@aiwayds/dsh-topics-memory 0.16.1-next.1 → 0.17.1

package/lib/commands.js

@@ -112,6 +112,35 @@ async function renderStatus(service) {
         const gc = typeof lastRun.gcDropped === 'number' && lastRun.gcDropped > 0 ? `，GC 回收 ${lastRun.gcDropped}` : '';
         rows.push(['最近蒸馏', `${outcome}${gc} @ ${cell(String(lastRun.at ?? '').slice(0, 19).replace('T', ' '))}`]);
     }
+    // Fast-lane heartbeat (0.17.0): pair "observer lane recorded recently"
+    // with "no injection round for >48h" — exactly the asymmetry a silent
+    // fast-lane death produces (the 0.1.5-rc.2 claim-order incident shape).
+    // With autoInject off there is no fast lane to be stale.
+    if (cfg.autoInject) {
+        const HOUR = 3_600_000;
+        const hb = await service.store.readLaneHeartbeat();
+        const stamp = (iso) => cell(iso.slice(0, 19).replace('T', ' '));
+        const ago = (ms) => {
+            const h = ms / HOUR;
+            if (!Number.isFinite(h))
+                return '';
+            return h < 1 ? `${Math.max(1, Math.round(h * 60))} 分钟前` : h < 48 ? `${Math.round(h)}h 前` : `${Math.round(h / 24)} 天前`;
+        };
+        const lastAt = hb.lastInjectionAt;
+        const fastIdleMs = lastAt !== undefined ? Date.now() - Date.parse(lastAt) : Number.POSITIVE_INFINITY;
+        const obsAgeMs = hb.lastObservationAt !== undefined ? Date.now() - Date.parse(hb.lastObservationAt) : Number.POSITIVE_INFINITY;
+        const obsRecent = obsAgeMs < 24 * HOUR;
+        if (lastAt === undefined) {
+            rows.push(['快道心跳', obsRecent ? `⚠️ 从未注入，但观察 lane ${ago(obsAgeMs)}仍在记录——快道疑似静默死亡` : '从未注入']);
+        }
+        else if (fastIdleMs > 48 * HOUR && obsRecent) {
+            rows.push(['快道心跳', `⚠️ ${stamp(lastAt)}（${ago(fastIdleMs)}）无注入轮次，而观察 lane ${ago(obsAgeMs)}仍在记录——快道疑似静默死亡`]);
+        }
+        else {
+            const since = ago(fastIdleMs);
+            rows.push(['快道心跳', `${stamp(lastAt)}${since === '' ? '' : `（${since}）`}`]);
+        }
+    }
     const lastConsolidate = await service.store.readConsolidateState();
     if (lastConsolidate !== undefined) {
         const count = (v) => (Array.isArray(v) ? v.length : 0);

package/lib/index.d.ts

@@ -17,6 +17,74 @@ export declare function settleBounded(p: Promise<unknown> | undefined, ms: numbe
 /** Services consumed at apply time; llm joins via guarded ctx.inject, and the
  *  skills registry serves the bundled usage/config guide. */
 export declare const inject: string[];
+/** A firehose event as the replay path reads it: envelope fields only. */
+export interface InboxEventLike {
+    seq?: unknown;
+    type?: unknown;
+    data?: unknown;
+}
+/** The pending-inbox projection replayed from a session-log prefix. */
+export interface PendingInboxWindow {
+    'next-turn': readonly unknown[];
+    'next-step': readonly unknown[];
+}
+/**
+ * Fold a session-log prefix into the pending-inbox projection state.
+ * Coordinates in the log are already normalize-at-append (dsh-agent-loop
+ * clamps start/deleteCount before appending), so each entry applies as a
+ * plain toSpliced. Events at or past `upToSeqExclusive` are ignored — pass
+ * the current splice's own seq to fold everything BEFORE it. Returns
+ * undefined when any entry is malformed enough to break the fold (the
+ * caller degrades to the projection read, as before).
+ */
+export declare function replayPendingInbox(events: readonly InboxEventLike[], upToSeqExclusive: number): PendingInboxWindow | undefined;
+/**
+ * Claimed-text extraction, shared verbatim by the projection read and the
+ * log replay: user-kind messages only, text blocks joined per message —
+ * the pre-0.17.0 splice-window semantics.
+ */
+export declare function claimedUserText(messages: readonly unknown[]): string;
+/** Where the resolved claimed text actually came from (see resolveClaimedText). */
+export type ClaimedTextSource = 'log-replay' | 'projection';
+export interface ClaimedTextResolution {
+    text: string;
+    source: ClaimedTextSource;
+}
+/**
+ * Resolve the claimed text for one splice, ordering the two sources by
+ * authority (review CONCERN A, 0.17.1):
+ *
+ * 1. Session-log replay — preferred UNCONDITIONALLY whenever the event
+ *    carries a seq and a log prefix is available. The fold reproduces the
+ *    pre-splice window the claim coordinates (start/removedCount) are
+ *    defined against, so it is immune to handler order AND to the backlog
+ *    misalignment: with ≥2 pending messages the post-splice projection
+ *    read is NON-empty but shifted by one (a claim of msg1 would read
+ *    msg2's residual text), which the 0.17.0 empty-projection-only gating
+ *    missed. The replay verdict is FINAL — when the fold succeeds the
+ *    projection is not consulted, even if the replayed slice comes back
+ *    empty (the pre-splice window genuinely held no user text).
+ * 2. Projection read — the fallback for hosts where the replay cannot arm
+ *    (no event.seq on the firehose, or snapshotEvents unreachable/failed).
+ *    Pre-0.1.5 live dispatch precedes the mutation, so this read yields
+ *    the pre-splice window, as it always did.
+ *
+ * `source` names the source that ACTUALLY produced the returned text
+ * (review CONCERN B): 'log-replay' whenever the replay supplied the
+ * verdict (empty included), 'projection' only when the fallback did (or
+ * the replay never armed).
+ */
+export declare function resolveClaimedText(input: {
+    /** The pending window as read at handler time (post-splice on 0.1.5+). */
+    projection: readonly unknown[];
+    /** Session-log prefix up to (excluding) `seq`, or undefined when unreachable. */
+    logEvents: readonly InboxEventLike[] | undefined;
+    /** The splice event's own seq — a number marks a replay-capable host. */
+    seq: unknown;
+    target: 'next-turn' | 'next-step';
+    start: number;
+    removedCount: number;
+}): ClaimedTextResolution;
 /**
  * Settings-provider surface the legacy-namespace migration needs. Structurally
  * typed like every other host seam in this file, so bare test harnesses

package/lib/index.js

@@ -62,6 +62,98 @@ export function settleBounded(p, ms) {
 /** Services consumed at apply time; llm joins via guarded ctx.inject, and the
  *  skills registry serves the bundled usage/config guide. */
 export const inject = ['systemPrompt', 'tools', 'settings', 'agents', 'llm', 'skills'];
+/**
+ * Fold a session-log prefix into the pending-inbox projection state.
+ * Coordinates in the log are already normalize-at-append (dsh-agent-loop
+ * clamps start/deleteCount before appending), so each entry applies as a
+ * plain toSpliced. Events at or past `upToSeqExclusive` are ignored — pass
+ * the current splice's own seq to fold everything BEFORE it. Returns
+ * undefined when any entry is malformed enough to break the fold (the
+ * caller degrades to the projection read, as before).
+ */
+export function replayPendingInbox(events, upToSeqExclusive) {
+    const window = { 'next-turn': [], 'next-step': [] };
+    try {
+        for (const event of events) {
+            const seq = event.seq;
+            if (typeof seq === 'number' && seq >= upToSeqExclusive)
+                break;
+            if (event.type !== 'agent/inbox/spliced')
+                continue;
+            const splice = event.data;
+            if (splice === null || typeof splice !== 'object')
+                continue;
+            const target = splice.target ?? 'next-turn';
+            if (target !== 'next-turn' && target !== 'next-step')
+                continue;
+            const start = Math.trunc(splice.start);
+            const removedCount = Math.trunc(splice.removedCount ?? 0);
+            if (!Number.isFinite(start) || !Number.isFinite(removedCount) || start < 0 || removedCount < 0)
+                continue;
+            window[target] = window[target].toSpliced(start, removedCount, ...(splice.inserted ?? []));
+        }
+    }
+    catch {
+        return undefined;
+    }
+    return window;
+}
+/**
+ * Claimed-text extraction, shared verbatim by the projection read and the
+ * log replay: user-kind messages only, text blocks joined per message —
+ * the pre-0.17.0 splice-window semantics.
+ */
+export function claimedUserText(messages) {
+    let claimedText = '';
+    for (const message of messages) {
+        const data = message;
+        if (data === null || typeof data !== 'object' || data.source?.kind !== 'user')
+            continue;
+        const text = textOf(data);
+        if (text.trim() !== '')
+            claimedText = claimedText === '' ? text : `${claimedText}\n${text}`;
+    }
+    return claimedText;
+}
+/**
+ * Resolve the claimed text for one splice, ordering the two sources by
+ * authority (review CONCERN A, 0.17.1):
+ *
+ * 1. Session-log replay — preferred UNCONDITIONALLY whenever the event
+ *    carries a seq and a log prefix is available. The fold reproduces the
+ *    pre-splice window the claim coordinates (start/removedCount) are
+ *    defined against, so it is immune to handler order AND to the backlog
+ *    misalignment: with ≥2 pending messages the post-splice projection
+ *    read is NON-empty but shifted by one (a claim of msg1 would read
+ *    msg2's residual text), which the 0.17.0 empty-projection-only gating
+ *    missed. The replay verdict is FINAL — when the fold succeeds the
+ *    projection is not consulted, even if the replayed slice comes back
+ *    empty (the pre-splice window genuinely held no user text).
+ * 2. Projection read — the fallback for hosts where the replay cannot arm
+ *    (no event.seq on the firehose, or snapshotEvents unreachable/failed).
+ *    Pre-0.1.5 live dispatch precedes the mutation, so this read yields
+ *    the pre-splice window, as it always did.
+ *
+ * `source` names the source that ACTUALLY produced the returned text
+ * (review CONCERN B): 'log-replay' whenever the replay supplied the
+ * verdict (empty included), 'projection' only when the fallback did (or
+ * the replay never armed).
+ */
+export function resolveClaimedText(input) {
+    if (typeof input.seq === 'number' && input.logEvents !== undefined) {
+        const window = replayPendingInbox(input.logEvents, input.seq);
+        if (window !== undefined) {
+            return {
+                text: claimedUserText(window[input.target].slice(input.start, input.start + input.removedCount)),
+                source: 'log-replay',
+            };
+        }
+    }
+    return {
+        text: claimedUserText(input.projection.slice(input.start, input.start + input.removedCount)),
+        source: 'projection',
+    };
+}
 // dsh-settings 0.1.2-alpha.3 removed the runtime settingsNamespace() helper:
 // register() now brand-checks the namespace at the type level
 // (SettingsNamespaceInput) and validates the same lowercase-hyphenated
@@ -217,6 +309,22 @@ export function apply(ctx) {
     // fail-open, idempotent — see migrateLegacySettings). Fire-and-forget: the
     // write settles on its own; a rejection only skips the migration.
     void migrateLegacySettings(settingsNs, warn);
+    // Low-noise observability for the fast lane's early exits. The 2026-09-21
+    // silent-death incident (0.1.5-rc.2 claim order) died precisely because
+    // every exit path was silent: the injected log stayed empty for weeks
+    // while the observer kept recording. First occurrence warns immediately;
+    // repeats batch into one count line per SILENT_EXIT_LOG_EVERY occurrences.
+    // DSH_TOPICS_DEBUG=1 logs every single one for bench debugging.
+    const SILENT_EXIT_LOG_EVERY = 50;
+    const debugVerbose = process.env.DSH_TOPICS_DEBUG === '1';
+    const silentExitCounts = new Map();
+    const silentExit = (key, detail) => {
+        const n = (silentExitCounts.get(key) ?? 0) + 1;
+        silentExitCounts.set(key, n);
+        if (debugVerbose || n === 1 || n % SILENT_EXIT_LOG_EVERY === 0) {
+            warn(`dsh-topics-memory 快道本轮未触发（${key}，累计 ${n} 次）：${detail}`);
+        }
+    };
     const cfgNow = () => {
         const v = scope.get();
         // Schema defaults may not be applied by bare test harnesses; fill them in.
@@ -281,6 +389,15 @@ export function apply(ctx) {
                 }
             }
             const r = service.retrieveSync(query, sessionId, seen === undefined && echo === undefined ? undefined : { exclude: seen, echo }, slow, slowExpired);
+            // The service-layer early exit (empty roster — e.g. a probe home with
+            // no topics seeded) writes NO injection record and used to be fully
+            // silent (the P8 early-exit the incident audit enumerated). autoInject
+            // off never reaches here (the spliced branch gates it) and an empty
+            // query is pre-filtered by the empty-claimed exit, so rosterSize 0 on
+            // this path means exactly "roster empty".
+            if (r.outcome.rosterSize === 0) {
+                silentExit('no-roster', 'roster 为空（topics 库 0 条）——service 层早退，本轮不写 ilog 记录');
+            }
             // Mark only what entered the context this round (hits AND slow picks →
             // dedup filter → assemble → registry mark; budget-dropped slugs stay
             // injectable).
@@ -466,11 +583,18 @@ export function apply(ctx) {
             if (!cfgNow().autoInject)
                 return;
             const splice = event.data;
-            if (!splice.removedCount || splice.outcome === 'canceled')
+            // A canceled claim is routine host flow (inbox cancel/remove), not a
+            // fault signal — it only logs under DSH_TOPICS_DEBUG, never warns.
+            if (!splice.removedCount || splice.outcome === 'canceled') {
+                if (debugVerbose)
+                    silentExit('canceled', `target=${String(splice.target)} removedCount=${String(splice.removedCount)} outcome=${String(splice.outcome)}`);
                 return;
+            }
             const agent = agents()?.get(session.id);
-            if (agent === undefined)
+            if (agent === undefined) {
+                silentExit('agent-missing', `agents() 无此会话 ${sessionId}——快道文本无法定位`);
                 return;
+            }
             // The agent-scoped context carries the llm instance this agent's own
             // loop streams through (adapters included) — capture it while alive.
             try {
@@ -481,24 +605,41 @@ export function apply(ctx) {
             catch {
                 // scope already unwinding — the root fallback stays
             }
-            const list = ((splice.target ?? 'next-turn') === 'next-step' ? agent.inbox.nextStep : agent.inbox.nextTurn);
-            // Live dispatch precedes projection mutation: read the pre-splice window.
-            const claimed = list.slice(splice.start, splice.start + splice.removedCount);
-            let claimedText = '';
-            for (const message of claimed) {
-                if (message.source?.kind !== 'user')
-                    continue;
-                const text = textOf(message);
-                if (text.trim() !== '')
-                    claimedText = claimedText === '' ? text : `${claimedText}\n${text}`;
+            const target = (splice.target ?? 'next-turn') === 'next-step' ? 'next-step' : 'next-turn';
+            const list = (target === 'next-step' ? agent.inbox.nextStep : agent.inbox.nextTurn);
+            // Authority — session-log replay (resolveClaimedText, CONCERN A):
+            // whenever the event carries a seq, the fold runs FIRST and its
+            // verdict is final — with ≥2 pending messages the post-splice
+            // projection read is non-empty but shifted by one, so gating the
+            // replay on an empty projection would claim msg1 and read msg2.
+            const seq = event.seq;
+            let logEvents;
+            if (typeof seq === 'number') {
+                try {
+                    const snapshot = session.snapshotEvents;
+                    if (typeof snapshot === 'function')
+                        logEvents = snapshot.call(session, 0, seq);
+                }
+                catch {
+                    // contained — the projection fallback inside resolveClaimedText
+                    // stays the verdict
+                }
             }
-            if (claimedText.trim() === '')
+            const claimed = resolveClaimedText({ projection: list, logEvents, seq, target, start: splice.start, removedCount: splice.removedCount });
+            if (claimed.text.trim() === '') {
+                // claimed.source names where the (empty) verdict actually came
+                // from (CONCERN B): 'log-replay' = the fold ran and the pre-splice
+                // window genuinely held no user text; 'projection' = the replay
+                // never armed (no seq / snapshotEvents unreachable) and the
+                // projection read was empty too.
+                silentExit(`empty-claimed/${claimed.source}`, `target=${target} start=${String(splice.start)} removedCount=${String(splice.removedCount)}——被 claim 窗口重建后仍无用户文本`);
                 return;
+            }
             const state = turns.get(sessionId) ?? { claimedText: '', injectionText: '' };
-            state.claimedText = claimedText;
+            state.claimedText = claimed.text;
             state.injectionText = '';
             turns.set(sessionId, state);
-            retrieveForTurn(sessionId, claimedText);
+            retrieveForTurn(sessionId, claimed.text);
             return;
         }
         if (event.type === 'turn/start') {

package/lib/store.d.ts

@@ -61,6 +61,19 @@ export declare class BundleStore {
     topicPath(slug: string): string;
     private observationsPath;
     private injectionsPath;
+    /**
+     * Fast-lane heartbeat (0.17.0): tail timestamps of the two lane sidecars —
+     * the last injection round (`injections.jsonl`) and the last observation
+     * (`observations.jsonl`). Feeds the /topics status stale check that makes
+     * "observer still recording, injection lane silently dead" visible within
+     * a day instead of weeks (the 0.1.5-rc.2 claim-order incident shape).
+     * Full-file reads are fine here: /topics status is interactive and both
+     * logs are append-per-round small; unreadable logs degrade to undefined.
+     */
+    readLaneHeartbeat(): Promise<{
+        lastInjectionAt?: string;
+        lastObservationAt?: string;
+    }>;
     private conflictsPath;
     private distillStatePath;
     /** Last distill-lane run outcome (diagnostics for /topics status and e2e). */

package/lib/store.js

@@ -74,6 +74,31 @@ export class BundleStore {
     injectionsPath() {
         return join(this.metaDir(), 'injections.jsonl');
     }
+    /**
+     * Fast-lane heartbeat (0.17.0): tail timestamps of the two lane sidecars —
+     * the last injection round (`injections.jsonl`) and the last observation
+     * (`observations.jsonl`). Feeds the /topics status stale check that makes
+     * "observer still recording, injection lane silently dead" visible within
+     * a day instead of weeks (the 0.1.5-rc.2 claim-order incident shape).
+     * Full-file reads are fine here: /topics status is interactive and both
+     * logs are append-per-round small; unreadable logs degrade to undefined.
+     */
+    async readLaneHeartbeat() {
+        const tailAt = async (file) => {
+            try {
+                const lines = (await readFile(file, 'utf8')).trimEnd().split('\n');
+                const at = JSON.parse(lines.at(-1) ?? '').at;
+                return typeof at === 'string' ? at : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        };
+        return {
+            lastInjectionAt: await tailAt(this.injectionsPath()),
+            lastObservationAt: await tailAt(this.observationsPath()),
+        };
+    }
     conflictsPath() {
         return join(this.metaDir(), 'conflicts.json');
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwayds/dsh-topics-memory",
-  "version": "0.16.1-next.1",
+  "version": "0.17.1",
   "description": "dsh-plugin: quality-first topic memory for dsh — a topic keeps the starting question, conclusion, impact and dependencies, not the process; local-first git-traced OKF bundle, budgeted LLM-free injection",
   "type": "module",
   "main": "lib/index.js",
@@ -39,7 +39,7 @@
     "build": "tsc -p tsconfig.json",
     "check": "tsc --noEmit -p tsconfig.json",
     "pretest": "tsc -p tsconfig.json",
-    "test": "node --test test/yaml.test.mjs test/okf.test.mjs test/retrieval.test.mjs test/digest.test.mjs test/ilog.test.mjs test/store.test.mjs test/paths.test.mjs test/git.test.mjs test/sync.test.mjs test/tools.test.mjs test/dedup.test.mjs test/commands.test.mjs test/onboard.test.mjs test/delegation.test.mjs test/observer.test.mjs test/distill.test.mjs test/consolidate.test.mjs test/viz.test.mjs test/corpus.test.mjs test/llm-scope.test.mjs test/settings-migration.test.mjs test/quality.test.mjs test/replay-gate.test.mjs test/depends-repair.test.mjs test/skill.test.mjs",
+    "test": "node --test test/yaml.test.mjs test/okf.test.mjs test/retrieval.test.mjs test/digest.test.mjs test/ilog.test.mjs test/store.test.mjs test/paths.test.mjs test/git.test.mjs test/sync.test.mjs test/tools.test.mjs test/dedup.test.mjs test/commands.test.mjs test/onboard.test.mjs test/delegation.test.mjs test/observer.test.mjs test/distill.test.mjs test/consolidate.test.mjs test/viz.test.mjs test/corpus.test.mjs test/llm-scope.test.mjs test/settings-migration.test.mjs test/quality.test.mjs test/replay-gate.test.mjs test/depends-repair.test.mjs test/skill.test.mjs test/fast-lane.test.mjs",
     "smoke": "node scripts/smoke-boot.mjs"
   },
   "dependencies": {},

package/src/commands.ts

@@ -149,6 +149,32 @@ async function renderStatus(service: TopicsService): Promise<string> {
     const gc = typeof lastRun.gcDropped === 'number' && lastRun.gcDropped > 0 ? `，GC 回收 ${lastRun.gcDropped}` : ''
     rows.push(['最近蒸馏', `${outcome}${gc} @ ${cell(String(lastRun.at ?? '').slice(0, 19).replace('T', ' '))}`])
   }
+  // Fast-lane heartbeat (0.17.0): pair "observer lane recorded recently"
+  // with "no injection round for >48h" — exactly the asymmetry a silent
+  // fast-lane death produces (the 0.1.5-rc.2 claim-order incident shape).
+  // With autoInject off there is no fast lane to be stale.
+  if (cfg.autoInject) {
+    const HOUR = 3_600_000
+    const hb = await service.store.readLaneHeartbeat()
+    const stamp = (iso: string): string => cell(iso.slice(0, 19).replace('T', ' '))
+    const ago = (ms: number): string => {
+      const h = ms / HOUR
+      if (!Number.isFinite(h)) return ''
+      return h < 1 ? `${Math.max(1, Math.round(h * 60))} 分钟前` : h < 48 ? `${Math.round(h)}h 前` : `${Math.round(h / 24)} 天前`
+    }
+    const lastAt = hb.lastInjectionAt
+    const fastIdleMs = lastAt !== undefined ? Date.now() - Date.parse(lastAt) : Number.POSITIVE_INFINITY
+    const obsAgeMs = hb.lastObservationAt !== undefined ? Date.now() - Date.parse(hb.lastObservationAt) : Number.POSITIVE_INFINITY
+    const obsRecent = obsAgeMs < 24 * HOUR
+    if (lastAt === undefined) {
+      rows.push(['快道心跳', obsRecent ? `⚠️ 从未注入，但观察 lane ${ago(obsAgeMs)}仍在记录——快道疑似静默死亡` : '从未注入'])
+    } else if (fastIdleMs > 48 * HOUR && obsRecent) {
+      rows.push(['快道心跳', `⚠️ ${stamp(lastAt)}（${ago(fastIdleMs)}）无注入轮次，而观察 lane ${ago(obsAgeMs)}仍在记录——快道疑似静默死亡`])
+    } else {
+      const since = ago(fastIdleMs)
+      rows.push(['快道心跳', `${stamp(lastAt)}${since === '' ? '' : `（${since}）`}`])
+    }
+  }
   const lastConsolidate = await service.store.readConsolidateState()
   if (lastConsolidate !== undefined) {
     const count = (v: unknown): number => (Array.isArray(v) ? v.length : 0)

package/src/index.ts

@@ -86,6 +86,154 @@ export function settleBounded(p: Promise<unknown> | undefined, ms: number): Prom
  *  skills registry serves the bundled usage/config guide. */
 export const inject = ['systemPrompt', 'tools', 'settings', 'agents', 'llm', 'skills']
 
+// ---- Fast-lane claim-text rebuild from the session log (0.17.0/0.17.1) ----
+//
+// dsh 0.1.5-rc.2's SessionProjectionRegistry registers its eager inbox drive
+// at session/event hooksOrder[0]; every later handler — this plugin sits at
+// [10] — observes the projection AFTER the current splice was applied, so the
+// pre-0.1.5 contract "live dispatch precedes projection mutation" is gone and
+// the projection read at `agent/inbox/spliced` time yields the post-splice
+// window. 0.17.0 armed the replay only when that read came back empty —
+// which still mis-fired with ≥2 pending messages (review CONCERN A): the
+// post-splice projection is NON-empty but shifted by one, so a claim of msg1
+// read msg2's residual text and the replay never armed. Since 0.17.1 the
+// replay is the UNCONDITIONAL first source whenever event.seq exists:
+// dsh-agent-loop's InboxProjector funnels every append/prepend/replace/
+// remove/claim/cancel through mutate(), and mutate() appends each normalized
+// splice — target, clamped coordinates, AND the full inserted messages — to
+// the session log as `agent/inbox/spliced`. Folding that log prefix up to
+// (excluding) the current event's seq reproduces the exact pre-splice pending
+// window — the very coordinates the claim is defined against — with zero
+// dependence on dispatch order. The projection read survives only as the
+// fallback for hosts whose events carry no seq (or whose session object
+// exposes no snapshotEvents).
+
+/** A firehose event as the replay path reads it: envelope fields only. */
+export interface InboxEventLike {
+  seq?: unknown
+  type?: unknown
+  data?: unknown
+}
+
+/** The pending-inbox projection replayed from a session-log prefix. */
+export interface PendingInboxWindow {
+  'next-turn': readonly unknown[]
+  'next-step': readonly unknown[]
+}
+
+/** One `agent/inbox/spliced` log entry (shape per dsh-agent-loop mutate()). */
+interface InboxSpliceData {
+  target?: string
+  start: number
+  removedCount?: number
+  inserted?: readonly unknown[]
+}
+
+/**
+ * Fold a session-log prefix into the pending-inbox projection state.
+ * Coordinates in the log are already normalize-at-append (dsh-agent-loop
+ * clamps start/deleteCount before appending), so each entry applies as a
+ * plain toSpliced. Events at or past `upToSeqExclusive` are ignored — pass
+ * the current splice's own seq to fold everything BEFORE it. Returns
+ * undefined when any entry is malformed enough to break the fold (the
+ * caller degrades to the projection read, as before).
+ */
+export function replayPendingInbox(events: readonly InboxEventLike[], upToSeqExclusive: number): PendingInboxWindow | undefined {
+  const window: { 'next-turn': unknown[]; 'next-step': unknown[] } = { 'next-turn': [], 'next-step': [] }
+  try {
+    for (const event of events) {
+      const seq = event.seq
+      if (typeof seq === 'number' && seq >= upToSeqExclusive) break
+      if (event.type !== 'agent/inbox/spliced') continue
+      const splice = event.data as InboxSpliceData | null | undefined
+      if (splice === null || typeof splice !== 'object') continue
+      const target = splice.target ?? 'next-turn'
+      if (target !== 'next-turn' && target !== 'next-step') continue
+      const start = Math.trunc(splice.start)
+      const removedCount = Math.trunc(splice.removedCount ?? 0)
+      if (!Number.isFinite(start) || !Number.isFinite(removedCount) || start < 0 || removedCount < 0) continue
+      window[target] = window[target].toSpliced(start, removedCount, ...(splice.inserted ?? []))
+    }
+  } catch {
+    return undefined
+  }
+  return window
+}
+
+/**
+ * Claimed-text extraction, shared verbatim by the projection read and the
+ * log replay: user-kind messages only, text blocks joined per message —
+ * the pre-0.17.0 splice-window semantics.
+ */
+export function claimedUserText(messages: readonly unknown[]): string {
+  let claimedText = ''
+  for (const message of messages) {
+    const data = message as UserMessageData | null | undefined
+    if (data === null || typeof data !== 'object' || data.source?.kind !== 'user') continue
+    const text = textOf(data as UserMessageLike)
+    if (text.trim() !== '') claimedText = claimedText === '' ? text : `${claimedText}\n${text}`
+  }
+  return claimedText
+}
+
+/** Where the resolved claimed text actually came from (see resolveClaimedText). */
+export type ClaimedTextSource = 'log-replay' | 'projection'
+
+export interface ClaimedTextResolution {
+  text: string
+  source: ClaimedTextSource
+}
+
+/**
+ * Resolve the claimed text for one splice, ordering the two sources by
+ * authority (review CONCERN A, 0.17.1):
+ *
+ * 1. Session-log replay — preferred UNCONDITIONALLY whenever the event
+ *    carries a seq and a log prefix is available. The fold reproduces the
+ *    pre-splice window the claim coordinates (start/removedCount) are
+ *    defined against, so it is immune to handler order AND to the backlog
+ *    misalignment: with ≥2 pending messages the post-splice projection
+ *    read is NON-empty but shifted by one (a claim of msg1 would read
+ *    msg2's residual text), which the 0.17.0 empty-projection-only gating
+ *    missed. The replay verdict is FINAL — when the fold succeeds the
+ *    projection is not consulted, even if the replayed slice comes back
+ *    empty (the pre-splice window genuinely held no user text).
+ * 2. Projection read — the fallback for hosts where the replay cannot arm
+ *    (no event.seq on the firehose, or snapshotEvents unreachable/failed).
+ *    Pre-0.1.5 live dispatch precedes the mutation, so this read yields
+ *    the pre-splice window, as it always did.
+ *
+ * `source` names the source that ACTUALLY produced the returned text
+ * (review CONCERN B): 'log-replay' whenever the replay supplied the
+ * verdict (empty included), 'projection' only when the fallback did (or
+ * the replay never armed).
+ */
+export function resolveClaimedText(input: {
+  /** The pending window as read at handler time (post-splice on 0.1.5+). */
+  projection: readonly unknown[]
+  /** Session-log prefix up to (excluding) `seq`, or undefined when unreachable. */
+  logEvents: readonly InboxEventLike[] | undefined
+  /** The splice event's own seq — a number marks a replay-capable host. */
+  seq: unknown
+  target: 'next-turn' | 'next-step'
+  start: number
+  removedCount: number
+}): ClaimedTextResolution {
+  if (typeof input.seq === 'number' && input.logEvents !== undefined) {
+    const window = replayPendingInbox(input.logEvents, input.seq)
+    if (window !== undefined) {
+      return {
+        text: claimedUserText(window[input.target].slice(input.start, input.start + input.removedCount)),
+        source: 'log-replay',
+      }
+    }
+  }
+  return {
+    text: claimedUserText(input.projection.slice(input.start, input.start + input.removedCount)),
+    source: 'projection',
+  }
+}
+
 // dsh-settings 0.1.2-alpha.3 removed the runtime settingsNamespace() helper:
 // register() now brand-checks the namespace at the type level
 // (SettingsNamespaceInput) and validates the same lowercase-hyphenated
@@ -105,6 +253,10 @@ interface AgentMapLike {
 interface SessionEvent {
   type: string
   data: unknown
+  /** Log sequence number, present on hosts whose firehose carries appended
+   * events (dsh 0.1.5+). The fast-lane log replay keys on it; absent on
+   * older hosts, where the replay simply never arms. */
+  seq?: number
 }
 
 interface UserMessageData {
@@ -274,6 +426,22 @@ export function apply(ctx: Context): void {
   // fail-open, idempotent — see migrateLegacySettings). Fire-and-forget: the
   // write settles on its own; a rejection only skips the migration.
   void migrateLegacySettings(settingsNs as unknown as SettingsNsLike, warn)
+  // Low-noise observability for the fast lane's early exits. The 2026-09-21
+  // silent-death incident (0.1.5-rc.2 claim order) died precisely because
+  // every exit path was silent: the injected log stayed empty for weeks
+  // while the observer kept recording. First occurrence warns immediately;
+  // repeats batch into one count line per SILENT_EXIT_LOG_EVERY occurrences.
+  // DSH_TOPICS_DEBUG=1 logs every single one for bench debugging.
+  const SILENT_EXIT_LOG_EVERY = 50
+  const debugVerbose = process.env.DSH_TOPICS_DEBUG === '1'
+  const silentExitCounts = new Map<string, number>()
+  const silentExit = (key: string, detail: string): void => {
+    const n = (silentExitCounts.get(key) ?? 0) + 1
+    silentExitCounts.set(key, n)
+    if (debugVerbose || n === 1 || n % SILENT_EXIT_LOG_EVERY === 0) {
+      warn(`dsh-topics-memory 快道本轮未触发（${key}，累计 ${n} 次）：${detail}`)
+    }
+  }
   const cfgNow = (): TopicsConfigValue => {
     const v = scope.get() as Partial<TopicsConfigValue> | undefined
     // Schema defaults may not be applied by bare test harnesses; fill them in.
@@ -351,6 +519,15 @@ export function apply(ctx: Context): void {
         }
       }
       const r = service.retrieveSync(query, sessionId, seen === undefined && echo === undefined ? undefined : { exclude: seen, echo }, slow, slowExpired)
+      // The service-layer early exit (empty roster — e.g. a probe home with
+      // no topics seeded) writes NO injection record and used to be fully
+      // silent (the P8 early-exit the incident audit enumerated). autoInject
+      // off never reaches here (the spliced branch gates it) and an empty
+      // query is pre-filtered by the empty-claimed exit, so rosterSize 0 on
+      // this path means exactly "roster empty".
+      if (r.outcome.rosterSize === 0) {
+        silentExit('no-roster', 'roster 为空（topics 库 0 条）——service 层早退，本轮不写 ilog 记录')
+      }
       // Mark only what entered the context this round (hits AND slow picks →
       // dedup filter → assemble → registry mark; budget-dropped slugs stay
       // injectable).
@@ -529,9 +706,17 @@ export function apply(ctx: Context): void {
       if (event.type === 'agent/inbox/spliced') {
       if (!cfgNow().autoInject) return
       const splice = event.data as { target?: string; start: number; removedCount?: number; outcome?: string }
-      if (!splice.removedCount || splice.outcome === 'canceled') return
+      // A canceled claim is routine host flow (inbox cancel/remove), not a
+      // fault signal — it only logs under DSH_TOPICS_DEBUG, never warns.
+      if (!splice.removedCount || splice.outcome === 'canceled') {
+        if (debugVerbose) silentExit('canceled', `target=${String(splice.target)} removedCount=${String(splice.removedCount)} outcome=${String(splice.outcome)}`)
+        return
+      }
       const agent = agents()?.get(session.id)
-      if (agent === undefined) return
+      if (agent === undefined) {
+        silentExit('agent-missing', `agents() 无此会话 ${sessionId}——快道文本无法定位`)
+        return
+      }
       // The agent-scoped context carries the llm instance this agent's own
       // loop streams through (adapters included) — capture it while alive.
       try {
@@ -542,21 +727,41 @@ export function apply(ctx: Context): void {
       } catch {
         // scope already unwinding — the root fallback stays
       }
-      const list = ((splice.target ?? 'next-turn') === 'next-step' ? agent.inbox.nextStep : agent.inbox.nextTurn) as readonly UserMessageLike[]
-      // Live dispatch precedes projection mutation: read the pre-splice window.
-      const claimed = list.slice(splice.start, splice.start + splice.removedCount)
-      let claimedText = ''
-      for (const message of claimed) {
-        if ((message as UserMessageData).source?.kind !== 'user') continue
-        const text = textOf(message as UserMessageLike)
-        if (text.trim() !== '') claimedText = claimedText === '' ? text : `${claimedText}\n${text}`
+      const target = (splice.target ?? 'next-turn') === 'next-step' ? 'next-step' : 'next-turn'
+      const list = (target === 'next-step' ? agent.inbox.nextStep : agent.inbox.nextTurn) as readonly UserMessageLike[]
+      // Authority — session-log replay (resolveClaimedText, CONCERN A):
+      // whenever the event carries a seq, the fold runs FIRST and its
+      // verdict is final — with ≥2 pending messages the post-splice
+      // projection read is non-empty but shifted by one, so gating the
+      // replay on an empty projection would claim msg1 and read msg2.
+      const seq = event.seq
+      let logEvents: readonly InboxEventLike[] | undefined
+      if (typeof seq === 'number') {
+        try {
+          const snapshot = (session as unknown as {
+            snapshotEvents?: (fromSeq?: number, toSeqExclusive?: number) => readonly InboxEventLike[]
+          }).snapshotEvents
+          if (typeof snapshot === 'function') logEvents = snapshot.call(session, 0, seq)
+        } catch {
+          // contained — the projection fallback inside resolveClaimedText
+          // stays the verdict
+        }
+      }
+      const claimed = resolveClaimedText({ projection: list, logEvents, seq, target, start: splice.start, removedCount: splice.removedCount })
+      if (claimed.text.trim() === '') {
+        // claimed.source names where the (empty) verdict actually came
+        // from (CONCERN B): 'log-replay' = the fold ran and the pre-splice
+        // window genuinely held no user text; 'projection' = the replay
+        // never armed (no seq / snapshotEvents unreachable) and the
+        // projection read was empty too.
+        silentExit(`empty-claimed/${claimed.source}`, `target=${target} start=${String(splice.start)} removedCount=${String(splice.removedCount)}——被 claim 窗口重建后仍无用户文本`)
+        return
       }
-      if (claimedText.trim() === '') return
       const state = turns.get(sessionId) ?? { claimedText: '', injectionText: '' }
-      state.claimedText = claimedText
+      state.claimedText = claimed.text
       state.injectionText = ''
       turns.set(sessionId, state)
-      retrieveForTurn(sessionId, claimedText)
+      retrieveForTurn(sessionId, claimed.text)
       return
       }
       if (event.type === 'turn/start') {

package/src/store.ts

@@ -140,6 +140,31 @@ export class BundleStore {
     return join(this.metaDir(), 'injections.jsonl')
   }
 
+  /**
+   * Fast-lane heartbeat (0.17.0): tail timestamps of the two lane sidecars —
+   * the last injection round (`injections.jsonl`) and the last observation
+   * (`observations.jsonl`). Feeds the /topics status stale check that makes
+   * "observer still recording, injection lane silently dead" visible within
+   * a day instead of weeks (the 0.1.5-rc.2 claim-order incident shape).
+   * Full-file reads are fine here: /topics status is interactive and both
+   * logs are append-per-round small; unreadable logs degrade to undefined.
+   */
+  async readLaneHeartbeat(): Promise<{ lastInjectionAt?: string; lastObservationAt?: string }> {
+    const tailAt = async (file: string): Promise<string | undefined> => {
+      try {
+        const lines = (await readFile(file, 'utf8')).trimEnd().split('\n')
+        const at = (JSON.parse(lines.at(-1) ?? '') as { at?: unknown }).at
+        return typeof at === 'string' ? at : undefined
+      } catch {
+        return undefined
+      }
+    }
+    return {
+      lastInjectionAt: await tailAt(this.injectionsPath()),
+      lastObservationAt: await tailAt(this.observationsPath()),
+    }
+  }
+
   private conflictsPath(): string {
     return join(this.metaDir(), 'conflicts.json')
   }