@lmzhen/dsh-evolution-core 0.3.51 → 0.3.53

package/lib/index.js

@@ -13,16 +13,19 @@ import { load } from "js-yaml";
 /**
 * Run `task` inside `io.transact` when the backend provides it; otherwise fall
 * back to a plain read → task → write/remove sequence (no cross-process lock —
-* callers keep their single-process serialize chain as the second layer).
+* callers keep their single-process serialize chain as the second layer). A
+* byte-identical task result skips the write (C-07 — parity with the
+* node backend's V5-03 short-circuit).
 */
 async function transactIo(io, path, task) {
 	if (io.transact) {
 		await io.transact(path, task);
 		return;
 	}
-	const next = await task(await io.readText(path));
+	const current = await io.readText(path);
+	const next = await task(current);
 	if (next === null) await io.remove(path);
-	else await io.writeText(path, next);
+	else if (next !== current) await io.writeText(path, next);
 }
 /** Lazy adapter over an IO provider registry, shared by every evolution consumer. */
 function evolutionIoAdapter(provider) {
@@ -64,11 +67,17 @@ function evolutionIoAdapter(provider) {
 * so `io.spec.ts` can drive the self-heal path deterministically.
 */
 const pendingSelfCleanup = /* @__PURE__ */ new Map();
+const RENAME_RETRY_BASE_MS = 50;
+const RENAME_RETRY_MAX_DELAY_MS = 800;
+const RENAME_RETRY_MAX_ATTEMPTS = 6;
 /**
 * Retry a rename that a peer is temporarily holding on Windows (EPERM/EBUSY):
-* a short 50ms backoff, at most 3 retries (~150ms budget), matching the
-* write-lock cadence. A non-transient code surfaces immediately. `fn` is the
-* rename primitive, injectable for deterministic tests.
+* exponential backoff (50ms doubling, capped at 800ms) with a ~2s total
+* budget, matching the write-lock cadence (C-28 — the old 3x50ms
+* budget turned a transient antivirus hold into a permanent write failure).
+* A non-transient code surfaces immediately; a persistent EPERM/EBUSY
+* rethrows with a pointer at the usual causes instead of a bare errno.
+* `fn` is the rename primitive, injectable for deterministic tests.
 *
 * @param tmp - the source path to rename.
 * @param target - the destination path.
@@ -82,24 +91,85 @@ async function renameWithRetry(tmp, target, fn = rename) {
 	} catch (error) {
 		const code = error?.code;
 		if (code !== "EPERM" && code !== "EBUSY") throw error;
-		if (retry >= 3) throw error;
-		await new Promise((resolve) => setTimeout(resolve, 50));
+		if (retry >= RENAME_RETRY_MAX_ATTEMPTS) {
+			const final = error;
+			final.message = `${final.message} (persisted after ${retry + 1} rename attempts over ~2s — the target may be held by another process or marked read-only; check antivirus, search indexers and file attributes)`;
+			throw final;
+		}
+		await new Promise((resolve) => setTimeout(resolve, Math.min(RENAME_RETRY_BASE_MS * 2 ** retry, RENAME_RETRY_MAX_DELAY_MS)));
 	}
 }
 /**
+* V10-06 (P1-1): the crash-durable tmp half of the upstream storage-json
+* `writeAtomic` protocol (storage-json/src/atomic.ts:24-40): exclusive-create
+* a same-directory tmp (`wx` — never clobbers), write, `handle.sync()`,
+* close, then hand the tmp to `commitTmp` for the rename. Without the fsync a
+* power loss could land the rename (metadata) before the data blocks and
+* leave an empty/truncated target — which the state-json E-9 quarantine then
+* amplifies into a permanent fail-loud. The tmp name keeps the
+* `<target>.<pid>.<rand>.tmp` shape so sweepStaleTmps keeps matching.
+* Mode parity note: no explicit mode is passed (upstream uses 0o600) — this
+* seam also writes operator-editable skill/memory files, so the previous
+* `writeFile` default (0o666 & ~umask) is deliberately preserved.
+* `openImpl` is injectable so the sync-failure regression test can drive a
+* failing `handle.sync()` deterministically.
+*/
+async function writeDurableTmp(target, content, openImpl = open) {
+	const tmp = `${target}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+	try {
+		const handle = await openImpl(tmp, "wx");
+		try {
+			await handle.writeFile(content, "utf8");
+			await handle.sync();
+		} finally {
+			await handle.close();
+		}
+		return tmp;
+	} catch (error) {
+		await rm(tmp, { force: true }).catch(() => {});
+		throw error;
+	}
+}
+/** V10-06 (P1-1): fsync a POSIX directory so a just-renamed entry is
+* crash-durable (upstream atomic.ts `fsyncDirectory`). */
+/* v8 ignore start -- Windows rejects O_RDONLY directory opens; POSIX coverage exercises this. */
+async function fsyncDirectory(path) {
+	if (process.platform === "win32") return;
+	const handle = await open(path, "r");
+	try {
+		await handle.sync();
+	} finally {
+		await handle.close();
+	}
+}
+/* v8 ignore stop */
+/**
 * F-366: commit a freshly-written tmp to its target inside the write lock. On a
 * still-failing rename the tmp is deleted immediately rather than left for the
 * (1h + dead-pid) sweep, so a live writer never leaks a tmp it abandoned.
+* V10-06 (P1-1): after a successful rename the parent directory is fsynced on
+* POSIX so the new directory entry itself is crash-durable (upstream atomic.ts
+* tail; Windows skips — it rejects O_RDONLY directory opens). A dir-fsync
+* failure propagates like upstream: the data is on disk, but the durability
+* contract failed loud.
 */
 async function commitTmp(tmp, target) {
 	try {
 		await renameWithRetry(tmp, target);
+		await fsyncDirectory(dirname(target));
 	} catch (error) {
 		await rm(tmp, { force: true }).catch(() => {});
 		throw error;
 	}
 }
-function nodeEvolutionIo() {
+/**
+* Build the Node IO backend. `lockAttempts` scales the write-lock retry budget
+* (attempts × 50ms); the default 40 (~2s, rc.69) covers production contention,
+* while contention TESTS on a loaded runner may raise it (e.g. 240 ≈ 12s) —
+* V10-06 integration: full-suite parallel load made 32-way takeover bursts
+* exceed the default budget and fail loud.
+*/
+function nodeEvolutionIo(lockAttempts = 40) {
 	const isMissing = (error) => {
 		const code = error?.code;
 		return code === "ENOENT" || code === "ENOTDIR";
@@ -114,6 +184,24 @@ function nodeEvolutionIo() {
 		}
 	};
 	/**
+	* V10-07 (P2-1): age threshold for taking over a lock whose body is TORN
+	* (non-empty, but the pid prefix does not parse to a positive integer). 1h:
+	* a legal hold (the ~2s lock/rename retry budgets, a slow task) never
+	* approaches minutes, so 1h fires only in the "torn write + creator long
+	* dead" scenario — far above any legitimate hold, far below "forever".
+	*/
+	const LOCK_TEAR_TAKEOVER_MS = 36e5;
+	/**
+	* V10-06 (P1-1 integration fix): a takeover TICKET must never be reclaimed
+	* while its (live) holder can still be committing — the C-28 rename retry
+	* budget is ~2.35s under AV/indexer pressure, so the former 1s ticket age
+	* threshold let a contender steal an in-flight ticket, double-enter the
+	* critical section and drop one RMW (observed as 5/6 increments under
+	* full-suite load). 5s = retry budget + comfortable margin; a DEAD holder's
+	* ticket is still reclaimed immediately via the pid probe.
+	*/
+	const TICKET_STALE_MS = 5e3;
+	/**
 	* Cross-process write lock (claw `withFileLock` parity): an O_EXCL lock file
 	* guards the atomic write. A >1s-old lock is taken over ONLY after probing
 	* the holder pid it carries (rc.66): a LIVE holder is never stolen, so a
@@ -144,11 +232,15 @@ function nodeEvolutionIo() {
 	* mtime over 1s is indistinguishable from a long task still executing in this
 	* process, and recycling that live lock would double-hold it. A failure to
 	* release in finally is recorded so the next write self-heals.
+	* V10-07 (P2-1): a third takeover shape — a TORN body (non-empty, no
+	* parseable pid) — is taken over after a wide 1h threshold with a
+	* console.warn; before this branch such a lock blocked every future writer
+	* forever.
 	*/
 	const withWriteLock = async (path, task) => {
 		const lock = `${path}.lock`;
 		let myClaim = "";
-		for (let attempt = 0; attempt < 40; attempt += 1) {
+		for (let attempt = 0; attempt < lockAttempts; attempt += 1) {
 			let lockHandle = null;
 			try {
 				myClaim = `${process.pid}:${randomBytes(4).toString("hex")}`;
@@ -179,21 +271,27 @@ function nodeEvolutionIo() {
 					}
 					const staleDead = Number.isInteger(holder) && holder > 0 && Date.now() - st.mtimeMs > 1e3 && !holderAlive;
 					const staleEmpty = holderContent === "" && Date.now() - st.mtimeMs > 1e3;
-					if (staleDead || staleEmpty) {
+					const staleCorrupt = holderContent !== "" && !(Number.isInteger(holder) && holder > 0) && Date.now() - st.mtimeMs > LOCK_TEAR_TAKEOVER_MS;
+					if (staleDead || staleEmpty || staleCorrupt) {
+						if (staleCorrupt) console.warn(`evolution-io: took over a corrupt write lock "${lock}" (body ${JSON.stringify(holderContent)} has no parseable pid, lock older than 1h) — a previous writer likely crashed mid-write`);
 						if (await readFile(lock, "utf8").catch(() => "") === holderContent) {
 							const ticket = `${lock}.next`;
 							try {
 								const ticketBody = await readFile(ticket, "utf8").catch(() => "");
 								const ticketMtime = await stat(ticket).then((s) => s.mtimeMs, () => 0);
 								const ticketHolder = Number(ticketBody.split(":")[0] ?? "");
-								if ((!Number.isInteger(ticketHolder) || ticketHolder <= 0 || !isAlive(ticketHolder) || Date.now() - ticketMtime > 1e3) && (ticketBody !== "" || Date.now() - ticketMtime > 1e3)) await rm(ticket, { force: true }).catch(() => {});
+								if ((!Number.isInteger(ticketHolder) || ticketHolder <= 0 || !isAlive(ticketHolder) || Date.now() - ticketMtime > TICKET_STALE_MS) && (ticketBody !== "" || Date.now() - ticketMtime > TICKET_STALE_MS)) await rm(ticket, { force: true }).catch(() => {});
 							} catch {}
 							try {
 								await writeFile(ticket, `${process.pid}:${randomBytes(4).toString("hex")}`, { flag: "wx" });
 							} catch {
 								continue;
 							}
-							if (await readFile(lock, "utf8").catch(() => "") === holderContent) await rm(lock, { force: true }).catch(() => {});
+							const verify = await readFile(lock, "utf8").catch(() => "");
+							if (verify === holderContent) {
+								const verifyHolder = Number(verify.split(":")[0] ?? "");
+								if (!(Number.isInteger(verifyHolder) && verifyHolder > 0 && isAlive(verifyHolder))) await rm(lock, { force: true }).catch(() => {});
+							}
 							await rm(ticket, { force: true }).catch(() => {});
 							continue;
 						}
@@ -207,13 +305,17 @@ function nodeEvolutionIo() {
 			try {
 				return await task();
 			} finally {
-				if (await readFile(lock, "utf8").catch(() => null) === myClaim) await rm(lock, { force: true }).catch(async () => {
+				if (await readFile(lock, "utf8").catch(() => null) === myClaim) await rm(lock, {
+					force: true,
+					maxRetries: 20,
+					retryDelay: 100
+				}).catch(async () => {
 					const body = await readFile(lock, "utf8").catch(() => "");
 					pendingSelfCleanup.set(lock, body);
 				});
 			}
 		}
-		throw new Error(`could not acquire write lock for ${path} after 40 attempts`);
+		throw new Error(`could not acquire write lock for ${path} after ${lockAttempts} attempts`);
 	};
 	/** 0.3.17 (E-8b): sweep tmp files a crashed writer left behind — same
 	* `<target>.<pid>.<rand>.tmp` shape, older than 1h AND held by a dead pid.
@@ -231,6 +333,7 @@ function nodeEvolutionIo() {
 		const prefix = `${base}.`;
 		const lockName = `${base}.lock`;
 		const ticketName = `${lockName}.next`;
+		const CORRUPT_SWEEP_AGE_MS = 168 * 36e5;
 		for (const name of entries) {
 			if (!name.startsWith(prefix) || name === lockName) continue;
 			if (!name.endsWith(".tmp")) {
@@ -244,6 +347,14 @@ function nodeEvolutionIo() {
 						const old = Date.now() - st.mtimeMs > 1e3;
 						if (dead || old) await rm(ticketPath, { force: true });
 					} catch {}
+					continue;
+				}
+				if (name.includes(".corrupt")) {
+					const corruptPath = join(dir, name);
+					try {
+						const st = await stat(corruptPath);
+						if (Date.now() - st.mtimeMs > CORRUPT_SWEEP_AGE_MS) await rm(corruptPath, { force: true });
+					} catch {}
 				}
 				continue;
 			}
@@ -269,9 +380,7 @@ function nodeEvolutionIo() {
 			await mkdir(dirname(path), { recursive: true });
 			await withWriteLock(path, async () => {
 				await sweepStaleTmps(path);
-				const tmp = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
-				await writeFile(tmp, content, "utf8");
-				await commitTmp(tmp, path);
+				await commitTmp(await writeDurableTmp(path, content), path);
 			});
 		},
 		async transact(path, task) {
@@ -291,9 +400,7 @@ function nodeEvolutionIo() {
 					return;
 				}
 				if (next === current) return;
-				const tmp = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
-				await writeFile(tmp, next, "utf8");
-				await commitTmp(tmp, path);
+				await commitTmp(await writeDurableTmp(path, next), path);
 			});
 		},
 		async remove(path) {
@@ -399,7 +506,7 @@ function normalizeUsageRecord(record) {
 	const base = emptyRecord();
 	if (!record || typeof record !== "object" || Array.isArray(record)) return base;
 	const raw = record;
-	const num = (value, fallback) => typeof value === "number" && Number.isFinite(value) ? value : fallback;
+	const num = (value, fallback) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : fallback;
 	const bool = (value, fallback) => typeof value === "boolean" ? value : fallback;
 	return {
 		created_by: typeof raw.created_by === "string" ? raw.created_by : null,
@@ -793,7 +900,7 @@ function renderCuratorReportMarkdown(report) {
 		""
 	].join("\n");
 }
-const NOMINATION_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
+const NOMINATION_NAME_RE = SKILL_NAME_RE;
 /**
 * Parse the curator LLM's YAML nomination block (consolidations + prunings).
 * Line-oriented and lenient by design: the LLM output is advisory, every name
@@ -1010,7 +1117,8 @@ function eventsFile(home) {
 	return join(home, "evolution", "events.json");
 }
 function isEventRecord(event) {
-	return typeof event === "object" && event !== null && typeof event.seq === "number";
+	const seq = event?.seq;
+	return typeof event === "object" && event !== null && typeof seq === "number" && Number.isFinite(seq);
 }
 /**
 * Parse an event log body. A missing file, a whitespace-only file (rc.69:
@@ -1029,13 +1137,22 @@ function isEventRecord(event) {
 * damaged record is the only loss (self-heal semantics, matching the usage
 * sidecar's per-field normalization on read).
 */
+/**
+* Post-parse v1 gate shared by parseEvolutionEvents and appendEvolutionEvent
+* (C-06, v10 audit: the append used to JSON.parse the same body a second time
+* through parseEvolutionEvents — double parse cost per append). A null parse
+* (missing/whitespace/unparsable body) reads as an empty timeline.
+*/
+function v1EventRecords(parsed) {
+	if (parsed === null) return [];
+	if (parsed.version !== void 0 && parsed.version !== 1) return [];
+	if (!Array.isArray(parsed.events)) return [];
+	return parsed.events.filter(isEventRecord);
+}
 function parseEvolutionEvents(raw) {
 	if (raw === null || raw.trim() === "") return [];
 	try {
-		const parsed = JSON.parse(raw);
-		if (parsed.version !== void 0 && parsed.version !== 1) return [];
-		if (!Array.isArray(parsed.events)) return [];
-		return parsed.events.filter(isEventRecord);
+		return v1EventRecords(JSON.parse(raw));
 	} catch {
 		return [];
 	}
@@ -1073,6 +1190,7 @@ async function listEventArchives(io, path) {
 async function appendEvolutionEvent(io, path, event, rotateAt = EVENT_LOG_ROTATE_AT) {
 	let assigned = 0;
 	let refuseMessage = "";
+	let parsedBody = null;
 	await transactIo(io, path, async (current) => {
 		if (current !== null && current.trim() !== "") {
 			let shape;
@@ -1081,6 +1199,7 @@ async function appendEvolutionEvent(io, path, event, rotateAt = EVENT_LOG_ROTATE
 			} catch {
 				return current;
 			}
+			parsedBody = shape;
 			if (shape.version !== void 0 && shape.version !== 1) {
 				const found = typeof shape.version === "number" || typeof shape.version === "string" ? String(shape.version) : "unknown";
 				const kind = typeof shape.version === "number" || typeof shape.version === "string" ? typeof shape.version : "unknown";
@@ -1088,7 +1207,7 @@ async function appendEvolutionEvent(io, path, event, rotateAt = EVENT_LOG_ROTATE
 				return current;
 			}
 		}
-		const nextEvents = await rotateIfDue(io, path, parseEvolutionEvents(current), rotateAt);
+		const nextEvents = await rotateIfDue(io, path, await rotateIfDue(io, path, v1EventRecords(parsedBody), rotateAt), rotateAt);
 		let maxSeq = nextEvents.reduce((max, entry) => Math.max(max, entry.seq), 0);
 		if (maxSeq === 0) for (const name of await listEventArchives(io, path)) maxSeq = Math.max(maxSeq, Number.parseInt(name.slice(7, name.length - 5), 10));
 		const record = {
@@ -1229,8 +1348,8 @@ async function readEvolutionTimeline(io, path) {
 * changes semantically: the bundle digest is the fail-closed signal for
 * review workers, so a stale id across deployments must be distinguishable.
 */
-const PROMPT_BUNDLE_VERSION = 14;
-const PROMPT_BUNDLE_ID = `dsh-evolution@14`;
+const PROMPT_BUNDLE_VERSION = 15;
+const PROMPT_BUNDLE_ID = `dsh-evolution@15`;
 const MEMORY_REVIEW_PROMPT = `[Auto-review — Memory]
 Review the conversation above and consider saving to memory if appropriate.
 
@@ -1477,6 +1596,18 @@ D. 库·整合纪律（计划形态约束）
 - 库规模无关：判据是事实与条款，不是库体量印象。
 - 信号机制疑问（阈值/检测原理）→ needs_human，不猜测机制。`;
 /**
+* One-line output instruction appended after the facts block in the maintain
+* subagent's prompt (persona carries the template, the prompt carries facts +
+* this instruction — one copy of the template in the model input, 011 v11
+* P3-4). F-16: this text used to be hardcoded in evolution-maintenance
+* orchestrate — a second model-facing prompt living OUTSIDE the bundle digest.
+* It now rides PROMPT_BUNDLE so the digest integrity check covers every
+* maintenance prompt. Adding the entry changes the bundle digest (the intended
+* fail-closed signal); PROMPT_BUNDLE_VERSION itself is owned by the core test
+* pin and stays untouched in this batch.
+*/
+const MAINTAIN_OUTPUT_INSTRUCTION = "按模板契约输出 JSON 维护计划（verdict/plan/notes）；除 skill 工具与维护模板外你无其他工具。";
+/**
 * System-prompt guidance section (Hermes `SKILLS_GUIDANCE`, DSH-adapted).
 * Registered as a system-prompt section by tool-skill-manage (it mounts
 * exactly when `skill_manage` is available — the DSH analogue of Hermes'
@@ -1505,12 +1636,12 @@ function sha256(text) {
 function createPromptBundle(prompts) {
 	const canonical = JSON.stringify({
 		id: PROMPT_BUNDLE_ID,
-		version: 14,
+		version: 15,
 		prompts: Object.fromEntries(Object.entries(prompts).sort())
 	});
 	return Object.freeze({
 		id: PROMPT_BUNDLE_ID,
-		version: 14,
+		version: 15,
 		prompts: Object.freeze({ ...prompts }),
 		sha256: sha256(canonical)
 	});
@@ -1524,13 +1655,14 @@ const PROMPT_BUNDLE = createPromptBundle({
 	curator: CURATOR_PROMPT,
 	completion: COMPLETION_SKILL_REVIEW_PROMPT,
 	maintain: MAINTAIN_PROMPT,
+	maintainOutput: MAINTAIN_OUTPUT_INSTRUCTION,
 	skillsGuidance: SKILLS_GUIDANCE
 });
 function verifyPromptBundle(bundle = PROMPT_BUNDLE) {
-	if (bundle.id !== PROMPT_BUNDLE_ID || bundle.version !== 14) return false;
+	if (bundle.id !== PROMPT_BUNDLE_ID || bundle.version !== 15) return false;
 	const canonical = JSON.stringify({
 		id: PROMPT_BUNDLE_ID,
-		version: 14,
+		version: 15,
 		prompts: Object.fromEntries(Object.entries(bundle.prompts).sort())
 	});
 	return bundle.sha256 === sha256(canonical);
@@ -1613,8 +1745,16 @@ function buildLearnPrompt(userRequest) {
 //#endregion
 //#region lib/types/state-store.js
 /**
-* Evolution home path helper: `$DSH_HOME/evolution` for plugin-owned sidecar
-* state (reports, activity store, feedback file, state-domain data).
+* Evolution home path helpers: the DSH root and `$DSH_HOME/evolution` for
+* plugin-owned sidecar state (reports, activity store, feedback file,
+* state-domain data).
+*
+* C-10: PATH HELPERS ONLY — despite the file name there is no store
+* here. Durable evolution state lives in the state stack (evolution-state over
+* evolution-state-json / -domain); skills and memories live in skill-store.ts
+* / memory-store.ts. The file name is kept deliberately: renaming it would
+* touch every family import for zero behavior change, and the audit records
+* the mismatch as known naming debt.
 */
 /**
 * DSH home root: `$DSH_HOME` or `~/.dsh`. Single source of the empty-string
@@ -1623,9 +1763,16 @@ function buildLearnPrompt(userRequest) {
 * V8-06 (0.3.47) extends the guard to whitespace (upstream home-paths:
 * `trim().length > 0` is the adoption test — `DSH_HOME=" "` must not produce
 * a sidecar under a relative "." path).
+* C-11: the adoption test and the RETURNED value now come from the
+* SAME trimmed source — the old form tested `trim()` but returned the raw
+* value, so `DSH_HOME=" /x "` was accepted AND persisted with literal spaces.
+* Known tradeoff vs upstream `resolveDshHome`: `~` is NOT expanded here —
+* documented as a deliberate difference in the v10 audit; revisit only if a
+* real deployment needs it.
 */
 function evolutionRoot(env = process.env) {
-	return env.DSH_HOME?.trim() ? env.DSH_HOME : join(homedir(), ".dsh");
+	const home = env.DSH_HOME?.trim();
+	return home ? home : join(homedir(), ".dsh");
 }
 /** Evolution home path helper: `$DSH_HOME/evolution` for plugin-owned sidecar
 * state (reports, activity store, feedback file, state-domain data). */
@@ -1943,6 +2090,15 @@ function scanContentThreats(text, maxScanChars = 65536, options = NO_SCAN_OPTION
 	if (!blocked) return null;
 	return `Blocked by security scan (${findings[0]?.label ?? "unknown"}). This content appears to contain potentially malicious instructions.`;
 }
+/**
+* V10-03 (P2-18): suffix the SkillLibrary/MemoryStore write gates append to a
+* block message — the hit label is already embedded by scanContentThreats /
+* scanMemoryThreats, this names the deployable self-heal path so the model
+* (or operator) can allowlist a known-benign label. The evolution-threat tool
+* channel deliberately does NOT append it: that channel has no
+* threatExemptLabels option to advertise.
+*/
+const THREAT_EXEMPT_HINT = " If this is a legitimate false positive, the deployment can allow its label via the threatExemptLabels store option.";
 //#endregion
 //#region lib/types/memory-store.js
 /**
@@ -2012,6 +2168,8 @@ var MemoryStore = class {
 	root;
 	maxFailures;
 	io;
+	/** V10-03 (P2-18): see MemoryStoreOptions.threatExemptLabels. */
+	threatExemptLabels;
 	/** V6-16 (0.3.37): same-process RMW serialization (the SkillLibrary queue) —
 	* on a backend WITHOUT a transact lock two concurrent callers compute on the
 	* same old content and the last rename wins, silently dropping one op's
@@ -2027,6 +2185,18 @@ var MemoryStore = class {
 		this.addDatePrefix = options.addDatePrefix ?? false;
 		this.root = options.root ?? memoryRoot();
 		this.maxFailures = options.maxConsolidationFailures ?? 3;
+		this.threatExemptLabels = options.threatExemptLabels ?? [];
+	}
+	/** V10-03 (P2-18): ScanOptions shared by every threat check of this store —
+	* the constructor's exempt labels, empty by default (behavior unchanged). */
+	threatScanOptions() {
+		return this.threatExemptLabels.length > 0 ? { excludeLabels: this.threatExemptLabels } : {};
+	}
+	/** V10-03 (P2-18): the strict-scan write gate. A block message names the hit
+	* label (scanMemoryThreats already embeds it) plus the self-heal hint. */
+	memoryThreatBlock(text) {
+		const threat = scanMemoryThreats(text, void 0, this.threatScanOptions());
+		return threat === null ? null : threat + THREAT_EXEMPT_HINT;
 	}
 	limitFor(target) {
 		return target === "memory" ? this.memoryLimit : this.userLimit;
@@ -2151,7 +2321,13 @@ var MemoryStore = class {
 			outcome = core.result;
 			return core.write ?? current ?? null;
 		});
-		return outcome;
+		return outcome ?? {
+			ok: false,
+			message: "internal error: the memory transaction did not invoke the task; no write was performed",
+			entries: [],
+			chars: 0,
+			limit: this.limitFor(target)
+		};
 	}
 	/**
 	* Single-entry add inside the transaction: shared checks (oversized,
@@ -2177,7 +2353,7 @@ var MemoryStore = class {
 				write: null
 			};
 		}
-		const threat = scanMemoryThreats(content);
+		const threat = this.memoryThreatBlock(content);
 		if (threat) return {
 			result: {
 				ok: false,
@@ -2188,7 +2364,8 @@ var MemoryStore = class {
 			},
 			write: null
 		};
-		if (hasEntryDelimiter(this.addDatePrefix ? `## ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}\n${content}` : content)) return {
+		const prefixed = this.addDatePrefix ? `## ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}\n${content}` : content;
+		if (hasEntryDelimiter(prefixed)) return {
 			result: {
 				ok: false,
 				message: "Fact contains the entry delimiter (§) and would split into multiple entries; rewrite it as separate facts.",
@@ -2212,7 +2389,7 @@ var MemoryStore = class {
 				write: null
 			};
 		}
-		const next = [...entries, this.addDatePrefix ? `## ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}\n${content}` : content];
+		const next = [...entries, prefixed];
 		const total = next.join(ENTRY_DELIMITER).length;
 		const addLimit = this.limitFor(target);
 		if (addLimit > 0 && total > addLimit) return {
@@ -2259,7 +2436,13 @@ var MemoryStore = class {
 			outcome = core.result;
 			return core.write ?? current ?? null;
 		});
-		return outcome;
+		return outcome ?? {
+			ok: false,
+			message: "internal error: the memory transaction did not invoke the task; no write was performed",
+			entries: [],
+			chars: 0,
+			limit: this.limitFor(target)
+		};
 	}
 	/** Batch RMW inside the transaction. `write: null` = failure/no-op, disk untouched. */
 	async applyBatchCore(target, operations, raw) {
@@ -2278,6 +2461,7 @@ var MemoryStore = class {
 		}
 		const entries = [...new Set(normalizeEntries(raw))];
 		const working = [...entries];
+		const datePrefix = this.addDatePrefix ? `## ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}\n` : "";
 		for (const [index, op] of operations.entries()) {
 			const position = index + 1;
 			if (op.action === "add") {
@@ -2292,7 +2476,7 @@ var MemoryStore = class {
 					},
 					write: null
 				};
-				const threat = scanMemoryThreats(body);
+				const threat = this.memoryThreatBlock(body);
 				if (threat) return {
 					result: {
 						ok: false,
@@ -2303,7 +2487,7 @@ var MemoryStore = class {
 					},
 					write: null
 				};
-				const entryBody = this.addDatePrefix ? `## ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}\n${body}` : body;
+				const entryBody = `${datePrefix}${body}`;
 				if (hasEntryDelimiter(entryBody)) return {
 					result: {
 						ok: false,
@@ -2371,7 +2555,7 @@ var MemoryStore = class {
 					},
 					write: null
 				};
-				const threat = scanMemoryThreats(body);
+				const threat = this.memoryThreatBlock(body);
 				if (threat) return {
 					result: {
 						ok: false,
@@ -2382,7 +2566,8 @@ var MemoryStore = class {
 					},
 					write: null
 				};
-				if (hasEntryDelimiter(body)) return {
+				const entryBody = `${datePrefix}${body}`;
+				if (hasEntryDelimiter(entryBody)) return {
 					result: {
 						ok: false,
 						message: `Operation ${position} (replace): Fact contains the entry delimiter (§) and would split into multiple entries; rewrite it as separate facts.${previewEntries(entries)}`,
@@ -2392,7 +2577,7 @@ var MemoryStore = class {
 					},
 					write: null
 				};
-				working[matchIndex] = body;
+				working[matchIndex] = entryBody;
 			}
 		}
 		const total = working.join(ENTRY_DELIMITER).length;
@@ -2431,13 +2616,13 @@ var MemoryStore = class {
 				parts.push(`## ${label} — file skipped: ${oversized.size} bytes (limit ${oversized.limit * READ_GUARD_FACTOR}); not read`);
 				continue;
 			}
-			const safe = entries.filter((entry) => !scanMemoryThreats(entry));
+			const safe = entries.filter((entry) => !scanMemoryThreats(entry, void 0, this.threatScanOptions()));
 			if (safe.length > 0) {
 				const body = safe.join(ENTRY_DELIMITER);
 				const limit = this.limitFor(target);
-				const pct = limit > 0 ? Math.min(100, Math.floor(body.length * 100 / limit)) : 0;
 				const note = safe.length === entries.length ? "" : ` (${entries.length - safe.length} threat-matched entries filtered)`;
-				parts.push(`## ${label} (${safe.length} entries) [${pct}% — ${body.length}/${limit} chars]${note}\n${body}`);
+				const usage = limit > 0 ? ` [${Math.min(100, Math.floor(body.length * 100 / limit))}% — ${body.length}/${limit} chars]` : "";
+				parts.push(`## ${label} (${safe.length} entries)${usage}${note}\n${body}`);
 			}
 		}
 		return parts.join("\n\n");
@@ -2507,6 +2692,7 @@ async function recordMutation(root, io, record, cap = 500) {
 		if (current !== null) try {
 			JSON.parse(current);
 		} catch {
+			console.warn(`mutation audit record dropped: ${mutationsFile(root)} is malformed and was not overwritten`);
 			return current;
 		}
 		const existing = parseMutationRecords(current);
@@ -2533,6 +2719,14 @@ async function recordMutation(root, io, record, cap = 500) {
 * standard row id fails loud by default, and `DSH_EVOLUTION_ALLOW_ROW_COLLISIONS=1`
 * downgrades it to a warning that keeps both (the row mounts twice).
 *
+* V10-14 / 0.3.53 (P1-2): BOTH composers now inject the Hermes 60-char catalog
+* cap onto the standard-sourced `- id: tool-skill` row of the composed preset
+* (see injectCatalogDescriptionCap) — the session-visible tool-skill instance
+* mounts in the preset's own standing scope, where no profile-root patch can
+* reach it. 0.3.53 moved the injection INTO the composer so
+* `/evolution preset install` (the npm user's only preset path) gets it too;
+* install-layered applies the byte-identical rule, pinned by installer.spec.
+*
 * Row ids are read from `- id:` lines; an id present in both fragments would
 * mount twice and could shadow the platform row, so it fails loud.
 * @param standardComposition - the runtime `standard` preset composition.
@@ -2544,13 +2738,53 @@ function composePresetComposition(standardComposition, deltaComposition) {
 	const collisions = [...compositionRowIds(deltaComposition)].filter((id) => standardIds.has(id)).sort();
 	if (collisions.length > 0 && process.env.DSH_EVOLUTION_ALLOW_ROW_COLLISIONS !== "1") throw new Error(`evolution preset composition: delta rows collide with runtime standard rows: ${collisions.join(", ")}`);
 	if (collisions.length > 0) console.warn(`evolution preset composition: warning — delta rows collide with standard rows (${collisions.join(", ")}); keeping both (DSH_EVOLUTION_ALLOW_ROW_COLLISIONS=1)`);
-	return `${standardComposition.replace(/\s+$/, "")}\n\n${deltaComposition.trim()}\n`;
+	return injectCatalogDescriptionCap(`${standardComposition.replace(/\s+$/, "")}\n\n${deltaComposition.trim()}\n`);
+}
+/**
+* V10-14 (P1-2), 0.3.53: inject the Hermes 60-char catalog cap onto the
+* standard-sourced `- id: tool-skill` row of a composed preset.
+*
+* The session-visible `tool-skill` instance mounts in the agent preset's own
+* standing scope; a profile-root patch (evolution-host/cordis.patch.yml)
+* cannot reach it, so without this injection the catalog's read side runs the
+* platform default (500). Text-level rewrite in the same line-scan style as
+* compositionRowIds (no YAML library):
+*   - idempotent: a tool-skill item that already carries a `config:` key is
+*     left byte-identical, so re-running the installer never doubles the key;
+*   - the injected block carries a marker comment so a diff of the generated
+*     preset can tell composer-owned text from platform text;
+*   - a composition WITHOUT a tool-skill row is returned unchanged with a
+*     one-time warning (a renamed platform row must not brick the install,
+*     but the missed cap must be observable).
+* install-layered.mjs ships the byte-identical `injectToolSkillCap`.
+*/
+function injectCatalogDescriptionCap(composition) {
+	const lines = composition.split("\n");
+	let found = false;
+	for (let i = 0; i < lines.length; i += 1) {
+		if (!/^- id:\s*tool-skill\s*$/.test(lines[i] ?? "")) continue;
+		found = true;
+		let end = i;
+		let hasConfig = false;
+		for (let j = i + 1; j < lines.length; j += 1) {
+			const next = lines[j] ?? "";
+			if (next.trim() === "") break;
+			if (!/^\s/.test(next)) break;
+			if (/^\s+config:(\s|$)/.test(next)) hasConfig = true;
+			end = j;
+		}
+		if (hasConfig) continue;
+		lines.splice(end + 1, 0, "  # V10-14: Hermes 60-char catalog cap — injected by the preset composer (P1-2);", "  # this preset-scope row is the session-visible instance and no profile", "  # patch can reach it. Remove only to run the platform default (500).", "  config:", "    catalogDescriptionMaxLength: 60");
+		i = end + 5;
+	}
+	if (!found) console.warn("evolution preset composition: warning — no `- id: tool-skill` row in the composed preset; the 60-char catalog cap was NOT injected (platform renamed the row? reconcile with the delta)");
+	return lines.join("\n");
 }
 function compositionRowIds(composition) {
 	const ids = /* @__PURE__ */ new Set();
 	for (const line of composition.split("\n")) {
-		const match = /^- id:\s*(\S+)/.exec(line);
-		if (match) ids.add(match[1] ?? "");
+		const id = /^- id:\s*(\S+)/.exec(line)?.[1];
+		if (id) ids.add(id);
 	}
 	return ids;
 }
@@ -2617,7 +2851,10 @@ function computeQualityScores(input) {
 function normalize(content) {
 	return content.toLowerCase().replace(/\s+/g, " ").trim();
 }
-function contentHash$1(content) {
+/** C-26 (v10 audit): renamed from `contentHash` — mutations.ts exports a
+* contentHash of RAW bytes, this one hashes the NORMALIZED text for dedup
+* grouping. Same private helper, unambiguous name. */
+function normalizedHash(content) {
 	return createHash("sha256").update(normalize(content)).digest("hex");
 }
 function tokenize(content) {
@@ -2639,7 +2876,7 @@ function computeDedupGroups(input) {
 	const names = [...input.contents.keys()];
 	const hashes = /* @__PURE__ */ new Map();
 	for (const name of names) {
-		const hash = contentHash$1(input.contents.get(name) ?? "");
+		const hash = normalizedHash(input.contents.get(name) ?? "");
 		const bucket = hashes.get(hash);
 		if (bucket) bucket.push(name);
 		else hashes.set(hash, [name]);
@@ -2771,6 +3008,12 @@ const DEFAULT_HEALTH_THRESHOLDS = {
 * (`defaced`, `feedback`) are not counted as commit shas; the ISO branch
 * accepts a UTC `Z`, a numeric UTC offset (`+08:00`), or no timezone at all —
 * non-UTC timestamps used to escape detection (log-like content missed).
+*
+* Known boundary, recorded not fixed (C-22, v10 audit): the hex branch also
+* matches 7-40 char PURE-DIGIT strings (order numbers etc.), so stamp density
+* can be over-reported for such content. The misjudgment direction is "extra
+* stamp hits" only — never a miss — and no real incident exists; revisit only
+* if curator decisions are actually distorted (v10 deferral ledger).
 */
 const HEALTH_STAMP_RE = new RegExp(String.raw`\brc\.\d+\b|\b(?=[0-9a-f]{7,40}\b)[0-9a-f]*[0-9][0-9a-f]*\b|\b\d{4}-\d{2}-\d{2}(?:T[0-9:.]+(?:Z|[+-]\d{2}:?\d{2})?)?\b`, "g");
 /**
@@ -2815,7 +3058,7 @@ function assessStructureHealth(snapshot, thresholds = DEFAULT_HEALTH_THRESHOLDS)
 * Deterministic review signal gate.
 *
 * Scans a DSH session event log for durable learning signals before any LLM
-* is spent. `turn/end` calls `observeTurn`; the returned review kind is
+* is spent. `turn/end` calls `observeEvent`; the returned review kind is
 * accumulated until a configured interval fires.
 */
 const CORRECTION_PATTERNS = [
@@ -3035,7 +3278,7 @@ function computeDriftSignals(snapshots) {
 			const narrow = narrowNameMatches(snapshot.name);
 			signals.push(narrow.length === 0 ? sig("narrow_name", "pass", "none") : sig("narrow_name", "over", narrow.join(", "), void 0, `name=${snapshot.name}`));
 			const description = snapshot.description;
-			signals.push(description === void 0 ? sig("description_chars", "unknown", "missing", "60") : sig("description_chars", description.length > 60 ? "over" : "pass", `${description.length}`, `60`));
+			signals.push(description === void 0 ? sig("description_chars", "unknown", "missing", `60`) : sig("description_chars", description.length > 60 ? "over" : "pass", `${description.length}`, `60`));
 			const quality = snapshot.quality;
 			signals.push(quality === null || quality === void 0 ? sig("quality_low", "unknown", "not-assessed") : sig("quality_low", quality < .3 ? "over" : "pass", quality.toFixed(2), `${LOW_QUALITY_THRESHOLD}`));
 			return {
@@ -3240,6 +3483,13 @@ function frontmatterYamlUnsafeValues(content) {
 * rewritten block no longer parses, or a rewritten value's parsed content
 * differs from the original, the rewrite is rolled back and reported in
 * `issues` (fail-loud, never a silent value corruption — P3-4).
+*
+* V10-02 (P2-3): the rewrite decision is PER LINE — each entry parses its own
+* value, so a duplicated key can never route one entry's unsafe value into a
+* different line's rewrite (the old key→Map lookup rewrote the FIRST (safe)
+* line with the SECOND line's quoted value, and the last-wins YAML reader
+* masked the damage). A duplicated key is itself invalid input and is
+* reported in `issues` (the write path refuses) instead of being rewritten.
 */
 function normalizeFrontmatter(content) {
 	const block = frontmatterBlock(content);
@@ -3250,10 +3500,10 @@ function normalizeFrontmatter(content) {
 		issues: []
 	};
 	const { lines, end, nl } = block;
-	const unsafe = new Map(frontmatterYamlUnsafeValues(content).map((entry) => [entry.key, entry.value]));
-	const originalValues = new Map(unsafe);
 	const fields = [];
 	const issues = [];
+	const seen = /* @__PURE__ */ new Set();
+	const originalValues = /* @__PURE__ */ new Map();
 	let changed = false;
 	for (let i = 1; i < end; i++) {
 		const line = lines[i];
@@ -3261,16 +3511,29 @@ function normalizeFrontmatter(content) {
 		const match = /^([A-Za-z0-9_-]+):\s*(.*)$/.exec(line);
 		if (!match) continue;
 		const key = match[1];
-		const value = unsafe.get(key ?? "");
-		if (key === void 0 || value === void 0) continue;
+		if (key === void 0) continue;
+		const value = (match[2] ?? "").trim();
+		if (seen.has(key)) {
+			issues.push(`${key}: duplicate frontmatter key — remove the repeated entry and retry`);
+			continue;
+		}
+		seen.add(key);
+		if (!yamlPlainScalarNeedsQuotes(value)) continue;
 		if (/[\u0000-\u0008\u000B\u000C\u000E-\u001F]/.test(value)) {
 			issues.push(`${key}: value contains control characters — clean them manually`);
 			continue;
 		}
 		lines[i] = `${key}: ${value.includes("\"") || value.includes("\\") ? `'${value.replace(/'/g, "''")}'` : `"${value}"`}`;
+		originalValues.set(key, value);
 		fields.push(key);
 		changed = true;
 	}
+	if (issues.length > 0) return {
+		content,
+		changed: false,
+		fields: [],
+		issues
+	};
 	if (!changed) return {
 		content,
 		changed: false,
@@ -3320,7 +3583,7 @@ function validateFrontmatter(content, expectedName, limits = DEFAULT_SKILL_LIMIT
 	const parsed = parseFrontmatter(content);
 	if (!parsed) return "SKILL.md must start and end with YAML frontmatter and include a body.";
 	if (!parsed.frontmatter.name) return "Frontmatter must include a name field.";
-	if (!/^[a-z0-9][a-z0-9-]*$/.test(parsed.frontmatter.name)) return `Invalid skill name "${parsed.frontmatter.name}" — use lowercase letters, digits, and hyphens.`;
+	if (!SKILL_NAME_RE.test(parsed.frontmatter.name)) return `Invalid skill name "${parsed.frontmatter.name}" — use lowercase letters, digits, and hyphens.`;
 	if (parsed.frontmatter.name.length > limits.maxNameLength) return `Skill name exceeds ${limits.maxNameLength} characters.`;
 	if (expectedName && parsed.frontmatter.name !== expectedName) return `Frontmatter name "${parsed.frontmatter.name}" does not match target skill "${expectedName}".`;
 	if (!parsed.frontmatter.description) return "Frontmatter must include a description field.";
@@ -3358,12 +3621,51 @@ async function listNames(root, io) {
 	}
 	return names.sort();
 }
+/** C-18: support file names are restricted to the
+* RESTRUCTURE_TARGET_RE character class (leading `[a-z0-9]`, then
+* `[a-z0-9._-]`) — drive-colon / odd-character / uppercase names can no
+* longer reach the filesystem through writeSupportFile / patch /
+* removeSupportFile. */
+const SUPPORT_FILE_NAME_RE = /^[a-z0-9][a-z0-9._-]*$/;
+/** C-18: win32 reserves these stems with ANY extension (`nul.md` hits the
+* NUL device), and they are fully inside the charset above — so the reserved
+* set is checked on the first-dot prefix as well; the charset close alone
+* cannot refuse them. */
+const WIN32_RESERVED_DEVICE_NAMES = new Set([
+	"con",
+	"prn",
+	"aux",
+	"nul",
+	"com1",
+	"com2",
+	"com3",
+	"com4",
+	"com5",
+	"com6",
+	"com7",
+	"com8",
+	"com9",
+	"lpt1",
+	"lpt2",
+	"lpt3",
+	"lpt4",
+	"lpt5",
+	"lpt6",
+	"lpt7",
+	"lpt8",
+	"lpt9"
+]);
 function validateSupportPath(filePath) {
 	const normalized = filePath.replace(/\\/g, "/");
 	if (normalized.includes("..")) return "Path traversal is not allowed.";
 	const parts = normalized.split("/").filter(Boolean);
 	if (parts.length === 0 || !SUPPORT_DIRS.includes(parts[0])) return `file_path must be under one of: ${SUPPORT_DIRS.join(", ")}.`;
 	if (parts.length < 2) return "Provide a file name, not just a directory.";
+	for (const part of parts.slice(1)) {
+		if (!SUPPORT_FILE_NAME_RE.test(part)) return `Unsupported file name "${part}" — use lowercase letters, digits, dots, hyphens, and underscores (leading letter or digit).`;
+		const stem = part.split(".")[0]?.toLowerCase() ?? "";
+		if (WIN32_RESERVED_DEVICE_NAMES.has(stem)) return `Unsupported file name "${part}" — a Windows reserved device name.`;
+	}
 	return null;
 }
 /**
@@ -3537,11 +3839,15 @@ var SkillLibrary = class {
 	* one skill never interleave their read-modify-write (the cross-process layer
 	* is the IO backend's transact lock; this chain is the second layer). */
 	serial;
-	constructor(root = skillsRoot(), io = nodeEvolutionIo(), limits = DEFAULT_SKILL_LIMITS, onMutation, transact) {
+	/** V10-03 (P2-18): see the constructor's threatExemptLabels. Empty by
+	* default — the strict ANY-hit-blocks policy is unchanged. */
+	threatExemptLabels;
+	constructor(root = skillsRoot(), io = nodeEvolutionIo(), limits = DEFAULT_SKILL_LIMITS, onMutation, transact, threatExemptLabels) {
 		this.root = root;
 		this.io = io;
 		this.limits = limits;
 		this.onMutation = onMutation;
+		this.threatExemptLabels = threatExemptLabels ?? [];
 		this.transact = transact ?? (io.transact ? (ioLike, path, task) => {
 			const t = ioLike.transact;
 			return t ? t(path, task) : transactIo(ioLike, path, task);
@@ -3585,12 +3891,24 @@ var SkillLibrary = class {
 			this.onMutation?.(event);
 		} catch {}
 	}
+	/** V10-03 (P2-18): ScanOptions shared by every write-path threat check —
+	* the constructor's exempt labels, empty by default (behavior unchanged). */
+	threatScanOptions() {
+		return this.threatExemptLabels.length > 0 ? { excludeLabels: this.threatExemptLabels } : {};
+	}
+	/** V10-03 (P2-18): the strict-scan write gate. A block message names the hit
+	* label (scanContentThreats already embeds it) plus the self-heal hint, so a
+	* false-positive rewrite direction is actionable instead of a dead end. */
+	contentThreatBlock(content) {
+		const threat = scanContentThreats(content, void 0, this.threatScanOptions());
+		return threat === null ? null : threat + THREAT_EXEMPT_HINT;
+	}
 	async list() {
 		const summaries = [];
 		for (const name of await listNames(this.root, this.io)) {
 			const dir = this.dirOf(name);
 			const md = await this.io.readText(join(dir, "SKILL.md"));
-			if (!md) continue;
+			if (md === null) continue;
 			const parsed = parseFrontmatter(md);
 			let entries = [];
 			try {
@@ -3598,9 +3916,10 @@ var SkillLibrary = class {
 			} catch {}
 			const has = (marker) => entries.includes(markerEntryName(marker));
 			const protectedBy = has("bundled") ? "bundled" : has("hub-installed") ? "hub-installed" : has("pinned") ? "pinned" : null;
+			const parsedDescription = parsed?.frontmatter.description;
 			summaries.push({
 				name,
-				description: parsed?.frontmatter.description ?? "",
+				description: typeof parsedDescription === "string" ? parsedDescription : "",
 				path: dir,
 				protectedBy,
 				managed: has("hermes-managed"),
@@ -3766,9 +4085,10 @@ var SkillLibrary = class {
 	*/
 	async setPinned(name, pinned, origin = "foreground") {
 		const normalized = name.trim();
-		if (!SKILL_NAME_RE.test(normalized) || normalized.length > this.limits.maxNameLength) return {
+		const bad = this.badName(normalized);
+		if (bad) return {
 			ok: false,
-			message: `Invalid skill name "${normalized}". Use lowercase letters, digits, and hyphens (<= ${this.limits.maxNameLength}).`
+			message: bad
 		};
 		if (origin === "background_review") return {
 			ok: false,
@@ -3802,9 +4122,10 @@ var SkillLibrary = class {
 	}
 	async create(name, content, origin = "foreground") {
 		const normalized = name.trim();
-		if (!SKILL_NAME_RE.test(normalized) || normalized.length > this.limits.maxNameLength) return {
+		const bad = this.badName(normalized);
+		if (bad) return {
 			ok: false,
-			message: `Invalid skill name "${normalized}". Use lowercase letters, digits, and hyphens (<= ${this.limits.maxNameLength}).`
+			message: bad
 		};
 		const validation = validateFrontmatter(content, normalized, this.limits);
 		if (validation) return {
@@ -3824,7 +4145,7 @@ var SkillLibrary = class {
 				message: revalidated
 			};
 		}
-		const threat = scanContentThreats(finalContent);
+		const threat = this.contentThreatBlock(finalContent);
 		if (threat) return {
 			ok: false,
 			message: threat
@@ -3834,6 +4155,11 @@ var SkillLibrary = class {
 			ok: false,
 			message: `Skill "${normalized}" already exists.`
 		};
+		const protection = await this.writeProtection(normalized, origin);
+		if (protection) return {
+			ok: false,
+			message: `Skill "${normalized}" is protected (${protection}).`
+		};
 		const onDisk = finalContent.trimEnd() + "\n";
 		await this.io.writeText(join(dir, "SKILL.md"), onDisk);
 		if (origin !== "foreground") await this.io.writeText(markerPath(dir, "hermes-managed"), "");
@@ -3885,7 +4211,7 @@ var SkillLibrary = class {
 				message: revalidated
 			};
 		}
-		const threat = scanContentThreats(finalContent);
+		const threat = this.contentThreatBlock(finalContent);
 		if (threat) return {
 			ok: false,
 			message: threat
@@ -4028,7 +4354,7 @@ var SkillLibrary = class {
 				},
 				write: null
 			};
-			const threat = scanContentThreats(writeContent);
+			const threat = this.contentThreatBlock(writeContent);
 			if (threat) return {
 				result: {
 					ok: false,
@@ -4078,11 +4404,11 @@ var SkillLibrary = class {
 		};
 		const dir = this.dirOf(name);
 		const md = await this.io.readText(join(dir, "SKILL.md"));
-		if (!md) return {
+		if (md === null) return {
 			ok: false,
 			message: `Skill "${name}" not found.`
 		};
-		const protection = await this.deleteProtection(name, options.allowBundled === void 0 ? {} : { allowBundled: options.allowBundled });
+		const protection = await this.deleteProtection(name, options);
 		if (protection) return {
 			ok: false,
 			message: protection === "pinned" ? `Skill "${name}" is pinned and cannot be archived. Remove the \`.pinned\` marker in its directory, then retry.` : `Skill "${name}" is protected (${protection}).`
@@ -4179,10 +4505,13 @@ var SkillLibrary = class {
 			ok: false,
 			message: "Consolidation requires at least one distinct source skill."
 		};
-		for (const name of [targetName, ...normalizedSources]) if (!SKILL_NAME_RE.test(name)) return {
-			ok: false,
-			message: `Invalid skill name "${name}". Use lowercase letters, digits, and hyphens.`
-		};
+		for (const name of [targetName, ...normalizedSources]) {
+			const bad = this.badName(name);
+			if (bad) return {
+				ok: false,
+				message: bad
+			};
+		}
 		const targetDir = this.dirOf(targetName);
 		const targetProtection = await this.writeProtection(targetName, origin);
 		if (targetProtection) return {
@@ -4262,7 +4591,14 @@ var SkillLibrary = class {
 					ok: false,
 					message: `Skill "${targetName}" not found.`
 				};
-				const writes = [...referenceWrites];
+				const writes = [];
+				for (const reference of referenceWrites) {
+					const base = (await this.io.readText(reference.target).catch(() => null))?.trimEnd() ?? "";
+					writes.push({
+						target: reference.target,
+						content: base === "" ? reference.content : `${base}\n\n${reference.content}`
+					});
+				}
 				if (mode === "append") {
 					const merged = freshTargetMd.trimEnd() + parts.join("\n") + "\n";
 					const validation = validateFrontmatter(merged, targetName, this.limits);
@@ -4469,7 +4805,7 @@ var SkillLibrary = class {
 				ok: false,
 				message: `Write exceeds ${this.limits.maxSkillFileBytes} bytes: ${write.target}`
 			};
-			const threat = scanContentThreats(write.content);
+			const threat = this.contentThreatBlock(write.content);
 			if (threat) return {
 				ok: false,
 				message: threat
@@ -4613,7 +4949,7 @@ var SkillLibrary = class {
 			ok: false,
 			message: `Support file exceeds ${this.limits.maxSkillFileBytes} bytes.`
 		};
-		const threat = scanContentThreats(content);
+		const threat = this.contentThreatBlock(content);
 		if (threat) return {
 			ok: false,
 			message: threat
@@ -4878,4 +5214,4 @@ var SkillLibrary = class {
 	}
 };
 //#endregion
-export { AUTHORING_DESCRIPTION_BAR, COMBINED_REVIEW_PLAN_PROMPT, COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_HEALTH_THRESHOLDS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_USER_CHAR_LIMIT, DRIFT_MAX_LINE_CHARS, DRIFT_SIGNALS_VERSION, DRIFT_SIGNAL_NOUNS, DSH_AUTHORING_STANDARDS, ENTRY_DELIMITER, EVENT_ARCHIVE_PREFIX, EVENT_LOG_RETAIN_ARCHIVES, EVENT_LOG_ROTATE_AT, EVENT_LOG_VERSION, EVOLUTION_WRITE_TOOLS, EvolutionGateSet, FORBIDDEN_CONTROL_KEYS, HEALTH_STAMP_RE, LOW_QUALITY_THRESHOLD, MAINTAIN_PROMPT, MAX_DESCRIPTION_LENGTH, MAX_RESTRUCTURE_MOVES, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MEMORY_REVIEW_PROMPT, MIN_STAMP_BODY_CHARS, MUTATIONS_FILE_VERSION, MemoryStore, PATTERN_OVERLAP, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, QUALITY_WEIGHTS, RESTRUCTURE_TARGET_RE, SKILLS_GUIDANCE, SKILL_NAME_RE, SKILL_REVIEW_PLAN_PROMPT, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, SUPPORT_DIRS, SUPPRESSED_FILE_VERSION, SkillLibrary, advanceReview, appendEvolutionEvent, applyCuratorFields, applyCuratorLifecycleFields, applyCuratorMetaFields, assessStructureHealth, authoringFeedback, buildCuratorRunReport, buildLearnPrompt, bumpPatch, bumpUse, bumpView, clampedNumber, composePresetComposition, computeDedupGroups, computeDriftSignals, computeLifecycleTransitions, computePrefixClusters, computeQualityScores, computeScopeView, contentHash, createGateSet, duplicateHeadings, emptyRecord, evaluateThreat, eventsFile, evolutionHome, evolutionIoAdapter, evolutionRoot, findDriftSignal, foldCuratorFields, foldTurn, frontmatterBlock, frontmatterYamlUnsafeValues, getRecord, latestActivityAt, lifecycleCandidate, listEventArchives, loadMutations, loadSuppressedNames, loadUsage, makeSerialQueue, markAgentCreated, markerEntryName, memoryRoot, missingSupportPointers, mutateUsage, mutationsFile, narrowNameMatches, nodeEvolutionIo, normalizeFrontmatter, normalizeUsageRecord, observeEvent, overlongLines, parseCuratorNominations, parseEvolutionEvents, parseFrontmatter, pendingSelfCleanup, readEvolutionEvents, readEvolutionTimeline, recordMutation, redactSecrets, relatedSkillNames, renameWithRetry, renderCuratorReportMarkdown, resolveOrigins, resolveSkillsRoot, retainEventArchives, reviewPrompt, saveSuppressedNames, saveUsage, scanContentThreats, scanMemoryThreats, scanThreats, skillsRoot, suppressedFile, transactIo, updateSuppressedNames, usageFile, usageObserved, validateFrontmatter, verifyPromptBundle, yamlPlainScalarNeedsQuotes };
+export { AUTHORING_DESCRIPTION_BAR, COMBINED_REVIEW_PLAN_PROMPT, COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_HEALTH_THRESHOLDS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_USER_CHAR_LIMIT, DRIFT_MAX_LINE_CHARS, DRIFT_SIGNALS_VERSION, DRIFT_SIGNAL_NOUNS, DSH_AUTHORING_STANDARDS, ENTRY_DELIMITER, EVENT_ARCHIVE_PREFIX, EVENT_LOG_RETAIN_ARCHIVES, EVENT_LOG_ROTATE_AT, EVENT_LOG_VERSION, EVOLUTION_WRITE_TOOLS, EvolutionGateSet, FORBIDDEN_CONTROL_KEYS, HEALTH_STAMP_RE, LOW_QUALITY_THRESHOLD, MAINTAIN_OUTPUT_INSTRUCTION, MAINTAIN_PROMPT, MAX_DESCRIPTION_LENGTH, MAX_RESTRUCTURE_MOVES, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MEMORY_REVIEW_PROMPT, MIN_STAMP_BODY_CHARS, MUTATIONS_FILE_VERSION, MemoryStore, PATTERN_OVERLAP, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, QUALITY_WEIGHTS, RESTRUCTURE_TARGET_RE, SKILLS_GUIDANCE, SKILL_NAME_RE, SKILL_REVIEW_PLAN_PROMPT, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, SUPPORT_DIRS, SUPPRESSED_FILE_VERSION, SkillLibrary, THREAT_EXEMPT_HINT, advanceReview, appendEvolutionEvent, applyCuratorFields, applyCuratorLifecycleFields, applyCuratorMetaFields, assessStructureHealth, authoringFeedback, buildCuratorRunReport, buildLearnPrompt, bumpPatch, bumpUse, bumpView, clampedNumber, composePresetComposition, computeDedupGroups, computeDriftSignals, computeLifecycleTransitions, computePrefixClusters, computeQualityScores, computeScopeView, contentHash, createGateSet, duplicateHeadings, emptyRecord, evaluateThreat, eventsFile, evolutionHome, evolutionIoAdapter, evolutionRoot, findDriftSignal, foldCuratorFields, foldTurn, frontmatterBlock, frontmatterYamlUnsafeValues, getRecord, latestActivityAt, lifecycleCandidate, listEventArchives, loadMutations, loadSuppressedNames, loadUsage, makeSerialQueue, markAgentCreated, markerEntryName, memoryRoot, missingSupportPointers, mutateUsage, mutationsFile, narrowNameMatches, nodeEvolutionIo, normalizeFrontmatter, normalizeUsageRecord, observeEvent, overlongLines, parseCuratorNominations, parseEvolutionEvents, parseFrontmatter, pendingSelfCleanup, readEvolutionEvents, readEvolutionTimeline, recordMutation, redactSecrets, relatedSkillNames, renameWithRetry, renderCuratorReportMarkdown, resolveOrigins, resolveSkillsRoot, retainEventArchives, reviewPrompt, saveSuppressedNames, saveUsage, scanContentThreats, scanMemoryThreats, scanThreats, skillsRoot, suppressedFile, transactIo, updateSuppressedNames, usageFile, usageObserved, validateFrontmatter, verifyPromptBundle, writeDurableTmp, yamlPlainScalarNeedsQuotes };