@lmzhen/dsh-evolution-core 0.30.17 → 0.30.19

package/lib/subagent/index.js

@@ -1,4 +1,4 @@
-import { h as restrictedPresetId, n as ensureRestrictedPreset, r as restrictedPresetState } from "../ensure-MEYMj9jn.js";
+import { h as restrictedPresetId, n as ensureRestrictedPreset, r as restrictedPresetState } from "../ensure-BuWsjPGD.js";
 //#region lib/types/subagent/readiness.js
 function serviceOf$1(ctx, name) {
 	return ctx.get(name);

package/lib/types/composition/composer.js

@@ -372,7 +372,7 @@ export function presetRowBlock(patchText, rowId) {
     const span = rowBlockSpan(lines, rowId);
     if (span === null)
         return null;
-    const block = [...lines.slice(span.start, span.end)];
+    const block = lines.slice(span.start, span.end);
     while (block.length > 0 && (block[block.length - 1] ?? '').trim() === '')
         block.pop();
     return block.join('\n') + '\n';

package/lib/types/frontmatter.js

@@ -385,7 +385,7 @@ export function yamlPlainScalarNeedsQuotes(value) {
         return true;
     if (/^(?:[-+]?\.inf|\.nan)$/i.test(value))
         return true;
-    if (/^[-?:,[\]{}#&*!|>'\"%@`\s]/.test(value))
+    if (/^[-?:,[\]{}#&*!|>'"%@`\s]/.test(value))
         return true;
     return false;
 }

package/lib/types/http-routes.d.ts

@@ -56,6 +56,8 @@ export declare const HOST_ROUTES: {
     readonly merge: {
         readonly view: "/api/dsh-evolution/merge/view";
         readonly rows: "/api/dsh-evolution/merge/rows";
+        readonly run: "/api/dsh-evolution/merge/run";
+        readonly runs: "/api/dsh-evolution/merge/runs";
         readonly body: "/api/dsh-evolution/merge/body";
         readonly history: "/api/dsh-evolution/merge/history";
     };

package/lib/types/http-routes.js

@@ -53,6 +53,8 @@ export const HOST_ROUTES = {
     merge: {
         view: '/api/dsh-evolution/merge/view',
         rows: '/api/dsh-evolution/merge/rows',
+        run: '/api/dsh-evolution/merge/run',
+        runs: '/api/dsh-evolution/merge/runs',
         body: '/api/dsh-evolution/merge/body',
         history: '/api/dsh-evolution/merge/history',
     },

package/lib/types/index.d.ts

@@ -33,6 +33,10 @@
  */
 export * from './citations.ts';
 export * from './tree-write.ts';
+export * from './unit-storage.ts';
+export * from './unit-journal.ts';
+export * from './unit-transaction.ts';
+export * from './unit-backend.ts';
 export * from './package-identity.ts';
 export * from './write-authority.ts';
 export * from './write-gates.ts';
@@ -80,6 +84,7 @@ export * from './drift-signals.ts';
 export * from './skill-history.ts';
 export * from './unit-members.ts';
 export * from './skill-store.ts';
+export * from './skill-revision.ts';
 export * from './store-ledger.ts';
 export * from './reachability.ts';
 export * from './state-store.ts';

package/lib/types/index.js

@@ -34,6 +34,10 @@
 export * from "./citations.js";
 // G1/1.1: the ONE authority behind a write (its type and the authorityFrom builder).
 export * from "./tree-write.js";
+export * from "./unit-storage.js";
+export * from "./unit-journal.js";
+export * from "./unit-transaction.js";
+export * from "./unit-backend.js";
 export * from "./package-identity.js";
 export * from "./write-authority.js";
 export * from "./write-gates.js";
@@ -81,6 +85,7 @@ export * from "./drift-signals.js";
 export * from "./skill-history.js";
 export * from "./unit-members.js";
 export * from "./skill-store.js";
+export * from "./skill-revision.js";
 export * from "./store-ledger.js";
 export * from "./reachability.js";
 export * from "./state-store.js";

package/lib/types/params.js

@@ -186,7 +186,7 @@ export const PARAM_EXPOSURE = Object.freeze([
     { id: 'threatExemptLabels', group: 'deployment', tier: 'E1', authority: 'cordis', owner: 'evolution-threat', applies: 'none', docAnchor: 'PARAMETERS.md#deployment', summary: 'Threat labels the deployment declares benign (safety surface, never user-writable).', why: 'security' },
     { id: 'evolution-threat.enabled', group: 'deployment', tier: 'E2', authority: 'cordis', owner: 'evolution-threat', applies: 'none', docAnchor: 'PARAMETERS.md#deployment', summary: 'Mount the write-time threat guard at all.', why: 'security' },
     { id: 'evolution-threat.maxScanChars', group: 'deployment', tier: 'E2', authority: 'cordis', owner: 'evolution-threat', applies: 'none', docAnchor: 'PARAMETERS.md#deployment', summary: 'Scan window size of the threat guard.', why: 'security' },
-    { id: 'evolution-approval.enabled', group: 'deployment', tier: 'E2', authority: 'cordis', owner: 'evolution-approval', applies: 'none', docAnchor: 'PARAMETERS.md#deployment', summary: 'Require approval before a staged write executes.', why: 'security' },
+    { id: 'evolution-approval.enabled', group: 'deployment', tier: 'E3', authority: 'cordis', owner: 'evolution-approval', applies: 'live', docAnchor: 'PARAMETERS.md#deployment', summary: 'Master approval switch: run the approval pipeline for foreground writes.', label: '启用批准流水线', hint: '关闭后前台写入不再经批准。', control: 'switch', unit: '', values: '', card: 'evolution-approval' },
     { id: 'evolution-approval.stageForeground', group: 'deployment', tier: 'E2', authority: 'cordis', owner: 'evolution-approval', applies: 'none', docAnchor: 'PARAMETERS.md#deployment', summary: 'Stage foreground agent writes for approval too.', why: 'security' },
     { id: 'evolution-approval.pendingTtlMs', group: 'deployment', tier: 'E3', authority: 'cordis', owner: 'evolution-approval', applies: 'live', docAnchor: 'PARAMETERS.md#deployment', summary: 'How long a staged write may wait before it expires: expired writes are closed as rejected and are NEVER executed; 0 (the default) means the window never expires.', label: '待批过期时间', hint: '一条待批写入最多等多久：超时就按「拒绝」关掉（不会执行，写效果不会落地）；0 = 永不过期（默认）。', control: 'number', unit: '毫秒', values: '', card: 'evolution-approval' },
     { id: 'approvalConfirm', group: 'write-caps', tier: 'E3', authority: 'cordis', owner: 'evolution-approval', applies: 'live', docAnchor: 'PARAMETERS.md#write-caps', summary: 'What the confirmation before an APPROVE does: write straight through, ask first, or treat an unanswered prompt as a cancel. The same three words skillWriteConfirm uses for a skill write.', label: '批准前先确认', hint: '点「批准」时要不要再确认一次：直接执行 / 先确认 / 等待超时即取消。默认直接执行（不打断批量批准）。', control: 'select', unit: '', values: 'auto|ask|timeout', valueLabels: '直接执行|先确认|等待超时即取消', card: 'evolution-approval' },
@@ -208,7 +208,6 @@ export const PARAM_EXPOSURE = Object.freeze([
     { id: 'mergeSkippedTtlDays', group: 'merge', tier: 'E3', authority: 'cordis', owner: 'evolution-merge', applies: 'live', docAnchor: 'PARAMETERS.md#merge', summary: 'Days a skipped pair stays out of screening; 0 means it never expires.', label: '无需合并保留天数', hint: '判定无需合并的对，多少天内不再参与筛选；0 表示一直保留。', control: 'number', unit: '天', values: '', card: 'evolution-merge' },
     { id: 'mergeRunTimeoutMinutes', group: 'merge', tier: 'E3', authority: 'cordis', owner: 'evolution-merge', applies: 'live', docAnchor: 'PARAMETERS.md#merge', summary: 'Wall-clock budget of one merge run; 0 means no limit.', label: '单次运行上限', hint: '一次合并运行最多持续多少分钟；0 表示不设上限。', control: 'number', unit: '分钟', values: '', card: 'evolution-merge' },
     { id: 'mergePairTimeoutMinutes', group: 'merge', tier: 'E2', authority: 'cordis', owner: 'evolution-merge', applies: 'none', docAnchor: 'PARAMETERS.md#merge', summary: 'Wall-clock budget of one pair round (a stuck child guard).', why: 'internal' },
-    { id: 'mergeModelsRoot', group: 'merge', tier: 'E2', authority: 'cordis', owner: 'evolution-merge', applies: 'none', docAnchor: 'PARAMETERS.md#merge', summary: 'Local model root containing the int8 and pca64 model directories; empty falls back to SKILL_MERGE_MODELS_ROOT. No auto provisioning.', why: 'path' },
 ]);
 /** The settings namespace each OWNER PACKAGE registers (design §7.2).
  *

package/lib/types/platform-services.js

@@ -20,9 +20,9 @@ export const PLATFORM_SERVICE_PROBES = Object.freeze([
     { service: 'evolutionApproval', feature: 'pending writes: list, approve and reject from the command surface', side: 'host' },
     { service: 'evolutionCurator', feature: '/evolution curator subcommands, skill undo and history', side: 'host' },
     { service: 'evolutionIo', feature: 'every durable read and write (the IO seam)', side: 'host' },
+    { service: 'evolutionMerge', feature: 'merge command delegation and the merge doctor fact', side: 'host' },
     { service: 'hmr', feature: 'the preset install read-merge-write commit (the platform HMR lock serializes it)', side: 'host' },
     { service: 'evolutionMemoryBudget', feature: 'the memory-budget divergence section of this report', side: 'host' },
-    { service: 'evolutionMerge', feature: 'the merge command and its read-only panel routes', side: 'host' },
     { service: 'evolutionPolicy', feature: 'the policy snapshot that shadows row knobs', side: 'host' },
     { service: 'evolutionReplay', feature: '/evolution replay', side: 'host' },
     { service: 'evolutionState', feature: 'the state facade behind activity and replay', side: 'host' },

package/lib/types/redact.js

@@ -30,7 +30,7 @@ const SECRET_PATTERNS = [
     ['google api key', /AIza[0-9A-Za-z_-]{30,}/g],
     // F-335 (0.3.23): case-insensitive (`bearer`), and `\s+` so a tab or run of
     // spaces between `Bearer` and the token is still masked (`Bearer\t...`).
-    ['bearer credential', /Bearer[\s]+[a-z0-9._~+/=\-]{16,}/gi],
+    ['bearer credential', /Bearer[\s]+[a-z0-9._~+/=-]{16,}/gi],
     // R3 (round-2 audit): HTTP Basic — `Authorization: Basic <base64>` crossed
     // every model boundary: `Basic` was in no value-shape row and
     // `authorization` in no keyword set, so the base64 user:password blob
@@ -117,7 +117,7 @@ const PEM_PRIVATE_KEY_PATTERN = new RegExp(`${PEM_HEAD}[\\s\\S]*?${PEM_TAIL}`, '
 // secret crossed verbatim. Both anchors now tolerate an optional `\r` so the
 // line-paired pass behaves identically on LF and CRLF input (Windows-authored
 // .env / compose / kubectl YAML is the realistic carrier).
-const BLOCK_KEY_ONLY_LINE = /(?:^|\s)([\w-]*[_\-])?((?:token|api[_-]?key|secret|password|passwd)(?:[_\-][\w-]*)?)\s*:(?:\r)?$/i;
+const BLOCK_KEY_ONLY_LINE = /(?:^|\s)([\w-]*[_-])?((?:token|api[_-]?key|secret|password|passwd)(?:[_-][\w-]*)?)\s*:(?:\r)?$/i;
 // S0.3 (v37 P0-2): the two patterns above cannot express a camelCase hump —
 // they are case-INSENSITIVE, so [A-Z] would match lowercase too. This pair
 // decides by a case-insensitive KEYWORD test that rejects a lowercase

package/lib/types/run-registry.d.ts

@@ -75,10 +75,13 @@ export interface RunRecord {
     supersededAt?: number | undefined;
     /** The run this run was spawned from (approve/resume after an earlier command). */
     parentRunId?: string | undefined;
-    /** Merge-side projection; core lifecycle stays four-state. */
+    /** @deprecated Legacy merge projection; read-only compatibility, never written. */
     mergeStatus?: 'running' | 'succeeded' | 'failed' | 'cancelled' | 'awaiting-approval' | 'undone' | 'superseded' | 'interrupted' | 'orphan' | undefined;
+    /** @deprecated Legacy merge projection; read-only compatibility, never written. */
     stagingRef?: string | undefined;
+    /** @deprecated Legacy merge projection; read-only compatibility, never written. */
     pairKey?: string | undefined;
+    /** @deprecated Legacy merge projection; read-only compatibility, never written. */
     pairs?: readonly unknown[] | undefined;
 }
 /** What a started run gets: its id and the signal its work must honour. */
@@ -90,10 +93,13 @@ export interface RunHandle {
     readonly startedAt: number;
     readonly command?: RunCommand | undefined;
     readonly parentRunId?: string | undefined;
-    /** Merge-side projection; core lifecycle stays four-state. */
+    /** @deprecated Legacy merge projection; read-only compatibility, never written. */
     readonly mergeStatus?: 'running' | 'succeeded' | 'failed' | 'cancelled' | 'awaiting-approval' | 'undone' | 'superseded' | 'interrupted' | 'orphan' | undefined;
+    /** @deprecated Legacy merge projection; read-only compatibility, never written. */
     readonly stagingRef?: string | undefined;
+    /** @deprecated Legacy merge projection; read-only compatibility, never written. */
     readonly pairKey?: string | undefined;
+    /** @deprecated Legacy merge projection; read-only compatibility, never written. */
     readonly pairs?: readonly unknown[] | undefined;
 }
 /** How a run ended, as reported by its owner. */
@@ -101,6 +107,7 @@ export interface RunOutcome {
     state: 'succeeded' | 'failed' | 'cancelled';
     resultRef?: string | undefined;
     failure?: string | undefined;
+    /** @deprecated Legacy merge projection; read-only compatibility, never written. */
     mergeStatus?: 'running' | 'succeeded' | 'failed' | 'cancelled' | 'awaiting-approval' | 'undone' | 'superseded' | 'interrupted' | 'orphan' | undefined;
 }
 /** The registry surface the commands row drives. */
@@ -114,6 +121,12 @@ export interface RunRegistry {
         ok: boolean;
         note?: string;
     }>;
+    /** Load and throw on unreadable/invalid index. */
+    ensureLoaded(): Promise<void>;
+    /** The active run after ensureLoaded; explicit read entry. */
+    findActive(kind?: RunKind): Promise<RunRecord | undefined>;
+    /** Whether this run id is currently owned by a live running process (RG0b). */
+    hasOwner(id: string): Promise<boolean>;
     /**
      * Register a new run, arm its cancellation, and return its handle.
      *
@@ -125,13 +138,19 @@ export interface RunRegistry {
         command?: RunCommand;
         total?: number;
         parentRunId?: string;
-        mergeStatus?: 'running' | 'succeeded' | 'failed' | 'cancelled' | 'awaiting-approval' | 'undone' | 'superseded' | 'interrupted' | 'orphan';
-        stagingRef?: string;
-        pairKey?: string;
-        pairs?: readonly unknown[];
     }): Promise<RunHandle>;
     /** Record a run's terminal state (first writer wins). */
     settle(id: string, outcome: RunOutcome): Promise<void>;
+    /**
+     * Settle a run this process does not own: the controlled orphan upgrade.
+     *
+     * Startup recovery runs AFTER `load()` (which materializes the orphan verdict for a
+     * dead owner). A committed unit then proves the run really succeeded, so the verdict
+     * must be upgradeable — but ONLY from an explicit orphan stamp (or a still-running
+     * row whose owner is gone). A run that is genuinely in flight elsewhere is refused.
+     * @returns whether the index now carries the requested terminal state.
+     */
+    settleRecovered(id: string, outcome: RunOutcome): Promise<boolean>;
     /** Record the current stage/progress of a running run. */
     stage(id: string, stage: RunStage, progress?: RunProgress): Promise<void>;
     /** Mark runs as superseded by a tree restore; idempotent. */
@@ -146,6 +165,8 @@ export interface RunRegistry {
     runs(kind?: RunKind): readonly RunRecord[];
     /** One run by id, converged view included. */
     find(id: string): RunRecord | undefined;
+    /** Settle a running run whose owner is gone as failed(orphan). @returns whether a run was running. */
+    settleOrphan(id: string): Promise<boolean>;
     /** Ask a running run to stop; it settles as `cancelled`. @returns whether it was running. */
     cancel(id: string): boolean;
     /** Ask every running run to stop (fiber dispose). @returns how many were running. */

package/lib/types/run-registry.js

@@ -110,10 +110,6 @@ function parseIndex(raw) {
             ...(typeof record.failure === 'string' ? { failure: record.failure } : {}),
             ...(typeof record.supersededAt === 'number' ? { supersededAt: record.supersededAt } : {}),
             ...(typeof record.parentRunId === 'string' ? { parentRunId: record.parentRunId } : {}),
-            ...(record.mergeStatus === 'running' || record.mergeStatus === 'succeeded' || record.mergeStatus === 'failed' || record.mergeStatus === 'cancelled' || record.mergeStatus === 'awaiting-approval' || record.mergeStatus === 'undone' || record.mergeStatus === 'superseded' || record.mergeStatus === 'interrupted' || record.mergeStatus === 'orphan' ? { mergeStatus: record.mergeStatus } : {}),
-            ...(typeof record.stagingRef === 'string' ? { stagingRef: record.stagingRef } : {}),
-            ...(typeof record.pairKey === 'string' ? { pairKey: record.pairKey } : {}),
-            ...(Array.isArray(record.pairs) ? { pairs: record.pairs } : {}),
         });
     }
     return { ok: true, records, foreign, ...(notes.length > 0 ? { note: notes.join('; ') } : {}) };
@@ -139,7 +135,7 @@ export function newRunRegistry(options) {
     /** A row whose owner cannot be reached: `pid` absent (an older build) or not alive. */
     const ownerIsGone = (row) => row.pid === undefined || !isProcessAlive(row.pid);
     /** The verdict is materialized ONCE, so its `endedAt` (and the duration a reader sees) is stable. */
-    const orphanOf = (row) => ({ ...row, state: 'failed', mergeStatus: 'orphan', endedAt: now(), failure: ORPHAN_FAILURE });
+    const orphanOf = (row) => ({ ...row, state: 'failed', endedAt: now(), failure: ORPHAN_FAILURE });
     /** Every row this process knows, newest first. ALL reads go through here. */
     const view = () => [...owned.values(), ...foreign.values()].sort((a, b) => b.startedAt - a.startedAt);
     /** Retained history: every running row plus the newest terminal rows per kind. */
@@ -291,6 +287,26 @@ export function newRunRegistry(options) {
             ].filter((note) => note !== undefined);
             return { ok: true, ...(notes.length > 0 ? { note: notes.join('; ') } : {}) };
         },
+        async ensureLoaded() {
+            const loaded = await this.load();
+            if (!loaded.ok)
+                throw new Error(loaded.note ?? 'runs-unreadable');
+        },
+        async findActive(kind) {
+            await this.ensureLoaded();
+            return this.inFlight(kind);
+        },
+        async hasOwner(id) {
+            await this.ensureLoaded();
+            return this.find(id)?.state === 'running';
+        },
+        async settleOrphan(id) {
+            const run = this.find(id);
+            if (run?.state !== 'running')
+                return false;
+            await this.settle(id, { state: 'failed', failure: 'orphan' });
+            return true;
+        },
         async begin(kind, seed) {
             const id = randomUUID();
             const startedAt = now();
@@ -305,10 +321,6 @@ export function newRunRegistry(options) {
                 pid: process.pid,
                 ...(seed?.command !== undefined ? { command: seed.command } : {}),
                 ...(seed?.parentRunId !== undefined ? { parentRunId: seed.parentRunId } : {}),
-                ...(seed?.mergeStatus !== undefined ? { mergeStatus: seed.mergeStatus } : {}),
-                ...(seed?.stagingRef !== undefined ? { stagingRef: seed.stagingRef } : {}),
-                ...(seed?.pairKey !== undefined ? { pairKey: seed.pairKey } : {}),
-                ...(seed?.pairs !== undefined ? { pairs: seed.pairs } : {}),
                 ...(seed?.total !== undefined ? { progress: { done: 0, total: seed.total } } : {}),
             });
             // Write-through (0.19.1, review P2): answering "started" promises a run another
@@ -340,8 +352,6 @@ export function newRunRegistry(options) {
                 if (row === undefined || row.supersededAt !== undefined)
                     continue;
                 row.supersededAt = now();
-                if (row.kind === 'merge')
-                    row.mergeStatus = 'superseded';
                 changed = true;
             }
             if (changed)
@@ -360,8 +370,6 @@ export function newRunRegistry(options) {
                     if (row.kind !== kind || row.supersededAt !== undefined)
                         continue;
                     row.supersededAt = now();
-                    if (row.kind === 'merge')
-                        row.mergeStatus = 'superseded';
                     marked += 1;
                 }
                 const kept = capped([...merged.values()]);
@@ -383,11 +391,46 @@ export function newRunRegistry(options) {
                 row.resultRef = outcome.resultRef;
             if (outcome.failure !== undefined)
                 row.failure = outcome.failure;
-            if (outcome.mergeStatus !== undefined)
-                row.mergeStatus = outcome.mergeStatus;
             controllers.delete(id);
             await persist();
         },
+        async settleRecovered(id, outcome) {
+            const local = owned.get(id);
+            if (local !== undefined) {
+                await this.settle(id, outcome);
+                return owned.get(id)?.state === outcome.state;
+            }
+            let changed = false;
+            await transactIo(options.io, path, (current) => {
+                const onDisk = parseIndex(current);
+                const row = onDisk.records.find(item => item.id === id);
+                if (row === undefined)
+                    return current;
+                // The two admissible sources: an unresolved running row with a dead owner, or
+                // the orphan verdict load() already materialized. Anything else is a real
+                // terminal answer (someone's cancel/success) and stays put.
+                const recoverable = (row.state === 'running' && ownerIsGone(row))
+                    || (row.state === 'failed' && row.failure === ORPHAN_FAILURE);
+                if (!recoverable)
+                    return current;
+                changed = true;
+                const next = {
+                    ...row,
+                    state: outcome.state,
+                    endedAt: now(),
+                    ...(outcome.resultRef === undefined ? {} : { resultRef: outcome.resultRef }),
+                    ...(outcome.failure === undefined ? {} : { failure: outcome.failure }),
+                };
+                const kept = capped(onDisk.records.map(item => item.id === id ? next : item));
+                const live = kept.filter(item => item.state === 'running');
+                const done = kept.filter(item => TERMINAL.has(item.state));
+                return JSON.stringify({ schemaVersion: RUNS_SCHEMA_VERSION, runs: [...live, ...done, ...onDisk.foreign] }, null, 2);
+            });
+            // Rebuild the foreign view so this process answers the upgraded verdict at once.
+            if (changed)
+                await this.load();
+            return changed;
+        },
         inFlight(kind) {
             return view().find(row => row.state === 'running' && (kind === undefined || row.kind === kind));
         },

package/lib/types/skill-history.d.ts

@@ -36,6 +36,10 @@ export declare const HISTORY_INDEX_VERSION = 1;
 export declare const BASELINE_ACTION = "baseline";
 /** G3b: one unit's head. Exactly one of the two forms is present (they never coexist). */
 export interface UnitHead {
+    /** The merge run this unit belongs to, when the writer recorded one. */
+    runId?: string;
+    /** This unit starts a fresh target baseline; older versions remain listable but outside it. */
+    baseline?: true;
     /** Representative shard: the unit's WHOLE manifest of moves (one entry per written path). */
     moves?: readonly Readonly<Record<string, unknown>>[];
     /** Representative shard: the skills this unit wrote, so members resolve without a directory scan. */

package/lib/types/skill-revision.d.ts

@@ -0,0 +1,37 @@
+/** One support file as read through the store (path is normalized `references/x.md`). */
+export interface RevisionFile {
+    readonly path: string;
+    readonly content: string;
+}
+/** The two-state content anchor: absent (no live skill) or a content hash. */
+export type RevisionAnchor = {
+    readonly kind: 'absent';
+} | {
+    readonly kind: 'present';
+    readonly sha256: string;
+};
+/**
+ * Canonical fingerprint of one skill's content.
+ *
+ * Field order and separators are a wire format: decisions persist anchors derived from
+ * this string, and a later commit compares against it. Do not reorder.
+ * @param name - the (trimmed) skill name.
+ * @param body - the SKILL.md text.
+ * @param files - every support file under SUPPORT_DIRS.
+ * @returns the fingerprint string to hash.
+ */
+export declare function revisionFingerprint(name: string, body: string, files: readonly RevisionFile[]): string;
+/** Hash one fingerprint into its anchor (CRLF-normalized by contentHash). */
+export declare function revisionAnchor(name: string, body: string, files: readonly RevisionFile[]): RevisionAnchor;
+/** Anchor for a skill whose body may be absent. */
+export declare function revisionAnchorOf(name: string, body: string | null, files: readonly RevisionFile[]): RevisionAnchor;
+/**
+ * Support digest over several skills' fingerprints: the union of their full content.
+ *
+ * Sort is by fingerprint (name-prefixed), so name order and fingerprint order agree and
+ * a decision-time digest can be recomputed by a committer that only has hashes.
+ * @param fingerprints - one fingerprint per involved skill (missing skills simply absent).
+ * @returns the digest recorded on a decision and re-checked at commit.
+ */
+export declare function revisionSupportDigest(fingerprints: readonly string[]): string;
+//# sourceMappingURL=skill-revision.d.ts.map

package/lib/types/skill-revision.js

@@ -0,0 +1,45 @@
+/**
+ * Content-revision identity shared by every planner that records a decision and every
+ * committer that re-checks it.
+ *
+ * A skill's revision covers the trimmed NAME, the SKILL.md body and every support file
+ * (`references/…`, `templates/…`, `scripts/…`, `assets/…`), each as read through the
+ * store. The merge domain records a decision-time anchor and the store compares the live
+ * anchor before writing; both sides must hash the same bytes or the compare is meaningless,
+ * so the hash lives HERE and nowhere else.
+ */
+import { contentHash } from "./mutations.js";
+/**
+ * Canonical fingerprint of one skill's content.
+ *
+ * Field order and separators are a wire format: decisions persist anchors derived from
+ * this string, and a later commit compares against it. Do not reorder.
+ * @param name - the (trimmed) skill name.
+ * @param body - the SKILL.md text.
+ * @param files - every support file under SUPPORT_DIRS.
+ * @returns the fingerprint string to hash.
+ */
+export function revisionFingerprint(name, body, files) {
+    const ordered = [...files].sort((left, right) => left.path.localeCompare(right.path));
+    return name + '\u0000' + body + '\u0000' + ordered.map(file => file.path + '\u0000' + file.content).join('\u0000');
+}
+/** Hash one fingerprint into its anchor (CRLF-normalized by contentHash). */
+export function revisionAnchor(name, body, files) {
+    return { kind: 'present', sha256: contentHash(revisionFingerprint(name, body, files)) };
+}
+/** Anchor for a skill whose body may be absent. */
+export function revisionAnchorOf(name, body, files) {
+    return body === null ? { kind: 'absent' } : revisionAnchor(name, body, files);
+}
+/**
+ * Support digest over several skills' fingerprints: the union of their full content.
+ *
+ * Sort is by fingerprint (name-prefixed), so name order and fingerprint order agree and
+ * a decision-time digest can be recomputed by a committer that only has hashes.
+ * @param fingerprints - one fingerprint per involved skill (missing skills simply absent).
+ * @returns the digest recorded on a decision and re-checked at commit.
+ */
+export function revisionSupportDigest(fingerprints) {
+    return contentHash([...fingerprints].sort().join('\u0000'));
+}
+//# sourceMappingURL=skill-revision.js.map

package/lib/types/skill-store.d.ts

@@ -37,6 +37,7 @@ import { transactIo, type EvolutionIoLike } from './io.ts';
 import { type Probe } from './probe.ts';
 import type { SkillLimits } from './limits.ts';
 import { type MutationRecord } from './mutations.ts';
+import { type RevisionAnchor, type RevisionFile } from './skill-revision.ts';
 import { type UnitHead, type SkillVersion } from './skill-history.ts';
 import { type SkillHealthAssessment, type SkillHealthThresholds } from './skill-health.ts';
 import type { EvolutionSkillMutatedEvent } from './events.ts';
@@ -181,6 +182,9 @@ export interface ArchiveOptions {
 }
 /** One multi-skill merge commit: target body + support files, with the source names it absorbs. */
 export interface CommitMergePlan {
+    readonly runId?: string;
+    /** The unit transaction id; history must record this exact id for undo. */
+    readonly unitId?: string;
     readonly target: string;
     /** Whether the target already exists. The caller planned this; commit re-checks it. */
     readonly targetExists: boolean;
@@ -196,12 +200,27 @@ export interface CommitMergePlan {
         readonly name: string;
         readonly body: string;
     }[];
+    /** Stage limits snapshot; absent uses the deployed store limits. */
+    readonly limits?: import('./limits.ts').SkillLimits;
+    readonly targetRevision?: RevisionAnchor;
+    readonly sourceRevisions?: Readonly<Record<string, RevisionAnchor>>;
+    readonly supportDigest?: string;
     readonly origin: WriteOrigin;
     readonly summary: string;
+    /** Real write-phase callback used by UnitTransaction; not persisted. */
+    readonly onPhase?: (phase: 'target-pending' | 'target-applied' | 'target-written' | 'source-archiving' | 'sources-archived' | 'support-pending' | 'unit-written', detail?: {
+        source?: string;
+    }) => void | Promise<void>;
+    /** Phase-boundary cancellation; checked before target/source writes. */
+    readonly signal?: AbortSignal;
+    /** Tree-fence guard; checked before every tree/source write. */
+    readonly assertFence?: () => Promise<boolean>;
 }
 export interface CommitMergeResult {
     readonly ok: boolean;
     readonly message: string;
+    /** Typed refusal kind for the revision CAS (target/source/support changed after the plan). */
+    readonly code?: 'target-changed' | 'source-changed' | 'support-changed';
     readonly unitId?: string;
     readonly targetPath?: string;
     readonly archived?: readonly string[];
@@ -414,7 +433,20 @@ export declare class SkillLibrary {
     }): Promise<SkillSummary[]>;
     read(rawName: string): Promise<string | null>;
     /**
-  
+     * Content anchor of one live skill: name + body + every support file under SUPPORT_DIRS.
+     *
+     * This is the commit-side counterpart of the decision-time anchor recorded by the merge
+     * domain (see skill-revision.ts): both sides call the same fingerprint, so a changed
+     * source, target or support file cannot slip past the commit CAS.
+     * @param rawName - caller-supplied skill name (trimmed here).
+     * @returns present anchor, or absent when the skill has no SKILL.md.
+     */
+    revisionFingerprint(rawName: string): Promise<string | null>;
+    /** Content anchor of one live skill; the hash a decision records and a commit re-checks. */
+    revisionAnchor(rawName: string): Promise<RevisionAnchor>;
+    /** Every support file of one live skill, in listing order; unreadable/missing files fail loud. */
+    liveSupportFiles(rawName: string): Promise<readonly RevisionFile[]>;
+    /**
      * Single path-building choke point (rc.42 audit P2-5): every directory path
   
      * is built from the TRIMMED name, so a name that passes `badName` (which
@@ -444,6 +476,8 @@ export declare class SkillLibrary {
     deleteProtection(rawName: string, options?: {
         allowBundled?: boolean | undefined;
     }): Promise<string | null>;
+    /** Whether the target directory exists at all (a SKILL.md-less ghost still occupies the name). */
+    skillDirExists(rawName: string): Promise<boolean>;
     isManaged(rawName: string): Promise<boolean>;
     /** Whether the skill carries the bundled marker (curator prune-builtins eligibility). */
     isBundled(rawName: string): Promise<boolean>;
@@ -517,6 +551,8 @@ export declare class SkillLibrary {
      * @returns the versions, oldest first.
      */
     listVersions(rawName: string): Promise<SkillVersion[]>;
+    /** Versions from the latest merge baseline onward; old versions stay listable via listVersions. */
+    listBaselineVersions(rawName: string): Promise<SkillVersion[]>;
     /**
      * One version's content, read back from the content-addressed blob store.
      * @param rawName - the skill's name.
@@ -525,6 +561,10 @@ export declare class SkillLibrary {
      *   blob cannot be read — never an empty string.
      */
     readVersion(rawName: string, v: number): Promise<string | null>;
+    /** Read an archived skill's human-readable reason, exact or stamped. */
+    readArchiveReason(rawName: string): Promise<string | null>;
+    /** Read an archived skill body (SKILL.md) by its original name, exact or stamped. */
+    readArchived(rawName: string): Promise<string | null>;
     /**
      * Pin or unpin a skill (`.pinned` marker). Pinned skills are protected from
      * deletion, from background-review writes, and from the lifecycle — a
@@ -567,6 +607,8 @@ export declare class SkillLibrary {
      * P2-4 (v19): a non-string entry (`skills: [123]`) is refused structurally
      * instead of throwing `name.includes is not a function`. */
     private safeSnapshotEntryName;
+    /** Mark merge-absorbed sources archived in the usage sidecar (FR-DATA-07). */
+    private foldArchivedUsage;
     archive(rawName: string, options?: ArchiveOptions, origin?: WriteOrigin): Promise<SkillActionResult>;
     /**
      * Commit one merge plan as a single multi-skill transaction.