dsh-trivium 0.4.22 → 0.5.1

package/README.md

@@ -154,7 +154,7 @@ Lists unarchived preference / decision / entity (experience stays out). Check to
 
 | Action | When it takes effect |
 |---|---|
-| Check a chip | The **next** message you send in this segment carries it (L0, ≤300 tokens) |
+| Check a chip | The **next** message you send in this segment carries it (L0; chips and recall share 300 tokens) |
 | Uncheck | The turn after that no longer carries it |
 | Add | One click writes one node; a whole paste is still one node |
 | Select → Archive | Soft delete: gone from find / short map / chips; the node remains in `.tdb` |
@@ -173,7 +173,7 @@ Settings → **Trivium memory** manages the store. Check for updates sits at the
 |---|---|---|
 | **Chips (memory whitelist)** | off | Title-bar **Chips** tab next to Conversation / Trajectory. Checked chips are a whitelist for the next turn (L0, ≤300 tokens). |
 | **Session layer** | off (needs Chips on) | Plot canvas on the same tab: Create checkpoint, Update checkpoints, fork from a box. |
-| **Git sidecar** | off | Debounced write of `.dsh/trivium.jsonl`. **Generate** (on) overwrites from the current `.tdb`. **Delete jsonl** (off) removes known files. Clone / pull re-imports. |
+| **Git sidecar** | off | Debounced write of `.dsh/trivium.jsonl` (format v2; relations included, local sources never written). **Generate** (on) overwrites from the current `.tdb`. **Delete jsonl** (off) removes known files. Clone / pull re-imports. |
 | **Plugin language** | follow host | Chinese / English for this plugin's Settings card and Chips tab only. Does not change DSH. |
 | **Injection** | off | Short map only, unless you pick autoRecall or entity-name path. |
 | **Extract** | on | Write from compaction / idle. |
@@ -185,6 +185,30 @@ Injection detail: autoRecall injects at most 3 L0 hits when the step has user te
 - **Export / import** — JSON is a real round-trip. Markdown is a read-only projection (for people). Git sync uses `.dsh/trivium.jsonl` (business facts, auto). One-shot strict import from WorkBuddy `MEMORY.md`, Claude Code `CLAUDE.md`, and Codex `AGENTS.md`. No watch of those files, no session jsonl dumps.
 - **Check for updates** — Settings compares the installed version with npm latest and shows `dsh plugin --profile web add dsh-trivium` when a newer version exists. It does not auto-upgrade.
 
+### Sources, history, and recall check
+
+The card has two tabs, and a node detail has three.
+
+| Surface | What it answers |
+|---|---|
+| **Memory entries** | What is stored. Replaced versions are hidden by default; **Show replaced** is a separate switch from **Show expired**. |
+| **Recall check** | What the last turn actually injected, in estimated tokens, plus a read-only probe: candidates, real filter reasons, and the exact text that would be sent. |
+| **Content / Source / Decision history** | The body, where it came from, and the chain of decisions that replaced it. |
+
+A memory knows where it came from only if the write recorded it (`kind`, session, message, a short quote). A record with no source says so; it never guesses a session or an author. A session this process cannot confirm is reported as unavailable while the stored excerpt is kept. The host exposes no session locator, so there is no deep link — rather than inventing one.
+
+The recall check is read-only: it does not write, does not run a tool, and never requests an embedding. With no query vector it says the semantic channel did not run. Nothing on these tabs injects context or calls a model.
+
+### Replacing a decision
+
+A newer decision does not expire the old one — it supersedes it. **Replace…** on a decision picks another existing decision, shows both side by side, and asks for confirmation. The old body and deadline are kept and nothing is archived; the panel then shows **Current version** / **Replaced** as its own axis, next to **Expired**.
+
+The chain is linear: at most one direct predecessor and one successor, no cycles, at most 32 hops. Writes are validated server-side inside a per-workspace queue with both nodes' ETags, so a second window that confirmed off a stale view gets a 409 instead of overwriting. **Undo replacement** removes only that one relation, and it refuses when a newer version sits above it.
+
+A body inside a chain is confirmed history: automatic extraction, merging, editing the text, deleting or merging the node are all refused (`REVISION_PROTECTED` / `REVISION_LINKED`). Name, aliases, deadline and source notes stay editable. New text becomes a new decision that then supersedes the old one.
+
+Automatic recall still only speaks about the current version: a hit on an old body is mapped forward, de-duplicated, and carries one short `matched_history` pointer. A pin you set on the old version is never rewritten — it is marked historical with an offer to pin the current version. If the current version is archived or expired, the chain is simply not injected; the old version is not revived.
+
 ### Agent tools
 
 | Tool | What it does |
@@ -240,17 +264,29 @@ Off by default. After you turn **Chips (memory whitelist)** on in Settings, the
 
 - If the model never calls `ctx_find` and no chips are checked, the window is mostly the opening short map.
 - Extraction misses things; dirty data can be archived / deleted on the chip strip or edited / merged in Settings.
-- Do not open the same `.tdb` from two Node processes at once (one `dsh web` is enough).
+- Do not open the same `.tdb` from two Node processes at once (one `dsh web` is enough). The panel now says so instead of showing the raw TDB error.
+- **Supported window width: 900 px and up.** At 390 px the host keeps a fixed 188 px settings sidebar, leaving ~154 px for the plugin column (~106 px cards); the layout collapses but is not readable. Phone-width support is intentionally not claimed.
 - Markdown export is for humans; it cannot be parsed back. Git-friendly write-back is `trivium.jsonl`, not Markdown. External import (WorkBuddy / Claude Code / Codex) is one-shot, not two-way sync, and does not ingest session jsonl dumps.
 - Do not merge `.tdb` in git (binary). Track `trivium.jsonl`; ignore `.tdb`. jsonl merge conflicts are ordinary text — resolve, then reopen the workspace.
 - The session layer (when on) projects compaction and fork; it does not split boxes by message count. If the window has not reached DSH’s compact line, **Update checkpoints** will not invent history boxes — use **Create checkpoint**.
 - Plugin setting toggles (chips / session layer / git sidecar / recall / extract) save immediately. Embedding URL still uses Save; restart only if the Settings card itself is missing.
+- **0.5.0 writes JSONL `v: 2` and graph JSON `version: 2`.** Both are additive and a v1 file still reads, but downgrading is not supported in place: an older build ignores the revision relations and will drop them on its next write. To go back, restore the pre-upgrade file group (`.dsh/trivium.tdb` plus `.dsh/trivium.jsonl`) rather than letting the old build rewrite it.
+- A decision chain is linear in this release: one predecessor, one successor. Splitting one version into several, or a fan-in, is refused instead of half-applied.
+- Deleting a replacement relation from the JSONL file is reported as a conflict, not applied. Revoke it in the panel.
 - After the host moved to rc.8, DSH’s own older session store may not open (official SQLite format change). The workspace `.tdb` graph is still there; leftover boxes on unmatched old sessions are plot residue and do not affect `ctx_find`.
 
 ---
 
 ## Changelog
 
+**0.5.1** — Correctness release for 0.5.0. A user turn is now booked by the text actually rendered, so three long chips can no longer ship 3 × ~217 tokens against one 300 allowance; commit is idempotent and an explicit zero budget stays zero. Version resolution returns the current node's own body, type, deadline and state instead of only its id, so a query matching a superseded decision no longer shows the old instruction under the new id. Imports plan URI identity and validate the whole resulting graph before one native transaction: two versions are never merged by similar text, no `supersedes` self-loop is written, and a failed transaction leaves no node, body or edge behind. When a delivered fact changes, the session that saw it gets a short correction notice (never the old body), scoped per workspace and consumed only after delivery. Kernel: `triviumdb@0.9.0-beta.3` (pinned prerelease). Windows are supported from 900 px upward; at 390 px the host's 188 px settings sidebar leaves ~154 px for the panel, which is not readable (it does not scroll horizontally). Upgrade note: `until` values written by 0.4.21 from prose dates are not rewritten automatically — clear them with **Show expired decisions** or `ctx_remember` with `until: ""`.
+
+**0.5.0** — Memory you can audit. Chips and recall now share **one** 300-token allowance per user turn instead of clipping to 300 each, the same node can no longer appear twice, and a tool loop no longer re-injects inside one turn. The delivery ledger is keyed by host message ids, so a failed send is retried and compaction rebuilds, while a fork inherits neither the ledger nor the pins. `ctx_find` is capped at ~1200 estimated tokens with whole-record truncation, and `ctx_read` projects a field allowlist so new metadata cannot grow its output.
+
+Settings gains a **Recall check** tab (read-only: it never writes, runs a tool, or requests an embedding) and per-node **Source** / **Decision history** tabs. Provenance is reported only when a write recorded it — no invented sessions, quotes, or deep links. Recall traces name the pipeline branches that actually ran, capped at 20 per workspace+session / 10 minutes / 64 KiB each.
+
+New `supersedes` relation between decisions, confirmed by the user: linear chain, 32-hop limit, per-workspace write queue, both endpoints' ETags, idempotent `operationId`, and a revoke that touches only that edge. Chain bodies are protected from extraction, merges, edits and deletes. JSON export is `version: 2` and the Git JSONL is `v: 2`; both are additive and v1 still reads, but v2 cannot be downgraded in place.
+
 **0.4.22** — Fix [issue #3](https://github.com/QWQcool/dsh-trivium/issues/3): expiry is explicit, clearing it persists, and relevant expired history is searchable with a `stale` label. Preserve native text/vector candidates; add multiword fallback, aliases, and two-character Chinese entity anchors. Upgrade TriviumDB to `0.8.11`. Add focused expiry/recall regressions and keep automatic recall restricted to unexpired memories.
 
 The peer ranges now explicitly admit the supported DSH `0.1.5`, `0.2.0`, and `0.2.1` RC lines; a broad stable-version range alone does not include those prereleases under npm rules.

package/README.zh-CN.md

@@ -167,9 +167,9 @@ Trivium 是记忆内核，不是日记、日历或聊天伴侣。它按**节点
 
 | 开关 | 默认 | 作用 |
 |---|---|---|
-| **芯片（记忆白名单）** | 关 | 标题栏「对话 / 轨迹」旁的标签。勾选的芯片是下一轮注入白名单（L0，≤300 token）。 |
+| **芯片（记忆白名单）** | 关 | 标题栏「对话 / 轨迹」旁的标签。勾选的芯片是下一轮注入白名单（L0；与召回共用 300 token）。 |
 | **会话层** | 关（要先开芯片） | 同一标签里的情节画布：生成检查点、更新检查点、从方框分叉。 |
-| **Git 旁路** | 关 | 图有改动后延迟写入 `.dsh/trivium.jsonl`。开着可 **生成**（从当前 `.tdb` 覆盖写出）；关掉可 **删除 jsonl**。clone / pull 会导回。 |
+| **Git 旁路** | 关 | 图有改动后延迟写入 `.dsh/trivium.jsonl`（格式 v2：含版本关系，不含本机来源）。开着可 **生成**（从当前 `.tdb` 覆盖写出）；关掉可 **删除 jsonl**。clone / pull 会导回。 |
 | **界面语言** | 跟随宿主 | 只改本插件设置页和芯片标签的中英文，不改 DSH。 |
 | **注入策略** | 关 | 只有开场短地图；可改 autoRecall 或实体名折中。 |
 | **抽取** | 开 | compaction / 空闲后写入。 |
@@ -181,6 +181,30 @@ Trivium 是记忆内核，不是日记、日历或聊天伴侣。它按**节点
 - **导出导入** — JSON 是真回写。Markdown 只读投影（给人看）。给 git 用的是 `.dsh/trivium.jsonl`（业务事实，自动写）。WorkBuddy `MEMORY.md`、Claude Code `CLAUDE.md`、Codex `AGENTS.md` 可一次性严导入。不监视那些文件，不导入会话 jsonl。
 - **检查更新** — 设置页对比已装版本和 npm latest，有新版时给出 `dsh plugin --profile web add dsh-trivium`。不会在后台自动升级。
 
+### 来源、历史与召回检查
+
+面板分两个页签，条目详情分三个。
+
+| 位置 | 回答什么 |
+|---|---|
+| **记忆条目** | 存了什么。已替代的版本默认收起；**显示已替代**与**显示过期**是两个独立开关。 |
+| **召回检查** | 上一轮实际注入了什么（按估算 token），外加一次只读检查：候选、真实过滤原因、以及将要发送的原文。 |
+| **内容 / 来源 / 决策历史** | 正文、它从哪来、以及替代它的决策链。 |
+
+只有写入时确实记录了来源（`kind`、会话、消息、短引文），条目才知道自己从哪来。没有来源就直说没有，不猜会话也不猜作者；本进程无法确认的会话报「已不可用」，但保留已存的摘录。宿主没有会话定位接口，所以不提供跳转，也不拼一个假的 deep link。
+
+召回检查是只读的：不写库、不跑工具、不请求 embedding。没有查询向量时明确显示语义通道未运行。这些页签不会注入上下文，也不会调用模型。
+
+### 替代一条决策
+
+新决策不会让旧决策「过期」，而是替代它。决策上的**替代…**让你选另一条已有决策，并排展示两条、要求确认。旧正文与期限保留，不归档；之后面板把 **当前版本 / 已被替代** 作为独立一维显示，与 **已过期** 并列。
+
+首版是线性链：每个节点最多一个直接前驱与一个后继，不允许循环，最多 32 跳。写入在服务端按工作区排队校验，并带上两端 ETag，所以另一个窗口用旧视图确认时拿到 409 而不是覆盖。**撤销替代**只删这一条关系，且当下方还有更新版本时拒绝。
+
+链上的正文是已确认的历史：自动抽取、合并、改正文、删除、合并节点都会被拒绝（`REVISION_PROTECTED` / `REVISION_LINKED`）。名称、别名、期限、来源补充仍可改。新说法请新建一条决策，再让它替代旧的。
+
+自动召回只讲当前版本：命中旧正文会前向映射、去重，并带一条短 `matched_history` 指针。你手工钉的旧节点不会被改写，只标为历史并提示可以改钉当前版本。当前版本被归档或过期时，这条链直接不注入，也不会把旧版本复活。
+
 ### 四个工具
 
 | 工具 | 说明 |
@@ -236,17 +260,29 @@ Trivium 是记忆内核，不是日记、日历或聊天伴侣。它按**节点
 
 - 模型不调 `ctx_find`、也不勾芯片时，窗口里主要是开场短地图。
 - 抽取会漏；脏数据可在芯片条归档 / 删除，或到设置里改、合并。
-- 同一个 `.tdb` 不要两个 Node 进程同时打开（正常只开一个 `dsh web` 即可）。
+- 同一个 `.tdb` 不要两个 Node 进程同时打开（正常只开一个 `dsh web` 即可）。现在面板会给出一句可读说明，而不是原始 TDB 错误。
+- **支持宽度：900px 及以上。** 390px 时宿主固定保留 188px 设置侧栏，插件内容列只剩约 154px（卡片约 106px），布局会收缩但不可读。本版不声称支持手机宽度。
 - Markdown 导出是给人看的，不能再解析回去。能回写进 git 的是 `trivium.jsonl`，不是 Markdown。外部导入（WorkBuddy / Claude Code / Codex）是一次性，不是双向同步，也不会吃会话 jsonl。
 - `.tdb` 不要在 git 里合并（二进制）。跟踪 `trivium.jsonl`，忽略 `.tdb`。jsonl 冲突按普通文本解决，再打开工作区即可。
 - 会话层打开时只投影 compaction 与 fork，不会按消息条数自己切方框。窗口没到 DSH 压缩线时，「更新检查点」也补不出历史方框；要分段请点「生成检查点」。
 - 芯片 / 会话层 / Git 旁路 / 注入 / 抽取开关拨一下即保存。Embedding URL 仍要点「保存设置」。只有设置页本身没出现时才需要重启 `dsh web`。
+- **0.5.0 写出的 JSONL 是 `v: 2`，图 JSON 是 `version: 2`。** 都是增量格式，v1 文件仍可读，但不支持原地降级：旧版本会忽略版本关系，并在下次写出时把它们丢掉。要退回请恢复升级前的文件组（`.dsh/trivium.tdb` 与 `.dsh/trivium.jsonl`），不要让旧版重写一遍。
+- 这一版的决策链是线性的：一个前驱、一个后继。把一个版本拆成多条，或者多对一汇入，都会被拒绝，而不是半应用。
+- 从 JSONL 文件里删掉一条替代关系会被报告为冲突，不会直接生效；请在面板里撤销。
 - 宿主升到 rc.8 后，DSH 自己的旧会话库可能打不开（官方 SQLite 格式不兼容）。工作区里的 `.tdb` 图记忆还在；对不上号的旧情节方框可以当残留，不影响 `ctx_find`。
 
 ---
 
 ## 更新说明
 
+**0.5.1** — 0.5.0 的正确性修复版。一轮的预算改为按**实际渲染出的文本**记账，三条长芯片不可能再在同一轮送出 3 × 约 217 token；`commit` 幂等，显式 0 预算保持为 0。版本解析返回当前节点自己的正文、类型、期限与状态，而不是只换 id——查询命中被替代的决策时，不会再把旧指令挂在新 id 下。导入先按 URI 规划身份、校验映射后的完整图，再用一次原生事务提交：两个版本不会因正文相近被合并，不会写出 `supersedes` 自环，事务失败也不留下节点、正文或边。已投递的事实被修改后，看过它的会话会收到一条短更正（不重发旧正文），按工作区隔离，且只有真正送达才消费。内核升到 `triviumdb@0.9.0-beta.3`（精确锁定预发布版）。界面支持宽度为 **≥900px**；390px 时宿主固定 188px 侧栏只给面板留下约 154px，不可读（但不会横向滚动）。升级说明：0.4.21 从正文日期误写的 `until` 不会自动清除，请在「显示过期决策」里清空，或用 `ctx_remember` 传 `until: ""`。
+
+**0.5.0** — 记忆可审计。芯片与召回改为**共用**每轮 300 估算 token（原先各 300），同一节点不会出现两次，一轮内的工具循环也不再重复注入。投递账本按宿主消息 id 记账：失败可重试、压缩后可重建，fork 既不继承账本也不继承 pins。`ctx_find` 默认上限约 1200 估算 token，超预算丢弃整条记录；`ctx_read` 改为字段白名单，新元数据不会撑大默认输出。
+
+设置页新增**召回检查**页签（只读：不写库、不跑工具、不请求 embedding），条目详情新增**来源**与**决策历史**页签。只有写入时记录过来源才显示来源，不编造会话、引文或跳转。召回诊断只记录实际跑过的管线分支，每工作区+会话最多 20 条 / 10 分钟 / 每条 64KiB。
+
+决策之间新增由用户确认的 `supersedes` 关系：线性链、32 跳上限、按工作区写队列、两端 ETag、幂等 `operationId`，撤销只动这一条边。链上正文受保护，抽取、合并、改正文、删除都会被拒。JSON 导出为 `version: 2`，Git JSONL 为 `v: 2`；都是增量格式，v1 仍可读，但 v2 不能原地降级。
+
 **0.4.22** — 修复 [issue #3](https://github.com/QWQcool/dsh-trivium/issues/3)：期限只由显式字段设置，清空后不再重新生成，相关过期记忆可带 `stale` 标记检索。保留数据库原生文本 / 向量候选，增加中英文多词兜底、别名与两字中文实体锚点。TriviumDB 升至 `0.8.11`。新增期限与召回专项回归，自动召回仍排除过期记忆。
 
 peer 范围显式接受已支持的 DSH `0.1.5`、`0.2.0`、`0.2.1` RC 版本线，修复 npm 普通稳定版范围不会自动接受这些预发布版本的问题。