dsh-hypatia-auto-memory 0.3.0 → 0.4.0

package/README.md

@@ -357,12 +357,23 @@ changes. No card claims it, so it renders nowhere; nothing ever writes to it.
    (get-before-create); uncovered ranges are re-enqueued from watermarks.
 4. To check the route warning: consolidation with no selected `models`
    logs a one-time warning and otherwise stays silent.
-5. `hypatia backfill --status` reports the shelf's embedding debt. With a
+5. Which model a background call actually ran on is recorded per attempt in
+   `~/.dsh/storages/hypatia_auto_memory_diag.json` (`tables.model_calls`,
+   newest first by `seq`, bounded to 100). The settings list is not the answer:
+   one process-local cursor rotates through `consolidation.models` across every
+   span summary, adjudication and cascade call, so consecutive attempts
+   alternate. `outcome` is `pending` (in flight, or the process died mid-call),
+   `ok` (a usable result was produced), `incomplete` (the call settled without
+   one — output cap, abort, unparseable reply) or `error` (the call threw); in
+   the last two the cursor was consumed and nothing was stored. `detail` is a
+   finish kind, a fixed label, or the provider's message, capped at 200
+   characters — never message content and never model output.
+6. `hypatia backfill --status` reports the shelf's embedding debt. With a
    current hypatia, logging a turn adds nothing to it; only summaries and work
    units are pending until the next flush. `hypatia scope list --count` shows
    the scopes in use — the one this project's `msg-*` entries carry is the one
    the session seed reads.
-6. Uninstall: `dsh plugin --profile web remove dsh-hypatia-auto-memory` —
+7. Uninstall: `dsh plugin --profile web remove dsh-hypatia-auto-memory` —
    hypatia entries themselves are left in `~/.hypatia/`.
 
 ## Failure modes
@@ -374,7 +385,7 @@ changes. No card claims it, so it renders nowhere; nothing ever writes to it.
 | Entries appear only after a turn finishes | By design: spans are cut at `turn/end`, or at the first `step/end` once a turn has run longer than `flushWindowMs`, so an entry never lacks its own tool results |
 | Logging works, no summaries | `consolidation.models` is empty or invalid — one warning at first trigger |
 | Summaries but no `sum2-*` | Fewer than `cascade.batchSize` unarchived tier-1 summaries in that project yet |
-| Work units have no relationships | No embedding model on the shelf (`similar` fails), or every candidate was beyond `dedupMaxDistance`. Since hypatia #19 the local model is looked up in `~/.hypatia/models/<org>/<name>` (or the Hugging Face cache), no longer beside the shelf: a shelf that used to answer `similar` and now says `is not installed` needs `hypatia model install <model>`, or `hypatia model register <model> <dir>` pointing at the files it already has |
+| Work units have no relationships | No embedding model on the shelf (`similar` fails), every candidate was beyond `dedupMaxDistance`, or the adjudication call itself produced no verdict — `model_calls` shows that as `incomplete` / `max-tokens`, which is what a thinking-enabled route does when it spends the whole output budget on reasoning before answering. The call now asks a route for `reasoningEffort: 'off'` once the adapter advertises it, and carries a 1024-token cap for routes that cannot honour it. Since hypatia #19 the local model is looked up in `~/.hypatia/models/<org>/<name>` (or the Hugging Face cache), no longer beside the shelf: a shelf that used to answer `similar` and now says `is not installed` needs `hypatia model install <model>`, or `hypatia model register <model> <dir>` pointing at the files it already has |
 | `similar` still returns `msg-*` rows | They were written before this plugin opted the log layer out of embedding, or by a hypatia without `--no-embed`. Retract the knowledge vectors once with `embedding.skip_tags = ["message"]` in the shelf's `shelf.toml` followed by `hypatia backfill` (a binary older than the key refuses to open the shelf, so upgrade every binary sharing it first). Do not add `session` to that list: `skip_tags` matches any entry carrying the tag, and knowledge people write about sessions carries it too — one such entry lost its vector on the shelf this was tried on. The plugin's own `session-*` nodes are few and now opt out per write. Statements have no tags and no update command, so `belongTo` / `summary` edges written before keep their vectors |
 | Task in `deferred` state | Neither the live store nor persistence could supply its session. Not an error: it spends no attempts and runs as soon as one of them can. Normally storage answers immediately — the state persists only when `sessionPersistence` is absent from the composition, or its read failed (look for `could not be read` in the log) |
 | Task in `failed` state | A hypatia or model error persisted after `maxAttempts`. Failed `log-message` records are pruned at the next startup, since the watermark re-derives their range; other kinds are kept for inspection — delete one to let the next trigger re-create it |
@@ -386,6 +397,7 @@ changes. No card claims it, so it renders nowhere; nothing ever writes to it.
 | Duplicate `msg-*` after weird manual edits | Delete the entry in hypatia and lower `lastLoggedSeq` for that session in the state domain — backfill recreates it once |
 | The agent's own `hypatia` write still asks for approval | `autoApprove: false` (needs a profile reload to change), the command pipes/redirects/chains outside quotes, or its first word is not one of `binaries` — only plain calls are answered, by design. Reads never reach approval at all, so nothing to fix there |
 | The agent got a memory protocol that tells it to log messages by hand | Another plugin registered `hypatia-memory` first (`dsh-hypatia` still in the profile), or a `hypatia-memory` exists on disk — typically `~/.agents/skills/hypatia-memory`, written by `hypatia skill install --agent codex`. Agent presets load disk skills in a layer nearer than plugins, so it wins in sessions even though the skill center may list this plugin. Remove the copy the startup warning names |
+| Can't tell which model actually ran | By design the choice rotates: one process-local cursor is shared by span summaries, adjudication and cascade, so consecutive calls alternate through `consolidation.models`. Each attempt lands in `~/.dsh/storages/hypatia_auto_memory_diag.json` (`model_calls`) with purpose, provider/model, outcome and duration. The usage ledger cannot answer this — it folds agent turns (`assistant/message`) and never sees a plugin's direct `llm.stream`. A `pending` row means the call is still in flight, or the process died mid-call: the row is written before the call and settled after it |
 | Startup warnings never appear in the terminal | `dsh web` mounts no log exporter, so plugin log lines of any level go nowhere; the console exporter's default threshold would also drop warnings (warn is level 2, above info's 1). Mount a logger such as `dsh-logbook` or `dsh-boot-doctor` temporarily to read them |
 | Project scope looks wrong | Scope = basename of the session cwd's git top level (`git rev-parse --show-toplevel`), or of the cwd itself when git finds no work tree or cannot answer (not installed, a repo it refuses as unsafe). A `rev-parse` slower than 3 s leaves that one session on the cwd's own name. Two same-named checkouts share a scope by design; a linked worktree is scoped by its own directory, not the main checkout's; git resolves symlinks, so a checkout opened through a link named differently from its target gets the target's name. A name hypatia would rewrite is normalized first: a session at `/` is scoped `/`, commas become `_`, surrounding whitespace goes. Entries written before these fixes stay where they were stored: a subdirectory session's under that directory's name (`repo/src` wrote under `src` — the git root was never read), a session at `/` with no scope, `a,b` under both `a` and `b`, `foo,` under `foo` and global. Padded names were stored trimmed, which is what the query now asks for. Nothing migrates them; `knowledge-update --scopes` moves one entry and keeps its `created_at`. `hypatia scope list --count` (hypatia #30) shows every spelling in use and how many entries each holds |
 
@@ -482,6 +494,7 @@ dsh-hypatia-auto-memory/
 │   ├── writer.js         # idempotent get-before-create writes
 │   ├── consolidator.js   # thresholds, prompt, llm.stream, validation
 │   ├── cascade.js        # log₁₆(n) hierarchical summary archive
+│   ├── model-log.js      # bounded record of which model each attempt ran on
 │   ├── recall.js         # rules/taboos preload at session start
 │   ├── auto-approve.js   # approves the agent's own plain bash hypatia calls
 │   ├── skills.js         # bundled skill registration (never shadows another provider)

package/README.zh-CN.md

@@ -292,11 +292,19 @@ rules/taboos 预载、启动清理。设置卡片把它做成 `hypatia list` 所
 3. 写入中途重启是安全的：已存储的消息被跳过（get-before-create）；未覆盖的范围从
    水位重新排队。
 4. 检查路由告警：没选 `models` 的巩固只记录一次告警，其余时间静默。
-5. `hypatia backfill --status` 报告 shelf 的嵌入债务。用当前的 hypatia，记录一个
+5. 后台调用实际用了哪个模型，逐次记在
+   `~/.dsh/storages/hypatia_auto_memory_diag.json`（`tables.model_calls`，按 `seq`
+   倒序，上限 100 条）。设置卡片里的列表不是答案：一个进程内游标被 span 摘要、
+   裁决和 cascade 三者共用，所以相邻几次调用是轮流换模型的。`outcome` 为
+   `pending`（在飞行中，或进程中途死了）、`ok`（产出了可用结果）、`incomplete`
+   （调用结束了但没产出——撞输出上限、被中止、回复解析不出来）或 `error`（调用本身
+   抛错）；后两种都消耗了游标且没有写入任何条目。`detail` 是 finish kind、固定标签
+   或 provider 的错误消息，截断到 200 字符——绝不放消息正文，也绝不放模型输出。
+6. `hypatia backfill --status` 报告 shelf 的嵌入债务。用当前的 hypatia，记录一个
    turn 不会增加债务；只有摘要和工作单元在下一次 flush 前处于待处理。`hypatia scope
    list --count` 显示在用的 scope——本项目 `msg-*` 条目所带的那个，就是会话种子读取
    的那个。
-6. 卸载：`dsh plugin --profile web remove dsh-hypatia-auto-memory`——hypatia 条目
+7. 卸载：`dsh plugin --profile web remove dsh-hypatia-auto-memory`——hypatia 条目
    本身留在 `~/.hypatia/`。
 
 ## 故障模式
@@ -308,7 +316,7 @@ rules/taboos 预载、启动清理。设置卡片把它做成 `hypatia list` 所
 | 条目只在 turn 结束后才出现 | 设计如此：span 在 `turn/end` 切分，或当 turn 跑得比 `flushWindowMs` 久时在第一个 `step/end` 切分，所以条目不会缺它自己的工具结果 |
 | 有记录，没摘要 | `consolidation.models` 为空或无效——首次触发时告警一次 |
 | 有摘要但没有 `sum2-*` | 该项目里未归档的 tier-1 摘要还不足 `cascade.batchSize` 条 |
-| 工作单元没有关系 | shelf 没有嵌入模型（`similar` 失败），或所有候选都超过了 `dedupMaxDistance`。自 hypatia #19 起，本地模型在 `~/.hypatia/models/<org>/<name>`（或 Hugging Face 缓存）里找，不再挨着 shelf：一个以前能回答 `similar`、现在说 `is not installed` 的 shelf，需要 `hypatia model install <model>`，或 `hypatia model register <model> <dir>` 指向它已有的文件 |
+| 工作单元没有关系 | shelf 没有嵌入模型（`similar` 失败），所有候选都超过了 `dedupMaxDistance`，或裁决调用本身没有产出裁决——`model_calls` 里表现为 `incomplete` / `max-tokens`，也就是开启了思考的路由把整个输出预算花在推理上、还没开始作答就撞了上限。现在裁决会先确认适配器声明了 `off`，再对该路由请求 `reasoningEffort: 'off'`；对无法接受它的路由则把上限提到 1024。自 hypatia #19 起，本地模型在 `~/.hypatia/models/<org>/<name>`（或 Hugging Face 缓存）里找，不再挨着 shelf：一个以前能回答 `similar`、现在说 `is not installed` 的 shelf，需要 `hypatia model install <model>`，或 `hypatia model register <model> <dir>` 指向它已有的文件 |
 | `similar` 仍返回 `msg-*` 行 | 它们是在本插件让日志层退出嵌入之前写的，或由一个没有 `--no-embed` 的 hypatia 写的。在 shelf 的 `shelf.toml` 里用 `embedding.skip_tags = ["message"]` 加一次 `hypatia backfill` 一次性收回知识向量（比该 key 旧的二进制会拒绝打开 shelf，所以先升级所有共享它的二进制）。不要把 `session` 加进那个列表：`skip_tags` 匹配任何带该 tag 的条目，而人们写的关于会话的知识也带它——在试过的 shelf 上就有一条这样的条目丢了向量。插件自己的 `session-*` 节点很少，现在已逐次写入退出。三元组没有 tags 也没有 update 命令，所以之前写的 `belongTo` / `summary` 边保留向量 |
 | 任务处于 `deferred` 状态 | live store 和 persistence 都没能提供它的会话。不是错误：它不消耗尝试次数，一旦二者之一能提供就运行。通常 storage 立即回答——只有组合里没有 `sessionPersistence`，或它的读取失败（日志里找 `could not be read`）时才会持久化这个状态 |
 | 任务处于 `failed` 状态 | 一次 hypatia 或模型错误在 `maxAttempts` 之后持久化了。失败的 `log-message` 记录在下次启动时被修剪，因为水位会重新推导它们的范围；其它类型保留供检查——删掉一条好让下一个触发器重新创建它 |
@@ -320,6 +328,7 @@ rules/taboos 预载、启动清理。设置卡片把它做成 `hypatia list` 所
 | 手动乱改后出现重复 `msg-*` | 在 hypatia 里删掉该条目，并在 state domain 里把该会话的 `lastLoggedSeq` 调低——回填会重新创建它一次 |
 | Agent 自己的 `hypatia` 写入仍要审批 | `autoApprove: false`（改动需重载 profile）、命令在引号外有管道/重定向/串联、或首词不是 `binaries` 之一——按设计只回答纯调用。读取根本不会走到审批，所以那里没有要修的 |
 | Agent 拿到了一份教它手动记录消息的记忆协议 | 另一个插件先注册了 `hypatia-memory`（profile 里还有 `dsh-hypatia`），或磁盘上有 `hypatia-memory`——通常是 `hypatia skill install --agent codex` 写的 `~/.agents/skills/hypatia-memory`。Agent 预设会在比插件更近的一层加载磁盘技能，所以它在会话里胜出，尽管技能中心可能列出本插件。删掉启动告警指出的那份拷贝 |
+| 不知道实际用了哪个模型 | 设计上就是轮流的：span 摘要、裁决、cascade 共用一个进程内游标，所以相邻调用在 `consolidation.models` 里交替。每次尝试都落在 `~/.dsh/storages/hypatia_auto_memory_diag.json`（`model_calls`），带 purpose、provider/model、outcome 和耗时。usage ledger 答不了这个问题——它只折算 Agent 的 turn（`assistant/message`），看不见插件直连的 `llm.stream`。`pending` 行表示调用仍在进行中，或进程在调用中途死了：记录在调用前先落盘、调用结束后回填 |
 | 启动告警从不出现在终端 | `dsh web` 不挂日志导出器，所以插件任何级别的日志行都没地方去；控制台导出器的默认阈值也会丢掉警告（warn 是 2 级，高于 info 的 1 级）。临时挂一个 logger，如 `dsh-logbook` 或 `dsh-boot-doctor` 来读它们 |
 | 项目 scope 看起来不对 | Scope = 会话 cwd 的 git 顶层目录的 basename（`git rev-parse --show-toplevel`）；git 找不到工作树或答不上（未安装、或某 repo 被判定不安全）时，则是 cwd 本身的 basename。一次慢于 3 秒的 `rev-parse` 会让那个会话留在 cwd 自己的名字上。两个同名 checkout 按设计共享 scope；linked worktree 按它自己的目录而非主 checkout 的目录定 scope；git 会解析符号链接，所以通过一个与目标不同名的链接打开的 checkout 会得到目标的名字。一个会被 hypatia 改写的名字会先归一化：位于 `/` 的会话定 scope 为 `/`，逗号变 `_`，去掉首尾空白。这些修复之前写的条目留在原处：子目录会话写在那个目录名下（`repo/src` 写在 `src` 下——git 根从未被读取）、位于 `/` 的会话无 scope、`a,b` 同时写在 `a` 和 `b` 下、`foo,` 写在 `foo` 和全局下。带空白的名字被去空白存储，这也正是查询现在所请求的。没有任何东西迁移它们；`knowledge-update --scopes` 可移动单条并保留其 `created_at`。`hypatia scope list --count`（hypatia #30）显示每种在用的拼写及其条目数 |
 
@@ -394,6 +403,7 @@ dsh-hypatia-auto-memory/
 │   ├── writer.js         # 幂等 get-before-create 写入
 │   ├── consolidator.js   # 阈值、prompt、llm.stream、校验
 │   ├── cascade.js        # log₁₆(n) 分层摘要归档
+│   ├── model-log.js      # 每次尝试实际用了哪个模型的有界记录
 │   ├── recall.js         # 会话启动时的 rules/taboos 预载
 │   ├── auto-approve.js   # 批准 Agent 自己的纯 bash hypatia 调用
 │   ├── skills.js         # 随包技能注册（从不遮蔽其它提供者）

package/lib/client.js

@@ -108,45 +108,45 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var SettingsCard_module_css_default = {
-			"limitsTitle": "YVNYya_limitsTitle",
-			"modelGroup": "YVNYya_modelGroup",
-			"model": "YVNYya_model",
-			"headText": "YVNYya_headText",
+			"advancedHint": "YVNYya_advancedHint",
+			"body": "YVNYya_body",
 			"card": "YVNYya_card",
-			"readOnly": "YVNYya_readOnly",
 			"cardOpen": "YVNYya_cardOpen",
-			"hint": "YVNYya_hint",
-			"group": "YVNYya_group",
-			"label": "YVNYya_label",
-			"providerName": "YVNYya_providerName",
 			"catalogError": "YVNYya_catalogError",
+			"chevron": "YVNYya_chevron",
 			"chevronOpen": "YVNYya_chevronOpen",
-			"pending": "YVNYya_pending",
-			"unavailable": "YVNYya_unavailable",
-			"input": "YVNYya_input",
-			"reset": "YVNYya_reset",
 			"description": "YVNYya_description",
-			"select": "YVNYya_select",
+			"error": "YVNYya_error",
 			"field": "YVNYya_field",
-			"switchOn": "YVNYya_switchOn",
-			"advancedHint": "YVNYya_advancedHint",
-			"name": "YVNYya_name",
-			"status": "YVNYya_status",
-			"switchThumb": "YVNYya_switchThumb",
-			"route": "YVNYya_route",
-			"models": "YVNYya_models",
+			"fieldHead": "YVNYya_fieldHead",
+			"footer": "YVNYya_footer",
+			"group": "YVNYya_group",
 			"groupTitle": "YVNYya_groupTitle",
-			"error": "YVNYya_error",
+			"headText": "YVNYya_headText",
+			"header": "YVNYya_header",
+			"hint": "YVNYya_hint",
+			"input": "YVNYya_input",
+			"label": "YVNYya_label",
+			"limitsTitle": "YVNYya_limitsTitle",
+			"model": "YVNYya_model",
+			"modelGroup": "YVNYya_modelGroup",
+			"modelName": "YVNYya_modelName",
 			"modelSelection": "YVNYya_modelSelection",
-			"footer": "YVNYya_footer",
+			"models": "YVNYya_models",
+			"name": "YVNYya_name",
+			"notice": "YVNYya_notice",
 			"pairedFields": "YVNYya_pairedFields",
-			"body": "YVNYya_body",
-			"modelName": "YVNYya_modelName",
+			"pending": "YVNYya_pending",
+			"providerName": "YVNYya_providerName",
+			"readOnly": "YVNYya_readOnly",
+			"reset": "YVNYya_reset",
+			"route": "YVNYya_route",
+			"select": "YVNYya_select",
+			"status": "YVNYya_status",
 			"switch": "YVNYya_switch",
-			"chevron": "YVNYya_chevron",
-			"notice": "YVNYya_notice",
-			"header": "YVNYya_header",
-			"fieldHead": "YVNYya_fieldHead",
+			"switchOn": "YVNYya_switchOn",
+			"switchThumb": "YVNYya_switchThumb",
+			"unavailable": "YVNYya_unavailable",
 			"warning": "YVNYya_warning"
 		};
 		//#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-hypatia-auto-memory",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Event-driven Hypatia memory for DSH: automatic conversation logging via session events, queued background consolidation (span summaries + work-unit extraction) with a dedicated model route, and recall injection — zero per-call model work in the main session.",
   "type": "module",
   "main": "src/index.js",

package/src/cascade.js

@@ -22,6 +22,7 @@
 import { createHash } from 'node:crypto'
 
 import { PLUGIN_NAME } from './consolidator.js'
+import { NULL_MODEL_LOG } from './model-log.js'
 
 /** Tag marking the tier an entry belongs to. */
 export function levelTag(level) {
@@ -80,9 +81,10 @@ function archiveInstruction(level, count) {
  *   selectRoute: (routes: any) => any,
  *   getConfig: () => any,
  *   status: import('./status.js').StatusLog,
+ *   modelLog?: ReturnType<import('./model-log.js').createModelLog>,
  * }} deps
  */
-export function createCascade({ cli, llm, selectRoute, getConfig, status }) {
+export function createCascade({ cli, llm, selectRoute, getConfig, status, modelLog = NULL_MODEL_LOG }) {
   /**
    * Ask the model to archive one batch.
    * @returns {Promise<{title: string, summary: string} | undefined>}
@@ -93,8 +95,11 @@ export function createCascade({ cli, llm, selectRoute, getConfig, status }) {
       return `### ${i + 1}. ${row.name}\n${data}`
     }).join('\n\n')
 
+    const attempt = modelLog.begin('memory-cascade', route)
     const controller = new AbortController()
     const timer = setTimeout(() => controller.abort(), timeoutMs)
+    let outcome = 'incomplete'
+    let detail = ''
     try {
       const { createUserMessage, BlockAssembler } = await import('@deepseek-ai/dsh-llm')
       const assembler = new BlockAssembler()
@@ -112,18 +117,38 @@ export function createCascade({ cli, llm, selectRoute, getConfig, status }) {
       })) {
         assembler.push(chunk)
       }
-      if (assembler.finish.kind !== 'stop') return undefined
+      if (assembler.finish.kind !== 'stop') {
+        detail = String(assembler.finish.kind)
+        return undefined
+      }
       const text = assembler.blocks().filter((b) => b.type === 'text').map((b) => b.text).join('\n').trim()
       const fence = /^```(?:json)?\s*([\s\S]*?)```\s*$/.exec(text)
-      const parsed = JSON.parse(fence ? fence[1].trim() : text)
+      // Its own catch: a parse failure is an unusable reply, not a failed call,
+      // and Node's parse error quotes the reply's opening characters.
+      let parsed
+      try {
+        parsed = JSON.parse(fence ? fence[1].trim() : text)
+      } catch {
+        detail = 'unparseable reply'
+        return undefined
+      }
       const summary = typeof parsed?.summary === 'string' ? parsed.summary.trim() : ''
-      if (summary === '') return undefined
+      if (summary === '') {
+        detail = 'no summary'
+        return undefined
+      }
       const title = typeof parsed?.title === 'string' && parsed.title.trim() !== ''
         ? parsed.title.trim()
         : `Archive tier ${level}`
+      outcome = 'ok'
       return { title, summary }
+    } catch (error) {
+      outcome = 'error'
+      detail = error instanceof Error ? error.message : String(error)
+      throw error
     } finally {
       clearTimeout(timer)
+      void attempt.finish(outcome, detail)
     }
   }
 

package/src/consolidator.js

@@ -19,9 +19,32 @@ import { countLoggableMessages, isCompactionReplacement, isLoggableMessage } fro
 import { messageName, summaryName } from './writer.js'
 import { EMPTY_PROGRESS, advanceProgress } from './progress.js'
 import { TaskDeferredError } from './queue.js'
+import { NULL_MODEL_LOG } from './model-log.js'
 
 export const PLUGIN_NAME = 'dsh-hypatia-auto-memory'
 
+/**
+ * Output budget for one adjudication.
+ *
+ * It is not 200 — the value it carried for as long as the call existed — because
+ * a thinking-enabled route spends the SAME cap on its reasoning and its answer.
+ * `deepseek-*` resolves an omitted `reasoningEffort` to `high` (the
+ * `llm-deepseek` profile default) and puts roughly half its output tokens into
+ * reasoning, so a 200-token adjudication ended with `max-tokens` before the
+ * verdict was ever emitted: every other work unit was silently stored with no
+ * relationship at all. `ADJUDICATION_REASONING_EFFORT` below usually removes
+ * the need for the headroom, but a route that cannot honour `off` — or a
+ * provider that ignores the control — still has to fit thinking plus a verdict.
+ */
+export const ADJUDICATION_MAX_TOKENS = 1024
+
+/**
+ * What the adjudication call asks for on a route that advertises it. A verdict
+ * is a six-way classification of two short texts: thinking there spends the
+ * output budget and the latency for nothing.
+ */
+export const ADJUDICATION_REASONING_EFFORT = 'off'
+
 /** Distinguishes permanent failures (no retry value) from transient ones. */
 export class PermanentConsolidationError extends Error {
   constructor(message) {
@@ -263,13 +286,46 @@ export function parseConsolidationOutput(raw, maxWorkUnits) {
  *   writer: ReturnType<import('./writer.js').createWriter>,
  *   getConfig: () => any,
  *   status: import('./status.js').StatusLog,
+ *   modelLog?: ReturnType<import('./model-log.js').createModelLog>,
  *   projectFor: (session: any) => Promise<string>,
  * }} deps
  */
-export function createConsolidator({ queue, progress, sessions, llm, cli, writer, getConfig, status, projectFor }) {
+export function createConsolidator({ queue, progress, sessions, llm, cli, writer, getConfig, status, modelLog = NULL_MODEL_LOG, projectFor }) {
   let warnedNoRoute = false
   const selectRoute = createConsolidationRouteSelector()
 
+  /**
+   * Whether a route may be asked for {@link ADJUDICATION_REASONING_EFFORT},
+   * memoized per route for this instance.
+   *
+   * The core rejects a request whose effort the model does not advertise
+   * (`UNSUPPORTED_REASONING_EFFORT`, `llm`'s `resolveCallWithInfo`), so the
+   * control only follows a positive capability answer. A route that cannot be
+   * inspected — an adapter that throws, or the `llm` double a unit test hands
+   * in — simply gets no effort, which is what every call did before this.
+   * Capability does not change while an instance lives; a profile reload
+   * rebuilds the instance and the cache with it.
+   *
+   * @param {{provider: string, model: string}} route
+   * @param {AbortSignal} signal - the same signal the call carries, so a
+   * lookup cannot outlive the timeout it is part of.
+   */
+  const thinkingOff = new Map()
+  async function canDisableThinking(route, signal) {
+    const key = `${route.provider}\0${route.model}`
+    if (thinkingOff.has(key)) return thinkingOff.get(key)
+    let supported = false
+    try {
+      const info = await llm.resolveModelInfo?.(route.provider, route.model, signal)
+      supported = Array.isArray(info?.reasoning?.efforts)
+        && info.reasoning.efforts.some((effort) => effort?.id === ADJUDICATION_REASONING_EFFORT)
+    } catch (error) {
+      status.warn(`reasoning capability lookup failed for ${key.replace('\0', '/')}: ${String(error)}`)
+    }
+    thinkingOff.set(key, supported)
+    return supported
+  }
+
   /**
    * Turn-end trigger check. The turn threshold is a minimum interval between
    * accepted consolidation tasks, not a polling cadence: once the interval
@@ -388,9 +444,14 @@ export function createConsolidator({ queue, progress, sessions, llm, cli, writer
       listed,
     ].join('\n')
 
+    const attempt = modelLog.begin('memory-adjudication', route)
     const controller = new AbortController()
     const timer = setTimeout(() => controller.abort(), consolidation.timeoutMs)
+    let outcome = 'incomplete'
+    let detail = ''
     try {
+      // Asked for only when the route advertises it; see `canDisableThinking`.
+      const skipThinking = await canDisableThinking(route, controller.signal)
       const { createUserMessage, BlockAssembler } = await import('@deepseek-ai/dsh-llm')
       const assembler = new BlockAssembler()
       for await (const chunk of llm.stream({
@@ -401,20 +462,41 @@ export function createConsolidator({ queue, progress, sessions, llm, cli, writer
           content: [{ type: 'text', text: instruction }],
           source: { kind: 'plugin', plugin: PLUGIN_NAME },
         })],
-        maxTokens: 200,
+        maxTokens: ADJUDICATION_MAX_TOKENS,
+        ...skipThinking ? { reasoningEffort: ADJUDICATION_REASONING_EFFORT } : {},
         purpose: 'memory-adjudication',
         signal: controller.signal,
       })) {
         assembler.push(chunk)
       }
-      if (assembler.finish.kind !== 'stop') return undefined
+      if (assembler.finish.kind !== 'stop') {
+        detail = String(assembler.finish.kind)
+        return undefined
+      }
       const text = assembler.blocks().filter((b) => b.type === 'text').map((b) => b.text).join('\n').trim()
       const fence = /^```(?:json)?\s*([\s\S]*?)```\s*$/.exec(text)
-      const parsed = JSON.parse(fence ? fence[1].trim() : text)
-      if (typeof parsed?.verdict !== 'string') return undefined
+      // Its own catch: a parse failure is an unusable reply, not a failed call,
+      // and Node's parse error quotes the reply's opening characters.
+      let parsed
+      try {
+        parsed = JSON.parse(fence ? fence[1].trim() : text)
+      } catch {
+        detail = 'unparseable reply'
+        return undefined
+      }
+      if (typeof parsed?.verdict !== 'string') {
+        detail = 'no verdict'
+        return undefined
+      }
+      outcome = 'ok'
       return { verdict: parsed.verdict, target: typeof parsed.target === 'string' ? parsed.target : '' }
+    } catch (error) {
+      outcome = 'error'
+      detail = error instanceof Error ? error.message : String(error)
+      throw error
     } finally {
       clearTimeout(timer)
+      void attempt.finish(outcome, detail)
     }
   }
 
@@ -491,44 +573,84 @@ export function createConsolidator({ queue, progress, sessions, llm, cli, writer
     // watermark and the next trigger resumes from exactly there.
     const coveredToSeq = complete ? task.toSeq : lastSeq + 1
 
+    const attempt = modelLog.begin('memory-consolidation', route)
     const controller = new AbortController()
     const timer = setTimeout(() => controller.abort(), consolidation.timeoutMs)
-    let assembled
+    let outcome = 'incomplete'
+    let detail = ''
+    let parsedOutput
     try {
-      const { createUserMessage, BlockAssembler } = await import('@deepseek-ai/dsh-llm')
-      const assembler = new BlockAssembler()
-      const request = createUserMessage({
-        content: [{ type: 'text', text: `${consolidationInstruction(consolidation.maxWorkUnitsPerRun)}\n\n<transcript>\n${transcript}\n</transcript>` }],
-        source: { kind: 'plugin', plugin: PLUGIN_NAME },
-      })
-      for await (const chunk of llm.stream({
-        provider: route.provider,
-        model: route.model,
-        system: 'You produce strict JSON only. You never add prose around it.',
-        messages: [request],
-        maxTokens: consolidation.maxOutputTokens,
-        purpose: 'memory-consolidation',
-        signal: controller.signal,
-      })) {
-        assembler.push(chunk)
+      let assembled
+      try {
+        const { createUserMessage, BlockAssembler } = await import('@deepseek-ai/dsh-llm')
+        const assembler = new BlockAssembler()
+        const request = createUserMessage({
+          content: [{ type: 'text', text: `${consolidationInstruction(consolidation.maxWorkUnitsPerRun)}\n\n<transcript>\n${transcript}\n</transcript>` }],
+          source: { kind: 'plugin', plugin: PLUGIN_NAME },
+        })
+        for await (const chunk of llm.stream({
+          provider: route.provider,
+          model: route.model,
+          system: 'You produce strict JSON only. You never add prose around it.',
+          messages: [request],
+          maxTokens: consolidation.maxOutputTokens,
+          purpose: 'memory-consolidation',
+          signal: controller.signal,
+        })) {
+          assembler.push(chunk)
+        }
+        assembled = assembler
+      } finally {
+        clearTimeout(timer)
       }
-      assembled = assembler
-    } finally {
-      clearTimeout(timer)
-    }
-    const finish = assembled.finish
-    if (finish.kind !== 'stop') {
-      if (finish.kind === 'max-tokens') {
-        throw new PermanentConsolidationError('consolidation hit the output token cap (truncated JSON)')
+      // The attempt stays open through parsing: a stream that ended with `stop`
+      // but yields no usable summary is `incomplete`, not `ok` — the cursor was
+      // consumed, nothing was stored, and a table that said otherwise would
+      // send a reader looking for a summary that does not exist. The throws are
+      // re-issued unchanged, so recording never changes which error the queue
+      // sees.
+      const finish = assembled.finish
+      if (finish.kind !== 'stop') {
+        // The thrown message is computed exactly as it was before this attempt
+        // was recorded: `error` AND `aborted` carry the provider's reason, and
+        // losing it for `aborted` would replace a timeout with a bare
+        // 'aborted' in the task row. `detail` uses the same message; `finish`
+        // caps it.
+        const message = finish.kind === 'error' || finish.kind === 'aborted'
+          ? finish.failure?.message ?? finish.kind
+          : finish.kind
+        if (finish.kind === 'error') outcome = 'error'
+        detail = String(message)
+        throw finish.kind === 'max-tokens'
+          ? new PermanentConsolidationError('consolidation hit the output token cap (truncated JSON)')
+          : new Error(`consolidation model call failed: ${message}`)
+      }
+      const text = assembled.blocks()
+        .filter((block) => block.type === 'text')
+        .map((block) => block.text)
+        .join('\n')
+      try {
+        parsedOutput = parseConsolidationOutput(text, consolidation.maxWorkUnitsPerRun)
+      } catch (parseError) {
+        // A parse failure is an unusable reply, not a failed call, and its
+        // message quotes the reply — so it never becomes `detail`. See the
+        // `detail` contract in model-log.js.
+        detail = 'unusable output'
+        throw parseError
       }
-      const message = finish.kind === 'error' || finish.kind === 'aborted' ? finish.failure?.message ?? finish.kind : finish.kind
-      throw new Error(`consolidation model call failed: ${message}`)
+      outcome = 'ok'
+    } catch (error) {
+      // Only a throw that arrived with nothing classified is a failed call
+      // rather than an unusable reply.
+      if (outcome === 'incomplete' && detail === '') {
+        outcome = 'error'
+        detail = error instanceof Error ? error.message : String(error)
+      }
+      throw error
+    } finally {
+      void attempt.finish(outcome, detail)
     }
-    const text = assembled.blocks()
-      .filter((block) => block.type === 'text')
-      .map((block) => block.text)
-      .join('\n')
-    const { summary, workUnits } = parseConsolidationOutput(text, consolidation.maxWorkUnitsPerRun)
+    const { summary, workUnits } = parsedOutput
 
     const span = summaryName(task.sessionId, fromSeq, coveredToSeq)
     // The entries the log executor actually wrote for this span. Both sides

package/src/index.js

@@ -37,6 +37,7 @@ import { TaskDeferredError, createQueue } from './queue.js'
 import { countLoggableMessages, createCollector, formatSpan } from './collector.js'
 import { createCascade } from './cascade.js'
 import { createConsolidator, PLUGIN_NAME } from './consolidator.js'
+import { openModelLog } from './model-log.js'
 import { createRecall } from './recall.js'
 import { createPersistedSessions } from './persisted-session.js'
 import { createAutoApprove } from './auto-approve.js'
@@ -93,6 +94,20 @@ function applyCollect(ctx, cordisConfig) {
       progress: shelfTable(openedState.progress, shelf),
       tasks: shelfTable(openedState.tasks, shelf),
     }
+    // Which model a background attempt ran on is otherwise unknowable from
+    // outside the process: the cursor that picks it is process-local, the host
+    // logger scrolls away, and the usage ledger cannot see plugin calls. Kept in
+    // its own domain so a diagnostics row can never reject the open of the
+    // watermarks (see model-log.js). Not shelf-scoped: the route list is config,
+    // and the question is about this process, not this shelf.
+    const openedModelLog = await openModelLog(ctx, { status })
+    if (disposed) {
+      // Same race as the state domain above: if the fiber went away while this
+      // was opening, its disposer may never run, so close the handle here.
+      await openedModelLog.domain?.close().catch(() => {})
+      return
+    }
+    const modelLog = openedModelLog.modelLog
     let announcedShelf = shelf
     configHandle.onChange((value) => {
       if (value.shelf === announcedShelf) return
@@ -364,6 +379,7 @@ function applyCollect(ctx, cordisConfig) {
           writer,
           getConfig: configHandle.get,
           status,
+          modelLog,
           projectFor: collector.projectFor,
         })
         queue.registerExecutor('consolidate', consolidator.execute)
@@ -376,6 +392,7 @@ function applyCollect(ctx, cordisConfig) {
           selectRoute: consolidator.selectRoute,
           getConfig: configHandle.get,
           status,
+          modelLog,
         })
         queue.registerExecutor('cascade', cascade.execute)
         shared.consolidator = consolidator

package/src/model-log.js

@@ -0,0 +1,246 @@
+/**
+ * Durable, bounded record of the model attempts the background pipeline makes.
+ *
+ * Why this exists. The route one consolidation attempt runs on is chosen by a
+ * process-local round-robin cursor (`createConsolidationRouteSelector`) and,
+ * before this, was dropped the moment the call was made. "Which model actually
+ * summarised that span?" was then unanswerable from outside the process: the
+ * settings card shows the configured route LIST, the host logger goes to a
+ * terminal that scrolls away, and the usage ledger only folds agent turns — it
+ * cannot see a plugin's direct `llm.stream` call at all (see
+ * `@linxin666/dsh-usage` `usage-service.ts`, which folds `assistant/message`).
+ *
+ * The record is written at SELECTION time and updated when the attempt settles,
+ * so a row left at `pending` is itself evidence: the process died, or the
+ * attempt is still in flight. That distinguishes the three states the cursor
+ * alone cannot — selected, completed, and consumed-but-produced-nothing.
+ *
+ * It lives in its OWN storage domain rather than in the one holding watermarks
+ * and queued tasks. In that domain a record failing its schema rejects the whole
+ * open and silently disables the plugin (see the note on `taskTable` in
+ * state.js); diagnostics must never be able to take the authoritative data down
+ * with them. Here the blast radius is one bounded table nobody's correctness
+ * depends on. `openModelLog` therefore degrades to a logger-only log when the
+ * domain will not open, and callers keep working.
+ *
+ * @module dsh-hypatia-auto-memory/model-log
+ */
+
+import { defineDomain, domainTable } from '@deepseek-ai/dsh-storage-domain'
+import { z } from 'zod'
+
+/** How many attempts to keep. A ring large enough to answer "the last run(s)". */
+export const MODEL_CALL_LIMIT = 100
+
+/**
+ * One model attempt. `outcome` is the state that matters:
+ *
+ * - `pending`  — selected, not settled (in flight, or the process died).
+ * - `ok`       — the call settled AND produced a usable result.
+ * - `incomplete` — settled without one: output cap, abort, refusal, a reply
+ *   that did not parse, or one that parsed into nothing usable. The cursor WAS
+ *   consumed and nothing was stored. This is a deliberate catch-all: from
+ *   outside, every one of those looks the same, and a caller that reported `ok`
+ *   for a stop that yielded no summary would make the table lie.
+ * - `error`    — the call itself threw (provider/transport failure).
+ *
+ * `detail` carries a finish kind, a fixed label, or a provider error message —
+ * never message content and never model output. The plugin's whole log path is
+ * built to keep conversation text out of places a later reader can stumble
+ * into, and a `JSON.parse` failure is exactly where that leaks by accident:
+ * Node quotes the offending input in the message (`Unexpected token 'H', "Here
+ * is th"...`). Parse sites therefore record a fixed label, and `finish` caps
+ * whatever it is handed, because a provider `failure.message` can carry a whole
+ * HTTP body.
+ */
+export const modelCallTable = domainTable(z.object({
+  /** Monotonic within the process; recovered from the stored rows on open. */
+  seq: z.number().step(1).min(1),
+  /** Epoch milliseconds at selection. */
+  at: z.number().default(0),
+  /** The `purpose` the call was made with ('memory-consolidation', …). */
+  purpose: z.string().default(''),
+  provider: z.string().default(''),
+  model: z.string().default(''),
+  outcome: z.string().default('pending'),
+  /** Wall time from selection to settle; 0 while pending. */
+  ms: z.number().min(0).default(0),
+  detail: z.string().default(''),
+}))
+
+/** Upper bound on `detail`; see the table doc. Applied on every write. */
+export const DETAIL_MAX = 200
+
+/**
+ * Diagnostics domain. Separate from `hypatia_auto_memory` on purpose (module
+ * doc); its own version line, so the authoritative domain's format never has to
+ * move for a table only a human reads.
+ */
+export const diagnosticsSpec = defineDomain({
+  name: 'hypatia_auto_memory_diag',
+  version: 1,
+  // Table names must match /^[a-z][a-z0-9_]*$/ — the module-load guard rejects
+  // camelCase before any medium is touched.
+  tables: { model_calls: modelCallTable },
+})
+
+/**
+ * Fixed-width key so lexicographic order equals sequence order. A bare numeric
+ * key would be re-ordered by the JSON object it is stored in (integer-like keys
+ * sort first, numerically), which is why ordering is carried by the padded key
+ * AND by the `seq` field the reader sorts on.
+ * @param {number} seq
+ */
+function keyOf(seq) {
+  return String(seq).padStart(12, '0')
+}
+
+/**
+ * The log a caller gets when none was injected (unit tests, a composition
+ * without storage). Call sites default to it, so none of them branches on
+ * observability being available.
+ */
+export const NULL_MODEL_LOG = Object.freeze({
+  begin: () => ({ finish: async () => {} }),
+  recent: () => [],
+})
+
+/**
+ * @param {{
+ *   table?: any,
+ *   status: import('./status.js').StatusLog,
+ *   limit?: number,
+ *   now?: () => number,
+ * }} deps - `table` absent (or the domain failed to open) means: log lines
+ * still happen, nothing is stored, and no caller has to branch.
+ */
+export function createModelLog({ table, status, limit = MODEL_CALL_LIMIT, now = Date.now }) {
+  let counter = 0
+  if (table !== undefined) {
+    // Every stored row passed the schema at open, so `seq` is always the number
+    // the padded key was derived from.
+    for (const [, row] of table.entries()) {
+      if (row.seq > counter) counter = row.seq
+    }
+  }
+
+  function onWriteError(error) {
+    status.warn(`model-call log write failed: ${String(error)}`)
+  }
+
+  /** Keep the newest `limit` rows; drop the rest oldest-first. */
+  async function prune() {
+    while (table.size > limit) {
+      let oldest
+      for (const [key, row] of table.entries()) {
+        if (oldest === undefined || row.seq < oldest.row.seq) oldest = { key, row }
+      }
+      if (oldest === undefined) return
+      await table.delete(oldest.key)
+    }
+  }
+
+  async function write(key, record) {
+    try {
+      await table.put(key, record)
+      await prune()
+    } catch (error) {
+      onWriteError(error)
+    }
+  }
+
+  /**
+   * Record one attempt as it is selected, before the call is made.
+   *
+   * @param {string} purpose - The same string handed to `llm.stream`.
+   * @param {{provider: string, model: string}} route
+   * @returns {{seq: number, finish: (outcome: string, detail?: string) => Promise<void>}}
+   */
+  function begin(purpose, route) {
+    counter += 1
+    const seq = counter
+    const at = now()
+    const key = keyOf(seq)
+    const record = {
+      seq,
+      at,
+      purpose,
+      provider: String(route?.provider ?? ''),
+      model: String(route?.model ?? ''),
+      outcome: 'pending',
+      ms: 0,
+      detail: '',
+    }
+    // Durable before the call runs, so an attempt that never settles still
+    // leaves a row. Awaited by `finish`, never by the caller.
+    const stored = table === undefined ? Promise.resolve() : write(key, record)
+    return {
+      seq,
+      async finish(outcome, detail = '') {
+        // Never rejects, and callers do not await it: every one of them calls
+        // this from a `finally`, where a throw here would replace the error the
+        // queue was going to see, and a storage stall would hold the queue task
+        // open after its own timeout has already been cleared.
+        try {
+          await stored
+          const ms = Math.max(0, now() - at)
+          const bounded = String(detail).slice(0, DETAIL_MAX)
+          if (table !== undefined) {
+            await write(key, { ...record, outcome, ms, detail: bounded })
+          }
+          const suffix = bounded === '' ? '' : ` (${bounded})`
+          status.info(`model call: ${purpose} ${record.provider}/${record.model} ${outcome} ${ms}ms${suffix}`)
+        } catch (error) {
+          onWriteError(error)
+        }
+      },
+    }
+  }
+
+  /** Newest-first snapshot, for a human reading the state file or a card. */
+  function recent(count = 20) {
+    if (table === undefined) return []
+    return [...table.entries()]
+      .map(([, row]) => row)
+      .sort((a, b) => Number(b?.seq) - Number(a?.seq))
+      .slice(0, count)
+  }
+
+  return { begin, recent }
+}
+
+/**
+ * Open the diagnostics domain and build the log. Never throws: a domain that
+ * will not open costs the stored history, not the memory pipeline.
+ *
+ * @param {import('@deepseek-ai/cordis').Context} ctx - context injecting `storageDomain`.
+ * @param {{status: import('./status.js').StatusLog, limit?: number, now?: () => number}} deps
+ * @returns {Promise<{modelLog: ReturnType<typeof createModelLog>, domain?: any}>}
+ * `domain` is the open handle when there is one, so a caller that finds itself
+ * disposed can close it (mirrors `openState`).
+ */
+export async function openModelLog(ctx, { status, limit, now }) {
+  let domain
+  try {
+    domain = await ctx.storageDomain.open(diagnosticsSpec)
+  } catch (error) {
+    status.warn(`model-call log unavailable, attempts will only be logged: ${String(error)}`)
+    return { modelLog: createModelLog({ status, limit, now }) }
+  }
+  try {
+    ctx.effect(() => () => {
+      void domain.close().catch(() => {
+        // Closing during teardown must never take the fiber down.
+      })
+    }, 'hypatia-auto-memory: close diagnostics domain')
+  } catch {
+    // The fiber went away while the domain was opening, so no disposer will
+    // ever run for it — closing here is the only thing that prevents a leak.
+    // Deliberately silent: the plugin is being torn down, and a warning about
+    // an unavailable log would be noise at exactly the moment nothing can act
+    // on it.
+    await domain.close().catch(() => {})
+    return { modelLog: createModelLog({ status, limit, now }) }
+  }
+  return { modelLog: createModelLog({ table: domain.table('model_calls'), status, limit, now }), domain }
+}