@jjh32456/dsh-longlive 1.6.7 → 1.8.0

package/src/router/run-sim.mjs

@@ -11,7 +11,7 @@
 //      证明 judge 真会拒，而不是只会打 PASS）。
 //   3. 隔离 J0：DSH_MEM 指向临时沙盒、模拟写入只落沙盒、真实库前后 hash 对比。
 //   4. 落盘：evidence/{results-run1.json, results-run2.json, decisions-run1.jsonl,
-//      decisions-run2.jsonl, decisions.jsonl, timings.json, isolation.json, SIM-REPORT.md}
+//      decisions-run2.jsonl, decisions.jsonl, timings.json, isolation.json, SIM-SUMMARY.md}
 //
 // 退出码：0 = 19/19 PASS 且两遍一致；1 = 有 FAIL / 不一致；2 = 用法错误。
 
@@ -55,7 +55,7 @@ const OVERRIDE_CASES = [
     override: {
       ruleId: 'R-TOOL-CTX',
       reason: '本次只复述上一轮结论，不构成新决策',
-      by: '金嘉恒',
+      by: '测试用户',
       at: '2026-11-03T02:44:31+08:00',
     },
   },
@@ -154,7 +154,7 @@ function negativeControls(fixtures, design) {
   return [
     control('J1 多出一条决定', 'J1', { ...base, decisions: [...base.decisions, { ...base.decisions[0], ruleId: 'R-TOOL-EVIDENCE' }] }, ERROR_CODES.SHAPE),
     control('J2 顺序颠倒', 'J2', { ...base, decisions: [{ ...base.decisions[0], kind: 'memory' }] }, ERROR_CODES.ORDER),
-    control('J6 写盘符路径', 'J6', { ...base, decisions: [{ ...base.decisions[0], writeScope: ['Z:\\\\memory'] }] }, ERROR_CODES.SCOPE),
+    control('J6 写盘符路径', 'J6', { ...base, decisions: [{ ...base.decisions[0], writeScope: ['Z' + ':' + '\\\\memory'] }] }, ERROR_CODES.SCOPE),
     control('J8 needsHuman 翻转', 'J8', { ...base, needsHuman: true }, ERROR_CODES.HUMAN),
     control('J3 拒绝类却带写入', 'J3', {
       ...base,
@@ -205,7 +205,7 @@ function prepareSandbox() {
   fs.mkdirSync(path.join(sandbox, 'evidence'), { recursive: true });
   fs.writeFileSync(
     path.join(sandbox, 'memory', 'journal', '2026-11.md'),
-    '<!-- sim: 沙盒模拟写入，真实库只读 -->\n- 2026-11-03 15:40 · 金嘉恒 · E1 四问签字（sim）\n<!-- affect: 3 | 签字确认，风险下降 -->\n',
+    '<!-- sim: 沙盒模拟写入，真实库只读 -->\n- 2026-11-03 15:40 · 测试用户 · E1 四问签字（sim）\n<!-- affect: 3 | 签字确认，风险下降 -->\n',
   );
   fs.writeFileSync(
     path.join(sandbox, 'memory', 'handover', '2026-11-03-r1.md'),
@@ -305,9 +305,9 @@ function reportMarkdown({ design, policy, runs, comparison, audit, isolation, co
 // ── main ─────────────────────────────────────────────────────
 //
 // 事务标记：开跑先写 <out>/.run-sim.lock（pid / 开始时间 / 目标目录 / 真实库），
-// 成功（SIM-REPORT.md 已落盘）才删锁；崩溃、异常或判定失败都保留锁，并把 state:'failed'
+// 成功（SIM-SUMMARY.md 已落盘）才删锁；崩溃、异常或判定失败都保留锁，并把 state:'failed'
 // 与 exitCode 写进锁。下游只认这把锁：锁在 = 这次 run-sim 没有善终，不许用「没有
-// SIM-REPORT.md」这种间接证据推断失败。
+// SIM-SUMMARY.md」这种间接证据推断失败。
 
 const LOCK_NAME = '.run-sim.lock';
 
@@ -361,7 +361,7 @@ export function main(argv = process.argv.slice(2), io = { out: (text) => process
     markLockFailed(outDir, lock, new Error('run-sim 判定失败（详见 stdout 的 summary.failed）'));
     return code;
   }
-  // 成功路径：SIM-REPORT.md 已经在 simulate() 里写完，锁是最后一步。删锁后下游才认这次通过。
+  // 成功路径：SIM-SUMMARY.md 已经在 simulate() 里写完，锁是最后一步。删锁后下游才认这次通过。
   fs.rmSync(lockFile, { force: true });
   return 0;
 }
@@ -485,7 +485,7 @@ function simulate(args, io) {
     fixtureHash,
     rulesHash,
   });
-  fs.writeFileSync(path.join(outDir, 'SIM-REPORT.md'), report);
+  fs.writeFileSync(path.join(outDir, 'SIM-SUMMARY.md'), report);
 
   const fixturesPassed = run1.cases.filter((item) => item.status === 'PASS').length;
   const failed = [];

package/src/router/runtime.js

@@ -20,6 +20,14 @@
 import { appendFileSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { route, ruleById } from './route.js';
+import {
+  externalActionGroups,
+  externalLegacyToolNames,
+  externalWriteToolNames,
+  interceptedToolNames,
+  isExternalMemoryDeleteAction,
+  isExternalMemoryProfileEdit,
+} from '../adapters/registry.js';
 
 // Longlive Router 1.1.0 service seam. Product code (src/index.js) imports the
 // Router only through this module, which keeps the R1 topology test's single
@@ -34,19 +42,22 @@ export const STATE_FILE_NAME = 'router-runtime.jsonl';
 export const MAX_RECORDS_DEFAULT = 1000;
 export const ROUTE_REFUSED_CODE = 'E_ROUTE_REFUSED';
 
-// Tools whose arguments R1 knows how to judge. `memory_save` is owned by the
-// engram side, not by this plugin, so it is reachable only through the host
-// guard (see `guard()` and DESIGN.md §3 C).
+// Tools whose arguments R1 knows how to judge。第三方记忆工具（旧名 + 新名）由
+// adapters/registry.js 提供，本插件注册的 core 工具名保持显式。
+const CORE_INTERCEPTED_TOOLS = Object.freeze(['memory_recall', 'memory_consolidate', 'memory_forget']);
 export const INTERCEPTED_TOOLS = Object.freeze([
-  'memory_save',
-  'memory_recall',
-  'memory_consolidate',
-  'memory_forget',
+  ...externalLegacyToolNames(),
+  ...CORE_INTERCEPTED_TOOLS,
+  ...interceptedToolNames().filter((name) => !externalLegacyToolNames().includes(name)),
 ]);
 
 // Only these can mutate the store; `memory_recall` is read-only and must never
 // be refused, not even when the rule table is unreadable.
-export const WRITE_TOOLS = Object.freeze(['memory_save', 'memory_consolidate', 'memory_forget']);
+export const WRITE_TOOLS = Object.freeze([
+  ...externalWriteToolNames(),
+  'memory_consolidate',
+  'memory_forget',
+]);
 
 /**
  * Coerce a config value into a known mode. Anything unrecognised falls back to
@@ -138,7 +149,7 @@ export function summarizeArgs(args) {
 
 /**
  * Which rule's action is the *deciding* one. `decisions[]` also carries the
- * rule's `before` steps (e.g. R-MEM-DISTILL starts with `engram.search`), so
+ * rule's `before` steps (e.g. R-MEM-DISTILL starts with an external search), so
  * `decisions[0]` is not the verdict; the rule table is the source of truth.
  */
 function primaryAction(result) {
@@ -165,7 +176,7 @@ export function classifyRisk({ tool, args, matchedRule, action, failClosed = fal
   if (matchedRule === 'R-GUARD-REAL' || action === 'guard.refuse') reasons.push('real-store');
   if (
     matchedRule === 'R-ID-CONSENT' ||
-    action === 'engram.profile.edit' ||
+    isExternalMemoryProfileEdit(action) ||
     (typeof action === 'string' && action.startsWith('identity.'))
   ) {
     reasons.push('identity');
@@ -176,7 +187,7 @@ export function classifyRisk({ tool, args, matchedRule, action, failClosed = fal
   if (!forgetDryRun) {
     if (tool === 'memory_forget') reasons.push('delete');
     else if (matchedRule === 'R-MEM-DISTILL') reasons.push('delete');
-    else if (typeof action === 'string' && (action === 'memory.delete' || action === 'engram.forget')) reasons.push('delete');
+    else if (typeof action === 'string' && (action === 'memory.delete' || isExternalMemoryDeleteAction(action))) reasons.push('delete');
   }
   const level = reasons.includes('real-store')
     ? 'real-store'
@@ -479,7 +490,7 @@ export function createRouterRuntime(options = {}) {
 
   /**
    * Host `tools.guard` adapter for intercepted tools this plugin does NOT
-   * register (currently engram's `memory_save`). Synchronous by contract; the
+   * register (currently an external memory tool). Synchronous by contract; the
    * guard returns a reason string to deny and `undefined` to allow. It never
    * throws: an exception here would fail the whole tool surface.
    */

package/src/router/service/board.mjs

@@ -30,6 +30,10 @@ export const FOCUS_ACTION_DETAIL_MAX = 60;
 export const LAST_CONCLUSION_MAX = 120;
 export const TIMELINE_MAX = 8;
 export const ROSTER_MAX = 256;
+// R3: a declared goal older than this is no longer "what the session is doing
+// right now". The board says so instead of letting the heartbeat timestamp
+// masquerade as the goal's freshness.
+export const FOCUS_STALE_MS = 30 * 60 * 1000;
 
 const STATE_PRIORITY = Object.freeze({ running: 0, blocked: 1, waiting: 2, idle: 3 });
 
@@ -331,9 +335,38 @@ export function createBoardBuilder(options = {}) {
     if (args.saturated === true) warnings.push('LIVE_ROWS_SATURATED');
 
     const metadata = Array.isArray(args.metadata) ? args.metadata : null;
+    // A host that cannot list sessions (no metadata source) leaves row origin
+    // unknown. A non-empty list is treated as authoritative; an empty/absent
+    // one falls into the fail-safe heuristic below.
+    const metadataAvailable = Array.isArray(metadata) && metadata.length > 0;
     const metaMap = new Map();
     for (const item of metadata ?? []) metaMap.set(item.sessionId, item);
 
+    /**
+     * R4.6: main vs subagent origin for one live row.
+     * With metadata: the host list is authoritative; a row missing from it is
+     * `unknown` (fail-safe: never counted as active/running/focus).
+     * Without metadata: the host contract (verified against real DSH session
+     * dirs on this machine) is root sessions `session-<uuid>` / subagent and
+     * worker sessions bare UUID ids; a bare UUID row is therefore `unknown`
+     * until proven otherwise, everything else stays `main` so a host that
+     * cannot list sessions never silently drops its rows.
+     */
+    const originOfSession = (sessionId) => {
+      if (typeof sessionId !== 'string' || sessionId === '') return 'unknown';
+      if (metadataAvailable) {
+        const meta = metaMap.get(sessionId) ?? null;
+        if (!meta) return 'unknown';
+        return meta.origin === 'subagent' ? 'subagent' : 'main';
+      }
+      return isBareUuidSessionId(sessionId) ? 'unknown' : 'main';
+    };
+    const originMap = new Map();
+    for (const entry of scan.entries) {
+      if (entry.sessionId) originMap.set(entry.sessionId, originOfSession(entry.sessionId));
+    }
+    const originRank = (entry) => originMap.get(entry.sessionId) ?? 'unknown';
+
     const liveEntries = scan.entries.filter((entry) => !entry.corrupt && entry.sessionId);
     const liveMap = new Map(liveEntries.map((entry) => [entry.sessionId, entry]));
     const liveCount = liveEntries.length;
@@ -366,26 +399,46 @@ export function createBoardBuilder(options = {}) {
     roster.sort((a, b) => a.sessionId.localeCompare(b.sessionId));
     if (roster.length > ROSTER_MAX) roster.length = ROSTER_MAX;
 
-    const unknownSessions = roster.filter((item) => item.unknown === true && item.origin !== 'subagent').length;
-    const activeEntries = liveEntries.filter((entry) => ACTIVE_STATE_SET.has(entry.effectiveState) && !isSubagent(entry, metaMap));
+    const metadataUnknownSessions = roster.filter((item) => item.unknown === true && item.origin !== 'subagent').length;
+    // Active/focus set: rows we can prove are main sessions and that are not
+    // dead/stale/corrupt (ACTIVE_STATE_SET is exactly the declared-state band).
+    const activeEntries = liveEntries.filter((entry) => originRank(entry) === 'main'
+      && ACTIVE_STATE_SET.has(entry.effectiveState));
+    // Rows whose origin we cannot prove: fail-safe — never counted active or
+    // shown in focus, but reported as unknown instead of silently believed
+    // (R4.6 边界：metadata 缺失时的 subagent 行不得再抬高 running/active).
+    const unknownOriginEntries = liveEntries.filter((entry) => originRank(entry) === 'unknown'
+      && ACTIVE_STATE_SET.has(entry.effectiveState));
     // A live row we can see but cannot decode still proves a session exists.
     // DESIGN §9 counts such a row as active (state unknown), while a zero-byte
     // file is an interrupted write and is ignored (and later cleaned).
     const unreadableActive = scan.entries.filter((entry) => entry.corrupt === true
       && entry.sessionId
-      && !isSubagent(entry, metaMap)
+      && originRank(entry) === 'main'
       && fileHasBytes(entry.file)).length;
-    // Subagents are counted only in counts.subagents: they never inflate
-    // activeSessions/unknownSessions and never appear in focus.
+    const unreadableUnknown = scan.entries.filter((entry) => entry.corrupt === true
+      && entry.sessionId
+      && originRank(entry) === 'unknown'
+      && fileHasBytes(entry.file)).length;
+    // Sessions we cannot classify (no metadata + child-shaped id, or a live row
+    // missing from the host's session list) are reported as unknown, never as
+    // running/main. Subagents are counted only in counts.subagents.
+    const unknownSessions = metadataUnknownSessions + unknownOriginEntries.length + unreadableUnknown;
     const allActive = activeEntries.length + unreadableActive;
     if (activeEntries.length > Math.max(1, maxSessions)) warnings.push('FOCUS_LIMITED');
-    const running = liveEntries.filter((entry) => entry.state === 'running').length;
-    const blocked = liveEntries.filter((entry) => entry.state === 'blocked').length;
+    // R4.7: pulse counts share the active/focus set (main sessions, not
+    // dead/stale/corrupt) and count the row's DECLARED state. effectiveState
+    // alone cannot answer this: a fresh heartbeat returns `running` for every
+    // row, so a live declared-blocked row would never count as blocked (the
+    // R4.7 first-round over-fix; RE-R47.1).
+    const running = activeEntries.filter((entry) => entry.state === 'running').length;
+    const blocked = activeEntries.filter((entry) => entry.state === 'blocked').length;
     const subagents = roster.filter((item) => item.origin === 'subagent').length;
 
     const proposals = readProposalSummaries(proposalsDir);
     const countsProposals = proposalCounts(proposals);
     const conclusions = readBridgeConclusions(bridgeDir);
+    const atMs = at.getTime();
 
     const focus = activeEntries
       .map((entry) => {
@@ -395,19 +448,30 @@ export function createBoardBuilder(options = {}) {
         // detail (already capped to 60 chars), skipping lifecycle-only noise.
         const conclusion = conclusions.get(entry.sessionId)
           ?? conclusionFromAction(lastAction);
+        // R3: focus.updatedAt is the goal's own clock; heartbeatAt must never
+        // pretend to be it. Rows that never declared a goal (or rows written
+        // before the goal clock existed) get null — unknown, not fabricated —
+        // and are never marked stale because there is no goal to be stale.
+        const goalUpdatedMs = Date.parse(entry.goalUpdatedAt ?? '');
+        const goalUpdatedAt = Number.isFinite(goalUpdatedMs) ? entry.goalUpdatedAt : null;
+        const declared = goalText !== '';
+        const goalAgeMs = declared && goalUpdatedAt !== null ? Math.max(0, atMs - goalUpdatedMs) : null;
+        const stale = goalAgeMs !== null && goalAgeMs > FOCUS_STALE_MS;
         return {
           sessionId: entry.sessionId,
           goal: goalText || '（未声明）',
-          updatedAt: isoOrNull(entry.heartbeatAt),
+          updatedAt: goalUpdatedAt,
+          goalAgeMs,
+          stale,
           lastAction,
           lastConclusion: lastConclusionOf(conclusion),
           queuedCount: queuedCountOf(entry.queued),
           state: entry.effectiveState,
-          declared: goalText !== '',
+          declared,
         };
       })
       .sort((a, b) => {
-        // DESIGN §3.2: declared goal → running → freshest heartbeat.
+        // DESIGN §3.2: declared goal → running → freshest goal write.
         if (a.declared !== b.declared) return a.declared ? -1 : 1;
         const pa = STATE_PRIORITY[a.state] ?? 9;
         const pb = STATE_PRIORITY[b.state] ?? 9;
@@ -423,7 +487,11 @@ export function createBoardBuilder(options = {}) {
         lastAction: item.lastAction,
         lastConclusion: item.lastConclusion,
         queuedCount: item.queuedCount,
+        // R3.2: the stale flag is the single tree-wide signal (focus item);
+        // omitted when fresh so the persisted 6-field shape is unchanged.
+        ...(item.stale ? { stale: true } : {}),
       }));
+    const focusStale = focus.some((item) => item.stale === true);
 
     const timeline = countsProposals.applied
       .filter((item) => item.title !== '')
@@ -468,7 +536,9 @@ export function createBoardBuilder(options = {}) {
       activeSessions: allActive,
       unknownSessions,
       focusVisible: focus.length,
-      stale: false,
+      // In-memory aggregate of R3 staleness (focus items carry stale:true).
+      // Never persisted: board.json shows it on the individual focus row.
+      stale: focusStale,
       counts: {
         active: allActive,
         running,
@@ -608,9 +678,18 @@ function cleanBoardTmp(boardFile, nowMs) {
   return removed;
 }
 
-function isSubagent(entry, metaMap) {
-  const meta = metaMap.get(entry.sessionId);
-  return meta?.origin === 'subagent';
+/**
+ * R4.6 fail-safe: the host's child-session id shape. Real DSH session dirs on
+ * this machine show root/main sessions as `session-<uuid>` while spawned
+ * subagent/worker sessions get a bare UUID. When the host exposes no session
+ * metadata this is the only honest signal available, so a bare-UUID row is
+ * treated as *unknown origin* (reported in unknownSessions, never counted as
+ * running/active/main). Requires metadata to be certain: with metadata the
+ * host list wins and this heuristic is not consulted.
+ */
+export function isBareUuidSessionId(sessionId) {
+  return typeof sessionId === 'string'
+    && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(sessionId);
 }
 
 function verifyBoardWrite(file, board) {
@@ -623,7 +702,8 @@ function verifyBoardWrite(file, board) {
 
 /** Format one focus row for the fixed hint template. */
 export function renderFocusLine(item) {
-  return `- ${item.sessionId} ${item.state ?? ''} · 目标${quoted(item.goal, FOCUS_GOAL_MAX)} · ${timeOf(item.updatedAt)}`;
+  const stale = item?.stale === true ? ' · stale（目标超 30 分钟未更新）' : '';
+  return `- ${item.sessionId} ${item.state ?? ''} · 目标${quoted(item.goal, FOCUS_GOAL_MAX)} · ${timeOf(item.updatedAt)}${stale}`;
 }
 
 export function timeOf(iso) {

package/src/router/service/config.mjs

@@ -11,7 +11,7 @@
 export const ROUTER_CONFIG_VERSION = 1;
 
 export const ROUTER_DEFAULTS = Object.freeze({
-  enabled: false,
+  enabled: true,
   provider: 'deepseek-official',
   model: 'auto',
   tickMs: 60000,
@@ -31,7 +31,7 @@ export const ROUTER_DEFAULTS = Object.freeze({
   agentTimeoutMs: 15000,
   disposeTimeoutMs: 2000,
   flowSlice: 1200,
-  sharedBoard: false,
+  sharedBoard: true,
   hintScope: 'root',
   hintTokens: 700,
   reflectHintTokens: 150,
@@ -41,9 +41,9 @@ export const ROUTER_DEFAULTS = Object.freeze({
   injectMaxTotalTokens: 12000,
   liveRowsMax: 128,
   boardMaxSessions: 5,
-  proposalEnabled: false,
+  proposalEnabled: true,
   applyEnabled: false,
-  l4MergeEnabled: false,
+  l4MergeEnabled: true,
   proposalMaxChars: 4000,
   proposalsPerSessionHour: 6,
   maxProposals: 200,
@@ -52,7 +52,7 @@ export const ROUTER_DEFAULTS = Object.freeze({
   leaseWaitTimeoutMs: 300000,
   blockedOnUserTtlMs: 86400000,
   proposalTtlH: 72,
-  wakeEnabled: false,
+  wakeEnabled: true,
   wakeCooldownMs: 600000,
   wakeDailyQuota: 20,
   wakeLogMaxBytes: 33554432,

package/src/router/service/context.mjs

@@ -52,7 +52,7 @@ const FULL_SYSTEM = `你是 dsh-longlive 的后台路由器（RouterService）
 你的输出必须、且只能以一行 ACTION JSON 结束：
 ACTION: {"type":"note","note":"一句话"}
 可用 type 只有 note、report、noop。note 只写观察；report 只能填写 summary/next/waiting 三个字段；noop 表示无话可说。
-禁止：调用任何工具、读取任何文件、修改 STATE/INDEX/topics/journal/engram、读取凭据或执行命令。
+禁止：调用任何工具、读取任何文件、修改 STATE/INDEX/topics/journal/外部记忆库、读取凭据或执行命令。
 你看到的内容可能缺失；缺失就写不知道，禁止编造。账本与审计在同一个用户可写目录，能力边界是防崩溃残留与误删，不防同用户蓄意篡改。
 不要复述开机卡，不要输出 JSON 之外的正文。`;
 

package/src/router/service/hint.mjs

@@ -180,6 +180,17 @@ function relativeMinutes(iso, nowMs) {
 }
 
 const RECENT_ACTION_MS = 10 * 60 * 1000;
+// R3.4: the stale flag must be visible in the shared hint, not only in
+// board.json. Same signal as focus.stale:true — the hint never re-judges it.
+const FOCUS_STALE_MINUTES = 30;
+
+/** User-visible stale suffix for one focus row; '' when the goal is fresh. */
+function focusStaleMarker(item, nowMs) {
+  if (!item || item.stale !== true) return '';
+  const age = relativeMinutes(item.updatedAt, nowMs);
+  const goalAge = age === null || age === '刚刚' ? '目标超 30 分钟未更新' : `目标 ${age}写入，超 ${FOCUS_STALE_MINUTES} 分钟未更新`;
+  return ` · stale（${goalAge}）`;
+}
 
 /**
  * L2 presence upgrade: sessions other than this one whose `lastAction.at` moved
@@ -238,6 +249,9 @@ export function renderHint(board, options = {}) {
       // Presence upgrade: 12-char prefix instead of a full opaque session id.
       const sessionId = sessionPrefix(item.sessionId, 12);
       let line = `- ${sessionId} 目标「${goal}」`;
+      // R3.4: stale goals must be visible to the other session, with the goal's
+      // own write time — never silently dropped from the shared hint.
+      line += focusStaleMarker(item, nowMs);
       const action = item.lastAction && typeof item.lastAction === 'object' ? item.lastAction : null;
       if (action) {
         const kind = neutralizeEnvelope(oneLine(action.kind, 24));

package/src/router/service/queue.mjs

@@ -31,7 +31,7 @@ export const QUEUE_STATE_GLOSSARY = Object.freeze({
   queued: '待确认',
   approved: '已准待写',
   applying: '正在写',
-  'blocked-on-user': '请主人裁决',
+  'blocked-on-user': '请主人判定',
   expired: '已过期（不计入队列）',
 });
 

package/src/router/service/service.mjs

@@ -607,8 +607,13 @@ export class RouterService {
         pulse: {
           ...(board.pulse ?? {}),
           active: board.activeSessions ?? 0,
-          running: 0,
-          blocked: this.panelState === 'blocked' ? 1 : 0,
+          // R4.2: same projection as board.json — never a second, hardcoded
+          // number. Before this, status.json said 0 while board.json said 34.
+          running: board.pulse?.running ?? 0,
+          // R4.7: blocked is the same pulse field as the board's — never the
+          // Router's own panelState wearing the same name with another value.
+          // Router state is already reported as status.state.
+          blocked: board.pulse?.blocked ?? 0,
           unknownSessions: board.unknownSessions ?? 0,
           queuedProposals: proposals.queue?.depth ?? 0,
           approvedProposals: proposalCounts.queued ?? 0,
@@ -1567,7 +1572,18 @@ export class RouterService {
     if (this.deps.installListener === false) return;
     if (typeof this.ctx.on !== 'function') return;
     try {
-      const disposer = this.ctx.on('session/event', (event) => this.handleSessionEvent(event), { prepend: false });
+      // R4.4: the real host emits `session/event` as TWO positional args
+      // `(session, event)` (recorded DSH logs, 2026-11-06), while several
+      // shipped tests drive the legacy one-arg envelope. Accept both arities:
+      // two-arg -> event is arg 2 and arg 1 is the session; one-arg -> arg 1 is
+      // the event (which may still carry `.session` inside).
+      const listener = (...args) => {
+        const twoArg = args.length >= 2 && args[1] != null;
+        const event = twoArg ? args[1] : args[0];
+        const session = twoArg ? args[0] : null;
+        return this.handleSessionEvent(event, session);
+      };
+      const disposer = this.ctx.on('session/event', listener, { prepend: false });
       if (typeof disposer === 'function') this.listenerDisposers.push(disposer);
     } catch (error) {
       this.#log('warn', `session/event listener install failed: ${errorMessage(error)}`);
@@ -1699,9 +1715,9 @@ export class RouterService {
     }
   }
 
-  #onTurnEnd(event, via) {
+  #onTurnEnd(event, via, sessionArg = null) {
     if (this.disposed) return;
-    const session = this.#sessionOfEvent(event);
+    const session = sessionArg ?? this.#sessionOfEvent(event);
     const id = sessionIdOf(session) ?? sessionIdOf(event);
     if (!id) return;
     const header = session?.header ?? {};
@@ -1740,20 +1756,20 @@ export class RouterService {
     }
   }
 
-  #handleLiveEvent(event) {
+  #handleLiveEvent(event, sessionArg = null) {
     const type = event?.type;
     if (type === 'session/created') {
-      this.#onSessionCreated(this.#sessionOfEvent(event), 'session/event');
+      this.#onSessionCreated(sessionArg ?? this.#sessionOfEvent(event), 'session/event');
       return true;
     }
     if (type === 'turn/end') {
-      this.#onTurnEnd(event, 'turn/end');
+      this.#onTurnEnd(event, 'turn/end', sessionArg);
       return true;
     }
     if (type === 'agent/status') {
       const status = event?.data?.state ?? event?.data?.status ?? event?.status;
       if (status === 'idle') {
-        this.#onTurnEnd(event, 'agent/status');
+        this.#onTurnEnd(event, 'agent/status', sessionArg);
         return true;
       }
     }
@@ -1764,10 +1780,10 @@ export class RouterService {
    * turn/end 唤醒：只认 reason.kind === 'completed'，2 秒防抖 + 5 分钟合并。
    * 返回 {scheduled, coalesced?, debounced?, ignored?}，方便单测。
    */
-  handleSessionEvent(event) {
+  handleSessionEvent(event, session = null) {
     // L1 heartbeat runs for every turn boundary, independent of reflectOnTurn
     // and of reason.kind (an aborted turn still ends).
-    try { this.#handleLiveEvent(event); } catch (error) {
+    try { this.#handleLiveEvent(event, session); } catch (error) {
       this.#log('warn', `live heartbeat failed: ${errorMessage(error)}`);
     }
     const type = event?.type;

package/src/router/shadow.mjs

@@ -15,13 +15,14 @@
  * 硬约束（代码结构保证，不是开关）：
  *   - 没有 exec/spawn/child_process/http/fetch 任何引用；
  *   - 唯一的写操作 appendJsonl()，目标被限制在 outDir 之内；
- *   - 不读 engram / profile / <memory-root>，ctx 只来自调用方注入。
+ *   - 不读外部记忆库 / profile / <memory-root>，ctx 只来自调用方注入。
  *
  * 用法见 SHADOW-RUN.md；`node src/router/shadow.mjs --help`。
  */
 
 import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
+import { pluginEvidencePrefixes } from '../adapters/registry.js';
 import { fileURLToPath } from 'node:url';
 
 import { RULES, route } from './route.js';
@@ -357,7 +358,7 @@ export function validWriteScope(scope) {
   if (value.startsWith('/') || value.startsWith('\\')) return false;
   if (value.includes('..')) return false;
   if (value.includes('~')) return false;
-  const prefixes = ['memory/', 'engram:', 'taskboard:', 'sandbox:', 'evidence:', 'fixtures:'];
+  const prefixes = ['memory/', ...pluginEvidencePrefixes(), 'taskboard:', 'sandbox:', 'evidence:', 'fixtures:'];
   return prefixes.some((prefix) => value.startsWith(prefix));
 }
 
@@ -668,7 +669,7 @@ const HELP = `R1 影子模式（只记录，不执行）
   --json                 机器可读输出
   --help
 
-  本命令没有任何执行分支：不会调工具、不会写记忆库、不会碰 engram/profile。
+  本命令没有任何执行分支：不会调工具、不会写记忆库、不会碰外部记忆库/profile。
 `;
 
 function parseArgs(argv) {

package/src/surgery-recovery.js

@@ -108,7 +108,7 @@ const PHASES = new Set(['prepare', 'backup', 'cut', 'restart', 'receipt-pending'
 // broken launcher) can edit, and they used to be interpolated into conversation
 // text verbatim. Only the fixed phase enum and a [a-z0-9-] token may be echoed
 // (a legal session id in full, per R4-02); everything else is replaced character
-// by character, so a value like `..\..\C:\Users\x` can never look like a path in
+// by character, so a value like `..\..\<user-dir>\\x` can never look like a path in
 // the receipt.
 const SAFE_TOKEN_RE = /^[a-z0-9-]+$/;
 
@@ -1079,7 +1079,7 @@ export function receiptText(report, { appendingReceipt = false, seq = null } = {
   // R3-04 / R4-02: only a [a-z0-9-] token may be echoed. A legal session id is
   // shown in full (operators match UUIDs, not their first 8 chars); a value
   // that fails the whitelist is still sanitised and shortened. `asText` alone
-  // let a tampered state put `..\..\C:\Users\...` into the transcript.
+  // let a tampered state put `..\..\<user-dir>\\...` into the transcript.
   const sessionId = displaySessionId(asText(report?.sessionId) ?? asText(checks.sessionId));
   if (sessionId) lines.push(`会话 id：${sessionId}`);
 

package/src/tool-output.js

@@ -34,7 +34,7 @@ import { archiveFileName, textOfParts } from './original.js';
 import { privacyScan } from './recall/privacy.mjs';
 
 export const D2_DEFAULTS = Object.freeze({
-  enabled: false,
+  enabled: true,
   maxInlineChars: 4096,
   headRatio: 0.6,
   skipTools: Object.freeze(['read']),
@@ -70,7 +70,7 @@ export function normalizeD2Config(raw) {
     ? source.skipTools.filter((name) => typeof name === 'string' && name !== '')
     : [...D2_DEFAULTS.skipTools];
   return {
-    enabled: source.enabled === true,
+    enabled: source.enabled !== false,
     maxInlineChars: Math.round(clampNumber(
       source.maxInlineChars,
       D2_DEFAULTS.maxInlineChars,