dsh-embedded-workbench 0.9.2 → 0.9.4

package/README.en-US.md

@@ -4,7 +4,7 @@
 
 [![HOL Guard Scanner](https://img.shields.io/badge/HOL%20Guard-passing-00a67e)](https://github.com/hashgraph-online/hol-guard)
 
-Embedded C/C++ firmware toolbox: 4 agents and 8 skills covering FreeRTOS, ISR, NVM storage, Keil MDK (AC5/AC6), ARMCLANG, HardFault triage, state machines, architecture principles, and LVGL patterns.
+Embedded C/C++ firmware toolbox: covering FreeRTOS, ISR, NVM storage, Keil MDK (AC5/AC6), ARMCLANG, HardFault triage, state machines, architecture principles, and LVGL patterns.
 
 **Cross-platform**: works with Claude Code, Codex CLI, Cursor, Kimi CLI, OpenCode, ZCode, and DeepSeek Harness (dsh). Built on the [Agent Skills](https://agentskills.io) open standard.
 
@@ -208,8 +208,8 @@ Skills are invoked with `$skill-name`. ZCode also auto-discovers from `.claude/s
 ## Requirements
 
 - Host: Claude Code v2.1+ / Codex CLI latest / Cursor 2.5+ / Kimi CLI latest / OpenCode latest / ZCode 3.0+
-- DeepSeek Harness (dsh): dev preview, declared support for `>= 0.1.0-rc.7`. The latest round measured install, mount, boot and uninstall on 0.2.1-alpha.1. The earlier round measured 0.1.5-rc.2 through 0.2.0-rc.2. Per-release evidence is in [DSH-COMPATIBILITY.md](DSH-COMPATIBILITY.md).
-- The Web Plugins-page "Gate injection" switch requires **dsh ≥ 0.1.7-alpha.1**, because its settings service must be able to project live fields. On older dsh the plugin and its 8 skills still load and still inject. The switch is simply absent, with no error.
+- DeepSeek Harness (dsh): dev preview, declared support for `>= 0.1.0-rc.7`. The latest round measured install, mount, boot, gate injection and uninstall on 0.2.1-rc.2 and 0.2.1-rc.1. The earlier round measured 0.1.5-rc.2 through 0.2.0-rc.2. Per-release evidence is in [DSH-COMPATIBILITY.md](DSH-COMPATIBILITY.md).
+- The Web Plugins-page "Gate injection" switch requires **dsh ≥ 0.1.7-alpha.1**, because its settings service must be able to project live fields. On older dsh the plugin and its skills still load and still inject. The switch is simply absent, with no error.
 - No external dependencies.
 
 ## Configuration
@@ -280,9 +280,12 @@ To report a security vulnerability, do **not** open a public issue. Use the priv
 
 | Plugin | Description |
 |--------|-------------|
+| [dsh-model-everything](https://github.com/AmethystLuna/dsh-model-everything) | Design and code modelling plus automated review, by the same author: UML diagrams rendered, read and reviewed; state-machine and protocol verification; data-model and migration checks; concurrency claim routing; dependency-graph review; design review; export to external checkers; report diffing. Install with `dsh plugin --profile <name> add dsh-model-everything` ([npm](https://www.npmjs.com/package/dsh-model-everything)). |
 | [logicprobe](https://github.com/AmethystLuna/logicprobe) | Claim-verification skill: checks every verifiable claim in design docs, architecture specs, and refactoring plans against the codebase, and escalates behavioral claims to executable-model verification. It was split out of this plugin. The Plan Verification Gate prefers it, and falls back to the built-in `fact-check` skill when it is not installed. Install with `claude plugin install logicprobe@logicprobe`, or on dsh with `dsh plugin --profile <name> add dsh-logicprobe`. |
 | [superpowers](https://github.com/obra/superpowers) | The original agent discipline engine: skill loading enforcement, Red Flags, subagent-driven development. Many of this plugin's agent-compliance patterns (1% Rule, Red Flags, `<SUBAGENT-STOP>`, instruction priority) were adapted from Superpowers. |
 
+dsh-model-everything covers modelling and automated review of designs and code. It does not replace this plugin. This plugin remains the embedded C/C++ firmware workbench: its firmware skills, agent roles and the Plan Verification Gate stay here.
+
 ## Acknowledgments
 
 This plugin's agent-compliance architecture is adapted from [Superpowers](https://github.com/obra/superpowers) by Jesse Vincent (MIT License). These patterns were especially influential:

package/README.md

@@ -2,7 +2,7 @@
 
 <p align="center"><a href="README.en-US.md">English</a> · <strong>中文</strong></p>
 
-嵌入式 C/C++ 固件开发工具箱：4 个代理、8 个技能，覆盖 FreeRTOS、中断、NVM 存储、Keil MDK（AC5/AC6）、ARMCLANG、HardFault 分析、状态机、架构原则与 LVGL 陷阱。
+嵌入式 C/C++ 固件开发工具箱：覆盖 FreeRTOS、中断、NVM 存储、Keil MDK（AC5/AC6）、ARMCLANG、HardFault 分析、状态机、架构原则与 LVGL 陷阱。
 
 **跨平台**：支持 Claude Code、Codex CLI、Cursor、Kimi CLI、OpenCode、ZCode、DeepSeek Harness (dsh)。基于 [Agent Skills](https://agentskills.io) 开放标准构建。
 
@@ -206,8 +206,8 @@ cp -r embedded-workbench/skills/* .zcode/skills/
 ## 依赖
 
 - 宿主：Claude Code v2.1+ / Codex CLI 最新版 / Cursor 2.5+ / Kimi CLI 最新版 / OpenCode 最新版 / ZCode 3.0+
-- DeepSeek Harness (dsh)：dev preview，声明支持 `>= 0.1.0-rc.7`。最新一轮在 0.2.1-alpha.1 上实测了安装、挂载、启动与卸载；更早一轮实测覆盖 0.1.5-rc.2 到 0.2.0-rc.2。逐版本证据见 [DSH-COMPATIBILITY.md](DSH-COMPATIBILITY.md)。
-- Web 端的「Gate 注入」开关需要 **dsh ≥ 0.1.7-alpha.1**，因为设置服务必须能投影即时字段。更早的 dsh 上插件与 8 个技能照常加载、照常注入，只是开关不出现，也不报错。
+- DeepSeek Harness (dsh)：dev preview，声明支持 `>= 0.1.0-rc.7`。最新一轮在 0.2.1-rc.2 与 0.2.1-rc.1 上实测了安装、挂载、启动、门禁注入与卸载；更早一轮实测覆盖 0.1.5-rc.2 到 0.2.0-rc.2。逐版本证据见 [DSH-COMPATIBILITY.md](DSH-COMPATIBILITY.md)。
+- Web 端的「Gate 注入」开关需要 **dsh ≥ 0.1.7-alpha.1**，因为设置服务必须能投影即时字段。更早的 dsh 上插件与技能照常加载、照常注入，只是开关不出现，也不报错。
 - 无外部依赖。
 
 ## 配置
@@ -219,7 +219,7 @@ cp -r embedded-workbench/skills/* .zcode/skills/
 | `enabled` | boolean | `true` | 设为 `false` 可完全关闭首步 Gate 注入；技能注册不受影响。 |
 | `gateContent` | string | 内置 gate 文本 | 覆盖注入到首轮模型上下文中的文本。 |
 
-在 dsh Web GUI 里可以直接改这个开关：侧边栏 **插件** → 本插件卡片 → 「Gate 注入」。它实时生效，不必重启 profile。它只管注入的那段文本：关掉后 8 个技能照常注册。同一张卡片上还有一个更粗粒度的行开关，关掉它会整行卸载插件，技能和这个开关一起消失。要持久化覆盖，仍按下面的 profile patch 写。
+在 dsh Web GUI 里可以直接改这个开关：侧边栏 **插件** → 本插件卡片 → 「Gate 注入」。它实时生效，不必重启 profile。它只管注入的那段文本：关掉后技能照常注册。同一张卡片上还有一个更粗粒度的行开关，关掉它会整行卸载插件，技能和这个开关一起消失。要持久化覆盖，仍按下面的 profile patch 写。
 
 在 profile 的 `cordis.patch.yml` 中按 row id 覆盖（下面的例子自定义 Gate 文本）：
 
@@ -278,9 +278,12 @@ bash tests/skill-triggering/run-all.sh
 
 | 插件 | 简介 |
 |------|------|
+| [dsh-model-everything](https://github.com/AmethystLuna/dsh-model-everything) | 同一作者的设计与代码建模、自动审查插件：UML 图渲染、读取与审查，状态机与协议验证，数据模型与迁移检查，并发声称分流，依赖图审查，设计审查，导出到外部验证器，报告对比。安装：`dsh plugin --profile <name> add dsh-model-everything`（[npm](https://www.npmjs.com/package/dsh-model-everything)）。 |
 | [logicprobe](https://github.com/AmethystLuna/logicprobe) | 声称核查技能：逐条核验设计文档、架构规格、重构计划中的可验证声称与代码库是否一致，行为类声称升级为可执行模型验证。它自本插件拆分而来。Plan Verification Gate 优先使用它，未安装时回退到内置 `fact-check` 技能。安装：Claude 侧 `claude plugin install logicprobe@logicprobe`；dsh 侧 `dsh plugin --profile <name> add dsh-logicprobe`。 |
 | [superpowers](https://github.com/obra/superpowers) | 原始 agent 纪律引擎：技能加载强制、Red Flags、子代理驱动开发。本插件的多项 agent 合规模式（1% Rule、Red Flags、`<SUBAGENT-STOP>`、指令优先级）均借鉴自 Superpowers。 |
 
+dsh-model-everything 覆盖设计与代码的建模和审查，不替代本插件。本插件仍是嵌入式 C/C++ 固件工作台：嵌入式技能、agent 角色与 Plan Verification Gate 都还在这里。
+
 ## 致谢
 
 本插件的 agent 合规架构借鉴自 Jesse Vincent 的 [Superpowers](https://github.com/obra/superpowers)（MIT License）。以下设计模式尤其有启发：

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "dsh-embedded-workbench",
-    "version": "0.9.2",
-    "description": "Embedded C/C++ firmware development toolbox — 4 agents, 8 skills covering FreeRTOS, ISR, NVM storage, Keil MDK, ARMCLANG, HardFault, state machines, architecture, LVGL patterns, and claim fact-checking. Ships a native DeepSeek Harness (dsh) bundle that folds a short gate — the Plan Verification Gate plus a context-budget rule — into the first model step.",
+    "version": "0.9.4",
+    "description": "Embedded C/C++ firmware development toolbox — FreeRTOS, ISR, NVM storage, Keil MDK, ARMCLANG, HardFault, state machines, architecture, LVGL patterns, and claim fact-checking. Ships a native DeepSeek Harness (dsh) bundle that folds a short gate — the Plan Verification Gate plus a context-budget rule — into the first model step.",
     "type": "module",
     "main": "lib/index.js",
     "types": "lib/types/index.d.ts",
@@ -43,7 +43,7 @@
             ]
         },
         "compatibility": {
-            "dsh": "^0.1.0-rc.7 || ^0.1.1-rc.1 || ^0.1.2-alpha.2 || ^0.1.2-alpha.3 || ^0.1.2-alpha.4 || ^0.1.2-alpha.5 || ^0.1.2-rc.1 || ^0.1.3-alpha.1 || ^0.1.3-alpha.2 || ^0.1.5-alpha.1 || ^0.1.5-rc.1 || ^0.1.5-alpha.2 || ^0.1.5-rc.2 || ^0.1.5-rc.3 || ^0.1.6-alpha.1 || ^0.1.6-alpha.2 || ^0.1.7-alpha.1 || ^0.1.7-alpha.2 || ^0.1.7-rc.1 || ^0.1.7-rc.2 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2",
+            "dsh": "^0.1.0-rc.7 || ^0.1.1-rc.1 || ^0.1.2-alpha.2 || ^0.1.2-alpha.3 || ^0.1.2-alpha.4 || ^0.1.2-alpha.5 || ^0.1.2-rc.1 || ^0.1.3-alpha.1 || ^0.1.3-alpha.2 || ^0.1.5-alpha.1 || ^0.1.5-rc.1 || ^0.1.5-alpha.2 || ^0.1.5-rc.2 || ^0.1.5-rc.3 || ^0.1.6-alpha.1 || ^0.1.6-alpha.2 || ^0.1.7-alpha.1 || ^0.1.7-alpha.2 || ^0.1.7-rc.1 || ^0.1.7-rc.2 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2 || ^0.2.1-rc.2",
             "dshReleases": {
                 "0.1.0-rc.7": "compatible",
                 "0.1.0-rc.8": "compatible",
@@ -70,7 +70,9 @@
                 "0.2.0-rc.1": "compatible",
                 "0.2.0-rc.2": "compatible",
                 "0.2.1-alpha.1": "compatible",
-                "0.2.1-alpha.2": "compatible"
+                "0.2.1-alpha.2": "compatible",
+                "0.2.1-rc.1": "compatible",
+                "0.2.1-rc.2": "compatible"
             },
             "profiles": [
                 "headless",
@@ -85,10 +87,10 @@
     },
     "peerDependencies": {
         "@deepseek-ai/cordis": "^4.0.4",
-        "@deepseek-ai/dsh-agent": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2",
-        "@deepseek-ai/dsh-llm": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2",
-        "@deepseek-ai/dsh-session": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2",
-        "@deepseek-ai/dsh-skill-filesystem": "^0.1.0-rc.8 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2",
+        "@deepseek-ai/dsh-agent": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2 || ^0.2.1-rc.2",
+        "@deepseek-ai/dsh-llm": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2 || ^0.2.1-rc.2",
+        "@deepseek-ai/dsh-session": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2 || ^0.2.1-rc.2",
+        "@deepseek-ai/dsh-skill-filesystem": "^0.1.0-rc.8 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2 || ^0.2.1-rc.2",
         "@deepseek-ai/schemastery": "^3.18.4"
     },
     "devDependencies": {
@@ -102,7 +104,7 @@
         "@deepseek-ai/dsh-skill": "^0.2.0-rc.2",
         "@deepseek-ai/dsh-skill-filesystem": "^0.2.0-rc.2",
         "@deepseek-ai/schemastery": "^3.18.4",
-        "@types/node": "^26.6.3",
+        "@types/node": "^26.6.5",
         "typescript": "^7.0.2"
     },
     "author": {

package/skills/embedded-workbench/SKILL.md

@@ -36,9 +36,9 @@ If you catch yourself thinking any of these, STOP — you are rationalizing:
 | "The worker can figure out the details" | The worker has NO context from previous calls. A vague plan = the worker guessing. |
 | "I'll review it myself, no need for quality-coordinator" | Self-review is enough for a bounded, reversible edit. A second pass earns its cost when the blast radius is unclear or the change is hard to undo. |
 | "This change is too small for a Detailed Change Plan" | Bounded, reversible, single-site edits do not need the ceremony. Crossing a module boundary, a public interface, or a non-obvious failure mode does. Name the invariants either way. |
-| "I've explored enough, time to exit plan mode" | ExitPlanMode is the verification gate. Have you loaded `Skill("logicprobe")` or, if it is not installed, the built-in fallback `Skill("fact-check")`? Every plan — simple or complex — must pass this gate before exit. |
-| "This plan is too simple for logicprobe" | logicprobe auto-classifies depth (LIGHTWEIGHT/STANDARD/ESCALATED); the fallback fact-check verifies every claim regardless. You don't decide whether verification is needed. |
-| "I already read the code, I know the file paths and API names are correct" | Organic verification leaves no audit trail. Load `Skill("logicprobe")` or the fallback `Skill("fact-check")`, verify each claim, append the `## Plan Verification` block. |
+| "I've explored enough, time to exit plan mode" | ExitPlanMode is the verification gate. Have you loaded `Skill("model-everything")` (or `Skill("logicprobe")` if only the older plugin is installed), or the built-in fallback `Skill("fact-check")` when neither is? Every plan — simple or complex — must pass this gate before exit. |
+| "This plan is too simple for the verification skill" | `model-everything` (and `logicprobe` before it) auto-classifies depth (LIGHTWEIGHT/STANDARD/ESCALATED); the fallback fact-check verifies every claim regardless. You don't decide whether verification is needed. |
+| "I already read the code, I know the file paths and API names are correct" | Organic verification leaves no audit trail. Load `Skill("model-everything")` (or `Skill("logicprobe")` if only the older plugin is installed), or the fallback `Skill("fact-check")`, verify each claim, append the `## Plan Verification` block. |
 
 ---
 
@@ -84,7 +84,7 @@ Sub-agents are **optional equipment, not mandatory stages** — dispatch one whe
 
 Plan the change, make it, verify it. Self-review is sufficient for a bounded, reversible edit.
 
-If the plan rests on claims about the codebase (API names, file paths, enum values, counts), verify those claims before implementing — inline for a small change, or with `logicprobe` / the built-in `fact-check` skill. Escalate to Full when the change turns out to cross a boundary, or when two revisions fail to converge.
+If the plan rests on claims about the codebase (API names, file paths, enum values, counts), verify those claims before implementing — inline for a small change, or with `model-everything` (or `logicprobe` if only the older plugin is installed) / the built-in `fact-check` skill. Escalate to Full when the change turns out to cross a boundary, or when two revisions fail to converge.
 
 ### Full — cross-module, new interfaces, state-ownership changes
 
@@ -113,12 +113,12 @@ Claude Code's built-in `EnterPlanMode` / `ExitPlanMode` maps to the **plan phase
 
 ### Plan Verification Gate
 
-> **⚠️ logicprobe 已拆分为独立插件 / moved to a standalone plugin** (v0.6.0): the full verification skill (executable model checks, adversarial probing) now ships in its own plugin — <https://github.com/AmethystLuna/logicprobe> (install commands are in the README's "Other Plugins"). This plugin ships a built-in simplified fallback — `Skill("fact-check")` — for claim-by-claim verification when logicprobe is not installed; behavioral/model claims then degrade to manual confirmation.
+> **⚠️ The verification skill ships in another plugin.** It started in `logicprobe` (v0.6.0, <https://github.com/AmethystLuna/logicprobe>) and that plugin continues as [`dsh-model-everything`](https://github.com/AmethystLuna/dsh-model-everything), which is the superset: the same claim verification plus diagram review, data-model checks, a concurrency claim family and export to external checkers. Load `Skill("model-everything")` when `dsh-model-everything` is installed, `Skill("logicprobe")` when only the older plugin is, and the built-in `Skill("fact-check")` when neither is — behavioral and model claims then degrade to manual confirmation.
 
 **Before calling `ExitPlanMode`**, exactly one of the following must happen:
 
-1. **Load `Skill("logicprobe")`** (standalone plugin) — it classifies depth (LIGHTWEIGHT / STANDARD / ESCALATED), runs the verification including executable model checks, and appends a `## Plan Verification` summary block to the plan.
-2. **Load `Skill("fact-check")`** (built-in fallback, only when logicprobe is not installed) — verifies every verifiable claim against the codebase with evidence, appends a `## Plan Verification` block marked `fact-check (fallback)`, and tells the user that state-machine/behavioral claims degrade to manual confirmation.
+1. **Load the verification skill** — `Skill("model-everything")` when `dsh-model-everything` is installed (the successor of `logicprobe`), otherwise `Skill("logicprobe")` if the older plugin is installed. It classifies depth (LIGHTWEIGHT / STANDARD / ESCALATED), runs the verification including executable model checks, and appends a `## Plan Verification` summary block to the plan.
+2. **Load `Skill("fact-check")`** (built-in fallback, only when neither plugin is installed) — verifies every verifiable claim against the codebase with evidence, appends a `## Plan Verification` block marked `fact-check (fallback)`, and tells the user that state-machine/behavioral claims degrade to manual confirmation.
 3. **Inform the user** — if you load neither, say: *"此计划未经核查。是否需要我在审批前运行事实核查？（This plan has not been fact-verified. Would you like me to run verification before approving?）"*
 
 Silent skip is not an option. Plan mode permits `Read`, `Glob`, `Grep`, and `Skill` calls, so all of this executes before exit.
@@ -169,8 +169,9 @@ Each domain skill is classified by how strictly it should be followed:
 **Rigid** — follow exactly. These are rules and checklists. Don't adapt away the discipline.
 
 - `debug-methodology`: 8 iron rules are non-negotiable
-- `logicprobe` (external plugin): claim verification must check every claim
-- `fact-check` (built-in fallback): claim-by-claim verification when logicprobe is not installed
+- `model-everything` (external plugin, `dsh-model-everything`): claim verification and model checks must cover every claim
+- `logicprobe` (external plugin, the predecessor): the same gate when only the older plugin is installed
+- `fact-check` (built-in fallback): claim-by-claim verification when neither is installed
 
 **Flexible** — adapt principles to context. These are patterns and references, not commands.
 
@@ -186,7 +187,7 @@ If unsure, treat a skill as Rigid until you confirm otherwise.
 
 When multiple skills could apply, use this order:
 
-1. **Diagnosis skills first** — `debug-methodology`, `hardfault-triage`, `logicprobe` (external plugin; use the built-in `fact-check` fallback if logicprobe is not installed). These determine WHAT is wrong.
+1. **Diagnosis skills first** — `debug-methodology`, `hardfault-triage`, and the verification skill (`model-everything` from `dsh-model-everything`, or `logicprobe` if only the older plugin is installed; the built-in `fact-check` fallback if neither is). These determine WHAT is wrong.
 2. **Design skills second** — `state-machine-design`. These determine HOW to fix it.
 3. **Implementation skills third** — `c-cpp-dev`, `embedded-firmware-dev`, `keil-mdk-build`. These guide execution.
 

package/skills/embedded-workbench/references/platform-tool-mapping.md

@@ -110,7 +110,7 @@ This plugin defines 4 sub-agents. On platforms without an `Agent` tool (includin
 | Claude Code Agent | Alternative Approach |
 |-------------------|---------------------|
 | `architecture-steward` | Ask user to run a separate session with planning prompt |
-| `design-reviewer` | Load `logicprobe` skill (standalone plugin; built-in `fact-check` fallback if logicprobe is not installed); manually verify claims |
+| `design-reviewer` | Load `model-everything` skill (`dsh-model-everything`, the successor of `logicprobe`; the older `logicprobe` skill if only that is installed; built-in `fact-check` fallback if neither is); manually verify claims |
 | `execution-worker` | Sequential implementation in current session with approval gates |
 | `quality-coordinator` | Self-review checklist from `references/final-qc.md` template |
 

package/skills/embedded-workbench/references/proactive-suggestions.md

@@ -18,7 +18,7 @@ user declines.
 ## Rules
 
 - **Suggest once per task**, not repeatedly. If the user declines, don't push.
-- **Say what the check finds**, not which tool runs it. If logicprobe is not installed,
+- **Say what the check finds**, not which tool runs it. If neither `dsh-model-everything` nor `logicprobe` is installed,
   offer the built-in `fact-check` skill instead — "I can check every claim in the plan
   against the codebase" — and note that behavioral/model claims then degrade to manual
   confirmation.

package/skills/fact-check/SKILL.md

@@ -1,13 +1,14 @@
 ---
 name: fact-check
-description: "Use when reviewing design documents, architecture specs, technical proposals, or plans that make claims about API names, file paths, enum values, counts, or mechanism feasibility — a lightweight claim-by-claim check against the codebase with evidence. Built into embedded-workbench as the fallback when the full logicprobe plugin is not installed. NOT for state machines, protocol/retry logic, or 'always'/'never' behavioral claims that need executable model verification — those require the logicprobe plugin."
+description: "Use when reviewing design documents, architecture specs, technical proposals, or plans that make claims about API names, file paths, enum values, counts, or mechanism feasibility — a lightweight claim-by-claim check against the codebase with evidence. Built into embedded-workbench as the fallback when the full dsh-model-everything plugin (or its predecessor logicprobe) is not installed. NOT for state machines, protocol/retry logic, or 'always'/'never' behavioral claims that need executable model verification — those require dsh-model-everything (or logicprobe)."
 ---
 
 # Fact Check (fallback)
 
 Lightweight claim verification built into this plugin. Use it when the full
-`logicprobe` plugin is not installed — it checks every verifiable claim in a
-document/plan against the codebase with evidence, without model escalation.
+`dsh-model-everything` plugin — or its predecessor `logicprobe` — is not installed.
+It checks every verifiable claim in a document/plan against the codebase with
+evidence, without model escalation.
 
 ## When to use
 

package/skills/state-machine-design/SKILL.md

@@ -9,6 +9,8 @@ This is a domain implementation skill. If you are planning, designing, or enteri
 
 # State Machine Design
 
+> **For a design that has to be decided rather than reviewed:** `dsh-model-everything` verifies the machine itself — `model_verify` explores every interleaving for unreachable states, deadlock, a timeout that can never fire, and a lock held across an await; `model_compose_verify` decides two mechanisms interacting, including a lost update on a shared location. Load its `model-everything` skill when the plugin is installed. This skill stays the implementation guide: the C code, the flags, the timeouts.
+
 ## Core Rules
 
 - Fix the state model, not the symptom. Every in-progress or pending flag must have explicit success, failure, timeout, and reset exits.