches, foldTurnEvent, foldTurnEvents, foldUntrustedLines, frontmatterBlock, frontmatterCatalogInvalid, fuzzyPatch, getRecord, h2Sections, historyIndexFile, historyReachability, historyRoot, hostSurface, identity, idleDays, initialTurnFold, installEvolutionProjections, instanceClaimKey, instanceClaimedWriteSites, instanceHolder, isAbsent, isBookkeepingFrame, isCommittedWarning, isDeprecatedParamId, isFileShapedPath, isIgnorableEvent, isLandmark, isMissingPath, isPresent, isProcessAlive, isProgramToolName, isRecord, isReviewChannelSession, isSkillReadToolName, isSkillToolName, isUnknown, isUnreadWrite, json, landmarkVerdict, latestActivityAt, latestVersionAt, lifecycleCandidate, lintBody, lintSkill, listEventArchives, liveBool, liveEnum, liveNumber, liveString, loadMutations, loadSuppressedNames, loadUsage, loadVersionContent, loadVersions, makeSerialQueue, mapProbe, markAgentCreated, markReviewChannel, markerEntryName, memoryRoot, methodNotAllowed, missingSupportPointers, mutateUsage, mutationsFile, narrowNameMatches, nearDuplicateSummaries, newRunRegistry, newSkillLibrary, nextHistoryIndex, nodeEvolutionIo, normalizeFrontmatter, normalizeUsageRecord, normalizeVersionSummary, observeEvent, orderVersions, overlongLines, paramNamespace, paramRowId, paramSettingsId, parseCuratorNominations, parseEvolutionEvents, parseFrontmatter, parseHistoryIndex, partitionVersions, payloadText, persistedWriteSite, persistedWriteSites, pickWithPolicy, planNamespaceMigration, planReferenceRewrite, planRehoming, policyStageLimits, probeAbsent, probeChannelState, probeList, probeMtime, probePresent, probeReason, probeText, probeUnknown, projectionText, protectedSkillNamesOf, readDispatchSignal, readEvolutionEvents, readEvolutionTimeline, readHistoryIndex, readJsonObject, readNumberParam, readParam, readingStats, recordMutation, recordVersions, redactSecrets, referencedBlobs, registerHostRoutes, relatedSkillNames, releaseInstance, renameWithRetry, renderCuratorReportMarkdown, renderLongRunTable, reportTime, reportsReachability, reportsSweepLockTarget, resolveCitations, resolveExecOrigins, resolveOrigins, resolveParamId, resolveRootConfig, resolveSkillsRoot, resolveUnitMembers, resolveUnitMembersFromIndexes, restructureCandidates, retainEventArchives, retirementReport, reviewPrompt, runWriteGates, runsFile, saveSuppressedNames, saveUsage, scanBodyHooks, scanContentThreats, scanMemoryThreats, scanThreats, scopeOfNearestManifest, scopedPackageName, scopedProbeReport, sessionAudited, sessionEvidenceIndex, sessionLastEventTime, sessionReadNames, sessionReadSkillNames, sessionSeesFamilyTools, sessionTurnSignals, skillReadNameOf, skillRowCells, skillStateKey, skillWriteGateContext, skillsRoot, staleRouteStubs, subagentChannelState, supportFileReadOf, suppressedFile, sweepReports, sweepReviewChannelSessions, textDiffFacts, tokenLineFor, transactIo, transactTaskGuard, trimPatternBoundaries, unhookedSupportPointers, unitMembersAreComplete, unwrapLive, updateSuppressedNames, usageFile, usageObserved, userSetKeys, validateFrontmatter, validateRestructureTarget, valueOr, verifyPromptBundle, versionActionKind, versionRowCells, versionSummaryPrompt, versionTarget, vocabulary, withTreeWrite, writeDurableTmp, writePathSymbols, yamlPlainScalarNeedsQuotes };