@aiwayds/dsh-topics-memory 0.16.1-next.1 → 0.18.0

package/lib/index.js

@@ -2,7 +2,8 @@
  * dsh-topics-memory — OKF topic memory for DeepSeek Harness.
  *
  * Wiring (per ADR 0001–0008):
- *  - `topics` settings namespace (user-tunable via /topics set)
+ *  - settings page = projection of the plugin `Config` schema, namespace =
+ *    profile entry id `dsh-topics-memory` (user-tunable via /topics set)
  *  - static systemPrompt section teaching the topic tools (never volatile
  *    content — the provider cache prefix stays byte-stable)
  *  - same-turn injection: retrieval runs synchronously at inbox-claim time
@@ -62,68 +63,112 @@ export function settleBounded(p, ms) {
 /** Services consumed at apply time; llm joins via guarded ctx.inject, and the
  *  skills registry serves the bundled usage/config guide. */
 export const inject = ['systemPrompt', 'tools', 'settings', 'agents', 'llm', 'skills'];
-// dsh-settings 0.1.2-alpha.3 removed the runtime settingsNamespace() helper:
-// register() now brand-checks the namespace at the type level
-// (SettingsNamespaceInput) and validates the same lowercase-hyphenated
-// pattern at runtime via parseSettingsNamespace. A plain literal is the
-// supported spelling (same adaptation as dsh-cron / dsh-model-sync).
-const OWN_NS = 'topics';
-/** Pre-rename settings namespace (dsh-llmwiki-memory ≤ 0.5.x). The plugin
- *  itself never writes to it, but while the migration window is open the
- *  registration shows up in config UIs like any other namespace (ADR 0013). */
-const LEGACY_NS = 'llmwiki';
 /**
- * One-time carry-over of user-tuned values from the pre-rename `llmwiki`
- * settings namespace into `topics` (ADR 0013). Constraints:
- * - one-time: only fires while the new namespace holds NO raw user overrides —
- *   describe().user is the only way to tell user keys from schema defaults,
- *   because scope.get() folds the defaults in;
- * - idempotent: after the copy (or any config written on the new name) the
- *   override check short-circuits every later boot;
- * - fail-open: registering the legacy namespace can throw (duplicate or
- *   schema-invalid stored section) and the write can reject — both contained,
- *   so plugin startup never depends on the migration.
- * Keys whose stored value equals the schema default are not copied (nothing
- * user-tuned to preserve). Returns the in-flight write for tests; apply()
- * fire-and-forgets it.
+ * Fold a session-log prefix into the pending-inbox projection state.
+ * Coordinates in the log are already normalize-at-append (dsh-agent-loop
+ * clamps start/deleteCount before appending), so each entry applies as a
+ * plain toSpliced. Events at or past `upToSeqExclusive` are ignored — pass
+ * the current splice's own seq to fold everything BEFORE it. Returns
+ * undefined when any entry is malformed enough to break the fold (the
+ * caller degrades to the projection read, as before).
  */
-export function migrateLegacySettings(settings, warn) {
+export function replayPendingInbox(events, upToSeqExclusive) {
+    const window = { 'next-turn': [], 'next-step': [] };
     try {
-        const describe = settings.describe?.bind(settings);
-        if (describe === undefined)
-            return undefined;
-        const findUser = (ns) => {
-            const user = describe().find((entry) => entry.ns === ns)?.user;
-            return user !== undefined && user !== null && typeof user === 'object' ? user : undefined;
-        };
-        // Already migrated / user-configured on the new name — never touch it.
-        if (findUser(OWN_NS) !== undefined)
-            return undefined;
-        // Old-plugin coexistence (ADR 0013): `llmwiki` already registered means
-        // the pre-rename dsh-llmwiki-memory 0.5.x is still loaded in this host.
-        // Our register below would hit the duplicate guard, migration would
-        // silently skip, and both plugins would drift onto separate bundles
-        // (split brain). Warn loudly instead of registering blind.
-        if (describe().some((entry) => entry.ns === LEGACY_NS)) {
-            warn?.('dsh-topics-memory: the legacy dsh-llmwiki-memory (0.5.x) is still running in this host — ' +
-                'settings migration was skipped because the "llmwiki" namespace is already registered. ' +
-                'Remove @aiwayds/dsh-llmwiki-memory from this profile so only dsh-topics-memory loads.');
-            return undefined;
+        for (const event of events) {
+            const seq = event.seq;
+            if (typeof seq === 'number' && seq >= upToSeqExclusive)
+                break;
+            if (event.type !== 'agent/inbox/spliced')
+                continue;
+            const splice = event.data;
+            if (splice === null || typeof splice !== 'object')
+                continue;
+            const target = splice.target ?? 'next-turn';
+            if (target !== 'next-turn' && target !== 'next-step')
+                continue;
+            const start = Math.trunc(splice.start);
+            const removedCount = Math.trunc(splice.removedCount ?? 0);
+            if (!Number.isFinite(start) || !Number.isFinite(removedCount) || start < 0 || removedCount < 0)
+                continue;
+            window[target] = window[target].toSpliced(start, removedCount, ...(splice.inserted ?? []));
         }
-        // Registering the legacy namespace is the only API that surfaces its
-        // stored section; a duplicate or schema-invalid section throws — contained.
-        settings.register(LEGACY_NS, TopicsConfig);
-        const legacyUser = findUser(LEGACY_NS);
-        if (legacyUser === undefined)
-            return undefined;
-        const ops = CONFIG_KEYS.filter((k) => k in legacyUser && legacyUser[k] !== DEFAULTS[k]).map((k) => ({ op: 'set', path: [k], value: legacyUser[k] }));
-        if (ops.length === 0)
-            return undefined;
-        return settings.mutate?.call(settings, OWN_NS, ops)?.catch(() => undefined);
     }
     catch {
         return undefined;
     }
+    return window;
+}
+/**
+ * Claimed-text extraction, shared verbatim by the projection read and the
+ * log replay: user-kind messages only, text blocks joined per message —
+ * the pre-0.17.0 splice-window semantics.
+ */
+export function claimedUserText(messages) {
+    let claimedText = '';
+    for (const message of messages) {
+        const data = message;
+        if (data === null || typeof data !== 'object' || data.source?.kind !== 'user')
+            continue;
+        const text = textOf(data);
+        if (text.trim() !== '')
+            claimedText = claimedText === '' ? text : `${claimedText}\n${text}`;
+    }
+    return claimedText;
+}
+/**
+ * Resolve the claimed text for one splice, ordering the two sources by
+ * authority (review CONCERN A, 0.17.1):
+ *
+ * 1. Session-log replay — preferred UNCONDITIONALLY whenever the event
+ *    carries a seq and a log prefix is available. The fold reproduces the
+ *    pre-splice window the claim coordinates (start/removedCount) are
+ *    defined against, so it is immune to handler order AND to the backlog
+ *    misalignment: with ≥2 pending messages the post-splice projection
+ *    read is NON-empty but shifted by one (a claim of msg1 would read
+ *    msg2's residual text), which the 0.17.0 empty-projection-only gating
+ *    missed. The replay verdict is FINAL — when the fold succeeds the
+ *    projection is not consulted, even if the replayed slice comes back
+ *    empty (the pre-splice window genuinely held no user text).
+ * 2. Projection read — the fallback for hosts where the replay cannot arm
+ *    (no event.seq on the firehose, or snapshotEvents unreachable/failed).
+ *    Pre-0.1.5 live dispatch precedes the mutation, so this read yields
+ *    the pre-splice window, as it always did.
+ *
+ * `source` names the source that ACTUALLY produced the returned text
+ * (review CONCERN B): 'log-replay' whenever the replay supplied the
+ * verdict (empty included), 'projection' only when the fallback did (or
+ * the replay never armed).
+ */
+export function resolveClaimedText(input) {
+    if (typeof input.seq === 'number' && input.logEvents !== undefined) {
+        const window = replayPendingInbox(input.logEvents, input.seq);
+        if (window !== undefined) {
+            return {
+                text: claimedUserText(window[input.target].slice(input.start, input.start + input.removedCount)),
+                source: 'log-replay',
+            };
+        }
+    }
+    return {
+        text: claimedUserText(input.projection.slice(input.start, input.start + input.removedCount)),
+        source: 'projection',
+    };
+}
+// dsh 0.1.7 settings: the runtime namespace registry (register/describe per
+// plugin) is gone. A plugin's settings page is the projection of its `Config`
+// schema below, and the settings namespace is the profile entry id
+// (`dsh-topics-memory`, cordis.patch.yml) — the same spelling /topics set
+// passes to ctx.settings.mutate(). A legacy top-level `topics:` section in
+// settings.yaml is NOT auto-imported under this id — the host imports the
+// old settings.yaml once, then renames it to settings.yaml.imported.
+export const Config = TopicsConfig;
+/** Settings namespace this plugin reads and writes: the profile entry id. */
+const ENTRY_ID = 'dsh-topics-memory';
+/** Snapshot one config slot: live ref → current value, plain value → itself. */
+function readConfigValue(slot) {
+    const ref = slot;
+    return typeof ref?.get === 'function' ? ref.get() : slot;
 }
 // --- Bundled skill -----------------------------------------------------------
 /** Provider name under `ctx.skills`; doubles as the skill name. */
@@ -137,7 +182,7 @@ const SKILL_RESOURCE_BASE = {
 };
 const SKILL_INVOCATION = { modelInvocable: true, userInvocable: true };
 /** Routing description; must stay identical to the SKILL.md frontmatter (asserted in tests). */
-const SKILL_DESCRIPTION = 'dsh 记忆插件（@aiwayds/dsh-topics-memory）使用与配置指南。凡涉及 dsh 记忆/话题库/GitHub 同步/蒸馏/整理，或要配置 topics 段时先读本指南：settings.yaml 顶层 `topics:` 段全部键（repo/autoInject/topK/注入预算/蒸馏/整理/观察/图游走等）、/topics 命令族（onboard/status/distill/consolidate/stats/list/show/history/graph/sync/config/set）、首次配置 ask_user_question 向导（local-only 或绑 GitHub 仓、蒸馏模型路由、注入档位、自动观察）、注入形态 pointer/digest、legacy llmwiki 段自动迁移。触发词：topics、记忆、topic、蒸馏、distill、整理、consolidate、合并重复、deprecatedTtl、usageBoost、使用加成、autoInject、记忆库、llmwiki、include-subagents。';
+const SKILL_DESCRIPTION = 'dsh 记忆插件（@aiwayds/dsh-topics-memory）使用与配置指南。凡涉及 dsh 记忆/话题库/GitHub 同步/蒸馏/整理，或要配置 topics 时先读本指南：设置页 `dsh-topics-memory` 条目全部键（repo/autoInject/topK/注入预算/蒸馏/整理/观察/图游走等）、/topics 命令族（onboard/status/distill/consolidate/stats/list/show/history/graph/sync/config/set）、首次配置 ask_user_question 向导（local-only 或绑 GitHub 仓、蒸馏模型路由、注入档位、自动观察）、注入形态 pointer/digest。触发词：topics、记忆、topic、蒸馏、distill、整理、consolidate、合并重复、deprecatedTtl、usageBoost、使用加成、autoInject、记忆库、include-subagents。';
 const SKILL_CANDIDATE = {
     name: SKILL_PROVIDER_NAME,
     description: SKILL_DESCRIPTION,
@@ -190,19 +235,16 @@ export function stripFrontmatter(raw) {
     }
     return raw;
 }
-export function apply(ctx) {
+export function apply(ctx, config = {}) {
     // `inject = ['skills']` guarantees the service exists on every real host;
     // register unconditionally so a missing service fails loud instead of
     // silently dropping the bundled skill.
     ctx.skills.registerProvider(() => skillProvider);
-    // dsh-settings is part of every real host closure but is a runtime-optional
-    // peer so bare test harnesses can still load this module.
-    const settingsNs = ctx.settings;
-    if (settingsNs === undefined)
-        return;
-    const scope = settingsNs.register(OWN_NS, TopicsConfig);
+    // 0.1.7 hosts validate the profile patch against `Config` above and hand
+    // apply() live volatile references; bare harnesses pass plain values (or
+    // nothing) — readConfigValue treats both shapes the same.
     // Host logger access is best-effort: cordis always provides one, but bare
-    // test harnesses may not — the migration stays silent rather than throwing.
+    // test harnesses may not — the logging stays silent rather than throwing.
     const warn = (message) => {
         try {
             const logger = ctx.logger;
@@ -213,12 +255,31 @@ export function apply(ctx) {
             // contained — a missing/broken logger must not break startup
         }
     };
-    // Carry user-tuned values over from the pre-rename namespace (one-time,
-    // fail-open, idempotent — see migrateLegacySettings). Fire-and-forget: the
-    // write settles on its own; a rejection only skips the migration.
-    void migrateLegacySettings(settingsNs, warn);
+    // Low-noise observability for the fast lane's early exits. The 2026-09-21
+    // silent-death incident (0.1.5-rc.2 claim order) died precisely because
+    // every exit path was silent: the injected log stayed empty for weeks
+    // while the observer kept recording. First occurrence warns immediately;
+    // repeats batch into one count line per SILENT_EXIT_LOG_EVERY occurrences.
+    // DSH_TOPICS_DEBUG=1 logs every single one for bench debugging.
+    const SILENT_EXIT_LOG_EVERY = 50;
+    const debugVerbose = process.env.DSH_TOPICS_DEBUG === '1';
+    const silentExitCounts = new Map();
+    const silentExit = (key, detail) => {
+        const n = (silentExitCounts.get(key) ?? 0) + 1;
+        silentExitCounts.set(key, n);
+        if (debugVerbose || n === 1 || n % SILENT_EXIT_LOG_EVERY === 0) {
+            warn(`dsh-topics-memory 快道本轮未触发（${key}，累计 ${n} 次）：${detail}`);
+        }
+    };
     const cfgNow = () => {
-        const v = scope.get();
+        const v = {};
+        for (const k of CONFIG_KEYS) {
+            const slot = config[k];
+            // Skip absent keys so the DEFAULTS fold below keeps them (an explicit
+            // undefined spread would wipe the default).
+            if (slot !== undefined)
+                v[k] = readConfigValue(slot);
+        }
         // Schema defaults may not be applied by bare test harnesses; fill them in.
         return { ...DEFAULTS, ...v };
     };
@@ -281,6 +342,15 @@ export function apply(ctx) {
                 }
             }
             const r = service.retrieveSync(query, sessionId, seen === undefined && echo === undefined ? undefined : { exclude: seen, echo }, slow, slowExpired);
+            // The service-layer early exit (empty roster — e.g. a probe home with
+            // no topics seeded) writes NO injection record and used to be fully
+            // silent (the P8 early-exit the incident audit enumerated). autoInject
+            // off never reaches here (the spliced branch gates it) and an empty
+            // query is pre-filtered by the empty-claimed exit, so rosterSize 0 on
+            // this path means exactly "roster empty".
+            if (r.outcome.rosterSize === 0) {
+                silentExit('no-roster', 'roster 为空（topics 库 0 条）——service 层早退，本轮不写 ilog 记录');
+            }
             // Mark only what entered the context this round (hits AND slow picks →
             // dedup filter → assemble → registry mark; budget-dropped slugs stay
             // injectable).
@@ -466,11 +536,18 @@ export function apply(ctx) {
             if (!cfgNow().autoInject)
                 return;
             const splice = event.data;
-            if (!splice.removedCount || splice.outcome === 'canceled')
+            // A canceled claim is routine host flow (inbox cancel/remove), not a
+            // fault signal — it only logs under DSH_TOPICS_DEBUG, never warns.
+            if (!splice.removedCount || splice.outcome === 'canceled') {
+                if (debugVerbose)
+                    silentExit('canceled', `target=${String(splice.target)} removedCount=${String(splice.removedCount)} outcome=${String(splice.outcome)}`);
                 return;
+            }
             const agent = agents()?.get(session.id);
-            if (agent === undefined)
+            if (agent === undefined) {
+                silentExit('agent-missing', `agents() 无此会话 ${sessionId}——快道文本无法定位`);
                 return;
+            }
             // The agent-scoped context carries the llm instance this agent's own
             // loop streams through (adapters included) — capture it while alive.
             try {
@@ -481,24 +558,46 @@ export function apply(ctx) {
             catch {
                 // scope already unwinding — the root fallback stays
             }
-            const list = ((splice.target ?? 'next-turn') === 'next-step' ? agent.inbox.nextStep : agent.inbox.nextTurn);
-            // Live dispatch precedes projection mutation: read the pre-splice window.
-            const claimed = list.slice(splice.start, splice.start + splice.removedCount);
-            let claimedText = '';
-            for (const message of claimed) {
-                if (message.source?.kind !== 'user')
-                    continue;
-                const text = textOf(message);
-                if (text.trim() !== '')
-                    claimedText = claimedText === '' ? text : `${claimedText}\n${text}`;
+            const target = (splice.target ?? 'next-turn') === 'next-step' ? 'next-step' : 'next-turn';
+            const list = (target === 'next-step' ? agent.inbox.nextStep : agent.inbox.nextTurn);
+            // Authority — session-log replay (resolveClaimedText, CONCERN A):
+            // whenever the event carries a seq, the fold runs FIRST and its
+            // verdict is final — with ≥2 pending messages the post-splice
+            // projection read is non-empty but shifted by one, so gating the
+            // replay on an empty projection would claim msg1 and read msg2.
+            const seq = event.seq;
+            let logEvents;
+            if (typeof seq === 'number') {
+                try {
+                    // Soft-deprecated surface, deliberately kept (dsh 0.17 migration):
+                    // `snapshotEvents` still ships in dsh-session 0.1.7-rc.1 and this is
+                    // the replay's data source, reachable only behind event.seq with a
+                    // full projection-read fallback below. Migrating to registered
+                    // SessionMessageProjections is a dedicated project, not a drive-by.
+                    const snapshot = session.snapshotEvents;
+                    if (typeof snapshot === 'function')
+                        logEvents = snapshot.call(session, 0, seq);
+                }
+                catch {
+                    // contained — the projection fallback inside resolveClaimedText
+                    // stays the verdict
+                }
             }
-            if (claimedText.trim() === '')
+            const claimed = resolveClaimedText({ projection: list, logEvents, seq, target, start: splice.start, removedCount: splice.removedCount });
+            if (claimed.text.trim() === '') {
+                // claimed.source names where the (empty) verdict actually came
+                // from (CONCERN B): 'log-replay' = the fold ran and the pre-splice
+                // window genuinely held no user text; 'projection' = the replay
+                // never armed (no seq / snapshotEvents unreachable) and the
+                // projection read was empty too.
+                silentExit(`empty-claimed/${claimed.source}`, `target=${target} start=${String(splice.start)} removedCount=${String(splice.removedCount)}——被 claim 窗口重建后仍无用户文本`);
                 return;
+            }
             const state = turns.get(sessionId) ?? { claimedText: '', injectionText: '' };
-            state.claimedText = claimedText;
+            state.claimedText = claimed.text;
             state.injectionText = '';
             turns.set(sessionId, state);
-            retrieveForTurn(sessionId, claimedText);
+            retrieveForTurn(sessionId, claimed.text);
             return;
         }
         if (event.type === 'turn/start') {
@@ -527,10 +626,6 @@ export function apply(ctx) {
         if (event.type === 'turn/end')
             dispatchSlowLane(sessionId);
     }));
-    // Session-start boot chain dedup: rc.2's creation transaction emits BOTH
-    // `agent/session-start` and `agent/created`, so the pair collapses to one
-    // chain run per session; teardown clears the entry.
-    const bootedSessions = new Set();
     // ---- Session teardown: real cordis events, not session/event types ----
     // dsh-session 0.1.2-alpha.4's SessionEventMap has no `agent/disposed` or
     // `session/disposed` event type — the old `event.type === 'agent/disposed'`
@@ -555,7 +650,6 @@ export function apply(ctx) {
             observer.onSessionEvent(sessionId, name, undefined);
             injectedBySession.delete(sessionId);
             slowLane.clear(sessionId);
-            bootedSessions.delete(sessionId);
             // A teardown-triggered run (session-end distill) reads the payload
             // capture lazily: drop the entry here only when no run can still read
             // it. The slow lane's in-flight pipeline reads it too (shared caller);
@@ -563,91 +657,128 @@ export function apply(ctx) {
             releaseSessionLlm(sessionId);
         }));
     }
-    // ---- Sync lifecycle: pull on session start, local commit on dispose ----
+    // ---- Boot chain: pull on session start, replay-distill, consolidate, TTL ----
     // Session start is an agent-bus event, never a session/event firehose type:
-    // the firehose only carries Session.append types. Tarball-verified emission
-    // sites: `agent/session-start` (sync, payload { agent, source }) is emitted
-    // by dsh-agent-loop up to 0.1.5; 0.1.6-alpha.1 merges the startup
-    // notification into the serial `agent/created` announcement (payload
-    // { agent, source, signal? }) and drops the old name. So one registration
-    // per name — a host that never emits a name simply never calls that
-    // listener. Only { agent } is structural; the rest is defensive.
+    // the firehose only carries Session.append types. dsh 0.1.7 announces ONE
+    // serial `agent/created` event (payload { agent, source, signal? }, source
+    // ∈ 'startup' | 'resume' | 'clear' | 'compact') and `agent/session-start`
+    // is gone with no shim — 0.16.1's dual-name registration collapses to a
+    // single listener, and with it the per-session dedup Set: the registry
+    // guarantees exactly one announce per agent entry (a second announce
+    // throws), so a 'clear'/'compact' re-creation legitimately re-runs the
+    // chain on its fresh entry and teardown has nothing to re-arm. Only
+    // { agent } is structural; the rest is defensive.
+    //
+    // BOOT GUARANTEE (dsh 0.1.7): the serial dispatch awaits every
+    // `agent/created` listener and a throw or rejection ROLLS THE ENTIRE AGENT
+    // CREATION BACK. This listener is therefore total and synchronous — it
+    // never throws, never returns a promise — and the chain is deferred off
+    // the creation transaction entirely (setImmediate, unref'd): the pull /
+    // replay-distill / consolidation slow work starts only after the serial
+    // dispatch has moved on. Plugin initialization must never block, delay,
+    // or abort session startup; a chain failure at most warns.
     const runBootChain = (sessionId) => {
-        void sync
-            .pull()
-            .catch(() => undefined)
-            .finally(() => store.ensure().catch(() => undefined))
-            .then(() => {
-            // Boot replay: the observations JSONL is the durable distill queue.
-            // Whatever the previous exit skipped (local-only exit since the
-            // no-network exit commit) or a killed run left unmarked is still
-            // undistilled here. Empty pool and no-model are cheap no-ops inside
-            // the distiller; the per-session dedup guards double runs.
-            void store
-                .undistilledObservations(1)
-                .then((pending) => {
-                if (pending.length === 0)
-                    return;
-                // Same trigger-time capture the observer callback does: the
-                // replay run's caller resolves candidates lazily and a fresh
-                // session has no prior capture to lean on.
+        // Contained at the top too: a synchronous prologue throw (config read,
+        // sync bookkeeping) must degrade to a warn, not leak toward the host.
+        try {
+            void sync
+                .pull()
+                .catch((error) => {
+                // The pull failing must stay non-fatal for the chain (replay and
+                // TTL still run on the local pool), but no longer silent — a dead
+                // sync route should leave a host-log trace.
+                warn(`dsh-topics-memory 启动同步 pull 失败（继续本地启动链）：${error instanceof Error ? error.message : String(error)}`);
+            })
+                .finally(() => store.ensure().catch(() => undefined))
+                .then(() => {
+                // Boot replay: the observations JSONL is the durable distill queue.
+                // Whatever the previous exit skipped (local-only exit since the
+                // no-network exit commit) or a killed run left unmarked is still
+                // undistilled here. Empty pool and no-model are cheap no-ops inside
+                // the distiller; the per-session dedup guards double runs.
+                void store
+                    .undistilledObservations(1)
+                    .then((pending) => {
+                    if (pending.length === 0)
+                        return;
+                    // Same trigger-time capture the observer callback does: the
+                    // replay run's caller resolves candidates lazily and a fresh
+                    // session has no prior capture to lean on.
+                    try {
+                        captureFromAgent(agents()?.get(sessionId));
+                    }
+                    catch {
+                        // contained — the run below fails with the readable
+                        // no-adapter detail instead
+                    }
+                    const run = distiller.request(sessionId, 'boot-replay');
+                    if (run !== undefined)
+                        void run.catch(() => undefined);
+                })
+                    .catch(() => undefined);
+                // Consolidation cadence check — after the pull (freshest pool),
+                // fully fire-and-forget: cadence/single-flight gates live inside
+                // maybeRun, and a no-model boot just skips (no stamp advanced).
+                // Failures are NOT silent at the host log: the 2026-09-09 real-host
+                // test showed a dead distill route would otherwise hide here with
+                // zero observable trace (the state file only advances on success).
                 try {
                     captureFromAgent(agents()?.get(sessionId));
                 }
                 catch {
-                    // contained — the run below fails with the readable
-                    // no-adapter detail instead
-                }
-                const run = distiller.request(sessionId, 'boot-replay');
-                if (run !== undefined)
-                    void run.catch(() => undefined);
-            })
-                .catch(() => undefined);
-            // Consolidation cadence check — after the pull (freshest pool),
-            // fully fire-and-forget: cadence/single-flight gates live inside
-            // maybeRun, and a no-model boot just skips (no stamp advanced).
-            // Failures are NOT silent at the host log: the 2026-09-09 real-host
-            // test showed a dead distill route would otherwise hide here with
-            // zero observable trace (the state file only advances on success).
-            try {
-                captureFromAgent(agents()?.get(sessionId));
-            }
-            catch {
-                // contained — the run below fails with a readable no-model detail
-            }
-            void consolidator
-                .maybeRun({ sessionId })
-                .then((r) => {
-                if (r !== undefined && !r.ok && r.reason !== 'no-clusters') {
-                    warn(`dsh-topics-memory 整理 lane 未执行：${r.reason ?? 'unknown'}${r.detail !== undefined ? `（${r.detail}）` : ''}`);
+                    // contained — the run below fails with a readable no-model detail
                 }
-            })
-                .catch(() => undefined);
-            // Deprecated-TTL sweep — pure local rule, no model, runs even when
-            // the distill route is unconfigured. Drops are logged: deletion is
-            // the one housekeeping action the user should always see happened.
-            const ttl = cfgNow().deprecatedTtlDays;
-            if (ttl > 0) {
-                void dropExpiredDeprecated(service, ttl)
-                    .then((dropped) => {
-                    if (dropped.length > 0) {
-                        warn(`dsh-topics-memory：按 ${ttl} 天 TTL 删除了 ${dropped.length} 条 deprecated topic（${dropped.map((s) => `topics/${s}`).join('、')}）；git 历史可找回`);
+                void consolidator
+                    .maybeRun({ sessionId })
+                    .then((r) => {
+                    if (r !== undefined && !r.ok && r.reason !== 'no-clusters') {
+                        warn(`dsh-topics-memory 整理 lane 未执行：${r.reason ?? 'unknown'}${r.detail !== undefined ? `（${r.detail}）` : ''}`);
                     }
                 })
                     .catch(() => undefined);
-            }
-        })
-            .catch(() => undefined);
+                // Deprecated-TTL sweep — pure local rule, no model, runs even when
+                // the distill route is unconfigured. Drops are logged: deletion is
+                // the one housekeeping action the user should always see happened.
+                const ttl = cfgNow().deprecatedTtlDays;
+                if (ttl > 0) {
+                    void dropExpiredDeprecated(service, ttl)
+                        .then((dropped) => {
+                        if (dropped.length > 0) {
+                            warn(`dsh-topics-memory：按 ${ttl} 天 TTL 删除了 ${dropped.length} 条 deprecated topic（${dropped.map((s) => `topics/${s}`).join('、')}）；git 历史可找回`);
+                        }
+                    })
+                        .catch(() => undefined);
+                }
+            })
+                .catch((error) => {
+                warn(`dsh-topics-memory 启动链失败（不影响会话启动）：${error instanceof Error ? error.message : String(error)}`);
+            });
+        }
+        catch (error) {
+            warn(`dsh-topics-memory 启动链无法启动（不影响会话启动）：${error instanceof Error ? error.message : String(error)}`);
+        }
     };
-    for (const name of ['agent/session-start', 'agent/created']) {
-        ctx.on(name, ((payload) => {
+    ctx.on('agent/created', ((payload) => {
+        // The boot-fallback contract lives HERE, not inside runBootChain: dsh
+        // 0.1.7 rolls agent creation back when this listener throws, so even a
+        // hostile/malformed payload (a throwing getter, a proxy trap) degrades to
+        // a warn. Returning undefined (never a thenable) keeps the serial
+        // dispatch from awaiting anything.
+        try {
             const sessionId = String(payload?.agent?.id ?? '');
-            if (sessionId === '' || bootedSessions.has(sessionId))
+            if (sessionId === '')
                 return;
-            bootedSessions.add(sessionId);
-            runBootChain(sessionId);
-        }));
-    }
+            // Off the creation transaction: the unref'd immediate fires after the
+            // current serial dispatch slice, so the chain's synchronous prologue
+            // (config read, sync state) never delays the remaining listeners nor
+            // the loop start, and the timer cannot hold a dying process open.
+            const deferred = setImmediate(() => runBootChain(sessionId));
+            deferred.unref?.();
+        }
+        catch (error) {
+            warn(`dsh-topics-memory boot 链触发失败（不影响会话启动）：${error instanceof Error ? error.message : String(error)}`);
+        }
+    }));
     ctx.effect(() => {
         void store.ensure().catch(() => undefined);
         // Async disposer: cordis awaits it during unload (Disposable may be
@@ -680,7 +811,9 @@ export function apply(ctx) {
         const mutate = async (ops) => {
             if (settingsMutator?.mutate === undefined)
                 throw new Error('settings 服务不可用，无法写入配置');
-            await settingsMutator.mutate(OWN_NS, ops);
+            // 0.1.7: the settings namespace is the profile entry id, not the old
+            // `topics` namespace name.
+            await settingsMutator.mutate(ENTRY_ID, ops);
         };
         // Resolved lazily at invocation time: whichever UI registered the ask-user
         // provider (TUI panel / web composer / feishu card, ask-router optional)

package/lib/store.d.ts

@@ -61,6 +61,19 @@ export declare class BundleStore {
     topicPath(slug: string): string;
     private observationsPath;
     private injectionsPath;
+    /**
+     * Fast-lane heartbeat (0.17.0): tail timestamps of the two lane sidecars —
+     * the last injection round (`injections.jsonl`) and the last observation
+     * (`observations.jsonl`). Feeds the /topics status stale check that makes
+     * "observer still recording, injection lane silently dead" visible within
+     * a day instead of weeks (the 0.1.5-rc.2 claim-order incident shape).
+     * Full-file reads are fine here: /topics status is interactive and both
+     * logs are append-per-round small; unreadable logs degrade to undefined.
+     */
+    readLaneHeartbeat(): Promise<{
+        lastInjectionAt?: string;
+        lastObservationAt?: string;
+    }>;
     private conflictsPath;
     private distillStatePath;
     /** Last distill-lane run outcome (diagnostics for /topics status and e2e). */

package/lib/store.js

@@ -74,6 +74,31 @@ export class BundleStore {
     injectionsPath() {
         return join(this.metaDir(), 'injections.jsonl');
     }
+    /**
+     * Fast-lane heartbeat (0.17.0): tail timestamps of the two lane sidecars —
+     * the last injection round (`injections.jsonl`) and the last observation
+     * (`observations.jsonl`). Feeds the /topics status stale check that makes
+     * "observer still recording, injection lane silently dead" visible within
+     * a day instead of weeks (the 0.1.5-rc.2 claim-order incident shape).
+     * Full-file reads are fine here: /topics status is interactive and both
+     * logs are append-per-round small; unreadable logs degrade to undefined.
+     */
+    async readLaneHeartbeat() {
+        const tailAt = async (file) => {
+            try {
+                const lines = (await readFile(file, 'utf8')).trimEnd().split('\n');
+                const at = JSON.parse(lines.at(-1) ?? '').at;
+                return typeof at === 'string' ? at : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        };
+        return {
+            lastInjectionAt: await tailAt(this.injectionsPath()),
+            lastObservationAt: await tailAt(this.observationsPath()),
+        };
+    }
     conflictsPath() {
         return join(this.metaDir(), 'conflicts.json');
     }