dsh-trivium 0.5.0 → 0.6.0

package/README.md

@@ -264,7 +264,8 @@ Off by default. After you turn **Chips (memory whitelist)** on in Settings, the
 
 - If the model never calls `ctx_find` and no chips are checked, the window is mostly the opening short map.
 - Extraction misses things; dirty data can be archived / deleted on the chip strip or edited / merged in Settings.
-- Do not open the same `.tdb` from two Node processes at once (one `dsh web` is enough).
+- Do not open the same `.tdb` from two Node processes at once (one `dsh web` is enough). The panel now says so instead of showing the raw TDB error.
+- **Supported window width: 900 px and up.** At 390 px the host keeps a fixed 188 px settings sidebar, leaving ~154 px for the plugin column (~106 px cards); the layout collapses but is not readable. Phone-width support is intentionally not claimed.
 - Markdown export is for humans; it cannot be parsed back. Git-friendly write-back is `trivium.jsonl`, not Markdown. External import (WorkBuddy / Claude Code / Codex) is one-shot, not two-way sync, and does not ingest session jsonl dumps.
 - Do not merge `.tdb` in git (binary). Track `trivium.jsonl`; ignore `.tdb`. jsonl merge conflicts are ordinary text — resolve, then reopen the workspace.
 - The session layer (when on) projects compaction and fork; it does not split boxes by message count. If the window has not reached DSH’s compact line, **Update checkpoints** will not invent history boxes — use **Create checkpoint**.
@@ -278,6 +279,10 @@ Off by default. After you turn **Chips (memory whitelist)** on in Settings, the
 
 ## Changelog
 
+**0.6.0** — Maintenance release. The read-only revision checker and the stale-deadline cleaner now ship with the package as `dsh-trivium-check` and `dsh-trivium-clear-until` (dry run by default; `--apply` clears only deadlines also present in the body, `--all` clears every stale one). The checker previously existed only in the Git checkout even though the 0.5.1 notes told users to run it. This release also pins two verifications: turn identity comes from the host's own user-message id (checked in a real session log), and a genuine second-window attempt with a stale ETag returns 409 and succeeds after refresh. No defaults or data formats changed.
+
+**0.5.1** — Correctness release for 0.5.0. A user turn is now booked by the text actually rendered, so three long chips can no longer ship 3 × ~217 tokens against one 300 allowance; commit is idempotent and an explicit zero budget stays zero. Version resolution returns the current node's own body, type, deadline and state instead of only its id, so a query matching a superseded decision no longer shows the old instruction under the new id. Imports plan URI identity and validate the whole resulting graph before one native transaction: two versions are never merged by similar text, no `supersedes` self-loop is written, and a failed transaction leaves no node, body or edge behind. When a delivered fact changes, the session that saw it gets a short correction notice (never the old body), scoped per workspace and consumed only after delivery. Kernel: `triviumdb@0.9.0-beta.3` (pinned prerelease). Windows are supported from 900 px upward; at 390 px the host's 188 px settings sidebar leaves ~154 px for the panel, which is not readable (it does not scroll horizontally). Upgrade note: `until` values written by 0.4.21 from prose dates are not rewritten automatically — clear them with **Show expired decisions** or `ctx_remember` with `until: ""`.
+
 **0.5.0** — Memory you can audit. Chips and recall now share **one** 300-token allowance per user turn instead of clipping to 300 each, the same node can no longer appear twice, and a tool loop no longer re-injects inside one turn. The delivery ledger is keyed by host message ids, so a failed send is retried and compaction rebuilds, while a fork inherits neither the ledger nor the pins. `ctx_find` is capped at ~1200 estimated tokens with whole-record truncation, and `ctx_read` projects a field allowlist so new metadata cannot grow its output.
 
 Settings gains a **Recall check** tab (read-only: it never writes, runs a tool, or requests an embedding) and per-node **Source** / **Decision history** tabs. Provenance is reported only when a write recorded it — no invented sessions, quotes, or deep links. Recall traces name the pipeline branches that actually ran, capped at 20 per workspace+session / 10 minutes / 64 KiB each.
@@ -348,6 +353,11 @@ The peer ranges now explicitly admit the supported DSH `0.1.5`, `0.2.0`, and `0.
 | Check for updates fails | That request only hits the npm registry for the latest version. Memory is unaffected; try again later. |
 | Old conversations will not open after rc.8 | That is DSH’s own session-store format change, not a broken `.tdb`. Graph memory still works via `ctx_find`; leftover boxes on unmatched old sessions are plot residue. |
 
+**Maintenance commands** (shipped with the package since 0.6.0):
+
+- `npx dsh-trivium-check <workspace>` — opens the graph **read-only** and reports `supersedes` self loops, cycles, forks, duplicate URIs, dangling endpoints and unresolvable chains. Exit code 0 clean, 2 issues, 1 cannot open.
+- `npx dsh-trivium-clear-until <workspace>` — dry run: lists stale decisions that still carry a deadline. `--apply` clears only deadlines whose text also appears in the body (the shape 0.4.21 produced from prose dates); `--apply --all` clears every stale deadline, including explicit ones. Close the host first — the kernel is single-writer.
+
 Local source checkout: `npm install`, then `node scripts/link-dsh.mjs`, then restart `dsh web`. `triviumdb` is a native module; if it will not install, check Node against `package.json` `engines` (`^22.19.0 || >=24`).
 
 ---
@@ -355,8 +365,8 @@ Local source checkout: `npm install`, then `node scripts/link-dsh.mjs`, then res
 ## Release info
 
 - GitHub: https://github.com/QWQcool/dsh-trivium
-- Package version: `0.4.22` · [npm](https://www.npmjs.com/package/dsh-trivium)
-- Tested host: `@deepseek-ai/dsh@0.1.5-rc.1` (also `0.1.1-rc.2` / `0.1.0-rc.8`)
+- Package version: `0.6.0` · [npm](https://www.npmjs.com/package/dsh-trivium)
+- Tested host: `@deepseek-ai/dsh@0.2.1-rc.4` (the peer range also admits the 0.1.x lines)
 - License: MIT (depends on [TriviumDB](https://github.com/YoKONCy/TriviumDB), Apache-2.0)
 
 ---

package/README.zh-CN.md

@@ -260,7 +260,8 @@ Trivium 是记忆内核，不是日记、日历或聊天伴侣。它按**节点
 
 - 模型不调 `ctx_find`、也不勾芯片时，窗口里主要是开场短地图。
 - 抽取会漏；脏数据可在芯片条归档 / 删除，或到设置里改、合并。
-- 同一个 `.tdb` 不要两个 Node 进程同时打开（正常只开一个 `dsh web` 即可）。
+- 同一个 `.tdb` 不要两个 Node 进程同时打开（正常只开一个 `dsh web` 即可）。现在面板会给出一句可读说明，而不是原始 TDB 错误。
+- **支持宽度：900px 及以上。** 390px 时宿主固定保留 188px 设置侧栏，插件内容列只剩约 154px（卡片约 106px），布局会收缩但不可读。本版不声称支持手机宽度。
 - Markdown 导出是给人看的，不能再解析回去。能回写进 git 的是 `trivium.jsonl`，不是 Markdown。外部导入（WorkBuddy / Claude Code / Codex）是一次性，不是双向同步，也不会吃会话 jsonl。
 - `.tdb` 不要在 git 里合并（二进制）。跟踪 `trivium.jsonl`，忽略 `.tdb`。jsonl 冲突按普通文本解决，再打开工作区即可。
 - 会话层打开时只投影 compaction 与 fork，不会按消息条数自己切方框。窗口没到 DSH 压缩线时，「更新检查点」也补不出历史方框；要分段请点「生成检查点」。
@@ -274,6 +275,10 @@ Trivium 是记忆内核，不是日记、日历或聊天伴侣。它按**节点
 
 ## 更新说明
 
+**0.6.0** — 维护版本。只读版本链体检与过期期限清理现在随包分发：`dsh-trivium-check`、`dsh-trivium-clear-until`（默认只列不改；`--apply` 只清「期限同时出现在正文里」的那些，`--all` 清所有过期期限）。此前 0.5.1 的说明让用户运行 `scripts/check-integrity.mjs`，但该脚本并不在 npm 包里。本版同时固化两项验收：轮标识取自宿主自己的用户消息 id（已在真实会话日志中确认），以及真实第二窗口带过期 ETag 会得到 409、刷新后成功。默认值与数据格式均未变。
+
+**0.5.1** — 0.5.0 的正确性修复版。一轮的预算改为按**实际渲染出的文本**记账，三条长芯片不可能再在同一轮送出 3 × 约 217 token；`commit` 幂等，显式 0 预算保持为 0。版本解析返回当前节点自己的正文、类型、期限与状态，而不是只换 id——查询命中被替代的决策时，不会再把旧指令挂在新 id 下。导入先按 URI 规划身份、校验映射后的完整图，再用一次原生事务提交：两个版本不会因正文相近被合并，不会写出 `supersedes` 自环，事务失败也不留下节点、正文或边。已投递的事实被修改后，看过它的会话会收到一条短更正（不重发旧正文），按工作区隔离，且只有真正送达才消费。内核升到 `triviumdb@0.9.0-beta.3`（精确锁定预发布版）。界面支持宽度为 **≥900px**；390px 时宿主固定 188px 侧栏只给面板留下约 154px，不可读（但不会横向滚动）。升级说明：0.4.21 从正文日期误写的 `until` 不会自动清除，请在「显示过期决策」里清空，或用 `ctx_remember` 传 `until: ""`。
+
 **0.5.0** — 记忆可审计。芯片与召回改为**共用**每轮 300 估算 token（原先各 300），同一节点不会出现两次，一轮内的工具循环也不再重复注入。投递账本按宿主消息 id 记账：失败可重试、压缩后可重建，fork 既不继承账本也不继承 pins。`ctx_find` 默认上限约 1200 估算 token，超预算丢弃整条记录；`ctx_read` 改为字段白名单，新元数据不会撑大默认输出。
 
 设置页新增**召回检查**页签（只读：不写库、不跑工具、不请求 embedding），条目详情新增**来源**与**决策历史**页签。只有写入时记录过来源才显示来源，不编造会话、引文或跳转。召回诊断只记录实际跑过的管线分支，每工作区+会话最多 20 条 / 10 分钟 / 每条 64KiB。
@@ -344,6 +349,11 @@ peer 范围显式接受已支持的 DSH `0.1.5`、`0.2.0`、`0.2.1` RC 版本线
 | 检查更新失败 | 只请求 npm registry 拿最新版本号，不影响记忆；过一会儿再点即可。 |
 | rc.8 之后旧对话打不开 | 那是 DSH 自己的会话库格式变了，不是 `.tdb` 坏了。图记忆仍可 `ctx_find`；对不上号的旧方框可当情节残留。 |
 
+**维护命令**（0.6.0 起随包分发）：
+
+- `npx dsh-trivium-check <工作区>` —— 以**只读**方式打开图，报告 `supersedes` 自环、循环、分叉、重复 URI、悬空端点与无法解析的链。退出码：0 干净，2 有问题，1 打不开。
+- `npx dsh-trivium-clear-until <工作区>` —— 默认只列出仍带期限的过期决策；`--apply` 只清「期限文本同时出现在正文里」的那些（0.4.21 从正文抓日期的形态）；`--apply --all` 清掉所有过期期限，包括用户显式填的。先关宿主，内核是单写者。
+
 本地联调：仓库里 `npm install` 后 `node scripts/link-dsh.mjs`，再重启 `dsh web`。`triviumdb` 是原生模块，装不上时先看 Node 是否满足 `package.json` 的 `engines`（`^22.19.0 || >=24`）。
 
 ---
@@ -351,8 +361,8 @@ peer 范围显式接受已支持的 DSH `0.1.5`、`0.2.0`、`0.2.1` RC 版本线
 ## 发布信息
 
 - GitHub: https://github.com/QWQcool/dsh-trivium
-- 包版本：`0.4.22` · [npm](https://www.npmjs.com/package/dsh-trivium)
-- 测试宿主：`@deepseek-ai/dsh@0.1.5-rc.1`（兼 `0.1.1-rc.2` / `0.1.0-rc.8`）
+- 包版本：`0.6.0` · [npm](https://www.npmjs.com/package/dsh-trivium)
+- 测试宿主：`@deepseek-ai/dsh@0.2.1-rc.4`（peer 范围同时接受 0.1.x 各线）
 - License: MIT（依赖 [TriviumDB](https://github.com/YoKONCy/TriviumDB) 为 Apache-2.0）
 
 ---

package/lib/context-budget.js

@@ -35,6 +35,8 @@ export const DROP_REASONS = Object.freeze({
 const PIN_HEADER = "dsh-trivium pins (L0 only; use ctx_read for full text):";
 const RECALL_HEADER = (form) =>
   `dsh-trivium ${form || "recall"} (L0 only; use ctx_read for full text):`;
+const CORRECTION_HEADER =
+  "dsh-trivium memory corrections (facts you were given earlier changed; do not rely on their old text):";
 
 const MIN_MAP_MATCH_CHARS = 12;
 
@@ -117,20 +119,34 @@ function shapeCandidate(raw, channel) {
     supersededBy: Number.isFinite(Number(raw.supersededBy)) ? Number(raw.supersededBy) : null,
     matchedHistory: raw.matchedHistory || null,
     note: normaliseText(raw.note, 120),
+    correction: raw.correction === true,
     fingerprint: "",
   };
 }
 
-function fingerprintOf(id, l0) {
-  // Cheap stable content fingerprint: node id plus its normalised L0. Enough to
-  // tell "same record delivered twice" from "record changed within the turn".
+/**
+ * Cheap stable content fingerprint: node id, normalised L0 **and the state the
+ * model was shown**. id+L0 alone meant a deadline or archive flag could change
+ * without the next pre-step noticing, because the fingerprint still matched.
+ */
+export function fingerprintOf(id, l0, record = {}) {
+  const state = [
+    record.type || "",
+    record.until || "",
+    record.stale === true ? "s" : "",
+    record.archived === true ? "a" : "",
+    record.correction === true ? "c" : "",
+  ].join("|");
   let hash = 5381;
-  const s = String(l0 || "");
+  const s = `${String(l0 || "")}\u0000${state}`;
   for (let i = 0; i < s.length; i += 1) hash = ((hash * 33) ^ s.charCodeAt(i)) >>> 0;
   return `${id}:${hash.toString(36)}`;
 }
 
 function lineFor(record) {
+  if (record.channel === "correction") {
+    return `- [${record.type}#${record.id}] ${record.l0}`;
+  }
   const flags = [];
   if (record.stale) flags.push(record.until ? `stale until=${record.until}` : "stale");
   if (record.historical) flags.push(record.supersededBy ? `superseded->#${record.supersededBy}` : "superseded");
@@ -150,7 +166,8 @@ function withPath(record) {
 
 function blockTextOf(records, channel, form) {
   if (!records.length) return "";
-  const header = channel === "pin" ? PIN_HEADER : RECALL_HEADER(form);
+  const header =
+    channel === "pin" ? PIN_HEADER : channel === "correction" ? CORRECTION_HEADER : RECALL_HEADER(form);
   return `${header}\n${records.map((r) => r.line).join("\n")}`;
 }
 
@@ -161,16 +178,21 @@ function blockTextOf(records, channel, form) {
  */
 export function renderContextRecords(plan, { form = "recall" } = {}) {
   const pinRecords = plan.records.filter((r) => r.channel === "pin");
-  const recallRecords = plan.records.filter((r) => r.channel !== "pin");
+  const correctionRecords = plan.records.filter((r) => r.channel === "correction");
+  const recallRecords = plan.records.filter((r) => r.channel !== "pin" && r.channel !== "correction");
   const pinText = blockTextOf(pinRecords, "pin", form);
+  const correctionText = blockTextOf(correctionRecords, "correction", form);
   const recallText = blockTextOf(recallRecords, "recall", form);
   const pinTokens = pinText ? estimateTokens(pinText) : 0;
+  const correctionTokens = correctionText ? estimateTokens(correctionText) : 0;
   const recallTokens = recallText ? estimateTokens(recallText) : 0;
+  const total = pinTokens + correctionTokens + recallTokens;
   return {
     pins: { text: pinText, tokens: pinTokens },
+    corrections: { text: correctionText, tokens: correctionTokens },
     recall: { text: recallText, tokens: recallTokens },
-    total: pinTokens + recallTokens,
-    estimatedTokens: pinTokens + recallTokens,
+    total,
+    estimatedTokens: total,
   };
 }
 
@@ -178,6 +200,40 @@ function measure(records, form) {
   return renderContextRecords({ records }, { form }).total;
 }
 
+/**
+ * Budget normalisation.
+ *
+ * An explicit 0 means "send nothing". It must never be turned back into the
+ * default 300 by `Number(budget) || DEFAULT`; only a missing value is default.
+ */
+function normaliseBudget(value) {
+  if (value === undefined || value === null || value === "") return TURN_ADDITIONAL_BUDGET;
+  const n = Number(value);
+  if (!Number.isFinite(n)) return 0;
+  return Math.max(0, Math.floor(n));
+}
+
+/**
+ * Copy the current node's own fields onto the record.
+ *
+ * Without this, a hit on an old version only had its id swapped, so the model
+ * saw the new id with the superseded body — the exact defect in REVIEW P1-2.
+ */
+function applyProjection(record, resolved, { remapped = false } = {}) {
+  if (resolved.type !== undefined && resolved.type !== null && String(resolved.type).trim()) {
+    record.type = normaliseText(resolved.type, 24) || record.type;
+  }
+  if (resolved.l0 !== undefined) record.l0 = normaliseText(resolved.l0, 200);
+  if (resolved.until !== undefined) record.until = normaliseText(resolved.until, 32);
+  if (resolved.stale !== undefined) record.stale = resolved.stale === true;
+  if (resolved.archived !== undefined) record.archived = resolved.archived === true;
+  if (resolved.dirty !== undefined) record.dirty = resolved.dirty === true;
+  if (Array.isArray(resolved.path)) record.path = normalisePath(resolved.path);
+  // A search path describes the candidate node; it cannot be reused for a
+  // different (current) node, so it is dropped instead of being faked.
+  else if (remapped) record.path = [];
+}
+
 /**
  * Turn one round of candidates into the exact records to inject.
  *
@@ -204,7 +260,7 @@ export function selectContextRecords({
   delivered = null,
   mapText = "",
 } = {}) {
-  const cap = Math.max(1, Number(budget) || TURN_ADDITIONAL_BUDGET);
+  const cap = normaliseBudget(budget);
   const at = now instanceof Date ? now : new Date();
   const deliveredSet = delivered instanceof Set ? delivered : new Set();
   const mapBlob = String(mapText || "");
@@ -222,20 +278,43 @@ export function selectContextRecords({
       drop(raw, DROP_REASONS.invalid, channel);
       return;
     }
-    if (!record.l0) {
-      drop(record, DROP_REASONS.empty, channel);
-      return;
-    }
-    if (record.archived) {
-      drop(record, DROP_REASONS.archived, channel);
-      return;
-    }
-    if (record.dirty) {
-      drop(record, DROP_REASONS.dirty, channel);
+
+    /*
+     * A correction is a short notice that a fact the model was already given
+     * changed. It is deliberately NOT a recall candidate: it must survive the
+     * archived/stale filters (those describe the fact and would drop the
+     * notice), must not be remapped (the note names the new id itself), and its
+     * body is the notice, never the old or new full text.
+     */
+    if (record.correction) {
+      if (!record.l0) {
+        drop(record, DROP_REASONS.empty, channel);
+        return;
+      }
+      record.channel = "correction";
+      record.channels = ["correction"];
+      record.fingerprint = fingerprintOf(record.id, record.l0, record);
+      record.line = lineFor(record);
+      if (deliveredSet.has(record.fingerprint)) {
+        drop(record, DROP_REASONS.duplicateTurn, record.channel);
+        return;
+      }
+      if (mapBlob && mapCoversRecord(mapBlob, record.l0)) {
+        drop(record, DROP_REASONS.alreadyInMap, record.channel);
+        return;
+      }
+      const key = `correction:${record.id}`;
+      if (byId.has(key)) {
+        drop(record, DROP_REASONS.duplicateNode, record.channel);
+        return;
+      }
+      byId.set(key, record);
+      ordered.push(record);
       return;
     }
 
-    let targetId = record.id;
+    const originalId = record.id;
+    let targetId = originalId;
     if (record.channel !== "pin" && typeof resolveCurrent === "function") {
       let resolved = null;
       try {
@@ -252,17 +331,21 @@ export function selectContextRecords({
         drop(record, DROP_REASONS.noCurrent, channel);
         return;
       }
+      const remapped = nextId !== originalId;
       // The successor is gone, archived or expired: do not resurrect the old
       // node, and do not inject the dead chain either.
-      if (nextId !== record.id) {
+      if (remapped) {
         if (resolved.archived === true || resolved.stale === true) {
           drop(record, resolved.archived === true ? DROP_REASONS.archived : DROP_REASONS.stale, channel);
           return;
         }
-        record.matchedHistory = { from: record.id, current: nextId };
+        record.matchedHistory = { from: originalId, current: nextId };
         targetId = nextId;
         record.id = nextId;
       }
+      // Body, type, deadline and state all come from the node that will be
+      // rendered. The matched candidate only supplies the history pointer.
+      applyProjection(record, resolved, { remapped });
     } else if (record.channel !== "pin" && record.stale) {
       // Recall never injects expired nodes; pinned chips may be stale (the user
       // chose them) and carry a `stale until=` flag instead.
@@ -270,6 +353,19 @@ export function selectContextRecords({
       return;
     }
 
+    if (!record.l0) {
+      drop(record, DROP_REASONS.empty, channel);
+      return;
+    }
+    if (record.archived) {
+      drop(record, DROP_REASONS.archived, channel);
+      return;
+    }
+    if (record.dirty) {
+      drop(record, DROP_REASONS.dirty, channel);
+      return;
+    }
+
     const existing = byId.get(targetId);
     if (existing) {
       if (!existing.channels.includes(record.channel)) existing.channels.push(record.channel);
@@ -280,7 +376,7 @@ export function selectContextRecords({
 
     record.channel = record.channel === "pin" ? "pin" : channel;
     record.channels = [record.channel];
-    record.fingerprint = fingerprintOf(record.id, record.l0);
+    record.fingerprint = fingerprintOf(record.id, record.l0, record);
     record.line = lineFor(record);
     if (deliveredSet.has(record.fingerprint)) {
       drop(record, DROP_REASONS.duplicateTurn, record.channel);
@@ -295,7 +391,7 @@ export function selectContextRecords({
   };
 
   for (const pin of pins) accept(pin, "pin");
-  for (const correction of corrections) accept(correction, "recall");
+  for (const correction of corrections) accept(correction, "correction");
   for (const hit of recall) accept(hit, "recall");
 
   // Greedy fill in priority order: a later, shorter record may still fit after
@@ -314,6 +410,20 @@ export function selectContextRecords({
     }
   }
 
+  /*
+   * Give every kept record its real cost. The marginal (prefix) cost is what the
+   * text grows by when this record is appended, so `sum(tokens) === total` by
+   * construction and the ledger never has to guess. Header and wrapper cost is
+   * charged to the first record of each block, which is why it is not divided
+   * evenly: that would make the numbers look nicer and be wrong.
+   */
+  let previous = 0;
+  for (let i = 0; i < kept.length; i += 1) {
+    const cumulative = measure(kept.slice(0, i + 1), form);
+    kept[i].tokens = Math.max(0, cumulative - previous);
+    previous = cumulative;
+  }
+
   const rendered = renderContextRecords({ records: kept }, { form });
   return {
     budget: cap,

package/lib/index.js

@@ -46,6 +46,7 @@ import {
   remainingOf,
   reserve,
   rollback,
+  setSessionWorkspace,
 } from "./turn-ledger.js";
 import { syncSidecarOnOpen } from "./sidecar.js";
 
@@ -634,11 +635,13 @@ export function apply(ctx, config = {}) {
       beginTurn(sessionId, turnKey);
       // 300 is the cumulative allowance for one user turn, not per pre-step:
       // a tool loop that re-enters must not start a fresh 300 each time.
-      const remaining = remainingOf(sessionId, turnKey, TURN_ADDITIONAL_BUDGET);
-      if (remaining <= 0) return decision;
+      if (remainingOf(sessionId, turnKey, TURN_ADDITIONAL_BUDGET) <= 0) return decision;
 
       const db = await openWorkspaceDb(cwdOf(agent));
       const cwd = cwdOf(agent);
+      // Node ids are per database: corrections may only reach sessions reading
+      // the same workspace.
+      setSessionWorkspace(sessionId, cwd);
       const pins = chipsOn ? pinCandidates(db, sessionId, { resolveRevision: makeRevisionResolver(db) }) : [];
       const query = mode === "off" ? "" : proposedQuery(decision, messages);
       const trace =
@@ -647,6 +650,15 @@ export function apply(ctx, config = {}) {
           : startTrace({ cwd, sessionId, query, mode, semantic: "not_run", source: "pre-step" });
       const recall = mode === "off" ? { hits: [], semantic: "not_run" } : await recallCandidates(db, mode, query, (stage, ids) => trace?.stage(stage, stageNodes(db, ids)));
       const form = mode === "anchor" ? "anchorRecall" : "autoRecall";
+      /*
+       * Re-read the ledger after the awaits above. Two pre-steps can overlap
+       * (the second one starts while the first is still searching), and reading
+       * `remaining` only before the awaits would let both spend the same
+       * allowance. Selection and reserve below are synchronous, so this value
+       * cannot change between planning and booking.
+       */
+      const remaining = remainingOf(sessionId, turnKey, TURN_ADDITIONAL_BUDGET);
+      if (remaining <= 0) return decision;
       const plan = selectContextRecords({
         pins,
         recall: recall.hits,
@@ -680,7 +692,7 @@ export function apply(ctx, config = {}) {
       // Reserve first, assemble second, commit last: anything that throws while
       // building the messages rolls the reservation back, so the next pre-step
       // retries the same content instead of believing it was delivered.
-      const reservation = reserve(sessionId, turnKey, plan.records);
+      const reservation = reserve(sessionId, turnKey, plan.records, { totalTokens: rendered.total });
       try {
         const extra = [];
         if (rendered.pins.text) {
@@ -694,6 +706,16 @@ export function apply(ctx, config = {}) {
             }),
           );
         }
+        if (rendered.corrections.text) {
+          // Its own message: a correction is a state notice, not recall, and it
+          // must never carry the old or new full body.
+          extra.push(
+            createUserMessage({
+              content: [{ type: "text", text: rendered.corrections.text }],
+              source: producerSource(),
+            }),
+          );
+        }
         if (rendered.recall.text) {
           extra.push(
             createUserMessage({

package/lib/integrity.js

@@ -0,0 +1,124 @@
+/**
+ * Read-only integrity check for decision revision relations.
+ *
+ * This module never writes: it walks the in-memory graph and reports what is
+ * inconsistent. It deliberately does not repair anything — a chain that was
+ * damaged by an old import has to be restored from a backup or an export, and
+ * guessing a repair would invent history.
+ */
+
+import { EDGE_LABELS, REVISION_WALK_LIMIT } from "./schema.js";
+
+const SUPERSEDES = EDGE_LABELS.supersedes;
+
+function edgeTargetOf(edge) {
+  const raw = edge?.targetId ?? edge?.target_id ?? edge?.target ?? edge?.dst;
+  const id = Number(raw);
+  return Number.isFinite(id) ? id : null;
+}
+
+/**
+ * @returns {{ok:boolean, nodes:number, edges:number, issues:Array<object>}}
+ */
+export function checkRevisionIntegrity(db) {
+  const ids = (db.allNodeIds?.() || []).map(Number).filter((id) => Number.isFinite(id));
+  const idSet = new Set(ids);
+  const payloads = new Map();
+  const out = new Map();
+  const inn = new Map();
+  const uris = new Map();
+  const pairs = new Set();
+  const issues = [];
+
+  for (const id of ids) {
+    const node = db.get(id);
+    const payload = node?.payload || {};
+    payloads.set(id, payload);
+    const uri = String(payload.uri || "").trim();
+    if (uri) {
+      if (!uris.has(uri)) uris.set(uri, []);
+      uris.get(uri).push(id);
+    }
+    for (const edge of node?.edges || []) {
+      if (String(edge.label) !== SUPERSEDES) continue;
+      const to = edgeTargetOf(edge);
+      if (to === null) {
+        issues.push({ code: "missing-endpoint", id });
+        continue;
+      }
+      if (to === id) issues.push({ code: "self-loop", id });
+      const pair = `${id}\u0000${to}`;
+      if (pairs.has(pair)) issues.push({ code: "duplicate-edge", id, to });
+      pairs.add(pair);
+      if (!out.has(id)) out.set(id, []);
+      out.get(id).push(to);
+      if (!inn.has(to)) inn.set(to, []);
+      inn.get(to).push(id);
+    }
+  }
+
+  for (const [uri, owners] of uris) {
+    if (owners.length > 1) issues.push({ code: "duplicate-uri", uri, ids: owners });
+  }
+
+  const checkEndpoint = (id) => {
+    if (!idSet.has(id)) {
+      issues.push({ code: "missing-node", id });
+      return;
+    }
+    const payload = payloads.get(id) || {};
+    if (payload.type !== "decision") issues.push({ code: "non-decision", id, type: payload.type || "" });
+    if (payload.status === "archived") issues.push({ code: "archived-endpoint", id });
+  };
+
+  for (const [id, targets] of out) {
+    checkEndpoint(id);
+    if (targets.length > 1) issues.push({ code: "fork-successor", id, to: targets });
+    for (const to of targets) {
+      checkEndpoint(to);
+      if (!idSet.has(to)) issues.push({ code: "dangling-edge", id, to });
+    }
+  }
+  for (const [id, sources] of inn) {
+    if (sources.length > 1) issues.push({ code: "fork-predecessor", id, from: sources });
+  }
+
+  // Follow each chain once from its head(s). A fork stops the walk; a repeated
+  // node is a cycle; more than the walk limit is reported as too-long.
+  for (const start of out.keys()) {
+    const seen = new Set();
+    let current = start;
+    let hops = 0;
+    while (out.has(current)) {
+      if (seen.has(current)) {
+        issues.push({ code: "cycle", id: current });
+        break;
+      }
+      seen.add(current);
+      // Follow the first edge even when the node forks: a fork is reported on
+      // its own, but a cycle behind the fork must still be visible here.
+      current = out.get(current)[0];
+      hops += 1;
+      if (hops > REVISION_WALK_LIMIT) {
+        issues.push({ code: "too-long", id: start, hops });
+        break;
+      }
+    }
+  }
+
+  const unique = [];
+  const seenIssue = new Set();
+  for (const issue of issues) {
+    const key = JSON.stringify(issue);
+    if (seenIssue.has(key)) continue;
+    seenIssue.add(key);
+    unique.push(issue);
+  }
+
+  return {
+    ok: unique.length === 0,
+    nodes: ids.length,
+    edges: pairs.size,
+    issues: unique,
+  };
+}

package/lib/recall-preview.js

@@ -84,7 +84,8 @@ export function recallPreview(
   const plan = selectContextRecords({
     pins,
     recall: hits.map((hit) => candidateOf(db, hit)),
-    budget: Number(budget) || TURN_ADDITIONAL_BUDGET,
+    // Passed through untouched: an explicit 0 is a real budget, not "use 300".
+    budget,
     form,
     resolveCurrent,
   });
@@ -115,7 +116,7 @@ export function recallPreview(
       l0: r.l0,
       historical: r.historical === true,
       matchedHistory: r.matchedHistory || null,
-      tokens: 0,
+      tokens: Number(r.tokens) || 0,
     })),
     dropped: plan.dropped,
     deferred: plan.deferred,

package/lib/revisions.js

@@ -13,7 +13,9 @@
 
 import { createHash, randomUUID } from "node:crypto";
 import { EDGE_LABELS, REVISION_EDGES, nowIso, weightOf } from "./schema.js";
+import { noteFactChanged } from "./turn-ledger.js";
 import {
+  cwdOfDb,
   currentHeadOf,
   isRevisionLinked,
   persistAfterRevision,
@@ -26,6 +28,7 @@ import {
 } from "./store.js";
 import { isStalePayload } from "./until.js";
 import { provenanceOf } from "./provenance.js";
+import { payloadLooksDirty } from "./hygiene.js";
 
 /*
  * The graph predicates live in store.js: the write guards there need them, and
@@ -71,21 +74,33 @@ export function revisionStateOf(db, id) {
 }
 
 /**
- * Resolver for context selection.
+ * Resolver for context selection and tool output.
  *
- * Returns `{currentId, archived, stale}` for the head of this node's chain, or
- * null when the chain cannot be resolved — selection then drops the candidate
- * rather than injecting a guess.
+ * Returns the full projection of the head node — id, type, body, deadline and
+ * state — or null when the chain cannot be resolved. Returning only
+ * `currentId` was the REVIEW P1-2 bug: callers swapped the id but kept the
+ * superseded candidate's body, so the model read an old instruction under a new
+ * id. `path` is null on purpose: a search path belongs to the matched
+ * candidate, and reusing it for a different node would be a fabricated fact.
  */
-export function makeRevisionResolver(db) {
+export function makeRevisionResolver(db, { now } = {}) {
+  const at = now instanceof Date ? now : undefined;
   return (id) => {
     const state = revisionStateOf(db, id);
     if (!state.ok) return null;
-    const payload = db.get(state.currentId)?.payload || {};
+    const node = db.get(state.currentId);
+    if (!node) return null;
+    const payload = node.payload || {};
     return {
       currentId: state.currentId,
+      superseded: state.superseded,
+      type: payload.type || "unknown",
+      l0: String(payload.text || payload.name || "").slice(0, 200),
+      until: String(payload.until || payload.untilAt || ""),
+      stale: isStalePayload(payload, at),
       archived: payload.status === "archived",
-      stale: isStalePayload(payload),
+      dirty: payloadLooksDirty(payload),
+      path: null,
     };
   };
 }
@@ -376,6 +391,17 @@ export function supersede(db, input = {}) {
     return refuse(409, REVISION_CODES.transactionFailed, `关系写入失败，两端保持原状：${err.message}`);
   }
   persistAfterRevision(db);
+  noteFactChanged(oldId, {
+    cwd: cwdOfDb(db),
+    type: oldPayload.type || "decision",
+    l0: String(oldPayload.text || oldPayload.name || "").slice(0, 200),
+    until: String(oldPayload.until || oldPayload.untilAt || ""),
+    stale: isStalePayload(oldPayload),
+    archived: oldPayload.status === "archived",
+    note: `已被 #${successorId} 替代；后续请以 #${successorId} 为准。`,
+    currentId: successorId,
+    force: true,
+  });
   return {
     ok: true,
     oldId,
@@ -426,6 +452,18 @@ export function revokeSupersession(db, input = {}) {
     return refuse(409, REVISION_CODES.transactionFailed, `撤销失败，关系仍在：${err.message}`);
   }
   persistAfterRevision(db);
+  const oldPayload = db.get(oldId)?.payload || {};
+  noteFactChanged(oldId, {
+    cwd: cwdOfDb(db),
+    type: oldPayload.type || "decision",
+    l0: String(oldPayload.text || oldPayload.name || "").slice(0, 200),
+    until: String(oldPayload.until || oldPayload.untilAt || ""),
+    stale: isStalePayload(oldPayload),
+    archived: oldPayload.status === "archived",
+    note: `与 #${successorId} 的替代关系已撤销；#${oldId} 重新成为当前事实。`,
+    currentId: oldId,
+    force: true,
+  });
   return { ok: true, oldId, successorId, etag: { old: etagOf(db, oldId), new: etagOf(db, successorId) } };
 }