@lmzhen/dsh-evolution-core 0.30.18 → 0.30.20

package/lib/types/skill-store.js

@@ -48,8 +48,9 @@ import { makeSerialQueue } from "./serial.js";
 import { h2Sections } from "./document-body.js";
 import { diffFindings } from "./skill-lint.js";
 import { contentHash, loadMutations, recordMutation } from "./mutations.js";
+import { revisionFingerprint, revisionSupportDigest } from "./skill-revision.js";
 import { contentRetentionFeedback, HISTORY_DIR, loadVersionContent, loadVersions, recordVersions } from "./skill-history.js";
-import { suppressedFile, usageFile } from "./usage.js";
+import { getRecord, mutateUsage, suppressedFile, usageFile } from "./usage.js";
 import { assessStructureHealth, DEFAULT_HEALTH_THRESHOLDS, lintBody } from "./skill-health.js";
 import { CONTENT_SPLIT_HINT, DEFAULT_SKILL_VERSION_KEEP, PROTECTED_BUILTIN_SKILLS, SKILL_NAME_RE, SUPPORT_DIRS } from "./constants.js";
 /**
@@ -472,6 +473,12 @@ function serialForRoot(root) {
     ROOT_SERIAL.set(key, created);
     return created;
 }
+/** Same-content test for two revision anchors (absent only equals absent). */
+function sameRevisionAnchor(expected, live) {
+    if (expected.kind !== live.kind)
+        return false;
+    return expected.kind === 'absent' || expected.sha256 === live.sha256;
+}
 export class SkillLibrary {
     root;
     limits;
@@ -861,7 +868,55 @@ export class SkillLibrary {
         }
     }
     /**
-  
+     * Content anchor of one live skill: name + body + every support file under SUPPORT_DIRS.
+     *
+     * This is the commit-side counterpart of the decision-time anchor recorded by the merge
+     * domain (see skill-revision.ts): both sides call the same fingerprint, so a changed
+     * source, target or support file cannot slip past the commit CAS.
+     * @param rawName - caller-supplied skill name (trimmed here).
+     * @returns present anchor, or absent when the skill has no SKILL.md.
+     */
+    async revisionFingerprint(rawName) {
+        const name = rawName.trim();
+        if (this.badName(name) !== null)
+            return null;
+        let body;
+        try {
+            body = await this.io.readText(join(this.dirOf(name), 'SKILL.md'));
+        }
+        catch (error) {
+            if (error?.code === 'EISDIR')
+                return null;
+            throw error;
+        }
+        if (body === null)
+            return null;
+        return revisionFingerprint(name, body, await this.liveSupportFiles(name));
+    }
+    /** Content anchor of one live skill; the hash a decision records and a commit re-checks. */
+    async revisionAnchor(rawName) {
+        const fingerprint = await this.revisionFingerprint(rawName);
+        return fingerprint === null ? { kind: 'absent' } : { kind: 'present', sha256: contentHash(fingerprint) };
+    }
+    /** Every support file of one live skill, in listing order; unreadable/missing files fail loud. */
+    async liveSupportFiles(rawName) {
+        const name = rawName.trim();
+        if (this.badName(name) !== null)
+            return [];
+        const listed = await this.listSupportFiles(name);
+        if (isUnknown(listed))
+            throw new Error('support file list is unknown: ' + name);
+        if (!isPresent(listed))
+            return [];
+        const dir = this.dirOf(name);
+        return await Promise.all(listed.value.map(async (path) => {
+            const content = await this.io.readText(join(dir, ...path.replace(/\\/g, '/').split('/').filter(Boolean)));
+            if (content === null)
+                throw new Error('support file disappeared: ' + name + '/' + path);
+            return { path, content };
+        }));
+    }
+    /**
      * Single path-building choke point (rc.42 audit P2-5): every directory path
   
      * is built from the TRIMMED name, so a name that passes `badName` (which
@@ -1254,6 +1309,18 @@ export class SkillLibrary {
             return [];
         return await loadVersions(this.root, this.io, name);
     }
+    /** Versions from the latest merge baseline onward; old versions stay listable via listVersions. */
+    async listBaselineVersions(rawName) {
+        const versions = await this.listVersions(rawName);
+        let start = -1;
+        for (let index = versions.length - 1; index >= 0; index -= 1) {
+            if (versions[index]?.unitHead?.baseline === true) {
+                start = index;
+                break;
+            }
+        }
+        return start < 0 ? versions : versions.slice(start);
+    }
     /**
      * One version's content, read back from the content-addressed blob store.
      * @param rawName - the skill's name.
@@ -1267,6 +1334,50 @@ export class SkillLibrary {
             return null;
         return await loadVersionContent(this.root, this.io, name, v);
     }
+    /** Read an archived skill's human-readable reason, exact or stamped. */
+    async readArchiveReason(rawName) {
+        const name = rawName.trim();
+        if (this.badName(name) !== null)
+            return null;
+        const archiveRoot = join(this.root, '.archive');
+        const exact = await this.io.readText(join(archiveRoot, name, '.archive-reason'));
+        if (exact !== null)
+            return exact.trim();
+        const entries = await this.io.list(archiveRoot).catch(() => []);
+        for (const entry of [...entries].reverse()) {
+            if (entry !== name && !entry.startsWith(name + '-'))
+                continue;
+            const marker = await this.io.readText(join(archiveRoot, entry, '.archive-name'));
+            if (marker !== null && marker.trim() !== name)
+                continue;
+            const reason = await this.io.readText(join(archiveRoot, entry, '.archive-reason'));
+            if (reason !== null)
+                return reason.trim();
+        }
+        return null;
+    }
+    /** Read an archived skill body (SKILL.md) by its original name, exact or stamped. */
+    async readArchived(rawName) {
+        const name = rawName.trim();
+        if (this.badName(name) !== null)
+            return null;
+        const archiveRoot = join(this.root, '.archive');
+        const exact = await this.io.readText(join(archiveRoot, name, 'SKILL.md'));
+        if (exact !== null)
+            return exact;
+        const entries = await this.io.list(archiveRoot).catch(() => []);
+        for (const entry of [...entries].reverse()) {
+            if (entry !== name && !entry.startsWith(name + '-'))
+                continue;
+            const marker = await this.io.readText(join(archiveRoot, entry, '.archive-name'));
+            if (marker !== null && marker.trim() !== name)
+                continue;
+            const text = await this.io.readText(join(archiveRoot, entry, 'SKILL.md'));
+            if (text !== null)
+                return text;
+        }
+        return null;
+    }
     /**
      * Pin or unpin a skill (`.pinned` marker). Pinned skills are protected from
      * deletion, from background-review writes, and from the lifecycle — a
@@ -1812,6 +1923,19 @@ export class SkillLibrary {
             && !name.includes('/') && !name.includes('\\')
             && basename(name) === name;
     }
+    /** Mark merge-absorbed sources archived in the usage sidecar (FR-DATA-07). */
+    async foldArchivedUsage(sources, at) {
+        try {
+            await mutateUsage(this.root, this.io, map => {
+                for (const name of sources) {
+                    const record = getRecord(map, name);
+                    record.state = 'archived';
+                    record.archived_at = at;
+                }
+            });
+        }
+        catch { /* lifecycle telemetry is best-effort; the archive already landed */ }
+    }
     async archive(rawName, options = {}, origin = this.authority.origin) {
         // One trim per entry: paths (dirOf), validation and messages all see the same name.
         const name = rawName.trim();
@@ -1954,6 +2078,7 @@ export class SkillLibrary {
         const protectedSource = sources.find(name => PROTECTED_BUILTIN_SKILLS.has(name));
         if (protectedSource !== undefined)
             return { ok: false, message: `来源技能「${protectedSource}」是受保护的内置技能。` };
+        const limits = plan.limits ?? this.limits;
         return await this.serial(async () => {
             const dir = this.dirOf(target);
             const targetPath = join(dir, 'SKILL.md');
@@ -1992,7 +2117,38 @@ export class SkillLibrary {
                     return { ok: false, message: `来源技能「${source}」在计划之后被改过；拒绝提交（未写入任何内容）。` };
                 sourceBodies.set(source, body);
             }
-            const validation = validateFrontmatter(plan.body, target, this.limits);
+            // Decision-time CAS (FR-EXEC-12/GAP-CAND-02): the body compare above only covers
+            // SKILL.md; a changed support file (or a changed target body recorded with different
+            // formatting) would still slip through. Re-hash the LIVE tree with the same canonical
+            // fingerprint the decision recorded and refuse before the first write.
+            if (plan.targetRevision !== undefined) {
+                const liveTargetRevision = await this.revisionAnchor(target);
+                if (!sameRevisionAnchor(plan.targetRevision, liveTargetRevision)) {
+                    return { ok: false, code: 'target-changed', message: `目标技能「${target}」的内容在决策之后被改过；拒绝提交（未写入任何内容）。` };
+                }
+            }
+            if (plan.sourceRevisions !== undefined) {
+                for (const [name, expected] of Object.entries(plan.sourceRevisions)) {
+                    if (!sources.includes(name))
+                        continue;
+                    const live = await this.revisionAnchor(name);
+                    if (!sameRevisionAnchor(expected, live)) {
+                        return { ok: false, code: 'source-changed', message: `来源技能「${name}」的内容在决策之后被改过；拒绝提交（未写入任何内容）。` };
+                    }
+                }
+            }
+            if (plan.supportDigest !== undefined) {
+                const fingerprints = [];
+                for (const name of [target, ...sources]) {
+                    const fingerprint = await this.revisionFingerprint(name);
+                    if (fingerprint !== null)
+                        fingerprints.push(fingerprint);
+                }
+                if (revisionSupportDigest(fingerprints) !== plan.supportDigest) {
+                    return { ok: false, code: 'support-changed', message: '参与合并的技能支撑文件在决策之后被改过；拒绝提交（未写入任何内容）。' };
+                }
+            }
+            const validation = validateFrontmatter(plan.body, target, limits);
             if (validation)
                 return { ok: false, message: validation };
             const supportPaths = new Set();
@@ -2004,8 +2160,8 @@ export class SkillLibrary {
                 if (supportPaths.has(file.path))
                     return { ok: false, message: `支撑文件重复：${file.path}` };
                 supportPaths.add(file.path);
-                if (Buffer.byteLength(file.content, 'utf8') > this.limits.maxSkillFileBytes)
-                    return { ok: false, message: `支撑文件超过 ${this.limits.maxSkillFileBytes} 字节：${file.path}` };
+                if (Buffer.byteLength(file.content, 'utf8') > limits.maxSkillFileBytes)
+                    return { ok: false, message: `支撑文件超过 ${limits.maxSkillFileBytes} 字节：${file.path}` };
                 const threat = this.contentThreatBlock(file.content);
                 if (threat)
                     return { ok: false, message: threat };
@@ -2021,7 +2177,7 @@ export class SkillLibrary {
                 if (!existing)
                     return { ok: false, message: `正文引用了未提供的支撑文件「${ref}」；拒绝提交。` };
             }
-            const unitId = 'u-' + Date.now().toString(36) + '-' + (nextUnitSeq += 1).toString(36);
+            const unitId = plan.unitId ?? ('u-' + Date.now().toString(36) + '-' + (nextUnitSeq += 1).toString(36));
             const supportMoves = plan.supportFiles.map((file) => {
                 const previous = supportPrevious.get(file.path) ?? null;
                 return {
@@ -2033,6 +2189,8 @@ export class SkillLibrary {
                 };
             });
             const unitHead = {
+                ...(plan.runId === undefined ? {} : { runId: plan.runId }),
+                baseline: true,
                 moves: supportMoves,
                 sources: [{ skill: target }, ...sources.map(source => ({ skill: source }))],
             };
@@ -2154,6 +2312,7 @@ export class SkillLibrary {
                     archived.push(source);
                 }
                 await plan.onPhase?.('sources-archived');
+                await this.foldArchivedUsage(sources, new Date().toISOString());
                 await plan.onPhase?.('unit-written');
                 return { ok: true, message: `已把 ${sources.join(', ')} 合并进「${target}」。`, unitId, targetPath: dir, archived, mutations: 1 + sources.length };
             }

package/lib/types/unit-backend.js

@@ -7,6 +7,8 @@ export function skillLibraryUnitBackend(skills) {
         },
         async commit(plan, onPhase, signal, assertFence) {
             const result = await skills.commitMerge({
+                ...(plan.runId === undefined ? {} : { runId: plan.runId }),
+                ...(plan.unitId === undefined ? {} : { unitId: plan.unitId }),
                 target: plan.target,
                 targetExists: plan.targetExists,
                 sources: plan.sources,
@@ -16,11 +18,15 @@ export function skillLibraryUnitBackend(skills) {
                 expectedSourceBodies: plan.expectedSourceBodies,
                 origin: plan.origin,
                 summary: plan.summary,
+                ...(plan.skillLimits === undefined ? {} : { limits: plan.skillLimits }),
+                ...(plan.targetRevision === undefined ? {} : { targetRevision: plan.targetRevision }),
+                ...(plan.sourceRevisions === undefined ? {} : { sourceRevisions: plan.sourceRevisions }),
+                ...(plan.supportDigest === undefined ? {} : { supportDigest: plan.supportDigest }),
                 ...(onPhase === undefined ? {} : { onPhase }),
                 ...(signal === undefined ? {} : { signal }),
                 ...(assertFence === undefined ? {} : { assertFence }),
             });
-            return { ok: result.ok, message: result.message, ...(result.archived === undefined ? {} : { archived: result.archived }), ...(result.mutations === undefined ? {} : { mutations: result.mutations }) };
+            return { ok: result.ok, message: result.message, ...(result.code === undefined ? {} : { code: result.code }), ...(result.archived === undefined ? {} : { archived: result.archived }), ...(result.mutations === undefined ? {} : { mutations: result.mutations }) };
         },
         async restoreTarget(name, body) {
             if (body === null) {

package/lib/types/unit-journal.d.ts

@@ -1,6 +1,6 @@
 import type { EvolutionIoLike } from './io.ts';
 export declare const UNIT_JOURNAL_SCHEMA_VERSION = 1;
-export declare const UNIT_JOURNAL_PHASES: readonly ["prepared", "target-pending", "target-written", "source-archiving", "sources-archived", "support-pending", "committed", "failed", "rolled-back"];
+export declare const UNIT_JOURNAL_PHASES: readonly ["prepared", "target-pending", "target-written", "source-archiving", "sources-archived", "support-pending", "unit-written", "committed", "failed", "rolled-back"];
 export type UnitJournalPhase = typeof UNIT_JOURNAL_PHASES[number];
 export interface UnitJournalCheckpoint {
     readonly source: string;

package/lib/types/unit-journal.js

@@ -9,6 +9,7 @@ export const UNIT_JOURNAL_PHASES = [
     'source-archiving',
     'sources-archived',
     'support-pending',
+    'unit-written',
     'committed',
     'failed',
     'rolled-back',

package/lib/types/unit-storage.d.ts

@@ -23,6 +23,11 @@ export interface UnitSnapshot {
     }[];
     readonly origin: string;
     readonly summary: string;
+    readonly validationPlan?: {
+        readonly planVersion: 1;
+        readonly stageDigest: string;
+        readonly revision: string;
+    };
     readonly createdAt: number;
 }
 export interface UnitEvidenceRecord {
@@ -45,6 +50,11 @@ export interface UnitEvidenceRecord {
         absorbedInto: string;
     }[];
     readonly mutations: number;
+    readonly validationPlan?: {
+        readonly planVersion: 1;
+        readonly stageDigest: string;
+        readonly revision: string;
+    };
     readonly at: number;
 }
 export interface UnitIndexEntry {
@@ -76,6 +86,8 @@ export interface UnitReceiptRecord {
     readonly target: string;
     readonly archived: readonly string[];
     readonly at: number;
+    /** Hash of the evidence written after this receipt; set on the final receipt. */
+    readonly evidenceSha256?: string;
 }
 export declare function unitReceiptPath(home: string, unitId: string): string;
 export declare function writeUnitReceipt(io: EvolutionIoLike, home: string, receipt: UnitReceiptRecord): Promise<string>;

package/lib/types/unit-transaction.d.ts

@@ -7,6 +7,8 @@ export interface UnitSupportFile {
 }
 export interface UnitPlan {
     readonly runId: string;
+    /** Filled by the transaction before the backend write; history records it. */
+    readonly unitId?: string;
     readonly pairKey: string;
     readonly target: string;
     readonly targetExists: boolean;
@@ -20,10 +22,32 @@ export interface UnitPlan {
     }[];
     readonly origin: "foreground" | "subagent" | "background_review";
     readonly summary: string;
+    readonly skillLimits?: import("./limits.ts").SkillLimits;
+    readonly limitsDigest?: string;
+    readonly validationPlan?: {
+        readonly planVersion: 1;
+        readonly stageDigest: string;
+        readonly revision: string;
+    };
+    readonly targetRevision?: {
+        readonly kind: 'absent';
+    } | {
+        readonly kind: 'present';
+        readonly sha256: string;
+    };
+    readonly sourceRevisions?: Readonly<Record<string, {
+        readonly kind: 'absent';
+    } | {
+        readonly kind: 'present';
+        readonly sha256: string;
+    }>>;
+    readonly supportDigest?: string;
 }
 export interface UnitCommitResult {
     readonly ok: boolean;
     readonly message: string;
+    /** Typed backend refusal (revision CAS); absent means a generic commit failure. */
+    readonly code?: UnitErrorCode;
     readonly archived?: readonly string[];
     readonly mutations?: number;
 }
@@ -55,7 +79,7 @@ export interface UnitTransactionOptions {
     /** Gate instrumentation: tree fence then target claim. */
     readonly onLock?: (lock: "tree" | "claim") => void;
 }
-export type UnitErrorCode = "unit-plan-missing" | "unit-conflict" | "unit-committed" | "unit-prepare-failed" | "unit-commit-failed" | "unit-claim-failed" | "unit-fence-failed" | "unit-rollback-blocked";
+export type UnitErrorCode = "unit-plan-missing" | "unit-conflict" | "unit-committed" | "unit-prepare-failed" | "unit-commit-failed" | "unit-claim-failed" | "unit-fence-failed" | "unit-rollback-blocked" | "target-changed" | "source-changed" | "support-changed";
 export interface UnitFailure {
     readonly ok: false;
     readonly code: UnitErrorCode;
@@ -101,6 +125,7 @@ export interface UnitTransaction {
         phase: UnitJournalPhase | "none";
     }>;
 }
+export declare function unitEvidenceDigest(evidence: UnitEvidenceRecord): string;
 export declare class UnitTransactions implements UnitTransaction {
     private readonly options;
     private readonly prepared;
@@ -189,7 +214,7 @@ export declare class UnitTransactions implements UnitTransaction {
         phase: "target-pending" | "target-written" | "source-archiving" | "sources-archived";
     } | {
         ok: boolean;
-        phase: "prepared" | "support-pending" | "committed" | "failed" | "rolled-back";
+        phase: "prepared" | "support-pending" | "unit-written" | "committed" | "failed" | "rolled-back";
     }>;
 }
 //# sourceMappingURL=unit-transaction.d.ts.map

package/lib/types/unit-transaction.js

@@ -19,6 +19,20 @@ function canonical(value) {
 function digest(plan) {
     return createHash("sha256").update(canonical(plan)).digest("hex");
 }
+function canonicalJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return '[' + value.map(canonicalJson).join(',') + ']';
+    const object = value;
+    return '{' + Object.keys(object).sort().map(key => JSON.stringify(key) + ':' + canonicalJson(object[key])).join(',') + '}';
+}
+export function unitEvidenceDigest(evidence) {
+    return createHash("sha256").update(canonicalJson({ ...evidence, at: 0, mutations: 0 })).digest("hex");
+}
+function evidenceDigest(evidence) {
+    return createHash("sha256").update(JSON.stringify({ ...evidence, at: 0, mutations: 0 }, null, 2) + "\n").digest("hex");
+}
 export class UnitTransactions {
     options;
     prepared = new Map();
@@ -54,6 +68,7 @@ export class UnitTransactions {
             sourceBefore,
             origin: plan.origin,
             summary: plan.summary,
+            ...(plan.validationPlan === undefined ? {} : { validationPlan: plan.validationPlan }),
             createdAt: this.now(),
         };
     }
@@ -136,13 +151,13 @@ export class UnitTransactions {
         let lock;
         let claim;
         const checkpoints = [];
-        const writePhase = async (phase, checkpointsNext) => {
+        const writePhase = async (phase, checkpointsNext = checkpoints) => {
             if (lock !== undefined && !(await lock.assertHeld()))
                 throw new Error("unit-fence-lost");
             await writeUnitJournal(this.options.io, this.options.home, {
                 ...journalBase,
                 phase,
-                ...(checkpointsNext === undefined ? {} : { checkpoints: checkpointsNext }),
+                checkpoints: checkpointsNext,
             });
             await this.options.onPhase?.(phase);
         };
@@ -157,7 +172,7 @@ export class UnitTransactions {
             claim = await this.options.claim.acquire(stored.plan.target, stored.plan.runId);
             this.options.onLock?.("claim");
             await writeUnitJournal(this.options.io, this.options.home, { ...journalBase, phase: "target-pending" });
-            const result = await this.options.backend.commit(stored.plan, async (phase, detail) => {
+            const result = await this.options.backend.commit({ ...stored.plan, unitId: prepared.unitId }, async (phase, detail) => {
                 if (phase === "support-pending") {
                     await writePhase("support-pending");
                     await this.options.onPhase?.("support-pending");
@@ -179,7 +194,7 @@ export class UnitTransactions {
                         archived: stored.plan.sources.filter((source) => source !== stored.plan.target),
                         at: this.now(),
                     });
-                    await this.options.onPhase?.("unit-written");
+                    await writePhase("unit-written");
                     return;
                 }
                 if (phase === "source-archiving" && detail?.source !== undefined) {
@@ -196,7 +211,7 @@ export class UnitTransactions {
             }, options?.signal, async () => lock !== undefined && (await lock.assertHeld()));
             if (!result.ok) {
                 await writePhase("failed");
-                return { ok: false, code: "unit-commit-failed", message: result.message };
+                return { ok: false, code: result.code ?? "unit-commit-failed", message: result.message };
             }
             const targetAfter = (await this.options.backend.readSkill(stored.plan.target)) ?? "";
             const evidence = {
@@ -221,11 +236,17 @@ export class UnitTransactions {
                     absorbedInto: stored.plan.target,
                 })),
                 mutations: result.mutations ?? 0,
+                ...(stored.plan.validationPlan === undefined ? {} : { validationPlan: stored.plan.validationPlan }),
                 at: this.now(),
             };
             if (!(await lock.assertHeld()))
                 throw new Error("unit-fence-lost");
+            const evidenceSha256 = evidenceDigest(evidence);
             await writeUnitEvidence(this.options.io, this.options.home, evidence);
+            await writeUnitReceipt(this.options.io, this.options.home, {
+                schemaVersion: 1, unitId: prepared.unitId, runId: stored.plan.runId, planDigest: stored.digest,
+                target: stored.plan.target, archived: stored.plan.sources.filter((source) => source !== stored.plan.target), at: this.now(), evidenceSha256,
+            });
             await writePhase("committed", checkpoints);
             this.prepared.delete(prepared.unitId);
             return { ok: true, evidence };
@@ -278,6 +299,16 @@ export class UnitTransactions {
                 code: "unit-rollback-blocked",
                 message: "source checkpoint missing: " + missing.map((item) => item.name).join(","),
             };
+        const liveTarget = await this.options.backend.readSkill(snapshot.target);
+        if (liveTarget === null || liveTarget !== (snapshot.targetAfter ?? null))
+            return { ok: false, code: "unit-rollback-blocked", message: "target live hash does not match the prepared target; manual recovery required" };
+        const liveSources = await Promise.all(snapshot.sourceBefore.map(async (source) => ({ name: source.name, body: await this.options.backend.readSkill(source.name) })));
+        const liveSource = liveSources.find(source => source.body !== null);
+        if (liveSource !== undefined)
+            return { ok: false, code: "unit-rollback-blocked", message: "source is still live: " + liveSource.name };
+        const liveSupport = await Promise.all(snapshot.supportAfter.map(async (file) => ({ path: file.path, content: await this.options.backend.readSupportFile(snapshot.target, file.path) })));
+        if (liveSupport.some(file => file.content !== (snapshot.supportAfter.find(item => item.path === file.path)?.content ?? null)))
+            return { ok: false, code: "unit-rollback-blocked", message: "support file live hash does not match the prepared support; manual recovery required" };
         const evidence = {
             schemaVersion: 1,
             unitId,
@@ -298,8 +329,11 @@ export class UnitTransactions {
                 absorbedInto: snapshot.target,
             })),
             mutations: 0,
+            ...(snapshot.validationPlan === undefined ? {} : { validationPlan: snapshot.validationPlan }),
             at: this.now(),
         };
+        if (receipt?.evidenceSha256 !== undefined && evidenceDigest(evidence) !== receipt.evidenceSha256)
+            return { ok: false, code: "unit-rollback-blocked", message: "receipt evidence hash does not match rebuilt evidence" };
         await writeUnitEvidence(this.options.io, this.options.home, evidence);
         if (journal.phase !== "committed")
             await writeUnitJournal(this.options.io, this.options.home, { ...journal, phase: "committed", checkpoints, updatedAt: this.now() });
@@ -311,7 +345,7 @@ export class UnitTransactions {
             return { ok: true, evidence: existing };
         const snapshot = await readUnitSnapshot(this.options.io, this.options.home, unitId);
         const journal = await readUnitJournal(this.options.io, this.options.home, unitId);
-        if (snapshot === null || journal === null || (journal.phase !== "target-written" && journal.phase !== "sources-archived"))
+        if (snapshot === null || journal === null || !["target-written", "support-pending", "source-archiving", "sources-archived", "unit-written"].includes(journal.phase))
             return {
                 ok: false,
                 code: "unit-rollback-blocked",
@@ -326,8 +360,15 @@ export class UnitTransactions {
                 message: "source checkpoint missing: " + missing.map((item) => item.name).join(","),
             };
         const targetAfter = await this.options.backend.readSkill(snapshot.target);
-        if (targetAfter === null)
-            return { ok: false, code: "unit-rollback-blocked", message: "target missing; manual recovery required" };
+        if (targetAfter === null || targetAfter !== (snapshot.targetAfter ?? null))
+            return { ok: false, code: "unit-rollback-blocked", message: "target missing or drifted; manual recovery required" };
+        const liveSources = await Promise.all(snapshot.sourceBefore.map(async (source) => ({ name: source.name, body: await this.options.backend.readSkill(source.name) })));
+        const liveSource = liveSources.find(source => source.body !== null);
+        if (liveSource !== undefined)
+            return { ok: false, code: "unit-rollback-blocked", message: "source is still live: " + liveSource.name };
+        const liveSupport = await Promise.all(snapshot.supportAfter.map(async (file) => ({ path: file.path, content: await this.options.backend.readSupportFile(snapshot.target, file.path) })));
+        if (liveSupport.some(file => file.content !== (snapshot.supportAfter.find(item => item.path === file.path)?.content ?? null)))
+            return { ok: false, code: "unit-rollback-blocked", message: "support file live hash does not match the prepared support; manual recovery required" };
         const evidence = {
             schemaVersion: 1,
             unitId,
@@ -348,6 +389,7 @@ export class UnitTransactions {
                 absorbedInto: snapshot.target,
             })),
             mutations: 0,
+            ...(snapshot.validationPlan === undefined ? {} : { validationPlan: snapshot.validationPlan }),
             at: this.now(),
         };
         await writeUnitEvidence(this.options.io, this.options.home, evidence);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-core",
   "description": "Shared stores, prompts, signals and lifecycle logic for the dsh-evolution plugin family (community build)",
-  "version": "0.30.18",
+  "version": "0.30.20",
   "publishConfig": {
     "access": "public"
   },