@lmzhen/dsh-evolution-review 0.26.15 → 0.27.0

package/README.md

@@ -15,6 +15,7 @@ own, and the delivery mode lives on the `evolution-policy` row, not here.
 
 - **The autonomous write leg does not pass `tools.guard`.** `executePlan` calls the service seam directly (`memory.applyBatch`, `library.*`), so the guard `evolution-threat` installs on the TOOL channel never sees these writes (`grep "tools.execute(" src` = 0 by design). The scan still happens one layer down: `MemoryStore` and `SkillLibrary` refuse threat-shaped payloads at the write point through core's own pattern table, which is the same table the guard consumes. A deployment that wants the tool channel's guard wording on a plan write should route it through a tool — nothing in the plan path claims that coverage.
 - The review's model/context routing below applies to `reviewMode: 'subagent'` (opt-in since 0.3.74); in the default `'inject'` mode the review runs on the parent agent's model inside the parent thread.
+- Review subagents run under a **restricted preset** (a read-only child preset): the tool surface is the caller's `reviewToolAllow` (schema default `[skill]`), and the child scope is the only place the allow-list is applied. A review run never inherits write authority from the parent session.
 - Review subagents are spawned with the plain `skill` tool only (`reviewToolAllow` default and the host/preset config both = `[skill]`: the DSH tool catalog has no `skill_search`/`skill_load` discovery pair, so the Hermes-lineage Anchored Standard `skill_search`/`skill_load` allow-list does not exist here).
 - Review subagents run as `spawn` children on the deployment default preset rather than inheriting the parent agent's composition (`fork`): a fork child is always promoted by the Anchored Standard bootstrap and its narrowed resident catalog would drop the plain `skill` tool from the review allow-list.
 - The review request text is redacted for credential-shaped patterns before it reaches the subagent, but redaction is pattern-based and best-effort, not a security boundary.

package/lib/index.js

@@ -1,8 +1,8 @@
+import { COMPLETION_SKILL_REVIEW_PROMPT, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MEMORY_REVIEW_MODEL, DEFAULT_REVIEW_CONTEXT_MESSAGES, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_MESSAGE_CHARS, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_REVIEW_TIMEOUT_MS, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_MODEL, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_USER_CHAR_LIMIT, MAX_TIMER_DELAY_MS, PROMPT_BUNDLE, advanceReview, assertSkillsRootAliasRetired, authorityFrom, clampOnce, classifySessionEvent, clearReviewChannel, contentHash, createSubagentChannel, evolutionIoAdapter, filterUnreadSkillOps, filterUnreadSkillOps as filterUnreadSkillOps$1, foldUntrustedLines, isPresent, isUnknown, liveBool, markReviewChannel, newSkillLibrary, paramRowId, payloadText, pickWithPolicy, policyStageLimits, readDispatchSignal, redactSecrets, resolveOrigins, resolveRootConfig, reviewPrompt, sessionAudited, sessionEvidenceIndex, sessionReadNames, sessionTurnSignals, sweepReviewChannelSessions, unwrapLive, userSetKeys, verifyPromptBundle } from "@lmzhen/dsh-evolution-core";
 import { createHash, randomUUID } from "node:crypto";
 import z from "@deepseek-ai/schemastery";
 import { createUserMessage } from "@deepseek-ai/dsh-llm";
 import { SessionId } from "@deepseek-ai/dsh-session";
-import { COMPLETION_SKILL_REVIEW_PROMPT, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MEMORY_REVIEW_MODEL, DEFAULT_REVIEW_CONTEXT_MESSAGES, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_MESSAGE_CHARS, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_REVIEW_TIMEOUT_MS, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_MODEL, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_USER_CHAR_LIMIT, MAX_TIMER_DELAY_MS, PROMPT_BUNDLE, advanceReview, assertSkillsRootAliasRetired, clampOnce, clearReviewChannel, contentHash, evolutionIoAdapter, filterUnreadSkillOps, filterUnreadSkillOps as filterUnreadSkillOps$1, foldUntrustedLines, liveBool, markReviewChannel, newSkillLibrary, paramRowId, payloadText, pickWithPolicy, policyStageLimits, readDispatchSignal, redactSecrets, resolveOrigins, resolveRootConfig, reviewPrompt, sessionAudited, sessionEvidenceIndex, sessionReadNames, sessionTurnSignals, sweepReviewChannelSessions, unwrapLive, userSetKeys, verifyPromptBundle } from "@lmzhen/dsh-evolution-core";
 import { validateEvolutionPlan } from "@lmzhen/dsh-evolution-plan-validator";
 /**
 * Whether a message is a notice this plugin delivered, judged only by durable source fields.
@@ -140,9 +140,7 @@ function emitReviewScheduled(ctx, event) {
 * 2026-09-16) and caps the sum at the timer ceiling (PLAN-R2 P2-1). The
 * `run.dispose` arm point counts this margin ALONE — its clock starts after
 * the result settled, not at the review timeout (PLAN-R2 P2-2, 2026-09-16). */
-const REVIEW_SETTLE_MARGIN_MS = 5e3;
 /** Error name marking the S2-6 watchdog expiry (see the catch in trySubagentReview). */
-const REVIEW_SETTLE_TIMEOUT = "ReviewSettleTimeout";
 const name = "evolution-review";
 const inject = ["agents"];
 const Config = z.object({
@@ -249,6 +247,7 @@ function apply(ctx, rawConfig = {}) {
 	});
 	if (!verifyPromptBundle(PROMPT_BUNDLE)) throw new Error("dsh-evolution prompt bundle integrity check failed; refusing to schedule review work");
 	const config = clampReviewConfig(rawConfig, ctx);
+	const reviewChannel = createSubagentChannel(ctx);
 	assertSkillsRootAliasRetired(rawConfig);
 	const rootConfig = resolveRootConfig(rawConfig);
 	const sessionState = new SessionScopedState();
@@ -263,6 +262,8 @@ function apply(ctx, rawConfig = {}) {
 	const pendingReviewNotices = sessionState.add("pendingReviewNotices", /* @__PURE__ */ new Map());
 	const cadenceResetWarned = sessionState.add("cadenceResetWarned", /* @__PURE__ */ new Set());
 	let reviewInFlight = false;
+	/** W5 G3-S3: capability-missing is warned once per plugin instance (the error signal is per trigger). */
+	let channelUnavailableWarned = false;
 	const policy = () => ctx.get("evolutionPolicy")?.get();
 	/**
 	* This row's knobs as they stand right now (G1 §8.3): the live fields are resolved
@@ -334,6 +335,7 @@ function apply(ctx, rawConfig = {}) {
 	}
 	ctx.on("session/event", (session, event) => {
 		if (!sessionAudited(ctx, session.id, config.sessionScoped)) return;
+		if (classifySessionEvent(event) === "plugin-record") return;
 		appendDispatchFrame(dispatchDigest, session.id, event);
 		if (event.type === "user/message") {
 			if ((event.data?.source)?.kind === "user") clearReviewChannel(session.id);
@@ -666,31 +668,6 @@ function apply(ctx, rawConfig = {}) {
 			return false;
 		}
 	};
-	let settleBudgetCapWarned = false;
-	const resultSettleBudgetMs = () => {
-		const budget = config.reviewTimeoutMs + Math.min(REVIEW_SETTLE_MARGIN_MS, config.reviewTimeoutMs);
-		if (budget <= MAX_TIMER_DELAY_MS) return budget;
-		if (!settleBudgetCapWarned) {
-			settleBudgetCapWarned = true;
-			ctx.logger.warn(`dsh-evolution-review: reviewTimeoutMs ${config.reviewTimeoutMs}ms plus the settle margin exceeds the 32-bit timer delay ceiling (${MAX_TIMER_DELAY_MS}ms) — the settle watchdog arms at the ceiling`);
-		}
-		return MAX_TIMER_DELAY_MS;
-	};
-	const disposeSettleBudgetMs = () => Math.min(REVIEW_SETTLE_MARGIN_MS, config.reviewTimeoutMs);
-	const withSettleWatchdog = (promise, label, budgetMs, overdue) => new Promise((resolve, reject) => {
-		const timer = setTimeout(() => {
-			const error = /* @__PURE__ */ new Error(`dsh-evolution-review: ${label} ${overdue(budgetMs)} — abandoning the handle`);
-			error.name = REVIEW_SETTLE_TIMEOUT;
-			reject(error);
-		}, budgetMs);
-		promise.then((value) => {
-			clearTimeout(timer);
-			resolve(value);
-		}, (error) => {
-			clearTimeout(timer);
-			reject(error instanceof Error ? error : new Error(String(error)));
-		});
-	});
 	/**
 	* T3-09/A37: the ONE abort channel for this fiber's long work.
 	*
@@ -731,6 +708,7 @@ function apply(ctx, rawConfig = {}) {
 		const io = ctx.get("evolutionIo");
 		if (!io) return hashes;
 		const library = newSkillLibrary({
+			authority: authorityFrom({ origin: "foreground" }),
 			config: rootConfig,
 			io: evolutionIoAdapter(() => io.provider())
 		});
@@ -742,8 +720,19 @@ function apply(ctx, rawConfig = {}) {
 	}
 	async function trySubagentReview(session, agent, kind, signal) {
 		if (params().reviewMode === "inject") return false;
-		const subagents = ctx.get("subagents");
-		if (!subagents) return false;
+		const channelState = reviewChannel.state;
+		if (channelState.kind !== "available") {
+			if (!channelUnavailableWarned) {
+				channelUnavailableWarned = true;
+				ctx.logger.warn("dsh-evolution-review: subagent channel unavailable (" + channelState.code + ": " + channelState.reason + ") — reviews fall back to the inject path until the capability returns");
+			}
+			try {
+				ctx.emit("evolution/review-error", { sessionId: session.id });
+			} catch (emitError) {
+				ctx.logger.warn("dsh-evolution-review: review-error emit failed: " + (emitError instanceof Error ? emitError.message : String(emitError)));
+			}
+			return false;
+		}
 		if (reviewInFlight) {
 			const existing = deferredFallbackReviews.findIndex((entry) => entry.sessionId === session.id && entry.kind === kind);
 			if (existing >= 0 || deferredFallbackReviews.length < DEFERRED_REVIEW_CAP) {
@@ -770,138 +759,139 @@ function apply(ctx, rawConfig = {}) {
 			const reviewText = redactSecrets(buildReviewRequest(session, kind, signal, config.reviewContextMessages, config.reviewMessageChars, dispatchDigest.get(session.id) ?? []));
 			const agentOptions = { model };
 			if (config.reviewProvider) agentOptions.provider = config.reviewProvider;
-			const registry = ctx.get("tools");
 			const requestedReviewTools = config.reviewToolAllow ?? [];
-			if (requestedReviewTools.length > 0) if (registry === void 0) ctx.logger.warn("dsh-evolution-review: tools service not mounted — the review subagent tool allow-list was not probed; passing it through unchanged");
-			else {
-				const notInGlobalLayer = requestedReviewTools.filter((name) => registry.get(name) == null);
-				if (notInGlobalLayer.length > 0) ctx.logger.warn(`dsh-evolution-review: reviewToolAllow name(s) ${notInGlobalLayer.map((name) => `"${name}"`).join(", ")} are absent from the GLOBAL tool layer — passing them through unchanged (a preset-mounted tool is invisible to a scope-less lookup)`);
-			}
 			const preRunHashes = await treeSkillHashes();
 			const sessionSeqAtPlanTime = session.seq - 1;
 			const substantiveEvidenceSeqs = sessionEvidenceIndex(ctx, session);
-			const run = await subagents.start("spawn", {
-				label: "dsh-evolution-review",
-				prompt: [{
-					type: "text",
-					text: reviewText
-				}],
+			const outcome = await reviewChannel.run({
 				parent: agent,
-				signal: AbortSignal.any([AbortSignal.timeout(config.reviewTimeoutMs), fiberAbort.signal]),
+				label: "dsh-evolution-review",
+				promptText: reviewText + "\n\n" + reviewPrompt(kind, "plan"),
+				kind: "reviewer",
+				allow: requestedReviewTools,
+				outputSchema: REVIEW_OUTPUT_SCHEMA,
 				maxDepth: config.reviewMaxDepth,
 				agentOptions,
-				persona: reviewPrompt(kind, "plan"),
-				toolFilter: { allow: requestedReviewTools },
-				outputSchema: REVIEW_OUTPUT_SCHEMA
+				timeoutMs: config.reviewTimeoutMs,
+				signal: fiberAbort.signal,
+				afterResult: (child) => {
+					const childSession = child.session;
+					return childSession === void 0 ? /* @__PURE__ */ new Set() : new Set(sessionReadNames(ctx, childSession) ?? []);
+				}
 			});
-			try {
-				const result = await withSettleWatchdog(run.result, "subagent review result", resultSettleBudgetMs(), (total) => `did not settle within ${Math.max(0, total - config.reviewTimeoutMs)}ms after the review timeout (watchdog total ${total}ms)`);
-				if (!result.structured) {
-					try {
-						ctx.emit("evolution/review-error", { sessionId: session.id });
-					} catch (emitError) {
-						ctx.logger.warn(`dsh-evolution-review: review-error emit failed: ${emitError instanceof Error ? emitError.message : String(emitError)}`);
-					}
-					const stopDetail = typeof result.stopReason === "string" ? result.stopReason : void 0;
-					const diagDetail = typeof result.diagnostic === "string" ? result.diagnostic : void 0;
-					ctx.logger.warn(`dsh-evolution-review: review subagent returned no structured plan${stopDetail !== void 0 ? ` (stopReason=${stopDetail}${diagDetail !== void 0 ? `; diagnostic=${diagDetail}` : ""})` : ""}`);
-					return false;
+			if (outcome.kind === "aborted") {
+				try {
+					ctx.emit("evolution/review-error", { sessionId: session.id });
+				} catch (emitError) {
+					ctx.logger.warn("dsh-evolution-review: review-error emit failed: " + (emitError instanceof Error ? emitError.message : String(emitError)));
+				}
+				return false;
+			}
+			if (outcome.kind === "unavailable") {
+				if (!channelUnavailableWarned) {
+					channelUnavailableWarned = true;
+					ctx.logger.warn("dsh-evolution-review: subagent channel unavailable (" + outcome.code + ": " + outcome.reason + ") — reviews fall back to the inject path until the capability returns");
 				}
-				const childReads = run.localAgent ? sessionReadNames(ctx, run.localAgent.session) ?? /* @__PURE__ */ new Set() : /* @__PURE__ */ new Set();
-				const plan = result.structured;
-				const policyFingerprint = fingerprintPolicy(snapshot);
-				const validation = validateEvolutionPlan(plan, {
-					sessionSeq: sessionSeqAtPlanTime,
-					substantiveEvidenceSeqs,
-					maxOpsPerPlan: snapshot?.maxOpsPerPlan ?? DEFAULT_MAX_OPS_PER_PLAN,
-					protectedSkillNames: new Set(snapshot?.protectedSkillNames ?? []),
-					maxMemoryChars: snapshot?.memoryChars ?? DEFAULT_MEMORY_CHAR_LIMIT,
-					maxUserChars: snapshot?.userChars ?? DEFAULT_USER_CHAR_LIMIT,
-					maxSkillContentChars: snapshot?.skillContentChars ?? DEFAULT_SKILL_CONTENT_CHARS
-				});
-				if (validation.reports.length > 0) ctx.logger.warn(`dsh-evolution-review: ${validation.reports.length} op(s) cite only bookkeeping frames as evidence: ${validation.reports.map((report) => report.reason).join("; ")}`);
-				const acceptedSkillOps = validation.accepted.skillOps ?? [];
-				const skippedUnread = filterUnreadSkillOps$1(acceptedSkillOps, new Set([...sessionReadNames(ctx, session) ?? /* @__PURE__ */ new Set(), ...childReads]));
-				const evidenceQuotes = [...validation.accepted.memoryOps ?? [], ...acceptedSkillOps].reduce((total, op) => total + (Array.isArray(op.evidence) ? op.evidence.length : 0), 0);
-				const emitApplied = (report) => {
-					try {
-						ctx.emit("evolution/plan-applied", {
-							sessionId: session.id,
-							planId: randomUUID(),
-							policyFingerprint,
-							memoryApplied: report.actions.filter((action) => action.startsWith("Memory")).length,
-							skillApplied: report.actions.filter((action) => action.startsWith("Skill ")).length,
-							rejectedOps: validation.rejected.length,
-							...skippedUnread > 0 ? { skippedUnread } : {},
-							...validation.reports.length > 0 ? { evidenceClassReports: validation.reports.length } : {},
-							executionFailures: report.failedOps?.length ?? 0,
-							...report.executionError !== void 0 ? { executionError: report.executionError } : {},
-							evidenceQuotes,
-							estimatedInputChars: reviewText.length
-						});
-					} catch (emitError) {
-						ctx.logger.warn(`dsh-evolution-review: plan-applied emit failed: ${emitError instanceof Error ? emitError.message : String(emitError)}`);
-					}
-				};
-				const landed = [];
-				let deadlineMissed = false;
-				const lateLandings = [];
-				const noteLanded = (action) => {
-					landed.push(action);
-					if (!deadlineMissed) return;
-					lateLandings.push(action);
-					const before = landed.length - lateLandings.length;
-					const earlier = before > 0 ? ` (${before} other op(s) had landed before the deadline)` : "";
-					deliverMessage(agent, `\u{1F4BE} Self-improvement review: ${action} ${lateLandings.length === 1 ? "landed AFTER the review timed out" : `landed after the timeout (${lateLandings.length} late so far)`}${earlier} \u2014 reconcile before re-requesting the same change.`, "self-improvement review late landing");
-				};
-				let executed;
 				try {
-					executed = await withTimeout(executePlan(validation.accepted, session, noteLanded, preRunHashes, fiberAbort.signal), config.reviewTimeoutMs, "review plan execution");
-				} catch (error) {
-					deadlineMissed = true;
-					emitApplied({
-						actions: landed,
-						executionError: `execution timed out after ${config.reviewTimeoutMs}ms`
-					});
-					throw error;
+					ctx.emit("evolution/review-error", { sessionId: session.id });
+				} catch (emitError) {
+					ctx.logger.warn("dsh-evolution-review: review-error emit failed: " + (emitError instanceof Error ? emitError.message : String(emitError)));
 				}
-				const actions = executed.actions;
-				if (actions.length > 0) {
-					const applied = actions.join(" · ");
-					const failedNote = executed.failedOps.length > 0 ? ` 失败 ${executed.failedOps.length} 个：${executed.failedOps.join("；")}。` : "";
-					deliverMessage(agent, `💾 Self-improvement review: ${applied}${executed.ok ? "" : `\n部分操作失败。${failedNote}以上操作已应用，请勿重复执行。`}`, "self-improvement review");
-				} else {
-					const reasons = [];
-					if (validation.rejected.length > 0) reasons.push(`${validation.rejected.length} op(s) rejected by validation`);
-					if (skippedUnread > 0) reasons.push(`${skippedUnread} op(s) skipped (skill not read this session)`);
-					if (executed.failedOps.length > 0) reasons.push(`${executed.failedOps.length} op(s) failed at execution: ${executed.failedOps.join("; ")}`);
-					if (executed.aborted !== void 0) reasons.push(`execution aborted: ${executed.aborted}`);
-					if (reasons.length === 0) reasons.push("the review plan contained nothing executable");
-					let text = `💾 Self-improvement review: 0 ops landed. ${reasons.join(" ")}`;
-					if (text.length > 500) text = `${text.slice(0, 497)}…`;
-					deliverMessage(agent, text, "self-improvement review");
+				return false;
+			}
+			if (outcome.kind === "no-structured") {
+				try {
+					ctx.emit("evolution/review-error", { sessionId: session.id });
+				} catch (emitError) {
+					ctx.logger.warn("dsh-evolution-review: review-error emit failed: " + (emitError instanceof Error ? emitError.message : String(emitError)));
 				}
-				emitApplied({
-					actions,
-					failedOps: executed.failedOps,
-					...executed.aborted !== void 0 ? { executionError: executed.aborted } : executed.failedOps[0] !== void 0 ? { executionError: executed.failedOps[0] } : {}
-				});
-				return true;
-			} finally {
+				const stopDetail = typeof outcome.stopReason === "string" ? outcome.stopReason : void 0;
+				const diagDetail = typeof outcome.diagnostic === "string" ? outcome.diagnostic : void 0;
+				ctx.logger.warn("dsh-evolution-review: review subagent returned no structured plan" + (stopDetail !== void 0 ? " (stopReason=" + stopDetail + (diagDetail !== void 0 ? "; " + diagDetail : "") + ")" : ""));
+				return false;
+			}
+			const childReads = outcome.evidence ?? /* @__PURE__ */ new Set();
+			const plan = outcome.structured;
+			const policyFingerprint = fingerprintPolicy(snapshot);
+			const validation = validateEvolutionPlan(plan, {
+				sessionSeq: sessionSeqAtPlanTime,
+				substantiveEvidenceSeqs,
+				maxOpsPerPlan: snapshot?.maxOpsPerPlan ?? DEFAULT_MAX_OPS_PER_PLAN,
+				protectedSkillNames: new Set(snapshot?.protectedSkillNames ?? []),
+				maxMemoryChars: snapshot?.memoryChars ?? DEFAULT_MEMORY_CHAR_LIMIT,
+				maxUserChars: snapshot?.userChars ?? DEFAULT_USER_CHAR_LIMIT,
+				maxSkillContentChars: snapshot?.skillContentChars ?? DEFAULT_SKILL_CONTENT_CHARS
+			});
+			if (validation.reports.length > 0) ctx.logger.warn(`dsh-evolution-review: ${validation.reports.length} op(s) cite only bookkeeping frames as evidence: ${validation.reports.map((report) => report.reason).join("; ")}`);
+			const acceptedSkillOps = validation.accepted.skillOps ?? [];
+			const skippedUnread = filterUnreadSkillOps$1(acceptedSkillOps, new Set([...sessionReadNames(ctx, session) ?? /* @__PURE__ */ new Set(), ...childReads]));
+			const evidenceQuotes = [...validation.accepted.memoryOps ?? [], ...acceptedSkillOps].reduce((total, op) => total + (Array.isArray(op.evidence) ? op.evidence.length : 0), 0);
+			const emitApplied = (report) => {
 				try {
-					await withSettleWatchdog(run.dispose(), "subagent dispose", disposeSettleBudgetMs(), (total) => `did not settle within ${total}ms`);
-				} catch (disposeError) {
-					ctx.logger.warn(`dsh-evolution-review: subagent dispose failed: ${disposeError instanceof Error ? disposeError.message : String(disposeError)}`);
+					ctx.emit("evolution/plan-applied", {
+						sessionId: session.id,
+						planId: randomUUID(),
+						policyFingerprint,
+						memoryApplied: report.actions.filter((action) => action.startsWith("Memory")).length,
+						skillApplied: report.actions.filter((action) => action.startsWith("Skill ")).length,
+						rejectedOps: validation.rejected.length,
+						...skippedUnread > 0 ? { skippedUnread } : {},
+						...validation.reports.length > 0 ? { evidenceClassReports: validation.reports.length } : {},
+						executionFailures: report.failedOps?.length ?? 0,
+						...report.executionError !== void 0 ? { executionError: report.executionError } : {},
+						evidenceQuotes,
+						estimatedInputChars: reviewText.length
+					});
+				} catch (emitError) {
+					ctx.logger.warn(`dsh-evolution-review: plan-applied emit failed: ${emitError instanceof Error ? emitError.message : String(emitError)}`);
 				}
+			};
+			const landed = [];
+			let deadlineMissed = false;
+			const lateLandings = [];
+			const noteLanded = (action) => {
+				landed.push(action);
+				if (!deadlineMissed) return;
+				lateLandings.push(action);
+				const before = landed.length - lateLandings.length;
+				const earlier = before > 0 ? ` (${before} other op(s) had landed before the deadline)` : "";
+				deliverMessage(agent, `\u{1F4BE} Self-improvement review: ${action} ${lateLandings.length === 1 ? "landed AFTER the review timed out" : `landed after the timeout (${lateLandings.length} late so far)`}${earlier} \u2014 reconcile before re-requesting the same change.`, "self-improvement review late landing");
+			};
+			let executed;
+			try {
+				executed = await withTimeout(executePlan(validation.accepted, session, noteLanded, preRunHashes, fiberAbort.signal), config.reviewTimeoutMs, "review plan execution");
+			} catch (error) {
+				deadlineMissed = true;
+				emitApplied({
+					actions: landed,
+					executionError: `execution timed out after ${config.reviewTimeoutMs}ms`
+				});
+				throw error;
+			}
+			const actions = executed.actions;
+			if (actions.length > 0) {
+				const applied = actions.join(" · ");
+				const failedNote = executed.failedOps.length > 0 ? ` 失败 ${executed.failedOps.length} 个：${executed.failedOps.join("；")}。` : "";
+				deliverMessage(agent, `💾 Self-improvement review: ${applied}${executed.ok ? "" : `\n部分操作失败。${failedNote}以上操作已应用，请勿重复执行。`}`, "self-improvement review");
+			} else {
+				const reasons = [];
+				if (validation.rejected.length > 0) reasons.push(`${validation.rejected.length} op(s) rejected by validation`);
+				if (skippedUnread > 0) reasons.push(`${skippedUnread} op(s) skipped (skill not read this session)`);
+				if (executed.failedOps.length > 0) reasons.push(`${executed.failedOps.length} op(s) failed at execution: ${executed.failedOps.join("; ")}`);
+				if (executed.aborted !== void 0) reasons.push(`execution aborted: ${executed.aborted}`);
+				if (reasons.length === 0) reasons.push("the review plan contained nothing executable");
+				let text = `💾 Self-improvement review: 0 ops landed. ${reasons.join(" ")}`;
+				if (text.length > 500) text = `${text.slice(0, 497)}…`;
+				deliverMessage(agent, text, "self-improvement review");
 			}
+			emitApplied({
+				actions,
+				failedOps: executed.failedOps,
+				...executed.aborted !== void 0 ? { executionError: executed.aborted } : executed.failedOps[0] !== void 0 ? { executionError: executed.failedOps[0] } : {}
+			});
+			return true;
 		} catch (error) {
 			ctx.logger.warn(`dsh-evolution-review: subagent review failed: ${error instanceof Error ? error.message : String(error)}`);
-			if (error instanceof Error && error.name === REVIEW_SETTLE_TIMEOUT) try {
-				ctx.emit("evolution/review-error", { sessionId: session.id });
-			} catch (emitError) {
-				ctx.logger.warn(`dsh-evolution-review: review-error emit failed: ${emitError instanceof Error ? emitError.message : String(emitError)}`);
-			}
-			if (error instanceof Error && error.message.includes("plan execution timed out")) ctx.logger.warn("dsh-evolution-review: plan execution abandoned on timeout — late writes ARE reported to the model as they land (S2-10) but still have NO plan-applied record and race the fallback inject; inspect the skill tree and usage sidecar");
 			return false;
 		} finally {
 			reviewInFlight = false;
@@ -931,6 +921,7 @@ function apply(ctx, rawConfig = {}) {
 			const io = ctx.get("evolutionIo");
 			if (!io) return null;
 			return newSkillLibrary({
+				authority: authorityFrom({ origin: "foreground" }),
 				config: rootConfig,
 				io: evolutionIoAdapter(() => io.provider())
 			});
@@ -941,7 +932,7 @@ function apply(ctx, rawConfig = {}) {
 		let ok = true;
 		try {
 			for (const op of plan.memoryOps ?? []) {
-				if (signal?.aborted === true) {
+				if (ctx.fiber.uid === null || signal?.aborted === true) {
 					const reason = "the review was unloaded mid-plan";
 					ctx.logger.warn(`dsh-evolution-review: executePlan stopped at an op boundary after ${actions.length} op(s): ${reason}`);
 					return {
@@ -972,7 +963,7 @@ function apply(ctx, rawConfig = {}) {
 				}
 			}
 			for (const op of plan.skillOps ?? []) {
-				if (signal?.aborted === true) {
+				if (ctx.fiber.uid === null || signal?.aborted === true) {
 					const reason = "the review was unloaded mid-plan";
 					ctx.logger.warn(`dsh-evolution-review: executePlan stopped at an op boundary after ${actions.length} op(s): ${reason}`);
 					return {
@@ -992,17 +983,35 @@ function apply(ctx, rawConfig = {}) {
 					evidence: op.evidence
 				};
 				let stagedBytes;
-				if ((args.action === "update" || args.action === "edit") && hashLibrary && typeof args.name === "string" && args.name !== "") stagedBytes = await hashLibrary.read(args.name).catch(() => void 0);
+				if ((args.action === "update" || args.action === "edit") && hashLibrary && typeof args.name === "string" && args.name !== "") {
+					const probe = await hashLibrary.readSkillProbe(args.name);
+					if (isUnknown(probe)) {
+						ok = false;
+						failedOps.push(`skill ${args.action} ${args.name}: target is unreadable (${probe.reason}); refusing to stage an unverifiable anchor`);
+						continue;
+					}
+					stagedBytes = isPresent(probe) ? probe.value : null;
+				}
 				if ((args.action === "write_file" || args.action === "remove_file") && hashLibrary && typeof args.name === "string" && args.name !== "" && typeof args.file_path === "string" && args.file_path !== "") {
-					const stageFile = await hashLibrary.readSupportFile(args.name, args.file_path).catch(() => void 0);
-					if (stageFile !== void 0) args.staged_from_sha256 = stageFile === null ? "absent" : contentHash(stageFile);
+					const supportProbe = await hashLibrary.readSupportFileProbe(args.name, args.file_path);
+					if (isUnknown(supportProbe)) {
+						ok = false;
+						failedOps.push(`file ${args.action} ${args.name}/${args.file_path}: target is unreadable (${supportProbe.reason}); refusing to stage an unverifiable anchor`);
+						continue;
+					}
+					const stageFile = isPresent(supportProbe) ? supportProbe.value : null;
+					args.staged_from_sha256 = stageFile === null ? "absent" : contentHash(stageFile);
 				}
 				const opName = typeof args.name === "string" ? args.name : "";
 				const hashChecked = (args.action === "update" || args.action === "edit" || args.action === "patch") && opName !== "" && preRunHashes?.has(opName) === true;
 				const anchored = hashChecked && typeof stagedBytes === "string" ? stagedBytes : null;
 				let gateVerifiedBytes = null;
 				if (hashChecked) {
-					const live = anchored !== null ? anchored : hashLibrary ? await hashLibrary.read(opName).catch(() => null) : null;
+					const live = anchored !== null ? anchored : await (async () => {
+						if (hashLibrary === null) return null;
+						const probed = await hashLibrary.readSkillProbe(opName);
+						return isPresent(probed) ? probed.value : null;
+					})();
 					const preRun = preRunHashes.get(opName);
 					if (live === null || preRun !== void 0 && contentHash(live) !== preRun) {
 						ok = false;
@@ -1022,7 +1031,8 @@ function apply(ctx, rawConfig = {}) {
 					actions.push(`Skill ${op.name} ${op.action ?? "patch"}`);
 					onLanded?.(`Skill ${op.name} ${op.action ?? "patch"}`);
 					if (hashChecked) {
-						const landed = await hashLibrary?.read(opName).catch(() => null) ?? null;
+						const landedProbe = hashLibrary === null ? void 0 : await hashLibrary.readSkillProbe(opName);
+						const landed = landedProbe !== void 0 && isPresent(landedProbe) ? landedProbe.value : null;
 						if (landed !== null) preRunHashes.set(opName, contentHash(landed));
 					}
 				} else {
@@ -1101,6 +1111,7 @@ function apply(ctx, rawConfig = {}) {
 			};
 			const policySnapshot = policySnapshotOf(ctx.get("evolutionPolicy"));
 			const library = newSkillLibrary({
+				authority: authorityFrom({ origin: resolveOrigins(void 0, true).library }),
 				config: rootConfig,
 				io: evolutionIoAdapter(() => io.provider()),
 				limits: {

package/lib/types/index.d.ts

@@ -15,6 +15,14 @@ declare module '@deepseek-ai/dsh-llm' {
 import type { Session } from '@deepseek-ai/dsh-session';
 import { type ReviewKind } from '@lmzhen/dsh-evolution-core';
 export { filterUnreadSkillOps } from '@lmzhen/dsh-evolution-core';
+/** S2-6 (FLOW1-1): the settle-grace margin a subagent handle gets beyond its
+ * own deadline before the review abandons it. As the dispose watchdog's WHOLE
+ * budget it is capped by the review timeout so a short (test) budget stays
+ * short; the result watchdog adds it AFTER the full timeout (PLAN S1.1,
+ * 2026-09-16) and caps the sum at the timer ceiling (PLAN-R2 P2-1). The
+ * `run.dispose` arm point counts this margin ALONE — its clock starts after
+ * the result settled, not at the review timeout (PLAN-R2 P2-2, 2026-09-16). */
+/** Error name marking the S2-6 watchdog expiry (see the catch in trySubagentReview). */
 export declare const name = "evolution-review";
 export declare const inject: string[];
 export interface Config {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-review",
   "description": "Background review orchestration (community build)",
-  "version": "0.26.15",
+  "version": "0.27.0",
   "publishConfig": {
     "access": "public"
   },
@@ -26,32 +26,35 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "@deepseek-ai/schemastery": "^3.18.4",
-    "@lmzhen/dsh-evolution-approval": "^0.26.15",
-    "@lmzhen/dsh-evolution-core": "^0.26.15",
-    "@lmzhen/dsh-evolution-plan-validator": "^0.26.15"
+    "@deepseek-ai/schemastery": "^3.18.5",
+    "@lmzhen/dsh-evolution-approval": "^0.27.0",
+    "@lmzhen/dsh-evolution-core": "^0.27.0",
+    "@lmzhen/dsh-evolution-plan-validator": "^0.27.0"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-agent": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-llm": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-session": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-tools": "^0.2.0-rc.1",
-    "@lmzhen/dsh-evolution-state": "^0.26.15",
-    "@lmzhen/dsh-evolution-policy": "^0.26.15"
+    "@deepseek-ai/cordis": "^4.0.5",
+    "@deepseek-ai/dsh-agent": "^0.2.1-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.2.1-rc.1",
+    "@deepseek-ai/dsh-session": "^0.2.1-rc.1",
+    "@deepseek-ai/dsh-tools": "^0.2.1-rc.1",
+    "@lmzhen/dsh-evolution-policy": "^0.27.0",
+    "@lmzhen/dsh-evolution-state": "^0.27.0"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-agent": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-agent-loop-testkit": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-llm": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-session": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-session-persistence": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-session-persistence-jsonl": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-tools": "^0.2.0-rc.1",
-    "@lmzhen/dsh-evolution-approval": "^0.26.15",
-    "@lmzhen/dsh-evolution-core": "^0.26.15",
-    "@lmzhen/dsh-evolution-curator": "^0.26.15",
-    "@lmzhen/dsh-evolution-plan-validator": "^0.26.15",
-    "@lmzhen/dsh-evolution-state": "^0.26.15"
+    "@deepseek-ai/dsh-agent": "^0.2.1-rc.1",
+    "@deepseek-ai/dsh-agent-loop-testkit": "^0.2.1-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.2.1-rc.1",
+    "@deepseek-ai/dsh-session": "^0.2.1-rc.1",
+    "@deepseek-ai/dsh-session-persistence": "^0.2.1-rc.1",
+    "@deepseek-ai/dsh-session-persistence-jsonl": "^0.2.1-rc.1",
+    "@deepseek-ai/dsh-tools": "^0.2.1-rc.1",
+    "@lmzhen/dsh-evolution-approval": "^0.27.0",
+    "@lmzhen/dsh-evolution-core": "^0.27.0",
+    "@lmzhen/dsh-evolution-curator": "^0.27.0",
+    "@lmzhen/dsh-evolution-plan-validator": "^0.27.0",
+    "@lmzhen/dsh-evolution-state": "^0.27.0"
+  },
+  "engines": {
+    "dsh": ">=0.2.1-rc.1 <0.2.2-0"
   }
 }