@lmzhen/dsh-evolution-core 0.31.0 → 0.32.0

package/README.md

@@ -50,7 +50,7 @@ section, and importing the package root is its only entry.
 
 ## Events (the family's own, process-local)
 
-Seven process events ride the cordis bus (`evolution-core/src/events.ts` declares the payloads;
+Eight process events ride the cordis bus (`evolution-core/src/events.ts` declares the payloads;
 producers call `ctx.emit`, consumers `ctx.on`). They are NOT session events — appending one to a
 session log made the session unresumable (A-line P0-1), which is why the payload file says so.
 
@@ -62,9 +62,10 @@ session log made the session unresumable (A-line P0-1), which is why the payload
 | `evolution/review-error` | emit (notification) | `evolution-review` failure paths |
 | `evolution/review-completed` | emit (notification) | `evolution-review` after a plugin branch settles |
 | `evolution/memory-applied` | emit (notification) | `memory` after a memory write |
+| `evolution/memory-provider-registered` | emit (notification) | `memory` when a provider registers |
 | `evolution/approval-decided` | emit (notification) | `evolution-approval` after an approval decision lands |
 
-Legacy `evolution/plan-applied` remains declared so old activity ledgers stay readable, but the current production tree has no plan emitter after the review subagent/plan path was removed.
+`evolution/plan-applied` is declared for old activity ledgers; `evolution-review` now emits it from a branch review once that branch settles, with real action counts. `reviewMode: "inject"` still emits none by design.
 
 The mode column is what the code does today: every one of them is an announcement, and each
 declaration carries it as a `@mode` tag (finding O-1, landed) — `verify-arch-guards`' rule **N33** checks that

package/lib/index.js

@@ -573,6 +573,9 @@ function transactTaskGuard(what) {
 /** Lazy adapter over an IO provider registry, shared by every evolution consumer. */
 function evolutionIoAdapter(provider) {
 	return {
+		get processScope() {
+			return provider().processScope;
+		},
 		readText: (path) => provider().readText(path),
 		writeText: (path, content) => provider().writeText(path, content),
 		remove: (path) => provider().remove(path),
@@ -824,6 +827,7 @@ function nodeEvolutionIo() {
 		}
 	};
 	return {
+		processScope: "single-process",
 		async readText(path) {
 			try {
 				return await readFile(path, "utf8");
@@ -1037,13 +1041,14 @@ function atomicWriteFiles(targetDir, writes, fs = defaultFs, logger = console.wa
 //#endregion
 //#region lib/types/tree-lock.js
 /**
-* Cross-process tree write lock.
+* Tree write lock.
 *
 * The merge run holds this lock for its whole lifetime; curator's pass takes the same
-* lock. The lock is a cooperative file record, created through `transactIo` so two
-* processes cannot both win the create. A holder whose pid is gone is stale and may be
-* taken over; a live pid is always respected, even for a long run (a live long run is
-* exactly what the lock protects).
+* lock. The record is created through `transactIo`, so exclusion is exactly as strong as
+* the IO backend's `transact`: the platform `ctx.fs` provider is cross-process, while the
+* standalone `nodeEvolutionIo` is explicitly single-process (G2 S4). This module builds no
+* file lock or WAL of its own. A holder whose pid is gone is stale and may be taken over;
+* a live pid is respected, even for a long run (a live long run is what the lock protects).
 *
 * `commitMerge` deliberately does NOT take this lock itself: the run shell owns it, so a
 * run and its commit share one acquisition. Taking it inside the store would also
@@ -2402,7 +2407,6 @@ const DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS = 20;
 const DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS = 3;
 const DEFAULT_SUBSTANTIVE_MIN_USER_CHARS = 200;
 const DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS = 500;
-const DEFAULT_MAX_OPS_PER_PLAN = 32;
 const DEFAULT_CURATOR_INTERVAL_HOURS = 168;
 const DEFAULT_MIN_IDLE_HOURS = 2;
 const DEFAULT_STALE_AFTER_DAYS = 30;
@@ -5905,9 +5909,10 @@ function buildLearnPrompt(userRequest) {
 /**
 * A process-local serial task queue: each task starts only after the previous
 * one settles (success or failure), so read-modify-write sequences that share
-* one file never interleave inside this process. The durable cross-process
-* serialization layer is the IO backend's transact lock; this chain is the
-* second layer (0.3.17 S2.8, T-1: the shape was duplicated in state-json and
+* one file never interleave inside this process. When the IO backend provides
+* a cross-process transact lock, that is the first layer; the node backend does
+* not, so this chain is its only serialization. (0.3.17 S2.8, T-1: the shape was
+* duplicated in state-json and
 * memory-files — one factory now).
 */
 function makeSerialQueue() {
@@ -9160,6 +9165,11 @@ const PLATFORM_SERVICE_PROBES = Object.freeze([
 		feature: "the state facade behind activity and replay",
 		side: "host"
 	},
+	{
+		service: "evolutionStateStore",
+		feature: "generic durable state store for assignment queue and future collections",
+		side: "host"
+	},
 	{
 		service: "llm",
 		feature: "the curator one-shot review model call",
@@ -9247,8 +9257,9 @@ function absentHostServices(has) {
 * B3 / G4 (0.3.78): the family's single-instance contract, made explicit.
 *
 * Every persisted sidecar is written under TWO assumptions: the IO backend's
-* cross-process write lock serializes different processes, and exactly ONE
-* instance of each writer service exists per evolution home. The second half
+* transact serializes different processes when the provider guarantees it (the
+* node backend is process-local only), and exactly ONE instance of each writer
+* service exists per evolution home. The second half
 * was implicit — `makeSerialQueue()` and the module-scope stores are
 * per-instance, so two rows writing one home interleave inside one file (the
 * "two instances, one file" class). This module makes that half enforceable: a
@@ -9265,8 +9276,9 @@ function absentHostServices(has) {
 * `claims` below is a module-scope Map: two ROWS over one home in ONE process
 * contend, while the SAME home in another process gets its own Map and is
 * granted the key. That is by construction, not a gap to close here — the
-* cross-process half of the contract is the IO backend's write lock
-* (`transactIo`, core/io.ts), which serializes a per-target read-modify-write.
+* cross-process half of the contract is the IO backend's transact
+* (`transactIo`, core/io.ts) when the provider guarantees it; the node backend
+* is process-local, so a shared home across processes is not protected by it alone.
 * The FLOW2-1 finding was three call sites reading a GRANTED claim as "no other
 * process can be doing this work", so the caller contract is stated here:
 * - granted means "no other row OF THIS PROCESS owns the key";
@@ -10216,9 +10228,8 @@ function foldTurnEvents(events, fromSeq = 0) {
 /**
 * Which session frames are EVIDENCE, and which are bookkeeping.
 *
-* A plan op must cite `evidence` seqs, and the validator's range rule
-* (`evolution-plan-validator`, rule `EVIDENCE_RANGE`) answers only "is this an integer inside
-* the window the plan was authored against". A boundary frame satisfies that while carrying
+* The session's evidence index answers "does this seq carry content"; a bare range check used
+* to accept any integer inside the authoring window. A boundary frame satisfies that while carrying
 * nothing a claim can rest on: the `turn/start` seq is the frame a claim about that turn was
 * most likely read out of, and citing it is indistinguishable from citing a real exchange. This
 * module owns the ONE classification of a session frame by what it CARRIES, so the plan path can
@@ -17299,17 +17310,6 @@ const PARAM_EXPOSURE = Object.freeze([
 		summary: "Name this package registers as the memory provider.",
 		why: "identity"
 	},
-	{
-		id: "maxOpsPerPlan",
-		group: "deployment",
-		tier: "E2",
-		authority: "cordis",
-		owner: "evolution-plan-validator",
-		applies: "none",
-		docAnchor: "PARAMETERS.md#deployment",
-		summary: "Operation cap one staged plan may carry.",
-		why: "internal"
-	},
 	{
 		id: "substantiveMinToolCalls",
 		group: "deployment",
@@ -18247,4 +18247,4 @@ function isIgnorableEvent(event) {
 	return classifySessionEvent(event) !== "model";
 }
 //#endregion
-export { AUTHORING_DESCRIPTION_BAR, AUTHORING_SPLIT_LINE_CHARS, BASELINE_ACTION, CITATION_SUPPORT_DIRS, COMBINED_REVIEW_PLAN_PROMPT, COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CONTENT_SPLIT_HINT, COST_ASCII_TOKEN_HIGH, COST_ASCII_TOKEN_LOW, COST_CJK_TOKEN_HIGH, COST_CJK_TOKEN_LOW, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEDUP_MAX_PAIR_COMPARISONS, DEDUP_SIMILARITY_THRESHOLD, DEFAULT_ADMISSION, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_ARCHIVE_RETENTION_POLICY, DEFAULT_CITATION_POLICY, DEFAULT_CITATION_REF_BUDGET, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_BOOT_GRACE_SECONDS, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_CURATOR_MODEL, DEFAULT_CURATOR_REVIEW_MAX_TOKENS, DEFAULT_HEALTH_THRESHOLDS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_PROBE_TIMEOUT_MS, DEFAULT_REFERENCE_REWRITE_POLICY, DEFAULT_REVIEW_CONTEXT_MESSAGES, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_MESSAGE_CHARS, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_REVIEW_TIMEOUT_MS, DEFAULT_RUN_RECORDS, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_SKILL_VERSION_KEEP, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_SUPPORT_FILE_CHAR_POLICY, DEFAULT_SUPPORT_READ_TOOL_NAMES, DEFAULT_THREAT_MAX_SCAN_CHARS, DEFAULT_USER_CHAR_LIMIT, DEFAULT_WRITE_CONFIRM_MODE, DEFAULT_WRITE_CONFIRM_TIMEOUT_SECONDS, DIAGNOSTICS_FACT_KEYS, DIAGNOSTICS_RUNTIME_KEYS, DIAGNOSTICS_VIEW_SCHEMA_VERSION, DISPATCH_EVENT_TYPES, DRIFT_MAX_LINE_CHARS, DRIFT_SIGNALS_VERSION, DRIFT_SIGNAL_NOUNS, DSH_AUTHORING_STANDARDS, ENTRY_DELIMITER, EVENT_ARCHIVE_PREFIX, EVENT_LOG_RETAIN_ARCHIVES, EVENT_LOG_ROTATE_AT, EVENT_LOG_VERSION, EVOLUTION_ERRORS, EVOLUTION_PRESET_IDS, EVOLUTION_WRITE_TOOLS, EXTRACT_PROMPT_HASH, EXTRACT_PROMPT_V1, EXTRACT_PROMPT_VERSION, EvolutionGateSet, FAMILY_SESSION_TOOL_NAMES, FORBIDDEN_CONTROL_KEYS, FUZZY_MAX_PATTERN_CHARS, FUZZY_MAX_WORK, HEALTH_STAMP_RE, HISTORY_DIR, HISTORY_INDEX_VERSION, HOOK_LINE_RE, HOST_ROUTES, INSTANCE_KEYS, KEEP_LINE_RE, LONG_RUNS, LOW_QUALITY_THRESHOLD, MAINTAINER_PRESET_ID, MAINTAIN_OUTPUT_INSTRUCTION, MAINTAIN_PROMPT, MAX_DESCRIPTION_LENGTH, MAX_REQUEST_BODY_BYTES, MAX_RESTRUCTURE_MOVES, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MAX_SUPPORT_READ_PATHS, MAX_TIMER_DELAY_MS, MEMORY_GUIDANCE_SECTION_ORDER, MEMORY_REVIEW_PROMPT, MIN_STAMP_BODY_CHARS, MODEL_SESSION_EVENT_TYPES as MODEL_SESSION_EVENTS, MODEL_SESSION_EVENT_TYPES, MUTATIONS_FILE_VERSION, MemoryStore, MutationUnit, NAMESPACE_MIGRATIONS, NATIVE_CALL_EVENT, NATIVE_RESULT_EVENT, PARAM_ALIASES, PARAM_EXPOSURE, PARAM_GROUP_LABELS, PARAM_NAMESPACES, PATTERN_OVERLAP, PLATFORM_CATALOG_DESCRIPTION_DEFAULT, PLATFORM_ESTIMATE_CHARS_PER_TOKEN, PLATFORM_LINE, PLATFORM_SERVICE_PROBES, POLICY_STAGE_DEFAULTS, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, PTC_DISPATCH_EVENT, PTC_DISPATCH_START_EVENT, QUALITY_WEIGHTS, READ_REQUIRED_ACTIONS, RESTRICTED_PRESET_DISPLAY, RESTRICTED_TOOLS_ROW_ID, RESTRICTOR_MODULE, RESTRUCTURE_TARGET_RE, RETENTION_FEEDBACK_KEEP_RATIO, RETENTION_FEEDBACK_MIN_CHARS, REVIEWER_PRESET_ID, RULES, RUNS_SCHEMA_VERSION, SKILLS_GUIDANCE, SKILLS_GUIDANCE_SECTION_ORDER, SKILL_ACTION_REQUIRED_FIELDS, SKILL_NAME_RE, SKILL_REVIEW_PLAN_PROMPT, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, STORE_LEDGER, SUMMARY_DUPLICATE_HINT_THRESHOLD, SUPPORT_DIRS, SUPPORT_SPRAWL_FILES, SUPPRESSED_FILE_VERSION, SkillLibrary, SkillModel, TEXT_DIFF_MAX_CHARS, TEXT_DIFF_MAX_LINES, THREAT_EXEMPTION_HINT, TOKEN_ASCII_WEIGHT, TOKEN_CJK_WEIGHT, ToolDispatchNormalizer, ToolDispatchPayloadError, UNIT_JOURNAL_PHASES, UNIT_JOURNAL_SCHEMA_VERSION, UNIT_STORAGE_SCHEMA_VERSION, UNTRUSTED_LINE_BREAK, UNTRUSTED_LINE_MARK, UPSTREAM_LIMIT_CHARS_PER_TOKEN, UnitTransactions, VERSION_SUMMARY_MAX_CHARS, absentHostServices, acquireTreeWriteLock, admissionVerdict, advanceReview, affinity, ageCopyKey, allowRowCollisions, anchorVerdict, appendEvolutionEvent, applyCuratorLifecycleFields, applyCuratorMetaFields, applyNamespaceMigration, applyReferenceRewrite, asRecord, assertDispatchPayload, assertSkillsRootAliasRetired, assertUnitJournalTransition, assessStructureHealth, atomicWriteFiles, authoringFeedback, authorityFrom, backupsReachability, blobPath, bodyCost, buildCuratorRunReport, buildExtractPlanFromLibrary, buildHealthBaseline, buildLearnPrompt, bumpPatch, bumpSupportRead, bumpUse, bumpView, callingScope, candidateSkills, canonicalWriteId, claimInstance, clampOnce, clampedNumber, classifyNamespaceMigration, classifySessionEvent, clearReviewChannel, collectReadSkillNames, computeDedupGroups, computeDriftSignals, computeLifecycleTransitions, computePrefixClusters, computeQualityScores, computeScopeView, contentHash, contentRetentionFeedback, countDispatches, countReferenceFiles, createGateSet, createSubagentChannel, daysSinceIso, declaredReportStamp, describeReferenceRewrite, diffFindings, dispatchKeyOf, dispatchStepOf, displayBodyOf, duplicateHeadings, elapsedSince, emptyRecord, ensureSkillFrontmatter, entryTarget, errorText, evaluateThreat, eventsFile, evidenceKindIndex, evolutionActivityProjection, evolutionEventPayloadIssue, evolutionEvidenceProjection, evolutionHome, evolutionIoAdapter, evolutionReadsProjection, evolutionRoot, evolutionSignalsProjection, executeUnitUndo, externalRefs, fileMutationLock, filterUnreadSkillOps, findDriftSignal, findOwnerCandidate, foldCuratorFields, foldToolDispatches, foldTurnEvent, foldTurnEvents, foldUntrustedLines, frontmatterBlock, frontmatterCatalogInvalid, fuzzyPatch, getRecord, h2Sections, historyIndexFile, historyReachability, historyRoot, hostSurface, identity, idleDays, initialTurnFold, installEvolutionProjections, instanceClaimKey, instanceClaimedWriteSites, instanceHolder, isAbsent, isBookkeepingFrame, isCommittedWarning, isDeprecatedParamId, isFileShapedPath, isIgnorableEvent, isLandmark, isMissingPath, isPresent, isProcessAlive, isProgramToolName, isRecord, isReviewChannelSession, isSkillReadToolName, isSkillToolName, isUnknown, isUnreadWrite, json, landmarkVerdict, latestActivityAt, latestVersionAt, lifecycleCandidate, lintBody, lintSkill, listEventArchives, liveBool, liveEnum, liveNumber, liveString, loadMutations, loadSuppressedNames, loadUsage, loadVersionContent, loadVersions, makeSerialQueue, mapProbe, markAgentCreated, markReviewChannel, markerEntryName, memoryRoot, methodNotAllowed, missingSupportPointers, mutateUsage, mutationsFile, narrowNameMatches, nearDuplicateSummaries, newRunRegistry, newSkillLibrary, nextHistoryIndex, nodeEvolutionIo, normalizeFrontmatter, normalizeUsageRecord, normalizeVersionSummary, observeEvent, orderVersions, overlongLines, ownerCandidatesFromSummaries, ownerDecisionText, paramNamespace, paramRowId, paramSettingsId, parseCuratorNominations, parseEvolutionEvents, parseFrontmatter, parseHistoryIndex, partitionVersions, payloadText, persistedWriteSite, persistedWriteSites, pickWithPolicy, planExtract, planNamespaceMigration, planReferenceRewrite, planRehoming, planUnitUndoAcross, policyStageLimits, probeAbsent, probeChannelState, probeList, probeMtime, probePresent, probeReason, probeText, probeUnknown, projectExtractBodies, projectionText, proposalFromPlan, proposalReportDir, proposalReportName, protectedSkillNamesOf, readDispatchSignal, readEvolutionEvents, readEvolutionTimeline, readExternalSupport, readHistoryIndex, readJsonObject, readNumberParam, readParam, readProposalReports, readTreeLock, readUnitEvidence, readUnitIndex, readUnitJournal, readUnitReceipt, readUnitSnapshot, readingStats, recordMutation, recordVersions, redactSecrets, referencedBlobs, registerHostRoutes, relatedSkillNames, releaseInstance, renameWithRetry, renderCuratorReportMarkdown, renderLongRunTable, reportTime, reportsReachability, reportsSweepLockTarget, resolveCitations, resolveExecOrigins, resolveOrigins, resolveParamId, resolveRootConfig, resolveSkillsRoot, resolveUnitMembers, resolveUnitMembersFromIndexes, restructureCandidates, retainEventArchives, retirementReport, reviewPrompt, revisionAnchor, revisionAnchorOf, revisionFingerprint, revisionSupportDigest, runWriteGates, runsFile, saveSuppressedNames, saveUsage, scanBodyHooks, scanContentThreats, scanMemoryThreats, scanThreats, scopeOfNearestManifest, scopedPackageName, scopedProbeReport, selectSections, sessionAudited, sessionEvidenceIndex, sessionLastEventTime, sessionReadNames, sessionReadSkillNames, sessionSeesFamilyTools, sessionTurnSignals, skillLibraryUnitBackend, skillReadNameOf, skillRowCells, skillStateKey, skillWriteGateContext, skillsRoot, staleRouteStubs, subagentChannelState, supportFileReadOf, supportRefs, suppressedFile, sweepReports, sweepReviewChannelSessions, textDiffFacts, tokenLineFor, transactIo, transactTaskGuard, treeLockFile, trimPatternBoundaries, unhookedSupportPointers, unitEvidenceDigest, unitEvidencePath, unitIndexPath, unitJournalPath, unitJournalPhaseRank, unitJournalPort, unitMembersAreComplete, unitReceiptPath, unitSnapshotPath, unitSnapshotPort, unitSnapshotsDir, unitStorageKey, unwrapLive, updateSuppressedNames, upsertUnitIndex, usageFile, usageObserved, userSetKeys, validateFrontmatter, validateMutationRequest, validateRestructureTarget, validateSupportPath, valueOr, verifyPromptBundle, versionActionKind, versionRowCells, versionSummaryPrompt, versionTarget, vocabulary, withTreeWrite, withTreeWriteLock, writeDurableTmp, writePathSymbols, writeProposalReport, writeUnitEvidence, writeUnitJournal, writeUnitReceipt, writeUnitSnapshot, yamlPlainScalarNeedsQuotes };
+export { AUTHORING_DESCRIPTION_BAR, AUTHORING_SPLIT_LINE_CHARS, BASELINE_ACTION, CITATION_SUPPORT_DIRS, COMBINED_REVIEW_PLAN_PROMPT, COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CONTENT_SPLIT_HINT, COST_ASCII_TOKEN_HIGH, COST_ASCII_TOKEN_LOW, COST_CJK_TOKEN_HIGH, COST_CJK_TOKEN_LOW, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEDUP_MAX_PAIR_COMPARISONS, DEDUP_SIMILARITY_THRESHOLD, DEFAULT_ADMISSION, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_ARCHIVE_RETENTION_POLICY, DEFAULT_CITATION_POLICY, DEFAULT_CITATION_REF_BUDGET, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_BOOT_GRACE_SECONDS, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_CURATOR_MODEL, DEFAULT_CURATOR_REVIEW_MAX_TOKENS, DEFAULT_HEALTH_THRESHOLDS, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_PROBE_TIMEOUT_MS, DEFAULT_REFERENCE_REWRITE_POLICY, DEFAULT_REVIEW_CONTEXT_MESSAGES, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_MESSAGE_CHARS, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_REVIEW_TIMEOUT_MS, DEFAULT_RUN_RECORDS, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_SKILL_VERSION_KEEP, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_SUPPORT_FILE_CHAR_POLICY, DEFAULT_SUPPORT_READ_TOOL_NAMES, DEFAULT_THREAT_MAX_SCAN_CHARS, DEFAULT_USER_CHAR_LIMIT, DEFAULT_WRITE_CONFIRM_MODE, DEFAULT_WRITE_CONFIRM_TIMEOUT_SECONDS, DIAGNOSTICS_FACT_KEYS, DIAGNOSTICS_RUNTIME_KEYS, DIAGNOSTICS_VIEW_SCHEMA_VERSION, DISPATCH_EVENT_TYPES, DRIFT_MAX_LINE_CHARS, DRIFT_SIGNALS_VERSION, DRIFT_SIGNAL_NOUNS, DSH_AUTHORING_STANDARDS, ENTRY_DELIMITER, EVENT_ARCHIVE_PREFIX, EVENT_LOG_RETAIN_ARCHIVES, EVENT_LOG_ROTATE_AT, EVENT_LOG_VERSION, EVOLUTION_ERRORS, EVOLUTION_PRESET_IDS, EVOLUTION_WRITE_TOOLS, EXTRACT_PROMPT_HASH, EXTRACT_PROMPT_V1, EXTRACT_PROMPT_VERSION, EvolutionGateSet, FAMILY_SESSION_TOOL_NAMES, FORBIDDEN_CONTROL_KEYS, FUZZY_MAX_PATTERN_CHARS, FUZZY_MAX_WORK, HEALTH_STAMP_RE, HISTORY_DIR, HISTORY_INDEX_VERSION, HOOK_LINE_RE, HOST_ROUTES, INSTANCE_KEYS, KEEP_LINE_RE, LONG_RUNS, LOW_QUALITY_THRESHOLD, MAINTAINER_PRESET_ID, MAINTAIN_OUTPUT_INSTRUCTION, MAINTAIN_PROMPT, MAX_DESCRIPTION_LENGTH, MAX_REQUEST_BODY_BYTES, MAX_RESTRUCTURE_MOVES, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MAX_SUPPORT_READ_PATHS, MAX_TIMER_DELAY_MS, MEMORY_GUIDANCE_SECTION_ORDER, MEMORY_REVIEW_PROMPT, MIN_STAMP_BODY_CHARS, MODEL_SESSION_EVENT_TYPES as MODEL_SESSION_EVENTS, MODEL_SESSION_EVENT_TYPES, MUTATIONS_FILE_VERSION, MemoryStore, MutationUnit, NAMESPACE_MIGRATIONS, NATIVE_CALL_EVENT, NATIVE_RESULT_EVENT, PARAM_ALIASES, PARAM_EXPOSURE, PARAM_GROUP_LABELS, PARAM_NAMESPACES, PATTERN_OVERLAP, PLATFORM_CATALOG_DESCRIPTION_DEFAULT, PLATFORM_ESTIMATE_CHARS_PER_TOKEN, PLATFORM_LINE, PLATFORM_SERVICE_PROBES, POLICY_STAGE_DEFAULTS, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, PTC_DISPATCH_EVENT, PTC_DISPATCH_START_EVENT, QUALITY_WEIGHTS, READ_REQUIRED_ACTIONS, RESTRICTED_PRESET_DISPLAY, RESTRICTED_TOOLS_ROW_ID, RESTRICTOR_MODULE, RESTRUCTURE_TARGET_RE, RETENTION_FEEDBACK_KEEP_RATIO, RETENTION_FEEDBACK_MIN_CHARS, REVIEWER_PRESET_ID, RULES, RUNS_SCHEMA_VERSION, SKILLS_GUIDANCE, SKILLS_GUIDANCE_SECTION_ORDER, SKILL_ACTION_REQUIRED_FIELDS, SKILL_NAME_RE, SKILL_REVIEW_PLAN_PROMPT, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, STORE_LEDGER, SUMMARY_DUPLICATE_HINT_THRESHOLD, SUPPORT_DIRS, SUPPORT_SPRAWL_FILES, SUPPRESSED_FILE_VERSION, SkillLibrary, SkillModel, TEXT_DIFF_MAX_CHARS, TEXT_DIFF_MAX_LINES, THREAT_EXEMPTION_HINT, TOKEN_ASCII_WEIGHT, TOKEN_CJK_WEIGHT, ToolDispatchNormalizer, ToolDispatchPayloadError, UNIT_JOURNAL_PHASES, UNIT_JOURNAL_SCHEMA_VERSION, UNIT_STORAGE_SCHEMA_VERSION, UNTRUSTED_LINE_BREAK, UNTRUSTED_LINE_MARK, UPSTREAM_LIMIT_CHARS_PER_TOKEN, UnitTransactions, VERSION_SUMMARY_MAX_CHARS, absentHostServices, acquireTreeWriteLock, admissionVerdict, advanceReview, affinity, ageCopyKey, allowRowCollisions, anchorVerdict, appendEvolutionEvent, applyCuratorLifecycleFields, applyCuratorMetaFields, applyNamespaceMigration, applyReferenceRewrite, asRecord, assertDispatchPayload, assertSkillsRootAliasRetired, assertUnitJournalTransition, assessStructureHealth, atomicWriteFiles, authoringFeedback, authorityFrom, backupsReachability, blobPath, bodyCost, buildCuratorRunReport, buildExtractPlanFromLibrary, buildHealthBaseline, buildLearnPrompt, bumpPatch, bumpSupportRead, bumpUse, bumpView, callingScope, candidateSkills, canonicalWriteId, claimInstance, clampOnce, clampedNumber, classifyNamespaceMigration, classifySessionEvent, clearReviewChannel, collectReadSkillNames, computeDedupGroups, computeDriftSignals, computeLifecycleTransitions, computePrefixClusters, computeQualityScores, computeScopeView, contentHash, contentRetentionFeedback, countDispatches, countReferenceFiles, createGateSet, createSubagentChannel, daysSinceIso, declaredReportStamp, describeReferenceRewrite, diffFindings, dispatchKeyOf, dispatchStepOf, displayBodyOf, duplicateHeadings, elapsedSince, emptyRecord, ensureSkillFrontmatter, entryTarget, errorText, evaluateThreat, eventsFile, evidenceKindIndex, evolutionActivityProjection, evolutionEventPayloadIssue, evolutionEvidenceProjection, evolutionHome, evolutionIoAdapter, evolutionReadsProjection, evolutionRoot, evolutionSignalsProjection, executeUnitUndo, externalRefs, fileMutationLock, filterUnreadSkillOps, findDriftSignal, findOwnerCandidate, foldCuratorFields, foldToolDispatches, foldTurnEvent, foldTurnEvents, foldUntrustedLines, frontmatterBlock, frontmatterCatalogInvalid, fuzzyPatch, getRecord, h2Sections, historyIndexFile, historyReachability, historyRoot, hostSurface, identity, idleDays, initialTurnFold, installEvolutionProjections, instanceClaimKey, instanceClaimedWriteSites, instanceHolder, isAbsent, isBookkeepingFrame, isCommittedWarning, isDeprecatedParamId, isFileShapedPath, isIgnorableEvent, isLandmark, isMissingPath, isPresent, isProcessAlive, isProgramToolName, isRecord, isReviewChannelSession, isSkillReadToolName, isSkillToolName, isUnknown, isUnreadWrite, json, landmarkVerdict, latestActivityAt, latestVersionAt, lifecycleCandidate, lintBody, lintSkill, listEventArchives, liveBool, liveEnum, liveNumber, liveString, loadMutations, loadSuppressedNames, loadUsage, loadVersionContent, loadVersions, makeSerialQueue, mapProbe, markAgentCreated, markReviewChannel, markerEntryName, memoryRoot, methodNotAllowed, missingSupportPointers, mutateUsage, mutationsFile, narrowNameMatches, nearDuplicateSummaries, newRunRegistry, newSkillLibrary, nextHistoryIndex, nodeEvolutionIo, normalizeFrontmatter, normalizeUsageRecord, normalizeVersionSummary, observeEvent, orderVersions, overlongLines, ownerCandidatesFromSummaries, ownerDecisionText, paramNamespace, paramRowId, paramSettingsId, parseCuratorNominations, parseEvolutionEvents, parseFrontmatter, parseHistoryIndex, partitionVersions, payloadText, persistedWriteSite, persistedWriteSites, pickWithPolicy, planExtract, planNamespaceMigration, planReferenceRewrite, planRehoming, planUnitUndoAcross, policyStageLimits, probeAbsent, probeChannelState, probeList, probeMtime, probePresent, probeReason, probeText, probeUnknown, projectExtractBodies, projectionText, proposalFromPlan, proposalReportDir, proposalReportName, protectedSkillNamesOf, readDispatchSignal, readEvolutionEvents, readEvolutionTimeline, readExternalSupport, readHistoryIndex, readJsonObject, readNumberParam, readParam, readProposalReports, readTreeLock, readUnitEvidence, readUnitIndex, readUnitJournal, readUnitReceipt, readUnitSnapshot, readingStats, recordMutation, recordVersions, redactSecrets, referencedBlobs, registerHostRoutes, relatedSkillNames, releaseInstance, renameWithRetry, renderCuratorReportMarkdown, renderLongRunTable, reportTime, reportsReachability, reportsSweepLockTarget, resolveCitations, resolveExecOrigins, resolveOrigins, resolveParamId, resolveRootConfig, resolveSkillsRoot, resolveUnitMembers, resolveUnitMembersFromIndexes, restructureCandidates, retainEventArchives, retirementReport, reviewPrompt, revisionAnchor, revisionAnchorOf, revisionFingerprint, revisionSupportDigest, runWriteGates, runsFile, saveSuppressedNames, saveUsage, scanBodyHooks, scanContentThreats, scanMemoryThreats, scanThreats, scopeOfNearestManifest, scopedPackageName, scopedProbeReport, selectSections, sessionAudited, sessionEvidenceIndex, sessionLastEventTime, sessionReadNames, sessionReadSkillNames, sessionSeesFamilyTools, sessionTurnSignals, skillLibraryUnitBackend, skillReadNameOf, skillRowCells, skillStateKey, skillWriteGateContext, skillsRoot, staleRouteStubs, subagentChannelState, supportFileReadOf, supportRefs, suppressedFile, sweepReports, sweepReviewChannelSessions, textDiffFacts, tokenLineFor, transactIo, transactTaskGuard, treeLockFile, trimPatternBoundaries, unhookedSupportPointers, unitEvidenceDigest, unitEvidencePath, unitIndexPath, unitJournalPath, unitJournalPhaseRank, unitJournalPort, unitMembersAreComplete, unitReceiptPath, unitSnapshotPath, unitSnapshotPort, unitSnapshotsDir, unitStorageKey, unwrapLive, updateSuppressedNames, upsertUnitIndex, usageFile, usageObserved, userSetKeys, validateFrontmatter, validateMutationRequest, validateRestructureTarget, validateSupportPath, valueOr, verifyPromptBundle, versionActionKind, versionRowCells, versionSummaryPrompt, versionTarget, vocabulary, withTreeWrite, withTreeWriteLock, writeDurableTmp, writePathSymbols, writeProposalReport, writeUnitEvidence, writeUnitJournal, writeUnitReceipt, writeUnitSnapshot, yamlPlainScalarNeedsQuotes };

package/lib/types/constants.d.ts

@@ -90,7 +90,6 @@ export declare const DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS = 20;
 export declare const DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS = 3;
 export declare const DEFAULT_SUBSTANTIVE_MIN_USER_CHARS = 200;
 export declare const DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS = 500;
-export declare const DEFAULT_MAX_OPS_PER_PLAN = 32;
 export declare const DEFAULT_CURATOR_INTERVAL_HOURS = 168;
 export declare const DEFAULT_MIN_IDLE_HOURS = 2;
 export declare const DEFAULT_STALE_AFTER_DAYS = 30;

package/lib/types/constants.js

@@ -109,7 +109,6 @@ export const DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS = 20;
 export const DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS = 3;
 export const DEFAULT_SUBSTANTIVE_MIN_USER_CHARS = 200;
 export const DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS = 500;
-export const DEFAULT_MAX_OPS_PER_PLAN = 32;
 export const DEFAULT_CURATOR_INTERVAL_HOURS = 168;
 export const DEFAULT_MIN_IDLE_HOURS = 2;
 export const DEFAULT_STALE_AFTER_DAYS = 30;

package/lib/types/events.d.ts

@@ -12,6 +12,8 @@
  * these events off `session.append`). Plan-outcome durability lives in the
  * evolution-activity store, not the session log.
  */
+import type { EvolutionPlanAppliedEvent, EvolutionSkillMutatedEvent } from '@lmzhen/dsh-evolution-contract';
+export type { EvolutionPlanAppliedEvent, EvolutionSkillMutatedEvent } from '@lmzhen/dsh-evolution-contract';
 import type { ReviewKind } from './signals.ts';
 export interface EvolutionReviewScheduledEvent {
     /** Owning session (payload v2): process events carry no session envelope. */
@@ -71,52 +73,6 @@ export interface EvolutionReviewCompletedEvent {
     readonly promptVersion?: string | undefined;
     readonly error?: string | undefined;
 }
-export interface EvolutionPlanAppliedEvent {
-    /** Owning session (payload v2): process events carry no session envelope. */
-    sessionId: string;
-    planId: string;
-    /** Stable fingerprint of the policy snapshot that produced this plan. */
-    policyFingerprint?: string | undefined;
-    memoryApplied: number;
-    skillApplied: number;
-    /** Validation rejects ONLY (see the contract note below). V27 R-03: a plan op
-     * that was skipped because the session had not read the skill is NOT a
-     * validation reject and now travels in `skippedUnread`. */
-    rejectedOps: number;
-    /** 0.3.31 (V5-19): execution-layer failures — ops that reached execution but
-     * did not land (non-throw `ok:false` results). `rejectedOps` counts only
-     * VALIDATION rejects; a consumer that treats rejectedOps as "work not done"
-     * would otherwise miss a partial application. */
-    executionFailures?: number | undefined;
-    /** V27 R-03: "not done" has a third, independent cause — an op naming a skill
-     * this session never read (the review pipeline refuses to touch unread
-     * skills). It is neither a validation reject nor an execution failure, so it
-     * has its own field; folding it into `rejectedOps` broke that field's stated
-     * contract and made the replay leaderboard penalize one refusal twice
-     * (rejectedOps weight AND the executionFailures dimension). */
-    skippedUnread?: number | undefined;
-    /** First execution-layer failure message (abort reason or op failure). */
-    executionError?: string | undefined;
-    /** Batch D (2026-09-27): ops whose ENTIRE evidence list cites bookkeeping frames
-     * (a turn/step boundary) — the report-only phase of the plan path's
-     * `EVIDENCE_CLASS` rule. Not a refusal and not a "not done" cause: the ops in
-     * this count executed. It rides the same payload as the other dimensions so the
-     * observation window has a durable record; the model's notice says nothing about
-     * it. */
-    evidenceClassReports?: number | undefined;
-    evidenceQuotes?: number | undefined;
-    estimatedInputChars?: number | undefined;
-}
-export interface EvolutionSkillMutatedEvent {
-    action: string;
-    name: string;
-    /** 0.3.16 (E-50): was `filePath` with mixed semantics — skill-directory ops
-     * carried the DIRECTORY while file ops (write_file/remove_file) carried the
-     * FILE path. Split into explicit fields so a subscriber can distinguish. */
-    skillDir?: string;
-    file?: string;
-    archivedPath?: string;
-}
 /** 0.3.18 (E-6): a turn-end review pipeline failure was caught (never an
  * unhandled rejection); this event lets operators/observability see it. The
  * reason is already logged by the emitter — the event is a timestamped signal. */
@@ -167,5 +123,4 @@ declare module '@deepseek-ai/cordis' {
         'evolution/review-error'(event: EvolutionReviewErrorEvent): void;
     }
 }
-export {};
 //# sourceMappingURL=events.d.ts.map

package/lib/types/evidence.d.ts

@@ -1,9 +1,8 @@
 /**
  * Which session frames are EVIDENCE, and which are bookkeeping.
  *
- * A plan op must cite `evidence` seqs, and the validator's range rule
- * (`evolution-plan-validator`, rule `EVIDENCE_RANGE`) answers only "is this an integer inside
- * the window the plan was authored against". A boundary frame satisfies that while carrying
+ * The session's evidence index answers "does this seq carry content"; a bare range check used
+ * to accept any integer inside the authoring window. A boundary frame satisfies that while carrying
  * nothing a claim can rest on: the `turn/start` seq is the frame a claim about that turn was
  * most likely read out of, and citing it is indistinguishable from citing a real exchange. This
  * module owns the ONE classification of a session frame by what it CARRIES, so the plan path can
@@ -33,8 +32,7 @@ export declare function isBookkeepingFrame(type: string): boolean;
  *
  * Structural on purpose — {@link evidenceKindIndex} materializes the dense set of content seqs,
  * while the projection answers by complement over the sparse boundary seqs
- * (`session-projection.ts`). Both satisfy this interface, and it is all the plan path reads
- * (`evolution-plan-validator/src/index.ts:164`).
+ * (`session-projection.ts`). Both satisfy this interface; `session-projection` is the reader.
  */
 export interface EvidenceIndex {
     /** @param seq - a cited evidence seq. @returns true when that frame carries content. */

package/lib/types/evidence.js

@@ -1,9 +1,8 @@
 /**
  * Which session frames are EVIDENCE, and which are bookkeeping.
  *
- * A plan op must cite `evidence` seqs, and the validator's range rule
- * (`evolution-plan-validator`, rule `EVIDENCE_RANGE`) answers only "is this an integer inside
- * the window the plan was authored against". A boundary frame satisfies that while carrying
+ * The session's evidence index answers "does this seq carry content"; a bare range check used
+ * to accept any integer inside the authoring window. A boundary frame satisfies that while carrying
  * nothing a claim can rest on: the `turn/start` seq is the frame a claim about that turn was
  * most likely read out of, and citing it is indistinguishable from citing a real exchange. This
  * module owns the ONE classification of a session frame by what it CARRIES, so the plan path can

package/lib/types/instance-scope.d.ts

@@ -2,8 +2,9 @@
  * B3 / G4 (0.3.78): the family's single-instance contract, made explicit.
  *
  * Every persisted sidecar is written under TWO assumptions: the IO backend's
- * cross-process write lock serializes different processes, and exactly ONE
- * instance of each writer service exists per evolution home. The second half
+ * transact serializes different processes when the provider guarantees it (the
+ * node backend is process-local only), and exactly ONE instance of each writer
+ * service exists per evolution home. The second half
  * was implicit — `makeSerialQueue()` and the module-scope stores are
  * per-instance, so two rows writing one home interleave inside one file (the
  * "two instances, one file" class). This module makes that half enforceable: a
@@ -20,8 +21,9 @@
  * `claims` below is a module-scope Map: two ROWS over one home in ONE process
  * contend, while the SAME home in another process gets its own Map and is
  * granted the key. That is by construction, not a gap to close here — the
- * cross-process half of the contract is the IO backend's write lock
- * (`transactIo`, core/io.ts), which serializes a per-target read-modify-write.
+ * cross-process half of the contract is the IO backend's transact
+ * (`transactIo`, core/io.ts) when the provider guarantees it; the node backend
+ * is process-local, so a shared home across processes is not protected by it alone.
  * The FLOW2-1 finding was three call sites reading a GRANTED claim as "no other
  * process can be doing this work", so the caller contract is stated here:
  * - granted means "no other row OF THIS PROCESS owns the key";

package/lib/types/instance-scope.js

@@ -2,8 +2,9 @@
  * B3 / G4 (0.3.78): the family's single-instance contract, made explicit.
  *
  * Every persisted sidecar is written under TWO assumptions: the IO backend's
- * cross-process write lock serializes different processes, and exactly ONE
- * instance of each writer service exists per evolution home. The second half
+ * transact serializes different processes when the provider guarantees it (the
+ * node backend is process-local only), and exactly ONE instance of each writer
+ * service exists per evolution home. The second half
  * was implicit — `makeSerialQueue()` and the module-scope stores are
  * per-instance, so two rows writing one home interleave inside one file (the
  * "two instances, one file" class). This module makes that half enforceable: a
@@ -20,8 +21,9 @@
  * `claims` below is a module-scope Map: two ROWS over one home in ONE process
  * contend, while the SAME home in another process gets its own Map and is
  * granted the key. That is by construction, not a gap to close here — the
- * cross-process half of the contract is the IO backend's write lock
- * (`transactIo`, core/io.ts), which serializes a per-target read-modify-write.
+ * cross-process half of the contract is the IO backend's transact
+ * (`transactIo`, core/io.ts) when the provider guarantees it; the node backend
+ * is process-local, so a shared home across processes is not protected by it alone.
  * The FLOW2-1 finding was three call sites reading a GRANTED claim as "no other
  * process can be doing this work", so the caller contract is stated here:
  * - granted means "no other row OF THIS PROCESS owns the key";

package/lib/types/io.d.ts

@@ -6,6 +6,13 @@
  */
 import { open } from 'node:fs/promises';
 export interface EvolutionIoLike {
+    /**
+     * The process scope this backend actually guarantees. `transact` is NOT proof:
+     * nodeEvolutionIo's transact serializes in-process only (G2 S4). Required for
+     * any backend that claims cross-process; omitted/`single-process` means the
+     * caller must keep its own chain and the family must report the weaker truth.
+     */
+    readonly processScope?: 'single-process' | 'cross-process' | undefined;
     readText(path: string): Promise<string | null>;
     writeText(path: string, content: string): Promise<void>;
     remove(path: string): Promise<void>;

package/lib/types/io.js

@@ -78,6 +78,7 @@ export function transactTaskGuard(what) {
 /** Lazy adapter over an IO provider registry, shared by every evolution consumer. */
 export function evolutionIoAdapter(provider) {
     return {
+        get processScope() { return provider().processScope; },
         readText: path => provider().readText(path),
         writeText: (path, content) => provider().writeText(path, content),
         remove: path => provider().remove(path),
@@ -382,6 +383,7 @@ export function nodeEvolutionIo() {
         }
     };
     return {
+        processScope: 'single-process',
         async readText(path) {
             try {
                 return await readFile(path, 'utf8');

package/lib/types/params.js

@@ -178,7 +178,6 @@ export const PARAM_EXPOSURE = Object.freeze([
     { id: 'evolution-state.provider', group: 'deployment', tier: 'E2', authority: 'cordis', owner: 'evolution-state', applies: 'none', docAnchor: 'PARAMETERS.md#deployment', summary: 'Registered state-store provider name.', why: 'identity' },
     { id: 'memory.provider', group: 'deployment', tier: 'E2', authority: 'cordis', owner: 'memory', applies: 'none', docAnchor: 'PARAMETERS.md#deployment', summary: 'Registered memory provider name.', why: 'identity' },
     { id: 'memory-files.providerName', group: 'deployment', tier: 'E2', authority: 'cordis', owner: 'memory-files', applies: 'none', docAnchor: 'PARAMETERS.md#deployment', summary: 'Name this package registers as the memory provider.', why: 'identity' },
-    { id: 'maxOpsPerPlan', group: 'deployment', tier: 'E2', authority: 'cordis', owner: 'evolution-plan-validator', applies: 'none', docAnchor: 'PARAMETERS.md#deployment', summary: 'Operation cap one staged plan may carry.', why: 'internal' },
     { id: 'substantiveMinToolCalls', group: 'deployment', tier: 'E2', authority: 'cordis', owner: 'evolution-review', applies: 'none', docAnchor: 'PARAMETERS.md#deployment', summary: 'Tool calls that make a turn count as substantive.', why: 'internal' },
     { id: 'substantiveMinUserChars', group: 'deployment', tier: 'E2', authority: 'cordis', owner: 'evolution-review', applies: 'none', docAnchor: 'PARAMETERS.md#deployment', summary: 'User characters that make a turn count as substantive.', why: 'internal' },
     { id: 'substantiveMinAgentChars', group: 'deployment', tier: 'E2', authority: 'cordis', owner: 'evolution-review', applies: 'none', docAnchor: 'PARAMETERS.md#deployment', summary: 'Assistant characters that make a turn count as substantive.', why: 'internal' },

package/lib/types/platform-services.d.ts

@@ -11,15 +11,8 @@
  * `client` probes run in the browser half, where the host has no view of the seats.
  * @module @lmzhen/dsh-evolution-core
  */
-/** One platform service the family probes, with the feature that goes quiet without it. */
-export interface PlatformServiceProbe {
-    /** The service key as `ctx.get` spells it. */
-    readonly service: string;
-    /** The family feature that silently degrades when the service is absent. */
-    readonly feature: string;
-    /** Where the probe runs. */
-    readonly side: 'host' | 'client';
-}
+import type { PlatformServiceProbe } from '@lmzhen/dsh-evolution-contract';
+export type { PlatformServiceProbe } from '@lmzhen/dsh-evolution-contract';
 /** The 30 probes, in service-name order (the guard checks this list against the tree). */
 export declare const PLATFORM_SERVICE_PROBES: readonly PlatformServiceProbe[];
 /**

package/lib/types/platform-services.js

@@ -29,6 +29,7 @@ export const PLATFORM_SERVICE_PROBES = Object.freeze([
     { service: 'evolutionPolicy', feature: 'the policy snapshot that shadows row knobs', side: 'host' },
     { service: 'evolutionReplay', feature: '/evolution replay', side: 'host' },
     { service: 'evolutionState', feature: 'the state facade behind activity and replay', side: 'host' },
+    { service: 'evolutionStateStore', feature: 'generic durable state store for assignment queue and future collections', side: 'host' },
     { service: 'llm', feature: 'the curator one-shot review model call', side: 'host' },
     { service: 'memory', feature: 'the cross-session memory store (review and learning-graph reads)', side: 'host' },
     { service: 'pluginInventory', feature: 'the plugin inventory view', side: 'host' },

package/lib/types/run-registry.js

@@ -185,7 +185,8 @@ export function newRunRegistry(options) {
     };
     const persist = async () => {
         try {
-            // Read-modify-write under the io backend's cross-process lock. The file is the
+            // Read-modify-write under io.transact when the backend provides it; the node
+            // backend serializes in-process only. The file is the
             // BASE and only THIS process's rows are laid over it ("one writer per row"); the
             // single write a non-owner may make is the orphan verdict for a row whose owner is
             // gone. The row read inside this transaction IS the compare-and-swap: if its owner

package/lib/types/serial.d.ts

@@ -1,9 +1,10 @@
 /**
  * A process-local serial task queue: each task starts only after the previous
  * one settles (success or failure), so read-modify-write sequences that share
- * one file never interleave inside this process. The durable cross-process
- * serialization layer is the IO backend's transact lock; this chain is the
- * second layer (0.3.17 S2.8, T-1: the shape was duplicated in state-json and
+ * one file never interleave inside this process. When the IO backend provides
+ * a cross-process transact lock, that is the first layer; the node backend does
+ * not, so this chain is its only serialization. (0.3.17 S2.8, T-1: the shape was
+ * duplicated in state-json and
  * memory-files — one factory now).
  */
 export declare function makeSerialQueue(): <T>(task: () => Promise<T>) => Promise<T>;

package/lib/types/serial.js

@@ -1,9 +1,10 @@
 /**
  * A process-local serial task queue: each task starts only after the previous
  * one settles (success or failure), so read-modify-write sequences that share
- * one file never interleave inside this process. The durable cross-process
- * serialization layer is the IO backend's transact lock; this chain is the
- * second layer (0.3.17 S2.8, T-1: the shape was duplicated in state-json and
+ * one file never interleave inside this process. When the IO backend provides
+ * a cross-process transact lock, that is the first layer; the node backend does
+ * not, so this chain is its only serialization. (0.3.17 S2.8, T-1: the shape was
+ * duplicated in state-json and
  * memory-files — one factory now).
  */
 export function makeSerialQueue() {

package/lib/types/tree-lock.js

@@ -1,11 +1,12 @@
 /**
- * Cross-process tree write lock.
+ * Tree write lock.
  *
  * The merge run holds this lock for its whole lifetime; curator's pass takes the same
- * lock. The lock is a cooperative file record, created through `transactIo` so two
- * processes cannot both win the create. A holder whose pid is gone is stale and may be
- * taken over; a live pid is always respected, even for a long run (a live long run is
- * exactly what the lock protects).
+ * lock. The record is created through `transactIo`, so exclusion is exactly as strong as
+ * the IO backend's `transact`: the platform `ctx.fs` provider is cross-process, while the
+ * standalone `nodeEvolutionIo` is explicitly single-process (G2 S4). This module builds no
+ * file lock or WAL of its own. A holder whose pid is gone is stale and may be taken over;
+ * a live pid is respected, even for a long run (a live long run is what the lock protects).
  *
  * `commitMerge` deliberately does NOT take this lock itself: the run shell owns it, so a
  * run and its commit share one acquisition. Taking it inside the store would also

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-core",
   "description": "Shared stores, prompts, signals and lifecycle logic for the dsh-evolution plugin family (community build)",
-  "version": "0.31.0",
+  "version": "0.32.0",
   "publishConfig": {
     "access": "public"
   },
@@ -48,7 +48,8 @@
   "dependencies": {
     "yaml": "^2.4.2",
     "zod": "^4.4.3",
-    "js-yaml": "^4.1.0"
+    "js-yaml": "^4.1.0",
+    "@lmzhen/dsh-evolution-contract": "^0.32.0"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.5",

package/persisted-write-inventory.json

@@ -297,6 +297,15 @@
       "marker": "transactIo(io, pairIndexPath(home)",
       "state": [],
       "note": "pairKey → result/runId/target index; RMW under the same IO lock so two merge runs cannot lose each other's entries."
+    },
+    {
+      "id": "state-store-collections",
+      "path": "<evolutionHome>/state-store/<collection>.json",
+      "writer": "evolution-state-json/src/state-store.ts",
+      "serializedBy": "transact",
+      "marker": "transactIo(this.io, this.path(collection)",
+      "state": [],
+      "note": "Generic contract StateStore collections (one file per collection); provider serial queue plus transactIo. cross-process false on the node backend."
     }
   ]
 }