@lmzhen/dsh-evolution-merge 0.30.24 → 0.30.27

package/lib/index.js

@@ -596,7 +596,11 @@ function transitionV4(row, event, expectedVersion, at = (/* @__PURE__ */ new Dat
 			};
 			if (event.type === "staged") return {
 				ok: true,
-				row: advance(row, at, { state: "fuse" }),
+				row: advance(row, at, {
+					state: "fuse",
+					...event.stagingRef === void 0 ? {} : { stagingRef: event.stagingRef },
+					...event.stagingExpiresAt === void 0 ? {} : { stagingExpiresAt: event.stagingExpiresAt }
+				}),
 				version: expectedVersion + 1
 			};
 			if (event.type === "skipped") return {
@@ -631,7 +635,11 @@ function transitionV4(row, event, expectedVersion, at = (/* @__PURE__ */ new Dat
 		case "approved":
 			if (event.type === "staged") return {
 				ok: true,
-				row: advance(row, at, { state: "fuse" }),
+				row: advance(row, at, {
+					state: "fuse",
+					...event.stagingRef === void 0 ? {} : { stagingRef: event.stagingRef },
+					...event.stagingExpiresAt === void 0 ? {} : { stagingExpiresAt: event.stagingExpiresAt }
+				}),
 				version: expectedVersion + 1
 			};
 			if (event.type === "committed") return {
@@ -648,7 +656,7 @@ function transitionV4(row, event, expectedVersion, at = (/* @__PURE__ */ new Dat
 				}),
 				version: expectedVersion + 1
 			};
-			if (event.type === "failed") return event.failure.retryable ? {
+			if (event.type === "failed") return {
 				ok: true,
 				row: advance(row, at, {
 					state: "fuse",
@@ -656,15 +664,6 @@ function transitionV4(row, event, expectedVersion, at = (/* @__PURE__ */ new Dat
 					attempts: row.attempts + 1
 				}),
 				version: expectedVersion + 1
-			} : {
-				ok: true,
-				row: advance(row, at, {
-					state: "skipped",
-					reason: event.failure.code,
-					failure: event.failure,
-					attempts: row.attempts + 1
-				}),
-				version: expectedVersion + 1
 			};
 			if (event.type === "superseded") return {
 				ok: true,
@@ -687,7 +686,7 @@ function transitionV4(row, event, expectedVersion, at = (/* @__PURE__ */ new Dat
 				}),
 				version: expectedVersion + 1
 			};
-			if (event.type === "failed") return event.failure.retryable ? {
+			if (event.type === "failed") return {
 				ok: true,
 				row: advance(row, at, {
 					state: "fuse",
@@ -695,15 +694,6 @@ function transitionV4(row, event, expectedVersion, at = (/* @__PURE__ */ new Dat
 					attempts: row.attempts + 1
 				}),
 				version: expectedVersion + 1
-			} : {
-				ok: true,
-				row: advance(row, at, {
-					state: "skipped",
-					reason: event.failure.code,
-					failure: event.failure,
-					attempts: row.attempts + 1
-				}),
-				version: expectedVersion + 1
 			};
 			if (event.type === "superseded") return {
 				ok: true,
@@ -794,7 +784,14 @@ function v3ToV4(row) {
 		target: row.target,
 		decision: row.decision,
 		...row.sourceRevision === void 0 ? {} : { sourceRevision: row.sourceRevision },
-		...row.runId === void 0 ? {} : { runId: row.runId }
+		...row.runId === void 0 ? {} : { runId: row.runId },
+		...row.staging?.kind === "present" ? {
+			stagingRef: row.staging.ref,
+			stagingExpiresAt: row.staging.expiresAt
+		} : row.staging?.kind === "expired" && row.staging.ref !== void 0 ? {
+			stagingRef: row.staging.ref,
+			stagingExpiresAt: row.staging.expiresAt
+		} : {}
 	};
 	return {
 		...base,
@@ -870,6 +867,8 @@ function v4ToLegacy(row) {
 		...(row.state === "pending" || row.state === "approved" || row.state === "fuse") && row.sourceRevision !== void 0 ? { sourceRevision: row.sourceRevision } : {},
 		...(row.state === "pending" || row.state === "approved" || row.state === "fuse") && row.targetRevision !== void 0 ? { targetRevision: row.targetRevision } : {},
 		...row.runId === void 0 ? {} : { runId: row.runId },
+		...row.state === "fuse" && row.stagingRef !== void 0 ? { stagingRef: row.stagingRef } : {},
+		...row.state === "fuse" && row.stagingExpiresAt !== void 0 ? { stagingExpiresAt: row.stagingExpiresAt } : {},
 		...row.origin === void 0 ? {} : { origin: row.origin },
 		...row.attempts === void 0 ? {} : { attempts: row.attempts },
 		createdAt: row.createdAt,
@@ -2311,9 +2310,13 @@ async function presentStage(io, home, entry) {
 		state: "present"
 	});
 }
-async function dropStage(io, home, rowId, ref) {
-	await io.remove(join(home, "merge", "staging-index", encodeURIComponent(rowId) + ".json")).catch(() => {});
-	if (ref !== void 0 && ref !== "") await io.remove(join(home, "merge", "runs", ref)).catch(() => {});
+async function dropStage(io, home, rowId, ref, onError) {
+	const index = join(home, "merge", "staging-index", encodeURIComponent(rowId) + ".json");
+	await io.remove(index).catch((error) => onError?.(index, error));
+	if (ref !== void 0 && ref !== "") {
+		const tree = join(home, "merge", "runs", ref);
+		await io.remove(tree).catch((error) => onError?.(tree, error));
+	}
 }
 /** Bounded cleanup: reserved/present TTL, pending/verify stale index removal, terminal/absent rows, orphan trees. */
 async function cleanupStage(io, home, now, rows, limit = 100) {
@@ -2321,6 +2324,13 @@ async function cleanupStage(io, home, now, rows, limit = 100) {
 	const expired = [];
 	const kept = [];
 	const orphans = [];
+	const failures = [];
+	const fail = (path, error) => {
+		failures.push({
+			path,
+			message: error instanceof Error ? error.message : String(error)
+		});
+	};
 	const refs = /* @__PURE__ */ new Set();
 	const indexRoot = join(home, "merge", "staging-index");
 	const names = await io.exists(indexRoot) ? await listOrEmpty(io, indexRoot) : [];
@@ -2338,7 +2348,7 @@ async function cleanupStage(io, home, now, rows, limit = 100) {
 		if (entry.ref !== "") refs.add(entry.ref);
 		const row = rows.get(entry.rowId);
 		if (row === void 0 || row.state === "skipped" || row?.state === "pending" || row?.state === "verify") {
-			await dropStage(io, home, entry.rowId, entry.ref);
+			await dropStage(io, home, entry.rowId, entry.ref, fail);
 			removed.push(entry.rowId);
 			continue;
 		}
@@ -2353,11 +2363,13 @@ async function cleanupStage(io, home, now, rows, limit = 100) {
 						createdAt: typeof entry.createdAt === "number" ? entry.createdAt : now,
 						state: "expired"
 					});
-				} catch {}
+				} catch (error) {
+					fail(join(indexRoot, name), error);
+				}
 				expired.push(entry.rowId);
 				continue;
 			}
-			await dropStage(io, home, entry.rowId, entry.ref);
+			await dropStage(io, home, entry.rowId, entry.ref, fail);
 			removed.push(entry.rowId);
 			continue;
 		}
@@ -2368,14 +2380,15 @@ async function cleanupStage(io, home, now, rows, limit = 100) {
 	for (const run of runNames.slice(0, limit)) {
 		const prefix = run + "/";
 		if ([...refs].some((ref) => ref === run || ref.startsWith(prefix))) continue;
-		await io.remove(join(runRoot, run)).catch(() => {});
+		await io.remove(join(runRoot, run)).catch((error) => fail(join(runRoot, run), error));
 		orphans.push(run);
 	}
 	return {
 		removed,
 		expired,
 		kept,
-		orphans
+		orphans,
+		failures
 	};
 }
 /** Read all production v2 stage entries. */
@@ -2685,7 +2698,8 @@ async function writeCommitReceipt(io, home, receipt) {
 	const path = commitReceiptPath(home, receipt.runId);
 	await io.writeText(path, JSON.stringify(receipt, null, 2) + "\n");
 	const parent = receipt.parentRunId ?? receipt.runId.split("/pairs/")[0] ?? receipt.runId;
-	await io.writeText(durableReceiptPath(home, parent, receipt.runId), JSON.stringify({
+	const leaf = (receipt.runId + "-" + receipt.unitId).replace(/[^A-Za-z0-9._-]+/g, "-");
+	await io.writeText(durableReceiptPath(home, parent, leaf), JSON.stringify({
 		...receipt,
 		parentRunId: parent
 	}, null, 2) + "\n");
@@ -2863,6 +2877,10 @@ const emptyCounts = {
 const queueOf$3 = (state) => state === "approved" || state === "fuse" ? "fuse" : state === "verify" ? "verify" : state === "pending" ? "pending" : "skipped";
 async function readMergeSnapshot(options) {
 	const readAt = (options.now ?? (() => Date.now()))();
+	const hostOnly = options.hostOnly === void 0 ? void 0 : await options.hostOnly().catch((error) => ({
+		code: "E-323",
+		detail: error instanceof Error ? error.message : String(error)
+	}));
 	const readiness = await readV4Readiness(options.io, options.home);
 	if (!readiness.ok) return {
 		wireVersion: 1,
@@ -2870,6 +2888,7 @@ async function readMergeSnapshot(options) {
 		readAt,
 		queueRevision: "blocked",
 		consistency: "eventual",
+		...hostOnly === void 0 ? {} : { hostOnly },
 		blocked: {
 			code: readiness.code,
 			message: readiness.message,
@@ -2908,6 +2927,7 @@ async function readMergeSnapshot(options) {
 	for (const row of ledger?.rows ?? []) {
 		const stage = stages.find((item) => item.rowId === row.id) ?? null;
 		const queue = queueOf$3(row.state);
+		const bSide = live !== void 0 && live.managed(row.b) ? "live" : "archive";
 		const bodies = [{
 			rowId: row.id,
 			name: row.a,
@@ -2915,9 +2935,9 @@ async function readMergeSnapshot(options) {
 		}, {
 			rowId: row.id,
 			name: row.b,
-			side: "archive"
+			side: bSide
 		}];
-		const expiredKind = persistedExpiry(row) ?? pendingExpiry(row, live);
+		const expiredKind = row.state === "skipped" && row.expiredAt !== void 0 ? "skipped-ttl" : persistedExpiry(row) ?? pendingExpiry(row, live);
 		rows.push({
 			row,
 			stage,
@@ -3020,6 +3040,7 @@ async function readMergeSnapshot(options) {
 		readAt,
 		queueRevision,
 		consistency: "eventual",
+		...hostOnly === void 0 ? {} : { hostOnly },
 		rows,
 		stages,
 		runs,
@@ -3345,7 +3366,13 @@ async function reconcileMergeState(options) {
 			if (current === void 0 || current.state !== "approved") continue;
 			const entry = byRow.get(row.id);
 			if (usable.get(row.id) === true) {
-				if (tx.transition(row.id, { type: "staged" }, current.version).ok) {
+				if (tx.transition(row.id, {
+					type: "staged",
+					...entry === void 0 ? {} : {
+						stagingRef: entry.ref,
+						stagingExpiresAt: entry.expiresAt
+					}
+				}, current.version).ok) {
 					actions.push({
 						kind: "approved-fused",
 						rowId: row.id,
@@ -3577,12 +3604,16 @@ function actions(row) {
 		renderAction("reject", context, true, true),
 		renderAction("discard", context, true, true)
 	];
-	if (row.row.state === "approved" || row.row.state === "fuse") return [
-		renderAction("retry-resume", context, true, true),
-		renderAction("discard", context, true, true),
-		renderAction("status", context)
-	];
+	if (row.row.state === "approved" || row.row.state === "fuse") {
+		if (row.row.failure !== void 0 && row.row.failure.retryable === false) return [renderAction("pair", context, true, true), renderAction("discard", context, true, true)];
+		return [
+			renderAction("retry-resume", context, true, true),
+			renderAction("discard", context, true, true),
+			renderAction("status", context)
+		];
+	}
 	if (row.row.state === "skipped") return [renderAction("restore", context, true, true)];
+	if (row.row.state === "verify") return [renderAction("retry-candidates", context)];
 	return [renderAction("pair", context)];
 }
 function verifyState(row) {
@@ -3627,7 +3658,10 @@ function toRowFact$1(row) {
 		b: state.b,
 		...target === void 0 ? {} : { target },
 		...summary === void 0 ? {} : { summary },
-		...state.state === "skipped" ? { reason: state.reason } : {},
+		...state.state === "skipped" ? {
+			reason: state.reason,
+			reasonCode: state.reason
+		} : {},
 		...state.origin === void 0 ? {} : { origin: state.origin },
 		...state.failure === void 0 ? {} : { failure: {
 			stage: state.failure.stage,
@@ -3648,7 +3682,7 @@ function toRowFact$1(row) {
 }
 function runView(run, readAt, includeResultRef = false) {
 	const record = run.record;
-	const state = run.meta?.phase === "undone" ? "undone" : run.meta?.approval === "pending" ? "awaiting-approval" : record.state;
+	const state = run.meta?.phase === "undone" ? "undone" : run.meta?.stopReason === "interrupted" ? "interrupted" : run.meta?.approval === "pending" ? "awaiting-approval" : record.state;
 	const stopReason = run.meta?.stopReason ?? (record.state === "cancelled" ? "cancelled" : record.state === "failed" ? "failed" : record.state === "succeeded" ? "completed" : void 0);
 	return {
 		wireVersion: 1,
@@ -3807,6 +3841,7 @@ function buildDoctorView(snapshot) {
 		...snapshot.runs[0] === void 0 ? {} : { latestRun: runView(snapshot.runs[0], snapshot.readAt) },
 		staging: snapshot.doctor.staging,
 		approval: snapshot.approval,
+		...snapshot.hostOnly === void 0 ? {} : { hostOnly: snapshot.hostOnly },
 		...snapshot.blocked === void 0 ? {} : { blocked: {
 			code: snapshot.blocked.code,
 			message: snapshot.blocked.message
@@ -4124,7 +4159,7 @@ async function mergeDoctor(io, home, configuredRoot) {
 		key: "state",
 		label: "合并状态",
 		status: snapshot.blocked === void 0 || !hasState ? "ok" : "warn",
-		detail: snapshot.blocked === void 0 ? "pairs " + String(snapshot.rows.length) + "；verify " + String(counts.verify) + " / pending " + String(counts.pending) + " / fuse " + String(counts.fuse) + " / skipped " + String(counts.skipped) : snapshot.blocked.code + ": " + snapshot.blocked.message
+		detail: snapshot.blocked === void 0 ? "pairs " + String(snapshot.rows.length) + "；verify " + String(counts.verify) + " / pending " + String(counts.pending) + " / fuse " + String(counts.fuse) + " / skipped " + String(counts.skipped) + " / expired " + String(snapshot.doctor.counts.expired) : snapshot.blocked.code + ": " + snapshot.blocked.message
 	});
 	const recoveryRuns = /* @__PURE__ */ new Set();
 	try {
@@ -4323,7 +4358,7 @@ async function mergeDoctor(io, home, configuredRoot) {
 //#endregion
 //#region lib/types/domain/errors.js
 function redact(text) {
-	return text.replace(/sk-[A-Za-z0-9_-]{16,}/g, "[redacted]").replace(/Bearer\s+\S+/gi, "Bearer [redacted]").replace(/(api[_-]?key\s*[:=]\s*)\S+/gi, "$1[redacted]");
+	return text.replace(/sk-[A-Za-z0-9_-]{16,}/g, "[redacted]").replace(/ghp_[A-Za-z0-9]{20,}/g, "[redacted]").replace(/github_pat_[A-Za-z0-9_]{20,}/g, "[redacted]").replace(/xox[baprs]-[A-Za-z0-9-]{10,}/g, "[redacted]").replace(/AKIA[0-9A-Z]{16}/g, "[redacted]").replace(/Bearer\s+\S+/gi, "Bearer [redacted]").replace(/((?:api[_-]?key|token|password|secret)\s*[:=]\s*)\S+/gi, "$1[redacted]");
 }
 /** Build the typed failure every command/CLI/runtime branch returns. */
 function commandError(stage, code, hint, next, runId) {
@@ -4452,7 +4487,7 @@ async function projectRecoveredUnit(options) {
 			command: "approve",
 			startedAt: at,
 			endedAt: at,
-			stopReason: "completed",
+			stopReason: options.interrupted === true ? "interrupted" : "completed",
 			approval: {
 				platformWrite: false,
 				mergeApproval: true
@@ -4526,17 +4561,21 @@ async function projectRecoveredUnit(options) {
 	await writeRunMeta(options.io, options.home, {
 		version: 1,
 		runId: options.runId,
+		...meta?.pid === void 0 ? {} : { pid: meta.pid },
 		phase: "settled",
+		...options.interrupted === true ? { stopReason: "interrupted" } : {},
 		reportRef: reportPath,
 		pairCount: 1,
 		...meta?.parentRunId === void 0 ? {} : { parentRunId: meta.parentRunId },
+		...meta?.stagingRef === void 0 ? {} : { stagingRef: meta.stagingRef },
+		...meta?.pairs === void 0 ? {} : { pairs: meta.pairs },
 		createdAt: meta?.createdAt ?? new Date(at).toISOString(),
 		updatedAt: new Date(at).toISOString()
 	});
 	await options.onPhase?.("settle");
 	if (options.runs !== void 0) {
 		const outcome = {
-			state: "succeeded",
+			state: options.interrupted === true ? "interrupted" : "succeeded",
 			resultRef: reportPath
 		};
 		if (!(options.runs.settleRecovered === void 0 ? false : await options.runs.settleRecovered(options.runId, outcome))) await options.runs.settle(options.runId, outcome);
@@ -4548,6 +4587,24 @@ async function projectRecoveredUnit(options) {
 	};
 }
 //#endregion
+//#region lib/types/domain/undo-receipt.js
+/** Undo receipt: immutable per-pair settlement, separate from the commit receipt. */
+function undoReceiptPath(home, runId, pairKey) {
+	return join(home, "merge", "undo-receipts", encodeURIComponent(runId), createHash("sha256").update(pairKey).digest("hex") + ".json");
+}
+async function readUndoReceipt(io, home, runId, pairKey) {
+	const raw = await readTextOrNull(io, undoReceiptPath(home, runId, pairKey));
+	if (raw === null) return null;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+async function writeUndoReceipt(io, home, receipt) {
+	await io.writeText(undoReceiptPath(home, receipt.runId, receipt.pairKey), JSON.stringify(receipt, null, 2) + "\n");
+}
+//#endregion
 //#region lib/types/recovery-coordinator.js
 /** Batch 2c unit-journal recovery coordinator. UnitTransaction remains the only skill writer. */
 const branchOf = (phase) => {
@@ -4584,6 +4641,20 @@ async function recoverCommitUnits(options) {
 			continue;
 		}
 		const evidence = await readUnitEvidence(options.io, options.home, journal.unitId);
+		const receipt = (await readCommitReceipts(options.io, options.home)).find((item) => item.unitId === journal.unitId);
+		const undoRunId = receipt?.parentRunId ?? journal.runId;
+		if (receipt?.pairKey !== void 0 && await readUndoReceipt(options.io, options.home, undoRunId, receipt.pairKey) !== null) {
+			reports.push({
+				unitId: journal.unitId,
+				runId: journal.runId,
+				phase: journal.phase,
+				branch: branchOf(journal.phase),
+				action: "none",
+				ok: true,
+				code: "undo-recorded"
+			});
+			continue;
+		}
 		const branch = branchOf(journal.phase);
 		if (journal.phase === "committed" || evidence !== null || journal.phase === "unit-written" || journal.phase === "sources-archived") {
 			const result = await options.unit.finalize(journal.unitId);
@@ -4597,6 +4668,7 @@ async function recoverCommitUnits(options) {
 						unitId: journal.unitId,
 						evidence: result.evidence,
 						now: options.now,
+						...branch === "D" ? { interrupted: true } : {},
 						...options.runs === void 0 ? {} : { runs: options.runs },
 						...options.onProjectionPhase === void 0 ? {} : { onPhase: options.onProjectionPhase }
 					});
@@ -4615,7 +4687,8 @@ async function recoverCommitUnits(options) {
 					action: "blocked",
 					ok: false,
 					code: "projection-failed",
-					message: projection.message
+					message: projection.message,
+					...branch === "D" ? { state: "interrupted" } : {}
 				});
 				else reports.push({
 					unitId: journal.unitId,
@@ -4624,7 +4697,8 @@ async function recoverCommitUnits(options) {
 					branch,
 					action: "finalize",
 					ok: true,
-					evidenceSha256: evidenceSha256(result.evidence)
+					evidenceSha256: evidenceSha256(result.evidence),
+					...branch === "D" ? { state: "interrupted" } : {}
 				});
 				continue;
 			}
@@ -4636,7 +4710,8 @@ async function recoverCommitUnits(options) {
 				action: "finalize",
 				ok: false,
 				code: result.code,
-				message: result.message
+				message: result.message,
+				...branch === "D" ? { state: "interrupted" } : {}
 			});
 			continue;
 		}
@@ -4838,8 +4913,31 @@ function actionRefs(row) {
 		action("reject", true),
 		action("discard", true)
 	];
-	if (row.state === "approved" || row.state === "fuse") return [action("discard", true), action("status")];
+	if (row.state === "approved" || row.state === "fuse") {
+		if (row.failure !== void 0 && row.failure.retryable === false) return [{
+			id: "pair",
+			command: "/evolution merge pair " + row.a + " " + row.b,
+			confirm: true,
+			enabled: true
+		}, action("discard", true)];
+		return [
+			{
+				id: "retry-resume",
+				command: "/evolution merge resume --retry " + row.id,
+				confirm: true,
+				enabled: true
+			},
+			action("discard", true),
+			action("status")
+		];
+	}
 	if (row.state === "skipped") return [action("restore", true)];
+	if (row.state === "verify") return [{
+		id: "retry-candidates",
+		command: "/evolution merge candidates --retry " + row.id,
+		confirm: false,
+		enabled: true
+	}];
 	return [action("pair")];
 }
 function toRowFact(row, actions = actionRefs(row)) {
@@ -4945,6 +5043,11 @@ function makeMergeRoutes(deps, _audit) {
 		code: "merge-state-blocked",
 		readiness
 	});
+	const hostOnly = (snapshot) => snapshot.hostOnly === void 0 ? null : json(503, {
+		wireVersion: 1,
+		code: "E-323",
+		message: snapshot.hostOnly.detail ?? "host data plane unavailable"
+	});
 	const notReady = async (source) => {
 		if (source.readiness === void 0) return null;
 		const readiness = await source.readiness();
@@ -4974,6 +5077,8 @@ function makeMergeRoutes(deps, _audit) {
 						code: "merge-state-blocked",
 						readiness: snapshot.blocked.readiness
 					});
+					const capability = hostOnly(snapshot);
+					if (capability !== null) return capability;
 					return json(200, buildFacts$1(snapshot));
 				}
 				const readiness = await notReady(source);
@@ -5009,6 +5114,8 @@ function makeMergeRoutes(deps, _audit) {
 						code: "merge-state-blocked",
 						readiness: snapshot.blocked.readiness
 					});
+					const capability = hostOnly(snapshot);
+					if (capability !== null) return capability;
 					try {
 						return json(200, buildQueuePage(snapshot, queue, expiredOnly, query.get("cursor") ?? void 0, Number.isFinite(limit) ? limit : 50));
 					} catch (error) {
@@ -5261,8 +5368,26 @@ function parseMergeCommand(argv) {
 		};
 	}
 }
+/** Machine-readable three-verb table: merge undo / skill undo / skill restore. */
+const MERGE_LIFECYCLE_VERBS = [
+	{
+		verb: "merge undo",
+		appliesTo: "一次 merge run（按 run 反序撤销 unit）",
+		excludes: ["skill undo", "skill restore"]
+	},
+	{
+		verb: "skill undo",
+		appliesTo: "单个技能的一次 patch",
+		excludes: ["merge undo"]
+	},
+	{
+		verb: "skill restore",
+		appliesTo: "从 .archive 恢复整棵技能树",
+		excludes: ["merge undo"]
+	}
+];
 function mergeUsage() {
-	return "usage: " + MERGE_COMMAND_DEFS.filter((def) => def.id !== "merge.doctor" && def.usage !== false).map((def) => def.fallback).join(" | ") + "\ndefaults: mergeApproval=false, mergeSkippedTtlDays=0, mergeRunTimeoutMinutes=0, mergePairTimeoutMinutes=15, mergeModelsRoot=\"\"";
+	return "usage: " + MERGE_COMMAND_DEFS.filter((def) => def.id !== "merge.doctor" && def.usage !== false).map((def) => def.fallback).join(" | ") + "\ndefaults: mergeApproval=false, mergeSkippedTtlDays=0, mergeRunTimeoutMinutes=0, mergePairTimeoutMinutes=15, mergeModelsRoot=\"\"\nlifecycle: " + MERGE_LIFECYCLE_VERBS.map((item) => item.verb + "=" + item.appliesTo + "；互斥 " + item.excludes.join("/")).join(" | ");
 }
 //#endregion
 //#region lib/types/presentation-budget.js
@@ -5492,6 +5617,36 @@ function failureOf(stage, error) {
 		retryFrom: stage === "decide" ? "agent1" : "agent2"
 	};
 }
+function pairCriteria(outcome) {
+	if (outcome === "merged") return {
+		decision: "merge",
+		validation: "required",
+		commit: "required",
+		archive: "sources",
+		evidence: "receipt"
+	};
+	if (outcome === "kept") return {
+		decision: "keep",
+		validation: "report-only",
+		commit: "never",
+		archive: "none",
+		evidence: "none"
+	};
+	if (outcome === "pending") return {
+		decision: "merge",
+		validation: "required",
+		commit: "if-approved",
+		archive: "none",
+		evidence: "none"
+	};
+	return {
+		decision: "merge",
+		validation: "required",
+		commit: "never",
+		archive: "none",
+		evidence: "none"
+	};
+}
 function pairOf(row, candidate, outcome, extra = {}) {
 	return {
 		id: row.id,
@@ -5503,6 +5658,7 @@ function pairOf(row, candidate, outcome, extra = {}) {
 		...candidate.gate === void 0 ? {} : { gate: candidate.gate },
 		outcome,
 		archived: [],
+		criteria: pairCriteria(outcome),
 		...extra
 	};
 }
@@ -5699,7 +5855,11 @@ async function runScan(options) {
 			totals.failed += 1;
 			continue;
 		}
-		const mergeDecision = options.cards !== void 0 ? withDecisionRevisions(round1.decision, options.cards, row.a, row.b) : round1.decision;
+		const decided = options.model === void 0 || round1.decision.model !== void 0 ? round1.decision : {
+			...round1.decision,
+			model: options.model
+		};
+		const mergeDecision = options.cards !== void 0 ? withDecisionRevisions(decided, options.cards, row.a, row.b) : decided;
 		if (options.approval) {
 			const event = {
 				type: "verify-passed",
@@ -5764,7 +5924,13 @@ async function runScan(options) {
 		const fused = await pairLedger(options.io, options.home).transact((tx) => {
 			const current = tx.rows().find((item) => item.id === row.id);
 			if (current === void 0) return null;
-			const moved = tx.transition(row.id, { type: "staged" }, current.version);
+			const moved = tx.transition(row.id, {
+				type: "staged",
+				...stageEntry === void 0 ? {} : {
+					stagingRef: stageEntry.ref,
+					stagingExpiresAt: stageEntry.expiresAt
+				}
+			}, current.version);
 			return moved.ok && moved.row !== null ? v4ToLegacy(moved.row) : null;
 		});
 		if (fused === null) {
@@ -5778,20 +5944,15 @@ async function runScan(options) {
 		row = fused;
 		if (stageEntry !== void 0) await presentStage(options.io, options.home, stageEntry);
 		if (isAborted(options.signal)) {
-			const projected = await pairLedger(options.io, options.home).transact((tx) => {
+			await pairLedger(options.io, options.home).transact((tx) => {
 				const current = tx.rows().find((item) => item.id === row.id);
-				if (current === void 0) return null;
-				const moved = tx.transition(row.id, {
-					type: "skipped",
-					reason: "cancelled"
-				}, current.version);
-				return moved.ok && moved.row !== null ? v4ToLegacy(moved.row) : null;
+				return current === void 0 ? false : tx.remove(row.id, "superseded", void 0, current.version).ok;
 			});
-			if (projected !== null) row = projected;
+			await dropStage(options.io, options.home, row.id, row.stagingRef);
 			stopReason = "cancelled";
 			remaining.push(...candidates.slice(index).map((candidate) => ({
 				pairKey: pairKey(candidate.a, candidate.b),
-				queue: "fuse"
+				queue: "verify"
 			})));
 			break;
 		}
@@ -5817,6 +5978,8 @@ async function runScan(options) {
 			pairs.push({
 				...pairOf(row, candidate, "merged", {
 					decision: mergeDecision,
+					...round2.manifestFiles === void 0 ? {} : { manifestFiles: round2.manifestFiles },
+					...round2.validationIssues === void 0 ? {} : { validation: { issues: round2.validationIssues } },
 					...round2.unitId === void 0 ? {} : { unitId: round2.unitId },
 					...round2.target === void 0 ? {} : { target: round2.target },
 					...round2.usage === void 0 ? {} : { usage: round2.usage },
@@ -5829,8 +5992,8 @@ async function runScan(options) {
 			continue;
 		}
 		const failed = round2.failure ?? failureOf("author", "round2 failed");
-		if (failed.code === "merge-over-limit" || failed.code === "limit" || failed.code === "merge-validation") {
-			const reason = failed.code === "merge-validation" ? "validation-failed" : "merge-over-limit";
+		if (failed.code === "merge-over-limit" || failed.code === "limit") {
+			const reason = "merge-over-limit";
 			if (await pairLedger(options.io, options.home).transact((tx) => {
 				const current = tx.rows().find((item) => item.id === row.id);
 				return current === void 0 ? false : tx.transition(row.id, {
@@ -5842,33 +6005,35 @@ async function runScan(options) {
 			})) await dropStage(options.io, options.home, row.id);
 			pairs.push(pairOf(row, candidate, "failed", {
 				decision: mergeDecision,
-				failure: failed
+				failure: failed,
+				...round2.manifestFiles === void 0 ? {} : { manifestFiles: round2.manifestFiles },
+				...round2.criteria === void 0 ? {} : { criteria: round2.criteria },
+				...round2.validationIssues === void 0 ? {} : { validation: { issues: round2.validationIssues } }
 			}));
 			totals.failed += 1;
 			continue;
 		}
 		if (failed.code === "target-changed" || failed.code === "target-taken" || failed.code === "source-changed" || failed.code === "support-changed" || failed.code === "source-gone") {
 			const code = failed.code === "target-changed" ? "target-taken" : failed.code === "support-changed" ? "source-changed" : failed.code;
+			const terminalFailure = {
+				...failed,
+				code,
+				retryable: false,
+				retryFrom: "none"
+			};
 			await pairLedger(options.io, options.home).transact((tx) => {
 				const current = tx.rows().find((item) => item.id === row.id);
 				if (current === void 0) return false;
 				if (code === "source-gone") return tx.remove(row.id, "superseded", void 0, current.version).ok;
 				return tx.transition(row.id, {
-					type: "skipped",
-					reason: code,
-					origin: "system",
-					skipSource: "system"
+					type: "failed",
+					failure: terminalFailure
 				}, current.version).ok;
 			});
 			await dropStage(options.io, options.home, row.id);
 			pairs.push(pairOf(row, candidate, "failed", {
 				decision: mergeDecision,
-				failure: {
-					...failed,
-					code,
-					retryable: false,
-					retryFrom: "none"
-				}
+				failure: terminalFailure
 			}));
 			totals.failed += 1;
 			continue;
@@ -5884,13 +6049,24 @@ async function runScan(options) {
 			return moved.ok && moved.row !== null ? v4ToLegacy(moved.row) : null;
 		});
 		if (projected === null && terminal) {
-			await pairLedger(options.io, options.home).transact((tx) => {
+			if (await pairLedger(options.io, options.home).transact((tx) => {
 				const current = tx.rows().find((item) => item.id === row.id);
 				return current === void 0 ? false : tx.remove(row.id, "superseded", void 0, current.version).ok;
-			});
+			})) {
+				await dropStage(options.io, options.home, row.id, row.stagingRef);
+				await recordPair(options.io, options.home, {
+					pairKey: row.pairKey,
+					runId: row.runId ?? "merge",
+					result: "failed",
+					...row.decision?.target === void 0 ? {} : { target: row.decision.target }
+				});
+			}
 			pairs.push(pairOf(row, candidate, "failed", {
 				decision: mergeDecision,
-				failure: failed
+				failure: failed,
+				...round2.manifestFiles === void 0 ? {} : { manifestFiles: round2.manifestFiles },
+				...round2.criteria === void 0 ? {} : { criteria: round2.criteria },
+				...round2.validationIssues === void 0 ? {} : { validation: { issues: round2.validationIssues } }
 			}));
 			totals.failed += 1;
 			continue;
@@ -5906,7 +6082,10 @@ async function runScan(options) {
 		row = projected;
 		pairs.push(pairOf(row, candidate, "failed", {
 			decision: mergeDecision,
-			failure: failed
+			failure: failed,
+			...round2.manifestFiles === void 0 ? {} : { manifestFiles: round2.manifestFiles },
+			...round2.criteria === void 0 ? {} : { criteria: round2.criteria },
+			...round2.validationIssues === void 0 ? {} : { validation: { issues: round2.validationIssues } }
 		}));
 		totals.failed += 1;
 	}
@@ -5978,6 +6157,8 @@ async function runScan(options) {
 }
 //#endregion
 //#region lib/types/run-shell.js
+/** Bounded wait for a detached body before the run is reported as timed out. */
+const DETACHED_DRAIN_MS = 3e4;
 function emptyDraft(reason) {
 	return {
 		stopReason: "failed",
@@ -6018,8 +6199,14 @@ async function withMergeRun(options) {
 	await writeRunMeta(options.io, options.home, {
 		version: 1,
 		runId: handle.id,
+		pid: process.pid,
 		...options.parentRunId === void 0 ? {} : { parentRunId: options.parentRunId },
 		...options.pairKey === void 0 ? {} : { pairKey: options.pairKey },
+		...options.stagingRef === void 0 ? {} : { stagingRef: options.stagingRef },
+		...options.pairKey === void 0 ? {} : { pairs: [{
+			pairKey: options.pairKey,
+			state: "pending"
+		}] },
 		pairCount: options.pairCount ?? (options.pairKey === void 0 ? 0 : 1),
 		phase: "running",
 		approval: options.approval.mergeApproval ? "pending" : "approved",
@@ -6035,26 +6222,50 @@ async function withMergeRun(options) {
 		handle.signal.addEventListener("abort", onAbort, { once: true });
 		let timer;
 		const timeoutMinutes = options.timeoutMinutes;
-		const timeout = timeoutMinutes === void 0 || timeoutMinutes <= 0 ? void 0 : new Promise((_, reject) => {
-			timer = setTimeout(() => {
-				runController.abort();
-				reject(/* @__PURE__ */ new Error("merge run timed out after " + String(timeoutMinutes) + " minutes"));
-			}, timeoutMinutes * 6e4);
-		});
+		const bodyOutcome = options.body({
+			runId: handle.id,
+			startedAt,
+			signal: runController.signal,
+			stage
+		}).then((value) => ({
+			kind: "draft",
+			value
+		})).catch((error) => ({
+			kind: "error",
+			error
+		}));
+		let outcome;
+		let timedOut = false;
 		try {
-			draft = timeout === void 0 ? await options.body({
-				runId: handle.id,
-				startedAt,
-				signal: runController.signal,
-				stage
-			}) : await Promise.race([options.body({
-				runId: handle.id,
-				startedAt,
-				signal: runController.signal,
-				stage
-			}), timeout]);
-		} catch (error) {
-			draft = emptyDraft("run body failed: " + (error instanceof Error ? error.message : String(error)));
+			if (timeoutMinutes === void 0 || timeoutMinutes <= 0) outcome = await bodyOutcome;
+			else {
+				const timeout = new Promise((resolve) => {
+					timer = setTimeout(() => {
+						runController.abort();
+						resolve({ kind: "timeout" });
+					}, timeoutMinutes * 6e4);
+				});
+				const raced = await Promise.race([bodyOutcome, timeout]);
+				if (raced.kind !== "timeout") outcome = raced;
+				else {
+					timedOut = true;
+					let drainTimer;
+					const drained = await Promise.race([bodyOutcome, new Promise((resolve) => {
+						drainTimer = setTimeout(() => resolve({ kind: "drain-timeout" }), DETACHED_DRAIN_MS);
+					})]);
+					if (drainTimer !== void 0) clearTimeout(drainTimer);
+					outcome = drained.kind === "drain-timeout" ? {
+						kind: "error",
+						error: /* @__PURE__ */ new Error("timeout: body did not stop within 30s drain window")
+					} : drained;
+				}
+			}
+			draft = outcome.kind === "draft" ? outcome.value : emptyDraft("run body failed: " + (outcome.error instanceof Error ? outcome.error.message : String(outcome.error)));
+			if (timedOut) draft = {
+				...draft,
+				stopReason: "timeout",
+				notes: [...draft.notes, "merge run timeout reached; body aborted"]
+			};
 		} finally {
 			if (timer !== void 0) clearTimeout(timer);
 			handle.signal.removeEventListener("abort", onAbort);
@@ -6070,9 +6281,13 @@ async function withMergeRun(options) {
 			approval: options.approval,
 			scope: draft.scope,
 			pairs: draft.pairs,
+			processedPairs: draft.pairs,
 			totals: draft.totals,
 			notes: draft.notes,
-			...draft.remaining === void 0 ? {} : { remaining: draft.remaining },
+			...draft.remaining === void 0 ? {} : {
+				remaining: draft.remaining,
+				remainingPairs: draft.remaining
+			},
 			...draft.reportOnly === void 0 ? {} : { reportOnly: draft.reportOnly },
 			...draft.validationFailures === void 0 ? {} : { validationFailures: draft.validationFailures },
 			...draft.archived === void 0 ? {} : { archived: draft.archived },
@@ -6117,11 +6332,21 @@ async function withMergeRun(options) {
 			...runState === "failed" ? { failure: "merge " + report.stopReason } : {}
 		});
 		const awaiting = options.approval.mergeApproval && (options.command === "scan" || options.command === "pair") && report.stopReason === "completed" && report.totals.pending > 0;
+		const finalPairs = draft.pairs.length > 0 ? draft.pairs.map((pair) => ({
+			pairKey: pair.pairKey,
+			state: pair.outcome === "merged" ? "fused" : pair.outcome === "pending" ? "pending" : "skipped"
+		})) : options.pairKey === void 0 ? [] : [{
+			pairKey: options.pairKey,
+			state: "pending"
+		}];
 		await writeRunMeta(options.io, options.home, {
 			version: 1,
 			runId: handle.id,
+			pid: process.pid,
 			...options.parentRunId === void 0 ? {} : { parentRunId: options.parentRunId },
 			...options.pairKey === void 0 ? {} : { pairKey: options.pairKey },
+			...options.stagingRef === void 0 ? {} : { stagingRef: options.stagingRef },
+			...finalPairs.length === 0 ? {} : { pairs: finalPairs },
 			pairCount: options.pairCount ?? (options.pairKey === void 0 ? 0 : 1),
 			phase: awaiting ? "awaiting-approval" : "settled",
 			approval: awaiting ? "pending" : "approved",
@@ -6184,7 +6409,8 @@ async function runScanCommand(options) {
 				...options.timeoutMinutes === void 0 ? {} : { timeoutMinutes: options.timeoutMinutes },
 				...options.notes === void 0 ? {} : { notes: options.notes },
 				...options.isOwnerActive === void 0 ? {} : { isOwnerActive: options.isOwnerActive },
-				...options.cards === void 0 ? {} : { cards: options.cards }
+				...options.cards === void 0 ? {} : { cards: options.cards },
+				...options.model === void 0 ? {} : { model: options.model }
 			});
 		}
 	});
@@ -6204,6 +6430,11 @@ async function act(io, home, now, id, type) {
 			reason: "not-pending",
 			message: "row is not pending: " + row.state
 		};
+		if (row.expired !== void 0) return {
+			ok: false,
+			reason: "expired",
+			message: "pending row expired (" + row.expired + "): only discard or re-pair"
+		};
 		const event = type === "approve" ? {
 			type: "approved",
 			runId: row.runId ?? "approve:" + id
@@ -6253,6 +6484,11 @@ function casExpiredHook(code) {
 //#endregion
 //#region lib/types/round2-outcome.js
 async function recordRound2Outcome(io, home, now, row, outcome, deferProjection = false) {
+	const reportExtra = {
+		...outcome.manifestFiles === void 0 ? {} : { manifestFiles: outcome.manifestFiles },
+		...outcome.criteria === void 0 ? {} : { criteria: outcome.criteria },
+		...outcome.validationIssues === void 0 ? {} : { validation: { issues: outcome.validationIssues } }
+	};
 	if (outcome.kind === "merged") {
 		const unitRef = {
 			unitId: outcome.unitId ?? "unknown",
@@ -6289,8 +6525,10 @@ async function recordRound2Outcome(io, home, now, row, outcome, deferProjection
 				...row.decision === void 0 ? {} : { decision: row.decision },
 				outcome: "merged",
 				archived: outcome.archived ?? [],
+				...outcome.lengths === void 0 ? {} : { lengths: outcome.lengths },
 				...outcome.unitId === void 0 ? {} : { unitId: outcome.unitId },
-				...outcome.target === void 0 ? {} : { target: outcome.target }
+				...outcome.target === void 0 ? {} : { target: outcome.target },
+				...reportExtra
 			}
 		};
 		await finalize();
@@ -6305,6 +6543,8 @@ async function recordRound2Outcome(io, home, now, row, outcome, deferProjection
 				...row.decision === void 0 ? {} : { decision: row.decision },
 				outcome: "merged",
 				archived: outcome.archived ?? [],
+				...outcome.lengths === void 0 ? {} : { lengths: outcome.lengths },
+				...reportExtra,
 				...outcome.unitId === void 0 ? {} : { unitId: outcome.unitId },
 				...outcome.target === void 0 ? {} : { target: outcome.target },
 				...outcome.validationPlan === void 0 ? {} : { validationPlan: outcome.validationPlan }
@@ -6318,8 +6558,8 @@ async function recordRound2Outcome(io, home, now, row, outcome, deferProjection
 		retryable: true,
 		retryFrom: "agent2"
 	};
-	if (failure.code === "merge-over-limit" || failure.code === "limit" || failure.code === "merge-validation") {
-		const reason = failure.code === "merge-validation" ? "validation-failed" : "merge-over-limit";
+	if (failure.code === "merge-over-limit" || failure.code === "limit") {
+		const reason = "merge-over-limit";
 		if (await pairLedger(io, home).transact((tx) => {
 			const current = tx.rows().find((item) => item.id === row.id);
 			return current === void 0 ? false : tx.transition(row.id, {
@@ -6340,20 +6580,25 @@ async function recordRound2Outcome(io, home, now, row, outcome, deferProjection
 				...row.decision === void 0 ? {} : { decision: row.decision },
 				outcome: "failed",
 				archived: [],
-				failure
+				failure,
+				...reportExtra
 			}
 		};
 	}
 	const cas = casExpiredHook(failure.code);
 	if (cas !== null) {
+		const terminalFailure = {
+			...failure,
+			code: cas.reason,
+			retryable: false,
+			retryFrom: "none"
+		};
 		await pairLedger(io, home).transact((tx) => {
 			const current = tx.rows().find((item) => item.id === row.id);
 			if (current === void 0) return false;
 			return tx.transition(row.id, {
-				type: "skipped",
-				reason: cas.reason,
-				origin: "system",
-				skipSource: "system"
+				type: "failed",
+				failure: terminalFailure
 			}, current.version).ok;
 		});
 		await dropStage(io, home, row.id);
@@ -6368,24 +6613,30 @@ async function recordRound2Outcome(io, home, now, row, outcome, deferProjection
 				...row.decision === void 0 ? {} : { decision: row.decision },
 				outcome: "failed",
 				archived: [],
-				failure: {
-					...failure,
-					code: cas.reason,
-					retryable: false,
-					retryFrom: "none"
-				}
+				failure: terminalFailure,
+				...reportExtra
 			}
 		};
 	}
-	if (failure.code === "commit-failed" || failure.code === "validation-failed") await pairLedger(io, home).transact((tx) => {
-		const current = tx.rows().find((item) => item.id === row.id);
-		return current === void 0 ? false : tx.remove(row.id, "superseded", void 0, current.version).ok;
-	});
+	if (failure.code === "commit-failed" || failure.code === "validation-failed") {
+		if (await pairLedger(io, home).transact((tx) => {
+			const current = tx.rows().find((item) => item.id === row.id);
+			return current === void 0 ? false : tx.remove(row.id, "superseded", void 0, current.version).ok;
+		})) {
+			await dropStage(io, home, row.id, row.stagingRef);
+			await recordPair(io, home, {
+				pairKey: row.pairKey,
+				runId: row.runId ?? "merge",
+				result: "failed",
+				...row.decision?.target === void 0 ? {} : { target: row.decision.target }
+			});
+		}
+	}
 	if (failure.code === "source-gone") {
-		await pairLedger(io, home).transact((tx) => {
+		if (await pairLedger(io, home).transact((tx) => {
 			const current = tx.rows().find((item) => item.id === row.id);
 			return current === void 0 ? false : tx.remove(row.id, "superseded", void 0, current.version).ok;
-		});
+		})) await dropStage(io, home, row.id, row.stagingRef);
 		return {
 			merged: false,
 			pair: {
@@ -6422,7 +6673,8 @@ async function recordRound2Outcome(io, home, now, row, outcome, deferProjection
 				...failure,
 				code: "row-changed",
 				message: "row changed before failure record"
-			}
+			},
+			...reportExtra
 		}
 	};
 	await recordPair(io, home, {
@@ -6442,7 +6694,8 @@ async function recordRound2Outcome(io, home, now, row, outcome, deferProjection
 			...row.decision === void 0 ? {} : { decision: row.decision },
 			outcome: "failed",
 			archived: [],
-			failure
+			failure,
+			...reportExtra
 		}
 	};
 }
@@ -6470,7 +6723,11 @@ async function runApproveCommand(options) {
 		const fused = await pairLedger(options.io, options.home).transact((tx) => {
 			const current = tx.rows().find((item) => item.id === row.id);
 			if (current === void 0) return null;
-			const moved = tx.transition(row.id, { type: "staged" }, current.version);
+			const moved = tx.transition(row.id, {
+				type: "staged",
+				stagingRef: staged.entry.ref,
+				stagingExpiresAt: staged.entry.expiresAt
+			}, current.version);
 			return moved.ok && moved.row !== null ? v4ToLegacy(moved.row) : null;
 		});
 		if (fused === null) return failure("approve", "row-changed", "行在暂存完成前被并发修改：" + row.id, "运行 /evolution merge status " + row.id + " 后重试", row.runId);
@@ -6487,6 +6744,7 @@ async function runApproveCommand(options) {
 			mergeApproval: true
 		},
 		pairKey: row.pairKey,
+		...row.stagingRef === void 0 ? {} : { stagingRef: row.stagingRef },
 		parentRunId,
 		now: options.now,
 		...options.detached === true ? { detached: true } : {},
@@ -6598,7 +6856,11 @@ async function runResumeCommand(options) {
 		const fused = await pairLedger(options.io, options.home).transact((tx) => {
 			const current = tx.rows().find((item) => item.id === selected.id);
 			if (current === void 0) return null;
-			const moved = tx.transition(selected.id, { type: "staged" }, current.version);
+			const moved = tx.transition(selected.id, {
+				type: "staged",
+				stagingRef: staged.entry.ref,
+				stagingExpiresAt: staged.entry.expiresAt
+			}, current.version);
 			return moved.ok && moved.row !== null ? v4ToLegacy(moved.row) : null;
 		});
 		if (fused === null) return failure("resume", "row-changed", "行在暂存完成前被并发修改：" + selected.id, "运行 /evolution merge status " + selected.id + " 后重试", selected.runId);
@@ -6615,6 +6877,7 @@ async function runResumeCommand(options) {
 			mergeApproval: options.approval
 		},
 		pairKey: row.pairKey,
+		...row.stagingRef === void 0 ? {} : { stagingRef: row.stagingRef },
 		parentRunId,
 		now: options.now,
 		...options.detached === true ? { detached: true } : {},
@@ -6710,24 +6973,6 @@ async function writeUndoJournal(io, home, journal) {
 	await transactIo(io, undoJournalPath(home, journal.runId), () => JSON.stringify(journal, null, 2) + "\n");
 }
 //#endregion
-//#region lib/types/domain/undo-receipt.js
-/** Undo receipt: immutable per-pair settlement, separate from the commit receipt. */
-function undoReceiptPath(home, runId, pairKey) {
-	return join(home, "merge", "undo-receipts", encodeURIComponent(runId), createHash("sha256").update(pairKey).digest("hex") + ".json");
-}
-async function readUndoReceipt(io, home, runId, pairKey) {
-	const raw = await readTextOrNull(io, undoReceiptPath(home, runId, pairKey));
-	if (raw === null) return null;
-	try {
-		return JSON.parse(raw);
-	} catch {
-		return null;
-	}
-}
-async function writeUndoReceipt(io, home, receipt) {
-	await io.writeText(undoReceiptPath(home, receipt.runId, receipt.pairKey), JSON.stringify(receipt, null, 2) + "\n");
-}
-//#endregion
 //#region lib/types/undo-operation.js
 function digest$1(value) {
 	return value === null ? null : contentHash(value);
@@ -6749,11 +6994,16 @@ function sortReceipts(receipts) {
 }
 async function preflight(io, home, port, receipt) {
 	const evidence = await readUnitEvidence(io, home, receipt.unitId);
-	if (evidence === null) return {
+	if (evidence === null) return receipt.evidenceSha256 === void 0 ? {
 		ok: false,
 		code: "undo-unavailable-legacy-receipt",
 		message: "commit evidence is missing; undo unavailable for legacy receipt",
 		undone: []
+	} : {
+		ok: false,
+		code: "undo-evidence-expired",
+		message: "commit evidence aged out of the retention window; undo unavailable (fail-closed)",
+		undone: []
 	};
 	const expectedSha = receipt.evidenceSha256 ?? evidenceSha256(evidence);
 	if (evidenceSha256(evidence) !== expectedSha) return {
@@ -6814,8 +7064,9 @@ async function settleRun(io, home, runId, pairKey, allPairs, at) {
 	});
 }
 async function runUndoOperation(options) {
-	const allReceipts = (await readCommitReceipts(options.io, options.home)).filter((receipt) => (receipt.parentRunId ?? receipt.runId) === options.runId);
-	const allPairKeys = allReceipts.map((receipt) => receipt.pairKey ?? receipt.unitId);
+	const runReceipts = (await readCommitReceipts(options.io, options.home)).filter((receipt) => (receipt.parentRunId ?? receipt.runId) === options.runId);
+	const allPairKeys = runReceipts.map((receipt) => receipt.pairKey ?? receipt.unitId);
+	const allReceipts = runReceipts.filter((receipt) => options.target === void 0 || receipt.target === options.target);
 	const receipts = options.pairKey === void 0 ? allReceipts : allReceipts.filter((receipt) => receipt.pairKey === options.pairKey);
 	if (receipts.length === 0) return {
 		ok: false,
@@ -7712,6 +7963,7 @@ async function commitStagedRun(io, home, runId, port, options) {
 	};
 	let result;
 	let evidenceSha256$1;
+	let warning;
 	const transaction = options.unit ?? port.unit ?? legacyUnitAdapter(port, assembled.plan, options, runId);
 	if (transaction === void 0) return {
 		ok: false,
@@ -7747,7 +7999,7 @@ async function commitStagedRun(io, home, runId, port, options) {
 			message: prepared.message,
 			plan: assembled.plan
 		};
-		const committed = await transaction.commit(prepared.prepared);
+		const committed = await transaction.commit(prepared.prepared, options.signal === void 0 ? void 0 : { signal: options.signal });
 		if (!committed.ok) {
 			try {
 				await writeJournal(io, home, {
@@ -7772,11 +8024,7 @@ async function commitStagedRun(io, home, runId, port, options) {
 		const finalize = transaction.finalize;
 		if (finalize !== void 0) {
 			const finalized = await finalize.call(transaction, unitId);
-			if (!finalized.ok) return {
-				ok: false,
-				message: "unit committed but finalize failed: " + finalized.message,
-				plan: assembled.plan
-			};
+			if (!finalized.ok) warning = "commit landed but finalize failed: " + finalized.message;
 		}
 		evidenceSha256$1 = evidenceSha256(committed.evidence);
 		result = {
@@ -7820,7 +8068,7 @@ async function commitStagedRun(io, home, runId, port, options) {
 		runId,
 		...evidenceSha256$1 === void 0 ? {} : { evidenceSha256: evidenceSha256$1 },
 		...options.validationPlan === void 0 ? {} : { validationPlan: options.validationPlan },
-		parentRunId: runId.split("/pairs/")[0] ?? runId,
+		...options.parentRunId === void 0 ? {} : { parentRunId: options.parentRunId },
 		unitId: result.unitId,
 		target: assembled.plan.target,
 		create: !assembled.plan.targetExists,
@@ -7838,14 +8086,15 @@ async function commitStagedRun(io, home, runId, port, options) {
 			ok: true,
 			plan: assembled.plan,
 			result,
-			receipt
+			receipt,
+			...warning === void 0 ? {} : { warning }
 		};
 	} catch (error) {
 		return {
 			ok: true,
 			plan: assembled.plan,
 			result,
-			warning: "commit landed but receipt write failed: " + (error instanceof Error ? error.message : String(error))
+			warning: (warning === void 0 ? "" : warning + "; ") + "commit landed but receipt write failed: " + (error instanceof Error ? error.message : String(error))
 		};
 	}
 }
@@ -7971,7 +8220,8 @@ function buildValidationPlan(input) {
 	const reverseRefs = files.map((file) => file.path).filter((path) => !refs.has(path) && manifest.has(path)).sort();
 	const orphanFiles = [...new Set(input.existingSupport ?? [])].filter((path) => !staged.has(path)).sort();
 	const byPath = /* @__PURE__ */ new Map();
-	for (const file of input.supportSources ?? []) {
+	const supportSources = input.supportSources ?? [];
+	for (const file of supportSources) {
 		const entry = byPath.get(file.path) ?? {
 			contents: /* @__PURE__ */ new Set(),
 			sources: []
@@ -8127,7 +8377,8 @@ async function runAuthoring(options) {
 		message: "target must be a bare skill name: " + options.target
 	};
 	const targetCard = options.cards.find((card) => card.name === options.target);
-	const mode = options.mode ?? (targetCard === void 0 ? "create-umbrella" : "merge-into-existing");
+	const requestedMode = options.mode ?? (targetCard === void 0 ? "create-umbrella" : "merge-into-existing");
+	const mode = requestedMode === "merge-into-existing" && targetCard === void 0 ? "create-umbrella" : requestedMode;
 	const createMode = mode === "create-umbrella";
 	if (!createMode && targetCard !== void 0) {
 		if (targetCard.managed !== true) return {
@@ -8202,7 +8453,8 @@ async function runAuthoring(options) {
 		message: "manifest file missing from staged tree: " + missing
 	};
 	const limitsSnapshot = limitsSnapshotOf(options.limits ?? DEFAULT_SKILL_LIMITS);
-	const supportSources = options.cards.flatMap((card) => (card.files ?? []).map((file) => ({
+	const participants = new Set(options.sources ?? []);
+	const supportSources = options.cards.filter((card) => participants.has(card.name)).flatMap((card) => (card.files ?? []).map((file) => ({
 		path: file.path,
 		content: file.content,
 		source: card.name
@@ -8224,28 +8476,31 @@ async function runAuthoring(options) {
 		existingSupport: (options.cards.find((card) => card.name === options.target)?.files ?? []).map((file) => file.path)
 	});
 	const findings = [...validateStagedTree(tree.value, limitsSnapshot.skillLimits), ...validationPlan.findings];
+	const lengths = {
+		bodyBytes: Buffer.byteLength(tree.value.body, "utf8"),
+		fileBytes: tree.value.files.reduce((sum, file) => sum + Buffer.byteLength(file.content, "utf8"), 0),
+		totalBytes: Buffer.byteLength(tree.value.body, "utf8") + tree.value.files.reduce((sum, file) => sum + Buffer.byteLength(file.content, "utf8"), 0)
+	};
 	if (hasBlockingFinding(findings)) return {
 		ok: false,
 		code: findings.some((finding) => finding.rule === "limit") ? "merge-over-limit" : "merge-validation",
 		message: "staged tree failed the rule gate",
 		findings,
-		lengths: {
-			bodyBytes: Buffer.byteLength(tree.value.body, "utf8"),
-			fileBytes: tree.value.files.reduce((sum, file) => sum + Buffer.byteLength(file.content, "utf8"), 0),
-			totalBytes: Buffer.byteLength(tree.value.body, "utf8") + tree.value.files.reduce((sum, file) => sum + Buffer.byteLength(file.content, "utf8"), 0)
-		}
+		lengths
 	};
 	const commit = await commitStagedRun(options.io, options.home, stageKey, options.commitPort, {
 		origin: "foreground",
 		summary: options.summary,
 		now: options.now,
+		...options.signal === void 0 ? {} : { signal: options.signal },
 		...options.isBlocked === void 0 ? {} : { isBlocked: options.isBlocked },
 		...options.unit === void 0 ? {} : { unit: options.unit },
-		...options.limits === void 0 ? {} : { limits: options.limits },
+		limits: limitsSnapshot.skillLimits,
 		validationPlan: {
 			planVersion: validationPlan.planVersion,
 			stageDigest: validationPlan.stageDigest,
-			revision: validationPlan.revision
+			revision: validationPlan.revision,
+			manifestFiles: validationPlan.manifestFiles
 		},
 		...options.revisions?.targetRevision === void 0 ? {} : { targetRevision: options.revisions.targetRevision },
 		...options.revisions?.sourceRevisions === void 0 ? {} : { sourceRevisions: options.revisions.sourceRevisions },
@@ -8255,7 +8510,8 @@ async function runAuthoring(options) {
 		ok: true,
 		tree: tree.value,
 		validationPlan,
-		commit
+		commit,
+		lengths
 	};
 	return {
 		ok: false,
@@ -8391,6 +8647,7 @@ function createChannelScanPorts(options) {
 					reuseStaging: true,
 					target: decision.target,
 					mode: decision.mode,
+					sources: [row.a, row.b],
 					cards: options.cards,
 					commitPort: options.commitPort,
 					...options.unit === void 0 ? {} : { unit: options.unit },
@@ -8400,6 +8657,7 @@ function createChannelScanPorts(options) {
 					...options.limits === void 0 ? {} : { limits: options.limits },
 					promptVersion: MERGE_PROMPT_VERSION,
 					promptHash: promptHashOf(buildRound2Prompt(row, decision)),
+					signal,
 					revisions: {
 						...decision.targetRevisionRef === void 0 ? {} : { targetRevision: decision.targetRevisionRef },
 						...decision.sourceRevisions === void 0 ? {} : { sourceRevisions: decision.sourceRevisions },
@@ -8430,6 +8688,7 @@ function createChannelScanPorts(options) {
 					...receipt?.unitId === void 0 ? {} : { unitId: receipt.unitId },
 					...receipt?.evidenceSha256 === void 0 ? {} : { evidenceSha256: receipt.evidenceSha256 },
 					...receipt?.validationPlan === void 0 ? {} : { validationPlan: receipt.validationPlan },
+					...authored.lengths === void 0 ? {} : { lengths: authored.lengths },
 					...usage === void 0 ? {} : { usage },
 					archived: receipt?.archived ?? [],
 					target: {
@@ -8632,7 +8891,7 @@ async function runNewChildAuthoring(options, row, decision, signal) {
 			})),
 			manifestFiles,
 			existingSupport: (options.cards.find((card) => card.name === decision.target)?.files ?? []).map((file) => file.path),
-			supportSources: options.cards.flatMap((card) => (card.files ?? []).map((file) => ({
+			supportSources: options.cards.filter((card) => card.name === row.a || card.name === row.b).flatMap((card) => (card.files ?? []).map((file) => ({
 				path: file.path,
 				content: file.content,
 				source: card.name
@@ -8646,6 +8905,12 @@ async function runNewChildAuthoring(options, row, decision, signal) {
 				totalBytes: Buffer.byteLength(tree.value.body, "utf8") + tree.value.files.reduce((sum, file) => sum + Buffer.byteLength(file.content, "utf8"), 0)
 			};
 			const limit = findings.find((finding) => finding.rule === "limit");
+			const plan = {
+				planVersion: validationPlan.planVersion,
+				stageDigest: validationPlan.stageDigest,
+				revision: validationPlan.revision,
+				manifestFiles: validationPlan.manifestFiles
+			};
 			return limit === void 0 ? {
 				kind: "failed",
 				failure: {
@@ -8654,6 +8919,16 @@ async function runNewChildAuthoring(options, row, decision, signal) {
 					message: "staged tree failed the rule gate",
 					retryable: false,
 					retryFrom: "none"
+				},
+				validationPlan: plan,
+				manifestFiles: validationPlan.manifestFiles,
+				validationIssues: findings,
+				criteria: {
+					decision: "merge",
+					validation: "required",
+					commit: "never",
+					archive: "none",
+					evidence: "none"
 				}
 			} : {
 				kind: "failed",
@@ -8664,16 +8939,29 @@ async function runNewChildAuthoring(options, row, decision, signal) {
 					retryable: false,
 					retryFrom: "none",
 					lengths
+				},
+				validationPlan: plan,
+				manifestFiles: validationPlan.manifestFiles,
+				validationIssues: findings,
+				criteria: {
+					decision: "merge",
+					validation: "required",
+					commit: "never",
+					archive: "none",
+					evidence: "none"
 				}
 			};
 		}
+		const parentRunId = typeof options.parentRunId === "function" ? options.parentRunId(options.runId) : options.parentRunId;
 		const commit = await commitStagedRun(options.io, options.home, stageKey, options.commitPort, {
 			origin: "foreground",
 			summary: "merge " + row.a + " + " + row.b,
 			now: options.now,
+			signal,
 			...options.isBlocked === void 0 ? {} : { isBlocked: options.isBlocked },
 			...options.unit === void 0 ? {} : { unit: options.unit },
 			...options.limits === void 0 ? {} : { limits: options.limits },
+			...parentRunId === void 0 ? {} : { parentRunId },
 			validationPlan: {
 				planVersion: validationPlan.planVersion,
 				stageDigest: validationPlan.stageDigest,
@@ -8707,6 +8995,22 @@ async function runNewChildAuthoring(options, row, decision, signal) {
 			...receipt?.unitId === void 0 ? {} : { unitId: receipt.unitId },
 			archived: receipt?.archived ?? [],
 			lengths,
+			validationPlan: {
+				planVersion: validationPlan.planVersion,
+				stageDigest: validationPlan.stageDigest,
+				revision: validationPlan.revision,
+				manifestFiles: validationPlan.manifestFiles
+			},
+			...parentRunId === void 0 ? {} : { parentRunId },
+			manifestFiles: validationPlan.manifestFiles,
+			validationIssues: findings,
+			criteria: {
+				decision: "merge",
+				validation: "required",
+				commit: "required",
+				archive: "sources",
+				evidence: "receipt"
+			},
 			target: {
 				requested: decision.target,
 				actual: commit.plan.target,
@@ -8777,6 +9081,11 @@ function failRun(stage, hint, next, result) {
 		text: formatMergeError(result.error)
 	};
 }
+async function hostOnlyFailure(verb, capabilities) {
+	if (capabilities === void 0) return void 0;
+	const state = await capabilities.hostOnly();
+	return state === void 0 ? void 0 : fail(verb, "e-323", "host data plane unavailable: " + state.code + (state.detail === void 0 ? "" : " (" + state.detail + ")"), "run /evolution merge doctor");
+}
 /**
 * The approved/fuse row that already holds a target. Pair/approve move a row to
 * approved/fuse BEFORE their run starts, so this row IS the in-flight claim a second
@@ -8834,6 +9143,7 @@ function createMergeRuntime(deps) {
 		registry: deps.registry,
 		platformWrite: deps.platformWrite,
 		now: deps.now,
+		...deps.model === void 0 ? {} : { model: deps.model },
 		...deps.isOwnerActive === void 0 ? {} : { isOwnerActive: deps.isOwnerActive },
 		...timeout === void 0 ? {} : { timeoutMinutes: timeout }
 	};
@@ -8853,11 +9163,22 @@ function createMergeRuntime(deps) {
 		if (command.verb === "pair") {
 			const signal = new AbortController().signal;
 			if (command.a === command.b) return fail("pair", "pair-same-source", "merge pair 需要两个不同技能源：" + command.a, "重新指定两个不同的 family-managed 技能");
-			if ([command.a, command.b].some((name) => name.includes("/") || name.includes(":"))) return fail("pair", "target-invalid", "技能名不能包含 provider/name 或 provider:name 语法：" + command.a + " / " + command.b, "使用裸技能名重新 pair");
+			if ([command.a, command.b].some((name) => name.includes("/") || name.includes(":"))) return {
+				ok: false,
+				text: "merge: 技能名不能包含 provider/name 或 provider:name 语法：" + command.a + " / " + command.b + " (provider-conflict)\nusage: /evolution merge pair <a> <b>"
+			};
 			if (agentless) return fail("pair", "e-305", errorText("e-305-this-invocation-carries-no", { a1: "pair" }), "在 GUI 或 CLI 的会话里运行 /evolution merge pair " + command.a + " " + command.b);
+			const pairHost = await hostOnlyFailure("pair", deps.hostCapabilities);
+			if (pairHost !== void 0) return pairHost;
 			const pairKeyValue = pairKey(command.a, command.b);
 			const inFlight = inFlightPairRun(await readRunMetas(deps.io, deps.home), pairKeyValue);
-			if (inFlight !== void 0 && (deps.isOwnerActive === void 0 || await deps.isOwnerActive(inFlight.runId) === true)) return fail("pair", "merge-pair-in-flight", "同一 pair 已在运行 " + inFlight.runId, "等待该 run 结束，或运行 /evolution merge status " + inFlight.runId, inFlight.runId);
+			let ownerActive = false;
+			if (inFlight !== void 0) if (deps.isOwnerActive !== void 0) ownerActive = await deps.isOwnerActive(inFlight.runId);
+			else ownerActive = inFlight.pid === void 0 ? true : isProcessAlive(inFlight.pid);
+			if (inFlight !== void 0 && ownerActive) return {
+				ok: true,
+				text: "merge pair 已在运行：" + inFlight.runId + "；作用域：family-managed 技能对，1 对，无 per-run 上限"
+			};
 			const cards = await deps.cards(signal);
 			const cardA = cards.find((card) => card.name === command.a);
 			const cardB = cards.find((card) => card.name === command.b);
@@ -8869,12 +9190,14 @@ function createMergeRuntime(deps) {
 				b: command.b
 			}];
 			const existing = (await loadMergeState(deps.io, deps.home)).state.rows.find((row) => row.pairKey === pairKey(command.a, command.b));
-			if (existing?.state === "skipped") {
-				if (!await removeRuntimeRow(deps.io, deps.home, existing.id, "superseded")) return fail("pair", "row-changed", "清理 skipped 行时发现并发修改：" + existing.id, "运行 /evolution merge status 后重试");
+			let cleared = false;
+			if (existing?.state === "skipped" || existing?.state === "fuse" && existing.failure?.retryable === false) {
+				if (!await removeRuntimeRow(deps.io, deps.home, existing.id, "superseded")) return fail("pair", "row-changed", "清理可替换行时发现并发修改：" + existing.id, "运行 /evolution merge status 后重试");
+				cleared = true;
 			}
 			if (existing?.state === "verify" && existing.runId !== void 0 && await deps.isOwnerActive?.(existing.runId) === true) return fail("pair", "merge-pair-in-flight", "同一 pair 已在运行 " + existing.runId, "等待该 run 结束，或运行 /evolution merge status " + existing.runId, existing.runId);
 			if (existing?.state === "pending") return fail("pair", "pair-pending", "该 pair 已在待批准队列：" + existing.id, "先运行 /evolution merge approve/reject/discard " + existing.id, existing.runId);
-			if (existing?.state === "approved" || existing?.state === "fuse") return fail("pair", "pair-fuse", "该 pair 已在待合并队列，可复用决策重跑", "运行 /evolution merge resume --retry " + (existing.runId ?? existing.id), existing.runId);
+			if (!cleared && (existing?.state === "approved" || existing?.state === "fuse")) return fail("pair", "pair-fuse", "该 pair 已在待合并队列，可复用决策重跑", "运行 /evolution merge resume --retry " + (existing.runId ?? existing.id), existing.runId);
 			const forced = command.force === true ? forcedDecisionFor(command.a, command.b) : void 0;
 			const approval = deps.params.mergeApproval;
 			const result = await runScanCommand({
@@ -8914,7 +9237,7 @@ function createMergeRuntime(deps) {
 			if (!result.ok) return failRun("pair", result.message, "修复后重新发起 pair；run 报告见 /evolution merge report", result);
 			if ("accepted" in result) return {
 				ok: true,
-				text: "merge pair 已启动：" + result.runId
+				text: "merge pair 已启动：" + result.runId + "；作用域：family-managed 技能对，1 对，无 per-run 上限"
 			};
 			if (!("report" in result)) return fail("pair", "report-missing", "merge pair 已结束但没有写报告", "重新运行 pair，或运行 /evolution merge runs 查看运行");
 			return {
@@ -8924,6 +9247,8 @@ function createMergeRuntime(deps) {
 		}
 		if (command.verb === "scan") {
 			if (agentless) return fail("scan", "e-305", errorText("e-305-this-invocation-carries-no", { a1: "scan" }), "在 GUI 或 CLI 的会话里运行 /evolution merge scan");
+			const scanHost = await hostOnlyFailure("scan", deps.hostCapabilities);
+			if (scanHost !== void 0) return scanHost;
 			const signal = new AbortController().signal;
 			const cards = await deps.cards(signal);
 			const blocked = /* @__PURE__ */ new Set();
@@ -8980,7 +9305,7 @@ function createMergeRuntime(deps) {
 			if (!result.ok) return failRun("scan", result.message, "修复后重新 scan；run 报告见 /evolution merge report", result);
 			if ("accepted" in result) return {
 				ok: true,
-				text: "merge scan 已启动：" + result.runId
+				text: "merge scan 已启动：" + result.runId + "；作用域：family-managed 技能库，候选来源 engine screening，无 per-run 上限"
 			};
 			if (!("report" in result)) return fail("scan", "report-missing", "merge scan 已结束但没有写报告", "重新运行 scan，或运行 /evolution merge runs 查看运行");
 			return {
@@ -9031,7 +9356,7 @@ function createMergeRuntime(deps) {
 			if (!result.ok) return failRun("candidates", result.message, "修复后重试 candidates --retry", result);
 			if ("accepted" in result) return {
 				ok: true,
-				text: "candidates --retry 已启动：" + result.runId
+				text: "candidates --retry 已启动：" + result.runId + "；作用域：单条 verify 行重跑，无 per-run 上限"
 			};
 			if (!("report" in result)) return fail("candidates", "report-missing", "candidates --retry 已结束但没有写报告", "运行 /evolution merge runs 查看运行");
 			return {
@@ -9131,10 +9456,9 @@ function createMergeRuntime(deps) {
 			};
 		}
 		if (command.verb === "undo") {
-			const receipt = await readCommitReceipt(deps.io, deps.home, command.run, command.target);
-			if (receipt === null) return fail("undo", "receipt-not-found", "该 run 没有提交回执：" + command.run, "只有已提交的 run 可 undo；运行 /evolution merge runs 查看");
-			if (receipt.target !== command.target) return fail("undo", "receipt-target-mismatch", "回执目标是 " + receipt.target + "，不是 " + command.target, "按回执目标重新运行 undo");
-			const undoRunId = receipt.parentRunId ?? receipt.runId;
+			const receipts = (await readCommitReceipts(deps.io, deps.home)).filter((receipt) => (receipt.parentRunId ?? receipt.runId) === command.run && receipt.target === command.target);
+			if (receipts.length === 0) return fail("undo", "receipt-not-found", "该 run 没有目标回执：" + command.run + " / " + command.target, "只有已提交的 run 可 undo；运行 /evolution merge runs 查看");
+			const undoRunId = receipts[0].parentRunId ?? receipts[0].runId;
 			if (deps.registry.runs("merge").some((run) => run.id === undoRunId && run.supersededAt !== void 0)) return fail("undo", "run-superseded", "该 run 已因技能树 restore 失效，不能再 undo：" + undoRunId, "运行 /evolution merge runs 查看失效标记");
 			const unit = unitFor(deps);
 			const result = await runUndoOperation({
@@ -9143,7 +9467,7 @@ function createMergeRuntime(deps) {
 				runId: undoRunId,
 				port: skillLibraryUndoPort(deps.skills),
 				now: deps.now,
-				...receipt.pairKey === void 0 ? {} : { pairKey: receipt.pairKey },
+				target: command.target,
 				...unit === void 0 ? {} : { finalizeUnit: (id) => unit.finalize.call(unit, id) }
 			});
 			return result.ok ? {
@@ -9241,6 +9565,7 @@ function createMergeRuntime(deps) {
 					cards,
 					channel: deps.channel,
 					parent,
+					parentRunId: (runId) => runId,
 					allow: deps.allow,
 					...deps.cwd === void 0 ? {} : { cwd: deps.cwd },
 					timeoutMs: deps.params.mergePairTimeoutMinutes * 6e4,
@@ -9255,7 +9580,7 @@ function createMergeRuntime(deps) {
 			if (!result.ok) return failRun("resume", result.message, "修复后重新 resume；run 报告见 /evolution merge report", result);
 			if ("accepted" in result) return {
 				ok: true,
-				text: "merge resume 已启动：" + result.runId
+				text: "merge resume 已启动：" + result.runId + "；作用域：单条待合并行重跑 agent2，无 per-run 上限"
 			};
 			if (!("report" in result)) return fail("resume", "report-missing", "merge resume 已结束但没有写报告", "重新运行 resume，或运行 /evolution merge runs 查看运行");
 			return {
@@ -9381,6 +9706,7 @@ function createMergeRuntime(deps) {
 						cards,
 						channel: deps.channel,
 						parent,
+						parentRunId: (runId) => runId,
 						allow: deps.allow,
 						...deps.cwd === void 0 ? {} : { cwd: deps.cwd },
 						timeoutMs: deps.params.mergePairTimeoutMinutes * 6e4,
@@ -9396,7 +9722,7 @@ function createMergeRuntime(deps) {
 			if (!result.ok) return failRun("approve", result.message, "修复后重新 approve；run 报告见 /evolution merge report", result);
 			if ("accepted" in result) return {
 				ok: true,
-				text: "merge approve 已启动：" + result.runId
+				text: "merge approve 已启动：" + result.runId + "；作用域：单条 pending 行批准后重跑 agent2，无 per-run 上限"
 			};
 			if (!("report" in result)) return fail("approve", "report-missing", "merge approve 已结束但没有写报告", "重新运行 approve，或运行 /evolution merge runs 查看运行");
 			return {
@@ -9440,6 +9766,31 @@ function createMergeRuntime(deps) {
 	} };
 }
 //#endregion
+//#region lib/types/host-capabilities.js
+/**
+* The host's data-plane capability as ONE value shared by snapshot, doctor, HTTP and run preflight.
+* The probe is injected so the Cordis wiring stays in index.ts; a rejected probe is the same E-323
+* answer as an unavailable one, never an unhandled promise.
+* @module @lmzhen/dsh-evolution-merge
+*/
+/**
+* Wrap one probe with the shared error normalization.
+* @param probe - the platform-specific availability check.
+* @returns the capability value consumed by snapshot and runtime.
+*/
+function createHostCapabilities(probe) {
+	return { hostOnly: async () => {
+		try {
+			return await probe();
+		} catch (error) {
+			return {
+				code: "E-323",
+				detail: error instanceof Error ? error.message : String(error)
+			};
+		}
+	} };
+}
+//#endregion
 //#region lib/types/params.js
 /**
 * Merge parameter resolution. E2/E3 values arrive as one JSON object; this is the only
@@ -10185,6 +10536,7 @@ function apply(ctx, rawConfig = {}) {
 				if (v4.ok) {
 					const cleanup = await cleanupStage(io, home, Date.now(), new Map(v4.state.rows.map((row) => [row.id, { state: row.state }])));
 					if (cleanup.expired.length > 0 || cleanup.removed.length > 0) ctx.logger.info("merge stage cleanup: " + String(cleanup.expired.length) + " expired, " + String(cleanup.removed.length) + " removed, " + String(cleanup.orphans.length) + " orphan(s)");
+					if (cleanup.failures.length > 0) ctx.logger.warn("merge stage cleanup failed for " + String(cleanup.failures.length) + " path(s): " + cleanup.failures.map((item) => item.path + "=" + item.message).join("; "));
 					const library = v4.state.rows.some((row) => row.state === "pending") ? await cards().catch(() => []) : [];
 					const live = library.length === 0 ? void 0 : liveRowFactsOf(library);
 					const reconciled = await reconcileMergeState({
@@ -10215,7 +10567,18 @@ function apply(ctx, rawConfig = {}) {
 		}).catch((error) => {
 			ctx.logger.warn("merge state readiness failed: " + (error instanceof Error ? error.message : String(error)));
 		});
-		const channel = subagentChannelAdapter(createSubagentChannel(ctx));
+		const platformChannel = createSubagentChannel(ctx);
+		const channel = subagentChannelAdapter(platformChannel);
+		const hostCapabilities = createHostCapabilities(async () => {
+			const state = await platformChannel.prepare({
+				kind: "reviewer",
+				allow: ["skill"]
+			});
+			return state.kind === "unavailable" ? {
+				code: "E-323",
+				detail: state.reason
+			} : void 0;
+		});
 		const stage = new StageToolRegistry();
 		const engineInput = resolveEngineInput({ modelsRoot: params.mergeModelsRoot });
 		const engineConfig = engineConfigFromRoot(engineInput.modelsRoot);
@@ -10279,6 +10642,7 @@ function apply(ctx, rawConfig = {}) {
 					runs: runs.runs("merge"),
 					approval: params.mergeApproval,
 					platformWrite,
+					hostOnly: hostCapabilities.hostOnly,
 					live: async () => liveRowFactsOf(await readSkillCards(skills)),
 					history: async () => {
 						const items = /* @__PURE__ */ new Map();
@@ -10367,10 +10731,12 @@ function apply(ctx, rawConfig = {}) {
 			now: () => Date.now(),
 			params,
 			platformWrite,
+			...defaultModel === void 0 ? {} : { model: defaultModel.currentSelection().model },
 			channel,
 			parent: void 0,
 			allow: ["merge_stage"],
 			timeoutMinutes: params.mergeRunTimeoutMinutes,
+			hostCapabilities,
 			isBlocked: async (name) => {
 				return await ctx.get("evolutionCurator")?.isBlocked?.(name) === true;
 			},
@@ -10415,4 +10781,4 @@ function apply(ctx, rawConfig = {}) {
 	});
 }
 //#endregion
-export { Config, MERGE_DOCTOR_SCHEMA_VERSION, MERGE_MAX_ATTEMPTS, MERGE_PAIR_STATES, MERGE_PARAM_DEFAULTS, MERGE_PROMPT_VERSION, MERGE_QUEUES, MERGE_ROUTES, MERGE_STAGE_TOOL_NAME, MERGE_STATE_VERSION, STAGING_SCHEMA_VERSION, STANDBY_PROMPT, StageToolRegistry, apply, applyStageTool, approvePending, assembleStagedCommit, buildCommitPlan, buildRound1Prompt, buildRound2Prompt, buildStandbyPrompt, canRetry, cleanupExpiredStaging, commitReceiptPath, commitStagedRun, committedPairs, configureMergePresentation, copyStagedFile, countRows, createChannelScanPorts, createEngineRunner, createEngineScreening, createMergeCommand, createMergeRuntime, createMergeStageTool, createNewChildRound2, createReadOnlyMergeService, createStageForCards, createStaging, dropRow, dropRowV3, dropStaging, durableReceiptDir, durableReceiptPath, emptyMergeState, engineConfigFromRoot, ensureStaging, formatFacts, formatQueue, formatRunDetail, formatRunsView, formatSnapshotQueue, formatSnapshotStatus, formatStatus, handleReadOnlyMergeCommand, hasBlockingFinding, inject, isSkippedPair, listStagedFiles, liveRowFactsOf, loadMergeState, loadStateSchema, makeMergeRoutes, manifestFilesOf, mergeCommandHelp, mergeDoctor, mergeDoctorAvailability, mergeDoctorFact, mergeReportDigestPath, mergeReportPath, mergeRunIdsToSupersede, mergeStatePath, mergeUsage, missingManifestFile, moveRow, mutateMergeState, pairKey, parseAuthoringManifest, parseDecision, parseMergeCommand, pendingExpiry, persistedExpiry, promptHashOf, queueOf, readCommitReceipt, readCommitReceipts, readMergeReport, readStagedFile, readStagedTree, readStaging, recordRound2Outcome, rejectPending, resolveMergeParams, resolveTargetName, retryMergeReport, rewriteFrontmatterName, rowIdOf, rowsOf, runApproveCommand, runAuthoring, runMergeCommand, runNewChildAuthoring, runPairCommand, runResumeCommand, runRound1OverChannel, runScan, runScanCommand, setStagingTarget, skillLibraryPort, skillLibraryUndoPort, skippedPairKeys, snapshotCards, sourceBlock, stageKeyOf, stageOf, stagingRoot, subagentChannelAdapter, supersedeMergeRuns, transactRows, transitionLegacyForProjection, undoMergeReceipt, unitFor, upsertRow, validateStagedTree, withMergeRun, writeCommitReceipt, writeMergeReport, writeStagedFile };
+export { Config, MERGE_DOCTOR_SCHEMA_VERSION, MERGE_LIFECYCLE_VERBS, MERGE_MAX_ATTEMPTS, MERGE_PAIR_STATES, MERGE_PARAM_DEFAULTS, MERGE_PROMPT_VERSION, MERGE_QUEUES, MERGE_ROUTES, MERGE_STAGE_TOOL_NAME, MERGE_STATE_VERSION, STAGING_SCHEMA_VERSION, STANDBY_PROMPT, StageToolRegistry, apply, applyStageTool, approvePending, assembleStagedCommit, buildCommitPlan, buildRound1Prompt, buildRound2Prompt, buildStandbyPrompt, canRetry, cleanupExpiredStaging, commitReceiptPath, commitStagedRun, committedPairs, configureMergePresentation, copyStagedFile, countRows, createChannelScanPorts, createEngineRunner, createEngineScreening, createMergeCommand, createMergeRuntime, createMergeStageTool, createNewChildRound2, createReadOnlyMergeService, createStageForCards, createStaging, dropRow, dropRowV3, dropStaging, durableReceiptDir, durableReceiptPath, emptyMergeState, engineConfigFromRoot, ensureStaging, forcedDecisionFor, formatFacts, formatQueue, formatRunDetail, formatRunsView, formatSnapshotQueue, formatSnapshotStatus, formatStatus, handleReadOnlyMergeCommand, hasBlockingFinding, inject, isSkippedPair, listStagedFiles, liveRowFactsOf, loadMergeState, loadStateSchema, makeMergeRoutes, manifestFilesOf, mergeCommandHelp, mergeDoctor, mergeDoctorAvailability, mergeDoctorFact, mergeReportDigestPath, mergeReportPath, mergeRunIdsToSupersede, mergeStatePath, mergeUsage, missingManifestFile, moveRow, mutateMergeState, pairKey, parseAuthoringManifest, parseDecision, parseMergeCommand, pendingExpiry, persistedExpiry, promptHashOf, queueOf, readCommitReceipt, readCommitReceipts, readMergeReport, readStagedFile, readStagedTree, readStaging, recordRound2Outcome, rejectPending, resolveMergeParams, resolveTargetName, retryMergeReport, rewriteFrontmatterName, rowIdOf, rowsOf, runApproveCommand, runAuthoring, runMergeCommand, runNewChildAuthoring, runPairCommand, runResumeCommand, runRound1OverChannel, runScan, runScanCommand, setStagingTarget, skillLibraryPort, skillLibraryUndoPort, skippedPairKeys, snapshotCards, sourceBlock, stageKeyOf, stageOf, stagingRoot, subagentChannelAdapter, supersedeMergeRuns, transactRows, transitionLegacyForProjection, undoMergeReceipt, unitFor, upsertRow, validateStagedTree, withMergeRun, writeCommitReceipt, writeMergeReport, writeStagedFile };