@lmzhen/dsh-evolution-core 0.3.61 → 0.3.63

package/lib/index.js

@@ -117,7 +117,7 @@ async function renameWithRetry(tmp, target, fn = rename) {
 async function writeDurableTmp(target, content, openImpl = open) {
 	const tmp = `${target}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
 	try {
-		const handle = await openImpl(tmp, "wx");
+		const handle = await openImpl(tmp, "wx", process.platform === "win32" ? void 0 : await stat(target).then((value) => value.mode & 511).catch(() => void 0));
 		try {
 			await handle.writeFile(content, "utf8");
 			await handle.sync();
@@ -312,8 +312,16 @@ function nodeEvolutionIo(lockAttempts = 40) {
 				}).catch(async () => {
 					const body = await readFile(lock, "utf8").catch(() => "");
 					if (pendingSelfCleanup.size >= 64) {
-						const oldest = pendingSelfCleanup.keys().next().value;
-						if (oldest !== void 0) pendingSelfCleanup.delete(oldest);
+						let droppable;
+						for (const candidate of pendingSelfCleanup.keys()) {
+							if (candidate === lock) continue;
+							if (await readFile(candidate, "utf8").then(() => false, () => true)) {
+								droppable = candidate;
+								break;
+							}
+						}
+						const victim = droppable ?? pendingSelfCleanup.keys().next().value;
+						if (victim !== void 0) pendingSelfCleanup.delete(victim);
 					}
 					pendingSelfCleanup.set(lock, body);
 				});
@@ -452,8 +460,9 @@ function nodeEvolutionIo(lockAttempts = 40) {
 		async isSymlink(path) {
 			try {
 				return (await lstat(path)).isSymbolicLink();
-			} catch {
-				return null;
+			} catch (error) {
+				if (isMissing(error)) return null;
+				throw error;
 			}
 		},
 		async mtime(path) {
@@ -525,7 +534,9 @@ function normalizeUsageRecord(record) {
 		pinned: bool(raw.pinned, base.pinned),
 		archived_at: nullableTimestamp(raw.archived_at) ? raw.archived_at : base.archived_at,
 		quality_score: typeof raw.quality_score === "number" && Number.isFinite(raw.quality_score) ? raw.quality_score : void 0,
-		quality_warn: typeof raw.quality_warn === "boolean" ? raw.quality_warn : void 0
+		quality_warn: typeof raw.quality_warn === "boolean" ? raw.quality_warn : void 0,
+		feedback_score: typeof raw.feedback_score === "number" && Number.isFinite(raw.feedback_score) ? raw.feedback_score : void 0,
+		feedback_warn: typeof raw.feedback_warn === "boolean" ? raw.feedback_warn : void 0
 	};
 }
 /** Parse a raw usage sidecar; malformed content reads as empty (best-effort telemetry). */
@@ -551,11 +562,14 @@ async function loadUsage(root, io = nodeEvolutionIo()) {
 */
 async function mutateUsage(root, io, task) {
 	await transactIo(io, usageFile(root), async (current) => {
+		let shapePreserved = false;
 		if (current !== null) try {
-			JSON.parse(current);
+			const probe = JSON.parse(current);
+			if (probe === null || Array.isArray(probe) || typeof probe !== "object") shapePreserved = true;
 		} catch {
 			return current;
 		}
+		if (shapePreserved) return current;
 		const map = parseUsage(current);
 		await task(map);
 		return JSON.stringify(Object.fromEntries(map.entries()), null, 2);
@@ -584,6 +598,9 @@ function applyCuratorLifecycleFields(disk, curated) {
 * Copy the recomputed meta pair (quality_score/quality_warn + the
 * marker-mirrored pin flag) — refreshed tree-wide each run by design, so a
 * concurrent curator run's lifecycle changes are never reverted by them.
+* P1-1 (v15): the feedback pair (`feedback_score`/`feedback_warn`) is
+* deliberately NOT copied — it is feedback-owned (see the field-ownership
+* contract on {@link UsageRecord}) and must survive curator runs untouched.
 */
 function applyCuratorMetaFields(disk, curated) {
 	disk.quality_score = curated.quality_score;
@@ -614,7 +631,9 @@ function foldCuratorFields(disk, curated, stateOwned) {
 /** Whole-file usage write (V6-37, 0.3.37): this is the ONE path that bypasses
 * the malformed-defense and the transact lock — prefer `mutateUsage` for any
 * read-modify-write so a concurrent writer cannot lose its update and a
-* malformed sidecar stays recoverable. Kept for fixture/test seeding. */
+* malformed sidecar stays recoverable. Kept for fixture/test seeding.
+* @internal P3-16 (v14): no production caller (verified by grep); exported for
+* the family's tests only. Do not use it to write the sidecar in new code. */
 async function saveUsage(root, map, io = nodeEvolutionIo()) {
 	const obj = Object.fromEntries(map.entries());
 	await io.writeText(usageFile(root), JSON.stringify(obj, null, 2));
@@ -778,6 +797,13 @@ const DEFAULT_USER_CHAR_LIMIT = 1375;
 /** Consolidation-failure backoff cap, shared by MemoryStore and memory-files' Config default. */
 const DEFAULT_CONSOLIDATION_FAILURES = 3;
 const DEFAULT_SKILL_CONTENT_CHARS = 1e5;
+/** P3-19 (v14): defaults that were written twice (schema `.default()` AND the
+* clamp fallback literal) now have one home per value. */
+const DEFAULT_REVIEW_TIMEOUT_MS = 12e4;
+const DEFAULT_REVIEW_CONTEXT_MESSAGES = 60;
+const DEFAULT_REVIEW_MESSAGE_CHARS = 2e3;
+const DEFAULT_CURATOR_BOOT_GRACE_SECONDS = 10;
+const DEFAULT_CURATOR_REVIEW_MAX_TOKENS = 2048;
 /** 0.3.17 (S3.10, T-1): control-plane fields a model-facing write call may
 * never carry — single source for plan-validator, evolution-policy and the
 * threat scanner (they used to each hardcode the list). */
@@ -1000,8 +1026,9 @@ function computeScopeView(usage, config, protectedNames, gates) {
 		if (record.pinned || bundled || suppressed || protectedNames?.has(name) === true || isBuiltin) protectedSet.add(name);
 		if (lifecycleCandidate(name, record, config, bundled, gateSet, protectedNames)) {
 			managed.push(name);
-			if (record.state === "stale" || record.quality_warn === true) watched.push(name);
-			if (record.quality_warn === true) qualityWarned.push(name);
+			const warned = record.quality_warn === true || record.feedback_warn === true;
+			if (record.state === "stale" || warned) watched.push(name);
+			if (warned) qualityWarned.push(name);
 		}
 	}
 	return {
@@ -1028,7 +1055,7 @@ function computeLifecycleTransitions(usage, config, now = /* @__PURE__ */ new Da
 		const age = daysSince(null, record.created_at, now.getTime());
 		if (record.use_count === 0 && age < config.staleAfterDays) continue;
 		const idle = daysSince(latestActivityAt(record), record.created_at, now.getTime());
-		const qualityWarn = record.quality_warn === true;
+		const qualityWarn = record.quality_warn === true || record.feedback_warn === true;
 		const staleAfterDays = qualityWarn && config.qualityWarnStaleAfterDays !== void 0 ? config.qualityWarnStaleAfterDays : config.staleAfterDays;
 		if (record.state === "active") {
 			if (idle >= config.archiveAfterDays) {
@@ -1043,7 +1070,8 @@ function computeLifecycleTransitions(usage, config, now = /* @__PURE__ */ new Da
 				result.archive.push(name);
 			} else if (idle >= staleAfterDays) {
 				record.state = "stale";
-				const reason = qualityWarn ? `idle ${Math.round(idle)}d >= quality-warn stale ${staleAfterDays}d` : `idle ${Math.round(idle)}d >= ${staleAfterDays}d`;
+				const warnSource = record.feedback_warn === true ? "feedback-warn stale" : "quality-warn stale";
+				const reason = qualityWarn ? `idle ${Math.round(idle)}d >= ${warnSource} ${staleAfterDays}d` : `idle ${Math.round(idle)}d >= ${staleAfterDays}d`;
 				result.transitions.push({
 					name,
 					from: "active",
@@ -1339,10 +1367,14 @@ async function readEvolutionTimeline(io, path) {
 * reads inside patch YAML `!!js` expressions (session-query path/openAt) stay
 * in the profile config evaluation — they are NOT migrated (they are resolved
 * at cordis config time, not plugin time) but are documented in the README
-* env table.
+* env table. `EVOLUTION_SCOPE` is read by the source installers only
+* (`packages/scripts/install-layered.mjs`, `packages/test-support/row-contract.ts`),
+* never by plugin runtime code.
+*
+* v14 P3-1: the former `EVOLUTION_ENV_KEYS` export was deleted — nothing read
+* it, so the "generated env reference" it claimed to source was never
+* generated (the README table is maintained by hand and now lists every key).
 */
-/** Plugin-side DSH_EVOLUTION_* keys (config-layer keys are documented separately). */
-const EVOLUTION_ENV_KEYS = ["DSH_EVOLUTION_ALLOW_ROW_COLLISIONS"];
 const ALLOW_ROW_COLLISIONS = "1";
 /** N-5 escape: `DSH_EVOLUTION_ALLOW_ROW_COLLISIONS=1` downgrades a delta-row
 * collision from fail-loud to warn+keep-both. Any other value (including an
@@ -1977,7 +2009,7 @@ const PATTERNS = [
 		label: "read_secrets",
 		category: "exfiltration",
 		scope: "all",
-		regex: /\bcat\s+[^\n]{0,512}(?:\.env|credentials|\.netrc|\.pgpass|\.npmrc|\.pypirc)/i
+		regex: /\bcat\s+[^\n]{0,512}(?:\.env(?!\w)|(?:\bcredentials\b)|\.netrc|\.pgpass|\.npmrc|\.pypirc)/i
 	},
 	{
 		label: "ssh_backdoor",
@@ -2027,6 +2059,12 @@ const PATTERNS = [
 		scope: "strict",
 		regex: /(?:api[_-]?key|token|secret|password)\s*[=:]\s*["'][a-z0-9+/=_-]{20,}["']/i
 	},
+	{
+		label: "jwt_like_secret",
+		category: "hardcoded_secrets",
+		scope: "strict",
+		regex: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/
+	},
 	{
 		label: "private_key_block",
 		category: "hardcoded_secrets",
@@ -2060,15 +2098,16 @@ const PATTERN_OVERLAP = 4096;
 function scanThreats(text, scope = "strict", maxScanChars = 65536, options = NO_SCAN_OPTIONS) {
 	const windowSize = clampedNumber(maxScanChars, 65536, { min: 4097 });
 	const findings = [];
-	if (ZERO_WIDTH_CHARS.test(text)) findings.push({
+	const excluded = new Set(options.excludeLabels ?? []);
+	if (ZERO_WIDTH_CHARS.test(text) && !excluded.has("unicode_zero_width")) findings.push({
 		label: "unicode_zero_width",
 		category: "unicode_obfuscation",
-		scope
+		scope: "all"
 	});
-	if (BIDI_CHARS.test(text)) findings.push({
+	if (BIDI_CHARS.test(text) && !excluded.has("unicode_bidi_override")) findings.push({
 		label: "unicode_bidi_override",
 		category: "unicode_obfuscation",
-		scope
+		scope: "all"
 	});
 	const normalized = text.normalize("NFKC");
 	const windows = [];
@@ -2077,7 +2116,6 @@ function scanThreats(text, scope = "strict", maxScanChars = 65536, options = NO_
 		const step = Math.max(Math.floor(windowSize / 2), 1);
 		for (let start = 0; start < normalized.length; start += step) windows.push(normalized.slice(start, start + windowSize));
 	}
-	const excluded = new Set(options.excludeLabels ?? []);
 	const seen = /* @__PURE__ */ new Set();
 	for (const window of windows) for (const pattern of PATTERNS) {
 		if (SCOPE_ORDER[pattern.scope] > SCOPE_ORDER[scope]) continue;
@@ -2121,9 +2159,11 @@ function scanContentThreats(text, maxScanChars = 65536, options = NO_SCAN_OPTION
 * V10-03 (P2-18): suffix the SkillLibrary/MemoryStore write gates append to a
 * block message — the hit label is already embedded by scanContentThreats /
 * scanMemoryThreats, this names the deployable self-heal path so the model
-* (or operator) can allowlist a known-benign label. The evolution-threat tool
-* channel deliberately does NOT append it: that channel has no
-* threatExemptLabels option to advertise.
+* (or operator) can allowlist a known-benign label. P2-4 (v14): the
+* evolution-threat guard channel now carries `threatExemptLabels` too, so its
+* block message (which embeds the same exemption sentence) is accurate there
+* as well; this suffix stays store-side because the guard returns the scan
+* message verbatim.
 */
 const THREAT_EXEMPT_HINT = " If this is a legitimate false positive, the deployment can allow its label via the threatExemptLabels store option.";
 //#endregion
@@ -2300,11 +2340,14 @@ var MemoryStore = class {
 	async backupFile(target) {
 		const path = fileFor(this.root, target);
 		const backup = `${path}.bak`;
+		const staging = `${backup}.${process.pid}.${Date.now().toString(36)}.tmp`;
 		try {
-			await this.io.remove(backup).catch(() => {});
-			await this.io.copy(path, backup);
+			await this.io.remove(staging).catch(() => {});
+			await this.io.copy(path, staging);
+			await this.io.rename(staging, backup);
 			return backup;
 		} catch {
+			await this.io.remove(staging).catch(() => {});
 			return null;
 		}
 	}
@@ -2364,7 +2407,13 @@ var MemoryStore = class {
 	async addCore(target, facts, raw) {
 		const content = facts.trim();
 		if (!content) return {
-			result: this.failure(target, "Content cannot be empty.", []),
+			result: {
+				ok: false,
+				message: "Content cannot be empty.",
+				entries: [],
+				chars: 0,
+				limit: this.limitFor(target)
+			},
 			write: null
 		};
 		if (this.driftFromRaw(target, raw)) {
@@ -2650,7 +2699,7 @@ var MemoryStore = class {
 				const note = safe.length === entries.length ? "" : ` (${entries.length - safe.length} threat-matched entries filtered)`;
 				const usage = limit > 0 ? ` [${Math.min(100, Math.floor(body.length * 100 / limit))}% — ${body.length}/${limit} chars]` : "";
 				parts.push(`## ${label} (${safe.length} entries)${usage}${note}\n${body}`);
-			}
+			} else if (entries.length > 0) parts.push(`## ${label} — ${entries.length} entries withheld by the security scan; none injected`);
 		}
 		return parts.join("\n\n");
 	}
@@ -2704,25 +2753,31 @@ function contentHash(content) {
 function parseMutationRecords(raw) {
 	if (raw === null) return [];
 	try {
-		const parsed = JSON.parse(raw);
-		return (Array.isArray(parsed) ? parsed : typeof parsed === "object" && parsed !== null && Array.isArray(parsed.records) ? parsed.records : []).filter((entry) => typeof entry === "object" && entry !== null && typeof entry.skillName === "string" && typeof entry.action === "string" && typeof entry.at === "string");
+		return recordsFromParsed(JSON.parse(raw));
 	} catch {
 		return [];
 	}
 }
+/** Field-level shape guard shared by the parse and the recordMutation write
+* path (P3/v15: the guard's JSON.parse and this parse used to run twice over
+* the same bytes inside one transact). */
+function recordsFromParsed(parsed) {
+	return (Array.isArray(parsed) ? parsed : typeof parsed === "object" && parsed !== null && Array.isArray(parsed.records) ? parsed.records : []).filter((entry) => typeof entry === "object" && entry !== null && typeof entry.skillName === "string" && typeof entry.action === "string" && typeof entry.at === "string");
+}
 async function loadMutations(root, io = nodeEvolutionIo()) {
 	return parseMutationRecords(await io.readText(mutationsFile(root)));
 }
 /** Append one record, trim to `cap`, and write atomically (versioned shape). */
 async function recordMutation(root, io, record, cap = 500) {
 	await transactIo(io, mutationsFile(root), (current) => {
+		let parsed = [];
 		if (current !== null) try {
-			JSON.parse(current);
+			parsed = JSON.parse(current);
 		} catch {
 			console.warn(`mutation audit record dropped: ${mutationsFile(root)} is malformed and was not overwritten`);
 			return current;
 		}
-		const existing = parseMutationRecords(current);
+		const existing = recordsFromParsed(parsed);
 		existing.push(record);
 		const trimmed = existing.length > cap ? existing.slice(existing.length - cap) : existing;
 		return JSON.stringify({
@@ -3660,7 +3715,9 @@ const SUPPORT_FILE_NAME_RE = /^[a-z0-9][a-z0-9._-]*$/;
 /** C-18: win32 reserves these stems with ANY extension (`nul.md` hits the
 * NUL device), and they are fully inside the charset above — so the reserved
 * set is checked on the first-dot prefix as well; the charset close alone
-* cannot refuse them. */
+* cannot refuse them. Exported single source: `badName` (skill directories,
+* P2-11/v15) and `validateSupportPath` (support-file stems, C-18) both
+* consume this one set — a third copy would drift. */
 const WIN32_RESERVED_DEVICE_NAMES = new Set([
 	"con",
 	"prn",
@@ -3693,6 +3750,7 @@ function validateSupportPath(filePath) {
 	if (parts.length < 2) return "Provide a file name, not just a directory.";
 	for (const part of parts.slice(1)) {
 		if (!SUPPORT_FILE_NAME_RE.test(part)) return `Unsupported file name "${part}" — use lowercase letters, digits, dots, hyphens, and underscores (leading letter or digit).`;
+		if (part.toLowerCase().endsWith(".lock")) return `Unsupported file name "${part}" — the .lock suffix is reserved for the writer-lock protocol.`;
 		const stem = part.split(".")[0]?.toLowerCase() ?? "";
 		if (WIN32_RESERVED_DEVICE_NAMES.has(stem)) return `Unsupported file name "${part}" — a Windows reserved device name.`;
 	}
@@ -3982,14 +4040,30 @@ var SkillLibrary = class {
 	dirOf(name) {
 		return skillDir(this.root, name.trim());
 	}
-	/** Name-format guard shared by every path-building mutator/reader. */
-	badName(name) {
+	/**
+	* Name-format guard for every path-building entry point (P1-1/v14 closed the
+	* one gap: `patch`). Write paths, protection probes and support-file
+	* enumeration all call it before `dirOf`, so no directory path is ever built
+	* from a name that could escape the skills root. `list()` and `snapshotAll()`
+	* are the deliberate exceptions — their names come from `listNames()`, i.e.
+	* from the tree itself, never from caller input.
+	*/
+	badName(name, opts = {}) {
 		const normalized = name.trim();
 		if (!SKILL_NAME_RE.test(normalized) || normalized.length > this.limits.maxNameLength) return `Invalid skill name "${normalized}". Use lowercase letters, digits, and hyphens (<= ${this.limits.maxNameLength}).`;
+		if (!opts.allowReserved && WIN32_RESERVED_DEVICE_NAMES.has(normalized)) return `"${normalized}" is a Windows reserved device name and cannot be used as a skill name.`;
 		return null;
 	}
+	/**
+	* Refusal reason for a write to `rawName`, or null when the write may
+	* proceed: a protection marker on the directory, or an invalid name
+	* (P1-1/v14 — the name guard lives HERE as well as at every entry point, so
+	* no caller can build a path from an unvalidated name).
+	*/
 	async writeProtection(rawName, origin = "foreground") {
 		const name = rawName.trim();
+		const badName = this.badName(name);
+		if (badName) return badName;
 		const dir = this.dirOf(name);
 		for (const marker of ["bundled", "hub-installed"]) if (await this.io.exists(markerPath(dir, marker))) return marker;
 		if (origin === "background_review" && await this.io.exists(markerPath(dir, "pinned"))) return "pinned";
@@ -3997,6 +4071,8 @@ var SkillLibrary = class {
 	}
 	async deleteProtection(rawName, options = {}) {
 		const name = rawName.trim();
+		const badName = this.badName(name, { allowReserved: true });
+		if (badName) return badName;
 		const dir = this.dirOf(name);
 		const markers = options.allowBundled ? ["hub-installed", "pinned"] : [
 			"bundled",
@@ -4008,6 +4084,7 @@ var SkillLibrary = class {
 	}
 	async isManaged(rawName) {
 		const name = rawName.trim();
+		if (this.badName(name) !== null) return false;
 		const dir = this.dirOf(name);
 		return await this.io.exists(markerPath(dir, "hermes-managed"));
 	}
@@ -4051,7 +4128,9 @@ var SkillLibrary = class {
 	* Used by the maintenance enrichment (011 §7) and probe reads.
 	*/
 	async listSupportFiles(rawName) {
-		const dir = this.dirOf(rawName);
+		const name = rawName.trim();
+		if (this.badName(name) !== null) return [];
+		const dir = this.dirOf(name);
 		let entries;
 		try {
 			entries = await this.io.list(dir);
@@ -4194,7 +4273,21 @@ var SkillLibrary = class {
 			message: `Skill "${normalized}" is protected (${protection}).`
 		};
 		const onDisk = finalContent.trimEnd() + "\n";
-		await this.io.writeText(join(dir, "SKILL.md"), onDisk);
+		const createPath = join(dir, "SKILL.md");
+		let existsAtCommit = false;
+		if (this.transact) await this.transact(this.io, createPath, (current) => {
+			if (current !== null) {
+				existsAtCommit = true;
+				return current;
+			}
+			return onDisk;
+		});
+		else if (await this.io.exists(createPath)) existsAtCommit = true;
+		else await this.io.writeText(createPath, onDisk);
+		if (existsAtCommit) return {
+			ok: false,
+			message: `Skill "${normalized}" already exists.`
+		};
 		if (origin !== "foreground") await this.io.writeText(markerPath(dir, "hermes-managed"), "");
 		await this.audit(normalized, "create", null, onDisk, "created");
 		this.notifyMutation({
@@ -4214,13 +4307,13 @@ var SkillLibrary = class {
 		return await this.serial(() => this.updateCore(name, content, origin));
 	}
 	async updateCore(name, content, origin) {
-		const dir = this.dirOf(name);
-		const path = join(dir, "SKILL.md");
 		const badName = this.badName(name);
 		if (badName) return {
 			ok: false,
 			message: badName
 		};
+		const dir = this.dirOf(name);
+		const path = join(dir, "SKILL.md");
 		const protection = await this.writeProtection(name, origin);
 		if (protection) return {
 			ok: false,
@@ -4295,6 +4388,11 @@ var SkillLibrary = class {
 		return await this.serial(() => this.patchCore(name, oldString, newString, filePath, replaceAll, origin));
 	}
 	async patchCore(name, oldString, newString, filePath, replaceAll, origin) {
+		const badName = this.badName(name);
+		if (badName) return {
+			ok: false,
+			message: badName
+		};
 		const dir = this.dirOf(name);
 		const skillMd = join(dir, "SKILL.md");
 		if (!await this.io.exists(skillMd)) return {
@@ -4333,6 +4431,13 @@ var SkillLibrary = class {
 				},
 				write: null
 			};
+			if (oldString === "" || trimPatternBoundaries(oldString) === "") return {
+				result: {
+					ok: false,
+					message: `old_string is empty (or whitespace-only) — a patch of "${name}/${patchLabel}" needs an anchor; use update for a full rewrite.`
+				},
+				write: null
+			};
 			const patched = fuzzyPatch(md, oldString, newString, replaceAll);
 			if (patched === null) return {
 				result: {
@@ -4428,9 +4533,113 @@ var SkillLibrary = class {
 			};
 		});
 	}
+	/**
+	* P2-9 (v15): the destructive directory move shared by archive and
+	* restoreFromArchive — rename first, copy+remove fallback when the backend
+	* cannot rename across media (V5-35), with the E-14 rollback when the
+	* fallback's source removal fails. Returns a failure MESSAGE on a failed
+	* move (caller wraps into a structured result) or undefined on success.
+	*/
+	async moveDir(dir, dest) {
+		try {
+			await this.io.rename(dir, dest);
+			return;
+		} catch {
+			if (await this.io.exists(dest)) return "the destination appeared mid-move (concurrent create or restore); refusing to merge — inspect both trees";
+			try {
+				await this.io.copy(dir, dest);
+			} catch (copyError) {
+				return `the move fell back to copy but failed (${copyError instanceof Error ? copyError.message : String(copyError)}); the tree stays where it is`;
+			}
+			try {
+				await this.io.remove(dir);
+				return;
+			} catch (error) {
+				const reason = error instanceof Error ? error.message : String(error);
+				try {
+					await this.io.remove(dest);
+					return `the copy succeeded but the source could not be removed (${reason}); the copied tree was rolled back`;
+				} catch {
+					return `the copy succeeded but the source could not be removed (${reason}) and the copied tree could not be rolled back — the tree now exists in BOTH locations; clean up manually`;
+				}
+			}
+		}
+	}
+	/**
+	* P2 (v16): the write-lock probe for the DESTRUCTIVE MOVERS (archive /
+	* restoreFromArchive). A byte-writer mid-flight is the ghost-generator —
+	* after the move its transact commit re-creates `<dir>/…` (mkdir
+	* recursive) and the tree ends half-archived. The signal is the writer's
+	* own lock file, and its PLACEMENT (inside the moved directory) is why the
+	* mover must PROBE-and-REFUSE instead of acquiring it: an acquired lock
+	* would be renamed into `.archive` with the tree, stranding a phantom live
+	* lock (the v16 audit proved the probe→rename TOCTOU does exactly that,
+	* and restore would later move the residue back into the live root).
+	* Coverage: `SKILL.md.lock` (update/patch of the body) plus one level of
+	* each support dir (write_file's lock sits next to its file). Residual:
+	* NESTED support-subdir locks and the probe→rename TOCTOU itself remain
+	* fail-safe (renameWithRetry rides the write out; the writer's locked
+	* re-read refuses on the moved-away file), and a residue `.lock` from a
+	* CRASHED writer also refuses — correct: inspect, don't archive.
+	*/
+	async hasWriteLock(dir) {
+		const markerLocks = [
+			join(dir, "SKILL.md.lock"),
+			join(dir, ".pinned.lock"),
+			join(dir, ".hermes-managed.lock")
+		];
+		for (const lock of markerLocks) if (await this.isWriterLock(lock)) return true;
+		for (const supportDir of SUPPORT_DIRS) {
+			let entries;
+			try {
+				entries = await this.io.list(join(dir, supportDir));
+			} catch {
+				return true;
+			}
+			for (const entry of entries) {
+				if (!entry.endsWith(".lock")) continue;
+				if (await this.isWriterLock(join(dir, supportDir, entry))) return true;
+			}
+		}
+		return false;
+	}
+	/** P2 (v17): a file only counts as a writer lock when its body has the
+	* `pid:token` shape the io layer writes. User support files legitimately
+	* named `*.lock` (allowed by SUPPORT_FILE_NAME_RE) must not trip the probe
+	* or be swept as residue — the v16 first cut matched on suffix alone,
+	* which permanently refused archiving and deleted user content on restore. */
+	async isWriterLock(lockPath) {
+		const body = await this.io.readText(lockPath).catch(() => null);
+		if (body === null) return false;
+		return /^\d+:[0-9a-f]*$/.test(body.trim());
+	}
+	/** P2 (v16): best-effort removal of lock residue inside a RESTORED tree —
+	* a `.lock` that a pre-restore crash or TOCTOU stranded in `.archive`
+	* cannot have a live writer (restore refuses when the live root is
+	* locked), and if left in place its body (a live pid on a single-host
+	* deployment) structurally closes the writer's self-heal path. */
+	async deleteStrandedLocks(dir) {
+		await this.sweepLockIfStranded(join(dir, "SKILL.md.lock"));
+		for (const supportDir of SUPPORT_DIRS) {
+			let entries = [];
+			try {
+				entries = await this.io.list(join(dir, supportDir));
+			} catch {
+				continue;
+			}
+			for (const entry of entries) if (entry.endsWith(".lock")) await this.sweepLockIfStranded(join(dir, supportDir, entry));
+		}
+	}
+	/** Remove `lockPath` only when its body has the writer-lock `pid:token`
+	* shape; anything else (a user support file) is left untouched. */
+	async sweepLockIfStranded(lockPath) {
+		const body = await this.io.readText(lockPath).catch(() => null);
+		if (body === null || !/^\d+:[0-9a-f]*$/.test(body.trim())) return;
+		await this.io.remove(lockPath).catch(() => {});
+	}
 	async archive(rawName, options = {}) {
 		const name = rawName.trim();
-		const badName = this.badName(name);
+		const badName = this.badName(name, { allowReserved: true });
 		if (badName) return {
 			ok: false,
 			message: badName
@@ -4451,6 +4660,11 @@ var SkillLibrary = class {
 				ok: false,
 				message: "absorbed_into cannot be the skill being archived (cannot absorb into itself)."
 			};
+			const intoBad = this.badName(options.absorbedInto.trim());
+			if (intoBad) return {
+				ok: false,
+				message: `absorbed_into: ${intoBad}`
+			};
 			if (!await this.io.readText(join(this.dirOf(options.absorbedInto), "SKILL.md"))) return {
 				ok: false,
 				message: `absorbed_into="${options.absorbedInto}" does not exist.`
@@ -4469,37 +4683,19 @@ var SkillLibrary = class {
 				message: `Skill "${name}" is a symlink; refusing to archive it.`
 			};
 		}
-		try {
-			await this.io.rename(dir, dest);
-		} catch {
-			try {
-				await this.io.copy(dir, dest);
-			} catch (copyError) {
-				return {
-					ok: false,
-					message: `Skill "${name}" archive fell back to copy but failed (${copyError instanceof Error ? copyError.message : String(copyError)}); the skill stays where it is.`
-				};
-			}
-			try {
-				await this.io.remove(dir);
-			} catch (error) {
-				const reason = error instanceof Error ? error.message : String(error);
-				try {
-					await this.io.remove(dest);
-					return {
-						ok: false,
-						message: `Archive copy succeeded but the source could not be removed (${reason}); the copied archive was rolled back.`
-					};
-				} catch {
-					return {
-						ok: false,
-						message: `Archive copy succeeded but the source could not be removed (${reason}) and the archive copy could not be rolled back — the skill now exists in BOTH the active root and .archive; clean up manually.`
-					};
-				}
-			}
-		}
+		if (await this.hasWriteLock(dir)) return {
+			ok: false,
+			message: `Skill "${name}" is being written (write lock present); retry archiving once the write completes.`
+		};
+		const moveFailure = await this.moveDir(dir, dest);
+		if (moveFailure !== void 0) return {
+			ok: false,
+			message: `Skill "${name}" archive failed: ${moveFailure}.`
+		};
 		const reason = options.reason ?? (options.absorbedInto ? `Consolidated into ${options.absorbedInto}` : "Archived by self-evolution curator");
-		await this.io.writeText(join(dest, ".archive-reason"), `${(/* @__PURE__ */ new Date()).toISOString()}: ${reason}\n`);
+		try {
+			await this.io.writeText(join(dest, ".archive-reason"), `${(/* @__PURE__ */ new Date()).toISOString()}: ${reason}\n`);
+		} catch {}
 		await this.audit(name, "archive", md, null, reason);
 		this.notifyMutation({
 			action: "archive",
@@ -4808,7 +5004,7 @@ var SkillLibrary = class {
 	*/
 	async applyTreeChange(plan) {
 		const name = plan.name.trim();
-		const badName = this.badName(name);
+		const badName = this.badName(name, { allowReserved: true });
 		if (badName) return {
 			ok: false,
 			message: badName
@@ -4892,7 +5088,7 @@ var SkillLibrary = class {
 	*/
 	async restoreFromArchive(rawName) {
 		const name = rawName.trim();
-		const bad = this.badName(name);
+		const bad = this.badName(name, { allowReserved: true });
 		if (bad) return {
 			ok: false,
 			message: bad
@@ -4929,20 +5125,18 @@ var SkillLibrary = class {
 				message: `Archived entry "${chosen}" is a symlink; refusing to restore it.`
 			};
 		}
-		try {
-			await this.io.rename(source, dest);
-		} catch {
-			try {
-				await this.io.copy(source, dest);
-				await this.io.remove(source);
-			} catch (error) {
-				return {
-					ok: false,
-					message: `Restore of "${name}" from .archive failed: ${error instanceof Error ? error.message : String(error)}`
-				};
-			}
-		}
+		if (await this.hasWriteLock(dest)) return {
+			ok: false,
+			message: `Skill "${name}" is being written (write lock present); retry restoring once the write completes.`
+		};
+		const moveFailure = await this.moveDir(source, dest);
+		if (moveFailure !== void 0) return {
+			ok: false,
+			message: `Restore of "${name}" from .archive failed: ${moveFailure}`
+		};
+		await this.deleteStrandedLocks(dest);
 		if (await this.io.exists(join(dest, ".archive-reason"))) await this.io.remove(join(dest, ".archive-reason"));
+		await this.audit(name, "restore", null, await this.io.readText(join(dest, "SKILL.md")).catch(() => null), `restored from ${source}`);
 		this.notifyMutation({
 			action: "restore",
 			name,
@@ -4959,12 +5153,12 @@ var SkillLibrary = class {
 		return await this.serial(() => this.writeSupportFileCore(name, filePath, content, origin));
 	}
 	async writeSupportFileCore(name, filePath, content, origin) {
-		const dir = this.dirOf(name);
 		const badName = this.badName(name);
 		if (badName) return {
 			ok: false,
 			message: badName
 		};
+		const dir = this.dirOf(name);
 		if (!await this.io.exists(join(dir, "SKILL.md"))) return {
 			ok: false,
 			message: `Skill "${name}" not found.`
@@ -5053,6 +5247,10 @@ var SkillLibrary = class {
 			message: `File "${filePath}" not found in skill "${name}".`
 		};
 		const before = await this.io.readText(target).catch(() => null);
+		if (before === null) return {
+			ok: false,
+			message: `"${filePath}" is not a readable regular file — remove the files inside it one by one.`
+		};
 		await this.io.remove(target);
 		await this.audit(name, "remove_file", before, null, `removed ${filePath}`);
 		this.notifyMutation({
@@ -5253,7 +5451,11 @@ var SkillLibrary = class {
 				await this.io.copy(join(snapshotPath, ".archive"), archiveRoot);
 			} else if (manifest.hasArchive === false) await this.io.remove(archiveRoot);
 		}
+		for (const entry of await this.io.list(this.root)) {
+			if (entry.startsWith(".")) continue;
+			await this.deleteStrandedLocks(join(this.root, entry));
+		}
 	}
 };
 //#endregion
-export { AUTHORING_DESCRIPTION_BAR, COMBINED_REVIEW_PLAN_PROMPT, COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_HEALTH_THRESHOLDS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_USER_CHAR_LIMIT, DRIFT_MAX_LINE_CHARS, DRIFT_SIGNALS_VERSION, DRIFT_SIGNAL_NOUNS, DSH_AUTHORING_STANDARDS, ENTRY_DELIMITER, EVENT_ARCHIVE_PREFIX, EVENT_LOG_RETAIN_ARCHIVES, EVENT_LOG_ROTATE_AT, EVENT_LOG_VERSION, EVOLUTION_ENV_KEYS, EVOLUTION_WRITE_TOOLS, EvolutionGateSet, FORBIDDEN_CONTROL_KEYS, HEALTH_STAMP_RE, LOW_QUALITY_THRESHOLD, MAINTAIN_OUTPUT_INSTRUCTION, MAINTAIN_PROMPT, MAX_DESCRIPTION_LENGTH, MAX_RESTRUCTURE_MOVES, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MEMORY_REVIEW_PROMPT, MIN_STAMP_BODY_CHARS, MUTATIONS_FILE_VERSION, MemoryStore, PATTERN_OVERLAP, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, QUALITY_WEIGHTS, RESTRUCTURE_TARGET_RE, SKILLS_GUIDANCE, SKILL_NAME_RE, SKILL_REVIEW_PLAN_PROMPT, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, SUPPORT_DIRS, SUPPRESSED_FILE_VERSION, SkillLibrary, THREAT_EXEMPT_HINT, advanceReview, allowRowCollisions, appendEvolutionEvent, applyCuratorFields, applyCuratorLifecycleFields, applyCuratorMetaFields, assessStructureHealth, authoringFeedback, buildCuratorRunReport, buildLearnPrompt, bumpPatch, bumpUse, bumpView, clampedNumber, composePresetComposition, computeDedupGroups, computeDriftSignals, computeLifecycleTransitions, computePrefixClusters, computeQualityScores, computeScopeView, contentHash, createGateSet, duplicateHeadings, emptyRecord, evaluateThreat, eventsFile, evolutionHome, evolutionIoAdapter, evolutionRoot, findDriftSignal, foldCuratorFields, foldTurn, frontmatterBlock, frontmatterYamlUnsafeValues, getRecord, latestActivityAt, lifecycleCandidate, listEventArchives, loadMutations, loadSuppressedNames, loadUsage, makeSerialQueue, markAgentCreated, markerEntryName, memoryRoot, missingSupportPointers, mutateUsage, mutationsFile, narrowNameMatches, nodeEvolutionIo, normalizeFrontmatter, normalizeUsageRecord, observeEvent, overlongLines, parseCuratorNominations, parseEvolutionEvents, parseFrontmatter, pendingSelfCleanup, readEvolutionEvents, readEvolutionTimeline, recordMutation, redactSecrets, relatedSkillNames, renameWithRetry, renderCuratorReportMarkdown, resolveOrigins, resolveSkillsRoot, retainEventArchives, reviewPrompt, saveSuppressedNames, saveUsage, scanContentThreats, scanMemoryThreats, scanThreats, skillsRoot, suppressedFile, transactIo, updateSuppressedNames, usageFile, usageObserved, validateFrontmatter, verifyPromptBundle, writeDurableTmp, yamlPlainScalarNeedsQuotes };
+export { AUTHORING_DESCRIPTION_BAR, COMBINED_REVIEW_PLAN_PROMPT, COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_BOOT_GRACE_SECONDS, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_CURATOR_REVIEW_MAX_TOKENS, DEFAULT_HEALTH_THRESHOLDS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_REVIEW_CONTEXT_MESSAGES, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_MESSAGE_CHARS, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_REVIEW_TIMEOUT_MS, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_USER_CHAR_LIMIT, DRIFT_MAX_LINE_CHARS, DRIFT_SIGNALS_VERSION, DRIFT_SIGNAL_NOUNS, DSH_AUTHORING_STANDARDS, ENTRY_DELIMITER, EVENT_ARCHIVE_PREFIX, EVENT_LOG_RETAIN_ARCHIVES, EVENT_LOG_ROTATE_AT, EVENT_LOG_VERSION, EVOLUTION_WRITE_TOOLS, EvolutionGateSet, FORBIDDEN_CONTROL_KEYS, HEALTH_STAMP_RE, LOW_QUALITY_THRESHOLD, MAINTAIN_OUTPUT_INSTRUCTION, MAINTAIN_PROMPT, MAX_DESCRIPTION_LENGTH, MAX_RESTRUCTURE_MOVES, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MEMORY_REVIEW_PROMPT, MIN_STAMP_BODY_CHARS, MUTATIONS_FILE_VERSION, MemoryStore, PATTERN_OVERLAP, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, QUALITY_WEIGHTS, RESTRUCTURE_TARGET_RE, SKILLS_GUIDANCE, SKILL_NAME_RE, SKILL_REVIEW_PLAN_PROMPT, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, SUPPORT_DIRS, SUPPRESSED_FILE_VERSION, SkillLibrary, THREAT_EXEMPT_HINT, WIN32_RESERVED_DEVICE_NAMES, advanceReview, allowRowCollisions, appendEvolutionEvent, applyCuratorFields, applyCuratorLifecycleFields, applyCuratorMetaFields, assessStructureHealth, authoringFeedback, buildCuratorRunReport, buildLearnPrompt, bumpPatch, bumpUse, bumpView, clampedNumber, composePresetComposition, computeDedupGroups, computeDriftSignals, computeLifecycleTransitions, computePrefixClusters, computeQualityScores, computeScopeView, contentHash, createGateSet, duplicateHeadings, emptyRecord, evaluateThreat, eventsFile, evolutionHome, evolutionIoAdapter, evolutionRoot, findDriftSignal, foldCuratorFields, foldTurn, frontmatterBlock, frontmatterYamlUnsafeValues, getRecord, latestActivityAt, lifecycleCandidate, listEventArchives, loadMutations, loadSuppressedNames, loadUsage, makeSerialQueue, markAgentCreated, markerEntryName, memoryRoot, missingSupportPointers, mutateUsage, mutationsFile, narrowNameMatches, nodeEvolutionIo, normalizeFrontmatter, normalizeUsageRecord, observeEvent, overlongLines, parseCuratorNominations, parseEvolutionEvents, parseFrontmatter, pendingSelfCleanup, readEvolutionEvents, readEvolutionTimeline, recordMutation, redactSecrets, relatedSkillNames, renameWithRetry, renderCuratorReportMarkdown, resolveOrigins, resolveSkillsRoot, retainEventArchives, reviewPrompt, saveSuppressedNames, saveUsage, scanContentThreats, scanMemoryThreats, scanThreats, skillsRoot, suppressedFile, transactIo, updateSuppressedNames, usageFile, usageObserved, validateFrontmatter, verifyPromptBundle, writeDurableTmp, yamlPlainScalarNeedsQuotes };

package/lib/types/constants.d.ts

@@ -54,6 +54,13 @@ export declare const DEFAULT_USER_CHAR_LIMIT = 1375;
 /** Consolidation-failure backoff cap, shared by MemoryStore and memory-files' Config default. */
 export declare const DEFAULT_CONSOLIDATION_FAILURES = 3;
 export declare const DEFAULT_SKILL_CONTENT_CHARS = 100000;
+/** P3-19 (v14): defaults that were written twice (schema `.default()` AND the
+ * clamp fallback literal) now have one home per value. */
+export declare const DEFAULT_REVIEW_TIMEOUT_MS = 120000;
+export declare const DEFAULT_REVIEW_CONTEXT_MESSAGES = 60;
+export declare const DEFAULT_REVIEW_MESSAGE_CHARS = 2000;
+export declare const DEFAULT_CURATOR_BOOT_GRACE_SECONDS = 10;
+export declare const DEFAULT_CURATOR_REVIEW_MAX_TOKENS = 2048;
 /** 0.3.17 (S3.10, T-1): control-plane fields a model-facing write call may
  * never carry — single source for plan-validator, evolution-policy and the
  * threat scanner (they used to each hardcode the list). */

package/lib/types/env.d.ts

@@ -7,10 +7,14 @@
  * reads inside patch YAML `!!js` expressions (session-query path/openAt) stay
  * in the profile config evaluation — they are NOT migrated (they are resolved
  * at cordis config time, not plugin time) but are documented in the README
- * env table.
+ * env table. `EVOLUTION_SCOPE` is read by the source installers only
+ * (`packages/scripts/install-layered.mjs`, `packages/test-support/row-contract.ts`),
+ * never by plugin runtime code.
+ *
+ * v14 P3-1: the former `EVOLUTION_ENV_KEYS` export was deleted — nothing read
+ * it, so the "generated env reference" it claimed to source was never
+ * generated (the README table is maintained by hand and now lists every key).
  */
-/** Plugin-side DSH_EVOLUTION_* keys (config-layer keys are documented separately). */
-export declare const EVOLUTION_ENV_KEYS: readonly ["DSH_EVOLUTION_ALLOW_ROW_COLLISIONS"];
 /** N-5 escape: `DSH_EVOLUTION_ALLOW_ROW_COLLISIONS=1` downgrades a delta-row
  * collision from fail-loud to warn+keep-both. Any other value (including an
  * EMPTY/whitespace string — a set-but-unset variable) keeps the fail-loud. */

package/lib/types/skill-health.d.ts

@@ -47,7 +47,13 @@ export declare const HEALTH_STAMP_RE: RegExp;
  */
 export declare const MIN_STAMP_BODY_CHARS = 2000;
 export type SkillHealthVerdict = 'healthy' | 'warn' | 'needs-restructure';
-/** Facts a caller already has; assessors never do IO. */
+/** Facts a caller already has; assessors never do IO.
+ *
+ * `bodyChars`/`bodyText` are the WHOLE `SKILL.md` text as read from disk
+ * (frontmatter included), matching both callers: `SkillLibrary.assessHealth`
+ * and `snapshotFromLibrary` feed `read()` verbatim. The field names predate
+ * that convention; the thresholds are calibrated against the whole file, so a
+ * caller must not strip frontmatter before measuring. */
 export interface SkillHealthSnapshot {
     skillName: string;
     bodyChars: number;

package/lib/types/skill-store.d.ts

@@ -228,6 +228,13 @@ export interface AuthoringFeedback {
  * truncated or route-poor instead of silently shipping it.
  */
 export declare function authoringFeedback(frontmatter: Frontmatter): AuthoringFeedback;
+/** C-18: win32 reserves these stems with ANY extension (`nul.md` hits the
+ * NUL device), and they are fully inside the charset above — so the reserved
+ * set is checked on the first-dot prefix as well; the charset close alone
+ * cannot refuse them. Exported single source: `badName` (skill directories,
+ * P2-11/v15) and `validateSupportPath` (support-file stems, C-18) both
+ * consume this one set — a third copy would drift. */
+export declare const WIN32_RESERVED_DEVICE_NAMES: ReadonlySet<string>;
 export declare class SkillLibrary {
     readonly root: string;
     readonly limits: SkillLimits;
@@ -280,8 +287,21 @@ export declare class SkillLibrary {
   
      */
     private dirOf;
-    /** Name-format guard shared by every path-building mutator/reader. */
+    /**
+     * Name-format guard for every path-building entry point (P1-1/v14 closed the
+     * one gap: `patch`). Write paths, protection probes and support-file
+     * enumeration all call it before `dirOf`, so no directory path is ever built
+     * from a name that could escape the skills root. `list()` and `snapshotAll()`
+     * are the deliberate exceptions — their names come from `listNames()`, i.e.
+     * from the tree itself, never from caller input.
+     */
     private badName;
+    /**
+     * Refusal reason for a write to `rawName`, or null when the write may
+     * proceed: a protection marker on the directory, or an invalid name
+     * (P1-1/v14 — the name guard lives HERE as well as at every entry point, so
+     * no caller can build a path from an unvalidated name).
+     */
     writeProtection(rawName: string, origin?: WriteOrigin): Promise<string | null>;
     deleteProtection(rawName: string, options?: {
         allowBundled?: boolean | undefined;
@@ -326,6 +346,47 @@ export declare class SkillLibrary {
     private updateCore;
     patch(rawName: string, oldString: string, newString: string, filePath?: string, replaceAll?: boolean, origin?: WriteOrigin): Promise<SkillActionResult>;
     private patchCore;
+    /**
+     * P2-9 (v15): the destructive directory move shared by archive and
+     * restoreFromArchive — rename first, copy+remove fallback when the backend
+     * cannot rename across media (V5-35), with the E-14 rollback when the
+     * fallback's source removal fails. Returns a failure MESSAGE on a failed
+     * move (caller wraps into a structured result) or undefined on success.
+     */
+    private moveDir;
+    /**
+     * P2 (v16): the write-lock probe for the DESTRUCTIVE MOVERS (archive /
+     * restoreFromArchive). A byte-writer mid-flight is the ghost-generator —
+     * after the move its transact commit re-creates `<dir>/…` (mkdir
+     * recursive) and the tree ends half-archived. The signal is the writer's
+     * own lock file, and its PLACEMENT (inside the moved directory) is why the
+     * mover must PROBE-and-REFUSE instead of acquiring it: an acquired lock
+     * would be renamed into `.archive` with the tree, stranding a phantom live
+     * lock (the v16 audit proved the probe→rename TOCTOU does exactly that,
+     * and restore would later move the residue back into the live root).
+     * Coverage: `SKILL.md.lock` (update/patch of the body) plus one level of
+     * each support dir (write_file's lock sits next to its file). Residual:
+     * NESTED support-subdir locks and the probe→rename TOCTOU itself remain
+     * fail-safe (renameWithRetry rides the write out; the writer's locked
+     * re-read refuses on the moved-away file), and a residue `.lock` from a
+     * CRASHED writer also refuses — correct: inspect, don't archive.
+     */
+    private hasWriteLock;
+    /** P2 (v17): a file only counts as a writer lock when its body has the
+     * `pid:token` shape the io layer writes. User support files legitimately
+     * named `*.lock` (allowed by SUPPORT_FILE_NAME_RE) must not trip the probe
+     * or be swept as residue — the v16 first cut matched on suffix alone,
+     * which permanently refused archiving and deleted user content on restore. */
+    private isWriterLock;
+    /** P2 (v16): best-effort removal of lock residue inside a RESTORED tree —
+     * a `.lock` that a pre-restore crash or TOCTOU stranded in `.archive`
+     * cannot have a live writer (restore refuses when the live root is
+     * locked), and if left in place its body (a live pid on a single-host
+     * deployment) structurally closes the writer's self-heal path. */
+    private deleteStrandedLocks;
+    /** Remove `lockPath` only when its body has the writer-lock `pid:token`
+     * shape; anything else (a user support file) is left untouched. */
+    private sweepLockIfStranded;
     archive(rawName: string, options?: ArchiveOptions): Promise<SkillActionResult>;
     /**
      * Merge the bodies of `sources` into `target` and archive the sources with

package/lib/types/threats.d.ts

@@ -52,9 +52,11 @@ export declare function scanContentThreats(text: string, maxScanChars?: number,
  * V10-03 (P2-18): suffix the SkillLibrary/MemoryStore write gates append to a
  * block message — the hit label is already embedded by scanContentThreats /
  * scanMemoryThreats, this names the deployable self-heal path so the model
- * (or operator) can allowlist a known-benign label. The evolution-threat tool
- * channel deliberately does NOT append it: that channel has no
- * threatExemptLabels option to advertise.
+ * (or operator) can allowlist a known-benign label. P2-4 (v14): the
+ * evolution-threat guard channel now carries `threatExemptLabels` too, so its
+ * block message (which embeds the same exemption sentence) is accurate there
+ * as well; this suffix stays store-side because the guard returns the scan
+ * message verbatim.
  */
 export declare const THREAT_EXEMPT_HINT = " If this is a legitimate false positive, the deployment can allow its label via the threatExemptLabels store option.";
 //# sourceMappingURL=threats.d.ts.map

package/lib/types/usage.d.ts

@@ -18,6 +18,16 @@ export interface UsageRecord {
     archived_at: string | null;
     quality_score?: number | undefined;
     quality_warn?: boolean | undefined;
+    /** P1-1 (v15): feedback-owned quality signal. Field ownership contract —
+     * `quality_score`/`quality_warn` are written ONLY by the curator's
+     * six-factor `scoreTree`; `feedback_score`/`feedback_warn` are written ONLY
+     * by the feedback channel (`SkillUsageRegistry.setFeedbackQuality`);
+     * `foldCuratorFields` refreshes the quality_* pair tree-wide and must never
+     * touch feedback_*. The lifecycle engine and the scope view read the UNION
+     * of both warn flags, which is what makes negative feedback decision-
+     * relevant again. */
+    feedback_score?: number | undefined;
+    feedback_warn?: boolean | undefined;
 }
 export type UsageMap = Map<string, UsageRecord>;
 export declare function usageFile(root: string): string;
@@ -60,6 +70,9 @@ export declare function applyCuratorLifecycleFields(disk: UsageRecord, curated:
  * Copy the recomputed meta pair (quality_score/quality_warn + the
  * marker-mirrored pin flag) — refreshed tree-wide each run by design, so a
  * concurrent curator run's lifecycle changes are never reverted by them.
+ * P1-1 (v15): the feedback pair (`feedback_score`/`feedback_warn`) is
+ * deliberately NOT copied — it is feedback-owned (see the field-ownership
+ * contract on {@link UsageRecord}) and must survive curator runs untouched.
  */
 export declare function applyCuratorMetaFields(disk: UsageRecord, curated: UsageRecord): void;
 /**
@@ -76,7 +89,9 @@ export declare function foldCuratorFields(disk: UsageMap, curated: UsageMap, sta
 /** Whole-file usage write (V6-37, 0.3.37): this is the ONE path that bypasses
  * the malformed-defense and the transact lock — prefer `mutateUsage` for any
  * read-modify-write so a concurrent writer cannot lose its update and a
- * malformed sidecar stays recoverable. Kept for fixture/test seeding. */
+ * malformed sidecar stays recoverable. Kept for fixture/test seeding.
+ * @internal P3-16 (v14): no production caller (verified by grep); exported for
+ * the family's tests only. Do not use it to write the sidecar in new code. */
 export declare function saveUsage(root: string, map: UsageMap, io?: EvolutionIoLike): Promise<void>;
 export declare function getRecord(map: UsageMap, name: string): UsageRecord;
 export declare function bumpView(map: UsageMap, name: string, when?: Date): void;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-core",
   "description": "Shared stores, prompts, signals and lifecycle logic for the dsh-evolution plugin family (community build)",
-  "version": "0.3.61",
+  "version": "0.3.63",
   "publishConfig": {
     "access": "public"
   },