dsh-continual-evolve 0.15.12 → 0.15.13

package/lib/review-candidates.js

@@ -0,0 +1,113 @@
+/**
+ * Collect review candidates across every workspace carrying active items:
+ * new items first (newest first), then corrects-linked requeues, then stale
+ * requeues (`staleDays`, default 30). Bounded by `limit`.
+ *
+ * @param store - The central store, sole source of the queue.
+ * @param opts - Clock override (tests), staleness window, and queue bound.
+ * @returns Candidates ordered by priority.
+ */
+export function collectCandidates(store, opts = {}) {
+    const now = opts.now ?? Date.now();
+    const staleMs = (opts.staleDays ?? 30) * 24 * 60 * 60 * 1000;
+    const limit = opts.limit ?? 100;
+    const fresh = [];
+    const requeued = [];
+    const stale = [];
+    // One push per enumerated row: store primary keys make (workspace, kind,
+    // id) unique, so no dedup set is needed — a duplicate here would mean a
+    // store invariant broke, and failing loud beats silently merging.
+    const push = (candidate) => {
+        (candidate.priority === 0 ? fresh : candidate.priority === 1 ? requeued : stale).push(candidate);
+    };
+    const partitions = new Set();
+    for (const summary of store.listWorkspaces()) {
+        partitions.add(summary.workspaceId);
+    }
+    for (const summary of store.listSkillWorkspaces()) {
+        partitions.add(summary.workspaceId);
+    }
+    partitions.add("");
+    for (const workspaceId of partitions) {
+        const correctsTargets = new Set();
+        const memories = store.listAll(workspaceId);
+        for (const record of memories) {
+            if (record.corrects !== null && record.corrects.length > 0) {
+                correctsTargets.add(record.corrects);
+            }
+        }
+        for (const record of memories) {
+            if (record.status !== "active") {
+                continue;
+            }
+            const state = store.reviewStateOf(workspaceId, "memory", record.id);
+            const updatedAt = Date.parse(record.updatedAt) || 0;
+            if (state === undefined) {
+                push({ workspaceId, kind: "memory", id: record.id, priority: 0, title: record.title, description: record.description, body: record.body, memoryType: record.type });
+            }
+            else if (correctsTargets.has(record.id)) {
+                push({ workspaceId, kind: "memory", id: record.id, priority: 1, title: record.title, description: record.description, body: record.body, memoryType: record.type });
+            }
+            else if (now - updatedAt >= staleMs) {
+                push({ workspaceId, kind: "memory", id: record.id, priority: 2, title: record.title, description: record.description, body: record.body, memoryType: record.type });
+            }
+        }
+        const projectSeen = new Set();
+        const skillsOf = (partition, scope) => {
+            for (const record of store.listAllSkills(partition)) {
+                if (record.status !== "active" || projectSeen.has(record.id)) {
+                    continue;
+                }
+                projectSeen.add(record.id);
+                const state = store.reviewStateOf(partition, "skill", record.id);
+                const updatedAt = Date.parse(record.updatedAt) || 0;
+                const candidate = {
+                    workspaceId: partition, kind: "skill", id: record.id,
+                    priority: state === undefined ? 0 : 2,
+                    title: record.title, description: record.description, body: record.body, scope,
+                };
+                if (state === undefined || now - updatedAt >= staleMs) {
+                    push(candidate);
+                }
+            }
+        };
+        if (workspaceId !== "") {
+            skillsOf(workspaceId, "project");
+        }
+    }
+    // Global skills ride along once (project rows shadow them per id).
+    skillsGlobal(store, now, staleMs, push);
+    const byPriority = (a, b) => (a.priority - b.priority);
+    return [...fresh, ...requeued, ...stale].sort(byPriority).slice(0, limit);
+}
+/** The global partition's skills, minus every id an active project row shadows. */
+function skillsGlobal(store, now, staleMs, push) {
+    const projectIds = new Set();
+    for (const summary of store.listSkillWorkspaces()) {
+        if (summary.workspaceId === "") {
+            continue;
+        }
+        for (const record of store.listAllSkills(summary.workspaceId)) {
+            // Archived rows shadow nothing (readWithScope shows the global
+            // row once the project row archives after a move-to-global).
+            if (record.status === "active") {
+                projectIds.add(record.id);
+            }
+        }
+    }
+    for (const record of store.listAllSkills("")) {
+        if (record.status !== "active" || projectIds.has(record.id)) {
+            continue;
+        }
+        const state = store.reviewStateOf("", "skill", record.id);
+        const updatedAt = Date.parse(record.updatedAt) || 0;
+        if (state === undefined || now - updatedAt >= staleMs) {
+            push({
+                workspaceId: "", kind: "skill", id: record.id,
+                priority: state === undefined ? 0 : 2,
+                title: record.title, description: record.description, body: record.body, scope: "global",
+            });
+        }
+    }
+}
+//# sourceMappingURL=review-candidates.js.map

package/lib/review-prompt.d.ts

@@ -10,8 +10,23 @@
  * body executability, reusability, non-duplicate). The prompts are
  * deliberately behavior-blind: there are no task datasets here (unlike
  * Hermes GEPA), only the item text plus its provenance.
+ *
+ * Each of the four review jobs has its own gate/evolve prompt pair, and the
+ * memory and skill rubrics contradict each other on home-ownership by design
+ * (a memory must survive having its repo name stripped; a project skill must
+ * not). Sharing one prompt between them is what made the review ring judge
+ * skills by the memory rubric.
+ */
+export declare const REVIEW_MEMORY_CHEAP_SYSTEM_PROMPT = "\u4F60\u662F\u8BB0\u5FC6\u5E93\u7684\u5185\u5BB9\u8BC4\u5BA1\u95E8\u3002\u5148\u8FC7\u5F52\u5C5E\u4E09\u6D4B\uFF1A\u2460\u4E3B\u8BED\u662F\u7528\u6237/\u73AF\u5883\u8FD8\u662F\u67D0\u4ED3\u5E93\u7684\u67D0\u7248\u673A\u5236\uFF08\u7248\u672C\u53F7\u3001\u9608\u503C\u3001\u5F00\u5173\u540D\u51FA\u73B0\u5373\u540E\u8005\uFF09\uFF1B\u2461\u62B9\u6389\u4ED3\u5E93\u540D\u7248\u672C\u53F7\u673A\u5236\u540D\u540E\u53E5\u5B50\u8FD8\u6210\u7ACB\u5417\uFF1B\u2462\u4ED3\u5E93\u4E8B\u5B9E\u4F4F ADR/docs\uFF0C\u8BB0\u5FC6\u53EA\u6536\u8DDF\u4EBA\u8D70\u7684\u3002\u5F52\u5C5E\u4E0D\u8FC7\u76F4\u63A5\u5224 false \u5E76\u6CE8\u660E\u653E\u9519\u5BB6\u3002\u518D\u5224\u503C\u4E0D\u503C\u5F97\u7EC6\u770B\uFF1A\u6709\u660E\u786E\u4E8B\u5B9E\u3001\u505A\u6CD5\u3001\u504F\u597D\u6216\u53EF\u590D\u7528\u89C4\u7A0B\u5C31\u6279\uFF1B\u7A7A\u8BDD\u3001\u7EAF\u8FC7\u7A0B\u8BB0\u5F55\u3001\u4E00\u6B21\u6027\u7684\u77AC\u65F6\u8F93\u51FA\u3001\u5F53\u8F6E\u5DF2\u53EF\u63A8\u5BFC\u7684\u4E00\u5F8B\u62D2\u3002\u53EA\u8F93\u51FA JSON\uFF1A{\"worthReview\": true|false, \"reason\": \"\u4E00\u53E5\u8BDD\"}\u3002";
+/**
+ * The skill cheap gate: the memory gate's rubric inverted on home-ownership.
+ * A skill bound to one repo's paths, gates and workflow cards is a *project
+ * skill* — its home test is the project, not the world — so the gate that
+ * fronted skills with the memory rubric rejected them for being exactly what
+ * they are. Every judgment here is scope-relative, and the scope rides the
+ * user prompt.
  */
-export declare const REVIEW_CHEAP_SYSTEM_PROMPT = "\u4F60\u662F\u8BB0\u5FC6\u5E93\u7684\u5185\u5BB9\u8BC4\u5BA1\u95E8\u3002\u5148\u8FC7\u5F52\u5C5E\u4E09\u6D4B\uFF1A\u2460\u4E3B\u8BED\u662F\u7528\u6237/\u73AF\u5883\u8FD8\u662F\u67D0\u4ED3\u5E93\u7684\u67D0\u7248\u673A\u5236\uFF08\u7248\u672C\u53F7\u3001\u9608\u503C\u3001\u5F00\u5173\u540D\u51FA\u73B0\u5373\u540E\u8005\uFF09\uFF1B\u2461\u62B9\u6389\u4ED3\u5E93\u540D\u7248\u672C\u53F7\u673A\u5236\u540D\u540E\u53E5\u5B50\u8FD8\u6210\u7ACB\u5417\uFF1B\u2462\u4ED3\u5E93\u4E8B\u5B9E\u4F4F ADR/docs\uFF0C\u8BB0\u5FC6\u53EA\u6536\u8DDF\u4EBA\u8D70\u7684\u3002\u5F52\u5C5E\u4E0D\u8FC7\u76F4\u63A5\u5224 false \u5E76\u6CE8\u660E\u653E\u9519\u5BB6\u3002\u518D\u5224\u503C\u4E0D\u503C\u5F97\u7EC6\u770B\uFF1A\u6709\u660E\u786E\u4E8B\u5B9E\u3001\u505A\u6CD5\u3001\u504F\u597D\u6216\u53EF\u590D\u7528\u89C4\u7A0B\u5C31\u6279\uFF1B\u7A7A\u8BDD\u3001\u7EAF\u8FC7\u7A0B\u8BB0\u5F55\u3001\u4E00\u6B21\u6027\u7684\u77AC\u65F6\u8F93\u51FA\u3001\u5F53\u8F6E\u5DF2\u53EF\u63A8\u5BFC\u7684\u4E00\u5F8B\u62D2\u3002\u53EA\u8F93\u51FA JSON\uFF1A{\"worthReview\": true|false, \"reason\": \"\u4E00\u53E5\u8BDD\"}\u3002";
+export declare const REVIEW_SKILL_CHEAP_SYSTEM_PROMPT = "\u4F60\u662F\u6280\u80FD\u5E93\u7684\u5185\u5BB9\u8BC4\u5BA1\u95E8\u3002\u5148\u770B\u5F52\u5C5E\uFF08prompt \u91CC\u6807\u4E86 scope\uFF09\uFF1A\u7ED1\u5B9A\u67D0\u4ED3\u5E93\u7684\u8DEF\u5F84/\u95E8\u7981/\u6D41\u7A0B**\u4E0D\u662F**\u7F3A\u9677\u2014\u2014\u4F4F\u9879\u76EE\u5206\u533A\uFF08scope=project\uFF09\u7684\u6280\u80FD\u672C\u6765\u5C31\u53EA\u5728\u8BE5\u9879\u76EE\u5185\u751F\u6548\uFF0C\u7981\u7528\u300C\u8DE8\u9879\u76EE\u4E0D\u53EF\u590D\u7528\u300D\u300C\u62B9\u6389\u4ED3\u5E93\u540D\u4E0D\u6210\u7ACB\u300D\u5F53\u7406\u7531\u53BB\u62D2\u5B83\uFF1B\u53EA\u6709\u300Cscope=global \u5374\u7ED1\u5B9A\u67D0\u4ED3\u5E93\u300D\u624D\u7B97\u653E\u9519\u5BB6\uFF0C\u76F4\u63A5\u5224 false \u5E76\u6CE8\u660E\u3002\u518D\u5224\u503C\u4E0D\u503C\u5F97\u7EC6\u770B\uFF1Adescription \u8BA9\u4EBA\u5728\u8BE5\u7528\u65F6\u60F3\u5F97\u8D77\u3001\u6B63\u6587\u6B65\u9AA4\u53EF\u6267\u884C\u3001\u6709\u53EF\u590D\u7528\u7684\u89C4\u7A0B\u5C31\u6279\uFF1B\u7A7A\u8BDD\u3001\u4E00\u6B21\u6027\u8F93\u51FA\u3001\u7EAF\u8FC7\u7A0B\u8BB0\u5F55\u3001\u4E0E\u65E2\u6709\u6280\u80FD\u91CD\u590D\u7684\u4E00\u5F8B\u62D2\u3002\u53EA\u8F93\u51FA JSON\uFF1A{\"worthReview\": true|false, \"reason\": \"\u4E00\u53E5\u8BDD\"}\u3002";
 /** Memory rubric: accurate, usable, reusable, non-duplicate, fresh, right-home. */
 export declare const REVIEW_MEMORY_SYSTEM_PROMPT = "\u4F60\u662F\u8BB0\u5FC6\u5E93\u7684\u5185\u5BB9\u8BC4\u5BA1\u3002\u5148\u8FC7\u5F52\u5C5E\u4E09\u6D4B\uFF08\u4E3B\u8BED\u662F\u7528\u6237/\u73AF\u5883\u8FD8\u662F\u67D0\u4ED3\u5E93\u7684\u67D0\u7248\u673A\u5236\uFF1B\u62B9\u6389\u4ED3\u5E93\u540D\u7248\u672C\u53F7\u673A\u5236\u540D\u540E\u8FD8\u6210\u7ACB\u5417\uFF1B\u4ED3\u5E93\u4E8B\u5B9E\u4F4F ADR/docs\uFF09\uFF1A\u5F52\u5C5E\u4E0D\u8FC7\u76F4\u63A5 quarantine \u5E76\u6CE8\u660E\u653E\u9519\u5BB6\u3002\u518D\u6309\u4E94\u7EF4\u5224\uFF1A\u2460\u51C6\u786E\uFF08\u4E8B\u5B9E\u53EF\u4FE1\u3001\u65E0\u5E7B\u89C9\uFF09\uFF1B\u2461\u53EF\u7528\uFF08Why/How \u5177\u4F53\u3001\u53EF\u6267\u884C\uFF0C\u53CD\u9988\u7C7B\u5FC5\u987B\u5E26 Why \u4E0E How to apply\uFF09\uFF1B\u2462\u53EF\u590D\u7528\uFF08\u672A\u6765\u4F1A\u8BDD\u7528\u5F97\u4E0A\uFF09\uFF1B\u2463\u4E0D\u91CD\u590D\uFF08\u4E0E\u5019\u9009\u65E7\u6761\u6BD4\uFF0C\u6709\u91CD\u590D\u5C31\u6307\u51FA\u6765\uFF09\uFF1B\u2464\u4E0D\u8FC7\u65F6\uFF08\u672A\u88AB\u7EA0\u6B63\u94FE\u53D6\u4EE3\uFF09\u3002\u53EA\u8F93\u51FA JSON\uFF1A{\"verdict\": \"keep|rewrite|quarantine\", \"reason\": \"\u4E00\u53E5\u8BDD\", \"title\"?: \"\u6539\u5199\u540E\u6807\u9898\", \"description\"?: \"\u6539\u5199\u540E\u94A9\u5B50\", \"body\"?: \"\u6539\u5199\u540E\u6B63\u6587\u5168\u6587\", \"corrects\"?: \"\u88AB\u53D6\u4EE3\u7684\u540C\u533A\u6761\u76EEid\"}\u3002verdict \u8BF4\u660E\uFF1Akeep=\u4E0D\u52A8\uFF1Brewrite=\u7ED9\u51FA\u6539\u5199\u540E\u5168\u6587\u4E09\u4EF6\uFF1Bquarantine=\u6D89\u5BC6/\u6709\u5BB3/\u5B8C\u5168\u8FC7\u65F6/\u653E\u9519\u5BB6\u3002\u7981\u5220\u9664\uFF0C\u7981\u7F16\u9020\u5F15\u7528\u3002";
 /**
@@ -49,7 +64,6 @@ export declare function evolvePrompt(entry: {
     title: string;
     description: string;
     body: string;
-    extra?: string | undefined;
     scope?: "project" | "global" | undefined;
 }, neighbors: readonly {
     id: string;

package/lib/review-prompt.js

@@ -10,8 +10,23 @@
  * body executability, reusability, non-duplicate). The prompts are
  * deliberately behavior-blind: there are no task datasets here (unlike
  * Hermes GEPA), only the item text plus its provenance.
+ *
+ * Each of the four review jobs has its own gate/evolve prompt pair, and the
+ * memory and skill rubrics contradict each other on home-ownership by design
+ * (a memory must survive having its repo name stripped; a project skill must
+ * not). Sharing one prompt between them is what made the review ring judge
+ * skills by the memory rubric.
+ */
+export const REVIEW_MEMORY_CHEAP_SYSTEM_PROMPT = "你是记忆库的内容评审门。先过归属三测：①主语是用户/环境还是某仓库的某版机制（版本号、阈值、开关名出现即后者）；②抹掉仓库名版本号机制名后句子还成立吗；③仓库事实住 ADR/docs，记忆只收跟人走的。归属不过直接判 false 并注明放错家。再判值不值得细看：有明确事实、做法、偏好或可复用规程就批；空话、纯过程记录、一次性的瞬时输出、当轮已可推导的一律拒。只输出 JSON：{\"worthReview\": true|false, \"reason\": \"一句话\"}。";
+/**
+ * The skill cheap gate: the memory gate's rubric inverted on home-ownership.
+ * A skill bound to one repo's paths, gates and workflow cards is a *project
+ * skill* — its home test is the project, not the world — so the gate that
+ * fronted skills with the memory rubric rejected them for being exactly what
+ * they are. Every judgment here is scope-relative, and the scope rides the
+ * user prompt.
  */
-export const REVIEW_CHEAP_SYSTEM_PROMPT = "你是记忆库的内容评审门。先过归属三测：①主语是用户/环境还是某仓库的某版机制（版本号、阈值、开关名出现即后者）；②抹掉仓库名版本号机制名后句子还成立吗；③仓库事实住 ADR/docs，记忆只收跟人走的。归属不过直接判 false 并注明放错家。再判值不值得细看：有明确事实、做法、偏好或可复用规程就批；空话、纯过程记录、一次性的瞬时输出、当轮已可推导的一律拒。只输出 JSON：{\"worthReview\": true|false, \"reason\": \"一句话\"}。";
+export const REVIEW_SKILL_CHEAP_SYSTEM_PROMPT = "你是技能库的内容评审门。先看归属（prompt 里标了 scope）：绑定某仓库的路径/门禁/流程**不是**缺陷——住项目分区（scope=project）的技能本来就只在该项目内生效，禁用「跨项目不可复用」「抹掉仓库名不成立」当理由去拒它；只有「scope=global 却绑定某仓库」才算放错家，直接判 false 并注明。再判值不值得细看：description 让人在该用时想得起、正文步骤可执行、有可复用的规程就批；空话、一次性输出、纯过程记录、与既有技能重复的一律拒。只输出 JSON：{\"worthReview\": true|false, \"reason\": \"一句话\"}。";
 /** Memory rubric: accurate, usable, reusable, non-duplicate, fresh, right-home. */
 export const REVIEW_MEMORY_SYSTEM_PROMPT = "你是记忆库的内容评审。先过归属三测（主语是用户/环境还是某仓库的某版机制；抹掉仓库名版本号机制名后还成立吗；仓库事实住 ADR/docs）：归属不过直接 quarantine 并注明放错家。再按五维判：①准确（事实可信、无幻觉）；②可用（Why/How 具体、可执行，反馈类必须带 Why 与 How to apply）；③可复用（未来会话用得上）；④不重复（与候选旧条比，有重复就指出来）；⑤不过时（未被纠正链取代）。只输出 JSON：{\"verdict\": \"keep|rewrite|quarantine\", \"reason\": \"一句话\", \"title\"?: \"改写后标题\", \"description\"?: \"改写后钩子\", \"body\"?: \"改写后正文全文\", \"corrects\"?: \"被取代的同区条目id\"}。verdict 说明：keep=不动；rewrite=给出改写后全文三件；quarantine=涉密/有害/完全过时/放错家。禁删除，禁编造引用。";
 /**
@@ -37,10 +52,10 @@ export function evolvePrompt(entry, neighbors) {
     if (entry.scope !== undefined) {
         lines.push(`scope=${entry.scope}`);
     }
+    // Nothing rides after `全文：` — a rubric reminder adjacent to the item
+    // text gets copied back as if it were content (2026-10-14, memory
+    // `codegraph`). The rubric lives in the system prompt only.
     lines.push(`title=${entry.title}`, `钩子=${entry.description}`, "全文：", entry.body);
-    if (entry.extra !== undefined && entry.extra.length > 0) {
-        lines.push("", entry.extra);
-    }
     if (neighbors.length > 0) {
         lines.push("", "同类候选（判重复用）：");
         for (const neighbor of neighbors) {

package/lib/review-ring.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The review ring, assembled as a responsibility chain: cheap gate → evolve
+ * pass → landing. Each link owns exactly one step and hands the item on until
+ * a link terminates the walk; the batch runner (the environment class) is the
+ * only place that knows the order.
+ *
+ * Every terminal path lands exactly one `item-review` row, and every row now
+ * carries the model it ran on — a failure with no route on it cannot be
+ * attributed, which is what left the gate's failure rate unreadable.
+ */
+import { type ChainLink } from "./chain.js";
+import { type ModelSelection } from "./llm-call.js";
+import { type EvolveVerdict } from "./review-prompt.js";
+import { type SubagentLoader } from "./subagent.js";
+import { type UsageTotals } from "./token-usage.js";
+import type { ReviewCandidate, ReviewDeps, ReviewRunOptions, ReviewRunSummary } from "./review.js";
+/** A rewrite lands only when the body-length ratio stays within this bound. */
+export declare const REWRITE_MAGNITUDE_CAP = 0.3;
+/** One item's walk through the ring: the context every link reads and fills in. */
+export interface ReviewItem {
+    readonly deps: ReviewDeps;
+    /** The loader bound to this run's route and session — the only LLM entry point. */
+    readonly loader: SubagentLoader;
+    /** The route this run reviews on, for every row's `model` column. */
+    readonly route: ModelSelection;
+    readonly runId: string;
+    readonly candidate: ReviewCandidate;
+    readonly opts: ReviewRunOptions;
+    readonly summary: ReviewRunSummary;
+    readonly skipReasons: string[];
+    /** Gate facts: the normalized totals later rows carry, and the raw payload rows keep. */
+    gate: {
+        usage: UsageTotals;
+        raw: unknown;
+    };
+    /** The evolve verdict, filled by the evolve link. */
+    evolved?: EvolveVerdict;
+    /** The evolve call's raw usage payload; `undefined` when it never reported one. */
+    evolveUsage?: unknown;
+}
+/**
+ * Assemble the review chain: the environment class owns the order, the links
+ * own their step, and the item carries the run's loader and route.
+ *
+ * @returns The chain, in order, ending in the landing link.
+ */
+export declare function reviewChain(): readonly ChainLink<ReviewItem>[];
+/** One-line error head for ledger rows (fail-loud shape, capped length). */
+export declare function failureHead(error: unknown, max?: number): string;
+/** Relative body change: |new-old| / max(old, 1). Above the cap → quarantine. */
+export declare function rewriteMagnitude(oldBody: string, newBody: string): number;
+//# sourceMappingURL=review-ring.d.ts.map

package/lib/review-ring.js

@@ -0,0 +1,257 @@
+import { observedUsageOf } from "./llm-call.js";
+import { evolvePrompt, gatePrompt } from "./review-prompt.js";
+import { REVIEW_EVOLVE_BY_KIND, REVIEW_GATE_BY_KIND } from "./subagent-defs.js";
+import { cutFailureOf } from "./subagent.js";
+import { normalizeUsage, zeroUsage } from "./token-usage.js";
+/** A rewrite lands only when the body-length ratio stays within this bound. */
+export const REWRITE_MAGNITUDE_CAP = 0.3;
+/**
+ * Assemble the review chain: the environment class owns the order, the links
+ * own their step, and the item carries the run's loader and route.
+ *
+ * @returns The chain, in order, ending in the landing link.
+ */
+export function reviewChain() {
+    return [gateLink(), evolveLink(), landLink()];
+}
+/** Cheap gate: decide whether the item deserves the expensive pass at all. */
+function gateLink() {
+    return {
+        name: "review-gate",
+        async handle(item) {
+            const { deps, candidate } = item;
+            const base = rowBaseOf(item);
+            try {
+                const answer = await item.loader.run(REVIEW_GATE_BY_KIND[candidate.kind], gatePrompt(candidate));
+                const verdict = answer.answer;
+                if (verdict === null) {
+                    // A cut gate is a failure only when no complete verdict came
+                    // through: the JSON usually lands before the budget runs out, so
+                    // parse first and blame the finish reason only if it did not.
+                    if (answer.finish !== undefined && answer.finish !== "stop") {
+                        throw cutFailureOf(answer, item.route);
+                    }
+                    deps.store.logReview({ ...base, verdict: "skip", reason: "gate-parse-failed", cheapUsage: answer.usage, applied: 0 });
+                    item.skipReasons.push("gate-parse-failed");
+                    return "handled";
+                }
+                if (!verdict.worthReview) {
+                    item.summary.cheapToken += totalOf(answer.usage);
+                    deps.store.logReview({ ...base, verdict: "skip", reason: verdict.reason, cheapUsage: answer.usage, applied: 0 });
+                    item.skipReasons.push("cheap-gate");
+                    return "handled";
+                }
+                item.summary.cheapToken += totalOf(answer.usage);
+                item.gate = { usage: normalizedOf(answer.usage), raw: answer.usage };
+                // Approved counts the gate's decision, not the outcome: the
+                // evolve leg may still fail and ledger its own skip row.
+                item.summary.approved += 1;
+                return "next";
+            }
+            catch (error) {
+                // The error text rides the row: a bare `gate-llm-failed` hid a ~50%
+                // per-item failure rate in production (2026-10-12) with no way to
+                // tell transient route faults from systematic ones — and the usage
+                // the call already reported rides it too, or a failed call burns
+                // tokens that no account shows.
+                deps.store.logReview({
+                    ...base, verdict: "skip", reason: `gate-llm-failed: ${failureHead(error)}`,
+                    cheapUsage: observedUsageOf(error), applied: 0,
+                });
+                item.skipReasons.push("gate-llm-failed");
+                return "handled";
+            }
+        },
+    };
+}
+/** The evolve pass: judge the item and produce a verdict, or ledger why not. */
+function evolveLink() {
+    return {
+        name: "review-evolve",
+        async handle(item) {
+            const { deps, candidate } = item;
+            const base = rowBaseOf(item);
+            try {
+                const definition = REVIEW_EVOLVE_BY_KIND[candidate.kind];
+                const neighbors = neighborHooks(deps.store, candidate);
+                const answer = await item.loader.run(definition, evolvePrompt({ id: candidate.id, title: candidate.title, description: candidate.description, body: candidate.body, scope: candidate.scope }, neighbors));
+                item.evolveUsage = answer.usage;
+                item.summary.evolveToken += totalOf(answer.usage);
+                // The evolve pass carries full replacement text: a cut stream may hold
+                // half a body, so it never becomes a verdict.
+                if (answer.finish !== undefined && answer.finish !== "stop") {
+                    throw cutFailureOf(answer, item.route);
+                }
+                if (answer.answer === null) {
+                    deps.store.logReview({
+                        ...base, verdict: "skip", reason: "evolve-parse-failed",
+                        cheapUsage: item.gate.usage, evolveUsage: item.evolveUsage, applied: 0,
+                    });
+                    item.skipReasons.push("evolve-parse-failed");
+                    return "handled";
+                }
+                item.evolved = answer.answer;
+                return "next";
+            }
+            catch (error) {
+                deps.store.logReview({
+                    ...base, verdict: "skip", reason: `evolve-llm-failed: ${failureHead(error)}`,
+                    cheapUsage: item.gate.usage, evolveUsage: observedUsageOf(error) ?? item.evolveUsage, applied: 0,
+                });
+                item.skipReasons.push("evolve-llm-failed");
+                return "handled";
+            }
+        },
+    };
+}
+/** Landing: turn one verdict into a row, and (outside dry-run) into a change. */
+function landLink() {
+    return {
+        name: "review-land",
+        handle(item) {
+            const evolved = item.evolved;
+            if (evolved === undefined) {
+                // A landing link reached without a verdict is a wiring bug: fail
+                // loud instead of writing a row with nothing behind it.
+                throw new Error(`review landing reached without a verdict for ${item.candidate.kind} ${item.candidate.id}`);
+            }
+            if (evolved.verdict === "keep") {
+                item.deps.store.logReview({
+                    ...rowBaseOf(item), verdict: "keep", reason: evolved.reason,
+                    cheapUsage: item.gate.usage, evolveUsage: item.evolveUsage, applied: 0,
+                });
+                return "handled";
+            }
+            if (evolved.verdict === "quarantine") {
+                landQuarantine(item, evolved, evolved.reason);
+                return "handled";
+            }
+            // Rewrite: magnitude cap first, dry-run second, gates last.
+            const nextBody = evolved.body ?? item.candidate.body;
+            if (rewriteMagnitude(item.candidate.body, nextBody) > REWRITE_MAGNITUDE_CAP) {
+                landQuarantine(item, evolved, `幅度超限转隔离：${evolved.reason}`);
+                return "handled";
+            }
+            if (item.opts.dryRun) {
+                item.deps.store.logReview({
+                    ...rowBaseOf(item), verdict: "rewrite", reason: `试运行未落盘：${evolved.reason}`,
+                    proposed: proposedOf(evolved), cheapUsage: item.gate.usage, evolveUsage: item.evolveUsage, applied: 0,
+                });
+                return "handled";
+            }
+            landRewrite(item, evolved);
+            return "handled";
+        },
+    };
+}
+/** Quarantine (or, in trial mode, the row it would have written). */
+function landQuarantine(item, evolved, reason) {
+    const { deps, candidate, opts, summary } = item;
+    const prior = evolveCountOf(deps.store, candidate);
+    if (opts.dryRun) {
+        deps.store.logReview({
+            ...rowBaseOf(item), verdict: "quarantine", reason: `试运行未隔离：${reason}`, proposed: proposedOf(evolved),
+            cheapUsage: item.gate.usage, evolveUsage: item.evolveUsage, applied: 0, evolveCount: prior,
+        });
+        return;
+    }
+    const ok = deps.store.quarantine(candidate.workspaceId, candidate.kind, candidate.id);
+    deps.store.logReview({
+        ...rowBaseOf(item), verdict: "quarantine", reason,
+        cheapUsage: item.gate.usage, evolveUsage: item.evolveUsage,
+        applied: ok ? 1 : 0, evolveCount: ok ? prior + 1 : prior,
+    });
+    if (ok) {
+        summary.applied += 1;
+    }
+}
+/** Apply one rewrite through the store's write gates. */
+function landRewrite(item, evolved) {
+    const { deps, candidate, opts, summary } = item;
+    const prior = evolveCountOf(deps.store, candidate);
+    const ctx = {
+        workspaceId: candidate.workspaceId, trigger: "item-review",
+        sessionId: opts.sessionId, runId: item.runId, model: opts.model, decision: evolved.reason,
+    };
+    const outcome = candidate.kind === "memory"
+        ? deps.store.applyProposals(ctx, [{
+                action: "update", id: candidate.id,
+                title: evolved.title, description: evolved.description, body: evolved.body, corrects: evolved.corrects,
+            }])[0]
+        : deps.store.applySkillProposals(ctx, [{
+                action: "update", scope: candidate.scope ?? "project", id: candidate.id,
+                title: evolved.title, description: evolved.description, body: evolved.body,
+            }]).outcomes[0];
+    const ok = outcome !== undefined && outcome.ok;
+    deps.store.logReview({
+        ...rowBaseOf(item), verdict: "rewrite", reason: ok ? evolved.reason : `门禁拒绝：${outcome?.reason ?? "未知原因"}`,
+        cheapUsage: item.gate.usage, evolveUsage: item.evolveUsage, applied: ok ? 1 : 0, evolveCount: ok ? prior + 1 : prior,
+    });
+    if (ok) {
+        summary.applied += 1;
+    }
+}
+function rowBaseOf(item) {
+    return {
+        runId: item.runId,
+        workspaceId: item.candidate.workspaceId,
+        itemKind: item.candidate.kind,
+        itemId: item.candidate.id,
+        model: item.route.model,
+    };
+}
+function evolveCountOf(store, candidate) {
+    return store.reviewStateOf(candidate.workspaceId, candidate.kind, candidate.id)?.evolveCount ?? 0;
+}
+/**
+ * The rewrite payload a non-landing row keeps: exactly the fields the model
+ * supplied, or `undefined` when it proposed no text at all.
+ */
+function proposedOf(evolved) {
+    const payload = {};
+    if (evolved.title !== undefined) {
+        payload.title = evolved.title;
+    }
+    if (evolved.description !== undefined) {
+        payload.description = evolved.description;
+    }
+    if (evolved.body !== undefined) {
+        payload.body = evolved.body;
+    }
+    if (evolved.corrects !== undefined) {
+        payload.corrects = evolved.corrects;
+    }
+    return Object.keys(payload).length === 0 ? undefined : payload;
+}
+/** Similar existing items (hooks only) for the model's duplication check. */
+function neighborHooks(store, candidate) {
+    try {
+        if (candidate.kind === "memory") {
+            const query = candidate.title.slice(0, 60);
+            const hits = query.length >= 3 ? store.search(candidate.workspaceId, query, 5) : store.list(candidate.workspaceId).slice(0, 5);
+            return hits.filter((hit) => hit.id !== candidate.id).slice(0, 4).map((hit) => ({ id: hit.id, title: hit.title, description: hit.description }));
+        }
+        const hits = store.searchSkills(candidate.workspaceId, candidate.title.slice(0, 60), 5);
+        return hits.filter((hit) => hit.id !== candidate.id).slice(0, 4).map((hit) => ({ id: hit.id, title: hit.title, description: hit.description }));
+    }
+    catch {
+        return [];
+    }
+}
+function totalOf(raw) {
+    return normalizeUsage(raw)?.total ?? 0;
+}
+/** One-line error head for ledger rows (fail-loud shape, capped length). */
+export function failureHead(error, max = 120) {
+    const message = error instanceof Error ? error.message : String(error);
+    const head = message.split("\n", 1)[0] ?? "";
+    return head.length > max ? `${head.slice(0, max)}…` : head;
+}
+/** Relative body change: |new-old| / max(old, 1). Above the cap → quarantine. */
+export function rewriteMagnitude(oldBody, newBody) {
+    return Math.abs(newBody.length - oldBody.length) / Math.max(oldBody.length, 1);
+}
+function normalizedOf(raw) {
+    return normalizeUsage(raw) ?? zeroUsage();
+}
+//# sourceMappingURL=review-ring.js.map

package/lib/review.d.ts

@@ -1,5 +1,5 @@
-import type { MemoryStore } from "./store.js";
 import { type LlmRuntime, type RouteResolver } from "./llm-call.js";
+import type { MemoryStore } from "./store.js";
 /** The LLM face review calls, aliased so each scheduler can name its own. */
 export type ReviewLlm = LlmRuntime;
 export interface ReviewDeps {
@@ -51,44 +51,19 @@ export interface ReviewRunSummary {
     cheapToken: number;
     evolveToken: number;
 }
-/** A rewrite lands only when the body-length ratio stays within this bound. */
-export declare const REWRITE_MAGNITUDE_CAP = 0.3;
-/**
- * Output budget for one cheap-gate call: a verdict JSON **plus** the reasoning
- * a thinking model spends before emitting it. A 512-token budget cut the gate
- * off on reasoning-model calls (2026-10-13) and the cut was ledgered as a
- * route failure, so the per-item failure rate read as a network problem.
- */
-export declare const GATE_MAX_TOKENS = 1024;
-/** Output budget for the evolve pass: a verdict plus full replacement text. */
-export declare const EVOLVE_MAX_TOKENS = 4096;
 /** Defaults for the review settings the host may override — and edit live. */
 export declare const REVIEW_DEFAULT_DRY_RUN = true;
 export declare const REVIEW_DEFAULT_DAILY_BUDGET = 100;
 export declare const REVIEW_DEFAULT_BATCH_SIZE = 10;
 export declare const REVIEW_DEFAULT_STALE_DAYS = 30;
-/** Relative body change: |new-old| / max(old, 1). Above the cap → quarantine. */
-export declare function rewriteMagnitude(oldBody: string, newBody: string): number;
-/**
- * Collect review candidates across every workspace carrying active items:
- * new items first (newest first), then corrects-linked requeues, then stale
- * requeues (30 days untouched). bounded by `limit`.
- */
-export declare function collectCandidates(store: MemoryStore, opts?: {
-    now?: number | undefined;
-    staleDays?: number | undefined;
-    limit?: number | undefined;
-}): ReviewCandidate[];
 /**
- * Run one review batch: cheap gate per item, evolve pass on approval,
- * safeguards before landing, one `item-review` row per terminal path, one
- * daily merge at the end. Never throws: LLM and parse failures degrade to
- * skip rows (the run keeps going), exactly like extraction's fail-ledgered
- * discipline.
+ * Run one review batch: assemble the per-item chain once, then walk each
+ * candidate through it — cheap gate, evolve pass on approval, safeguards
+ * before landing, one `item-review` row per terminal path, one daily merge at
+ * the end. LLM and parse failures degrade to skip rows inside the chain (the
+ * run keeps going), exactly like extraction's fail-ledgered discipline.
  */
 export declare function runReviewBatch(deps: ReviewDeps, candidates: readonly ReviewCandidate[], opts: ReviewRunOptions): Promise<ReviewRunSummary>;
-/** One-line error head for ledger rows (fail-loud shape, capped length). */
-export declare function failureHead(error: unknown, max?: number): string;
 /** Current UTC day `YYYY-MM-DD` for the hard-cap account. */
 export declare function todayUtc(): string;
 /** The event wiring surface (duck-typed cordis context, mirrors extraction). */