@lmzhen/dsh-evolution-core 0.3.63 → 0.3.64

package/README.md

@@ -29,16 +29,17 @@ Single-file writes (`update`, `patch`, `writeSupportFile`)
 additionally run the read and the write inside `transactIo` when a caller
 injects a `transact` into the constructor — that is the cross-process lock, so
 two processes sharing `DSH_HOME` cannot interleave their RMW on one file.
-`create` writes a new file and `archive`/`consolidate` already own a two-phase
-commit, so they deliberately stay outside the serial chain.
-
-**0.3.46 residual (documented, per G2.5 precedent):** the low-frequency
-single-file entry points `create`, `archive`, `removeSupportFile` and
-`setPinned` still perform an unlocked read→write (their per-file read is not
-inside the serial/transact task). The race needs a same-process concurrent
-mutator on the SAME skill file, which the serialized entry points above make
-unlikely; the exposure is acknowledged and not locked (收益不抵锁面扩大 —
-adding locks to four low-frequency entry points is not worth the surface).
+`create` is INSIDE the serial chain and, when a transact backend is bound, its
+exists check runs inside the same per-file transact (v18); `archive`/`consolidate`
+are rename-based two-phase paths and stay outside the single-file serial chain.
+
+**v18 residual (updated):** `create`, `removeSupportFile` and `setPinned` now
+run on the serial chain (`removeSupportFile`'s delete also goes through the
+per-file transact), so the remaining single-file residual is the protection
+TOCTOU (a marker check outside the transact) and the multi-file two-phase
+paths `archive`/`consolidate`/`restructure`. The race needs a concurrent
+mutator on the SAME skill file/package; the exposure is acknowledged and the
+protection check is the next candidate (see the v18 optimization plan, E-5).
 
 When the backend provides `transact` (nodeEvolutionIo and the io adapter do),
 the constructor binds it BY DEFAULT since 0.3.27 — the single-file entry points
@@ -47,8 +48,9 @@ the constructor binds it BY DEFAULT since 0.3.27 — the single-file entry point
 instantiation, so same-file concurrent writes from different processes no
 longer resolve to last-writer-wins there. An explicit `transact` argument
 overrides the default binding. The two-phase paths deliberately stay outside
-that lock: `create` (exists probe + write) can still double-pass the probe
-across processes, `archive`/`consolidate` are rename-based with best-effort
+that lock: `create`'s exists probe runs inside the transact when a transact
+backend is bound (v18), so only a transact-less custom backend can still
+double-pass the probe across processes; `archive`/`consolidate` are rename-based with best-effort
 rollback (an archive loser's rollback surfaces the raw failure when the source
 vanished), and `restructure`'s multi-file swap can expose an interleaved tree
 to a concurrent reader. These residual windows are documented rather than

package/lib/index.js

@@ -156,12 +156,41 @@ async function fsyncDirectory(path) {
 async function commitTmp(tmp, target) {
 	try {
 		await renameWithRetry(tmp, target);
-		await fsyncDirectory(dirname(target));
 	} catch (error) {
 		await rm(tmp, { force: true }).catch(() => {});
 		throw error;
 	}
+	try {
+		await fsyncDirectory(dirname(target));
+	} catch (error) {
+		throw Object.assign(/* @__PURE__ */ new Error(`commitTmp: ${target} was renamed but the directory fsync failed: ${error instanceof Error ? error.message : String(error)}`), {
+			committed: true,
+			cause: error
+		});
+	}
+}
+/**
+* True when the pid is alive (EPERM = alive but unowned; ESRCH = gone).
+* V18 single source: the node backend's lock takeover and SkillLibrary's
+* stranded-lock sweep must use the same liveness rule.
+*/
+function isProcessAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error?.code === "EPERM";
+	}
 }
+/** F-17 (v18): the write-lock protocol is a cross-module contract — the lock
+* file is `<target>.lock` and its body is `<pid>:<token>`. This module creates
+* them (`withWriteLock`) and `skill-store`'s probes/sweepers parse them, so both
+* consume these two constants instead of repeating the literals. */
+const LOCK_SUFFIX = ".lock";
+/** Writer-lock body shape: a decimal pid, a colon, then the claim token. A
+* torn body (no parsable pid) still matches the `\\d+:` prefix rule only when
+* the pid part is intact, which is what the takeover probe needs. */
+const LOCK_BODY_RE = /^\d+:[0-9a-f]*$/;
 /**
 * Build the Node IO backend. `lockAttempts` scales the write-lock retry budget
 * (attempts × 50ms); the default 40 (~2s, rc.69) covers production contention,
@@ -174,15 +203,8 @@ function nodeEvolutionIo(lockAttempts = 40) {
 		const code = error?.code;
 		return code === "ENOENT" || code === "ENOTDIR";
 	};
-	/** True when the pid is alive (EPERM = alive but unowned; ESRCH = gone). */
-	const isAlive = (pid) => {
-		try {
-			process.kill(pid, 0);
-			return true;
-		} catch (error) {
-			return error?.code === "EPERM";
-		}
-	};
+	/** True when the pid is alive (single source: `isProcessAlive`). */
+	const isAlive = isProcessAlive;
 	/**
 	* V10-07 (P2-1): age threshold for taking over a lock whose body is TORN
 	* (non-empty, but the pid prefix does not parse to a positive integer). 1h:
@@ -238,7 +260,7 @@ function nodeEvolutionIo(lockAttempts = 40) {
 	* forever.
 	*/
 	const withWriteLock = async (path, task) => {
-		const lock = `${path}.lock`;
+		const lock = `${path}${LOCK_SUFFIX}`;
 		let myClaim = "";
 		for (let attempt = 0; attempt < lockAttempts; attempt += 1) {
 			let lockHandle = null;
@@ -343,40 +365,41 @@ function nodeEvolutionIo(lockAttempts = 40) {
 			return;
 		}
 		const prefix = `${base}.`;
-		const lockName = `${base}.lock`;
+		const lockName = `${base}${LOCK_SUFFIX}`;
 		const ticketName = `${lockName}.next`;
 		const CORRUPT_SWEEP_AGE_MS = 168 * 36e5;
 		for (const name of entries) {
 			if (!name.startsWith(prefix) || name === lockName) continue;
-			if (!name.endsWith(".tmp")) {
-				if (name === ticketName) {
-					const ticketPath = join(dir, name);
-					try {
-						const body = await readFile(ticketPath, "utf8").catch(() => "");
-						const holder = Number(body.split(":")[0] ?? "");
-						const st = await stat(ticketPath);
-						const dead = !Number.isInteger(holder) || holder <= 0 || !isAlive(holder);
-						const old = Date.now() - st.mtimeMs > 1e3;
-						if (dead || old) await rm(ticketPath, { force: true });
-					} catch {}
-					continue;
-				}
-				if (name.includes(".corrupt")) {
-					const corruptPath = join(dir, name);
-					try {
-						const st = await stat(corruptPath);
-						if (Date.now() - st.mtimeMs > CORRUPT_SWEEP_AGE_MS) await rm(corruptPath, { force: true });
-					} catch {}
-				}
+			const tmpMatch = /^(.*)\.(\d+)\.([0-9a-f]+)\.tmp$/.exec(name);
+			if (tmpMatch !== null && tmpMatch[1] === base) {
+				const tmpPath = join(dir, name);
+				const holder = Number(tmpMatch[2]);
+				try {
+					const st = await stat(tmpPath);
+					const deadHolder = !Number.isInteger(holder) || holder <= 0 || !isAlive(holder);
+					if (holder === process.pid || Date.now() - st.mtimeMs > 36e5 && deadHolder) await rm(tmpPath, { force: true });
+				} catch {}
 				continue;
 			}
-			const tmpPath = join(dir, name);
-			const holder = Number(name.slice(prefix.length, name.length - 4).split(".")[0] ?? "");
-			try {
-				const st = await stat(tmpPath);
-				const deadHolder = !Number.isInteger(holder) || holder <= 0 || !isAlive(holder);
-				if (holder === process.pid || Date.now() - st.mtimeMs > 36e5 && deadHolder) await rm(tmpPath, { force: true });
-			} catch {}
+			if (name === ticketName) {
+				const ticketPath = join(dir, name);
+				try {
+					const body = await readFile(ticketPath, "utf8").catch(() => "");
+					const holder = Number(body.split(":")[0] ?? "");
+					const st = await stat(ticketPath);
+					const dead = !Number.isInteger(holder) || holder <= 0 || !isAlive(holder);
+					const old = Date.now() - st.mtimeMs > 1e3;
+					if (dead || old) await rm(ticketPath, { force: true });
+				} catch {}
+				continue;
+			}
+			if (name.includes(".corrupt")) {
+				const corruptPath = join(dir, name);
+				try {
+					const st = await stat(corruptPath);
+					if (Date.now() - st.mtimeMs > CORRUPT_SWEEP_AGE_MS) await rm(corruptPath, { force: true });
+				} catch {}
+			}
 		}
 	};
 	return {
@@ -566,6 +589,11 @@ async function mutateUsage(root, io, task) {
 		if (current !== null) try {
 			const probe = JSON.parse(current);
 			if (probe === null || Array.isArray(probe) || typeof probe !== "object") shapePreserved = true;
+			else {
+				const record = probe;
+				if (Object.values(record).some((value) => value === null || typeof value !== "object" || Array.isArray(value))) shapePreserved = true;
+				if (typeof record.version === "number" && record.version > 1) shapePreserved = true;
+			}
 		} catch {
 			return current;
 		}
@@ -617,7 +645,8 @@ function applyCuratorMetaFields(disk, curated) {
 * transitioned — a concurrent curator run's archive/restore is never reverted
 * by a stale snapshot; without it both pairs apply everywhere.
 */
-function foldCuratorFields(disk, curated, stateOwned) {
+function foldCuratorFields(disk, curated, stateOwned, runStartStates) {
+	const skipped = [];
 	for (const [name, record] of curated) {
 		const diskRecord = disk.get(name);
 		if (!diskRecord) {
@@ -625,8 +654,16 @@ function foldCuratorFields(disk, curated, stateOwned) {
 			continue;
 		}
 		applyCuratorMetaFields(diskRecord, record);
-		if (stateOwned === void 0 || stateOwned.has(name)) applyCuratorLifecycleFields(diskRecord, record);
+		if (stateOwned === void 0 || stateOwned.has(name)) {
+			const expected = runStartStates?.get(name);
+			if (expected !== void 0 && diskRecord.state !== expected) {
+				skipped.push(name);
+				continue;
+			}
+			applyCuratorLifecycleFields(diskRecord, record);
+		}
 	}
+	return skipped;
 }
 /** Whole-file usage write (V6-37, 0.3.37): this is the ONE path that bypasses
 * the malformed-defense and the transact lock — prefer `mutateUsage` for any
@@ -757,8 +794,14 @@ async function updateSuppressedNames(root, io, task) {
 * threshold, which are intentionally left where they are used.
 * @module @lmzhen/dsh-evolution-core
 */
-/** Skill frontmatter `name` validated for the file name (lowercase + hyphen). */
-const SKILL_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
+/** Skill frontmatter `name` validated for the file name (lowercase + hyphen).
+* 计划 B-4 (v18): tightened to the UPSTREAM `SKILL_NAME` shape
+* (`/^[a-z0-9]+(?:-[a-z0-9]+)*$/`, packages/skill/skill/src/index.ts:20). The
+* old form admitted trailing/consecutive hyphens, which upstream
+* `validateCandidate` throws on — and that throw aborts the WHOLE `ctx.skills`
+* collection. The catalog provider still filters such legacy tree entries so
+* an existing tree cannot break a session. */
+const SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 /** Allowed skill support-file subdirectories (path-traversal boundary). */
 const SUPPORT_DIRS = [
 	"references",
@@ -796,7 +839,10 @@ const DEFAULT_MEMORY_CHAR_LIMIT = 2200;
 const DEFAULT_USER_CHAR_LIMIT = 1375;
 /** Consolidation-failure backoff cap, shared by MemoryStore and memory-files' Config default. */
 const DEFAULT_CONSOLIDATION_FAILURES = 3;
-const DEFAULT_SKILL_CONTENT_CHARS = 1e5;
+/** F-20 (v18): the authored-body budget and the hard ceiling are the same
+* number today. Derive it so a future divergence is one edit, not two names
+* that silently disagree. */
+const DEFAULT_SKILL_CONTENT_CHARS = MAX_SKILL_CONTENT_CHARS;
 /** P3-19 (v14): defaults that were written twice (schema `.default()` AND the
 * clamp fallback literal) now have one home per value. */
 const DEFAULT_REVIEW_TIMEOUT_MS = 12e4;
@@ -1040,7 +1086,10 @@ function computeScopeView(usage, config, protectedNames, gates) {
 	};
 }
 function daysSince(iso, created, now) {
-	return (now - new Date(iso ?? created).getTime()) / 864e5;
+	const anchor = iso ?? created;
+	const t = Date.parse(anchor);
+	if (!Number.isFinite(t)) return 0;
+	return (now - t) / 864e5;
 }
 function computeLifecycleTransitions(usage, config, now = /* @__PURE__ */ new Date(), gates, protectedNames) {
 	const result = {
@@ -1053,9 +1102,9 @@ function computeLifecycleTransitions(usage, config, now = /* @__PURE__ */ new Da
 	for (const [name, record] of usage) {
 		if (!lifecycleCandidate(name, record, config, config.bundledNames?.has(name) === true, gateSet, protectedNames)) continue;
 		const age = daysSince(null, record.created_at, now.getTime());
-		if (record.use_count === 0 && age < config.staleAfterDays) continue;
-		const idle = daysSince(latestActivityAt(record), record.created_at, now.getTime());
 		const qualityWarn = record.quality_warn === true || record.feedback_warn === true;
+		if (record.use_count + record.view_count === 0 && !qualityWarn && age < config.staleAfterDays) continue;
+		const idle = daysSince(latestActivityAt(record), record.created_at, now.getTime());
 		const staleAfterDays = qualityWarn && config.qualityWarnStaleAfterDays !== void 0 ? config.qualityWarnStaleAfterDays : config.staleAfterDays;
 		if (record.state === "active") {
 			if (idle >= config.archiveAfterDays) {
@@ -1148,6 +1197,28 @@ const EVENT_ARCHIVE_RE = /^events-(\d+)\.json$/;
 function eventsFile(home) {
 	return join(home, "evolution", "events.json");
 }
+/** I-5 (v18): one lightweight description of the durable event payload
+* contract. The log is a FILE boundary (a host, a script or an older version
+* can write it), so `appendEvolutionEvent` refuses a record no consumer can
+* fold instead of persisting it and failing silently later. The process event
+* bus stays unvalidated — that is a typed same-process boundary.
+* @param event - the candidate event record.
+* @returns a human-readable issue, or null when the record is well-formed.
+*/
+function evolutionEventPayloadIssue(event) {
+	const type = event.type;
+	if (typeof type !== "string") return `unknown event type "${String(type)}"`;
+	switch (type) {
+		case "feedback":
+			if (event.kind !== "skill" && event.kind !== "session") return "feedback event requires kind skill|session";
+			if (event.rating !== "positive" && event.rating !== "negative") return "feedback event requires rating positive|negative";
+			return null;
+		case "maintain": return typeof event.runId === "string" ? null : "maintain event requires runId";
+		case "learn":
+		case "usage": return null;
+		default: return `unknown event type "${type}"`;
+	}
+}
 function isEventRecord(event) {
 	const seq = event?.seq;
 	return typeof event === "object" && event !== null && typeof seq === "number" && Number.isFinite(seq);
@@ -1220,6 +1291,8 @@ async function listEventArchives(io, path) {
 * event can never shadow an archived one in the seq-deduped timeline.
 */
 async function appendEvolutionEvent(io, path, event, rotateAt = EVENT_LOG_ROTATE_AT) {
+	const issue = evolutionEventPayloadIssue(event);
+	if (issue !== null) throw new Error(`evolution event refused: ${issue}`);
 	let assigned = 0;
 	let refuseMessage = "";
 	let parsedBody = null;
@@ -1265,7 +1338,7 @@ async function appendEvolutionEvent(io, path, event, rotateAt = EVENT_LOG_ROTATE
 * one-event rotate would archive everything and restart seqs at 1).
 */
 async function rotateIfDue(io, path, events, rotateAt) {
-	if (rotateAt < 2 || events.length < rotateAt) return events;
+	if (!Number.isFinite(rotateAt) || rotateAt < 2 || events.length < rotateAt) return events;
 	const mid = Math.ceil(events.length / 2);
 	const head = events.slice(0, mid);
 	const tail = events.slice(mid);
@@ -1919,7 +1992,7 @@ const PATTERNS = [
 		label: "disregard_rules",
 		category: "prompt_injection",
 		scope: "all",
-		regex: /disregard\s+(?:your|all|any)\s+(?:instructions|rules|guidelines)/i
+		regex: new RegExp(String.raw`disregard\s+${FILLER}(?:your|all|any)\s+${FILLER}(?:instructions|rules|guidelines)`, "i")
 	},
 	{
 		label: "system_prompt_override",
@@ -2072,7 +2145,7 @@ const PATTERNS = [
 		regex: /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/
 	}
 ];
-const ZERO_WIDTH_CHARS = /[\u200b\u200c\u200d\u2060\u2062\u2063\u2064\ufeff]/;
+const ZERO_WIDTH_CHARS = new RegExp(`[\\u00ad\\u034f\\u061c\\u180e\\u200b\\u200c\\u200d\\u2060\\u2061\\u2062\\u2063\\u2064\\u206a-\\u206f\\ufeff\\ufe00-\\ufe0f]|\\u{e0000}-\\u{e007f}`, "u");
 const BIDI_CHARS = /[\u202a-\u202e\u2066-\u2069]/;
 const SCOPE_ORDER = {
 	all: 1,
@@ -2262,12 +2335,17 @@ var MemoryStore = class {
 	/** V10-03 (P2-18): the strict-scan write gate. A block message names the hit
 	* label (scanMemoryThreats already embeds it) plus the self-heal hint. */
 	memoryThreatBlock(text) {
-		const threat = scanMemoryThreats(text, void 0, this.threatScanOptions());
-		return threat === null ? null : threat + THREAT_EXEMPT_HINT;
+		return scanMemoryThreats(text, void 0, this.threatScanOptions());
 	}
 	limitFor(target) {
 		return target === "memory" ? this.memoryLimit : this.userLimit;
 	}
+	/** P2-1 (v18): the generated date prefix participates in duplicate detection
+	* only when THIS store writes it. With addDatePrefix=false a fact's own
+	* leading `## YYYY-MM-DD\n` is content, not a generated prefix. */
+	dedupeKey(entry) {
+		return this.addDatePrefix ? stripDatePrefix(entry) : entry;
+	}
 	/**
 	* Read-guard probe: `{ size, limit }` when the on-disk file exceeds
 	* `limit * READ_GUARD_FACTOR` bytes, `null` when it is absent, unknown
@@ -2452,7 +2530,7 @@ var MemoryStore = class {
 			write: null
 		};
 		const entries = [...new Set(normalizeEntries(raw))];
-		if (entries.some((entry) => stripDatePrefix(entry) === content)) {
+		if (entries.some((entry) => this.dedupeKey(entry) === content)) {
 			this.resetFailures();
 			return {
 				result: {
@@ -2574,7 +2652,7 @@ var MemoryStore = class {
 					},
 					write: null
 				};
-				if (!working.some((entry) => stripDatePrefix(entry) === body)) working.push(entryBody);
+				if (!working.some((entry) => this.dedupeKey(entry) === body)) working.push(entryBody);
 				continue;
 			}
 			const rawAction = op.action;
@@ -2777,6 +2855,13 @@ async function recordMutation(root, io, record, cap = 500) {
 			console.warn(`mutation audit record dropped: ${mutationsFile(root)} is malformed and was not overwritten`);
 			return current;
 		}
+		if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+			const version = parsed.version;
+			if (typeof version === "number" && version > 1) {
+				console.warn(`mutation audit record dropped: ${mutationsFile(root)} declares version ${version} (newer than 1); not overwritten`);
+				return current;
+			}
+		}
 		const existing = recordsFromParsed(parsed);
 		existing.push(record);
 		const trimmed = existing.length > cap ? existing.slice(existing.length - cap) : existing;
@@ -2897,7 +2982,9 @@ function clamp01(value) {
 	return Math.max(0, Math.min(1, value));
 }
 function daysBetween(from, now) {
-	return Math.max(0, (now.getTime() - new Date(from).getTime()) / 864e5);
+	const t = Date.parse(from);
+	if (!Number.isFinite(t)) return 0;
+	return Math.max(0, (now.getTime() - t) / 864e5);
 }
 function computeQualityScores(input) {
 	const now = input.now ?? /* @__PURE__ */ new Date();
@@ -2906,9 +2993,9 @@ function computeQualityScores(input) {
 		const ageDays = Math.max(1, daysBetween(record.created_at, now));
 		const idleDays = daysBetween(latestActivityAt(record) ?? record.created_at, now);
 		const patchCount = record.patch_count;
-		const useCount = record.use_count;
-		const usageFrequency = clamp01(useCount / ageDays);
-		const stability = useCount === 0 ? 1 : clamp01(1 - patchCount / useCount);
+		const loadCount = record.use_count + record.view_count;
+		const usageFrequency = clamp01(loadCount / ageDays);
+		const stability = loadCount === 0 ? 1 : clamp01(1 - patchCount / loadCount);
 		const recency = idleDays < 30 ? 1 : clamp01(1 - (idleDays - 30) / 150);
 		const references = clamp01((input.referenceCounts?.get(name) ?? 0) / 3);
 		const mutationMaturity = patchCount === 0 ? .3 : patchCount === 1 ? .4 : clamp01((patchCount - 1) / Math.max(1, ageDays / 30));
@@ -3053,7 +3140,7 @@ const SECRET_PATTERNS = [
 	["jwt", /eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g],
 	["bearer credential", /Bearer[\s]+[a-z0-9._~+/=\-]{16,}/gi]
 ];
-const INLINE_ASSIGNMENT_PATTERN = /* @__PURE__ */ new RegExp("((?:\\b|[\\w-]+[_\\-])(?:token|api[_-]?key|secret|password|passwd)(?:[_\\-][\\w-]+)?\\b[\\s]*[:=][\\s]*[\"']?)([A-Z0-9._~+/=\\-]{12,})", "gi");
+const INLINE_ASSIGNMENT_PATTERN = /* @__PURE__ */ new RegExp("(^|[^\\w-])([\\w-]{0,64}[_\\-])?((?:token|api[_-]?key|secret|password|passwd)(?:[_\\-][\\w-]{0,64})?)\\b([\\s]*[:=][\\s]*)(?:\"([^\"\\r\\n]*)\"|'([^'\\r\\n]*)'|([^\\r\\n]+))", "gi");
 /**
 * Mask credential-shaped text before it crosses a session boundary.
 * @param text - the text about to be sent to a model outside this session.
@@ -3062,7 +3149,7 @@ const INLINE_ASSIGNMENT_PATTERN = /* @__PURE__ */ new RegExp("((?:\\b|[\\w-]+[_\
 function redactSecrets(text) {
 	let out = text;
 	for (const [, pattern] of SECRET_PATTERNS) out = out.replace(pattern, "<redacted>");
-	out = out.replace(INLINE_ASSIGNMENT_PATTERN, (_match, p1) => `${p1 ?? ""}<redacted>`);
+	out = out.replace(INLINE_ASSIGNMENT_PATTERN, (_match, lead, prefix, key, separator) => `${lead ?? ""}${prefix ?? ""}${key ?? ""}${separator ?? ""}<redacted>`);
 	return out;
 }
 //#endregion
@@ -3150,6 +3237,22 @@ const CORRECTION_PATTERNS = [
 	/remember\s+(?:this|that|to)/i
 ];
 const FIX_PATTERNS = [/worked after|fixed by|the fix was|root cause/i, /retry(?:ing)? worked|workaround/i];
+/** Text of one persisted content block, or `''` for any other shape.
+*
+* Content blocks cross the durable session-log boundary, so their runtime
+* shape is `unknown` even where the static event type promises
+* `{ type, text }`: a persisted `content: [null]` (A2-7, v18) used to throw a
+* TypeError here and the review catch swallowed the whole turn's remaining
+* signals. Keeping the guard in one helper also keeps the branches free of
+* conditions the static type already excludes.
+* @param block - one element of a persisted message `content` array.
+* @returns the block's text when it is a text block, otherwise an empty string.
+*/
+function textOfBlock(block) {
+	if (block === null || typeof block !== "object") return "";
+	const candidate = block;
+	return candidate.type === "text" && typeof candidate.text === "string" ? candidate.text : "";
+}
 /** Fold one session event into the current turn observation. */
 function observeEvent(signal, event) {
 	const data = event.data;
@@ -3157,7 +3260,7 @@ function observeEvent(signal, event) {
 	if (event.type === "user/message") {
 		const content = data.content;
 		if (!Array.isArray(content)) return;
-		const text = content.map((block) => block.type === "text" ? block.text ?? "" : "").join(" ");
+		const text = content.map(textOfBlock).join(" ");
 		signal.userChars += text.length;
 		if (CORRECTION_PATTERNS.some((pattern) => pattern.test(text))) signal.memorySignal = true;
 		if (FIX_PATTERNS.some((pattern) => pattern.test(text))) signal.skillSignal = true;
@@ -3166,7 +3269,7 @@ function observeEvent(signal, event) {
 	if (event.type === "assistant/message") {
 		const message = data.message;
 		if (!message || !Array.isArray(message.content)) return;
-		const text = message.content.map((block) => block.type === "text" ? block.text ?? "" : "").join(" ");
+		const text = message.content.map(textOfBlock).join(" ");
 		signal.assistantChars += text.length;
 		return;
 	}
@@ -3408,8 +3511,12 @@ const MAX_RESTRUCTURE_MOVES = 5;
 * dots) used to pass here while every later patch/write/remove on it was
 * refused as traversal (an orphan file the user could not touch). */
 const RESTRUCTURE_TARGET_RE = /^references\/[a-z0-9](?!.*\.\.)[a-z0-9._-]*\.md$/;
+/** F-20 (v18): the character rule shared by support-file names and snapshot
+* `extras/` entry names. The two exported names used to carry the same literal
+* independently; both now derive from this one. */
+const SUPPORT_ENTRY_NAME_RE = /^[a-z0-9][a-z0-9._-]*$/;
 /** Extra file name carried inside a snapshot's `extras/` directory. */
-const SNAPSHOT_EXTRA_NAME_RE = /^[a-z0-9][a-z0-9._-]*$/;
+const SNAPSHOT_EXTRA_NAME_RE = SUPPORT_ENTRY_NAME_RE;
 function skillsRoot(env = process.env) {
 	return join(evolutionRoot(env), "skills");
 }
@@ -3423,6 +3530,29 @@ function skillsRoot(env = process.env) {
 function resolveSkillsRoot(config = {}) {
 	return (config.root ?? "").trim() || skillsRoot();
 }
+/** E-7 (v18): every family row reads ONE root key. `root` is canonical;
+* `skillsRoot` is a deprecated alias honoured only while `root` is empty (so a
+* deployment that sets both keeps the canonical one) and removed after 0.3.65.
+* Callers log their own deprecation warning.
+* @param config - the raw plugin config, carrying `root` and/or `skillsRoot`.
+* @returns the effective root (empty when neither key is set) and whether the
+* deprecated alias supplied it.
+*/
+function resolveRootConfig(config = {}) {
+	const root = (config.root ?? "").trim();
+	if (root !== "") return {
+		root,
+		usedDeprecatedAlias: false
+	};
+	const alias = (config.skillsRoot ?? "").trim();
+	return alias === "" ? {
+		root: "",
+		usedDeprecatedAlias: false
+	} : {
+		root: alias,
+		usedDeprecatedAlias: true
+	};
+}
 /**
 * Map a requesting session onto the two origin surfaces (rc.44 plan M2-2.3):
 * the APPROVAL surface treats every delegated subagent as the autonomous
@@ -3459,6 +3589,15 @@ function skillDir(root, name) {
 function markerEntryName(marker) {
 	return `.${marker}`;
 }
+/** F-17 (v18): the root-level lock files a DESTRUCTIVE MOVER must treat as an
+* active writer (skill body + the two marker writers). Single source with
+* `markerEntryName`/`LOCK_SUFFIX` so a renamed marker cannot silently drop out
+* of the ghost-writer probe. */
+const MARKER_LOCK_NAMES = [
+	`SKILL.md${LOCK_SUFFIX}`,
+	`.pinned${LOCK_SUFFIX}`,
+	`.hermes-managed${LOCK_SUFFIX}`
+];
 function markerPath(dir, marker) {
 	return join(dir, markerEntryName(marker));
 }
@@ -3711,7 +3850,7 @@ async function listNames(root, io) {
 * `[a-z0-9._-]`) — drive-colon / odd-character / uppercase names can no
 * longer reach the filesystem through writeSupportFile / patch /
 * removeSupportFile. */
-const SUPPORT_FILE_NAME_RE = /^[a-z0-9][a-z0-9._-]*$/;
+const SUPPORT_FILE_NAME_RE = SUPPORT_ENTRY_NAME_RE;
 /** C-18: win32 reserves these stems with ANY extension (`nul.md` hits the
 * NUL device), and they are fully inside the charset above — so the reserved
 * set is checked on the first-dot prefix as well; the charset close alone
@@ -3742,6 +3881,16 @@ const WIN32_RESERVED_DEVICE_NAMES = new Set([
 	"lpt8",
 	"lpt9"
 ]);
+/** A1-6 (v18): the regex alone admits `references/nul.md` (a Windows device
+* stem), which the support-file layer refuses. Restructure must use the same
+* rule, or it creates an orphan the later patch/write/remove paths refuse.
+* Single source shared with the plan validator. */
+function validateRestructureTarget(filePath) {
+	if (!RESTRUCTURE_TARGET_RE.test(filePath)) return `toFile must be references/<topic>.md (got "${filePath}").`;
+	const stem = filePath.slice(filePath.lastIndexOf("/") + 1).split(".")[0]?.toLowerCase() ?? "";
+	if (WIN32_RESERVED_DEVICE_NAMES.has(stem)) return `toFile "${filePath}" uses a Windows reserved device name.`;
+	return null;
+}
 function validateSupportPath(filePath) {
 	const normalized = filePath.replace(/\\/g, "/");
 	if (normalized.includes("..")) return "Path traversal is not allowed.";
@@ -3751,6 +3900,7 @@ function validateSupportPath(filePath) {
 	for (const part of parts.slice(1)) {
 		if (!SUPPORT_FILE_NAME_RE.test(part)) return `Unsupported file name "${part}" — use lowercase letters, digits, dots, hyphens, and underscores (leading letter or digit).`;
 		if (part.toLowerCase().endsWith(".lock")) return `Unsupported file name "${part}" — the .lock suffix is reserved for the writer-lock protocol.`;
+		if (part.toLowerCase().endsWith(".corrupt") || part.toLowerCase().endsWith(".tmp")) return `Unsupported file name "${part}" — the .corrupt/.tmp suffixes are reserved for the state/IO protocols.`;
 		const stem = part.split(".")[0]?.toLowerCase() ?? "";
 		if (WIN32_RESERVED_DEVICE_NAMES.has(stem)) return `Unsupported file name "${part}" — a Windows reserved device name.`;
 	}
@@ -3958,11 +4108,23 @@ var SkillLibrary = class {
 			outcome = o;
 			return o.write ?? current ?? null;
 		};
-		if (this.transact) await this.transact(this.io, path, run);
+		let durabilityWarning = "";
+		const committedOnly = (error) => error?.committed === true;
+		if (this.transact) try {
+			await this.transact(this.io, path, run);
+		} catch (error) {
+			if (!committedOnly(error)) throw error;
+			durabilityWarning = error instanceof Error ? error.message : String(error);
+		}
 		else {
 			const current = await this.io.readText(path);
 			const next = await run(current);
-			if (next !== null && next !== current) await this.io.writeText(path, next);
+			if (next !== null && next !== current) try {
+				await this.io.writeText(path, next);
+			} catch (error) {
+				if (!committedOnly(error)) throw error;
+				durabilityWarning = error instanceof Error ? error.message : String(error);
+			}
 		}
 		const o = outcome;
 		if (o === void 0 || typeof o !== "object" || !Object.prototype.hasOwnProperty.call(o, "write")) return {
@@ -3971,7 +4133,10 @@ var SkillLibrary = class {
 		};
 		if (o.write !== null && o.audit) await this.audit(o.audit.skillName, o.audit.action, o.audit.before, o.audit.after, o.audit.summary);
 		if (o.write !== null && o.event) this.notifyMutation(o.event);
-		return o.result;
+		return durabilityWarning === "" || !o.result.ok ? o.result : {
+			...o.result,
+			message: `${o.result.message} (warning: the write landed but the directory fsync failed — durability unconfirmed: ${durabilityWarning})`
+		};
 	}
 	/** Notify the mutation observer after a successful write; observers must never fail the mutation. */
 	notifyMutation(event) {
@@ -3988,8 +4153,7 @@ var SkillLibrary = class {
 	* label (scanContentThreats already embeds it) plus the self-heal hint, so a
 	* false-positive rewrite direction is actionable instead of a dead end. */
 	contentThreatBlock(content) {
-		const threat = scanContentThreats(content, void 0, this.threatScanOptions());
-		return threat === null ? null : threat + THREAT_EXEMPT_HINT;
+		return scanContentThreats(content, void 0, this.threatScanOptions());
 	}
 	async list() {
 		const summaries = [];
@@ -3998,20 +4162,42 @@ var SkillLibrary = class {
 			const md = await this.io.readText(join(dir, "SKILL.md"));
 			if (md === null) continue;
 			const parsed = parseFrontmatter(md);
-			let entries = [];
+			let entries = null;
 			try {
 				entries = await this.io.list(dir);
-			} catch {}
-			const has = (marker) => entries.includes(markerEntryName(marker));
-			const protectedBy = has("bundled") ? "bundled" : has("hub-installed") ? "hub-installed" : has("pinned") ? "pinned" : null;
+			} catch {
+				entries = null;
+			}
+			const probeMarker = async (marker) => {
+				if (entries !== null) return entries.includes(markerEntryName(marker));
+				try {
+					return await this.io.exists(join(dir, markerEntryName(marker)));
+				} catch {
+					return null;
+				}
+			};
+			const [bundled, hubInstalled, pinned, hermesManaged] = await Promise.all([
+				probeMarker("bundled"),
+				probeMarker("hub-installed"),
+				probeMarker("pinned"),
+				probeMarker("hermes-managed")
+			]);
+			const protectedBy = bundled === true ? "bundled" : hubInstalled === true ? "hub-installed" : pinned === true ? "pinned" : null;
 			const parsedDescription = parsed?.frontmatter.description;
+			const parsedWhenToUse = parsed?.frontmatter.whenToUse;
 			summaries.push({
 				name,
 				description: typeof parsedDescription === "string" ? parsedDescription : "",
 				path: dir,
 				protectedBy,
-				managed: has("hermes-managed"),
-				archived: false
+				protectionUnknown: [
+					bundled,
+					hubInstalled,
+					pinned,
+					hermesManaged
+				].some((value) => value === null),
+				managed: hermesManaged === true,
+				...typeof parsedWhenToUse === "string" && parsedWhenToUse.trim() !== "" ? { whenToUse: parsedWhenToUse } : {}
 			});
 		}
 		return summaries;
@@ -4193,6 +4379,9 @@ var SkillLibrary = class {
 	* marker write is the only state change; content is untouched.
 	*/
 	async setPinned(name, pinned, origin = "foreground") {
+		return await this.serial(() => this.setPinnedCore(name, pinned, origin));
+	}
+	async setPinnedCore(name, pinned, origin) {
 		const normalized = name.trim();
 		const bad = this.badName(normalized);
 		if (bad) return {
@@ -4275,15 +4464,26 @@ var SkillLibrary = class {
 		const onDisk = finalContent.trimEnd() + "\n";
 		const createPath = join(dir, "SKILL.md");
 		let existsAtCommit = false;
+		let taskRan = false;
 		if (this.transact) await this.transact(this.io, createPath, (current) => {
+			taskRan = true;
 			if (current !== null) {
 				existsAtCommit = true;
 				return current;
 			}
 			return onDisk;
 		});
-		else if (await this.io.exists(createPath)) existsAtCommit = true;
-		else await this.io.writeText(createPath, onDisk);
+		else if (await this.io.exists(createPath)) {
+			taskRan = true;
+			existsAtCommit = true;
+		} else {
+			taskRan = true;
+			await this.io.writeText(createPath, onDisk);
+		}
+		if (!taskRan) return {
+			ok: false,
+			message: "internal error: the create transaction did not invoke the task; no file was written"
+		};
 		if (existsAtCommit) return {
 			ok: false,
 			message: `Skill "${normalized}" already exists.`
@@ -4583,11 +4783,7 @@ var SkillLibrary = class {
 	* CRASHED writer also refuses — correct: inspect, don't archive.
 	*/
 	async hasWriteLock(dir) {
-		const markerLocks = [
-			join(dir, "SKILL.md.lock"),
-			join(dir, ".pinned.lock"),
-			join(dir, ".hermes-managed.lock")
-		];
+		const markerLocks = MARKER_LOCK_NAMES.map((name) => join(dir, name));
 		for (const lock of markerLocks) if (await this.isWriterLock(lock)) return true;
 		for (const supportDir of SUPPORT_DIRS) {
 			let entries;
@@ -4609,17 +4805,25 @@ var SkillLibrary = class {
 	* or be swept as residue — the v16 first cut matched on suffix alone,
 	* which permanently refused archiving and deleted user content on restore. */
 	async isWriterLock(lockPath) {
-		const body = await this.io.readText(lockPath).catch(() => null);
+		let body;
+		try {
+			body = await this.io.readText(lockPath);
+		} catch {
+			return true;
+		}
 		if (body === null) return false;
-		return /^\d+:[0-9a-f]*$/.test(body.trim());
+		return LOCK_BODY_RE.test(body.trim());
 	}
-	/** P2 (v16): best-effort removal of lock residue inside a RESTORED tree —
-	* a `.lock` that a pre-restore crash or TOCTOU stranded in `.archive`
-	* cannot have a live writer (restore refuses when the live root is
-	* locked), and if left in place its body (a live pid on a single-host
-	* deployment) structurally closes the writer's self-heal path. */
+	/** P2 (v16): best-effort removal of lock residue inside a RESTORED tree.
+	* A1-2/A1-7 (v18): the sweep now covers the marker locks the probe checks
+	* (`SKILL.md.lock`/`.pinned.lock`/`.hermes-managed.lock`) and only removes
+	* a lock whose holder pid is NOT alive — a live writer's lock is never
+	* stolen by the sweep. A dead-pid residue would otherwise permanently
+	* refuse archive/restore. */
 	async deleteStrandedLocks(dir) {
 		await this.sweepLockIfStranded(join(dir, "SKILL.md.lock"));
+		await this.sweepLockIfStranded(join(dir, ".pinned.lock"));
+		await this.sweepLockIfStranded(join(dir, ".hermes-managed.lock"));
 		for (const supportDir of SUPPORT_DIRS) {
 			let entries = [];
 			try {
@@ -4631,10 +4835,33 @@ var SkillLibrary = class {
 		}
 	}
 	/** Remove `lockPath` only when its body has the writer-lock `pid:token`
-	* shape; anything else (a user support file) is left untouched. */
+	* shape AND the holder pid is not alive; anything else (a user support file
+	* or a live writer's lock) is left untouched. */
 	async sweepLockIfStranded(lockPath) {
 		const body = await this.io.readText(lockPath).catch(() => null);
-		if (body === null || !/^\d+:[0-9a-f]*$/.test(body.trim())) return;
+		if (body === null) return;
+		const match = /^(\d+):[0-9a-f]*$/.exec(body.trim());
+		if (match === null) return;
+		const pid = Number(match[1]);
+		if (Number.isInteger(pid) && pid > 0 && isProcessAlive(pid)) return;
+		await this.io.remove(lockPath).catch(() => {});
+	}
+	/** A1-4 (v18): a manifest-declared name is copied with `join(root, name)`;
+	* only a single, non-traversing path component is safe. Dotfiles
+	* (`.usage.json`) stay allowed — sidecars are legitimately dot-prefixed. */
+	safeSnapshotEntryName(name) {
+		return name !== "" && name !== "." && name !== ".." && !name.includes("/") && !name.includes("\\") && basename(name) === name;
+	}
+	/** A1-7 (v18): a root-level lock whose holder is alive must refuse the
+	* restore; a dead residue is swept so a crashed writer cannot block
+	* recovery. A non-lock body shape is left alone (user file). */
+	async refuseLiveLockOrSweep(lockPath, label) {
+		const body = await this.io.readText(lockPath).catch(() => null);
+		if (body === null) return;
+		const match = /^(\d+):[0-9a-f]*$/.exec(body.trim());
+		if (match === null) return;
+		const pid = Number(match[1]);
+		if (Number.isInteger(pid) && pid > 0 && isProcessAlive(pid)) throw new Error(`snapshot restore refused: ${label} is being written (write lock present); retry once the write completes`);
 		await this.io.remove(lockPath).catch(() => {});
 	}
 	async archive(rawName, options = {}) {
@@ -4921,9 +5148,10 @@ var SkillLibrary = class {
 				ok: false,
 				message: "Every restructure move needs a non-empty heading."
 			};
-			if (!RESTRUCTURE_TARGET_RE.test(move.toFile)) return {
+			const targetIssue = validateRestructureTarget(move.toFile);
+			if (targetIssue) return {
 				ok: false,
-				message: `toFile must be references/<topic>.md (got "${move.toFile}").`
+				message: targetIssue
 			};
 		}
 		const dir = this.dirOf(name);
@@ -5020,16 +5248,17 @@ var SkillLibrary = class {
 			ok: false,
 			message: `Skill "${name}" is protected (${protection}).`
 		};
-		for (const precondition of plan.preconditions ?? []) {
-			const issue = await precondition({ dir });
-			if (issue) return {
-				ok: false,
-				message: issue
-			};
-		}
 		const landing = [];
 		for (const write of plan.writes) {
-			const previous = await this.io.readText(write.target).catch(() => null);
+			let previous;
+			try {
+				previous = await this.io.readText(write.target);
+			} catch (error) {
+				return {
+					ok: false,
+					message: `Tree change refused: cannot safely pre-read ${write.target} (${error instanceof Error ? error.message : String(error)}); no writes were performed`
+				};
+			}
 			if (Buffer.byteLength(write.content, "utf8") > this.limits.maxSkillFileBytes) return {
 				ok: false,
 				message: `Write exceeds ${this.limits.maxSkillFileBytes} bytes: ${write.target}`
@@ -5045,18 +5274,16 @@ var SkillLibrary = class {
 				previous
 			});
 		}
-		const semantic = plan.validate?.({
-			dir,
-			currentMd: md
-		}) ?? null;
-		if (semantic) return {
-			ok: false,
-			message: semantic
-		};
 		const written = [];
+		let durabilityWarning = "";
 		try {
 			for (const entry of landing) {
-				await this.io.writeText(entry.target, entry.content);
+				try {
+					await this.io.writeText(entry.target, entry.content);
+				} catch (error) {
+					if (error?.committed !== true) throw error;
+					durabilityWarning = error instanceof Error ? error.message : String(error);
+				}
 				written.push({
 					target: entry.target,
 					previous: entry.previous
@@ -5077,7 +5304,7 @@ var SkillLibrary = class {
 		});
 		return {
 			ok: true,
-			message: `${plan.eventAction} "${name}" succeeded.`,
+			message: durabilityWarning === "" ? `${plan.eventAction} "${name}" succeeded.` : `${plan.eventAction} "${name}" succeeded (warning: the write landed but the directory fsync failed — durability unconfirmed: ${durabilityWarning})`,
 			path: dir
 		};
 	}
@@ -5093,9 +5320,10 @@ var SkillLibrary = class {
 			ok: false,
 			message: bad
 		};
-		if (await this.io.exists(join(this.dirOf(name), "SKILL.md"))) return {
+		const dest = this.dirOf(name);
+		if (await this.io.exists(dest)) return {
 			ok: false,
-			message: `Skill "${name}" already exists in the active root; refusing to overwrite.`
+			message: await this.io.exists(join(dest, "SKILL.md")) ? `Skill "${name}" already exists in the active root; refusing to overwrite.` : `Skill directory "${name}" already exists in the active root but carries no SKILL.md; remove or repair it before restoring.`
 		};
 		const archiveRoot = join(this.root, ".archive");
 		let entries;
@@ -5118,7 +5346,6 @@ var SkillLibrary = class {
 			message: `Skill "${name}" is not in .archive.`
 		};
 		const source = join(archiveRoot, chosen);
-		const dest = this.dirOf(name);
 		if (this.io.isSymlink) {
 			if (await this.io.isSymlink(source) === true) return {
 				ok: false,
@@ -5251,7 +5478,8 @@ var SkillLibrary = class {
 			ok: false,
 			message: `"${filePath}" is not a readable regular file — remove the files inside it one by one.`
 		};
-		await this.io.remove(target);
+		if (this.transact) await this.transact(this.io, target, () => null);
+		else await this.io.remove(target);
 		await this.audit(name, "remove_file", before, null, `removed ${filePath}`);
 		this.notifyMutation({
 			action: "remove_file",
@@ -5278,9 +5506,10 @@ var SkillLibrary = class {
 		while (await this.io.exists(dest)) dest = join(backupRoot, `skills-${stamp}-${Math.random().toString(36).slice(2, 8)}`);
 		try {
 			const names = await listNames(this.root, this.io);
-			await Promise.all(names.map(async (name) => {
+			const copyFailure = (await Promise.allSettled(names.map(async (name) => {
 				await this.io.copy(this.dirOf(name), join(dest, name));
-			}));
+			}))).find((result) => result.status === "rejected");
+			if (copyFailure) throw copyFailure.reason;
 			const sidecars = [];
 			for (const sidecar of [usageFile(this.root), suppressedFile(this.root)]) if (await this.io.exists(sidecar)) {
 				const name = basename(sidecar);
@@ -5295,9 +5524,10 @@ var SkillLibrary = class {
 			}
 			const validExtras = extras.filter((extra) => SNAPSHOT_EXTRA_NAME_RE.test(extra.name));
 			const extraNames = validExtras.map((extra) => extra.name);
-			await Promise.all(validExtras.map(async (extra) => {
+			const extraFailure = (await Promise.allSettled(validExtras.map(async (extra) => {
 				await this.io.writeText(join(dest, "extras", extra.name), extra.content);
-			}));
+			}))).find((result) => result.status === "rejected");
+			if (extraFailure) throw extraFailure.reason;
 			await this.io.writeText(join(dest, "manifest.json"), JSON.stringify({
 				reason,
 				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -5319,10 +5549,11 @@ var SkillLibrary = class {
 		if (raw === null) return null;
 		try {
 			const manifest = JSON.parse(raw);
+			if (!Array.isArray(manifest.skills)) return null;
 			return {
 				reason: typeof manifest.reason === "string" ? manifest.reason : "",
 				createdAt: typeof manifest.createdAt === "string" ? manifest.createdAt : "",
-				skills: Array.isArray(manifest.skills) ? manifest.skills : [],
+				skills: manifest.skills,
 				sidecars: Array.isArray(manifest.sidecars) ? manifest.sidecars : [],
 				...typeof manifest.hasArchive === "boolean" ? { hasArchive: manifest.hasArchive } : {},
 				extras: Array.isArray(manifest.extras) ? manifest.extras : []
@@ -5357,6 +5588,7 @@ var SkillLibrary = class {
 				reason: manifest.reason
 			});
 		}
+		out.sort((a, b) => (b.createdAt || "").localeCompare(a.createdAt || "") || b.path.localeCompare(a.path));
 		return out;
 	}
 	/**
@@ -5427,6 +5659,15 @@ var SkillLibrary = class {
 	* restoreLatestSnapshot so a failed restore can roll itself back (E-13).
 	*/
 	async restoreSnapshotIntoRoot(snapshotPath) {
+		const manifest = await this.readSnapshotManifest(snapshotPath);
+		if (manifest === null) {
+			if (await this.io.exists(join(snapshotPath, "manifest.json"))) throw new Error(`snapshot ${snapshotPath} has an unreadable manifest.json; refusing to clear the active tree`);
+		} else {
+			for (const name of [...manifest.skills, ...manifest.sidecars]) if (!this.safeSnapshotEntryName(name)) throw new Error(`snapshot ${snapshotPath} declares an unsafe entry name ${JSON.stringify(name)}; refusing to restore`);
+			if (manifest.skills.length === 0) {
+				if ((await this.io.list(snapshotPath)).some((entry) => entry !== "manifest.json" && entry !== "extras" && entry !== ".archive")) throw new Error(`snapshot ${snapshotPath} declares no skills but contains entries; refusing to clear the active tree`);
+			}
+		}
 		let rootEntries;
 		try {
 			rootEntries = await this.io.list(this.root);
@@ -5435,13 +5676,24 @@ var SkillLibrary = class {
 		}
 		for (const entry of rootEntries) {
 			if (entry === ".archive" || entry === ".backups" || entry === ".mutations.json" || entry === ".curator-suppressed.json") continue;
-			await this.io.remove(join(this.root, entry));
+			if (entry.endsWith(".lock") || entry.endsWith(`.lock.next`)) {
+				await this.refuseLiveLockOrSweep(join(this.root, entry), entry);
+				continue;
+			}
+			const dir = join(this.root, entry);
+			if (await this.io.exists(join(dir, "SKILL.md"))) {
+				await this.deleteStrandedLocks(dir);
+				if (await this.hasWriteLock(dir)) throw new Error(`snapshot restore refused: skill "${entry}" is being written (write lock present); retry once the write completes`);
+			}
 		}
-		const manifest = await this.readSnapshotManifest(snapshotPath);
-		if (manifest === null) for (const entry of await this.io.list(snapshotPath)) {
-			if (entry === "manifest.json" || entry === "extras") continue;
-			await this.io.copy(join(snapshotPath, entry), join(this.root, entry));
+		const restoresSuppressed = manifest !== null && manifest.sidecars.includes(".curator-suppressed.json");
+		for (const entry of rootEntries) {
+			if (entry === ".archive" || entry === ".backups" || entry === ".mutations.json") continue;
+			if (entry === ".curator-suppressed.json" && restoresSuppressed) continue;
+			if (entry.endsWith(".lock") || entry.endsWith(`.lock.next`)) continue;
+			await this.io.remove(join(this.root, entry));
 		}
+		if (manifest === null) throw new Error(`snapshot ${snapshotPath} has no readable manifest.json; refusing to restore`);
 		else {
 			for (const name of manifest.skills) await this.io.copy(join(snapshotPath, name), join(this.root, name));
 			for (const sidecar of manifest.sidecars) await this.io.copy(join(snapshotPath, sidecar), join(this.root, sidecar));
@@ -5458,4 +5710,4 @@ var SkillLibrary = class {
 	}
 };
 //#endregion
-export { AUTHORING_DESCRIPTION_BAR, COMBINED_REVIEW_PLAN_PROMPT, COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_BOOT_GRACE_SECONDS, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_CURATOR_REVIEW_MAX_TOKENS, DEFAULT_HEALTH_THRESHOLDS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_REVIEW_CONTEXT_MESSAGES, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_MESSAGE_CHARS, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_REVIEW_TIMEOUT_MS, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_USER_CHAR_LIMIT, DRIFT_MAX_LINE_CHARS, DRIFT_SIGNALS_VERSION, DRIFT_SIGNAL_NOUNS, DSH_AUTHORING_STANDARDS, ENTRY_DELIMITER, EVENT_ARCHIVE_PREFIX, EVENT_LOG_RETAIN_ARCHIVES, EVENT_LOG_ROTATE_AT, EVENT_LOG_VERSION, EVOLUTION_WRITE_TOOLS, EvolutionGateSet, FORBIDDEN_CONTROL_KEYS, HEALTH_STAMP_RE, LOW_QUALITY_THRESHOLD, MAINTAIN_OUTPUT_INSTRUCTION, MAINTAIN_PROMPT, MAX_DESCRIPTION_LENGTH, MAX_RESTRUCTURE_MOVES, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MEMORY_REVIEW_PROMPT, MIN_STAMP_BODY_CHARS, MUTATIONS_FILE_VERSION, MemoryStore, PATTERN_OVERLAP, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, QUALITY_WEIGHTS, RESTRUCTURE_TARGET_RE, SKILLS_GUIDANCE, SKILL_NAME_RE, SKILL_REVIEW_PLAN_PROMPT, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, SUPPORT_DIRS, SUPPRESSED_FILE_VERSION, SkillLibrary, THREAT_EXEMPT_HINT, WIN32_RESERVED_DEVICE_NAMES, advanceReview, allowRowCollisions, appendEvolutionEvent, applyCuratorFields, applyCuratorLifecycleFields, applyCuratorMetaFields, assessStructureHealth, authoringFeedback, buildCuratorRunReport, buildLearnPrompt, bumpPatch, bumpUse, bumpView, clampedNumber, composePresetComposition, computeDedupGroups, computeDriftSignals, computeLifecycleTransitions, computePrefixClusters, computeQualityScores, computeScopeView, contentHash, createGateSet, duplicateHeadings, emptyRecord, evaluateThreat, eventsFile, evolutionHome, evolutionIoAdapter, evolutionRoot, findDriftSignal, foldCuratorFields, foldTurn, frontmatterBlock, frontmatterYamlUnsafeValues, getRecord, latestActivityAt, lifecycleCandidate, listEventArchives, loadMutations, loadSuppressedNames, loadUsage, makeSerialQueue, markAgentCreated, markerEntryName, memoryRoot, missingSupportPointers, mutateUsage, mutationsFile, narrowNameMatches, nodeEvolutionIo, normalizeFrontmatter, normalizeUsageRecord, observeEvent, overlongLines, parseCuratorNominations, parseEvolutionEvents, parseFrontmatter, pendingSelfCleanup, readEvolutionEvents, readEvolutionTimeline, recordMutation, redactSecrets, relatedSkillNames, renameWithRetry, renderCuratorReportMarkdown, resolveOrigins, resolveSkillsRoot, retainEventArchives, reviewPrompt, saveSuppressedNames, saveUsage, scanContentThreats, scanMemoryThreats, scanThreats, skillsRoot, suppressedFile, transactIo, updateSuppressedNames, usageFile, usageObserved, validateFrontmatter, verifyPromptBundle, writeDurableTmp, yamlPlainScalarNeedsQuotes };
+export { AUTHORING_DESCRIPTION_BAR, COMBINED_REVIEW_PLAN_PROMPT, COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_BOOT_GRACE_SECONDS, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_CURATOR_REVIEW_MAX_TOKENS, DEFAULT_HEALTH_THRESHOLDS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_REVIEW_CONTEXT_MESSAGES, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_MESSAGE_CHARS, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_REVIEW_TIMEOUT_MS, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_USER_CHAR_LIMIT, DRIFT_MAX_LINE_CHARS, DRIFT_SIGNALS_VERSION, DRIFT_SIGNAL_NOUNS, DSH_AUTHORING_STANDARDS, ENTRY_DELIMITER, EVENT_ARCHIVE_PREFIX, EVENT_LOG_RETAIN_ARCHIVES, EVENT_LOG_ROTATE_AT, EVENT_LOG_VERSION, EVOLUTION_WRITE_TOOLS, EvolutionGateSet, FORBIDDEN_CONTROL_KEYS, HEALTH_STAMP_RE, LOCK_BODY_RE, LOCK_SUFFIX, LOW_QUALITY_THRESHOLD, MAINTAIN_OUTPUT_INSTRUCTION, MAINTAIN_PROMPT, MAX_DESCRIPTION_LENGTH, MAX_RESTRUCTURE_MOVES, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MEMORY_REVIEW_PROMPT, MIN_STAMP_BODY_CHARS, MUTATIONS_FILE_VERSION, MemoryStore, PATTERN_OVERLAP, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, QUALITY_WEIGHTS, RESTRUCTURE_TARGET_RE, SKILLS_GUIDANCE, SKILL_NAME_RE, SKILL_REVIEW_PLAN_PROMPT, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, SUPPORT_DIRS, SUPPRESSED_FILE_VERSION, SkillLibrary, THREAT_EXEMPT_HINT, advanceReview, allowRowCollisions, appendEvolutionEvent, applyCuratorFields, applyCuratorLifecycleFields, applyCuratorMetaFields, assessStructureHealth, authoringFeedback, buildCuratorRunReport, buildLearnPrompt, bumpPatch, bumpUse, bumpView, clampedNumber, composePresetComposition, computeDedupGroups, computeDriftSignals, computeLifecycleTransitions, computePrefixClusters, computeQualityScores, computeScopeView, contentHash, createGateSet, duplicateHeadings, emptyRecord, evaluateThreat, eventsFile, evolutionEventPayloadIssue, evolutionHome, evolutionIoAdapter, evolutionRoot, findDriftSignal, foldCuratorFields, foldTurn, frontmatterBlock, frontmatterYamlUnsafeValues, getRecord, isProcessAlive, latestActivityAt, lifecycleCandidate, listEventArchives, loadMutations, loadSuppressedNames, loadUsage, makeSerialQueue, markAgentCreated, markerEntryName, memoryRoot, missingSupportPointers, mutateUsage, mutationsFile, narrowNameMatches, nodeEvolutionIo, normalizeFrontmatter, normalizeUsageRecord, observeEvent, overlongLines, parseCuratorNominations, parseEvolutionEvents, parseFrontmatter, pendingSelfCleanup, readEvolutionEvents, readEvolutionTimeline, recordMutation, redactSecrets, relatedSkillNames, renameWithRetry, renderCuratorReportMarkdown, resolveOrigins, resolveRootConfig, resolveSkillsRoot, retainEventArchives, reviewPrompt, saveSuppressedNames, saveUsage, scanContentThreats, scanMemoryThreats, scanThreats, skillsRoot, suppressedFile, transactIo, updateSuppressedNames, usageFile, usageObserved, validateFrontmatter, validateRestructureTarget, verifyPromptBundle, writeDurableTmp, yamlPlainScalarNeedsQuotes };

package/lib/types/constants.d.ts

@@ -19,7 +19,13 @@
  * threshold, which are intentionally left where they are used.
  * @module @lmzhen/dsh-evolution-core
  */
-/** Skill frontmatter `name` validated for the file name (lowercase + hyphen). */
+/** Skill frontmatter `name` validated for the file name (lowercase + hyphen).
+ * 计划 B-4 (v18): tightened to the UPSTREAM `SKILL_NAME` shape
+ * (`/^[a-z0-9]+(?:-[a-z0-9]+)*$/`, packages/skill/skill/src/index.ts:20). The
+ * old form admitted trailing/consecutive hyphens, which upstream
+ * `validateCandidate` throws on — and that throw aborts the WHOLE `ctx.skills`
+ * collection. The catalog provider still filters such legacy tree entries so
+ * an existing tree cannot break a session. */
 export declare const SKILL_NAME_RE: RegExp;
 /** Allowed skill support-file subdirectories (path-traversal boundary). */
 export declare const SUPPORT_DIRS: readonly ["references", "templates", "scripts", "assets"];
@@ -53,6 +59,9 @@ export declare const DEFAULT_MEMORY_CHAR_LIMIT = 2200;
 export declare const DEFAULT_USER_CHAR_LIMIT = 1375;
 /** Consolidation-failure backoff cap, shared by MemoryStore and memory-files' Config default. */
 export declare const DEFAULT_CONSOLIDATION_FAILURES = 3;
+/** F-20 (v18): the authored-body budget and the hard ceiling are the same
+ * number today. Derive it so a future divergence is one edit, not two names
+ * that silently disagree. */
 export declare const DEFAULT_SKILL_CONTENT_CHARS = 100000;
 /** P3-19 (v14): defaults that were written twice (schema `.default()` AND the
  * clamp fallback literal) now have one home per value. */

package/lib/types/events.d.ts

@@ -12,10 +12,12 @@
  * these events off `session.append`). Plan-outcome durability lives in the
  * evolution-activity store, not the session log.
  */
+import type { ReviewKind } from './signals.ts';
 export interface EvolutionReviewScheduledEvent {
     /** Owning session (payload v2): process events carry no session envelope. */
     sessionId: string;
-    kind: 'memory' | 'skill' | 'combined';
+    /** F-20 (v18): single definition point — `ReviewKind` in signals.ts. */
+    kind: ReviewKind;
     toolCalls: number;
     userChars: number;
     assistantChars: number;

package/lib/types/evolution-events.d.ts

@@ -68,6 +68,17 @@ export interface EvolutionEvent {
     } | undefined;
 }
 export declare function eventsFile(home: string): string;
+/** I-5 (v18): one lightweight description of the durable event payload
+ * contract. The log is a FILE boundary (a host, a script or an older version
+ * can write it), so `appendEvolutionEvent` refuses a record no consumer can
+ * fold instead of persisting it and failing silently later. The process event
+ * bus stays unvalidated — that is a typed same-process boundary.
+ * @param event - the candidate event record.
+ * @returns a human-readable issue, or null when the record is well-formed.
+ */
+export declare function evolutionEventPayloadIssue(event: {
+    type?: unknown;
+} & Partial<EvolutionEvent>): string | null;
 export declare function parseEvolutionEvents(raw: string | null): EvolutionEvent[];
 /**
  * List the numeric archives under the log's directory, sorted ascending by

package/lib/types/io.d.ts

@@ -106,6 +106,21 @@ export declare function renameWithRetry(tmp: string, target: string, fn?: (from:
  * failing `handle.sync()` deterministically.
  */
 export declare function writeDurableTmp(target: string, content: string, openImpl?: typeof open): Promise<string>;
+/**
+ * True when the pid is alive (EPERM = alive but unowned; ESRCH = gone).
+ * V18 single source: the node backend's lock takeover and SkillLibrary's
+ * stranded-lock sweep must use the same liveness rule.
+ */
+export declare function isProcessAlive(pid: number): boolean;
+/** F-17 (v18): the write-lock protocol is a cross-module contract — the lock
+ * file is `<target>.lock` and its body is `<pid>:<token>`. This module creates
+ * them (`withWriteLock`) and `skill-store`'s probes/sweepers parse them, so both
+ * consume these two constants instead of repeating the literals. */
+export declare const LOCK_SUFFIX = ".lock";
+/** Writer-lock body shape: a decimal pid, a colon, then the claim token. A
+ * torn body (no parsable pid) still matches the `\\d+:` prefix rule only when
+ * the pid part is intact, which is what the takeover probe needs. */
+export declare const LOCK_BODY_RE: RegExp;
 /**
  * Build the Node IO backend. `lockAttempts` scales the write-lock retry budget
  * (attempts × 50ms); the default 40 (~2s, rc.69) covers production contention,

package/lib/types/memory-store.d.ts

@@ -57,6 +57,10 @@ export declare class MemoryStore {
      * label (scanMemoryThreats already embeds it) plus the self-heal hint. */
     private memoryThreatBlock;
     limitFor(target: MemoryTarget): number;
+    /** P2-1 (v18): the generated date prefix participates in duplicate detection
+     * only when THIS store writes it. With addDatePrefix=false a fact's own
+     * leading `## YYYY-MM-DD\n` is content, not a generated prefix. */
+    private dedupeKey;
     /**
      * Read-guard probe: `{ size, limit }` when the on-disk file exceeds
      * `limit * READ_GUARD_FACTOR` bytes, `null` when it is absent, unknown

package/lib/types/quality.d.ts

@@ -11,9 +11,9 @@
  */
 import type { UsageMap } from './usage.ts';
 export interface QualityFactors {
-    /** 0.25 — use_count per day of age, capped at 1. */
+    /** 0.25 — skill LOADS per day of age (view_count + use_count), capped at 1. */
     usageFrequency: number;
-    /** 0.20 — 1 − patch/use (zero use = stable). */
+    /** 0.20 — 1 − patch/load (zero loads = stable). */
     stability: number;
     /** 0.20 — 1 under 30 idle days, linear decay to 0 at 180. */
     recency: number;

package/lib/types/skill-store.d.ts

@@ -22,8 +22,15 @@ export interface SkillSummary {
     description: string;
     path: string;
     protectedBy: string | null;
+    /** A1-17 (v18): the marker probe itself failed (EACCES/EIO), so "no marker"
+     * cannot be told apart from "directory unreadable". Consumers must treat this
+     * as protected, never as unprotected. */
+    protectionUnknown: boolean;
     managed: boolean;
-    archived: boolean;
+    /** E-11 (v18): the frontmatter `whenToUse` routing hint, published so the
+     * platform catalog keeps it while this provider shadows the upstream
+     * filesystem provider. Absent when the frontmatter has none. */
+    whenToUse?: string;
 }
 export interface SkillActionResult {
     ok: boolean;
@@ -99,6 +106,21 @@ export declare function skillsRoot(env?: NodeJS.ProcessEnv): string;
 export declare function resolveSkillsRoot(config?: {
     root?: string | undefined;
 }): string;
+/** E-7 (v18): every family row reads ONE root key. `root` is canonical;
+ * `skillsRoot` is a deprecated alias honoured only while `root` is empty (so a
+ * deployment that sets both keeps the canonical one) and removed after 0.3.65.
+ * Callers log their own deprecation warning.
+ * @param config - the raw plugin config, carrying `root` and/or `skillsRoot`.
+ * @returns the effective root (empty when neither key is set) and whether the
+ * deprecated alias supplied it.
+ */
+export declare function resolveRootConfig(config?: {
+    root?: string | undefined;
+    skillsRoot?: string | undefined;
+}): {
+    root: string;
+    usedDeprecatedAlias: boolean;
+};
 /**
  * Map a requesting session onto the two origin surfaces (rc.44 plan M2-2.3):
  * the APPROVAL surface treats every delegated subagent as the autonomous
@@ -228,13 +250,11 @@ export interface AuthoringFeedback {
  * truncated or route-poor instead of silently shipping it.
  */
 export declare function authoringFeedback(frontmatter: Frontmatter): AuthoringFeedback;
-/** C-18: win32 reserves these stems with ANY extension (`nul.md` hits the
- * NUL device), and they are fully inside the charset above — so the reserved
- * set is checked on the first-dot prefix as well; the charset close alone
- * cannot refuse them. Exported single source: `badName` (skill directories,
- * P2-11/v15) and `validateSupportPath` (support-file stems, C-18) both
- * consume this one set — a third copy would drift. */
-export declare const WIN32_RESERVED_DEVICE_NAMES: ReadonlySet<string>;
+/** A1-6 (v18): the regex alone admits `references/nul.md` (a Windows device
+ * stem), which the support-file layer refuses. Restructure must use the same
+ * rule, or it creates an orphan the later patch/write/remove paths refuse.
+ * Single source shared with the plan validator. */
+export declare function validateRestructureTarget(filePath: string): string | null;
 export declare class SkillLibrary {
     readonly root: string;
     readonly limits: SkillLimits;
@@ -340,6 +360,7 @@ export declare class SkillLibrary {
      * marker write is the only state change; content is untouched.
      */
     setPinned(name: string, pinned: boolean, origin?: WriteOrigin): Promise<SkillActionResult>;
+    private setPinnedCore;
     create(name: string, content: string, origin?: WriteOrigin): Promise<SkillActionResult>;
     private createCore;
     update(rawName: string, content: string, origin?: WriteOrigin): Promise<SkillActionResult>;
@@ -378,15 +399,25 @@ export declare class SkillLibrary {
      * or be swept as residue — the v16 first cut matched on suffix alone,
      * which permanently refused archiving and deleted user content on restore. */
     private isWriterLock;
-    /** P2 (v16): best-effort removal of lock residue inside a RESTORED tree —
-     * a `.lock` that a pre-restore crash or TOCTOU stranded in `.archive`
-     * cannot have a live writer (restore refuses when the live root is
-     * locked), and if left in place its body (a live pid on a single-host
-     * deployment) structurally closes the writer's self-heal path. */
+    /** P2 (v16): best-effort removal of lock residue inside a RESTORED tree.
+     * A1-2/A1-7 (v18): the sweep now covers the marker locks the probe checks
+     * (`SKILL.md.lock`/`.pinned.lock`/`.hermes-managed.lock`) and only removes
+     * a lock whose holder pid is NOT alive — a live writer's lock is never
+     * stolen by the sweep. A dead-pid residue would otherwise permanently
+     * refuse archive/restore. */
     private deleteStrandedLocks;
     /** Remove `lockPath` only when its body has the writer-lock `pid:token`
-     * shape; anything else (a user support file) is left untouched. */
+     * shape AND the holder pid is not alive; anything else (a user support file
+     * or a live writer's lock) is left untouched. */
     private sweepLockIfStranded;
+    /** A1-4 (v18): a manifest-declared name is copied with `join(root, name)`;
+     * only a single, non-traversing path component is safe. Dotfiles
+     * (`.usage.json`) stay allowed — sidecars are legitimately dot-prefixed. */
+    private safeSnapshotEntryName;
+    /** A1-7 (v18): a root-level lock whose holder is alive must refuse the
+     * restore; a dead residue is swept so a crashed writer cannot block
+     * recovery. A non-lock body shape is left alone (user file). */
+    private refuseLiveLockOrSweep;
     archive(rawName: string, options?: ArchiveOptions): Promise<SkillActionResult>;
     /**
      * Merge the bodies of `sources` into `target` and archive the sources with

package/lib/types/usage.d.ts

@@ -85,7 +85,7 @@ export declare function applyCuratorMetaFields(disk: UsageRecord, curated: Usage
  * transitioned — a concurrent curator run's archive/restore is never reverted
  * by a stale snapshot; without it both pairs apply everywhere.
  */
-export declare function foldCuratorFields(disk: UsageMap, curated: UsageMap, stateOwned?: ReadonlySet<string>): void;
+export declare function foldCuratorFields(disk: UsageMap, curated: UsageMap, stateOwned?: ReadonlySet<string>, runStartStates?: ReadonlyMap<string, string>): string[];
 /** Whole-file usage write (V6-37, 0.3.37): this is the ONE path that bypasses
  * the malformed-defense and the transact lock — prefer `mutateUsage` for any
  * read-modify-write so a concurrent writer cannot lose its update and a

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-core",
   "description": "Shared stores, prompts, signals and lifecycle logic for the dsh-evolution plugin family (community build)",
-  "version": "0.3.63",
+  "version": "0.3.64",
   "publishConfig": {
     "access": "public"
   },