dsh-memento 0.5.24 → 0.5.27

package/CHANGELOG.md

@@ -1,18 +1,51 @@
 # Changelog
 
+## [0.5.27] - 2026-10-18
+
+### Changed
+
+- Add a 1280×720 hero and a 960×540, 4-second terminal GIF rendered from the test run; `screenshots.json` is an object array and `capture.json` records the command.
+
+## [0.5.26] - 2026-10-18
+
+### Changed
+
+- Compatibility: devDependencies to `0.2.1-rc.2`; add `@deepseek-ai/dsh-working-directory`; `dshVersions` includes `0.2.1-rc.2`. The peer range keeps the old-host corridors.
+
 All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Added
+
+- **The README now carries the video walkthrough.** `docs/assets/dsh-memento-demo.mp4` — a 2 min 23 s narrated run, H.264 (Main @ 4.2) + AAC-LC stereo, 960×544, 1.87 MB — sits behind a click-to-open thumbnail (`docs/assets/dsh-memento-demo-video.png`: the documented terminal still with a play affordance, carrying no language-specific copy so all five READMEs share one asset). All five READMEs carry the block. Neither asset joins the published `files` list: the poster is referenced by absolute `raw.githubusercontent.com` URL, as the PNG and the GIF already were, and the MP4 by both a `github.com/blob` link and a raw direct-download link.
+
+### Changed
+
+- **The video is documented as a file to open, not as inline playback.** Two facts drive the wording, both checked against the hosts rather than assumed: GitHub's HTML sanitizer whitelists no `video`/`source` element, so a `<video>` tag in a README renders as nothing, and `raw.githubusercontent.com` serves `.mp4` as `application/octet-stream`, i.e. a download. The caption therefore says what to do — the thumbnail opens the MP4 file, and *Download raw file* is the fallback if it does not play on the page — rather than promising playback inside the README.
+- **The `@alex-debap` credit is restated with the role named.** `0.5.24` introduced the credit; this release names the role (**product manager**), writes out the scope it covers, and drops the version anchor `0.5.24` used. Two claims are narrowed to what the code actually guarantees: the write-approval gate is enforced inside the service so that **no model path** can bypass it — an in-process holder of `ctx.memory` can still reach the store — and the character budgets are hard **per track and per layer**, not per track alone.
+
+## [0.5.25] - 2026-10-12
+
+### Changed
+
+- **Compatibility baseline raised to `0.2.1-alpha.2`** (the newest published host line, `dsh-v0.2.1-alpha.2`, released 2026-10-09). The `@deepseek-ai/dsh-*` dev/test pins move from `0.2.1-alpha.1` to `0.2.1-alpha.2`, `dshWorkshop.compatibility.dshVersions` appends `0.2.1-alpha.2` after `0.2.1-alpha.1`, and `pnpm-workspace.yaml`'s `minimumReleaseAgeExclude` allowlist gains `|| 0.2.1-alpha.2` on 20 package rows — the alpha.2 packages are younger than the release-age window, so pnpm refuses them without the explicit exemption. The declared peer ranges and `engines.dsh` are **unchanged**: the existing `>=0.2.1-0 <0.3.0` clause already admits alpha.2, and nothing was narrowed. Both lockfiles are regenerated for the new pins.
+- **No code change was needed, and that is a verified result rather than an assumption.** Every plugin-facing seam this package touches is byte-identical between `dsh-v0.2.1-alpha.1` and `dsh-v0.2.1-alpha.2`: `packages/settings/settings/src/**`, `packages/api/settings-controller/src/**`, `packages/client/ui-settings/src/**` (the whole `configForms` implementation, including `SettingsForms.configure` at `src/index.ts:266` and the write admission at `:377-423`), `packages/client/ui-slots/src/**`, `packages/client/modules/src/**` (the `__ModuleLoader__.load({id, factory})` handshake), `packages/client/store/src/**`, `packages/interaction/user-approval/**` (the approval seam: `request` at `src/index.ts:215`, outcomes at `types.ts:32`, and the `approval/asked` + `approval/decided` audit events at `:225`/`:232`), `packages/core/system-prompt/src/**` (`PromptSection` at `src/index.ts:53`, the synchronous section provider, `SECTION_ORDERS` with order `-50` untouched), `vendor/loader/src/**` (`equalExceptVolatile`, the `loader/volatile-update` commit path), `vendor/schemastery/src/**` (`.volatile()` at `src/index.ts:480-483`), `vendor/cordis/src/**` (`ctx.provide`), `packages/boot/app-boot/src/config-schema/**` and `packages/storage/**` (package.json version bumps only). `SESSION_FORMAT_VERSION` is still 4 and no `v4-to-v5` migration package exists, so a log this package reads is unchanged in shape; `KNOWN_SESSION_EVENT_TYPES` gained exactly one first-party type (`working-directory/change`), so the adaptive audit gate still evaluates `memory/*` as unknown and the audit chain stays on the approval seam plus the plugin's own audit table.
+- **Reviewed and deliberately not adopted: alpha.2's `appendPluginRecord`.** It is the first host-side record writer a plugin could use (`appendPluginRecord(session, 'plugin:<name>/*', data)`, self-stamping `ignorable`), but the host's own `packages/core/session/README.md` states that plugins outside the repository must not call it, and the mandatory `plugin:` prefix cannot express this package's declared `memory/added|updated|removed|recalled|snapshot` vocabulary. The once-per-process gate warning in `index.mjs` now names that writer, so the next reader does not conclude the host has no writer at all. Two further non-changes are deliberate: the memory snapshot stays a **`systemPrompt` section** rather than moving to a `PromptContext` — contexts are re-read at every admission refresh (`refreshContext`), which would forfeit the once-per-session freeze — and the loop's removal of the `{{cwd}}` prompt variable cannot bite this package, whose snapshot text resolves no prompt variables and whose `session.header.cwd` read is the sanctioned "original project identity" use.
+- Verified on the new line: `npm test` **201/201** (including `composition.test.mjs`, which drives the real vendored Loader through the Include builtin), `npm run typecheck:ci` (published alpha.2 types), `npm run check:coverage`, `npm run verify:artifacts`, `npm run verify:self-contained`, `npm run check:readmes`, `npm run check:lockfile` and `npm run test:conformance` (22/22). Documentation, pins and one console warning string; no behavioural change.
+
+
 ## [0.5.24] - 2026-10-12
 
 ### Changed
 
-- **Unfrozen (2026-10-12).** The 2026-10-05 maintenance freeze is lifted: the package is back on the actively maintained roster (34 of 42) and receives feature work again, not only breakage fixes. The five READMEs replace `## Maintenance status: 🧊 FROZEN` with `## Maintenance status: ✅ Active` and keep the 2026-10-05 supersession measurement verbatim as a dated record; the family tables in the sibling repositories now state 34 active / 5 frozen / 3 retired, with this package's row carrying no status cell. No code, dependency or behaviour change, and existing installs need no migration.
+- **Documentation-only release**, the same shape as `0.5.20`: the package page no longer carries a maintenance-status banner or a rival comparison table — `dsh-memento` is documented as an actively maintained member of the family (34 active of 42), the way every other active plugin is, and the family tables in the sibling repositories state 34 active / 5 frozen / 3 retired with this package's row carrying no status cell. Published deliberately against the usual "release only for an install-breaking defect" rule, because npm serves this README as the package page: a wrong public statement there is a defect of its own. No code, dependency or behaviour change, and existing installs need no migration.
 - Credits [@alex-debap](https://github.com/alex-debap) in the Contributors section of all five READMEs, for work that starts at the 0.1.0 conception stage: the seam-not-warehouse thesis, the structurally unbypassable approval gate, the audit guarantee rebuildable from the approval pair plus the plugin audit table, the bounded layered recall model, local-first zero-credential storage, and the public protocol rehearsal with its adapter registry and conformance suite.
 
-  This is a **deliberate documentation-only release**, against the usual "release only for an install-breaking defect" rule, and the exception is recorded here so the rule is not quietly broken. The reason: npm serves this README as the package page, and it was still telling readers that no new features were coming and to prefer `@openviking/dsh-memory-plugin`. Those statements stopped being true when the freeze was lifted, and waiting for the next code fix would leave the package's only public page arguing against its own use. The published tarball differs from 0.5.23 in `README*`, `CHANGELOG.md` and `package.json` only — the same shape as the documentation-only `0.5.20`.
+  The published tarball differs from 0.5.23 in `README*`, `CHANGELOG.md` and `package.json` only.
 
 
 ## [0.5.23] - 2026-10-10