@@ -69,12 +69,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   there is no legacy skill corpus whose directory names would change
   under the new sanitizer. Sanitizing is lossy: skills whose raw names
   differ only in characters the sanitizer drops or replaces (e.g.
-  `"fix django"` vs. `"fix_django"`) now share one `SKILL.md`, and the
-  later write wins — the earlier skill's `source_case_ids`,
-  `maturity_score`, and body are silently lost, not merged. This is
-  accepted, not mitigated: the LLM's add/update decision is keyed on the
-  name it sees, so a collision usually reads as an intended update
-  anyway.
+  `"fix django"` vs. `"fix_django"`) now share one `SKILL.md`, and so do
+  names differing only in a combining mark regardless of script (e.g.
+  Devanagari `"किताब"` vs. `"कताब"` — a combining mark alone is not `\w`
+  and is stripped either way; same for Thai tone marks, Hebrew niqqud,
+  Arabic harakat). The later write wins — the earlier skill's
+  `source_case_ids`, `maturity_score`, and body are silently lost, not
+  merged. This is accepted, not mitigated, on two grounds: a
+  disambiguating suffix would break the `name` ≡ directory-suffix
+  identity the reader/writer relies on, and detecting a collision and
+  raising would reintroduce the dead-letter DoS the sanitizer was built
+  to avoid.
 
 ### Added
 
 
@@ -269,20 +269,34 @@ def sanitize_skill_name(cls, skill_name: str) -> str:
         name rather than merely idempotent-if-resanitized.
 
         This is lossy: distinct raw names can collapse onto the same
-        sanitized name (``"fix django"`` and ``"fix_django"`` both become
-        ``"fix_django"``; ``"fix!django"`` and ``"fixdjango"`` both become
-        ``"fixdjango"``; two names differing only past the 50-character cap
-        also collide). Because ``AgentSkillWriter.write_main`` is a full-file
-        replace and the LanceDB primary key is
-        ``f"{agent_id}_{sanitized_name}"``, a collision means the later skill
-        silently overwrites the earlier one — its accumulated
-        ``source_case_ids``, ``maturity_score``, and body are lost, not
-        merged. This is deliberate, not an oversight: the LLM's add/update
-        decision for a skill is keyed on the name it sees, so a collision
-        usually reads as an intended update anyway; and disambiguating
-        colliding names (e.g. with a suffix) would break the
+        sanitized name. Dropped punctuation, space/underscore collapse, and
+        the 50-character cap are the visible cases (``"fix django"`` and
+        ``"fix_django"`` both become ``"fix_django"``; ``"fix!django"`` and
+        ``"fixdjango"`` both become ``"fixdjango"``). The larger case is
+        every combining mark: a combining mark alone is not ``\\w``, so it
+        is stripped regardless of script, and two names that differ only in
+        their marks collide — e.g. Devanagari ``"किताब"`` and ``"कताब"``
+        both sanitize to ``"कतब"``; the same holds for Thai tone marks,
+        Hebrew niqqud, and Arabic harakat.
+
+        Because ``AgentSkillWriter.write_main`` is a full-file replace and
+        the LanceDB primary key is ``f"{agent_id}_{sanitized_name}"``, a
+        collision means the later skill silently overwrites the earlier
+        one — its accumulated ``source_case_ids``, ``maturity_score``, and
+        body are lost, not merged.
+
+        This is deliberate, not an oversight — but not because a collision
+        "usually reads as an intended update". ``_persist_skill`` sanitizes
+        *before* constructing the frontmatter, so the LLM is shown the
+        already-sanitized name in ``existing_relevant_skills``; when it
+        then emits a raw name like ``"fix django"`` after having just been
+        shown ``"fix_django"``, it has affirmatively treated them as two
+        different skills, and the write silently merges them anyway. The
+        decision to accept this is justified on two other grounds instead:
+        a disambiguating suffix on a collision would break the
         ``frontmatter.name`` ≡ directory-suffix identity the reader/writer
-        seam relies on.
+        seam relies on, and detecting a collision and raising would
+        reintroduce the dead-letter DoS this sanitizer was built to avoid.
         """
         return sanitize_dirname(skill_name, fallback="unnamed")
 
 
@@ -38,10 +38,18 @@
 def sanitize_dirname(raw: str, fallback: str) -> str:
     """Produce a safe directory/file name segment from free-text input.
 
-    * NFC-normalize first, so a decomposed (NFD) accented character (e.g. an
-      ``"e"`` + combining acute accent) collapses to its precomposed form
-      before the character filter runs, rather than losing the accent
-      entirely (a combining mark is not ``\\w``).
+    * NFC-normalize first. For an ordinary decomposed (NFD) input — a base
+      letter plus a combining mark, e.g. ``"e"`` + combining acute accent —
+      this collapses to the precomposed form before the character filter
+      runs, so the accent survives (a combining mark alone is not ``\\w``
+      and would otherwise be silently stripped). This is best-effort, not a
+      guarantee: for the ~1,082 Unicode *composition exclusion* codepoints
+      (e.g. Devanagari ``क़``/``ख़``, U+0958/U+0959), NFC does the
+      opposite — it *decomposes* an already-precomposed exclusion
+      character, because recomposing it is explicitly excluded from the
+      NFC algorithm, and the resulting combining mark is then stripped just
+      the same. Normalizing here improves fidelity for the common case; it
+      does not make every Unicode script round-trip losslessly.
     * Replace spaces with underscores.
     * Strip characters outside ``[a-zA-Z0-9_\\-.]`` (``\\w`` is Unicode-aware,
       so CJK and other non-ASCII scripts survive readably). Note that ``.``
 
@@ -6,9 +6,10 @@
   :class:`AgentSkillFrontmatter` subclass instance + the Tier-2 body, so
   the caller never deals with raw dicts.
 - :meth:`list_by_cluster` walks every ``skill_*/SKILL.md`` under an agent
-  and returns the ones whose parsed ``cluster_id`` matches. This is the
-  strong-consistency source of truth for cluster membership — LanceDB is
-  cascade-lagged and must not be used for that check.
+  and returns ``(frontmatter, body)`` for the ones whose parsed
+  ``cluster_id`` matches. This is the strong-consistency source of truth
+  for cluster membership — LanceDB is cascade-lagged and must not be used
+  for that check.
 - :meth:`read_reference` / :meth:`read_script` are plain text reads;
   no frontmatter, no schema.
 
@@ -24,13 +25,18 @@
 directory segment. ``read_main`` / ``read_reference`` / ``read_script``
 take a caller-supplied ``skill_name`` and re-derive the path from it, so
 the reader and writer must never diverge on how a ``skill_name`` maps to
-a directory. ``list_by_cluster`` avoids that class of risk entirely for
-its own enumeration: it reads each globbed ``SKILL.md`` path directly
-rather than recovering a name from the directory and re-deriving a path
-from it — the reader never derives a path at all on that route, so a
-directory whose suffix happens not to be a sanitizer fixpoint (e.g. one
-containing a space) can never be silently dropped by a re-sanitization
-mismatch.
+a directory. ``list_by_cluster`` never derives a path at all: it reads
+each globbed ``SKILL.md`` path directly and hands back the body it
+already read, rather than recovering a name from the directory and
+leaving the caller to re-derive a path from that name for a second read.
+A caller that discarded the body and re-read by name would recreate
+exactly the re-sanitization risk this method exists to avoid — a
+directory whose suffix isn't itself a sanitizer fixpoint (e.g. one
+containing a raw space) would silently miss on that second, name-based
+read even though the first, path-based read found it just fine. Returning
+the body is what makes "the reader never derives a path" a property of
+the full ``list_by_cluster`` → caller flow, not just of the enumeration
+step in isolation.
 """
 
 from __future__ import annotations
@@ -88,11 +94,11 @@ async def list_by_cluster(
         *,
         app_id: str = "default",
         project_id: str = "default",
-    ) -> list[AgentSkillFrontmatter]:
+    ) -> list[tuple[AgentSkillFrontmatter, str]]:
         """Enumerate this agent's ``SKILL.md`` files whose ``cluster_id`` matches.
 
         Walks ``skills/skill_*/SKILL.md`` under the agent's memory root and
-        returns fully-parsed frontmatter for each match. Skills whose
+        returns ``(frontmatter, body)`` for each match. Skills whose
         frontmatter has ``cluster_id is None`` (or a different cluster) are
         filtered out.
 
@@ -105,7 +111,11 @@ async def list_by_cluster(
         derives a path at all on this route, so this enumeration cannot drop
         a skill whose on-disk directory suffix is not itself a sanitizer
         fixpoint (e.g. one written with a raw, unsanitized name containing a
-        space).
+        space). Returning the body here (rather than frontmatter alone) is
+        load-bearing, not a convenience: a caller that discarded it and
+        re-read by ``frontmatter.name`` would reintroduce the same
+        name-based re-derivation this method exists to avoid, one call
+        later.
 
         Args:
             agent_id: Owning agent.
@@ -114,7 +124,7 @@ async def list_by_cluster(
             project_id: Project scope; defaults to ``"default"``.
 
         Returns:
-            ``AgentSkillFrontmatter`` list sorted by skill directory path.
+            ``(frontmatter, body)`` pairs sorted by skill directory path.
             Empty if the agent has no skill directory yet, or none match.
         """
         skills_dir = self._skills_root(agent_id, app_id, project_id)
@@ -125,14 +135,14 @@ async def list_by_cluster(
             f"/{AgentSkillFrontmatter.SKILL_MAIN_FILENAME}"
         )
         paths = await anyio.to_thread.run_sync(lambda: sorted(skills_dir.glob(pattern)))
-        matches: list[AgentSkillFrontmatter] = []
+        matches: list[tuple[AgentSkillFrontmatter, str]] = []
         for path in paths:
             parsed = await self._read_path(path, schema=AgentSkillFrontmatter)
             if parsed is None:
                 continue
-            frontmatter, _body = parsed
+            frontmatter, body = parsed
             if frontmatter.cluster_id == cluster_id:
-                matches.append(frontmatter)
+                matches.append((frontmatter, body))
         return matches
 
     async def read_reference(
@@ -177,7 +187,7 @@ async def read_script(
         text = await apath.read_text(encoding="utf-8")
         return text.rstrip("\n")
 
-    # ── Internals ─────────────────────────────────────────────────────────
+    # ── Internals — same shape as AgentSkillWriter ────────────────────────────
 
     async def _read_path(self, path: Path, *, schema: type[T]) -> tuple[T, str] | None:
         """Read + parse an already-resolved ``SKILL.md`` path.
@@ -193,8 +203,6 @@ async def _read_path(self, path: Path, *, schema: type[T]) -> tuple[T, str] | No
         body = parsed.body.rstrip("\n")
         return frontmatter, body
 
-    # ── Internals — same shape as AgentSkillWriter ────────────────────────────
-
     def _skills_root(self, agent_id: str, app_id: str, project_id: str) -> Path:
         return (
             self._root.agents_dir(app_id, project_id)
 
@@ -245,6 +245,15 @@ async def _select_existing_skills(
     count exceeds ``MAX_SKILLS_IN_PROMPT`` and ``case_vector`` is
     available; when it isn't (pre-1.2.3 event, or embedding was
     unavailable upstream), fall back to md ordering.
+
+    ``list_by_cluster`` returns each skill's frontmatter *and* body
+    together, so there is no second, name-based read to hydrate
+    ``content`` — a prior version re-read each selected skill by
+    ``fm.name`` via ``read_main``, which re-derives (and re-sanitizes) a
+    path from that name and would silently miss a skill whose on-disk
+    directory suffix isn't itself a sanitizer fixpoint, even though the
+    first, path-based enumeration found it. See
+    ``AgentSkillReader.list_by_cluster``'s docstring.
     """
     reader = _get_reader()
     md_skills = await reader.list_by_cluster(
@@ -254,9 +263,9 @@ async def _select_existing_skills(
         return []
 
     if len(md_skills) <= MAX_SKILLS_IN_PROMPT:
-        selected_fms = md_skills
+        selected = md_skills
     elif case_vector is not None:
-        selected_fms = await _rank_skills_by_relevance(
+        selected = await _rank_skills_by_relevance(
             md_skills,
             agent_id=agent_id,
             cluster_id=cluster_id,
@@ -269,20 +278,18 @@ async def _select_existing_skills(
             cluster_id=cluster_id,
             md_count=len(md_skills),
         )
-        selected_fms = md_skills[:MAX_SKILLS_IN_PROMPT]
+        selected = md_skills[:MAX_SKILLS_IN_PROMPT]
 
-    return await _hydrate_algo_skills(
-        selected_fms, agent_id=agent_id, app_id=app_id, project_id=project_id
-    )
+    return [_md_to_algo_skill(fm, body) for fm, body in selected]
 
 
 async def _rank_skills_by_relevance(
-    md_skills: list[AgentSkillFrontmatter],
+    md_skills: list[tuple[AgentSkillFrontmatter, str]],
     *,
     agent_id: str,
     cluster_id: str,
     case_vector: list[float],
-) -> list[AgentSkillFrontmatter]:
+) -> list[tuple[AgentSkillFrontmatter, str]]:
     """Ask LanceDB to rank the md skills by cosine relevance, capped at K.
 
     LanceDB is used purely as a ranking index here, never as the
@@ -291,59 +298,27 @@ async def _rank_skills_by_relevance(
     skill LanceDB didn't return (also stale index) is appended in
     arbitrary order so no skill is silently dropped from the prompt.
     """
-    md_by_name = {fm.name: fm for fm in md_skills}
+    md_by_name = {fm.name: (fm, body) for fm, body in md_skills}
     ranked_lance = await agent_skill_repo.find_topk_relevant_in_cluster(
         owner_id=agent_id,
         cluster_id=cluster_id,
         query_vector=case_vector,
         top_k=MAX_SKILLS_IN_PROMPT,
     )
-    selected: list[AgentSkillFrontmatter] = []
+    selected: list[tuple[AgentSkillFrontmatter, str]] = []
     seen_names: set[str] = set()
     for lance_row in ranked_lance:
-        fm = md_by_name.get(lance_row.name)
-        if fm is not None and fm.name not in seen_names:
-            selected.append(fm)
-            seen_names.add(fm.name)
-    for fm in md_skills:
+        pair = md_by_name.get(lance_row.name)
+        if pair is not None and pair[0].name not in seen_names:
+            selected.append(pair)
+            seen_names.add(pair[0].name)
+    for fm, body in md_skills:
         if fm.name not in seen_names and len(selected) < MAX_SKILLS_IN_PROMPT:
-            selected.append(fm)
+            selected.append((fm, body))
             seen_names.add(fm.name)
     return selected
 
 
-async def _hydrate_algo_skills(
-    frontmatters: list[AgentSkillFrontmatter],
-    *,
-    agent_id: str,
-    app_id: str,
-    project_id: str,
-) -> list[AlgoAgentSkill]:
-    """Re-read each selected skill's body and project it onto the algo type.
-
-    A second read (rather than reusing the frontmatter-only rows from
-    ``list_by_cluster``) is needed because ``content`` must carry the
-    real skill body — see :func:`_md_to_algo_skill`. A skill deleted
-    between the enumeration and this read is skipped rather than
-    raising; the next run will simply not see it.
-    """
-    reader = _get_reader()
-    algo_skills: list[AlgoAgentSkill] = []
-    for fm in frontmatters:
-        result = await reader.read_main(
-            agent_id,
-            fm.name,
-            schema=AgentSkillFrontmatter,
-            app_id=app_id,
-            project_id=project_id,
-        )
-        if result is None:
-            continue
-        fresh_fm, body = result
-        algo_skills.append(_md_to_algo_skill(fresh_fm, body))
-    return algo_skills
-
-
 async def _select_supporting_cases(
     skills: list[AlgoAgentSkill],
     *,
 
@@ -78,7 +78,6 @@
 @pytest.fixture(autouse=True)
 def _opt_in_real_embedding(
     _reset_embedding_capability_singleton: None,
-    _reset_rerank_capability_singleton: None,
 ) -> Iterator[None]:
     """Opt this module's test into a real embedding capability.
 
@@ -93,15 +92,13 @@ def _opt_in_real_embedding(
     Scoped to this file only (not the global fixture) so every other
     test keeps its hermetic default.
 
-    Requesting both ``_reset_embedding_capability_singleton`` and
-    ``_reset_rerank_capability_singleton`` as parameters — rather than
-    relying on collection/declaration order between this file's conftest
-    chain and the root conftest — makes pytest's dependency graph
-    guarantee this fixture's setup runs after both and its teardown before
-    either. This fixture does not touch the rerank capability's value
-    (see the module docstring for why); the rerank fixture is requested
-    purely for that ordering guarantee, not because this fixture opts
-    rerank in.
+    Requesting ``_reset_embedding_capability_singleton`` as a parameter
+    — rather than relying on collection/declaration order between this
+    file's conftest chain and the root conftest — makes pytest's
+    dependency graph guarantee this fixture's setup runs after it and its
+    teardown before it. Rerank is left untouched (see the module
+    docstring): this fixture reads and writes only the embedding
+    capability, so there is nothing to order it against.
 
     Setting ``_capability = None`` (rather than constructing a capability
     object directly) makes the accessor rebuild lazily from
 
@@ -93,6 +93,28 @@ def test_nfc_normalizes_decomposed_accents() -> None:
     assert sanitized_nfc == sanitized_nfd == "café"
 
 
+def test_nfc_does_not_help_composition_exclusions() -> None:
+    """Pins the documented exception: for Unicode "composition exclusion"
+    codepoints, NFC normalization does not help — it decomposes an
+    already-precomposed character, and the resulting combining mark is
+    stripped either way.
+
+    U+0958 / U+0959 (Devanagari letters formed from a base letter + nukta)
+    are composition exclusions: their canonical decomposition is excluded
+    from NFC recomposition, so ``normalize("NFC", precomposed)`` yields the
+    *decomposed* form, not the precomposed one.
+    """
+    precomposed = "क़ख़"
+    assert unicodedata.normalize("NFC", precomposed) != precomposed
+
+    sanitized = sanitize_dirname(precomposed, fallback="unnamed")
+
+    # The nukta (combining mark, U+093C) is lost: NFC decomposes the
+    # precomposed input into base + nukta, and the nukta is then stripped
+    # (not \w) -- the opposite of what NFC does for an ordinary NFD accent.
+    assert sanitized == "कख"
+
+
 def test_cjk_and_space_input_preserved_readably() -> None:
     raw = "修复 Django 自动重载问题"
     sanitized = sanitize_dirname(raw, fallback="unnamed")