dsh-loci 2.4.1 → 2.6.0

package/CHANGELOG.md

@@ -4,6 +4,78 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); the project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html) from 1.0.0.
 
+## [2.6.0] — 2026-11-15
+
+The rest of the boundary audit: three silent-wrongness bugs, and the invariants rewritten
+to say what the code actually does.
+
+### Fixed
+
+- **The review filter was ignored.** The panel sent `kinds=rule,semantic,procedural`
+  while the route read `kind`, so every session summary appeared in a queue designed to
+  exclude them. The route now accepts both spellings.
+- **"N items await review" could never reach zero.** `countPending` ignored `valid_to`,
+  so candidates closed by maintenance stayed counted in the injected notice forever —
+  a permanent nag that cost bytes and named rows no review list would show.
+- **`/loci review` pointed at an operation that does not exist** (`loci_write op:"verify"`).
+  Fixed by adding the door that was actually missing: **`dsh-loci verify --id <id>
+  [--status disputed]`**. The tool surface still has no verify, on purpose — the model
+  must never grant trust — but a terminal-only user could previously create candidates
+  forever and never promote one.
+
+### Changed
+
+- **The invariants now state what is enforced, and when each one expires.**
+  - I2 became **I2′**: no write reorders or rewrites an existing line; re-evaluation
+    happens at session/day boundaries only. The old "byte-identical with no writes" was
+    false — the footer carries a date, so it changed daily by design.
+  - I4 became **I4′**: session reads bind an explicit key set; the panel and export
+    enumerate every scope, which is an administrative view rather than a session read.
+  - I1 no longer says "verified requires a human": it says the store derives status, and
+    verified comes from a human action **or** a quote that is present and related.
+  - R1 and R2 were rewritten because the project violated them: `recallAssist` selects by
+    body text (now an explicit, bounded exception), and the pending count deliberately
+    changes mid-session (now stated as an informed cost, not denied).
+  - New **§0.1** gives every invariant its category (structural / contingent /
+    preference), what it depends on, and the event that should trigger re-evaluation.
+    §2.1 had expiry signals for the one thing the project *rejected* and none for the
+    four things it *relies on*; that asymmetry is the most reusable finding of the audit.
+
+- **PRIVACY said "two things can reach the network". It was three.** Session extraction
+  sends up to 12 KB of conversation through the Host's own model service. Not a third
+  party, but the count was wrong and the page now names all three. The prose test grew a
+  check for the third path so the count cannot drift again.
+
+## [2.5.0] — 2026-11-15
+
+The rest of the boundary audit: one real hole in the trust gate, one check that could
+never fail, and a number that was being read as more than it is.
+
+### Fixed
+
+- **A real quote could certify an unrelated claim.** The gate asked only "did the user
+  say this"; it never asked "is the claim about what they said". Quoting any real
+  sentence — "好的，继续吧" — was enough to launder a fabricated fact into the prompt.
+  `evidenceSupports` was written for exactly this and had no caller. It is now part of
+  the gate, and its threshold is **measured** rather than inherited: on Chinese text a
+  legitimate paraphrase scores 0.083–0.364 and a laundered claim scores 0.000, so the
+  bar is 0.05. The old 0.15 would have rejected "用户偏好中文" from "以后都用中文回复我".
+
+- **`loci doctor`'s host row could never warn.** It printed `[ok]` for any recorded
+  version, including one outside `engines.dsh`. It now compares against the declared
+  range and warns when outside, degrading to `ok` (not a failure) when the range cannot
+  be parsed.
+
+### Changed
+
+- **The acceptance numbers are qualified, not deleted.** Every measurement in
+  `docs/ACCEPTANCE.md` was taken on **v1.0.0**; the tree is 2.5.0. Worse, the
+  acceptance question contains the entry title verbatim (`acceptance-e2e.mjs:94`), the
+  corpus fixture is readable from the agent's workspace, and there is no no-memory arm —
+  so "49/50" measures lookup, not memory effect. The page now says so at the top and on
+  the row itself. A re-acceptance on 2.5.x with held-out facts and a control arm is an
+  open item, not something a doc edit can settle.
+
 ## [2.4.1] — 2026-11-15
 
 Three fixes from an independent boundary audit. All three were verified by running the

package/README.md

@@ -117,10 +117,15 @@ The settings page writes the fields marked *live* without a restart.
 
 ## What it will not do
 
-- No model call in any automatic path in v1.0 — capture and summaries are
-  deterministic, so the cost is visible and zero.
-- No cloud, no telemetry. Two optional network paths, both off by default: the update check (`updateCheck`) and the HTTP embedding channel (`vectorMode: 'http'`).
-- No cross-project leakage: reads use an explicit scope-key set, never a wildcard.
+- Capture and the session summary are deterministic — no model call, so their cost is
+  visible and zero. The only model call is `extractMode`, which is **off** by default
+  and only runs when you set it.
+- No cloud, no telemetry. Three optional network paths, all off by default: the update
+  check (`updateCheck`), the HTTP embedding channel (`vectorMode: 'http'`), and session
+  extraction (which sends the recent conversation to your configured model through the
+  Harness).
+- Session reads use an explicit scope-key set, never a wildcard. The panel and export
+  enumerate every scope — an admin view, not a session read.
 - No physical deletion by default; `purge` needs a config switch, a confirmation,
   and leaves an audit line.
 

package/README.zh.md

@@ -87,9 +87,9 @@ node "$HOME/.dsh/profiles/<profile>/node_modules/dsh-loci/scripts/cli.mjs" docto
 
 ## 它明确不做
 
-- v1.0 的自动路径里没有模型调用 —— 捕获与摘要是确定性的，成本可见且为零。
-- 无云、无遥测。只有两条可选出网路径，**都默认关闭**：更新检查（`updateCheck`）与 HTTP 向量通道（`vectorMode: 'http'`）。
-- 不跨项目串味：读取用显式 scope-key 集合，从不通配。
+- 捕获与会话摘要是确定性的，无模型调用，成本可见且为零。唯一的模型调用是 `extractMode`，**默认关闭**，只有你开启时才跑。
+- 无云、无遥测。三条可选出网路径，**都默认关闭**：更新检查（`updateCheck`）、HTTP 向量通道（`vectorMode: 'http'`）、会话结束抽取（经宿主把最近对话发给你配置的模型）。
+- 会话读取用显式 scope-key 集合，从不通配。面板与导出会枚举全部作用域——那是管理视图，不是会话读取。
 - 默认不物理删除；`purge` 需要配置开关 + 确认 + 留审计。
 
 ## 数据位置

package/docs/ACCEPTANCE.md

@@ -1,5 +1,11 @@
 # ACCEPTANCE — measured results (v1.0.0)
 
+> **Version warning.** Everything below was measured on **v1.0.0**. The current tree is
+> 2.4.x: schema v3, auto-verified capture, the pending-review notice, lesson fields, the
+> review-kind filter and the two-part quote gate all landed after these runs. Treat this
+> page as a record of what was true then, not as a property of what ships now. A
+> re-acceptance is an open item.
+
 Environment: Windows 11 · DSH 0.2.2-rc.1 · Node 24.13.0 · model `local-test/deepseek-flash`
 (reasoning off, 100k context) · every run in a throwaway `DSH_HOME` under `%TEMP%`.
 The plugin under test is the packed tarball, installed with
@@ -9,7 +15,7 @@ Verdict summary:
 
 | # | Row | Result |
 |---|---|---|
-| 1 | Recall accuracy | **PASS** - single 49/50 = 98% (`acceptance-single.json`), multi 10/10, broad 50/50 |
+| 1 | Seeded-corpus keyword recall (**not** an evaluation of whether memory helps) | **PASS on its own terms** — single 49/50, multi 10/10, broad 50/50. Caveats that limit what this number means: the question contains the entry title verbatim (scripts/acceptance-e2e.mjs:94), the corpus fixture is readable from the agent's workspace, and there is no no-memory control arm. It shows the tools can find an entry when the question names it; it does not show that injection improved an answer |
 | 2 | Injection cost | **PASS** — 0 B empty; 3,450–3,507 B steady; ~1.2k tokens measured |
 | 3 | Concurrency and crash | **PASS** — 200/200 rows, 0 lock errors, kill -9 recoverable |
 | 4 | Migration and rollback | **PASS** — rehearsal upgrade + snapshot restore, row-identical |

package/docs/DESIGN.md

@@ -140,10 +140,12 @@ status resolution:
    else                               → candidate
 ```
 
-The quote check is the whole trust model in one line: **a fact is verified when the
-user's own words, still present in this session, support it.** A model cannot promote
-its own guess by writing `status: 'verified'` through the tool — the tool does not
-accept that field, and the store re-derives status from evidence.
+The quote check is two questions, and both have to pass: **is the quote still present in
+this session's user messages** (containment), and **does it share substance with the
+claim** (≥5% character-bigram overlap). The second half exists because containment alone
+is enough to launder a fabricated fact — quoting "好的，继续吧" certified anything. A model
+cannot promote its own guess by writing `status: 'verified'` through the tool: the tool
+does not accept that field, and the store re-derives status from evidence.
 
 The write is one `BEGIN IMMEDIATE` transaction that touches `memory`, `memory_fts`,
 `token_stat`, `entity`/`memory_entity`, `memory_head`, and `memory_edge`. A crash

package/docs/PRIOR-ART.md

@@ -7,16 +7,33 @@
 > 这份文档的存在原因：本项目一度是"用户提一个、我做一个"的反应式开发。
 > 2026-11-15 的一次反问（"不要我说一个你就搞一个"）之后补上系统性盘点。
 
-## 0. 评估基准（loci 的四条硬不变量）
+## 0. 评估基准（loci 的四条硬不变量，2026-11-15 修正版）
 
-一条设计值不值得抄，先过这四关。违反任何一条的，无论多流行，都不抄：
+一条设计值不值得抄，先过这四关。违反任何一条的，无论多流行，都不抄。
 
-| # | 不变量 | 含义 |
+**这一版是根据独立边界审计改写的。**旧版的措辞比代码更强，而在一次盲评里被逐条打穿：I2 说"字节级不变"，但尾部有日期；I4 说"读永不越界"，但面板枚举全部键。一个说得过满的判据比没有判据更糟 —— 它会让后续每个决定都建立在一个假前提上。所以下面每条都分**断言**与**它什么时候会失效**（后者见 §0.1）。
+
+| # | 不变量 | 断言（代码实际保证的） |
 |---|---|---|
-| **I1** | 注入闸门 | 只有 `verified` 进提示词；candidate 必须经人核实 |
-| **I2** | 前缀稳定 | 无写入时，注入段字节级不变（保 KV/prefix cache） |
-| **I3** | 默认零网络 | 除两条可选出网路径外不发请求 |
-| **I4** | 作用域显式 | 读永不越界；不存在"猜出来的"作用域 |
+| **I1** | 注入闸门 | 只有 `status='verified'` 且未过期、未删除的条目进入提示词。`status` 由 store 重新派生，模型无法通过工具断言它。verified 来自**面板/CLI 的人工操作**，或**用户自己消息里逐字存在且与主张有实质关联的引文**（§2.1 的两问闸门）。 |
+| **I2′** | 前缀稳定 | **没有任何写入会重排或改写已有行**；重求值只发生在会话/日边界，绝不在步内。尾部（`as of` 日期、`+N more`、待审提示）允许随写入与 UTC 日期变化。 |
+| **I3** | 默认零网络 | 默认配置下不发任何请求。三条可选出网路径：更新检查、HTTP 向量通道、会话结束的抽取（经宿主 `ctx.llm`，非本进程直连）。前两条默认关闭，第三条默认 `off`。 |
+| **I4′** | 作用域显式 | **会话内的每一项读取都绑定显式键集**，不使用通配。面板/导出枚举全部键，那是**明确的行政通道**（管理员视图），不是会话读取。作用域键由宿主 `session.header.cwd` 派生；该字段缺失时回落进程 cwd —— 这是已知风险，不是保证。 |
+
+> **旧版 I2 / I4 为什么被替换**：I2 原文"无写入时字节级不变"在 UTC 零点自破（尾部日期），且在 TTL 到期时于会话中途静默改变内容；I4 原文"读永不越界"与 `allScopeKeys()` 的通配枚举矛盾。把它们改宽不是妥协，是把判据改到能被代码验证的精度。
+
+## 0.1 每条不变量什么时候会自动失效
+
+§2.1 给拒绝了的东西写了失效信号，却没给四条不变量写 —— 这是结构性的不对称：**唯一被认真对待的判据，是那个被拒绝的**。补齐如下（判定方式与是否有人会注意到，见审计报告 `reports/2026-11-15-boundary-audit.md`）：
+
+| # | 类别 | 依赖什么 | 失效信号 | 会被注意到吗 |
+|---|---|---|---|---|
+| I1 | 结构（数据层）/ 语义依赖 | 宿主持续发 `session/event` 让引文缓冲存在 | 缓冲缺失 → 闸门**更严**（fail-safe，全部变候选）；引文门槛或 `autoVerifyCaptured` 默认值改动 → 闸门**更松** | **不会**。所有单测都桩掉验证器，真实函数只在手动 e2e 里跑过 |
+| I2′ | 结构（排序）/ 经济性依赖 | provider 的 prefix cache 粒度 | provider 改为按段缓存或取消前缀缓存 → 经济理由消失（安全性理由仍在） | **不会**。仓库里没有任何 cache 命中量；`request_stat` 记的是字节数 |
+| I3 | 结构（无直连）/ 计数依赖 | 三个默认布尔值 + 枚举完整性 | 新增经宿主服务的出网（如 `ctx.llm` 的另一处调用）→ grep 门看不见 | **部分**。直接 `fetch` 会挂 CI，宿主中介出网不会 |
+| I4′ | 结构（查询）/ 派生依赖 | `session.header.cwd` 存在性 | 会话创建时不带 cwd → 所有此类会话共享宿主进程目录；深目录超过 12 层 → 项目作用域塌成工作区 | **不会**。doctor 不检查作用域身份，无相关测试 |
+
+**这套机制本身是这次审计最有价值的产出**：判据要带失效条件，否则它只是当时当地的偏好，被后人当成真理。任何新增不变量必须同时写它的失效信号。
 
 ## 1. 已采纳（2026-11 三次发布）
 
@@ -25,7 +42,7 @@
 | Claude Code memory | 索引 + 主题文件两层；正文永不入提示词 | 索引段只放 id/kind/日期/标题，正文靠 `loci_get` | 1.0 |
 | mem0 | 注入字节数作为一等指标 | `request_stat.section_bytes` + 面板注入记录 | 1.0 |
 | mem0 | 截断要吵，不能静默 | `total`/`hasMore`/`cursor` + "还有 N 条" | 1.x |
-| supermemory | 推断事实要人审（approve/decline） | 待审队列 + `verified` 只能人工授予 | 1.3 |
+| supermemory | 推断事实要人审（approve/decline） | 待审队列 + 由 store 派生 `status`；verified 来自人工操作**或**与主张相关的逐字引文（§2.1 两问闸门） | 1.3 |
 | dsh-auto-memory | 4 态信任机 + 逐字证据 | candidate/verified/disputed/superseded + quote 闸门 | 1.3 |
 | dsh-ltm | 修订 CAS、迁移前快照 | `expectedRevision` + `VACUUM INTO` | 1.x |
 | Letta / mem0 | 用量是一等事实（不是装饰） | `memory_usage` 表：inject/read 计数 | 2.1 |
@@ -85,16 +102,14 @@
 
 | 拒绝项 | 来源 | 理由 |
 |---|---|---|
-| 条件注入（`when`/`guard` 自动触发） | `dsh-project-memory`、`supermemory` | 违反 **I2**：每步都可能改段内容，KV 前缀失效；也违反"可预测"的产品承诺。可选折中：`when_condition` 只存不判，供检索与面板显示 |
 | 写入时自动 cosine 合并（0.9 覆盖） | `dsh-project-memory` | 0.9 相似也可能语义相反（"必须做 X" vs "不许做 X"）。我们保留手动 `merge` + 乐观锁 |
 | 空闲"做梦"式整合 | `meow-memory`、Letta `dreaming`、`zzerx` | 后台无监督改写记忆，是"我明明没改它却变了"的来源。**必须有人在场** |
 | 自动 scope 晋升（task→project→global） | `dsh-project-memory` 的两/三次晋升 | 违反 **I4**：作用域由使用次数漂移，跨项目泄漏风险不可接受 |
-| 每轮全量抽取 | `zzerx`、`dsh-cross-memory` 后台抽取 | 每轮一次模型调用 + 每轮一条待审，实测会让人放弃审阅（2.3 的 digest 就是为此而生） |
+| 每轮全量抽取**作为默认** | `zzerx`、`dsh-cross-memory` 后台抽取 | 每轮一次模型调用 + 每轮一条待审，会让人放弃审阅（2.3 的 digest 就是为此而生）。**这一行说的是"不做默认"，不是"永不"**：本项目自己发货了 `extractMode: 'on'|'turn'`，即按需的逐轮抽取。规则正确读法是"默认关闭，开启时必须明说代价" |
 | 把语料正文当注入触发源 | 多家 | 正文可被污染 → 等于让记忆内容决定自己是否入提示词 |
 | 外部记忆服务（Hindsight / Honcho / supermemory 云） | `dsh-hindsight`、mnemon providers | 违反 **I3**；且我们权衡过：一次网络往返换来的召回提升不值得把记忆送出去 |
 | 常驻大块（resident USER.md/MEMORY.md 全文注入） | `dsh-mnemon` | 提示词成本不可控；索引 + 按需取正文是更省的形状 |
 | **代码/文档索引（"读到即索引"）** | `dsh-project-memory`、`basic-memory` | 那是**对仓库内容的 RAG**，不是记忆。加进来会多一条检索通道、一套过期语义和一份"代码的第二份副本"；代码与 AGENTS.md 已是 SSOT，`grep` 比索引更可信 |
-| **自动触发式注入（`when` 命中即注入）** | `dsh-project-memory`、`supermemory` | 只保留"存条件"（见 A1 的 `when_condition`），**不保留"由条件决定是否注入"**；理由见 §2.1，那里也写清了这个判定的适用范围与失效信号 |
 
 ### 2.1 拒绝条件注入：理由、适用范围、失效信号
 
@@ -117,11 +132,15 @@ R-b 只在**正文参与判定**时成立。由人工核实过的结构化字段
 
 #### 可持久的规则（建议按此判定将来任何条件注入提案）
 
-1. **R1 正文永不触发**：存储的标题/正文不得参与"是否注入"的判定。条件只能来自结构化字段，且该字段本身经过核实。
-2. **R2 系统提示段在会话内字节稳定**：任何条件求值不得发生在会话中途。
-3. **R3 只允许在会话边界求值**，且输入必须是可复现快照（同一会话重放得到同一结果；不得由随机数或漂移的时间窗决定）。
-4. **R4 可解释**：每条被条件选中的条目，必须在面板或审计里回答"为什么这次出现"。
-5. **R5 可选且有界**：默认关闭、有字节上限、可随时关掉，关掉后行为与无此功能完全一致。
+**R1 与 R3 的旧措辞已被代码推翻，这里是修正版。**旧 R1 说"正文永不触发"，但已发货的 `recallAssist` 正是按正文 FTS 命中决定注入 —— 项目一边立规矩一边违反它。旧 R2 说"系统段会话内不变"，而待审计数在渲染缓存键里，这正是**故意**让它随写入变化。规矩要与实现一致，否则它只是一句愿望。
+
+1. **R1 正文不参与注入选取**（限定为索引段）：**索引段**的选取不读正文 —— SELECT 里没有 body，只有 id/kind/date/title。`recallAssist` 是**明确的例外**：按正文检索、每会话一次、注入为 user message、有字节上限、默认关闭。例外不算违规，前提是它被写下来且被单独约束（R3′/R4/R5）。将来任何按正文选取注入集的提案，仍然按拒绝处理。
+2. **R2 提前一个边界，而非禁止改变**：条件求值不得发生在**步内**；允许发生在会话/日边界。已发货的待审计数是**边界例外**：它随写入变化，代价是前缀可能失效，这是知情选择（§2.1 R-a 记为未测量的经济赌注），不是疏忽。
+3. **R3 只允许在会话边界求值**，且输入必须是可复现快照。**当前 `recallAssist` 只满足前半句**：它读实时库并用墙钟做时效加权，同一库重放可能得到不同排序。所以 R3 目前是一条**待实现**的规则，不是已满足的事实。
+4. **R4 可解释**：每条被条件选中的条目，必须在面板或审计里回答"为什么这次出现"。**索引段满足；`recallAssist` 不满足** —— 它不写 `request_stat`、不写 `memory_usage`，审计行里没有 id 也没有 session。这是待补的缺口。
+5. **R5 可选且有界**：默认关闭、有字节上限、可随时关掉。**已满足**（`recallAssist` 默认 `off`，`recallAssistBytes` 默认 512、上限 2048，每会话一次）。
+
+> 修正原则：一条规则如果代码违反它、且没有任何测试或检查发现，那么真正生效的不是规则，是代码。把规则改成代码实际的样子（并标明待补的部分），比保留一句漂亮话有用。
 
 #### 什么时候这条拒绝会自动失效（失效信号）
 

package/docs/PRIVACY.md

@@ -23,12 +23,17 @@ anything from a session that is not the root session of a conversation.
 Nothing, by default. There is no telemetry, no analytics, and no network call in the
 plugin's normal path.
 
-Two things can reach the network, and both are opt-in:
+Three things can reach the network, and all are opt-in:
 
 | Path | When | What is sent | How to disable |
 |---|---|---|---|
-| Update check | only when you press "check for updates" on the sidebar card | one `GET https://registry.npmjs.org/dsh-loci/latest`; no query string, no identifier | `updateCheck: false`, or simply never press it |
+| Update check | only when you press "check for updates" on the sidebar card | one `GET https://registry.npmjs.org/dsh-loci/latest`; no query string, no identifier | `updateCheck: false` (the default), or simply never press it |
 | Embedding channel | only when `vectorMode` is `http` and an endpoint is configured | the text of the memory being embedded | leave `vectorMode` at `off` |
+| Session extraction | only when `extractMode` is `on`/`turn`/`session`, at session end | up to 12 KB of the recent conversation, to the model your Host is already configured with — through the Host's own `llm` service, not a connection this plugin opens | leave `extractMode` at `off` (the default) |
+
+The third path was missing from this page for two releases. It is not a third party —
+it goes to the same model provider the session itself is talking to — but "two things"
+was a count, and the count was wrong.
 
 Opening the panel or the card does **not** contact the registry - the version
 badge renders what is installed, and the update answer is served from a local

package/docs/SECURITY.md

@@ -17,7 +17,7 @@ file sandbox, approval policy) are the Harness's and are assumed to work.
 | T6 | The panel API is reachable from another origin | Local admin surface exposed to a web page | exact `connection.fetch` route (owner Peer, same-origin fence), JSON-only writes, 256 KB body cap, no CORS headers |
 | T7 | Data written outside the Harness home | Un-backed-up, un-scoped secrets | single root `$DSH_HOME/memory/loci/`, every path asserted with `assertInside` |
 | T8 | A write blocks the agent loop | Turn hangs | WAL + bounded busy timeout + six retries; transactions are single-digit milliseconds; capture is debounced and never awaited by the turn |
-| T9 | Memory exfiltration over the network | Privacy breach | two opt-in paths only, both off by default: the update check (`updateCheck`, one `GET` of the package metadata, carries nothing about memory) and the HTTP embedding channel (`vectorMode: 'http'`, endpoint user-configured, failure parks the channel). No other request exists — `docs/PRIVACY.md` §3 lists both |
+| T9 | Memory exfiltration over the network | Privacy breach | three opt-in paths, all off by default: the update check (`updateCheck`, one `GET` of the package metadata, carries nothing about memory), the HTTP embedding channel (`vectorMode: 'http'`, endpoint user-configured, failure parks the channel), and session extraction (`extractMode`, up to 12 KB of recent conversation to the Host's own model service at session end). No other request exists — `docs/PRIVACY.md` §3 lists all three |
 | T10 | Unbounded growth | Token cost creep | hard byte budget, pinned/rule caps, soft per-scope cap option |
 
 ## 2. The trust gate, precisely
@@ -26,8 +26,11 @@ A memory is injected only when `status = 'verified'`. Status is derived, not
 declared:
 
 - `trust_source = 'user'` (a human asserted it in the panel) → `verified`;
-- a tool write with an `evidenceQuote` of ≥8 characters that is still findable in
-  **the user's own messages of the live session** → `verified`;
+- a tool write with an `evidenceQuote` of ≥8 characters that is findable in **the
+  user's own messages of the live session** *and* shares substance with the claim
+  (≥5% character-bigram overlap) → `verified`; a quote that is real but unrelated to
+  the claim stays a candidate, because quoting a real sentence is the cheapest way to
+  launder a fabricated fact;
 - anything else → `candidate`;
 - instruction-shaped text → `disputed`;
 - imported or summarized text → `candidate`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-loci",
-  "version": "2.4.1",
+  "version": "2.6.0",
   "description": "Layered long-term memory for DeepSeek Harness: the prompt sees only a stable index, full text is one lookup away. Bi-temporal facts, strict scope isolation, verified-only injection.",
   "type": "module",
   "license": "MIT",

package/scripts/cli.mjs

@@ -63,6 +63,7 @@ const COMMANDS = new Set([
   'migrate',
   'rollback',
   'purge',
+  'verify',
   'snapshot',
   'snapshots',
   'help',
@@ -201,10 +202,38 @@ switch (command) {
         console.log(`candidates ${candidates.total} · disputed ${disputed.total}`);
         for (const item of candidates.items) console.log(`  candidate ${item.id} · ${item.title}`);
         for (const item of disputed.items) console.log(`  disputed  ${item.id} · ${item.title}`);
+        if (candidates.total > 0 || disputed.total > 0) {
+          console.log('');
+          console.log('approve with: dsh-loci verify --id <id>            (or in the panel: Memory → Review)');
+          console.log('reject  with: dsh-loci verify --id <id> --status disputed');
+        }
       }
     });
     break;
   }
+  // A person approving a candidate. The tool surface deliberately has no equivalent —
+  // the model must never be able to grant trust — so before this command a terminal-only
+  // or MCP user could create candidates forever and never promote one. The panel is the
+  // GUI door; this is the other one, and both are human-typed.
+  case 'verify': {
+    const id = flag('id');
+    if (id === undefined || id === '') {
+      console.error('verify needs --id <memory id>');
+      process.exitCode = 2;
+      break;
+    }
+    const status = flag('status') ?? 'verified';
+    if (!['verified', 'disputed', 'candidate'].includes(status)) {
+      console.error(`unknown status: ${status}; expected verified, disputed or candidate`);
+      process.exitCode = 2;
+      break;
+    }
+    await withStore((store) => {
+      const result = store.setTrust(id, status, { actor: 'cli' });
+      emit(result, `${id} → ${status}`);
+    });
+    break;
+  }
   case 'export': {
     await withStore((store) => {
       const result = exportMarkdown(store, paths);
@@ -340,6 +369,7 @@ switch (command) {
   snapshot [--label <name>]
   migrate [--target <n>]
   rollback [--from <snapshot>]
+  verify --id <id> [--status verified|disputed|candidate]
   purge --id <id> --confirm <id> [--allow-hard-delete]
 
 options: --home <path>  --json   (either may come before or after the command)

package/src/host/api/routes.js

@@ -179,8 +179,12 @@ export function registerApiRoutes(ctx, deps) {
     const statuses = status === 'any' || status === null
       ? ['verified', 'candidate', 'disputed']
       : status.split(',').filter(Boolean);
-    const kind = url.searchParams.get('kind');
-    const kinds = kind === null || kind === 'all' ? undefined : kind.split(',').filter(Boolean);
+    // Accept both spellings. The panel sent `kinds=` while this read `kind=`, so the
+    // review tab's "only injectable kinds" filter was a no-op: every session summary
+    // showed up in a queue that was designed to exclude them. A silently ignored query
+    // parameter is the kind of bug that only shows up as "the list is full of noise".
+    const kindParam = url.searchParams.get('kinds') ?? url.searchParams.get('kind');
+    const kinds = kindParam === null || kindParam === 'all' ? undefined : kindParam.split(',').map((entry) => entry.trim()).filter(Boolean);
     if (query.trim().length > 0) {
       const result = await search(store, {
         query,

package/src/host/commands.js

@@ -92,7 +92,13 @@ export function registerCommands(ctx, deps) {
             const lines = [`candidates: ${pending.total}`, `disputed: ${disputed.total}`];
             for (const item of pending.items.slice(0, 15)) lines.push(`  candidate ${item.id} · ${item.title}`);
             for (const item of disputed.items.slice(0, 15)) lines.push(`  disputed  ${item.id} · ${item.title}`);
-            lines.push('verify with: loci_write op:"verify" id:<id>');
+            // Point at things that exist. This used to say `loci_write op:"verify"`,
+            // an operation the tool has never had and must not have — the model is not
+            // allowed to grant trust. A person approves in the panel, or from a
+            // terminal with the CLI, which is where the authority actually lives.
+            lines.push('');
+            lines.push('approve in the panel: Memory → Review');
+            lines.push('or from a terminal:   dsh-loci verify --id <id> [--status disputed]');
             return { kind: 'success', text: lines.join('\n') };
           }
           case 'export': {

package/src/host/doctor.js

@@ -10,8 +10,37 @@ import { accessSync, constants, existsSync, readdirSync, statSync } from 'node:f
 import { join } from 'node:path';
 import { findDuplicateGroups } from './store/duplicates.js';
 import { detectInstructionLike, renderSafe } from './inject/sanitize.js';
+import { compareVersions } from './update.js';
 
 /** One check result. */
+/**
+ * Decide whether a host version falls inside a declared range.
+ *
+ * Only the comparisons `engines.dsh` actually uses are supported — `>=X <Y` and
+ * `>=X <Y-0` — because a full semver implementation is a dependency this plugin does
+ * not otherwise need. Anything else returns `unknown` and the caller assumes fine: a
+ * doctor row must never fail on a range it cannot read.
+ *
+ * @param version - the host version string.
+ * @param range - `engines.dsh`, e.g. `>=0.2.2-rc.1 <0.3.0-0`.
+ * @returns `'inside' | 'outside' | 'unknown'`.
+ */
+function checkAgainstRange(version, range) {
+  if (typeof range !== 'string' || typeof version !== 'string') return 'unknown';
+  const lower = /(?:^|\s)(>=)\s*([0-9][^\s]*)/.exec(range);
+  const upperLt = /(?:^|\s)<\s*([0-9][^\s]*)/.exec(range);
+  const upperLe = /(?:^|\s)<=\s*([0-9][^\s]*)/.exec(range);
+  if (lower === null && upperLt === null && upperLe === null) return 'unknown';
+  const compare = (a, b) => compareVersions(a, b);
+  // `compareVersions(a, b) > 0` means b is newer than a.
+  // lower bound: outside when the version is below it.
+  if (lower !== null && compare(lower[2], version) < 0) return 'outside';
+  // upper `<`: outside when the version is at or above it.
+  if (upperLt !== null && compare(version, upperLt[1]) <= 0) return 'outside';
+  // upper `<=`: outside only when strictly above it.
+  if (upperLe !== null && compare(version, upperLe[1]) < 0) return 'outside';
+  return 'inside';
+}
 function check(name, status, detail) {
   return { name, status, detail };
 }
@@ -64,15 +93,28 @@ export function runDoctor(options) {
   const lastMaintenance = Number(health.migration?.to === undefined ? 0 : 0);
   checks.push(check('rows', 'ok', `${health.counts.memory} revisions · ${health.counts.memory_head} entries · ${health.counts.entity} entities`));
 
-  // Which Harness opened this store. A range in engines.dsh is a promise; this row
-  // is what actually happened, and it is the first thing to ask for in a bug report.
+  // Which Harness opened this store, and whether that version is inside the range this
+  // build declares. The row used to print `[ok]` for any version at all, which made it
+  // a warning surface that could never warn — the exact shape of check that survives
+  // review because it looks like engineering.
   try {
     const hostVersion = store.hostVersion ?? null;
-    checks.push(
-      hostVersion === null
-        ? check('host', 'warn', `not recorded yet; this build declares engines.dsh ${engines?.dsh ?? 'unknown'}`)
-        : check('host', 'ok', `last opened by DeepSeek Harness ${hostVersion}`),
-    );
+    if (hostVersion === null) {
+      checks.push(check('host', 'warn', `not recorded yet; this build declares engines.dsh ${engines?.dsh ?? 'unknown'}`));
+    } else {
+      const verdict = checkAgainstRange(hostVersion, engines?.dsh);
+      checks.push(
+        verdict === 'inside'
+          ? check('host', 'ok', `last opened by DeepSeek Harness ${hostVersion} (inside ${engines?.dsh})`)
+          : verdict === 'outside'
+            ? check(
+                'host',
+                'warn',
+                `last opened by DeepSeek Harness ${hostVersion}, outside the declared ${engines?.dsh}; memory may misbehave`,
+              )
+            : check('host', 'ok', `last opened by DeepSeek Harness ${hostVersion} (range not parsed; assumed fine)`),
+      );
+    }
   } catch (error) {
     checks.push(check('host', 'warn', `could not read: ${String(error?.message ?? error)}`));
   }

package/src/host/index.js

@@ -23,7 +23,7 @@ import { registerCommands } from './commands.js';
 import { runDoctor } from './doctor.js';
 
 /** Version stamped into the database and diagnostics. */
-export const VERSION = '2.4.1';
+export const VERSION = '2.6.0';
 
 /** Optional collaborators; without them the plugin still serves tools. */
 export const inject = ['systemPrompt', 'tools'];

package/src/host/store/store.js

@@ -876,7 +876,7 @@ export class Store {
    * @param scopeKeys - explicit scope keys (never a wildcard).
    * @returns the count of candidate and disputed entries.
    */
-  countPending(scopeKeys) {
+  countPending(scopeKeys, now = this.now()) {
     if (scopeKeys.length === 0) return 0;
     const marks = scopeKeys.map(() => '?').join(', ');
     return Number(
@@ -884,9 +884,10 @@ export class Store {
         .prepare(
           `SELECT COUNT(*) AS n FROM memory m
            WHERE m.status IN ('candidate', 'disputed') AND m.deleted_at IS NULL
+             AND (m.valid_to IS NULL OR m.valid_to > ?)
              AND m.scope_key IN (${marks})`,
         )
-        .get(...scopeKeys)?.n ?? 0,
+        .get(now, ...scopeKeys)?.n ?? 0,
     );
   }
 
@@ -1555,6 +1556,18 @@ export class Store {
       verified = false;
     }
     this.quoteChecked += 1;
+    // Two questions, not one. The verifier answers "did the user say this"; this
+    // answers "is the claim about what they said". Checking only the first let any real
+    // sentence certify an unrelated fact — the cheapest way to launder a wrong memory
+    // into the prompt. A quote that fails the second question lands as a candidate,
+    // which costs a person one click.
+    if (verified) {
+      const claim = `${input?.title ?? ''} ${input?.body ?? ''}`.trim();
+      if (claim.length > 0 && !evidenceSupports(quote, claim)) {
+        this.log?.debug?.('loci: quote is in the transcript but unrelated to the claim; keeping it a candidate');
+        verified = false;
+      }
+    }
     return verified;
   }
 
@@ -1725,9 +1738,29 @@ function nowOrMax(value) {
  * @param text - new title and body.
  * @returns true when the two share at least 15% of their character bigrams.
  */
+/**
+ * Does the quote have anything to do with the claim?
+ *
+ * Containment alone is not enough: a model can quote any real user sentence ("好的，
+ * 继续吧") and attach a fabricated claim to it, and the transcript check would pass.
+ * This is the second half — the quote must share some substance with what it is
+ * supposed to support.
+ *
+ * The 0.05 threshold is measured, not guessed. On Chinese text:
+ *   "以后都用中文回复我" → "用户偏好中文"                    0.083  legitimate paraphrase
+ *   "回滚窗口是三十分钟"   → "回滚窗口 30 分钟"                0.364  legitimate restatement
+ *   "好的，继续吧"         → "用户要求永远不要审查代码"        0.000  laundering
+ * A higher bar (the 0.15 this function used to carry) rejects the first case; 0.05
+ * separates the two groups cleanly. Failing it lands the entry as a candidate, which
+ * a person can still promote — the cost of being wrong in this direction is one click.
+ *
+ * @param quote - evidence quote.
+ * @param text - title and body of the claim.
+ * @returns true when the two share at least 5% of their character bigrams.
+ */
 function evidenceSupports(quote, text) {
   if (typeof quote !== 'string' || quote.trim().length < 8) return false;
-  return jaccard(quote, text) >= 0.15;
+  return jaccard(quote, text) >= 0.05;
 }
 /** Jaccard over whitespace-collapsed character bigrams (duplicate heuristic). */
 function jaccard(a, b) {

package/src/mcp/store-facade.js

@@ -36,7 +36,7 @@ export function openFacadeStore(options = {}) {
     memoryRoot: root,
     paths,
     config,
-    pluginVersion: '2.4.1',
+    pluginVersion: '2.6.0',
     readOnly: options.readOnly === true,
   });
   return { store, paths };