dsh-prime-memory 0.22.1 → 0.24.0

package/CHANGELOG.en.md

@@ -7,6 +7,407 @@
 
 This file covers the **0.12.0** release notes and the current **unreleased** changes in English. For the full history, see [CHANGELOG.md](./CHANGELOG.md) (Chinese).
 
+## [0.24.0] — Unreleased (local line `0.24.0-local.0…3`, 2026-10-13)
+
+### Added
+
+- **Single source of truth for the type vocabulary (`src/memory-types.ts`)**: the 29 original names of the host memory taxonomy + the plugin's legacy 7 types + the `unclassified` fallback, 37 types in total. The projection-directory whitelist, the `memory_add` write whitelist, the panel labels, the enum strings in the extraction and dedup prompts, and the type codes in memport's TS/Python dual implementations are **all derived from it**. Previously the "full set of types" was hand-copied in four places that each evolved on its own: `memory_add` **silently rewrote** external classifications into `episodic`, while the memport copy promised "passed through as-is" — two contradictory accounts of the same thing.
+- **Name distillation (`cfg.naming`)**: extraction produces a `title` on the spot, **defined separately from** `content` (the title is the noun phrase answering "what is this entry about", the content is the full narrative body); the dedup merge also produces a `merged_title`. On write, `title` is only a **name candidate** and must pass the `validateTitle` shape gate — if it fails, the naming engine still handles it; the source of truth for name uniqueness does not split into two sets of criteria just because one more source appears.
+- **few-shot standard-format example set (`src/prompts/examples.ts`)**: per-type positive and negative examples, with a cap on the total length budget (examples are a fixed cost paid on every distillation round); the positive examples themselves must pass the gate and carry a complete skeleton, and the test cases consume `auditFewShot()` directly instead of hand-copying the criteria.
+- **Executable skeleton criteria (`SKELETON_ELEMENTS` + `scoreSkeleton`)**: turning "no cause-and-effect chain, an incomplete write does not count as usable" from a wish inside the prompt into a criterion that can be measured and used to set defaults. Declared limitation: a keyword heuristic, usable only for relative comparison between two arms on the same input — not an absolute quality score.
+- **Directory skeleton + a per-type `_index.md` (`memory-md-skeleton.ts`)**: each type directory holds one index file (type name + entry count in the library). Empty directories get dropped by git and by archives, while "there is no such directory" and "this type has 0 entries" look identical to a human. Idempotent: unchanged content means zero writes and no mtime bump; zero action while the projection surface is off.
+
+### Changed
+
+- **Three defaults flipped per A/B measurement** (`narrativeTemplates.enabled` / `naming.enabled` / `naming.fewShot`). The basis is two measurements in **opposite directions**: on the real-session distillation path, skeleton completeness is **0.000** (0/23) without examples and **0.703** (26/37) with them; while for the naming task of renaming existing entries, adding examples actually **−0.113** (18/160 missed answers). Conclusion: **examples must not cross tasks** — they only enter the extraction prompt, never the naming script.
+- **md projection on by default** (`memExport.enabled`): the whole plan rests on "files are the authority on content + the database is the index"; defaulting it off means defaulting it unused. `mdSync.enabled` **still defaults off** — it writes to the database, and the risk is asymmetric.
+- **The workspace-attribution config key renamed `workspaceHints` → `workspaceSource`**: a hard rename with no compatibility alias (the key has never shipped externally with any release; adding an alias means nurturing a second source of truth). On by default; the routing `path` now stores the **workspace root** (old values were written as `E:\test\rewrite-agently\.agents`, and `targetFor` appends `.agents/memory` again → producing a `.agents\.agents\memory\` orphan tree; the guardrail "fall back to a single root only when the root does not exist" cannot catch this shape). Backfill on a real machine gave **724/1166** existing records their attribution, with `hashRecords` byte-for-byte unchanged.
+
+### Fixed
+
+- **The ledger loader overwrote absolute keys into `relPath`**: since N10 the ledger keys are absolute paths, and the "on mismatch, rewrite from the key" line fired on every single load, measurably contaminating **1167/1241** entries; downstream symptoms were orphan archiving assembling an illegal directory containing a colon, and 75 moves all failing with ENOENT. Now derived from `root` + key (new `deriveRelPath`); the archiving side no longer trusts the stored `relPath`.
+- **`--revert` did not fall back to hooks**: `findArchivedOld` touched `deps.hooks.exists` directly, while `runCli` does not pass hooks when calling revert (the apply side has `deps.hooks ?? defaultHooks`, the revert side omitted it). The first rollback run in the sandbox errored out on all 74 entries. The point is the asymmetric harm: an apply failure is escaped via `--revert`, so **a broken rollback means the backup is the only way out**.
+- **Cross-root duplicate files bypassed "if both sides changed, touch neither"**: `roots = the record's landing root ∪ the roots the ledger has recorded`, so one record can have one file under each of two roots; the decision used the old root's copy while the write went to the new root's copy computed by `targetFor` — a human edit in the old root overwrote the authoritative copy, and the report looked entirely compliant. Now only the current landing root is acknowledged; the rest are counted in the new field `staleRootFiles` and displayed on the panel.
+- **A name collision pushed the whole memory out of the retrieval library**: the `{ ...old record, id: new id }` idiom wrote to the database carrying "a name already belonging to another row" → hit the partial unique index → the batch write fell back to per-row and still failed → that entry's merged product **silently vanished** (the old record had already retired, so this supersede left nothing behind). The naming criterion changed from "name is empty" to "**this name does not belong to it**".
+- **The vector "N pending" counter never reached zero while "rebuild index" said there was nothing to do**: the display-side `missing = total − embedded` denominator included retired rows, while retired rows legitimately have no vectors by design; the two SQL statements driving the backfill both exclude retired rows, so "pending 114" and "nothing to do" appeared on the same screen. The denominator is now unified on active rows.
+- **The projection guardrail was counting "traversal" instead of "action"**: `maxRecords` also charged entries judged "unchanged" against the quota, so the second click scanned the same first N — the panel's "click again to continue" was a lie (real-machine symptom: `已写 9 · 未变 291 · 剩余 866` stayed constant). Now only entries that touched disk are counted; total scan volume is bounded by `timeBudgetMs`.
+- **O(n²) ledger flush**: `set()` serialized the whole ledger to JSON and atomically rewrote it once per entry. On 1200 entries on the same disk, measured **9442ms → 1954ms** (dirty flag + batch window + forced `flush()`).
+- **`NAME_MAX`(40) and `NAME_CLIP_MAX`(28) split into two numbers**: the character counter priced ASCII and Han characters the same, so `dsh-agent-teams` / `Python-3.13` ate 15 units in a single word, and legitimate names of just one or two words were judged `too-long`; while setting both to 40 lets `deriveName` copy a narrative sentence into a sentence tail (observed in practice). Also removed the hard-coded 28 inside `validateTitle` (one threshold, two sources of truth).
+- **Three false kills by the name gate**: the preamble-strip table and the name-reject table were **separated** (the bare subjects 「用户/团队」 no longer mistakenly kill noun phrases like 「用户npm账号用户名」, 10 real-machine entries); `has-id-fragment` narrowed to "4+ digits following a non-ASCII character" (`ADR-0006`, `Han-1413141` now pass, 4 real-machine entries).
+
+### Known boundaries
+
+- Incremental projection at the end of rumination relies on an `id→updatedAt` baseline diff, while relabel / retirement go through `patchMetadata` and do not touch `updated_time` ⇒ **a metadata-only rewrite is not re-projected in that round**.
+- P2 reverse sync still owes two items: the startup automatic hook (changed to endpoint + button only) and the batch of `pending` entries not yet on the `conflicts` adjudication surface.
+- **The 8-language translations have not been kept up since 0.20.0** (this pass only backfilled the entries from 0.22.0 onward; the 0.20/0.21 gap remains, noted separately).
+
+## [0.23.0] — Unreleased (local line `0.23.0-local.1…8`, 2026-10-12…13)
+
+### Added
+
+- **md authoritative projection surface (P0/P1/U/N10/N11)**: the `l1_records.name` column (file identity key + partial unique index); `renderRecord` + the dual-fingerprint ledger (`dbDigest`/`fileDigest`) + the `mem-export` / `mem-reconcile` endpoints; the panel's "external archive" section; the projection root switched to **workspace-first** (`<ws>/.agents/memory/<类型>/<名>.memory.md`); staleness judgment now also couples with `.memory.md.disable`.
+- **P2 reverse sync (file → index)**: a **three-way quadrant** computed from the ledger's dual digest — only the file changed → backfill into the database and rewrite with the canonical render (breaking the write-back loop); only the database changed → reuse `exportRecords` to rewrite the file; **both changed → neither side is touched**, only `pending` is raised; `.disable` goes through retirement without deleting the file; unrecognized new files are only counted, never imported (import must pass through the write kernel). Endpoint `dsh-memory/mem-sync`.
+- **P3 archive + physical delete**: the `exportThenPurge` gate moved from a whole-database hash to a **batch-level projection** (with concurrent distillation, as soon as any record unrelated to the batch is changed, the old implementation made cleanup never able to delete anything); after deletion a human-readable `retired.md` is written + the batch's projected files (including `.disable`) moved into a snapshot directory; `cleanup-retired` dry run returns a **preview of the to-delete list**; the graph projection index table gained `forgetRecords` (previously the whole repo only ever added and never removed — records restored from a snapshot were treated as "already projected" because the projection row was still there, so **they were never re-projected**, and the retrieval graph silently lacked one entry without raising an error).
+- **P4.1 default class `unclassified` + P4.2 body layout standardization** (`normalizeContentMd`). Idempotence is a hard requirement: without it the ledger's `fileDigest` changes every round, and the write-back loop is introduced by the renderer itself. Layout only, no semantics (no bulletizing prose, no inserting an H1, no stuffing metadata into the body).
+- **Orphan projection file archive `dsh-memory/mem-orphans`**: only moves files "the ledger records us as having written, and that no record currently claims this path for"; unrecognized files absent from the ledger are **left alone** (they may be input a human placed in the projection directory waiting to be synced back). Never deleted, only moved, preserving the relative shape and the original text.
+
+### Behavior fixes (recall display surface)
+
+- Recall entries no longer vanish instantly: the view carries `body` / `retired`, the removal of `session_recalled` rows stopped, and the pill shows a "judged stale" strikethrough annotation.
+- Startup cleans up existing retirement residue (725 rows still dirty in `l1_fts` on this machine); the retirement invariant gained two bypass write paths (fixing "after marking invalid, it revives on the retrieval surface").
+- Recall scoring end to end: `-1..5` (0..5 relevance; `-1` declares stale and retires), scores feed the maturity metric (`-1/1/2` pull down and sink, `4/5` push up and float).
+- Workspace content routing landed for the first time (dsh ecosystem → `rewrite-agently`, non-dsh → `agent-no-dsh`; **only writes `workspace_id`, does not touch `scope`, does not touch `updated_time`**, and syncs the attribution columns carried by the `l1_fts` rows).
+
+### Discipline
+
+- Two giant memport functions split over two rounds (Extract Function, behavior preserved, CLI gold standard byte-for-byte regression).
+- The endpoint-contract **five-places-changed-together** discipline stayed in force (`MEMORY_ENDPOINTS ≡ switch ≡ contract dual map ≡ contract-keys count ≡ config`), count chain 55→56→57→58→59.
+
+## [0.22.2] — 2026-10-12
+
+### Added
+
+- Skin tri-state (auto/light/dark) + token override block; the panel's 11 Tabs tightened onto a single row.
+- `ext_key` idempotence for `memory_import` (`l1_records.ext_key` + partial unique index + `deduped` receipt).
+- **Memport Connect**: `.mem` parsing / pre-filtering / scanning + source registry + Connect Tab (cross-implementation sha256 gold-standard alignment).
+- **Skill crystallization**: skill-store (JSON sidecar) + candidate detection + skill recall injection + the board switch `skillsEnabled`.
+- G4 graph causal edges (导致 / 因为 / 修复了 / 取代, without bumping `projectorVersion`).
+- G3 maturity derived at read time (record-card badge + contradiction-adjudication view annotation, not part of automatic adjudication).
+- G1 `usageScenario` gating end to end (extraction → landing in `metadata.dsh_usage_scenario` → recall fine ranking; off stays byte-for-byte unchanged).
+- G2 per-type narrative templates (gated prompt variant; off is a prefix of on).
+- wing / cognition hall two axes do not cross (orthogonal accessors + disjoint value-domain regression lock).
+- **G-live live recall set of this session**: persistent sidecar + the `session-recalled` read-only endpoint + the pill read-only list.
+- `memoryRecall` session-aware projection (the data source of the brief sidebar's "recalled this session" section, `init(header).id`).
+- `cfg.slots.migrateLegacy` (off by default): softly retires rule slots that are "pinned as resident while their content is already carried by live L1".
+
+### Fixed
+
+- Rumination re-feed resetting or inflating the pending count (ruminate now passes empty messages, same semantics as `enqueueSessionSlices`).
+- The rumination finalize and `doLightRefresh`'s L3 forced real run + count zeroing + `state.save()` flush (fixing "pending L2/L3 not cleared after rumination, bouncing back on restart").
+
+### Discipline
+
+- All new capabilities off by default; in the off state the artifacts and injections are byte-for-byte unchanged; the cross-plugin display contract (the `memorySlots` projection) stays wired.
+
+## [0.22.1] — 2026-10-09
+
+### Fixed
+
+- **Popover underlay made opaque**: the memory popover in the input bar (`.dsh-mem-popover`) and the dropdown / filter panels (`.dsh-mem-pop`) previously followed the host's `--dsw-specific-menu`, which the host resolves to a translucent glass value ⇒ the panel let the background show through. Now an alias layer is stacked on an **opaque `bg-primary` underlay** (the underlay technique), so the panel is solid regardless of the host's alpha.
+
+## [0.22.0] — 2026-10-09
+
+### Changed
+
+- **Declaration surface adapted to 15rc**: 9 dsh peers covering all published host rcs (`0.1.0-rc.2..0.2.0-rc.2`, evidenced entry by entry via `npm view` and consistent across the line sets), all optional; `engines >= 0.1.0-rc.2` as a coarse fence (the precise gate is peers), `package.json` and `dsh.plugin.json` in sync.
+- **Dual-manifest version restored**: `dsh.plugin.json` had drifted at `0.20.0-beta.6-dsh0.2.0.1`, this batch aligned it byte-for-byte with `package.json` (the V1 gate).
+- **`dsh.client.inject` shrunk to `ui-primitives` only**: `dsh-client-connection` only exists as a package from 0.1.2 on, and declaring it would hang the entire client entry on 0.1.0/0.1.1 (`rpc.ts` has long lazily `ctx.get`s that connection).
+
+### Discipline
+
+- All build-type repos inject `prepack: npm run build` — `npm pack` only triggers prepack, not `prepublishOnly`; this is one of the three defense layers against the stale-build miscarriage.
+
+## [0.21.0] — 2026-10-04
+
+### Added
+
+- **Tool-group sealing (memory panel → Memory → Tool Sealing)**: 5 toggles (room management / graph / ruminate / conflict / mutate write-delete, covering 13 tools). Off = that group's tools **are not registered**, vanishing straight from the model's tool list (not a rejection at execution time). A flip takes effect instantly via a volatile hot update, no restart needed. The core reads (memory_search / memory_read_scene / memory_receipts / conversation_search) and the three slot tools are not under control. Background: most grouped tools (e.g. Room governance, rumination) are used extremely rarely day to day, so keeping them resident in the tool list only wastes attention and lures the model into mis-invoking them.
+- **Existence check on mem_ references in memory_slot_write**: L1 record_ids of the `mem_*` shape in refs are run through a `getByIds` existence check before writing; a hallucinated or misspelled id is rejected outright with a prompt to go through memory_search — guaranteeing that "memories activated by search" entering a slot reference are necessarily real records (the brief side's name-summary resolution therefore has reliable input). File-path / URL refs are not checked.
+
+## [0.20.4] — 2026-10-04 (local build, unreleased)
+
+### Fixed
+
+- **Full fault tolerance for projection refViews resolution**: the call to L1 `getByIds` inside `resolveRefViews` is wrapped in try/catch — the registry's drive has no exception protection, so any throw at the resolution layer (sqlite busy / backend degradation / abnormal record state) would take down the whole session-event driver and even the host process. On failure it degrades to that frame carrying no refViews (the front end falls back to the raw refs).
+
+## [0.20.3] — 2026-10-03
+
+### Fixed
+
+- **The `memory_search` render text now carries the id**: v0.20.2 added record_id to the output JSON and the schema, but the model sees the render product, not the raw JSON — the rendered line had no id, which for the model is as good as no return (found on real-machine retest). Each result now ends in `— id: mem_xxx`, directly writable into slot refs.
+
+## [0.20.2] — 2026-10-03
+
+### Fixed
+
+- **Projection `memorySlots` dirtiness loosened to any event**: previously dirtiness was judged by store rev only on `tool/result` (settled, non-error) — after a write it relied on "another tool result happening to come in" to refresh, and cross-session viewing had to wait for the viewing session's own tool calls; the real machine exposed the sidebar sitting on an empty frame long after a write. Changed to an O(1) rev comparison on any committed event — when rev changes, rebuild and push; the isError guard is removed (rev only increments after a real change; the event is just a trigger, not the data source).
+- **Resident injection moved to a `<system-reminder>` tag frame** (aligning with the dsh-agent-instructions AGENTS.md injection house style): the user-role carrier is unchanged, but it now presents as a tag box + authority declaration (no reply needed / do not echo / does not override system prompts or the user's direct instructions) — fixing weak models that echoed slot content verbatim as if it were the user's own speech and disrupted normal replies; closing tags inside the slot body are escaped (`</system-reminder>`) to prevent slot content from forging the frame boundary.
+
+### Added
+
+- **`memory_search` results expose `id` (L1 record_id)**: breaking the deadlock of "retrieval can't get an id → can't write slot refs / feed memory_receipts"; the schema description notes the two destinations of id.
+- **wire view exposes `refs` + `refViews`**: `mem_*` references are resolved at projection-frame build time via L1 `getByIds` into `[type] 名称简述` (first line of content, truncated at 80 chars), rendered directly by brief-sidebar (≥0.5.0-beta.2); path / URL references stay literal; missing or retired records produce no entry. Resolution happens at frame-build time — the reference set is frozen when the slot is written, so later edits to the L1 record do not flow back into old frames. The self-implemented schema only validates extra fields "if present", so old checkpoint rows pass wholesale (stateVersion untouched).
+
+## [0.20.1] — 2026-10-03 (promoted to stable; the beta channel's full capability set since beta.1 finalized)
+
+The complete Hall·Room classification-management chain (two-level registry / merge / rename / retire / update / adoption / retirement-with-records / retiring an unregistered entry adds a registry record), independent Hall and Room management pages (search filter, default-collapsed, pointer drag-and-drop classification, retirement filter), aging-weight display + recall usage stats (only entering topN counts as used). The last beta before promotion was 0.20.0-beta.26, identical in content to 0.20.1; the `dsh-0.2.0-beta` channel continues to receive subsequent betas.
+
+## [0.20.0-beta.26] — 2026-10-03
+
+### Added (usability after Hall/Room growth)
+
+- **Hall/Room name search filter**: a new search box on the Hall page (slug, display name, alias, case-insensitive) — a hit on the hall itself shows all its child rooms, otherwise only the matching child rooms are kept, and a group with no match at all is hidden; while searching, matching groups auto-expand (the collapsed state no longer hides results); the self-grown unregistered area is filtered the same way. The Room page has the same search box, composing with the retirement-filter chips.
+- **Hall grouping collapse, default all collapsed**: the hall header only shows "total N entries · M rooms"; tap the header or the ▸/▾ button to expand/collapse child rooms; "expand all / collapse all" batch buttons; the expanded state is remembered in localStorage (`dsh.memory.halls.open`). The click-to-classify priority (tap the hall header to finish classifying) is unchanged.
+
+## [0.20.0-beta.25] — 2026-10-02
+
+> Fix for self-grown rooms becoming state-invisible after retirement + the Hall child-room display rule (user ruling).
+
+### Fixed / Changed
+
+- **Self-grown unregistered rooms become "retired / restore" on retirement**: previously retirement only soft-deleted records, the vocabulary had no entry to change, and the button was always "adopt / retire". Now retire withRecords, for an unregistered slug, **auto-adds a grown registration entry and sets it retired** — the panel row instantly switches to the "retired" state, and "restore" (active:true) brings it back into the vocabulary. Persisted, survives restart.
+- **Hall page child rooms show only active**: retired rooms no longer appear under the hall grouping (see them on the Room page, which includes a "retired" filter); the group aggregate count accordingly includes only active subtypes.
+
+## [0.20.0-beta.24] — 2026-10-02
+
+### Fixed
+
+- **Hall page expand/retire aligned with the Room page**: expanding a room row on the Hall page also pulls only active records (`retired:false`); after a retirement confirmation, if that room is expanded, the expanded area auto-refreshes. (beta.23 only patched the Room page, the Hall page missed the sync — the other spot behind the user-observed "retire but I see no effect".)
+
+## [0.20.0-beta.23] — 2026-10-02
+
+> **Room page retirement filter completed** (beta.22's filter chips never landed due to a patch script failing mid-way, only the badge made it into the package — this pass writes each item to disk via Edit and verifies all green).
+
+### Fixed / Added
+
+- **Retirement-filter chips** (Room page, above the registration form): all / active (vocabulary not retired) / retired.
+- **Instant retirement effect**: expanding an entry pulls only **active** records (`retired:false`) — after retirement the expanded area shows "no memory entries"; if the room is expanded after a retirement confirmation it **auto-refreshes**; [retired] badge + grey-out fallback (already in beta.22).
+
+## [0.20.0-beta.22] — 2026-10-02
+
+> Retirement-effect visibility + Room page retirement filter (real-machine feedback: after a retirement confirmation the UI showed no change and there was no way to filter).
+
+### Fixed / Added
+
+- **Instant retirement effect**: expanding a Room-page entry pulls only **active** records (`retired:false`) — after retirement the expanded area shows "this Room has no memory entries"; if that room is expanded after a retirement confirmation its entries **auto-refresh**; mixed-listing fallback: retired entries show a [retired] badge and are greyed out.
+- **Retirement filter**: the Room page gains "all / active / retired" chips (a vocabulary retirement-state filter).
+
+## [0.20.0-beta.21] — 2026-10-02
+
+> **Retire with records**: retiring a room can optionally **retire all its active memories along with it** (previously there was only the verb table, and self-grown rooms especially had no way to be handled).
+
+### Added
+
+- **`retire withRecords`** (the Room/Hall page "retire" button, red): vocabulary retirement + batch soft-delete of all **active** records under that room (each batch ≤200, the same primitive as records-delete; reason=manual) — records can be restored one by one in the memory page's "retired" section. A self-grown unregistered row also gets a "retire" (records only, no vocabulary entry to touch). The response carries a `retiredRecords` count.
+- The "export orphans" button is relocated back to the **memory query panel** (inline in the orphan-filter row).
+
+### Fixed
+
+- recall-usage test isolation (a persisted-roundtrip case racing under parallelism); the literal `\n` display fix in the RoomTab retirement confirm dialog.
+
+## [0.20.0-beta.20] — 2026-10-02
+
+> **Room on its own tab** (separated from Hall): a room's existence, name, and entries each have their own management surface; the memory page no longer piles up Room tags.
+
+### Added
+
+- **The "Room" tab** (after Hall): a flat list of all rooms (registered entries ∪ self-grown unregistered) — **existence** (register a two-level slug / adopt grown / retire·restore), **name** (edit the display name + classification note; renaming can use a two-level slug, records follow), **entries** (▸ expand to browse that room's memory entries, default collapsed, first pull of 10); the orphan export / high-privilege toggles ride along.
+- **Re-editable after registration**: a new `room-admin update` (rewrite label/description, fields not provided are left untouched) + store `RoomRegistryStore.update` + tool `memory_room_admin action=update` + a panel "edit" entry — previously, after registration the label/description could only fill in blanks, not be rewritten.
+- **Room-row content expansion** (same as Hall-page room rows): default collapsed, ▸ expand to view entries.
+- **Memory-page Room block separated**: removed the slug chips / paging / expand block (duplicating the Hall/Room pages), keeping only the "no binding · N" orphan filter and the guidance text — room tag browsing/management belongs to the Hall/Room pages.
+
+### Changed
+
+- The merge/classify/rename forms and preview sticky-follow scroll (with many halls you no longer swipe up and down hunting for the confirm dialog).
+- Pointer-based custom drag-and-drop (the same pointer scheme as ego-browser, a fallback for webviews where HTML5 DnD does not fire).
+
+## [0.20.0-beta.19] — 2026-10-02
+
+> Classification interaction redone (real-machine feedback: HTML5 drag-and-drop does not fire in some webviews; after tapping a hall the preview was buried inside the source row and looked like "no response").
+
+### Changed
+
+- **Pointer-based custom drag-and-drop** (the same pure-pointer scheme as ego-browser): hold a room / self-grown slug → a floating ghost chip follows the finger → hover a hall header for a dashed highlight → release to classify. Not dependent on HTML5 DnD, works in any webview. Click-to-classify ("classify" / "assign" → selection state → tap the hall header) is kept.
+- **Global action bar**: the merge/classify/rename forms and the dryRun preview are **permanently at the page head** (the red confirm dialog does not scroll with the row and is no longer buried inside the source room row) — after tapping a hall you always see it.
+- **Room-row layout**: buttons pinned to one row no longer wrap (Export is no longer stranded on its own line); name/alias wrap naturally in the left info area (aliases can break mid-word).
+
+## [0.20.0-beta.18] — 2026-10-02
+
+### Maintenance
+
+- lint cleanup: the two dead imports left in stats.ts / rooms-registry.ts by beta.17's isTag→isRoomSlug replacement (missed by the release gate — after the pipe `$?` took the tail's exit code, the D2 pitfall recurring). No functional change.
+
+## [0.20.0-beta.17] — 2026-10-02
+
+> **Fix for hall/room relations lost after restart**: the loader of `rooms-registry.json` was still filtering slugs with `isTag` — on restart-from-disk all `major/minor` two-level entries were treated as illegal and **silently dropped** (single-segment halls passed, so they survived). This is the third spot of the isTag/isRoomSlug mixup; the same batch cleared the identical landmine in `normTags`.
+
+### Fixed
+
+- **Loader dropping two-level entries** (`store/rooms-registry.ts` init): the filter changed to `isRoomSlug`. **Your on-disk rooms-registry.json data was intact** (the two-level entries were always in the file, only dropped at startup) — after upgrading and reloading the relations recover automatically, no repair action needed.
+- **normTags washing out slash tags** (`metadata-validators.ts`): the gate "every tags write-back point must pass through here" used isTag, so a `hall/minor` tag written back by classification would be silently stripped the next time distillation or relabeling touched it. Now two-level room slugs pass (three-level still rejected); the `isRoomSlug` source of truth was moved into this file (to avoid a dependency cycle), and the rooms-registry re-export stays compatible.
+- **list-records two-level tag filter wrongly rejected** (same shape as stats.ts tagSel): changed to `isRoomSlug` — tapping a two-level room's record filter on the Hall page used to 400.
+- Red-test-first ×3 (two-level persistence roundtrip / normTags passing / integration two-level tag filter), verified red then fixed back to green.
+
+## [0.20.0-beta.16] — 2026-10-02
+
+> **Self-grown unregistered slugs classified straight into a hall**: each chip in the bottom "self-grown unregistered" area can now be dragged onto a hall header — adoption + becoming its subtype in one step.
+
+### Added
+
+- **grown chip drag / click classify**: drag an unregistered slug (e.g. `git-commits`) onto a hall header (or tap the "assign" button on the chip to enter selection state, then tap the target hall) → dryRun preview → confirm to run for real. Semantics = **adopt in place (from, source=grown) → rename to `hall/子类`**: record tags follow, the old name goes into the target's aliases, the entry is active and does not wear ⭐ (adoption identity). Falling back to a two-level slug under its own hall (e.g. `dsh-plugin/xxx`) = adopt in place.
+- The composition order is pinned in an integration test (markMered early-exits on an unregistered from — you must adopt from first, then rename); execMerge auto-adopts an unregistered from.
+
+## [0.20.0-beta.15] — 2026-10-02
+
+> Two back-to-back fixes from real classification feedback: ① a renamed entry wrongly carrying "retired" (it would fall out of the annotation vocabulary); ② HTML5 drag-and-drop not working in some webviews → a **click-to-classify** main path added.
+
+### Fixed
+
+- **Entry wrongly marked retired after classify (rename)**: renameRoom reuses the merge orchestration, and `markMerged`'s "turn the old entry retired" came along — the newly-classified room displayed "retired" and **fell out of the annotator vocabulary** (the listActive filter). Now rename's tail restores the prior state (an active entry stays active after rename); a real merge (union semantics) is unaffected. Red-test-first (unit + HTTP-surface integration).
+
+### Changed
+
+- **Click-to-classify as the main path**: tap the room row's "classify" → enter selection state (the button becomes "pick hall…", all hall headers dashed-highlight) → tap the target hall header → dryRun preview → confirm to run. Drag-and-drop is kept (still usable in supporting environments) but no longer depended on.
+
+## [0.20.0-beta.14] — 2026-10-02
+
+> Memory cards gain **aging weight** and **recall usage** display, and start accumulating data for "aging-weight effect statistics". Definitions (user ruling): **only entering topN (being injected into context) counts as used**; a participation attempt that did not enter = attempt only.
+
+### Added
+
+- **Card fields**: an "aging N%" chip (the read-path decay coefficient `max(0.5, 0.5^(Δ天/半衰期))`, same formula and same source as the recall ranking; ≤60% turns red = aging) + a "used/attempts" counter (the title carries last-used / last-attempt times). The toolbar gains a summary "recall usage used/attempted(rate%)".
+- **Stats surface**: `RecallUsageStore` (a recall-usage.json sidecar, the same discipline family as rooms-registry — a corrupt file falls back to read-only degrade, never blocking the recall read path); each recall round records at the three terminal states (inject / all-suppressed / budget-zeroed) (candidates attempts++, injected used++, timestamp takes the latest); in-memory immediate + a debounced 5s atomic flush, 50k entries evicted by most-recent-attempt; un-assembled = a zero-cost bypass.
+- Contract: UiRecord gains `agingWeight`/`usage`, ListRecordsResponse gains `usageSummary` (optional fields, zero breakage for old clients); the contract key count is unchanged.
+
+### Effect-statistics definitions (for later analysis)
+- usageSummary: tracked (memories with usage stats) / attempted (Σ attempts) / used (Σ used) / rate (usage %)
+- Fine-grained analysis (usage distribution by type/age band, half-life tuning basis) accumulates data from this version; the analysis view is to be discussed separately.
+
+## [0.20.0-beta.13] — 2026-10-02
+
+> Classification logic completed: putting a room under an existing hall (previously you could only add a new hall, or merge into another room and erase its identity). The panel supports **drag-and-drop classification** — drag a room and drop it on a hall header.
+
+### Added
+
+- **Hall-page drag-to-classify**: a room row is draggable (grab cursor when hiPriv is on), hall headers are drop targets (dashed highlight); release = a pre-filled rename (major/minor) straight to a dryRun preview, confirm to run — records follow, the old name goes to aliases, the grouped view hangs it under that hall. Touchscreens / environments without drag use the room-row "classify" button or the hall quick-select chips in the rename form as fallback.
+- Backend fix: `renameSlug` target validation `isTag` → `isRoomSlug` — previously two-level targets (major/minor) were wrongly rejected, so "classify under a hall" was actually broken (and the rename orchestration would rewrite records first, then throw when renaming the registry, leaving a half-done state). Per the C3 removal/change discipline: red-test-first (unit + HTTP-surface integration, one each), verified red then fixed to green.
+
+### Fixed
+
+- Same as above: the `renameSlug` two-level target validation (a gap introduced in beta.5).
+
+## [0.20.0-beta.12] — 2026-10-02
+
+> lint cleanup + the removal discipline written down (C3 added to ENGINEERING-NOTES). **No functional change**.
+
+### Maintenance
+
+- **eslint cleanup (13 error → 0)**: longtask removal residue (stats.ts dead imports ×2, RecordsTab dead state) + older batches' debt (recluster.ts dead interface and let, rooms-registry.ts / ruminate.ts / room-review.ts / two test files' dead imports and let). The remaining 4 warnings are pre-existing baseline (the any in primitives/tools).
+- **C3 "removal is also TDD" added to ENGINEERING-NOTES**: removal first changes tests to express the new expectation (red) → then removes the implementation (green); lint is a must-run gate for deletion-type changes (an unused import = an auto-detector for "not fully removed").
+
+## [0.20.0-beta.11] — 2026-10-02
+
+> Hall·Room **integration tests** landed (`tests/hall-room.integration.test.ts`: HTTP-surface full chain × real-storage user journey, 9 cases); the first integration run caught and fixed a unit-test blind spot.
+
+### Fixed
+
+- **rooms-get merged view hardcoding source `pre-registered`** (introduced in beta.4): when registry entries were merged into the count list the source was written fixed, so an adopted (source=grown) entry always wore the ⭐ pre-registered badge in the panel count chips — identity distortion. Now it uses the entry's real source (⭐ belongs only to pre-registered; adoption shows grown). Cause of the unit-test blind spot: the rooms-registry unit tests only tested the store layer, and no one asserted the source of a grown entry on the endpoint's merged row.
+
+### Tests
+
+- `hall-room.integration.test.ts`: empty-table self-grown count → two-level registration / illegal slug rejection → adoption → export three kinds → merge dryRun zero-write → run for real (backup to disk / retirement row rewrite / metadata preservation / scene recompute enqueue source='room-merge') → rename aliases → retire/restore → big-class 200 cap + small-class not counting against quota → corrupt read-only degrade red line (rooms-get not blocking, disk not written back).
+
+## [0.20.0-beta.10] — 2026-10-02
+
+> **Full removal of longtask (long-task mode)**: this family's home was on the context-compression side ("suggest starting compaction" is its domain), pm carried it by mistake — beta.8 removed the floating ball, this version removes the remaining backend. pm returns to the pure memory domain. Should "immediately distill the tail" and the like be needed later, redesign it from pm's own standpoint and re-charter it.
+
+### Removed
+
+- **Endpoints `longtask-hint-get` / `longtask-compress-tail`** (contract keys 48 → 46) and the `compressTailTurns` / debounced ruminate loop: context metering (`ContextUsageStore`), todo drift detection (`TodoRefStore`), the suggestion decision — all removed together; `hooks/long-task.ts`, `store/context-usage.ts`, `store/todo-ref.ts` three files deleted (including the todo/write-event declare module augmentation).
+- **The `cfg.longTask.*` config block** (defaults + two Schema sites): longTask keys in old config files are ignored by the schema, no migration needed.
+- **The session-level `longTask` flag and the tail-compression watermark `lastTailCompressedTurn`** (session-modes): leftover keys in old session-modes.json are naturally ignored by the load filter.
+- **`session-mode-set`'s `mode` restored to required** (that optionalization existed only for the longTask either-or); the `longTask` request/response fields deleted.
+- Kept: beta.9's roomRegistry RPC wiring fix (stands on its own); the Hall management page and Room classification management surface unchanged.
+
+## [0.20.0-beta.9] — 2026-10-02
+
+> Fix for deps being dropped across the whole panel RPC chain: `roomRegistry` and `longTaskDeps` were lost when rpcHandler assembled sources, so panel-side Room-management / long-task endpoints always read "not assembled" (the tool surface passes them directly and was unaffected, hence tools worked since beta.4 while panel registration kept erroring).
+
+### Fixed
+
+- **`registerMemoryRpc`'s rpcHandler dropped `roomRegistry`/`longTask`** (introduced in beta.4): HTTP dispatch uniformly goes through `buildEndpointDeps`, but sources carried only 7 items — `rooms-get` did not send down the registry, `room-register`/`room-admin` threw "Room registry not assembled (needs a plugin reload to initialize)", `longtask-hint-get`/`longtask-compress-tail` were always disabled. Now they are sent down with sources; a regression test pins the whole HTTP surface (register → rooms-get merge → room-admin, rpc.test.ts).
+
+## [0.20.0-beta.8] — 2026-10-02
+
+> Remove the floating-ball UI: the floating suggestion panel's home was on the context-compression side ("suggest starting compaction" is its domain), pm carried it by mistake — the FAB shipped since beta.1 is removed in this version.
+
+### Removed
+
+- **Floating ball + suggestion card (`client/src/longtask-fab.ts`, shipped since beta.1)**: entirely removed, the client reverts to two surfaces — `settings.section` (memory panel) + `conversation.input.left` (tier pill), no more application-wide floating UI. The long-task mode itself (context metering / todo reference / tail turn compression) is unaffected; the `longtask-hint-get` / `longtask-compress-tail` endpoints are kept as the backend surface, and the long-task toggle and manual-compaction entry will land in the memory settings section at finalize time.
+
+## [0.20.0-beta.7] — 2026-10-02
+
+> Room classification management third voyage (the **management-panel volume**): a dedicated "Hall" tab, hall (big class) + room (small class) managed together — manually viewing/managing Rooms no longer has to borrow the agent tool.
+
+### Added
+
+- **The "Hall" management tab** (after "Scene"): a hall grouping tree — `major/minor` go under their prefix big-class, a standalone slug forms its own hall (it is both a hall and the only room under it); the hall header row aggregates counts + a one-click "+small class" (pre-filled `hall/`); room rows show ⭐pre-registered / source / state / aliases / counts, retired greyed out. The UI terms Hall/Room are the grouping view, unrelated to Wing (the `metadata.hall` domain) and to cognition hall (ADR-0020 §7 disambiguation).
+- **Full-operation UI entry (high-privilege memoryMutate gate)**: two-level slug registration (a controlled form, placeholder `dsh-plugin` / `dsh-plugin/merge`); self-grown slug **adoption** (`source=grown`); **rename/merge** via the new RPC — dryRun preview (affected count + samples) → "confirm run", the same orchestration as the memory_room_admin tool (auto-backup before execution + scene recompute enqueued on completion); retire/restore one click (restore has no second confirm, retire does confirm); a per-room record-list CSV export; vocabulary / orphan export consolidated onto this page; merge/rename carry an "execute when rumination is idle" hint.
+- **New endpoint `dsh-memory/room-admin`** (merge/rename/retire; memoryMutate gate, endpoint-side throw semantics): contract keys 47 → 48. `rooms-export` gains `kind='records'` (export a record list by Room, `tag` required); `room-register` gains an optional `source` (adoption passes `grown`).
+- The memory Tab Room block slimmed: the management sub-panel removed (orphan export moved to the header row), the hint points to the Hall page.
+
+### Fixed
+
+- The `rooms-export` records branch kind type narrowing (TS2322) and a garbled historical error string; the CHANGELOG beta.1-beta.5 duplicate header line fix.
+
+## [0.20.0-beta.6] — 2026-10-01
+
+### Fixed
+
+- **Annotator vocabulary wired to the registry (beta.5's missing item completed)**: beta.5's merge/rename/retire landed, but the candidate annotator's (`annotateOrphanCandidates`) vocabulary was still a pure self-grown aggregate — pre-registered Rooms could not enter candidates at all. Now OrphanAnnotateIO carries a registry: the merged vocabulary = registry entries ordered first (count=0, with label/description) + the self-grown directory, capped at 120; both the ruminate and memory_room_admin annotate paths pass the argument. **Pre-registered Rooms now genuinely influence candidate annotation.**
+
+## [0.20.0-beta.5] — 2026-10-01
+
+> Room classification management second voyage (the **destructive surface**). dryRun defaults to true — merge/rename preview the impact first, run only after confirmation; auto-backup to `rooms-merge-backups/` before execution.
+
+### Added
+
+- **Room registry two-level system**: slugs support a `major` or `major/minor` two-level shape (e.g. `dsh-plugin`, `dsh-plugin/merge`); **big-class cap 200**, small-class subdivisions do not count against the big-class quota (an overall insurance of 2000). The isTag vocabulary is not loosened (slash is only allowed at the registry layer).
+- **merge/rename/retire (tool `memory_room_admin`, high-privilege)**: merge rewrites the tags of all matching records via a cursor (re-read-merge-write before writing, keys preserved across roomCandidates/roomReview/hall/anchors etc.; includes already-retired rows, consistent with the count definition); rename = 1:1 merge + registry rename (aliases absorb the old name); retire is vocabulary retirement only (existing data untouched). merge/rename running concurrently with rumination overwrite each other — stagger them (both the tool hint and ADR-0020 declare this).
+- **Rewrite-safety trio**: dryRun by default returns only affected + preview with zero writes; auto-backup matching records to `rooms-merge-backups/<ts>-<slug>.json` before running; on completion auto `invalidateRooms` + enqueue scene recompute by affected (family, scene) (`source='room-merge'`).
+- **Panel Room management sub-panel** (appears after high-privilege is enabled): a registration form (slug/name/description, via the new RPC `room-register`), orphan-list export; merge/retirement suggestions go through the agent tool (dryRun preview is more detailed).
+- Endpoint surface 46 → 47 (`room-register`).
+
+## [0.20.0-beta.4] — 2026-10-01
+
+> Room classification management first voyage (the **zero-drift surface**): an empty registry = behavior byte-identical to beta.3. The merge/rename/retire destructive surface comes with beta.5 (dryRun default true held back one version).
+
+### Added
+
+- **Room registry (`rooms-registry.json` sidecar)**: pre-register curated Rooms (slug/label/description); corrupt/empty → degrade back to a pure self-grown directory, never blocking the panel or the annotator; cap 200 to prevent spam. The `rooms-get` endpoint layer merges: a registered entry enters the vocabulary even at count=0 and carries `source`/`label`, the response gains a full `registry` field (optionally read by the client).
+- **Export endpoint `dsh-memory/rooms-export`** (kind=rooms|orphans, CSV direct out): rooms = registry ∪ self-grown vocabulary with counts; orphans = the active-record list with no Room binding (including candidate/recheck state columns).
+- **Tool `memory_room_admin`** (action=list|register): list shows the registry + self-grown overview; register pre-registers a Room (high-privilege gate, idempotent completion) — paired with `memory_room_review`'s per-item recheck, the agent gains a full "register → pre-mark → confirm one by one" classification-management entry.
+- Client: Room chips carry a "pre-registered / self-grown" source badge; orphan chips carry a pending-recheck semantics.
+
+## [0.20.0-beta.3] — 2026-10-01
+
+### Added
+
+- **Record panel Room classification improvements**: ① expand/collapse (collapse = header + a preview of the top 8 high-frequency Rooms, open/close state persisted); ② full paging in the expanded state (40 per page, ◀▶ to page), replacing the old hard cut of "only the first 40 shown"; ③ **orphan memory filter** — a leading "no binding · N" chip that shows only memories with no Room binding at all (`list-records` gains an `untagged` filter channel, `rooms-get` gains `orphanCount`, same definition as the Room count); ④ filter conditions instantly visible + one-click clear. The retrieval path has the same orphan filter.
+
+## [0.20.0-beta.2] — 2026-10-01
+
+> dsh-0.2.0-beta channel +1: full-context rumination optimization (repo soft fence / per-project scene migration / closed loop). Packaged with longtask (see beta.1), real-machine feedback merged in.
+
+### Added
+
+- **Repo soft fence (ADR-0015, `recall.scopeFence.*`, default off)**: repoKey=basename(normalized cwd) computed at write time into L1 metadata (repo_key_name/repo_key_owner/applicability, DEFAULT zero backfill, not entering FTS or the snapshot hash); recall and memory_search exits soft-downrank by `this-repo`/`cross-project` (×0.2 tunable, **only downrank, never exclude**, the chat family and unattributed records are not fenced, a dedup-path sentinel guards against mis-entry). Zero drift: when off by default, the recall order sha1 roundtrips identical.
+- **Per-project scene migration (L2 repo awareness + re-clustering)**: the L2 consolidation prompt sees repoKeyName/applicability — this-repo records are no longer merged into cross-project scenes; a `scene_recluster_jobs` queue + a rumination idle-tier consumer (snapshot → delete-summary projection → full rollback on failure, zero new LLM channel); after a repo attribution patch it auto-queries affected scenes by repoKey and enqueues a recompute.
+- **Compaction closed loop**: a 10-minute debounced rumination after a tail-compaction enqueue succeeds (flush → L2 → L3 → relabel → re-clustering consumption), fixing the break of "compacted records stranded in the distillation bucket".
+
+## [0.20.0-beta.1] — 2026-10-01
+
+> The first beta-channel release of the dsh-0.2.0 line (`dsh-0.2.0-beta` tag): long-task mode real-machine preview. Beyond the items below, this version also carries all prior main changes parked in `[Unreleased]` (activation slots / source anchors / evidence reader / memory retirement loop / three-axis conflicts etc.) — they shipped with the 0.1.7 line but the main line had no corresponding version number.
+
+### Added
+
+- **Long-task mode (`longTask.*`, default off) — the three-piece set for "long-running sessions": context metering, task reference, tail compression, plus a non-blocking floating suggestion panel.**
+  - **Context usage (`store/context-usage.ts`)**: listens to the input side of `assistant/message`'s official `usage` (input + cache read/write), taking the **most-recent value** semantics (each round's input side already contains all history, no accumulation); zeroed and recounted after `compaction/summary`. A pure in-memory per-session Map — the first assistant message after a restart can rebuild it; persistence would only resurrect stale samples.
+  - **todo reference (`store/todo-ref.ts` + `hooks/long-task.ts`)**: listens to the host's structured `todo/write` event (a full snapshot; the package types had not declared it as of 0.2.0-rc.1, so the plugin self-augments via declare module — the same precedent as §E's dsh-compaction). **Long-task sessions only**: the snapshot is flushed into one pinned `todo` slot (`SlotStore.refreshByTitle` managed refresh — repeated writes by the same subject must update in place, otherwise within the ≤8 slot cap you pile up closed-slot trails), injected residently via slot-recall — after compaction evicts the old context, the task north-star is still there. Adjacent snapshots get a lexical Jaccard drift detection (repeated writes of the same snapshot do not dilute the signal); body ≤512 bytes, truncation stated.
+  - **Tail turn compression (`longtask-compress-tail` endpoint + `compressTailTurns`)**: immediately `enqueue(force:true)`-distills the most recent N turns within (compaction watermark, latest captured turn] into memory — landing the tail conversation into searchable memory right away rather than waiting for the distillation threshold. The watermark (`SessionModeStore.lastTailCompressedTurn`) only moves forward, and repeated presses are naturally idempotent; the off tier is fully invisible; un-anchored old data is only included on the first compression (watermark 0) — rather take less than re-distill.
+  - **Suggestion state (`longtask-hint-get`) + floating ball (`client/src/longtask-fab.ts`)**: an ego-browser-style vanilla overlay (FAB + panel, drag / position persistence / viewport clamping), **the suggestion does not block** — the glow lights only when "context occupancy reaches `contextThresholdPct`" or "todo drift reaches `driftThreshold`" and long-task is off; inside the panel: the long-task toggle (temporary, per-session, **carries no mode** — flipping the switch does not reset the user's tier), the occupancy / drift progress bars, a manual tail-compaction button (only usable when long-task is on). Polling busy 2s / idle 5s, RPC failures silent; the seat contract is unchanged (settings.section exactly one, the body singleton occupies no seat).
+  - **`session-mode-set`'s `mode` made optional**: either it or `longTask` is required — flipping only the long-task switch is no longer forced to send a tier (old clients always send mode, behavior unchanged). The response `mode` is changed back to the currently effective value.
+
 ## [0.19.0] — 2026-09-29
 
 ### Changed