dsh-continual-evolve 0.15.10 → 0.15.11

package/README.md

@@ -7,7 +7,7 @@ English | [中文](README.zh.md)
 [![CI](https://github.com/ZK-Andy/dsh-continual-evolve/actions/workflows/ci.yml/badge.svg)](https://github.com/ZK-Andy/dsh-continual-evolve/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node](https://img.shields.io/badge/node-%5E22.19%20%7C%7C%20%3E%3D24-339933)](package.json)
-[![Tests](https://img.shields.io/badge/tests-333%20passing-brightgreen)]()
+[![Tests](https://img.shields.io/badge/tests-337%20passing-brightgreen)]()
 [![Coverage · statements](https://img.shields.io/badge/coverage_statements-96%25-brightgreen)]()
 [![Coverage · branches](https://img.shields.io/badge/coverage_branches-90%25-green)]()
 [![Coverage · functions](https://img.shields.io/badge/coverage_functions-100%25-brightgreen)]()
@@ -23,7 +23,7 @@ Reusable experience gathered in one session (user preferences, pitfalls, project
 1. **Session-start injection** — the plugin registers a single system-prompt section: the workspace's memory index as a store query (hooks only, whole-line truncated over budget, ordered feedback > user > reference), the central-library path, and a three-line guide. The section is computed once per session and reused byte-for-byte, keeping the system prompt stable and the prompt cache warm; an empty store costs zero tokens.
 2. **Four tools, one writer** — `memory_write` (create/update/delete) is the explicit path for "remember …" / "forget …": every proposal passes the code gates (id shape, type enum, the feedback Why/How contract, secret screening carried over from v1, 64KB body cap, optional `corrects` links to the same-workspace active memory being superseded) inside one transaction. `memory_read` fetches bodies by id and searches by keyword — whitespace-separated terms are AND-combined, with literal substring matching for short terms and whenever the trigram index misses; the injected index carries hooks only. Each memory body served by id increments that memory's view counter (views + last viewed, the same presence heartbeat as skills). `skill_write` (create/update/delete in the project, plus an explicit move-to-global) sediments reusable procedures through the same discipline (kebab ids, secret screening, 64KB cap, no duplicate ids or bodies across scopes); every applied skill is materialized by the plugin as `<workspace>/.agents/skills/<id>/SKILL.md` — the database is the source of truth, the files are a read-only projection patrol restores on drift. `skill_read` fetches skill bodies by id and searches project plus global skills (the project shadows a same-named global); each body served by id increments that skill's view counter (views + last viewed), which the card shows as a presence heartbeat — viewed, not applied, so long-unviewed rows are removal candidates while pruning itself stays human. On hosts without the tools service the plugin degrades to "tell the user" phrasing and stays functional.
 3. **Proposal-based extraction** — the trajectory-to-memory automation, audited in the `extraction_log`: every `agent/turn-stopping` schedules that session's boundary, with state kept **per session** (a run in flight keeps only its newest boundary — coalescing, not queueing; `compaction/start` and session close drain it) and **no idle timer**. A run reads the session increment since its cursor, feeds FTS-similar existing memories to one LLM call, and the model's structured proposal lands through the same gates; failures and rejections never advance the cursor. A cheap pre-gate (increment head + ownership triple-test, tiny verdict) runs first: refusals consume the increment as a model skip without the full call, and an unclear gate fails open to the full call — worst case degrades to the old single-call behavior, never to a stall. Full and gate usages ledger in separate `usage` / `cheap_usage` columns, and a gate that dies keeps its error head in the same row's `cheap_error` — a dead gate stays tellable from a gate that never existed. Internal agents, empty increments, turns without real user prose, and turns that already carried an explicit `memory_write` are mechanically skipped — and every skip is ledgered, consecutive quiet turns of one session as a single row carrying how many wake-ups it stands for.
-4. **Autonomous content-quality loop** — the second background automation, independent from extraction by construction (own prompts, own daily budget, own `review_log` ledger, no cursor; only the store's write gates are shared): a cheap gate model call decides whether a memory/skill entry deserves a close look, and only approvals run the evolve pass that judges content quality (memories on home-ownership plus accuracy/usability/reusability/duplication/freshness, skills on home-ownership plus trigger precision/executability/duplication, where reuse is scope-aware: a project-partition skill is judged inside its project (in-project reuse) and the cross-project test applies to global-scope skills only — a repo-bound row in the global partition is the mis-homed case) and proposes the rewrite. The same three home tests (user/environment vs repo-version subject, name-stripped sentence, repo facts live in ADR/docs) guard the extraction prompt, so repo-version specifics never enter as memories in the first place. Gate/leg failures ledger the error text instead of a bare code. New writes are reviewed as they land, the existing stock drains through a bounded backlog queue, and untouched entries requeue after 30 days. Two hard guarantees bound the autonomy: delete never lands automatically (rewrite or quarantine only — quarantine hides, never deletes) and oversized rewrites degrade to quarantine. A daily cap (default 100 items, new > corrects-linked > stale > spot-check priority, the tail drops instead of rolling over) bounds the token spend, and every terminal path lands one `item-review` verdict row plus one daily rollup row (budget vs reviewed vs backlog vs dropped, tokens split by cheap/evolve purpose) for later replay. Ships in trial mode (`review.dryRun`, default on): verdicts ledgered, nothing applied — and a declined rewrite now rides the row's `proposed` column, because a trial has to show what it would write, not just why.
+4. **Autonomous content-quality loop** — the second background automation, independent from extraction by construction (own prompts, own daily budget, own `review_log` ledger, no cursor; only the store's write gates are shared): a cheap gate model call decides whether a memory/skill entry deserves a close look, and only approvals run the evolve pass that judges content quality (memories on home-ownership plus accuracy/usability/reusability/duplication/freshness, skills on home-ownership plus trigger precision/executability/duplication, where reuse is scope-aware: a project-partition skill is judged inside its project (in-project reuse) and the cross-project test applies to global-scope skills only — a repo-bound row in the global partition is the mis-homed case) and proposes the rewrite. The same three home tests (user/environment vs repo-version subject, name-stripped sentence, repo facts live in ADR/docs) guard the extraction prompt, so repo-version specifics never enter as memories in the first place. Gate/leg failures ledger the error text instead of a bare code, and the gate's own budget (1024 tokens) leaves room for a thinking model's reasoning: a verdict that completed before a cut still counts, while a call that produced no verdict at all (route fault, budget cut) leaves the item queued instead of marking it reviewed. New writes are reviewed as they land, the existing stock drains through a bounded backlog queue, and untouched entries requeue after 30 days. Two hard guarantees bound the autonomy: delete never lands automatically (rewrite or quarantine only — quarantine hides, never deletes) and oversized rewrites degrade to quarantine. A daily cap (default 100 items, new > corrects-linked > stale > spot-check priority, the tail drops instead of rolling over) bounds the token spend, and every terminal path lands one `item-review` verdict row plus one daily rollup row (budget vs reviewed vs backlog vs dropped, tokens split by cheap/evolve purpose) for later replay. Ships in trial mode (`review.dryRun`, default on): verdicts ledgered, nothing applied — and a declined rewrite now rides the row's `proposed` column, because a trial has to show what it would write, not just why.
 5. **Rollback is a ledger, not a mechanism** — every mutation lands an `extraction_log` row with full before/after snapshots; undo means rewriting the `before` values. Skill mutations land the same way in `skill_log`, review verdicts in `review_log`. A hygiene pass rides on every applied run: orphan FTS rows are dropped and secret-bearing rows are quarantined (hidden, never deleted; a quarantined skill's materialized file is removed so it stops loading). The read-only card surfaces quarantine anomalies.
 6. **Read-only card** — mounted on the plugin's page in the official plugin manager (the `plugins.bundle.config` slot; hosts without it silently degrade to no card), shaped like the market's own settings card and aligned with ZCode's Settings → Memory viewer: a dropdown scope selector over the store's workspace partitions (opening on the host's current workspace), a search box, per-entry relative updated times, click-to-preview bodies (5 MiB cap), patrol warnings, and a skills section listing the workspace's project skills plus visible global skills (global rows badged, project shadowing global) with the same preview, each row showing its view count. Localized through the host's `locale/*.json` metadata channel; host theme tokens, the `Button` primitive, and zh/en copy that tracks the DSH language. The card is a request-time projection of the database and has no edit path.
 
@@ -60,8 +60,11 @@ No commands. On the first session after restart the index is injected automatica
 | `review.dryRun` | `true` | Ledger verdicts without landing them (flip off after the trial distribution reads clean) |
 | `review.dailyBudget` | `100` | Reviewed items per UTC day (new > corrects-linked > stale > spot-check, tail drops) |
 | `review.batchSize` | `10` | Max items per drain run |
+| `review.staleDays` | `30` | Days a reviewed item stays out of the queue before it requeues (a review that produced no verdict never counts) |
 | `memoryCard.enabled` | `true` | Read-only memory card in the official plugin manager (degrades to no card when the host lacks `webServer`/`plugins.bundle.config`) |
 
+Every `review.*` field is volatile: a settings surface edits it without a remount, and the scheduler re-reads the values on every drain.
+
 Profile patch example:
 
 ```yaml
@@ -78,7 +81,7 @@ Profile patch example:
 
 ```bash
 pnpm install && pnpm build   # deps + clean build -> lib/
-pnpm test                    # vitest (328 tests)
+pnpm test                    # vitest (337 tests)
 pnpm test:coverage           # v8 coverage, CI-enforced thresholds
 pnpm lint                    # oxlint src test client
 pnpm check:pack              # published-artifact consistency (also runs on prepack)

package/README.zh.md

@@ -7,7 +7,7 @@
 [![CI](https://github.com/ZK-Andy/dsh-continual-evolve/actions/workflows/ci.yml/badge.svg)](https://github.com/ZK-Andy/dsh-continual-evolve/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node](https://img.shields.io/badge/node-%5E22.19%20%7C%7C%20%3E%3D24-339933)](package.json)
-[![Tests](https://img.shields.io/badge/tests-333%20passing-brightgreen)]()
+[![Tests](https://img.shields.io/badge/tests-337%20passing-brightgreen)]()
 [![Coverage · statements](https://img.shields.io/badge/coverage_statements-96%25-brightgreen)]()
 [![Coverage · branches](https://img.shields.io/badge/coverage_branches-90%25-green)]()
 [![Coverage · functions](https://img.shields.io/badge/coverage_functions-100%25-brightgreen)]()
@@ -23,7 +23,7 @@ Agent 每个会话积累的可复用经验（用户偏好、踩坑教训、项
 1. **开局注入** —— 插件只注册一个 system-prompt section：注入本工作区的记忆索引（查库结果，只含钩子，超预算按整行截断，feedback > user > reference 排序）、中央库路径、三行指南。该 section 每会话只算一次并逐字节复用，system prompt 稳定、prompt cache 持续命中；空 store 零 token。
 2. **四个工具，一个写者** —— `memory_write`（create/update/delete）承接显式的记住/忘掉：每条提案过代码门禁（id 规范、type 枚举、feedback 的 Why/How 契约、v1 移植的 secret 筛查、64KB 正文上限、可选 `corrects` 指向被替代的同工作区 active 记忆）后在一个事务内落盘。`memory_read` 按 id 取正文、按关键词检索——空格分隔的关键词取 AND，短词与 trigram 未命中时回退字面子串匹配；注入索引只有钩子。按 id 取到的每份记忆正文计一次查阅（与技能同纪律的存在心跳）。`skill_write`（项目内 create/update/delete + 显式搬到全局）沉淀可复用的操作规程，走同一套纪律（短横线 id、secret 筛查、64KB 上限、跨范围禁重名重文）；每条落地的技能由插件代码物化为 `<workspace>/.agents/skills/<id>/SKILL.md`——库是唯一真相，文件是只读投影，漂移由巡检按库还原。`skill_read` 按 id 取技能正文、检索项目与全局技能（同名时项目遮蔽全局）；按 id 取到的每份正文计一次查阅（查阅次数 + 上次查阅，卡片展示）。这是存在心跳——只证明被翻过，不证明有用：长期零查阅是删除候选，剪枝拍板仍需人工。宿主没有工具服务时降级为告诉用户措辞，注入不受影响。
 3. **提案制提取** —— 轨迹到记忆的自动化，全程 `extraction_log` 可对账：每个 `agent/turn-stopping` 调度**该会话自己**的边界，状态按会话隔离（运行中只保留最新边界——合并而非排队；`compaction/start` 与会话收尾触发 drain），**没有空闲计时器**。一次运行读取该会话游标之后的轨迹增量，用 FTS 取相似既有记忆喂给一次 LLM 调用，模型的结构化提案过同一套门禁落盘；失败与被拒不推游标，下次触发重试。贵调用之前先过一道便宜预检门（增量前 4KB + 归属三测，小 verdict）：拒了直接按 model-skip 消费游标，不烧全量 prompt；门不清不楚就透传给贵调用——最差退化成老单调用，永不 stall。贵用量与门用量分 `usage` / `cheap_usage` 两列记账；门自己挂了按 fail-open 透传，错误原文留在同一行的 `cheap_error`——门死了与门不存在可区分。内部 agent、空增量、无真实用户文本的轮次、当轮已有显式 `memory_write` 的轮次机械跳过——每次跳过都记账，同一会话连续的空转轮次合成一行并累计唤醒次数。
-4. **内容质量自进化环** —— 第二条后台自动化，与提取在结构上独立（自有提示词、自有日预算、自有 `review_log` 账本、无游标；只共享库的写门）：便宜门模型先判某条记忆/技能值不值得细看，批了才跑贵改写，按内容质量打分（记忆：归属 + 准确/可用/可复用/不重复/不过时五维；技能：归属 + 触发精度/可执行完备/不重复三维，其中「可复用」按分区判——项目分区技能只按该项目内跨任务可用判，跨项目可用只对全局分区技能判，绑定本仓库路径/门禁的项目技能不算缺陷）并给出改写提案。同一套归属三测（主语是用户/环境还是某仓库的某版机制、去名后还成立吗、仓库事实住 ADR/docs）也守在提取 prompt 门口，版本细节从源头就不进记忆；评审调用失败记错误原文，不记秃码。新写即审、存量走有界积压队列排空、长期未动 30 天回炉。两条硬保证框住自动化：删除永不自动落盘（只有改写与隔离——隔离隐藏不删），超幅改写自动转隔离。日上限默认 100 条（新写 > 被纠正牵连 > 陈旧 > 抽查，尾部丢弃不滚雪球）框住 token 开销；每条终态落一行 `item-review` verdict 行、每天合一行日 rollup（预算 vs 实审 vs 积压 vs 丢弃，token 按便宜/贵分账），方便以后复盘。默认试运行（`review.dryRun` 开）：只记 verdict 不落盘，且未落盘的拟改稿全文随行进 `proposed` 列——试运行要看的是「改成什么样」，不只是「为什么改」。
+4. **内容质量自进化环** —— 第二条后台自动化，与提取在结构上独立（自有提示词、自有日预算、自有 `review_log` 账本、无游标；只共享库的写门）：便宜门模型先判某条记忆/技能值不值得细看，批了才跑贵改写，按内容质量打分（记忆：归属 + 准确/可用/可复用/不重复/不过时五维；技能：归属 + 触发精度/可执行完备/不重复三维，其中「可复用」按分区判——项目分区技能只按该项目内跨任务可用判，跨项目可用只对全局分区技能判，绑定本仓库路径/门禁的项目技能不算缺陷）并给出改写提案。同一套归属三测（主语是用户/环境还是某仓库的某版机制、去名后还成立吗、仓库事实住 ADR/docs）也守在提取 prompt 门口，版本细节从源头就不进记忆；评审调用失败记错误原文，不记秃码；门自身预算 1024 token，给推理模型的思考留出余量——截断前已完成解析的 verdict 仍算数，而一条 verdict 都没产出的调用（路由故障、预算截断）不让条目记为已评审，而是留队重试。新写即审、存量走有界积压队列排空、长期未动 30 天回炉。两条硬保证框住自动化：删除永不自动落盘（只有改写与隔离——隔离隐藏不删），超幅改写自动转隔离。日上限默认 100 条（新写 > 被纠正牵连 > 陈旧 > 抽查，尾部丢弃不滚雪球）框住 token 开销；每条终态落一行 `item-review` verdict 行、每天合一行日 rollup（预算 vs 实审 vs 积压 vs 丢弃，token 按便宜/贵分账），方便以后复盘。默认试运行（`review.dryRun` 开）：只记 verdict 不落盘，且未落盘的拟改稿全文随行进 `proposed` 列——试运行要看的是「改成什么样」，不只是「为什么改」。
 5. **回滚靠账本，不靠机制** —— 每次变更落一条带 before/after 全文快照的 `extraction_log` 行；undo 就是取 before 重写。技能变更同样落 `skill_log`，评审 verdict 落 `review_log`。每次应用后随跑一次巡检：孤儿 FTS 行清除、含密钥条目隔离（隐藏，不物理删除；被隔离技能的物化文件一并撤下，使其不再被加载）。只读卡片显形巡检异常。
 6. **只读卡片** —— 挂在官方插件管理的本 bundle 页面（`plugins.bundle.config` slot，老宿主自动降级为无卡片）：形态对齐市场自家设置卡，内容对齐 ZCode 设置的记忆选项卡——下拉作用域选择器列出库里的工作区分区（默认选中宿主当前工作区）、搜索框、每条记忆的相对更新时间、点击行内展开正文预览（5 MiB 上限）、巡检异常警告，以及技能区（本工作区技能 + 可见的全局技能，全局行打标记，同名时项目遮蔽全局），预览同记忆，每行显示查阅次数。显示名与描述走宿主 `locale/*.json` 通道双语；宿主主题 token、`Button` 原语、中英文案跟随 DSH 语言。卡片是数据库的请求时投影，没有编辑路径。
 
@@ -60,8 +60,11 @@ dsh plugin add ZK-Andy/dsh-continual-evolve
 | `review.dryRun` | `true` | 只记 verdict 不落盘（试运行分布看顺后再关） |
 | `review.dailyBudget` | `100` | 每天评审上限（新写 > 被纠正牵连 > 陈旧 > 抽查，尾部丢弃） |
 | `review.batchSize` | `10` | 每次 drain 最多审几条 |
+| `review.staleDays` | `30` | 已评审条目重回队列前要等几天（没产出 verdict 的评审从不算数） |
 | `memoryCard.enabled` | `true` | 官方插件管理内的只读记忆卡片（宿主缺 `webServer`/`plugins.bundle.config` 时自动降级为无卡片） |
 
+`review.*` 全部是 volatile 字段：设置界面可在不重挂载的情况下修改，调度器每次 drain 重新读取取值。
+
 profile patch 示例：
 
 ```yaml
@@ -78,7 +81,7 @@ profile patch 示例：
 
 ```bash
 pnpm install && pnpm build   # 依赖 + 干净构建 -> lib/
-pnpm test                    # vitest（328 例）
+pnpm test                    # vitest（337 例）
 pnpm test:coverage           # v8 覆盖率，CI 强制阈值
 pnpm lint                    # oxlint src test client
 pnpm check:pack              # 发布产物一致性（prepack 也会跑）

package/lib/extraction.js

@@ -9,6 +9,8 @@ const UNEXPECTED_ERROR_RAW_MAX = 2048;
 const ERROR_REASON_MAX = 300;
 /** Head length of a failed pre-gate call's error kept in the ledger `cheap_error` column. */
 const GATE_ERROR_MAX = 200;
+/** Output budget for one cheap-gate call (see review.ts's `GATE_MAX_TOKENS`). */
+const GATE_MAX_TOKENS = 1024;
 /** Split an unexpected throw into a ledger-sized reason head and file body. */
 function errorText(error) {
     const message = error instanceof Error && error.message.length > 0 ? error.message : String(error);
@@ -127,9 +129,15 @@ async function runExtractionInner(deps, target, opts) {
     {
         const gateStarted = Date.now();
         try {
-            const gate = await streamOnce(deps.llm, target, cheapPrompt({ incrementHead: increment.slice(0, CHEAP_INCREMENT_MAX), userSeqs: slice.userSeqs }), EXTRACTION_CHEAP_SYSTEM_PROMPT, 512);
+            const gate = await streamOnce(deps.llm, target, cheapPrompt({ incrementHead: increment.slice(0, CHEAP_INCREMENT_MAX), userSeqs: slice.userSeqs }), EXTRACTION_CHEAP_SYSTEM_PROMPT, GATE_MAX_TOKENS);
             cheapUsage = gate.usage;
             const verdict = parseCheapAnswer(gate.text);
+            // A gate cut at its budget that still answered is a usable verdict;
+            // only a cut with nothing parseable rides the run's row as a gate
+            // error. Parse before blaming the finish reason.
+            if (verdict === null && gate.finish !== undefined && gate.finish !== "stop") {
+                throw new Error(`stream finished with ${gate.finish}`);
+            }
             if (verdict !== null && !verdict.worth) {
                 advanceCursor();
                 store.logSkipped({
@@ -163,6 +171,10 @@ async function runExtractionInner(deps, target, opts) {
     let usage;
     try {
         const answer = await streamOnce(deps.llm, target, prompt);
+        // The full call carries the proposal payload: a cut stream is a failure.
+        if (answer.finish !== undefined && answer.finish !== "stop") {
+            throw new Error(`stream finished with ${answer.finish}`);
+        }
         text = answer.text;
         usage = answer.usage;
     }
@@ -267,13 +279,14 @@ async function streamOnce(llm, target, prompt, system = EXTRACTION_SYSTEM_PROMPT
             finish = piece.reason;
         }
     }
-    if (finish !== undefined && finish.kind !== "stop") {
-        throw new Error(`stream finished with ${finish.kind ?? "unknown"}`);
-    }
+    const finishKind = finish?.kind;
     if (text.trim().length === 0) {
-        throw new Error("empty model output");
+        // Nothing usable arrived: the finish reason is the only diagnosis.
+        throw new Error(finishKind !== undefined && finishKind !== "stop" ? `stream finished with ${finishKind}` : "empty model output");
     }
-    return { text, usage };
+    // The caller owns the truncation verdict: a gate answer often completes
+    // before its budget does, a proposal body never does.
+    return { text, usage, finish: finishKind };
 }
 /**
  * Wire the extraction triggers onto the host context. Returns a disposer

package/lib/index.d.ts

@@ -82,19 +82,25 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     /**
      * The autonomous content-quality loop (own prompts, own daily budget,
      * own ledger — shares only the store's write gates with extraction).
-     * `dryRun` ledgers verdicts without landing them (trial mode, default
-     * on); `dailyBudget` caps reviewed items per UTC day (default 100).
+     * Every field is volatile: a settings surface edits them without a
+     * remount, so the scheduler re-reads them per drain instead of capturing
+     * them at mount. `dryRun` ledgers verdicts without landing them (trial
+     * mode, default on); `dailyBudget` caps reviewed items per UTC day
+     * (default 100); `staleDays` is how long a reviewed item stays out of the
+     * queue before it comes back (default 30).
      */
     review: z<Schemastery.ObjectS<NoInfer<{
-        enabled: z<boolean, boolean, "plain">;
-        dryRun: z<boolean, boolean, "plain">;
-        dailyBudget: z<number, number, "plain">;
-        batchSize: z<number, number, "plain">;
+        enabled: z<boolean, boolean, "volatile">;
+        dryRun: z<boolean, boolean, "volatile">;
+        dailyBudget: z<number, number, "volatile">;
+        batchSize: z<number, number, "volatile">;
+        staleDays: z<number, number, "volatile">;
     }>>, Schemastery.ObjectT<NoInfer<{
-        enabled: z<boolean, boolean, "plain">;
-        dryRun: z<boolean, boolean, "plain">;
-        dailyBudget: z<number, number, "plain">;
-        batchSize: z<number, number, "plain">;
+        enabled: z<boolean, boolean, "volatile">;
+        dryRun: z<boolean, boolean, "volatile">;
+        dailyBudget: z<number, number, "volatile">;
+        batchSize: z<number, number, "volatile">;
+        staleDays: z<number, number, "volatile">;
     }>>, "plain">;
     /**
      * The read-only memory card in the official plugin manager
@@ -141,19 +147,25 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     /**
      * The autonomous content-quality loop (own prompts, own daily budget,
      * own ledger — shares only the store's write gates with extraction).
-     * `dryRun` ledgers verdicts without landing them (trial mode, default
-     * on); `dailyBudget` caps reviewed items per UTC day (default 100).
+     * Every field is volatile: a settings surface edits them without a
+     * remount, so the scheduler re-reads them per drain instead of capturing
+     * them at mount. `dryRun` ledgers verdicts without landing them (trial
+     * mode, default on); `dailyBudget` caps reviewed items per UTC day
+     * (default 100); `staleDays` is how long a reviewed item stays out of the
+     * queue before it comes back (default 30).
      */
     review: z<Schemastery.ObjectS<NoInfer<{
-        enabled: z<boolean, boolean, "plain">;
-        dryRun: z<boolean, boolean, "plain">;
-        dailyBudget: z<number, number, "plain">;
-        batchSize: z<number, number, "plain">;
+        enabled: z<boolean, boolean, "volatile">;
+        dryRun: z<boolean, boolean, "volatile">;
+        dailyBudget: z<number, number, "volatile">;
+        batchSize: z<number, number, "volatile">;
+        staleDays: z<number, number, "volatile">;
     }>>, Schemastery.ObjectT<NoInfer<{
-        enabled: z<boolean, boolean, "plain">;
-        dryRun: z<boolean, boolean, "plain">;
-        dailyBudget: z<number, number, "plain">;
-        batchSize: z<number, number, "plain">;
+        enabled: z<boolean, boolean, "volatile">;
+        dryRun: z<boolean, boolean, "volatile">;
+        dailyBudget: z<number, number, "volatile">;
+        batchSize: z<number, number, "volatile">;
+        staleDays: z<number, number, "volatile">;
     }>>, "plain">;
     /**
      * The read-only memory card in the official plugin manager

package/lib/index.js

@@ -31,7 +31,7 @@
 import z from "@deepseek-ai/schemastery";
 import { mountCardRoutes } from "./card-routes.js";
 import { createExtractionScheduler } from "./extraction.js";
-import { createReviewScheduler } from "./review.js";
+import { createReviewScheduler, REVIEW_DEFAULT_BATCH_SIZE, REVIEW_DEFAULT_DAILY_BUDGET, REVIEW_DEFAULT_DRY_RUN, REVIEW_DEFAULT_STALE_DAYS, } from "./review.js";
 import { createFrozenMemorySection, cwdOf, DEFAULT_MAX_CHARS, DEFAULT_MEMORY_SECTION_ORDER, MEMORY_SECTION_NAME, memorySectionText, } from "./memory-section.js";
 import { registerMemoryTools } from "./memory-tools.js";
 import { registerSkillTools } from "./skill-tools.js";
@@ -63,14 +63,19 @@ export const Config = z.object({
     /**
      * The autonomous content-quality loop (own prompts, own daily budget,
      * own ledger — shares only the store's write gates with extraction).
-     * `dryRun` ledgers verdicts without landing them (trial mode, default
-     * on); `dailyBudget` caps reviewed items per UTC day (default 100).
+     * Every field is volatile: a settings surface edits them without a
+     * remount, so the scheduler re-reads them per drain instead of capturing
+     * them at mount. `dryRun` ledgers verdicts without landing them (trial
+     * mode, default on); `dailyBudget` caps reviewed items per UTC day
+     * (default 100); `staleDays` is how long a reviewed item stays out of the
+     * queue before it comes back (default 30).
      */
     review: z.object({
-        enabled: z.boolean(),
-        dryRun: z.boolean(),
-        dailyBudget: z.natural(),
-        batchSize: z.natural(),
+        enabled: z.boolean().volatile(),
+        dryRun: z.boolean().volatile(),
+        dailyBudget: z.natural().volatile(),
+        batchSize: z.natural().volatile(),
+        staleDays: z.natural().volatile(),
     }),
     /**
      * The read-only memory card in the official plugin manager
@@ -140,7 +145,7 @@ function mountExtractionWhenAvailable(host, store, config) {
  */
 function mountReviewWhenAvailable(host, store, config) {
     const log = host.logger("continual-evolve");
-    if (config.review?.enabled === false) {
+    if (config.review?.enabled?.get() === false) {
         log.info("review disabled by config — extraction and tools unaffected");
         return;
     }
@@ -155,10 +160,12 @@ function mountReviewWhenAvailable(host, store, config) {
         const llm = (context.llm ?? context.get?.("llm"));
         createReviewScheduler(events, { store, llm }, {
             enabled: true,
-            dryRun: config.review?.dryRun ?? true,
-            dailyBudget: config.review?.dailyBudget ?? 100,
-            batchSize: config.review?.batchSize ?? 10,
-            staleDays: 30,
+            read: () => ({
+                dryRun: config.review?.dryRun?.get() ?? REVIEW_DEFAULT_DRY_RUN,
+                dailyBudget: config.review?.dailyBudget?.get() ?? REVIEW_DEFAULT_DAILY_BUDGET,
+                batchSize: config.review?.batchSize?.get() ?? REVIEW_DEFAULT_BATCH_SIZE,
+                staleDays: config.review?.staleDays?.get() ?? REVIEW_DEFAULT_STALE_DAYS,
+            }),
             minIntervalMs: 5 * 60 * 1000,
         });
     });

package/lib/review.d.ts

@@ -48,6 +48,18 @@ export interface ReviewRunSummary {
 }
 /** A rewrite lands only when the body-length ratio stays within this bound. */
 export declare const REWRITE_MAGNITUDE_CAP = 0.3;
+/**
+ * Output budget for one cheap-gate call: a verdict JSON **plus** the reasoning
+ * a thinking model spends before emitting it. A 512-token budget cut the gate
+ * off on reasoning-model calls (2026-10-13) and the cut was ledgered as a
+ * route failure, so the per-item failure rate read as a network problem.
+ */
+export declare const GATE_MAX_TOKENS = 1024;
+/** Defaults for the review settings the host may override — and edit live. */
+export declare const REVIEW_DEFAULT_DRY_RUN = true;
+export declare const REVIEW_DEFAULT_DAILY_BUDGET = 100;
+export declare const REVIEW_DEFAULT_BATCH_SIZE = 10;
+export declare const REVIEW_DEFAULT_STALE_DAYS = 30;
 /** Relative body change: |new-old| / max(old, 1). Above the cap → quarantine. */
 export declare function rewriteMagnitude(oldBody: string, newBody: string): number;
 /**
@@ -80,12 +92,21 @@ export interface ReviewSchedulerHost {
         warn(message: string): void;
     };
 }
-export interface ReviewSchedulerConfig {
-    enabled: boolean;
+/** The editable review settings, re-read on every drain. */
+export interface ReviewSettings {
     dryRun: boolean;
     dailyBudget: number;
     batchSize: number;
     staleDays: number;
+}
+export interface ReviewSchedulerConfig {
+    enabled: boolean;
+    /**
+     * Read the current settings for each drain: the host's configuration is
+     * volatile, so values edited live take effect without a remount and are
+     * never captured once at mount time.
+     */
+    read: () => ReviewSettings;
     /** Minimum ms between two drains (default 5 minutes). */
     minIntervalMs: number;
 }

package/lib/review.js

@@ -16,6 +16,18 @@ import { evolvePrompt, gatePrompt, parseEvolveAnswer, parseGateAnswer, REVIEW_CH
 import { cwdOf } from "./memory-section.js";
 /** A rewrite lands only when the body-length ratio stays within this bound. */
 export const REWRITE_MAGNITUDE_CAP = 0.3;
+/**
+ * Output budget for one cheap-gate call: a verdict JSON **plus** the reasoning
+ * a thinking model spends before emitting it. A 512-token budget cut the gate
+ * off on reasoning-model calls (2026-10-13) and the cut was ledgered as a
+ * route failure, so the per-item failure rate read as a network problem.
+ */
+export const GATE_MAX_TOKENS = 1024;
+/** Defaults for the review settings the host may override — and edit live. */
+export const REVIEW_DEFAULT_DRY_RUN = true;
+export const REVIEW_DEFAULT_DAILY_BUDGET = 100;
+export const REVIEW_DEFAULT_BATCH_SIZE = 10;
+export const REVIEW_DEFAULT_STALE_DAYS = 30;
 /** Relative body change: |new-old| / max(old, 1). Above the cap → quarantine. */
 export function rewriteMagnitude(oldBody, newBody) {
     return Math.abs(newBody.length - oldBody.length) / Math.max(oldBody.length, 1);
@@ -194,10 +206,16 @@ async function reviewOne(deps, runId, candidate, opts, summary, skipReasons) {
     let gateUsage = zeroUsage();
     let gateRaw;
     try {
-        const answer = await streamOnce(deps.llm, opts, REVIEW_CHEAP_SYSTEM_PROMPT, gatePrompt(candidate), 512);
+        const answer = await streamOnce(deps.llm, opts, REVIEW_CHEAP_SYSTEM_PROMPT, gatePrompt(candidate), GATE_MAX_TOKENS);
         gateRaw = answer.usage;
         const gate = parseGateAnswer(answer.text);
         if (gate === null) {
+            // A cut gate is a failure only when no complete verdict came
+            // through: the JSON usually lands before the budget runs out, so
+            // parse first and blame the finish reason only if it did not.
+            if (answer.finish !== undefined && answer.finish !== "stop") {
+                throw new Error(`stream finished with ${answer.finish}`);
+            }
             deps.store.logReview({ ...base, verdict: "skip", reason: "gate-parse-failed", cheapUsage: gateRaw, applied: 0 });
             skipReasons.push("gate-parse-failed");
             return;
@@ -231,6 +249,11 @@ async function reviewOne(deps, runId, candidate, opts, summary, skipReasons) {
         const answer = await streamOnce(deps.llm, opts, system, evolvePrompt({ id: candidate.id, title: candidate.title, description: candidate.description, body: candidate.body, extra, scope: candidate.scope }, neighbors), 4096);
         evolveRaw = answer.usage;
         summary.evolveToken += totalOf(evolveRaw);
+        // The evolve pass carries full replacement text: a cut stream may hold
+        // half a body, so it never becomes a verdict.
+        if (answer.finish !== undefined && answer.finish !== "stop") {
+            throw new Error(`stream finished with ${answer.finish}`);
+        }
         const evolved = parseEvolveAnswer(answer.text);
         if (evolved === null) {
             deps.store.logReview({ ...base, verdict: "skip", reason: "evolve-parse-failed", cheapUsage: gateUsage, evolveUsage: evolveRaw, applied: 0 });
@@ -383,13 +406,14 @@ async function streamOnce(llm, opts, system, prompt, maxTokens) {
             finish = piece.reason;
         }
     }
-    if (finish !== undefined && finish.kind !== "stop") {
-        throw new Error(`stream finished with ${finish.kind ?? "unknown"}`);
-    }
+    const finishKind = finish?.kind;
     if (text.trim().length === 0) {
-        throw new Error("empty model output");
+        // Nothing usable arrived: the finish reason is the only diagnosis.
+        throw new Error(finishKind !== undefined && finishKind !== "stop" ? `stream finished with ${finishKind}` : "empty model output");
     }
-    return { text, usage };
+    // The caller owns the truncation verdict: a gate answer often completes
+    // before its budget does, a replacement body never does.
+    return { text, usage, finish: finishKind };
 }
 /** Current UTC day `YYYY-MM-DD` for the hard-cap account. */
 export function todayUtc() {
@@ -429,19 +453,20 @@ export function createReviewScheduler(host, deps, config) {
         pendingWorkspace = undefined;
         void (async () => {
             try {
+                const settings = config.read();
                 const day = todayUtc();
                 const daily = deps.store.getDaily(day);
-                const remaining = config.dailyBudget - (daily?.reviewed ?? 0);
+                const remaining = settings.dailyBudget - (daily?.reviewed ?? 0);
                 if (remaining <= 0) {
                     return;
                 }
-                const candidates = collectCandidates(deps.store, { staleDays: config.staleDays, limit: config.batchSize * 2 });
+                const candidates = collectCandidates(deps.store, { staleDays: settings.staleDays, limit: settings.batchSize * 2 });
                 const ordered = workspace === undefined
                     ? candidates
                     : [...candidates.filter((c) => c.workspaceId === workspace), ...candidates.filter((c) => c.workspaceId !== workspace)];
-                await runReviewBatch(deps, ordered.slice(0, config.batchSize), {
-                    day, budget: config.dailyBudget, dryRun: config.dryRun,
-                    batchSize: config.batchSize, staleDays: config.staleDays,
+                await runReviewBatch(deps, ordered.slice(0, settings.batchSize), {
+                    day, budget: settings.dailyBudget, dryRun: settings.dryRun,
+                    batchSize: settings.batchSize, staleDays: settings.staleDays,
                     provider: lastRoute?.provider, model: lastRoute?.model, sessionId: lastRoute?.sessionId,
                 });
             }
@@ -474,7 +499,8 @@ export function createReviewScheduler(host, deps, config) {
         drain(pendingWorkspace);
         pendingWorkspace = undefined;
     }));
-    host.logger("continual-evolve").info(`review scheduler armed (daily cap ${config.dailyBudget}, dry-run ${config.dryRun ? "on" : "off"})`);
+    const armed = config.read();
+    host.logger("continual-evolve").info(`review scheduler armed (daily cap ${armed.dailyBudget}, dry-run ${armed.dryRun ? "on" : "off"})`);
     return () => {
         pendingWorkspace = undefined;
         for (const listener of listeners) {

package/lib/store.js

@@ -37,6 +37,14 @@ const LEDGER_OCCURRENCES = "occurrences";
  * row per occurrence — a persistent fault deserves a timeline, not a counter.
  */
 const COALESCED_SKIP_REASONS = new Set(["no-user-prose", "no-new-events"]);
+/**
+ * Verdict rows that leave an item queued: a call that never produced a verdict
+ * must not read as "reviewed". Without this a single gate fault (a route blip,
+ * a budget cut) locked the item out for `staleDays`, because the failure row
+ * counted as a finished review (2026-10-13).
+ */
+const INCOMPLETE_REVIEW_SQL = "(coalesce(reason, '') LIKE 'gate-llm-failed%' OR coalesce(reason, '') LIKE 'evolve-llm-failed%' " +
+    "OR coalesce(reason, '') IN ('no-route', 'budget-exhausted', 'gate-parse-failed', 'evolve-parse-failed'))";
 const DDL = `
 PRAGMA journal_mode=WAL;
 PRAGMA busy_timeout=5000;CREATE TABLE IF NOT EXISTS memories (
@@ -361,7 +369,7 @@ export async function openMemoryStore(explicitPath) {
             "ON CONFLICT (workspace_id, memory_id) DO UPDATE SET use_count = use_count + 1, last_used_at = excluded.last_used_at"),
         reviewLog: database.prepare("INSERT INTO review_log (run_id, ts, workspace_id, item_kind, item_id, verdict, reason, proposed, cheap_usage, evolve_usage, applied, evolve_count) " +
             "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
-        reviewLast: database.prepare("SELECT ts, applied FROM review_log WHERE workspace_id IS ? AND item_kind = ? AND item_id = ? ORDER BY rowid DESC LIMIT 1"),
+        reviewLast: database.prepare(`SELECT ts, applied FROM review_log WHERE workspace_id IS ? AND item_kind = ? AND item_id = ? AND NOT ${INCOMPLETE_REVIEW_SQL} ORDER BY rowid DESC LIMIT 1`),
         reviewEvolved: database.prepare("SELECT COUNT(*) AS n FROM review_log WHERE workspace_id IS ? AND item_kind = ? AND item_id = ? AND applied = 1"),
         reviewPrune: database.prepare("DELETE FROM review_log WHERE ts < ?"),
         dailyGet: database.prepare("SELECT * FROM review_daily WHERE day = ?"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-continual-evolve",
-  "version": "0.15.10",
+  "version": "0.15.11",
   "description": "ZCode-style workspace memory for DeepSeek Harness: one central SQLite store partitioned by workspace, index injection, and sole-writer gated writes.",
   "license": "MIT",
   "repository": {