dsh-hypatia-auto-memory 1.0.0 → 1.1.0

package/README.md

@@ -33,6 +33,17 @@ additions are used when the binary has them and skipped when it does not:
 The first call logs which the binary offers
 (`hypatia over mcp: no-embed yes, similar filters yes`).
 
+The plugin also needs **dsh ≥ 0.1.7**, and dsh enforces that itself rather than
+this README: the package declares
+`peerDependencies["@deepseek-ai/dsh"]: ">=0.1.7-rc.1"` (the same range also
+sits under `dsh.engines.dsh` for display), and dsh checks every
+`@deepseek-ai/dsh*` peer against the running version when a bundle is installed
+and again at startup — an older runtime refuses the install instead of loading a
+plugin built for API it does not have, and `dsh plugin allow-version` grants an
+exact-version exemption when the risk is accepted deliberately. The peer is
+marked optional in `peerDependenciesMeta` so that neither npm nor a profile
+installation pulls the runtime in as a dependency: the launcher supplies it.
+
 ```bash
 # from a local checkout (development)
 dsh plugin --profile web add link:/path/to/dsh-hypatia-auto-memory
@@ -85,8 +96,11 @@ session/event (emit)
   │                 └─ cascade      ──▶ $not-summaried ──▶ sum<N>-* (summary N)
   └─ session/title | compaction/summary ──▶ session-node ──▶ session-<sid> + belongTo
 session/disposed ──▶ final flush + consolidation, thresholds waived (a session
-                     closed while DSH keeps running; a restart is covered by the
-                     startup consolidation backfill instead)
+                     closed while DSH keeps running)
+collect fiber dispose ──▶ the same flush for every session still open, persisted
+                     before the queue stops; the model call finishes at the next start
+                     (a restart, a config-change restart, or a crash: the startup
+                     consolidation backfill)
 agent/session-start ──▶ rules/taboos inject()
 ```
 
@@ -178,6 +192,19 @@ agent/session-start ──▶ rules/taboos inject()
   and advances the watermark only that far, so the remainder is not silently
   marked done.
 
+  The extraction call asks for **no reasoning** on a route that advertises it.
+  Extraction is a mechanical transform into a fixed JSON shape, and on a
+  thinking route the reasoning is charged to the SAME `maxOutputTokens` as the
+  answer: measured live, a `deepseek-flash` route resolving to `high` spent
+  ~800–1400 of a 2000-token cap thinking and hit `max-tokens` with the JSON half
+  written (9.3 s, against 25 s for a completed run of the same kind on that
+  route). Where a route cannot be asked — or a provider ignores the control —
+  the budget carries a fixed thinking allowance instead, and a truncation is
+  **retried** rather than declared permanent: the retry asks for one work unit
+  instead of `maxWorkUnitsPerRun`, because the units are what make the reply
+  long. Cascade is the exception: it keeps thinking (it is compressing sixteen
+  summaries, not filling a shape) and pays for it in the same allowance.
+
 - **Cascade** archives sixteen unarchived tier-N summaries into one tier-(N+1)
   entry, using hypatia's own `$not-summaried` (which anti-joins on
   `statement.tail` and orders `created_at ASC`, giving FIFO batching for free).
@@ -200,22 +227,39 @@ agent/session-start ──▶ rules/taboos inject()
   re-log and a re-consolidation, so both passes act only on positive evidence:
   a failed shelf query or an empty session listing changes nothing.
 
-  A third pass consolidates what a restart interrupted. The session-end trigger
-  does not survive one: DSH runs its close path at shutdown (it appends
-  `session/end-seed`), but nothing queued there becomes durable before the
-  process is gone — measured on a live restart, the storage file was not written
-  and the session came back with `lastConsolidatedSeq: 0`. So a row whose logged
-  tail was never consolidated is queued at the next startup, gated by the same
-  `consolidation.minNewTokens` floor and read from the row rather than by
-  loading the session. Without that gate every restart would spend one model
-  call per session carrying any tail at all.
+  A third pass consolidates what a shutdown could only persist, and what a crash
+  or `kill -9` left behind. Nothing a closing session owes survives on its own:
+  `session/disposed` observers are fire-and-forget in DSH, the collect fiber is
+  torn down before the session store releases its sessions, and the queue dies
+  with the fiber — so an `enqueue` there was a silent no-op and a whole run's
+  tails were dropped. Two things fix that. The collect fiber's disposer now
+  **persists** both ranges for every session still open (registering the sweep
+  after the queue's own disposer, because cordis disposes a fiber's effects in
+  reverse order, so it runs while the queue can still write), and this pass
+  finishes the work at the next start. Only the final log write is waited for at
+  shutdown: a hypatia write is milliseconds, while the model call it may trigger
+  is measured in tens of seconds and could never fit inside DSH's 5 s shutdown
+  budget.
+
+  This pass deliberately ignores the `consolidation.minNewTokens` floor that
+  paces the live trigger. The floor is right while a conversation is running —
+  there is always a later turn — but at boot there is no later turn, and a tail
+  skipped here is skipped for good: measured on a live shelf, fifteen sessions
+  carried 1–1950 pending tokens, not one of them was ever consolidated, and
+  eight of nine sessions had messages with `lastConsolidatedSeq: 0`. Cost is
+  bounded by `housekeeping.consolidationBackfillPerScope` instead — at most that
+  many sessions **per project scope** per start, the largest tails first, so a
+  backlog drains over several starts rather than in one unbounded burst of model
+  calls. A range whose consolidate record is `failed` is taken first whatever its
+  size: `resumeKind` never re-schedules a failed row, and re-enqueueing it is the
+  only path back.
 
   Those tasks then read their events from **storage**, not only from the live
   store. `session/created` — the signal that wakes a deferred task — fires only
   where an agent actually runs, so a finished session may never emit it again,
   and a subagent session (which the sidebar does not even list) almost certainly
   will not: one sat `deferred` across a restart and stayed deferred while its
-  transcript was open on screen. `sessionPersistence.load()` returns the same
+  transcript was open on screen. `sessionPersistence.open(id, 'read')` returns the same
   log without publishing anything, and the executors use only `snapshotEvents`,
   `inheritedEventCount`, `seq` and `header`, so a tail nothing will reopen still
   becomes knowledge. A composition without `sessionPersistence` behaves as
@@ -304,9 +348,13 @@ agent/session-start ──▶ rules/taboos inject()
 
 ## Configuration
 
-The plugin's cordis `Config` is its settings tab (dsh ≥ 0.1.7 projects a
-plugin's Config schema into Settings → Plugins; every field below applies on
-save, without a profile reload). Stored as the plugin entry's `config:` in the
+The plugin's cordis `Config` is its configuration form. dsh ≥ 0.1.7 projects a
+plugin's Config schema onto the sidebar's **Plugins** page, and the card renders
+on this bundle's own page there; a deployment whose profile renders no Plugins
+page gets the same card as a tab under **Settings → Built-in plugins**. The card
+takes whichever seat exists and moves between them without ever appearing twice
+(`src/client/plugin-card-seat.ts`). Every field below applies on
+save, without a profile reload. Stored as the plugin entry's `config:` in the
 profile patch; a pre-0.1.7 `settings.yaml` section is imported once on first
 launch. All fields optional, defaults shown. A blank consolidation route is
 refused on save; a duplicate one is dropped at runtime with a warning:
@@ -353,6 +401,7 @@ hypatia-auto-memory:
     reconcileOnStartup: true     # reset rows whose session has no msg-* left in the shelf
     pruneVanishedSessions: true  # drop rows and tasks of sessions DSH no longer has
     backfillConsolidation: true  # consolidate a logged tail the in-session trigger never reached
+    consolidationBackfillPerScope: 4  # sessions that pass may queue per scope, per start
 ```
 
 The cordis config block on the bundle row only carries skill packaging:
@@ -453,7 +502,7 @@ now only projects plugin Config forms.)
 | Summaries but no `sum2-*` | Fewer than `cascade.batchSize` unarchived tier-1 summaries in that project yet |
 | Work units have no relationships | No embedding model on the shelf (`similar` fails), every candidate was beyond `dedupMaxDistance`, or the adjudication call itself produced no verdict — `model_calls` shows that as `incomplete` / `max-tokens`, which is what a thinking-enabled route does when it spends the whole output budget on reasoning before answering. The call now asks a route for `reasoningEffort: 'off'` once the adapter advertises it, and carries a 1024-token cap for routes that cannot honour it. Since hypatia #19 the local model is looked up in `~/.hypatia/models/<org>/<name>` (or the Hugging Face cache), no longer beside the shelf: a shelf that used to answer `similar` and now says `is not installed` needs `hypatia model install <model>`, or `hypatia model register <model> <dir>` pointing at the files it already has |
 | `similar` still returns `msg-*` rows | They were written before this plugin opted the log layer out of embedding, or by a hypatia without `--no-embed`. Retract the knowledge vectors once with `embedding.skip_tags = ["message"]` in the shelf's `shelf.toml` followed by `hypatia backfill` (a binary older than the key refuses to open the shelf, so upgrade every binary sharing it first). Do not add `session` to that list: `skip_tags` matches any entry carrying the tag, and knowledge people write about sessions carries it too — one such entry lost its vector on the shelf this was tried on. The plugin's own `session-*` nodes are few and now opt out per write. Statements have no tags and no update command, so `belongTo` / `summary` edges written before keep their vectors |
-| Task in `deferred` state | Neither the live store nor persistence could supply its session. Not an error: it spends no attempts and runs as soon as one of them can. Normally storage answers immediately — the state persists only when `sessionPersistence` is absent from the composition, or its read failed (look for `could not be read` in the log) |
+| Task in `deferred` state | Neither the live store nor persistence could supply its session. Not an error: it spends no attempts and runs as soon as one of them can. Normally storage answers immediately — the state persists only when `sessionPersistence` is absent from the composition, or its read failed (look for `could not be read` in the log). A deferred consolidation is re-queued by the next startup's backfill, so it does not wait for its session to be opened again |
 | Task in `failed` state | A hypatia or model error persisted after `maxAttempts`. Failed `log-message` records are pruned at the next startup, since the watermark re-derives their range; other kinds are kept for inspection — delete one to let the next trigger re-create it |
 | Watermark says logged, but the shelf has no entries | The shelf was reset or switched after logging. Handled at startup: `housekeeping.reconcileOnStartup` resets any row whose session has no `msg-*` left, and that session is re-logged — and re-consolidated — from the start on its next activity. A shelf query that fails leaves the row untouched. A session whose messages were all deleted on purpose is indistinguishable and is logged again; turn the switch off if that matters |
 | Warning `hypatia mcp unavailable: …; using the hypatia CLI until the profile reloads` | The binary predates `hypatia mcp` (the message quotes its `unrecognized subcommand`), lacks a tool the plugin calls, or answered the handshake with an error. Everything keeps working over the CLI; upgrade hypatia and reload the profile to use MCP |
@@ -572,7 +621,8 @@ dsh-hypatia-auto-memory/
 │       ├── SettingsCard.tsx
 │       ├── MemoryView.tsx     # the Memory tab body
 │       ├── memory-client.ts   # its fetch + merge rules (pure)
-│       ├── shelves.ts    # shelf dropdown choices from the inventory namespace
+│       ├── plugin-card-seat.ts # card seat: official Plugins page, else Settings tab
+│       ├── shelves.ts    # shelf dropdown choices (listing from the /shelves route)
 │       └── slot-contract.ts
 ├── lib/
 │   └── client.js         # built browser factory (commit this)

package/README.zh-CN.md

@@ -28,6 +28,14 @@
 检索。首次调用会记录二进制提供了哪些（`hypatia over mcp: no-embed yes, similar
 filters yes`）。
 
+本插件还需要 **dsh ≥ 0.1.7**，而且这个下限由 dsh 自己强制执行，不靠本 README：
+包里声明了 `peerDependencies["@deepseek-ai/dsh"]: ">=0.1.7-rc.1"`（同样的范围也写在
+`dsh.engines.dsh` 里，供展示），dsh 在安装 bundle 时、以及每次启动时，会把每个
+`@deepseek-ai/dsh*` peer 与自身版本比对——运行时太旧会直接拒绝安装，而不是加载一个
+面向它并不具备的 API 写成的插件；确实要接受风险时，用 `dsh plugin allow-version`
+授予精确版本豁免。该 peer 在 `peerDependenciesMeta` 里标为 optional，这样 npm 和
+profile 安装都不会把运行时本身拉成依赖：运行时由 launcher 提供。
+
 ```bash
 # 从本地 checkout 安装（开发）
 dsh plugin --profile web add link:/path/to/dsh-hypatia-auto-memory
@@ -75,7 +83,10 @@ session/event (emit)
   │                 └─ cascade      ──▶ $not-summaried ──▶ sum<N>-* (summary N)
   └─ session/title | compaction/summary ──▶ session-node ──▶ session-<sid> + belongTo
 session/disposed ──▶ final flush + consolidation, thresholds waived (DSH 仍在运行时
-                     关闭的会话；进程重启则由启动时的 consolidation backfill 覆盖)
+                     关闭的会话)
+collect fiber 拆除 ──▶ 对每个仍打开的会话做同样的收尾，并在队列停止前落盘；模型
+                     调用留到下次启动完成（重启、配置变更重启，或崩溃：启动时的
+                     consolidation backfill）
 agent/session-start ──▶ rules/taboos inject()
 ```
 
@@ -143,6 +154,15 @@ agent/session-start ──▶ rules/taboos inject()
   脱敏并绝对化日期，超预算的 span 只巩固其**最旧**的条目，水位也只推进到那里，剩下
   的不会被打成已完成。
 
+  抽取调用在**声明支持的路由上关闭推理**。抽取是朝固定 JSON 形状的机械变换，而在开启
+  thinking 的路由上，推理与答案**共享同一个 `maxOutputTokens`**：实测中一条解析为
+  `high` 的 `deepseek-flash` 路由在 2000 的预算里花掉约 800–1400 思考，然后带着写到
+  一半的 JSON 撞上 `max-tokens`（9.3s，而同一条路由上同类成功调用要 25s）。路由无法
+  被要求关闭（或 provider 忽略该控制）时，预算改为携带固定的思考余量；而**截断不再
+  算永久失败**，而是重试——重试时只要 1 个工作单元而不是 `maxWorkUnitsPerRun`，因为
+  正是工作单元让回复变长。Cascade 是例外：它保留 thinking（它是在压缩十六条摘要，不是
+  在填一个形状），并用同一份余量来支付。
+
 - **Cascade** 把十六个未归档的 tier-N 摘要归档为一条 tier-(N+1) 条目，用 hypatia 自带
   的 `$not-summaried`（它对 `statement.tail` 做反连接并按 `created_at ASC` 排序，
   免费得到 FIFO 分批）。这就是协议的 log₁₆(n) 归档：每一层只压缩上一层已经蒸馏过的
@@ -160,17 +180,28 @@ agent/session-start ──▶ rules/taboos inject()
   DSH 已不存在的会话的行和任务。重置的代价是一次重新记录和一次重新巩固，所以两遍
   都只在有正面证据时才行动：shelf 查询失败或空的会话列表都不做任何改动。
 
-  第三遍巩固那些被重启打断的内容。session-end 触发器活不过重启：DSH 在关闭时跑它的
-  关闭路径（追加 `session/end-seed`），但那里排入的任何东西在进程消失前都来不及
-  持久化——实测在一次真实重启中，storage 文件根本没写，会话回来时
-  `lastConsolidatedSeq: 0`。所以一个有已记录但从未巩固的尾部的行，会在下次启动时被
-  排入队列，受同样的 `consolidation.minNewTokens` 下限约束，并且从行里读取而不是
-  加载会话。没有这道门槛，每次重启都会为每个带尾部的会话花一次模型调用。
+  第三遍巩固那些关闭时只能落盘、以及崩溃或 `kill -9` 完全没留下的内容。关闭中的会话
+  所欠的东西本身活不下来：DSH 里 `session/disposed` 的观察者是 fire-and-forget，
+  collect fiber 先于 session store 释放会话就被拆除，而队列随 fiber 一起消失——所以在
+  那里 `enqueue` 是一次静默的空操作，一整轮的尾巴就这么丢了。两件事修好了它：collect
+  fiber 的 disposer 现在会为每个仍打开的会话**落盘**两段范围（把收尾 effect 注册在队列
+  自己的 disposer **之后**，因为 cordis 按注册逆序拆除 fiber 的 effects，于是它跑的时候
+  队列还能写），而这一遍在下一次启动把活干完。关闭时只等最后的日志写入：一次 hypatia
+  写入是毫秒级，而它可能触发的模型调用是几十秒，永远塞不进 DSH 5s 的关机预算。
+
+  这一遍**刻意不看**节流实时触发器的 `consolidation.minNewTokens` 下限。对话还在进行时
+  下限是对的——总还有下一轮——但启动时没有下一轮，在这里被跳过的尾部就是永久跳过：
+  实测一个 live shelf 上 15 个会话带着 1–1950 的 pending token，没有一个被巩固过，9 个
+  有消息的会话里 8 个 `lastConsolidatedSeq: 0`。成本改由
+  `housekeeping.consolidationBackfillPerScope` 封顶——每次启动**每个 project scope**
+  最多这么多个会话，尾巴最大的优先，于是积压分几次启动消化，而不是一次爆出无界的模型
+  调用。consolidate 记录处于 `failed` 的范围无论多小都优先：`resumeKind` 不会重排
+  failed 行，重新入队是它唯一的回头路。
 
   这些任务随后从 **storage** 读取事件，而不只是从活 store。`session/created`——唤醒
   被延迟任务的信号——只在 Agent 实际运行的地方触发，所以一个已结束的会话可能再也不
   会发它，而 subagent 会话（侧栏甚至不列出）几乎肯定不会：有一个就曾跨重启停留在
-  `deferred` 状态，尽管它的 transcript 正开在屏幕上。`sessionPersistence.load()`
+  `deferred` 状态，尽管它的 transcript 正开在屏幕上。`sessionPersistence.open(id, 'read')`
   返回同样的日志而不发布任何东西，执行器只用 `snapshotEvents`、
   `inheritedEventCount`、`seq` 和 `header`，所以一个不会再被重新打开的尾部仍能变成
   知识。没有 `sessionPersistence` 的组合行为照旧：任务等待。
@@ -235,8 +266,11 @@ agent/session-start ──▶ rules/taboos inject()
 
 ## 配置
 
-插件的 cordis `Config` 就是它的设置页（dsh ≥ 0.1.7 把插件的 Config schema 投影到
-「设置 → 插件」；下面每个字段保存即生效，无需重载 profile）。配置以插件条目 `config:`
+插件的 cordis `Config` 就是它的配置表单。dsh ≥ 0.1.7 把插件的 Config schema 投影到
+侧边栏的**「插件」页**，卡片渲染在该 bundle 自己的页面上；如果某个部署的 profile
+不渲染这个页面，同一张卡片会退到**「设置 → 内置插件」**里作为一个标签页。卡片落在
+存在的那个位置上，并在两者之间迁移时绝不会同时出现（`src/client/plugin-card-seat.ts`）。
+下面每个字段保存即生效，无需重载 profile。配置以插件条目 `config:`
 的形式存进 profile patch；0.1.7 之前的 `settings.yaml` 段落会在首次启动时被一次性导入。
 所有字段可选，展示的是默认值。空白的巩固路由在保存时就被拒绝；重复的路由在运行时被丢弃
 并记一条警告：
@@ -283,6 +317,7 @@ hypatia-auto-memory:
     reconcileOnStartup: true     # 重置 session 在 shelf 里已无 msg-* 的行
     pruneVanishedSessions: true  # 删除 DSH 已不存在的会话的行和任务
     backfillConsolidation: true  # 巩固会话内触发器从未到达的已记录尾部
+    consolidationBackfillPerScope: 4  # 每次启动每个 scope 允许排入的会话数
 ```
 
 bundle 行上的 cordis config 块只承载技能打包：
@@ -364,7 +399,7 @@ shelf 清单本来就不是配置，而设置域现在只投影插件的 Config
 | 有摘要但没有 `sum2-*` | 该项目里未归档的 tier-1 摘要还不足 `cascade.batchSize` 条 |
 | 工作单元没有关系 | shelf 没有嵌入模型（`similar` 失败），所有候选都超过了 `dedupMaxDistance`，或裁决调用本身没有产出裁决——`model_calls` 里表现为 `incomplete` / `max-tokens`，也就是开启了思考的路由把整个输出预算花在推理上、还没开始作答就撞了上限。现在裁决会先确认适配器声明了 `off`，再对该路由请求 `reasoningEffort: 'off'`；对无法接受它的路由则把上限提到 1024。自 hypatia #19 起，本地模型在 `~/.hypatia/models/<org>/<name>`（或 Hugging Face 缓存）里找，不再挨着 shelf：一个以前能回答 `similar`、现在说 `is not installed` 的 shelf，需要 `hypatia model install <model>`，或 `hypatia model register <model> <dir>` 指向它已有的文件 |
 | `similar` 仍返回 `msg-*` 行 | 它们是在本插件让日志层退出嵌入之前写的，或由一个没有 `--no-embed` 的 hypatia 写的。在 shelf 的 `shelf.toml` 里用 `embedding.skip_tags = ["message"]` 加一次 `hypatia backfill` 一次性收回知识向量（比该 key 旧的二进制会拒绝打开 shelf，所以先升级所有共享它的二进制）。不要把 `session` 加进那个列表：`skip_tags` 匹配任何带该 tag 的条目，而人们写的关于会话的知识也带它——在试过的 shelf 上就有一条这样的条目丢了向量。插件自己的 `session-*` 节点很少，现在已逐次写入退出。三元组没有 tags 也没有 update 命令，所以之前写的 `belongTo` / `summary` 边保留向量 |
-| 任务处于 `deferred` 状态 | live store 和 persistence 都没能提供它的会话。不是错误：它不消耗尝试次数，一旦二者之一能提供就运行。通常 storage 立即回答——只有组合里没有 `sessionPersistence`，或它的读取失败（日志里找 `could not be read`）时才会持久化这个状态 |
+| 任务处于 `deferred` 状态 | live store 和 persistence 都没能提供它的会话。不是错误：它不消耗尝试次数，一旦二者之一能提供就运行。通常 storage 立即回答——只有组合里没有 `sessionPersistence`，或它的读取失败（日志里找 `could not be read`）时才会持久化这个状态。被 deferred 的巩固任务会在下次启动时被 backfill 重新入队，所以它不必等会话被重新打开 |
 | 任务处于 `failed` 状态 | 一次 hypatia 或模型错误在 `maxAttempts` 之后持久化了。失败的 `log-message` 记录在下次启动时被修剪，因为水位会重新推导它们的范围；其它类型保留供检查——删掉一条好让下一个触发器重新创建它 |
 | 水位说已记录，但 shelf 里没条目 | shelf 在记录后被重置或切换。启动时处理：`housekeeping.reconcileOnStartup` 重置任何 session 已无 `msg-*` 的行，该会话下次活跃时从头重新记录——并重新巩固。shelf 查询失败则不动该行。一个所有消息都被故意删除的会话无法区分，会被重新记录；如果这要紧，关掉这个开关 |
 | 警告 `hypatia mcp unavailable: …; using the hypatia CLI until the profile reloads` | 二进制早于 `hypatia mcp`（消息会引用它的 `unrecognized subcommand`）、缺本插件调用的某工具、或握手返回错误。一切继续走 CLI；升级 hypatia 并重载 profile 以使用 MCP |
@@ -461,6 +496,7 @@ dsh-hypatia-auto-memory/
 │       ├── SettingsCard.tsx
 │       ├── MemoryView.tsx     # 记忆标签页主体
 │       ├── memory-client.ts   # 它的请求与合并规则（纯函数）
+│       ├── plugin-card-seat.ts # 卡片落座：官方「插件」页，否则设置标签页
 │       ├── shelves.ts    # shelf 下拉选项（清单来自 /shelves 路由）
 │       └── slot-contract.ts
 ├── lib/

package/cordis.patch.yml

@@ -3,8 +3,10 @@
 #   dsh plugin --profile <name> add dsh-hypatia-auto-memory          (registry)
 #   dsh plugin --profile <name> add link:/path/to/dsh-hypatia-auto-memory
 #
-# Behavior is configured through this entry's `config:` (edited live in
-# Settings → Plugins; dsh ≥ 0.1.7 projects the plugin's Config schema there).
+# Behavior is configured through this entry's `config:` (edited live on the
+# bundle's own page of the sidebar's Plugins page, which dsh ≥ 0.1.7 projects
+# the plugin's Config schema onto; a deployment that renders no Plugins page
+# gets the same card under Settings → Built-in plugins).
 # The cordis-level knobs below are the non-volatile ones — changing them
 # remounts the plugin:
 #

package/lib/client.js

@@ -307,7 +307,8 @@ window.__ModuleLoader__.load({
 		//#endregion
 		//#region src/client/SettingsCard.tsx
 		/**
-		* Settings card for the `hypatia-auto-memory` namespace.
+		* Configuration card for the `hypatia-auto-memory` namespace, rendered on
+		* whichever seat the harness offers (see `plugin-card-seat.ts`).
 		*
 		* The card owns its disclosure state and stages edits until Save. Its visual
 		* treatment mirrors the DSH plugin-settings cards while remaining bundle-local.
@@ -1678,7 +1679,123 @@ window.__ModuleLoader__.load({
 			});
 		}
 		//#endregion
+		//#region src/client/plugin-card-seat.ts
+		/**
+		* Which seat the settings card occupies on the harness that is running.
+		*
+		* dsh 0.1.7 moved a bundle's own configuration out of Settings. The sidebar's
+		* Plugins page owns it now, and `plugins.bundle.config` — keyed by the bundle's
+		* package name — is the seat that page renders on the bundle's own page. The
+		* Settings section still declares `settings.plugins.tab`, and it is the only
+		* seat a deployment whose profile does not mount the plugin manager page has.
+		*
+		* Three facts about the slot registry shape this module:
+		*
+		* - The harness declares the official seats before an external plugin's
+		*   `apply()` runs, so the first attempt normally succeeds. It is a plain
+		*   `register`, never a declaration probe: `register` is the operation the
+		*   registry validates, and a probe would answer for a different question —
+		*   "is this key declared?" is true even in the deployment whose whole point is
+		*   the other seat.
+		* - `register` throws for an undeclared seat. That refusal is the fallback
+		*   signal, so the seats are tried rather than predicted.
+		* - `slots/changed` is emitted synchronously from inside both `register` and a
+		*   disposer, so an unguarded reconcile re-enters itself mid-move and registers
+		*   the card twice into the seat it is leaving ("already has an entry for key
+		*   …"). The latch below is what prevents that.
+		*
+		* The card is therefore in exactly one seat at any time: the official one when
+		* the harness renders it, the Settings tab otherwise, and the Settings entry is
+		* disposed before the official one is taken. This module holds the policy and
+		* no client-SDK import, so the moves are unit-tested with a fake registry.
+		*
+		* @module dsh-hypatia-auto-memory/client/plugin-card-seat
+		*/
+		/** The official keyed seat on the sidebar Plugins page, keyed by bundle package name. */
+		const BUNDLE_CONFIG_SEAT = "plugins.bundle.config";
+		/** The list seat inside Settings → Built-in plugins, declared by the Settings section. */
+		const SETTINGS_TAB_SEAT = "settings.plugins.tab";
+		/**
+		* Install one card into the seat this harness renders, following the harness if
+		* the seat becomes available later.
+		*
+		* @param host - the client context's slot registry and event bus.
+		* @param seats - the two seat contributions and an optional refusal diagnostic.
+		* @returns one disposer that removes the card and stops watching.
+		*/
+		function installPluginCard(host, seats) {
+			/** The live official registration, while the card occupies that seat. */
+			let official;
+			/** The live Settings-tab registration, while the card occupies that seat instead. */
+			let settingsTab;
+			/** Set by the returned disposer: every later reconcile is a no-op. */
+			let stopped = false;
+			/** Re-entrancy latch: the registry emits `slots/changed` from inside register and dispose. */
+			let reconciling = false;
+			const refused = /* @__PURE__ */ new Set();
+			/** One registration attempt, reporting its refusal once instead of on every retry. */
+			const attempt = (seat, register) => {
+				try {
+					return register();
+				} catch (error) {
+					if (!refused.has(seat)) {
+						refused.add(seat);
+						seats.onRefused?.(seat, error);
+					}
+					return;
+				}
+			};
+			/** Take the official seat when it is declared, retiring the Settings fallback first. */
+			const reconcile = () => {
+				if (stopped || reconciling || official !== void 0) return;
+				reconciling = true;
+				try {
+					const dispose = attempt(BUNDLE_CONFIG_SEAT, seats.official);
+					if (dispose === void 0) return;
+					official = dispose;
+					const previous = settingsTab;
+					settingsTab = void 0;
+					previous?.();
+				} finally {
+					reconciling = false;
+				}
+			};
+			reconcile();
+			const stopWaiting = host.slots.inject(SETTINGS_TAB_SEAT, () => {
+				if (stopped || official !== void 0 || settingsTab !== void 0) return () => {};
+				const dispose = attempt(SETTINGS_TAB_SEAT, seats.settingsTab);
+				if (dispose === void 0) return () => {};
+				settingsTab = dispose;
+				if (official !== void 0) {
+					settingsTab = void 0;
+					dispose();
+					return () => {};
+				}
+				return () => {
+					const current = settingsTab;
+					settingsTab = void 0;
+					current?.();
+				};
+			});
+			const stopWatching = host.on?.("slots/changed", () => {
+				reconcile();
+			});
+			return () => {
+				stopped = true;
+				stopWatching?.();
+				stopWaiting();
+				const officialDispose = official;
+				official = void 0;
+				officialDispose?.();
+				const settingsDispose = settingsTab;
+				settingsTab = void 0;
+				settingsDispose?.();
+			};
+		}
+		//#endregion
 		//#region src/client/index.tsx
+		/** The bundle's npm package name: the key the official seat identifies it by. */
+		const BUNDLE_NAME = "dsh-hypatia-auto-memory";
 		const APPLY_CLAIM = "__dshHypatiaAutoMemoryApplied";
 		function claimApply() {
 			const scope = globalThis;
@@ -1728,12 +1845,22 @@ window.__ModuleLoader__.load({
 				loadShelfInventory,
 				...props
 			});
-			const unregister = ctx.effect(() => configForms.whileServed([NS], () => ctx.slots.inject("settings.plugins.tab", () => ctx.slots.register({
-				name: "settings.plugins.tab",
-				id: NS,
-				label: () => t("title"),
-				locale: NS
-			}, renderCard))), "dsh-hypatia-auto-memory: plugins settings tab");
+			const unregister = ctx.effect(() => configForms.whileServed([NS], () => installPluginCard(ctx, {
+				official: () => ctx.slots.register({
+					name: BUNDLE_CONFIG_SEAT,
+					key: BUNDLE_NAME,
+					locale: NS
+				}, renderCard),
+				settingsTab: () => ctx.slots.register({
+					name: SETTINGS_TAB_SEAT,
+					id: NS,
+					label: () => t("title"),
+					locale: NS
+				}, renderCard),
+				onRefused: (seat, error) => {
+					console.warn(`[${BUNDLE_NAME}] configuration card refused by slot "${seat}"`, error);
+				}
+			})), "dsh-hypatia-auto-memory: configuration card seat");
 			const unregisterMemoryView = ctx.slots.inject("conversation.view", () => ctx.slots.register({
 				name: "conversation.view",
 				id: "memory",