@lmzhen/dsh-evolution-core 0.32.3 → 0.32.5

package/lib/types/tool-dispatch.js

@@ -375,9 +375,8 @@ function parsedArguments(signal) {
         return null;
     return parsed;
 }
-/** The path-shaped argument of a file tool, when it carries one. */
-function readPathArgument(signal) {
-    const record = parsedArguments(signal);
+/** The path-shaped argument of one already-parsed call, when it carries one. */
+function readPathFromRecord(record) {
     if (record === null)
         return null;
     for (const key of ['file_path', 'path', 'file', 'target']) {
@@ -387,6 +386,23 @@ function readPathArgument(signal) {
     }
     return null;
 }
+/** The path-shaped argument of a file tool, when it carries one. */
+function readPathArgument(signal) {
+    return readPathFromRecord(parsedArguments(signal));
+}
+/** The path one dispatch names, for the read-evidence projection. */
+export function dispatchPathOf(step) {
+    let parsed = step.arguments;
+    if (typeof parsed === 'string') {
+        try {
+            parsed = JSON.parse(parsed);
+        }
+        catch {
+            return null;
+        }
+    }
+    return parsed !== null && typeof parsed === 'object' ? readPathFromRecord(parsed) : null;
+}
 /**
  * Read one dispatch as a SUPPORT-FILE read attributed to a skill: a read of
  * `<root>/<skill>/<support dir>/…` is demand evidence for that one file, the
@@ -397,14 +413,8 @@ function readPathArgument(signal) {
  * @returns the skill name and the skill-root-relative path, or `null` when the
  *   dispatch is not a support-file read. Pure: no IO, no service lookup.
  */
-export function supportFileReadOf(signal, options) {
-    if (!options.toolNames.includes(signal.name))
-        return null;
-    if (signal.ok === false)
-        return null;
-    const raw = readPathArgument(signal);
-    if (raw === null)
-        return null;
+/** Attribute one raw path string to a skill support file (pure; no IO). */
+export function supportFileReadFromPath(raw, options) {
     const normalized = raw.replace(/\\/g, '/').trim();
     if (normalized === '' || normalized.split('/').includes('..'))
         return null;
@@ -432,6 +442,14 @@ export function supportFileReadOf(signal, options) {
         return null;
     return { skill: skill.trim(), rel: parts.slice(1).join('/') };
 }
+export function supportFileReadOf(signal, options) {
+    if (!options.toolNames.includes(signal.name))
+        return null;
+    if (signal.ok === false)
+        return null;
+    const raw = readPathArgument(signal);
+    return raw === null ? null : supportFileReadFromPath(raw, options);
+}
 export function skillReadNameOf(signal) {
     if (!SKILL_READ_TOOL_NAMES.has(signal.name))
         return undefined;
@@ -468,6 +486,19 @@ export function collectReadSkillNames(events) {
     }
     return names;
 }
+/** Every skill support file this log read through a non-failed configured file tool. */
+export function collectReadSupportFiles(events, options) {
+    const reads = new Map();
+    for (const signal of foldToolDispatches(events)) {
+        const hit = supportFileReadOf(signal, options);
+        if (hit === null)
+            continue;
+        const set = reads.get(hit.skill) ?? new Set();
+        set.add(hit.rel);
+        reads.set(hit.skill, set);
+    }
+    return reads;
+}
 /** Tool names that touch the skill library at all — the review's skill-signal set. */
 const SKILL_TOOL_NAMES = new Set([...SKILL_READ_TOOL_NAMES, 'skill_manage']);
 /**

package/lib/types/unit-journal.d.ts

@@ -19,11 +19,13 @@ export interface UnitJournal {
     readonly storageKey: string;
     readonly snapshotSha256: string;
     readonly checkpoints?: readonly UnitJournalCheckpoint[];
+    readonly kind?: 'merge' | 'tree-change';
     readonly updatedAt: number;
 }
-export declare function unitJournalPath(home: string, unitId: string): string;
+export type UnitJournalScope = 'merge' | 'skill';
+export declare function unitJournalPath(home: string, unitId: string, scope?: UnitJournalScope): string;
 export declare function unitJournalPhaseRank(phase: UnitJournalPhase): number;
 export declare function assertUnitJournalTransition(from: UnitJournalPhase, to: UnitJournalPhase): void;
-export declare function writeUnitJournal(io: EvolutionIoLike, home: string, journal: UnitJournal): Promise<string>;
-export declare function readUnitJournal(io: EvolutionIoLike, home: string, unitId: string): Promise<UnitJournal | null>;
+export declare function writeUnitJournal(io: EvolutionIoLike, home: string, journal: UnitJournal, scope?: UnitJournalScope): Promise<string>;
+export declare function readUnitJournal(io: EvolutionIoLike, home: string, unitId: string, scope?: UnitJournalScope): Promise<UnitJournal | null>;
 //# sourceMappingURL=unit-journal.d.ts.map

package/lib/types/unit-journal.js

@@ -14,8 +14,9 @@ export const UNIT_JOURNAL_PHASES = [
     'failed',
     'rolled-back',
 ];
-export function unitJournalPath(home, unitId) {
-    return join(home, 'merge', 'unit-journals', createHash('sha256').update(unitId).digest('hex') + '.json');
+export function unitJournalPath(home, unitId, scope = 'merge') {
+    const base = scope === 'merge' ? join(home, 'merge', 'unit-journals') : join(home, 'units', 'skill', 'journals');
+    return join(base, createHash('sha256').update(unitId).digest('hex') + '.json');
 }
 export function unitJournalPhaseRank(phase) {
     return UNIT_JOURNAL_PHASES.indexOf(phase);
@@ -28,8 +29,8 @@ export function assertUnitJournalTransition(from, to) {
     if (unitJournalPhaseRank(to) <= unitJournalPhaseRank(from))
         throw new Error('unit-journal-nonmonotonic:' + from + '->' + to);
 }
-export async function writeUnitJournal(io, home, journal) {
-    const path = unitJournalPath(home, journal.unitId);
+export async function writeUnitJournal(io, home, journal, scope = 'merge') {
+    const path = unitJournalPath(home, journal.unitId, scope);
     const content = JSON.stringify(journal, null, 2) + '\n';
     if (io.transact !== undefined)
         await io.transact(path, () => content);
@@ -37,8 +38,8 @@ export async function writeUnitJournal(io, home, journal) {
         await io.writeText(path, content);
     return path;
 }
-export async function readUnitJournal(io, home, unitId) {
-    const raw = await io.readText(unitJournalPath(home, unitId));
+export async function readUnitJournal(io, home, unitId, scope = 'merge') {
+    const raw = await io.readText(unitJournalPath(home, unitId, scope));
     if (raw === null)
         return null;
     try {

package/lib/types/unit-storage.d.ts

@@ -78,12 +78,13 @@ export interface UnitIndexEntry {
 }
 /** Stable, filesystem-safe key; unitId stays opaque (may contain ':' or '/'). */
 export declare function unitStorageKey(unitId: string): string;
-export declare function unitSnapshotsDir(home: string): string;
-export declare function unitSnapshotPath(home: string, unitId: string): string;
+export type UnitStoreScope = 'merge' | 'skill';
+export declare function unitSnapshotsDir(home: string, scope?: UnitStoreScope): string;
+export declare function unitSnapshotPath(home: string, unitId: string, scope?: UnitStoreScope): string;
 export declare function unitEvidencePath(home: string, unitId: string): string;
 export declare function unitIndexPath(home: string): string;
-export declare function writeUnitSnapshot(io: EvolutionIoLike, home: string, snapshot: UnitSnapshot): Promise<string>;
-export declare function readUnitSnapshot(io: EvolutionIoLike, home: string, unitId: string): Promise<UnitSnapshot | null>;
+export declare function writeUnitSnapshot(io: EvolutionIoLike, home: string, snapshot: UnitSnapshot, scope?: UnitStoreScope): Promise<string>;
+export declare function readUnitSnapshot(io: EvolutionIoLike, home: string, unitId: string, scope?: UnitStoreScope): Promise<UnitSnapshot | null>;
 export declare function writeUnitEvidence(io: EvolutionIoLike, home: string, evidence: UnitEvidenceRecord): Promise<string>;
 export declare function readUnitEvidence(io: EvolutionIoLike, home: string, unitId: string): Promise<UnitEvidenceRecord | null>;
 export declare function readUnitIndex(io: EvolutionIoLike, home: string): Promise<UnitIndexEntry[]>;

package/lib/types/unit-storage.js

@@ -6,11 +6,11 @@ export const UNIT_STORAGE_SCHEMA_VERSION = 1;
 export function unitStorageKey(unitId) {
     return createHash('sha256').update(unitId).digest('hex');
 }
-export function unitSnapshotsDir(home) {
-    return join(home, 'merge', 'unit-snapshots');
+export function unitSnapshotsDir(home, scope = 'merge') {
+    return scope === 'merge' ? join(home, 'merge', 'unit-snapshots') : join(home, 'units', 'skill', 'snapshots');
 }
-export function unitSnapshotPath(home, unitId) {
-    return join(unitSnapshotsDir(home), unitStorageKey(unitId) + '.json');
+export function unitSnapshotPath(home, unitId, scope = 'merge') {
+    return join(unitSnapshotsDir(home, scope), unitStorageKey(unitId) + '.json');
 }
 export function unitEvidencePath(home, unitId) {
     return join(home, 'merge', 'units', unitStorageKey(unitId), 'evidence.json');
@@ -18,8 +18,8 @@ export function unitEvidencePath(home, unitId) {
 export function unitIndexPath(home) {
     return join(home, 'merge', 'unit-index.json');
 }
-export async function writeUnitSnapshot(io, home, snapshot) {
-    const path = unitSnapshotPath(home, snapshot.unitId);
+export async function writeUnitSnapshot(io, home, snapshot, scope = 'merge') {
+    const path = unitSnapshotPath(home, snapshot.unitId, scope);
     const content = JSON.stringify(snapshot, null, 2) + '\n';
     if (io.transact !== undefined)
         await io.transact(path, () => content);
@@ -27,8 +27,8 @@ export async function writeUnitSnapshot(io, home, snapshot) {
         await io.writeText(path, content);
     return path;
 }
-export async function readUnitSnapshot(io, home, unitId) {
-    const raw = await io.readText(unitSnapshotPath(home, unitId));
+export async function readUnitSnapshot(io, home, unitId, scope = 'merge') {
+    const raw = await io.readText(unitSnapshotPath(home, unitId, scope));
     if (raw === null)
         return null;
     try {

package/lib/types/unit-transaction.js

@@ -1,7 +1,7 @@
 /** G2 opaque UnitTransaction. Core owns prepare/commit/verify/rollback lifecycle. */
 import { createHash } from "node:crypto";
 import { acquireTreeWriteLock } from "./tree-lock.js";
-import { readUnitEvidence, readUnitReceipt, readUnitSnapshot, unitStorageKey, writeUnitEvidence, writeUnitReceipt, writeUnitSnapshot, } from "./unit-storage.js";
+import { readUnitEvidence, readUnitReceipt, readUnitIndex, readUnitSnapshot, unitStorageKey, writeUnitEvidence, writeUnitReceipt, writeUnitSnapshot, } from "./unit-storage.js";
 import { readUnitJournal, writeUnitJournal } from "./unit-journal.js";
 function canonical(value) {
     if (value === null || typeof value !== "object")
@@ -30,9 +30,6 @@ function canonicalJson(value) {
 export function unitEvidenceDigest(evidence) {
     return createHash("sha256").update(canonicalJson({ ...evidence, at: 0, mutations: 0 })).digest("hex");
 }
-function evidenceDigest(evidence) {
-    return createHash("sha256").update(JSON.stringify({ ...evidence, at: 0, mutations: 0 }, null, 2) + "\n").digest("hex");
-}
 export class UnitTransactions {
     options;
     prepared = new Map();
@@ -243,7 +240,7 @@ export class UnitTransactions {
             };
             if (!(await lock.assertHeld()))
                 throw new Error("unit-fence-lost");
-            const evidenceSha256 = evidenceDigest(evidence);
+            const evidenceSha256 = unitEvidenceDigest(evidence);
             await writeUnitEvidence(this.options.io, this.options.home, evidence);
             await writeUnitReceipt(this.options.io, this.options.home, {
                 schemaVersion: 1, unitId: prepared.unitId, runId: stored.plan.runId, planDigest: stored.digest,
@@ -269,7 +266,8 @@ export class UnitTransactions {
     async verify(ref) {
         if ("unitId" in ref)
             return await readUnitEvidence(this.options.io, this.options.home, ref.unitId);
-        const all = await Promise.all([...this.prepared.keys()].map(async (id) => readUnitEvidence(this.options.io, this.options.home, id)));
+        const entries = (await readUnitIndex(this.options.io, this.options.home)).filter(entry => entry.runId === ref.runId);
+        const all = await Promise.all(entries.map(async (entry) => readUnitEvidence(this.options.io, this.options.home, entry.unitId)));
         const found = all.filter((item) => item !== null && item.runId === ref.runId);
         const only = found[0];
         return found.length === 0 ? null : found.length === 1 ? (only ?? null) : found;
@@ -334,7 +332,7 @@ export class UnitTransactions {
             ...(snapshot.validationPlan === undefined ? {} : { validationPlan: snapshot.validationPlan }),
             at: this.now(),
         };
-        if (receipt?.evidenceSha256 !== undefined && evidenceDigest(evidence) !== receipt.evidenceSha256)
+        if (receipt?.evidenceSha256 !== undefined && unitEvidenceDigest(evidence) !== receipt.evidenceSha256)
             return { ok: false, code: "unit-rollback-blocked", message: "receipt evidence hash does not match rebuilt evidence" };
         await writeUnitEvidence(this.options.io, this.options.home, evidence);
         if (journal.phase !== "committed")

package/lib/types/write-gates.d.ts

@@ -54,6 +54,8 @@ export interface SkillWriteGateServices {
     readonly confirm: WriteConfirm | undefined;
     /** Names this session read successfully; `undefined` when the session log is not readable. */
     readonly readNames: ReadonlySet<string> | undefined;
+    /** Support files this session read, per skill; `undefined` when no evidence. */
+    readonly readSupportFiles?: ReadonlyMap<string, ReadonlySet<string>> | undefined;
     /** Report a degraded gate; must not throw. */
     readonly warn: (message: string) => void;
     /** The registry's `skillWriteConfirm`; `auto` (the default) skips the question. */
@@ -87,6 +89,8 @@ export interface WriteGateContext {
     readonly protectedNames: readonly string[] | undefined;
     /** Names this session read successfully; `undefined` when the session log is not readable. */
     readonly readNames: ReadonlySet<string> | undefined;
+    /** Support files this session read, per skill; `undefined` when no evidence. */
+    readonly readSupportFiles?: ReadonlyMap<string, ReadonlySet<string>> | undefined;
     /** The human confirm seam — read only by the gates that apply to `'admission'`. */
     readonly confirm: WriteConfirm | undefined;
     /** The registry's `skillWriteConfirm`: `auto` (the default) skips the question entirely. */

package/lib/types/write-gates.js

@@ -76,6 +76,7 @@ export function skillWriteGateContext(services, request) {
         origin: request.origin,
         protectedNames: protectedSkillNamesOf(services.policy),
         readNames: services.readNames,
+        ...(services.readSupportFiles === undefined ? {} : { readSupportFiles: services.readSupportFiles }),
         confirm: services.confirm,
         ...(services.confirmMode === undefined ? {} : { confirmMode: services.confirmMode }),
         ...(services.confirmTimeoutSeconds === undefined ? {} : { confirmTimeoutSeconds: services.confirmTimeoutSeconds }),
@@ -109,6 +110,7 @@ function gateArgsOf(args) {
         // (`args.absorbed_into ? { absorbedInto } : {}`) — so `''` performs a BARE archive and must not
         // borrow the merge exemption (review 2026-09-26, P1).
         absorbedInto: typeof absorbedInto === 'string' && absorbedInto.trim() !== '' ? absorbedInto : undefined,
+        filePath: typeof scalars.file_path === 'string' && scalars.file_path.trim() !== '' ? scalars.file_path.replace(/\\/g, '/').replace(/^\.\//, '') : undefined,
         scalars,
     };
 }
@@ -195,7 +197,7 @@ const POLICY_PROTECTION = {
 const READ_BEFORE_WRITE = {
     id: 'read-before-write',
     appliesTo: ['admission'],
-    run: ({ view, origin, readNames, warn }) => {
+    run: ({ view, origin, readNames, readSupportFiles, warn }) => {
         if (origin === 'foreground')
             return null;
         if (readNames === undefined) {
@@ -208,6 +210,19 @@ const READ_BEFORE_WRITE = {
         // P2). The rule's default-to-`patch` (V6-26) stays where it belongs, on the plan path.
         if (view.action === undefined)
             return null;
+        // P2-27: a support-file write is judged on THAT FILE, not on the skill body.
+        // Reading the SKILL.md does not mean the model saw references/x.md.
+        if ((view.action === 'write_file' || view.action === 'remove_file') && view.filePath !== undefined) {
+            if (readSupportFiles === undefined) {
+                warn('skill_manage: the support-file read check could not run for this call — no support-file read evidence; the write is allowed.');
+            }
+            else if (readSupportFiles.get(view.name)?.has(view.filePath) === true) {
+                return null;
+            }
+            else {
+                return errorText('e-326-support-write-without-a-read', { a1: view.name, a2: view.filePath });
+            }
+        }
         if (!isUnreadWrite({ action: view.action, name: view.name }, readNames))
             return null;
         return errorText('e-318-skill-write-without-a-read', { a1: view.name });

package/lib/types/write-kernel.d.ts

@@ -0,0 +1,81 @@
+import { type EvolutionIoLike } from './io.ts';
+/** The four persistent writer kinds the family permits. */
+export type WriteUnitKind = 'skill' | 'state' | 'merge' | 'curator';
+/** One planned write: expected is the baseline read before the plan, next is the new bytes. */
+export interface WriteTarget {
+    readonly path: string;
+    readonly expected: string | null;
+    readonly next: string | null;
+    readonly skill?: string | undefined;
+}
+/** A structured failure; conflict always means the target changed before/inside the write. */
+export interface WriteKernelError {
+    readonly code: 'cas-conflict' | 'write-failed' | 'compensation-blocked';
+    readonly message: string;
+    readonly target: string;
+}
+/** Outcome of one write or one multi-target commit. */
+export interface WriteKernelResult {
+    readonly ok: boolean;
+    readonly changed: readonly string[];
+    readonly errors: readonly WriteKernelError[];
+    readonly warnings?: readonly string[] | undefined;
+}
+export interface WriteKernelOptions {
+    readonly io: EvolutionIoLike;
+    readonly transact?: ((io: EvolutionIoLike, path: string, task: (current: string | null) => string | null | Promise<string | null>) => Promise<void>) | undefined;
+    readonly now?: (() => number) | undefined;
+}
+export interface WriteOneOptions {
+    /** false is the create-under-root-lock retry seam: a mismatch defers instead of failing. */
+    readonly guardBaseline?: boolean | undefined;
+}
+/**
+ * The family's single write primitive: compare the baseline INSIDE the write
+ * transaction, never overwrite a concurrent value, and compensate only this
+ * unit's own writes. Business state machines stay in their domain owners.
+ */
+export declare class WriteKernel {
+    private readonly io;
+    private readonly transact;
+    private readonly now;
+    constructor(options: WriteKernelOptions);
+    /** @returns the current time source; exposed for adapters that stamp evidence. */
+    clock(): number;
+    /**
+     * Run a read-modify-write task inside the same transaction seam. Unlike
+     * writeOne, task errors keep their type (state files rely on WRITE_GATE_ERROR_NAME)
+     * and only committed-only failures become warnings. expected is optional because
+     * the state medium passes the task the locked current value itself.
+     */
+    run(target: {
+        readonly path: string;
+        readonly expected?: string | null | undefined;
+    }, task: (current: string | null) => string | null | Promise<string | null>): Promise<{
+        readonly warnings?: readonly string[] | undefined;
+    }>;
+    /**
+     * Write one target only if the current bytes still equal the baseline.
+     * A conflict performs no write. With guardBaseline:false a stale callback
+     * defers (returns the current bytes) so a retrying transact can re-observe;
+     * if no retry ever writes, the result is still a conflict.
+     */
+    writeOne(target: WriteTarget, options?: WriteOneOptions): Promise<WriteKernelResult>;
+    /**
+     * Write a plan in order. A preflight drift writes nothing; a later failure
+     * compensates only the targets this commit wrote, and only while they still
+     * hold this commit's bytes.
+     */
+    commit(targets: readonly WriteTarget[]): Promise<WriteKernelResult>;
+    /**
+     * Restore a target to its before bytes only if it still holds the bytes this
+     * unit wrote. A concurrent writer wins and the compensation is reported.
+     */
+    restore(target: {
+        readonly path: string;
+        readonly before: string | null;
+        readonly after: string | null;
+    }): Promise<WriteKernelResult>;
+    private compensate;
+}
+//# sourceMappingURL=write-kernel.d.ts.map

package/lib/types/write-kernel.js

@@ -0,0 +1,155 @@
+import { isCommittedWarning } from "./io.js";
+/**
+ * The family's single write primitive: compare the baseline INSIDE the write
+ * transaction, never overwrite a concurrent value, and compensate only this
+ * unit's own writes. Business state machines stay in their domain owners.
+ */
+export class WriteKernel {
+    io;
+    transact;
+    now;
+    constructor(options) {
+        this.io = options.io;
+        this.transact = options.transact;
+        this.now = options.now ?? Date.now;
+    }
+    /** @returns the current time source; exposed for adapters that stamp evidence. */
+    clock() { return this.now(); }
+    /**
+     * Run a read-modify-write task inside the same transaction seam. Unlike
+     * writeOne, task errors keep their type (state files rely on WRITE_GATE_ERROR_NAME)
+     * and only committed-only failures become warnings. expected is optional because
+     * the state medium passes the task the locked current value itself.
+     */
+    async run(target, task) {
+        let invoked = false;
+        let conflict = false;
+        const invoke = async (current) => {
+            if (target.expected !== undefined && current !== target.expected) {
+                conflict = true;
+                throw Object.assign(new Error('concurrent modification detected: ' + target.path), { noWrite: true });
+            }
+            invoked = true;
+            return await task(current);
+        };
+        try {
+            if (this.transact !== undefined)
+                await this.transact(this.io, target.path, invoke);
+            else if (this.io.transact !== undefined)
+                await this.io.transact(target.path, invoke);
+            else {
+                const current = await this.io.readText(target.path);
+                const next = await invoke(current);
+                if (next === null && current !== null)
+                    await this.io.remove(target.path);
+                else if (next !== null && next !== current)
+                    await this.io.writeText(target.path, next);
+            }
+        }
+        catch (error) {
+            if (conflict)
+                throw Object.assign(new Error('concurrent modification detected: ' + target.path), { noWrite: true });
+            if (isCommittedWarning(error))
+                return { warnings: [error instanceof Error ? error.message : String(error)] };
+            throw error;
+        }
+        if (!invoked)
+            throw new Error('internal error: the write transaction for ' + target.path + ' did not invoke the task; no write was performed');
+        return {};
+    }
+    /**
+     * Write one target only if the current bytes still equal the baseline.
+     * A conflict performs no write. With guardBaseline:false a stale callback
+     * defers (returns the current bytes) so a retrying transact can re-observe;
+     * if no retry ever writes, the result is still a conflict.
+     */
+    async writeOne(target, options = {}) {
+        const guard = options.guardBaseline !== false;
+        let wrote = false;
+        let deferred = false;
+        let conflict = false;
+        const task = (current) => {
+            if (current !== target.expected) {
+                if (guard) {
+                    conflict = true;
+                    throw Object.assign(new Error('concurrent modification detected: ' + target.path), { noWrite: true });
+                }
+                deferred = true;
+                return current;
+            }
+            wrote = true;
+            return target.next;
+        };
+        try {
+            if (this.transact !== undefined)
+                await this.transact(this.io, target.path, task);
+            else if (this.io.transact !== undefined)
+                await this.io.transact(target.path, task);
+            else {
+                const current = await this.io.readText(target.path);
+                const next = task(current);
+                if (next === null && current !== null)
+                    await this.io.remove(target.path);
+                else if (next !== null && next !== current)
+                    await this.io.writeText(target.path, next);
+            }
+        }
+        catch (error) {
+            if (conflict)
+                return { ok: false, changed: [], errors: [{ code: 'cas-conflict', message: error instanceof Error ? error.message : String(error), target: target.path }] };
+            if (isCommittedWarning(error))
+                return { ok: true, changed: [target.path], errors: [], warnings: [error instanceof Error ? error.message : String(error)] };
+            return { ok: false, changed: [], errors: [{ code: 'write-failed', message: error instanceof Error ? error.message : String(error), target: target.path }] };
+        }
+        if (conflict || (!wrote && deferred))
+            return { ok: false, changed: [], errors: [{ code: 'cas-conflict', message: 'concurrent modification detected: ' + target.path, target: target.path }] };
+        if (!wrote)
+            return { ok: false, changed: [], errors: [{ code: 'write-failed', message: 'transaction did not invoke the write task: ' + target.path, target: target.path }] };
+        return { ok: true, changed: [target.path], errors: [] };
+    }
+    /**
+     * Write a plan in order. A preflight drift writes nothing; a later failure
+     * compensates only the targets this commit wrote, and only while they still
+     * hold this commit's bytes.
+     */
+    async commit(targets) {
+        for (const target of targets) {
+            const current = await this.io.readText(target.path);
+            if (current !== target.expected)
+                return { ok: false, changed: [], errors: [{ code: 'cas-conflict', message: 'target changed after plan: ' + target.path, target: target.path }] };
+        }
+        const written = [];
+        for (const target of targets) {
+            const result = await this.writeOne(target);
+            if (!result.ok) {
+                const compensation = await this.compensate(written);
+                return { ok: false, changed: written.map(item => item.path), errors: [...result.errors, ...compensation] };
+            }
+            written.push(target);
+        }
+        return { ok: true, changed: written.map(item => item.path), errors: [] };
+    }
+    /**
+     * Restore a target to its before bytes only if it still holds the bytes this
+     * unit wrote. A concurrent writer wins and the compensation is reported.
+     */
+    async restore(target) {
+        const result = await this.writeOne({ path: target.path, expected: target.after, next: target.before });
+        if (result.ok)
+            return result;
+        if (result.errors.some(error => error.code === 'cas-conflict')) {
+            return { ok: false, changed: [], errors: [{ code: 'compensation-blocked', message: 'compensation refused: target changed after this unit; leave the concurrent bytes in place', target: target.path }] };
+        }
+        return result;
+    }
+    async compensate(written) {
+        const errors = [];
+        for (const target of [...written].reverse()) {
+            const result = await this.restore({ path: target.path, before: target.expected, after: target.next });
+            if (!result.ok)
+                errors.push(...result.errors);
+        }
+        return errors;
+    }
+}
+//# sourceMappingURL=write-kernel.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-core",
   "description": "Shared stores, prompts, signals and lifecycle logic for the dsh-evolution plugin family (community build)",
-  "version": "0.32.3",
+  "version": "0.32.5",
   "publishConfig": {
     "access": "public"
   },
@@ -49,7 +49,7 @@
     "yaml": "^2.4.2",
     "zod": "^4.4.3",
     "js-yaml": "^4.1.0",
-    "@lmzhen/dsh-evolution-contract": "^0.32.3"
+    "@lmzhen/dsh-evolution-contract": "^0.32.5"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.5",

package/persisted-write-inventory.json

@@ -87,7 +87,7 @@
       "path": "<evolutionHome>/<review|curator|pending>-state.json",
       "writer": "evolution-state-json/src/index.ts",
       "serializedBy": "transact",
-      "marker": "transactIo(io(), join(root, file)",
+      "marker": "new WriteKernel({ io: io() }).run({ path: join(root, file)",
       "state": [],
       "note": "The durable state stack (review/curator/pending). S4.4/O-6 moved its three warn/rewrite sets into the provider instance (QuarantineMemory), so no module-scope N12 store remains here."
     },
@@ -297,15 +297,6 @@
       "marker": "transactIo(io, pairIndexPath(home)",
       "state": [],
       "note": "pairKey → result/runId/target index; RMW under the same IO lock so two merge runs cannot lose each other's entries."
-    },
-    {
-      "id": "state-store-collections",
-      "path": "<evolutionHome>/state-store/<collection>.json",
-      "writer": "evolution-state-json/src/state-store.ts",
-      "serializedBy": "transact",
-      "marker": "transactIo(this.io, this.path(collection)",
-      "state": [],
-      "note": "Generic contract StateStore collections (one file per collection); provider serial queue plus transactIo. cross-process false on the node backend."
     }
   ]
 }