dsh-layered-memory 0.8.12 → 0.9.0

package/README.en.md

@@ -60,8 +60,8 @@ This package declares a `dsh.bundle` composition layer (`cordis.patch.yml`); aft
 installation the **plugin entry is mounted automatically** — no need to hand-edit
 `$DSH_HOME/profiles/web/cordis.patch.yml`. Then restart DeepSeek Harness and verify:
 the appearance of `conversations/ records/ scenes/` and `memory.db` under
-`~/.dsh/memory/` means the plugin applied successfully; the "Memory" page in settings
-and the mode pill in the input bar mean the client half is ready.
+`~/.dsh/memory/` means the plugin applied successfully; the "Memory" page in settings (the Memory Workspace with five zones)
+and the memory chip in the input bar (`Memory · Auto`) mean the client half is ready.
 
 > ⚠️ **Security note**: installing a plugin = running third-party code with your
 > privileges. This plugin reads session content, writes files in its data directory,
@@ -112,7 +112,7 @@ also registers three model-callable memory tools: `memory_search` /
 **Cost dashboard**: every distillation LLM call (extract / dedup / L2 / L3) writes its
 token cost to a SQLite detail table keyed by `provider/model` (configurable retention,
 default 365 days with rolling cleanup on write; accounting failures only log a warning
-and never block distillation). Visualize it under Settings → Memory → the **Cost** tab:
+and never block distillation). Visualize it under Settings → Memory → Insights → the **Cost** sub-page:
 per-model trend lines (day/week/month granularity + last-N-days window + L1/L2/L3 layer
 filter), a layer × time-window table (calls / output & reasoning tokens / mean / median),
 and per-model totals — distillation overhead at a glance. Input is counted in characters
@@ -146,45 +146,67 @@ trajectory view):
 ## Per-Session Memory Modes
 
 <p align="center">
-  <img src="./assets/img/Modes.png" width="100%"
-       alt="Per-session memory modes: a glass capsule track with four stops (日常 · 工作 · 智能 · 关闭), the glowing orb resting on 智能 (default); a vignette above each — personal chat bubbles for 日常, code/document panes for 工作, two streams merging brightest for 智能, a dim dashed ghost bubble for 关闭">
+  <img src="./assets/img/MemoryChip.png" width="72%"
+       alt="Session memory chip and cascade menu in dark theme: in the composer-left cluster, right of the Read Only chip sits the "Memory · Auto ▾" chip; clicking opens a rounded popover menu upward with two rows "Memory scope  Auto ›" / "Data flow  Follow global ›", and hovering the data-flow row reveals a secondary panel listing Follow global ✓ / Read & write / Write only / Paused">
 </p>
 
-- **Control**: the pill next to the mode selector in the input bar (`Memory · Auto`);
-  clicking opens a macOS-style sliding picker above — release to snap to the nearest
-  mode; adapts to light/dark themes;
-- The lower half of the popover is a **per-session info area**: recall hits
-  (hit/searched turns plus cumulative items), batching progress (this session's
-  slice x/effective threshold; the off mode shows parked slices instead), memories
-  produced for this session, and session message count — plus status lines for
-  anomalies (storage degraded / vector search unavailable) and a global summary
-  (pending distill count, last distill time). Data comes from the
-  `dsh-memory/session-stats` endpoint (in-memory registries + an indexed COUNT,
-  zero file I/O), adaptively polled while open (2s busy / 5s idle) and stopped on
-  close;
-- Each session's choice is persisted by sessionId to `session-modes.json`, surviving
-  restarts/session restore; stacks with the global switches (global is the master gate);
-  L2/L3 are fully family-isolated — content never leaks across families.
-- **Write-only sessions (#38)**: a three-state "injection" switch inside the popover
-  (follow global / on / off) — set to "off" for a **write-only session**: capture and
-  distillation continue as usual (conversation still settles into L0→L1→L2/L3), but
-  nothing is injected into this session (recall injection, the persona/navigation
-  stable section and the tools guide all stop; `memory_search` and the other read
-  tools return a write-only notice). The pill face changes to `Memory · Write-only`;
-  the override persists per session, and switching back to "follow global" clears it
-  to the settings-page recall toggle. Ideal for debug/eval/sensitive sessions that
-  should absorb without interference. Orthogonal to the off mode: off remains full
-  stealth (capture off too), while write-only keeps the "in" and gates the "out".
+The conversation side is a **distributed memory surface** — each kind of information
+lives in the native host seat designed for it; the plugin no longer owns a strip:
+
+- **Memory chip** (composer-left cluster, right of the Read Only chip): a borderless
+  `Memory · {Auto|Personal|Work}` chip in official composer-chip grammar; the text is
+  the resolved truth — `Memory · write-only` (injection off), `Memory · paused`
+  (gray dot), `Memory · degraded` (amber dot); zh/en bilingual, following the host
+  language.
+- **Cascade menu** (click the chip, opens upward): two rows, `Memory scope {value} ›`
+  and `Data flow {value} ›`; data-flow options live in a **hover-only secondary
+  panel** (Follow global / Read & write / Write only / Paused) — no click-pinning,
+  with bridge hot-zones so slow mouse travel never breaks the hover chain; full
+  keyboard path (arrow-key roving + focus reveal).
+- **Inline slider** (click "Memory scope", grows in place): three stops
+  Personal / Work / Auto; crossing a stop updates the chip text **live** while
+  dragging; keyboard arrows/Home/End + `aria-valuetext`.
+- **Pause-resume snapshot**: switching the data flow to "Paused" enters the off mode
+  and persists the pre-pause scope and injection override; resuming restores them
+  as-is. Per-session choices persist to `session-modes.json` (stacked with the
+  global switches — global is the master gate); L2/L3 are fully family-isolated.
+- **Memory occupancy lives only in the official context meter panel**: opening the
+  official ring shows the "Memory" section (recall snippets / memory stable zone);
+  the composer area has zero occupancy UI — only a `N pending distill` telemetry
+  segment appended to the official stats line.
+- **Write-only sessions (#38)**: pick "Write only" in the data-flow panel for a
+  **write-only session** — capture and distillation continue as usual (conversation
+  still settles into L0→L1→L2/L3), but nothing is injected into this session (recall
+  injection, the persona/navigation stable section and the tools guide all stop;
+  `memory_search` and the other read tools return a write-only notice). The override
+  persists per session; switching back to "Follow global" clears it to the recall
+  toggle in Automation. Ideal for debug/eval/sensitive sessions that should absorb
+  without interference. Orthogonal to Paused: paused is full stealth (capture off
+  too), while write-only keeps the "in" and gates the "out".
 
 ## UI Preview
 
 <p align="center">
-  <img src="./assets/img/ui-dark.jpg" width="49.5%"
-       alt="Settings memory browser overview in dark theme: status card (plugin version, capture/distill/recall switch states, FTS and vector capabilities, L1 memory count, distillation model) and stat tiles, glassy controls with a cold-blue accent">
-  <img src="./assets/img/ui-light.jpg" width="49.5%"
-       alt="The same settings memory browser overview in light theme: identical layout and information on light card backgrounds with the same accent family, theme switch without reload">
+  <img src="./assets/img/ui-dark.png" width="49.5%"
+       alt="Memory Workspace overview in dark theme: five-zone task nav (Overview selected), health summary card (running normally + storage/vector/distill-queue subsystem chips + a pending-distill attention chip), recent-activity list (New/Updated verb tags + Memory/Scene kind tags + relative times), key-number tiles (memories / scenes / weekly distill output / last distill) and jump buttons to the other zones">
+  <img src="./assets/img/ui-light.png" width="49.5%"
+       alt="The same Memory Workspace overview in light theme: identical five-zone nav and health/activity/numbers layout on light card backgrounds with the same accent family, theme switch without reload">
 </p>
 
+Settings → Memory is the **Memory Workspace** (five-zone task nav, sticky tabs +
+arrow-key roving):
+
+- **Overview**: health summary + recent activity + key numbers + a guided empty state;
+- **Library**: a **read-only asset activity feed** with L1 memories / L2 scenes /
+  L3 personas mixed by update time (search + type/scope/time filters + in-place
+  expansion + copy);
+- **Automation**: basic switches + advanced disclosure (distill route chains and
+  budgets) + embedding-model disclosure;
+- **Insights**: Cost / Activity (7-day asset activity + distill calls & failures) /
+  Recall (cumulative totals + disabled distribution);
+- **Maintenance**: runtime health + diagnostic log + the danger-zone full rebuild
+  (confirm modal + progress + cancellable).
+
 ## Measured Comparison (DSH-MemBench: Automated Benchmark)
 
 Screenshots show what the plugin looks like — this section answers "**what does enabling it actually buy you?**" with measured numbers from an **automated benchmark** ([`bench/`](./bench/), one command to reproduce). Method: the same scenario bank with verbatim-identical inputs runs in **Group A (memory on)** with 3 merged repetitions and **Group B (memory off)** with 1 repetition (a memory-off long task burns multiples of the tokens per scenario — a cost guardrail); the dialog track now runs Group A only (memory-off probes in independent sessions cannot succeed, so the control carries no information — retired). Dialog-track environment: DeepSeek official `deepseek-v4-flash`, plugin 0.8.5 (judge same-source as tested; every answer archived for manual audit), Windows; taxonomy adapted from [LongMemEval](https://github.com/xiaowu0162/longmemeval) / [LoCoMo](https://snap-research.github.io/locomo/) / [AMB](https://github.com/vectorize-io/agent-memory-benchmark), with the extended probe types and lifecycle track informed by [MemoryAgentBench](https://arxiv.org/abs/2507.05257) / [GoodAI LTM](https://github.com/GoodAI/goodai-ltm-benchmark) / BEAM.
@@ -288,13 +310,13 @@ the bundle layer appends and causes `duplicate loader entry id` startup failure)
 | `embedding.allowLocalModels` | `true` | Allow the local embedding tier (deployment ceiling; when off, no model downloads and no local tier in settings) |
 | `embedding.mirror` | `https://hf-mirror.com` | Download mirror root for local models (can be changed back to `https://huggingface.co`) |
 | `embedding.proxy` | `''` | Three-state download proxy: `''` (default) = auto-detect proxy env vars (`HTTPS_PROXY`/`ALL_PROXY` etc., honoring `NO_PROXY`); `none` = disable, always direct; any other value = proxy URL (e.g. `http://127.0.0.1:7890`). Direct connections to the mirror are intermittently unreachable on some networks (connect timeouts and poisoned bytes have both been observed) — keep the default auto-detection on machines with a proxy |
-| `llm.provider/model` | empty | Static distillation route (deployment pin): when **both** fields are set the route is locked, outranking the settings-page runtime route chain and the default model (deployments can force distillation onto a specific route); when empty the route follows "settings-page route-chain primary → default model". At runtime, configure the primary route and fallback chain in the **route-chain editor** under Settings → Memory → Overview → distillation parameters (pick from **configured providers**, including custom ones added in dsh Settings → Models; the primary row may stay empty to follow the default model) — a non-empty chain takes over this static config wholesale, effective immediately with no restart |
+| `llm.provider/model` | empty | Static distillation route (deployment pin): when **both** fields are set the route is locked, outranking the settings-page runtime route chain and the default model (deployments can force distillation onto a specific route); when empty the route follows "settings-page route-chain primary → default model". At runtime, configure the primary route and fallback chain in the **route-chain editor** under Settings → Memory → Automation → Advanced routing and budgets (pick from **configured providers**, including custom ones added in dsh Settings → Models; the primary row may stay empty to follow the default model) — a non-empty chain takes over this static config wholesale, effective immediately with no restart |
 | `llm.fallbacks` | `[]` | Distillation fallback chain: an ordered list of backup routes tried one by one when the primary route fails (error / cut-off / network error / **empty output**); each entry is `{provider, model, reasoningEffort?}` (a non-empty effort overrides the global `llm.reasoningEffort`, still clamped by model capability); entries identical to the primary route are skipped; **each route gets the full `timeoutMs`**; when all routes fail, the existing per-session backoff takes over. Empty list (default) = single-route behavior unchanged (see [Distillation fallback chain & slow-TTFT models](#distillation-fallback-chain--slow-ttft-models) below); a non-empty settings-page runtime chain (`distillChain`) takes over **both** the primary route and the fallback chain (a single-row chain = explicitly no fallbacks), empty = follow this config |
 | `llm.layerRoutes` | `{}` | **Per-layer distillation routing** (#34): keys `l1`/`l2`/`l3`, each holding a **complete chain** (entries like `llm.fallbacks`, **head row must have both provider+model explicitly**). A non-empty chain **fully replaces** that layer's resolution (its primary and fallbacks all come from the layer chain; the global chain no longer participates); empty/missing = the layer follows the global chain. `l1` covers both extraction and dedup call sites. Layers can also be edited at runtime in the segmented panel under distillation parameters on the settings page (takes priority over this static config); a deployment pin does not disable static layer chains (same deployer-owned config as the fallback-chain precedent). Orthogonal to and composable with the fallback chain — one complete chain per layer (ADR-0005) |
-| `llm.maxTokens` | `65536` | Fallback output cap for non-layered calls. Each distillation stage has its own budget (extraction 16k / dedup 8k / L2 32k / L3 16k; auto ×4 when the reasoning effort is high/xhigh/max, so thinking can't starve the text budget); the per-layer budgets are runtime-adjustable in Settings → Memory → Overview → distillation parameters (empty/0 = built-in defaults) |
+| `llm.maxTokens` | `65536` | Fallback output cap for non-layered calls. Each distillation stage has its own budget (extraction 16k / dedup 8k / L2 32k / L3 16k; auto ×4 when the reasoning effort is high/xhigh/max, so thinking can't starve the text budget); the per-layer budgets are runtime-adjustable in Settings → Memory → Automation → Advanced routing and budgets (empty/0 = built-in defaults) |
 | `llm.reasoningEffort` | empty | Distillation reasoning effort: empty = **auto** (resolved from model capability: the model's default tier, else `high`); an explicit value (`off`/`none`/`minimal`/`low`/`medium`/`high`/`xhigh`/`max`) is only sent when the model declares support — effort vocabularies differ across providers (deepseek accepts `off`, OpenAI-style APIs use `none`, models that declare no tiers get nothing), and unsupported tiers degrade to not-sending with a one-time warning; output budgets auto-×4 at high/xhigh/max. At runtime, override the effort **per route** in the settings-page route-chain editor (per-row dropdown; the tier list follows each model's declared capability live, defaulting to this value) |
 | `llm.temperature` | `0.3` | Distillation temperature |
-| `llm.maxInputChars` | `700000` | Input character budget per distillation call (over-budget L1 inputs are chunked automatically); runtime-adjustable in Settings → distillation parameters → input budget (empty/0 = follow this value) |
+| `llm.maxInputChars` | `700000` | Input character budget per distillation call (over-budget L1 inputs are chunked automatically); runtime-adjustable in Settings → Memory → Automation → Advanced routing and budgets → input budget (empty/0 = follow this value) |
 | `llm.timeoutMs` | `120000` | Per-call distillation timeout (ms) |
 | `tokenCost.retentionDays` | `365` | Retention (days) for distillation cost details (the `token_cost` table); rows older than this are rolled away on write. `0` = keep forever. Also the upper bound of the cost dashboard's "last N days" window |
 | `tools` | `true` | Whether to register model-callable memory tools |
@@ -304,7 +326,7 @@ the bundle layer appends and causes `duplicate loader entry id` startup failure)
 
 Free/slow tiers of some inference providers have **first-token latencies (TTFT) upwards of 20 seconds**, while some upstream gateways cut a silent connection at ~20s — distillation calls then fail at a fixed ~20s (`llm aborted`) long before the plugin's 120s timeout could ever matter (the scenario measured in [#31](https://github.com/JunNanLYS/dsh-layered-memory/issues/31)). Three mitigations, pick as needed:
 
-1. **Switch route** (most direct): change the primary route live in the route-chain editor under Settings → Memory → Overview → distillation parameters (or move a fast route to the head of the chain), or pin `llm.provider`/`llm.model` statically.
+1. **Switch route** (most direct): change the primary route live in the route-chain editor under Settings → Memory → Automation → Advanced routing and budgets (or move a fast route to the head of the chain), or pin `llm.provider`/`llm.model` statically.
 2. **Fallback chain** (automatic demotion): when the primary route fails, backup routes are tried in order with no manual intervention:
 
    ```yaml
@@ -336,9 +358,9 @@ Free/slow tiers of some inference providers have **first-token latencies (TTFT)
            reasoningEffort: high
    ```
 
-   Layers can also be edited at runtime in the **segmented panel** (global default / L1 / L2 / L3) under Settings → Memory → Overview → distillation parameters. In-layer priority: runtime layer chain > this static YAML layer chain > global default chain, falling back level by level.
+   Layers can also be edited at runtime in the **segmented panel** (global default / L1 / L2 / L3) under Settings → Memory → Automation → Advanced routing and budgets. In-layer priority: runtime layer chain > this static YAML layer chain > global default chain, falling back level by level.
 
-   Failure = error / cut-off / network error / **empty output** (stream ends normally with 0 characters — worthless for distillation since parsing always fails, so it is treated as a route failure rather than an empty return); caller-initiated cancellation does not demote; each route gets the **full** `llm.timeoutMs` (a shared budget would give a slow-TTFT fallback route less time than its real first-packet needs, defeating the chain); token costs are recorded per attempt (failed attempts get a row too, with whatever tokens arrived before the stream broke), and successful calls are attributed to the route that actually served. The route chain can also be adjusted at runtime in the route-chain editor under Settings → Memory → Overview → distillation parameters (no config edit or restart needed); the YAML below suits deployments that want to pin the static chain.
+   Failure = error / cut-off / network error / **empty output** (stream ends normally with 0 characters — worthless for distillation since parsing always fails, so it is treated as a route failure rather than an empty return); caller-initiated cancellation does not demote; each route gets the **full** `llm.timeoutMs` (a shared budget would give a slow-TTFT fallback route less time than its real first-packet needs, defeating the chain); token costs are recorded per attempt (failed attempts get a row too, with whatever tokens arrived before the stream broke), and successful calls are attributed to the route that actually served. The route chain can also be adjusted at runtime in the route-chain editor under Settings → Memory → Automation → Advanced routing and budgets (no config edit or restart needed); the YAML below suits deployments that want to pin the static chain.
 4. **Raise the timeout**: `llm.timeoutMs` only helps when the route is genuinely slow but the gateway doesn't cut; if the gateway kills at 20s, raising the plugin timeout is futile — use the first two layers.
 
 ## Storage Layout
@@ -354,7 +376,7 @@ local), switchable at runtime in the settings page — see the next section.
 
 ## Semantic Retrieval (Embedding Source)
 
-Pick the embedding source in Settings → Memory → Overview → Semantic Retrieval;
+Pick the embedding source in Settings → Memory → Automation → embedding models;
 it takes effect immediately, no config edit or restart:
 
 <p align="center">

package/README.md

@@ -54,7 +54,8 @@ Agent 应当返回安装结果，并明确告诉你配置中是否已经出现 `
 本包声明了 `dsh.bundle` 组合包层（`cordis.patch.yml`），安装后会**自动挂载插件行**——
 不需要再手改 `$DSH_HOME/profiles/web/cordis.patch.yml`。然后重启 DeepSeek Harness，
 验证：`~/.dsh/memory/` 下出现 `conversations/ records/ scenes/` 目录和 `memory.db`
-即插件 apply 成功；设置页出现"记忆"页面、输入栏出现档位 pill 即 client 半边就绪。
+即插件 apply 成功；设置页出现"记忆"页面（记忆工作台五区）、输入栏出现记忆芯片
+（`记忆 · 智能`）即 client 半边就绪。
 
 **卸载**：`dsh plugin --profile web remove dsh-layered-memory` + 重启。数据保留在
 `~/.dsh/memory/`，不需要时手动删除整个目录即可。
@@ -81,7 +82,7 @@ npx tsc src/smoke.ts --outDir dist-smoke --module nodenext --moduleResolution no
 
 **成本看板**：每次蒸馏 LLM 调用（抽取/去重/L2/L3）的 token 成本按 `provider/model` 写入
 SQLite 明细表（保留期可配置，默认 365 天，写入时滚动清理；记账失败只告警、绝不阻塞蒸馏），
-设置页 → 记忆 → **成本** Tab 可视化：按模型分色的趋势折线（日/周/月粒度 + 近 N 天窗口 +
+设置页 → 记忆 → 洞察 → **成本** 子页可视化：按模型分色的趋势折线（日/周/月粒度 + 近 N 天窗口 +
 L1/L2/L3 层级过滤）、层级 × 时间窗口表格（调用数 / 输出与思考 token / 均值 / 中位数）、
 按模型累计——蒸馏开销一目了然。输入按字符计（dsh 流式 usage 不含输入 token），
 输出与思考按 token 计。
@@ -115,34 +116,49 @@ L1/L2/L3 层级过滤）、层级 × 时间窗口表格（调用数 / 输出与
 ## 会话级记忆档位
 
 <p align="center">
-  <img src="./assets/img/Modes.png" width="100%"
-       alt="会话级记忆档位：一条玻璃胶囊滑轨四个停点（日常·工作·智能·关闭），发光圆球停在智能（默认）档；各档上方微场景——日常为个人聊天气泡、工作为代码文档窗格、智能为双流合流最亮、关闭为暗淡虚线幽灵泡">
+  <img src="./assets/img/MemoryChip.png" width="72%"
+       alt="深色主题下的会话记忆芯片与级联菜单：输入栏左簇 Read Only 芯片右侧是「记忆 · 智能 ▾」芯片；点击向上弹出圆角浮层菜单，两行「记忆范围 智能 ›」「数据流 跟随全局 ›」，数据流行右侧悬停出二级子面板列出 跟随全局✓/读写/只写/暂停 四个选项">
 </p>
 
-- **控件**：输入栏内、模式选择器右侧的 pill（`记忆·自动`），点击在上方浮出档位滑块深浅主题自适应；
-- 悬浮板下半部是**会话信息区**：召回命中（命中/检索轮次与累计条数）、攒批进度
-  （本会话切片 x/生效阈值；关闭档显示挂起切片数）、本会话产出记忆条数、会话消息数，
-  外加异常状态行（存储降级 / 向量检索不可用）与全局摘要（待蒸馏条数、上次蒸馏时间）；
-  数据走 `dsh-memory/session-stats` 端点（纯内存注册表 + 索引 COUNT，零文件 I/O），
-  打开期间自适应轮询（忙 2s / 静 5s），关闭即停；
-- 每会话的选择按 sessionId 持久化到 `session-modes.json`，重启/恢复会话不丢；
-  与全局开关叠加（全局是总闸）；L2/L3 完全分类，分类内容不渗透。
-- **只写不读（#38）**：悬浮板内「注入」三态开关（跟随全局 / 开 / 关）——设为「关」
-  即**只写会话**：捕获与蒸馏照常（对话照常沉淀为 L0→L1→L2/L3），但不向本会话注入
-  任何记忆（召回注入、画像/导航稳定区、工具指南一并停止；`memory_search` 等读工具
-  返回只写提示）。pill 面文换作 `记忆·只写` 提示状态；覆盖按会话持久化，切回
-  「跟随全局」即清除、跟随设置页召回开关；适合调试/评测/敏感会话「只吸收不干扰」。
-  与 off 档正交：off 仍是完全隐身（连捕获都关），只写保留「进」关「出」。
+会话侧是**分散式记忆面**——信息按类型住进宿主原生座位，插件不再有自有条带：
+
+- **记忆芯片**（输入栏左簇、Read Only 芯片右侧）：`记忆 · {智能|日常|工作}` 无边框
+  芯片（官方 composer chip 语法），文案是解析真值——`记忆 · 只写`（注入关）、
+  `记忆 · 暂停`（灰点）、`记忆 · 降级`（琥珀点）；zh/en 双语随宿主语言切换。
+- **级联菜单**（点击芯片向上展开）：两行 `记忆范围 {值} ›` / `数据流 {值} ›`；数据流
+  选项在 **hover 二级子面板**（跟随全局/读写/只写/暂停），点击不固定、桥接热区保证
+  慢速移动不断链；键盘通路齐备（方向键巡游 + focus 揭示）。
+- **内联滑条**（点「记忆范围」原地展开）：三停点 日常/工作/智能，拖拽跨档时**芯片文字
+  实时联动**；键盘方向键/Home/End + `aria-valuetext`。
+- **暂停恢复快照**：数据流切「暂停」进 off 档时记录暂停前范围与注入覆盖，恢复即原样
+  还原；每会话选择持久化到 `session-modes.json`（与全局开关叠加，全局是总闸）；
+  L2/L3 完全分类，分类内容不渗透。
+- **记忆占用只住官方上下文环面板**：点开官方环即可见「记忆」分项小节（召回片段 /
+  记忆稳定区）；输入区没有任何占用 UI，只在官方统计行追加 `待蒸馏 N` 遥测段。
+- **只写不读（#38）**：数据流选「只写」即**只写会话**——捕获与蒸馏照常（对话照常沉淀
+  为 L0→L1→L2/L3），但不向本会话注入任何记忆（召回注入、画像/导航稳定区、工具指南
+  一并停止；`memory_search` 等读工具返回只写提示）。覆盖按会话持久化，切回
+  「跟随全局」即清除、跟随自动化区的召回开关；适合调试/评测/敏感会话「只吸收不干扰」。
+  与暂停正交：暂停是完全隐身（连捕获都关），只写保留「进」关「出」。
 
 ## 界面预览
 
 <p align="center">
-  <img src="./assets/img/ui-dark.jpg" width="49.5%"
-       alt="深色主题下的设置页记忆浏览器概览：状态卡（插件版本、捕获/蒸馏/召回开关状态、FTS 与向量能力、L1 记忆计数、蒸馏模型）与统计瓦片，玻璃质感控件与冷蓝强调色">
-  <img src="./assets/img/ui-light.jpg" width="49.5%"
-       alt="浅色主题下的同一设置页记忆浏览器概览：同款布局与信息，浅色卡片底与同套强调色，主题切换无需重载">
+  <img src="./assets/img/ui-dark.png" width="49.5%"
+       alt="深色主题下的记忆工作台总览：五区任务导航（总览选中），健康摘要卡（运行正常 + 存储/向量检索/蒸馏队列子系统标签 + 待蒸馏注意提示）、最近活动列表（新增/更新动词标签 + 记忆/场景层标签 + 相对时间）、关键数字瓦片（记忆资产/场景/本周蒸馏输出/上次蒸馏）与四区跳转按钮">
+  <img src="./assets/img/ui-light.png" width="49.5%"
+       alt="浅色主题下的同一记忆工作台总览：同款五区导航与健康摘要/最近活动/关键数字布局，浅色卡片底与同套品牌蓝强调色，主题切换无需重载">
 </p>
 
+设置 → 记忆 是**记忆工作台**（五区任务导航，sticky 标签 + 箭头键巡游）：
+
+- **总览**：健康摘要 + 最近活动 + 关键数字 + 引导式空状态；
+- **记忆库**：L1 记忆 / L2 场景 / L3 画像按更新时间混排的**只读资产活动流**
+  （搜索 + 类型/范围/时间筛选 + 原位展开 + 复制）；
+- **自动化**：基础开关 + 高级披露（蒸馏路由链与预算）+ 嵌入模型披露；
+- **洞察**：成本 / 活动（近 7 天资产活动 + 蒸馏调用失败）/ 召回（累计与停用分布）；
+- **维护**：运行健康 + 诊断日志 + 危险区全量重建（二次确认 + 进度 + 可取消）。
+
 ## 实测对比（DSH-MemBench：自动化基准）
 
 图文回答"长什么样"，这一节用**自动化基准**的实测数字回答"**开了到底有什么用**"（[`bench/`](./bench/)，一条命令可复现）。方法：同场景库、逐字相同输入，**A 组（记忆开）跑 3 次取合并值，B 组（记忆关）跑 1 次**（无记忆的长任务每场景要吞数倍 token，成本护栏）；对话赛道只跑 A 组（B 组会话独立无记忆必然失败，对照无信息量，已下线）。对话赛道环境：DeepSeek 官方 `deepseek-v4-flash`、插件 0.8.5（判卷与被测同源，答案原文全部留痕可人工复核）、Windows；题型设计借鉴 [LongMemEval](https://github.com/xiaowu0162/longmemeval) / [LoCoMo](https://snap-research.github.io/locomo/) / [AMB](https://github.com/vectorize-io/agent-memory-benchmark)，扩展题型与生命周期赛道参照 [MemoryAgentBench](https://arxiv.org/abs/2507.05257) / [GoodAI LTM](https://github.com/GoodAI/goodai-ltm-benchmark) / BEAM。
@@ -204,7 +220,7 @@ node bench/harness/retrieval-metrics.mjs <runDir> --flood 200,600
 
 ## 语义检索（嵌入源）
 
-设置页（记忆 → 概览 → 语义检索）选择嵌入源，即时生效、无需改配置重启：
+设置页（记忆 → 自动化 → 嵌入模型）选择嵌入源，即时生效、无需改配置重启：
 
 <p align="center">
   <img src="./assets/img/EmbeddingSource.png" width="70%"
@@ -284,10 +300,10 @@ ONNX 量化 **CPU 推理**——无需 API Key，数据不出本机）。本地
 | `embedding.allowLocalModels` | `true` | 允许本地嵌入档（部署上限：关闭后设置页不能下载模型、不能切本地档） |
 | `embedding.mirror` | `https://hf-mirror.com` | 本地模型下载镜像根地址（可改回官方 `https://huggingface.co`） |
 | `embedding.proxy` | `''` | 模型下载代理三态：`''`（默认）= 自动探测代理环境变量（`HTTPS_PROXY`/`ALL_PROXY` 等，尊重 `NO_PROXY`）；`none` = 禁用强制直连；其他值 = 代理 URL（如 `http://127.0.0.1:7890`）。镜像直连在国内网络间歇不可达（直连超时与污染字节交替出现过），开代理的机器建议保持默认自动探测 |
-| `llm.provider/model` | 空 | 蒸馏模型静态路由（部署 pin）：provider 与 model **双字段齐**时锁定蒸馏路由，优先于设置页的运行时路由链与默认模型（部署可强制蒸馏走指定路由）；留空则跟随"设置页路由链主路由 → 默认模型"。运行时可在设置页 → 记忆 → 概览 → 蒸馏参数的**蒸馏路由链编辑器**里配置主路由与回退链（从**已配置的供应商**（含 dsh 设置 → 模型里添加的自定义供应商）中选择，主路由行可留空跟随默认模型），非空即整体接管本静态配置，即时生效无需重启 |
+| `llm.provider/model` | 空 | 蒸馏模型静态路由（部署 pin）：provider 与 model **双字段齐**时锁定蒸馏路由，优先于设置页的运行时路由链与默认模型（部署可强制蒸馏走指定路由）；留空则跟随"设置页路由链主路由 → 默认模型"。运行时可在设置页 → 记忆 → 自动化 → 高级路由与预算的**蒸馏路由链编辑器**里配置主路由与回退链（从**已配置的供应商**（含 dsh 设置 → 模型里添加的自定义供应商）中选择，主路由行可留空跟随默认模型），非空即整体接管本静态配置，即时生效无需重启 |
 | `llm.fallbacks` | `[]` | 蒸馏回退链：主路由失败（报错/被掐断/网络异常/**空输出**）后按条目顺序逐个降级尝试的备用路由列表，条目 = `{provider, model, reasoningEffort?}`（档位非空覆盖全局 `llm.reasoningEffort`，仍按模型能力钳制）；与主路由完全相同的条目自动跳过；**每条路由各享全额 `timeoutMs`**；全部失败交既有按会话退避重试。空数组（缺省）= 单路由行为不变（详见下方[蒸馏回退链与慢 TTFT 模型](#蒸馏回退链与慢-ttft-模型)）；设置页运行时路由链（`distillChain`）非空时**整体接管**主路由与回退链（单行链 = 显式无回退），空 = 跟随本配置 |
 | `llm.layerRoutes` | `{}` | 蒸馏**按层路由**：层键 `l1`/`l2`/`l3` 各配一条**完整链**（条目同 `llm.fallbacks`，**头行必须 provider+model 双显式**），非空即**完整替换**该层解析（该层主路由与回退都归层链管，全局链对该层不参与），空/缺省 = 该层跟随全局；`l1` 同管抽取+去重两个调用点。运行时可在设置页「蒸馏参数」分段面板里按层编辑（优先于本静态配置）；部署 pin 不废静态层链（同为部署配置，同回退链先例）。与回退链正交可组合——每层各自一条链（ADR-0005） |
-| `llm.maxTokens` | `65536` | 未分层调用的兜底输出总闸。各蒸馏层有独立预算（抽取 16k / 去重 8k / L2 32k / L3 16k；思考档 high/xhigh/max 时自动 ×4，防 reasoning 吃光预算），分层预算可在设置页 → 记忆 → 概览 → 蒸馏参数运行时调整（留空/0 = 跟随内置默认） |
+| `llm.maxTokens` | `65536` | 未分层调用的兜底输出总闸。各蒸馏层有独立预算（抽取 16k / 去重 8k / L2 32k / L3 16k；思考档 high/xhigh/max 时自动 ×4，防 reasoning 吃光预算），分层预算可在设置页 → 记忆 → 自动化 → 高级路由与预算运行时调整（留空/0 = 跟随内置默认） |
 | `llm.reasoningEffort` | 空 | 蒸馏思考档位：空串 = **自动**（按模型能力解析：模型默认档 → `high`）；显式值（`off`/`none`/`minimal`/`low`/`medium`/`high`/`xhigh`/`max`）仅在该模型声明支持时发送——跨供应商 effort 词汇表不同（deepseek 认 `off`，OpenAI 系是 `none`，未声明档位的模型不传），不支持的档位自动降级为不传并告警一次；思考档 high/xhigh/max 时输出预算自动 ×4。运行时可在设置页路由链编辑器里**逐路由**覆盖档位（行内下拉，词表按各模型声明的能力实时显示，缺省跟随本值） |
 | `llm.temperature` | `0.3` | 蒸馏温度 |
 | `llm.maxInputChars` | `700000` | 单次蒸馏输入字符预算（超限的 L1 输入自动分块抽取）；运行时可在设置页 → 蒸馏参数 → 输入预算调整（留空/0 = 跟随本值） |
@@ -300,7 +316,7 @@ ONNX 量化 **CPU 推理**——无需 API Key，数据不出本机）。本地
 
 部分推理供应商的免费/慢速档位**首 token 延迟（TTFT）可达 20 秒以上**，而部分上游网关会在连接静默约 20 秒时掐断——蒸馏调用以固定 ~20s 失败（`llm aborted`），插件侧 120s 超时根本轮不到生效（[#31](https://github.com/JunNanLYS/dsh-layered-memory/issues/31) 的实测场景）。三层缓解按需取用：
 
-1. **换路由**（最直接）：设置页 → 记忆 → 概览 → 蒸馏参数的路由链编辑器即时改主路由（或把快路由排到链首），或静态 pin `llm.provider`/`llm.model`。
+1. **换路由**（最直接）：设置页 → 记忆 → 自动化 → 高级路由与预算的路由链编辑器即时改主路由（或把快路由排到链首），或静态 pin `llm.provider`/`llm.model`。
 2. **回退链**（自动降级）：主路由失败时按序自动换备用路由，无需人工干预：
 
    ```yaml
@@ -334,11 +350,11 @@ ONNX 量化 **CPU 推理**——无需 API Key，数据不出本机）。本地
            reasoningEffort: high
    ```
 
-   也可在设置页 → 记忆 → 概览 → 蒸馏参数的**分段面板**（全局默认 / L1 / L2 / L3）
+   也可在设置页 → 记忆 → 自动化 → 高级路由与预算的**分段面板**（全局默认 / L1 / L2 / L3）
    里按层运行时编辑，层内优先级：运行时层链 > 本 YAML 静态层链 > 全局默认链，
    逐级兜底。
 
-   失败 = 报错 / 被掐断 / 网络异常 / **空输出**（流正常结束但 0 字符——对蒸馏而言必然在解析阶段报废，改判为该路由失败而非返回空串）；调用方主动取消不降级；每条路由各享**全额** `llm.timeoutMs`（共享预算会让慢 TTFT 的回退路由拿到的窗口小于它真实需要的首包时间，回退链形同虚设）；token 成本逐次尝试记账（失败尝试也计一行，含流中断前已到的 token），成功调用归因到实际服务的路由。路由链也可在设置页 → 记忆 → 概览 → 蒸馏参数的「蒸馏路由链」编辑器里运行时调整（无需改配置重启）；本 YAML 适合部署者固化静态链。
+   失败 = 报错 / 被掐断 / 网络异常 / **空输出**（流正常结束但 0 字符——对蒸馏而言必然在解析阶段报废，改判为该路由失败而非返回空串）；调用方主动取消不降级；每条路由各享**全额** `llm.timeoutMs`（共享预算会让慢 TTFT 的回退路由拿到的窗口小于它真实需要的首包时间，回退链形同虚设）；token 成本逐次尝试记账（失败尝试也计一行，含流中断前已到的 token），成功调用归因到实际服务的路由。路由链也可在设置页 → 记忆 → 自动化 → 高级路由与预算的「蒸馏路由链」编辑器里运行时调整（无需改配置重启）；本 YAML 适合部署者固化静态链。
 4. **调高超时**：`llm.timeoutMs` 只在路由确实慢但网关不掐时有用；网关 20s 掐断的场景调插件超时无效，请用前两层。
 
 ## 日志与故障排查