dsh-memento 0.5.23 → 0.5.25

package/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.25] - 2026-10-12
+
+### Changed
+
+- **Compatibility baseline raised to `0.2.1-alpha.2`** (the newest published host line, `dsh-v0.2.1-alpha.2`, released 2026-10-09). The `@deepseek-ai/dsh-*` dev/test pins move from `0.2.1-alpha.1` to `0.2.1-alpha.2`, `dshWorkshop.compatibility.dshVersions` appends `0.2.1-alpha.2` after `0.2.1-alpha.1`, and `pnpm-workspace.yaml`'s `minimumReleaseAgeExclude` allowlist gains `|| 0.2.1-alpha.2` on 20 package rows — the alpha.2 packages are younger than the release-age window, so pnpm refuses them without the explicit exemption. The declared peer ranges and `engines.dsh` are **unchanged**: the existing `>=0.2.1-0 <0.3.0` clause already admits alpha.2, and nothing was narrowed. Both lockfiles are regenerated for the new pins.
+- **No code change was needed, and that is a verified result rather than an assumption.** Every plugin-facing seam this package touches is byte-identical between `dsh-v0.2.1-alpha.1` and `dsh-v0.2.1-alpha.2`: `packages/settings/settings/src/**`, `packages/api/settings-controller/src/**`, `packages/client/ui-settings/src/**` (the whole `configForms` implementation, including `SettingsForms.configure` at `src/index.ts:266` and the write admission at `:377-423`), `packages/client/ui-slots/src/**`, `packages/client/modules/src/**` (the `__ModuleLoader__.load({id, factory})` handshake), `packages/client/store/src/**`, `packages/interaction/user-approval/**` (the approval seam: `request` at `src/index.ts:215`, outcomes at `types.ts:32`, and the `approval/asked` + `approval/decided` audit events at `:225`/`:232`), `packages/core/system-prompt/src/**` (`PromptSection` at `src/index.ts:53`, the synchronous section provider, `SECTION_ORDERS` with order `-50` untouched), `vendor/loader/src/**` (`equalExceptVolatile`, the `loader/volatile-update` commit path), `vendor/schemastery/src/**` (`.volatile()` at `src/index.ts:480-483`), `vendor/cordis/src/**` (`ctx.provide`), `packages/boot/app-boot/src/config-schema/**` and `packages/storage/**` (package.json version bumps only). `SESSION_FORMAT_VERSION` is still 4 and no `v4-to-v5` migration package exists, so a log this package reads is unchanged in shape; `KNOWN_SESSION_EVENT_TYPES` gained exactly one first-party type (`working-directory/change`), so the adaptive audit gate still evaluates `memory/*` as unknown and the audit chain stays on the approval seam plus the plugin's own audit table.
+- **Reviewed and deliberately not adopted: alpha.2's `appendPluginRecord`.** It is the first host-side record writer a plugin could use (`appendPluginRecord(session, 'plugin:<name>/*', data)`, self-stamping `ignorable`), but the host's own `packages/core/session/README.md` states that plugins outside the repository must not call it, and the mandatory `plugin:` prefix cannot express this package's declared `memory/added|updated|removed|recalled|snapshot` vocabulary. The once-per-process gate warning in `index.mjs` now names that writer, so the next reader does not conclude the host has no writer at all. Two further non-changes are deliberate: the memory snapshot stays a **`systemPrompt` section** rather than moving to a `PromptContext` — contexts are re-read at every admission refresh (`refreshContext`), which would forfeit the once-per-session freeze — and the loop's removal of the `{{cwd}}` prompt variable cannot bite this package, whose snapshot text resolves no prompt variables and whose `session.header.cwd` read is the sanctioned "original project identity" use.
+- Verified on the new line: `npm test` **201/201** (including `composition.test.mjs`, which drives the real vendored Loader through the Include builtin), `npm run typecheck:ci` (published alpha.2 types), `npm run check:coverage`, `npm run verify:artifacts`, `npm run verify:self-contained`, `npm run check:readmes`, `npm run check:lockfile` and `npm run test:conformance` (22/22). Documentation, pins and one console warning string; no behavioural change.
+
+
+## [0.5.24] - 2026-10-12
+
+### Changed
+
+- **Documentation-only release**, the same shape as `0.5.20`: the package page no longer carries a maintenance-status banner or a rival comparison table — `dsh-memento` is documented as an actively maintained member of the family (34 active of 42), the way every other active plugin is, and the family tables in the sibling repositories state 34 active / 5 frozen / 3 retired with this package's row carrying no status cell. Published deliberately against the usual "release only for an install-breaking defect" rule, because npm serves this README as the package page: a wrong public statement there is a defect of its own. No code, dependency or behaviour change, and existing installs need no migration.
+- Credits [@alex-debap](https://github.com/alex-debap) in the Contributors section of all five READMEs, for work that starts at the 0.1.0 conception stage: the seam-not-warehouse thesis, the structurally unbypassable approval gate, the audit guarantee rebuildable from the approval pair plus the plugin audit table, the bounded layered recall model, local-first zero-credential storage, and the public protocol rehearsal with its adapter registry and conformance suite.
+
+  The published tarball differs from 0.5.23 in `README*`, `CHANGELOG.md` and `package.json` only.
+
+
 ## [0.5.23] - 2026-10-10
 
 ### Changed

package/README-es.md

@@ -47,34 +47,11 @@ Una costura tipada `ctx.memory`, una puerta de aprobación de escritura que ning
 
 *La misma ejecución, animada.*
 
-## Estado de mantenimiento: 🧊 CONGELADO
-
-> **Congelado el 2026-10-05. Sin nuevas funciones.** Este paquete sigue funcionando y **no está retirado**, pero ya no recibe trabajo de funciones; solo se corregirá una avería real.
-
-Los mantenedores consideran que en esta capacidad **ya existen alternativas con mejor adopción**, así que el esfuerzo se ha trasladado. Comparativa medida el 2026-10-05:
-
-| | paquete | descargas semanales |
-|---|---|---|
-| **este paquete** | `dsh-memento` | 1,202 |
-| alternativa mejor adoptada | [`@openviking/dsh-memory-plugin`](https://github.com/volcengine/OpenViking) | **10,160** |
-| otra alternativa | `dsh-prime-memory` | 6,157 |
-| otra alternativa | `@a9i5k4/dsh-auto-memory` | 4,781 |
-
-👉 **Para trabajo nuevo, prefiera cualquiera de las anteriores, pero compruebe antes la barrera de compatibilidad.** Las instalaciones existentes siguen funcionando sin cambios.
-
-*Evidencia completa: `dsh-plugin-supersession-review-20261005.md`. Texto completo en la sección **Maintenance status: 🧊 FROZEN** de [README.md](README.md).*
-
-## Comparison
-
-![Gráfico comparativo medido de dsh-memento](https://raw.githubusercontent.com/PerryLink/dsh-memento/main/docs/assets/dsh-memento-evidence.png)
-
-measured 2026-10-05 · from the README's FROZEN maintenance table (npm weekly downloads)
-
 ## Compatibility
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1` (adaptado el 2026-10-04): la línea `0.1.7` sustituyó toda la superficie de registro de ajustes (`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`) por formularios de config en vivo, así que ambas mitades siguen el contrato nuevo — el namespace de un formulario es el id de la entrada del perfil (`memento`), sus campos editables son los marcados `.volatile()` y una edición aceptada se confirma **dentro del plugin en ejecución** en lugar de remontarlo. La mitad de navegador lee ese formulario con `ctx.configForms.get(entryId)` (el servicio `ctx.settingsScope` ya no existe). Ambas mitades conservan sus ramas `installSection` / `settingsScope` para las líneas `0.1.2-rc.1`, `0.1.5-alpha.1` y `0.1.6-0` que el rango de peers sigue anunciando, y la nueva cláusula `>=0.1.7-0 <0.2.0` es lo que hace instalable al propio host objetivo (el rango anterior lo excluía por la regla de semver sobre versiones preliminares). Sigue sin haber superficie de registro de eventos para plugins — `KNOWN_SESSION_EVENT_TYPES` no incluye `memory/*` y el tercer argumento de `Session.append` solo lleva un `SurfaceIntent` para tipos de superficie, así que la puerta de auditoría sigue siendo adaptativa y se salta igual (lo dice una vez por proceso y en `/memory audit`). La evidencia de tipos viene de tres caras: los tipos ya compilados del checkout local, la línea publicada fijada en `node_modules` y la mitad de navegador bajo una lib DOM. |
+| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.2` (adaptado el 2026-10-12; `0.2.1-alpha.1` desde el 2026-10-04): la línea `0.1.7` sustituyó toda la superficie de registro de ajustes (`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`) por formularios de config en vivo, así que ambas mitades siguen el contrato nuevo — el namespace de un formulario es el id de la entrada del perfil (`memento`), sus campos editables son los marcados `.volatile()` y una edición aceptada se confirma **dentro del plugin en ejecución** en lugar de remontarlo. La mitad de navegador lee ese formulario con `ctx.configForms.get(entryId)` (el servicio `ctx.settingsScope` ya no existe). Ambas mitades conservan sus ramas `installSection` / `settingsScope` para las líneas `0.1.2-rc.1`, `0.1.5-alpha.1` y `0.1.6-0` que el rango de peers sigue anunciando, y la nueva cláusula `>=0.1.7-0 <0.2.0` es lo que hace instalable al propio host objetivo (el rango anterior lo excluía por la regla de semver sobre versiones preliminares). Sigue sin haber superficie de registro de eventos para plugins — `KNOWN_SESSION_EVENT_TYPES` no incluye `memory/*` y el tercer argumento de `Session.append` solo lleva un `SurfaceIntent` para tipos de superficie, así que la puerta de auditoría sigue siendo adaptativa y se salta igual (lo dice una vez por proceso y en `/memory audit`). La evidencia de tipos viene de tres caras: los tipos ya compilados del checkout local, la línea publicada fijada en `node_modules` y la mitad de navegador bajo una lib DOM. **Reverificado contra `0.2.1-alpha.2`:** todas las costuras del host que toca este paquete son **idénticas byte a byte** entre las dos etiquetas (`packages/settings/settings/src/**`, `packages/client/ui-settings/src/**`, `packages/client/ui-slots/src/**`, `packages/client/modules/src/**`, `packages/interaction/user-approval/**`, `vendor/loader/src/**`, `vendor/schemastery/src/**`, `packages/boot/app-boot/src/config-schema/**`), el formato de sesión sigue siendo v4 sin migración v4→v5, y `KNOWN_SESSION_EVENT_TYPES` solo ganó un tipo de primera parte — así que la puerta de auditoría adaptativa sigue cerrada y **no hizo falta ningún cambio de código**. Lo que se movió es la línea fijada de dev/test (`0.2.1-alpha.2`, más sus entradas en la lista de permitidos por antigüedad de `pnpm-workspace.yaml`) y la línea base de compatibilidad; `npm test` (201 casos, incluida la suite de composición con el Loader real), `typecheck:ci`, cobertura, artefactos, conformidad y las puertas de cinco idiomas pasan contra ella. alpha.2 sí añade un escritor `appendPluginRecord` en el espacio de nombres `plugin:<name>/*`, pero el propio `packages/core/session/README.md` del host prohíbe llamarlo a los plugins externos al repositorio y el prefijo obligatorio `plugin:` no puede expresar `memory/*`, así que este paquete no lo adopta. |
 | Node | `^22.19.0 || >=24.0.0` |
 | Platforms | Windows / macOS / Linux (solo host; sin código nativo, sin red) |
 | Model | Cualquiera |
@@ -309,10 +286,11 @@ Evidencia estática: `dsh-plugin-doctor` K10–K13 dan `pass` en todas las compr
 ## Contributors
 
 - [@Niuniu-Sir](https://github.com/Niuniu-Sir) — el informe de fallo de arranque en [issue #1](https://github.com/PerryLink/dsh-memento/issues/1) que llevó al fallback `~/.dsh` incluido en 0.3.1.
+- [@alex-debap](https://github.com/alex-debap) — presente desde la etapa de concepción de la 0.1.0: la tesis de la costura y no otro almacén, la insistencia en que la puerta de aprobación sea estructuralmente ineludible y una auditoría reconstruible desde el par de aprobación más la tabla de auditoría del plugin. Nombró el modelo de recuerdo acotado y por capas, defendió el almacenamiento local primero y sin credenciales, y llevó el ensayo del protocolo al espacio público con un registro de adaptadores y una suite de conformidad.
 
 ## PerryLink DSH Plugin Family
 
-Este proyecto es uno de los **33 plugins activamente mantenidos** de DeepSeek Harness de [PerryLink](https://github.com/PerryLink): el registro tiene **42**, de los cuales **6** están congelados y **3** retirados; cada uno conserva su fila abajo, con el motivo en la columna Estado. Si este te ayuda, probablemente los demás también:
+Este proyecto es uno de los **34 plugins activamente mantenidos** de DeepSeek Harness de [PerryLink](https://github.com/PerryLink): el registro tiene **42**, de los cuales **5** están congelados y **3** retirados; cada uno conserva su fila abajo, con el motivo en la columna Estado. Si este te ayuda, probablemente los demás también:
 
 | Plugin | En una línea | Estado |
 |---|---|---|
@@ -340,7 +318,7 @@ Este proyecto es uno de los **33 plugins activamente mantenidos** de DeepSeek Ha
 | **[dsh-lsp-actions](https://github.com/PerryLink/dsh-lsp-actions)** | LSP diagnostics, formatting, completion, code actions and rename over language servers | |
 | **[dsh-mask](https://github.com/PerryLink/dsh-mask)** | PII masking middleware: anonymize at the model boundary, restore at the display layer | |
 | **[dsh-mcp-panel](https://github.com/PerryLink/dsh-mcp-panel)** | Read-only MCP runtime panel: /mcp command + Settings tab with status, tools and errors | |
-| **[dsh-memento](https://github.com/PerryLink/dsh-memento)** | Approval-gated cross-session memory: ctx.memory seam + SQLite + memory tool | 🧊 CONGELADO — ver el README del repositorio |
+| **[dsh-memento](https://github.com/PerryLink/dsh-memento)** | Approval-gated cross-session memory: ctx.memory seam + SQLite + memory tool | |
 | **[dsh-observe](https://github.com/PerryLink/dsh-observe)** | OpenTelemetry and Langfuse observability exporter for DeepSeek Harness. | |
 | **[dsh-output-styles](https://github.com/PerryLink/dsh-output-styles)** | Claude Code outputStyles-equivalent runtime style switching | |
 | **[dsh-permission-rules](https://github.com/PerryLink/dsh-permission-rules)** | Claude Code-style declarative allow/deny/ask permission rules with audit | |

package/README-hi.md

@@ -47,34 +47,11 @@ DeepSeek Harness के लिए परिबद्ध, स्तरित, अ
 
 *वही रन, एनिमेटेड।*
 
-## रखरखाव स्थिति: 🧊 फ़्रीज़
-
-> **2026-10-05 से फ़्रीज़। कोई नई सुविधा नहीं।** यह पैकेज अभी भी काम करता है और **सेवानिवृत्त नहीं है**, पर अब इसमें नई सुविधाओं का काम नहीं होगा; केवल वास्तविक खराबी ठीक की जाएगी।
-
-रखरखावकर्ताओं का मानना है कि इस क्षमता में **अधिक अपनाए गए विकल्प अब मौजूद हैं**, इसलिए प्रयास अन्यत्र स्थानांतरित किया गया। 2026-10-05 को मापी गई तुलना:
-
-| | पैकेज | साप्ताहिक डाउनलोड |
-|---|---|---|
-| **यह पैकेज** | `dsh-memento` | 1,202 |
-| अधिक अपनाया गया विकल्प | [`@openviking/dsh-memory-plugin`](https://github.com/volcengine/OpenViking) | **10,160** |
-| अन्य विकल्प | `dsh-prime-memory` | 6,157 |
-| अन्य विकल्प | `@a9i5k4/dsh-auto-memory` | 4,781 |
-
-👉 **नए काम के लिए ऊपर दिए गए किसी भी विकल्प को प्राथमिकता दें — पर पहले संगतता गार्ड जाँच लें।** मौजूदा इंस्टॉल बिना किसी बदलाव के काम करते रहेंगे।
-
-*पूर्ण प्रमाण: `dsh-plugin-supersession-review-20261005.md`। पूरा पाठ [README.md](README.md) के **Maintenance status: 🧊 FROZEN** अनुभाग में।*
-
-## Comparison
-
-![dsh-memento का मापा गया तुलना चार्ट](https://raw.githubusercontent.com/PerryLink/dsh-memento/main/docs/assets/dsh-memento-evidence.png)
-
-measured 2026-10-05 · from the README's FROZEN maintenance table (npm weekly downloads)
-
 ## Compatibility
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1` (2026-10-04 को अनुकूलित): `0.1.7` लाइन ने पूरी सेटिंग्स पंजीकरण सतह (`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`) को लाइव कॉन्फ़िग फ़ॉर्म से बदल दिया, इसलिए दोनों आधे नया अनुबंध अपनाते हैं — फ़ॉर्म का namespace प्रोफ़ाइल प्रविष्टि की id (`memento`) है, संपादन-योग्य फ़ील्ड `.volatile()` वाले हैं, और स्वीकृत संपादन प्लगइन को रीमाउंट करने के बजाय **चल रहे प्लगइन में** लागू होता है। ब्राउज़र आधा वही फ़ॉर्म `ctx.configForms.get(entryId)` से पढ़ता है (`ctx.settingsScope` सेवा हट चुकी है)। दोनों आधे `installSection` / `settingsScope` शाखाएँ उन `0.1.2-rc.1`, `0.1.5-alpha.1` और `0.1.6-0` लाइनों के लिए बनाए रखते हैं जिन्हें peer रेंज अब भी घोषित करती है, और नई `>=0.1.7-0 <0.2.0` शर्त ही लक्ष्य होस्ट को स्थापित-योग्य बनाती है (पुरानी रेंज semver के प्रीरिलीज़ नियम से उसे बाहर कर देती थी)। प्लगइन इवेंट पंजीकरण सतह अब भी नहीं है — `KNOWN_SESSION_EVENT_TYPES` में `memory/*` नहीं है, और `Session.append` का तीसरा तर्क केवल सरफ़ेस-योग्य प्रकारों के लिए `SurfaceIntent` ले जाता है, इसलिए ऑडिट द्वार अनुकूली रहता है और पहले जैसे छोड़ देता है (यह प्रति प्रोसेस एक बार और `/memory audit` में बताता है)। टाइप प्रमाण तीन फ़ेस से आता है: स्थानीय checkout के बने टाइप, `node_modules` में पिन की गई प्रकाशित लाइन, और DOM लाइब्रेरी के अंतर्गत ब्राउज़र आधा। |
+| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.2` (2026-10-12 को अनुकूलित; `0.2.1-alpha.1` 2026-10-04 से): `0.1.7` लाइन ने पूरी सेटिंग्स पंजीकरण सतह (`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`) को लाइव कॉन्फ़िग फ़ॉर्म से बदल दिया, इसलिए दोनों आधे नया अनुबंध अपनाते हैं — फ़ॉर्म का namespace प्रोफ़ाइल प्रविष्टि की id (`memento`) है, संपादन-योग्य फ़ील्ड `.volatile()` वाले हैं, और स्वीकृत संपादन प्लगइन को रीमाउंट करने के बजाय **चल रहे प्लगइन में** लागू होता है। ब्राउज़र आधा वही फ़ॉर्म `ctx.configForms.get(entryId)` से पढ़ता है (`ctx.settingsScope` सेवा हट चुकी है)। दोनों आधे `installSection` / `settingsScope` शाखाएँ उन `0.1.2-rc.1`, `0.1.5-alpha.1` और `0.1.6-0` लाइनों के लिए बनाए रखते हैं जिन्हें peer रेंज अब भी घोषित करती है, और नई `>=0.1.7-0 <0.2.0` शर्त ही लक्ष्य होस्ट को स्थापित-योग्य बनाती है (पुरानी रेंज semver के प्रीरिलीज़ नियम से उसे बाहर कर देती थी)। प्लगइन इवेंट पंजीकरण सतह अब भी नहीं है — `KNOWN_SESSION_EVENT_TYPES` में `memory/*` नहीं है, और `Session.append` का तीसरा तर्क केवल सरफ़ेस-योग्य प्रकारों के लिए `SurfaceIntent` ले जाता है, इसलिए ऑडिट द्वार अनुकूली रहता है और पहले जैसे छोड़ देता है (यह प्रति प्रोसेस एक बार और `/memory audit` में बताता है)। टाइप प्रमाण तीन फ़ेस से आता है: स्थानीय checkout के बने टाइप, `node_modules` में पिन की गई प्रकाशित लाइन, और DOM लाइब्रेरी के अंतर्गत ब्राउज़र आधा। **`0.2.1-alpha.2` के विरुद्ध पुनः सत्यापित:** इस पैकेज द्वारा छुई जाने वाली हर होस्ट सीम दोनों टैगों के बीच **बाइट-दर-बाइट समान** है (`packages/settings/settings/src/**`, `packages/client/ui-settings/src/**`, `packages/client/ui-slots/src/**`, `packages/client/modules/src/**`, `packages/interaction/user-approval/**`, `vendor/loader/src/**`, `vendor/schemastery/src/**`, `packages/boot/app-boot/src/config-schema/**`), सेशन फ़ॉर्मैट अब भी v4 है और कोई v4→v5 माइग्रेशन नहीं है, तथा `KNOWN_SESSION_EVENT_TYPES` में केवल एक प्रथम-पक्ष प्रकार जुड़ा — इसलिए अनुकूली ऑडिट द्वार बंद ही रहता है और **कोड में कोई बदलाव आवश्यक नहीं था**। जो बदला वह है पिन की गई dev/test लाइन (`0.2.1-alpha.2`, साथ में `pnpm-workspace.yaml` की संबंधित release-age अनुमति-सूची प्रविष्टियाँ) और अनुकूलता बेसलाइन; `npm test` (201 केस, वास्तविक Loader composition सूट सहित), `typecheck:ci`, कवरेज, आर्टिफ़ैक्ट, अनुरूपता और पाँच-भाषा गेट उस पर पास होते हैं। alpha.2 वास्तव में `plugin:<name>/*` नामस्थान वाला `appendPluginRecord` लेखक जोड़ता है, पर होस्ट का अपना `packages/core/session/README.md` रिपॉज़िटरी से बाहर के प्लगइनों को उसे कॉल करने से मना करता है और अनिवार्य `plugin:` उपसर्ग `memory/*` व्यक्त नहीं कर सकता, इसलिए यह पैकेज उसे नहीं अपनाता। |
 | Node | `^22.19.0 || >=24.0.0` |
 | Platforms | Windows / macOS / Linux (केवल host; कोई नेटिव कोड नहीं, कोई नेटवर्क नहीं) |
 | Model | कोई भी |
@@ -309,10 +286,11 @@ npm run verify:artifacts # artifact presence + syntax + import
 ## Contributors
 
 - [@Niuniu-Sir](https://github.com/Niuniu-Sir) — [issue #1](https://github.com/PerryLink/dsh-memento/issues/1) में बूट-क्रैश रिपोर्ट, जिससे 0.3.1 में `~/.dsh` फ़ॉलबैक आया।
+- [@alex-debap](https://github.com/alex-debap) — 0.1.0 के संकल्पना चरण से ही उपस्थित: भंडार नहीं बल्कि सीम होने का प्रस्ताव, अनुमोदन द्वार के संरचनात्मक रूप से अटल रहने पर ज़ोर, और अनुमोदन जोड़ी तथा प्लगइन की अपनी ऑडिट तालिका से पुनर्निर्मेय ऑडिट ट्रेल। परिबद्ध, स्तरित रिकॉल मॉडल का नामकरण, स्थानीय-प्रथम शून्य-क्रेडेंशियल भंडारण पर ज़ोर, और Adapter registry तथा Conformance suite के साथ प्रोटोकॉल रिहर्सल को सार्वजनिक रूप से आगे बढ़ाया।
 
 ## PerryLink DSH Plugin Family
 
-यह प्रोजेक्ट [PerryLink](https://github.com/PerryLink) के DeepSeek Harness प्लगइन परिवार का हिस्सा है — **33 सक्रिय रूप से अनुरक्षित**, कुल सूची **42** है जिसमें **6 फ़्रोज़न** और **3 सेवानिवृत्त** हैं; हर एक की पंक्ति नीचे बनी रहती है, कारण “स्थिति” कॉलम में है। अगर यह उपयोगी लगे, तो अन्य भी मददगार होंगे:
+यह प्रोजेक्ट [PerryLink](https://github.com/PerryLink) के DeepSeek Harness प्लगइन परिवार का हिस्सा है — **34 सक्रिय रूप से अनुरक्षित**, कुल सूची **42** है जिसमें **5 फ़्रोज़न** और **3 सेवानिवृत्त** हैं; हर एक की पंक्ति नीचे बनी रहती है, कारण “स्थिति” कॉलम में है। अगर यह उपयोगी लगे, तो अन्य भी मददगार होंगे:
 
 | Plugin | एक पंक्ति में | स्थिति |
 |---|---|---|
@@ -340,7 +318,7 @@ npm run verify:artifacts # artifact presence + syntax + import
 | **[dsh-lsp-actions](https://github.com/PerryLink/dsh-lsp-actions)** | LSP diagnostics, formatting, completion, code actions and rename over language servers | |
 | **[dsh-mask](https://github.com/PerryLink/dsh-mask)** | PII masking middleware: anonymize at the model boundary, restore at the display layer | |
 | **[dsh-mcp-panel](https://github.com/PerryLink/dsh-mcp-panel)** | Read-only MCP runtime panel: /mcp command + Settings tab with status, tools and errors | |
-| **[dsh-memento](https://github.com/PerryLink/dsh-memento)** | Approval-gated cross-session memory: ctx.memory seam + SQLite + memory tool | 🧊 फ़्रोज़न — रिपॉज़िटरी README देखें |
+| **[dsh-memento](https://github.com/PerryLink/dsh-memento)** | Approval-gated cross-session memory: ctx.memory seam + SQLite + memory tool | |
 | **[dsh-observe](https://github.com/PerryLink/dsh-observe)** | OpenTelemetry and Langfuse observability exporter for DeepSeek Harness. | |
 | **[dsh-output-styles](https://github.com/PerryLink/dsh-output-styles)** | Claude Code outputStyles-equivalent runtime style switching | |
 | **[dsh-permission-rules](https://github.com/PerryLink/dsh-permission-rules)** | Claude Code-style declarative allow/deny/ask permission rules with audit | |

package/README-pt.md

@@ -47,34 +47,11 @@ Uma costura tipada `ctx.memory`, uma porta de aprovação de escrita que nenhum
 
 *A mesma execução, animada.*
 
-## Status de manutenção: 🧊 CONGELADO
-
-> **Congelado em 2026-10-05. Sem novos recursos.** Este pacote continua funcionando e **não foi aposentado**, mas não recebe mais trabalho de recursos; apenas uma falha real será corrigida.
-
-Os mantenedores consideram que nesta capacidade **já existem alternativas com melhor adoção**, então o esforço foi redirecionado. Comparação medida em 2026-10-05:
-
-| | pacote | downloads semanais |
-|---|---|---|
-| **este pacote** | `dsh-memento` | 1,202 |
-| alternativa mais adotada | [`@openviking/dsh-memory-plugin`](https://github.com/volcengine/OpenViking) | **10,160** |
-| outra alternativa | `dsh-prime-memory` | 6,157 |
-| outra alternativa | `@a9i5k4/dsh-auto-memory` | 4,781 |
-
-👉 **Para trabalho novo, prefira qualquer uma das anteriores, mas verifique antes a barreira de compatibilidade.** As instalações existentes continuam funcionando sem alterações.
-
-*Evidência completa: `dsh-plugin-supersession-review-20261005.md`. Texto completo na seção **Maintenance status: 🧊 FROZEN** de [README.md](README.md).*
-
-## Comparison
-
-![Gráfico comparativo medido do dsh-memento](https://raw.githubusercontent.com/PerryLink/dsh-memento/main/docs/assets/dsh-memento-evidence.png)
-
-measured 2026-10-05 · from the README's FROZEN maintenance table (npm weekly downloads)
-
 ## Compatibility
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1` (adaptado em 2026-10-04): a linha `0.1.7` substituiu toda a superfície de registro de configurações (`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`) por formulários de config ao vivo, então as duas metades seguem o contrato novo — o namespace de um formulário é o id da entrada do perfil (`memento`), seus campos editáveis são os marcados `.volatile()` e uma edição aceita é confirmada **dentro do plugin em execução** em vez de remontá-lo. A metade de navegador lê esse formulário por `ctx.configForms.get(entryId)` (o serviço `ctx.settingsScope` deixou de existir). As duas metades mantêm seus ramos `installSection` / `settingsScope` para as linhas `0.1.2-rc.1`, `0.1.5-alpha.1` e `0.1.6-0` que o intervalo de peers ainda anuncia, e a nova cláusula `>=0.1.7-0 <0.2.0` é o que torna o próprio host alvo instalável (o intervalo antigo o excluía pela regra de semver para versões preliminares). Ainda não há superfície de registro de eventos para plugins — `KNOWN_SESSION_EVENT_TYPES` não inclui `memory/*` e o terceiro argumento de `Session.append` só carrega um `SurfaceIntent` para tipos de superfície, então a porta de auditoria continua adaptativa e pula como antes (diz isso uma vez por processo e em `/memory audit`). A evidência de tipos vem de três faces: os tipos já compilados do checkout local, a linha publicada fixada em `node_modules` e a metade de navegador sob uma lib DOM. |
+| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.2` (adaptado em 2026-10-12; `0.2.1-alpha.1` desde 2026-10-04): a linha `0.1.7` substituiu toda a superfície de registro de configurações (`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`) por formulários de config ao vivo, então as duas metades seguem o contrato novo — o namespace de um formulário é o id da entrada do perfil (`memento`), seus campos editáveis são os marcados `.volatile()` e uma edição aceita é confirmada **dentro do plugin em execução** em vez de remontá-lo. A metade de navegador lê esse formulário por `ctx.configForms.get(entryId)` (o serviço `ctx.settingsScope` deixou de existir). As duas metades mantêm seus ramos `installSection` / `settingsScope` para as linhas `0.1.2-rc.1`, `0.1.5-alpha.1` e `0.1.6-0` que o intervalo de peers ainda anuncia, e a nova cláusula `>=0.1.7-0 <0.2.0` é o que torna o próprio host alvo instalável (o intervalo antigo o excluía pela regra de semver para versões preliminares). Ainda não há superfície de registro de eventos para plugins — `KNOWN_SESSION_EVENT_TYPES` não inclui `memory/*` e o terceiro argumento de `Session.append` só carrega um `SurfaceIntent` para tipos de superfície, então a porta de auditoria continua adaptativa e pula como antes (diz isso uma vez por processo e em `/memory audit`). A evidência de tipos vem de três faces: os tipos já compilados do checkout local, a linha publicada fixada em `node_modules` e a metade de navegador sob uma lib DOM. **Reverificado contra `0.2.1-alpha.2`:** todas as costuras do host que este pacote toca são **idênticas byte a byte** entre as duas etiquetas (`packages/settings/settings/src/**`, `packages/client/ui-settings/src/**`, `packages/client/ui-slots/src/**`, `packages/client/modules/src/**`, `packages/interaction/user-approval/**`, `vendor/loader/src/**`, `vendor/schemastery/src/**`, `packages/boot/app-boot/src/config-schema/**`), o formato de sessão continua sendo v4 sem migração v4→v5, e `KNOWN_SESSION_EVENT_TYPES` ganhou apenas um tipo de primeira parte — então a porta de auditoria adaptativa continua fechada e **nenhuma mudança de código foi necessária**. O que mudou foi a linha fixada de dev/test (`0.2.1-alpha.2`, mais suas entradas na lista de permitidos por idade de release do `pnpm-workspace.yaml`) e a linha de base de compatibilidade; `npm test` (201 casos, incluindo a suíte de composição com o Loader real), `typecheck:ci`, cobertura, artefatos, conformidade e os portões de cinco idiomas passam contra ela. O alpha.2 de fato adiciona um escritor `appendPluginRecord` no espaço de nomes `plugin:<name>/*`, mas o próprio `packages/core/session/README.md` do host proíbe plugins externos ao repositório de chamá-lo e o prefixo obrigatório `plugin:` não consegue expressar `memory/*`, então este pacote não o adota. |
 | Node | `^22.19.0 || >=24.0.0` |
 | Platforms | Windows / macOS / Linux (somente host; sem código nativo, sem rede) |
 | Model | Qualquer |
@@ -309,10 +286,11 @@ Evidência estática: `dsh-plugin-doctor` K10–K13 retornam `pass` em todas as
 ## Contributors
 
 - [@Niuniu-Sir](https://github.com/Niuniu-Sir) — o relato de falha de inicialização na [issue #1](https://github.com/PerryLink/dsh-memento/issues/1) que levou ao fallback `~/.dsh` incluído na 0.3.1.
+- [@alex-debap](https://github.com/alex-debap) — presente desde a etapa de concepção da 0.1.0: a tese da costura e não outro armazém, a insistência em que a porta de aprovação seja estruturalmente incontornável e uma auditoria reconstruível a partir do par de aprovação mais a tabela de auditoria do plugin. Nomeou o modelo de recordação limitado e em camadas, defendeu o armazenamento local primeiro e sem credenciais, e levou o ensaio do protocolo ao espaço público com um registro de adaptadores e uma suíte de conformidade.
 
 ## PerryLink DSH Plugin Family
 
-Este projeto é um dos **33 plugins ativamente mantidos** do DeepSeek Harness da [PerryLink](https://github.com/PerryLink): o registro tem **42**, dos quais **6** estão congelados e **3** aposentados; cada um mantém sua linha abaixo, com o motivo na coluna Status. Se este ajudou você, provavelmente os outros também ajudarão:
+Este projeto é um dos **34 plugins ativamente mantidos** do DeepSeek Harness da [PerryLink](https://github.com/PerryLink): o registro tem **42**, dos quais **5** estão congelados e **3** aposentados; cada um mantém sua linha abaixo, com o motivo na coluna Status. Se este ajudou você, provavelmente os outros também ajudarão:
 
 | Plugin | Em uma linha | Status |
 |---|---|---|
@@ -340,7 +318,7 @@ Este projeto é um dos **33 plugins ativamente mantidos** do DeepSeek Harness da
 | **[dsh-lsp-actions](https://github.com/PerryLink/dsh-lsp-actions)** | LSP diagnostics, formatting, completion, code actions and rename over language servers | |
 | **[dsh-mask](https://github.com/PerryLink/dsh-mask)** | PII masking middleware: anonymize at the model boundary, restore at the display layer | |
 | **[dsh-mcp-panel](https://github.com/PerryLink/dsh-mcp-panel)** | Read-only MCP runtime panel: /mcp command + Settings tab with status, tools and errors | |
-| **[dsh-memento](https://github.com/PerryLink/dsh-memento)** | Approval-gated cross-session memory: ctx.memory seam + SQLite + memory tool | 🧊 CONGELADO — ver o README do repositório |
+| **[dsh-memento](https://github.com/PerryLink/dsh-memento)** | Approval-gated cross-session memory: ctx.memory seam + SQLite + memory tool | |
 | **[dsh-observe](https://github.com/PerryLink/dsh-observe)** | OpenTelemetry and Langfuse observability exporter for DeepSeek Harness. | |
 | **[dsh-output-styles](https://github.com/PerryLink/dsh-output-styles)** | Claude Code outputStyles-equivalent runtime style switching | |
 | **[dsh-permission-rules](https://github.com/PerryLink/dsh-permission-rules)** | Claude Code-style declarative allow/deny/ask permission rules with audit | |

package/README-zh.md

@@ -47,40 +47,11 @@
 
 *同一次运行，动图版。*
 
-## 维护状态：🧊 已冻结
-
-> **2026-10-05 起冻结，不再新增功能。** 本包仍可正常使用，**没有退役**——但不再投入功能开发，只有真实故障才会修复。
-
-维护者判定该能力面**已出现采用度更高、更值得推荐的替代方案**，因此把精力移到了别处。
-
-| | 包 | 周下载量 |
-|---|---|---|
-| **本包** | `dsh-memento` | 1,202 |
-| 更值得推荐的替代品 | [`@openviking/dsh-memory-plugin`](https://github.com/volcengine/OpenViking) | **10,160** |
-| 另一个替代品 | `dsh-prime-memory` | 6,157 |
-| 另一个替代品 | `@a9i5k4/dsh-auto-memory` | 4,781 |
-
-**为什么替代品更强。** `@openviking/dsh-memory-plugin` 是 **volcengine（字节跳动）官方组织仓**发布的记忆与上下文 bundle，带自动召回与自动捕获。
-
-**兼容性提醒。** 它声明的 dsh peer 上限低于 0.2.0，因此在 0.2.1-alpha.1 宿主上会被 0.2.x 兼容性守卫**直接跳过**，除非你手动加豁免。
-
-**本包仍然独有的能力。** 召回是**有界、分层、带审批门**的，且引用可从句会日志重建；但该赛道极其拥挤，多个替代品的采用度远高于本包。
-
-👉 **新工作请优先使用上述任一替代品——但请先确认它是否被兼容性守卫放行。** 已安装的照常可用，没有任何东西被移除。
-
-*完整证据（含宿主版本兼容矩阵）见 `dsh-plugin-supersession-review-20261005.md`；英文版见 [README.md](README.md) 的 **Maintenance status: 🧊 FROZEN** 一节。*
-
-## Comparison
-
-![dsh-memento 的实测对比柱状图](https://raw.githubusercontent.com/PerryLink/dsh-memento/main/docs/assets/dsh-memento-evidence.png)
-
-measured 2026-10-05 · from the README's FROZEN maintenance table (npm weekly downloads)
-
 ## Compatibility
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1`（2026-10-04 适配）：`0.1.7` 线把整条设置注册面（`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`）换成 live config 表单——表单的 namespace 就是 profile entry id（`memento`），可编辑字段就是标了 `.volatile()` 的那些，被接受的编辑**提交进运行中的插件**而不是重挂它。浏览器半经 `ctx.configForms.get(entryId)` 读同一份表单（`ctx.settingsScope` 服务已删）。两侧都保留了 `installSection` / `settingsScope` 分支，peer 区间仍声明支持 `0.1.2-rc.1`、`0.1.5-alpha.1`、`0.1.6-0` 三条线；新增的 `>=0.1.7-0 <0.2.0` 这一段是修 bug——旧范围按 semver 预发布规则把目标宿主本身排除在外。仍无插件事件注册面——`KNOWN_SESSION_EVENT_TYPES` 不含 `memory/*`，且 `Session.append` 第三参只承载 surface 类型的 `SurfaceIntent`，故审计门保持自适应、行为不变（会在进程内告警一次，并在 `/memory audit` 输出里明示缺口）。类型证据来自三个面：本机 checkout 的已构建类型、`node_modules` 里钉住的已发布线、以及 DOM 库下的浏览器半侧。 |
+| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.2`（2026-10-12 适配；`0.2.1-alpha.1` 自 2026-10-04 起）：`0.1.7` 线把整条设置注册面（`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`）换成 live config 表单——表单的 namespace 就是 profile entry id（`memento`），可编辑字段就是标了 `.volatile()` 的那些，被接受的编辑**提交进运行中的插件**而不是重挂它。浏览器半经 `ctx.configForms.get(entryId)` 读同一份表单（`ctx.settingsScope` 服务已删）。两侧都保留了 `installSection` / `settingsScope` 分支，peer 区间仍声明支持 `0.1.2-rc.1`、`0.1.5-alpha.1`、`0.1.6-0` 三条线；新增的 `>=0.1.7-0 <0.2.0` 这一段是修 bug——旧范围按 semver 预发布规则把目标宿主本身排除在外。仍无插件事件注册面——`KNOWN_SESSION_EVENT_TYPES` 不含 `memory/*`，且 `Session.append` 第三参只承载 surface 类型的 `SurfaceIntent`，故审计门保持自适应、行为不变（会在进程内告警一次，并在 `/memory audit` 输出里明示缺口）。类型证据来自三个面：本机 checkout 的已构建类型、`node_modules` 里钉住的已发布线、以及 DOM 库下的浏览器半侧。**已按 `0.2.1-alpha.2` 复核：** 本插件触及的全部宿主面在两个 tag 之间**逐字节相同**（`packages/settings/settings/src/**`、`packages/client/ui-settings/src/**`、`packages/client/ui-slots/src/**`、`packages/client/modules/src/**`、`packages/interaction/user-approval/**`、`vendor/loader/src/**`、`vendor/schemastery/src/**`、`packages/boot/app-boot/src/config-schema/**`），会话格式仍是 v4、没有 v4→v5 迁移，`KNOWN_SESSION_EVENT_TYPES` 只增了一个官方类型——故审计门继续关闭、**代码零改动**。真正变动的是钉住的 dev/test 线（`0.2.1-alpha.2`，以及 `pnpm-workspace.yaml` 里对应的 release-age 白名单）与兼容基线；`npm test`（201 例，含真实 Loader 组合套件）、`typecheck:ci`、覆盖率、制品、一致性套件与五语门在 alpha.2 上全绿。alpha.2 确实新增了 `plugin:<name>/*` 命名空间的 `appendPluginRecord` 写入器，但宿主自己的 `packages/core/session/README.md` 禁止仓外插件调用，且强制的 `plugin:` 前缀无法表达 `memory/*`，故本包不采用。 |
 | Node | `^22.19.0 || >=24.0.0` |
 | Platforms | Windows / macOS / Linux（纯 host；无原生代码、无网络） |
 | Model | 任意 |
@@ -315,10 +286,11 @@ npm run verify:artifacts # artifact presence + syntax + import
 ## Contributors
 
 - [@Niuniu-Sir](https://github.com/Niuniu-Sir) — [issue #1](https://github.com/PerryLink/dsh-memento/issues/1) 中的启动崩溃报告，催生了 0.3.1 引入的 `~/.dsh` 回退。
+- [@alex-debap](https://github.com/alex-debap) — 从 0.1.0 的构想阶段起就在场：提出「做能力接缝、不做又一个记忆仓库」的立项主张，坚持审批门在结构上不可绕过，并确立「每次写入都能从审批对加插件自有审计表重建」的审计保证。命名了有界、分层的召回模型，主张本地优先、零网络零凭据的存储，并把协议预演推向公开——适配器注册表与可分发一致性套件。
 
 ## PerryLink DSH Plugin Family
 
-本项目是 [PerryLink](https://github.com/PerryLink) 维护的 DeepSeek Harness 插件家族成员：**33 个活跃维护**，名册共 **42** 个，其中 **6 个已冻结**、**3 个已退役**——每一个都在下表保留自己的行，原因见「状态」列。如果它能帮到你，其他的也会：
+本项目是 [PerryLink](https://github.com/PerryLink) 维护的 DeepSeek Harness 插件家族成员：**34 个活跃维护**，名册共 **42** 个，其中 **5 个已冻结**、**3 个已退役**——每一个都在下表保留自己的行，原因见「状态」列。如果它能帮到你，其他的也会：
 
 | Plugin | 一句话 | 状态 |
 |---|---|---|
@@ -346,7 +318,7 @@ npm run verify:artifacts # artifact presence + syntax + import
 | **[dsh-lsp-actions](https://github.com/PerryLink/dsh-lsp-actions)** | LSP diagnostics, formatting, completion, code actions and rename over language servers | |
 | **[dsh-mask](https://github.com/PerryLink/dsh-mask)** | PII masking middleware: anonymize at the model boundary, restore at the display layer | |
 | **[dsh-mcp-panel](https://github.com/PerryLink/dsh-mcp-panel)** | Read-only MCP runtime panel: /mcp command + Settings tab with status, tools and errors | |
-| **[dsh-memento](https://github.com/PerryLink/dsh-memento)** | Approval-gated cross-session memory: ctx.memory seam + SQLite + memory tool | 🧊 已冻结 — 见仓库 README |
+| **[dsh-memento](https://github.com/PerryLink/dsh-memento)** | Approval-gated cross-session memory: ctx.memory seam + SQLite + memory tool | |
 | **[dsh-observe](https://github.com/PerryLink/dsh-observe)** | OpenTelemetry and Langfuse observability exporter for DeepSeek Harness. | |
 | **[dsh-output-styles](https://github.com/PerryLink/dsh-output-styles)** | Claude Code outputStyles-equivalent runtime style switching | |
 | **[dsh-permission-rules](https://github.com/PerryLink/dsh-permission-rules)** | Claude Code-style declarative allow/deny/ask permission rules with audit | |

package/README.md

@@ -48,40 +48,11 @@ A typed `ctx.memory` seam, a write-approval gate no model path can bypass, and a
 
 *The same run, animated.*
 
-## Maintenance status: 🧊 FROZEN
-
-> **Frozen on 2026-10-05. No new features.** This package still works, and it is not retired — but it no longer receives feature work. Only a genuine breakage will be fixed.
-
-Maintainers treat this capability as one where **better-adopted alternatives now exist**, so effort has moved elsewhere. The comparison below was measured on 2026-10-05 and is recorded so nobody has to redo it.
-
-| | package | weekly downloads |
-|---|---|---|
-| **this package** | `dsh-memento` | 1,202 |
-| better-adopted alternative | [`@openviking/dsh-memory-plugin`](https://github.com/volcengine/OpenViking) | **10,160** |
-| another alternative | `dsh-prime-memory` | 6,157 |
-| another alternative | `@a9i5k4/dsh-auto-memory` | 4,781 |
-
-**Why the alternative leads.** `@openviking/dsh-memory-plugin` provides a memory and context bundle published by the volcengine organisation.
-
-**Compatibility caveat.** its declared dsh peers cap below 0.2.0, so the 0.2.x compatibility guard SKIPS it on a 0.2.1-alpha.1 host unless you add an exemption
-
-**What this package still does that the alternatives do not.** this package's differentiator is that recall is bounded, layered and approval-gated, with recoverable citations into the session log; the field is crowded and several rivals are far better adopted
-
-👉 **For new work, prefer any of the above — but check the compatibility guard first.** Existing installs keep working unchanged; nothing is being removed.
-
-*Full evidence, including the host-version compatibility matrix: `dsh-plugin-supersession-review-20261005.md`.*
-
-## Comparison
-
-![Measured comparison chart for dsh-memento](https://raw.githubusercontent.com/PerryLink/dsh-memento/main/docs/assets/dsh-memento-evidence.png)
-
-measured 2026-10-05 · from the README's FROZEN maintenance table (npm weekly downloads)
-
 ## Compatibility
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1` (adapted 2026-10-04): the `0.1.7` line replaced the whole settings registration surface (`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`) with live Config forms, so both halves follow the new contract — a form's namespace is the profile entry id (`memento`), its editable fields are the `.volatile()` ones, and an accepted edit is committed into the running plugin instead of remounting it. The browser half reads that form through `ctx.configForms.get(entryId)` (the `ctx.settingsScope` service is gone). Both halves keep their `installSection` / `settingsScope` branches for the `0.1.2-rc.1`, `0.1.5-alpha.1` and `0.1.6-0` lines the peer range still advertises, and the new `>=0.1.7-0 <0.2.0` clause is what makes the target host itself installable (the old range excluded it by semver's prerelease rule). Still no plugin event-registration surface — `KNOWN_SESSION_EVENT_TYPES` does not carry `memory/*`, and `Session.append`'s third argument only carries a `SurfaceIntent` for surface-eligible types, so the audit gate stays adaptive and skips as before (it says so once per process and in `/memory audit`). Type evidence comes from three faces: the local checkout's built types, the pinned published line in `node_modules`, and the browser half under a DOM lib. |
+| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.2` (adapted 2026-10-12; `0.2.1-alpha.1` since 2026-10-04): the `0.1.7` line replaced the whole settings registration surface (`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`) with live Config forms, so both halves follow the new contract — a form's namespace is the profile entry id (`memento`), its editable fields are the `.volatile()` ones, and an accepted edit is committed into the running plugin instead of remounting it. The browser half reads that form through `ctx.configForms.get(entryId)` (the `ctx.settingsScope` service is gone). Both halves keep their `installSection` / `settingsScope` branches for the `0.1.2-rc.1`, `0.1.5-alpha.1` and `0.1.6-0` lines the peer range still advertises, and the new `>=0.1.7-0 <0.2.0` clause is what makes the target host itself installable (the old range excluded it by semver's prerelease rule). Still no plugin event-registration surface — `KNOWN_SESSION_EVENT_TYPES` does not carry `memory/*`, and `Session.append`'s third argument only carries a `SurfaceIntent` for surface-eligible types, so the audit gate stays adaptive and skips as before (it says so once per process and in `/memory audit`). Type evidence comes from three faces: the local checkout's built types, the pinned published line in `node_modules`, and the browser half under a DOM lib. **Re-verified against `0.2.1-alpha.2`:** every plugin-facing seam this package touches is byte-identical between the two tags (`packages/settings/settings/src/**`, `packages/client/ui-settings/src/**`, `packages/client/ui-slots/src/**`, `packages/client/modules/src/**`, `packages/interaction/user-approval/**`, `vendor/loader/src/**`, `vendor/schemastery/src/**`, `packages/boot/app-boot/src/config-schema/**`), the session format is still v4 with no v4→v5 migration, and `KNOWN_SESSION_EVENT_TYPES` gained only one first-party type — so the adaptive audit gate stays closed and **no code change was needed**. What moved is the pinned dev/test line (`0.2.1-alpha.2`, plus its `pnpm-workspace.yaml` release-age allowlist entries) and the compatibility baseline; `npm test` (201 cases, including the real-Loader composition suite), `typecheck:ci`, coverage, artifact, conformance and five-language gates all pass against it. alpha.2 does add a `plugin:<name>/*`-namespaced `appendPluginRecord` writer, but the host's own `packages/core/session/README.md` forbids out-of-repo callers and the mandatory `plugin:` prefix cannot express `memory/*`, so this package does not adopt it. |
 | Node | `^22.19.0 || >=24.0.0` |
 | Platforms | Windows / macOS / Linux (pure host; no native code, no network) |
 | Model | Any |
@@ -316,10 +287,11 @@ Static evidence: `dsh-plugin-doctor` K10–K13 report `pass` for every check on
 ## Contributors
 
 - [@Niuniu-Sir](https://github.com/Niuniu-Sir) — the boot-crash report in [issue #1](https://github.com/PerryLink/dsh-memento/issues/1) that led to the `~/.dsh` fallback shipped in 0.3.1.
+- [@alex-debap](https://github.com/alex-debap) — present from the 0.1.0 conception stage onward: the seam-not-warehouse thesis, insisting the approval gate be structurally unbypassable, and an audit trail rebuildable from the approval pair plus the plugin audit table. Named the bounded, layered recall model, argued for local-first, zero-credential storage, and took the protocol rehearsal public with an adapter registry and conformance suite.
 
 ## PerryLink DSH Plugin Family
 
-This project is one of the **33 actively maintained** DeepSeek Harness plugins from [PerryLink](https://github.com/PerryLink) — the roster is **42**, of which **6** are frozen and **3** retired; every one keeps its row below, with the reason in the Status column. If this one helps you, the others likely will too:
+This project is one of the **34 actively maintained** DeepSeek Harness plugins from [PerryLink](https://github.com/PerryLink) — the roster is **42**, of which **5** are frozen and **3** retired; every one keeps its row below, with the reason in the Status column. If this one helps you, the others likely will too:
 
 | Plugin | One-liner | Status |
 |---|---|---|
@@ -347,7 +319,7 @@ This project is one of the **33 actively maintained** DeepSeek Harness plugins f
 | **[dsh-lsp-actions](https://github.com/PerryLink/dsh-lsp-actions)** | LSP diagnostics, formatting, completion, code actions and rename over language servers | |
 | **[dsh-mask](https://github.com/PerryLink/dsh-mask)** | PII masking middleware: anonymize at the model boundary, restore at the display layer | |
 | **[dsh-mcp-panel](https://github.com/PerryLink/dsh-mcp-panel)** | Read-only MCP runtime panel: /mcp command + Settings tab with status, tools and errors | |
-| **[dsh-memento](https://github.com/PerryLink/dsh-memento)** | Approval-gated cross-session memory: ctx.memory seam + SQLite + memory tool | 🧊 FROZEN — see the repo README |
+| **[dsh-memento](https://github.com/PerryLink/dsh-memento)** | Approval-gated cross-session memory: ctx.memory seam + SQLite + memory tool | |
 | **[dsh-observe](https://github.com/PerryLink/dsh-observe)** | OpenTelemetry and Langfuse observability exporter for DeepSeek Harness. | |
 | **[dsh-output-styles](https://github.com/PerryLink/dsh-output-styles)** | Claude Code outputStyles-equivalent runtime style switching | |
 | **[dsh-permission-rules](https://github.com/PerryLink/dsh-permission-rules)** | Claude Code-style declarative allow/deny/ask permission rules with audit | |

package/index.mjs

@@ -325,7 +325,9 @@ function maybeAppendSessionEvent(session, type, data) {
       console.warn(
         'dsh-memento: 宿主未收录 memory/* 会话事件（KNOWN_SESSION_EVENT_TYPES 不含该词汇，'
         + '且 Session.append 无法为非 surface 类型盖 ignorable 标记），审计事件不落盘；'
-        + '审计链由审批 seam（approval/asked + approval/decided）与插件审计表承担。',
+        + '审计链由审批 seam（approval/asked + approval/decided）与插件审计表承担。'
+        + '（0.2.1-alpha.2 起宿主新增了 plugin:<name>/* 命名空间的 appendPluginRecord 写入器，'
+        + '但宿主 README 明文禁止仓外插件调用，且强制 plugin: 前缀无法表达 memory/*，故本门继续关闭。）',
       )
     }
     return 'skipped-unknown-type'

package/package.json

@@ -1,7 +1,17 @@
 {
   "name": "dsh-memento",
   "description": "Bounded, layered, approval-gated, auditable cross-session memory for DeepSeek Harness — a capability seam (ctx.memory service + local SQLite provider + memory tool + frozen snapshot injection), not another memory warehouse",
-  "version": "0.5.23",
+  "version": "0.5.25",
+  "contributors": [
+    {
+      "name": "Niuniu-Sir",
+      "url": "https://github.com/Niuniu-Sir"
+    },
+    {
+      "name": "alex-debap",
+      "url": "https://github.com/alex-debap"
+    }
+  ],
   "type": "module",
   "main": "./index.mjs",
   "types": "./types.d.ts",
@@ -97,7 +107,8 @@
         "0.1.7-alpha.2",
         "0.1.7-rc.1",
         "0.1.7-rc.2",
-        "0.2.1-alpha.1"
+        "0.2.1-alpha.1",
+        "0.2.1-alpha.2"
       ]
     },
     "capability": {
@@ -121,13 +132,13 @@
     "@deepseek-ai/schemastery": "^3.18.3"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-attachment": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-attachment": "0.2.1-alpha.2",
     "@deepseek-ai/cordis": "^4.0.5-alpha.1",
     "@deepseek-ai/cordis-plugin-include": "^1.0.10-alpha.1",
     "@deepseek-ai/cordis-plugin-loader": "^1.0.6-alpha.1",
-    "@deepseek-ai/dsh-session": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-settings": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-tools": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-session": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-settings": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-tools": "0.2.1-alpha.2",
     "@deepseek-ai/schemastery": "^3.18.5-alpha.1",
     "@types/node": "^26.2.0",
     "oxlint": "^0.18.1",