dsh-decision-layer 0.6.4 → 0.7.1

package/locale/en.json

@@ -1,6 +1,7 @@
 {
   "meta": {
     "title": "Decision Layer",
-    "description": "A structured decision layer for the DeepSeek Harness agent loop: a danger-call gate, output self-check, and loop guard backed by a pluggable adjudication model."
+    "description": "A structured decision layer for the DeepSeek Harness agent loop: a danger-call gate, output self-check, tool narrowing, task-completion review, and loop guard backed by a pluggable adjudication model.",
+    "detail": "docs/en/DETAIL.md"
   }
 }

package/locale/zh.json

@@ -1,6 +1,7 @@
 {
   "meta": {
     "title": "决策层",
-    "description": "为 DeepSeek Harness agent 循环提供的结构化决策层：危险调用门控、产出自检与防循环，由可插拔的裁决模型驱动。"
+    "description": "为 DeepSeek Harness agent 循环提供的结构化决策层：危险调用门控、产出自检、工具收窄、任务完成核对与防循环，由可插拔的裁决模型驱动。",
+    "detail": "docs/zh/DETAIL.md"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-decision-layer",
-  "version": "0.6.4",
+  "version": "0.7.1",
   "description": "A structured decision layer for the DeepSeek Harness agent loop: a danger-call gate, output self-check, tool narrowing, and loop guard backed by a pluggable adjudication model.",
   "keywords": [
     "dsh",
@@ -20,6 +20,8 @@
     "skills",
     "lib/client.js",
     "locale/*.json",
+    "docs/zh/DETAIL.md",
+    "docs/en/DETAIL.md",
     "icon.svg",
     "cordis.patch.yml",
     "README.md",
@@ -35,7 +37,9 @@
   },
   "scripts": {
     "test": "node --test tests/*.test.mjs",
-    "build:client": "tsc -p tsconfig.client.json && node scripts/build-client.mjs"
+    "build:client": "tsc -p tsconfig.client.json && node scripts/build-client.mjs",
+    "check": "npm run build:client && npm test",
+    "pack:assert": "node scripts/assert-pack.mjs"
   },
   "exports": {
     ".": "./service/dsh.mjs",

package/service/config-store.mjs

@@ -29,6 +29,11 @@ function safeText(value) {
   return typeof value === 'string' ? value.trim() : '';
 }
 
+// A confidence/threshold/probability: any finite number in [0, 1].
+function probability(value) {
+  return typeof value === 'number' && Number.isFinite(value) && value >= 0 && value <= 1;
+}
+
 function checkedUrl(value) {
   if (!value) return '';
   let url;
@@ -53,9 +58,31 @@ function validRules(value) {
   return rules;
 }
 
+// Danger-gate settings. A gate verdict only intervenes on a high-confidence
+// `deny`, so minConfidence is the single knob that decides how sure the model
+// must be before a dangerous call is actually blocked. Lowering it makes the
+// gate block more (and risk blocking legitimate commands); raising it makes it
+// pass more through. Range 0–1; unset uses the built-in 0.6.
+//
+// Like every sibling validator, an unknown field or an out-of-range value is
+// REJECTED rather than ignored, which makes the whole resolve reject (see the
+// contract note on saveConfig). Callers that read config on a hot path must
+// therefore tolerate a throw and fall back to a safe default — see `featureOn`
+// in dsh.mjs and `resolveMinConfidence` in danger-gate.mjs.
+function validGate(value) {
+  if (!safeObject(value)) return undefined;
+  if (Object.keys(value).some(key => key !== 'minConfidence')) throw new Error('Invalid gate settings');
+  const gate = {};
+  if (value.minConfidence !== undefined) {
+    if (!probability(value.minConfidence)) throw new Error('Invalid gate settings');
+    gate.minConfidence = value.minConfidence;
+  }
+  return gate;
+}
+
 function validCheck(value) {
   if (!safeObject(value)) return undefined;
-  if (Object.keys(value).some(key => !['mode', 'rubric', 'lowScoreThreshold', 'trendMinConfidence', 'trendRun', 'trendSevereRun'].includes(key))) throw new Error('Invalid self-check settings');
+  if (Object.keys(value).some(key => !['mode', 'rubric', 'lowScoreThreshold', 'minConfidence', 'trendMinConfidence', 'trendRun', 'trendSevereRun'].includes(key))) throw new Error('Invalid self-check settings');
   const check = {};
   if (value.mode !== undefined) {
     if (value.mode !== 'observe' && value.mode !== 'steer') throw new Error('Invalid self-check settings');
@@ -71,11 +98,18 @@ function validCheck(value) {
     if (!Number.isSafeInteger(value.lowScoreThreshold) || value.lowScoreThreshold < 0 || value.lowScoreThreshold > 9) throw new Error('Invalid self-check settings');
     check.lowScoreThreshold = value.lowScoreThreshold;
   }
+  // Confidence required before a low score actually triggers the supplemental
+  // prompt. Below this the score is still logged; only interrupting the user
+  // warrants the model being sure. Range 0–1; unset uses the built-in 0.4.
+  if (value.minConfidence !== undefined) {
+    if (!probability(value.minConfidence)) throw new Error('Invalid self-check settings');
+    check.minConfidence = value.minConfidence;
+  }
   // Quality-trend alarm thresholds (all unvalidated heuristics, tuned on real logs):
   // a high-confidence low score requires confidence ≥ trendMinConfidence; a run of
   // trendRun such scores raises "warn", trendSevereRun raises "severe".
   if (value.trendMinConfidence !== undefined) {
-    if (typeof value.trendMinConfidence !== 'number' || !Number.isFinite(value.trendMinConfidence) || value.trendMinConfidence < 0 || value.trendMinConfidence > 1) throw new Error('Invalid self-check settings');
+    if (!probability(value.trendMinConfidence)) throw new Error('Invalid self-check settings');
     check.trendMinConfidence = value.trendMinConfidence;
   }
   if (value.trendRun !== undefined) {
@@ -104,7 +138,7 @@ function validNarrow(value) {
     narrow.mode = value.mode;
   }
   if (value.threshold !== undefined) {
-    if (typeof value.threshold !== 'number' || !Number.isFinite(value.threshold) || value.threshold < 0 || value.threshold > 1) throw new Error('Invalid narrowing settings');
+    if (!probability(value.threshold)) throw new Error('Invalid narrowing settings');
     narrow.threshold = value.threshold;
   }
   // Tool name prefixes that are always kept and never judged for relevance, on
@@ -144,10 +178,12 @@ export const FEATURE_KEYS = Object.freeze(['gate', 'check', 'narrow', 'complete'
 
 // Task-completion checking settings: observe-only by default; steer opts into a
 // single supplemental prompt on low completion. minConditions is the minimum
-// number of explicit conditions a turn must have for the check to run at all.
+// number of explicit conditions a turn must have for the check to run at all;
+// minConfidence is how sure the model must be that a condition is unmet before
+// it actually opens the supplemental step.
 function validComplete(value) {
   if (!safeObject(value)) return undefined;
-  if (Object.keys(value).some(key => !['mode', 'minConditions'].includes(key))) throw new Error('Invalid task-completion settings');
+  if (Object.keys(value).some(key => !['mode', 'minConditions', 'minConfidence'].includes(key))) throw new Error('Invalid task-completion settings');
   const complete = {};
   if (value.mode !== undefined) {
     if (value.mode !== 'observe' && value.mode !== 'steer') throw new Error('Invalid task-completion settings');
@@ -157,6 +193,11 @@ function validComplete(value) {
     if (!Number.isSafeInteger(value.minConditions) || value.minConditions < 2 || value.minConditions > 20) throw new Error('Invalid task-completion settings');
     complete.minConditions = value.minConditions;
   }
+  // Range 0–1; unset uses the built-in 0.4.
+  if (value.minConfidence !== undefined) {
+    if (!probability(value.minConfidence)) throw new Error('Invalid task-completion settings');
+    complete.minConfidence = value.minConfidence;
+  }
   return complete;
 }
 
@@ -186,6 +227,7 @@ function view(stored) {
     httpApprovedUrl: safeText(stored.httpApprovedUrl),
   };
   if (stored.dangerRules !== undefined) result.dangerRules = validRules(stored.dangerRules);
+  if (stored.gateSettings !== undefined) result.gateSettings = validGate(stored.gateSettings);
   if (stored.checkSettings !== undefined) result.checkSettings = validCheck(stored.checkSettings);
   if (stored.narrowSettings !== undefined) result.narrowSettings = validNarrow(stored.narrowSettings);
   if (stored.completeSettings !== undefined) result.completeSettings = validComplete(stored.completeSettings);
@@ -207,6 +249,7 @@ export async function resolveConfig({ path = configPath(), env = process.env } =
     httpApprovedUrl: safeText(stored.httpApprovedUrl),
   };
   if (stored.dangerRules !== undefined) resolved.dangerRules = validRules(stored.dangerRules);
+  if (stored.gateSettings !== undefined) resolved.gateSettings = validGate(stored.gateSettings);
   if (stored.checkSettings !== undefined) resolved.checkSettings = validCheck(stored.checkSettings);
   if (stored.narrowSettings !== undefined) resolved.narrowSettings = validNarrow(stored.narrowSettings);
   if (stored.completeSettings !== undefined) resolved.completeSettings = validComplete(stored.completeSettings);
@@ -214,8 +257,17 @@ export async function resolveConfig({ path = configPath(), env = process.env } =
   return resolved;
 }
 
+// Write the configuration atomically. Contract for the nested settings sections
+// (dangerRules, gateSettings, checkSettings, narrowSettings, completeSettings,
+// features): a POSTED section REPLACES the stored one wholesale; an OMITTED
+// section keeps its previous value. So a caller updating one field of a section
+// must send the whole section, and a caller that wants to change a field inside
+// a section it does not own must read first and send `{...previous, edit}`.
+// Merge-per-field was considered and rejected: it would make a stored field
+// impossible to unset. service/manager-api.mjs forwards the raw body, so this
+// contract holds for API clients too, not just the config page.
 export async function saveConfig(input, path = configPath()) {
-  if (!safeObject(input) || Object.keys(input).some(key => !['url', 'apiKey', 'model', 'confirmHttpUrl', 'dangerRules', 'checkSettings', 'narrowSettings', 'completeSettings', 'features'].includes(key))) {
+  if (!safeObject(input) || Object.keys(input).some(key => !['url', 'apiKey', 'model', 'confirmHttpUrl', 'dangerRules', 'gateSettings', 'checkSettings', 'narrowSettings', 'completeSettings', 'features'].includes(key))) {
     throw new Error('Invalid configuration fields');
   }
   for (const key of ['url', 'apiKey', 'model', 'confirmHttpUrl']) {
@@ -229,6 +281,7 @@ export async function saveConfig(input, path = configPath()) {
     throw new Error('Invalid model or API key');
   }
   const dangerRules = input.dangerRules === undefined ? previous.dangerRules : validRules(input.dangerRules);
+  const gateSettings = input.gateSettings === undefined ? previous.gateSettings : validGate(input.gateSettings);
   const checkSettings = input.checkSettings === undefined ? previous.checkSettings : validCheck(input.checkSettings);
   const narrowSettings = input.narrowSettings === undefined ? previous.narrowSettings : validNarrow(input.narrowSettings);
   const completeSettings = input.completeSettings === undefined ? previous.completeSettings : validComplete(input.completeSettings);
@@ -240,6 +293,7 @@ export async function saveConfig(input, path = configPath()) {
   }
   const next = { url, apiKey, model, httpApprovedUrl: url.startsWith('http://') ? url : '' };
   if (dangerRules !== undefined) next.dangerRules = dangerRules;
+  if (gateSettings !== undefined) next.gateSettings = gateSettings;
   if (checkSettings !== undefined) next.checkSettings = checkSettings;
   if (narrowSettings !== undefined) next.narrowSettings = narrowSettings;
   if (completeSettings !== undefined) next.completeSettings = completeSettings;

package/service/danger-gate.mjs

@@ -11,7 +11,9 @@ const PATH_KEYS = new Set(['path', 'file_path', 'filePath', 'target', 'file', 'f
 const MAX_RULES = 64;
 const MAX_PATTERN_LENGTH = 128;
 const MAX_METADATA_LENGTH = 2048;
-export const MIN_CONFIDENCE = 0.7;
+export const MIN_CONFIDENCE = 0.6;
+
+const isProbability = value => typeof value === 'number' && Number.isFinite(value) && value >= 0 && value <= 1;
 
 export const DEFAULT_DANGEROUS_RULES = Object.freeze({
   toolNames: Object.freeze(['bash', 'pwsh', 'shell', 'exec', 'terminal', 'run_command', 'write', 'edit', 'str_replace_editor', 'file_write', 'write_file']),
@@ -82,6 +84,17 @@ export function createDangerGate({ evaluate, sessions, rules = DEFAULT_DANGEROUS
     if (typeof rules !== 'function') return rules;
     try { return (await rules()) ?? DEFAULT_DANGEROUS_RULES; } catch { return DEFAULT_DANGEROUS_RULES; }
   };
+  // The confidence floor may be a fixed number or a live resolver (config-backed),
+  // mirroring `rules`, so changing it takes effect without reloading the plugin.
+  // An invalid or failed resolution falls back to the built-in floor rather than
+  // to 0 — a broken config must never turn the gate into "block every deny".
+  const resolveMinConfidence = async () => {
+    if (typeof minConfidence !== 'function') return isProbability(minConfidence) ? minConfidence : MIN_CONFIDENCE;
+    try {
+      const value = await minConfidence();
+      return isProbability(value) ? value : MIN_CONFIDENCE;
+    } catch { return MIN_CONFIDENCE; }
+  };
   const deniedCalls = new WeakSet();
   const evaluatedCalls = new WeakSet();
   const record = (exec, outcome, detail = {}) => {
@@ -139,7 +152,8 @@ export function createDangerGate({ evaluate, sessions, rules = DEFAULT_DANGEROUS
       const answer = result?.answers?.verdict;
       const choice = answer?.choice;
       if (!['allow', 'ask', 'deny'].includes(choice)) return passThrough(exec, 'error', { reason: 'invalid-response' });
-      const confident = typeof answer.confidence === 'number' && Number.isFinite(answer.confidence) && answer.confidence >= minConfidence;
+      const minConfidenceNow = await resolveMinConfidence();
+      const confident = typeof answer.confidence === 'number' && Number.isFinite(answer.confidence) && answer.confidence >= minConfidenceNow;
       // Only a high-confidence deny blocks the call.
       if (choice === 'deny' && confident) {
         record(exec, 'deny', { suggestion: 'deny', action: 'deny' });

package/service/dsh.mjs

@@ -122,10 +122,23 @@ export async function apply(ctx, options = {}) {
     evaluate: (input, request) => backend.evaluate(input, request),
     sessions,
     rules: async () => normalizeDangerRules((await resolveConfig({ path })).dangerRules),
+    // Live config-backed floor (default 0.6): a `deny` only blocks once the model
+    // is at least this confident. Read per call so an edit takes effect at once.
+    minConfidence: async () => (await resolveConfig({ path })).gateSettings?.minConfidence,
   });
   const loopGuard = createLoopGuard({ sessions });
   // Live per-feature enablement; every decision point defaults to enabled.
-  const featureOn = async key => featureEnabled((await resolveConfig({ path })).features, key);
+  // An invalid config must not fail every tool call: these hooks run inside the
+  // host's tools/pre-execute waterfall, which converts a throw into a failed call
+  // (the tool never dispatches, so `read`/`edit` can no longer repair the file).
+  // An unreadable config therefore degrades to "all features on", and each
+  // decision point keeps its own safe fallback (the gate falls back to 0.6 and
+  // the built-in rules), so the safety net stays armed instead of the agent
+  // losing every tool.
+  const featureOn = async key => {
+    try { return featureEnabled((await resolveConfig({ path })).features, key); }
+    catch { return true; }
+  };
   if (typeof ctx.on === 'function') {
     if (typeof ctx.tools.guard === 'function') {
       // Deterministic loop guard runs with no backend; then the dangerous-gate
@@ -207,22 +220,28 @@ export async function apply(ctx, options = {}) {
       // process, before any gate/check/narrow/complete event mutates them, so a
       // resumed session continues from its saved totals instead of from zero.
       if (typeof id === 'string') await sessions.ensureLoaded(id);
-      if (typeof id === 'string' && Number.isInteger(turn) && await featureOn('narrow')) {
+      if (typeof id === 'string' && Number.isInteger(turn)) {
         const state = narrowedTurns.get(id);
         if (!state || state.turn !== turn) {
+          // Release the previous turn's restriction first: restrict is agent-scoped
+          // and stays in force until disposed, so a turn where narrowing is now off
+          // must not inherit the earlier allow-list.
           state?.dispose?.();
-          const entry = { turn, dispose: undefined };
-          narrowedTurns.set(id, entry);
-          if (narrowedTurns.size > 1024) { const oldest = narrowedTurns.keys().next().value; if (oldest !== id) { narrowedTurns.get(oldest)?.dispose?.(); narrowedTurns.delete(oldest); } }
-          try {
-            const result = await narrowing.review({
-              agent, turn, signal: payload.signal,
-              state: stepTaskText(payload.messages), tools: agentTools(ctx, agent),
-            });
-            if (result.mode === 'enforce' && result.applied && typeof agent?.ctx?.tools?.restrict === 'function') {
-              entry.dispose = agent.ctx.tools.restrict({ allow: result.keep });
-            }
-          } catch { /* narrowing is best effort; never block the step */ }
+          narrowedTurns.delete(id);
+          if (await featureOn('narrow')) {
+            const entry = { turn, dispose: undefined };
+            narrowedTurns.set(id, entry);
+            if (narrowedTurns.size > 1024) { const oldest = narrowedTurns.keys().next().value; if (oldest !== id) { narrowedTurns.get(oldest)?.dispose?.(); narrowedTurns.delete(oldest); } }
+            try {
+              const result = await narrowing.review({
+                agent, turn, signal: payload.signal,
+                state: stepTaskText(payload.messages), tools: agentTools(ctx, agent),
+              });
+              if (result.mode === 'enforce' && result.applied && typeof agent?.ctx?.tools?.restrict === 'function') {
+                entry.dispose = agent.ctx.tools.restrict({ allow: result.keep });
+              }
+            } catch { /* narrowing is best effort; never block the step */ }
+          }
         }
       }
       return next();

package/service/log-analyze.mjs

@@ -1,5 +1,6 @@
 import { createReadableStream } from './log-read.mjs';
 import { advanceRun, severityOf } from './quality-trend.mjs';
+import { narrowApplied } from './narrowing.mjs';
 
 // Offline analysis over the persisted decision JSONL logs. Pure aggregation:
 // given a stream of records (decision events + annotation events) for one
@@ -75,7 +76,7 @@ export function buildProfile(decisions) {
       if (cb) bucket.confidence[cb]++;
     } else if (kind === 'narrow') {
       if (record.outcome === 'error') bucket.error++;
-      else if (record.outcome === 'applied') bucket.applied++;
+      else if (narrowApplied(record)) bucket.applied++;
       if (Number.isSafeInteger(record.dropped) && record.dropped > 0) bucket.droppedSum += record.dropped;
       if (record.reason === 'too-many-candidates') bucket.tooManyCandidates++;
     } else if (kind === 'complete') {
@@ -196,7 +197,7 @@ export function buildSeed(decisions, { maxLog = 50, trendConfig = {} } = {}) {
       }
     } else if (record.kind === 'narrow') {
       if (record.outcome === 'applied') {
-        bucket.applied++;
+        if (narrowApplied(record)) bucket.applied++;
         if (Number.isSafeInteger(record.dropped) && record.dropped > 0) bucket.dropped += record.dropped;
       }
     } else if (record.kind === 'complete') {
@@ -234,9 +235,9 @@ export async function reconstructSessionSeed(sessionId, { dir, port, trendConfig
 // Read one session's persisted decision rows and return a single newest-first
 // page. Backs the analysis tab's full decision log (the dock panel still shows
 // only the in-memory recent rows). Decisions are folded by id (latest wins) so a
-// re-logged id is not double-counted. Rows carry only the panel fields — tool
-// name, outcome, counts — never gate command/path, which is never logged. The
-// internal sessionId tag is stripped before the row leaves the server.
+// re-logged id is not double-counted. Rows carry only the panel fields, including
+// the gate's redacted, length-bounded command/path. The internal sessionId tag is
+// stripped before the row leaves the server.
 export async function listSessionDecisions(sessionId, { dir, port, page = 1, pageSize = 100, readStream = createReadableStream } = {}) {
   if (typeof sessionId !== 'string' || !sessionId.trim()) throw new Error('Invalid session id');
   const size = Number.isSafeInteger(pageSize) && pageSize > 0 && pageSize <= 500 ? pageSize : 100;

package/service/manager-api.mjs

@@ -91,9 +91,9 @@ export function createManagerRoutes({ path, sessions, backend, logStore, analyze
       },
     }),
     // One newest-first page of this session's full persisted decision rows, for
-    // the analysis tab's paginated log. Rows carry only panel fields (tool name,
-    // outcome, counts) — never gate command/path, which is never logged — so this
-    // exposes nothing the recent-rows /log route does not already.
+    // the analysis tab's paginated log. Rows carry the same panel fields as /log,
+    // including the gate's already-redacted and length-bounded command/path, so
+    // this exposes nothing the recent-rows route does not already.
     route('logrows', {
       GET: async req => {
         if (typeof listRows !== 'function') { const error = new Error('log rows unavailable'); error.code = 'BAD_REQUEST'; throw error; }

package/service/narrowing.mjs

@@ -1,5 +1,14 @@
 const isObject = value => value !== null && typeof value === 'object' && !Array.isArray(value);
 const probability = value => typeof value === 'number' && Number.isFinite(value) && value >= 0 && value <= 1;
+
+// Whether a narrowing pass actually restricted the tool set. `applied` is the
+// authoritative field; a vetoed pass (low-keep, too many candidates) is never
+// applied, and rows logged before `applied` existed are read from their reason.
+export const narrowApplied = record => {
+  if (record?.applied === false) return false;
+  if (record?.reason === 'low-keep' || record?.reason === 'too-many-candidates') return false;
+  return record?.applied === true || record?.outcome === 'applied';
+};
 const MAX_STATE = 8 * 1024;
 // The adjudication backend hard-rejects a request carrying more than 64 questions
 // (backend.mjs validateRequest). One relevance question is sent per optional tool,
@@ -25,21 +34,28 @@ export const DEFAULT_CORE_TOOLS = Object.freeze([
 // Tool-name prefixes that are always kept and never judged, on top of the core
 // tools. Memory/context tools like OpenViking are "keep resident, trigger on
 // demand": their relevance rarely shows in the literal task text, so per-tool
-// relevance judging would keep pruning them. `team_task_` covers the shared
-// task-board tools as a group. Users can override this list.
-export const DEFAULT_KEEP_PREFIXES = Object.freeze(['mcp__openviking', 'team_task_']);
+// relevance judging would keep pruning them. Teamwork tools (`team_task_`) are
+// deliberately NOT in this list: they are ordinary task-board capabilities and
+// should be judged like any other optional tool. Users can override this list.
+export const DEFAULT_KEEP_PREFIXES = Object.freeze(['mcp__openviking']);
 
 // Intersect the host-allowed tool set with the model's relevance verdict. Only
 // removes tools; never adds. Any missing or invalid noul keeps the tool, and a
 // verdict that would strip everything is skipped so the agent is never disabled.
-// Drop threshold: a tool is dropped only when the model is fairly confident it
-// is not needed (noul < threshold). Default 0.3 is deliberately conservative —
-// a noul near 0.5 means the model is unsure, and dropping there is the most
-// likely to strip a still-useful tool, so uncertain tools are kept.
-export function narrowTools(allowed, result, { threshold = 0.3 } = {}) {
+// `keepBase` is the number of always-kept tools outside `allowed` (core tools and
+// keep-prefix matches); the never-strip-everything guard must count them, or
+// dropping every optional tool would be vetoed even though those tools remain.
+// Drop threshold: a tool is dropped only when its relevance probability is below
+// this value (noul < threshold). The default leans aggressive — only tools the
+// model rates as fairly relevant survive, so the surface stays small. A noul near
+// 0.5 means the model is unsure and is dropped under this default; lower the
+// threshold to keep such may-need tools.
+export const DEFAULT_NARROW_THRESHOLD = 0.7;
+export function narrowTools(allowed, result, { threshold = DEFAULT_NARROW_THRESHOLD, keepBase = 0 } = {}) {
   const tools = Array.isArray(allowed) ? allowed.filter(name => typeof name === 'string') : [];
   const answers = isObject(result?.answers) ? result.answers : undefined;
   if (tools.length === 0 || !answers) return { applied: false, keep: [...tools], drop: [] };
+  const base = Number.isSafeInteger(keepBase) && keepBase > 0 ? keepBase : 0;
 
   const keep = [];
   const drop = [];
@@ -48,7 +64,7 @@ export function narrowTools(allowed, result, { threshold = 0.3 } = {}) {
     if (isObject(answer) && answer.type === 'noul' && probability(answer.noul) && answer.noul < threshold) drop.push(name);
     else keep.push(name);
   }
-  if (drop.length === 0 || keep.length === 0) return { applied: false, keep: [...tools], drop: [] };
+  if (drop.length === 0 || keep.length + base === 0) return { applied: false, keep: [...tools], drop: [] };
   return { applied: true, keep, drop };
 }
 
@@ -96,7 +112,7 @@ export function createNarrowing({ evaluate, sessions, settings, coreTools = DEFA
     let raw = {};
     try { raw = (typeof settings === 'function' ? await settings() : settings) ?? {}; } catch { raw = {}; }
     const mode = raw?.mode === 'observe' ? 'observe' : 'enforce';
-    const threshold = typeof raw?.threshold === 'number' && Number.isFinite(raw.threshold) && raw.threshold >= 0 && raw.threshold <= 1 ? raw.threshold : 0.3;
+    const threshold = typeof raw?.threshold === 'number' && Number.isFinite(raw.threshold) && raw.threshold >= 0 && raw.threshold <= 1 ? raw.threshold : DEFAULT_NARROW_THRESHOLD;
     const batchMode = raw?.batchMode === 'single' || raw?.batchMode === 'split' ? raw.batchMode : 'auto';
     // An explicit array in settings (including empty) overrides the default set.
     const prefixes = Array.isArray(raw?.keepPrefixes)
@@ -112,7 +128,7 @@ export function createNarrowing({ evaluate, sessions, settings, coreTools = DEFA
   const record = (turn, outcome, detail = {}) => {
     const id = turn?.agent?.session?.id;
     if (!sessions || typeof id !== 'string') return;
-    try { if (typeof sessions.recordNarrow === 'function') sessions.recordNarrow(id, outcome, detail.dropped ?? 0); }
+    try { if (typeof sessions.recordNarrow === 'function') sessions.recordNarrow(id, outcome, detail.dropped ?? 0, narrowApplied({ ...detail, outcome })); }
     catch { /* telemetry is best effort */ }
     if (typeof sessions.log !== 'function') return;
     try { sessions.log(id, { kind: 'narrow', outcome, ...detail }); }
@@ -191,14 +207,14 @@ export function createNarrowing({ evaluate, sessions, settings, coreTools = DEFA
           }
         }
       }
-      const narrowed = narrowTools(judgedNames, result, { threshold });
+      const narrowed = narrowTools(judgedNames, result, { threshold, keepBase: keptNames.length });
       const keep = [...keptNames, ...narrowed.keep];
       const drop = narrowed.drop;
       // C: too few tools left over is a sign the verdict over-pruned; do not apply.
       const trustworthy = keep.length >= minKeep;
       const applied = narrowed.applied && trustworthy && !overCap && mode === 'enforce';
       const dropped = drop.length;
-      const detail = { dropped, kept: keep.length, mode: effectiveMode, tools: drop };
+      const detail = { dropped, kept: keep.length, mode: effectiveMode, tools: drop, applied };
       // The optional-candidate count (excludes core tools and keep-prefix matches),
       // recorded so the "too many candidates" reason shows the number that tripped it.
       if (overCap) { detail.reason = 'too-many-candidates'; detail.candidates = optional.length; }

package/service/self-check.mjs

@@ -33,6 +33,8 @@ function boundedRubric(rubric) {
   return levels.length >= 2 ? levels : DEFAULT_RUBRIC;
 }
 
+const isProbability = value => typeof value === 'number' && Number.isFinite(value) && value >= 0 && value <= 1;
+
 export function scoreQuestion(output, rubric = DEFAULT_RUBRIC) {
   return {
     state: { answer: String(output).slice(0, MAX_OUTPUT) },
@@ -44,10 +46,16 @@ export function scoreQuestion(output, rubric = DEFAULT_RUBRIC) {
   };
 }
 
+// The confidence floor for interrupting the user with a supplemental prompt.
+// Named rather than inlined because config-store's `checkSettings.minConfidence`
+// and the config form both document this value; a bare literal in three places
+// drifts silently on the next tuning pass.
+export const DEFAULT_MIN_CONFIDENCE = 0.4;
+
 // `settings` is an async resolver so rubric/mode/threshold follow live config.
 // `steer(agent, text)` performs the host-native steer; the caller owns building
 // the framework UserMessage so this module stays free of DSH message types.
-export function createSelfCheck({ evaluate, sessions, steer, settings, minConfidence = 0.4 } = {}) {
+export function createSelfCheck({ evaluate, sessions, steer, settings, minConfidence = DEFAULT_MIN_CONFIDENCE } = {}) {
   if (typeof evaluate !== 'function') throw new Error('Self-check requires an evaluator');
   const steerOnce = createSteerOnce();
   const resolveSettings = async () => {
@@ -55,11 +63,15 @@ export function createSelfCheck({ evaluate, sessions, steer, settings, minConfid
     try { raw = (typeof settings === 'function' ? await settings() : settings) ?? {}; } catch { raw = {}; }
     const mode = raw?.mode === 'steer' ? 'steer' : 'observe';
     const lowScoreThreshold = Number.isSafeInteger(raw?.lowScoreThreshold) && raw.lowScoreThreshold >= 0 ? raw.lowScoreThreshold : 1;
+    // Confidence required before a low score actually opens the supplemental
+    // prompt. The constructor argument is the fallback so a direct caller (and a
+    // config without the field) keeps its own floor.
+    const confidenceFloor = isProbability(raw?.minConfidence) ? raw.minConfidence : minConfidence;
     // Quality-trend thresholds (unvalidated heuristics; see quality-trend.mjs).
     const trendMinConfidence = typeof raw?.trendMinConfidence === 'number' && Number.isFinite(raw.trendMinConfidence) && raw.trendMinConfidence >= 0 && raw.trendMinConfidence <= 1 ? raw.trendMinConfidence : 0.6;
     const trendRun = Number.isSafeInteger(raw?.trendRun) && raw.trendRun >= 2 ? raw.trendRun : 3;
     const trendSevereRun = Number.isSafeInteger(raw?.trendSevereRun) && raw.trendSevereRun > trendRun ? raw.trendSevereRun : Math.max(trendRun + 1, 5);
-    return { mode, rubric: boundedRubric(raw?.rubric), lowScoreThreshold, trendMinConfidence, trendRun, trendSevereRun };
+    return { mode, rubric: boundedRubric(raw?.rubric), lowScoreThreshold, minConfidence: confidenceFloor, trendMinConfidence, trendRun, trendSevereRun };
   };
   const record = (turn, outcome, detail = {}, trend) => {
     const id = turn?.agent?.session?.id;
@@ -82,7 +94,7 @@ export function createSelfCheck({ evaluate, sessions, steer, settings, minConfid
       // can tell which turn's output each self-check score belongs to.
       const subject = subjectOf(turn?.userText);
       const subjectDetail = subject ? { subject } : {};
-      const { mode, rubric, lowScoreThreshold, trendMinConfidence, trendRun, trendSevereRun } = await resolveSettings();
+      const { mode, rubric, lowScoreThreshold, minConfidence: confidenceFloor, trendMinConfidence, trendRun, trendSevereRun } = await resolveSettings();
       let answer;
       try {
         const result = await evaluate(scoreQuestion(output, rubric), { signal: turn.signal });
@@ -107,7 +119,7 @@ export function createSelfCheck({ evaluate, sessions, steer, settings, minConfid
       if (lowScore && confidence !== undefined && !trend.confident) detail.lowConfidence = true;
       record(turn, lowScore ? 'low' : 'ok', { score: answer.score, ...detail }, trend);
       if (!lowScore) return { evaluated: true, lowScore: false, steered: false, score: answer.score };
-      const confident = confidence !== undefined && confidence >= minConfidence;
+      const confident = confidence !== undefined && confidence >= confidenceFloor;
       // The turn budget is consumed only on a successful steer (createSteerOnce),
       // so a transient host failure does not permanently suppress this turn.
       const steered = mode === 'steer' && confident && typeof steer === 'function' && turn?.agent

package/service/session-state.mjs

@@ -172,14 +172,16 @@ export function createSessionState({ maxSessions = 1024, maxLogEntries = 50, onL
       }
       bump(sessionKey(id), state);
     },
-    recordNarrow(id, outcome, dropped = 0) {
+    recordNarrow(id, outcome, dropped = 0, applied = outcome === 'applied') {
       if (!['ok', 'applied', 'error'].includes(outcome)) throw new Error('Invalid narrowing outcome');
       const state = writable(id);
       state.attempts++;
       state.narrow.attempts++;
       if (outcome === 'error') { state.failures++; state.narrow.failures++; }
       else if (outcome === 'applied') {
-        state.narrow.applied++;
+        // A vetoed pass (low-keep, too many candidates) still dropped tools on
+        // paper, but the restriction never took effect; only count real ones.
+        if (applied) state.narrow.applied++;
         if (Number.isSafeInteger(dropped) && dropped > 0) state.narrow.dropped += dropped;
       }
       bump(sessionKey(id), state);
@@ -227,6 +229,7 @@ export function createSessionState({ maxSessions = 1024, maxLogEntries = 50, onL
       if (typeof entry.confidence === 'number' && Number.isFinite(entry.confidence)) record.confidence = Math.round(entry.confidence * 100) / 100;
       if (Number.isSafeInteger(entry.dropped) && entry.dropped >= 0) record.dropped = entry.dropped;
       if (Number.isSafeInteger(entry.kept) && entry.kept >= 0) record.kept = entry.kept;
+      if (typeof entry.applied === 'boolean') record.applied = entry.applied;
       if (Number.isSafeInteger(entry.candidates) && entry.candidates >= 0) record.candidates = entry.candidates;
       if (Number.isSafeInteger(entry.conditions) && entry.conditions >= 0) record.conditions = entry.conditions;
       if (Number.isSafeInteger(entry.satisfied) && entry.satisfied >= 0) record.satisfied = entry.satisfied;

package/service/task-completion.mjs

@@ -74,11 +74,17 @@ export function completionQuestions(conditions, evidence, answer) {
   return { state, questions };
 }
 
+// The confidence floor for interrupting the user with a supplemental prompt.
+// Named rather than inlined because config-store's `completeSettings.minConfidence`
+// and the config form both document this value; a bare literal in three places
+// drifts silently on the next tuning pass.
+export const DEFAULT_MIN_CONFIDENCE = 0.4;
+
 // Orchestrates one task-completion pass at turn end. Read-only by default: it
 // records a per-condition verdict and only steers when explicitly configured,
 // the model is confident, and at least one condition is not satisfied. A steer
 // opens a supplemental step; it never rewrites the already-committed reply.
-export function createTaskCompletion({ evaluate, sessions, steer, settings, minConfidence = 0.4 } = {}) {
+export function createTaskCompletion({ evaluate, sessions, steer, settings, minConfidence = DEFAULT_MIN_CONFIDENCE } = {}) {
   if (typeof evaluate !== 'function') throw new Error('Task completion requires an evaluator');
   const steerOnce = createSteerOnce();
   const resolveSettings = async () => {
@@ -86,7 +92,11 @@ export function createTaskCompletion({ evaluate, sessions, steer, settings, minC
     try { raw = (typeof settings === 'function' ? await settings() : settings) ?? {}; } catch { raw = {}; }
     const mode = raw?.mode === 'steer' ? 'steer' : 'observe';
     const minConditions = Number.isSafeInteger(raw?.minConditions) && raw.minConditions >= 2 ? raw.minConditions : 2;
-    return { mode, minConditions };
+    // Confidence required before an unmet condition actually opens the
+    // supplemental step; the constructor argument is the fallback when the
+    // config does not set it.
+    const confidenceFloor = probability(raw?.minConfidence) ? raw.minConfidence : minConfidence;
+    return { mode, minConditions, minConfidence: confidenceFloor };
   };
   const record = (turn, outcome, detail = {}) => {
     const id = turn?.agent?.session?.id;
@@ -100,7 +110,7 @@ export function createTaskCompletion({ evaluate, sessions, steer, settings, minC
   return {
     async review(turn) {
       const output = typeof turn?.output === 'string' ? turn.output.trim() : '';
-      const { mode, minConditions } = await resolveSettings();
+      const { mode, minConditions, minConfidence: confidenceFloor } = await resolveSettings();
       const conditions = extractConditions(turn?.userText);
       if (conditions.length < minConditions) return { ...skip };
       const evidence = Array.isArray(turn?.evidence) ? turn.evidence : [];
@@ -139,7 +149,7 @@ export function createTaskCompletion({ evaluate, sessions, steer, settings, minC
       const outcome = unsatisfied > 0 ? 'unsatisfied' : 'ok';
       const detail = { conditions: conditions.length, satisfied, unsatisfied, insufficient };
       // A steer is only for a confident finding that a listed condition is not met.
-      const confident = unsatisfied > 0 && unsatisfiedMinConf >= minConfidence;
+      const confident = unsatisfied > 0 && unsatisfiedMinConf >= confidenceFloor;
       // The turn budget is consumed only on a successful steer (createSteerOnce),
       // so a transient host failure does not permanently suppress this turn.
       const steered = mode === 'steer' && confident && typeof steer === 'function' && turn?.agent