@aiwayds/dsh-topics-memory 0.9.0 → 0.11.0

package/README.md

@@ -6,10 +6,28 @@ A dsh plugin: maintains "working topic memory" as an [OKF (Open Knowledge Format
 
 > **Requires dsh >= 0.1.2-rc.1** — this plugin targets the dsh RC/stable line only (CI and releases resolve the newest of the `latest`/`next` dist-tags at runtime). **The alpha line is no longer supported.**
 
+## Demo
+
+The full flow in about four minutes: topics captured, distilled, and injected in a real session.
+
+https://github.com/user-attachments/assets/8c06cc98-b1ed-402b-9110-4f9a93eb15bc
+
 ## The problem it solves
 
 Long sessions forget. Cross-session, even more so. This plugin maintains **structured topic memory**: each Topic records a matter's **name, dependencies, open questions, current conclusion, impact, and recommendations**. When a conclusion changes, edit the file and commit — `git log` directly answers "when, by whom, and why did this conclusion change".
 
+## Why this plugin exists: memory is edited, not accumulated
+
+The short version: **more memory is not better memory.**
+
+Most memory tools assume accumulation — record everything, retrieve broadly. That may work for humans; for LLMs it backfires twice over. Model attention is a finite resource, so a giant memory bank means every turn is spent digging for signal in noise. Worse, process memories hoard intermediate judgments that were right once and wrong later — and they will confidently steer the model into bad decisions.
+
+So this plugin takes a hard editorial line on what deserves to be remembered: **a topic records exactly four things — the question that started it, the conclusion it reached, what it impacts, and what it depends on. Everything in between — the discussion, the dead ends, the wrong turns — is deliberately not memory.** Process belongs to the session; when the session ends, it goes. Only conclusions that survive distillation make it into the bundle.
+
+Short-term memory is the session's own job — the conversation context already is one, and a plugin that feeds it back is noise. Long-term memory belongs to topics: small, structured, git-traceable, injected in budgeted slices with zero hits meaning zero injection. Every turn hands the model the **minimum high-value context**, not the biggest warehouse.
+
+This plugin is not trying to be the model's notebook. It is trying to be the model's editor: deciding what is worth keeping — and, more importantly, what should be forgotten.
+
 ## Core features
 
 - **Strict OKF v0.2 compliance**: each Topic is a `markdown + YAML frontmatter` concept document (`type: Topic`) that the whole OKF ecosystem (Obsidian, OKF validators) can consume directly; ships with the provenance (`sources`), trust (`generated`/`verified`), and lifecycle (`status`/`stale_after`) field families.
@@ -30,7 +48,7 @@ Long sessions forget. Cross-session, even more so. This plugin maintains **struc
 
 | Model tools | Purpose |
 |---|---|
-| `topic_save` | Distill/revise a Topic (name / dependencies / open questions / conclusion / impact / recommendations) |
+| `topic_save` | Save/revise a Topic (name / dependencies / open questions / conclusion / impact / recommendations) |
 | `topic_observe` | Jot an atomic observation (decision/finding/constraint/question), pending distill |
 | `topic_search` | LLM-free keyword search over memory |
 | `topic_history` | A topic's conclusion change history (git log as a tool) |
@@ -115,7 +133,7 @@ This project's shape is directly inspired and supported by:
 ## Known boundaries
 
 - **Subagents engage memory by default — one switch to opt out**: by default (`include-subagents` on), injection and observation apply to subagent sessions too. `/topics set include-subagents off` skips delegated sessions entirely — no injection, no observation, no distill triggers; the topic tools stay on the global layer, so an explicit `topic_save` from a child still lands. Out-of-process subagents (claude-code/codex providers) never load this plugin anyway.
-- **Session-end distill in headless one-shot sessions**: the plugin's disposer now waits (bounded, up to 90s) for the exit-triggered distill to land before unload completes, so a headless process no longer loses that race by default; a hanging model call gives up at the cap and exit proceeds without that run. Within that 90s window the exit run may complete only part of its call budget — the remaining backlog waits for the next trigger. The exit trigger is skipped entirely while a session-end run is still in flight (the same pool head would otherwise be fed to the model twice). Manual `/topics distill` runs inside a live session bypass the race entirely; `meta/distill-state.json` records each lane's outcome, checkable via `/topics status`.
+- **Exit is local-only (0.10.0)**: the plugin's disposer makes one local git commit of the meta sidecars (observations / injections / distill state) and never waits on the network — no pull, no push, no model call, so host exit no longer pays a git round-trip or a bounded distill wait (the old 90s cap is gone; only a 10s guard against a pathological git stall remains). The exit distill trigger is fired fire-and-forget and is skipped entirely while a session-end run is still in flight (the same pool head would otherwise be fed to the model twice). Nothing is lost by skipping: observations are write-through on disk, the deferred push is replayed by the next boot's pull, and the skipped distill is replayed there too (boot-replay). `meta/distill-state.json` records each lane's outcome, checkable via `/topics status`.
 - **Observation GC (three strikes)**: an observation the model actually evaluated (parseable answer, however useless) but no op consumed accrues one failed attempt; the third failed attempt physically deletes it — explicitly authorized cleanup of raw data the lane demonstrably cannot process. Runs that never evaluated the batch never count: infrastructure failures (network errors, unconfigured distill route → readable `no-model` short-circuit) and unparseable output (`invalid-output`) are exempt, and a batch still mid-shrink on output-limit retries is only counted once a verdict is reached (success, floor stop, stall, or an explicit skip). Deletions are committed immediately (data destruction stays git-traceable); pure attempt counters follow the usual flush cadence.
 - **Config read timing**: `/topics set` and `settings.yaml` edits take effect most reliably from the next session start.
 - **Picking a distill model**: `/topics onboard` splits the distill decision into two dependent questions (provider first, then that provider's model catalog), pre-validated with `resolveModelInfo` — a provider with no live route blocks and re-asks, an off-catalog model (a non-NO_ADAPTER failure: outside the advisory catalog, possibly still usable) warns but is allowed; hosts without an ask UI or a usable model route fall back to typed input. The same validation backs the `/topics set` picker panels.

package/README.zh.md

@@ -6,10 +6,28 @@
 
 > **要求 dsh >= 0.1.2-rc.1** — 本插件只跟随 dsh RC/stable 线（CI 与发版在运行时解析 latest/next 中更新的 dist-tag）。**不再支持 alpha 线。**
 
+## 演示
+
+约 4 分钟的完整流程：topic 沉淀、蒸馏、注入在真实会话里跑起来。
+
+https://github.com/user-attachments/assets/6e9b346d-2ec9-4148-ae62-7087797d3188
+
 ## 它解决什么问题
 
 长会话会失忆，跨会话更会。本插件维护一份**结构化的 topic 记忆**：每个 Topic 记录一件事的**名字、依赖、未决问题、目前结论、影响、建议**。结论变了就改文件、打 commit——`git log` 直接回答「这个结论什么时候、被谁、为什么改的」。
 
+## 初衷：记忆是编辑出来的，不是攒出来的
+
+先说结论：**记忆不是越多越好。**
+
+「记忆」类产品的常见思路是多多益善——能记的都记，用时全量检索。这对人也许成立，对 LLM 恰恰相反，而且反在两处：模型的注意力是有限资源，巨型记忆库意味着每一轮对话都在噪音里翻找信号；更危险的是，过程记忆里囤着大量「当时正确、事后失效」的中间判断，它们会理直气壮地把模型引向错误的决定。
+
+所以本插件对「记什么」做了一次苛刻的取舍：**一个 topic 只记四件事——它从什么问题开始、得出了什么结论、影响什么、依赖什么。至于得出结论的过程：讨论、试错、绕过的弯路，一概不记。**过程属于 session，session 结束就该随它去；能留下的，只有经得起蒸馏的结论。
+
+短时记忆交给 session，对话上下文本就是它，不需要插件再回喂一遍；长时记忆交给 topics——小、结构化、git 可追溯，注入按预算切片、零命中零注入，每轮给模型的都是**最小的高价值上下文**，而不是越大越好的仓库。
+
+所以这个插件想做的不是模型的记事本，而是模型的编辑：替它决定什么值得记住，以及——更要紧的——什么应该被忘掉。
+
 ## 核心特性
 
 - **OKF v0.2 严格合规**：每个 Topic 是 `markdown + YAML frontmatter` 的 concept 文档（`type: Topic`），可被 Obsidian、OKF 校验器等整个生态直接消费；自带 provenance（`sources`）、trust（`generated`/`verified`）、lifecycle（`status`/`stale_after`）三族字段。
@@ -115,7 +133,7 @@ dsh plugin --profile <name> remove @aiwayds/dsh-topics-memory
 ## 已知边界
 
 - **子代理默认参与记忆，可整体关掉**：默认（`include-subagents` 开）注入与观察同样作用于子代理会话。`/topics set include-subagents off` 后，delegation depth > 0 的子代理会话被整体跳过——不注入、不观察、不触发蒸馏；topic 工具始终在全局层（子代理显式 `topic_save` 不受开关影响）。跨进程子代理（claude-code/codex 等 provider）本就不加载本插件。
-- **headless 单发会话里的 session-end 蒸馏**：插件 disposer 现在会等待退出触发的末次蒸馏落盘（有界等待，上限 90s；挂死的模型调用在超时后放弃、退出照常进行），headless 进程默认不再输掉这场竞速。90s 窗口内退出 run 可能只完成部分调用预算，剩余积压留待下次触发。已有 session-end run 在跑时退出触发整体跳过（否则同一全局队头批次会被双份喂给模型）。会话内 `/topics distill` 手动触发则完全绕开竞速；`meta/distill-state.json` 记录每次 lane 的结局，`/topics status` 可查。
+- **退出路径本地化（0.10.0）**：插件 disposer 只做一步本地 git commit（meta 侧车文件：observations / injections / distill state），不再等待任何网络——没有 pull、没有 push、没有模型调用，宿主退出不再支付 git 双程与有界蒸馏等待（旧的 90s 上限移除，仅保留 10s 兜底以防病理性 git 卡死）。退出蒸馏触发改为 fire-and-forget；已有 session-end run 在跑时整体跳过（否则同一全局队头批次会被双份喂给模型）。跳过不丢活：observations 本就 write-through 落盘，推迟的 push 由下次启动的 pull 补推，被跳过的蒸馏同样由下次启动回放（boot-replay）。`meta/distill-state.json` 记录每次 lane 的结局，`/topics status` 可查。
 - **观察 GC（三振删除）**：被模型实际评估（返回了可解析应答，无论内容有无价值）却未被任何 op 消费的观察记一次 failed attempt，连续 3 次即物理删除（用户已明确授权删除 lane 确实无法处理的原始观察）。模型从未评估过的批次永不计数：基础设施失败（网络错误、蒸馏路由未配置 → 可读 `no-model` 短路）与输出不可解析（`invalid-output`）豁免；输出上限减半重试中的批次只有到达裁决（成功 / 触底 / stalled / 明确跳过）才计一次。删除立即 commit（数据销毁 git 可追溯），纯计数沿用 flush 节奏。
 - **配置读取时机**：`/topics set` 与 settings.yaml 修改在下次会话启动后生效最稳。
 - **蒸馏选模型**：`/topics onboard` 的蒸馏一步拆成两问（先 provider 后 model，模型列表取自该 provider 的目录），选完经 `resolveModelInfo` 预校验——provider 无活路由会阻断重选，模型目录校验非 NO_ADAPTER 失败（目录外，可能仍可用）则警告但放行；无 ask UI 或无可用模型路由的环境自动退回文本输入。`/topics set` 的选择面板走同一套校验。

package/lib/commands.js

@@ -169,12 +169,19 @@ async function renderStats(service) {
         lines.push(`  慢道参与轮：${slowRounds}（快 ${(records.length - slowRounds)} / 慢或混合 ${slowRounds}${medianLag}）`);
     }
     // Pointer open rate (v4 §4.3): topic_open calls vs pointer entries injected.
+    // Echoed hits ride the retrieval but never became pointers — excluded here.
     const opens = await service.store.readOpenRecords();
     if (opens.length > 0 || records.some((r) => r.lane !== undefined)) {
-        const entries = records.reduce((acc, r) => acc + r.hits.filter((h) => !(r.deduped ?? []).includes(h.slug)).length + (r.slow?.length ?? 0), 0);
+        const entries = records.reduce((acc, r) => acc +
+            r.hits.filter((h) => !(r.deduped ?? []).includes(h.slug) && !(r.echoed ?? []).includes(h.slug)).length +
+            (r.slow?.length ?? 0), 0);
         const rate = entries === 0 ? 0 : Math.min(1, opens.length / entries);
         lines.push(`  指针打开率：${(rate * 100).toFixed(1)}%（${opens.length} 次 topic_open / ${entries} 条注入指针）`);
     }
+    const echoedCount = records.reduce((acc, r) => acc + (r.echoed?.length ?? 0), 0);
+    if (echoedCount > 0) {
+        lines.push(`  回声抑制：${echoedCount} 次（本会话蒸馏出的 topic 不回注）`);
+    }
     if (stats.topTopics.length > 0) {
         lines.push('  Top-N 被注入 Topic：');
         for (const t of stats.topTopics.slice(0, 5))
@@ -204,12 +211,23 @@ async function renderList(service) {
     const metas = await service.store.listTopics();
     if (metas.length === 0)
         return 'Bundle 里还没有 Topic —— 在会话里让我记点什么，或 /topics set 配置好蒸馏。';
-    const lines = [`共 ${metas.length} 个 Topic：`];
-    for (const m of metas.sort((a, b) => a.slug.localeCompare(b.slug))) {
-        lines.push(`  ${m.slug}  [${m.status}] ${m.title}${m.tags.length > 0 ? `  #${m.tags.join(' #')}` : ''}`);
+    metas.sort((a, b) => a.slug.localeCompare(b.slug));
+    const lines = [
+        `共 ${metas.length} 个 Topic：`,
+        '',
+        '| Slug | 标题 | 状态 | 标签 | 更新 |',
+        '| --- | --- | --- | --- | --- |',
+    ];
+    for (const m of metas) {
+        const tags = m.tags.length > 0 ? m.tags.map((t) => `#${cell(t)}`).join(' ') : '—';
+        lines.push(`| \`${cell(m.slug)}\` | ${cell(m.title)} | ${m.status} | ${tags} | ${cell(m.generatedAt.slice(0, 10))} |`);
     }
     return lines.join('\n');
 }
+/** One markdown table cell: pipes escaped, whitespace flattened. */
+function cell(text) {
+    return text.replace(/\|/g, '\\|').replace(/\s*\n\s*/g, ' ');
+}
 async function renderShow(service, slug) {
     if (slug === undefined || slug === '')
         return fail('用法：/topics show <slug>');

package/lib/config.d.ts

@@ -12,6 +12,11 @@ export declare const TopicsConfig: z<Schemastery.ObjectS<{
     autoInject: z<boolean, boolean>;
     /** Skip re-injecting topics already injected earlier in the same session. */
     injectDedup: z<boolean, boolean>;
+    /** Skip re-injecting topics distilled from the CURRENT session's own turns
+     *  (蒸馏回声): the conversation already carries that knowledge, so a
+     *  pointer is a stale echo at best (2026-09 audit: 3 of 6 useless rounds).
+     *  Provenance rides the observations log (sessionId → distilledInto). */
+    suppressEcho: z<boolean, boolean>;
     /** Max topics injected per round (ADR 0006: ≤4). */
     topK: z<number, number>;
     /** Per-topic digest budget in tokens. */
@@ -60,6 +65,11 @@ export declare const TopicsConfig: z<Schemastery.ObjectS<{
     autoInject: z<boolean, boolean>;
     /** Skip re-injecting topics already injected earlier in the same session. */
     injectDedup: z<boolean, boolean>;
+    /** Skip re-injecting topics distilled from the CURRENT session's own turns
+     *  (蒸馏回声): the conversation already carries that knowledge, so a
+     *  pointer is a stale echo at best (2026-09 audit: 3 of 6 useless rounds).
+     *  Provenance rides the observations log (sessionId → distilledInto). */
+    suppressEcho: z<boolean, boolean>;
     /** Max topics injected per round (ADR 0006: ≤4). */
     topK: z<number, number>;
     /** Per-topic digest budget in tokens. */
@@ -106,6 +116,7 @@ export type TopicsConfigValue = {
     repo: string;
     autoInject: boolean;
     injectDedup: boolean;
+    suppressEcho: boolean;
     topK: number;
     perTopicBudget: number;
     totalBudget: number;
@@ -126,7 +137,7 @@ export type TopicsConfigValue = {
     distillMaxModelCalls: number;
     pushDebounceSeconds: number;
 };
-export declare const CONFIG_KEYS: readonly ["repo", "autoInject", "injectDedup", "topK", "perTopicBudget", "totalBudget", "matchThreshold", "tagBoost", "injectMode", "qualityLane", "graphDepth", "recencyWindowDays", "autoObserve", "includeSubagents", "observationMaxChars", "distillEveryTurns", "distillOnSessionEnd", "distillProvider", "distillModel", "distillBatchSize", "distillMaxModelCalls", "pushDebounceSeconds"];
+export declare const CONFIG_KEYS: readonly ["repo", "autoInject", "injectDedup", "suppressEcho", "topK", "perTopicBudget", "totalBudget", "matchThreshold", "tagBoost", "injectMode", "qualityLane", "graphDepth", "recencyWindowDays", "autoObserve", "includeSubagents", "observationMaxChars", "distillEveryTurns", "distillOnSessionEnd", "distillProvider", "distillModel", "distillBatchSize", "distillMaxModelCalls", "pushDebounceSeconds"];
 export type ConfigKey = (typeof CONFIG_KEYS)[number];
 /** CamelCase → dash-display (topK → top-k) for command output. */
 export declare function displayKey(key: string): string;

package/lib/config.js

@@ -12,6 +12,11 @@ export const TopicsConfig = z.object({
     autoInject: z.boolean().default(true),
     /** Skip re-injecting topics already injected earlier in the same session. */
     injectDedup: z.boolean().default(true),
+    /** Skip re-injecting topics distilled from the CURRENT session's own turns
+     *  (蒸馏回声): the conversation already carries that knowledge, so a
+     *  pointer is a stale echo at best (2026-09 audit: 3 of 6 useless rounds).
+     *  Provenance rides the observations log (sessionId → distilledInto). */
+    suppressEcho: z.boolean().default(true),
     /** Max topics injected per round (ADR 0006: ≤4). */
     topK: z.number().default(4),
     /** Per-topic digest budget in tokens. */
@@ -58,6 +63,7 @@ export const CONFIG_KEYS = [
     'repo',
     'autoInject',
     'injectDedup',
+    'suppressEcho',
     'topK',
     'perTopicBudget',
     'totalBudget',
@@ -93,6 +99,7 @@ export function parseConfigValue(key, raw) {
         }
         case 'autoInject':
         case 'injectDedup':
+        case 'suppressEcho':
         case 'autoObserve':
         case 'distillOnSessionEnd':
         case 'includeSubagents': {

package/lib/distill.d.ts

@@ -69,8 +69,10 @@ export declare class Distiller {
      * caller can hook post-run cleanup — the per-session llm capture in
      * index.ts must live exactly as long as a run that may read it. `manual`
      * is the /topics distill trigger: same lane, same in-flight guard.
+     * `boot-replay` is the session-start backlog drain: a previous exit's
+     * skipped (or killed-mid-run) distill replays here.
      */
-    request(sessionId: string, reason: 'every-n' | 'session-end' | 'manual'): Promise<DistillResult> | undefined;
+    request(sessionId: string, reason: 'every-n' | 'session-end' | 'manual' | 'boot-replay'): Promise<DistillResult> | undefined;
     /** True while a run for the session is still in flight (teardown guard). */
     hasPending(sessionId: string): boolean;
     /** True while ANY session's run is still in flight (exit-dispose guard). */

package/lib/distill.js

@@ -65,6 +65,8 @@ export class Distiller {
      * caller can hook post-run cleanup — the per-session llm capture in
      * index.ts must live exactly as long as a run that may read it. `manual`
      * is the /topics distill trigger: same lane, same in-flight guard.
+     * `boot-replay` is the session-start backlog drain: a previous exit's
+     * skipped (or killed-mid-run) distill replays here.
      */
     request(sessionId, reason) {
         if (!this.configured)

package/lib/git.d.ts

@@ -51,7 +51,10 @@ export interface PullOutcome {
  * `pull --rebase` with conflict containment: on conflict we abort the rebase
  * (ADR 0003 — no automatic smart merging) and report the conflicted paths so
  * the caller can mark those topics. Remote and branch are explicit — the
- * bundle never depends on upstream tracking config.
+ * bundle never depends on upstream tracking config. IDENTITY rides along:
+ * a rebase REPLAYS local commits, which requires a committer identity, and
+ * a fresh machine (CI, new host) may have none — without this the pull
+ * fails with an empty conflicted list on every session start.
  */
 export declare function pullRebase(cwd: string, token?: string, remote?: string, branch?: string): Promise<PullOutcome>;
 export declare function push(cwd: string, token?: string, remote?: string, branch?: string): Promise<{

package/lib/git.js

@@ -117,10 +117,13 @@ export async function fileAtRev(cwd, path, rev) {
  * `pull --rebase` with conflict containment: on conflict we abort the rebase
  * (ADR 0003 — no automatic smart merging) and report the conflicted paths so
  * the caller can mark those topics. Remote and branch are explicit — the
- * bundle never depends on upstream tracking config.
+ * bundle never depends on upstream tracking config. IDENTITY rides along:
+ * a rebase REPLAYS local commits, which requires a committer identity, and
+ * a fresh machine (CI, new host) may have none — without this the pull
+ * fails with an empty conflicted list on every session start.
  */
 export async function pullRebase(cwd, token, remote = 'origin', branch = 'main') {
-    const r = await runGit(['pull', '--rebase', '--autostash', remote, branch], { cwd, token, mayFail: true, timeoutMs: 60_000 }).catch((e) => {
+    const r = await runGit([...IDENTITY, 'pull', '--rebase', '--autostash', remote, branch], { cwd, token, mayFail: true, timeoutMs: 60_000 }).catch((e) => {
         return { code: -1, stdout: '', stderr: String(e instanceof Error ? e.message : e) };
     });
     if (r.code === 0)

package/lib/ilog.d.ts

@@ -51,6 +51,8 @@ export interface InjectionRecord {
     }[];
     /** Slugs blocked this round by session-level injection dedup (never assembled). */
     deduped?: string[];
+    /** Slugs blocked this round as 蒸馏回声 (distilled from this session's own turns). */
+    echoed?: string[];
     usedTokens?: number;
     /** fast = lexical pointers only; slow = async picks only; mixed = both. */
     lane?: 'fast' | 'slow' | 'mixed';

package/lib/ilog.js

@@ -24,12 +24,14 @@ export function aggregateStats(records) {
             budgetSamples += 1;
             budgetSum += r.usedTokens;
         }
-        // topTopics feeds 「Top-N 被注入 Topic」— deduped hits were NOT injected,
-        // so they must not inflate the per-slug injection counts. Retrieval-shape
-        // metrics above (hits/rounds, zero-hit rounds) keep counting raw hits.
+        // topTopics feeds 「Top-N 被注入 Topic」— deduped/echoed hits were NOT
+        // injected, so they must not inflate the per-slug injection counts.
+        // Retrieval-shape metrics above (hits/rounds, zero-hit rounds) keep
+        // counting raw hits.
         const deduped = r.deduped === undefined ? undefined : new Set(r.deduped);
+        const echoed = r.echoed === undefined ? undefined : new Set(r.echoed);
         for (const h of r.hits) {
-            if (deduped?.has(h.slug))
+            if (deduped?.has(h.slug) || echoed?.has(h.slug))
                 continue;
             topicCounts.set(h.slug, (topicCounts.get(h.slug) ?? 0) + 1);
         }

package/lib/index.d.ts

@@ -18,13 +18,13 @@
 import type { Context } from '@deepseek-ai/cordis';
 export declare const name = "dsh-topics-memory";
 /**
- * Bounded wait for the process-exit distill. Session teardown is the last
- * distill trigger, but the disposer used to fire it fire-and-forget — process
- * exit always won the race and the run died unwritten. The disposer now waits
- * for the run, capped so a pathological (hanging) model call can never wedge
- * the host's exit.
+ * Bounded wait for the process-exit meta commit. The exit path is
+ * local-only: no pull/push, no model call — the deferred push rides the
+ * next boot's pull and the skipped exit distill is replayed there. The
+ * window only bounds the local `git commit` against a pathological stall
+ * (a wedged index.lock, a hung filesystem), which should never fire.
  */
-export declare const EXIT_DISTILL_TIMEOUT_MS = 90000;
+export declare const EXIT_COMMIT_TIMEOUT_MS = 10000;
 /**
  * Resolve when `p` settles (rejection swallowed) or after `ms`, whichever
  * comes first. The cap timer is unref'd: an otherwise-idle event loop exits

package/lib/index.js

@@ -11,13 +11,13 @@ import { CONFIG_KEYS, TopicsConfig } from "./config.js";
 import { isDelegated } from "./delegation.js";
 export const name = 'dsh-topics-memory';
 /**
- * Bounded wait for the process-exit distill. Session teardown is the last
- * distill trigger, but the disposer used to fire it fire-and-forget — process
- * exit always won the race and the run died unwritten. The disposer now waits
- * for the run, capped so a pathological (hanging) model call can never wedge
- * the host's exit.
+ * Bounded wait for the process-exit meta commit. The exit path is
+ * local-only: no pull/push, no model call — the deferred push rides the
+ * next boot's pull and the skipped exit distill is replayed there. The
+ * window only bounds the local `git commit` against a pathological stall
+ * (a wedged index.lock, a hung filesystem), which should never fire.
  */
-export const EXIT_DISTILL_TIMEOUT_MS = 90_000;
+export const EXIT_COMMIT_TIMEOUT_MS = 10_000;
 /**
  * Resolve when `p` settles (rejection swallowed) or after `ms`, whichever
  * comes first. The cap timer is unref'd: an otherwise-idle event loop exits
@@ -170,6 +170,7 @@ export function apply(ctx) {
                 return;
             const cfg = cfgNow();
             const seen = cfg.injectDedup ? injectedBySession.get(sessionId) : undefined;
+            const echo = cfg.suppressEcho ? service.echoSlugsSync(sessionId) : undefined;
             // Slow-lane consumption point (v4 生命周期表): the pending produced at
             // the previous turn/end rides THIS splice — consumed or expired, the
             // slot is gone either way (消费即清; expiry surfaces in record.why).
@@ -184,7 +185,7 @@ export function apply(ctx) {
                         slowExpired = consumed.expired;
                 }
             }
-            const r = service.retrieveSync(query, sessionId, seen === undefined ? undefined : { exclude: seen }, slow, slowExpired);
+            const r = service.retrieveSync(query, sessionId, seen === undefined && echo === undefined ? undefined : { exclude: seen, echo }, slow, slowExpired);
             // Mark only what entered the context this round (hits AND slow picks →
             // dedup filter → assemble → registry mark; budget-dropped slugs stay
             // injectable).
@@ -235,6 +236,21 @@ export function apply(ctx) {
             slowLane.dispatch(sessionId, {
                 ring: observer.recentTurns(sessionId),
                 turnId: observer.turnCountOf(sessionId),
+                // The lane must not spend its rerank on slugs this session already
+                // carries (injected earlier / distilled from its own turns) — such a
+                // pick is silently swallowed at consumption and the pending dies.
+                exclude: (() => {
+                    const seen = injectedBySession.get(sessionId);
+                    const echo = cfgNow().suppressEcho ? service.echoSlugsSync(sessionId) : undefined;
+                    if (seen === undefined || seen.size === 0)
+                        return echo;
+                    if (echo === undefined || echo.size === 0)
+                        return seen;
+                    const merged = new Set(seen);
+                    for (const slug of echo)
+                        merged.add(slug);
+                    return merged;
+                })(),
             });
         }
         catch {
@@ -301,10 +317,10 @@ export function apply(ctx) {
     // mid-pipeline deferred to THIS pipeline and never fires again.
     const slowLane = new SlowLane(service, caller, releaseSessionLlm);
     // ---- Observer (M2) ----
-    // The process-exit disposer awaits this run (bounded): the callback below
-    // records it synchronously when the fake 'dispose' session's end trigger
-    // fires, so the disposer can wait for the last distill to land.
-    let exitDistill;
+    // Trigger runs are fire-and-forget everywhere now — including the exit
+    // one. Observations are write-through on disk, so a run the process exits
+    // under is never lost work: its input is still undistilled and the next
+    // boot's replay distills it.
     const observer = new Observer(service, (sessionId, reason) => {
         // Trigger-time capture: the agent is still registered here, so its scoped
         // ctx can hand over the llm instance whose adapters are live.
@@ -321,8 +337,6 @@ export function apply(ctx) {
         // and its own settle hook does the release.
         const run = distiller.request(sessionId, reason);
         if (run !== undefined) {
-            if (sessionId === 'dispose')
-                exitDistill = run;
             void run.finally(() => releaseSessionLlm(sessionId)).catch(() => undefined);
         }
     });
@@ -445,36 +459,63 @@ export function apply(ctx) {
             releaseSessionLlm(sessionId);
         }));
     }
-    // ---- Sync lifecycle: pull on session start, flush on dispose ----
+    // ---- Sync lifecycle: pull on session start, local commit on dispose ----
     ctx.on('session/event', ((session, event) => {
         if (event.type === 'agent/session-start') {
             void sync
                 .pull()
                 .catch(() => undefined)
-                .finally(() => store.ensure().catch(() => undefined));
+                .finally(() => store.ensure().catch(() => undefined))
+                .then(() => {
+                // Boot replay: the observations JSONL is the durable distill queue.
+                // Whatever the previous exit skipped (local-only exit since the
+                // no-network exit commit) or a killed run left unmarked is still
+                // undistilled here. Empty pool and no-model are cheap no-ops inside
+                // the distiller; the per-session dedup guards double runs.
+                void store
+                    .undistilledObservations(1)
+                    .then((pending) => {
+                    if (pending.length === 0)
+                        return;
+                    // Same trigger-time capture the observer callback does: the
+                    // replay run's caller resolves candidates lazily and a fresh
+                    // session has no prior capture to lean on.
+                    try {
+                        captureFromAgent(agents()?.get(session.id));
+                    }
+                    catch {
+                        // contained — the run below fails with the readable
+                        // no-adapter detail instead
+                    }
+                    const run = distiller.request(String(session.id), 'boot-replay');
+                    if (run !== undefined)
+                        void run.catch(() => undefined);
+                })
+                    .catch(() => undefined);
+            });
         }
     }));
     ctx.effect(() => {
         void store.ensure().catch(() => undefined);
         // Async disposer: cordis awaits it during unload (Disposable may be
-        // async), so the exit distill gets its bounded window before the
-        // process goes away instead of always losing the exit race.
+        // async). The exit path is local-only — one git commit of the meta
+        // sidecars (observations / injection log / distill state), no pull, no
+        // push, no model call. The deferred push rides the next boot's pull
+        // (sync.pull replays it) and the skipped exit distill is replayed
+        // there too; both only ever needed the on-disk state, which the commit
+        // below makes durable before the process goes away.
         return () => {
             // A real session's session-end run (agent/disposed trigger, moments
             // earlier) may still be in flight — and the fake-'dispose' run would
             // feed the SAME global pool head to the model a second time (double
             // evaluation, double GC attempts). Skip the exit trigger while any
-            // run is pending; the bounded wait below then simply has nothing
-            // extra to await.
+            // run is pending; its capture is already write-through on disk.
             if (!distiller.hasAnyPending()) {
                 observer.onSessionEvent('dispose', 'agent/disposed', undefined);
             }
             sync.dispose();
-            // The exit flush (final meta commit + ledger flush) rides the SAME
-            // bounded window as the exit distill — fire-and-forget here loses the
-            // exit race that window was built to win.
-            const exitFlush = sync.commitMeta().then(() => sync.flush()).catch(() => undefined);
-            return settleBounded(exitDistill === undefined ? exitFlush : Promise.allSettled([exitDistill, exitFlush]), EXIT_DISTILL_TIMEOUT_MS);
+            const exitFlush = sync.commitMeta().catch(() => undefined);
+            return settleBounded(exitFlush, EXIT_COMMIT_TIMEOUT_MS);
         };
     }, 'topics: lifecycle');
     // ---- /topics command (optional peer) ----
@@ -557,6 +598,7 @@ const DEFAULTS = {
     repo: '',
     autoInject: true,
     injectDedup: true,
+    suppressEcho: true,
     topK: 4,
     perTopicBudget: 300,
     totalBudget: 1500,

package/lib/quality.d.ts

@@ -50,6 +50,14 @@ export type ConsumeResult = {
 export interface DispatchInput {
     ring: readonly RingEntry[];
     turnId: number;
+    /**
+     * Slugs the session already carries — injected earlier this session or
+     * distilled from its own turns (echo). The candidate band drops them
+     * BEFORE the rerank: a pick the fast-lane dedup would silently swallow at
+     * consumption is a wasted aux call and a dead pending (2026-09 audit: 2 of
+     * the first 3 slow-lane outcomes died exactly this way).
+     */
+    exclude?: ReadonlySet<string>;
 }
 /** Extract the first balanced JSON object from model output (tolerates fences). */
 export declare function parseJsonObject(raw: string): Record<string, unknown>;

package/lib/quality.js

@@ -29,6 +29,8 @@ export const SAMPLED_EVERY = 3;
 const RING_CHARS = 6000;
 /** Candidate band size fed to the rerank. */
 const CANDIDATE_LIMIT = 6;
+/** Over-fetch before the exclude filter, so excluded slugs don't thin the band. */
+const CANDIDATE_OVERFETCH = 6;
 export const QUERY_BUILD_PROMPT = [
     '你是检索查询构建器。输入是最近几轮对话。任务：判断「模型此刻需要什么背景知识」，输出一个用于关键词检索的 query。',
     '只输出一个 JSON 对象，不要任何其他文字：{"needs": true, "query": "3-8 个检索词加一句意图", "ignore": ["被你忽略的内容类型"]}',
@@ -205,13 +207,16 @@ export class SlowLane {
             // candidates = threshold passers + the near-miss band beneath them.
             const band = searchTopics(query, roster, {
                 threshold: this.service.cfg.matchThreshold,
-                topK: CANDIDATE_LIMIT,
+                topK: CANDIDATE_LIMIT + CANDIDATE_OVERFETCH,
                 tagBoost: this.service.cfg.tagBoost,
                 graphDepth: 0,
                 recencyWindowDays: this.service.cfg.recencyWindowDays,
                 structuralGate: false,
             });
-            const candidates = [...band.hits, ...band.nearMisses].slice(0, CANDIDATE_LIMIT);
+            const exclude = input.exclude;
+            const candidates = [...band.hits, ...band.nearMisses]
+                .filter((c) => !exclude?.has(c.slug))
+                .slice(0, CANDIDATE_LIMIT);
             if (candidates.length === 0)
                 return;
             const bySlug = new Map(roster.map((r) => [r.slug, r]));

package/lib/service.d.ts

@@ -36,6 +36,8 @@ export interface SlowDelivery {
 }
 export declare class TopicsService {
     private cache;
+    /** mtime-keyed parse of the observations log, grouped by session. */
+    private echoCache;
     readonly store: BundleStore;
     private readonly getConfig;
     readonly sync?: Sync;
@@ -46,6 +48,16 @@ export declare class TopicsService {
     roster(): Promise<RetrievableTopic[]>;
     /** Drop the roster cache (tests, bulk external edits). */
     invalidate(): void;
+    /**
+     * Slugs distilled from THIS session's own turns — the echo set (2026-09
+     * audit finding #3: a topic distilled from in-session knowledge injected
+     * back into the same session is a lagging echo of what the model already
+     * said, occasionally stale enough to contradict the newer in-session
+     * conclusion). Provenance is durable in the observations log: each line
+     * carries `sessionId` and, once distilled, `distilledInto`. Sync read on
+     * the injection hot path, mtime-cached like the roster.
+     */
+    echoSlugsSync(sessionId: string): Set<string>;
     /**
      * Full retrieval round: search → assemble → log (ADR 0006/0007). The
      * injection record is written even for zero-hit rounds — the hit-rate
@@ -61,22 +73,28 @@ export declare class TopicsService {
      *
      * `dedup.exclude` (session-level injection dedup) filters hits AND slow
      * picks before assembly; excluded slugs are reported back as `deduped`
-     * (and logged as `record.deduped`), never packed. `included` mirrors the
-     * fast pointers that entered the context and `slowIncluded` the slow ones
-     * — only these may be marked as injected by the caller; budget-dropped
-     * slugs stay injectable later.
+     * (and logged as `record.deduped`), never packed. `dedup.echo` (蒸馏回声,
+     * v4 audit) filters the same way but reports separately as `echoed` /
+     * `record.echoed`: slugs distilled from THIS session's own turns.
+     * `included` mirrors the fast pointers that entered the context and
+     * `slowIncluded` the slow ones — only these may be marked as injected by
+     * the caller; budget-dropped slugs stay injectable later.
      *
      * `slow` (v4 §4.2) carries the consumed pending when one exists: picks are
      * packed after the fast pointers under the same budget, take log-only
      * shadow re-gate verdicts against the CURRENT query (B3: record, never
-     * block), and fill the record's lane field family.
+     * block), and fill the record's lane field family. A pick the fast lane
+     * already delivers THIS round is counted as slow-delivered (it entered the
+     * context) but not packed twice.
      */
     retrieveSync(query: string, sessionId?: string, dedup?: {
         exclude?: ReadonlySet<string>;
+        echo?: ReadonlySet<string>;
     }, slow?: SlowDelivery, slowExpired?: 'ttl' | 'turn-lag'): {
         text: string;
         outcome: SearchOutcome;
         deduped: string[];
+        echoed: string[];
         included: string[];
         slowIncluded: string[];
     };
@@ -86,7 +104,7 @@ export declare class TopicsService {
      * the store stamps it on every write, so it IS the last-updated instant).
      * Logs an open record for the pointer-open-rate stat.
      */
-    openTopic(slug: string, sessionId?: string): Promise<{
+    openTopic(rawSlug: string, sessionId?: string): Promise<{
         found: boolean;
         slug: string;
         title?: string;