dsh-memu-memory 1.1.1 → 1.1.3

package/lib/memu-config.js

@@ -2,7 +2,7 @@ import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
 import { dataDir, ensureDir, stamp, withFileLock } from './paths.js'
-import { getSettings } from './state.js'
+import { getSettings, updateSettings } from './state.js'
 import { commit, retrieve } from './memu.js'
 
 export const MEMU_CONFIG_KEYS = [
@@ -108,9 +108,9 @@ export function getMemuConfig() {
     baseUrl,
     hasKey,
     providers: Object.keys(PROVIDER_ENV),
-    // Derived, not a separate stored flag: a loopback base URL is what "local"
-    // actually means to MemU, so the toggle can never drift from the config.
-    source: baseUrl && /^https?:\/\/(127\.0\.0\.1|localhost)(:|\/)/.test(baseUrl) ? 'local' : 'remote',
+    // Source is a persisted route choice, not an inference from connection fields.
+    // Toggling vector mode must never rewrite a saved remote endpoint or key.
+    source: getSettings().vectorSource === 'api' ? 'api' : 'local',
     localBaseUrl: LOCAL_EMBED_BASE_URL,
     localModel: LOCAL_EMBED_MODEL,
   }
@@ -132,24 +132,12 @@ export function getSummaryConfig({ withKey = false } = {}) {
   return withKey ? { ...view, apiKey } : view
 }
 
-// Switching source rewrites the connection fields but never the API key: leaving a
-// third-party key in place after moving to a loopback endpoint would send it to a
-// local server, and clearing it on the way out would silently break a working setup.
-export function setEmbeddingSource(source, { keepModel = false } = {}) {
-  const env = readMemuEnv()
-  if (source === 'local') {
-    env.MEMU_EMBED_PROVIDER = 'openai'
-    env.MEMU_BASE_URL = String(env.MEMU_BASE_URL || '').includes('127.0.0.1') || String(env.MEMU_BASE_URL || '').includes('localhost')
-      ? env.MEMU_BASE_URL
-      : LOCAL_EMBED_BASE_URL
-    if (!keepModel && !String(env.MEMU_EMBED_MODEL || '')) env.MEMU_EMBED_MODEL = LOCAL_EMBED_MODEL
-  } else if (source === 'remote') {
-    if (String(env.MEMU_BASE_URL || '') === LOCAL_EMBED_BASE_URL) delete env.MEMU_BASE_URL
-    if (String(env.MEMU_EMBED_MODEL || '') === LOCAL_EMBED_MODEL) delete env.MEMU_EMBED_MODEL
-  } else {
-    throw new Error('source must be local or remote')
-  }
-  writeMemuEnv(env)
+// Switch only the vector route. Connection fields belong to the selected profile and
+// must survive a route toggle; callers may explicitly edit them through saveMemuConfig.
+export function setEmbeddingSource(source) {
+  const normalized = source === 'remote' ? 'api' : source
+  if (normalized !== 'local' && normalized !== 'api') throw new Error('source must be local or api')
+  updateSettings({ vectorSource: normalized })
   return getMemuConfig()
 }
 

package/lib/memu.js

@@ -1,9 +1,11 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import { spawn } from 'node:child_process'
-import { dataDir, ensureDir, redactSecrets } from './paths.js'
+import { dataDir, ensureDir, redactSecrets, windowsSystemEnv } from './paths.js'
 import { readCurrent, verifyEngine } from './engine.js'
 import { getSettings } from './state.js'
+import { activeProfile, captureVectorGeneration, assertVectorGeneration, assertProfileVerified, assertMigrationProfile } from './vector-profile.js'
+import { embeddingWorkerManager } from './local-embedding-manager.js'
 
 // MemU's own storage mode. 'local' keeps every row in this plugin's sqlite files;
 // 'cloud' hands storage to MemU's backend and needs the vendor credentials in
@@ -36,6 +38,7 @@ function runRaw(pythonArgs, { env, timeoutMs = 90_000, cwd } = {}) {
     const child = spawn(current.python, pythonArgs, {
       cwd,
       env: {
+        ...windowsSystemEnv(),
         ...process.env,
         PYTHONUTF8: '1',
         PYTHONIOENCODING: 'utf-8',
@@ -75,11 +78,31 @@ function runRaw(pythonArgs, { env, timeoutMs = 90_000, cwd } = {}) {
   })
 }
 
-function run(args, opts) {
-  return runRaw(['-m', 'memu', ...args], opts)
+async function runConfigured(args, options = {}) {
+  const route = options.route || (options.vectorProfile ? 'managed-local' : 'remote-api')
+  const useManagedLocal = route === 'managed-local'
+  const migration = options.vectorProfile ? assertMigrationProfile({ profile: options.vectorProfile, db: options.db }) : null
+  const generation = useManagedLocal && !options.vectorProfile && activeProfile() ? captureVectorGeneration() : null
+  if (generation && options.db && ![generation.global, ...Object.values(generation.libraries)].includes(options.db)) {
+    throw new MemuError('database does not belong to the captured vector generation', 'VECTOR_DB_MISMATCH')
+  }
+  const env = await envFor({ ...options, route })
+  if (generation) assertVectorGeneration(generation)
+  if (migration) assertMigrationProfile(migration)
+  const result = await runRaw(['-m', 'memu', ...args], { env, timeoutMs: options.timeoutMs })
+  if (generation) assertVectorGeneration(generation)
+  if (migration) assertMigrationProfile(migration)
+  return result
 }
 
-function envFor({ db, provider, embedModel, baseUrl, apiKey }) {
+async function envFor({ db, provider, embedModel, baseUrl, apiKey, vectorProfile, route }) {
+  const profile = route === 'managed-local' ? (vectorProfile || activeProfile()) : null
+  if (profile) {
+    assertProfileVerified(profile)
+    const endpoint = await embeddingWorkerManager().acquire(profile)
+    return localEmbeddingEnv({ ...endpoint, db })
+  }
+  if (route === 'managed-local') throw new MemuError('managed local vector profile is not active', 'VECTOR_NOT_READY')
   const env = {}
   if (db) env.MEMU_DB = db
   if (provider) env.MEMU_EMBED_PROVIDER = provider
@@ -89,6 +112,26 @@ function envFor({ db, provider, embedModel, baseUrl, apiKey }) {
   return env
 }
 
+// §14.3 strict-local embedding wiring. The plugin injects this into each MemU
+// child instead of asking the user to export anything: the loopback endpoint, the
+// per-process random token (env only, never argv/log/config) and the pinned
+// embedding model id. Telemetry is switched off explicitly, because "local mode"
+// alone is not proof that nothing leaves the machine.
+export function localEmbeddingEnv({ baseUrl, token, model, db } = {}) {
+  const env = {
+    MEMU_MEMORY_MODE: 'local',
+    MEMU_EMBED_PROVIDER: 'openai',
+    MEMU_TELEMETRY: '0',
+    DO_NOT_TRACK: '1',
+    MEMU_EVENTS_BASE_URL: '',
+  }
+  if (typeof baseUrl === 'string' && baseUrl.trim()) env.MEMU_BASE_URL = baseUrl.trim()
+  if (typeof token === 'string' && token.trim()) env.MEMU_API_KEY = token.trim()
+  if (typeof model === 'string' && model.trim()) env.MEMU_EMBED_MODEL = model.trim()
+  if (typeof db === 'string' && db.trim()) env.MEMU_DB = db.trim()
+  return env
+}
+
 export function parseJson(text) {
   const raw = String(text || '').trim()
   if (!raw) return null
@@ -101,14 +144,11 @@ export function parseJson(text) {
   return null
 }
 
-export async function retrieve({ query, db, provider, embedModel, baseUrl, apiKey, timeoutMs = 60_000 }) {
+export async function retrieve({ query, db, provider, embedModel, baseUrl, apiKey, vectorProfile, route, timeoutMs = 60_000 }) {
   if (!query || !String(query).trim()) {
     throw new MemuError('retrieve requires a non-empty query', 'MEMU_BAD_ARGUMENT')
   }
-  const res = await run(['retrieve', String(query), '--json'], {
-    env: envFor({ db, provider, embedModel, baseUrl, apiKey }),
-    timeoutMs,
-  })
+  const res = await runConfigured(['retrieve', String(query), '--json'], { db, provider, embedModel, baseUrl, apiKey, vectorProfile, route, timeoutMs })
   const data = parseJson(res.stdout)
   if (data === null) {
     return { raw: res.stdout.trim(), parseWarning: 'memu retrieve returned non-JSON' }
@@ -116,11 +156,8 @@ export async function retrieve({ query, db, provider, embedModel, baseUrl, apiKe
   return data
 }
 
-export async function listFiles({ db, provider, embedModel, baseUrl, apiKey, timeoutMs = 60_000 } = {}) {
-  const res = await run(['list-files', '--json'], {
-    env: envFor({ db, provider, embedModel, baseUrl, apiKey }),
-    timeoutMs,
-  })
+export async function listFiles({ db, provider, embedModel, baseUrl, apiKey, vectorProfile, route, timeoutMs = 60_000 } = {}) {
+  const res = await runConfigured(['list-files', '--json'], { db, provider, embedModel, baseUrl, apiKey, vectorProfile, route, timeoutMs })
   const data = parseJson(res.stdout)
   if (data === null) {
     return { recall_files: [], raw: res.stdout.trim(), parseWarning: 'memu list-files returned non-JSON' }
@@ -128,15 +165,12 @@ export async function listFiles({ db, provider, embedModel, baseUrl, apiKey, tim
   return data
 }
 
-export async function commit({ payload, db, provider, embedModel, baseUrl, apiKey, timeoutMs = 180_000 }) {
+export async function commit({ payload, db, provider, embedModel, baseUrl, apiKey, vectorProfile, route, timeoutMs = 180_000 }) {
   const tmpDir = ensureDir(path.join(dataDir(), 'tmp'))
   const file = path.join(tmpDir, `commit-${process.pid}-${Date.now()}.json`)
   try {
     fs.writeFileSync(file, JSON.stringify(payload, null, 2), 'utf8')
-    const res = await run(['commit', file, '--json'], {
-      env: envFor({ db, provider, embedModel, baseUrl, apiKey }),
-      timeoutMs,
-    })
+    const res = await runConfigured(['commit', file, '--json'], { db, provider, embedModel, baseUrl, apiKey, vectorProfile, route, timeoutMs })
     const data = parseJson(res.stdout)
     if (data === null) {
       return { raw: res.stdout.trim(), parseWarning: 'memu commit returned non-JSON' }

package/lib/paths.js

@@ -243,6 +243,30 @@ export function stamp() {
   return new Date().toISOString()
 }
 
+/**
+ * Windows 子进程的系统变量补齐。
+ *
+ * 宿主在工具化执行里把 `process.env` 清空后（docs/env-and-commands.md §9.1），注入进程的
+ * 组件（输入法云缓存、DirectWrite 字体缓存）用 `%SystemDrive%\ProgramData\...` 拼路径时会
+ * 展开失败，于是整串被当成相对路径写进**当前工作目录** —— 仓库里出现过字面量
+ * `%SystemDrive%/ProgramData/...` 就是这么来的。
+ *
+ * 只补缺失的键：宿主给了正确的值就绝不覆盖。返回的是 overlay，调用方按
+ * `{ ...overlay, ...process.env, ...explicit }` 的顺序合并。
+ */
+export function windowsSystemEnv(platform = process.platform, env = process.env) {
+  if (platform !== 'win32') return {}
+  const source = env || {}
+  const drive = String(source.SystemDrive || source.HOMEDRIVE || 'C:')
+  const root = String(source.SystemRoot || source.windir || source.WINDIR || (drive.replace(/\\$/, '') + '\\Windows')).replace(/\\/g, '/')
+  const overlay = {}
+  if (!source.SystemDrive) overlay.SystemDrive = drive
+  if (!source.SystemRoot) overlay.SystemRoot = root
+  if (!source.windir && !source.WINDIR) overlay.windir = root
+  if (!source.PATH && !source.Path) overlay.PATH = root + '/system32'
+  return overlay
+}
+
 export function safeSegment(value, fallback = 'unknown') {
   const text = String(value ?? '').trim()
   if (!text) return fallback

package/lib/preset-scope.js

@@ -0,0 +1,121 @@
+// Preset conversations (an `agentPreset` whose cordis.yml lists its own model-facing
+// plugins) live in a scope subtree the host composition cannot see: `agent/pre-step`
+// never reaches the host-level listener, so no binding is ever created and the memory
+// anchor never appears. Nothing in the host API lets a plugin append rows to someone
+// else's preset, so the only way in is the agent's *own* context — the same object the
+// runtime hands to `agents.get(id)?.ctx`.
+//
+// The trap is double injection: for a normal conversation the host-level listener
+// already covers it, and attaching again on the agent ctx would inject twice. The test
+// is structural, not aesthetic — walk the agent's fiber chain and ask whether our own
+// fiber is in it. Same tree means "already covered; do not attach".
+
+import { registerInjection } from './inject.js'
+
+export const ATTACH_MS = 10_000
+
+// One registry per process: attachPresetAgents must see what previous passes attached,
+// otherwise every tick would stack another listener. Keyed by agent context.
+const attachments = new Map()
+let warnedNoCtx = false
+
+/**
+ * True when `agentCtx` sits inside the caller's own scope tree — the case the host
+ * listener already serves. Walks `fiber.parent.fiber`, stopping at the root.
+ */
+export function sameScopeTree(agentCtx, hostCtx) {
+  let fiber = agentCtx?.fiber
+  const own = hostCtx?.fiber
+  if (!fiber || !own) return false
+  for (let depth = 0; depth < 64; depth += 1) {
+    if (fiber === own) return true
+    const parent = fiber.parent?.fiber
+    if (!parent || parent === fiber) return false
+    fiber = parent
+  }
+  return false
+}
+
+/**
+ * Attach the memory pre-step listener to every live conversation that the host
+ * listener cannot see. Idempotent: one disposal per agent context, dropped when the
+ * agent goes away.
+ *
+ * Returns the number of conversations newly attached this pass.
+ */
+export function attachPresetAgents(ctx, { log = () => {}, attached = attachments } = {}) {
+  let agents
+  try {
+    agents = ctx.get('agents')
+  } catch {
+    return 0
+  }
+  if (!agents?.list) return 0
+  let live = []
+  try {
+    live = agents.list() || []
+  } catch {
+    return 0
+  }
+  const seen = new Set()
+  let added = 0
+  let resolved = 0
+  for (const raw of live) {
+    // `agents.list()` may hand back bare agent objects or the registry's
+    // `{ agent, owner, ctx }` records, and `agent.ctx` is only guaranteed on the
+    // record. Accept both shapes instead of betting on one host version.
+    const agent = raw?.agent && raw?.ctx ? raw.agent : raw
+    const sessionId = agent?.session?.header?.id
+    if (!sessionId) continue
+    if (agent?.session?.header?.origin === 'subagent') continue
+    const actx = raw?.ctx || agent?.ctx || (() => {
+      try { return agents.get?.(sessionId)?.ctx } catch { return undefined }
+    })()
+    if (!actx) continue
+    resolved += 1
+    seen.add(actx)
+    if (!attached.has(actx) && !sameScopeTree(actx, ctx)) {
+      try {
+        const dispose = registerInjection(actx, { guide: false, guideMessage: true })
+        attached.set(actx, dispose)
+        added += 1
+        log(`attached memory injection to preset conversation ${sessionId}`)
+      } catch (error) {
+        log(`could not attach memory injection to ${sessionId}: ${error?.message || error}`)
+      }
+    }
+  }
+  for (const [key, dispose] of attached.entries()) {
+    if (seen.has(key)) continue
+    try { dispose?.() } catch {}
+    attached.delete(key)
+  }
+  // One quiet line the first time the host hands us agents without a context: without
+  // it the whole adaptation fails silently and looks exactly like "nothing happened".
+  if (live.length > 0 && resolved === 0 && !warnedNoCtx) {
+    warnedNoCtx = true
+    log('agents.list() exposed no agent context on this host; preset conversations cannot be attached')
+  }
+  return added
+}
+
+/** Start the attach loop; returns a disposer that stops it and detaches every agent. */
+export function registerPresetAttachment(ctx, { log = () => {}, intervalMs = ATTACH_MS } = {}) {
+  const attached = attachments
+  const run = () => {
+    try {
+      attachPresetAgents(ctx, { log, attached })
+    } catch (error) {
+      log(`preset attachment pass failed: ${error?.message || error}`)
+    }
+  }
+  run()
+  const timer = setInterval(run, intervalMs)
+  timer.unref?.()
+  return () => {
+    clearInterval(timer)
+    for (const [, dispose] of attached.entries()) {
+      try { dispose?.() } catch {}
+    }
+  }
+}

package/lib/private.js

@@ -1,10 +1,11 @@
 import { createUserMessage } from '@deepseek-ai/dsh-llm'
 import crypto from 'node:crypto'
-import { getSessionBinding, getLibrary, getSettings, setSessionBinding, getMemoryBackend, loadPrivateIndex, effectiveScope } from './state.js'
+import { getSessionBinding, getLibrary, getSettings, setSessionBinding, loadPrivateIndex, effectiveScope } from './state.js'
 import { domainOf, privateRemember, isMemoryEligible, visibleToSession } from './memory.js'
 import { loadPromptForDomain, CONSOLIDATION_CONTRACTS } from './prompts.js'
 import { summarizeRemote } from './remote-summary.js'
 import { condenseEvents, readSessionSnapshot } from './curator.js'
+import { record } from './activity-log.js'
 
 // Short-term entries expire on a clock, so the idle pass is the last moment anyone
 // can decide what they were worth. The list is generated in code rather than added
@@ -141,7 +142,6 @@ export async function requestPrivateConsolidation(ctx, sessionId, options = {})
   const binding = getSessionBinding(sessionId)
   if (!binding) return { ok: false, error: 'session is not bound to a memory library; bind it first' }
   if (!binding.libraryId || !effectiveScope(binding).useLibrary) return { ok: false, error: 'private memory is disabled for this session or folder' }
-  if (getMemoryBackend() === 'api') return requestRemoteConsolidation(ctx, sessionId, options)
   // Always a fork, never the live session's own inbox. `agent.followup` on the
   // chat the user is looking at does queue a real turn — but the host renders a
   // queued next-turn message as a pending draft above the composer (editable,
@@ -192,8 +192,19 @@ export async function requestRemoteConsolidation(ctx, sessionId, { signal, timeo
       })
     }
     setSessionBinding(sessionId, { lastSleepSeq: events[events.length - 1]?.seq })
-    return { ok: true, sessionId, backend: 'api', count: memories.length }
+    const result = { ok: true, sessionId, backend: 'api', count: memories.length }
+    record({
+      kind: 'consolidate', scope: 'private', sessionId, libraryId: binding.libraryId || null, ok: true,
+      message: `整理完成（远程）· 写入 ${memories.length}`,
+      detail: { ...result, forced: force },
+    })
+    return result
   } catch (error) {
+    record({
+      kind: 'consolidate', scope: 'private', sessionId, libraryId: binding.libraryId || null, ok: false, level: 'error',
+      message: '整理失败（远程）：' + String(error?.message || error),
+      detail: { forced: force },
+    })
     return { ok: false, error: String(error?.message || error) }
   }
 }
@@ -210,6 +221,47 @@ async function loadBuildForkSeed() {
   }
 }
 
+function agentOptionsFromConfig(config) {
+  if (!config || typeof config !== 'object') return null
+  const provider = typeof config.provider === 'string' ? config.provider.trim() : ''
+  const model = typeof config.model === 'string' ? config.model.trim() : ''
+  if (!provider || !model) return null
+  const options = { provider, model }
+  if (typeof config.reasoningEffort === 'string' && config.reasoningEffort) options.reasoningEffort = config.reasoningEffort
+  if (Number.isSafeInteger(config.maxTokens) && config.maxTokens > 0) options.maxTokens = config.maxTokens
+  return options
+}
+
+// A fork starts a fresh agent loop, so it does not inherit the parent's Agent options.
+// The parent's live request header is the route that actually served its latest turn;
+// an older request/header event is the only equivalent for a closed session. Without
+// one of these, the standard preset cannot resolve {{model}} and every fork dies before
+// its first step, so refuse to create that fork instead of queueing another doomed seed.
+function inheritedAgentOptions(ctx, sessionId, events) {
+  let live
+  try { live = ctx.get?.('agents')?.get?.(sessionId) } catch {}
+  try {
+    const fromRequest = agentOptionsFromConfig(live?.session?.requestHeader?.()?.config)
+    if (fromRequest) return fromRequest
+  } catch {}
+  const fromLive = agentOptionsFromConfig(live?.options)
+  if (fromLive) return fromLive
+  for (let i = events.length - 1; i >= 0; i -= 1) {
+    if (events[i]?.type !== 'request/header') continue
+    const fromEvent = agentOptionsFromConfig(events[i]?.data?.header?.config)
+    if (fromEvent) return fromEvent
+  }
+  return null
+}
+
+function turnEndFailure(event) {
+  const reason = event?.data?.reason
+  if (!reason || typeof reason !== 'object') return 'the fork produced no turn/end event'
+  if (reason.kind === 'completed') return null
+  const message = reason?.error?.message || reason?.reason?.message || reason?.message
+  return 'the fork turn ended ' + (reason.kind || 'without a reason') + (message ? ': ' + message : '')
+}
+
 const inFlight = new Map()
 
 // Every agent-backend consolidation runs here, live sessions included: the same
@@ -230,29 +282,56 @@ export async function requestHistoricalConsolidation(ctx, sessionId, { maxWaitMs
   const abort = new AbortController()
   inFlight.set(sessionId, abort)
   let handle = null
+  let offSession = null
+  let turnEnd = null
+  // 每次整理都要在活动日志里留一条：谁触发（手动/空闲）、fork 有没有建、结果是完成、
+  // 超时还是失败。否则"点了没反应"只能靠翻会话文件才知道发生了什么。
+  const finish = (result) => {
+    const ok = result?.ok === true
+    const skipped = Boolean(result?.skipped)
+    record({
+      kind: 'consolidate',
+      scope: 'private',
+      sessionId,
+      libraryId: binding.libraryId || null,
+      ok,
+      level: ok ? (skipped ? 'info' : 'info') : (result?.timedOut ? 'warn' : 'error'),
+      message: '整理' + (ok ? (skipped ? '跳过（没有值得记的内容）' : '完成') : (result?.timedOut ? '超时' : '失败'))
+        + (force ? ' · 手动' : ' · 空闲')
+        + (result?.childId ? ' · fork ' + result.childId.slice(-8) : '')
+        + (result?.error ? '：' + String(result.error) : '')
+        + (result?.count !== undefined ? ' · 写入 ' + result.count : ''),
+      detail: { force, ...result },
+      refs: [],
+    })
+    return result
+  }
   try {
     const sessionQuery = ctx.get?.('sessionQuery')
     const agents = ctx.get?.('agents')
     if (!sessionQuery?.readSession || typeof agents?.create !== 'function') {
-      return { ok: false, error: 'host has no readSession / agents.create; historical consolidation is unavailable' }
+      return finish({ ok: false, error: 'host has no readSession / agents.create; historical consolidation is unavailable' })
     }
     const buildForkSeed = await loadBuildForkSeed()
-    if (!buildForkSeed) return { ok: false, error: 'dsh-session buildForkSeed is unavailable' }
+    if (!buildForkSeed) return finish({ ok: false, error: 'dsh-session buildForkSeed is unavailable' })
 
     const childId = `memu-consolidate-${Date.now().toString(36)}-${crypto.randomBytes(3).toString('hex')}`
     const snapshot = await sessionQuery.readSession(sessionId)
     const events = Array.isArray(snapshot?.events) ? snapshot.events : []
     const lastSeq = events[events.length - 1]?.seq
-    if (events.length === 0 || lastSeq === undefined) return { ok: false, error: 'this session has no content to consolidate' }
+    if (events.length === 0 || lastSeq === undefined) return finish({ ok: false, error: 'this session has no content to consolidate' })
     // The scheduler asks "is this conversation idle", which is not the same as
     // "did anything happen that deserves a memory". Answer the second question
     // before paying for a fork; a manual consolidation passes force and skips it.
     if (!force) {
       const value = assessConsolidationValue(unconsolidatedEvents(binding, events))
-      if (!value.worth) return { ok: true, sessionId, skipped: value.reason, settled: true, assessment: value }
+      if (!value.worth) return finish({ ok: true, sessionId, skipped: value.reason, settled: true, assessment: value })
     }
     const header = snapshot?.session || {}
 
+    const agentOptions = inheritedAgentOptions(ctx, sessionId, events)
+    if (!agentOptions) return finish({ ok: false, error: 'cannot inherit the parent model/provider; consolidation fork was not created' })
+
     // `inheritedEventCount` is a TOP-LEVEL CreateAgentOptions field, NOT session
     // metadata: SessionStore.prepare() rebuilds the header from a fixed meta
     // whitelist (version, id, createdAt, cwd, parentSession, isSeeded, origin,
@@ -273,9 +352,37 @@ export async function requestHistoricalConsolidation(ctx, sessionId, { maxWaitMs
       // The fork is the parent's transcript, so it inherits every event through lastSeq.
       inheritedEventCount: lastSeq + 1,
       seed: buildForkSeed(events, lastSeq),
+      agentOptions,
       signal: abort.signal,
     })
 
+    // 先记"已开始"再等结果：一个大会话的 fork 可能跑好几分钟，没有这条记录，
+    // 侧边栏和日志页在等待期间只会显示上一次的结果，用户会以为按钮没生效。
+    record({
+      kind: 'consolidate',
+      scope: 'private',
+      sessionId,
+      libraryId: binding.libraryId || null,
+      ok: true,
+      message: '整理已开始 · ' + (force ? '手动' : '空闲') + ' · fork ' + childId.slice(-8) + ' · ' + events.length + ' 条事件',
+      detail: { childId, force, events: events.length, phase: 'started' },
+    })
+
+    // turn/end is the authoritative outcome of the fork's first turn. whenIdle()
+    // only means the driver stopped: an error turn also resolves it, so without
+    // this check a failed consolidation would advance lastSleepSeq and look like
+    // success to the idle sweep. The listener is public and session-scoped; we
+    // register before followup so the event cannot race the wait.
+    const childSession = handle?.agent?.session
+    if (typeof ctx.on === 'function' && childSession) {
+      try {
+        offSession = ctx.on('session/event', (session, event) => {
+          if (session !== childSession || event?.type !== 'turn/end') return
+          turnEnd = event
+        })
+      } catch {}
+    }
+
     // The fork must write into the parent's library, not derive one from its own
     // freshly minted session id.
     setSessionBinding(childId, {
@@ -290,8 +397,8 @@ export async function requestHistoricalConsolidation(ctx, sessionId, { maxWaitMs
     })
 
     handle.agent.followup(noticeMessage(buildPrivateConsolidationPrompt(sessionId), '整理这场对话的私有记忆'))
-    // followup only queues, so idle is the only signal that the work actually ran
-    // before the scratch fork is thrown away.
+    // followup only queues. whenIdle says the driver stopped; turn/end says
+    // whether that turn actually succeeded, so both are checked below.
     const idle = typeof handle.agent.whenIdle === 'function' ? handle.agent.whenIdle() : Promise.resolve()
     let timer = null
     let outcome
@@ -302,14 +409,33 @@ export async function requestHistoricalConsolidation(ctx, sessionId, { maxWaitMs
     // A timeout is not success: the fork may still be mid-write. Report it as
     // unsettled so the scheduler can retry, instead of silently dropping the
     // consolidation.
-    // The next assessment measures from here, not from the top of the transcript.
-    if (outcome === 'done') setSessionBinding(sessionId, { lastSleepSeq: lastSeq })
-    return { ok: outcome === 'done', sessionId, childId, settled: outcome === 'done', timedOut: outcome === 'timeout' }
+    // On success, the next assessment measures from here, not from this transcript top.
+    if (outcome === 'done') {
+      const failure = turnEndFailure(turnEnd)
+      if (failure) return finish({ ok: false, error: 'consolidation fork failed: ' + failure, sessionId, childId, settled: false, timedOut: false })
+      setSessionBinding(sessionId, { lastSleepSeq: lastSeq })
+    }
+    // A timeout is not success: the fork may still be mid-write. It has to come
+    // back with a message, not just `timedOut` — the settings button renders
+    // `result.error` and an empty string there is indistinguishable from a click
+    // that did nothing at all (observed: two clicks, no feedback, no memories).
+    if (outcome === 'timeout') {
+      return finish({
+        ok: false,
+        sessionId,
+        childId,
+        settled: false,
+        timedOut: true,
+        error: `consolidation timed out after ${Math.round(maxWaitMs / 1000)}s; the fork was stopped (memories written before the timeout are kept). Retry, or consolidate a shorter conversation.`,
+      })
+    }
+    return finish({ ok: outcome === 'done', sessionId, childId, settled: outcome === 'done', timedOut: false })
   } catch (error) {
-    return { ok: false, error: String(error?.message || error) }
+    return finish({ ok: false, error: String(error?.message || error) })
   } finally {
     inFlight.delete(sessionId)
     abort.abort()
+    try { offSession?.() } catch {}
     try { await handle?.dispose?.() } catch {}
   }
 }