dsh-decision-layer 0.5.5 → 0.6.0

package/README.en.md

@@ -4,7 +4,7 @@
 
 `dsh-decision-layer` adds structured, explicitly scoped decisions to the DeepSeek Harness (DSH) agent loop, backed by a pluggable adjudication backend. Dangerous-call gating, output self-check, tool narrowing, and loop prevention hook into the agent loop as automatic interventions.
 
-> **0.5.5 is a preview release.** The plugin works, but how much real value the adjudication interventions add is still being explored — every threshold is an unvalidated heuristic default. Treat it as something to observe, not a proven guarantee of impact. See [ROADMAP.md](<ROADMAP.md>) for scope and progress.
+> **0.6.0 is a preview release.** The plugin works, but how much real value the adjudication interventions add is still being explored — every threshold is an unvalidated heuristic default. Treat it as something to observe, not a proven guarantee of impact. See [ROADMAP.md](<ROADMAP.md>) for scope and progress.
 
 ## Installation
 
@@ -46,7 +46,8 @@ Restart `dsh web` and refresh after installing or updating: the host and client
 - **Decision-analysis view** — an in-session "Decision analysis" tab (`conversation.view`, alongside chat and trajectory, naturally scoped per session) that reads the persisted log read-only and shows a process profile (per-point attempts and outcome distribution, mean self-check score), a quality-trend threshold backtest, and a decision-accuracy summary, and lets you rate each decision correct / wrong / unsure. Ratings share one source with the intervention panel: a rating on either surface writes to the same log, keyed by decision id, latest wins. Read-only over logs, append-only for annotations; it changes no decision behavior.
 - **Per-feature switches** — the config page has an independent switch for the danger gate, output self-check, and tool narrowing, all on by default; turning one off drops that intervention. The loop guard is not covered by these switches.
 - **Persisted decision log** — beyond the in-memory panel, decisions are written in full per session to `~/.config/dsh-decision-layer/logs` for research. Files roll by running-instance port and date (`decisions-<port>-YYYY-MM-DD.jsonl`), are batched, and retained for 30 days. Writing is best-effort: a failed flush drops that batch and never breaks the decision path.
+- **Persisted session metrics** — the panel's live metrics (dock count, per-decision-point cards, recent decision log) no longer reset to zero after a restart. Each session's live state is mirrored, keyed by session id (not port), to `~/.config/dsh-decision-layer/state/<sessionId>.json`, written debounced and atomically on every change and retained for 30 days. A resumed session restores from that snapshot; if it has no snapshot yet but has persisted log history (a session predating this mechanism, or whose snapshot was pruned), a seed is reconstructed from the logs across all ports by session id — the one exception is "actual" gate outcomes (observed allow/deny), which are not in the log and resume from zero. Writing is likewise best-effort and never enters the decision path.
 
 ## Safety boundary and development
 
-Automatic intervention only subtracts: the gate only denies, narrowing only removes tools, and neither grants new permissions. The gate defers to native DSH approval on backend failure rather than allowing; self-check, narrowing, and loop-guard errors skip intervention. The redacted summary sent to the backend carries only tool name and command/path with secret redaction — never file content. Node.js `>=20.11`; `npm test` and `npm run build:client` run local checks. Rebuild and commit `lib/client.js` with any client change. 0.5.5 is a preview: the interventions work, but their real value and thresholds are still being explored — feedback on misjudgments and feel observed in the decision log is welcome.
+Automatic intervention only subtracts: the gate only denies, narrowing only removes tools, and neither grants new permissions. The gate defers to native DSH approval on backend failure rather than allowing; self-check, narrowing, and loop-guard errors skip intervention. The redacted summary sent to the backend carries only tool name and command/path with secret redaction — never file content. Node.js `>=20.11`; `npm test` and `npm run build:client` run local checks. Rebuild and commit `lib/client.js` with any client change. 0.6.0 is a preview: the interventions work, but their real value and thresholds are still being explored — feedback on misjudgments and feel observed in the decision log is welcome.

package/README.md

@@ -4,7 +4,7 @@
 
 DeepSeek Harness（DSH）的结构化裁决插件。它把有明确判断标准的问题交给同协议的裁决后端，供 agent 在需要时使用，并在 agent loop 上接入危险门控、产出自检、工具收窄和防循环等自动介入。
 
-> **0.5.5 是体验版。** 插件功能已可用，但裁决介入能带来多少实际价值仍在探索中——各决策点的阈值都是未经验证的启发式默认值，建议先以观察心态体验，别当成经过验证的效果保证。功能与后续进度以 [ROADMAP.md](<ROADMAP.md>) 为准。
+> **0.6.0 是体验版。** 插件功能已可用，但裁决介入能带来多少实际价值仍在探索中——各决策点的阈值都是未经验证的启发式默认值，建议先以观察心态体验，别当成经过验证的效果保证。功能与后续进度以 [ROADMAP.md](<ROADMAP.md>) 为准。
 
 ## 安装
 
@@ -40,12 +40,13 @@ dsh plugin --profile web add file:/绝对路径/dsh-decision-layer
 - **产出自检**：回合结束用评分量表给最终产出打分（0–2，按各档位概率加权，可能是小数）。默认只提示、不打断；可开启「低分补完」，得分偏低且模型有把握时以你的名义追加一次补完提示，同一回合最多补一次。
 - **任务完成核对**：当用户明确列出多个交付条件（编号 / 项目符号 / 多命令）时，回合结束前用单选逐项判定「已满足 / 未满足 / 证据不足」，工具证据优先、回复自述不算证据；确定性提取、不推断隐含期望。默认只观察、可配 steer，与产出自检并存、指标分列。
 - **产出质量趋势告警**：建在自检数据上的只读提醒。连续多次高置信低分时，把输入框旁触发按钮的图标从灰变橙、变红，hover 提示可能是任务变难或模型波动、建议调整 prompt 或更换模型。纯提示、不驱动自动干预；高置信门槛 / 连续轮数 / 严重档三个阈值可配（默认 0.6 / 3 / 5），偏保守、待实测校准。
-- **工具收窄**：回合开始时用 noul 逐个判断可选工具与本轮任务的相关性，摘掉用不上的（相关性概率低于摘除阈值，默认 0.3、可配），只在宿主已允许的集合内取交集、不扩权。默认真正生效，可切到「仅观察」只记录不改工具集。三重保护：核心工具（读写、编辑、Shell、检索、待办，以及问用户、目标、技能、交付、后台作业、协作等 agent 元能力）始终保留、不参与判定；可选工具超过候选上限（默认 20，可配）时自动降为仅观察；保留下来不足 5 个时视为判定不可信、跳过。**保留工具前缀**白名单里的工具（默认含 `mcp__openviking`、`team_task_`）也始终保留、不参与判定，适合记忆 / 检索、协作这类常驻、按需触发的工具。
+- **工具收窄**：回合开始时用 noul 逐个判断可选工具与本轮任务的相关性，摘掉用不上的（相关性概率低于摘除阈值，默认 0.3、可配），只在宿主已允许的集合内取交集、不扩权。默认真正生效，可切到「仅观察」只记录不改工具集。三重保护：核心工具（读写、编辑、Shell、检索、待办，以及问用户、目标、技能、交付、后台作业、协作等 agent 元能力）始终保留、不参与判定；可选工具超过候选上限（默认 20，可配）时自动降为仅观察；保留下来不足 5 个时视为判定不可信、跳过。**保留工具前缀**白名单里的工具（默认含 `mcp__openviking`、`team_task_`）也始终保留、不参与判定，适合记忆 / 检索、协作这类常驻、按需触发的工具。**分批策略**按后端上下文容量自适应（`batchMode`，默认 `auto`）：大上下文后端（如 Jev）一次请求判完全部工具；小上下文后端（如本地 tev1，约 2050 token 单请求上限）在遇到上下文超限错误时自动降级为「每工具一次请求、并发执行」并记住，之后直接走拆分，不再反复探测。也可显式设 `single`（始终整批）或 `split`（始终逐工具）。某个工具的拆分请求失败时该工具保守保留。
 - **防循环**：确定性判断，不走后端；同一调用连续重复超过阈值即拒绝，打断死循环。始终生效，不在决策点开关范围内。
 - **会话面板**：输入框下方的 dock 触发器弹出面板，展示自动裁决指标（评估数、失败回退、模型建议与实际结果分列）、会话总开关和决策日志；无自动裁决时显示空态。总开关关闭只暂停自动介入，不影响手动裁决。
 - **决策分析页**：会话内「决策分析」tab（`conversation.view`，与对话/轨迹平级、天然按会话隔离），基于已落盘日志做只读聚合，展示过程画像（各决策点触发数与结果分布、自检平均分）、质量趋势阈值回测、判断准确度汇总，并可对每条决策标注「判对 / 判错 / 说不准」。标注与介入面板同源：任一处标注都写入同一份日志、按决策 id 关联、取最新。只读日志、只追加标注，不改任何决策行为。
 - **决策点开关**：详情页配置里，危险门控、产出自检、工具收窄各有独立开关，默认全开；关掉某个决策点就不再对应地介入。防循环不在此范围。
 - **决策日志落盘**：决策记录在内存面板之外，还按会话全量落盘到 `~/.config/dsh-decision-layer/logs`，供研究回看。文件按运行实例端口和日期滚动切分（`decisions-<端口>-YYYY-MM-DD.jsonl`），批量写入，保留 30 天。写盘为尽力而为，失败只丢当批、不影响决策路径。
+- **会话指标持久化**：面板的实时指标（dock 计数、各决策点卡片、最近决策日志）在重启后不再归零。每个会话的实时状态按会话 id（非端口）另存一份快照到 `~/.config/dsh-decision-layer/state/<会话id>.json`，每次计数变化防抖写盘、原子落盘，保留 30 天。同一会话恢复时优先读该快照续算；若尚无快照但有历史决策日志（如早于本机制、或快照已被清理的会话），则跨全部端口按会话 id 从日志重建种子续算——唯一例外是「实际结果」（gate 观测到的放行 / 拒绝）无法从日志重建，重启后从零重新累计。写盘同为尽力而为，失败绝不进入决策路径。
 
 ## 安全边界
 
@@ -53,4 +54,4 @@ dsh plugin --profile web add file:/绝对路径/dsh-decision-layer
 
 ## 开发
 
-服务端使用 Node.js `>=20.11`（`.mjs`，无需构建）；客户端用 TypeScript + esbuild 构建。`npm test` 跑本地测试，`npm run build:client` 生成 `lib/client.js`。改动客户端后需重建并连同 `lib/client.js` 一起提交，否则 GitHub 安装拿到的是旧 bundle。0.5.5 为体验版：介入能力已可用，但实际价值与阈值仍在探索，欢迎反馈决策日志观察到的误判与体感。
+服务端使用 Node.js `>=20.11`（`.mjs`，无需构建）；客户端用 TypeScript + esbuild 构建。`npm test` 跑本地测试，`npm run build:client` 生成 `lib/client.js`。改动客户端后需重建并连同 `lib/client.js` 一起提交，否则 GitHub 安装拿到的是旧 bundle。0.6.0 为体验版：介入能力已可用，但实际价值与阈值仍在探索，欢迎反馈决策日志观察到的误判与体感。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-decision-layer",
-  "version": "0.5.5",
+  "version": "0.6.0",
   "description": "A structured decision layer for the DeepSeek Harness agent loop: a danger-call gate, output self-check, tool narrowing, and loop guard backed by a pluggable adjudication model.",
   "keywords": [
     "dsh",

package/service/config-store.mjs

@@ -97,7 +97,7 @@ function validCheck(value) {
 
 function validNarrow(value) {
   if (!safeObject(value)) return undefined;
-  if (Object.keys(value).some(key => !['mode', 'threshold', 'keepPrefixes', 'maxCandidates'].includes(key))) throw new Error('Invalid narrowing settings');
+  if (Object.keys(value).some(key => !['mode', 'threshold', 'keepPrefixes', 'maxCandidates', 'batchMode'].includes(key))) throw new Error('Invalid narrowing settings');
   const narrow = {};
   if (value.mode !== undefined) {
     if (value.mode !== 'observe' && value.mode !== 'enforce') throw new Error('Invalid narrowing settings');
@@ -124,6 +124,17 @@ function validNarrow(value) {
     if (!Number.isSafeInteger(value.maxCandidates) || value.maxCandidates < 1 || value.maxCandidates > 200) throw new Error('Invalid narrowing settings');
     narrow.maxCandidates = value.maxCandidates;
   }
+  // Per-request batching strategy for the relevance pass, chosen by backend
+  // context capacity. 'single' sends every tool in one systemone request (best
+  // for large-context backends like Jev — one call). 'split' sends one request
+  // per tool concurrently (required for small-context backends like tev1, whose
+  // ~2050-token prompt limit rejects a many-tool request). 'auto' (default)
+  // tries 'single' first and falls back to 'split' only after a context-overflow
+  // http-error, so Jev stays at one call and tev1 self-corrects.
+  if (value.batchMode !== undefined) {
+    if (!['auto', 'single', 'split'].includes(value.batchMode)) throw new Error('Invalid narrowing settings');
+    narrow.batchMode = value.batchMode;
+  }
   return narrow;
 }
 

package/service/dsh.mjs

@@ -10,7 +10,8 @@ import { createNarrowing } from './narrowing.mjs';
 import { createTaskCompletion } from './task-completion.mjs';
 import { createLoopGuard } from './loop-guard.mjs';
 import { createLogStore } from './log-store.mjs';
-import { analyzeSessionLogs } from './log-analyze.mjs';
+import { createStateStore } from './state-store.mjs';
+import { analyzeSessionLogs, reconstructSessionSeed } from './log-analyze.mjs';
 
 export const name = 'dsh-decision-layer';
 export const inject = ['tools', 'skills'];
@@ -100,7 +101,23 @@ export async function apply(ctx, options = {}) {
   // The research log sink is attached once the web server reveals the instance
   // port (used in the file name); until then decision logs stay in memory only.
   let logStore;
-  const sessions = createSessionState({ onLog: entry => logStore?.append(entry) });
+  // Durable per-session mirror of the live decision counters/log, keyed by
+  // session id (not port), so a resumed session's panel survives an instance
+  // restart instead of resetting to zero. Independent of the JSONL research log.
+  const stateStore = createStateStore();
+  const sessions = createSessionState({
+    onLog: entry => logStore?.append(entry),
+    // Restore a resumed session from its durable snapshot; if it has none yet but
+    // has persisted JSONL decision history (e.g. a session that predates this
+    // persistence, or whose snapshot was pruned), reconstruct a seed from the
+    // logs instead. Logs are read across all ports and filtered by the globally
+    // unique session id, so a changed instance port never orphans the history.
+    loadState: async id => (await stateStore.load(id)) ?? reconstructSessionSeed(id, {
+      trendConfig: (await resolveConfig({ path })).checkSettings,
+    }).catch(() => undefined),
+    persistState: (id, state) => stateStore.save(id, state),
+  });
+  if (typeof ctx.effect === 'function') ctx.effect(() => () => { void stateStore.dispose(); });
   const gate = createDangerGate({
     evaluate: (input, request) => backend.evaluate(input, request),
     sessions,
@@ -185,6 +202,10 @@ export async function apply(ctx, options = {}) {
       const agent = payload?.agent;
       const id = agent?.session?.id;
       const turn = payload?.turn;
+      // Rehydrate this session's persisted counters/log on its first step this
+      // process, before any gate/check/narrow/complete event mutates them, so a
+      // resumed session continues from its saved totals instead of from zero.
+      if (typeof id === 'string') await sessions.ensureLoaded(id);
       if (typeof id === 'string' && Number.isInteger(turn) && await featureOn('narrow')) {
         const state = narrowedTurns.get(id);
         if (!state || state.turn !== turn) {

package/service/log-analyze.mjs

@@ -1,4 +1,5 @@
 import { createReadableStream } from './log-read.mjs';
+import { advanceRun, severityOf } from './quality-trend.mjs';
 
 // Offline analysis over the persisted decision JSONL logs. Pure aggregation:
 // given a stream of records (decision events + annotation events) for one
@@ -153,3 +154,79 @@ export async function analyzeSessionLogs(sessionId, { dir, port, trendConfig, re
   }
   return analyzeSession(records, trendConfig);
 }
+
+// Reconstruct a live session-state seed (the counter shape session-state keeps,
+// plus the recent decision log) from this session's folded decisions. Used to
+// bridge a restart for a session that has persisted JSONL history but no state
+// snapshot yet, so its panel resumes from its real totals instead of from zero.
+//
+// Faithful for every counter because each feature logs exactly one record per
+// record*() call with the same outcome — with one documented exception:
+// gate.actual (observed tool outcomes) is never logged, so it starts at zero and
+// resumes as new tool results arrive. The check trend run/severity is replayed
+// with the same advanceRun/severityOf semantics the live path uses.
+export function buildSeed(decisions, { maxLog = 50, trendConfig = {} } = {}) {
+  const ordered = [...decisions.values()].filter(record => DECISION_KINDS.has(record.kind)).sort((a, b) => (a.at ?? 0) - (b.at ?? 0));
+  const seed = {
+    attempts: 0, failures: 0,
+    gate: { attempts: 0, failures: 0, ask: 0, deny: 0, allow: 0, actual: { allow: 0, deny: 0, error: 0 } },
+    check: { attempts: 0, failures: 0, low: 0, run: 0, severity: 'normal' },
+    narrow: { attempts: 0, failures: 0, applied: 0, dropped: 0 },
+    complete: { attempts: 0, failures: 0, unsatisfied: 0, satisfied: 0, insufficient: 0, steered: 0 },
+    log: [],
+  };
+  const minConfidence = typeof trendConfig.trendMinConfidence === 'number' ? trendConfig.trendMinConfidence : 0.6;
+  const thresholds = { trendRun: trendConfig.trendRun ?? 3, trendSevereRun: trendConfig.trendSevereRun ?? 5 };
+  let run = 0;
+  for (const record of ordered) {
+    const bucket = seed[record.kind];
+    seed.attempts++;
+    bucket.attempts++;
+    const isError = record.outcome === 'error';
+    if (isError) { seed.failures++; bucket.failures++; }
+    if (record.kind === 'gate') {
+      if (['allow', 'ask', 'deny'].includes(record.outcome)) bucket[record.outcome]++;
+    } else if (record.kind === 'check') {
+      if (!isError) {
+        if (record.outcome === 'low') bucket.low++;
+        // Replay the trend run exactly as recordCheck does: lowScore keys off the
+        // 'low' outcome, confident off the logged confidence vs the threshold.
+        const confident = typeof record.confidence === 'number' && Number.isFinite(record.confidence) && record.confidence >= minConfidence;
+        run = advanceRun(run, { lowScore: record.outcome === 'low', confident });
+      }
+    } else if (record.kind === 'narrow') {
+      if (record.outcome === 'applied') {
+        bucket.applied++;
+        if (Number.isSafeInteger(record.dropped) && record.dropped > 0) bucket.dropped += record.dropped;
+      }
+    } else if (record.kind === 'complete') {
+      if (!isError) {
+        if (Number.isSafeInteger(record.satisfied)) bucket.satisfied += record.satisfied;
+        if (Number.isSafeInteger(record.unsatisfied)) bucket.unsatisfied += record.unsatisfied;
+        if (Number.isSafeInteger(record.insufficient)) bucket.insufficient += record.insufficient;
+        if (record.steered === true) bucket.steered++;
+      }
+    }
+  }
+  seed.check.run = run;
+  seed.check.severity = severityOf(run, thresholds);
+  // The recent-log list: the newest decisions, as plain records (drop sessionId,
+  // which the live log does not carry). Already in the panel-record shape.
+  seed.log = ordered.slice(-maxLog).map(record => { const { sessionId, ...rest } = record; return rest; });
+  return seed;
+}
+
+// Read one session's persisted JSONL and reconstruct its live state seed, or
+// undefined when it has no decision history. Streams files like analyzeSessionLogs.
+export async function reconstructSessionSeed(sessionId, { dir, port, trendConfig, maxLog, readStream = createReadableStream } = {}) {
+  if (typeof sessionId !== 'string' || !sessionId.trim()) return undefined;
+  const records = [];
+  for await (const record of readStream({ dir, port })) {
+    if (!isObject(record)) continue;
+    if (record.sessionId === sessionId) records.push(record);
+  }
+  if (records.length === 0) return undefined;
+  const { decisions } = foldSession(records);
+  if (decisions.size === 0) return undefined;
+  return buildSeed(decisions, { maxLog, trendConfig });
+}

package/service/manager-api.mjs

@@ -77,8 +77,8 @@ export function createManagerRoutes({ path, sessions, backend, logStore, analyze
         } catch { return { connected: false, reason: 'unavailable', effectiveUrl }; }
       },
     }),
-    route('metrics', { GET: req => sessions.snapshot(sessionId(req)) }),
-    route('log', { GET: req => ({ entries: sessions.snapshot(sessionId(req)).log ?? [] }) }),
+    route('metrics', { GET: async req => { const id = sessionId(req); await sessions.ensureLoaded?.(id); return sessions.snapshot(id); } }),
+    route('log', { GET: async req => { const id = sessionId(req); await sessions.ensureLoaded?.(id); return { entries: sessions.snapshot(id).log ?? [] }; } }),
     // Read-only analysis over the persisted decision logs for one session. Returns
     // only aggregates and annotation counts — never raw log rows — so gate command
     // / path fragments are not echoed back to the browser.
@@ -110,9 +110,10 @@ export function createManagerRoutes({ path, sessions, backend, logStore, analyze
       },
     }),
     route('session', {
-      GET: req => sessions.snapshot(sessionId(req)),
+      GET: async req => { const id = sessionId(req); await sessions.ensureLoaded?.(id); return sessions.snapshot(id); },
       PUT: async req => {
         const body = await readBody(req);
+        await sessions.ensureLoaded?.(body.sessionId);
         sessions.setEnabled(body.sessionId, body.enabled);
         return sessions.snapshot(body.sessionId);
       },

package/service/narrowing.mjs

@@ -82,15 +82,22 @@ export function relevanceQuestions(state, tools) {
 //   C. if narrowing would leave fewer than `minKeep` tools total, the verdict is
 //      treated as untrustworthy and no restriction is applied.
 export function createNarrowing({ evaluate, sessions, settings, coreTools = DEFAULT_CORE_TOOLS,
-  keepPrefixes = DEFAULT_KEEP_PREFIXES, minCandidates = 2, maxCandidates = 20, minKeep = 5 } = {}) {
+  keepPrefixes = DEFAULT_KEEP_PREFIXES, minCandidates = 2, maxCandidates = 20, minKeep = 5, splitConcurrency = 8 } = {}) {
   if (typeof evaluate !== 'function') throw new Error('Narrowing requires an evaluator');
   const core = new Set(Array.isArray(coreTools) ? coreTools.filter(name => typeof name === 'string') : []);
   const defaultPrefixes = Array.isArray(keepPrefixes) ? keepPrefixes.filter(prefix => typeof prefix === 'string' && prefix) : [];
+  const concurrency = Number.isSafeInteger(splitConcurrency) && splitConcurrency >= 1 ? splitConcurrency : 8;
+  // Set once a 'single' (whole-batch) pass hits a context-overflow http-error:
+  // from then on 'auto' sends one request per tool. A large-context backend
+  // (Jev) never trips this and stays at one call; a small-context backend
+  // (tev1, ~2050-token prompt) self-corrects after the first failure.
+  let adaptiveSplit = false;
   const resolveSettings = async () => {
     let raw = {};
     try { raw = (typeof settings === 'function' ? await settings() : settings) ?? {}; } catch { raw = {}; }
     const mode = raw?.mode === 'observe' ? 'observe' : 'enforce';
     const threshold = typeof raw?.threshold === 'number' && Number.isFinite(raw.threshold) && raw.threshold >= 0 && raw.threshold <= 1 ? raw.threshold : 0.3;
+    const batchMode = raw?.batchMode === 'single' || raw?.batchMode === 'split' ? raw.batchMode : 'auto';
     // An explicit array in settings (including empty) overrides the default set.
     const prefixes = Array.isArray(raw?.keepPrefixes)
       ? raw.keepPrefixes.filter(prefix => typeof prefix === 'string' && prefix)
@@ -100,7 +107,7 @@ export function createNarrowing({ evaluate, sessions, settings, coreTools = DEFA
     // never large enough to be rejected before it is sent.
     const configuredCap = Number.isSafeInteger(raw?.maxCandidates) && raw.maxCandidates >= 1 ? raw.maxCandidates : maxCandidates;
     const cap = Math.min(configuredCap, MAX_QUESTIONS);
-    return { mode, threshold, prefixes, cap };
+    return { mode, threshold, prefixes, cap, batchMode };
   };
   const record = (turn, outcome, detail = {}) => {
     const id = turn?.agent?.session?.id;
@@ -111,12 +118,34 @@ export function createNarrowing({ evaluate, sessions, settings, coreTools = DEFA
     try { sessions.log(id, { kind: 'narrow', outcome, ...detail }); }
     catch { /* logging is best effort */ }
   };
+  // Send one relevance request per tool with bounded concurrency, then merge the
+  // per-tool answers into one result. Each request's prompt is only the task
+  // state plus a single question, so it cannot exceed a small-context backend's
+  // prompt limit. A tool whose request fails is omitted from the merged answers,
+  // which narrowTools treats as "keep" (best effort). Returns null only when
+  // every tool failed, so the caller can still report a backend error.
+  const evaluateSplit = async (state, tools, signal) => {
+    const answers = Object.create(null);
+    let anyOk = false;
+    for (let i = 0; i < tools.length; i += concurrency) {
+      const group = tools.slice(i, i + concurrency);
+      const settled = await Promise.all(group.map(async tool => {
+        try {
+          const reply = await evaluate(relevanceQuestions(state, [tool]), { signal });
+          const answer = reply?.answers?.[tool.name];
+          return isObject(answer) ? [tool.name, answer] : undefined;
+        } catch { return undefined; }
+      }));
+      for (const pair of settled) { if (pair) { answers[pair[0]] = pair[1]; anyOk = true; } }
+    }
+    return anyOk ? { model: 'split', answers } : null;
+  };
   const skip = { evaluated: false, applied: false, keep: [], drop: [], mode: 'observe' };
   return {
     async review(turn) {
       const tools = Array.isArray(turn?.tools) ? turn.tools.filter(tool => tool && typeof tool.name === 'string') : [];
       const names = tools.map(tool => tool.name);
-      const { mode, threshold, prefixes, cap } = await resolveSettings();
+      const { mode, threshold, prefixes, cap, batchMode } = await resolveSettings();
       // A: core tools and keep-prefix matches are always kept and never sent to
       // the model for judging (e.g. mcp__openviking memory tools stay resident).
       const alwaysKeep = name => core.has(name) || prefixes.some(prefix => name.startsWith(prefix));
@@ -139,9 +168,29 @@ export function createNarrowing({ evaluate, sessions, settings, coreTools = DEFA
       const effectiveMode = overCap ? 'observe' : mode;
       const judged = overCap ? optional.slice(0, cap) : optional;
       const judgedNames = judged.map(tool => tool.name);
+      // Choose per-request strategy by backend context capacity. 'split' (or an
+      // 'auto' pass that already fell back) sends one request per tool so no
+      // prompt exceeds a small-context limit. 'single'/'auto' first try one
+      // whole-batch request; under 'auto', a context-overflow http-error flips
+      // this instance to split from then on and retries the same tools split.
       let result;
-      try { result = await evaluate(relevanceQuestions(turn.state, judged), { signal: turn.signal }); }
-      catch (error) { record(turn, 'error', { reason: typeof error?.reason === 'string' ? error.reason : 'unreachable', mode: effectiveMode }); return { ...skip, keep: names, mode: effectiveMode }; }
+      if (batchMode === 'split' || adaptiveSplit) {
+        result = await evaluateSplit(turn.state, judged, turn.signal);
+        if (!result) { record(turn, 'error', { reason: 'unreachable', mode: effectiveMode }); return { ...skip, keep: names, mode: effectiveMode }; }
+      } else {
+        try { result = await evaluate(relevanceQuestions(turn.state, judged), { signal: turn.signal }); }
+        catch (error) {
+          const reason = typeof error?.reason === 'string' ? error.reason : 'unreachable';
+          if (batchMode === 'auto' && reason === 'http-error') {
+            adaptiveSplit = true;
+            result = await evaluateSplit(turn.state, judged, turn.signal);
+            if (!result) { record(turn, 'error', { reason, mode: effectiveMode }); return { ...skip, keep: names, mode: effectiveMode }; }
+          } else {
+            record(turn, 'error', { reason, mode: effectiveMode });
+            return { ...skip, keep: names, mode: effectiveMode };
+          }
+        }
+      }
       const narrowed = narrowTools(judgedNames, result, { threshold });
       const keep = [...keptNames, ...narrowed.keep];
       const drop = narrowed.drop;

package/service/session-state.mjs

@@ -18,11 +18,65 @@ function safeTool(value) {
   return typeof value === 'string' && value.trim() ? value.trim().slice(0, 128) : undefined;
 }
 
-export function createSessionState({ maxSessions = 1024, maxLogEntries = 50, onLog } = {}) {
+const toCount = value => (Number.isSafeInteger(value) && value >= 0 ? value : 0);
+
+// Rebuild a trusted in-memory state from a persisted (untrusted) snapshot. Every
+// counter is coerced into the emptyState() shape with a non-negative-integer
+// guard and the trend severity into its enum, so a stale or tampered file can
+// never inject an out-of-shape value into the live counters. The recent log is
+// kept as plain records (newest-last); callers trim it to the log cap.
+function coerceState(raw) {
+  const state = emptyState();
+  if (!raw || typeof raw !== 'object') return state;
+  if (typeof raw.enabled === 'boolean') state.enabled = raw.enabled;
+  state.attempts = toCount(raw.attempts);
+  state.failures = toCount(raw.failures);
+  const g = raw.gate;
+  if (g && typeof g === 'object') {
+    state.gate.attempts = toCount(g.attempts); state.gate.failures = toCount(g.failures);
+    state.gate.ask = toCount(g.ask); state.gate.deny = toCount(g.deny); state.gate.allow = toCount(g.allow);
+    const a = g.actual;
+    if (a && typeof a === 'object') { state.gate.actual.allow = toCount(a.allow); state.gate.actual.deny = toCount(a.deny); state.gate.actual.error = toCount(a.error); }
+  }
+  const c = raw.check;
+  if (c && typeof c === 'object') {
+    state.check.attempts = toCount(c.attempts); state.check.failures = toCount(c.failures); state.check.low = toCount(c.low);
+    state.check.run = toCount(c.run);
+    state.check.severity = ['normal', 'warn', 'severe'].includes(c.severity) ? c.severity : 'normal';
+  }
+  const n = raw.narrow;
+  if (n && typeof n === 'object') {
+    state.narrow.attempts = toCount(n.attempts); state.narrow.failures = toCount(n.failures);
+    state.narrow.applied = toCount(n.applied); state.narrow.dropped = toCount(n.dropped);
+  }
+  const k = raw.complete;
+  if (k && typeof k === 'object') {
+    state.complete.attempts = toCount(k.attempts); state.complete.failures = toCount(k.failures);
+    state.complete.unsatisfied = toCount(k.unsatisfied); state.complete.satisfied = toCount(k.satisfied);
+    state.complete.insufficient = toCount(k.insufficient); state.complete.steered = toCount(k.steered);
+  }
+  if (Array.isArray(raw.log)) {
+    state.log = raw.log
+      .filter(entry => entry && typeof entry === 'object' && !Array.isArray(entry) && typeof entry.kind === 'string')
+      .map(entry => ({ ...entry }));
+  }
+  return state;
+}
+
+export function createSessionState({ maxSessions = 1024, maxLogEntries = 50, onLog, loadState, persistState } = {}) {
   if (!Number.isSafeInteger(maxSessions) || maxSessions < 1) throw new Error('Invalid session limit');
   if (!Number.isSafeInteger(maxLogEntries) || maxLogEntries < 1) throw new Error('Invalid log limit');
   const sessions = new Map();
   const sink = typeof onLog === 'function' ? onLog : undefined;
+  const load = typeof loadState === 'function' ? loadState : undefined;
+  const persist = typeof persistState === 'function' ? persistState : undefined;
+  // Memoize rehydration per id so a session is seeded from disk at most once per
+  // process. Bounded like `sessions`; dropping a memo entry only risks a
+  // redundant disk read that no-ops (ensureLoaded never clobbers live state).
+  const loaded = new Map();
+  // Mirror the latest live state to the durable store after every mutation.
+  // Best-effort: a persistence fault must never surface in the decision path.
+  const bump = (key, state) => { if (persist) { try { persist(key, state); } catch { /* best effort */ } } };
   // FIFO eviction: when the map is full, drop the oldest-inserted session before
   // admitting a new one (Map preserves insertion order, so the first key is the
   // oldest). This mirrors loop-guard / narrowing and means the store never
@@ -40,9 +94,38 @@ export function createSessionState({ maxSessions = 1024, maxLogEntries = 50, onL
     return state;
   };
   return {
+    // Rehydrate a session's live counters/log from the durable store the first
+    // time it is touched this process, before any new event mutates it — so disk
+    // history and in-process events never double-count. Memoized per id; a no-op
+    // when no loadState was given or the session already has live state. Callers
+    // should await this before the first snapshot/record of a resumed session
+    // (the plugin does so at the turn's first step and in the panel routes).
+    async ensureLoaded(id) {
+      if (!load) return;
+      let key;
+      try { key = sessionKey(id); } catch { return; }
+      const existing = loaded.get(key);
+      if (existing) return existing;
+      const promise = (async () => {
+        if (sessions.has(key)) return; // live events already created state; keep it
+        let raw;
+        try { raw = await load(key); } catch { raw = undefined; }
+        if (!raw) return;
+        if (sessions.has(key)) return; // a concurrent mutation won the race; do not clobber
+        const state = coerceState(raw);
+        if (state.log.length > maxLogEntries) state.log.splice(0, state.log.length - maxLogEntries);
+        if (sessions.size >= maxSessions) sessions.delete(sessions.keys().next().value);
+        sessions.set(key, state);
+      })();
+      if (loaded.size >= maxSessions) loaded.delete(loaded.keys().next().value);
+      loaded.set(key, promise);
+      return promise;
+    },
     setEnabled(id, enabled) {
       if (typeof enabled !== 'boolean') throw new Error('Invalid enabled value');
-      writable(id).enabled = enabled;
+      const state = writable(id);
+      state.enabled = enabled;
+      bump(sessionKey(id), state);
     },
     snapshot(id) {
       const stored = sessions.get(sessionKey(id));
@@ -62,26 +145,32 @@ export function createSessionState({ maxSessions = 1024, maxLogEntries = 50, onL
       state.gate.attempts++;
       if (outcome === 'error') { state.failures++; state.gate.failures++; }
       else state.gate[outcome]++;
+      bump(sessionKey(id), state);
     },
     recordActual(id, outcome) {
       if (!['allow', 'deny', 'error'].includes(outcome)) throw new Error('Invalid actual decision');
-      writable(id).gate.actual[outcome]++;
+      const state = writable(id);
+      state.gate.actual[outcome]++;
+      bump(sessionKey(id), state);
     },
     recordCheck(id, outcome, trend) {
       if (!['ok', 'low', 'error'].includes(outcome)) throw new Error('Invalid self-check outcome');
       const state = writable(id);
       state.attempts++;
       state.check.attempts++;
-      if (outcome === 'error') { state.failures++; state.check.failures++; return; }
-      if (outcome === 'low') state.check.low++;
-      // Advance the quality-trend run over this evaluated score. A good score
-      // resets the run; a high-confidence low score grows it; a low-confidence
-      // low score neither resets nor grows. `trend` carries the per-sample flags
-      // and the configured thresholds; absent trend leaves the run unchanged.
-      if (trend && typeof trend === 'object') {
-        state.check.run = advanceRun(state.check.run, { lowScore: outcome === 'low', confident: trend.confident === true });
-        state.check.severity = severityOf(state.check.run, { trendRun: trend.trendRun, trendSevereRun: trend.trendSevereRun });
+      if (outcome === 'error') { state.failures++; state.check.failures++; }
+      else {
+        if (outcome === 'low') state.check.low++;
+        // Advance the quality-trend run over this evaluated score. A good score
+        // resets the run; a high-confidence low score grows it; a low-confidence
+        // low score neither resets nor grows. `trend` carries the per-sample flags
+        // and the configured thresholds; absent trend leaves the run unchanged.
+        if (trend && typeof trend === 'object') {
+          state.check.run = advanceRun(state.check.run, { lowScore: outcome === 'low', confident: trend.confident === true });
+          state.check.severity = severityOf(state.check.run, { trendRun: trend.trendRun, trendSevereRun: trend.trendSevereRun });
+        }
       }
+      bump(sessionKey(id), state);
     },
     recordNarrow(id, outcome, dropped = 0) {
       if (!['ok', 'applied', 'error'].includes(outcome)) throw new Error('Invalid narrowing outcome');
@@ -93,6 +182,7 @@ export function createSessionState({ maxSessions = 1024, maxLogEntries = 50, onL
         state.narrow.applied++;
         if (Number.isSafeInteger(dropped) && dropped > 0) state.narrow.dropped += dropped;
       }
+      bump(sessionKey(id), state);
     },
     // Task-completion checking. `ok`/`unsatisfied` are real evaluations; `error`
     // is an unevaluated failure counted as a failure, never as "unsatisfied".
@@ -102,11 +192,14 @@ export function createSessionState({ maxSessions = 1024, maxLogEntries = 50, onL
       const state = writable(id);
       state.attempts++;
       state.complete.attempts++;
-      if (outcome === 'error') { state.failures++; state.complete.failures++; return; }
-      if (Number.isSafeInteger(detail.satisfied) && detail.satisfied > 0) state.complete.satisfied += detail.satisfied;
-      if (Number.isSafeInteger(detail.unsatisfied) && detail.unsatisfied > 0) state.complete.unsatisfied += detail.unsatisfied;
-      if (Number.isSafeInteger(detail.insufficient) && detail.insufficient > 0) state.complete.insufficient += detail.insufficient;
-      if (detail.steered === true) state.complete.steered++;
+      if (outcome === 'error') { state.failures++; state.complete.failures++; }
+      else {
+        if (Number.isSafeInteger(detail.satisfied) && detail.satisfied > 0) state.complete.satisfied += detail.satisfied;
+        if (Number.isSafeInteger(detail.unsatisfied) && detail.unsatisfied > 0) state.complete.unsatisfied += detail.unsatisfied;
+        if (Number.isSafeInteger(detail.insufficient) && detail.insufficient > 0) state.complete.insufficient += detail.insufficient;
+        if (detail.steered === true) state.complete.steered++;
+      }
+      bump(sessionKey(id), state);
     },
     log(id, entry) {
       if (entry === null || typeof entry !== 'object' || Array.isArray(entry)) throw new Error('Invalid log entry');
@@ -149,6 +242,7 @@ export function createSessionState({ maxSessions = 1024, maxLogEntries = 50, onL
         }
         try { sink(full); } catch { /* persistence is best effort */ }
       }
+      bump(sessionKey(id), state);
     },
   };
 }

package/service/state-store.mjs

@@ -0,0 +1,100 @@
+import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+export function stateDir() {
+  return join(homedir(), '.config', 'dsh-decision-layer', 'state');
+}
+
+// A session id is persisted only when it is safe as a single path segment, so a
+// crafted id can never escape the state directory. dsh session ids are
+// `session-<uuid>`, which pass; anything with separators, leading dot, `..`, or
+// an unreasonable length is skipped (that session simply stays in-memory only).
+const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/;
+export function safeStateId(id) {
+  return typeof id === 'string' && SAFE_ID.test(id) && !id.includes('..') ? id : undefined;
+}
+
+// Durable per-session mirror of the live decision counters + recent log. One
+// small JSON file per session id (`<id>.json`), written debounced and atomically
+// (unique tmp + rename), pruned by age on an occasional flush. This is separate
+// from the JSONL research log: it exists only so a resumed session's live panel
+// (dock count, metric cards, recent log) survives an instance restart instead of
+// resetting to zero. All IO is best-effort — a failure never throws into the
+// decision path; at worst the panel loses the last few seconds of counters.
+export function createStateStore({ dir = stateDir(), flushIntervalMs = 2000,
+  retentionDays = 30, now = () => Date.now() } = {}) {
+  const pending = new Map(); // id -> latest live state reference awaiting a flush
+  let timer;
+  let flushing = false;
+  let lastPrune = 0;
+
+  const fileFor = id => join(dir, `${id}.json`);
+
+  const writeOne = async (id, state) => {
+    const temporary = join(dir, `${id}.${randomUUID()}.tmp`);
+    try {
+      await writeFile(temporary, `${JSON.stringify({ v: 1, at: now(), state })}\n`, { mode: 0o600, flag: 'wx' });
+      await rename(temporary, fileFor(id));
+    } finally {
+      await rm(temporary, { force: true }).catch(() => {});
+    }
+  };
+
+  const prune = async () => {
+    let names;
+    try { names = await readdir(dir); } catch { return; }
+    const cutoff = now() - retentionDays * 24 * 60 * 60 * 1000;
+    await Promise.all(names.map(async name => {
+      if (!name.endsWith('.json')) return;
+      try {
+        const info = await stat(join(dir, name));
+        if (info.mtimeMs < cutoff) await rm(join(dir, name), { force: true }).catch(() => {});
+      } catch { /* a file vanishing under us is fine */ }
+    }));
+  };
+
+  const flush = async () => {
+    if (flushing || pending.size === 0) return;
+    flushing = true;
+    // Snapshot ids now; each state is JSON.stringify'd at write time so the file
+    // reflects the latest counters, which is exactly what we want.
+    const batch = [...pending.entries()];
+    pending.clear();
+    try {
+      await mkdir(dir, { recursive: true, mode: 0o700 });
+      for (const [id, state] of batch) await writeOne(id, state).catch(() => {});
+      // Prune at most about once per hour of activity, not on every flush.
+      if (now() - lastPrune > 60 * 60 * 1000) { lastPrune = now(); await prune(); }
+    } catch { /* best effort; a dropped flush must never break the decision path */ }
+    finally { flushing = false; }
+  };
+
+  return {
+    // Read a session's persisted state, or undefined when there is no usable file.
+    async load(id) {
+      const safe = safeStateId(id);
+      if (!safe) return undefined;
+      try {
+        const parsed = JSON.parse(await readFile(fileFor(safe), 'utf8'));
+        if (parsed && typeof parsed === 'object' && parsed.state && typeof parsed.state === 'object' && !Array.isArray(parsed.state)) {
+          return parsed.state;
+        }
+      } catch { /* missing or malformed: no seed, start empty */ }
+      return undefined;
+    },
+    // Register the latest live state for a session and schedule a debounced flush.
+    save(id, state) {
+      const safe = safeStateId(id);
+      if (!safe || state === null || typeof state !== 'object') return;
+      pending.set(safe, state);
+      if (!timer) timer = setTimeout(() => { timer = undefined; void flush(); }, flushIntervalMs);
+    },
+    flush,
+    dispose() {
+      if (timer) { clearTimeout(timer); timer = undefined; }
+      return flush();
+    },
+  };
+}