dsh-memento 0.5.24 → 0.5.25

package/CHANGELOG.md

@@ -5,14 +5,24 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.25] - 2026-10-12
+
+### Changed
+
+- **Compatibility baseline raised to `0.2.1-alpha.2`** (the newest published host line, `dsh-v0.2.1-alpha.2`, released 2026-10-09). The `@deepseek-ai/dsh-*` dev/test pins move from `0.2.1-alpha.1` to `0.2.1-alpha.2`, `dshWorkshop.compatibility.dshVersions` appends `0.2.1-alpha.2` after `0.2.1-alpha.1`, and `pnpm-workspace.yaml`'s `minimumReleaseAgeExclude` allowlist gains `|| 0.2.1-alpha.2` on 20 package rows — the alpha.2 packages are younger than the release-age window, so pnpm refuses them without the explicit exemption. The declared peer ranges and `engines.dsh` are **unchanged**: the existing `>=0.2.1-0 <0.3.0` clause already admits alpha.2, and nothing was narrowed. Both lockfiles are regenerated for the new pins.
+- **No code change was needed, and that is a verified result rather than an assumption.** Every plugin-facing seam this package touches is byte-identical between `dsh-v0.2.1-alpha.1` and `dsh-v0.2.1-alpha.2`: `packages/settings/settings/src/**`, `packages/api/settings-controller/src/**`, `packages/client/ui-settings/src/**` (the whole `configForms` implementation, including `SettingsForms.configure` at `src/index.ts:266` and the write admission at `:377-423`), `packages/client/ui-slots/src/**`, `packages/client/modules/src/**` (the `__ModuleLoader__.load({id, factory})` handshake), `packages/client/store/src/**`, `packages/interaction/user-approval/**` (the approval seam: `request` at `src/index.ts:215`, outcomes at `types.ts:32`, and the `approval/asked` + `approval/decided` audit events at `:225`/`:232`), `packages/core/system-prompt/src/**` (`PromptSection` at `src/index.ts:53`, the synchronous section provider, `SECTION_ORDERS` with order `-50` untouched), `vendor/loader/src/**` (`equalExceptVolatile`, the `loader/volatile-update` commit path), `vendor/schemastery/src/**` (`.volatile()` at `src/index.ts:480-483`), `vendor/cordis/src/**` (`ctx.provide`), `packages/boot/app-boot/src/config-schema/**` and `packages/storage/**` (package.json version bumps only). `SESSION_FORMAT_VERSION` is still 4 and no `v4-to-v5` migration package exists, so a log this package reads is unchanged in shape; `KNOWN_SESSION_EVENT_TYPES` gained exactly one first-party type (`working-directory/change`), so the adaptive audit gate still evaluates `memory/*` as unknown and the audit chain stays on the approval seam plus the plugin's own audit table.
+- **Reviewed and deliberately not adopted: alpha.2's `appendPluginRecord`.** It is the first host-side record writer a plugin could use (`appendPluginRecord(session, 'plugin:<name>/*', data)`, self-stamping `ignorable`), but the host's own `packages/core/session/README.md` states that plugins outside the repository must not call it, and the mandatory `plugin:` prefix cannot express this package's declared `memory/added|updated|removed|recalled|snapshot` vocabulary. The once-per-process gate warning in `index.mjs` now names that writer, so the next reader does not conclude the host has no writer at all. Two further non-changes are deliberate: the memory snapshot stays a **`systemPrompt` section** rather than moving to a `PromptContext` — contexts are re-read at every admission refresh (`refreshContext`), which would forfeit the once-per-session freeze — and the loop's removal of the `{{cwd}}` prompt variable cannot bite this package, whose snapshot text resolves no prompt variables and whose `session.header.cwd` read is the sanctioned "original project identity" use.
+- Verified on the new line: `npm test` **201/201** (including `composition.test.mjs`, which drives the real vendored Loader through the Include builtin), `npm run typecheck:ci` (published alpha.2 types), `npm run check:coverage`, `npm run verify:artifacts`, `npm run verify:self-contained`, `npm run check:readmes`, `npm run check:lockfile` and `npm run test:conformance` (22/22). Documentation, pins and one console warning string; no behavioural change.
+
+
 ## [0.5.24] - 2026-10-12
 
 ### Changed
 
-- **Unfrozen (2026-10-12).** The 2026-10-05 maintenance freeze is lifted: the package is back on the actively maintained roster (34 of 42) and receives feature work again, not only breakage fixes. The five READMEs replace `## Maintenance status: 🧊 FROZEN` with `## Maintenance status: ✅ Active` and keep the 2026-10-05 supersession measurement verbatim as a dated record; the family tables in the sibling repositories now state 34 active / 5 frozen / 3 retired, with this package's row carrying no status cell. No code, dependency or behaviour change, and existing installs need no migration.
+- **Documentation-only release**, the same shape as `0.5.20`: the package page no longer carries a maintenance-status banner or a rival comparison table — `dsh-memento` is documented as an actively maintained member of the family (34 active of 42), the way every other active plugin is, and the family tables in the sibling repositories state 34 active / 5 frozen / 3 retired with this package's row carrying no status cell. Published deliberately against the usual "release only for an install-breaking defect" rule, because npm serves this README as the package page: a wrong public statement there is a defect of its own. No code, dependency or behaviour change, and existing installs need no migration.
 - Credits [@alex-debap](https://github.com/alex-debap) in the Contributors section of all five READMEs, for work that starts at the 0.1.0 conception stage: the seam-not-warehouse thesis, the structurally unbypassable approval gate, the audit guarantee rebuildable from the approval pair plus the plugin audit table, the bounded layered recall model, local-first zero-credential storage, and the public protocol rehearsal with its adapter registry and conformance suite.
 
-  This is a **deliberate documentation-only release**, against the usual "release only for an install-breaking defect" rule, and the exception is recorded here so the rule is not quietly broken. The reason: npm serves this README as the package page, and it was still telling readers that no new features were coming and to prefer `@openviking/dsh-memory-plugin`. Those statements stopped being true when the freeze was lifted, and waiting for the next code fix would leave the package's only public page arguing against its own use. The published tarball differs from 0.5.23 in `README*`, `CHANGELOG.md` and `package.json` only — the same shape as the documentation-only `0.5.20`.
+  The published tarball differs from 0.5.23 in `README*`, `CHANGELOG.md` and `package.json` only.
 
 
 ## [0.5.23] - 2026-10-10

package/README-es.md

@@ -47,36 +47,11 @@ Una costura tipada `ctx.memory`, una puerta de aprobación de escritura que ning
 
 *La misma ejecución, animada.*
 
-## Estado de mantenimiento: ✅ Activo
-
-> **Descongelado el 2026-10-12: se reanuda el trabajo de funciones.** El congelamiento del 2026-10-05 queda levantado: este paquete vuelve al registro de mantenimiento activo (**34 de 42**) y recibe funciones de nuevo, no solo correcciones de averías. No se eliminó nada durante el congelamiento y las instalaciones existentes no necesitan migración.
-
-El congelamiento fue una decisión de **planificación**, no un veredicto sobre defectos: el campo de esta capacidad está saturado y existen rivales con mejor adopción, así que el esfuerzo se trasladó durante una temporada. Esa temporada ha terminado. Lo que la nota del congelamiento señalaba como diferencial sigue siendo la razón para conservar el paquete: el recuerdo es **acotado, por capas y con puerta de aprobación**, y cada escritura sigue siendo reconstruible a partir del par de aprobación más la tabla de auditoría del propio plugin.
-
-La comparación de abajo se conserva **literalmente como registro fechado** del 2026-10-05: es la evidencia en la que se apoyó el congelamiento y nadie debería tener que rehacerla. Léala como la instantánea de aquel día, no como la posición actual de este paquete.
-
-| | paquete | descargas semanales |
-|---|---|---|
-| **este paquete** | `dsh-memento` | 1,202 |
-| alternativa mejor adoptada | [`@openviking/dsh-memory-plugin`](https://github.com/volcengine/OpenViking) | **10,160** |
-| otra alternativa | `dsh-prime-memory` | 6,157 |
-| otra alternativa | `@a9i5k4/dsh-auto-memory` | 4,781 |
-
-👉 **Ambos caminos vuelven a estar abiertos.** El trabajo nuevo puede usar este paquete —está mantenido— y las alternativas anteriores siguen siendo razonables donde encajen; compruebe la barrera de compatibilidad en cualquier caso. Las instalaciones existentes siguen funcionando sin cambios; nunca se eliminó nada.
-
-*Evidencia completa, incluida la matriz de compatibilidad de versiones del host: `dsh-plugin-supersession-review-20261005.md`.*
-
-## Comparison
-
-![Gráfico comparativo medido de dsh-memento](https://raw.githubusercontent.com/PerryLink/dsh-memento/main/docs/assets/dsh-memento-evidence.png)
-
-measured 2026-10-05 · the freeze-period comparison, kept as a dated record (npm weekly downloads)
-
 ## Compatibility
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1` (adaptado el 2026-10-04): la línea `0.1.7` sustituyó toda la superficie de registro de ajustes (`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`) por formularios de config en vivo, así que ambas mitades siguen el contrato nuevo — el namespace de un formulario es el id de la entrada del perfil (`memento`), sus campos editables son los marcados `.volatile()` y una edición aceptada se confirma **dentro del plugin en ejecución** en lugar de remontarlo. La mitad de navegador lee ese formulario con `ctx.configForms.get(entryId)` (el servicio `ctx.settingsScope` ya no existe). Ambas mitades conservan sus ramas `installSection` / `settingsScope` para las líneas `0.1.2-rc.1`, `0.1.5-alpha.1` y `0.1.6-0` que el rango de peers sigue anunciando, y la nueva cláusula `>=0.1.7-0 <0.2.0` es lo que hace instalable al propio host objetivo (el rango anterior lo excluía por la regla de semver sobre versiones preliminares). Sigue sin haber superficie de registro de eventos para plugins — `KNOWN_SESSION_EVENT_TYPES` no incluye `memory/*` y el tercer argumento de `Session.append` solo lleva un `SurfaceIntent` para tipos de superficie, así que la puerta de auditoría sigue siendo adaptativa y se salta igual (lo dice una vez por proceso y en `/memory audit`). La evidencia de tipos viene de tres caras: los tipos ya compilados del checkout local, la línea publicada fijada en `node_modules` y la mitad de navegador bajo una lib DOM. |
+| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.2` (adaptado el 2026-10-12; `0.2.1-alpha.1` desde el 2026-10-04): la línea `0.1.7` sustituyó toda la superficie de registro de ajustes (`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`) por formularios de config en vivo, así que ambas mitades siguen el contrato nuevo — el namespace de un formulario es el id de la entrada del perfil (`memento`), sus campos editables son los marcados `.volatile()` y una edición aceptada se confirma **dentro del plugin en ejecución** en lugar de remontarlo. La mitad de navegador lee ese formulario con `ctx.configForms.get(entryId)` (el servicio `ctx.settingsScope` ya no existe). Ambas mitades conservan sus ramas `installSection` / `settingsScope` para las líneas `0.1.2-rc.1`, `0.1.5-alpha.1` y `0.1.6-0` que el rango de peers sigue anunciando, y la nueva cláusula `>=0.1.7-0 <0.2.0` es lo que hace instalable al propio host objetivo (el rango anterior lo excluía por la regla de semver sobre versiones preliminares). Sigue sin haber superficie de registro de eventos para plugins — `KNOWN_SESSION_EVENT_TYPES` no incluye `memory/*` y el tercer argumento de `Session.append` solo lleva un `SurfaceIntent` para tipos de superficie, así que la puerta de auditoría sigue siendo adaptativa y se salta igual (lo dice una vez por proceso y en `/memory audit`). La evidencia de tipos viene de tres caras: los tipos ya compilados del checkout local, la línea publicada fijada en `node_modules` y la mitad de navegador bajo una lib DOM. **Reverificado contra `0.2.1-alpha.2`:** todas las costuras del host que toca este paquete son **idénticas byte a byte** entre las dos etiquetas (`packages/settings/settings/src/**`, `packages/client/ui-settings/src/**`, `packages/client/ui-slots/src/**`, `packages/client/modules/src/**`, `packages/interaction/user-approval/**`, `vendor/loader/src/**`, `vendor/schemastery/src/**`, `packages/boot/app-boot/src/config-schema/**`), el formato de sesión sigue siendo v4 sin migración v4→v5, y `KNOWN_SESSION_EVENT_TYPES` solo ganó un tipo de primera parte — así que la puerta de auditoría adaptativa sigue cerrada y **no hizo falta ningún cambio de código**. Lo que se movió es la línea fijada de dev/test (`0.2.1-alpha.2`, más sus entradas en la lista de permitidos por antigüedad de `pnpm-workspace.yaml`) y la línea base de compatibilidad; `npm test` (201 casos, incluida la suite de composición con el Loader real), `typecheck:ci`, cobertura, artefactos, conformidad y las puertas de cinco idiomas pasan contra ella. alpha.2 sí añade un escritor `appendPluginRecord` en el espacio de nombres `plugin:<name>/*`, pero el propio `packages/core/session/README.md` del host prohíbe llamarlo a los plugins externos al repositorio y el prefijo obligatorio `plugin:` no puede expresar `memory/*`, así que este paquete no lo adopta. |
 | Node | `^22.19.0 || >=24.0.0` |
 | Platforms | Windows / macOS / Linux (solo host; sin código nativo, sin red) |
 | Model | Cualquiera |

package/README-hi.md

@@ -47,36 +47,11 @@ DeepSeek Harness के लिए परिबद्ध, स्तरित, अ
 
 *वही रन, एनिमेटेड।*
 
-## रखरखाव स्थिति: ✅ सक्रिय
-
-> **2026-10-12 को अनफ़्रीज़ — सुविधा कार्य फिर शुरू।** 2026-10-05 का फ़्रीज़ हटा लिया गया है: यह पैकेज सक्रिय रूप से अनुरक्षित सूची (**42 में से 34**) में लौट आया है और अब केवल खराबी सुधार नहीं, बल्कि नई सुविधाएँ भी लेता है। फ़्रीज़ के दौरान कुछ हटाया नहीं गया था, और मौजूदा इंस्टॉल को किसी माइग्रेशन की ज़रूरत नहीं है।
-
-फ़्रीज़ एक **समय-निर्धारण** का निर्णय था, खराबी का फ़ैसला नहीं: इस क्षमता का क्षेत्र भीड़-भरा है और अधिक अपनाए गए प्रतिद्वंद्वी मौजूद हैं, इसलिए प्रयास कुछ समय के लिए अन्यत्र चला गया। वह दौर समाप्त हो चुका है। फ़्रीज़ नोट में जिस विशेषता को कारण बताया गया था, वही आज भी इस पैकेज को रखने का कारण है — रिकॉल **परिबद्ध, स्तरित और अनुमोदन-द्वारित** है, और हर लेखन अनुमोदन जोड़ी तथा प्लगइन की अपनी ऑडिट तालिका से पुनर्निर्मेय रहता है।
-
-नीचे दी गई तुलना 2026-10-05 की **दिनांकित अभिलेख** के रूप में **ज्यों की त्यों** रखी गई है: यह वह प्रमाण है जिस पर फ़्रीज़ टिका था, और इसे दोबारा करने की ज़रूरत किसी को नहीं होनी चाहिए। इसे उस दिन का स्नैपशॉट पढ़ें, इस पैकेज की वर्तमान स्थिति नहीं।
-
-| | पैकेज | साप्ताहिक डाउनलोड |
-|---|---|---|
-| **यह पैकेज** | `dsh-memento` | 1,202 |
-| अधिक अपनाया गया विकल्प | [`@openviking/dsh-memory-plugin`](https://github.com/volcengine/OpenViking) | **10,160** |
-| अन्य विकल्प | `dsh-prime-memory` | 6,157 |
-| अन्य विकल्प | `@a9i5k4/dsh-auto-memory` | 4,781 |
-
-👉 **दोनों रास्ते फिर खुले हैं।** नया काम इस पैकेज का उपयोग कर सकता है — यह अनुरक्षित है — और ऊपर दिए विकल्प जहाँ उपयुक्त हों वहाँ उचित बने हुए हैं; किसी भी स्थिति में संगतता गार्ड जाँच लें। मौजूदा इंस्टॉल बिना किसी बदलाव के काम करते रहेंगे; कभी कुछ हटाया नहीं गया।
-
-*पूर्ण प्रमाण, होस्ट संस्करण संगतता मैट्रिक्स सहित: `dsh-plugin-supersession-review-20261005.md`।*
-
-## Comparison
-
-![dsh-memento का मापा गया तुलना चार्ट](https://raw.githubusercontent.com/PerryLink/dsh-memento/main/docs/assets/dsh-memento-evidence.png)
-
-measured 2026-10-05 · the freeze-period comparison, kept as a dated record (npm weekly downloads)
-
 ## Compatibility
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1` (2026-10-04 को अनुकूलित): `0.1.7` लाइन ने पूरी सेटिंग्स पंजीकरण सतह (`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`) को लाइव कॉन्फ़िग फ़ॉर्म से बदल दिया, इसलिए दोनों आधे नया अनुबंध अपनाते हैं — फ़ॉर्म का namespace प्रोफ़ाइल प्रविष्टि की id (`memento`) है, संपादन-योग्य फ़ील्ड `.volatile()` वाले हैं, और स्वीकृत संपादन प्लगइन को रीमाउंट करने के बजाय **चल रहे प्लगइन में** लागू होता है। ब्राउज़र आधा वही फ़ॉर्म `ctx.configForms.get(entryId)` से पढ़ता है (`ctx.settingsScope` सेवा हट चुकी है)। दोनों आधे `installSection` / `settingsScope` शाखाएँ उन `0.1.2-rc.1`, `0.1.5-alpha.1` और `0.1.6-0` लाइनों के लिए बनाए रखते हैं जिन्हें peer रेंज अब भी घोषित करती है, और नई `>=0.1.7-0 <0.2.0` शर्त ही लक्ष्य होस्ट को स्थापित-योग्य बनाती है (पुरानी रेंज semver के प्रीरिलीज़ नियम से उसे बाहर कर देती थी)। प्लगइन इवेंट पंजीकरण सतह अब भी नहीं है — `KNOWN_SESSION_EVENT_TYPES` में `memory/*` नहीं है, और `Session.append` का तीसरा तर्क केवल सरफ़ेस-योग्य प्रकारों के लिए `SurfaceIntent` ले जाता है, इसलिए ऑडिट द्वार अनुकूली रहता है और पहले जैसे छोड़ देता है (यह प्रति प्रोसेस एक बार और `/memory audit` में बताता है)। टाइप प्रमाण तीन फ़ेस से आता है: स्थानीय checkout के बने टाइप, `node_modules` में पिन की गई प्रकाशित लाइन, और DOM लाइब्रेरी के अंतर्गत ब्राउज़र आधा। |
+| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.2` (2026-10-12 को अनुकूलित; `0.2.1-alpha.1` 2026-10-04 से): `0.1.7` लाइन ने पूरी सेटिंग्स पंजीकरण सतह (`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`) को लाइव कॉन्फ़िग फ़ॉर्म से बदल दिया, इसलिए दोनों आधे नया अनुबंध अपनाते हैं — फ़ॉर्म का namespace प्रोफ़ाइल प्रविष्टि की id (`memento`) है, संपादन-योग्य फ़ील्ड `.volatile()` वाले हैं, और स्वीकृत संपादन प्लगइन को रीमाउंट करने के बजाय **चल रहे प्लगइन में** लागू होता है। ब्राउज़र आधा वही फ़ॉर्म `ctx.configForms.get(entryId)` से पढ़ता है (`ctx.settingsScope` सेवा हट चुकी है)। दोनों आधे `installSection` / `settingsScope` शाखाएँ उन `0.1.2-rc.1`, `0.1.5-alpha.1` और `0.1.6-0` लाइनों के लिए बनाए रखते हैं जिन्हें peer रेंज अब भी घोषित करती है, और नई `>=0.1.7-0 <0.2.0` शर्त ही लक्ष्य होस्ट को स्थापित-योग्य बनाती है (पुरानी रेंज semver के प्रीरिलीज़ नियम से उसे बाहर कर देती थी)। प्लगइन इवेंट पंजीकरण सतह अब भी नहीं है — `KNOWN_SESSION_EVENT_TYPES` में `memory/*` नहीं है, और `Session.append` का तीसरा तर्क केवल सरफ़ेस-योग्य प्रकारों के लिए `SurfaceIntent` ले जाता है, इसलिए ऑडिट द्वार अनुकूली रहता है और पहले जैसे छोड़ देता है (यह प्रति प्रोसेस एक बार और `/memory audit` में बताता है)। टाइप प्रमाण तीन फ़ेस से आता है: स्थानीय checkout के बने टाइप, `node_modules` में पिन की गई प्रकाशित लाइन, और DOM लाइब्रेरी के अंतर्गत ब्राउज़र आधा। **`0.2.1-alpha.2` के विरुद्ध पुनः सत्यापित:** इस पैकेज द्वारा छुई जाने वाली हर होस्ट सीम दोनों टैगों के बीच **बाइट-दर-बाइट समान** है (`packages/settings/settings/src/**`, `packages/client/ui-settings/src/**`, `packages/client/ui-slots/src/**`, `packages/client/modules/src/**`, `packages/interaction/user-approval/**`, `vendor/loader/src/**`, `vendor/schemastery/src/**`, `packages/boot/app-boot/src/config-schema/**`), सेशन फ़ॉर्मैट अब भी v4 है और कोई v4→v5 माइग्रेशन नहीं है, तथा `KNOWN_SESSION_EVENT_TYPES` में केवल एक प्रथम-पक्ष प्रकार जुड़ा — इसलिए अनुकूली ऑडिट द्वार बंद ही रहता है और **कोड में कोई बदलाव आवश्यक नहीं था**। जो बदला वह है पिन की गई dev/test लाइन (`0.2.1-alpha.2`, साथ में `pnpm-workspace.yaml` की संबंधित release-age अनुमति-सूची प्रविष्टियाँ) और अनुकूलता बेसलाइन; `npm test` (201 केस, वास्तविक Loader composition सूट सहित), `typecheck:ci`, कवरेज, आर्टिफ़ैक्ट, अनुरूपता और पाँच-भाषा गेट उस पर पास होते हैं। alpha.2 वास्तव में `plugin:<name>/*` नामस्थान वाला `appendPluginRecord` लेखक जोड़ता है, पर होस्ट का अपना `packages/core/session/README.md` रिपॉज़िटरी से बाहर के प्लगइनों को उसे कॉल करने से मना करता है और अनिवार्य `plugin:` उपसर्ग `memory/*` व्यक्त नहीं कर सकता, इसलिए यह पैकेज उसे नहीं अपनाता। |
 | Node | `^22.19.0 || >=24.0.0` |
 | Platforms | Windows / macOS / Linux (केवल host; कोई नेटिव कोड नहीं, कोई नेटवर्क नहीं) |
 | Model | कोई भी |

package/README-pt.md

@@ -47,36 +47,11 @@ Uma costura tipada `ctx.memory`, uma porta de aprovação de escrita que nenhum
 
 *A mesma execução, animada.*
 
-## Status de manutenção: ✅ Ativo
-
-> **Descongelado em 2026-10-12 — o trabalho de recursos foi retomado.** O congelamento de 2026-10-05 foi suspenso: este pacote volta ao registro de manutenção ativa (**34 de 42**) e recebe recursos de novo, não apenas correções de falhas. Nada foi removido durante o congelamento e as instalações existentes não precisam de migração.
-
-O congelamento foi uma decisão de **agendamento**, não um veredicto sobre defeitos: o campo desta capacidade está saturado e existem rivais com melhor adoção, então o esforço foi redirecionado por uma temporada. Essa temporada terminou. O que a nota do congelamento apontava como diferencial continua sendo a razão para manter o pacote: a recordação é **limitada, em camadas e com porta de aprovação**, e cada escrita continua reconstruível a partir do par de aprovação mais a tabela de auditoria do próprio plugin.
-
-A comparação abaixo é mantida **literalmente como registro datado** de 2026-10-05: é a evidência em que o congelamento se apoiou e ninguém deveria ter de refazê-la. Leia-a como o instantâneo daquele dia, não como a posição atual deste pacote.
-
-| | pacote | downloads semanais |
-|---|---|---|
-| **este pacote** | `dsh-memento` | 1,202 |
-| alternativa mais adotada | [`@openviking/dsh-memory-plugin`](https://github.com/volcengine/OpenViking) | **10,160** |
-| outra alternativa | `dsh-prime-memory` | 6,157 |
-| outra alternativa | `@a9i5k4/dsh-auto-memory` | 4,781 |
-
-👉 **Os dois caminhos estão abertos de novo.** O trabalho novo pode usar este pacote —ele é mantido— e as alternativas acima continuam razoáveis onde couberem; verifique a barreira de compatibilidade em qualquer caso. As instalações existentes continuam funcionando sem alterações; nada jamais foi removido.
-
-*Evidência completa, incluindo a matriz de compatibilidade de versões do host: `dsh-plugin-supersession-review-20261005.md`.*
-
-## Comparison
-
-![Gráfico comparativo medido do dsh-memento](https://raw.githubusercontent.com/PerryLink/dsh-memento/main/docs/assets/dsh-memento-evidence.png)
-
-measured 2026-10-05 · the freeze-period comparison, kept as a dated record (npm weekly downloads)
-
 ## Compatibility
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1` (adaptado em 2026-10-04): a linha `0.1.7` substituiu toda a superfície de registro de configurações (`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`) por formulários de config ao vivo, então as duas metades seguem o contrato novo — o namespace de um formulário é o id da entrada do perfil (`memento`), seus campos editáveis são os marcados `.volatile()` e uma edição aceita é confirmada **dentro do plugin em execução** em vez de remontá-lo. A metade de navegador lê esse formulário por `ctx.configForms.get(entryId)` (o serviço `ctx.settingsScope` deixou de existir). As duas metades mantêm seus ramos `installSection` / `settingsScope` para as linhas `0.1.2-rc.1`, `0.1.5-alpha.1` e `0.1.6-0` que o intervalo de peers ainda anuncia, e a nova cláusula `>=0.1.7-0 <0.2.0` é o que torna o próprio host alvo instalável (o intervalo antigo o excluía pela regra de semver para versões preliminares). Ainda não há superfície de registro de eventos para plugins — `KNOWN_SESSION_EVENT_TYPES` não inclui `memory/*` e o terceiro argumento de `Session.append` só carrega um `SurfaceIntent` para tipos de superfície, então a porta de auditoria continua adaptativa e pula como antes (diz isso uma vez por processo e em `/memory audit`). A evidência de tipos vem de três faces: os tipos já compilados do checkout local, a linha publicada fixada em `node_modules` e a metade de navegador sob uma lib DOM. |
+| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.2` (adaptado em 2026-10-12; `0.2.1-alpha.1` desde 2026-10-04): a linha `0.1.7` substituiu toda a superfície de registro de configurações (`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`) por formulários de config ao vivo, então as duas metades seguem o contrato novo — o namespace de um formulário é o id da entrada do perfil (`memento`), seus campos editáveis são os marcados `.volatile()` e uma edição aceita é confirmada **dentro do plugin em execução** em vez de remontá-lo. A metade de navegador lê esse formulário por `ctx.configForms.get(entryId)` (o serviço `ctx.settingsScope` deixou de existir). As duas metades mantêm seus ramos `installSection` / `settingsScope` para as linhas `0.1.2-rc.1`, `0.1.5-alpha.1` e `0.1.6-0` que o intervalo de peers ainda anuncia, e a nova cláusula `>=0.1.7-0 <0.2.0` é o que torna o próprio host alvo instalável (o intervalo antigo o excluía pela regra de semver para versões preliminares). Ainda não há superfície de registro de eventos para plugins — `KNOWN_SESSION_EVENT_TYPES` não inclui `memory/*` e o terceiro argumento de `Session.append` só carrega um `SurfaceIntent` para tipos de superfície, então a porta de auditoria continua adaptativa e pula como antes (diz isso uma vez por processo e em `/memory audit`). A evidência de tipos vem de três faces: os tipos já compilados do checkout local, a linha publicada fixada em `node_modules` e a metade de navegador sob uma lib DOM. **Reverificado contra `0.2.1-alpha.2`:** todas as costuras do host que este pacote toca são **idênticas byte a byte** entre as duas etiquetas (`packages/settings/settings/src/**`, `packages/client/ui-settings/src/**`, `packages/client/ui-slots/src/**`, `packages/client/modules/src/**`, `packages/interaction/user-approval/**`, `vendor/loader/src/**`, `vendor/schemastery/src/**`, `packages/boot/app-boot/src/config-schema/**`), o formato de sessão continua sendo v4 sem migração v4→v5, e `KNOWN_SESSION_EVENT_TYPES` ganhou apenas um tipo de primeira parte — então a porta de auditoria adaptativa continua fechada e **nenhuma mudança de código foi necessária**. O que mudou foi a linha fixada de dev/test (`0.2.1-alpha.2`, mais suas entradas na lista de permitidos por idade de release do `pnpm-workspace.yaml`) e a linha de base de compatibilidade; `npm test` (201 casos, incluindo a suíte de composição com o Loader real), `typecheck:ci`, cobertura, artefatos, conformidade e os portões de cinco idiomas passam contra ela. O alpha.2 de fato adiciona um escritor `appendPluginRecord` no espaço de nomes `plugin:<name>/*`, mas o próprio `packages/core/session/README.md` do host proíbe plugins externos ao repositório de chamá-lo e o prefixo obrigatório `plugin:` não consegue expressar `memory/*`, então este pacote não o adota. |
 | Node | `^22.19.0 || >=24.0.0` |
 | Platforms | Windows / macOS / Linux (somente host; sem código nativo, sem rede) |
 | Model | Qualquer |

package/README-zh.md

@@ -47,42 +47,11 @@
 
 *同一次运行，动图版。*
 
-## 维护状态：✅ 活跃
-
-> **2026-10-12 解冻——功能开发已恢复。** 2026-10-05 的冻结已解除：本包回到活跃维护名册（**42 个中的第 34 个**），重新接收功能开发，而不再只修故障。冻结期间没有任何东西被移除，已安装的用户也无需迁移。
-
-冻结是一次**排期**判断，不是缺陷裁定：该能力赛道拥挤、已出现采用度更高的对手，所以精力暂时移到了别处。这个阶段结束了。冻结说明里点出的差异化，仍然是保留本包的理由——召回是**有界、分层、带审批门**的，且每次写入都能从审批对加插件自有审计表重建。
-
-下表**按 2026-10-05 原样保留**为日期记录：它是当时冻结所依据的证据，不该有人再重做一遍。请把它读作那一天的快照，而不是本包的现状。
-
-| | 包 | 周下载量 |
-|---|---|---|
-| **本包** | `dsh-memento` | 1,202 |
-| 更值得推荐的替代品 | [`@openviking/dsh-memory-plugin`](https://github.com/volcengine/OpenViking) | **10,160** |
-| 另一个替代品 | `dsh-prime-memory` | 6,157 |
-| 另一个替代品 | `@a9i5k4/dsh-auto-memory` | 4,781 |
-
-**为什么替代品更强。** `@openviking/dsh-memory-plugin` 是 **volcengine（字节跳动）官方组织仓**发布的记忆与上下文 bundle，带自动召回与自动捕获。
-
-**兼容性提醒。** 它声明的 dsh peer 上限低于 0.2.0，因此在 0.2.1-alpha.1 宿主上会被 0.2.x 兼容性守卫**直接跳过**，除非你手动加豁免。
-
-**本包仍然独有的能力。** 召回是**有界、分层、带审批门**的，且引用可从句会日志重建。
-
-👉 **两条路都重新打开。** 新工作可以用本包——它在维护中；上述替代品在合适的地方仍然合理；无论选哪个，都先确认兼容性守卫是否放行。已安装的照常可用，从来没有东西被移除。
-
-*完整证据（含宿主版本兼容矩阵）见 `dsh-plugin-supersession-review-20261005.md`。*
-
-## Comparison
-
-![dsh-memento 的实测对比柱状图](https://raw.githubusercontent.com/PerryLink/dsh-memento/main/docs/assets/dsh-memento-evidence.png)
-
-measured 2026-10-05 · the freeze-period comparison, kept as a dated record (npm weekly downloads)
-
 ## Compatibility
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1`（2026-10-04 适配）：`0.1.7` 线把整条设置注册面（`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`）换成 live config 表单——表单的 namespace 就是 profile entry id（`memento`），可编辑字段就是标了 `.volatile()` 的那些，被接受的编辑**提交进运行中的插件**而不是重挂它。浏览器半经 `ctx.configForms.get(entryId)` 读同一份表单（`ctx.settingsScope` 服务已删）。两侧都保留了 `installSection` / `settingsScope` 分支，peer 区间仍声明支持 `0.1.2-rc.1`、`0.1.5-alpha.1`、`0.1.6-0` 三条线；新增的 `>=0.1.7-0 <0.2.0` 这一段是修 bug——旧范围按 semver 预发布规则把目标宿主本身排除在外。仍无插件事件注册面——`KNOWN_SESSION_EVENT_TYPES` 不含 `memory/*`，且 `Session.append` 第三参只承载 surface 类型的 `SurfaceIntent`，故审计门保持自适应、行为不变（会在进程内告警一次，并在 `/memory audit` 输出里明示缺口）。类型证据来自三个面：本机 checkout 的已构建类型、`node_modules` 里钉住的已发布线、以及 DOM 库下的浏览器半侧。 |
+| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.2`（2026-10-12 适配；`0.2.1-alpha.1` 自 2026-10-04 起）：`0.1.7` 线把整条设置注册面（`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`）换成 live config 表单——表单的 namespace 就是 profile entry id（`memento`），可编辑字段就是标了 `.volatile()` 的那些，被接受的编辑**提交进运行中的插件**而不是重挂它。浏览器半经 `ctx.configForms.get(entryId)` 读同一份表单（`ctx.settingsScope` 服务已删）。两侧都保留了 `installSection` / `settingsScope` 分支，peer 区间仍声明支持 `0.1.2-rc.1`、`0.1.5-alpha.1`、`0.1.6-0` 三条线；新增的 `>=0.1.7-0 <0.2.0` 这一段是修 bug——旧范围按 semver 预发布规则把目标宿主本身排除在外。仍无插件事件注册面——`KNOWN_SESSION_EVENT_TYPES` 不含 `memory/*`，且 `Session.append` 第三参只承载 surface 类型的 `SurfaceIntent`，故审计门保持自适应、行为不变（会在进程内告警一次，并在 `/memory audit` 输出里明示缺口）。类型证据来自三个面：本机 checkout 的已构建类型、`node_modules` 里钉住的已发布线、以及 DOM 库下的浏览器半侧。**已按 `0.2.1-alpha.2` 复核：** 本插件触及的全部宿主面在两个 tag 之间**逐字节相同**（`packages/settings/settings/src/**`、`packages/client/ui-settings/src/**`、`packages/client/ui-slots/src/**`、`packages/client/modules/src/**`、`packages/interaction/user-approval/**`、`vendor/loader/src/**`、`vendor/schemastery/src/**`、`packages/boot/app-boot/src/config-schema/**`），会话格式仍是 v4、没有 v4→v5 迁移，`KNOWN_SESSION_EVENT_TYPES` 只增了一个官方类型——故审计门继续关闭、**代码零改动**。真正变动的是钉住的 dev/test 线（`0.2.1-alpha.2`，以及 `pnpm-workspace.yaml` 里对应的 release-age 白名单）与兼容基线；`npm test`（201 例，含真实 Loader 组合套件）、`typecheck:ci`、覆盖率、制品、一致性套件与五语门在 alpha.2 上全绿。alpha.2 确实新增了 `plugin:<name>/*` 命名空间的 `appendPluginRecord` 写入器，但宿主自己的 `packages/core/session/README.md` 禁止仓外插件调用，且强制的 `plugin:` 前缀无法表达 `memory/*`，故本包不采用。 |
 | Node | `^22.19.0 || >=24.0.0` |
 | Platforms | Windows / macOS / Linux（纯 host；无原生代码、无网络） |
 | Model | 任意 |

package/README.md

@@ -48,42 +48,11 @@ A typed `ctx.memory` seam, a write-approval gate no model path can bypass, and a
 
 *The same run, animated.*
 
-## Maintenance status: ✅ Active
-
-> **Unfrozen on 2026-10-12 — feature work has resumed.** The freeze of 2026-10-05 is lifted: this package is back on the actively maintained roster (**34 of 42**) and receives features again, not only breakage fixes. Nothing was removed while it was frozen, and existing installs need no migration.
-
-The freeze was a **scheduling** call, not a defect ruling: this capability's field is crowded and better-adopted rivals exist, so effort moved elsewhere for a season. That season is over. What the freeze note named as the differentiator is still the reason to keep the package — recall is **bounded, layered and approval-gated**, and every write stays reconstructable from the approval pair plus the plugin's own audit table.
-
-The comparison below is kept **verbatim as a dated record** of 2026-10-05: it is the evidence the freeze rested on, and nobody should have to redo it. Read it as that day's snapshot, not as this package's current standing.
-
-| | package | weekly downloads |
-|---|---|---|
-| **this package** | `dsh-memento` | 1,202 |
-| better-adopted alternative | [`@openviking/dsh-memory-plugin`](https://github.com/volcengine/OpenViking) | **10,160** |
-| another alternative | `dsh-prime-memory` | 6,157 |
-| another alternative | `@a9i5k4/dsh-auto-memory` | 4,781 |
-
-**Why the alternative leads.** `@openviking/dsh-memory-plugin` provides a memory and context bundle published by the volcengine organisation.
-
-**Compatibility caveat.** its declared dsh peers cap below 0.2.0, so the 0.2.x compatibility guard SKIPS it on a 0.2.1-alpha.1 host unless you add an exemption
-
-**What this package still does that the alternatives do not.** this package's differentiator is that recall is bounded, layered and approval-gated, with recoverable citations into the session log.
-
-👉 **Both paths are open again.** New work can use this package — it is maintained — and the alternatives above stay reasonable where they fit; check the compatibility guard either way. Existing installs keep working unchanged; nothing was ever removed.
-
-*Full evidence, including the host-version compatibility matrix: `dsh-plugin-supersession-review-20261005.md`.*
-
-## Comparison
-
-![Measured comparison chart for dsh-memento](https://raw.githubusercontent.com/PerryLink/dsh-memento/main/docs/assets/dsh-memento-evidence.png)
-
-measured 2026-10-05 · the freeze-period comparison, kept as a dated record (npm weekly downloads)
-
 ## Compatibility
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1` (adapted 2026-10-04): the `0.1.7` line replaced the whole settings registration surface (`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`) with live Config forms, so both halves follow the new contract — a form's namespace is the profile entry id (`memento`), its editable fields are the `.volatile()` ones, and an accepted edit is committed into the running plugin instead of remounting it. The browser half reads that form through `ctx.configForms.get(entryId)` (the `ctx.settingsScope` service is gone). Both halves keep their `installSection` / `settingsScope` branches for the `0.1.2-rc.1`, `0.1.5-alpha.1` and `0.1.6-0` lines the peer range still advertises, and the new `>=0.1.7-0 <0.2.0` clause is what makes the target host itself installable (the old range excluded it by semver's prerelease rule). Still no plugin event-registration surface — `KNOWN_SESSION_EVENT_TYPES` does not carry `memory/*`, and `Session.append`'s third argument only carries a `SurfaceIntent` for surface-eligible types, so the audit gate stays adaptive and skips as before (it says so once per process and in `/memory audit`). Type evidence comes from three faces: the local checkout's built types, the pinned published line in `node_modules`, and the browser half under a DOM lib. |
+| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.2` (adapted 2026-10-12; `0.2.1-alpha.1` since 2026-10-04): the `0.1.7` line replaced the whole settings registration surface (`installSettingsSection` / `SettingsProvider.installSection` / `SettingsNamespace` / `SettingsScope`) with live Config forms, so both halves follow the new contract — a form's namespace is the profile entry id (`memento`), its editable fields are the `.volatile()` ones, and an accepted edit is committed into the running plugin instead of remounting it. The browser half reads that form through `ctx.configForms.get(entryId)` (the `ctx.settingsScope` service is gone). Both halves keep their `installSection` / `settingsScope` branches for the `0.1.2-rc.1`, `0.1.5-alpha.1` and `0.1.6-0` lines the peer range still advertises, and the new `>=0.1.7-0 <0.2.0` clause is what makes the target host itself installable (the old range excluded it by semver's prerelease rule). Still no plugin event-registration surface — `KNOWN_SESSION_EVENT_TYPES` does not carry `memory/*`, and `Session.append`'s third argument only carries a `SurfaceIntent` for surface-eligible types, so the audit gate stays adaptive and skips as before (it says so once per process and in `/memory audit`). Type evidence comes from three faces: the local checkout's built types, the pinned published line in `node_modules`, and the browser half under a DOM lib. **Re-verified against `0.2.1-alpha.2`:** every plugin-facing seam this package touches is byte-identical between the two tags (`packages/settings/settings/src/**`, `packages/client/ui-settings/src/**`, `packages/client/ui-slots/src/**`, `packages/client/modules/src/**`, `packages/interaction/user-approval/**`, `vendor/loader/src/**`, `vendor/schemastery/src/**`, `packages/boot/app-boot/src/config-schema/**`), the session format is still v4 with no v4→v5 migration, and `KNOWN_SESSION_EVENT_TYPES` gained only one first-party type — so the adaptive audit gate stays closed and **no code change was needed**. What moved is the pinned dev/test line (`0.2.1-alpha.2`, plus its `pnpm-workspace.yaml` release-age allowlist entries) and the compatibility baseline; `npm test` (201 cases, including the real-Loader composition suite), `typecheck:ci`, coverage, artifact, conformance and five-language gates all pass against it. alpha.2 does add a `plugin:<name>/*`-namespaced `appendPluginRecord` writer, but the host's own `packages/core/session/README.md` forbids out-of-repo callers and the mandatory `plugin:` prefix cannot express `memory/*`, so this package does not adopt it. |
 | Node | `^22.19.0 || >=24.0.0` |
 | Platforms | Windows / macOS / Linux (pure host; no native code, no network) |
 | Model | Any |

package/index.mjs

@@ -325,7 +325,9 @@ function maybeAppendSessionEvent(session, type, data) {
       console.warn(
         'dsh-memento: 宿主未收录 memory/* 会话事件（KNOWN_SESSION_EVENT_TYPES 不含该词汇，'
         + '且 Session.append 无法为非 surface 类型盖 ignorable 标记），审计事件不落盘；'
-        + '审计链由审批 seam（approval/asked + approval/decided）与插件审计表承担。',
+        + '审计链由审批 seam（approval/asked + approval/decided）与插件审计表承担。'
+        + '（0.2.1-alpha.2 起宿主新增了 plugin:<name>/* 命名空间的 appendPluginRecord 写入器，'
+        + '但宿主 README 明文禁止仓外插件调用，且强制 plugin: 前缀无法表达 memory/*，故本门继续关闭。）',
       )
     }
     return 'skipped-unknown-type'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-memento",
   "description": "Bounded, layered, approval-gated, auditable cross-session memory for DeepSeek Harness — a capability seam (ctx.memory service + local SQLite provider + memory tool + frozen snapshot injection), not another memory warehouse",
-  "version": "0.5.24",
+  "version": "0.5.25",
   "contributors": [
     {
       "name": "Niuniu-Sir",
@@ -107,7 +107,8 @@
         "0.1.7-alpha.2",
         "0.1.7-rc.1",
         "0.1.7-rc.2",
-        "0.2.1-alpha.1"
+        "0.2.1-alpha.1",
+        "0.2.1-alpha.2"
       ]
     },
     "capability": {
@@ -131,13 +132,13 @@
     "@deepseek-ai/schemastery": "^3.18.3"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-attachment": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-attachment": "0.2.1-alpha.2",
     "@deepseek-ai/cordis": "^4.0.5-alpha.1",
     "@deepseek-ai/cordis-plugin-include": "^1.0.10-alpha.1",
     "@deepseek-ai/cordis-plugin-loader": "^1.0.6-alpha.1",
-    "@deepseek-ai/dsh-session": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-settings": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-tools": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-session": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-settings": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-tools": "0.2.1-alpha.2",
     "@deepseek-ai/schemastery": "^3.18.5-alpha.1",
     "@types/node": "^26.2.0",
     "oxlint": "^0.18.1",