@lmzhen/dsh-evolution-core 0.3.74 → 0.3.76

package/lib/index.js

@@ -2,6 +2,7 @@ import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { cp, lstat, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { createHash, randomBytes } from "node:crypto";
 import { homedir } from "node:os";
+import { scopeOf } from "@deepseek-ai/dsh-scope";
 import { load } from "js-yaml";
 //#region lib/types/io.js
 /**
@@ -77,6 +78,25 @@ function evolutionIoAdapter(provider) {
 * so `io.spec.ts` can drive the self-heal path deterministically.
 */
 const pendingSelfCleanup = /* @__PURE__ */ new Map();
+/** P2-7 (v11)/P3-10 (v14): record a failed release so the next write to this
+* path self-heals it, keeping the map's 64-entry cap — a never-re-touched path
+* must not pin it, while a path whose lock still EXISTS is the last to drop
+* (dropping it disables the self-heal for a lock that is really there). */
+const recordPendingSelfCleanup = async (lock, token) => {
+	if (pendingSelfCleanup.size >= 64) {
+		let droppable;
+		for (const candidate of pendingSelfCleanup.keys()) {
+			if (candidate === lock) continue;
+			if (await readFile(candidate, "utf8").then(() => false, () => true)) {
+				droppable = candidate;
+				break;
+			}
+		}
+		const victim = droppable ?? pendingSelfCleanup.keys().next().value;
+		if (victim !== void 0) pendingSelfCleanup.delete(victim);
+	}
+	pendingSelfCleanup.set(lock, token);
+};
 const RENAME_RETRY_BASE_MS = 50;
 const RENAME_RETRY_MAX_DELAY_MS = 800;
 const RENAME_RETRY_MAX_ATTEMPTS = 6;
@@ -255,6 +275,11 @@ const EMPTY_LOCK_TAKEOVER_MS = 3e4;
 /** A body with no parseable pid (crash mid-write): 1h, far above any legal hold
 * and far below "forever". */
 const LOCK_TEAR_TAKEOVER_MS = 36e5;
+/** P2-27 (v37): the commit-point ownership re-read. A transient read failure
+* (EACCES/EMFILE/antivirus hold) must not abort a valid RMW, so the read is
+* retried in place; only a still-unreadable lock fails the attempt. */
+const OWNERSHIP_READ_ATTEMPTS = 3;
+const OWNERSHIP_READ_RETRY_MS = 20;
 /**
 * V27 G1.3: the error `commitTmp` throws when the rename landed but the parent
 * directory fsync failed — the bytes ARE visible, only their durability is
@@ -438,7 +463,26 @@ function nodeEvolutionIo(lockAttempts = 40) {
 				continue;
 			}
 			const assertOwned = async () => {
-				const body = await readFile(lock, "utf8").catch(() => null);
+				let body = "";
+				let readable = false;
+				for (let read = 0; read < OWNERSHIP_READ_ATTEMPTS && !readable; read += 1) {
+					if (read > 0) await new Promise((resolve) => setTimeout(resolve, OWNERSHIP_READ_RETRY_MS));
+					const attempt = await readFile(lock, "utf8").then((value) => ({
+						ok: true,
+						value
+					}), () => ({
+						ok: false,
+						value: ""
+					}));
+					if (attempt.ok) {
+						body = attempt.value;
+						readable = true;
+					}
+				}
+				if (!readable) {
+					console.warn(`evolution-io: write lock ${lock} could not be read at the commit point (ownership unverified, ours: ${JSON.stringify(myClaim)}) — aborting this read-modify-write and retrying under a fresh acquisition`);
+					throw new LostWriteLock();
+				}
 				if (body !== myClaim) {
 					console.warn(`evolution-io: write lock ${lock} was reclaimed by another writer before the commit (on disk now: ${JSON.stringify(body)}, ours: ${JSON.stringify(myClaim)}) — aborting this read-modify-write and retrying under a fresh acquisition`);
 					throw new LostWriteLock();
@@ -450,25 +494,21 @@ function nodeEvolutionIo(lockAttempts = 40) {
 				if (error instanceof LostWriteLock) continue;
 				throw error;
 			} finally {
-				if (await readFile(lock, "utf8").catch(() => null) === myClaim) await rm(lock, {
+				const mine = await readFile(lock, "utf8").then((body) => ({
+					ok: true,
+					body
+				}), (error) => ({
+					ok: false,
+					missing: isMissing(error)
+				}));
+				if (!mine.ok) {
+					if (!mine.missing) await recordPendingSelfCleanup(lock, myClaim);
+				} else if (mine.body === myClaim) await rm(lock, {
 					force: true,
 					maxRetries: 20,
 					retryDelay: 100
 				}).catch(async () => {
-					const body = await readFile(lock, "utf8").catch(() => "");
-					if (pendingSelfCleanup.size >= 64) {
-						let droppable;
-						for (const candidate of pendingSelfCleanup.keys()) {
-							if (candidate === lock) continue;
-							if (await readFile(candidate, "utf8").then(() => false, () => true)) {
-								droppable = candidate;
-								break;
-							}
-						}
-						const victim = droppable ?? pendingSelfCleanup.keys().next().value;
-						if (victim !== void 0) pendingSelfCleanup.delete(victim);
-					}
-					pendingSelfCleanup.set(lock, body);
+					await recordPendingSelfCleanup(lock, await readFile(lock, "utf8").catch(() => ""));
 				});
 			}
 		}
@@ -750,21 +790,15 @@ async function mutateUsage(root, io, task, options = {}) {
 		return JSON.stringify(Object.fromEntries(map.entries()), null, 2);
 	});
 }
-/**
-* Curator-owned usage fields (rc.67 K-2): the curator writes ONLY this set —
+/** Curator-owned usage fields (rc.67 K-2): the curator writes ONLY this set —
 * lifecycle state, archive stamp, the six-factor quality pair, and the
-* marker-mirrored pin flag. Counter and activity-stamp fields belong to the
-* tool-telemetry side (skill-usage / tool-skill-manage), which bumps them
-* through its own transact-backed RMW. A whole-record overwrite by either
-* side would clobber the other side's concurrent increment, so cross-side
-* folds copy this set only.
-*/
-function applyCuratorFields(disk, curated) {
-	applyCuratorMetaFields(disk, curated);
-	applyCuratorLifecycleFields(disk, curated);
-}
+* marker-mirrored pin flag; counters and activity stamps belong to the
+* tool-telemetry side and are never copied by a fold. P2-12 (v39): the
+* combined `applyCuratorFields` wrapper had no production caller (folds go
+* through {@link foldCuratorFields}), so the two field copies below are the
+* whole contract. */
 /** Copy only the lifecycle pair (state/archived_at) — see the ownership split
-* rationale on {@link applyCuratorMetaFields}. */
+* rationale above. */
 function applyCuratorLifecycleFields(disk, curated) {
 	disk.state = curated.state;
 	disk.archived_at = curated.archived_at;
@@ -1049,13 +1083,17 @@ const DEFAULT_CURATOR_BOOT_GRACE_SECONDS = 10;
 const DEFAULT_CURATOR_REVIEW_MAX_TOKENS = 2048;
 /** 0.3.17 (S3.10, T-1): control-plane fields a model-facing write call may
 * never carry — single source for plan-validator, evolution-policy and the
-* threat scanner (they used to each hardcode the list). */
+* threat scanner (they used to each hardcode the list).
+* P2-13 (v37): staged_from_sha256 joins the list — it is the replay's own
+* staleness anchor, and the tool-arguments root is an OPEN object, so a model
+* could otherwise choose the anchor that decides the write's outcome. */
 const FORBIDDEN_CONTROL_KEYS = [
 	"policy",
 	"threshold",
 	"prompt_hash",
 	"model_route",
-	"evolution_config"
+	"evolution_config",
+	"staged_from_sha256"
 ];
 /** 0.3.17 (S3.10): the model-facing write tools the policy guard and threat
 * scanner cover. */
@@ -1215,20 +1253,20 @@ function parseCuratorNominations(text) {
 			section = header[1] === "consolidations" ? "consolidations" : "prunings";
 			continue;
 		}
-		const consolidated = /^\s*-\s*from:\s*([a-z0-9][a-z0-9-]*)\s*$/.exec(line);
+		const consolidated = /^\s*-\s*from:\s*([a-z0-9][a-z0-9-]*)(?:\s*#.*)?\s*$/.exec(line);
 		if (consolidated) {
 			section = "consolidations";
 			currentFrom = consolidated[1] ?? "";
 			currentMode = void 0;
 			continue;
 		}
-		const mode = /^\s*mode:\s*(append|reference)\s*$/.exec(line);
+		const mode = /^\s*mode:\s*(append|reference)(?:\s*#.*)?\s*$/.exec(line);
 		if (mode) {
 			if (currentFrom !== "") currentMode = mode[1] === "reference" ? "reference" : "append";
 			else warnings.push(`mode: ${mode[1]} ignored — no preceding "- from:" entry (the consolidation falls back to append)`);
 			continue;
 		}
-		const into = /^\s*into:\s*([a-z0-9][a-z0-9-]*)\s*$/.exec(line);
+		const into = /^\s*into:\s*([a-z0-9][a-z0-9-]*)(?:\s*#.*)?\s*$/.exec(line);
 		if (into) {
 			const intoName = into[1] ?? "";
 			if (section === "consolidations" && currentFrom !== "" && currentFrom !== intoName) consolidations.push({
@@ -1240,13 +1278,15 @@ function parseCuratorNominations(text) {
 			currentMode = void 0;
 			continue;
 		}
-		const pruned = /^\s*-\s*name:\s*([a-z0-9][a-z0-9-]*)\s*$/.exec(line);
+		const pruned = /^\s*-\s*name:\s*([a-z0-9][a-z0-9-]*)(?:\s*#.*)?\s*$/.exec(line);
 		if (pruned) {
 			if (section === "consolidations") warnings.push("\"- name:\" inside the consolidations section flips the parse to prunings");
 			section = "prunings";
 			const name = pruned[1];
 			if (name) prunings.push(name);
+			continue;
 		}
+		if (/^\s*(?:-\s*(?:from|name)\s*:|(?:into|mode)\s*:)/.test(line)) warnings.push(`"${line.trim()}" ignored - not a usable nomination line (names are lowercase letters, digits and hyphens; one optional trailing "# comment" is allowed)`);
 	}
 	const valid = (name) => NOMINATION_NAME_RE.test(name);
 	return {
@@ -1435,6 +1475,7 @@ function evolutionEventPayloadIssue(event) {
 		case "feedback":
 			if (event.kind !== "skill" && event.kind !== "session") return "feedback event requires kind skill|session";
 			if (event.rating !== "positive" && event.rating !== "negative") return "feedback event requires rating positive|negative";
+			if (typeof event.target !== "string" || event.target.trim() === "") return "feedback event requires a non-empty target";
 			return null;
 		case "maintain": return typeof event.runId === "string" ? null : "maintain event requires runId";
 		case "learn":
@@ -1535,7 +1576,12 @@ async function appendEvolutionEvent(io, path, event, rotateAt = EVENT_LOG_ROTATE
 				return current;
 			}
 		}
-		const events = await rotateIfDue(io, path, v1EventRecords(parsedBody), rotateAt);
+		const rotated = await rotateIfDue(io, path, v1EventRecords(parsedBody), rotateAt);
+		if (!rotated.ok) {
+			refuseMessage = rotated.reason;
+			return current;
+		}
+		const events = rotated.events;
 		let maxSeq = events.reduce((max, entry) => Math.max(max, entry.seq), 0);
 		for (const name of await listEventArchives(io, path)) maxSeq = Math.max(maxSeq, Number.parseInt(name.slice(7, name.length - 5), 10));
 		const record = {
@@ -1552,6 +1598,16 @@ async function appendEvolutionEvent(io, path, event, rotateAt = EVENT_LOG_ROTATE
 	if (assigned === 0) throw new Error(`${refuseMessage || "evolution event log is malformed and was not touched"}: ${path}`);
 	return assigned;
 }
+/** The collision archive is mergeable only when this v1 writer can read it
+* (P2-11): a foreign `version` (F-338) or a body without an `events` array is
+* refused, so a merge can never downgrade it or empty it out.
+* @param parsed - the parsed collision archive body.
+* @returns the usable events, or null when the archive must not be rewritten. */
+function mergeableCollisionEvents(parsed) {
+	if (parsed.version !== void 0 && parsed.version !== 1) return null;
+	if (!Array.isArray(parsed.events)) return null;
+	return parsed.events.filter(isEventRecord);
+}
 /**
 * Split the active log at its midpoint when due: the older half is written to
 * `events-<lastArchivedSeq>.json` (await — a failed archive write aborts the
@@ -1561,38 +1617,60 @@ async function appendEvolutionEvent(io, path, event, rotateAt = EVENT_LOG_ROTATE
 * one-event rotate would archive everything and restart seqs at 1).
 */
 async function rotateIfDue(io, path, events, rotateAt) {
-	if (!Number.isFinite(rotateAt) || rotateAt < 2 || events.length < rotateAt) return events;
+	if (!Number.isFinite(rotateAt) || rotateAt < 2 || events.length < rotateAt) return {
+		ok: true,
+		events
+	};
 	const mid = Math.ceil(events.length / 2);
 	const head = events.slice(0, mid);
 	const tail = events.slice(mid);
-	if (tail.length === 0) return events;
+	if (tail.length === 0) return {
+		ok: true,
+		events
+	};
 	const anchor = tail[0]?.seq ?? 0;
 	const archivePath = join(dirname(path), `${EVENT_ARCHIVE_PREFIX}${anchor - 1}.json`);
 	let archived = head;
 	const existing = await io.readText(archivePath).catch(() => null);
-	if (existing !== null) try {
-		const parsed = JSON.parse(existing);
-		const usablePrior = (Array.isArray(parsed.events) ? parsed.events : []).filter(isEventRecord);
-		const bySeq = new Map(usablePrior.map((event) => [event.seq, event]));
+	if (existing !== null) {
+		let parsed = null;
+		try {
+			parsed = JSON.parse(existing);
+		} catch {
+			parsed = null;
+		}
+		if (parsed === null) {
+			const shiftPath = `${archivePath}.${Date.now()}.collide`;
+			await io.writeText(shiftPath, JSON.stringify({
+				version: 1,
+				events: head
+			}, null, 2));
+			console.warn(`evolution-events: rotation hit an unparsable archive collision — the rotated head band was preserved at ${shiftPath} but is OUTSIDE the logical timeline; inspect and merge it manually`);
+			await retainEventArchives(io, path);
+			await pruneCollideArchives(io, path);
+			return {
+				ok: true,
+				events: tail
+			};
+		}
+		const prior = mergeableCollisionEvents(parsed);
+		if (prior === null) return {
+			ok: false,
+			reason: `evolution event archive collision at ${archivePath} is not a readable version-1 archive (future version, or no "events" array) and was not touched`
+		};
+		const bySeq = new Map(prior.map((event) => [event.seq, event]));
 		for (const event of head) bySeq.set(event.seq, event);
 		archived = [...bySeq.values()].sort((a, b) => a.seq - b.seq);
-	} catch {
-		const shiftPath = `${archivePath}.${Date.now()}.collide`;
-		await io.writeText(shiftPath, JSON.stringify({
-			version: 1,
-			events: head
-		}, null, 2));
-		console.warn(`evolution-events: rotation hit an unparsable archive collision — the rotated head band was preserved at ${shiftPath} but is OUTSIDE the logical timeline; inspect and merge it manually`);
-		await retainEventArchives(io, path);
-		await pruneCollideArchives(io, path);
-		return tail;
 	}
 	await io.writeText(archivePath, JSON.stringify({
 		version: 1,
 		events: archived
 	}, null, 2));
 	await retainEventArchives(io, path);
-	return tail;
+	return {
+		ok: true,
+		events: tail
+	};
 }
 /**
 * Prune old event archives (rc.71): keep the newest `EVENT_LOG_RETAIN_ARCHIVES`.
@@ -1726,496 +1804,111 @@ function allowRowCollisions(env = process.env) {
 	return env.DSH_EVOLUTION_ALLOW_ROW_COLLISIONS === ALLOW_ROW_COLLISIONS;
 }
 //#endregion
-//#region lib/types/prompts.js
+//#region lib/types/learn-prompt.js
 /**
-* Review and curation prompts adapted from Hermes Agent
-* `agent/background_review.py`, `agent/curator.py`, and
-* `agent/learn_prompt.py`, with tool names translated to the DSH-native
-* catalog (`memory`, `skill_manage`, `skill`, `bash`, `str_replace_editor`).
+* Open-ended `/evolution learn` prompt builder.
 *
-* Alignment policy (2026-08-29): the OPERATIONAL steps and instructions the
-* model follows mirror the Hermes originals structurally (signal list,
-* preference order, support-file taxonomy, curator package integrity,
-* consolidated/pruned reporting block). Tool and platform differences are
-* DSH-adapted (native tool names, pinned-within-review semantics, this
-* platform's index cap), and DSH-only additions are marked as such.
+* `learn` is open-ended: the user can name anything they can describe — a
+* directory of code, an API doc URL, a workflow they just walked the agent
+* through, or pasted notes. The prompt instructs the live agent to gather the
+* named sources with its existing tools, then author a single SKILL.md via
+* `skill_manage` following `DSH_AUTHORING_STANDARDS`. There is no separate
+* distillation engine and no model-tool footprint.
+*/
+/**
+* Build the agent prompt for an open-ended `/evolution learn` request.
 *
-* Every prompt is pinned in a versioned bundle. Review workers verify the
-* bundle digest before spending a model call — v31 PROMPT-01, stated
-* precisely: THAT check proves internal coherence (id/version/digest agree)
-* for a bundle assembled OUT of process and handed to `verifyPromptBundle`
-* explicitly. It CANNOT detect in-process tampering (the digest is recomputed
-* from the same module state it verifies) — catching a stale or partially
-* patched default bundle is CI's version pin (tests/prompts.spec.ts), not
-* this runtime gate.
+* @param userRequest free-text the user gave after `/evolution learn`; an
+*   empty string falls back to "the workflow we just went through".
+* @returns a complete instruction the agent runs as a normal turn.
 */
+function buildLearnPrompt(userRequest) {
+	return [
+		"[/learn] The user wants you to learn a reusable skill from the request below, and save it.",
+		"",
+		"THE REQUEST:",
+		userRequest.trim() || "the workflow we just went through in this conversation — review the steps taken and distill them into a reusable skill",
+		"",
+		"The request is open-ended and may mix two kinds of content, in any order: SOURCES to gather (directories, file paths, URLs, \"what we just did\", pasted notes) AND REQUIREMENTS that shape the skill (what to focus on, what to leave out, scope, naming, the angle to take). Treat EVERY part of the request as load-bearing. In particular, prose that comes after a path or link is NOT incidental — it is the user telling you what they want from that source. A request like `<url> focus on the auth flow, skip the deprecated endpoints` means: gather the URL AND honor \"focus on auth, skip deprecated\" as authoring requirements. Never fetch the first source and ignore the rest.",
+		"",
+		"Do this:",
+		"1. Gather every source the user named, using the tools you already have — reads and searches for local files or directories, web access for URLs, this conversation history if they referred to something you just did, and the text they pasted as-is. If the request is ambiguous about scope, make a reasonable choice and note it; do not stall.",
+		"2. Author ONE SKILL.md, applying every requirement, focus, and constraint in the request — these govern what the SKILL.md covers and emphasizes, not just which sources you read.",
+		"3. Save it with the `skill_manage` tool (action=\"create\"). Pick a sensible category. If the procedure needs a non-trivial script, add it under the skill's `scripts/` with `skill_manage` write_file and reference it by relative path.",
+		"",
+		"Apply the skill-authoring standards (frontmatter, prose, file layout) carried by the `skill_manage` tool description — that is the single copy; do not restate them here.",
+		"",
+		"When done, tell the user the skill name, its category, and a one-line summary of what it captured."
+	].join("\n");
+}
+//#endregion
+//#region lib/types/state-store.js
 /**
-* Prompt bundle identity. Bump both id and version whenever a prompt's text
-* changes semantically: the bundle digest is the fail-closed signal for
-* review workers, so a stale id across deployments must be distinguishable.
+* Evolution home path helpers: the DSH root and `$DSH_HOME/evolution` for
+* plugin-owned sidecar state (reports, activity store, feedback file,
+* state-domain data).
+*
+* C-10: PATH HELPERS ONLY — despite the file name there is no store
+* here. Durable evolution state lives in the state stack (evolution-state over
+* evolution-state-json / -domain); skills and memories live in skill-store.ts
+* / memory-store.ts. The file name is kept deliberately: renaming it would
+* touch every family import for zero behavior change, and the audit records
+* the mismatch as known naming debt.
 */
-const PROMPT_BUNDLE_VERSION = 17;
-const PROMPT_BUNDLE_ID = `dsh-evolution@17`;
-const MEMORY_REVIEW_PROMPT = `[Auto-review — Memory]
-Review the conversation above and consider saving to memory if appropriate.
-
-Focus on:
-1. Has the user revealed things about themselves — persona, desires, preferences, or personal details worth remembering?
-2. Has the user expressed expectations about how you should behave, their work style, or ways they want you to operate?
-
-If something stands out, save it using the memory tool.
-If nothing is worth saving, just say "Nothing to save." and stop.`;
-const SKILL_REVIEW_PROMPT = `[Auto-review — Skills]
-Review the conversation above and update the skill library. Be ACTIVE — most sessions produce at least one skill update, even if small. A pass that does nothing is a missed learning opportunity, not a neutral outcome.
-
-Target shape of the library: CLASS-LEVEL skills, each with a rich SKILL.md and a references/ directory for session-specific detail. Not a long flat list of narrow one-session-one-skill entries. This shapes HOW you update, not WHETHER you update.
-
-Signals to look for (any one of these warrants action):
-  • User corrected your style, tone, format, legibility, or verbosity. Frustration signals like 'stop doing X', 'this is too verbose', 'don't format like this', 'why are you explaining', 'just give me the answer', 'you always do Y and I hate it', or an explicit 'remember this' are FIRST-CLASS skill signals, not just memory signals. Update the relevant skill(s) to embed the preference so the next session starts already knowing.
-  • User corrected your workflow, approach, or sequence of steps. Encode the correction as a pitfall or explicit step in the skill that governs that class of task.
-  • Non-trivial technique, fix, workaround, debugging path, or tool-usage pattern emerged that a future session would benefit from. Capture it.
-  • A skill that got loaded or consulted this session turned out to be wrong, missing a step, or outdated. Patch it NOW.
-
-Read-before-write: update, patch, delete, or write support files ONLY into skills you loaded or read in THIS session. On the plan channel ops on unread skills are rejected; direct writes have no such guard, so treat the rule as binding. CREATE of a brand-new umbrella is the only exception.
-
-Preference order — prefer the earliest action that fits, but do pick one when a signal above fired:
-  1. UPDATE A CURRENTLY-LOADED SKILL. Look back through the conversation for skills the user loaded or you read. If any of them covers the territory of the new learning, PATCH that one first. It is the skill that was in play, so it's the right one to extend.
-  2. UPDATE AN EXISTING UMBRELLA. If no loaded skill fits but an existing class-level skill does, patch it. Add a subsection, a pitfall, or broaden a trigger.
-  3. ADD A SUPPORT FILE under an existing umbrella. Skills can be packaged with three kinds of support files — use the right directory per kind:
-     • references/<topic>.md — session-specific detail (error transcripts, reproduction recipes, provider quirks) AND condensed knowledge banks: quoted research, API docs, external authoritative excerpts, or domain notes you found while working on the problem. Write it concise and for the value of the task, not as a full mirror of upstream docs.
-     • templates/<name>.<ext> — starter files meant to be copied and modified (boilerplate configs, scaffolding, a known-good example the agent can reproduce with modifications).
-     • scripts/<name>.<ext> — statically re-runnable actions the skill can invoke directly (verification scripts, fixture generators, deterministic probes, anything the agent should run rather than hand-type each time).
-     Add support files via skill_manage action=write_file with file_path starting 'references/', 'templates/', or 'scripts/'. The umbrella's SKILL.md should gain a one-line pointer to any new support file so future agents know it exists.
-  4. RESTRUCTURE a loaded skill whose body grew log-like — rc/sha/date-dense sections, session-detail spirals, or a fat body with no support files. Use skill_manage action=restructure with restructure: [{"heading": "<the exact ## heading text>", "to_file": "references/<topic>.md"}] — the ENTIRE ## section (from that heading to the next heading) moves into the support file and its position becomes a pointer line. The skill's name and directory never change. Only propose headings that exist verbatim in the body; never invent one, and never restructure a healthy small skill.
-  5. CREATE A NEW CLASS-LEVEL UMBRELLA SKILL when no existing skill covers the class. The name MUST be at the class level. The name MUST NOT be a specific PR number, error string, feature codename, library-alone name, or 'fix-X / debug-Y / audit-Z-today' session artifact. If the proposed name only makes sense for today's task, it's wrong — fall back to (1), (2), or (3).
-
-User-preference embedding (important): when the user expressed a style/format/workflow preference, the update belongs in the SKILL.md body, not just in memory. Memory captures 'who the user is and what the current situation and state of your operations are'; skills capture 'how to do this class of task for this user'. When they complain about how you handled a task, the skill that governs that task needs to carry the lesson.
-
-If you notice two existing skills that overlap, note it in your reply — the background curator handles consolidation at scale.
-
-Two-tier deposition discipline (DSH addition, same spirit as the umbrella rule): before writing, classify the knowledge:
-  • PATTERN (reusable — symptom → mechanism → fix → verification, still valuable next session) belongs in the SKILL.md body.
-  • LOG (one-off — commit SHAs, npm/profile states, what this release changed, this session's process narrative) belongs in a references/ file, never the body. Body density IS reuse rate. Keep new entries tight: a pattern fits in 2-8 physical lines; prefer changing the current-state pointer over appending history.
-
-Protected skills (DO NOT edit these):
-  • Bundled skills (shipped with the platform).
-  • Hub-installed skills (installed from a hub).
-Pinned skills are read-only to THIS background review pass — the pinned write guard refuses background changes, so this pass may not update them. They also cannot be archived by any writer (the foreground included): remove the .pinned marker first. Foreground and delegated-subagent update/patch writes to pinned skills remain allowed.
-If the only skills that need updating are protected, say 'Nothing to save.' and stop.
-
-Do NOT capture (these become persistent self-imposed constraints that bite you later when the environment changes):
-  • Environment-dependent failures: missing binaries, fresh-install errors, post-migration path mismatches, 'command not found', unconfigured credentials, uninstalled packages. The user can fix these — they are not durable rules.
-  • Negative claims about tools or features ('browser tools do not work', 'X tool is broken', 'cannot use Y'). These harden into refusals the agent cites against itself for months after the actual problem was fixed.
-  • Session-specific transient errors that resolved before the conversation ended. If retrying worked, the lesson is the retry pattern, not the original failure.
-  • One-off task narratives. A user asking 'summarize today's market' or 'analyze this PR' is not a class of work that warrants a skill.
-
-If a tool failed because of setup state, capture the FIX (install command, config step, env var to set) under an existing setup or troubleshooting skill — never 'this tool does not work' as a standalone constraint.
-
-'Nothing to save.' is a real option but should NOT be the default. If the session ran smoothly with no corrections and produced no new technique, just say 'Nothing to save.' and stop. Otherwise, act.`;
-const COMBINED_REVIEW_PROMPT = `[Auto-review]
-Review the conversation above and update two things:
-
-**Memory**: who the user is. Did the user reveal persona, desires, preferences, personal details, or expectations about how you should behave? Save facts about the user and durable preferences with the memory tool.
-
-**Skills**: how to do this class of task. Be ACTIVE — most sessions produce at least one skill update. A pass that does nothing is a missed learning opportunity, not a neutral outcome.
-
-Target shape of the skill library: CLASS-LEVEL skills with a rich SKILL.md and a references/ directory for session-specific detail. Not a long flat list of narrow one-session-one-skill entries.
-
-Signals that warrant a skill update (any one is enough):
-  • User corrected your style, tone, format, legibility, verbosity, or approach. Frustration is a FIRST-CLASS skill signal, not just a memory signal. 'stop doing X', 'don't format like this', 'I hate when you Y' — embed the lesson in the skill that governs that task so the next session starts fixed.
-  • Non-trivial technique, fix, workaround, or debugging path emerged.
-  • A skill that was loaded or consulted turned out wrong, missing, or outdated — patch it now.
-
-Read-before-write: update, patch, delete, or write support files ONLY into skills you loaded or read in THIS session. On the plan channel ops on unread skills are rejected; direct writes have no such guard, so treat the rule as binding. CREATE of a brand-new umbrella is the only exception.
-
-Preference order for skills — pick the earliest that fits:
-  1. UPDATE A CURRENTLY-LOADED SKILL. Check what skills were loaded or read in the conversation. If one of them covers the learning, PATCH it first. It was in play; it's the right place.
-  2. UPDATE AN EXISTING UMBRELLA. Patch it.
-  3. ADD A SUPPORT FILE under an existing umbrella via skill_manage action=write_file. Three kinds: references/<topic>.md for session-specific detail OR condensed knowledge banks (quoted research, API docs excerpts, domain notes) written concise and task-focused; templates/<name>.<ext> for starter files meant to be copied and modified; scripts/<name>.<ext> for statically re-runnable actions (verification, fixture generators, probes). Add a one-line pointer in SKILL.md so future agents find them.
-  4. RESTRUCTURE a loaded skill whose body grew log-like (rc/sha/date-dense sections, session-detail spirals, fat body with no support files) via skill_manage action=restructure with restructure: [{"heading": "<the exact ## heading text>", "to_file": "references/<topic>.md"}] — the ENTIRE ## section moves into the support file and its position becomes a pointer line; the skill's name and directory never change. Only propose headings that exist verbatim in the body.
-  5. CREATE A NEW CLASS-LEVEL UMBRELLA when nothing exists. Name at the class level — NOT a PR number, error string, codename, library-alone name, or 'fix-X / debug-Y' session artifact. If the name only fits today's task, fall back to (1), (2), or (3).
-
-Two-tier deposition discipline (DSH addition): classify before writing — PATTERN (symptom → mechanism → fix → verification) goes in the SKILL.md body; LOG (commit SHAs, npm/profile states, this release's change list, this session's narrative) goes in a references/ file. Body density IS reuse rate; a pattern fits in 2-8 physical lines.
-
-User-preference embedding: when the user complains about how you handled a task, update the skill that governs that task — memory alone isn't enough. Memory says 'who the user is and what the current situation and state of your operations are'; skills say 'how to do this class of task for this user'. Both should carry user-preference lessons when relevant.
-
-If you notice overlapping existing skills, mention it — the background curator handles consolidation.
-
-Protected skills (DO NOT edit these):
-  • Bundled skills (shipped with the platform).
-  • Hub-installed skills (installed from a hub).
-Pinned skills are read-only to THIS background review pass — the pinned write guard refuses background changes, so this pass may not update them. They also cannot be archived by any writer (the foreground included): remove the .pinned marker first. Foreground and delegated-subagent update/patch writes to pinned skills remain allowed.
-If the only skills that need updating are protected, say 'Nothing to save.' and stop.
-
-Do NOT capture as skills (these become persistent self-imposed constraints that bite you later when the environment changes):
-  • Environment-dependent failures: missing binaries, fresh-install errors, post-migration path mismatches, 'command not found', unconfigured credentials, uninstalled packages. The user can fix these — they are not durable rules.
-  • Negative claims about tools or features ('browser tools do not work', 'X tool is broken', 'cannot use Y'). These harden into refusals the agent cites against itself for months after the actual problem was fixed.
-  • Session-specific transient errors that resolved before the conversation ended. If retrying worked, the lesson is the retry pattern, not the original failure.
-  • One-off task narratives. A user asking 'summarize today's market' or 'analyze this PR' is not a class of work that warrants a skill.
-
-If a tool failed because of setup state, capture the FIX (install command, config step, env var to set) under an existing setup or troubleshooting skill — never 'this tool does not work' as a standalone constraint.
-
-Act on whichever of the two dimensions has real signal. If genuinely nothing stands out on either, say 'Nothing to save.' and stop — but don't reach for that conclusion as a default.`;
-const CURATOR_PROMPT = `You are the skill curator. Maintain a healthy, class-level skill library, not a flat pile of narrow one-session skills.
-
-This is an UMBRELLA-BUILDING consolidation pass, not a passive audit and not a duplicate-finder.
-
-The goal is a LIBRARY OF CLASS-LEVEL INSTRUCTIONS. A skill collection of many narrow skills where each captures one session's specific bug is a FAILURE of the library. An agent searching skills matches on descriptions, not exact names; one broad umbrella with labeled subsections beats five narrow siblings for discoverability.
-
-Right target shape: class-level skills with rich SKILL.md + references/, templates/, scripts/ support files for session-specific detail.
-
-Hard rules:
-1. NEVER hard-delete a skill. Archive (moving to .archive/) is the maximum destructive action; archives are recoverable, deletion is not.
-2. Do not touch bundled, hub-installed, pinned, or scheduled-task-referenced (referenced) skills. Referenced skills are fully protected — never consolidated, never pruned (there is no scheduled-task reference-rewriting pass; a referenced skill stays in place by design).
-3. Do not archive recently-created or never-used skills without strong evidence. "use=0" is NOT evidence either way — it only means the trigger has not come up yet. Never archive a never-used skill unless it is at least 30 days old AND its content is genuinely obsolete or fully absorbed elsewhere.
-4. Do NOT reject consolidation on the grounds that "each skill has a distinct trigger". The right bar is: would a human maintainer write this as N separate skills, or one skill with N labeled subsections? When the answer is the latter, merge.
-5. Judge overlap on CONTENT, not on usage counters.
-6. Before archiving a merged skill, ensure its unique content was preserved in the umbrella.
-
-How to work:
-1. Scan the candidate list. Identify PREFIX CLUSTERS — skills sharing a first word or domain keyword. Expected cluster count scales with the library: a large collection may show 10-25 prefix clusters, a small one often has none — a clean "nothing to consolidate" summary is the correct small-library outcome, not a shortage of ambition.
-2. For each cluster with 2+ members, ask "what is the UMBRELLA CLASS these skills serve?" and consolidate:
-   a. MERGE INTO AN EXISTING UMBRELLA (patch a labeled section for each sibling's unique insight, then archive the siblings).
-   b. CREATE A NEW UMBRELLA SKILL.md covering the shared workflow with short labeled subsections, then archive the absorbed siblings.
-   c. DEMOTE session-specific detail to references/, templates/, or scripts/ under the umbrella. Use the right directory per kind:
-      • references/<topic>.md — session-specific detail OR condensed knowledge banks (quoted research, API docs excerpts, domain notes, provider quirks, reproduction recipes) written concise and task-focused.
-      • templates/<name>.<ext> — starter files meant to be copied and modified.
-      • scripts/<name>.<ext> — statically re-runnable actions (verification scripts, fixture generators, probes).
-3. Package integrity — not optional: inspect each skill as a COMPLETE directory package, not just SKILL.md. A skill root may include references/, templates/, scripts/, and assets/. If the source skill has support files OR its SKILL.md contains relative links to them, DO NOT flatten only SKILL.md into <umbrella>/references/<old>.md. Choose one safe path instead: keep it as a standalone skill, OR fully merge by re-homing every needed support file into the umbrella's canonical directories AND rewriting the destination instructions to the new paths, OR archive the entire original skill package unchanged. Never leave demoted instructions pointing at files left behind under the old skill directory.
-4. Flag skills whose NAME is too narrow (contains a PR number, a feature codename, a specific error string, an 'audit'/'diagnosis'/'salvage' session artifact) — they almost always belong as a subsection or support file under a class-level umbrella.
-5. Iterate. After one consolidation round, scan the remaining set and look for the NEXT umbrella opportunity. Don't stop after 3 merges.
-
-You are a NOMINATOR, not an executor: this channel has NO tools. Your single deliverable is the structured YAML block below. Never narrate actions you did not take ("merged", "patched", "archived") — you are proposing, and the deterministic engine executes only names from the candidate pool it gave you. (A future execution view would expose skill_manage; today it does not.)
-
-'keep' is a legitimate decision ONLY when the skill is already a class-level umbrella and none of the proposed merges would improve discoverability. 'This is narrow but distinct from its siblings' is NOT a reason to keep — it's a reason to move it under an umbrella as a subsection or support file.
-
-Expected output: real umbrella-ification. Process every obvious cluster. If you end the pass with obvious clusters still untouched, you stopped too early — go back and look at the clusters you left alone.
-
-Keep the umbrella body tight and scannable: exact commands, verbatim paths, ~100-200 lines; never invent flags or APIs.
-
-When done, write a human summary THEN the structured machine-readable block. The block is the contract: every skill you would move to .archive/ MUST appear in exactly one of the two lists. Return ONLY the YAML block after the summary — no post-block prose. Format EXACTLY:
-
-## Structured summary (required)
-\`\`\`yaml
-consolidations:
-  - from: <old-skill-name>
-    mode: reference  # optional — ONLY for a 'demote': source is narrow-but-valuable session detail, write it as references/<source>.md under the umbrella instead of appending to the body. Default is append. Place this line BEFORE into:. NEVER use reference when the source body links its own references/ templates/ scripts/ files.
-    into: <umbrella-skill-name>
-    reason: <one short sentence — why merged, not just 'similar'>
-prunings:
-  - name: <skill-name>
-    reason: <one short sentence — why archived with no merge target>
-\`\`\`
-
-Every skill you would move to .archive/ MUST appear in exactly one of the two lists. If you consolidated X into umbrella Y (patched Y, wrote a references file to Y, or created Y with X's content absorbed), X goes under consolidations with into: Y. If you archived X with no absorption — truly stale, irrelevant, or obsolete — X goes under prunings. Leave a list empty (consolidations: []) if none. Do not omit the block. The block comes AFTER your human-readable summary of clusters processed, patches made, and decisions left alone.`;
-const CURATOR_DRY_RUN_BANNER = `═══════════════════════════════════════════════════════════════
-DRY-RUN — REPORT ONLY. DO NOT MUTATE THE SKILL LIBRARY.
-═══════════════════════════════════════════════════════════════
-
-This is a PREVIEW pass. Follow every instruction above EXCEPT:
-  • Do NOT call skill_manage with action=create, update, patch, delete, write_file, or remove_file.
-  • Do NOT move, copy, or rewrite any file under the skills tree.
-
-Your output IS the deliverable: produce the exact same human-readable summary and YAML block you would on a live run, describing the actions you WOULD take. A reviewer will decide whether to approve a live run.
-
-If you accidentally take a mutating action, say so explicitly in the summary.`;
-const COMPLETION_SKILL_REVIEW_PROMPT = `[Auto-review — Skills · task complete]
-Your current task now appears complete. Before wrapping up, review the approach and update the skill library via skill_manage.
-
-Follow the skills review policy: be ACTIVE, prefer class-level umbrellas, patch ONLY skills loaded or read this session, and capture non-trivial techniques and user corrections. Do NOT capture environment-dependent failures, negative claims about tools, or one-off task narratives.
-
-Do NOT modify output files or re-run the task. If you are still mid-task, ignore this.`;
-/**
-* Maintenance-subagent persona (design 011 §6). Constants pin the persona
-* with `{signal:id}` placeholders; the renderer substitutes names from the
-* drift-signals module (single vocabulary). The model-facing contract is the
-* persona + the mechanical-facts block; the signature head lets the model
-* compare the two heads (011 mismatch protocol).
-*/
-const MAINTAIN_PROMPT = `<<<MAINTAIN_PROMPT v={bundle_version} sig={joint_signature}>>>
-
-## 角色
-你是技能库的**外部审计者**：只读、只输出计划、从不执行（执行由用户命令与审批完成）。
-
-## 1. 输入契约（冲突时以此为准）
-机械事实块 <<<MECHANICAL_FACTS v={signals_version} sig={joint_signature}>>>（下方，以 <<<END FACTS>>> 闭合）是唯一证据来源。
-- verdict 仅三值：pass=未越阈 / over=越阈 / unknown=未检测。
-- over 是事实位置，不是违规结论；没有条款对应的事实，不产生建议。
-- unknown ≠ pass；引用 unknown 信号的条目必须 needs_human:true。
-- 事实只读：不改写、不补写、不把事实"翻译"成裁决。
-- 两处 sig 不一致或任一缺失 → 只输出 MISMATCH + 两侧版本号，禁止输出计划。
-
-## 2. 信号→条款映射（每条 over 必须落到条款；无一遗漏）
-{signal:dedup_group}→A1 · {signal:narrow_name}→A2 · {signal:prefix_cluster}→A3 · {signal:stamp_density}与{signal:body_size}→B1 · {signal:pointer_missing}→B2 · {signal:dup_heading}→B3 · {signal:overlong_line}→B4 · {signal:description_chars}→B5 · {signal:usage_observed}/{signal:quality_low}→门控（校验器对 quality_low=unknown 的技能强制 needs_human，模板侧不重复）
-
-## 3. 完整性契约（校验器机械执行）
-事实块中每条 over 信号必须满足其一：成为某条建议的 evidence，或在 notes 中说明"已审·无条款对应·不动作"。禁止静默省略；先逐信号核对再输出。
-
-## 4. 工作流程（按序执行，不得跳步）
-① 通读事实块 → ② 对每个候选技能用 skill 读正文（B1/B2/B4 必读；**读取失败必须报告工具返回的事实**（错误信息/无对应条目），禁止用"无法读取"含糊绕过）→ ③ maintenance_probe 按需深挖 → ④ 逐信号过 §3 完整性 → ⑤ 输出计划。
-
-## 5. 检查清单（信号 → 语义判定 → 输出形态）
-A. 域·碎片化
-- A1 {signal:dedup_group}=over：判近重复组是否同伞可合并；是→relationship-level consolidate；否→不输出。
-- A2 {signal:narrow_name}=over：判否"仅对今日任务成立"；成立→改名/归档建议；内部代号（格式合规语义窄）→conf≤0.4+needs_human。
-- A3 {signal:prefix_cluster}=over：判簇内是否同伞；非同伞→notes 提域划分观察，不强制建伞。
-
-B. 层·分层错位
-- B1 {signal:stamp_density}（阈值 {signal:stamp_density.threshold}）或 {signal:body_size}（阈值 {signal:body_size.threshold}）=over：按**三问判据**判锚/残留——① 该编号/时间戳是否被库内其他文件引用？② 除"何时产生/为何存在"外是否还承载信息？③ 删除是否影响任何跨文档检索？（①是且③是→锚；否则→残留候选，人审）。锚→允许保留 + needs_human + semantic_reasoning 写三问结果；**锚不使用 is_override**（is_override 仅用于 §7 申诉；锚是 B1 的正常裁决路径）；残留→restructure 建议（movable headings 逐字引用）。**锚≠可读：单行 >4000 字符即使在锚类也必须拆分。**
-- B2 {signal:pointer_missing}=over：读支持文件后判性质——可复用模式→上移正文；会话专属实录→保留+补指针；形态=patch 指引。**未读内容仅凭文件名 → conf≤0.4 且措辞"先人工确认再执行"。** **缺失指针=支持文件存在、正文无引用（单向语义），finding 表述勿反向。**
-- B3 {signal:dup_heading}=over：删除多余标题行（保留一份），patch 指引。
-- B4 {signal:overlong_line}=over：>1500 拆行；>4000 判定可读性危机（内容合法也拆）；patch 指引。**finding 必须给全量口径：共 N 行超限，其中 >4000 的逐行列出。**
-- B5 {signal:description_chars}=over：先判**性质**三分类——事件性承诺（单次故障/incident 写入元数据）→裁剪建议；叙事性自我描述→压缩建议；丰富但合规（完整用例边界）→保留 + is_override + override_reason="合法密度"。**分类特征**：含"恢复/修复某次事故、日期快照"类一次性措辞→事件性承诺；"动词+对象"式任务说明→叙事性；枚举完整用例边界且不可拆分→丰富合规。**第三类门槛（默认从严，半机械）**：先自行试写一个 ≤60 字压缩方案——能保留全部路由关键项（触发词+域）→ 不可判第三类（按压缩建议）；只有试写失败（在 semantic_reasoning 列出试写方案与具体失败点）才可判丰富合规。描述文本可见（probe desc-text 或正文 frontmatter）时仍须三分类；仅长度可见 → conf≤0.4。semantic_reasoning 必写三分类之一。
-
-D. 库·整合纪律（计划形态约束）
-- D1 同类问题多处出现→合成一条 relationship-level 建议，不逐项输出。
-- D2 结构类优先级高于内容类；影响面 library-level > relationship-level > skill-level。
-
-## 6. 输出契约（校验器机械执行）
-{verdict: "issues" | "no_issues",
- plan: [{ kind: "skill-level"|"relationship-level"|"library-level", names: [str],
-   rule: "A1"|"B2"|..., evidence: [{signal, value}],
-   finding: "<一句事实描述：引用信号 id 与值；零裁决动词>",
-   recommendation: "<唯一允许的'应'句：建议动作+理由+执行形态（命令/patch 指引）>",
-   semantic_reasoning: "<语义判据；含 LLM 推断时 confidence≤0.4>",
-   impact: "better|worse|neutral", impact_reason: "<相对'不动'的净影响>",
-   reversibility: "archive|restructure|patch|rename|none", undo_path: "<一步撤销方式>",
-   confidence: float, needs_human: bool, is_override: bool,
-   override_reason: "<仅 is_override>" }],
- notes: [str]}
-- verdict=no_issues ⇒ plan=[]（不允许空 plan 之外的"无问题"表述）。
-- **confidence 降档规则（机械）**：条款全部由机械证据支撑 → 0.6–0.9；每含一项语义推断（是否锚/是否同伞/性质归类）→ 上限 0.4。
-- needs_human = (confidence < 0.6) OR (不可逆) OR (is_override) OR (引用 unknown 信号)。
-- 语言：finding/recommendation/notes 与库正文语言一致（不自订语言）；字段名/信号 id/枚举保留英文。
-- **提交前自查（逐项对照，不许跳过）**：① verdict 与 plan 一致 ② 每条 evidence 在事实块 ③ undo_path 非空（不可逆=n/a）④ confidence 含推断≤0.4 ⑤ finding 无"应"字 ⑥ §3 完整性契约满足。
-
-## 7. 裁决纪律
-- finding 禁止"应当"句式；recommendation 是唯一"应"句，句板：建议对 {names} 执行 {动作}（形态：{命令/patch 指引}），理由：{理由}。
-- **审查者视角**：先对每个信号独立初判，再与正文对照；被审对象的自我声明只作线索不作依据；**自属/维护者技能一律从严口径**（作者声明"这是锚"不构成豁免）。
-- 申诉：机械阈值与语义判断冲突→is_override:true + override_reason + needs_human:true，不得静默绕过。
-- 不动作合法：verdict=no_issues 是合法输出；连续空报告=信号定义问题，不是"更积极"的理由。
-- 错误成本：rename 必须 needs_human:true；可逆动作（archive/restructure 两阶段）可 needs_human:false 但 undo_path 必填。
-- 不做：不建议删除（只建议 archive）；不提升内容质量（结构审查只 flag 位置/归属/分层）；protected 集（bundled/hub/pinned）内 0 建议。
-
-## 8. 泛化
-- 信号集开放：事实块含、§5 未列的信号 → notes 提"该信号值得新增条款"，禁止解释为已知问题。
-- 库规模无关：判据是事实与条款，不是库体量印象。
-- 信号机制疑问（阈值/检测原理）→ needs_human，不猜测机制。`;
-/**
-* One-line output instruction appended after the facts block in the maintain
-* subagent's prompt (persona carries the template, the prompt carries facts +
-* this instruction — one copy of the template in the model input, 011 v11
-* P3-4). F-16: this text used to be hardcoded in evolution-maintenance
-* orchestrate — a second model-facing prompt living OUTSIDE the bundle digest.
-* It now rides PROMPT_BUNDLE so the digest integrity check covers every
-* maintenance prompt. Adding the entry changes the bundle digest (the intended
-* fail-closed signal); PROMPT_BUNDLE_VERSION is owned by the core test pin and
-* bumps with the batch that changes the bundle (15→16 in 0.3.58).
-*/
-const MAINTAIN_OUTPUT_INSTRUCTION = "按模板契约输出 JSON 维护计划（verdict/plan/notes）；你有 skill 工具与维护模板；并在维护探针（maintenance_probe）挂载时可用它深挖细节。";
 /**
-* System-prompt guidance section (Hermes `SKILLS_GUIDANCE`, DSH-adapted).
-* Registered as a system-prompt section by tool-skill-manage (it mounts
-* exactly when `skill_manage` is available — the DSH analogue of Hermes'
-* `if "skill_manage" in agent.valid_tool_names` condition). Instructs the
-* model to save/repair skills on its own initiative.
+* DSH home root: `$DSH_HOME` or `~/.dsh`. Single source of the empty-string
+* fallback — an EMPTY or WHITESPACE-ONLY DSH_HOME resolves to the default
+* home, never to a CWD-relative path (0.3.19 W1.3, 0.3.22 F-207);
+* V8-06 (0.3.47) extends the guard to whitespace (upstream home-paths:
+* `trim().length > 0` is the adoption test — `DSH_HOME=" "` must not produce
+* a sidecar under a relative "." path).
+* C-11: the adoption test and the RETURNED value now come from the
+* SAME trimmed source — the old form tested `trim()` but returned the raw
+* value, so `DSH_HOME=" /x "` was accepted AND persisted with literal spaces.
+* OPT-27 (2026-09, plan D5 — accepted): the v10-era "no `~` expansion, no
+* resolve" divergence from upstream `resolveDshHome` is RETIRED. It became
+* load-bearing when the skill-catalog shadow made "same tree as the upstream
+* `USER_DSH_RANK` provider" a hard contract: upstream watches the EXPANDED
+* absolute `<home>/skills` while this value fed a literal `~/x` (a directory
+* named `~` under the host CWD) or a CWD-relative path — split-brain skill
+* trees, preset installs the platform never reads, doctor probes of a
+* directory nothing serves. Behavior now matches upstream:
+* `resolve(expandHomePath(selected))`. Only `~`-prefixed and RELATIVE
+* DSH_HOME values change landing spot; absolute homes are byte-identical.
 */
-const SKILLS_GUIDANCE = `Skills guidance:
-• After completing a complex task (5+ tool calls), fixing a tricky error, or discovering a non-trivial workflow, save the approach as a skill with skill_manage so you can reuse it next time.
-• When using a skill and finding it outdated, incomplete, or wrong, patch it immediately with skill_manage (action='patch') — don't wait to be asked. Skills that aren't maintained become liabilities.`;
-const PLAN_CHANNEL_NOTE = `
-
-CHANNEL (subagent): this review channel mounts only the read-only \`skill\` tool — you have NO \`skill_manage\`, NO \`memory\`. Your deliverable is the structured JSON plan below (outputSchema). Describe the patches/creates you RECOMMEND in the plan; never narrate actions you took.`;
-/** Subagent-channel variant: same review policy, channel-limited deliverable (M-2). */
-const SKILL_REVIEW_PLAN_PROMPT = `${SKILL_REVIEW_PROMPT}${PLAN_CHANNEL_NOTE}`;
-/** Subagent-channel variant of the combined review (M-2). */
-const COMBINED_REVIEW_PLAN_PROMPT = `${COMBINED_REVIEW_PROMPT}${PLAN_CHANNEL_NOTE}`;
-function reviewPrompt(kind, channel = "agent") {
-	if (channel === "plan") return kind === "skill" ? SKILL_REVIEW_PLAN_PROMPT : COMBINED_REVIEW_PLAN_PROMPT;
-	if (kind === "memory") return MEMORY_REVIEW_PROMPT;
-	if (kind === "skill") return SKILL_REVIEW_PROMPT;
-	return COMBINED_REVIEW_PROMPT;
-}
-function sha256(text) {
-	return createHash("sha256").update(text).digest("hex");
+function evolutionRoot(env = process.env) {
+	const home = env.DSH_HOME?.trim();
+	const selected = home ? home : join(homedir(), ".dsh");
+	const expanded = selected === "~" ? homedir() : selected.startsWith("~/") || selected.startsWith("~\\") ? join(homedir(), selected.slice(2)) : selected;
+	return isAbsolute(expanded) ? expanded : resolve(expanded);
 }
-function createPromptBundle(prompts) {
-	const canonical = JSON.stringify({
-		id: PROMPT_BUNDLE_ID,
-		version: 17,
-		prompts: Object.fromEntries(Object.entries(prompts).sort())
-	});
-	return Object.freeze({
-		id: PROMPT_BUNDLE_ID,
-		version: 17,
-		prompts: Object.freeze({ ...prompts }),
-		sha256: sha256(canonical)
-	});
+/** Evolution home path helper: `$DSH_HOME/evolution` for plugin-owned sidecar
+* state (reports, activity store, feedback file, state-domain data). */
+function evolutionHome(env = process.env) {
+	return join(evolutionRoot(env), "evolution");
 }
-const PROMPT_BUNDLE = createPromptBundle({
-	memory: MEMORY_REVIEW_PROMPT,
-	skill: SKILL_REVIEW_PROMPT,
-	combined: COMBINED_REVIEW_PROMPT,
-	skillPlan: SKILL_REVIEW_PLAN_PROMPT,
-	combinedPlan: COMBINED_REVIEW_PLAN_PROMPT,
-	curator: CURATOR_PROMPT,
-	completion: COMPLETION_SKILL_REVIEW_PROMPT,
-	maintain: MAINTAIN_PROMPT,
-	maintainOutput: MAINTAIN_OUTPUT_INSTRUCTION,
-	skillsGuidance: SKILLS_GUIDANCE
-});
-function verifyPromptBundle(bundle = PROMPT_BUNDLE) {
-	if (bundle.id !== PROMPT_BUNDLE_ID || bundle.version !== 17) return false;
-	const canonical = JSON.stringify({
-		id: PROMPT_BUNDLE_ID,
-		version: 17,
-		prompts: Object.fromEntries(Object.entries(bundle.prompts).sort())
-	});
-	return bundle.sha256 === sha256(canonical);
+//#endregion
+//#region lib/types/serial.js
+/**
+* A process-local serial task queue: each task starts only after the previous
+* one settles (success or failure), so read-modify-write sequences that share
+* one file never interleave inside this process. The durable cross-process
+* serialization layer is the IO backend's transact lock; this chain is the
+* second layer (0.3.17 S2.8, T-1: the shape was duplicated in state-json and
+* memory-files — one factory now).
+*/
+function makeSerialQueue() {
+	let chain = Promise.resolve();
+	return (task) => {
+		const run = chain.then(task, task);
+		chain = run.then(() => void 0, () => void 0);
+		return run;
+	};
 }
-const DSH_AUTHORING_STANDARDS = `Follow the Hermes skill-authoring standards, translated to DSH tools.
-
-Frontmatter:
-- name: lowercase-hyphenated, <=64 chars, no spaces.
-- description: ONE sentence, <=60 characters, ends with a period. State the capability, not the implementation. No marketing words. Do NOT repeat the skill name. Count the characters before saving. If the description contains a colon, wrap the whole value in double quotes.
-- version: 0.1.0
-- author: always the literal value "Hermes". NEVER fill it from the environment, git config, or any identity you can probe — an environment-derived name is a privacy leak the user never opted into (skills get shared and published), and the skill names itself as Hermes.
-- platforms: declare [macos], [linux], and/or [windows] only when the skill is genuinely OS-bound (osascript/apt/systemctl => the matching OS; /proc, signal.SIGKILL => linux; fcntl/termios => POSIX). Prefer fixing it cross-platform first (tempdir, pathlib, pure-Node); omit the field for portable skills.
-- metadata.hermes.tags: a few Capitalized, Relevant, Tags.
-- metadata.hermes.related_skills: [a, b] — name sibling skills this one builds on or is referenced by (optional; feeds the quality references factor).
-
-Body section order (omit only when empty):
-1. "# <Human Title>" then a 2-3 sentence intro: what it does, what it does NOT do, key dependency stance.
-2. "## When to Use" — concrete trigger phrases.
-3. "## Prerequisites" — exact env vars, install steps, credentials.
-4. "## How to Run" — canonical invocation framed through DSH tools.
-5. "## Quick Reference" — flat command/endpoint list.
-6. "## Procedure" — numbered steps with copy-paste-exact commands.
-7. "## Pitfalls" — known limits and rate limits.
-8. "## Verification" — one check proving the skill worked.
-
-DSH-tool framing:
-- Reference DSH tools by name in backticks: \`bash\`, \`str_replace_editor\`, \`write\`, \`skill\`, \`skill_manage\`, \`memory\`.
-- Do not name wrapped shell utilities when a DSH tool already covers them.
-- Larger scripts belong under \`scripts/\` (written with \`skill_manage write_file\`) and are referenced from SKILL.md by relative path.
-
-Quality bar:
-- Prefer verbatim flags, paths, and APIs from the source. Never invent them.
-- Keep it tight: ~100 lines simple, ~200 complex.
-- No router/index/hub skills that only point at other skills.
-- References go in \`references/\`, templates in \`templates/\`.
-
-Learn workflow (when the user asks you to learn a reusable skill, or you decide to turn a source/request into one):
-1. Gather every source named (files, URLs, "what we just did", pasted notes) with the tools you already have — and treat prose after a source as authoring requirements, not noise.
-2. Apply every requirement and constraint from the request to the SKILL.md you author.
-3. Author exactly ONE SKILL.md and save it with \`skill_manage\` (action=create); non-trivial scripts go under \`scripts/\`.
-4. When done, tell the user the skill name, its category, and a one-line summary of what it captured.`;
 //#endregion
-//#region lib/types/learn-prompt.js
+//#region lib/types/numeric.js
 /**
-* Open-ended `/evolution learn` prompt builder.
-*
-* `learn` is open-ended: the user can name anything they can describe — a
-* directory of code, an API doc URL, a workflow they just walked the agent
-* through, or pasted notes. The prompt instructs the live agent to gather the
-* named sources with its existing tools, then author a single SKILL.md via
-* `skill_manage` following `DSH_AUTHORING_STANDARDS`. There is no separate
-* distillation engine and no model-tool footprint.
-*/
-/**
-* Build the agent prompt for an open-ended `/evolution learn` request.
-*
-* @param userRequest free-text the user gave after `/evolution learn`; an
-*   empty string falls back to "the workflow we just went through".
-* @returns a complete instruction the agent runs as a normal turn.
-*/
-function buildLearnPrompt(userRequest) {
-	return [
-		"[/learn] The user wants you to learn a reusable skill from the request below, and save it.",
-		"",
-		"THE REQUEST:",
-		userRequest.trim() || "the workflow we just went through in this conversation — review the steps taken and distill them into a reusable skill",
-		"",
-		"The request is open-ended and may mix two kinds of content, in any order: SOURCES to gather (directories, file paths, URLs, \"what we just did\", pasted notes) AND REQUIREMENTS that shape the skill (what to focus on, what to leave out, scope, naming, the angle to take). Treat EVERY part of the request as load-bearing. In particular, prose that comes after a path or link is NOT incidental — it is the user telling you what they want from that source. A request like `<url> focus on the auth flow, skip the deprecated endpoints` means: gather the URL AND honor \"focus on auth, skip deprecated\" as authoring requirements. Never fetch the first source and ignore the rest.",
-		"",
-		"Do this:",
-		"1. Gather every source the user named, using the tools you already have — reads and searches for local files or directories, web access for URLs, this conversation history if they referred to something you just did, and the text they pasted as-is. If the request is ambiguous about scope, make a reasonable choice and note it; do not stall.",
-		"2. Author ONE SKILL.md, applying every requirement, focus, and constraint in the request — these govern what the SKILL.md covers and emphasizes, not just which sources you read.",
-		"3. Save it with the `skill_manage` tool (action=\"create\"). Pick a sensible category. If the procedure needs a non-trivial script, add it under the skill's `scripts/` with `skill_manage` write_file and reference it by relative path.",
-		"",
-		DSH_AUTHORING_STANDARDS,
-		"",
-		"When done, tell the user the skill name, its category, and a one-line summary of what it captured."
-	].join("\n");
-}
-//#endregion
-//#region lib/types/state-store.js
-/**
-* Evolution home path helpers: the DSH root and `$DSH_HOME/evolution` for
-* plugin-owned sidecar state (reports, activity store, feedback file,
-* state-domain data).
-*
-* C-10: PATH HELPERS ONLY — despite the file name there is no store
-* here. Durable evolution state lives in the state stack (evolution-state over
-* evolution-state-json / -domain); skills and memories live in skill-store.ts
-* / memory-store.ts. The file name is kept deliberately: renaming it would
-* touch every family import for zero behavior change, and the audit records
-* the mismatch as known naming debt.
-*/
-/**
-* DSH home root: `$DSH_HOME` or `~/.dsh`. Single source of the empty-string
-* fallback — an EMPTY or WHITESPACE-ONLY DSH_HOME resolves to the default
-* home, never to a CWD-relative path (0.3.19 W1.3, 0.3.22 F-207);
-* V8-06 (0.3.47) extends the guard to whitespace (upstream home-paths:
-* `trim().length > 0` is the adoption test — `DSH_HOME=" "` must not produce
-* a sidecar under a relative "." path).
-* C-11: the adoption test and the RETURNED value now come from the
-* SAME trimmed source — the old form tested `trim()` but returned the raw
-* value, so `DSH_HOME=" /x "` was accepted AND persisted with literal spaces.
-* OPT-27 (2026-09, plan D5 — accepted): the v10-era "no `~` expansion, no
-* resolve" divergence from upstream `resolveDshHome` is RETIRED. It became
-* load-bearing when the skill-catalog shadow made "same tree as the upstream
-* `USER_DSH_RANK` provider" a hard contract: upstream watches the EXPANDED
-* absolute `<home>/skills` while this value fed a literal `~/x` (a directory
-* named `~` under the host CWD) or a CWD-relative path — split-brain skill
-* trees, preset installs the platform never reads, doctor probes of a
-* directory nothing serves. Behavior now matches upstream:
-* `resolve(expandHomePath(selected))`. Only `~`-prefixed and RELATIVE
-* DSH_HOME values change landing spot; absolute homes are byte-identical.
-*/
-function evolutionRoot(env = process.env) {
-	const home = env.DSH_HOME?.trim();
-	const selected = home ? home : join(homedir(), ".dsh");
-	const expanded = selected === "~" ? homedir() : selected.startsWith("~/") || selected.startsWith("~\\") ? join(homedir(), selected.slice(2)) : selected;
-	return isAbsolute(expanded) ? expanded : resolve(expanded);
-}
-/** Evolution home path helper: `$DSH_HOME/evolution` for plugin-owned sidecar
-* state (reports, activity store, feedback file, state-domain data). */
-function evolutionHome(env = process.env) {
-	return join(evolutionRoot(env), "evolution");
-}
-//#endregion
-//#region lib/types/serial.js
-/**
-* A process-local serial task queue: each task starts only after the previous
-* one settles (success or failure), so read-modify-write sequences that share
-* one file never interleave inside this process. The durable cross-process
-* serialization layer is the IO backend's transact lock; this chain is the
-* second layer (0.3.17 S2.8, T-1: the shape was duplicated in state-json and
-* memory-files — one factory now).
-*/
-function makeSerialQueue() {
-	let chain = Promise.resolve();
-	return (task) => {
-		const run = chain.then(task, task);
-		chain = run.then(() => void 0, () => void 0);
-		return run;
-	};
-}
-//#endregion
-//#region lib/types/numeric.js
-/**
-* Numeric config clamping for the dsh-evolution plugin family.
+* Numeric config clamping for the dsh-evolution plugin family.
 *
 * G3.1 (0.3.23): numeric configuration values are normalised through a single
 * helper so 0 / negative / NaN / ±Infinity / out-of-range all fall back to the
@@ -2466,11 +2159,22 @@ const PATTERNS = [
 		regex: /(?:密钥|凭据|口令|密码|环境变量)[\s\S]{0,30}(?:发送|上传|传输|外传|泄露)[\s\S]{0,30}(?:到|至)\s*(?:https?:\/\/|[\w.-]+\.(?:com|net|org|io|cn|dev|xyz|ru)\b)/
 	}
 ];
-const INVISIBLE_CHAR_CLASS = "\\u034f\\u200b\\u2060\\u2061\\u2062\\u2063\\u2064\\u206a-\\u206f\\ufeff\\u{e0000}-\\u{e007f}";
-const ZERO_WIDTH_CHARS = new RegExp(`[${INVISIBLE_CHAR_CLASS}]`, "u");
+const ZERO_WIDTH_CHARS = new RegExp(`[\\u034f\\u200b\\u2060\\u2061\\u2062\\u2063\\u2064\\u206a-\\u206f\\ufeff\\u{e0000}-\\u{e007f}]`, "u");
 const ZWJ_OUTSIDE_EMOJI = /(?<!\p{Extended_Pictographic})\u200d(?!\p{Extended_Pictographic})/u;
 const TYPOGRAPHY_CHARS = /[\u00ad\u061c\u180e\u200c\ufe00-\ufe0f]/;
 const BIDI_CHARS = /[\u202a-\u202e\u2066-\u2069]/;
+const FORMAT_CONTROL_CLASS = "\\p{Cf}\\p{Zl}\\p{Zp}\\u0000\\u2065\\ufff0-\\ufff8\\u{e0080}-\\u{e00ff}";
+const FORMAT_CONTROL_TEST = new RegExp(`[${FORMAT_CONTROL_CLASS}]`, "u");
+/** S0.4 (v37 P0-3): a format control the three finding sets above do NOT report. */
+function hasUnreportedFormatControl(text) {
+	for (const character of text) {
+		if (!FORMAT_CONTROL_TEST.test(character)) continue;
+		if (ZERO_WIDTH_CHARS.test(character) || TYPOGRAPHY_CHARS.test(character) || BIDI_CHARS.test(character)) continue;
+		if (character === "\\u200d") continue;
+		return true;
+	}
+	return false;
+}
 const SCOPE_ORDER = {
 	all: 1,
 	context: 2,
@@ -2512,9 +2216,15 @@ function scanThreats(text, scope = "strict", maxScanChars = 65536, options = NO_
 		category: "unicode_obfuscation",
 		scope: "all"
 	});
+	if (!excluded.has("unicode_format_control") && hasUnreportedFormatControl(text)) findings.push({
+		label: "unicode_format_control",
+		category: "unicode_obfuscation",
+		scope: "all",
+		severity: "report"
+	});
 	const normalized = text.normalize("NFKC");
 	const SPACE_SPLITTERS = /[\u00ad\u061c\u180e\u200c\ufe00-\ufe0f]/gu;
-	const OBFUSCATION_SPLITTERS = new RegExp(`[${INVISIBLE_CHAR_CLASS}\\u200d]`, "gu");
+	const OBFUSCATION_SPLITTERS = new RegExp(`[${FORMAT_CONTROL_CLASS}]`, "gu");
 	const patternTexts = [normalized.replace(SPACE_SPLITTERS, " ").replace(OBFUSCATION_SPLITTERS, " "), normalized.replace(SPACE_SPLITTERS, "").replace(OBFUSCATION_SPLITTERS, "")];
 	const windows = [];
 	for (const patternText of patternTexts) if (patternText.length <= windowSize) windows.push(patternText);
@@ -2629,6 +2339,24 @@ function render(entries) {
 function stripDatePrefix(entry) {
 	return entry.replace(/^## \d{4}-\d{2}-\d{2}\n/, "");
 }
+/**
+* Neutralize the platform's `{{name}}` prompt-variable syntax in text that is
+* about to be registered as a `systemPrompt.context` contribution.
+*
+* The platform interpolates every context/section text once per model step and
+* THROWS on an unknown or malformed reference — so one stored memory entry
+* containing `{{...}}` (a CI expression, a Jinja/Helm/Vue template, a doc
+* placeholder) used to fail `assemble()` on EVERY later pre-step of every
+* session under this DSH_HOME, while a registered name such as `{{cwd}}` was
+* silently substituted into the "memory" the model reads. Only the INJECTED
+* text is neutralized: stored entries keep their original bytes.
+*
+* @param text - rendered context text about to leave for the prompt surface.
+* @returns the same text with every `{{` split so it cannot start a reference.
+*/
+function neutralizePromptVariables(text) {
+	return text.includes("{{") ? text.replaceAll("{{", "{ {") : text;
+}
 /** F-201: does `content` carry the on-disk entry delimiter or a trailing
 * `\n§` fragment that would combine with the render terminator into a real
 * delimiter boundary? Both split the fact into multiple entries on read-back
@@ -3196,7 +2924,7 @@ var MemoryStore = class {
 				parts.push(`## ${label} (${safe.length} entries)${usage}${note}\n${body}`);
 			} else if (entries.length > 0) parts.push(`## ${label} — ${entries.length} entries withheld by the security scan; none injected`);
 		}
-		return parts.join("\n\n");
+		return neutralizePromptVariables(parts.join("\n\n"));
 	}
 	/**
 	* Detect on-disk drift for a caller that holds no locked view: `true` when the
@@ -3312,56 +3040,452 @@ function composePresetComposition(standardComposition, deltaComposition) {
 	const collisions = [...compositionRowIds(deltaComposition)].filter((id) => standardIds.has(id)).sort();
 	if (collisions.length > 0 && !allowRowCollisions()) throw new Error(`evolution preset composition: delta rows collide with runtime standard rows: ${collisions.join(", ")}`);
 	if (collisions.length > 0) console.warn(`evolution preset composition: warning — delta rows collide with standard rows (${collisions.join(", ")}); keeping both (DSH_EVOLUTION_ALLOW_ROW_COLLISIONS=1)`);
-	return injectCatalogDescriptionCap(`${standardComposition.replace(/\s+$/, "")}\n\n${deltaComposition.trim()}\n`);
+	return applyRowOverrides(`${standardComposition.replace(/\s+$/, "")}\n\n${deltaComposition.trim()}\n`);
+}
+/** The composer-owned overrides, as DATA: one place states what the generated
+* preset must carry beyond the platform composition. V10-14's cap is the first
+* entry; install-layered.mjs keeps a byte-identical copy of this table. */
+const ROW_OVERRIDES = [{
+	row: "tool-skill",
+	key: "config",
+	lines: [
+		"  # V10-14: Hermes 60-char catalog cap — injected by the preset composer (P1-2);",
+		"  # this preset-scope row is the session-visible instance and no profile",
+		"  # patch can reach it. Remove only to run the platform default (500).",
+		"  config:",
+		"    catalogDescriptionMaxLength: 60"
+	],
+	missing: "evolution preset composition: warning — no `- id: tool-skill` row in the composed preset; the 60-char catalog cap was NOT injected (platform renamed the row? reconcile with the delta)"
+}];
+/**
+* Ensure every {@link RowOverride} inside its target row.
+*
+* Key-level by construction: we INSERT the override's own lines and leave a row
+* that already carries the key byte-identical, so a re-run never doubles a key.
+* This is the deliberate opposite of the platform's patch layers, where an
+* override REPLACES `config` wholesale — the difference is why the composer can
+* add a key without erasing the platform's own config defaults.
+*/
+function applyRowOverrides(composition, overrides = ROW_OVERRIDES) {
+	let lines = composition.split("\n");
+	for (const override of overrides) lines = applyOneOverride(lines, override);
+	return lines.join("\n");
+}
+function applyOneOverride(lines, override) {
+	const rowRe = new RegExp("^- id:\\s*" + override.row.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "\\s*$");
+	let found = false;
+	for (let i = 0; i < lines.length; i += 1) {
+		if (!rowRe.test(lines[i] ?? "")) continue;
+		found = true;
+		let end = i;
+		let hasConfig = false;
+		for (let j = i + 1; j < lines.length; j += 1) {
+			const next = lines[j] ?? "";
+			if (next.trim() === "") break;
+			if (!/^\s/.test(next)) break;
+			if (new RegExp("^ {2}" + override.key + ":(\\s|$)").test(next)) hasConfig = true;
+			end = j;
+		}
+		if (hasConfig) continue;
+		lines.splice(end + 1, 0, ...override.lines);
+		i = end + override.lines.length;
+	}
+	if (!found) console.warn(override.missing);
+	return lines;
+}
+function compositionRowIds(composition) {
+	const ids = /* @__PURE__ */ new Set();
+	for (const line of composition.split("\n")) {
+		const id = /^- id:\s*(\S+)/.exec(line)?.[1];
+		if (id) ids.add(id);
+	}
+	return ids;
+}
+//#endregion
+//#region lib/types/prompts.js
+/**
+* Review and curation prompts adapted from Hermes Agent
+* `agent/background_review.py`, `agent/curator.py`, and
+* `agent/learn_prompt.py`, with tool names translated to the DSH-native
+* catalog (`memory`, `skill_manage`, `skill`, `bash`, `str_replace_editor`).
+*
+* Alignment policy (2026-08-29): the OPERATIONAL steps and instructions the
+* model follows mirror the Hermes originals structurally (signal list,
+* preference order, support-file taxonomy, curator package integrity,
+* consolidated/pruned reporting block). Tool and platform differences are
+* DSH-adapted (native tool names, pinned-within-review semantics, this
+* platform's index cap), and DSH-only additions are marked as such.
+*
+* Every prompt is pinned in a versioned bundle. Review workers verify the
+* bundle digest before spending a model call — v31 PROMPT-01, stated
+* precisely: THAT check proves internal coherence (id/version/digest agree)
+* for a bundle assembled OUT of process and handed to `verifyPromptBundle`
+* explicitly. It CANNOT detect in-process tampering (the digest is recomputed
+* from the same module state it verifies) — catching a stale or partially
+* patched default bundle is CI's version pin (tests/prompts.spec.ts), not
+* this runtime gate.
+*/
+/**
+* Prompt bundle identity. Bump both id and version whenever a prompt's text
+* changes semantically: the bundle digest is the fail-closed signal for
+* review workers, so a stale id across deployments must be distinguishable.
+*/
+const PROMPT_BUNDLE_VERSION = 17;
+const PROMPT_BUNDLE_ID = `dsh-evolution@17`;
+const MEMORY_REVIEW_PROMPT = `[Auto-review — Memory]
+Review the conversation above and consider saving to memory if appropriate.
+
+Focus on:
+1. Has the user revealed things about themselves — persona, desires, preferences, or personal details worth remembering?
+2. Has the user expressed expectations about how you should behave, their work style, or ways they want you to operate?
+
+If something stands out, save it using the memory tool.
+If nothing is worth saving, just say "Nothing to save." and stop.`;
+const SKILL_REVIEW_PROMPT = `[Auto-review — Skills]
+Review the conversation above and update the skill library. Be ACTIVE — most sessions produce at least one skill update, even if small. A pass that does nothing is a missed learning opportunity, not a neutral outcome.
+
+Target shape of the library: CLASS-LEVEL skills, each with a rich SKILL.md and a references/ directory for session-specific detail. Not a long flat list of narrow one-session-one-skill entries. This shapes HOW you update, not WHETHER you update.
+
+Signals to look for (any one of these warrants action):
+  • User corrected your style, tone, format, legibility, or verbosity. Frustration signals like 'stop doing X', 'this is too verbose', 'don't format like this', 'why are you explaining', 'just give me the answer', 'you always do Y and I hate it', or an explicit 'remember this' are FIRST-CLASS skill signals, not just memory signals. Update the relevant skill(s) to embed the preference so the next session starts already knowing.
+  • User corrected your workflow, approach, or sequence of steps. Encode the correction as a pitfall or explicit step in the skill that governs that class of task.
+  • Non-trivial technique, fix, workaround, debugging path, or tool-usage pattern emerged that a future session would benefit from. Capture it.
+  • A skill that got loaded or consulted this session turned out to be wrong, missing a step, or outdated. Patch it NOW.
+
+Read-before-write: update, patch, delete, or write support files ONLY into skills you loaded or read in THIS session. On the plan channel ops on unread skills are rejected; direct writes have no such guard, so treat the rule as binding. CREATE of a brand-new umbrella is the only exception.
+
+Preference order — prefer the earliest action that fits, but do pick one when a signal above fired:
+  1. UPDATE A CURRENTLY-LOADED SKILL. Look back through the conversation for skills the user loaded or you read. If any of them covers the territory of the new learning, PATCH that one first. It is the skill that was in play, so it's the right one to extend.
+  2. UPDATE AN EXISTING UMBRELLA. If no loaded skill fits but an existing class-level skill does, patch it. Add a subsection, a pitfall, or broaden a trigger.
+  3. ADD A SUPPORT FILE under an existing umbrella. Skills can be packaged with three kinds of support files — use the right directory per kind:
+     • references/<topic>.md — session-specific detail (error transcripts, reproduction recipes, provider quirks) AND condensed knowledge banks: quoted research, API docs, external authoritative excerpts, or domain notes you found while working on the problem. Write it concise and for the value of the task, not as a full mirror of upstream docs.
+     • templates/<name>.<ext> — starter files meant to be copied and modified (boilerplate configs, scaffolding, a known-good example the agent can reproduce with modifications).
+     • scripts/<name>.<ext> — statically re-runnable actions the skill can invoke directly (verification scripts, fixture generators, deterministic probes, anything the agent should run rather than hand-type each time).
+     Add support files via skill_manage action=write_file with file_path starting 'references/', 'templates/', or 'scripts/'. The umbrella's SKILL.md should gain a one-line pointer to any new support file so future agents know it exists.
+  4. RESTRUCTURE a loaded skill whose body grew log-like — rc/sha/date-dense sections, session-detail spirals, or a fat body with no support files. Use skill_manage action=restructure with restructure: [{"heading": "<the exact ## heading text>", "to_file": "references/<topic>.md"}] — the ENTIRE ## section (from that heading to the next heading) moves into the support file and its position becomes a pointer line. The skill's name and directory never change. Only propose headings that exist verbatim in the body; never invent one, and never restructure a healthy small skill.
+  5. CREATE A NEW CLASS-LEVEL UMBRELLA SKILL when no existing skill covers the class. The name MUST be at the class level. The name MUST NOT be a specific PR number, error string, feature codename, library-alone name, or 'fix-X / debug-Y / audit-Z-today' session artifact. If the proposed name only makes sense for today's task, it's wrong — fall back to (1), (2), or (3).
+
+User-preference embedding (important): when the user expressed a style/format/workflow preference, the update belongs in the SKILL.md body, not just in memory. Memory captures 'who the user is and what the current situation and state of your operations are'; skills capture 'how to do this class of task for this user'. When they complain about how you handled a task, the skill that governs that task needs to carry the lesson.
+
+If you notice two existing skills that overlap, note it in your reply — the background curator handles consolidation at scale.
+
+Two-tier deposition discipline (DSH addition, same spirit as the umbrella rule): before writing, classify the knowledge:
+  • PATTERN (reusable — symptom → mechanism → fix → verification, still valuable next session) belongs in the SKILL.md body.
+  • LOG (one-off — commit SHAs, npm/profile states, what this release changed, this session's process narrative) belongs in a references/ file, never the body. Body density IS reuse rate. Keep new entries tight: a pattern fits in 2-8 physical lines; prefer changing the current-state pointer over appending history.
+
+Protected skills (DO NOT edit these):
+  • Bundled skills (shipped with the platform).
+  • Hub-installed skills (installed from a hub).
+Pinned skills are read-only to THIS background review pass — the pinned write guard refuses background changes, so this pass may not update them. They also cannot be archived by any writer (the foreground included): remove the .pinned marker first. Foreground and delegated-subagent update/patch writes to pinned skills remain allowed.
+If the only skills that need updating are protected, say 'Nothing to save.' and stop.
+
+Do NOT capture (these become persistent self-imposed constraints that bite you later when the environment changes):
+  • Environment-dependent failures: missing binaries, fresh-install errors, post-migration path mismatches, 'command not found', unconfigured credentials, uninstalled packages. The user can fix these — they are not durable rules.
+  • Negative claims about tools or features ('browser tools do not work', 'X tool is broken', 'cannot use Y'). These harden into refusals the agent cites against itself for months after the actual problem was fixed.
+  • Session-specific transient errors that resolved before the conversation ended. If retrying worked, the lesson is the retry pattern, not the original failure.
+  • One-off task narratives. A user asking 'summarize today's market' or 'analyze this PR' is not a class of work that warrants a skill.
+
+If a tool failed because of setup state, capture the FIX (install command, config step, env var to set) under an existing setup or troubleshooting skill — never 'this tool does not work' as a standalone constraint.
+
+'Nothing to save.' is a real option but should NOT be the default. If the session ran smoothly with no corrections and produced no new technique, just say 'Nothing to save.' and stop. Otherwise, act.`;
+const COMBINED_REVIEW_PROMPT = `[Auto-review]
+Review the conversation above and update two things:
+
+**Memory**: who the user is. Did the user reveal persona, desires, preferences, personal details, or expectations about how you should behave? Save facts about the user and durable preferences with the memory tool.
+
+**Skills**: how to do this class of task. Be ACTIVE — most sessions produce at least one skill update. A pass that does nothing is a missed learning opportunity, not a neutral outcome.
+
+Target shape of the skill library: CLASS-LEVEL skills with a rich SKILL.md and a references/ directory for session-specific detail. Not a long flat list of narrow one-session-one-skill entries.
+
+Signals that warrant a skill update (any one is enough):
+  • User corrected your style, tone, format, legibility, verbosity, or approach. Frustration is a FIRST-CLASS skill signal, not just a memory signal. 'stop doing X', 'don't format like this', 'I hate when you Y' — embed the lesson in the skill that governs that task so the next session starts fixed.
+  • Non-trivial technique, fix, workaround, or debugging path emerged.
+  • A skill that was loaded or consulted turned out wrong, missing, or outdated — patch it now.
+
+Read-before-write: update, patch, delete, or write support files ONLY into skills you loaded or read in THIS session. On the plan channel ops on unread skills are rejected; direct writes have no such guard, so treat the rule as binding. CREATE of a brand-new umbrella is the only exception.
+
+Preference order for skills — pick the earliest that fits:
+  1. UPDATE A CURRENTLY-LOADED SKILL. Check what skills were loaded or read in the conversation. If one of them covers the learning, PATCH it first. It was in play; it's the right place.
+  2. UPDATE AN EXISTING UMBRELLA. Patch it.
+  3. ADD A SUPPORT FILE under an existing umbrella via skill_manage action=write_file. Three kinds: references/<topic>.md for session-specific detail OR condensed knowledge banks (quoted research, API docs excerpts, domain notes) written concise and task-focused; templates/<name>.<ext> for starter files meant to be copied and modified; scripts/<name>.<ext> for statically re-runnable actions (verification, fixture generators, probes). Add a one-line pointer in SKILL.md so future agents find them.
+  4. RESTRUCTURE a loaded skill whose body grew log-like (rc/sha/date-dense sections, session-detail spirals, fat body with no support files) via skill_manage action=restructure with restructure: [{"heading": "<the exact ## heading text>", "to_file": "references/<topic>.md"}] — the ENTIRE ## section moves into the support file and its position becomes a pointer line; the skill's name and directory never change. Only propose headings that exist verbatim in the body.
+  5. CREATE A NEW CLASS-LEVEL UMBRELLA when nothing exists. Name at the class level — NOT a PR number, error string, codename, library-alone name, or 'fix-X / debug-Y' session artifact. If the name only fits today's task, fall back to (1), (2), or (3).
+
+Two-tier deposition discipline (DSH addition): classify before writing — PATTERN (symptom → mechanism → fix → verification) goes in the SKILL.md body; LOG (commit SHAs, npm/profile states, this release's change list, this session's narrative) goes in a references/ file. Body density IS reuse rate; a pattern fits in 2-8 physical lines.
+
+User-preference embedding: when the user complains about how you handled a task, update the skill that governs that task — memory alone isn't enough. Memory says 'who the user is and what the current situation and state of your operations are'; skills say 'how to do this class of task for this user'. Both should carry user-preference lessons when relevant.
+
+If you notice overlapping existing skills, mention it — the background curator handles consolidation.
+
+Protected skills (DO NOT edit these):
+  • Bundled skills (shipped with the platform).
+  • Hub-installed skills (installed from a hub).
+Pinned skills are read-only to THIS background review pass — the pinned write guard refuses background changes, so this pass may not update them. They also cannot be archived by any writer (the foreground included): remove the .pinned marker first. Foreground and delegated-subagent update/patch writes to pinned skills remain allowed.
+If the only skills that need updating are protected, say 'Nothing to save.' and stop.
+
+Do NOT capture as skills (these become persistent self-imposed constraints that bite you later when the environment changes):
+  • Environment-dependent failures: missing binaries, fresh-install errors, post-migration path mismatches, 'command not found', unconfigured credentials, uninstalled packages. The user can fix these — they are not durable rules.
+  • Negative claims about tools or features ('browser tools do not work', 'X tool is broken', 'cannot use Y'). These harden into refusals the agent cites against itself for months after the actual problem was fixed.
+  • Session-specific transient errors that resolved before the conversation ended. If retrying worked, the lesson is the retry pattern, not the original failure.
+  • One-off task narratives. A user asking 'summarize today's market' or 'analyze this PR' is not a class of work that warrants a skill.
+
+If a tool failed because of setup state, capture the FIX (install command, config step, env var to set) under an existing setup or troubleshooting skill — never 'this tool does not work' as a standalone constraint.
+
+Act on whichever of the two dimensions has real signal. If genuinely nothing stands out on either, say 'Nothing to save.' and stop — but don't reach for that conclusion as a default.`;
+const CURATOR_PROMPT = `You are the skill curator. Maintain a healthy, class-level skill library, not a flat pile of narrow one-session skills.
+
+This is an UMBRELLA-BUILDING consolidation pass, not a passive audit and not a duplicate-finder.
+
+The goal is a LIBRARY OF CLASS-LEVEL INSTRUCTIONS. A skill collection of many narrow skills where each captures one session's specific bug is a FAILURE of the library. An agent searching skills matches on descriptions, not exact names; one broad umbrella with labeled subsections beats five narrow siblings for discoverability.
+
+Right target shape: class-level skills with rich SKILL.md + references/, templates/, scripts/ support files for session-specific detail.
+
+Hard rules:
+1. NEVER hard-delete a skill. Archive (moving to .archive/) is the maximum destructive action; archives are recoverable, deletion is not.
+2. Do not touch bundled, hub-installed, pinned, or scheduled-task-referenced (referenced) skills. Referenced skills are fully protected — never consolidated, never pruned (there is no scheduled-task reference-rewriting pass; a referenced skill stays in place by design).
+3. Do not archive recently-created or never-used skills without strong evidence. "use=0" is NOT evidence either way — it only means the trigger has not come up yet. Never archive a never-used skill unless it is at least 30 days old AND its content is genuinely obsolete or fully absorbed elsewhere.
+4. Do NOT reject consolidation on the grounds that "each skill has a distinct trigger". The right bar is: would a human maintainer write this as N separate skills, or one skill with N labeled subsections? When the answer is the latter, merge.
+5. Judge overlap on CONTENT, not on usage counters.
+6. Before archiving a merged skill, ensure its unique content was preserved in the umbrella.
+
+How to work:
+1. Scan the candidate list. Identify PREFIX CLUSTERS — skills sharing a first word or domain keyword. Expected cluster count scales with the library: a large collection may show 10-25 prefix clusters, a small one often has none — a clean "nothing to consolidate" summary is the correct small-library outcome, not a shortage of ambition.
+2. For each cluster with 2+ members, ask "what is the UMBRELLA CLASS these skills serve?" and consolidate:
+   a. MERGE INTO AN EXISTING UMBRELLA (patch a labeled section for each sibling's unique insight, then archive the siblings).
+   b. CREATE A NEW UMBRELLA SKILL.md covering the shared workflow with short labeled subsections, then archive the absorbed siblings.
+   c. DEMOTE session-specific detail to references/, templates/, or scripts/ under the umbrella. Use the right directory per kind:
+      • references/<topic>.md — session-specific detail OR condensed knowledge banks (quoted research, API docs excerpts, domain notes, provider quirks, reproduction recipes) written concise and task-focused.
+      • templates/<name>.<ext> — starter files meant to be copied and modified.
+      • scripts/<name>.<ext> — statically re-runnable actions (verification scripts, fixture generators, probes).
+3. Package integrity — not optional: inspect each skill as a COMPLETE directory package, not just SKILL.md. A skill root may include references/, templates/, scripts/, and assets/. If the source skill has support files OR its SKILL.md contains relative links to them, DO NOT flatten only SKILL.md into <umbrella>/references/<old>.md. Choose one safe path instead: keep it as a standalone skill, OR fully merge by re-homing every needed support file into the umbrella's canonical directories AND rewriting the destination instructions to the new paths, OR archive the entire original skill package unchanged. Never leave demoted instructions pointing at files left behind under the old skill directory.
+4. Flag skills whose NAME is too narrow (contains a PR number, a feature codename, a specific error string, an 'audit'/'diagnosis'/'salvage' session artifact) — they almost always belong as a subsection or support file under a class-level umbrella.
+5. Iterate. After one consolidation round, scan the remaining set and look for the NEXT umbrella opportunity. Don't stop after 3 merges.
+
+You are a NOMINATOR, not an executor: this channel has NO tools. Your single deliverable is the structured YAML block below. Never narrate actions you did not take ("merged", "patched", "archived") — you are proposing, and the deterministic engine executes only names from the candidate pool it gave you. (A future execution view would expose skill_manage; today it does not.)
+
+'keep' is a legitimate decision ONLY when the skill is already a class-level umbrella and none of the proposed merges would improve discoverability. 'This is narrow but distinct from its siblings' is NOT a reason to keep — it's a reason to move it under an umbrella as a subsection or support file.
+
+Expected output: real umbrella-ification. Process every obvious cluster. If you end the pass with obvious clusters still untouched, you stopped too early — go back and look at the clusters you left alone.
+
+Keep the umbrella body tight and scannable: exact commands, verbatim paths, ~100-200 lines; never invent flags or APIs.
+
+When done, write a human summary THEN the structured machine-readable block. The block is the contract: every skill you would move to .archive/ MUST appear in exactly one of the two lists. Return ONLY the YAML block after the summary — no post-block prose. Format EXACTLY:
+
+## Structured summary (required)
+\`\`\`yaml
+consolidations:
+  - from: <old-skill-name>
+    mode: reference  # optional — ONLY for a 'demote': source is narrow-but-valuable session detail, write it as references/<source>.md under the umbrella instead of appending to the body. Default is append. Place this line BEFORE into:. NEVER use reference when the source body links its own references/ templates/ scripts/ files.
+    into: <umbrella-skill-name>
+    reason: <one short sentence — why merged, not just 'similar'>
+prunings:
+  - name: <skill-name>
+    reason: <one short sentence — why archived with no merge target>
+\`\`\`
+
+Every skill you would move to .archive/ MUST appear in exactly one of the two lists. If you consolidated X into umbrella Y (patched Y, wrote a references file to Y, or created Y with X's content absorbed), X goes under consolidations with into: Y. If you archived X with no absorption — truly stale, irrelevant, or obsolete — X goes under prunings. Leave a list empty (consolidations: []) if none. Do not omit the block. The block comes AFTER your human-readable summary of clusters processed, patches made, and decisions left alone.`;
+const CURATOR_DRY_RUN_BANNER = `═══════════════════════════════════════════════════════════════
+DRY-RUN — REPORT ONLY. DO NOT MUTATE THE SKILL LIBRARY.
+═══════════════════════════════════════════════════════════════
+
+This is a PREVIEW pass. Follow every instruction above EXCEPT:
+  • Do NOT call skill_manage with action=create, update, patch, delete, write_file, or remove_file.
+  • Do NOT move, copy, or rewrite any file under the skills tree.
+
+Your output IS the deliverable: produce the exact same human-readable summary and YAML block you would on a live run, describing the actions you WOULD take. A reviewer will decide whether to approve a live run.
+
+If you accidentally take a mutating action, say so explicitly in the summary.`;
+const COMPLETION_SKILL_REVIEW_PROMPT = `[Auto-review — Skills · task complete]
+Your current task now appears complete. Before wrapping up, review the approach and update the skill library via skill_manage.
+
+Follow the skills review policy: be ACTIVE, prefer class-level umbrellas, patch ONLY skills loaded or read this session, and capture non-trivial techniques and user corrections. Do NOT capture environment-dependent failures, negative claims about tools, or one-off task narratives.
+
+Do NOT modify output files or re-run the task. If you are still mid-task, ignore this.`;
+/**
+* Maintenance-subagent persona (design 011 §6). Constants pin the persona
+* with `{signal:id}` placeholders; the renderer substitutes names from the
+* drift-signals module (single vocabulary). The model-facing contract is the
+* persona + the mechanical-facts block; the signature head lets the model
+* compare the two heads (011 mismatch protocol).
+*/
+const MAINTAIN_PROMPT = `<<<MAINTAIN_PROMPT v={bundle_version} sig={joint_signature}>>>
+
+## 角色
+你是技能库的**外部审计者**：只读、只输出计划、从不执行（执行由用户命令与审批完成）。
+
+## 1. 输入契约（冲突时以此为准）
+机械事实块 <<<MECHANICAL_FACTS v={signals_version} sig={joint_signature}>>>（下方，以 <<<END FACTS>>> 闭合）是唯一证据来源。
+- verdict 仅三值：pass=未越阈 / over=越阈 / unknown=未检测。
+- over 是事实位置，不是违规结论；没有条款对应的事实，不产生建议。
+- unknown ≠ pass；引用 unknown 信号的条目必须 needs_human:true。
+- 事实只读：不改写、不补写、不把事实"翻译"成裁决。
+- 两处 sig 不一致或任一缺失 → 只输出 MISMATCH + 两侧版本号，禁止输出计划。
+
+## 2. 信号→条款映射（每条 over 必须落到条款；无一遗漏）
+{signal:dedup_group}→A1 · {signal:narrow_name}→A2 · {signal:prefix_cluster}→A3 · {signal:stamp_density}与{signal:body_size}→B1 · {signal:pointer_missing}→B2 · {signal:dup_heading}→B3 · {signal:overlong_line}→B4 · {signal:description_chars}→B5 · {signal:usage_observed}/{signal:quality_low}→门控（校验器对 quality_low=unknown 的技能强制 needs_human，模板侧不重复）
+
+## 3. 完整性契约（校验器机械执行）
+事实块中每条 over 信号必须满足其一：成为某条建议的 evidence，或在 notes 中说明"已审·无条款对应·不动作"。禁止静默省略；先逐信号核对再输出。
+
+## 4. 工作流程（按序执行，不得跳步）
+① 通读事实块 → ② 对每个候选技能用 skill 读正文（B1/B2/B4 必读；**读取失败必须报告工具返回的事实**（错误信息/无对应条目），禁止用"无法读取"含糊绕过）→ ③ maintenance_probe 按需深挖 → ④ 逐信号过 §3 完整性 → ⑤ 输出计划。
+
+## 5. 检查清单（信号 → 语义判定 → 输出形态）
+A. 域·碎片化
+- A1 {signal:dedup_group}=over：判近重复组是否同伞可合并；是→relationship-level consolidate；否→不输出。
+- A2 {signal:narrow_name}=over：判否"仅对今日任务成立"；成立→改名/归档建议；内部代号（格式合规语义窄）→conf≤0.4+needs_human。
+- A3 {signal:prefix_cluster}=over：判簇内是否同伞；非同伞→notes 提域划分观察，不强制建伞。
+
+B. 层·分层错位
+- B1 {signal:stamp_density}（阈值 {signal:stamp_density.threshold}）或 {signal:body_size}（阈值 {signal:body_size.threshold}）=over：按**三问判据**判锚/残留——① 该编号/时间戳是否被库内其他文件引用？② 除"何时产生/为何存在"外是否还承载信息？③ 删除是否影响任何跨文档检索？（①是且③是→锚；否则→残留候选，人审）。锚→允许保留 + needs_human + semantic_reasoning 写三问结果；**锚不使用 is_override**（is_override 仅用于 §7 申诉；锚是 B1 的正常裁决路径）；残留→restructure 建议（movable headings 逐字引用）。**锚≠可读：单行 >4000 字符即使在锚类也必须拆分。**
+- B2 {signal:pointer_missing}=over：读支持文件后判性质——可复用模式→上移正文；会话专属实录→保留+补指针；形态=patch 指引。**未读内容仅凭文件名 → conf≤0.4 且措辞"先人工确认再执行"。** **缺失指针=支持文件存在、正文无引用（单向语义），finding 表述勿反向。**
+- B3 {signal:dup_heading}=over：删除多余标题行（保留一份），patch 指引。
+- B4 {signal:overlong_line}=over：>1500 拆行；>4000 判定可读性危机（内容合法也拆）；patch 指引。**finding 必须给全量口径：共 N 行超限，其中 >4000 的逐行列出。**
+- B5 {signal:description_chars}=over：先判**性质**三分类——事件性承诺（单次故障/incident 写入元数据）→裁剪建议；叙事性自我描述→压缩建议；丰富但合规（完整用例边界）→保留 + is_override + override_reason="合法密度"。**分类特征**：含"恢复/修复某次事故、日期快照"类一次性措辞→事件性承诺；"动词+对象"式任务说明→叙事性；枚举完整用例边界且不可拆分→丰富合规。**第三类门槛（默认从严，半机械）**：先自行试写一个 ≤60 字压缩方案——能保留全部路由关键项（触发词+域）→ 不可判第三类（按压缩建议）；只有试写失败（在 semantic_reasoning 列出试写方案与具体失败点）才可判丰富合规。描述文本可见（probe desc-text 或正文 frontmatter）时仍须三分类；仅长度可见 → conf≤0.4。semantic_reasoning 必写三分类之一。
+
+D. 库·整合纪律（计划形态约束）
+- D1 同类问题多处出现→合成一条 relationship-level 建议，不逐项输出。
+- D2 结构类优先级高于内容类；影响面 library-level > relationship-level > skill-level。
+
+## 6. 输出契约（校验器机械执行）
+{verdict: "issues" | "no_issues",
+ plan: [{ kind: "skill-level"|"relationship-level"|"library-level", names: [str],
+   rule: "A1"|"B2"|..., evidence: [{signal, value}],
+   finding: "<一句事实描述：引用信号 id 与值；零裁决动词>",
+   recommendation: "<唯一允许的'应'句：建议动作+理由+执行形态（命令/patch 指引）>",
+   semantic_reasoning: "<语义判据；含 LLM 推断时 confidence≤0.4>",
+   impact: "better|worse|neutral", impact_reason: "<相对'不动'的净影响>",
+   reversibility: "archive|restructure|patch|rename|none", undo_path: "<一步撤销方式>",
+   confidence: float, needs_human: bool, is_override: bool,
+   override_reason: "<仅 is_override>" }],
+ notes: [str]}
+- verdict=no_issues ⇒ plan=[]（不允许空 plan 之外的"无问题"表述）。
+- **confidence 降档规则（机械）**：条款全部由机械证据支撑 → 0.6–0.9；每含一项语义推断（是否锚/是否同伞/性质归类）→ 上限 0.4。
+- needs_human = (confidence < 0.6) OR (不可逆) OR (is_override) OR (引用 unknown 信号)。
+- 语言：finding/recommendation/notes 与库正文语言一致（不自订语言）；字段名/信号 id/枚举保留英文。
+- **提交前自查（逐项对照，不许跳过）**：① verdict 与 plan 一致 ② 每条 evidence 在事实块 ③ undo_path 非空（不可逆=n/a）④ confidence 含推断≤0.4 ⑤ finding 无"应"字 ⑥ §3 完整性契约满足。
+
+## 7. 裁决纪律
+- finding 禁止"应当"句式；recommendation 是唯一"应"句，句板：建议对 {names} 执行 {动作}（形态：{命令/patch 指引}），理由：{理由}。
+- **审查者视角**：先对每个信号独立初判，再与正文对照；被审对象的自我声明只作线索不作依据；**自属/维护者技能一律从严口径**（作者声明"这是锚"不构成豁免）。
+- 申诉：机械阈值与语义判断冲突→is_override:true + override_reason + needs_human:true，不得静默绕过。
+- 不动作合法：verdict=no_issues 是合法输出；连续空报告=信号定义问题，不是"更积极"的理由。
+- 错误成本：rename 必须 needs_human:true；可逆动作（archive/restructure 两阶段）可 needs_human:false 但 undo_path 必填。
+- 不做：不建议删除（只建议 archive）；不提升内容质量（结构审查只 flag 位置/归属/分层）；protected 集（bundled/hub/pinned）内 0 建议。
+
+## 8. 泛化
+- 信号集开放：事实块含、§5 未列的信号 → notes 提"该信号值得新增条款"，禁止解释为已知问题。
+- 库规模无关：判据是事实与条款，不是库体量印象。
+- 信号机制疑问（阈值/检测原理）→ needs_human，不猜测机制。`;
+/**
+* One-line output instruction appended after the facts block in the maintain
+* subagent's prompt (persona carries the template, the prompt carries facts +
+* this instruction — one copy of the template in the model input, 011 v11
+* P3-4). F-16: this text used to be hardcoded in evolution-maintenance
+* orchestrate — a second model-facing prompt living OUTSIDE the bundle digest.
+* It now rides PROMPT_BUNDLE so the digest integrity check covers every
+* maintenance prompt. Adding the entry changes the bundle digest (the intended
+* fail-closed signal); PROMPT_BUNDLE_VERSION is owned by the core test pin and
+* bumps with the batch that changes the bundle (15→16 in 0.3.58).
+*/
+const MAINTAIN_OUTPUT_INSTRUCTION = "按模板契约输出 JSON 维护计划（verdict/plan/notes）；你有 skill 工具与维护模板；并在维护探针（maintenance_probe）挂载时可用它深挖细节。";
+/**
+* System-prompt guidance section (Hermes `SKILLS_GUIDANCE`, DSH-adapted).
+* Registered as a system-prompt section by tool-skill-manage (it mounts
+* exactly when `skill_manage` is available — the DSH analogue of Hermes'
+* `if "skill_manage" in agent.valid_tool_names` condition). Instructs the
+* model to save/repair skills on its own initiative.
+*/
+const SKILLS_GUIDANCE = `Skills guidance:
+• After completing a complex task (5+ tool calls), fixing a tricky error, or discovering a non-trivial workflow, save the approach as a skill with skill_manage so you can reuse it next time.
+• When using a skill and finding it outdated, incomplete, or wrong, patch it immediately with skill_manage (action='patch') — don't wait to be asked. Skills that aren't maintained become liabilities.`;
+const PLAN_CHANNEL_NOTE = `
+
+CHANNEL (subagent): this review channel mounts only the read-only \`skill\` tool — you have NO \`skill_manage\`, NO \`memory\`. Your deliverable is the structured JSON plan below (outputSchema). Describe the patches/creates you RECOMMEND in the plan; never narrate actions you took.`;
+/** Subagent-channel variant: same review policy, channel-limited deliverable (M-2). */
+const SKILL_REVIEW_PLAN_PROMPT = `${SKILL_REVIEW_PROMPT}${PLAN_CHANNEL_NOTE}`;
+/** Subagent-channel variant of the combined review (M-2). */
+const COMBINED_REVIEW_PLAN_PROMPT = `${COMBINED_REVIEW_PROMPT}${PLAN_CHANNEL_NOTE}`;
+function reviewPrompt(kind, channel = "agent") {
+	if (channel === "plan") return kind === "skill" ? SKILL_REVIEW_PLAN_PROMPT : COMBINED_REVIEW_PLAN_PROMPT;
+	if (kind === "memory") return MEMORY_REVIEW_PROMPT;
+	if (kind === "skill") return SKILL_REVIEW_PROMPT;
+	return COMBINED_REVIEW_PROMPT;
 }
-/**
-* V10-14 (P1-2), 0.3.53: inject the Hermes 60-char catalog cap onto the
-* standard-sourced `- id: tool-skill` row of a composed preset.
-*
-* The session-visible `tool-skill` instance mounts in the agent preset's own
-* standing scope; a profile-root patch (evolution-host/cordis.patch.yml)
-* cannot reach it, so without this injection the catalog's read side runs the
-* platform default (500). Text-level rewrite in the same line-scan style as
-* compositionRowIds (no YAML library):
-*   - idempotent: a tool-skill item that already carries a `config:` key is
-*     left byte-identical, so re-running the installer never doubles the key;
-*   - the injected block carries a marker comment so a diff of the generated
-*     preset can tell composer-owned text from platform text;
-*   - a composition WITHOUT a tool-skill row is returned unchanged with a
-*     one-time warning (a renamed platform row must not brick the install,
-*     but the missed cap must be observable).
-* install-layered.mjs ships the byte-identical `injectToolSkillCap`.
-*/
-function injectCatalogDescriptionCap(composition) {
-	const lines = composition.split("\n");
-	let found = false;
-	for (let i = 0; i < lines.length; i += 1) {
-		if (!/^- id:\s*tool-skill\s*$/.test(lines[i] ?? "")) continue;
-		found = true;
-		let end = i;
-		let hasConfig = false;
-		for (let j = i + 1; j < lines.length; j += 1) {
-			const next = lines[j] ?? "";
-			if (next.trim() === "") break;
-			if (!/^\s/.test(next)) break;
-			if (/^ {2}config:(\s|$)/.test(next)) hasConfig = true;
-			end = j;
-		}
-		if (hasConfig) continue;
-		lines.splice(end + 1, 0, "  # V10-14: Hermes 60-char catalog cap — injected by the preset composer (P1-2);", "  # this preset-scope row is the session-visible instance and no profile", "  # patch can reach it. Remove only to run the platform default (500).", "  config:", "    catalogDescriptionMaxLength: 60");
-		i = end + 5;
-	}
-	if (!found) console.warn("evolution preset composition: warning — no `- id: tool-skill` row in the composed preset; the 60-char catalog cap was NOT injected (platform renamed the row? reconcile with the delta)");
-	return lines.join("\n");
+function sha256(text) {
+	return createHash("sha256").update(text).digest("hex");
 }
-function compositionRowIds(composition) {
-	const ids = /* @__PURE__ */ new Set();
-	for (const line of composition.split("\n")) {
-		const id = /^- id:\s*(\S+)/.exec(line)?.[1];
-		if (id) ids.add(id);
-	}
-	return ids;
+function createPromptBundle(prompts) {
+	const canonical = JSON.stringify({
+		id: PROMPT_BUNDLE_ID,
+		version: 17,
+		prompts: Object.fromEntries(Object.entries(prompts).sort())
+	});
+	return Object.freeze({
+		id: PROMPT_BUNDLE_ID,
+		version: 17,
+		prompts: Object.freeze({ ...prompts }),
+		sha256: sha256(canonical)
+	});
+}
+const PROMPT_BUNDLE = createPromptBundle({
+	memory: MEMORY_REVIEW_PROMPT,
+	skill: SKILL_REVIEW_PROMPT,
+	combined: COMBINED_REVIEW_PROMPT,
+	skillPlan: SKILL_REVIEW_PLAN_PROMPT,
+	combinedPlan: COMBINED_REVIEW_PLAN_PROMPT,
+	curator: CURATOR_PROMPT,
+	completion: COMPLETION_SKILL_REVIEW_PROMPT,
+	maintain: MAINTAIN_PROMPT,
+	maintainOutput: MAINTAIN_OUTPUT_INSTRUCTION,
+	skillsGuidance: SKILLS_GUIDANCE
+});
+function verifyPromptBundle(bundle = PROMPT_BUNDLE) {
+	if (bundle.id !== PROMPT_BUNDLE_ID || bundle.version !== 17) return false;
+	const canonical = JSON.stringify({
+		id: PROMPT_BUNDLE_ID,
+		version: 17,
+		prompts: Object.fromEntries(Object.entries(bundle.prompts).sort())
+	});
+	return bundle.sha256 === sha256(canonical);
 }
+const DSH_AUTHORING_STANDARDS = `Follow the Hermes skill-authoring standards, translated to DSH tools.
+
+Frontmatter:
+- name: lowercase-hyphenated, <=64 chars, no spaces.
+- description: ONE sentence, <=60 characters, ends with a period. State the capability, not the implementation. No marketing words. Do NOT repeat the skill name. Count the characters before saving. If the description contains a colon, wrap the whole value in double quotes.
+- version: 0.1.0
+- author: always the literal value "Hermes". NEVER fill it from the environment, git config, or any identity you can probe — an environment-derived name is a privacy leak the user never opted into (skills get shared and published), and the skill names itself as Hermes.
+- platforms: declare [macos], [linux], and/or [windows] only when the skill is genuinely OS-bound (osascript/apt/systemctl => the matching OS; /proc, signal.SIGKILL => linux; fcntl/termios => POSIX). Prefer fixing it cross-platform first (tempdir, pathlib, pure-Node); omit the field for portable skills.
+- metadata.hermes.tags: a few Capitalized, Relevant, Tags.
+- metadata.hermes.related_skills: [a, b] — name sibling skills this one builds on or is referenced by (optional; feeds the quality references factor).
+
+Body section order (omit only when empty):
+1. "# <Human Title>" then a 2-3 sentence intro: what it does, what it does NOT do, key dependency stance.
+2. "## When to Use" — concrete trigger phrases.
+3. "## Prerequisites" — exact env vars, install steps, credentials.
+4. "## How to Run" — canonical invocation framed through DSH tools.
+5. "## Quick Reference" — flat command/endpoint list.
+6. "## Procedure" — numbered steps with copy-paste-exact commands.
+7. "## Pitfalls" — known limits and rate limits.
+8. "## Verification" — one check proving the skill worked.
+
+DSH-tool framing:
+- Reference DSH tools by name in backticks: \`bash\`, \`str_replace_editor\`, \`write\`, \`skill\`, \`skill_manage\`, \`memory\`.
+- Do not name wrapped shell utilities when a DSH tool already covers them.
+- Larger scripts belong under \`scripts/\` (written with \`skill_manage write_file\`) and are referenced from SKILL.md by relative path.
+
+Quality bar:
+- Prefer verbatim flags, paths, and APIs from the source. Never invent them.
+- Keep it tight: ~100 lines simple, ~200 complex.
+- No router/index/hub skills that only point at other skills.
+- References go in \`references/\`, templates in \`templates/\`.
+
+Learn workflow (when the user asks you to learn a reusable skill, or you decide to turn a source/request into one):
+1. Gather every source named (files, URLs, "what we just did", pasted notes) with the tools you already have — and treat prose after a source as authoring requirements, not noise.
+2. Apply every requirement and constraint from the request to the SKILL.md you author.
+3. Author exactly ONE SKILL.md and save it with \`skill_manage\` (action=create); non-trivial scripts go under \`scripts/\`.
+4. When done, tell the user the skill name, its category, and a one-line summary of what it captured.`;
 //#endregion
 //#region lib/types/quality.js
 /**
@@ -3551,10 +3675,12 @@ const SECRET_PATTERNS = [
 	["google api key", /AIza[0-9A-Za-z_-]{30,}/g],
 	["bearer credential", /Bearer[\s]+[a-z0-9._~+/=\-]{16,}/gi]
 ];
-const INLINE_ASSIGNMENT_PATTERN = /* @__PURE__ */ new RegExp("(^|[^\\w-])([\\w-]{0,64}[_\\-])?((?:token|api[_-]?key|secret|password|passwd)(?:[_\\-][\\w-]{0,64})?)\\b([\"\\']?[\\t ]*[:=][\\t ]*)([^\\r\\n]+)", "gi");
-const URL_CREDENTIALS_PATTERN = /([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)([^\s/@]+)@/gi;
+const INLINE_ASSIGNMENT_PATTERN = /* @__PURE__ */ new RegExp("(^|[^\\w-])([\\w-]*[_\\-])?((?:token|api[_-]?key|secret|password|passwd)(?:[_\\-][\\w-]*)?)\\b([\"\\']?[\\t ]*[:=][\\t ]*)([^\\r\\n]+)", "gi");
+const URL_CREDENTIALS_PATTERN = /([a-z][a-z0-9+.-]{0,63}:\/\/[^\s:/@]+:)([^\s/@]+)@/gi;
 const PEM_PRIVATE_KEY_PATTERN = new RegExp(`-----BEGIN\\s+(?:(?:RSA|EC|DSA|OPENSSH|ENCRYPTED|PGP)\\s+)?PRIVATE\\s+KEY(?:\\s+BLOCK)?-----[\\s\\S]*?-----END\\s+(?:(?:RSA|EC|DSA|OPENSSH|ENCRYPTED|PGP)\\s+)?PRIVATE\\s+KEY(?:\\s+BLOCK)?-----`, "g");
-const BLOCK_KEY_ONLY_LINE = /(?:^|\s)([\w-]{0,64}[_\-])?((?:token|api[_-]?key|secret|password|passwd)(?:[_\-][\w-]{0,64})?)\s*:(?:\r)?$/i;
+const BLOCK_KEY_ONLY_LINE = /(?:^|\s)([\w-]*[_\-])?((?:token|api[_-]?key|secret|password|passwd)(?:[_\-][\w-]*)?)\s*:(?:\r)?$/i;
+const CREDENTIAL_KEY_RE = /(?:[Tt]oken|[Ss]ecret|[Pp]assword|[Pp]asswd|[Aa]pi[_-]?[Kk]ey)(?![a-z])/;
+const CANDIDATE_ASSIGNMENT_PATTERN = /(^|[^\w-])([\w-]+)(["']?[\t ]*[:=][\t ]*)([^\r\n]+)/g;
 /**
 * Mask credential-shaped text before it crosses a session boundary.
 * @param text - the text about to be sent to a model outside this session.
@@ -3566,10 +3692,16 @@ function redactSecrets(text) {
 	for (const [, pattern] of SECRET_PATTERNS) out = out.replace(pattern, "<redacted>");
 	out = out.replace(URL_CREDENTIALS_PATTERN, (_match, lead) => `${lead ?? ""}<redacted>@`);
 	out = out.replace(INLINE_ASSIGNMENT_PATTERN, (_match, lead, prefix, key, separator) => `${lead ?? ""}${prefix ?? ""}${key ?? ""}${separator ?? ""}<redacted>`);
+	out = out.replace(CANDIDATE_ASSIGNMENT_PATTERN, (match, lead, key, separator) => {
+		if (typeof key !== "string" || !CREDENTIAL_KEY_RE.test(key)) return match;
+		return `${lead ?? ""}${key}${separator ?? ""}<redacted>`;
+	});
 	const lines = out.split("\n");
 	for (let i = 0; i < lines.length - 1; i++) {
 		const line = lines[i];
-		if (line === void 0 || !BLOCK_KEY_ONLY_LINE.test(line)) continue;
+		if (line === void 0) continue;
+		const camelKey = /^([\w-]+)\s*:(?:\r)?$/.exec(line)?.[1];
+		if (!(BLOCK_KEY_ONLY_LINE.test(line) || camelKey !== void 0 && CREDENTIAL_KEY_RE.test(camelKey))) continue;
 		const next = lines[i + 1] ?? "";
 		const [, indent, value, tail] = /^([ \t]+)(\S.*?)([ \t]*)(?:\r)?$/.exec(next) ?? [];
 		if (indent === void 0 || value === void 0) continue;
@@ -3584,6 +3716,109 @@ function redactSecrets(text) {
 	return out;
 }
 //#endregion
+//#region lib/types/review-channel.js
+/**
+* Family-internal mark for the review channel's INJECT delivery (v37 S2.2).
+*
+* With the default `reviewMode: 'inject'` the review prompt runs in the PARENT
+* session, so the parent model's own `skill_manage` calls carry no origin the
+* platform could attribute: `.pinned` and the `.hermes-managed` authorship mark
+* were skipped for exactly the autonomous writes they exist for. The delivery
+* marks the session here and the write path reads the mark.
+*
+* Window: after the review prompt, until the next REAL user message (a
+* `user/message` with `source.kind === 'user'` clears it; plugin-sourced notices
+* never do). Process-wide and keyed by session on purpose — the same
+* "restart is a fresh conversation boundary" discipline as the review plugin's
+* own per-session counters. This module is the ONE owner of the marker.
+* @module @lmzhen/dsh-evolution-core/review-channel
+*/
+/** Session ids currently executing a review prompt, oldest delivery first. */
+const markedSessions = /* @__PURE__ */ new Set();
+/**
+* Mark one session as running the review channel's prompt; idempotent, and
+* keyed by session so a mark can never leak into another session.
+* @param sessionId - the session the review prompt was delivered to.
+*/
+function markReviewChannel(sessionId) {
+	markedSessions.delete(sessionId);
+	markedSessions.add(sessionId);
+}
+/**
+* Clear the mark: the session's next prompt is human input again.
+* @param sessionId - the session whose mark is dropped.
+*/
+function clearReviewChannel(sessionId) {
+	markedSessions.delete(sessionId);
+}
+/**
+* Whether this session's current prompt came from the review channel. An
+* execution without a session is never the review channel.
+* @param sessionId - the executing session id, when the caller has one.
+* @returns true only for a marked session.
+*/
+function isReviewChannelSession(sessionId) {
+	return sessionId !== void 0 && markedSessions.has(sessionId);
+}
+/**
+* Drop marks whose session is gone — a dead session cannot execute a write.
+* @param isAlive - liveness probe for one session id.
+* @returns the number of removed marks.
+*/
+function sweepReviewChannelSessions(isAlive) {
+	let removed = 0;
+	for (const sessionId of [...markedSessions]) {
+		if (isAlive(sessionId)) continue;
+		markedSessions.delete(sessionId);
+		removed += 1;
+	}
+	return removed;
+}
+//#endregion
+//#region lib/types/probe.js
+function probePresent(value) {
+	return {
+		kind: "present",
+		value
+	};
+}
+function probeAbsent() {
+	return { kind: "absent" };
+}
+function probeUnknown(reason) {
+	return {
+		kind: "unknown",
+		reason
+	};
+}
+function isPresent(probe) {
+	return probe.kind === "present";
+}
+function isAbsent(probe) {
+	return probe.kind === "absent";
+}
+function isUnknown(probe) {
+	return probe.kind === "unknown";
+}
+/** Only a PRESENT probe yields a value; absent and unknown both fall back. */
+function valueOr(probe, fallback) {
+	return probe.kind === "present" ? probe.value : fallback;
+}
+function mapProbe(probe, transform) {
+	return probe.kind === "present" ? probePresent(transform(probe.value)) : probe;
+}
+//#endregion
+//#region lib/types/scope.js
+function callingScope(ctx, held) {
+	if (held !== void 0) return held;
+	return scopeOf(ctx);
+}
+/** True when a read is deliberately scope-less (global layer only). Callers
+* pass this to the register so the choice is reviewed, not accidental. */
+function isGlobalRead(scope) {
+	return scope === void 0;
+}
+//#endregion
 //#region lib/types/skill-health.js
 /**
 * Skill structure-health domain (rc.73 A1, 008 design): a SECOND assessment
@@ -3653,6 +3888,320 @@ function assessStructureHealth(snapshot, thresholds = DEFAULT_HEALTH_THRESHOLDS)
 	};
 }
 //#endregion
+//#region lib/types/tool-dispatch.js
+/**
+* The family's ONE reader of platform tool-dispatch events.
+*
+* The platform records a finished tool call under two different event
+* vocabularies and only one of them is written per dispatch, chosen by the
+* mounted tool runtime's mode:
+*
+* - native mode: \`tool/call\` (with \`callId\`) settled by \`tool/result\`, the
+*   write sites being core/agent-loop/src/tool-calls.ts:264 and :282.
+* - PTC mode: \`tool/ptc-dispatch-start\` and \`tool/ptc-dispatch\` (with
+*   \`subCallId\`), the write sites being core/tools/src/ptc.ts:534 and :509.
+*
+* A consumer that matches a vocabulary directly therefore goes blind in the
+* other mode while still appearing to work — the defect this module exists to
+* make impossible. Every family consumer reads dispatches through
+* \`ToolDispatchNormalizer\` (or the pure helpers below) and matches on
+* \`ToolDispatchSignal\` fields only; \`verify-arch-guards\` rule N11 rejects a
+* dispatch event-type comparison anywhere else.
+*
+* ## The one-dispatch invariant
+*
+* One dispatch produces exactly one \`ToolDispatchSignal\`, no matter how many
+* events carry it: a start/settle pair for a PTC sub-dispatch, a call/result
+* pair for a native call, or both vocabularies for the same call. Deduplication
+* and outcome folding are keyed by the platform's own per-vocabulary call
+* identity, which is stable across the pair (the platform's event JSDoc:
+* "the pairing ids (matching the \`tool/ptc-dispatch-start\` with the same
+* \`subCallId\`)").
+*
+* ## Layer
+*
+* Cross-cutting normalization: the reader half of the dispatch vocabulary,
+* next to \`signals.ts\` (which folds the signals this module emits). Both are
+* consumers; neither subscribes to the platform bus itself.
+* @module
+*/
+/** The platform event type carrying a PTC sub-dispatch start. */
+const PTC_DISPATCH_START_EVENT = "tool/ptc-dispatch-start";
+/** The platform event type carrying a PTC sub-dispatch settle. */
+const PTC_DISPATCH_EVENT = "tool/ptc-dispatch";
+/** The platform event type carrying a native tool call. */
+const NATIVE_CALL_EVENT = "tool/call";
+/** The platform event type carrying a native tool result. */
+const NATIVE_RESULT_EVENT = "tool/result";
+/**
+* The dispatch vocabulary this module owns. A consumer must never compare
+* against these literals itself (rule N11); it compares \`kind\` instead.
+*/
+const DISPATCH_EVENT_TYPES = [
+	NATIVE_CALL_EVENT,
+	NATIVE_RESULT_EVENT,
+	PTC_DISPATCH_START_EVENT,
+	PTC_DISPATCH_EVENT
+];
+/**
+* \`TypeError\` thrown when a payload that claims to be a dispatch event
+* violates the platform's event declaration. Named so a deployment can tell this
+* refusal apart from a generic failure in a log line.
+*/
+var ToolDispatchPayloadError = class extends TypeError {
+	name = "ToolDispatchPayloadError";
+};
+/** The dispatch event types this module recognizes, as a set. */
+const DISPATCH_EVENT_TYPE_SET = new Set(DISPATCH_EVENT_TYPES);
+/** \`name\`-less payloads: an external emitter or a corrupt log can produce these. */
+const MALFORMED = "malformed";
+/** One tool-result block of a native result payload, or \`null\` when the payload carries none. */
+function firstResultBlock(data) {
+	const content = data.message?.content;
+	if (!Array.isArray(content)) return null;
+	for (const entry of content) {
+		if (entry === null || typeof entry !== "object") continue;
+		const block = entry;
+		if (block.type === "tool-result") return block;
+	}
+	return null;
+}
+/** Deterministic identity for a dispatch payload that carries no call id. */
+function payloadIdentity(data) {
+	if (data === void 0) return "";
+	try {
+		return JSON.stringify(data);
+	} catch {
+		return "";
+	}
+}
+/** Read the payload of a recognized dispatch event, or \`null\` for any other event. */
+function readDispatchRecord(event) {
+	if (!DISPATCH_EVENT_TYPE_SET.has(event.type)) return null;
+	const data = event.data ?? {};
+	if (event.type === "tool/result") {
+		const owner = data.message?.source?.callId;
+		const block = firstResultBlock(data);
+		const callId = typeof owner === "string" && owner !== "" ? owner : typeof block?.toolCallId === "string" && block.toolCallId !== "" ? block.toolCallId : void 0;
+		if (callId === void 0) return null;
+		return {
+			kind: "native",
+			callId,
+			rootCallId: callId,
+			name: "",
+			arguments: void 0,
+			outcome: { ok: data.isError !== true && data.error === void 0 && block?.isError !== true }
+		};
+	}
+	const isPtc = event.type === "tool/ptc-dispatch-start" || event.type === "tool/ptc-dispatch";
+	const identity = isPtc ? data.subCallId : data.callId;
+	const callId = typeof identity === "string" && identity !== "" ? identity : `${event.type}:${payloadIdentity(event.data)}`;
+	const parent = isPtc && typeof data.parentCallId === "string" && data.parentCallId !== "" ? data.parentCallId : void 0;
+	const name = typeof data.name === "string" && data.name !== "" ? data.name : MALFORMED;
+	return {
+		kind: isPtc ? "program" : "native",
+		callId,
+		rootCallId: typeof data.rootCallId === "string" && data.rootCallId !== "" ? data.rootCallId : parent ?? callId,
+		name,
+		arguments: data.arguments,
+		...isPtc && event.type === "tool/ptc-dispatch" ? { outcome: { ok: data.isError !== true } } : {}
+	};
+}
+/**
+* The family's single dispatch ledger: absorbs platform events in log order,
+* emits one \`ToolDispatchSignal\` per dispatch, and folds later events of the
+* same dispatch into the record it already emitted.
+*
+* Consumers keep the \`ToolDispatchSignal\` object they received and re-read it
+* later; no consumer needs to correlate events itself.
+*/
+var ToolDispatchNormalizer = class {
+	records = /* @__PURE__ */ new Map();
+	/** Call ids of \`run_code\`-class calls, i.e. of dispatches whose sub-dispatches are \`program\`. */
+	programRoots = /* @__PURE__ */ new Set();
+	/**
+	* Absorb one session event.
+	* @param event - the event to absorb; any non-dispatch event is ignored.
+	* @returns the dispatch's signal when this event FIRST reveals the dispatch,
+	* otherwise \`null\` (the paired event of an already-emitted dispatch, or a
+	* non-dispatch event). A \`null\` return is never a dispatch to count again.
+	*/
+	advance(event) {
+		const record = readDispatchRecord(event);
+		if (record === null) return null;
+		if (record.name === "") {
+			const existing = this.records.get(record.callId);
+			if (existing !== void 0 && record.outcome !== void 0) existing.ok = record.outcome.ok;
+			return null;
+		}
+		const existing = this.records.get(record.callId);
+		if (existing !== void 0) {
+			if (record.outcome !== void 0) existing.ok = record.outcome.ok;
+			return null;
+		}
+		const signal = {
+			kind: record.kind === "native" && this.programRoots.has(record.callId) ? "program-root" : record.kind,
+			callId: record.callId,
+			rootCallId: record.rootCallId,
+			name: record.name,
+			arguments: record.arguments,
+			ok: record.outcome?.ok
+		};
+		this.records.set(record.callId, signal);
+		if (record.kind === "program" && record.rootCallId !== record.callId) this.programRoots.add(record.rootCallId);
+		return signal;
+	}
+	/** Every emitted dispatch, in first-seen order. */
+	get signals() {
+		return [...this.records.values()];
+	}
+	/**
+	* Fold every event of a session log, in order.
+	* @param events - the log, oldest first.
+	* @returns one signal per dispatch, in first-seen order.
+	*/
+	foldAll(events) {
+		const emitted = [];
+		for (const event of events) {
+			const signal = this.advance(event);
+			if (signal !== null) emitted.push(signal);
+		}
+		return emitted;
+	}
+};
+/**
+* Read one event into a dispatch record without a ledger (the pure half of the
+* fold). Unlike the ledger it does NOT dedupe: a caller that walks a log and
+* emits its own lines needs the call line on the event that opens the result.
+* @param event - one session event; an absent event (an over-advanced index)
+* answers \`null\` rather than throwing.
+* @returns the dispatch this event opens, or \`null\` for any other event.
+*/
+function readDispatchSignal(event) {
+	if (event?.type === void 0) return null;
+	const record = readDispatchRecord({
+		type: event.type,
+		...event.data === void 0 ? {} : { data: event.data }
+	});
+	if (record === null || record.name === "") return null;
+	return {
+		kind: record.kind,
+		callId: record.callId,
+		rootCallId: record.rootCallId,
+		name: record.name,
+		arguments: record.arguments
+	};
+}
+/** Tool names that READ one skill. The single authority for skill-read detection. */
+const SKILL_READ_TOOL_NAMES = new Set(["skill"]);
+/**
+* Is this dispatched tool name a single-skill read?
+* @param name - the dispatched tool name.
+* @returns \`true\` only for the read tool whose arguments name one skill.
+*/
+function isSkillReadToolName(name) {
+	return SKILL_READ_TOOL_NAMES.has(name);
+}
+/** Tool names whose dispatch opens a code program, i.e. whose sub-dispatches are \`program\`. */
+const PROGRAM_TOOL_NAMES = new Set(["run_code"]);
+/**
+* Does this signal read one skill, and did it not fail?
+* @param signal - a normalized dispatch.
+* @returns the skill name the dispatch read, or \`undefined\` when the dispatch
+* is not a skill read or has failed. A dispatch whose outcome is still pending
+* counts as a read: the platform settles every started sub-dispatch, so pending
+* is a live-window state, not a failure.
+*/
+function skillReadNameOf(signal) {
+	if (!SKILL_READ_TOOL_NAMES.has(signal.name)) return void 0;
+	if (signal.ok === false) return void 0;
+	let parsed = signal.arguments;
+	if (typeof parsed === "string") try {
+		parsed = JSON.parse(parsed);
+	} catch {
+		return;
+	}
+	if (parsed === null || typeof parsed !== "object") return void 0;
+	const candidate = parsed;
+	const name = typeof candidate.name === "string" ? candidate.name : typeof candidate.skill === "string" ? candidate.skill : "";
+	return name === "" ? void 0 : name;
+}
+/**
+* Fold one session log into its deduplicated dispatches.
+* @param events - the log, oldest first. Pass an array, not a live snapshot
+* iterator, when the log can grow while folding.
+* @returns one signal per dispatch, in first-seen order.
+*/
+function foldToolDispatches(events) {
+	return new ToolDispatchNormalizer().foldAll(events);
+}
+/**
+* Every skill name this log read through a dispatch, deduplicated by dispatch.
+* @param events - the log, oldest first.
+* @returns the names read by at least one non-failed skill dispatch.
+*/
+function collectReadSkillNames(events) {
+	const names = /* @__PURE__ */ new Set();
+	for (const signal of foldToolDispatches(events)) {
+		const name = skillReadNameOf(signal);
+		if (name !== void 0) names.add(name);
+	}
+	return names;
+}
+/** Tool names that touch the skill library at all — the review's skill-signal set. */
+const SKILL_TOOL_NAMES = new Set([...SKILL_READ_TOOL_NAMES, "skill_manage"]);
+/**
+* Does this dispatched tool name touch the skill library (read or mutate)?
+* @param name - the dispatched tool name.
+* @returns \`true\` for any skill-library tool. This is the review cadence's
+* skill signal, which has always covered reads and writes alike.
+*/
+function isSkillToolName(name) {
+	return SKILL_TOOL_NAMES.has(name);
+}
+/**
+* Does this dispatched tool name open a code program?
+* @param name - the dispatched tool name.
+* @returns \`true\` for the tool whose sub-dispatches are \`program\` kind.
+*/
+function isProgramToolName(name) {
+	return PROGRAM_TOOL_NAMES.has(name);
+}
+/**
+* Assert that a payload really is the dispatch event it claims to be.
+*
+* The normalizer is deliberately lenient (it also folds persisted logs, where a
+* payload may predate the current declaration); this is the loud gate for the
+* live path, where a malformed payload means the producer is broken. It never
+* silently downgrades: an unrecognized event type or a payload missing a
+* declared field throws a named \`ToolDispatchPayloadError\`.
+* @param event - the session event to check.
+* @returns nothing; throws when the payload violates the platform declaration.
+*/
+function assertDispatchPayload(event) {
+	const data = event.data ?? {};
+	if (event.type === "tool/call") {
+		if (typeof data.name !== "string" || data.name === "" || typeof data.callId !== "string" || data.callId === "") throw new ToolDispatchPayloadError("tool/call carries no name/callId: the agent-loop write site is broken");
+		return;
+	}
+	if (event.type === "tool/ptc-dispatch-start" || event.type === "tool/ptc-dispatch") {
+		if (typeof data.subCallId !== "string" || data.subCallId === "" || typeof data.name !== "string" || data.name === "") throw new ToolDispatchPayloadError(`${event.type} carries no name/subCallId: the PTC bridge write site is broken`);
+		if (event.type === "tool/ptc-dispatch" && typeof data.isError !== "boolean") throw new ToolDispatchPayloadError("tool/ptc-dispatch carries no boolean isError: the settle outcome is unusable");
+		return;
+	}
+	if (event.type === "tool/result") return;
+	throw new ToolDispatchPayloadError(`${event.type} is not a platform dispatch event; compare signal.kind instead of event types`);
+}
+/**
+* Total dispatches in a log, deduplicated.
+* @param events - the log, oldest first.
+* @returns the number of distinct dispatches, one per dispatch regardless of
+* how many events carried it.
+*/
+function countDispatches(events) {
+	return foldToolDispatches(events).length;
+}
+//#endregion
 //#region lib/types/signals.js
 /**
 * Deterministic review signal gate.
@@ -3684,6 +4233,23 @@ function textOfBlock(block) {
 	const candidate = block;
 	return candidate.type === "text" && typeof candidate.text === "string" ? candidate.text : "";
 }
+/**
+* Per-turn dispatch ledgers, keyed by the signal object they feed.
+*
+* `observeEvent` folds ONE event at a time, so the dedup state has to outlive
+* the call. One WeakMap entry per `TurnSignals`, so a finished fold's ledger is
+* collectable with the fold itself and two concurrent turns never share one.
+*/
+const dispatchLedgers = /* @__PURE__ */ new WeakMap();
+/** The ledger folding this signal's turn, created on first use. */
+function normalizerForSignal(signal) {
+	let normalizer = dispatchLedgers.get(signal);
+	if (normalizer === void 0) {
+		normalizer = new ToolDispatchNormalizer();
+		dispatchLedgers.set(signal, normalizer);
+	}
+	return normalizer;
+}
 /** Fold one session event into the current turn observation. */
 function observeEvent(signal, event) {
 	const data = event.data;
@@ -3704,11 +4270,10 @@ function observeEvent(signal, event) {
 		signal.assistantChars += text.length;
 		return;
 	}
-	if (event.type === "tool/call") {
-		signal.toolCalls += 1;
-		const name = data.name;
-		if (name === "skill" || name === "skill_manage") signal.skillSignal = true;
-	}
+	const dispatch = normalizerForSignal(signal).advance(event);
+	if (dispatch === null) return;
+	if (dispatch.kind !== "program") signal.toolCalls += 1;
+	if (isSkillToolName(dispatch.name)) signal.skillSignal = true;
 }
 /** Compute review cadence after `turn/end`. */
 function advanceReview(state, turn, signal, config) {
@@ -3815,7 +4380,8 @@ function missingSupportPointers(body, supportFiles) {
 /** Duplicate `## heading` occurrences: singleton results default to head of the file. */
 function duplicateHeadings(body) {
 	const counts = /* @__PURE__ */ new Map();
-	for (const line of body.split("\n")) {
+	for (const raw of body.split("\n")) {
+		const line = raw.endsWith("\r") ? raw.slice(0, -1) : raw;
 		const m = /^##\s+(.+)$/.exec(line);
 		if (m?.[1]) {
 			const heading = m[1].trim();
@@ -3832,7 +4398,8 @@ function overlongLines(body, max = DRIFT_MAX_LINE_CHARS) {
 	const out = [];
 	const lines = body.split("\n");
 	for (let index = 0; index < lines.length; index += 1) {
-		const length = (lines[index] ?? "").length;
+		const raw = lines[index] ?? "";
+		const length = raw.endsWith("\r") ? raw.length - 1 : raw.length;
 		if (length > max) out.push({
 			lineNo: index + 1,
 			chars: length
@@ -3887,7 +4454,7 @@ function computeDriftSignals(snapshots) {
 				bodyText: body,
 				supportGroups: supportGroupCount(supportFiles)
 			}, DEFAULT_HEALTH_THRESHOLDS).dims.stampDensityPerKb;
-			signals.push(density === null ? sig("stamp_density", "pass", body.length < 2e3 ? "below-min-body" : "not-assessed") : sig("stamp_density", density >= DEFAULT_HEALTH_THRESHOLDS.stampDensityPerKb ? "over" : "pass", `${density.toFixed(2)}/KB`, `${DEFAULT_HEALTH_THRESHOLDS.stampDensityPerKb}/KB`));
+			signals.push(density === null ? sig("stamp_density", "pass", "below-min-body") : sig("stamp_density", density >= DEFAULT_HEALTH_THRESHOLDS.stampDensityPerKb ? "over" : "pass", `${density.toFixed(2)}/KB`, `${DEFAULT_HEALTH_THRESHOLDS.stampDensityPerKb}/KB`));
 			signals.push(sig("body_size", body.length >= DEFAULT_HEALTH_THRESHOLDS.softBodyChars ? "over" : "pass", `${body.length}`, `${DEFAULT_HEALTH_THRESHOLDS.softBodyChars}`));
 			const dupes = duplicateHeadings(body);
 			signals.push(dupes.length === 0 ? sig("dup_heading", "pass", "none") : sig("dup_heading", "over", dupes.map((d) => `${d.heading}(${d.count})`).join(", "), "count >= 2"));
@@ -4134,23 +4701,35 @@ function markerPath(dir, marker) {
 * platform ignored the file: family visibility split from platform visibility,
 * which is exactly what a strict-YAML frontmatter is supposed to prevent.
 */
+/**
+* S1.1 (v37 P1-4): the frontmatter block is split on LF and every line keeps its
+* own `\r`, so the byte-preserving rebuild (`lines.join('\n')`) is exact. Line
+* MATCHERS must therefore look at a CR-stripped view: JS `.` does not match `\r`,
+* so `(.*)$` never reaches the end of a CRLF line.
+* @param line - one block line, possibly CR-terminated.
+* @returns the line without its trailing CR.
+*/
+function withoutCr(line) {
+	return line.endsWith("\r") ? line.slice(0, -1) : line;
+}
 function frontmatterBlock(content) {
 	if (!content.trimStart().startsWith("---")) return null;
-	const nl = content.includes("\r\n") ? "\r\n" : "\n";
-	const lines = content.split(nl);
+	const firstBreak = content.indexOf("\n");
+	const nl = firstBreak > 0 && content[firstBreak - 1] === "\r" ? "\r\n" : "\n";
+	const lines = content.split("\n");
 	if ((lines[0] ?? "").replace(/\r$/, "") !== "---") return null;
 	let end = -1;
 	for (let i = 1; i < lines.length; i++) {
 		const line = lines[i];
 		if (line === void 0) continue;
-		if (line.replace(/\r$/, "") === "---") {
+		if (line === "---" || line === "---\r") {
 			end = i;
 			break;
 		}
 	}
 	if (end < 0) return null;
 	return {
-		block: lines.slice(1, end).join(nl),
+		block: lines.slice(1, end).join("\n"),
 		lines,
 		end,
 		nl
@@ -4167,8 +4746,9 @@ function frontmatterBlock(content) {
 function unsafeFrontmatterEntries(block, nl) {
 	const found = [];
 	for (const line of block.split(nl)) {
-		if (line.includes("\n") || line.includes("\r")) continue;
-		const match = /^([A-Za-z0-9_-]+):\s*(.*)$/.exec(line);
+		const clean = withoutCr(line);
+		if (clean.includes("\n") || clean.includes("\r")) continue;
+		const match = /^([A-Za-z0-9_-]+):\s*(.*)$/.exec(clean);
 		if (!match) continue;
 		const key = match[1];
 		if (key === void 0) continue;
@@ -4181,9 +4761,22 @@ function unsafeFrontmatterEntries(block, nl) {
 	return found;
 }
 /**
+* Frontmatter fields the platform catalog reads as STRINGS (`stringField` /
+* `optionalString` in `skill-filesystem`): any other YAML type reads as
+* ABSENT there, and an absent `name`/`description` makes the catalog ignore the
+* whole file. The family publishes text for these keys anyway (its lenient
+* read), which is the one split a write must not create.
+*/
+const PLATFORM_STRING_FIELDS = [
+	"name",
+	"description",
+	"whenToUse"
+];
+/**
 * Frontmatter values as the STRICT platform catalog reads them — js-yaml, the
 * parser `normalizeFrontmatter` also verifies rewrites with — or `null` when
-* the block is not loadable as a YAML mapping.
+* the block is not loadable as a YAML mapping. Also reports the platform string
+* fields whose value is not a string ({@link PlatformStringSplit}).
 *
 * Scalars publish their text (`name`, `description`, `whenToUse` are strings by
 * contract; a number/boolean-shaped value keeps the text the family always
@@ -4195,17 +4788,28 @@ function unsafeFrontmatterEntries(block, nl) {
 * carried.
 */
 function strictFrontmatterValues(block) {
-	if (block.trim() === "") return /* @__PURE__ */ new Map();
+	if (block.trim() === "") return {
+		values: /* @__PURE__ */ new Map(),
+		split: []
+	};
 	let loaded;
 	try {
 		loaded = load(block);
 	} catch {
 		return null;
 	}
-	if (loaded === null || loaded === void 0) return /* @__PURE__ */ new Map();
+	if (loaded === null || loaded === void 0) return {
+		values: /* @__PURE__ */ new Map(),
+		split: []
+	};
 	if (typeof loaded !== "object" || Array.isArray(loaded)) return null;
 	const values = /* @__PURE__ */ new Map();
+	const split = [];
 	for (const [key, value] of Object.entries(loaded)) {
+		if (typeof value !== "string" && PLATFORM_STRING_FIELDS.includes(key)) split.push({
+			key,
+			kind: value === null || value === void 0 ? "null" : Array.isArray(value) ? "sequence" : typeof value === "object" ? "mapping" : "scalar"
+		});
 		if (typeof value === "string") {
 			values.set(key, value.trim());
 			continue;
@@ -4219,7 +4823,10 @@ function strictFrontmatterValues(block) {
 			continue;
 		}
 	}
-	return values;
+	return {
+		values,
+		split
+	};
 }
 /**
 * Lenient line scan, used only for a block the strict parser rejects: the
@@ -4231,7 +4838,7 @@ function lenientFrontmatterValues(block, nl) {
 	const values = /* @__PURE__ */ new Map();
 	const blockLines = block.split(nl);
 	for (let i = 0; i < blockLines.length; i += 1) {
-		const line = blockLines[i] ?? "";
+		const line = withoutCr(blockLines[i] ?? "");
 		const match = /^([A-Za-z0-9_-]+):\s*(.*)$/.exec(line);
 		if (!match) continue;
 		const [, key, value] = match;
@@ -4280,16 +4887,17 @@ function lenientFrontmatterValues(block, nl) {
 function readFrontmatterBlock(content) {
 	const found = frontmatterBlock(content);
 	if (!found) return null;
-	const body = found.lines.slice(found.end + 1).join(found.nl).trim();
+	const body = found.lines.slice(found.end + 1).join("\n").trim();
 	const strict = strictFrontmatterValues(found.block);
-	const values = strict ?? lenientFrontmatterValues(found.block, found.nl);
+	const values = strict?.values ?? lenientFrontmatterValues(found.block, found.nl);
 	const frontmatter = {};
 	for (const [key, value] of values) frontmatter[key] = value;
 	return {
 		frontmatter,
 		body,
 		unsafeValues: unsafeFrontmatterEntries(found.block, found.nl),
-		strictFailed: strict === null
+		strictFailed: strict === null,
+		platformStringSplit: strict?.split ?? []
 	};
 }
 /**
@@ -4309,7 +4917,8 @@ function parseFrontmatter(content) {
 		frontmatter: read.frontmatter,
 		body: read.body,
 		unsafeValues: read.unsafeValues,
-		catalogInvalid: read.strictFailed || read.unsafeValues.length > 0
+		catalogInvalid: read.strictFailed || read.unsafeValues.length > 0 || read.platformStringSplit.length > 0,
+		platformStringSplit: read.platformStringSplit
 	};
 }
 /**
@@ -4324,7 +4933,7 @@ function parseFrontmatter(content) {
 */
 function frontmatterCatalogInvalid(content) {
 	const read = readFrontmatterBlock(content);
-	if (read !== null) return read.strictFailed || read.unsafeValues.length > 0;
+	if (read !== null) return read.strictFailed || read.unsafeValues.length > 0 || read.platformStringSplit.length > 0;
 	return frontmatterBlock(content.replace(/^\uFEFF/, "").replace(/\r\n/g, "\n")) !== null;
 }
 /** YAML plain-scalar hazards that make an UNQUOTED frontmatter value
@@ -4384,16 +4993,16 @@ function normalizeFrontmatter(content) {
 		fields: [],
 		issues: []
 	};
-	const { lines, end, nl } = block;
+	const { lines, end } = block;
 	const fields = [];
 	const issues = [];
 	const seen = /* @__PURE__ */ new Set();
 	const originalValues = /* @__PURE__ */ new Map();
 	let changed = false;
 	for (let i = 1; i < end; i++) {
-		const line = lines[i];
-		if (line === void 0) continue;
-		const match = /^([A-Za-z0-9_-]+):\s*(.*)$/.exec(line);
+		const raw = lines[i];
+		if (raw === void 0) continue;
+		const match = /^([A-Za-z0-9_-]+):\s*(.*)$/.exec(withoutCr(raw));
 		if (!match) continue;
 		const key = match[1];
 		if (key === void 0) continue;
@@ -4408,7 +5017,7 @@ function normalizeFrontmatter(content) {
 			issues.push(`${key}: value contains control characters — clean them manually`);
 			continue;
 		}
-		lines[i] = `${key}: ${value.includes("\"") || value.includes("\\") ? `'${value.replace(/'/g, "''")}'` : `"${value}"`}`;
+		lines[i] = `${key}: ${value.includes("\"") || value.includes("\\") ? `'${value.replace(/'/g, "''")}'` : `"${value}"`}${raw.endsWith("\r") ? "\r" : ""}`;
 		originalValues.set(key, value);
 		fields.push(key);
 		changed = true;
@@ -4425,12 +5034,12 @@ function normalizeFrontmatter(content) {
 		fields: [],
 		issues
 	};
-	const rewrittenBlock = lines.slice(1, end).join(nl);
+	const rewrittenBlock = lines.slice(1, end).join("\n");
 	try {
 		const parsed = load(rewrittenBlock);
 		for (const key of fields) if (String(parsed[key]) !== originalValues.get(key)) throw new Error(`rewritten value for ${key} differs from the original`);
 		return {
-			content: lines.join(nl),
+			content: lines.join("\n"),
 			changed: true,
 			fields,
 			issues
@@ -4464,16 +5073,36 @@ function relatedSkillNames(content, exclude) {
 	}
 	return [...names];
 }
-function validateFrontmatter(content, expectedName, limits = DEFAULT_SKILL_LIMITS) {
+/** S1.2 (v37 P2-1): the content limit applies to the bytes that LAND ON DISK.
+* Every write normalizes with `trimEnd() + '\n'`, so judging the raw argument let
+* a 100_000-character body with no trailing newline land as 100_001 bytes — and
+* every later patch/update of that skill was then refused, which made it
+* unmaintainable through `skill_manage` with no repair path at all. */
+function skillMdOnDisk(content) {
+	return content.trimEnd() + "\n";
+}
+/** Whether `content` would exceed `limit` once written. */
+function exceedsContentLimit(content, limit) {
+	return skillMdOnDisk(content).length > limit;
+}
+/** S1.2: the repair path — a write that makes an already-over-limit file smaller.
+* Only a NET SHRINK is exempt; an equal or larger write stays refused. */
+function shrinksOverLimit(next, current, limit) {
+	if (current === null || current === void 0 || !exceedsContentLimit(current, limit)) return false;
+	return skillMdOnDisk(next).length < skillMdOnDisk(current).length;
+}
+function validateFrontmatter(content, expectedName, limits = DEFAULT_SKILL_LIMITS, current) {
 	const parsed = parseFrontmatter(content);
 	if (!parsed) return "SKILL.md must start with a `---` line, close the frontmatter with another exact `---` line (only a trailing `\\r` is tolerated), and include a body below it.";
+	const unreadable = parsed.platformStringSplit.filter((entry) => entry.kind === "sequence" || entry.kind === "mapping");
+	if (unreadable.length > 0) return `Frontmatter field ${unreadable.map((entry) => `"${entry.key}" (a YAML ${entry.kind})`).join(", ")} must be a string: the platform skill catalog reads such a field as absent and ignores the whole file. Write plain text, or wrap the value in double quotes to keep it literally.`;
 	if (!parsed.frontmatter.name) return "Frontmatter must include a name field.";
 	if (!SKILL_NAME_RE.test(parsed.frontmatter.name)) return `Invalid skill name "${parsed.frontmatter.name}" — use lowercase letters, digits, and hyphens.`;
 	if (parsed.frontmatter.name.length > limits.maxNameLength) return `Skill name exceeds ${limits.maxNameLength} characters.`;
 	if (expectedName && parsed.frontmatter.name !== expectedName) return `Frontmatter name "${parsed.frontmatter.name}" does not match target skill "${expectedName}".`;
 	if (!parsed.frontmatter.description) return "Frontmatter must include a description field.";
 	if (parsed.frontmatter.description.length > limits.maxDescriptionLength) return `Description exceeds ${limits.maxDescriptionLength} characters.`;
-	if (content.length > limits.maxSkillContentChars) return `SKILL.md content exceeds ${limits.maxSkillContentChars} characters. Consider splitting into a smaller SKILL.md with supporting files.`;
+	if (exceedsContentLimit(content, limits.maxSkillContentChars) && !shrinksOverLimit(content, current, limits.maxSkillContentChars)) return `SKILL.md content exceeds ${limits.maxSkillContentChars} characters. Consider splitting into a smaller SKILL.md with supporting files.`;
 	return null;
 }
 /**
@@ -5310,7 +5939,8 @@ var SkillLibrary = class {
 			ok: false,
 			message: `Skill "${name}" is protected (${protection}).`
 		};
-		const validation = validateFrontmatter(content, name, this.limits);
+		const currentForLimit = await this.io.readText(path).catch(() => null);
+		const validation = validateFrontmatter(content, name, this.limits, currentForLimit);
 		if (validation) return {
 			ok: false,
 			message: validation
@@ -5322,7 +5952,7 @@ var SkillLibrary = class {
 		};
 		const finalContent = norm.changed ? norm.content : content;
 		if (norm.changed) {
-			const revalidated = validateFrontmatter(finalContent, name, this.limits);
+			const revalidated = validateFrontmatter(finalContent, name, this.limits, currentForLimit);
 			if (revalidated) return {
 				ok: false,
 				message: revalidated
@@ -5447,7 +6077,7 @@ var SkillLibrary = class {
 			let writeContent = patched;
 			let normalizedFields;
 			if (target === skillMd) {
-				const validation = validateFrontmatter(patched, name, this.limits);
+				const validation = validateFrontmatter(patched, name, this.limits, md);
 				if (validation) return {
 					result: {
 						ok: false,
@@ -5466,7 +6096,7 @@ var SkillLibrary = class {
 				if (norm.changed) {
 					writeContent = norm.content;
 					normalizedFields = norm.fields;
-					const revalidated = validateFrontmatter(writeContent, name, this.limits);
+					const revalidated = validateFrontmatter(writeContent, name, this.limits, md);
 					if (revalidated) return {
 						result: {
 							ok: false,
@@ -5483,7 +6113,9 @@ var SkillLibrary = class {
 				},
 				write: null
 			};
-			if (writeContent.length > this.limits.maxSkillContentChars && target === skillMd) return {
+			const overLimit = exceedsContentLimit(writeContent, this.limits.maxSkillContentChars);
+			const repairing = shrinksOverLimit(writeContent, md, this.limits.maxSkillContentChars);
+			if (overLimit && target === skillMd && !repairing) return {
 				result: {
 					ok: false,
 					message: `Patched content exceeds ${this.limits.maxSkillContentChars} characters. Consider splitting into a smaller SKILL.md with supporting files.`
@@ -5577,8 +6209,8 @@ var SkillLibrary = class {
 	* each support dir (write_file's lock sits next to its file). Residual:
 	* NESTED support-subdir locks and the probe→rename TOCTOU itself remain
 	* fail-safe (renameWithRetry rides the write out; the writer's locked
-	* re-read refuses on the moved-away file), and a residue `.lock` from a
-	* CRASHED writer also refuses — correct: inspect, don't archive.
+	* re-read refuses on the moved-away file). v37 (P2-8): a residue `.lock` whose
+	* holder is GONE is not a writer — `decideTakeover` owns that verdict.
 	*/
 	async hasWriteLock(dir) {
 		const markerLocks = MARKER_LOCK_NAMES.map((name) => join(dir, name));
@@ -5597,11 +6229,12 @@ var SkillLibrary = class {
 		}
 		return false;
 	}
-	/** P2 (v17): a file only counts as a writer lock when its body has the
-	* `pid:token` shape the io layer writes. User support files legitimately
-	* named `*.lock` (allowed by SUPPORT_FILE_NAME_RE) must not trip the probe
-	* or be swept as residue — the v16 first cut matched on suffix alone,
-	* which permanently refused archiving and deleted user content on restore. */
+	/** P2 (v17): a `*.lock` file counts as a writer lock only when its body
+	* carries the io layer's protocol — `pid:token`, a bare pid, or an empty body
+	* (a creator between create and body write); anything else is user content
+	* (suffix-only matching refused archiving and deleted user files on restore).
+	* v37 (P2-8): the verdict is `decideTakeover`'s, so the mover refuses exactly
+	* the lock the io layer refuses to reclaim, the 30s empty window included. */
 	async isWriterLock(lockPath) {
 		let body;
 		try {
@@ -5610,7 +6243,19 @@ var SkillLibrary = class {
 			return true;
 		}
 		if (body === null) return false;
-		return LOCK_BODY_RE.test(body.trim());
+		const trimmed = body.trim();
+		if (trimmed !== "" && !/^\d+$/.test(trimmed) && !LOCK_BODY_RE.test(trimmed)) return false;
+		let mtimeMs = null;
+		try {
+			mtimeMs = await this.io.mtime?.(lockPath) ?? null;
+		} catch {
+			mtimeMs = null;
+		}
+		return decideTakeover({
+			body,
+			mtimeMs: mtimeMs ?? Date.now(),
+			alive: isProcessAlive
+		}) === "none";
 	}
 	/** P2 (v16): best-effort removal of lock residue inside a RESTORED tree.
 	* A1-2/A1-7 (v18): the sweep now covers the marker locks the probe checks
@@ -5984,7 +6629,7 @@ var SkillLibrary = class {
 			ok: false,
 			message: "SKILL.md has no valid frontmatter; refusing to restructure."
 		};
-		const header = block.lines.slice(0, block.end + 1).join(block.nl);
+		const header = block.lines.slice(0, block.end + 1).join("\n");
 		const plan = planRestructureSections(md.slice(header.length).replace(/\r\n/g, "\n"), moves);
 		if ("error" in plan) return {
 			ok: false,
@@ -6105,13 +6750,16 @@ var SkillLibrary = class {
 					if (this.transact) {
 						const baseline = entry.expected === void 0 ? entry.previous : entry.expected;
 						const drift = { seen: false };
+						const ran = { done: false };
 						await this.transact(this.io, entry.target, (current) => {
+							ran.done = true;
 							if (current !== baseline) {
 								drift.seen = true;
 								return current;
 							}
 							return entry.content;
 						});
+						if (!ran.done) throw new Error(`internal error: the write transaction for ${entry.target} did not invoke the task; nothing was written`);
 						if (drift.seen) throw new Error(`concurrent modification detected: ${entry.target} changed after the plan was computed (a concurrent writer won the race); no further writes were performed`);
 					} else await this.io.writeText(entry.target, entry.content);
 				} catch (error) {
@@ -6359,11 +7007,18 @@ var SkillLibrary = class {
 			message: `"${filePath}" is not a readable regular file — remove the files inside it one by one.`
 		};
 		let verdict = anchorVerdict(anchor, before);
-		if (verdict === "match" && this.transact) await this.transact(this.io, target, (current) => {
-			verdict = anchorVerdict(anchor, current);
-			return verdict === "match" ? null : current;
-		});
-		else if (verdict === "match") await this.io.remove(target);
+		if (verdict === "match" && this.transact) {
+			const ran = { done: false };
+			await this.transact(this.io, target, (current) => {
+				ran.done = true;
+				verdict = anchorVerdict(anchor, current);
+				return verdict === "match" ? null : current;
+			});
+			if (!ran.done) return {
+				ok: false,
+				message: "internal error: the delete transaction did not invoke the task; nothing was removed"
+			};
+		} else if (verdict === "match") await this.io.remove(target);
 		if (verdict !== "match") return anchorRefusalFile(name, filePath, verdict);
 		await this.audit(name, "remove_file", before, null, `removed ${filePath}`);
 		this.notifyMutation({
@@ -6668,8 +7323,8 @@ var SkillLibrary = class {
 		let rootEntries;
 		try {
 			rootEntries = await this.io.list(this.root);
-		} catch {
-			rootEntries = [];
+		} catch (error) {
+			throw new Error(`snapshot restore refused: the skill root could not be listed (${error instanceof Error ? error.message : String(error)}) — nothing was changed`);
 		}
 		for (const entry of rootEntries) {
 			if (entry === ".archive" || entry === ".backups" || entry === ".mutations.json" || entry === ".curator-suppressed.json") continue;
@@ -6705,5 +7360,11 @@ var SkillLibrary = class {
 		}
 	}
 };
+function newSkillLibrary(options) {
+	const { config, io, limits, ctx, transact, threatExemptLabels } = options;
+	return new SkillLibrary(resolveSkillsRoot(config ?? {}), io, limits, ctx ? (event) => {
+		ctx.emit("evolution/skill-mutated", event);
+	} : void 0, transact, [...threatExemptLabels ?? []]);
+}
 //#endregion
-export { AUTHORING_DESCRIPTION_BAR, COMBINED_REVIEW_PLAN_PROMPT, COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEAD_LOCK_TAKEOVER_MS, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_BOOT_GRACE_SECONDS, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_CURATOR_MODEL, DEFAULT_CURATOR_REVIEW_MAX_TOKENS, DEFAULT_HEALTH_THRESHOLDS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MEMORY_REVIEW_MODEL, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_REVIEW_CONTEXT_MESSAGES, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_MESSAGE_CHARS, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_REVIEW_TIMEOUT_MS, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_MODEL, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_USER_CHAR_LIMIT, DRIFT_MAX_LINE_CHARS, DRIFT_SIGNALS_VERSION, DRIFT_SIGNAL_NOUNS, DSH_AUTHORING_STANDARDS, EMPTY_LOCK_TAKEOVER_MS, ENTRY_DELIMITER, EVENT_ARCHIVE_PREFIX, EVENT_LOG_RETAIN_ARCHIVES, EVENT_LOG_ROTATE_AT, EVENT_LOG_VERSION, EVOLUTION_WRITE_TOOLS, EvolutionGateSet, FORBIDDEN_CONTROL_KEYS, HEALTH_STAMP_RE, LOCK_BODY_RE, LOCK_SUFFIX, LOCK_TEAR_TAKEOVER_MS, LOW_QUALITY_THRESHOLD, LostWriteLock, MAINTAIN_OUTPUT_INSTRUCTION, MAINTAIN_PROMPT, MAX_DESCRIPTION_LENGTH, MAX_RESTRUCTURE_MOVES, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MAX_TIMER_DELAY_MS, MEMORY_GUIDANCE_SECTION_ORDER, MEMORY_REVIEW_PROMPT, MIN_STAMP_BODY_CHARS, MUTATIONS_FILE_VERSION, MemoryStore, PATTERN_OVERLAP, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, QUALITY_WEIGHTS, RESTRUCTURE_TARGET_RE, SKILLS_GUIDANCE, SKILLS_GUIDANCE_SECTION_ORDER, SKILL_ACTION_REQUIRED_FIELDS, SKILL_NAME_RE, SKILL_REVIEW_PLAN_PROMPT, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, SUPPORT_DIRS, SUPPRESSED_FILE_VERSION, SkillLibrary, THREAT_EXEMPTION_HINT, advanceReview, allowRowCollisions, appendEvolutionEvent, applyCuratorFields, applyCuratorLifecycleFields, applyCuratorMetaFields, assertSkillsRootAliasRetired, assessStructureHealth, authoringFeedback, buildCuratorRunReport, buildLearnPrompt, bumpPatch, bumpUse, bumpView, clampedNumber, composePresetComposition, computeDedupGroups, computeDriftSignals, computeLifecycleTransitions, computePrefixClusters, computeQualityScores, computeScopeView, contentHash, createGateSet, decideTakeover, duplicateHeadings, emptyRecord, evaluateThreat, eventsFile, evolutionEventPayloadIssue, evolutionHome, evolutionIoAdapter, evolutionRoot, findDriftSignal, foldCuratorFields, foldTurn, frontmatterBlock, frontmatterCatalogInvalid, getRecord, isCommittedWarning, isProcessAlive, latestActivityAt, lifecycleCandidate, listEventArchives, loadMutations, loadSuppressedNames, loadUsage, makeSerialQueue, markAgentCreated, markerEntryName, memoryRoot, missingSupportPointers, mutateUsage, mutationsFile, narrowNameMatches, nodeEvolutionIo, normalizeFrontmatter, normalizeUsageRecord, observeEvent, overlongLines, parseCuratorNominations, parseEvolutionEvents, parseFrontmatter, parseLockBody, pendingSelfCleanup, readEvolutionEvents, readEvolutionTimeline, recordMutation, redactSecrets, relatedSkillNames, renameWithRetry, renderCuratorReportMarkdown, resolveOrigins, resolveRootConfig, resolveSkillsRoot, retainEventArchives, reviewPrompt, saveSuppressedNames, saveUsage, scanContentThreats, scanMemoryThreats, scanThreats, skillsRoot, suppressedFile, transactIo, updateSuppressedNames, usageFile, usageObserved, validateFrontmatter, validateRestructureTarget, verifyPromptBundle, writeDurableTmp, yamlPlainScalarNeedsQuotes };
+export { AUTHORING_DESCRIPTION_BAR, COMBINED_REVIEW_PLAN_PROMPT, COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEAD_LOCK_TAKEOVER_MS, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_BOOT_GRACE_SECONDS, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_CURATOR_MODEL, DEFAULT_CURATOR_REVIEW_MAX_TOKENS, DEFAULT_HEALTH_THRESHOLDS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MEMORY_REVIEW_MODEL, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_REVIEW_CONTEXT_MESSAGES, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_MESSAGE_CHARS, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_REVIEW_TIMEOUT_MS, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_MODEL, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_USER_CHAR_LIMIT, DISPATCH_EVENT_TYPES, DRIFT_MAX_LINE_CHARS, DRIFT_SIGNALS_VERSION, DRIFT_SIGNAL_NOUNS, DSH_AUTHORING_STANDARDS, EMPTY_LOCK_TAKEOVER_MS, ENTRY_DELIMITER, EVENT_ARCHIVE_PREFIX, EVENT_LOG_RETAIN_ARCHIVES, EVENT_LOG_ROTATE_AT, EVENT_LOG_VERSION, EVOLUTION_WRITE_TOOLS, EvolutionGateSet, FORBIDDEN_CONTROL_KEYS, HEALTH_STAMP_RE, LOCK_BODY_RE, LOCK_SUFFIX, LOCK_TEAR_TAKEOVER_MS, LOW_QUALITY_THRESHOLD, LostWriteLock, MAINTAIN_OUTPUT_INSTRUCTION, MAINTAIN_PROMPT, MAX_DESCRIPTION_LENGTH, MAX_RESTRUCTURE_MOVES, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MAX_TIMER_DELAY_MS, MEMORY_GUIDANCE_SECTION_ORDER, MEMORY_REVIEW_PROMPT, MIN_STAMP_BODY_CHARS, MUTATIONS_FILE_VERSION, MemoryStore, NATIVE_CALL_EVENT, NATIVE_RESULT_EVENT, PATTERN_OVERLAP, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, PTC_DISPATCH_EVENT, PTC_DISPATCH_START_EVENT, QUALITY_WEIGHTS, RESTRUCTURE_TARGET_RE, SKILLS_GUIDANCE, SKILLS_GUIDANCE_SECTION_ORDER, SKILL_ACTION_REQUIRED_FIELDS, SKILL_NAME_RE, SKILL_REVIEW_PLAN_PROMPT, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, SUPPORT_DIRS, SUPPRESSED_FILE_VERSION, SkillLibrary, THREAT_EXEMPTION_HINT, ToolDispatchNormalizer, ToolDispatchPayloadError, advanceReview, allowRowCollisions, appendEvolutionEvent, applyCuratorLifecycleFields, applyCuratorMetaFields, assertDispatchPayload, assertSkillsRootAliasRetired, assessStructureHealth, authoringFeedback, buildCuratorRunReport, buildLearnPrompt, bumpPatch, bumpUse, bumpView, callingScope, clampedNumber, clearReviewChannel, collectReadSkillNames, composePresetComposition, computeDedupGroups, computeDriftSignals, computeLifecycleTransitions, computePrefixClusters, computeQualityScores, computeScopeView, contentHash, countDispatches, createGateSet, decideTakeover, duplicateHeadings, emptyRecord, evaluateThreat, eventsFile, evolutionEventPayloadIssue, evolutionHome, evolutionIoAdapter, evolutionRoot, findDriftSignal, foldCuratorFields, foldToolDispatches, foldTurn, frontmatterBlock, frontmatterCatalogInvalid, getRecord, isAbsent, isCommittedWarning, isGlobalRead, isPresent, isProcessAlive, isProgramToolName, isReviewChannelSession, isSkillReadToolName, isSkillToolName, isUnknown, latestActivityAt, lifecycleCandidate, listEventArchives, loadMutations, loadSuppressedNames, loadUsage, makeSerialQueue, mapProbe, markAgentCreated, markReviewChannel, markerEntryName, memoryRoot, missingSupportPointers, mutateUsage, mutationsFile, narrowNameMatches, neutralizePromptVariables, newSkillLibrary, nodeEvolutionIo, normalizeFrontmatter, normalizeUsageRecord, observeEvent, overlongLines, parseCuratorNominations, parseEvolutionEvents, parseFrontmatter, parseLockBody, pendingSelfCleanup, probeAbsent, probePresent, probeUnknown, readDispatchSignal, readEvolutionEvents, readEvolutionTimeline, recordMutation, redactSecrets, relatedSkillNames, renameWithRetry, renderCuratorReportMarkdown, resolveOrigins, resolveRootConfig, resolveSkillsRoot, retainEventArchives, reviewPrompt, saveSuppressedNames, saveUsage, scanContentThreats, scanMemoryThreats, scanThreats, skillReadNameOf, skillsRoot, suppressedFile, sweepReviewChannelSessions, transactIo, updateSuppressedNames, usageFile, usageObserved, validateFrontmatter, validateRestructureTarget, valueOr, verifyPromptBundle, writeDurableTmp, yamlPlainScalarNeedsQuotes };