@lmzhen/dsh-evolution-core 0.3.63 → 0.3.65

package/lib/index.js

@@ -156,12 +156,41 @@ async function fsyncDirectory(path) {
 async function commitTmp(tmp, target) {
 	try {
 		await renameWithRetry(tmp, target);
-		await fsyncDirectory(dirname(target));
 	} catch (error) {
 		await rm(tmp, { force: true }).catch(() => {});
 		throw error;
 	}
+	try {
+		await fsyncDirectory(dirname(target));
+	} catch (error) {
+		throw Object.assign(/* @__PURE__ */ new Error(`commitTmp: ${target} was renamed but the directory fsync failed: ${error instanceof Error ? error.message : String(error)}`), {
+			committed: true,
+			cause: error
+		});
+	}
+}
+/**
+* True when the pid is alive (EPERM = alive but unowned; ESRCH = gone).
+* V18 single source: the node backend's lock takeover and SkillLibrary's
+* stranded-lock sweep must use the same liveness rule.
+*/
+function isProcessAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error?.code === "EPERM";
+	}
 }
+/** F-17 (v18): the write-lock protocol is a cross-module contract — the lock
+* file is `<target>.lock` and its body is `<pid>:<token>`. This module creates
+* them (`withWriteLock`) and `skill-store`'s probes/sweepers parse them, so both
+* consume these two constants instead of repeating the literals. */
+const LOCK_SUFFIX = ".lock";
+/** Writer-lock body shape: a decimal pid, a colon, then the claim token. A
+* torn body (no parsable pid) still matches the `\\d+:` prefix rule only when
+* the pid part is intact, which is what the takeover probe needs. */
+const LOCK_BODY_RE = /^\d+:[0-9a-f]*$/;
 /**
 * Build the Node IO backend. `lockAttempts` scales the write-lock retry budget
 * (attempts × 50ms); the default 40 (~2s, rc.69) covers production contention,
@@ -174,15 +203,8 @@ function nodeEvolutionIo(lockAttempts = 40) {
 		const code = error?.code;
 		return code === "ENOENT" || code === "ENOTDIR";
 	};
-	/** True when the pid is alive (EPERM = alive but unowned; ESRCH = gone). */
-	const isAlive = (pid) => {
-		try {
-			process.kill(pid, 0);
-			return true;
-		} catch (error) {
-			return error?.code === "EPERM";
-		}
-	};
+	/** True when the pid is alive (single source: `isProcessAlive`). */
+	const isAlive = isProcessAlive;
 	/**
 	* V10-07 (P2-1): age threshold for taking over a lock whose body is TORN
 	* (non-empty, but the pid prefix does not parse to a positive integer). 1h:
@@ -238,7 +260,7 @@ function nodeEvolutionIo(lockAttempts = 40) {
 	* forever.
 	*/
 	const withWriteLock = async (path, task) => {
-		const lock = `${path}.lock`;
+		const lock = `${path}${LOCK_SUFFIX}`;
 		let myClaim = "";
 		for (let attempt = 0; attempt < lockAttempts; attempt += 1) {
 			let lockHandle = null;
@@ -343,40 +365,41 @@ function nodeEvolutionIo(lockAttempts = 40) {
 			return;
 		}
 		const prefix = `${base}.`;
-		const lockName = `${base}.lock`;
+		const lockName = `${base}${LOCK_SUFFIX}`;
 		const ticketName = `${lockName}.next`;
 		const CORRUPT_SWEEP_AGE_MS = 168 * 36e5;
 		for (const name of entries) {
 			if (!name.startsWith(prefix) || name === lockName) continue;
-			if (!name.endsWith(".tmp")) {
-				if (name === ticketName) {
-					const ticketPath = join(dir, name);
-					try {
-						const body = await readFile(ticketPath, "utf8").catch(() => "");
-						const holder = Number(body.split(":")[0] ?? "");
-						const st = await stat(ticketPath);
-						const dead = !Number.isInteger(holder) || holder <= 0 || !isAlive(holder);
-						const old = Date.now() - st.mtimeMs > 1e3;
-						if (dead || old) await rm(ticketPath, { force: true });
-					} catch {}
-					continue;
-				}
-				if (name.includes(".corrupt")) {
-					const corruptPath = join(dir, name);
-					try {
-						const st = await stat(corruptPath);
-						if (Date.now() - st.mtimeMs > CORRUPT_SWEEP_AGE_MS) await rm(corruptPath, { force: true });
-					} catch {}
-				}
+			const tmpMatch = /^(.*)\.(\d+)\.([0-9a-f]+)\.tmp$/.exec(name);
+			if (tmpMatch !== null && tmpMatch[1] === base) {
+				const tmpPath = join(dir, name);
+				const holder = Number(tmpMatch[2]);
+				try {
+					const st = await stat(tmpPath);
+					const deadHolder = !Number.isInteger(holder) || holder <= 0 || !isAlive(holder);
+					if (holder === process.pid || Date.now() - st.mtimeMs > 36e5 && deadHolder) await rm(tmpPath, { force: true });
+				} catch {}
 				continue;
 			}
-			const tmpPath = join(dir, name);
-			const holder = Number(name.slice(prefix.length, name.length - 4).split(".")[0] ?? "");
-			try {
-				const st = await stat(tmpPath);
-				const deadHolder = !Number.isInteger(holder) || holder <= 0 || !isAlive(holder);
-				if (holder === process.pid || Date.now() - st.mtimeMs > 36e5 && deadHolder) await rm(tmpPath, { force: true });
-			} catch {}
+			if (name === ticketName) {
+				const ticketPath = join(dir, name);
+				try {
+					const body = await readFile(ticketPath, "utf8").catch(() => "");
+					const holder = Number(body.split(":")[0] ?? "");
+					const st = await stat(ticketPath);
+					const dead = !Number.isInteger(holder) || holder <= 0 || !isAlive(holder);
+					const old = Date.now() - st.mtimeMs > 1e3;
+					if (dead || old) await rm(ticketPath, { force: true });
+				} catch {}
+				continue;
+			}
+			if (/\.corrupt(\.\d+)?$/.test(name)) {
+				const corruptPath = join(dir, name);
+				try {
+					const st = await stat(corruptPath);
+					if (Date.now() - st.mtimeMs > CORRUPT_SWEEP_AGE_MS) await rm(corruptPath, { force: true });
+				} catch {}
+			}
 		}
 	};
 	return {
@@ -553,24 +576,30 @@ function parseUsage(raw) {
 async function loadUsage(root, io = nodeEvolutionIo()) {
 	return parseUsage(await io.readText(usageFile(root)));
 }
-/**
-* Atomic read-modify-write on the usage sidecar (rc.50 P2-2): `task` receives
-* the map parsed from the current on-disk state and may mutate it; the result
-* is persisted inside the same transact so a second process sharing DSH_HOME
-* cannot interleave its RMW and lose a counter update. Callers keep their own
-* single-process serialize chain as the second layer.
-*/
-async function mutateUsage(root, io, task) {
+async function mutateUsage(root, io, task, options = {}) {
 	await transactIo(io, usageFile(root), async (current) => {
 		let shapePreserved = false;
+		let recovered = null;
 		if (current !== null) try {
 			const probe = JSON.parse(current);
 			if (probe === null || Array.isArray(probe) || typeof probe !== "object") shapePreserved = true;
+			else {
+				const record = probe;
+				const isMalformed = (value) => value === null || typeof value !== "object" || Array.isArray(value);
+				if (typeof record.version === "number" && record.version > 1) shapePreserved = true;
+				else if (Object.values(record).some(isMalformed)) {
+					const bad = Object.keys(record).filter((key) => isMalformed(record[key]));
+					const corruptPath = `${usageFile(root)}.corrupt`;
+					await io.writeText(corruptPath, current).catch(() => {});
+					recovered = JSON.stringify(Object.fromEntries(Object.entries(record).filter(([, value]) => !isMalformed(value))));
+					options.onQuarantine?.(`usage sidecar ${usageFile(root)} carried ${bad.length} malformed entr${bad.length === 1 ? "y" : "ies"} (${bad.slice(0, 5).join(", ")}); the original bytes were copied to ${corruptPath} and the remaining entries continue to be served`);
+				}
+			}
 		} catch {
 			return current;
 		}
 		if (shapePreserved) return current;
-		const map = parseUsage(current);
+		const map = parseUsage(recovered ?? current);
 		await task(map);
 		return JSON.stringify(Object.fromEntries(map.entries()), null, 2);
 	});
@@ -617,7 +646,8 @@ function applyCuratorMetaFields(disk, curated) {
 * transitioned — a concurrent curator run's archive/restore is never reverted
 * by a stale snapshot; without it both pairs apply everywhere.
 */
-function foldCuratorFields(disk, curated, stateOwned) {
+function foldCuratorFields(disk, curated, stateOwned, runStartStates) {
+	const skipped = [];
 	for (const [name, record] of curated) {
 		const diskRecord = disk.get(name);
 		if (!diskRecord) {
@@ -625,8 +655,16 @@ function foldCuratorFields(disk, curated, stateOwned) {
 			continue;
 		}
 		applyCuratorMetaFields(diskRecord, record);
-		if (stateOwned === void 0 || stateOwned.has(name)) applyCuratorLifecycleFields(diskRecord, record);
+		if (stateOwned === void 0 || stateOwned.has(name)) {
+			const expected = runStartStates?.get(name);
+			if (expected !== void 0 && diskRecord.state !== expected) {
+				skipped.push(name);
+				continue;
+			}
+			applyCuratorLifecycleFields(diskRecord, record);
+		}
 	}
+	return skipped;
 }
 /** Whole-file usage write (V6-37, 0.3.37): this is the ONE path that bypasses
 * the malformed-defense and the transact lock — prefer `mutateUsage` for any
@@ -757,8 +795,14 @@ async function updateSuppressedNames(root, io, task) {
 * threshold, which are intentionally left where they are used.
 * @module @lmzhen/dsh-evolution-core
 */
-/** Skill frontmatter `name` validated for the file name (lowercase + hyphen). */
-const SKILL_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
+/** Skill frontmatter `name` validated for the file name (lowercase + hyphen).
+* 计划 B-4 (v18): tightened to the UPSTREAM `SKILL_NAME` shape
+* (`/^[a-z0-9]+(?:-[a-z0-9]+)*$/`, packages/skill/skill/src/index.ts:20). The
+* old form admitted trailing/consecutive hyphens, which upstream
+* `validateCandidate` throws on — and that throw aborts the WHOLE `ctx.skills`
+* collection. The catalog provider still filters such legacy tree entries so
+* an existing tree cannot break a session. */
+const SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 /** Allowed skill support-file subdirectories (path-traversal boundary). */
 const SUPPORT_DIRS = [
 	"references",
@@ -796,7 +840,10 @@ const DEFAULT_MEMORY_CHAR_LIMIT = 2200;
 const DEFAULT_USER_CHAR_LIMIT = 1375;
 /** Consolidation-failure backoff cap, shared by MemoryStore and memory-files' Config default. */
 const DEFAULT_CONSOLIDATION_FAILURES = 3;
-const DEFAULT_SKILL_CONTENT_CHARS = 1e5;
+/** F-20 (v18): the authored-body budget and the hard ceiling are the same
+* number today. Derive it so a future divergence is one edit, not two names
+* that silently disagree. */
+const DEFAULT_SKILL_CONTENT_CHARS = MAX_SKILL_CONTENT_CHARS;
 /** P3-19 (v14): defaults that were written twice (schema `.default()` AND the
 * clamp fallback literal) now have one home per value. */
 const DEFAULT_REVIEW_TIMEOUT_MS = 12e4;
@@ -1040,7 +1087,10 @@ function computeScopeView(usage, config, protectedNames, gates) {
 	};
 }
 function daysSince(iso, created, now) {
-	return (now - new Date(iso ?? created).getTime()) / 864e5;
+	const anchor = iso ?? created;
+	const t = Date.parse(anchor);
+	if (!Number.isFinite(t)) return 0;
+	return (now - t) / 864e5;
 }
 function computeLifecycleTransitions(usage, config, now = /* @__PURE__ */ new Date(), gates, protectedNames) {
 	const result = {
@@ -1053,9 +1103,9 @@ function computeLifecycleTransitions(usage, config, now = /* @__PURE__ */ new Da
 	for (const [name, record] of usage) {
 		if (!lifecycleCandidate(name, record, config, config.bundledNames?.has(name) === true, gateSet, protectedNames)) continue;
 		const age = daysSince(null, record.created_at, now.getTime());
-		if (record.use_count === 0 && age < config.staleAfterDays) continue;
-		const idle = daysSince(latestActivityAt(record), record.created_at, now.getTime());
 		const qualityWarn = record.quality_warn === true || record.feedback_warn === true;
+		if (record.use_count + record.view_count === 0 && !qualityWarn && age < config.staleAfterDays) continue;
+		const idle = daysSince(latestActivityAt(record), record.created_at, now.getTime());
 		const staleAfterDays = qualityWarn && config.qualityWarnStaleAfterDays !== void 0 ? config.qualityWarnStaleAfterDays : config.staleAfterDays;
 		if (record.state === "active") {
 			if (idle >= config.archiveAfterDays) {
@@ -1148,6 +1198,28 @@ const EVENT_ARCHIVE_RE = /^events-(\d+)\.json$/;
 function eventsFile(home) {
 	return join(home, "evolution", "events.json");
 }
+/** I-5 (v18): one lightweight description of the durable event payload
+* contract. The log is a FILE boundary (a host, a script or an older version
+* can write it), so `appendEvolutionEvent` refuses a record no consumer can
+* fold instead of persisting it and failing silently later. The process event
+* bus stays unvalidated — that is a typed same-process boundary.
+* @param event - the candidate event record.
+* @returns a human-readable issue, or null when the record is well-formed.
+*/
+function evolutionEventPayloadIssue(event) {
+	const type = event.type;
+	if (typeof type !== "string") return `unknown event type "${String(type)}"`;
+	switch (type) {
+		case "feedback":
+			if (event.kind !== "skill" && event.kind !== "session") return "feedback event requires kind skill|session";
+			if (event.rating !== "positive" && event.rating !== "negative") return "feedback event requires rating positive|negative";
+			return null;
+		case "maintain": return typeof event.runId === "string" ? null : "maintain event requires runId";
+		case "learn":
+		case "usage": return null;
+		default: return `unknown event type "${type}"`;
+	}
+}
 function isEventRecord(event) {
 	const seq = event?.seq;
 	return typeof event === "object" && event !== null && typeof seq === "number" && Number.isFinite(seq);
@@ -1220,6 +1292,8 @@ async function listEventArchives(io, path) {
 * event can never shadow an archived one in the seq-deduped timeline.
 */
 async function appendEvolutionEvent(io, path, event, rotateAt = EVENT_LOG_ROTATE_AT) {
+	const issue = evolutionEventPayloadIssue(event);
+	if (issue !== null) throw new Error(`evolution event refused: ${issue}`);
 	let assigned = 0;
 	let refuseMessage = "";
 	let parsedBody = null;
@@ -1265,7 +1339,7 @@ async function appendEvolutionEvent(io, path, event, rotateAt = EVENT_LOG_ROTATE
 * one-event rotate would archive everything and restart seqs at 1).
 */
 async function rotateIfDue(io, path, events, rotateAt) {
-	if (rotateAt < 2 || events.length < rotateAt) return events;
+	if (!Number.isFinite(rotateAt) || rotateAt < 2 || events.length < rotateAt) return events;
 	const mid = Math.ceil(events.length / 2);
 	const head = events.slice(0, mid);
 	const tail = events.slice(mid);
@@ -1903,9 +1977,16 @@ function clampedNumber(value, fallback, opts) {
 * Threat scanning for agent-authored memory and skill content.
 *
 * Ported as a small, dependency-free subset of Hermes Agent's
-* `tools/threat_patterns.py` + hermes-claw `threats.ts`. The policy is the
-* load-bearing part: ANY in-scope hit blocks. Severity and category are
-* metadata for diagnostics only.
+* `tools/threat_patterns.py` + hermes-claw `threats.ts`.
+*
+* Policy (P1-1, v19): a finding either BLOCKS the write or only REPORTS.
+* Blocking is reserved for shapes with no legitimate use in stored knowledge
+* (prompt-injection phrasing, credential exfiltration, the invisible-character
+* smuggling core). Typography and presentation characters that are legitimate
+* in ordinary prose — variation selectors (❤️), zero-width non-joiner, soft
+* hyphen from PDF paste, Arabic letter mark, Mongolian vowel separator — are
+* REPORT findings: they stay visible to operators and tests but never reject a
+* write. Blocking them turned every emoji into a security event.
 */
 const FILLER = String.raw`(?:\w+\s+){0,8}`;
 const PATTERNS = [
@@ -1919,7 +2000,7 @@ const PATTERNS = [
 		label: "disregard_rules",
 		category: "prompt_injection",
 		scope: "all",
-		regex: /disregard\s+(?:your|all|any)\s+(?:instructions|rules|guidelines)/i
+		regex: new RegExp(String.raw`disregard\s+${FILLER}(?:your|all|any)\s+${FILLER}(?:instructions|rules|guidelines)`, "i")
 	},
 	{
 		label: "system_prompt_override",
@@ -2072,7 +2153,9 @@ const PATTERNS = [
 		regex: /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/
 	}
 ];
-const ZERO_WIDTH_CHARS = /[\u200b\u200c\u200d\u2060\u2062\u2063\u2064\ufeff]/;
+const ZERO_WIDTH_CHARS = new RegExp(`[\\u034f\\u200b\\u2060\\u2061\\u2062\\u2063\\u2064\\u206a-\\u206f\\ufeff\\u{e0000}-\\u{e007f}]`, "u");
+const ZWJ_OUTSIDE_EMOJI = /(?<!\p{Extended_Pictographic})\u200d(?!\p{Extended_Pictographic})/u;
+const TYPOGRAPHY_CHARS = /[\u00ad\u061c\u180e\u200c\ufe00-\ufe0f]/;
 const BIDI_CHARS = /[\u202a-\u202e\u2066-\u2069]/;
 const SCOPE_ORDER = {
 	all: 1,
@@ -2099,11 +2182,17 @@ function scanThreats(text, scope = "strict", maxScanChars = 65536, options = NO_
 	const windowSize = clampedNumber(maxScanChars, 65536, { min: 4097 });
 	const findings = [];
 	const excluded = new Set(options.excludeLabels ?? []);
-	if (ZERO_WIDTH_CHARS.test(text) && !excluded.has("unicode_zero_width")) findings.push({
+	if ((ZERO_WIDTH_CHARS.test(text) || ZWJ_OUTSIDE_EMOJI.test(text)) && !excluded.has("unicode_zero_width")) findings.push({
 		label: "unicode_zero_width",
 		category: "unicode_obfuscation",
 		scope: "all"
 	});
+	if (TYPOGRAPHY_CHARS.test(text) && !excluded.has("unicode_typography")) findings.push({
+		label: "unicode_typography",
+		category: "unicode_obfuscation",
+		scope: "all",
+		severity: "report"
+	});
 	if (BIDI_CHARS.test(text) && !excluded.has("unicode_bidi_override")) findings.push({
 		label: "unicode_bidi_override",
 		category: "unicode_obfuscation",
@@ -2132,11 +2221,13 @@ function scanThreats(text, scope = "strict", maxScanChars = 65536, options = NO_
 	}
 	return findings;
 }
-/** Blocking policy: any hit blocks. `severity` is deliberately not a gate. */
+/** Blocking policy (P1-1, v19): a finding blocks unless it is explicitly
+* `report`-only. Pattern findings carry no severity and therefore block as
+* before. */
 function evaluateThreat(text, scope = "strict", maxScanChars = 65536, options = NO_SCAN_OPTIONS) {
 	const findings = scanThreats(text, scope, maxScanChars, options);
 	return {
-		blocked: findings.length > 0,
+		blocked: findings.some((finding) => finding.severity !== "report"),
 		findings
 	};
 }
@@ -2262,12 +2353,17 @@ var MemoryStore = class {
 	/** V10-03 (P2-18): the strict-scan write gate. A block message names the hit
 	* label (scanMemoryThreats already embeds it) plus the self-heal hint. */
 	memoryThreatBlock(text) {
-		const threat = scanMemoryThreats(text, void 0, this.threatScanOptions());
-		return threat === null ? null : threat + THREAT_EXEMPT_HINT;
+		return scanMemoryThreats(text, void 0, this.threatScanOptions());
 	}
 	limitFor(target) {
 		return target === "memory" ? this.memoryLimit : this.userLimit;
 	}
+	/** P2-1 (v18): the generated date prefix participates in duplicate detection
+	* only when THIS store writes it. With addDatePrefix=false a fact's own
+	* leading `## YYYY-MM-DD\n` is content, not a generated prefix. */
+	dedupeKey(entry) {
+		return this.addDatePrefix ? stripDatePrefix(entry) : entry;
+	}
 	/**
 	* Read-guard probe: `{ size, limit }` when the on-disk file exceeds
 	* `limit * READ_GUARD_FACTOR` bytes, `null` when it is absent, unknown
@@ -2452,7 +2548,7 @@ var MemoryStore = class {
 			write: null
 		};
 		const entries = [...new Set(normalizeEntries(raw))];
-		if (entries.some((entry) => stripDatePrefix(entry) === content)) {
+		if (entries.some((entry) => this.dedupeKey(entry) === content)) {
 			this.resetFailures();
 			return {
 				result: {
@@ -2574,7 +2670,7 @@ var MemoryStore = class {
 					},
 					write: null
 				};
-				if (!working.some((entry) => stripDatePrefix(entry) === body)) working.push(entryBody);
+				if (!working.some((entry) => this.dedupeKey(entry) === body)) working.push(entryBody);
 				continue;
 			}
 			const rawAction = op.action;
@@ -2777,6 +2873,13 @@ async function recordMutation(root, io, record, cap = 500) {
 			console.warn(`mutation audit record dropped: ${mutationsFile(root)} is malformed and was not overwritten`);
 			return current;
 		}
+		if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+			const version = parsed.version;
+			if (typeof version === "number" && version > 1) {
+				console.warn(`mutation audit record dropped: ${mutationsFile(root)} declares version ${version} (newer than 1); not overwritten`);
+				return current;
+			}
+		}
 		const existing = recordsFromParsed(parsed);
 		existing.push(record);
 		const trimmed = existing.length > cap ? existing.slice(existing.length - cap) : existing;
@@ -2897,7 +3000,9 @@ function clamp01(value) {
 	return Math.max(0, Math.min(1, value));
 }
 function daysBetween(from, now) {
-	return Math.max(0, (now.getTime() - new Date(from).getTime()) / 864e5);
+	const t = Date.parse(from);
+	if (!Number.isFinite(t)) return 0;
+	return Math.max(0, (now.getTime() - t) / 864e5);
 }
 function computeQualityScores(input) {
 	const now = input.now ?? /* @__PURE__ */ new Date();
@@ -2906,9 +3011,9 @@ function computeQualityScores(input) {
 		const ageDays = Math.max(1, daysBetween(record.created_at, now));
 		const idleDays = daysBetween(latestActivityAt(record) ?? record.created_at, now);
 		const patchCount = record.patch_count;
-		const useCount = record.use_count;
-		const usageFrequency = clamp01(useCount / ageDays);
-		const stability = useCount === 0 ? 1 : clamp01(1 - patchCount / useCount);
+		const loadCount = record.use_count + record.view_count;
+		const usageFrequency = clamp01(loadCount / ageDays);
+		const stability = loadCount === 0 ? 1 : clamp01(1 - patchCount / loadCount);
 		const recency = idleDays < 30 ? 1 : clamp01(1 - (idleDays - 30) / 150);
 		const references = clamp01((input.referenceCounts?.get(name) ?? 0) / 3);
 		const mutationMaturity = patchCount === 0 ? .3 : patchCount === 1 ? .4 : clamp01((patchCount - 1) / Math.max(1, ageDays / 30));
@@ -3053,7 +3158,7 @@ const SECRET_PATTERNS = [
 	["jwt", /eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g],
 	["bearer credential", /Bearer[\s]+[a-z0-9._~+/=\-]{16,}/gi]
 ];
-const INLINE_ASSIGNMENT_PATTERN = /* @__PURE__ */ new RegExp("((?:\\b|[\\w-]+[_\\-])(?:token|api[_-]?key|secret|password|passwd)(?:[_\\-][\\w-]+)?\\b[\\s]*[:=][\\s]*[\"']?)([A-Z0-9._~+/=\\-]{12,})", "gi");
+const INLINE_ASSIGNMENT_PATTERN = /* @__PURE__ */ new RegExp("(^|[^\\w-])([\\w-]{0,64}[_\\-])?((?:token|api[_-]?key|secret|password|passwd)(?:[_\\-][\\w-]{0,64})?)\\b([\\t ]*[:=][\\t ]*)([^\\r\\n]+)", "gi");
 /**
 * Mask credential-shaped text before it crosses a session boundary.
 * @param text - the text about to be sent to a model outside this session.
@@ -3062,7 +3167,7 @@ const INLINE_ASSIGNMENT_PATTERN = /* @__PURE__ */ new RegExp("((?:\\b|[\\w-]+[_\
 function redactSecrets(text) {
 	let out = text;
 	for (const [, pattern] of SECRET_PATTERNS) out = out.replace(pattern, "<redacted>");
-	out = out.replace(INLINE_ASSIGNMENT_PATTERN, (_match, p1) => `${p1 ?? ""}<redacted>`);
+	out = out.replace(INLINE_ASSIGNMENT_PATTERN, (_match, lead, prefix, key, separator) => `${lead ?? ""}${prefix ?? ""}${key ?? ""}${separator ?? ""}<redacted>`);
 	return out;
 }
 //#endregion
@@ -3150,6 +3255,22 @@ const CORRECTION_PATTERNS = [
 	/remember\s+(?:this|that|to)/i
 ];
 const FIX_PATTERNS = [/worked after|fixed by|the fix was|root cause/i, /retry(?:ing)? worked|workaround/i];
+/** Text of one persisted content block, or `''` for any other shape.
+*
+* Content blocks cross the durable session-log boundary, so their runtime
+* shape is `unknown` even where the static event type promises
+* `{ type, text }`: a persisted `content: [null]` (A2-7, v18) used to throw a
+* TypeError here and the review catch swallowed the whole turn's remaining
+* signals. Keeping the guard in one helper also keeps the branches free of
+* conditions the static type already excludes.
+* @param block - one element of a persisted message `content` array.
+* @returns the block's text when it is a text block, otherwise an empty string.
+*/
+function textOfBlock(block) {
+	if (block === null || typeof block !== "object") return "";
+	const candidate = block;
+	return candidate.type === "text" && typeof candidate.text === "string" ? candidate.text : "";
+}
 /** Fold one session event into the current turn observation. */
 function observeEvent(signal, event) {
 	const data = event.data;
@@ -3157,7 +3278,7 @@ function observeEvent(signal, event) {
 	if (event.type === "user/message") {
 		const content = data.content;
 		if (!Array.isArray(content)) return;
-		const text = content.map((block) => block.type === "text" ? block.text ?? "" : "").join(" ");
+		const text = content.map(textOfBlock).join(" ");
 		signal.userChars += text.length;
 		if (CORRECTION_PATTERNS.some((pattern) => pattern.test(text))) signal.memorySignal = true;
 		if (FIX_PATTERNS.some((pattern) => pattern.test(text))) signal.skillSignal = true;
@@ -3166,7 +3287,7 @@ function observeEvent(signal, event) {
 	if (event.type === "assistant/message") {
 		const message = data.message;
 		if (!message || !Array.isArray(message.content)) return;
-		const text = message.content.map((block) => block.type === "text" ? block.text ?? "" : "").join(" ");
+		const text = message.content.map(textOfBlock).join(" ");
 		signal.assistantChars += text.length;
 		return;
 	}
@@ -3408,8 +3529,12 @@ const MAX_RESTRUCTURE_MOVES = 5;
 * dots) used to pass here while every later patch/write/remove on it was
 * refused as traversal (an orphan file the user could not touch). */
 const RESTRUCTURE_TARGET_RE = /^references\/[a-z0-9](?!.*\.\.)[a-z0-9._-]*\.md$/;
+/** F-20 (v18): the character rule shared by support-file names and snapshot
+* `extras/` entry names. The two exported names used to carry the same literal
+* independently; both now derive from this one. */
+const SUPPORT_ENTRY_NAME_RE = /^[a-z0-9][a-z0-9._-]*$/;
 /** Extra file name carried inside a snapshot's `extras/` directory. */
-const SNAPSHOT_EXTRA_NAME_RE = /^[a-z0-9][a-z0-9._-]*$/;
+const SNAPSHOT_EXTRA_NAME_RE = SUPPORT_ENTRY_NAME_RE;
 function skillsRoot(env = process.env) {
 	return join(evolutionRoot(env), "skills");
 }
@@ -3423,6 +3548,29 @@ function skillsRoot(env = process.env) {
 function resolveSkillsRoot(config = {}) {
 	return (config.root ?? "").trim() || skillsRoot();
 }
+/** E-7 (v18): every family row reads ONE root key. `root` is canonical;
+* `skillsRoot` is a deprecated alias honoured only while `root` is empty (so a
+* deployment that sets both keeps the canonical one) and removed after 0.3.65.
+* Callers log their own deprecation warning.
+* @param config - the raw plugin config, carrying `root` and/or `skillsRoot`.
+* @returns the effective root (empty when neither key is set) and whether the
+* deprecated alias supplied it.
+*/
+function resolveRootConfig(config = {}) {
+	const root = (config.root ?? "").trim();
+	if (root !== "") return {
+		root,
+		usedDeprecatedAlias: false
+	};
+	const alias = (config.skillsRoot ?? "").trim();
+	return alias === "" ? {
+		root: "",
+		usedDeprecatedAlias: false
+	} : {
+		root: alias,
+		usedDeprecatedAlias: true
+	};
+}
 /**
 * Map a requesting session onto the two origin surfaces (rc.44 plan M2-2.3):
 * the APPROVAL surface treats every delegated subagent as the autonomous
@@ -3459,6 +3607,15 @@ function skillDir(root, name) {
 function markerEntryName(marker) {
 	return `.${marker}`;
 }
+/** F-17 (v18): the root-level lock files a DESTRUCTIVE MOVER must treat as an
+* active writer (skill body + the two marker writers). Single source with
+* `markerEntryName`/`LOCK_SUFFIX` so a renamed marker cannot silently drop out
+* of the ghost-writer probe. */
+const MARKER_LOCK_NAMES = [
+	`SKILL.md${LOCK_SUFFIX}`,
+	`.pinned${LOCK_SUFFIX}`,
+	`.hermes-managed${LOCK_SUFFIX}`
+];
 function markerPath(dir, marker) {
 	return join(dir, markerEntryName(marker));
 }
@@ -3697,6 +3854,13 @@ function authoringFeedback(frontmatter) {
 		lines
 	};
 }
+/** A1-15 (v18) / P2-2 (v19): the io layer marks an error `committed: true` when
+* the rename landed and only the directory fsync failed. Every single-file
+* writer must treat that as "written, durability unconfirmed" — never as a
+* plain failure (which a caller would retry, or a two-phase caller roll back). */
+function isCommittedOnly(error) {
+	return error?.committed === true;
+}
 async function listNames(root, io) {
 	const entries = await io.list(root);
 	const names = [];
@@ -3711,7 +3875,7 @@ async function listNames(root, io) {
 * `[a-z0-9._-]`) — drive-colon / odd-character / uppercase names can no
 * longer reach the filesystem through writeSupportFile / patch /
 * removeSupportFile. */
-const SUPPORT_FILE_NAME_RE = /^[a-z0-9][a-z0-9._-]*$/;
+const SUPPORT_FILE_NAME_RE = SUPPORT_ENTRY_NAME_RE;
 /** C-18: win32 reserves these stems with ANY extension (`nul.md` hits the
 * NUL device), and they are fully inside the charset above — so the reserved
 * set is checked on the first-dot prefix as well; the charset close alone
@@ -3742,6 +3906,16 @@ const WIN32_RESERVED_DEVICE_NAMES = new Set([
 	"lpt8",
 	"lpt9"
 ]);
+/** A1-6 (v18): the regex alone admits `references/nul.md` (a Windows device
+* stem), which the support-file layer refuses. Restructure must use the same
+* rule, or it creates an orphan the later patch/write/remove paths refuse.
+* Single source shared with the plan validator. */
+function validateRestructureTarget(filePath) {
+	if (!RESTRUCTURE_TARGET_RE.test(filePath)) return `toFile must be references/<topic>.md (got "${filePath}").`;
+	const stem = filePath.slice(filePath.lastIndexOf("/") + 1).split(".")[0]?.toLowerCase() ?? "";
+	if (WIN32_RESERVED_DEVICE_NAMES.has(stem)) return `toFile "${filePath}" uses a Windows reserved device name.`;
+	return null;
+}
 function validateSupportPath(filePath) {
 	const normalized = filePath.replace(/\\/g, "/");
 	if (normalized.includes("..")) return "Path traversal is not allowed.";
@@ -3751,6 +3925,7 @@ function validateSupportPath(filePath) {
 	for (const part of parts.slice(1)) {
 		if (!SUPPORT_FILE_NAME_RE.test(part)) return `Unsupported file name "${part}" — use lowercase letters, digits, dots, hyphens, and underscores (leading letter or digit).`;
 		if (part.toLowerCase().endsWith(".lock")) return `Unsupported file name "${part}" — the .lock suffix is reserved for the writer-lock protocol.`;
+		if (part.toLowerCase().endsWith(".corrupt") || part.toLowerCase().endsWith(".tmp")) return `Unsupported file name "${part}" — the .corrupt/.tmp suffixes are reserved for the state/IO protocols.`;
 		const stem = part.split(".")[0]?.toLowerCase() ?? "";
 		if (WIN32_RESERVED_DEVICE_NAMES.has(stem)) return `Unsupported file name "${part}" — a Windows reserved device name.`;
 	}
@@ -3958,11 +4133,23 @@ var SkillLibrary = class {
 			outcome = o;
 			return o.write ?? current ?? null;
 		};
-		if (this.transact) await this.transact(this.io, path, run);
+		let durabilityWarning = "";
+		const committedOnly = (error) => error?.committed === true;
+		if (this.transact) try {
+			await this.transact(this.io, path, run);
+		} catch (error) {
+			if (!committedOnly(error)) throw error;
+			durabilityWarning = error instanceof Error ? error.message : String(error);
+		}
 		else {
 			const current = await this.io.readText(path);
 			const next = await run(current);
-			if (next !== null && next !== current) await this.io.writeText(path, next);
+			if (next !== null && next !== current) try {
+				await this.io.writeText(path, next);
+			} catch (error) {
+				if (!committedOnly(error)) throw error;
+				durabilityWarning = error instanceof Error ? error.message : String(error);
+			}
 		}
 		const o = outcome;
 		if (o === void 0 || typeof o !== "object" || !Object.prototype.hasOwnProperty.call(o, "write")) return {
@@ -3971,7 +4158,10 @@ var SkillLibrary = class {
 		};
 		if (o.write !== null && o.audit) await this.audit(o.audit.skillName, o.audit.action, o.audit.before, o.audit.after, o.audit.summary);
 		if (o.write !== null && o.event) this.notifyMutation(o.event);
-		return o.result;
+		return durabilityWarning === "" || !o.result.ok ? o.result : {
+			...o.result,
+			message: `${o.result.message} (warning: the write landed but the directory fsync failed — durability unconfirmed: ${durabilityWarning})`
+		};
 	}
 	/** Notify the mutation observer after a successful write; observers must never fail the mutation. */
 	notifyMutation(event) {
@@ -3988,8 +4178,7 @@ var SkillLibrary = class {
 	* label (scanContentThreats already embeds it) plus the self-heal hint, so a
 	* false-positive rewrite direction is actionable instead of a dead end. */
 	contentThreatBlock(content) {
-		const threat = scanContentThreats(content, void 0, this.threatScanOptions());
-		return threat === null ? null : threat + THREAT_EXEMPT_HINT;
+		return scanContentThreats(content, void 0, this.threatScanOptions());
 	}
 	async list() {
 		const summaries = [];
@@ -3998,20 +4187,42 @@ var SkillLibrary = class {
 			const md = await this.io.readText(join(dir, "SKILL.md"));
 			if (md === null) continue;
 			const parsed = parseFrontmatter(md);
-			let entries = [];
+			let entries = null;
 			try {
 				entries = await this.io.list(dir);
-			} catch {}
-			const has = (marker) => entries.includes(markerEntryName(marker));
-			const protectedBy = has("bundled") ? "bundled" : has("hub-installed") ? "hub-installed" : has("pinned") ? "pinned" : null;
+			} catch {
+				entries = null;
+			}
+			const probeMarker = async (marker) => {
+				if (entries !== null) return entries.includes(markerEntryName(marker));
+				try {
+					return await this.io.exists(join(dir, markerEntryName(marker)));
+				} catch {
+					return null;
+				}
+			};
+			const [bundled, hubInstalled, pinned, hermesManaged] = await Promise.all([
+				probeMarker("bundled"),
+				probeMarker("hub-installed"),
+				probeMarker("pinned"),
+				probeMarker("hermes-managed")
+			]);
+			const protectedBy = bundled === true ? "bundled" : hubInstalled === true ? "hub-installed" : pinned === true ? "pinned" : null;
 			const parsedDescription = parsed?.frontmatter.description;
+			const parsedWhenToUse = parsed?.frontmatter.whenToUse;
 			summaries.push({
 				name,
 				description: typeof parsedDescription === "string" ? parsedDescription : "",
 				path: dir,
 				protectedBy,
-				managed: has("hermes-managed"),
-				archived: false
+				protectionUnknown: [
+					bundled,
+					hubInstalled,
+					pinned,
+					hermesManaged
+				].some((value) => value === null),
+				managed: hermesManaged === true,
+				...typeof parsedWhenToUse === "string" && parsedWhenToUse.trim() !== "" ? { whenToUse: parsedWhenToUse } : {}
 			});
 		}
 		return summaries;
@@ -4193,6 +4404,9 @@ var SkillLibrary = class {
 	* marker write is the only state change; content is untouched.
 	*/
 	async setPinned(name, pinned, origin = "foreground") {
+		return await this.serial(() => this.setPinnedCore(name, pinned, origin));
+	}
+	async setPinnedCore(name, pinned, origin) {
 		const normalized = name.trim();
 		const bad = this.badName(normalized);
 		if (bad) return {
@@ -4203,6 +4417,7 @@ var SkillLibrary = class {
 			ok: false,
 			message: "Only the foreground (user or the main agent) may pin or unpin skills."
 		};
+		let durabilityWarning = "";
 		const dir = this.dirOf(normalized);
 		const marker = markerPath(dir, "pinned");
 		const existing = await this.io.exists(marker);
@@ -4220,12 +4435,17 @@ var SkillLibrary = class {
 			ok: false,
 			message: `Skill "${normalized}" not found.`
 		};
-		if (pinned) await this.io.writeText(marker, "");
+		if (pinned) try {
+			await this.io.writeText(marker, "");
+		} catch (error) {
+			if (!isCommittedOnly(error)) throw error;
+			durabilityWarning = error instanceof Error ? error.message : String(error);
+		}
 		else await this.io.remove(marker);
 		await this.audit(normalized, pinned ? "pin" : "unpin", null, null, pinned ? "pinned" : "unpinned");
 		return {
 			ok: true,
-			message: pinned ? `Skill "${normalized}" pinned: protected from deletion, background review, and the lifecycle.` : `Skill "${normalized}" unpinned.`,
+			message: `${pinned ? `Skill "${normalized}" pinned: protected from deletion, background review, and the lifecycle.` : `Skill "${normalized}" unpinned.`}${durabilityWarning === "" ? "" : ` (warning: the write landed but the directory fsync failed — durability unconfirmed: ${durabilityWarning})`}`,
 			path: dir
 		};
 	}
@@ -4275,15 +4495,37 @@ var SkillLibrary = class {
 		const onDisk = finalContent.trimEnd() + "\n";
 		const createPath = join(dir, "SKILL.md");
 		let existsAtCommit = false;
-		if (this.transact) await this.transact(this.io, createPath, (current) => {
-			if (current !== null) {
-				existsAtCommit = true;
-				return current;
+		let taskRan = false;
+		let createDurabilityWarning = "";
+		if (this.transact) try {
+			await this.transact(this.io, createPath, (current) => {
+				taskRan = true;
+				if (current !== null) {
+					existsAtCommit = true;
+					return current;
+				}
+				return onDisk;
+			});
+		} catch (error) {
+			if (!isCommittedOnly(error)) throw error;
+			createDurabilityWarning = error instanceof Error ? error.message : String(error);
+		}
+		else if (await this.io.exists(createPath)) {
+			taskRan = true;
+			existsAtCommit = true;
+		} else {
+			taskRan = true;
+			try {
+				await this.io.writeText(createPath, onDisk);
+			} catch (error) {
+				if (!isCommittedOnly(error)) throw error;
+				createDurabilityWarning = error instanceof Error ? error.message : String(error);
 			}
-			return onDisk;
-		});
-		else if (await this.io.exists(createPath)) existsAtCommit = true;
-		else await this.io.writeText(createPath, onDisk);
+		}
+		if (!taskRan) return {
+			ok: false,
+			message: "internal error: the create transaction did not invoke the task; no file was written"
+		};
 		if (existsAtCommit) return {
 			ok: false,
 			message: `Skill "${normalized}" already exists.`
@@ -4297,7 +4539,7 @@ var SkillLibrary = class {
 		});
 		return {
 			ok: true,
-			message: `Skill "${normalized}" created.`,
+			message: `Skill "${normalized}" created.${createDurabilityWarning === "" ? "" : ` (warning: the write landed but the directory fsync failed — durability unconfirmed: ${createDurabilityWarning})`}`,
 			path: dir,
 			...norm.changed ? { normalizedFrontmatterFields: norm.fields } : {}
 		};
@@ -4583,11 +4825,7 @@ var SkillLibrary = class {
 	* CRASHED writer also refuses — correct: inspect, don't archive.
 	*/
 	async hasWriteLock(dir) {
-		const markerLocks = [
-			join(dir, "SKILL.md.lock"),
-			join(dir, ".pinned.lock"),
-			join(dir, ".hermes-managed.lock")
-		];
+		const markerLocks = MARKER_LOCK_NAMES.map((name) => join(dir, name));
 		for (const lock of markerLocks) if (await this.isWriterLock(lock)) return true;
 		for (const supportDir of SUPPORT_DIRS) {
 			let entries;
@@ -4609,17 +4847,25 @@ var SkillLibrary = class {
 	* or be swept as residue — the v16 first cut matched on suffix alone,
 	* which permanently refused archiving and deleted user content on restore. */
 	async isWriterLock(lockPath) {
-		const body = await this.io.readText(lockPath).catch(() => null);
+		let body;
+		try {
+			body = await this.io.readText(lockPath);
+		} catch {
+			return true;
+		}
 		if (body === null) return false;
-		return /^\d+:[0-9a-f]*$/.test(body.trim());
+		return LOCK_BODY_RE.test(body.trim());
 	}
-	/** P2 (v16): best-effort removal of lock residue inside a RESTORED tree —
-	* a `.lock` that a pre-restore crash or TOCTOU stranded in `.archive`
-	* cannot have a live writer (restore refuses when the live root is
-	* locked), and if left in place its body (a live pid on a single-host
-	* deployment) structurally closes the writer's self-heal path. */
+	/** P2 (v16): best-effort removal of lock residue inside a RESTORED tree.
+	* A1-2/A1-7 (v18): the sweep now covers the marker locks the probe checks
+	* (`SKILL.md.lock`/`.pinned.lock`/`.hermes-managed.lock`) and only removes
+	* a lock whose holder pid is NOT alive — a live writer's lock is never
+	* stolen by the sweep. A dead-pid residue would otherwise permanently
+	* refuse archive/restore. */
 	async deleteStrandedLocks(dir) {
 		await this.sweepLockIfStranded(join(dir, "SKILL.md.lock"));
+		await this.sweepLockIfStranded(join(dir, ".pinned.lock"));
+		await this.sweepLockIfStranded(join(dir, ".hermes-managed.lock"));
 		for (const supportDir of SUPPORT_DIRS) {
 			let entries = [];
 			try {
@@ -4631,10 +4877,41 @@ var SkillLibrary = class {
 		}
 	}
 	/** Remove `lockPath` only when its body has the writer-lock `pid:token`
-	* shape; anything else (a user support file) is left untouched. */
+	* shape AND the holder pid is not alive; anything else (a user support file
+	* or a live writer's lock) is left untouched. */
 	async sweepLockIfStranded(lockPath) {
 		const body = await this.io.readText(lockPath).catch(() => null);
-		if (body === null || !/^\d+:[0-9a-f]*$/.test(body.trim())) return;
+		if (body === null) return;
+		const match = /^(\d+):[0-9a-f]*$/.exec(body.trim());
+		if (match === null) return;
+		const pid = Number(match[1]);
+		if (Number.isInteger(pid) && pid > 0 && isProcessAlive(pid)) return;
+		await this.io.remove(lockPath).catch(() => {});
+	}
+	/** A1-4 (v18): a manifest-declared name is copied with `join(root, name)`;
+	* only a single, non-traversing path component is safe. Dotfiles
+	* (`.usage.json`) stay allowed — sidecars are legitimately dot-prefixed.
+	* P2-4 (v19): a non-string entry (`skills: [123]`) is refused structurally
+	* instead of throwing `name.includes is not a function`. */
+	safeSnapshotEntryName(name) {
+		if (typeof name !== "string") return false;
+		return name !== "" && name !== "." && name !== ".." && !name.includes("/") && !name.includes("\\") && basename(name) === name;
+	}
+	/** A1-7 (v18): a root-level lock whose holder is alive must refuse the
+	* restore; a dead residue is swept so a crashed writer cannot block
+	* recovery. A non-lock body shape is left alone (user file). */
+	async refuseLiveLockOrSweep(lockPath, label) {
+		let body;
+		try {
+			body = await this.io.readText(lockPath);
+		} catch (error) {
+			throw new Error(`snapshot restore refused: cannot verify ${label} (${error instanceof Error ? error.message : String(error)}); a live writer may hold it`);
+		}
+		if (body === null) return;
+		const match = /^(\d+):[0-9a-f]*$/.exec(body.trim());
+		if (match === null) return;
+		const pid = Number(match[1]);
+		if (Number.isInteger(pid) && pid > 0 && isProcessAlive(pid)) throw new Error(`snapshot restore refused: ${label} is being written (write lock present); retry once the write completes`);
 		await this.io.remove(lockPath).catch(() => {});
 	}
 	async archive(rawName, options = {}) {
@@ -4921,9 +5198,10 @@ var SkillLibrary = class {
 				ok: false,
 				message: "Every restructure move needs a non-empty heading."
 			};
-			if (!RESTRUCTURE_TARGET_RE.test(move.toFile)) return {
+			const targetIssue = validateRestructureTarget(move.toFile);
+			if (targetIssue) return {
 				ok: false,
-				message: `toFile must be references/<topic>.md (got "${move.toFile}").`
+				message: targetIssue
 			};
 		}
 		const dir = this.dirOf(name);
@@ -5020,16 +5298,17 @@ var SkillLibrary = class {
 			ok: false,
 			message: `Skill "${name}" is protected (${protection}).`
 		};
-		for (const precondition of plan.preconditions ?? []) {
-			const issue = await precondition({ dir });
-			if (issue) return {
-				ok: false,
-				message: issue
-			};
-		}
 		const landing = [];
 		for (const write of plan.writes) {
-			const previous = await this.io.readText(write.target).catch(() => null);
+			let previous;
+			try {
+				previous = await this.io.readText(write.target);
+			} catch (error) {
+				return {
+					ok: false,
+					message: `Tree change refused: cannot safely pre-read ${write.target} (${error instanceof Error ? error.message : String(error)}); no writes were performed`
+				};
+			}
 			if (Buffer.byteLength(write.content, "utf8") > this.limits.maxSkillFileBytes) return {
 				ok: false,
 				message: `Write exceeds ${this.limits.maxSkillFileBytes} bytes: ${write.target}`
@@ -5045,18 +5324,16 @@ var SkillLibrary = class {
 				previous
 			});
 		}
-		const semantic = plan.validate?.({
-			dir,
-			currentMd: md
-		}) ?? null;
-		if (semantic) return {
-			ok: false,
-			message: semantic
-		};
 		const written = [];
+		let durabilityWarning = "";
 		try {
 			for (const entry of landing) {
-				await this.io.writeText(entry.target, entry.content);
+				try {
+					await this.io.writeText(entry.target, entry.content);
+				} catch (error) {
+					if (error?.committed !== true) throw error;
+					durabilityWarning = error instanceof Error ? error.message : String(error);
+				}
 				written.push({
 					target: entry.target,
 					previous: entry.previous
@@ -5077,7 +5354,7 @@ var SkillLibrary = class {
 		});
 		return {
 			ok: true,
-			message: `${plan.eventAction} "${name}" succeeded.`,
+			message: durabilityWarning === "" ? `${plan.eventAction} "${name}" succeeded.` : `${plan.eventAction} "${name}" succeeded (warning: the write landed but the directory fsync failed — durability unconfirmed: ${durabilityWarning})`,
 			path: dir
 		};
 	}
@@ -5093,9 +5370,10 @@ var SkillLibrary = class {
 			ok: false,
 			message: bad
 		};
-		if (await this.io.exists(join(this.dirOf(name), "SKILL.md"))) return {
+		const dest = this.dirOf(name);
+		if (await this.io.exists(dest)) return {
 			ok: false,
-			message: `Skill "${name}" already exists in the active root; refusing to overwrite.`
+			message: await this.io.exists(join(dest, "SKILL.md")) ? `Skill "${name}" already exists in the active root; refusing to overwrite.` : `Skill directory "${name}" already exists in the active root but carries no SKILL.md; remove or repair it before restoring.`
 		};
 		const archiveRoot = join(this.root, ".archive");
 		let entries;
@@ -5118,7 +5396,6 @@ var SkillLibrary = class {
 			message: `Skill "${name}" is not in .archive.`
 		};
 		const source = join(archiveRoot, chosen);
-		const dest = this.dirOf(name);
 		if (this.io.isSymlink) {
 			if (await this.io.isSymlink(source) === true) return {
 				ok: false,
@@ -5251,7 +5528,8 @@ var SkillLibrary = class {
 			ok: false,
 			message: `"${filePath}" is not a readable regular file — remove the files inside it one by one.`
 		};
-		await this.io.remove(target);
+		if (this.transact) await this.transact(this.io, target, () => null);
+		else await this.io.remove(target);
 		await this.audit(name, "remove_file", before, null, `removed ${filePath}`);
 		this.notifyMutation({
 			action: "remove_file",
@@ -5278,9 +5556,10 @@ var SkillLibrary = class {
 		while (await this.io.exists(dest)) dest = join(backupRoot, `skills-${stamp}-${Math.random().toString(36).slice(2, 8)}`);
 		try {
 			const names = await listNames(this.root, this.io);
-			await Promise.all(names.map(async (name) => {
+			const copyFailure = (await Promise.allSettled(names.map(async (name) => {
 				await this.io.copy(this.dirOf(name), join(dest, name));
-			}));
+			}))).find((result) => result.status === "rejected");
+			if (copyFailure) throw copyFailure.reason;
 			const sidecars = [];
 			for (const sidecar of [usageFile(this.root), suppressedFile(this.root)]) if (await this.io.exists(sidecar)) {
 				const name = basename(sidecar);
@@ -5295,9 +5574,10 @@ var SkillLibrary = class {
 			}
 			const validExtras = extras.filter((extra) => SNAPSHOT_EXTRA_NAME_RE.test(extra.name));
 			const extraNames = validExtras.map((extra) => extra.name);
-			await Promise.all(validExtras.map(async (extra) => {
+			const extraFailure = (await Promise.allSettled(validExtras.map(async (extra) => {
 				await this.io.writeText(join(dest, "extras", extra.name), extra.content);
-			}));
+			}))).find((result) => result.status === "rejected");
+			if (extraFailure) throw extraFailure.reason;
 			await this.io.writeText(join(dest, "manifest.json"), JSON.stringify({
 				reason,
 				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -5319,10 +5599,11 @@ var SkillLibrary = class {
 		if (raw === null) return null;
 		try {
 			const manifest = JSON.parse(raw);
+			if (!Array.isArray(manifest.skills)) return null;
 			return {
 				reason: typeof manifest.reason === "string" ? manifest.reason : "",
 				createdAt: typeof manifest.createdAt === "string" ? manifest.createdAt : "",
-				skills: Array.isArray(manifest.skills) ? manifest.skills : [],
+				skills: manifest.skills,
 				sidecars: Array.isArray(manifest.sidecars) ? manifest.sidecars : [],
 				...typeof manifest.hasArchive === "boolean" ? { hasArchive: manifest.hasArchive } : {},
 				extras: Array.isArray(manifest.extras) ? manifest.extras : []
@@ -5357,6 +5638,7 @@ var SkillLibrary = class {
 				reason: manifest.reason
 			});
 		}
+		out.sort((a, b) => (b.createdAt || "").localeCompare(a.createdAt || "") || b.path.localeCompare(a.path));
 		return out;
 	}
 	/**
@@ -5427,6 +5709,21 @@ var SkillLibrary = class {
 	* restoreLatestSnapshot so a failed restore can roll itself back (E-13).
 	*/
 	async restoreSnapshotIntoRoot(snapshotPath) {
+		const manifest = await this.readSnapshotManifest(snapshotPath);
+		if (manifest === null) throw new Error(await this.io.exists(join(snapshotPath, "manifest.json")) ? `snapshot ${snapshotPath} has an unreadable manifest.json; refusing to clear the active tree` : `snapshot ${snapshotPath} has no readable manifest.json; refusing to restore`);
+		for (const name of [...manifest.skills, ...manifest.sidecars]) if (!this.safeSnapshotEntryName(name)) throw new Error(`snapshot ${snapshotPath} declares an unsafe entry name ${JSON.stringify(name)}; refusing to restore`);
+		if (manifest.skills.length === 0) {
+			const snapshotEntries = await this.io.list(snapshotPath);
+			const declared = new Set([
+				"manifest.json",
+				"extras",
+				".archive",
+				...manifest.skills,
+				...manifest.sidecars
+			]);
+			const undeclared = snapshotEntries.filter((entry) => !declared.has(entry));
+			if (undeclared.length > 0) throw new Error(`snapshot ${snapshotPath} declares no skills but contains undeclared entries (${undeclared.join(", ")}); refusing to clear the active tree`);
+		}
 		let rootEntries;
 		try {
 			rootEntries = await this.io.list(this.root);
@@ -5435,16 +5732,26 @@ var SkillLibrary = class {
 		}
 		for (const entry of rootEntries) {
 			if (entry === ".archive" || entry === ".backups" || entry === ".mutations.json" || entry === ".curator-suppressed.json") continue;
-			await this.io.remove(join(this.root, entry));
+			if (entry.endsWith(".lock") || entry.endsWith(`.lock.next`)) {
+				await this.refuseLiveLockOrSweep(join(this.root, entry), entry);
+				continue;
+			}
+			const dir = join(this.root, entry);
+			if (await this.io.exists(join(dir, "SKILL.md"))) {
+				await this.deleteStrandedLocks(dir);
+				if (await this.hasWriteLock(dir)) throw new Error(`snapshot restore refused: skill "${entry}" is being written (write lock present); retry once the write completes`);
+			}
 		}
-		const manifest = await this.readSnapshotManifest(snapshotPath);
-		if (manifest === null) for (const entry of await this.io.list(snapshotPath)) {
-			if (entry === "manifest.json" || entry === "extras") continue;
-			await this.io.copy(join(snapshotPath, entry), join(this.root, entry));
+		const restoresSuppressed = manifest.sidecars.includes(".curator-suppressed.json");
+		for (const entry of rootEntries) {
+			if (entry === ".archive" || entry === ".backups" || entry === ".mutations.json") continue;
+			if (entry === ".curator-suppressed.json" && restoresSuppressed) continue;
+			if (entry.endsWith(".lock") || entry.endsWith(`.lock.next`)) continue;
+			await this.io.remove(join(this.root, entry));
 		}
-		else {
-			for (const name of manifest.skills) await this.io.copy(join(snapshotPath, name), join(this.root, name));
-			for (const sidecar of manifest.sidecars) await this.io.copy(join(snapshotPath, sidecar), join(this.root, sidecar));
+		for (const name of manifest.skills) await this.io.copy(join(snapshotPath, name), join(this.root, name));
+		for (const sidecar of manifest.sidecars) await this.io.copy(join(snapshotPath, sidecar), join(this.root, sidecar));
+		{
 			const archiveRoot = join(this.root, ".archive");
 			if (manifest.hasArchive === true) {
 				await this.io.remove(archiveRoot);
@@ -5458,4 +5765,4 @@ var SkillLibrary = class {
 	}
 };
 //#endregion
-export { AUTHORING_DESCRIPTION_BAR, COMBINED_REVIEW_PLAN_PROMPT, COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_BOOT_GRACE_SECONDS, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_CURATOR_REVIEW_MAX_TOKENS, DEFAULT_HEALTH_THRESHOLDS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_REVIEW_CONTEXT_MESSAGES, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_MESSAGE_CHARS, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_REVIEW_TIMEOUT_MS, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_USER_CHAR_LIMIT, DRIFT_MAX_LINE_CHARS, DRIFT_SIGNALS_VERSION, DRIFT_SIGNAL_NOUNS, DSH_AUTHORING_STANDARDS, ENTRY_DELIMITER, EVENT_ARCHIVE_PREFIX, EVENT_LOG_RETAIN_ARCHIVES, EVENT_LOG_ROTATE_AT, EVENT_LOG_VERSION, EVOLUTION_WRITE_TOOLS, EvolutionGateSet, FORBIDDEN_CONTROL_KEYS, HEALTH_STAMP_RE, LOW_QUALITY_THRESHOLD, MAINTAIN_OUTPUT_INSTRUCTION, MAINTAIN_PROMPT, MAX_DESCRIPTION_LENGTH, MAX_RESTRUCTURE_MOVES, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MEMORY_REVIEW_PROMPT, MIN_STAMP_BODY_CHARS, MUTATIONS_FILE_VERSION, MemoryStore, PATTERN_OVERLAP, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, QUALITY_WEIGHTS, RESTRUCTURE_TARGET_RE, SKILLS_GUIDANCE, SKILL_NAME_RE, SKILL_REVIEW_PLAN_PROMPT, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, SUPPORT_DIRS, SUPPRESSED_FILE_VERSION, SkillLibrary, THREAT_EXEMPT_HINT, WIN32_RESERVED_DEVICE_NAMES, advanceReview, allowRowCollisions, appendEvolutionEvent, applyCuratorFields, applyCuratorLifecycleFields, applyCuratorMetaFields, assessStructureHealth, authoringFeedback, buildCuratorRunReport, buildLearnPrompt, bumpPatch, bumpUse, bumpView, clampedNumber, composePresetComposition, computeDedupGroups, computeDriftSignals, computeLifecycleTransitions, computePrefixClusters, computeQualityScores, computeScopeView, contentHash, createGateSet, duplicateHeadings, emptyRecord, evaluateThreat, eventsFile, evolutionHome, evolutionIoAdapter, evolutionRoot, findDriftSignal, foldCuratorFields, foldTurn, frontmatterBlock, frontmatterYamlUnsafeValues, getRecord, latestActivityAt, lifecycleCandidate, listEventArchives, loadMutations, loadSuppressedNames, loadUsage, makeSerialQueue, markAgentCreated, markerEntryName, memoryRoot, missingSupportPointers, mutateUsage, mutationsFile, narrowNameMatches, nodeEvolutionIo, normalizeFrontmatter, normalizeUsageRecord, observeEvent, overlongLines, parseCuratorNominations, parseEvolutionEvents, parseFrontmatter, pendingSelfCleanup, readEvolutionEvents, readEvolutionTimeline, recordMutation, redactSecrets, relatedSkillNames, renameWithRetry, renderCuratorReportMarkdown, resolveOrigins, resolveSkillsRoot, retainEventArchives, reviewPrompt, saveSuppressedNames, saveUsage, scanContentThreats, scanMemoryThreats, scanThreats, skillsRoot, suppressedFile, transactIo, updateSuppressedNames, usageFile, usageObserved, validateFrontmatter, verifyPromptBundle, writeDurableTmp, yamlPlainScalarNeedsQuotes };
+export { AUTHORING_DESCRIPTION_BAR, COMBINED_REVIEW_PLAN_PROMPT, COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_BOOT_GRACE_SECONDS, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_CURATOR_REVIEW_MAX_TOKENS, DEFAULT_HEALTH_THRESHOLDS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_REVIEW_CONTEXT_MESSAGES, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_MESSAGE_CHARS, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_REVIEW_TIMEOUT_MS, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_USER_CHAR_LIMIT, DRIFT_MAX_LINE_CHARS, DRIFT_SIGNALS_VERSION, DRIFT_SIGNAL_NOUNS, DSH_AUTHORING_STANDARDS, ENTRY_DELIMITER, EVENT_ARCHIVE_PREFIX, EVENT_LOG_RETAIN_ARCHIVES, EVENT_LOG_ROTATE_AT, EVENT_LOG_VERSION, EVOLUTION_WRITE_TOOLS, EvolutionGateSet, FORBIDDEN_CONTROL_KEYS, HEALTH_STAMP_RE, LOCK_BODY_RE, LOCK_SUFFIX, LOW_QUALITY_THRESHOLD, MAINTAIN_OUTPUT_INSTRUCTION, MAINTAIN_PROMPT, MAX_DESCRIPTION_LENGTH, MAX_RESTRUCTURE_MOVES, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MEMORY_REVIEW_PROMPT, MIN_STAMP_BODY_CHARS, MUTATIONS_FILE_VERSION, MemoryStore, PATTERN_OVERLAP, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, QUALITY_WEIGHTS, RESTRUCTURE_TARGET_RE, SKILLS_GUIDANCE, SKILL_NAME_RE, SKILL_REVIEW_PLAN_PROMPT, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, SUPPORT_DIRS, SUPPRESSED_FILE_VERSION, SkillLibrary, THREAT_EXEMPT_HINT, advanceReview, allowRowCollisions, appendEvolutionEvent, applyCuratorFields, applyCuratorLifecycleFields, applyCuratorMetaFields, assessStructureHealth, authoringFeedback, buildCuratorRunReport, buildLearnPrompt, bumpPatch, bumpUse, bumpView, clampedNumber, composePresetComposition, computeDedupGroups, computeDriftSignals, computeLifecycleTransitions, computePrefixClusters, computeQualityScores, computeScopeView, contentHash, createGateSet, duplicateHeadings, emptyRecord, evaluateThreat, eventsFile, evolutionEventPayloadIssue, evolutionHome, evolutionIoAdapter, evolutionRoot, findDriftSignal, foldCuratorFields, foldTurn, frontmatterBlock, frontmatterYamlUnsafeValues, getRecord, isProcessAlive, latestActivityAt, lifecycleCandidate, listEventArchives, loadMutations, loadSuppressedNames, loadUsage, makeSerialQueue, markAgentCreated, markerEntryName, memoryRoot, missingSupportPointers, mutateUsage, mutationsFile, narrowNameMatches, nodeEvolutionIo, normalizeFrontmatter, normalizeUsageRecord, observeEvent, overlongLines, parseCuratorNominations, parseEvolutionEvents, parseFrontmatter, pendingSelfCleanup, readEvolutionEvents, readEvolutionTimeline, recordMutation, redactSecrets, relatedSkillNames, renameWithRetry, renderCuratorReportMarkdown, resolveOrigins, resolveRootConfig, resolveSkillsRoot, retainEventArchives, reviewPrompt, saveSuppressedNames, saveUsage, scanContentThreats, scanMemoryThreats, scanThreats, skillsRoot, suppressedFile, transactIo, updateSuppressedNames, usageFile, usageObserved, validateFrontmatter, validateRestructureTarget, verifyPromptBundle, writeDurableTmp, yamlPlainScalarNeedsQuotes };