@lmzhen/dsh-evolution-merge 0.30.17 → 0.30.18

package/lib/index.js

@@ -1,9 +1,10 @@
-import { join, resolve, sep } from "node:path";
+import { dirname, join } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { pairKeyOf, screen, selectCandidates, toEngineCandidate } from "@lmzhen/dsh-evolution-merge-engine";
-import { DEFAULT_SKILL_LIMITS, authorityFrom, contentHash, createSubagentChannel, evolutionHome, evolutionIoAdapter, executeUnitUndo, isPresent, newRunRegistry, newSkillLibrary, parseFrontmatter, planUnitUndoAcross, policyStageLimits, probeAbsent, probeList, probePresent, probeText, probeUnknown, scanContentThreats, skillsRoot, supportRefs, transactIo, validateFrontmatter, validateSupportPath } from "@lmzhen/dsh-evolution-core";
+import { DEFAULT_SKILL_LIMITS, SkillLibrary, UnitTransactions, authorityFrom, contentHash, createSubagentChannel, evolutionHome, evolutionIoAdapter, executeUnitUndo, isPresent, isProcessAlive, newRunRegistry, newSkillLibrary, parseFrontmatter, planUnitUndoAcross, policyStageLimits, probeAbsent, probeList, probePresent, probeText, probeUnknown, readTreeLock, readUnitEvidence, runsFile, scanContentThreats, skillLibraryUnitBackend, supportRefs, transactIo, validateFrontmatter, validateSupportPath } from "@lmzhen/dsh-evolution-core";
 import { HOST_ROUTES, json, methodNotAllowed, registerHostRoutes } from "@lmzhen/dsh-evolution-core/http-routes";
 import { createHash, randomUUID } from "node:crypto";
+import { mkdir, open, readFile, unlink } from "node:fs/promises";
 //#region lib/types/adapters/select.js
 /** Host selector correction: engine selector does not route judge errors to candidates. */
 function selectWithErrors(report) {
@@ -132,7 +133,7 @@ function createEngineRunner(llm, route) {
 * The data layer keeps four states; the user face collapses verify/fuse into one retry
 * queue and keeps the stage as a chip. The API queue must never expose the raw state.
 */
-const MERGE_STATE_VERSION = 2;
+const MERGE_STATE_VERSION = 3;
 const MERGE_PAIR_STATES = [
 	"verify",
 	"pending",
@@ -181,7 +182,7 @@ function rowIdOf(key) {
 }
 function emptyMergeState() {
 	return {
-		schemaVersion: 2,
+		schemaVersion: 3,
 		rows: []
 	};
 }
@@ -218,6 +219,396 @@ function migrateV1Row(row) {
 	};
 }
 //#endregion
+//#region lib/types/domain/row-v3.js
+function bad$1(code, message) {
+	return {
+		ok: false,
+		code,
+		message
+	};
+}
+function advance(row, at, patch) {
+	return {
+		...row,
+		...patch,
+		version: row.version + 1,
+		updatedAt: at
+	};
+}
+function transitionV3(row, event, expectedVersion, at = (/* @__PURE__ */ new Date()).toISOString()) {
+	if (row.version !== expectedVersion) return bad$1("version-conflict", "expected " + String(expectedVersion) + ", got " + String(row.version));
+	switch (row.state) {
+		case "verify":
+			if (event.type === "verify-passed") return {
+				ok: true,
+				row: advance(row, at, {
+					state: "pending",
+					target: event.target,
+					decision: event.decision,
+					sourceRevision: event.sourceRevision,
+					attempts: 0
+				}),
+				version: expectedVersion + 1
+			};
+			if (event.type === "auto-approved") return {
+				ok: true,
+				row: advance(row, at, {
+					state: "approved",
+					target: event.target,
+					decision: event.decision,
+					attempts: 0,
+					...event.runId === void 0 ? {} : { runId: event.runId }
+				}),
+				version: expectedVersion + 1
+			};
+			if (event.type === "failed") return {
+				ok: true,
+				row: advance(row, at, {
+					failure: event.failure,
+					attempts: row.attempts + 1
+				}),
+				version: expectedVersion + 1
+			};
+			if (event.type === "skipped") return {
+				ok: true,
+				row: advance(row, at, {
+					state: "skipped",
+					reason: event.reason,
+					attempts: row.attempts
+				}),
+				version: expectedVersion + 1
+			};
+			if (event.type === "superseded") return {
+				ok: true,
+				row: null,
+				version: expectedVersion + 1
+			};
+			return bad$1("illegal-transition", "verify/" + event.type);
+		case "pending":
+			if (event.type === "approved") return {
+				ok: true,
+				row: advance(row, at, {
+					state: "approved",
+					runId: event.runId
+				}),
+				version: expectedVersion + 1
+			};
+			if (event.type === "auto-approved") return {
+				ok: true,
+				row: advance(row, at, {
+					state: "approved",
+					...event.runId === void 0 ? {} : { runId: event.runId }
+				}),
+				version: expectedVersion + 1
+			};
+			if (event.type === "staged") return {
+				ok: true,
+				row: advance(row, at, {
+					state: "fuse",
+					staging: event.ref === void 0 ? { kind: "absent" } : {
+						kind: "present",
+						ref: event.ref,
+						expiresAt: event.expiresAt ?? Date.now() + 7 * 864e5
+					}
+				}),
+				version: expectedVersion + 1
+			};
+			if (event.type === "skipped") return {
+				ok: true,
+				row: advance(row, at, {
+					state: "skipped",
+					reason: event.reason,
+					...event.origin === void 0 ? {} : { origin: event.origin }
+				}),
+				version: expectedVersion + 1
+			};
+			if (event.type === "expired") return {
+				ok: true,
+				row: advance(row, at, { expired: event.kind }),
+				version: expectedVersion + 1
+			};
+			if (event.type === "failed") return {
+				ok: true,
+				row: advance(row, at, {
+					failure: event.failure,
+					attempts: row.attempts + 1
+				}),
+				version: expectedVersion + 1
+			};
+			if (event.type === "superseded") return {
+				ok: true,
+				row: null,
+				version: expectedVersion + 1
+			};
+			return bad$1("illegal-transition", "pending/" + event.type);
+		case "approved":
+			if (event.type === "staged") return {
+				ok: true,
+				row: advance(row, at, {
+					state: "fuse",
+					staging: event.ref === void 0 ? { kind: "absent" } : {
+						kind: "present",
+						ref: event.ref,
+						expiresAt: event.expiresAt ?? Date.now() + 7 * 864e5
+					}
+				}),
+				version: expectedVersion + 1
+			};
+			if (event.type === "committed") return {
+				ok: true,
+				row: null,
+				version: expectedVersion + 1
+			};
+			if (event.type === "skipped") return {
+				ok: true,
+				row: advance(row, at, {
+					state: "skipped",
+					reason: event.reason
+				}),
+				version: expectedVersion + 1
+			};
+			if (event.type === "failed") return event.failure.retryable ? {
+				ok: true,
+				row: advance(row, at, {
+					state: "pending",
+					failure: event.failure,
+					attempts: row.attempts + 1
+				}),
+				version: expectedVersion + 1
+			} : {
+				ok: true,
+				row: advance(row, at, {
+					state: "skipped",
+					reason: event.failure.code,
+					failure: event.failure,
+					attempts: row.attempts + 1
+				}),
+				version: expectedVersion + 1
+			};
+			if (event.type === "superseded") return {
+				ok: true,
+				row: null,
+				version: expectedVersion + 1
+			};
+			return bad$1("illegal-transition", "approved/" + event.type);
+		case "fuse":
+			if (event.type === "staged") return {
+				ok: true,
+				row: advance(row, at, { staging: event.ref === void 0 ? { kind: "absent" } : {
+					kind: "present",
+					ref: event.ref,
+					expiresAt: event.expiresAt ?? Date.now() + 7 * 864e5
+				} }),
+				version: expectedVersion + 1
+			};
+			if (event.type === "committed") return {
+				ok: true,
+				row: null,
+				version: expectedVersion + 1
+			};
+			if (event.type === "skipped") return {
+				ok: true,
+				row: advance(row, at, {
+					state: "skipped",
+					reason: event.reason
+				}),
+				version: expectedVersion + 1
+			};
+			if (event.type === "failed") return event.failure.retryable ? {
+				ok: true,
+				row: advance(row, at, {
+					state: "pending",
+					failure: event.failure,
+					attempts: row.attempts + 1
+				}),
+				version: expectedVersion + 1
+			} : {
+				ok: true,
+				row: advance(row, at, {
+					state: "skipped",
+					reason: event.failure.code,
+					failure: event.failure,
+					attempts: row.attempts + 1
+				}),
+				version: expectedVersion + 1
+			};
+			if (event.type === "superseded") return {
+				ok: true,
+				row: null,
+				version: expectedVersion + 1
+			};
+			return bad$1("illegal-transition", "fuse/" + event.type);
+		case "skipped":
+			if (event.type === "restored" || event.type === "superseded") return {
+				ok: true,
+				row: null,
+				version: expectedVersion + 1
+			};
+			return bad$1("illegal-transition", "skipped is terminal");
+	}
+}
+function object(value) {
+	return value !== null && typeof value === "object";
+}
+function string(value) {
+	return typeof value === "string" && value.length > 0;
+}
+function number(value) {
+	return typeof value === "number" && Number.isFinite(value);
+}
+/** Runtime validation for a persisted v3 row. */
+function isV3Row(value) {
+	if (!object(value)) return false;
+	if (!string(value.id) || !string(value.pairKey) || !string(value.a) || !string(value.b) || !number(value.version)) return false;
+	if (!string(value.createdAt) || !string(value.updatedAt)) return false;
+	if (value.origin !== "agent" && value.origin !== "human" && value.origin !== "system") return false;
+	if (value.failure !== void 0 && !object(value.failure)) return false;
+	if (!number(value.attempts)) return false;
+	switch (value.state) {
+		case "verify": return value.verifySubState === "candidate" || value.verifySubState === "screened" || value.verifySubState === "unverified";
+		case "pending": return string(value.target) && object(value.decision);
+		case "approved": return string(value.target) && object(value.decision);
+		case "fuse":
+			if (!string(value.target) || !object(value.decision) || !object(value.staging)) return false;
+			if (value.staging.kind === "present") return string(value.staging.ref) && number(value.staging.expiresAt);
+			if (value.staging.kind === "expired") return number(value.staging.expiresAt);
+			return value.staging.kind === "absent";
+		case "skipped": return string(value.reason);
+		default: return false;
+	}
+}
+//#endregion
+//#region lib/types/domain/row-v3-bridge.js
+function v3ToLegacy(row) {
+	const common = {
+		id: row.id,
+		pairKey: row.pairKey,
+		a: row.a,
+		b: row.b,
+		state: row.state,
+		queue: row.state === "verify" ? "verify" : row.state === "pending" ? "pending" : row.state === "skipped" ? "skipped" : "fuse",
+		version: row.version,
+		origin: row.origin,
+		...row.runId === void 0 ? {} : { runId: row.runId },
+		...row.failure === void 0 ? {} : { failure: row.failure },
+		createdAt: row.createdAt,
+		updatedAt: row.updatedAt
+	};
+	if (row.state === "verify") return {
+		...common,
+		...row.sourceRevision === void 0 ? {} : { sourceRevision: row.sourceRevision },
+		attempts: row.attempts
+	};
+	if (row.state === "skipped") return {
+		...common,
+		reason: row.reason,
+		queue: "skipped",
+		...row.expiredAt === void 0 ? {} : { expired: "target-taken" },
+		attempts: row.attempts
+	};
+	const target = {
+		requested: row.target,
+		...row.state === "fuse" ? { actual: row.target } : {}
+	};
+	if (row.state === "fuse") return {
+		...common,
+		target,
+		decision: row.decision,
+		attempts: row.attempts,
+		...row.sourceRevision === void 0 ? {} : { sourceRevision: row.sourceRevision },
+		...row.runId === void 0 ? {} : { runId: row.runId },
+		...row.staging.kind === "present" ? {
+			stagingRef: row.staging.ref,
+			stagingExpiresAt: row.staging.expiresAt
+		} : row.staging.kind === "expired" ? {
+			stagingExpiresAt: row.staging.expiresAt,
+			...row.staging.ref === void 0 ? {} : { stagingRef: row.staging.ref }
+		} : {}
+	};
+	return {
+		...common,
+		target,
+		decision: row.decision,
+		attempts: row.attempts,
+		...row.sourceRevision === void 0 ? {} : { sourceRevision: row.sourceRevision },
+		...row.state === "pending" && row.targetRevision !== void 0 ? { targetRevision: row.targetRevision } : {},
+		...row.state === "pending" && row.expired !== void 0 ? { expired: row.expired } : {},
+		...row.state === "approved" && row.runId !== void 0 ? { runId: row.runId } : {}
+	};
+}
+function legacyToV3(row) {
+	const base = {
+		id: row.id,
+		pairKey: row.pairKey,
+		a: row.a,
+		b: row.b,
+		version: row.version ?? 0,
+		createdAt: row.createdAt,
+		updatedAt: row.updatedAt,
+		origin: row.origin ?? "system",
+		...row.runId === void 0 ? {} : { runId: row.runId },
+		...row.failure === void 0 ? {} : { failure: row.failure }
+	};
+	if (row.state === "verify") return {
+		...base,
+		state: "verify",
+		verifySubState: "unverified",
+		attempts: row.attempts ?? 0,
+		...row.sourceRevision === void 0 ? {} : { sourceRevision: row.sourceRevision }
+	};
+	if (row.state === "skipped") return {
+		...base,
+		state: "skipped",
+		reason: row.reason ?? "skipped",
+		attempts: row.attempts ?? 0
+	};
+	const targetName = row.target?.requested ?? row.a;
+	const decision = row.decision ?? {
+		shouldMerge: false,
+		mode: "keep",
+		target: targetName,
+		sources: [row.b],
+		rationale: "legacy row without decision"
+	};
+	if (row.state === "pending") return {
+		...base,
+		state: "pending",
+		target: targetName,
+		decision,
+		attempts: row.attempts ?? 0,
+		...row.sourceRevision === void 0 ? {} : { sourceRevision: row.sourceRevision },
+		...row.targetRevision === void 0 ? {} : { targetRevision: row.targetRevision },
+		...row.expired === void 0 ? {} : { expired: row.expired }
+	};
+	if (row.state === "approved") return {
+		...base,
+		state: "approved",
+		target: targetName,
+		decision,
+		attempts: row.attempts ?? 0,
+		...row.sourceRevision === void 0 ? {} : { sourceRevision: row.sourceRevision },
+		...row.runId === void 0 ? {} : { runId: row.runId }
+	};
+	const staging = row.stagingRef !== void 0 ? row.stagingExpiresAt !== void 0 ? {
+		kind: "present",
+		ref: row.stagingRef,
+		expiresAt: row.stagingExpiresAt
+	} : {
+		kind: "expired",
+		expiresAt: 0
+	} : { kind: "absent" };
+	return {
+		...base,
+		state: "fuse",
+		target: targetName,
+		decision,
+		attempts: row.attempts ?? 0,
+		...row.sourceRevision === void 0 ? {} : { sourceRevision: row.sourceRevision },
+		...row.runId === void 0 ? {} : { runId: row.runId },
+		staging
+	};
+}
+//#endregion
 //#region lib/types/domain/ledger.js
 /** Pure v2 ledger normalization/projection. No IO. */
 function isRow(value) {
@@ -246,7 +637,7 @@ function parseLedger(raw) {
 		};
 	}
 	const body = parsed;
-	if (typeof body.schemaVersion === "number" && body.schemaVersion > 2) return {
+	if (typeof body.schemaVersion === "number" && body.schemaVersion > 3) return {
 		ok: false,
 		ledger: {
 			schemaVersion: 2,
@@ -262,6 +653,23 @@ function parseLedger(raw) {
 		},
 		note: "rows missing"
 	};
+	if (body.schemaVersion === 3) {
+		if (!body.rows.every(isV3Row)) return {
+			ok: false,
+			ledger: {
+				schemaVersion: 2,
+				rows: []
+			},
+			note: body.rows.some((row) => row !== null && typeof row === "object" && "pairKey" in row && "version" in row) ? "merge-state-needs-repair" : "merge-state-forward-only"
+		};
+		return {
+			ok: true,
+			ledger: {
+				schemaVersion: 2,
+				rows: body.rows.map(v3ToLegacy)
+			}
+		};
+	}
 	const rows = [];
 	let skipped = 0;
 	for (const value of body.rows) {
@@ -292,6 +700,80 @@ function parseLedger(raw) {
 	};
 }
 //#endregion
+//#region lib/types/domain/row-tx.js
+/** G3-5 RowTx pure write API: only createVerify/createSkipped/transition. */
+function bad(code, message) {
+	return {
+		ok: false,
+		code,
+		message
+	};
+}
+function applyRowWrite(rows, write, at) {
+	if (write.kind === "transition") {
+		const index = rows.findIndex((row) => row.id === write.id);
+		if (index < 0) return bad("row-not-found", "row not found: " + write.id);
+		const current = rows[index];
+		const moved = transitionV3(current, write.event, write.expectedVersion, at);
+		if (!moved.ok) return bad(moved.code, moved.message);
+		if (moved.row === null) return {
+			ok: true,
+			rows: rows.filter((_, atIndex) => atIndex !== index),
+			row: null
+		};
+		const next = [...rows];
+		next[index] = moved.row;
+		return {
+			ok: true,
+			rows: next,
+			row: moved.row
+		};
+	}
+	if (write.row.version !== 0) return bad("row-invalid", "create requires version 0");
+	if (write.kind === "createVerify" && (write.row.state !== "verify" || write.row.verifySubState !== "unverified")) return bad("row-invalid", "createVerify requires verify/unverified");
+	if (write.kind === "createSkipped" && write.row.state !== "skipped") return bad("row-invalid", "createSkipped requires skipped");
+	if (!isV3Row(write.row)) return bad("row-invalid", "created row is invalid");
+	if (rows.some((row) => row.id === write.row.id)) return bad("row-duplicate", "duplicate row id: " + write.row.id);
+	return {
+		ok: true,
+		rows: [...rows, write.row],
+		row: write.row
+	};
+}
+//#endregion
+//#region lib/types/domain/staging-index.js
+/** Durable staging index for v3 pending/approved rows (rowId-keyed). */
+function stagingIndexPath(home, rowId) {
+	return join(home, "merge", "staging-index", encodeURIComponent(rowId) + ".json");
+}
+async function readStagingIndex(io, home, rowId, now = Date.now()) {
+	let raw;
+	try {
+		raw = await io.readText(stagingIndexPath(home, rowId));
+	} catch {
+		return null;
+	}
+	if (raw === null) return null;
+	try {
+		const entry = JSON.parse(raw);
+		if (entry.rowId !== rowId || typeof entry.ref !== "string" || typeof entry.expiresAt !== "number") return null;
+		if (entry.expiresAt <= now) return null;
+		return entry;
+	} catch {
+		return null;
+	}
+}
+async function writeStagingIndex(io, home, entry) {
+	const text = JSON.stringify(entry, null, 2) + "\n";
+	if (io.transact !== void 0) await io.transact(stagingIndexPath(home, entry.rowId), () => text);
+	else await io.writeText(stagingIndexPath(home, entry.rowId), text);
+}
+async function deleteStagingIndex(io, home, rowId) {
+	try {
+		await io.remove(stagingIndexPath(home, rowId));
+	} catch {}
+}
+//#endregion
 //#region lib/types/state.js
 /**
 * The one merge-state ledger: <home>/merge/merge-state.json.
@@ -326,7 +808,7 @@ async function loadMergeState(io, home) {
 		return {
 			ok: false,
 			state: {
-				schemaVersion: 2,
+				schemaVersion: 3,
 				rows: []
 			}
 		};
@@ -335,12 +817,68 @@ async function loadMergeState(io, home) {
 	return {
 		ok: parsed.ok,
 		state: {
-			schemaVersion: 2,
+			schemaVersion: 3,
 			rows: parsed.rows
 		},
 		...parsed.note === void 0 ? {} : { note: parsed.note }
 	};
 }
+/** Schema probe for doctor; the only other reader of mergeStatePath. */
+async function loadStateSchema(io, home) {
+	try {
+		const raw = await io.readText(mergeStatePath(home));
+		if (raw === null) return null;
+		const parsed = JSON.parse(raw);
+		return typeof parsed.schemaVersion === "number" ? parsed.schemaVersion : null;
+	} catch {
+		return null;
+	}
+}
+/** G3-5 runtime write API: only createVerify/createSkipped/transition. v2 writes are rejected. */
+async function transactRows(io, home, fn) {
+	let result;
+	await transactIo(io, mergeStatePath(home), (current) => {
+		let rows = [];
+		if (current !== null) {
+			let parsed;
+			try {
+				parsed = JSON.parse(current);
+			} catch {
+				throw new Error("merge-state-needs-repair");
+			}
+			const body = parsed;
+			if (body.schemaVersion !== 3 || !Array.isArray(body.rows) || !body.rows.every(isV3Row)) throw new Error(body.schemaVersion === 2 ? "merge-state-migration-required" : "merge-state-needs-repair");
+			rows = body.rows;
+		}
+		const apply = (write) => {
+			const next = applyRowWrite(rows, write, (/* @__PURE__ */ new Date()).toISOString());
+			if (next.ok) rows = next.rows;
+			return next;
+		};
+		result = fn({
+			rows: () => rows,
+			createVerify: (row) => apply({
+				kind: "createVerify",
+				row
+			}),
+			createSkipped: (row) => apply({
+				kind: "createSkipped",
+				row
+			}),
+			transition: (id, event, expectedVersion) => apply({
+				kind: "transition",
+				id,
+				event,
+				expectedVersion
+			})
+		});
+		return JSON.stringify({
+			schemaVersion: 3,
+			rows
+		}, null, 2);
+	});
+	return result;
+}
 /** The ONE write point. The callback returns the whole row set, not a delta. */
 async function mutateMergeState(io, home, now, fn) {
 	let result;
@@ -349,9 +887,11 @@ async function mutateMergeState(io, home, now, fn) {
 		if (!parsed.ok || parsed.note === "merge-state-forward-only") throw new Error(parsed.note ?? "merge-state-invalid");
 		const out = fn(parsed.rows);
 		result = out.result;
+		const rows = out.rows.map((row) => legacyToV3(row));
+		if (rows.some((row) => row === null)) throw new Error("merge-state-v3-row-invalid");
 		return JSON.stringify({
-			schemaVersion: 2,
-			rows: out.rows
+			schemaVersion: 3,
+			rows
 		}, null, 2);
 	});
 	return result;
@@ -425,6 +965,19 @@ async function moveRow(io, home, now, id, patch) {
 		};
 	});
 }
+/** G3-5 v3-aware drop: only terminal events. */
+async function dropRowV3(io, home, id, event, unitId = "unknown") {
+	const dropped = await transactRows(io, home, (tx) => {
+		const row = tx.rows().find((item) => item.id === id);
+		if (row === void 0) return false;
+		return tx.transition(id, event === "committed" ? {
+			type: "committed",
+			unitId
+		} : { type: event }, row.version).ok;
+	});
+	if (dropped) await deleteStagingIndex(io, home, id);
+	return dropped;
+}
 async function dropRow(io, home, now, id) {
 	return await mutateMergeState(io, home, now, (rows) => {
 		const next = rows.filter((item) => item.id !== id);
@@ -596,20 +1149,6 @@ async function cleanupExpiredStaging(io, home, now, keep = /* @__PURE__ */ new S
 	};
 }
 //#endregion
-//#region lib/types/domain/commit-journal.js
-/** What a restart may do with the last durable phase. */
-function recoveryFor(journal) {
-	switch (journal.phase) {
-		case "prepared": return "retry-commit";
-		case "target-written": return "rollback-target";
-		case "sources-archived": return "rollback-sources";
-		case "committed":
-		case "rolled-back":
-		case "failed": return "none";
-		default: return "refuse";
-	}
-}
-//#endregion
 //#region lib/types/domain/commit-journal-store.js
 /** Durable commit journal: <home>/merge/journals/<run>.json. */
 function journalPath(home, runId) {
@@ -617,9 +1156,20 @@ function journalPath(home, runId) {
 }
 async function writeJournal(io, home, journal) {
 	const path = journalPath(home, journal.runId);
-	await io.writeText(path, JSON.stringify(journal, null, 2));
+	const content = JSON.stringify(journal, null, 2);
+	if (io.transact !== void 0) await io.transact(path, () => content);
+	else await io.writeText(path, content);
 	return path;
 }
+async function readJournal(io, home, runId) {
+	const raw = await io.readText(journalPath(home, runId));
+	if (raw === null) return null;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
 //#endregion
 //#region lib/types/commit-snapshot.js
 /** Pre-commit snapshot: enough to restore the target and archived sources after a crash. */
@@ -654,32 +1204,9 @@ async function writeCommitSnapshot(io, home, runId, plan, now, port) {
 	await io.writeText(snapshotPath(home, runId), JSON.stringify(snapshot, null, 2));
 	return snapshot;
 }
-async function readCommitSnapshot(io, home, runId) {
-	const raw = await io.readText(snapshotPath(home, runId));
-	if (raw === null) return null;
-	try {
-		return JSON.parse(raw);
-	} catch {
-		return null;
-	}
-}
 function isSafeSkillName(name) {
 	return /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name) && name !== "." && name !== "..";
 }
-function skillFilePath(root, name, path) {
-	if (!isSafeSkillName(name) || path.startsWith("/") || path.split("/").includes("..")) throw new Error("unsafe skill file: " + name + "/" + path);
-	const base = resolve(root, name);
-	const file = resolve(base, path);
-	if (!file.startsWith(base + sep)) throw new Error("skill file escapes skill: " + name + "/" + path);
-	return file;
-}
-function skillBodyPath(root, name) {
-	if (!isSafeSkillName(name)) throw new Error("unsafe skill name: " + name);
-	const base = resolve(root);
-	const path = resolve(base, name, "SKILL.md");
-	if (!path.startsWith(base + sep)) throw new Error("skill path escapes root: " + name);
-	return path;
-}
 //#endregion
 //#region lib/types/commit-receipt.js
 /**
@@ -757,448 +1284,488 @@ async function readCommitReceipt(io, home, runId, target) {
 }
 //#endregion
 //#region lib/types/commit-recovery.js
-/** Startup replay for non-terminal commit journals. */
-async function recoverCommitJournals(io, home, now, skillRoot, restoreSource, isActive) {
+/** Startup replay for non-terminal commit journals: report only, never write skills. */
+async function recoverCommitJournals(io, home, now, isActive) {
 	const dir = join(home, "merge", "journals");
-	if (!await io.exists(dir)) return [];
-	const files = (await io.list(dir)).filter((name) => name.endsWith(".json"));
 	const reports = [];
+	let files = [];
+	if (await io.exists(dir)) try {
+		files = (await io.list(dir)).filter((name) => name.endsWith(".json"));
+	} catch {
+		reports.push({
+			runId: "(list)",
+			phase: "unknown",
+			action: "journal-list-failed",
+			ok: false,
+			journalPath: dir
+		});
+	}
 	for (const file of files) {
-		let journal;
-		try {
-			journal = JSON.parse(await io.readText(join(dir, file)) ?? "");
-		} catch {
-			continue;
-		}
-		if (isActive?.(journal.runId) === true) {
-			reports.push({
-				runId: journal.runId,
-				phase: journal.phase,
-				action: "skipped-active-run",
-				ok: true
-			});
-			continue;
-		}
-		const recovery = recoveryFor(journal);
-		if (recovery === "none") continue;
-		if (recovery === "refuse") {
-			reports.push({
-				runId: journal.runId,
-				phase: journal.phase,
-				action: "unknown-phase-refused",
-				ok: false
-			});
-			continue;
-		}
-		let receipt = null;
+		const path = join(dir, file);
 		try {
-			receipt = await readCommitReceipt(io, home, journal.runId, journal.target);
-		} catch {
-			reports.push({
-				runId: journal.runId,
-				phase: journal.phase,
-				action: "receipt-read-failed",
-				ok: false
-			});
-			continue;
-		}
-		if (receipt !== null) {
-			await writeJournal(io, home, {
-				...journal,
-				phase: "committed",
-				unitId: receipt.unitId,
-				updatedAt: new Date(now).toISOString()
-			});
+			let journal;
+			try {
+				journal = JSON.parse(await io.readText(path) ?? "");
+			} catch {
+				reports.push({
+					runId: file.replace(/\.json$/, ""),
+					phase: "unknown",
+					action: "journal-unreadable",
+					ok: false,
+					journalPath: path
+				});
+				continue;
+			}
+			if (isActive?.(journal.runId) === true) {
+				reports.push({
+					runId: journal.runId,
+					phase: journal.phase,
+					action: "skipped-active-run",
+					ok: true,
+					target: journal.target,
+					sources: journal.sources,
+					journalPath: path
+				});
+				continue;
+			}
+			let receipt = null;
+			try {
+				receipt = await readCommitReceipt(io, home, journal.runId, journal.target);
+			} catch {
+				reports.push({
+					runId: journal.runId,
+					phase: journal.phase,
+					action: "receipt-read-failed",
+					ok: false,
+					target: journal.target,
+					sources: journal.sources,
+					journalPath: path
+				});
+				continue;
+			}
+			if (receipt !== null) {
+				await writeJournal(io, home, {
+					...journal,
+					phase: "committed",
+					unitId: receipt.unitId,
+					updatedAt: new Date(now).toISOString()
+				});
+				reports.push({
+					runId: journal.runId,
+					phase: journal.phase,
+					action: "receipt-committed",
+					ok: true,
+					target: journal.target,
+					sources: journal.sources,
+					journalPath: path,
+					unitId: receipt.unitId
+				});
+				continue;
+			}
+			if (journal.phase === "committed") {
+				reports.push({
+					runId: journal.runId,
+					phase: journal.phase,
+					action: "receipt-missing",
+					ok: false,
+					target: journal.target,
+					sources: journal.sources,
+					journalPath: path
+				});
+				continue;
+			}
+			if (journal.phase === "failed" || journal.phase === "rolled-back") continue;
 			reports.push({
 				runId: journal.runId,
 				phase: journal.phase,
-				action: "receipt-committed",
-				ok: true
+				action: "manual-required",
+				ok: false,
+				target: journal.target,
+				sources: journal.sources,
+				journalPath: path,
+				snapshotPath: snapshotPath(home, journal.runId)
 			});
-			continue;
-		}
-		let snapshot;
-		try {
-			snapshot = await readCommitSnapshot(io, home, journal.runId);
 		} catch (error) {
 			reports.push({
-				runId: journal.runId,
-				phase: journal.phase,
-				action: "snapshot-read-failed: " + (error instanceof Error ? error.message : String(error)),
-				ok: false
+				runId: file.replace(/\.json$/, ""),
+				phase: "unknown",
+				action: "recovery-error: " + (error instanceof Error ? error.message : String(error)),
+				ok: false,
+				journalPath: path
 			});
-			continue;
 		}
-		let action = "report-only";
-		let ok = true;
-		if (recovery === "retry-commit") action = "no-host-write";
-		else if (snapshot === null) {
-			action = "snapshot-missing";
-			ok = false;
-		} else try {
-			if (recovery === "rollback-sources") {
-				let restoredArchived = restoreSource !== void 0;
-				if (restoreSource !== void 0) {
-					for (const source of snapshot.sourceBodies) if (!await restoreSource(source.name)) restoredArchived = false;
+	}
+	const unitDir = join(home, "merge", "unit-journals");
+	if (await io.exists(unitDir)) {
+		let unitFiles = [];
+		try {
+			unitFiles = (await io.list(unitDir)).filter((name) => name.endsWith(".json"));
+		} catch {}
+		for (const file of unitFiles) {
+			const path = join(unitDir, file);
+			try {
+				const journal = JSON.parse(await io.readText(path) ?? "");
+				if (await readUnitEvidence(io, home, journal.unitId) !== null) {
+					reports.push({
+						runId: journal.runId,
+						phase: "committed",
+						action: "unit-committed",
+						ok: true,
+						target: journal.target,
+						sources: journal.sources,
+						journalPath: path,
+						unitId: journal.unitId
+					});
+					continue;
 				}
-				if (!restoredArchived) for (const source of snapshot.sourceBodies) await io.writeText(skillBodyPath(skillRoot, source.name), source.body);
+				if (journal.phase === "committed") {
+					reports.push({
+						runId: journal.runId,
+						phase: "committed",
+						action: "unit-evidence-missing",
+						ok: false,
+						target: journal.target,
+						sources: journal.sources,
+						journalPath: path,
+						unitId: journal.unitId
+					});
+					continue;
+				}
+				if (journal.phase === "failed" || journal.phase === "rolled-back") continue;
+				reports.push({
+					runId: journal.runId,
+					phase: journal.phase,
+					action: "unit-manual-required",
+					ok: false,
+					target: journal.target,
+					sources: journal.sources,
+					journalPath: path,
+					unitId: journal.unitId
+				});
+			} catch {
+				reports.push({
+					runId: "(unit)",
+					phase: "unknown",
+					action: "unit-journal-unreadable",
+					ok: false,
+					journalPath: path
+				});
 			}
-			if (snapshot.create && snapshot.targetBody === null) {
-				try {
-					await io.remove(skillBodyPath(skillRoot, snapshot.target));
-				} catch {}
-				try {
-					const dir = join(skillRoot, snapshot.target);
-					if ((await io.list(dir)).length === 0) await io.remove(dir);
-				} catch {}
-			} else if (snapshot.targetBody !== null) await io.writeText(skillBodyPath(skillRoot, snapshot.target), snapshot.targetBody);
-			const oldPaths = new Set((snapshot.targetSupport ?? []).map((file) => file.path));
-			for (const file of snapshot.targetSupport ?? []) await io.writeText(skillFilePath(skillRoot, snapshot.target, file.path), file.content);
-			for (const file of snapshot.targetSupportAfter ?? []) if (!oldPaths.has(file.path)) try {
-				await io.remove(skillFilePath(skillRoot, snapshot.target, file.path));
-			} catch {}
-			for (const file of snapshot.sourceSupport ?? []) await io.writeText(skillFilePath(skillRoot, file.name, file.path), file.content);
-			action = recovery === "rollback-sources" ? "restored-sources-and-target" : "restored-target";
-		} catch (error) {
-			action = "restore-failed: " + (error instanceof Error ? error.message : String(error));
-			ok = false;
 		}
-		if (ok) await writeJournal(io, home, {
-			...journal,
-			phase: "rolled-back",
-			updatedAt: new Date(now).toISOString()
-		});
-		reports.push({
-			runId: journal.runId,
-			phase: journal.phase,
-			action,
-			ok
-		});
 	}
-	await io.writeText(join(home, "merge", "recovery.json"), JSON.stringify(reports, null, 2));
+	try {
+		await io.writeText(join(home, "merge", "recovery.json"), JSON.stringify(reports, null, 2));
+	} catch {}
 	return reports;
 }
 //#endregion
-//#region lib/types/coordinator.js
-/**
-* Pure merge transition table. No io, no run shell, no subagents.
-*
-* Every transition returns the whole next row (or a drop), so the caller can persist it
-* through mutateMergeState in one transaction. Invalid transitions are refused by name;
-* a caller never "repairs" a row by guessing which state the operator meant.
-*/
-function invalid(event, state) {
-	return {
-		ok: false,
-		code: "invalid-transition",
-		message: "cannot apply " + event.type + " to " + (state ?? "no row")
-	};
-}
-/** Drop fields that must not survive a transition; optional fields stay absent. */
-function base(row, at) {
+//#region lib/types/command-surface.js
+const flag = (name, kind = "boolean", valueName) => ({
+	name,
+	kind,
+	...valueName === void 0 ? {} : { valueName }
+});
+const pos = (name, kind, required = true) => ({
+	name,
+	kind,
+	required
+});
+const action = (id, command, confirm = false) => ({
+	id,
+	command,
+	confirm
+});
+function spec(id, words, flags, positional, readOnly, needsRun, rowActions, fallback) {
 	return {
-		id: row.id,
-		pairKey: row.pairKey,
-		a: row.a,
-		b: row.b,
-		state: row.state,
-		queue: row.queue,
-		createdAt: row.createdAt,
-		updatedAt: at,
-		...row.runId === void 0 ? {} : { runId: row.runId },
-		...row.unitId === void 0 ? {} : { unitId: row.unitId },
-		...row.origin === void 0 ? {} : { origin: row.origin },
-		...row.decision === void 0 ? {} : { decision: row.decision },
-		...row.sourceRevision === void 0 ? {} : { sourceRevision: row.sourceRevision },
-		...row.targetRevision === void 0 ? {} : { targetRevision: row.targetRevision },
-		...row.attempts === void 0 ? {} : { attempts: row.attempts },
-		...row.stagingRef === void 0 ? {} : { stagingRef: row.stagingRef },
-		...row.stagingExpiresAt === void 0 ? {} : { stagingExpiresAt: row.stagingExpiresAt },
-		...row.expired === void 0 ? {} : { expired: row.expired },
-		...row.reason === void 0 ? {} : { reason: row.reason },
-		...row.target === void 0 ? {} : { target: row.target }
+		id,
+		words,
+		flags,
+		positional,
+		summary: id,
+		readOnly,
+		needsRun,
+		defaults: {},
+		rowActions,
+		fallback
 	};
 }
-function next(row, at, state, patch = {}) {
-	return {
-		ok: true,
-		row: {
-			...base(row, at),
-			state,
-			queue: queueOf(state),
-			...patch
+const MERGE_COMMAND_SURFACE = {
+	wireVersion: 1,
+	prefix: "/evolution merge",
+	commands: [
+		spec("merge.scan", ["scan"], [], [], false, true, [], "/evolution merge scan"),
+		spec("merge.pair", ["pair"], [], [pos("a", "skill"), pos("b", "skill")], false, true, [action("pair", "/evolution merge pair", true)], "/evolution merge pair <a> <b>"),
+		spec("merge.pair.force", ["pair"], [flag("force")], [pos("a", "skill"), pos("b", "skill")], false, true, [], "/evolution merge pair --force <a> <b>"),
+		spec("merge.status", ["status"], [], [pos("id", "id", false)], true, false, [action("status", "/evolution merge status")], "/evolution merge status"),
+		spec("merge.report", ["report"], [], [pos("id", "id", false)], true, false, [action("report", "/evolution merge report")], "/evolution merge report"),
+		spec("merge.cancel", ["cancel"], [], [pos("id", "id", false)], false, false, [action("cancel", "/evolution merge cancel")], "/evolution merge cancel <id>"),
+		spec("merge.runs", ["runs"], [], [], true, false, [], "/evolution merge runs"),
+		spec("merge.pending", ["pending"], [], [], true, false, [], "/evolution merge pending"),
+		spec("merge.pending.expired", ["pending"], [flag("expired")], [], true, false, [], "/evolution merge pending --expired"),
+		spec("merge.approve", ["approve"], [], [pos("id", "id")], false, true, [action("approve", "/evolution merge approve <id>")], "/evolution merge approve <id>"),
+		spec("merge.reject", ["reject"], [], [pos("id", "id")], false, false, [action("reject", "/evolution merge reject <id>", true)], "/evolution merge reject <id>"),
+		spec("merge.skipped", ["skipped"], [], [], true, false, [], "/evolution merge skipped"),
+		spec("merge.skipped.restore", ["skipped"], [flag("restore", "value", "id")], [], false, false, [action("restore", "/evolution merge skipped --restore <id>", true)], "/evolution merge skipped --restore <id>"),
+		spec("merge.candidates", ["candidates"], [], [], true, false, [], "/evolution merge candidates"),
+		spec("merge.candidates.retry", ["candidates"], [flag("retry", "value", "id")], [], false, true, [action("retry-candidates", "/evolution merge candidates --retry <id>")], "/evolution merge candidates --retry <id>"),
+		spec("merge.resume", ["resume"], [], [pos("id", "id", false)], true, false, [], "/evolution merge resume"),
+		spec("merge.resume.retry", ["resume"], [flag("retry", "value", "id")], [], false, true, [action("retry-resume", "/evolution merge resume --retry <id>")], "/evolution merge resume --retry <id>"),
+		spec("merge.discard", ["discard"], [], [pos("id", "id")], false, false, [action("discard", "/evolution merge discard <id>", true)], "/evolution merge discard <id>"),
+		spec("merge.undo", ["undo"], [flag("run", "value", "id")], [pos("target", "target")], false, false, [], "/evolution merge undo <target> --run <id>")
+	],
+	fallback: [
+		{
+			id: "scan",
+			command: "/evolution merge scan"
+		},
+		{
+			id: "pair",
+			command: "/evolution merge pair <a> <b>"
+		},
+		{
+			id: "candidates",
+			command: "/evolution merge candidates"
+		},
+		{
+			id: "pending",
+			command: "/evolution merge pending"
+		},
+		{
+			id: "skipped",
+			command: "/evolution merge skipped"
+		},
+		{
+			id: "resume",
+			command: "/evolution merge resume"
+		},
+		{
+			id: "status",
+			command: "/evolution merge status"
+		},
+		{
+			id: "report",
+			command: "/evolution merge report"
+		},
+		{
+			id: "doctor",
+			command: "/evolution merge doctor"
 		}
-	};
-}
-function transition(current, event) {
-	if (event.type === "candidate") {
-		if (current !== void 0) return {
-			ok: true,
-			row: current
-		};
-		const key = pairKey(event.a, event.b);
-		return {
-			ok: true,
-			row: {
-				id: rowIdOf(key),
-				pairKey: key,
-				a: event.a,
-				b: event.b,
-				state: "verify",
-				queue: "verify",
-				createdAt: event.at,
-				updatedAt: event.at
-			}
-		};
-	}
-	if (event.type === "source-gone") return {
-		ok: true,
-		row: null
-	};
-	if (event.type === "gate-keep") {
-		if (current !== void 0) return {
-			ok: true,
-			row: current
-		};
-		const key = pairKey(event.a, event.b);
-		return {
-			ok: true,
-			row: {
-				id: rowIdOf(key),
-				pairKey: key,
-				a: event.a,
-				b: event.b,
-				state: "skipped",
-				queue: "skipped",
-				origin: "agent",
-				createdAt: event.at,
-				updatedAt: event.at
-			}
-		};
-	}
-	if (current === void 0) return invalid(event, void 0);
-	switch (event.type) {
-		case "round1-keep": return current.state === "verify" ? next(current, event.at, "skipped", { origin: "agent" }) : invalid(event, current.state);
-		case "round1-merge":
-			if (current.state !== "verify") return invalid(event, current.state);
-			return event.approval === "on" ? next(current, event.at, "pending", {
-				...event.decision === void 0 ? {} : { decision: event.decision },
-				...event.stagingRef === void 0 ? {} : { stagingRef: event.stagingRef },
-				...event.stagingExpiresAt === void 0 ? {} : { stagingExpiresAt: event.stagingExpiresAt },
-				...event.sourceRevision === void 0 ? {} : { sourceRevision: event.sourceRevision },
-				...event.targetRevision === void 0 ? {} : { targetRevision: event.targetRevision }
-			}) : next(current, event.at, "approved", {
-				...event.decision === void 0 ? {} : { decision: event.decision },
-				...event.stagingRef === void 0 ? {} : { stagingRef: event.stagingRef },
-				...event.stagingExpiresAt === void 0 ? {} : { stagingExpiresAt: event.stagingExpiresAt },
-				...event.sourceRevision === void 0 ? {} : { sourceRevision: event.sourceRevision },
-				...event.targetRevision === void 0 ? {} : { targetRevision: event.targetRevision }
-			});
-		case "round1-fail": return current.state === "verify" ? next(current, event.at, "verify", {
-			failure: event.failure,
-			attempts: (current.attempts ?? 0) + 1
-		}) : invalid(event, current.state);
-		case "approve": return current.state === "pending" ? next(current, event.at, "approved", { ...event.runId === void 0 ? {} : { runId: event.runId } }) : invalid(event, current.state);
-		case "reject": return current.state === "pending" ? next(current, event.at, "skipped", { origin: "human" }) : invalid(event, current.state);
-		case "round2-cancel": return current.state === "fuse" || current.state === "approved" ? next(current, event.at, "approved") : invalid(event, current.state);
-		case "round2-fail": return current.state === "fuse" || current.state === "approved" ? next(current, event.at, "approved", {
-			failure: event.failure,
-			attempts: (current.attempts ?? 0) + 1
-		}) : invalid(event, current.state);
-		case "round2-success": return current.state === "fuse" || current.state === "approved" ? {
-			ok: true,
-			row: null
-		} : invalid(event, current.state);
-		case "target-taken":
-		case "source-changed": return current.state === "pending" || current.state === "approved" || current.state === "fuse" ? next(current, event.at, current.state, { expired: event.type }) : invalid(event, current.state);
-		case "restore": return current.state === "skipped" ? next(current, event.at, "verify") : invalid(event, current.state);
-	}
-}
-//#endregion
-//#region lib/types/presentation-budget.js
-/** Tool-result budget: keep the head and tail, mark what was omitted. */
-function fitToolText(text, max = 8e3) {
-	if (text.length <= max) return text;
-	const marker = "\n... [truncated " + String(text.length - max) + " chars] ...\n";
-	const keep = Math.max(0, max - marker.length);
-	const head = Math.ceil(keep * .7);
-	const tail = keep - head;
-	return text.slice(0, head) + marker + (tail === 0 ? "" : text.slice(-tail));
-}
+	]
+};
 //#endregion
-//#region lib/types/status.js
-function countRows(rows) {
-	const counts = {
+//#region lib/types/facts.js
+const queueOf$2 = (row) => row.state === "approved" ? "fuse" : row.queue;
+const isExpired = (row) => row.expired !== void 0;
+function countsOf(rows) {
+	const active = {
 		verify: 0,
 		pending: 0,
 		fuse: 0,
 		skipped: 0
 	};
-	for (const row of rows) counts[queueOf(row.state)] += 1;
-	return counts;
-}
-function describe(row) {
-	const stage = stageOf(row.state);
-	const target = row.decision?.shouldMerge === true ? " → " + row.decision.target : "";
-	return row.a + " + " + row.b + " [" + row.state + (stage === null ? "" : "/" + stage) + "]" + target + (row.failure === void 0 ? "" : " — " + row.failure.message);
+	let expired = 0;
+	for (const row of rows) {
+		if (isExpired(row)) {
+			expired += 1;
+			continue;
+		}
+		active[queueOf$2(row)] += 1;
+	}
+	return {
+		active,
+		expired
+	};
 }
-function formatStatus(rows) {
-	const counts = countRows(rows);
-	const lines = ["merge: verify " + String(counts.verify) + ", pending " + String(counts.pending) + ", fuse " + String(counts.fuse) + ", skipped " + String(counts.skipped)];
-	for (const row of rows) lines.push("- " + describe(row));
-	return fitToolText(lines.join("\n"));
+function toRunView(record, readAt) {
+	const state = record.mergeStatus ?? record.state;
+	return {
+		wireVersion: 1,
+		readAt,
+		id: record.id,
+		state,
+		command: record.command ?? "scan",
+		...record.stage === void 0 ? {} : { stage: record.stage },
+		progress: record.progress === void 0 ? null : {
+			done: record.progress.done,
+			total: record.progress.total
+		},
+		startedAt: record.startedAt,
+		...record.endedAt === void 0 ? {} : { endedAt: record.endedAt },
+		...record.failure === void 0 ? {} : { failure: {
+			stage: "settle",
+			code: "run-failed",
+			retryable: false,
+			retryFrom: "none",
+			detail: record.failure
+		} },
+		...record.parentRunId === void 0 ? {} : { parentRunId: record.parentRunId },
+		...record.pairKey === void 0 ? {} : { currentPairKey: record.pairKey },
+		actions: [
+			{
+				id: "status",
+				command: "/evolution merge status " + record.id,
+				confirm: false,
+				enabled: true
+			},
+			{
+				id: "report",
+				command: "/evolution merge report " + record.id,
+				confirm: false,
+				enabled: record.resultRef !== void 0
+			},
+			{
+				id: "cancel",
+				command: "/evolution merge cancel " + record.id,
+				confirm: false,
+				enabled: state === "running"
+			}
+		]
+	};
 }
-function formatQueue(rows, queue) {
-	const selected = rows.filter((row) => queueOf(row.state) === queue);
-	if (selected.length === 0) return "merge " + queue + ": empty";
-	return fitToolText(["merge " + queue + ": " + String(selected.length)].concat(selected.map((row) => "- " + describe(row))).join("\n"));
+function buildFacts(input) {
+	const ordered = [...input.runs].sort((a, b) => b.startedAt - a.startedAt);
+	const active = ordered.find((run) => (run.mergeStatus ?? run.state) === "running");
+	const last = ordered.find((run) => (run.mergeStatus ?? run.state) !== "running");
+	const notes = input.notes ?? [];
+	return {
+		wireVersion: 1,
+		readAt: input.readAt,
+		approval: { mergeApproval: input.approval },
+		counts: countsOf(input.rows),
+		active: active === void 0 ? null : toRunView(active, input.readAt),
+		last: last === void 0 ? null : toRunView(last, input.readAt),
+		startCommands: {
+			scan: "/evolution merge scan",
+			pair: "/evolution merge pair <a> <b>"
+		},
+		fallback: MERGE_COMMAND_SURFACE.fallback,
+		notes,
+		degraded: notes.length > 0
+	};
 }
 //#endregion
-//#region lib/types/routes.js
-function toRowView(row) {
+//#region lib/types/wire-projection.js
+const queueOf$1 = (row) => row.state === "approved" ? "fuse" : row.queue;
+const expiredOf = (row) => row.expired !== void 0;
+/** Host-owned row actions; client only renders/copies them. */
+function actionRefs(row) {
+	const base = "/evolution merge ";
+	const disabled = row.expired === void 0 ? void 0 : "expired";
+	const action = (id, confirm = false, enabled = true) => ({
+		id,
+		command: base + id + " " + row.id,
+		confirm,
+		enabled,
+		...enabled ? {} : { disabledReason: disabled ?? "invalid" }
+	});
+	if (row.state === "pending" && row.expired !== void 0) return [{
+		id: "discard",
+		command: "/evolution merge discard " + row.id,
+		confirm: true,
+		enabled: true
+	}, {
+		id: "pair",
+		command: "/evolution merge pair " + row.a + " " + row.b,
+		confirm: true,
+		enabled: true
+	}];
+	if (row.state === "pending") return [
+		action("approve"),
+		action("reject", true),
+		action("discard", true)
+	];
+	if (row.state === "approved" || row.state === "fuse") return [action("discard", true), action("status")];
+	if (row.state === "skipped") return [action("restore", true)];
+	return [action("pair")];
+}
+function toRowFact(row, actions = actionRefs(row)) {
 	return {
 		id: row.id,
-		pairKey: row.pairKey,
+		state: row.state,
+		queue: queueOf$1(row),
+		...row.state === "verify" ? { verifySubState: "queued" } : {},
 		a: row.a,
 		b: row.b,
-		state: row.state,
-		queue: queueOf(row.state),
-		stage: stageOf(row.state),
-		label: row.a + " + " + row.b,
-		updatedAt: row.updatedAt,
-		createdAt: row.createdAt,
-		...row.decision?.target === void 0 ? {} : { target: row.decision.target },
-		...row.decision?.confidence === void 0 ? {} : { confidence: row.decision.confidence },
-		...row.decision?.aSummary === void 0 ? {} : { aSummary: row.decision.aSummary },
-		...row.decision?.bSummary === void 0 ? {} : { bSummary: row.decision.bSummary },
-		...row.decision?.rationale === void 0 ? {} : { rationale: row.decision.rationale },
+		...row.target === void 0 ? {} : { target: {
+			requested: row.target.requested,
+			...row.target.actual === void 0 ? {} : { actual: row.target.actual },
+			...row.target.created === void 0 ? {} : { created: row.target.created }
+		} },
+		...row.state === "pending" ? { summary: {
+			a: null,
+			b: null,
+			rationale: row.decision?.rationale ?? null
+		} } : {},
+		...row.reason === void 0 ? {} : { reason: row.reason },
+		...row.state === "skipped" ? { origin: row.origin ?? "system" } : {},
 		...row.failure === void 0 ? {} : { failure: {
-			stage: row.failure.stage,
+			stage: row.failure.stage === "screening" ? "screening" : row.failure.stage === "decide" ? "decide" : row.failure.stage === "author" ? "author" : row.failure.stage === "validate" ? "validate" : "commit",
 			code: row.failure.code,
-			message: row.failure.message,
-			retryable: row.failure.retryable
+			retryable: row.failure.retryable,
+			retryFrom: row.failure.retryFrom
+		} },
+		...row.stagingRef === void 0 ? {} : { staging: {
+			state: "kept",
+			...row.stagingExpiresAt === void 0 ? {} : { expiresAt: row.stagingExpiresAt }
+		} },
+		...row.expired === void 0 ? {} : { expired: {
+			kind: row.expired,
+			at: Date.parse(row.updatedAt)
 		} },
 		...row.attempts === void 0 ? {} : { attempts: row.attempts },
-		...row.origin === void 0 ? {} : { origin: row.origin },
-		...row.stagingExpiresAt === void 0 ? {} : { stagingExpiresAt: row.stagingExpiresAt },
-		...row.expired === void 0 ? {} : { expired: row.expired },
-		...row.reason === void 0 ? {} : { reason: row.reason },
-		summary: [
-			row.decision?.aSummary ?? "未提供技能1摘要",
-			row.decision?.bSummary ?? "未提供技能2摘要",
-			row.decision?.rationale ?? row.reason ?? "未提供融合原因"
-		],
-		actions: row.state === "pending" ? ["/evolution merge approve " + row.id, "/evolution merge reject " + row.id] : row.state === "skipped" ? ["/evolution merge skipped --restore " + row.id] : ["/evolution merge resume " + row.id]
+		...row.decision?.confidence === void 0 ? {} : { confidence: row.decision.confidence },
+		...row.state === "skipped" && row.stagingExpiresAt !== void 0 ? { expiresAt: row.stagingExpiresAt } : {},
+		createdAt: Date.parse(row.createdAt),
+		updatedAt: Date.parse(row.updatedAt),
+		actions
 	};
 }
-function buildMergeView(rows, commands, latestRun, approval) {
-	const counts = countRows(rows);
-	return {
-		schemaVersion: 2,
-		counts,
-		tabs: [
-			{
-				queue: "verify",
-				count: counts.verify
-			},
-			{
-				queue: "pending",
-				count: counts.pending
-			},
-			{
-				queue: "fuse",
-				count: counts.fuse
-			},
-			{
-				queue: "skipped",
-				count: counts.skipped
-			}
-		],
-		commands,
-		...latestRun === void 0 ? {} : { latestRun },
-		...approval === void 0 ? {} : { approval }
-	};
-}
-function pageQueue(rows, queue, cursor = 0, limit = 50) {
-	const filtered = rows.filter((row) => queueOf(row.state) === queue);
-	const size = Math.max(1, Math.min(200, limit));
-	const start = Math.max(0, cursor);
-	const items = filtered.slice(start, start + size).map(toRowView);
-	const next = start + size < filtered.length ? String(start + size) : void 0;
+function toQueuePage(rows, queue, expiredOnly, readAt, limit = 50) {
+	const filtered = rows.filter((row) => queueOf$1(row) === queue && (expiredOnly ? expiredOf(row) : !expiredOf(row)));
+	const page = filtered.slice(0, Math.max(0, Math.min(200, limit)));
 	return {
+		wireVersion: 1,
+		readAt,
 		queue,
-		items,
-		...next === void 0 ? {} : { nextCursor: next }
+		expiredOnly,
+		counts: countsOf(rows),
+		rows: page.map((row) => toRowFact(row)),
+		...filtered.length > page.length ? { nextCursor: String(page.length) } : {},
+		notes: []
 	};
 }
-function toRunFact(run) {
+function toRunsView(runs, readAt) {
 	return {
-		id: run.id,
-		state: run.state,
-		...run.command === void 0 ? {} : { command: run.command },
-		...run.stage === void 0 ? {} : { stage: run.stage },
-		...run.progress === void 0 ? {} : { progress: run.progress },
-		startedAt: run.startedAt,
-		...run.endedAt === void 0 ? {} : { endedAt: run.endedAt },
-		...run.resultRef === void 0 ? {} : { resultRef: run.resultRef },
-		...run.failure === void 0 ? {} : { failure: run.failure },
-		...run.supersededAt === void 0 ? {} : { supersededAt: run.supersededAt }
+		wireVersion: 1,
+		readAt,
+		runs: [...runs].sort((a, b) => b.startedAt - a.startedAt).slice(0, 50).map((run) => toRunView(run, readAt))
 	};
 }
-//#endregion
-//#region lib/types/domain/markdown.js
-/** Minimal safe Markdown renderer for the read-only body route. */
-function escapeHtml(text) {
-	return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-function renderMarkdown(source) {
-	const fence = String.fromCharCode(96, 96, 96);
-	const lines = source.split(/\r?\n/);
-	const out = [];
-	let inCode = false;
-	let inList = false;
-	for (const line of lines) {
-		if (line.startsWith(fence)) {
-			if (inCode) {
-				out.push("</code></pre>");
-				inCode = false;
-			} else {
-				out.push("<pre><code>");
-				inCode = true;
-			}
-			continue;
-		}
-		if (inCode) {
-			out.push(escapeHtml(line));
-			continue;
-		}
-		const heading = /^(#{1,6})\s+(.*)$/.exec(line);
-		if (heading !== null) {
-			if (inList) {
-				out.push("</ul>");
-				inList = false;
-			}
-			const level = heading[1]?.length ?? 1;
-			out.push("<h" + String(level) + ">" + escapeHtml(heading[2] ?? "") + "</h" + String(level) + ">");
-			continue;
-		}
-		if (/^[-*]\s+/.test(line)) {
-			if (!inList) {
-				out.push("<ul>");
-				inList = true;
-			}
-			out.push("<li>" + escapeHtml(line.replace(/^[-*]\s+/, "")) + "</li>");
-			continue;
-		}
-		if (inList) {
-			out.push("</ul>");
-			inList = false;
-		}
-		out.push(line.trim() === "" ? "" : "<p>" + escapeHtml(line) + "</p>");
-	}
-	if (inList) out.push("</ul>");
-	if (inCode) out.push("</code></pre>");
-	return out.join("\n");
+function toBodyView(name, side, text, readAt) {
+	return {
+		wireVersion: 1,
+		readAt,
+		name,
+		side,
+		text,
+		markdown: true,
+		truncated: false,
+		totalBytes: Buffer.byteLength(text, "utf8")
+	};
+}
+function toHistoryView(items, readAt) {
+	return {
+		wireVersion: 1,
+		readAt,
+		items: items.map((item) => ({
+			name: item.name,
+			kind: item.kind,
+			reason: item.reason,
+			lastVersion: item.lastVersion,
+			archivedAt: Date.parse(item.archivedAt),
+			...item.sourceRunId === void 0 ? {} : { sourceRunId: item.sourceRunId }
+		}))
+	};
 }
 //#endregion
 //#region lib/types/merge-routes.js
@@ -1211,12 +1778,15 @@ const MERGE_ROUTES = {
 	history: MERGE_PATHS.history ?? MERGE_BASE + "history"
 };
 function makeMergeRoutes(deps, _audit) {
-	const absent = () => json(503, {
-		ok: false,
-		error: {
-			code: "merge-service-absent",
-			message: "merge service is not mounted"
-		}
+	const absent = () => json(404, {
+		wireVersion: 1,
+		code: "E-325",
+		message: "merge service is not mounted"
+	});
+	const bad = (message) => json(400, {
+		wireVersion: 1,
+		code: "merge-bad-query",
+		message
 	});
 	const get = (request) => request.method === "GET" ? null : methodNotAllowed(["GET"]);
 	const url = (request) => new URL(request.url, "http://local");
@@ -1230,11 +1800,13 @@ function makeMergeRoutes(deps, _audit) {
 				if (denied !== null) return denied;
 				const source = deps.getSource();
 				if (source === void 0) return absent();
-				const latestMerge = (await source.runs(void 0, 20)).find((run) => run.kind === "merge");
-				return json(200, {
-					ok: true,
-					data: buildMergeView(await source.rows(), source.commands(), latestMerge === void 0 ? void 0 : toRunFact(latestMerge), source.approval?.())
-				});
+				const readAt = Date.now();
+				return json(200, buildFacts({
+					rows: await source.rows(),
+					runs: await source.runs(void 0, 20),
+					approval: source.approval?.() === true,
+					readAt
+				}));
 			}
 		},
 		{
@@ -1248,19 +1820,16 @@ function makeMergeRoutes(deps, _audit) {
 				if (source === void 0) return absent();
 				const query = url(request).searchParams;
 				const queue = query.get("queue") ?? "verify";
-				if (queue !== "verify" && queue !== "pending" && queue !== "fuse" && queue !== "skipped") return json(400, {
-					ok: false,
-					error: {
-						code: "bad-queue",
-						message: "queue must be verify/pending/fuse/skipped"
-					}
-				});
-				const cursor = Number.parseInt(query.get("cursor") ?? "0", 10);
+				if (queue !== "verify" && queue !== "pending" && queue !== "fuse" && queue !== "skipped") return bad("queue must be verify/pending/fuse/skipped");
+				const expiredOnly = query.get("expired") === "1";
+				if (expiredOnly && queue !== "pending") return bad("expired is only allowed for pending");
 				const limit = Number.parseInt(query.get("limit") ?? "50", 10);
-				return json(200, {
-					ok: true,
-					data: pageQueue(await source.rows(), queue, Number.isFinite(cursor) ? cursor : 0, Number.isFinite(limit) ? limit : 50)
-				});
+				const offset = Number.parseInt(query.get("cursor") ?? "0", 10);
+				const page = toQueuePage(await source.rows(), queue, expiredOnly, Date.now(), Number.isFinite(limit) ? limit : 50);
+				return json(200, Number.isFinite(offset) && offset > 0 ? {
+					...page,
+					rows: page.rows.slice(offset)
+				} : page);
 			}
 		},
 		{
@@ -1275,28 +1844,13 @@ function makeMergeRoutes(deps, _audit) {
 				const query = url(request).searchParams;
 				const id = query.get("id");
 				const side = query.get("side");
-				if (id === null || id === "" || side !== "a" && side !== "b") return json(400, {
-					ok: false,
-					error: {
-						code: "bad-body-query",
-						message: "id and side=a|b are required"
-					}
-				});
+				if (id === null || id === "" || side !== "a" && side !== "b") return bad("id and side=a|b are required");
 				const content = await source.body(id, side);
-				return content === null ? json(404, {
-					ok: false,
-					error: {
-						code: "body-not-found",
-						message: "merge body not found: " + id
-					}
-				}) : json(200, {
-					ok: true,
-					data: {
-						content,
-						markdown: true,
-						html: renderMarkdown(content)
-					}
-				});
+				return content === null ? json(200, {
+					wireVersion: 1,
+					code: "merge-body-missing",
+					message: "merge body not found: " + id
+				}) : json(200, toBodyView(id, side === "a" ? "live" : "archive", content, Date.now()));
 			}
 		},
 		{
@@ -1308,10 +1862,7 @@ function makeMergeRoutes(deps, _audit) {
 				if (denied !== null) return denied;
 				const source = deps.getSource();
 				if (source === void 0) return absent();
-				return json(200, {
-					ok: true,
-					data: { items: await source.history() }
-				});
+				return json(200, toHistoryView(await source.history(), Date.now()));
 			}
 		}
 	];
@@ -1559,8 +2110,58 @@ function mergeUsage() {
 	return USAGE;
 }
 //#endregion
+//#region lib/types/presentation-budget.js
+/** Tool-result budget: keep the head and tail, mark what was omitted. */
+function fitToolText(text, max = 8e3) {
+	if (text.length <= max) return text;
+	const marker = "\n... [truncated " + String(text.length - max) + " chars] ...\n";
+	const keep = Math.max(0, max - marker.length);
+	const head = Math.ceil(keep * .7);
+	const tail = keep - head;
+	return text.slice(0, head) + marker + (tail === 0 ? "" : text.slice(-tail));
+}
+//#endregion
+//#region lib/types/status.js
+function countRows(rows) {
+	const counts = {
+		verify: 0,
+		pending: 0,
+		fuse: 0,
+		skipped: 0
+	};
+	for (const row of rows) counts[queueOf(row.state)] += 1;
+	return counts;
+}
+function describe(row) {
+	const stage = stageOf(row.state);
+	const target = row.decision?.shouldMerge === true ? " → " + row.decision.target : "";
+	return row.a + " + " + row.b + " [" + row.state + (stage === null ? "" : "/" + stage) + "]" + target + (row.failure === void 0 ? "" : " — " + row.failure.message);
+}
+function formatStatus(rows) {
+	const counts = countRows(rows);
+	const lines = ["merge: verify " + String(counts.verify) + ", pending " + String(counts.pending) + ", fuse " + String(counts.fuse) + ", skipped " + String(counts.skipped)];
+	for (const row of rows) lines.push("- " + describe(row));
+	return fitToolText(lines.join("\n"));
+}
+function formatFacts(facts) {
+	const lines = ["merge: verify " + String(facts.counts.active.verify) + ", pending " + String(facts.counts.active.pending) + ", fuse " + String(facts.counts.active.fuse) + ", skipped " + String(facts.counts.active.skipped) + ", expired " + String(facts.counts.expired)];
+	if (facts.active !== null) lines.push("active: " + facts.active.id + " [" + facts.active.state + "]");
+	if (facts.last !== null) lines.push("last: " + facts.last.id + " [" + facts.last.state + "]");
+	if (facts.degraded) lines.push("degraded: " + facts.notes.join(","));
+	return fitToolText(lines.join("\n"));
+}
+function formatRunsView(view) {
+	if (view.runs.length === 0) return "merge runs: empty";
+	return fitToolText(["merge runs: " + String(view.runs.length)].concat(view.runs.map((run) => "- " + run.id + " [" + run.state + "]" + (run.endedAt === void 0 ? "" : " " + new Date(run.endedAt).toISOString()))).join("\n"));
+}
+function formatQueue(rows, queue) {
+	const selected = rows.filter((row) => queueOf(row.state) === queue);
+	if (selected.length === 0) return "merge " + queue + ": empty";
+	return fitToolText(["merge " + queue + ": " + String(selected.length)].concat(selected.map((row) => "- " + describe(row))).join("\n"));
+}
+//#endregion
 //#region lib/types/read-commands.js
-async function handleReadOnlyMergeCommand(command, io, home, cards) {
+async function handleReadOnlyMergeCommand(command, io, home, cards, runs, approval = false) {
 	const withNote = (text, note) => note === void 0 ? text : "note: " + note + "\n" + text;
 	const load = async () => {
 		const result = await loadMergeState(io, home);
@@ -1573,7 +2174,13 @@ async function handleReadOnlyMergeCommand(command, io, home, cards) {
 			const row = loaded.state.rows.find((item) => item.id === command.id);
 			return withNote(row === void 0 ? "merge row not found: " + command.id : formatStatus([row]), loaded.note);
 		}
-		return withNote(formatStatus(loaded.state.rows), loaded.note);
+		return withNote(formatFacts(buildFacts({
+			rows: loaded.state.rows,
+			runs: runs ?? [],
+			approval,
+			readAt: Date.now(),
+			...loaded.note === void 0 ? {} : { notes: [loaded.note] }
+		})), loaded.note);
 	}
 	if (command.verb === "pending") {
 		const loaded = await load();
@@ -1659,6 +2266,115 @@ function createMergeCommand(service) {
 	};
 }
 //#endregion
+//#region lib/types/domain/claim.js
+function acquireClaim(current, now, leaseMs, token, pid, startedAt) {
+	if (current !== void 0 && current.expiresAt > now) return void 0;
+	return {
+		id: "claim",
+		token,
+		expiresAt: now + Math.max(1, leaseMs),
+		...pid === void 0 ? {} : { pid },
+		...startedAt === void 0 ? {} : { startedAt }
+	};
+}
+function releaseClaim(current, token) {
+	return current?.token === token ? void 0 : current;
+}
+//#endregion
+//#region lib/types/target-claim.js
+/** Durable target claim: one approve writer per merge target at a time. */
+const PROCESS_STARTED_AT = Date.now() - process.uptime() * 1e3;
+function claimPath(home, target) {
+	return join(home, "merge", "claims", contentHash(target) + ".json");
+}
+function parseClaim(raw) {
+	if (raw === null) return void 0;
+	const parsed = JSON.parse(raw);
+	if (typeof parsed.token !== "string" || typeof parsed.expiresAt !== "number") throw new Error("corrupt target claim");
+	return {
+		id: "claim",
+		token: parsed.token,
+		expiresAt: parsed.expiresAt,
+		...typeof parsed.pid === "number" ? { pid: parsed.pid } : {},
+		...typeof parsed.startedAt === "number" ? { startedAt: parsed.startedAt } : {}
+	};
+}
+async function withGuard(path, fn) {
+	const guard = path + ".guard";
+	await mkdir(dirname(path), { recursive: true });
+	for (let attempt = 0; attempt < 500; attempt += 1) try {
+		const handle = await open(guard, "wx");
+		await handle.writeFile(String(process.pid));
+		await handle.close();
+		try {
+			return await fn();
+		} finally {
+			await unlink(guard).catch(() => {});
+		}
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+		const pid = Number(await readFile(guard, "utf8").catch(() => ""));
+		if (Number.isFinite(pid) && pid > 0 && !isProcessAlive(pid)) await unlink(guard).catch(() => {});
+		await new Promise((resolve) => setTimeout(resolve, 10));
+	}
+	throw new Error("target-claim-guard-timeout");
+}
+async function compareAndSwap(io, path, task) {
+	await withGuard(path, async () => {
+		if (io.transact !== void 0) {
+			await io.transact(path, (current) => task(current));
+			return;
+		}
+		const current = await io.exists(path) ? await io.readText(path) : null;
+		const next = task(current);
+		if (next === null) {
+			if (current !== null) try {
+				await io.remove(path);
+			} catch {}
+		} else if (next !== current) await io.writeText(path, next);
+	});
+}
+async function releaseTargetClaimQuietly(claim) {
+	if (claim === null || claim === void 0) return;
+	try {
+		await claim.release();
+	} catch {}
+}
+async function acquireTargetClaim(io, home, target, now) {
+	const path = claimPath(home, target);
+	const token = randomUUID();
+	let granted;
+	await compareAndSwap(io, path, (raw) => {
+		const current = parseClaim(raw);
+		const claim = acquireClaim(current !== void 0 && current.pid === process.pid && current.startedAt !== void 0 && Math.abs(current.startedAt - PROCESS_STARTED_AT) > 1e3 || current !== void 0 && current.expiresAt > now && current.pid !== void 0 && current.pid !== process.pid && !isProcessAlive(current.pid) ? void 0 : current, now, Number.MAX_SAFE_INTEGER, token, process.pid, PROCESS_STARTED_AT);
+		if (claim === void 0) return raw;
+		granted = claim;
+		return JSON.stringify(claim) + "\n";
+	});
+	if (granted === void 0) return null;
+	return {
+		token,
+		async release() {
+			await compareAndSwap(io, path, (raw) => {
+				const next = releaseClaim(parseClaim(raw), token);
+				return next === void 0 ? null : JSON.stringify(next) + "\n";
+			});
+		}
+	};
+}
+//#endregion
+//#region lib/types/unit-claim.js
+/** Commit-phase claim: 24h is only stale recovery; commit releases immediately, no approve TTL. */
+function targetClaimUnitPort(io, home, now) {
+	return { async acquire(target) {
+		const claim = await acquireTargetClaim(io, home, target, now());
+		if (claim === null) throw new Error("target-claim-busy: " + target);
+		return { async release() {
+			await releaseTargetClaimQuietly(claim);
+		} };
+	} };
+}
+//#endregion
 //#region lib/types/skipped.js
 /**
 * Skipped filtering: a pair the operator marked as not-worth-merging stays out of automatic
@@ -1806,29 +2522,46 @@ async function runScan(options) {
 		});
 		let row;
 		try {
-			const created = transition(void 0, {
-				type: "candidate",
+			const key = pairKey(candidate.a, candidate.b);
+			const atNow = at(options.now);
+			row = {
+				id: rowIdOf(key),
+				pairKey: key,
 				a: candidate.a,
 				b: candidate.b,
-				at: at(options.now)
-			});
-			if (!created.ok || created.row === null) throw new Error(created.ok ? "candidate row missing" : created.message);
-			row = options.runId === void 0 ? created.row : {
-				...created.row,
-				runId: options.runId
+				state: "verify",
+				queue: "verify",
+				createdAt: atNow,
+				updatedAt: atNow,
+				...options.runId === void 0 ? {} : { runId: options.runId }
 			};
 			const before = (await loadMergeState(options.io, options.home)).state.rows.find((item) => item.pairKey === row.pairKey);
 			if (before?.state === "verify" && before.runId !== void 0 && before.runId !== options.runId && await options.isOwnerActive?.(before.runId) === true) continue;
-			const placed = await upsertRow(options.io, options.home, options.now, row, "verify", before?.updatedAt ?? null);
-			if (!placed.ok && before?.state === "skipped") {
-				const restored = transition(before, {
-					type: "restore",
-					at: at(options.now)
+			const status = await transactRows(options.io, options.home, (tx) => {
+				const current = tx.rows().find((item) => item.pairKey === row.pairKey);
+				if (current !== void 0 && current.state !== "verify" && current.state !== "skipped") return "conflict:" + current.state;
+				if (current?.state === "skipped") {
+					if (!tx.transition(current.id, { type: "restored" }, current.version).ok) return "restore-failed";
+				}
+				if (current?.state === "verify") return "existing";
+				const made = tx.createVerify({
+					id: current?.id ?? rowIdOf(row.pairKey),
+					pairKey: row.pairKey,
+					a: row.a,
+					b: row.b,
+					version: 0,
+					createdAt: at(options.now),
+					updatedAt: at(options.now),
+					origin: "agent",
+					state: "verify",
+					verifySubState: "unverified",
+					attempts: 0,
+					...row.runId === void 0 ? {} : { runId: row.runId }
 				});
-				if (!restored.ok || restored.row === null) throw new Error("cannot restore skipped pair");
-				if (!(await upsertRow(options.io, options.home, options.now, restored.row, "any", before.updatedAt)).ok) throw new Error("pair changed while restoring skipped row");
-				row = restored.row;
-			} else if (!placed.ok) throw new Error("pair already in " + placed.current.state);
+				return made.ok ? "created" : "invalid:" + made.code;
+			});
+			if (status.startsWith("conflict:")) throw new Error("pair already in " + status.slice(9));
+			if (status === "restore-failed" || status.startsWith("invalid:")) throw new Error("cannot place verify row: " + status);
 		} catch (error) {
 			totals.failed += 1;
 			pairs.push({
@@ -1862,33 +2595,47 @@ async function runScan(options) {
 			break;
 		}
 		if (round1.kind === "failed") {
-			const next = transition(row, {
-				type: "round1-fail",
-				failure: round1.failure ?? failureOf("decide", "round1 failed"),
-				at: at(options.now)
+			const failure = round1.failure ?? failureOf("decide", "round1 failed");
+			const projected = await transactRows(options.io, options.home, (tx) => {
+				const current = tx.rows().find((item) => item.id === row.id);
+				if (current === void 0) return null;
+				const moved = tx.transition(row.id, {
+					type: "failed",
+					failure
+				}, current.version);
+				return moved.ok && moved.row !== null ? v3ToLegacy(moved.row) : null;
 			});
-			if (next.ok && next.row !== null) {
-				row = next.row;
-				await upsertRow(options.io, options.home, options.now, row);
+			if (projected === null) {
+				pairs.push(pairOf(row, candidate, "failed", { failure: failureOf("decide", "row changed before failure record") }));
+				totals.failed += 1;
+				continue;
 			}
-			pairs.push(pairOf(row, candidate, "failed", { failure: round1.failure ?? failureOf("decide", "round1 failed") }));
+			row = projected;
+			pairs.push(pairOf(row, candidate, "failed", { failure }));
 			totals.failed += 1;
 			continue;
 		}
 		if (round1.kind === "keep") {
-			const next = transition(row, {
-				type: "round1-keep",
-				at: at(options.now)
+			const projected = await transactRows(options.io, options.home, (tx) => {
+				const current = tx.rows().find((item) => item.id === row.id);
+				if (current === void 0) return null;
+				const moved = tx.transition(row.id, {
+					type: "skipped",
+					reason: "kept"
+				}, current.version);
+				return moved.ok && moved.row !== null ? v3ToLegacy(moved.row) : null;
 			});
-			if (next.ok && next.row !== null) {
-				row = next.row;
-				await upsertRow(options.io, options.home, options.now, row);
-				await recordPair(options.io, options.home, {
-					pairKey: row.pairKey,
-					runId: row.runId ?? "merge",
-					result: "kept"
-				});
+			if (projected === null) {
+				pairs.push(pairOf(row, candidate, "failed", { failure: failureOf("decide", "row changed before keep record") }));
+				totals.failed += 1;
+				continue;
 			}
+			row = projected;
+			await recordPair(options.io, options.home, {
+				pairKey: row.pairKey,
+				runId: row.runId ?? "merge",
+				result: "kept"
+			});
 			pairs.push(pairOf(row, candidate, "kept", round1.decision === void 0 ? {} : { decision: round1.decision }));
 			totals.kept += 1;
 			continue;
@@ -1899,49 +2646,79 @@ async function runScan(options) {
 			continue;
 		}
 		if (options.approval) {
-			const next = transition(row, {
-				type: "round1-merge",
-				approval: "on",
+			const event = {
+				type: "verify-passed",
 				decision: round1.decision,
-				...round1.sourceRevision === void 0 ? {} : { sourceRevision: round1.sourceRevision },
-				...round1.targetRevision === void 0 ? {} : { targetRevision: round1.targetRevision },
-				at: at(options.now)
+				target: round1.decision.target,
+				...round1.sourceRevision === void 0 ? {} : { sourceRevision: round1.sourceRevision }
+			};
+			const projected = await transactRows(options.io, options.home, (tx) => {
+				const current = tx.rows().find((item) => item.id === row.id);
+				if (current === void 0) return null;
+				const moved = tx.transition(row.id, event, current.version);
+				return moved.ok && moved.row !== null ? v3ToLegacy(moved.row) : null;
 			});
-			if (next.ok && next.row !== null) {
-				row = next.row;
-				await upsertRow(options.io, options.home, options.now, row);
+			if (projected === null) {
+				pairs.push(pairOf(row, candidate, "failed", {
+					decision: round1.decision,
+					failure: failureOf("decide", "row changed before pending record")
+				}));
+				totals.failed += 1;
+				continue;
 			}
+			row = projected;
 			pairs.push(pairOf(row, candidate, "pending", { decision: round1.decision }));
 			totals.pending += 1;
 			continue;
 		}
-		const fuse = transition(row, {
-			type: "round1-merge",
-			approval: "off",
-			decision: round1.decision,
-			...round1.stagingRef === void 0 ? {} : { stagingRef: round1.stagingRef },
-			...round1.stagingExpiresAt === void 0 ? {} : { stagingExpiresAt: round1.stagingExpiresAt },
-			at: at(options.now)
+		const staged = await transactRows(options.io, options.home, (tx) => {
+			const current = tx.rows().find((item) => item.id === row.id);
+			if (current === void 0) return null;
+			const approved = tx.transition(row.id, {
+				type: "auto-approved",
+				decision: round1.decision,
+				target: round1.decision.target,
+				...row.runId === void 0 ? {} : { runId: row.runId }
+			}, current.version);
+			if (!approved.ok || approved.row === null) return null;
+			const moved = tx.transition(row.id, {
+				type: "staged",
+				...round1.stagingRef === void 0 ? {} : { ref: round1.stagingRef },
+				...round1.stagingExpiresAt === void 0 ? {} : { expiresAt: round1.stagingExpiresAt }
+			}, approved.row.version);
+			return moved.ok && moved.row !== null ? v3ToLegacy(moved.row) : null;
 		});
-		if (!fuse.ok || fuse.row === null) {
+		if (staged === null) {
 			pairs.push(pairOf(row, candidate, "failed", {
 				decision: round1.decision,
-				failure: failureOf("decide", "cannot enter fuse")
+				failure: failureOf("author", "row changed before staging record")
 			}));
 			totals.failed += 1;
 			continue;
 		}
-		row = fuse.row;
-		await upsertRow(options.io, options.home, options.now, row);
+		row = staged;
+		if (round1.stagingRef !== void 0) {
+			const expiresAt = round1.stagingExpiresAt ?? options.now() + 7 * 864e5;
+			await writeStagingIndex(options.io, options.home, {
+				rowId: row.id,
+				pairKey: row.pairKey,
+				ref: round1.stagingRef,
+				expiresAt,
+				...row.runId === void 0 ? {} : { runId: row.runId },
+				createdAt: options.now()
+			});
+		}
 		if (isAborted(options.signal)) {
-			const cancelled = transition(row, {
-				type: "round2-cancel",
-				at: at(options.now)
+			const projected = await transactRows(options.io, options.home, (tx) => {
+				const current = tx.rows().find((item) => item.id === row.id);
+				if (current === void 0) return null;
+				const moved = tx.transition(row.id, {
+					type: "skipped",
+					reason: "cancelled"
+				}, current.version);
+				return moved.ok && moved.row !== null ? v3ToLegacy(moved.row) : null;
 			});
-			if (cancelled.ok && cancelled.row !== null) {
-				row = cancelled.row;
-				await upsertRow(options.io, options.home, options.now, row);
-			}
+			if (projected !== null) row = projected;
 			stopReason = "cancelled";
 			remaining.push(...candidates.slice(index).map((candidate) => ({
 				pairKey: pairKey(candidate.a, candidate.b),
@@ -1963,10 +2740,14 @@ async function runScan(options) {
 			};
 		}
 		if (round2.kind === "merged") {
-			if (transition(row, {
-				type: "round2-success",
-				at: at(options.now)
-			}).ok) await dropRow(options.io, options.home, options.now, row.id);
+			if (!await dropRowV3(options.io, options.home, row.id, "committed", round2.unitId ?? "unknown")) {
+				pairs.push(pairOf(row, candidate, "failed", {
+					decision: round1.decision,
+					failure: failureOf("commit", "row changed before commit record")
+				}));
+				totals.failed += 1;
+				continue;
+			}
 			pairs.push(pairOf(row, candidate, "merged", {
 				decision: round1.decision,
 				...round2.unitId === void 0 ? {} : { unitId: round2.unitId },
@@ -1977,15 +2758,24 @@ async function runScan(options) {
 			continue;
 		}
 		const failed = round2.failure ?? failureOf("author", "round2 failed");
-		const next = transition(row, {
-			type: "round2-fail",
-			failure: failed,
-			at: at(options.now)
+		const projected = await transactRows(options.io, options.home, (tx) => {
+			const current = tx.rows().find((item) => item.id === row.id);
+			if (current === void 0) return null;
+			const moved = tx.transition(row.id, {
+				type: "failed",
+				failure: failed
+			}, current.version);
+			return moved.ok && moved.row !== null ? v3ToLegacy(moved.row) : null;
 		});
-		if (next.ok && next.row !== null) {
-			row = next.row;
-			await upsertRow(options.io, options.home, options.now, row);
+		if (projected === null) {
+			pairs.push(pairOf(row, candidate, "failed", {
+				decision: round1.decision,
+				failure: failureOf("author", "row changed before failure record")
+			}));
+			totals.failed += 1;
+			continue;
 		}
+		row = projected;
 		pairs.push(pairOf(row, candidate, "failed", {
 			decision: round1.decision,
 			failure: failed
@@ -2205,48 +2995,40 @@ async function runScanCommand(options) {
 //#endregion
 //#region lib/types/pending-actions.js
 async function act(io, home, now, id, type) {
-	return await mutateMergeState(io, home, now, (rows) => {
-		const index = rows.findIndex((row) => row.id === id);
-		if (index < 0) return {
-			rows,
-			result: {
-				ok: false,
-				reason: "not-found",
-				message: "pending row not found: " + id
-			}
+	return await transactRows(io, home, (tx) => {
+		const row = tx.rows().find((item) => item.id === id);
+		if (row === void 0) return {
+			ok: false,
+			reason: "not-found",
+			message: "pending row not found: " + id
 		};
-		const current = rows[index];
-		if (current.state !== "pending") return {
-			rows,
-			result: {
-				ok: false,
-				reason: "not-pending",
-				message: "row is not pending: " + current.state
-			}
+		if (row.state !== "pending") return {
+			ok: false,
+			reason: "not-pending",
+			message: "row is not pending: " + row.state
 		};
-		const next = transition(current, type === "approve" ? {
-			type: "approve",
-			at: new Date(now()).toISOString()
+		const event = type === "approve" ? {
+			type: "approved",
+			runId: row.runId ?? "approve:" + id
 		} : {
-			type: "reject",
-			at: new Date(now()).toISOString()
-		});
-		if (!next.ok || next.row === null) return {
-			rows,
-			result: {
-				ok: false,
-				reason: "invalid",
-				message: next.ok ? "transition produced no row" : next.message
-			}
+			type: "skipped",
+			reason: "rejected",
+			origin: "human"
+		};
+		const moved = tx.transition(id, event, row.version);
+		if (!moved.ok) return {
+			ok: false,
+			reason: "invalid",
+			message: moved.message
+		};
+		if (moved.row === null) return {
+			ok: false,
+			reason: "invalid",
+			message: "transition produced no row"
 		};
-		const copy = [...rows];
-		copy[index] = next.row;
 		return {
-			rows: copy,
-			result: {
-				ok: true,
-				row: next.row
-			}
+			ok: true,
+			row: v3ToLegacy(moved.row)
 		};
 	});
 }
@@ -2257,79 +3039,29 @@ async function rejectPending(io, home, now, id) {
 	return await act(io, home, now, id, "reject");
 }
 //#endregion
-//#region lib/types/domain/claim.js
-function acquireClaim(current, now, leaseMs, token) {
-	if (current !== void 0 && current.expiresAt > now) return void 0;
-	return {
-		id: "claim",
-		token,
-		expiresAt: now + Math.max(1, leaseMs)
-	};
-}
-function releaseClaim(current, token) {
-	return current?.token === token ? void 0 : current;
-}
-//#endregion
-//#region lib/types/target-claim.js
-/** Durable target claim: one approve writer per merge target at a time. */
-const LEASE_MS = 30 * 6e4;
-function claimPath(home, target) {
-	return join(home, "merge", "claims", contentHash(target) + ".json");
-}
-function parseClaim(raw) {
-	if (raw === null) return void 0;
-	const parsed = JSON.parse(raw);
-	if (typeof parsed.token !== "string" || typeof parsed.expiresAt !== "number") throw new Error("corrupt target claim");
-	return {
-		id: "claim",
-		token: parsed.token,
-		expiresAt: parsed.expiresAt
-	};
-}
-async function compareAndSwap(io, path, task) {
-	if (io.transact !== void 0) {
-		await io.transact(path, (current) => task(current));
-		return;
-	}
-	const current = await io.exists(path) ? await io.readText(path) : null;
-	const next = task(current);
-	if (next === null) {
-		if (current !== null) try {
-			await io.remove(path);
-		} catch {}
-	} else if (next !== current) await io.writeText(path, next);
-}
-async function acquireTargetClaim(io, home, target, now) {
-	const path = claimPath(home, target);
-	const token = randomUUID();
-	let granted;
-	await compareAndSwap(io, path, (raw) => {
-		const claim = acquireClaim(parseClaim(raw), now, LEASE_MS, token);
-		if (claim === void 0) return raw;
-		granted = claim;
-		return JSON.stringify(claim) + "\n";
-	});
-	if (granted === void 0) return null;
-	return {
-		token,
-		async release() {
-			await compareAndSwap(io, path, (raw) => {
-				const next = releaseClaim(parseClaim(raw), token);
-				return next === void 0 ? null : JSON.stringify(next) + "\n";
-			});
-		}
-	};
-}
-//#endregion
 //#region lib/types/round2-outcome.js
 async function recordRound2Outcome(io, home, now, row, outcome) {
-	const at = new Date(now()).toISOString();
 	if (outcome.kind === "merged") {
-		if (transition(row, {
-			type: "round2-success",
-			at
-		}).ok) {
-			await dropRow(io, home, now, row.id);
+		{
+			if (!await dropRowV3(io, home, row.id, "committed", outcome.unitId ?? "unknown")) return {
+				merged: false,
+				pair: {
+					id: row.id,
+					pairKey: row.pairKey,
+					a: row.a,
+					b: row.b,
+					queue: row.queue,
+					outcome: "failed",
+					archived: [],
+					failure: {
+						stage: "commit",
+						code: "row-changed",
+						message: "row changed before commit record",
+						retryable: true,
+						retryFrom: "agent2"
+					}
+				}
+			};
 			const target = outcome.target?.actual ?? outcome.target?.requested ?? row.decision?.target;
 			await recordPair(io, home, {
 				pairKey: row.pairKey,
@@ -2362,20 +3094,37 @@ async function recordRound2Outcome(io, home, now, row, outcome) {
 		retryable: true,
 		retryFrom: "agent2"
 	};
-	const next = transition(row, {
-		type: "round2-fail",
-		failure,
-		at
-	});
-	if (next.ok && next.row !== null) {
-		await upsertRow(io, home, now, next.row);
-		await recordPair(io, home, {
+	if (await transactRows(io, home, (tx) => {
+		const current = tx.rows().find((item) => item.id === row.id);
+		if (current === void 0) return null;
+		const moved = tx.transition(row.id, {
+			type: "failed",
+			failure
+		}, current.version);
+		return moved.ok && moved.row !== null ? v3ToLegacy(moved.row) : null;
+	}) === null) return {
+		merged: false,
+		pair: {
+			id: row.id,
 			pairKey: row.pairKey,
-			runId: row.runId ?? "merge",
-			result: "failed",
-			...row.decision?.target === void 0 ? {} : { target: row.decision.target }
-		});
-	}
+			a: row.a,
+			b: row.b,
+			queue: row.queue,
+			outcome: "failed",
+			archived: [],
+			failure: {
+				...failure,
+				code: "row-changed",
+				message: "row changed before failure record"
+			}
+		}
+	};
+	await recordPair(io, home, {
+		pairKey: row.pairKey,
+		runId: row.runId ?? "merge",
+		result: "failed",
+		...row.decision?.target === void 0 ? {} : { target: row.decision.target }
+	});
 	return {
 		merged: false,
 		pair: {
@@ -2394,89 +3143,89 @@ async function recordRound2Outcome(io, home, now, row, outcome) {
 //#endregion
 //#region lib/types/approve-command.js
 async function runApproveCommand(options) {
-	const target = (await loadMergeState(options.io, options.home)).state.rows.find((item) => item.id === options.rowId)?.decision?.target;
-	const claim = target === void 0 ? null : await acquireTargetClaim(options.io, options.home, target, options.now());
-	if (target !== void 0 && claim === null) return {
+	const before = (await loadMergeState(options.io, options.home)).state.rows.find((item) => item.id === options.rowId);
+	if (before === void 0) return {
 		ok: false,
-		message: "target already claimed by another approve: " + target
+		message: "pending row not found: " + options.rowId
 	};
-	try {
-		const taken = await approvePending(options.io, options.home, options.now, options.rowId);
-		if (!taken.ok) return {
-			ok: false,
-			message: taken.message
-		};
-		const row = taken.row;
-		const decision = row.decision;
-		if (decision === void 0) return {
-			ok: false,
-			message: "pending row has no decision"
-		};
-		return await withMergeRun({
-			io: options.io,
-			home: options.home,
-			registry: options.registry,
-			command: "approve",
-			approval: {
-				platformWrite: options.platformWrite,
-				mergeApproval: true
-			},
-			now: options.now,
-			async body(ctx) {
-				const stage = (name) => ctx.stage(name, {
-					done: 0,
-					total: 1
-				});
-				await stage("author");
-				let outcome;
-				try {
-					outcome = await options.ports.round2(row, decision, ctx.signal, ctx.runId);
-				} catch (error) {
-					outcome = {
-						kind: "failed",
-						failure: {
-							stage: "author",
-							code: "merge-failed",
-							message: error instanceof Error ? error.message : String(error),
-							retryable: true,
-							retryFrom: "agent2"
-						}
-					};
-				}
-				const base = {
-					scope: {
-						candidatePairs: 1,
-						queueBefore: {
-							verify: 0,
-							pending: 0,
-							fuse: 1,
-							skipped: 0
-						}
-					},
-					notes: []
-				};
-				const record = await recordRound2Outcome(options.io, options.home, options.now, row, outcome);
-				return {
-					...base,
-					stopReason: record.merged ? "completed" : "failed",
-					pairs: [record.pair],
-					totals: record.merged ? {
-						merged: 1,
-						kept: 0,
-						pending: 0,
-						failed: 0
-					} : {
-						merged: 0,
-						kept: 0,
-						pending: 0,
-						failed: 1
+	if (before.state !== "pending") return {
+		ok: false,
+		message: "row is not pending: " + before.state
+	};
+	const taken = await approvePending(options.io, options.home, options.now, options.rowId);
+	if (!taken.ok) return {
+		ok: false,
+		message: taken.message
+	};
+	const row = taken.row;
+	const decision = row.decision;
+	if (decision === void 0) return {
+		ok: false,
+		message: "pending row has no decision"
+	};
+	return await withMergeRun({
+		io: options.io,
+		home: options.home,
+		registry: options.registry,
+		command: "approve",
+		approval: {
+			platformWrite: options.platformWrite,
+			mergeApproval: true
+		},
+		now: options.now,
+		...options.detached === true ? { detached: true } : {},
+		async body(ctx) {
+			const stage = (name) => ctx.stage(name, {
+				done: 0,
+				total: 1
+			});
+			await stage("author");
+			let outcome;
+			try {
+				outcome = await options.ports.round2(row, decision, ctx.signal, ctx.runId);
+			} catch (error) {
+				outcome = {
+					kind: "failed",
+					failure: {
+						stage: "author",
+						code: "merge-failed",
+						message: error instanceof Error ? error.message : String(error),
+						retryable: true,
+						retryFrom: "agent2"
 					}
 				};
 			}
-		});
-	} finally {
-		await claim?.release();
-	}
+			const base = {
+				scope: {
+					candidatePairs: 1,
+					queueBefore: {
+						verify: 0,
+						pending: 0,
+						fuse: 1,
+						skipped: 0
+					}
+				},
+				notes: []
+			};
+			const record = await recordRound2Outcome(options.io, options.home, options.now, row, outcome);
+			return {
+				...base,
+				stopReason: record.merged ? "completed" : "failed",
+				pairs: [record.pair],
+				totals: record.merged ? {
+					merged: 1,
+					kept: 0,
+					pending: 0,
+					failed: 0
+				} : {
+					merged: 0,
+					kept: 0,
+					pending: 0,
+					failed: 1
+				}
+			};
+		}
+	});
 }
 //#endregion
 //#region lib/types/resume-command.js
@@ -2498,6 +3247,7 @@ async function runResumeCommand(options) {
 			approval: true,
 			platformWrite: options.platformWrite,
 			now: options.now,
+			...options.detached === true ? { detached: true } : {},
 			...options.makePorts === void 0 ? { ports: {
 				...options.ports,
 				screening: () => Promise.resolve([{
@@ -2542,6 +3292,7 @@ async function runResumeCommand(options) {
 			mergeApproval: true
 		},
 		now: options.now,
+		...options.detached === true ? { detached: true } : {},
 		async body(ctx) {
 			await ctx.stage("author", {
 				done: 0,
@@ -2658,6 +3409,245 @@ function skillLibraryUndoPort(skills) {
 	};
 }
 //#endregion
+//#region lib/types/domain/state-v3.js
+function v2BackupPath(home) {
+	return join(home, "merge", "merge-state.v2.bak.json");
+}
+//#endregion
+//#region lib/types/domain/consistency.js
+const ALLOWED = [
+	{
+		row: "verify",
+		run: "none",
+		staging: "none",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 0
+	},
+	{
+		row: "verify",
+		run: "running",
+		staging: "none",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 1
+	},
+	{
+		row: "verify",
+		run: "failed",
+		staging: "none",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 0
+	},
+	{
+		row: "pending",
+		run: "none",
+		staging: "none",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 0
+	},
+	{
+		row: "pending",
+		run: "awaiting-approval",
+		staging: "none",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 1
+	},
+	{
+		row: "approved",
+		run: "none",
+		staging: "none",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 0
+	},
+	{
+		row: "approved",
+		run: "running",
+		staging: "none",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 1
+	},
+	{
+		row: "fuse",
+		run: "none",
+		staging: "kept",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 0
+	},
+	{
+		row: "fuse",
+		run: "running",
+		staging: "kept",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 1
+	},
+	{
+		row: "fuse",
+		run: "failed",
+		staging: "kept",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 0
+	},
+	{
+		row: "fuse",
+		run: "orphan",
+		staging: "kept",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 0
+	},
+	{
+		row: "fuse",
+		run: "none",
+		staging: "none",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 0,
+		recovery: true
+	},
+	{
+		row: "fuse",
+		run: "failed",
+		staging: "none",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 0,
+		recovery: true
+	},
+	{
+		row: "fuse",
+		run: "orphan",
+		staging: "none",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 0,
+		recovery: true
+	},
+	{
+		row: "fuse",
+		run: "running",
+		staging: "none",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 1,
+		recovery: true
+	},
+	{
+		row: "fuse",
+		run: "none",
+		staging: "missing",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 0,
+		recovery: true
+	},
+	{
+		row: "fuse",
+		run: "failed",
+		staging: "missing",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 0,
+		recovery: true
+	},
+	{
+		row: "fuse",
+		run: "orphan",
+		staging: "missing",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 0,
+		recovery: true
+	},
+	{
+		row: "fuse",
+		run: "running",
+		staging: "missing",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 1,
+		recovery: true
+	},
+	{
+		row: "fuse",
+		run: "running",
+		staging: "kept",
+		journal: "committing",
+		evidence: "none",
+		activeRuns: 1
+	},
+	{
+		row: "skipped",
+		run: "none",
+		staging: "none",
+		journal: "none",
+		evidence: "none",
+		activeRuns: 0
+	},
+	{
+		row: "merged",
+		run: "succeeded",
+		staging: "cleaned",
+		journal: "committed",
+		evidence: "receipt",
+		activeRuns: 0
+	},
+	{
+		row: "merged",
+		run: "succeeded",
+		staging: "kept",
+		journal: "committed",
+		evidence: "receipt",
+		activeRuns: 0
+	}
+];
+function same(a, b) {
+	return a.row === b.row && a.run === b.run && a.staging === b.staging && a.journal === b.journal && a.evidence === b.evidence && a.activeRuns === b.activeRuns && (b.recovery ?? false) === (a.recovery ?? false);
+}
+function validateArtifacts(state) {
+	if (state.activeRuns > 1) return {
+		ok: false,
+		reason: "multiple-active-runs"
+	};
+	if (state.activeRuns > 0 && state.hasOwner === false) return {
+		ok: false,
+		reason: "active-run-no-owner"
+	};
+	if (ALLOWED.some((item) => same(state, item))) return { ok: true };
+	if (state.row === "pending" && state.staging !== "none") return {
+		ok: false,
+		reason: "pending-staging"
+	};
+	if (state.row === "skipped" && state.run === "running") return {
+		ok: false,
+		reason: "skipped-running"
+	};
+	if (state.row === "fuse" && state.staging === "missing" && state.recovery !== true) return {
+		ok: false,
+		reason: "fuse-lost-staging"
+	};
+	if (state.journal === "committed" && state.evidence !== "receipt") return {
+		ok: false,
+		reason: "committed-no-evidence"
+	};
+	if (state.row === "merged" && state.journal === "rolled-back") return {
+		ok: false,
+		reason: "committed-rollback"
+	};
+	return {
+		ok: false,
+		reason: "not-allowed"
+	};
+}
+//#endregion
 //#region lib/types/doctor.js
 /**
 * Merge doctor rows: state, pending, gate cache and staging are each probed read-only.
@@ -2665,6 +3655,13 @@ function skillLibraryUndoPort(skills) {
 * operator can act on. This module never repairs or writes.
 */
 const MERGE_DOCTOR_SCHEMA_VERSION = 3;
+/** Global doctor host section: a missing merge mount must fail with E-325, not render empty. */
+function mergeDoctorAvailability(mounted) {
+	return mounted ? { ok: true } : {
+		ok: false,
+		code: "E-325"
+	};
+}
 async function mergeDoctor(io, home, configuredRoot) {
 	const rows = [];
 	const loaded = await loadMergeState(io, home);
@@ -2675,12 +3672,120 @@ async function mergeDoctor(io, home, configuredRoot) {
 		status: loaded.note === void 0 ? "ok" : "warn",
 		detail: loaded.note ?? "pairs " + String(loaded.state.rows.length) + "；verify " + String(counts.verify) + " / pending " + String(counts.pending) + " / fuse " + String(counts.fuse) + " / skipped " + String(counts.skipped)
 	});
-	const modelRoot = configuredRoot !== void 0 && configuredRoot !== "" ? configuredRoot : process.env.SKILL_MERGE_MODELS_ROOT;
-	if (modelRoot === void 0 || modelRoot === "") rows.push({
+	const recoveryRuns = /* @__PURE__ */ new Set();
+	try {
+		const raw = await io.readText(join(home, "merge", "recovery.json"));
+		if (raw !== null) {
+			for (const report of JSON.parse(raw)) if (report.ok === true && report.runId !== void 0) recoveryRuns.add(report.runId);
+		}
+	} catch {}
+	const receiptRuns = /* @__PURE__ */ new Set();
+	const receiptDir = await probeList(io, join(home, "merge", "receipts"));
+	if (receiptDir.kind === "present") for (const name of receiptDir.value) receiptRuns.add(name);
+	const invalid = [];
+	for (const row of loaded.state.rows) {
+		const run = row.state === "pending" && row.runId !== void 0 ? "awaiting-approval" : row.runId === void 0 ? "none" : "running";
+		const staging = row.stagingRef !== void 0 ? "kept" : row.state === "fuse" ? "missing" : "none";
+		const phase = row.runId === void 0 ? void 0 : (await readJournal(io, home, row.runId))?.phase;
+		const journal = phase === void 0 || phase === null ? "none" : phase === "committed" ? "committed" : phase === "prepared" ? "prepared" : phase === "rolled-back" ? "rolled-back" : phase === "failed" ? "failed" : "committing";
+		const evidence = row.runId !== void 0 && receiptRuns.has(row.runId) ? "receipt" : "none";
+		const recovery = row.runId !== void 0 && recoveryRuns.has(row.runId);
+		if (!validateArtifacts({
+			row: row.state,
+			run,
+			staging,
+			journal,
+			evidence,
+			activeRuns: run === "running" || run === "awaiting-approval" ? 1 : 0,
+			recovery
+		}).ok) invalid.push(row);
+	}
+	const schema = await loadStateSchema(io, home);
+	rows.push({
+		key: "merge-state-v3",
+		label: "state schema",
+		status: schema === 3 ? "ok" : schema === 2 ? "warn" : "unknown",
+		detail: schema === 3 ? "schemaVersion 3" : schema === 2 ? "schemaVersion 2；等待 v3 迁移" : "schemaVersion 未知/不可读"
+	});
+	let quarantineCount = 0;
+	try {
+		const qraw = await io.readText(join(home, "merge", "merge-state.quarantine.json"));
+		if (qraw !== null) {
+			const parsed = JSON.parse(qraw);
+			quarantineCount = Array.isArray(parsed) ? parsed.length : 0;
+		}
+	} catch {
+		quarantineCount = -1;
+	}
+	rows.push({
+		key: "quarantine",
+		label: "quarantine",
+		status: quarantineCount < 0 ? "unknown" : quarantineCount === 0 ? "ok" : "warn",
+		detail: quarantineCount < 0 ? "quarantine 不可读" : quarantineCount + " 行待人工检查"
+	});
+	const holder = await readTreeLock(io, home).catch(() => null);
+	rows.push({
+		key: "tree-lock",
+		label: "tree lock",
+		status: holder == null ? "ok" : "warn",
+		detail: holder == null ? "free" : "holder pid=" + String(holder.pid) + " epoch=" + String(holder.epoch) + " token=" + holder.token.slice(0, 8)
+	});
+	rows.push({
+		key: "backup",
+		label: "v2 backup",
+		status: await io.exists(v2BackupPath(home)) ? "ok" : "unknown",
+		detail: await io.exists(v2BackupPath(home)) ? "merge-state.v2.bak.json" : "no v2 backup (not migrated or already cleaned)"
+	});
+	const claims = await probeList(io, join(home, "merge", "claims"));
+	rows.push({
+		key: "target-claim",
+		label: "target claim",
+		status: claims.kind === "unknown" ? "unknown" : "ok",
+		detail: claims.kind === "unknown" ? "claims unreadable" : claims.kind === "absent" ? "no claims" : String(claims.value.length) + " claim files"
+	});
+	let orphanRuns = 0;
+	let runCount = 0;
+	try {
+		const raw = await io.readText(runsFile(home));
+		if (raw !== null) {
+			const parsed = JSON.parse(raw);
+			runCount = parsed.runs?.length ?? 0;
+			for (const run of parsed.runs ?? []) {
+				if (run.state !== "running" || typeof run.pid !== "number") continue;
+				try {
+					process.kill(run.pid, 0);
+				} catch {
+					orphanRuns += 1;
+				}
+			}
+		}
+	} catch {
+		orphanRuns = -1;
+	}
+	rows.push({
+		key: "runs",
+		label: "run owner",
+		status: orphanRuns < 0 ? "unknown" : orphanRuns === 0 ? "ok" : "warn",
+		detail: orphanRuns < 0 ? "runs.json unreadable" : String(runCount) + " runs; " + String(orphanRuns) + " dead-owner running"
+	});
+	rows.push({
+		key: "install",
+		label: "install form",
+		status: io.exists === void 0 ? "unknown" : "ok",
+		detail: "merge plugin loaded"
+	});
+	rows.push({
+		key: "consistency",
+		label: "一致性",
+		status: invalid.length === 0 ? "ok" : "warn",
+		detail: invalid.length === 0 ? "无非法组合" : String(invalid.length) + " 行需人工检查: " + invalid.map((row) => row.id).join(", ")
+	});
+	const modelRoot = configuredRoot?.trim() ?? "";
+	if (modelRoot === "") rows.push({
 		key: "models",
 		label: "合并模型",
 		status: "warn",
-		detail: "未设置 SKILL_MERGE_MODELS_ROOT；合并扫描会 fail loud"
+		detail: "未配置 mergeModelsRoot；合并扫描会 fail loud"
 	});
 	else {
 		const int8 = join(modelRoot, "potion-multilingual-128M-int8");
@@ -2707,12 +3812,32 @@ async function mergeDoctor(io, home, configuredRoot) {
 		status: "ok",
 		detail: stagingRoot(home, "<runId>")
 	});
+	try {
+		const raw = await io.readText(join(home, "merge", "recovery.json"));
+		if (raw !== null) {
+			const reports = JSON.parse(raw);
+			const failed = reports.filter((report) => report.ok !== true);
+			rows.push({
+				key: "recovery",
+				label: "提交恢复",
+				status: failed.length === 0 ? "ok" : "warn",
+				detail: failed.length === 0 ? String(reports.length) + " 条恢复报告，无待处理" : String(failed.length) + " 条待处理：" + failed.map((report) => (report.runId ?? "?") + "=" + (report.action ?? "?")).join(", ")
+			});
+		}
+	} catch {
+		rows.push({
+			key: "recovery",
+			label: "提交恢复",
+			status: "unknown",
+			detail: "无法读取 merge/recovery.json"
+		});
+	}
 	return rows;
 }
 //#endregion
 //#region lib/types/decision.js
 function extractJson(text) {
-	const body = /\`\`\`(?:json)?\s*([\s\S]*?)\`\`\`/i.exec(text)?.[1] ?? text;
+	const body = /`\``(?:json)?\s*([\s\S]*?)`\``/i.exec(text)?.[1] ?? text;
 	const start = body.indexOf("{");
 	if (start < 0) return void 0;
 	let depth = 0;
@@ -3239,12 +4364,17 @@ async function assembleStagedCommit(io, home, runId, port, options) {
 	const requested = staging.value.manifest.target;
 	let target = requested;
 	let targetCurrent = await port.readSkill(requested);
+	if (staging.value.manifest.mode !== "create-umbrella" && targetCurrent === null) return {
+		ok: false,
+		message: "target is gone; refusing to re-create it: " + requested
+	};
 	const requestedArchived = targetCurrent === null && await port.isArchived?.(requested) === true;
-	if (staging.value.manifest.mode === "create-umbrella" && (targetCurrent !== null || requestedArchived)) {
+	const requestedOccupied = targetCurrent === null && await port.isNameOccupied?.(requested) === true;
+	if (staging.value.manifest.mode === "create-umbrella" && (targetCurrent !== null || requestedArchived || requestedOccupied)) {
 		target = requested;
 		for (let suffix = 2; suffix <= 99; suffix += 1) {
 			const candidate = requested + "-v" + String(suffix);
-			if (await port.readSkill(candidate) === null && await port.isArchived?.(candidate) !== true) {
+			if (await port.readSkill(candidate) === null && await port.isArchived?.(candidate) !== true && await port.isNameOccupied?.(candidate) !== true) {
 				target = candidate;
 				targetCurrent = null;
 				break;
@@ -3289,27 +4419,87 @@ async function commitStagedRun(io, home, runId, port, options) {
 		ok: false,
 		message: assembled.message
 	};
-	try {
-		await writeCommitSnapshot(io, home, runId, assembled.plan, options.now(), port);
-	} catch (error) {
-		return {
-			ok: false,
-			message: "commit snapshot failed; refusing to write: " + (error instanceof Error ? error.message : String(error)),
-			plan: assembled.plan
-		};
-	}
+	if (await options.isBlocked?.(assembled.plan.target) === true) return {
+		ok: false,
+		message: "target is blocked by curator: " + assembled.plan.target,
+		plan: assembled.plan
+	};
 	const journal = {
 		runId,
 		target: assembled.plan.target,
 		create: !assembled.plan.targetExists,
 		sources: assembled.plan.sources,
-		phase: "sources-archived",
+		phase: "prepared",
 		updatedAt: new Date(options.now()).toISOString()
 	};
-	try {
-		await writeJournal(io, home, journal);
-	} catch {}
-	const result = await port.commitMerge(assembled.plan);
+	let result;
+	const transaction = options.unit ?? port.unit;
+	if (transaction !== void 0) {
+		const first = assembled.plan.sources[0] ?? assembled.plan.target;
+		const unitPlan = {
+			runId,
+			pairKey: pairKey(assembled.plan.target, first),
+			target: assembled.plan.target,
+			targetExists: assembled.plan.targetExists,
+			sources: assembled.plan.sources,
+			body: assembled.plan.body,
+			supportFiles: assembled.plan.supportFiles,
+			expectedTargetBody: assembled.plan.expectedTargetBody,
+			expectedSourceBodies: assembled.plan.expectedSourceBodies,
+			origin: options.origin,
+			summary: options.summary
+		};
+		try {
+			await writeJournal(io, home, journal);
+		} catch {}
+		const prepared = await transaction.prepare(unitPlan);
+		if (!prepared.ok) return {
+			ok: false,
+			message: prepared.message,
+			plan: assembled.plan
+		};
+		const committed = await transaction.commit(prepared.prepared);
+		if (!committed.ok) {
+			try {
+				await writeJournal(io, home, {
+					...journal,
+					phase: "failed",
+					updatedAt: new Date(options.now()).toISOString()
+				});
+			} catch {}
+			return {
+				ok: false,
+				message: committed.message,
+				plan: assembled.plan
+			};
+		}
+		result = {
+			ok: true,
+			message: "merged",
+			unitId: committed.evidence.unitId,
+			archived: committed.evidence.sources.filter((source) => source.archived).map((source) => source.name),
+			mutations: committed.evidence.mutations
+		};
+	} else {
+		try {
+			await writeCommitSnapshot(io, home, runId, assembled.plan, options.now(), port);
+		} catch (error) {
+			return {
+				ok: false,
+				message: "commit snapshot failed; refusing to write: " + (error instanceof Error ? error.message : String(error)),
+				plan: assembled.plan
+			};
+		}
+		try {
+			await writeJournal(io, home, journal);
+		} catch {}
+		if (port.commitMerge === void 0) return {
+			ok: false,
+			message: "commit port missing: UnitTransaction or commitMerge required",
+			plan: assembled.plan
+		};
+		result = await port.commitMerge(assembled.plan);
+	}
 	if (!result.ok) {
 		try {
 			await writeJournal(io, home, {
@@ -3327,7 +4517,8 @@ async function commitStagedRun(io, home, runId, port, options) {
 	const committed = {
 		...journal,
 		phase: "committed",
-		updatedAt: new Date(options.now()).toISOString()
+		updatedAt: new Date(options.now()).toISOString(),
+		...result.unitId === void 0 ? {} : { unitId: result.unitId }
 	};
 	try {
 		await writeJournal(io, home, committed);
@@ -3373,13 +4564,25 @@ async function commitStagedRun(io, home, runId, port, options) {
 //#region lib/types/authoring-flow.js
 async function runAuthoring(options) {
 	const targetCard = options.cards.find((card) => card.name === options.target);
-	if (targetCard?.protectionUnknown === true || targetCard?.protectedBy === "pinned") return {
+	const mode = options.mode ?? (targetCard === void 0 ? "create-umbrella" : "merge-into-existing");
+	const createMode = mode === "create-umbrella";
+	if (!createMode && targetCard !== void 0) {
+		if (targetCard.managed !== true) return {
+			ok: false,
+			message: "target is not family-managed: " + options.target
+		};
+		if (targetCard.protectionUnknown === true || targetCard.protectedBy != null) return {
+			ok: false,
+			message: "target is protected (" + (targetCard.protectedBy ?? "unknown") + "): " + options.target
+		};
+	}
+	if (!createMode && await options.isBlocked?.(options.target) === true) return {
 		ok: false,
-		message: "target is pinned: " + options.target
+		message: "target is blocked by curator: " + options.target
 	};
 	const stageKey = options.stageKey ?? options.runId;
 	if (options.reuseStaging === true) {
-		if (!await setStagingTarget(options.io, options.home, stageKey, options.target, options.mode)) return {
+		if (!await setStagingTarget(options.io, options.home, stageKey, options.target, mode)) return {
 			ok: false,
 			message: "staging missing or unreadable: " + stageKey
 		};
@@ -3387,7 +4590,7 @@ async function runAuthoring(options) {
 		const created = await createStaging(options.io, options.home, {
 			runId: stageKey,
 			target: options.target,
-			...options.mode === void 0 ? {} : { mode: options.mode },
+			mode,
 			sources: options.cards.map((card) => ({
 				name: card.name,
 				body: card.body,
@@ -3425,9 +4628,11 @@ async function runAuthoring(options) {
 		findings
 	};
 	const commit = await commitStagedRun(options.io, options.home, stageKey, options.commitPort, {
-		origin: "subagent",
+		origin: "foreground",
 		summary: options.summary,
-		now: options.now
+		now: options.now,
+		...options.isBlocked === void 0 ? {} : { isBlocked: options.isBlocked },
+		...options.unit === void 0 ? {} : { unit: options.unit }
 	});
 	if (!commit.ok) return {
 		ok: false,
@@ -3553,7 +4758,9 @@ function createChannelScanPorts(options) {
 					mode: decision.mode,
 					cards: options.cards,
 					commitPort: options.commitPort,
+					...options.unit === void 0 ? {} : { unit: options.unit },
 					now: options.now,
+					...options.isBlocked === void 0 ? {} : { isBlocked: options.isBlocked },
 					summary: "merge " + row.a + " + " + row.b,
 					author: async () => {
 						await entry.result.author?.(row, decision, signal);
@@ -3592,12 +4799,35 @@ function createChannelScanPorts(options) {
 //#region lib/types/new-child-authoring.js
 async function runNewChildAuthoring(options, row, decision, signal) {
 	const targetCard = options.cards.find((card) => card.name === decision.target);
-	if (targetCard?.protectionUnknown === true || targetCard?.protectedBy === "pinned") return {
+	const createMode = decision.mode === "create-umbrella";
+	if (!createMode && targetCard !== void 0) {
+		if (targetCard.managed !== true) return {
+			kind: "failed",
+			failure: {
+				stage: "author",
+				code: "target-not-managed",
+				message: "target is not family-managed: " + decision.target,
+				retryable: false,
+				retryFrom: "none"
+			}
+		};
+		if (targetCard.protectionUnknown === true || targetCard.protectedBy != null) return {
+			kind: "failed",
+			failure: {
+				stage: "author",
+				code: "target-protected",
+				message: "target is protected: " + decision.target,
+				retryable: false,
+				retryFrom: "none"
+			}
+		};
+	}
+	if (!createMode && await options.isBlocked?.(decision.target) === true) return {
 		kind: "failed",
 		failure: {
 			stage: "author",
-			code: "target-pinned",
-			message: "target is pinned: " + decision.target,
+			code: "target-blocked",
+			message: "target is blocked by curator: " + decision.target,
 			retryable: false,
 			retryFrom: "none"
 		}
@@ -3712,9 +4942,11 @@ async function runNewChildAuthoring(options, row, decision, signal) {
 			}
 		};
 		const commit = await commitStagedRun(options.io, options.home, stageKey, options.commitPort, {
-			origin: "subagent",
+			origin: "foreground",
 			summary: "merge " + row.a + " + " + row.b,
-			now: options.now
+			now: options.now,
+			...options.isBlocked === void 0 ? {} : { isBlocked: options.isBlocked },
+			...options.unit === void 0 ? {} : { unit: options.unit }
 		});
 		if (!commit.ok) return {
 			kind: "failed",
@@ -3761,7 +4993,10 @@ function skillLibraryPort(skills) {
 			const names = await archivedNames.call(skills);
 			return names === null ? true : names.includes(name);
 		},
-		commitMerge: (plan) => skills.commitMerge(plan),
+		isNameOccupied: async (name) => {
+			const probe = skills.skillDirExists;
+			return typeof probe === "function" ? await probe.call(skills, name) : false;
+		},
 		async readSupportFiles(name) {
 			if (typeof skills.listSupportFiles !== "function") return [];
 			const probe = await skills.listSupportFiles(name);
@@ -3795,6 +5030,17 @@ function forcedDecisionFor(a, b) {
 		rationale: "forced pair merge of " + sorted.join(" and ")
 	};
 }
+function unitFor(deps) {
+	if (deps.unit !== void 0) return deps.unit;
+	if (!(deps.skills instanceof SkillLibrary)) return void 0;
+	return new UnitTransactions({
+		io: deps.io,
+		home: deps.home,
+		backend: skillLibraryUnitBackend(deps.skills),
+		claim: targetClaimUnitPort(deps.io, deps.home, deps.now),
+		now: deps.now
+	});
+}
 function createMergeRuntime(deps) {
 	const readOnly = createReadOnlyMergeService(deps.io, deps.home);
 	const timeout = deps.timeoutMinutes > 0 ? deps.timeoutMinutes : void 0;
@@ -3845,7 +5091,12 @@ function createMergeRuntime(deps) {
 				b: command.b
 			}];
 			const existing = (await loadMergeState(deps.io, deps.home)).state.rows.find((row) => row.pairKey === pairKey(command.a, command.b));
-			if (existing?.state === "skipped") await dropRow(deps.io, deps.home, deps.now, existing.id);
+			if (existing?.state === "skipped") {
+				if (!await dropRowV3(deps.io, deps.home, existing.id, "superseded")) return {
+					ok: false,
+					text: "row changed before cleanup: " + existing.id
+				};
+			}
 			if (existing?.state === "pending") return {
 				ok: false,
 				text: "该 pair 已在待批准队列，先 approve/reject/discard: " + existing.id
@@ -3875,6 +5126,8 @@ function createMergeRuntime(deps) {
 						approval,
 						commitPort: skillLibraryPort(deps.skills),
 						now: deps.now,
+						...unitFor(deps) === void 0 ? {} : { unit: unitFor(deps) },
+						...deps.isBlocked === void 0 ? {} : { isBlocked: deps.isBlocked },
 						...stageHooks
 					});
 					return forced === void 0 ? ports : {
@@ -3940,6 +5193,8 @@ function createMergeRuntime(deps) {
 					approval: deps.params.mergeApproval,
 					commitPort: skillLibraryPort(deps.skills),
 					now: deps.now,
+					...unitFor(deps) === void 0 ? {} : { unit: unitFor(deps) },
+					...deps.isBlocked === void 0 ? {} : { isBlocked: deps.isBlocked },
 					...stageHooks
 				})
 			});
@@ -3966,15 +5221,18 @@ function createMergeRuntime(deps) {
 				ok: false,
 				text: "merge row not found: " + command.id
 			};
-			const next = transition(row, {
-				type: "reject",
-				at: new Date(deps.now()).toISOString()
-			});
-			if (!next.ok || next.row === null) return {
+			if (!await transactRows(deps.io, deps.home, (tx) => {
+				const current = tx.rows().find((item) => item.id === row.id);
+				if (current === void 0 || current.state !== "pending") return false;
+				return tx.transition(row.id, {
+					type: "skipped",
+					reason: "rejected",
+					origin: "human"
+				}, current.version).ok;
+			})) return {
 				ok: false,
-				text: "merge row is not pending: " + command.id
+				text: "merge row is not pending or changed: " + command.id
 			};
-			await upsertRow(deps.io, deps.home, deps.now, next.row);
 			return {
 				ok: true,
 				text: "已拒绝合并：" + command.id
@@ -3986,13 +5244,10 @@ function createMergeRuntime(deps) {
 		};
 		if (command.verb === "report" || command.verb === "runs" || command.verb === "cancel") {
 			const registry = deps.registry;
-			if (command.verb === "runs") {
-				const mergeRuns = registry.runs("merge");
-				return {
-					ok: true,
-					text: mergeRuns.length === 0 ? "merge runs: empty" : ["merge runs: " + String(mergeRuns.length)].concat(mergeRuns.map((run) => "- " + run.id + " [" + run.state + "]" + (run.resultRef === void 0 ? "" : " " + run.resultRef))).join("\n")
-				};
-			}
+			if (command.verb === "runs") return {
+				ok: true,
+				text: formatRunsView(toRunsView(registry.runs("merge"), deps.now()))
+			};
 			if (command.verb === "cancel") {
 				if (command.id !== void 0) {
 					const cancelled = registry.cancel(command.id);
@@ -4039,7 +5294,10 @@ function createMergeRuntime(deps) {
 				ok: false,
 				text: "merge row is not discardable: " + command.id
 			};
-			await dropRow(deps.io, deps.home, deps.now, row.id);
+			if (!await dropRowV3(deps.io, deps.home, row.id, "superseded")) return {
+				ok: false,
+				text: "row changed before discard: " + command.id
+			};
 			return {
 				ok: true,
 				text: "已丢弃合并行：" + command.id
@@ -4073,7 +5331,10 @@ function createMergeRuntime(deps) {
 				ok: false,
 				text: "skipped row not found: " + command.restore
 			};
-			await dropRow(deps.io, deps.home, deps.now, row.id);
+			if (!await dropRowV3(deps.io, deps.home, row.id, "restored")) return {
+				ok: false,
+				text: "row changed before restore: " + row.id
+			};
 			return {
 				ok: true,
 				text: "已恢复参与筛选：" + row.id
@@ -4086,7 +5347,10 @@ function createMergeRuntime(deps) {
 					ok: false,
 					text: "merge row not found: " + command.clear
 				};
-				await dropRow(deps.io, deps.home, deps.now, cleared.id);
+				if (!await dropRowV3(deps.io, deps.home, cleared.id, "superseded")) return {
+					ok: false,
+					text: "row changed before clear: " + cleared.id
+				};
 				return {
 					ok: true,
 					text: "已清除合并行：" + cleared.id
@@ -4106,6 +5370,21 @@ function createMergeRuntime(deps) {
 			};
 			const signal = new AbortController().signal;
 			const cards = await deps.cards(signal);
+			if ((row.state === "fuse" || row.state === "approved") && row.decision !== void 0 && row.decision.mode !== "create-umbrella") {
+				const targetCard = cards.find((card) => card.name === row.decision?.target);
+				if (targetCard !== void 0 && targetCard.managed !== true) return {
+					ok: false,
+					text: "target 不是 family-managed：" + row.decision.target
+				};
+				if (targetCard !== void 0 && (targetCard.protectionUnknown === true || targetCard.protectedBy != null)) return {
+					ok: false,
+					text: "target 受保护：" + row.decision.target
+				};
+				if (await deps.isBlocked?.(row.decision.target) === true) return {
+					ok: false,
+					text: "target 被范围门拦下：" + row.decision.target
+				};
+			}
 			const pair = () => Promise.resolve([{
 				a: row.a,
 				b: row.b
@@ -4129,6 +5408,8 @@ function createMergeRuntime(deps) {
 				...common,
 				rowId: row.id,
 				ports: basePorts,
+				...detached ? { detached: true } : {},
+				pairTimeoutMinutes: deps.params.mergePairTimeoutMinutes,
 				...deps.isOwnerActive === void 0 ? {} : { isOwnerActive: deps.isOwnerActive },
 				makePorts: (runId) => createChannelScanPorts({
 					io: deps.io,
@@ -4143,7 +5424,9 @@ function createMergeRuntime(deps) {
 					timeoutMs: deps.params.mergePairTimeoutMinutes * 6e4,
 					approval: deps.params.mergeApproval,
 					commitPort: skillLibraryPort(deps.skills),
-					now: deps.now
+					now: deps.now,
+					...unitFor(deps) === void 0 ? {} : { unit: unitFor(deps) },
+					...deps.isBlocked === void 0 ? {} : { isBlocked: deps.isBlocked }
 				}),
 				round2WithRun: createNewChildRound2({
 					io: deps.io,
@@ -4156,6 +5439,8 @@ function createMergeRuntime(deps) {
 					timeoutMs: deps.params.mergePairTimeoutMinutes * 6e4,
 					commitPort: skillLibraryPort(deps.skills),
 					now: deps.now,
+					...unitFor(deps) === void 0 ? {} : { unit: unitFor(deps) },
+					...deps.isBlocked === void 0 ? {} : { isBlocked: deps.isBlocked },
 					...stageHooks
 				})
 			});
@@ -4179,11 +5464,22 @@ function createMergeRuntime(deps) {
 		if (command.verb === "approve") {
 			const signal = new AbortController().signal;
 			const cards = await deps.cards(signal);
-			const candidate = (await loadMergeState(deps.io, deps.home)).state.rows.find((row) => row.id === command.id);
+			let candidate = (await loadMergeState(deps.io, deps.home)).state.rows.find((row) => row.id === command.id);
+			if (candidate !== void 0 && candidate.stagingRef === void 0) {
+				const entry = await readStagingIndex(deps.io, deps.home, candidate.id, deps.now());
+				if (entry !== null) candidate = {
+					...candidate,
+					stagingRef: entry.ref,
+					stagingExpiresAt: entry.expiresAt
+				};
+			}
 			if (candidate !== void 0 && candidate.state === "pending" && candidate.decision !== void 0) {
 				const missingSource = [candidate.a, candidate.b].find((name) => !cards.some((card) => card.name === name && card.managed === true));
 				if (missingSource !== void 0) {
-					await dropRow(deps.io, deps.home, deps.now, candidate.id);
+					if (!await dropRowV3(deps.io, deps.home, candidate.id, "superseded")) return {
+						ok: false,
+						text: "source-gone 但 row 已变化，未清理：" + candidate.id
+					};
 					return {
 						ok: false,
 						text: "source-gone：" + missingSource + " 已不在 family-managed 技能库，已从 active 队列清除；可 merge skipped --discard 清理"
@@ -4191,11 +5487,16 @@ function createMergeRuntime(deps) {
 				}
 				const currentRevision = sourceRevisionOf(cards, candidate.a, candidate.b);
 				if (candidate.sourceRevision !== void 0 && currentRevision !== void 0 && currentRevision !== candidate.sourceRevision) {
-					const changed = transition(candidate, {
-						type: "source-changed",
-						at: (/* @__PURE__ */ new Date()).toISOString()
-					});
-					if (changed.ok && changed.row !== null) await upsertRow(deps.io, deps.home, deps.now, changed.row);
+					if (!await transactRows(deps.io, deps.home, (tx) => {
+						const current = tx.rows().find((item) => item.id === candidate.id);
+						return current === void 0 ? false : tx.transition(candidate.id, {
+							type: "expired",
+							kind: "source-changed"
+						}, current.version).ok;
+					})) return {
+						ok: false,
+						text: "row changed before source-changed record: " + candidate.id
+					};
 					return {
 						ok: false,
 						text: "source-changed：源技能内容在决策后变化，拒绝照跑；出口：重新 merge pair，或 merge skipped --discard"
@@ -4203,22 +5504,47 @@ function createMergeRuntime(deps) {
 				}
 				const currentTargetRevision = targetRevisionOf(cards, candidate.decision.target);
 				if (candidate.targetRevision !== void 0 && currentTargetRevision !== void 0 && currentTargetRevision !== candidate.targetRevision) {
-					const taken = transition(candidate, {
-						type: "target-taken",
-						at: (/* @__PURE__ */ new Date()).toISOString()
-					});
-					if (taken.ok && taken.row !== null) await upsertRow(deps.io, deps.home, deps.now, taken.row);
+					if (!await transactRows(deps.io, deps.home, (tx) => {
+						const current = tx.rows().find((item) => item.id === candidate.id);
+						return current === void 0 ? false : tx.transition(candidate.id, {
+							type: "expired",
+							kind: "target-taken"
+						}, current.version).ok;
+					})) return {
+						ok: false,
+						text: "row changed before target-taken record: " + candidate.id
+					};
 					return {
 						ok: false,
 						text: "target-taken：目标 " + candidate.decision.target + " 在决策后变化，拒绝照跑；可重新 merge pair 或 discard"
 					};
 				}
+				if (candidate.decision.mode !== "create-umbrella") {
+					const targetCard = cards.find((card) => card.name === candidate.decision?.target);
+					if (targetCard !== void 0 && targetCard.managed !== true) return {
+						ok: false,
+						text: "target 不是 family-managed：" + candidate.decision.target
+					};
+					if (targetCard !== void 0 && (targetCard.protectionUnknown === true || targetCard.protectedBy != null)) return {
+						ok: false,
+						text: "target 受保护：" + candidate.decision.target
+					};
+					if (await deps.isBlocked?.(candidate.decision.target) === true) return {
+						ok: false,
+						text: "target 被范围门拦下：" + candidate.decision.target
+					};
+				}
 				if (candidate.decision.mode === "merge-into-existing" && !cards.some((card) => card.name === candidate.decision?.target)) {
-					const expired = transition(candidate, {
-						type: "target-taken",
-						at: (/* @__PURE__ */ new Date()).toISOString()
-					});
-					if (expired.ok && expired.row !== null) await upsertRow(deps.io, deps.home, deps.now, expired.row);
+					if (!await transactRows(deps.io, deps.home, (tx) => {
+						const current = tx.rows().find((item) => item.id === candidate.id);
+						return current === void 0 ? false : tx.transition(candidate.id, {
+							type: "expired",
+							kind: "target-taken"
+						}, current.version).ok;
+					})) return {
+						ok: false,
+						text: "row changed before target-taken record: " + candidate.id
+					};
 					return {
 						ok: false,
 						text: "target-taken：目标 " + candidate.decision.target + " 已不存在，行保留 pending --expired；出口：重新 merge pair，或 merge skipped --discard"
@@ -4228,6 +5554,8 @@ function createMergeRuntime(deps) {
 			const result = await runApproveCommand({
 				...common,
 				rowId: command.id,
+				...detached ? { detached: true } : {},
+				pairTimeoutMinutes: deps.params.mergePairTimeoutMinutes,
 				ports: { round2: createNewChildRound2({
 					io: deps.io,
 					home: deps.home,
@@ -4238,7 +5566,9 @@ function createMergeRuntime(deps) {
 					...deps.cwd === void 0 ? {} : { cwd: deps.cwd },
 					timeoutMs: deps.params.mergePairTimeoutMinutes * 6e4,
 					commitPort: skillLibraryPort(deps.skills),
-					now: deps.now
+					now: deps.now,
+					...unitFor(deps) === void 0 ? {} : { unit: unitFor(deps) },
+					...deps.isBlocked === void 0 ? {} : { isBlocked: deps.isBlocked }
 				}) }
 			});
 			if (!result.ok) return {
@@ -4259,7 +5589,9 @@ function createMergeRuntime(deps) {
 			};
 		}
 		const cards = command.verb === "pending" ? await deps.cards(new AbortController().signal) : void 0;
-		const text = await handleReadOnlyMergeCommand(command, deps.io, deps.home, cards);
+		const registry = deps.registry;
+		const runs = command.verb === "status" ? registry.runs("merge") : void 0;
+		const text = await handleReadOnlyMergeCommand(command, deps.io, deps.home, cards, runs, deps.params.mergeApproval);
 		if (text !== null) return {
 			ok: true,
 			text
@@ -4638,6 +5970,143 @@ async function supersedeMergeRuns(registry) {
 	return ids.length;
 }
 //#endregion
+//#region lib/types/coordinator.js
+/**
+* Pure merge transition table. No io, no run shell, no subagents.
+*
+* Every transition returns the whole next row (or a drop), so the caller can persist it
+* through one state transaction. Invalid transitions are refused by name;
+* a caller never "repairs" a row by guessing which state the operator meant.
+*/
+function invalid(event, state) {
+	return {
+		ok: false,
+		code: "invalid-transition",
+		message: "cannot apply " + event.type + " to " + (state ?? "no row")
+	};
+}
+/** Drop fields that must not survive a transition; optional fields stay absent. */
+function base(row, at) {
+	return {
+		id: row.id,
+		pairKey: row.pairKey,
+		a: row.a,
+		b: row.b,
+		state: row.state,
+		queue: row.queue,
+		createdAt: row.createdAt,
+		updatedAt: at,
+		...row.runId === void 0 ? {} : { runId: row.runId },
+		...row.unitId === void 0 ? {} : { unitId: row.unitId },
+		...row.origin === void 0 ? {} : { origin: row.origin },
+		...row.decision === void 0 ? {} : { decision: row.decision },
+		...row.sourceRevision === void 0 ? {} : { sourceRevision: row.sourceRevision },
+		...row.targetRevision === void 0 ? {} : { targetRevision: row.targetRevision },
+		...row.attempts === void 0 ? {} : { attempts: row.attempts },
+		...row.stagingRef === void 0 ? {} : { stagingRef: row.stagingRef },
+		...row.stagingExpiresAt === void 0 ? {} : { stagingExpiresAt: row.stagingExpiresAt },
+		...row.expired === void 0 ? {} : { expired: row.expired },
+		...row.reason === void 0 ? {} : { reason: row.reason },
+		...row.target === void 0 ? {} : { target: row.target }
+	};
+}
+function next(row, at, state, patch = {}) {
+	return {
+		ok: true,
+		row: {
+			...base(row, at),
+			state,
+			queue: queueOf(state),
+			...patch
+		}
+	};
+}
+/** Legacy v2 projection only; runtime writes must use transitionV3/RowTx. */
+function transitionLegacyForProjection(current, event) {
+	if (event.type === "candidate") {
+		if (current !== void 0) return {
+			ok: true,
+			row: current
+		};
+		const key = pairKey(event.a, event.b);
+		return {
+			ok: true,
+			row: {
+				id: rowIdOf(key),
+				pairKey: key,
+				a: event.a,
+				b: event.b,
+				state: "verify",
+				queue: "verify",
+				createdAt: event.at,
+				updatedAt: event.at
+			}
+		};
+	}
+	if (event.type === "source-gone") return {
+		ok: true,
+		row: null
+	};
+	if (event.type === "gate-keep") {
+		if (current !== void 0) return {
+			ok: true,
+			row: current
+		};
+		const key = pairKey(event.a, event.b);
+		return {
+			ok: true,
+			row: {
+				id: rowIdOf(key),
+				pairKey: key,
+				a: event.a,
+				b: event.b,
+				state: "skipped",
+				queue: "skipped",
+				origin: "agent",
+				createdAt: event.at,
+				updatedAt: event.at
+			}
+		};
+	}
+	if (current === void 0) return invalid(event, void 0);
+	switch (event.type) {
+		case "round1-keep": return current.state === "verify" ? next(current, event.at, "skipped", { origin: "agent" }) : invalid(event, current.state);
+		case "round1-merge":
+			if (current.state !== "verify") return invalid(event, current.state);
+			return event.approval === "on" ? next(current, event.at, "pending", {
+				...event.decision === void 0 ? {} : { decision: event.decision },
+				...event.stagingRef === void 0 ? {} : { stagingRef: event.stagingRef },
+				...event.stagingExpiresAt === void 0 ? {} : { stagingExpiresAt: event.stagingExpiresAt },
+				...event.sourceRevision === void 0 ? {} : { sourceRevision: event.sourceRevision },
+				...event.targetRevision === void 0 ? {} : { targetRevision: event.targetRevision }
+			}) : next(current, event.at, "approved", {
+				...event.decision === void 0 ? {} : { decision: event.decision },
+				...event.stagingRef === void 0 ? {} : { stagingRef: event.stagingRef },
+				...event.stagingExpiresAt === void 0 ? {} : { stagingExpiresAt: event.stagingExpiresAt },
+				...event.sourceRevision === void 0 ? {} : { sourceRevision: event.sourceRevision },
+				...event.targetRevision === void 0 ? {} : { targetRevision: event.targetRevision }
+			});
+		case "round1-fail": return current.state === "verify" ? next(current, event.at, "verify", {
+			failure: event.failure,
+			attempts: (current.attempts ?? 0) + 1
+		}) : invalid(event, current.state);
+		case "approve": return current.state === "pending" ? next(current, event.at, "approved", event.runId === void 0 ? {} : { runId: event.runId }) : invalid(event, current.state);
+		case "reject": return current.state === "pending" ? next(current, event.at, "skipped", { origin: "human" }) : invalid(event, current.state);
+		case "round2-cancel": return current.state === "fuse" || current.state === "approved" ? next(current, event.at, "approved") : invalid(event, current.state);
+		case "round2-fail": return current.state === "fuse" || current.state === "approved" ? next(current, event.at, "approved", {
+			failure: event.failure,
+			attempts: (current.attempts ?? 0) + 1
+		}) : invalid(event, current.state);
+		case "round2-success": return current.state === "fuse" || current.state === "approved" ? {
+			ok: true,
+			row: null
+		} : invalid(event, current.state);
+		case "target-taken":
+		case "source-changed": return current.state === "pending" || current.state === "approved" || current.state === "fuse" ? next(current, event.at, current.state, { expired: event.type }) : invalid(event, current.state);
+		case "restore": return current.state === "skipped" ? next(current, event.at, "verify") : invalid(event, current.state);
+	}
+}
+//#endregion
 //#region lib/types/pair-command.js
 async function runPairCommand(options) {
 	return await runScanCommand({
@@ -4667,14 +6136,10 @@ const Config = z.object({
 	mergePairTimeoutMinutes: z.number().min(1).default(15),
 	mergeModelsRoot: z.string().default("")
 });
-function engineConfigFromEnv(configuredRoot) {
-	const root = configuredRoot !== void 0 && configuredRoot !== "" ? configuredRoot : process.env.SKILL_MERGE_MODELS_ROOT;
-	if (root === void 0 || root === "") return void 0;
+function engineConfigFromRoot(configuredRoot) {
+	const root = configuredRoot?.trim() ?? "";
+	if (root === "") return void 0;
 	return {
-		models_dir: "",
-		offline: true,
-		auto_provision: false,
-		embed_backend: "local",
 		embedder_model: join(root, "potion-multilingual-128M-int8"),
 		embedder_model_last: join(root, "potion-multilingual-128M-pca64-int8")
 	};
@@ -4718,7 +6183,6 @@ function apply(ctx, rawConfig = {}) {
 				ctx.logger.warn(message);
 			}
 		});
-		runs.load();
 		ctx.effect(() => {
 			const host = ctx;
 			if (typeof host.on !== "function") return () => {};
@@ -4736,20 +6200,17 @@ function apply(ctx, rawConfig = {}) {
 				...policyStageLimits(policySnapshot?.get?.())
 			}
 		});
-		const mergeSkillsRoot = skills.root ?? skillsRoot();
-		recoverCommitJournals(io, home, Date.now(), mergeSkillsRoot, async (name) => {
-			return (await skills.restoreFromArchive(name)).ok;
-		}, (runId) => {
+		runs.load().then(() => recoverCommitJournals(io, home, Date.now(), (runId) => {
 			const run = runs.find(runId);
 			return run !== void 0 && run.state === "running";
-		}).then((reports) => {
+		})).then((reports) => {
 			if (reports.length > 0) ctx.logger.info("merge commit recovery: " + reports.map((report) => report.runId + "=" + report.action).join(", "));
 		}).catch((error) => {
 			ctx.logger.warn("merge commit recovery failed: " + (error instanceof Error ? error.message : String(error)));
 		});
 		const channel = subagentChannelAdapter(createSubagentChannel(ctx));
 		const stage = new StageToolRegistry();
-		const engineConfig = engineConfigFromEnv(params.mergeModelsRoot);
+		const engineConfig = engineConfigFromRoot(params.mergeModelsRoot);
 		const llm = ctx.get("llm");
 		const defaultModel = ctx.get("agentDefaultModel");
 		const runner = llm === void 0 || defaultModel === void 0 ? void 0 : createEngineRunner(llm, () => defaultModel.currentSelection());
@@ -4759,7 +6220,7 @@ function apply(ctx, rawConfig = {}) {
 			engine: { screen },
 			select: selectWithErrors,
 			cfg: {
-				...engineConfig ?? {},
+				...engineConfig,
 				judge: "deepseek"
 			},
 			...runner === void 0 ? {} : { runner },
@@ -4768,14 +6229,20 @@ function apply(ctx, rawConfig = {}) {
 				const at = (/* @__PURE__ */ new Date()).toISOString();
 				for (const skipped of selection.skipped) {
 					if (loaded.state.rows.some((row) => row.pairKey === skipped.pairKey)) continue;
-					const next = transition(void 0, {
-						type: "gate-keep",
+					const key = pairKey(skipped.a, skipped.b);
+					await transactRows(io, home, (tx) => tx.createSkipped({
+						id: rowIdOf(key),
+						pairKey: key,
 						a: skipped.a,
 						b: skipped.b,
-						...skipped.reason === void 0 ? {} : { reason: skipped.reason },
-						at
-					});
-					if (next.ok && next.row !== null) await upsertRow(io, home, () => Date.now(), next.row);
+						version: 0,
+						createdAt: at,
+						updatedAt: at,
+						origin: "agent",
+						state: "skipped",
+						reason: skipped.reason ?? "gate-keep",
+						attempts: 0
+					}).ok);
 				}
 			}
 		});
@@ -4906,4 +6373,4 @@ function apply(ctx, rawConfig = {}) {
 	});
 }
 //#endregion
-export { Config, MERGE_DOCTOR_SCHEMA_VERSION, MERGE_MAX_ATTEMPTS, MERGE_PAIR_STATES, MERGE_PARAM_DEFAULTS, MERGE_PROMPT_VERSION, MERGE_QUEUES, MERGE_ROUTES, MERGE_STAGE_TOOL_NAME, MERGE_STATE_VERSION, STAGING_SCHEMA_VERSION, STANDBY_PROMPT, StageToolRegistry, apply, applyStageTool, approvePending, assembleStagedCommit, buildCommitPlan, buildMergeView, buildRound1Prompt, buildRound2Prompt, buildStandbyPrompt, canRetry, cleanupExpiredStaging, commitReceiptPath, commitStagedRun, committedPairs, configureMergePresentation, copyStagedFile, countRows, createChannelScanPorts, createEngineRunner, createEngineScreening, createMergeCommand, createMergeRuntime, createMergeStageTool, createNewChildRound2, createReadOnlyMergeService, createStaging, dropRow, dropStaging, durableReceiptDir, durableReceiptPath, emptyMergeState, engineConfigFromEnv, ensureStaging, formatQueue, formatStatus, handleReadOnlyMergeCommand, hasBlockingFinding, inject, isSkippedPair, listStagedFiles, loadMergeState, makeMergeRoutes, mergeCommandHelp, mergeDoctor, mergeReportDigestPath, mergeReportPath, mergeRunIdsToSupersede, mergeStatePath, mergeUsage, moveRow, mutateMergeState, pageQueue, pairKey, parseDecision, parseMergeCommand, queueOf, readCommitReceipt, readCommitReceipts, readMergeReport, readStagedFile, readStagedTree, readStaging, recordRound2Outcome, rejectPending, resolveMergeParams, resolveTargetName, rewriteFrontmatterName, rowIdOf, rowsOf, runApproveCommand, runAuthoring, runMergeCommand, runNewChildAuthoring, runPairCommand, runResumeCommand, runRound1OverChannel, runScan, runScanCommand, setStagingTarget, skillLibraryPort, skillLibraryUndoPort, skippedPairKeys, snapshotCards, stageKeyOf, stageOf, stagingRoot, subagentChannelAdapter, supersedeMergeRuns, toRowView, toRunFact, transition, undoMergeReceipt, upsertRow, validateStagedTree, withMergeRun, writeCommitReceipt, writeMergeReport, writeStagedFile };
+export { Config, MERGE_DOCTOR_SCHEMA_VERSION, MERGE_MAX_ATTEMPTS, MERGE_PAIR_STATES, MERGE_PARAM_DEFAULTS, MERGE_PROMPT_VERSION, MERGE_QUEUES, MERGE_ROUTES, MERGE_STAGE_TOOL_NAME, MERGE_STATE_VERSION, STAGING_SCHEMA_VERSION, STANDBY_PROMPT, StageToolRegistry, apply, applyStageTool, approvePending, assembleStagedCommit, buildCommitPlan, buildRound1Prompt, buildRound2Prompt, buildStandbyPrompt, canRetry, cleanupExpiredStaging, commitReceiptPath, commitStagedRun, committedPairs, configureMergePresentation, copyStagedFile, countRows, createChannelScanPorts, createEngineRunner, createEngineScreening, createMergeCommand, createMergeRuntime, createMergeStageTool, createNewChildRound2, createReadOnlyMergeService, createStaging, dropRow, dropRowV3, dropStaging, durableReceiptDir, durableReceiptPath, emptyMergeState, engineConfigFromRoot, ensureStaging, formatFacts, formatQueue, formatRunsView, formatStatus, handleReadOnlyMergeCommand, hasBlockingFinding, inject, isSkippedPair, listStagedFiles, loadMergeState, loadStateSchema, makeMergeRoutes, mergeCommandHelp, mergeDoctor, mergeDoctorAvailability, mergeReportDigestPath, mergeReportPath, mergeRunIdsToSupersede, mergeStatePath, mergeUsage, moveRow, mutateMergeState, pairKey, parseDecision, parseMergeCommand, queueOf, readCommitReceipt, readCommitReceipts, readMergeReport, readStagedFile, readStagedTree, readStaging, recordRound2Outcome, rejectPending, resolveMergeParams, resolveTargetName, rewriteFrontmatterName, rowIdOf, rowsOf, runApproveCommand, runAuthoring, runMergeCommand, runNewChildAuthoring, runPairCommand, runResumeCommand, runRound1OverChannel, runScan, runScanCommand, setStagingTarget, skillLibraryPort, skillLibraryUndoPort, skippedPairKeys, snapshotCards, stageKeyOf, stageOf, stagingRoot, subagentChannelAdapter, supersedeMergeRuns, transactRows, transitionLegacyForProjection, undoMergeReceipt, unitFor, upsertRow, validateStagedTree, withMergeRun, writeCommitReceipt, writeMergeReport, writeStagedFile };