dsh-trivium 0.5.1 → 0.7.0

package/README.md

@@ -279,6 +279,10 @@ Off by default. After you turn **Chips (memory whitelist)** on in Settings, the
 
 ## Changelog
 
+**0.7.0** — Observability release. Settings → Recall check now lists pending and recently delivered corrections per session, scoped to the workspace, and adds a **Check version chains** button that runs the same read-only check as `dsh-trivium-check`. New read-only endpoints: `GET /api/dsh-trivium/corrections` and `GET /api/dsh-trivium/integrity`. A fault-injection regression now proves a sidecar write failure is reported by health and repaired by `bootstrap-write` on reopen, and the README documents the host-side desktop `EPIPE`. Memory format, defaults and the four-tool surface are unchanged.
+
+**0.6.0** — Maintenance release. The read-only revision checker and the stale-deadline cleaner now ship with the package as `dsh-trivium-check` and `dsh-trivium-clear-until` (dry run by default; `--apply` clears only deadlines also present in the body, `--all` clears every stale one). The checker previously existed only in the Git checkout even though the 0.5.1 notes told users to run it. This release also pins two verifications: turn identity comes from the host's own user-message id (checked in a real session log), and a genuine second-window attempt with a stale ETag returns 409 and succeeds after refresh. No defaults or data formats changed.
+
 **0.5.1** — Correctness release for 0.5.0. A user turn is now booked by the text actually rendered, so three long chips can no longer ship 3 × ~217 tokens against one 300 allowance; commit is idempotent and an explicit zero budget stays zero. Version resolution returns the current node's own body, type, deadline and state instead of only its id, so a query matching a superseded decision no longer shows the old instruction under the new id. Imports plan URI identity and validate the whole resulting graph before one native transaction: two versions are never merged by similar text, no `supersedes` self-loop is written, and a failed transaction leaves no node, body or edge behind. When a delivered fact changes, the session that saw it gets a short correction notice (never the old body), scoped per workspace and consumed only after delivery. Kernel: `triviumdb@0.9.0-beta.3` (pinned prerelease). Windows are supported from 900 px upward; at 390 px the host's 188 px settings sidebar leaves ~154 px for the panel, which is not readable (it does not scroll horizontally). Upgrade note: `until` values written by 0.4.21 from prose dates are not rewritten automatically — clear them with **Show expired decisions** or `ctx_remember` with `until: ""`.
 
 **0.5.0** — Memory you can audit. Chips and recall now share **one** 300-token allowance per user turn instead of clipping to 300 each, the same node can no longer appear twice, and a tool loop no longer re-injects inside one turn. The delivery ledger is keyed by host message ids, so a failed send is retried and compaction rebuilds, while a fork inherits neither the ledger nor the pins. `ctx_find` is capped at ~1200 estimated tokens with whole-record truncation, and `ctx_read` projects a field allowlist so new metadata cannot grow its output.
@@ -350,6 +354,12 @@ The peer ranges now explicitly admit the supported DSH `0.1.5`, `0.2.0`, and `0.
 | Memory still there after uninstall | Stop `dsh web` before `dsh plugin remove`. Leftover `.tdb` is a workspace never opened on 0.4.10+; delete `.dsh/trivium.tdb` in that folder. Committed `trivium.jsonl` comes back with `git checkout`. Disable-in-place does not wipe. |
 | Check for updates fails | That request only hits the npm registry for the latest version. Memory is unaffected; try again later. |
 | Old conversations will not open after rc.8 | That is DSH’s own session-store format change, not a broken `.tdb`. Graph memory still works via `ctx_find`; leftover boxes on unmatched old sessions are plot residue. |
+| Desktop shows “A JavaScript error occurred in the main process” with `EPIPE: broken pipe, write` | Host-side, not the plugin: `electron-updater` writes a log line to a console pipe whose parent process has exited (typical when the app was started by a test launcher with `--inspect`). No `dsh-trivium` frame is in that stack. Click OK and start the app from the Start menu; avoid launching it from a terminal or harness that closes. |
+
+**Maintenance commands** (shipped with the package since 0.6.0):
+
+- `npx dsh-trivium-check <workspace>` — opens the graph **read-only** and reports `supersedes` self loops, cycles, forks, duplicate URIs, dangling endpoints and unresolvable chains. Exit code 0 clean, 2 issues, 1 cannot open.
+- `npx dsh-trivium-clear-until <workspace>` — dry run: lists stale decisions that still carry a deadline. `--apply` clears only deadlines whose text also appears in the body (the shape 0.4.21 produced from prose dates); `--apply --all` clears every stale deadline, including explicit ones. Close the host first — the kernel is single-writer.
 
 Local source checkout: `npm install`, then `node scripts/link-dsh.mjs`, then restart `dsh web`. `triviumdb` is a native module; if it will not install, check Node against `package.json` `engines` (`^22.19.0 || >=24`).
 
@@ -358,8 +368,8 @@ Local source checkout: `npm install`, then `node scripts/link-dsh.mjs`, then res
 ## Release info
 
 - GitHub: https://github.com/QWQcool/dsh-trivium
-- Package version: `0.4.22` · [npm](https://www.npmjs.com/package/dsh-trivium)
-- Tested host: `@deepseek-ai/dsh@0.1.5-rc.1` (also `0.1.1-rc.2` / `0.1.0-rc.8`)
+- Package version: `0.7.0` · [npm](https://www.npmjs.com/package/dsh-trivium)
+- Tested host: `@deepseek-ai/dsh@0.2.1-rc.4` (the peer range also admits the 0.1.x lines)
 - License: MIT (depends on [TriviumDB](https://github.com/YoKONCy/TriviumDB), Apache-2.0)
 
 ---

package/README.zh-CN.md

@@ -275,6 +275,10 @@ Trivium 是记忆内核，不是日记、日历或聊天伴侣。它按**节点
 
 ## 更新说明
 
+**0.7.0** — 可观测性版本。设置 → 召回检查现在按会话列出待发送与最近已发送的更正（按工作区过滤），并新增「检查版本链」按钮，复用 `dsh-trivium-check` 的只读检查。新增只读接口：`GET /api/dsh-trivium/corrections`、`GET /api/dsh-trivium/integrity`。新增故障注入回归：旁路写入失败会被 health 报告，重开时由 `bootstrap-write` 修复；README 补充桌面端 `EPIPE` 的宿主侧说明。记忆格式、默认值与四工具面均未变。
+
+**0.6.0** — 维护版本。只读版本链体检与过期期限清理现在随包分发：`dsh-trivium-check`、`dsh-trivium-clear-until`（默认只列不改；`--apply` 只清「期限同时出现在正文里」的那些，`--all` 清所有过期期限）。此前 0.5.1 的说明让用户运行 `scripts/check-integrity.mjs`，但该脚本并不在 npm 包里。本版同时固化两项验收：轮标识取自宿主自己的用户消息 id（已在真实会话日志中确认），以及真实第二窗口带过期 ETag 会得到 409、刷新后成功。默认值与数据格式均未变。
+
 **0.5.1** — 0.5.0 的正确性修复版。一轮的预算改为按**实际渲染出的文本**记账，三条长芯片不可能再在同一轮送出 3 × 约 217 token；`commit` 幂等，显式 0 预算保持为 0。版本解析返回当前节点自己的正文、类型、期限与状态，而不是只换 id——查询命中被替代的决策时，不会再把旧指令挂在新 id 下。导入先按 URI 规划身份、校验映射后的完整图，再用一次原生事务提交：两个版本不会因正文相近被合并，不会写出 `supersedes` 自环，事务失败也不留下节点、正文或边。已投递的事实被修改后，看过它的会话会收到一条短更正（不重发旧正文），按工作区隔离，且只有真正送达才消费。内核升到 `triviumdb@0.9.0-beta.3`（精确锁定预发布版）。界面支持宽度为 **≥900px**；390px 时宿主固定 188px 侧栏只给面板留下约 154px，不可读（但不会横向滚动）。升级说明：0.4.21 从正文日期误写的 `until` 不会自动清除，请在「显示过期决策」里清空，或用 `ctx_remember` 传 `until: ""`。
 
 **0.5.0** — 记忆可审计。芯片与召回改为**共用**每轮 300 估算 token（原先各 300），同一节点不会出现两次，一轮内的工具循环也不再重复注入。投递账本按宿主消息 id 记账：失败可重试、压缩后可重建，fork 既不继承账本也不继承 pins。`ctx_find` 默认上限约 1200 估算 token，超预算丢弃整条记录；`ctx_read` 改为字段白名单，新元数据不会撑大默认输出。
@@ -346,6 +350,12 @@ peer 范围显式接受已支持的 DSH `0.1.5`、`0.2.0`、`0.2.1` RC 版本线
 | 卸载后记忆还在 | 先停 `dsh web` 再 `dsh plugin remove`。剩下的 `.tdb` 是从未用 0.4.10 打开过的工作区，到该文件夹删 `.dsh/trivium.tdb`。已提交的 `trivium.jsonl` 用 `git checkout` 找回。只在配置里 disabled 不会清文件。 |
 | 检查更新失败 | 只请求 npm registry 拿最新版本号，不影响记忆；过一会儿再点即可。 |
 | rc.8 之后旧对话打不开 | 那是 DSH 自己的会话库格式变了，不是 `.tdb` 坏了。图记忆仍可 `ctx_find`；对不上号的旧方框可当情节残留。 |
+| 桌面端弹出「A JavaScript error occurred in the main process / EPIPE: broken pipe, write」 | 宿主侧问题，不是插件：`electron-updater` 往一个已经断开的控制台管道写日志（常见于用 `--inspect` 的测试启动器拉起、父进程随后退出）。栈里没有 `dsh-trivium`。点确定后从开始菜单正常启动；不要从会关闭的终端/测试器拉起。 |
+
+**维护命令**（0.6.0 起随包分发）：
+
+- `npx dsh-trivium-check <工作区>` —— 以**只读**方式打开图，报告 `supersedes` 自环、循环、分叉、重复 URI、悬空端点与无法解析的链。退出码：0 干净，2 有问题，1 打不开。
+- `npx dsh-trivium-clear-until <工作区>` —— 默认只列出仍带期限的过期决策；`--apply` 只清「期限文本同时出现在正文里」的那些（0.4.21 从正文抓日期的形态）；`--apply --all` 清掉所有过期期限，包括用户显式填的。先关宿主，内核是单写者。
 
 本地联调：仓库里 `npm install` 后 `node scripts/link-dsh.mjs`，再重启 `dsh web`。`triviumdb` 是原生模块，装不上时先看 Node 是否满足 `package.json` 的 `engines`（`^22.19.0 || >=24`）。
 
@@ -354,8 +364,8 @@ peer 范围显式接受已支持的 DSH `0.1.5`、`0.2.0`、`0.2.1` RC 版本线
 ## 发布信息
 
 - GitHub: https://github.com/QWQcool/dsh-trivium
-- 包版本：`0.4.22` · [npm](https://www.npmjs.com/package/dsh-trivium)
-- 测试宿主：`@deepseek-ai/dsh@0.1.5-rc.1`（兼 `0.1.1-rc.2` / `0.1.0-rc.8`）
+- 包版本：`0.7.0` · [npm](https://www.npmjs.com/package/dsh-trivium)
+- 测试宿主：`@deepseek-ai/dsh@0.2.1-rc.4`（peer 范围同时接受 0.1.x 各线）
 - License: MIT（依赖 [TriviumDB](https://github.com/YoKONCy/TriviumDB) 为 Apache-2.0）
 
 ---

package/lib/client.js

@@ -84,6 +84,17 @@ window.__ModuleLoader__.load({
         recallSemanticOff: "语义通道未运行：只读检查不请求 embedding。",
         recallBudget: "本轮预算",
         recallBudgetHint: "估算 token，不是模型计费。芯片、更正与召回共用这 300。",
+        correctionsTitle: "更正",
+        correctionsHint: "事实被修改后，看过它的会话会收到一条短更正；只有真正送达才从待发送里移除。",
+        correctionsPending: "下一条消息生效",
+        correctionsSent: "最近已发送",
+        correctionsNone: "没有待发送或最近发送的更正。",
+        correctionsSession: "会话",
+        integrityTitle: "版本链体检",
+        integrityCheck: "检查版本链",
+        integrityOk: "版本链正常。",
+        integrityIssues: "发现问题",
+        integrityScanned: "已扫描",
         recallWillSend: "将发送给模型的文本",
         recallEmptyText: "本轮没有可注入的内容。",
         recallReasons: "入选与过滤原因",
@@ -311,6 +322,17 @@ window.__ModuleLoader__.load({
         recallSemanticOff: "Semantic channel did not run: the read-only check never requests an embedding.",
         recallBudget: "Turn budget",
         recallBudgetHint: "Estimated tokens, not model billing. Chips, corrections and recall share this 300.",
+        correctionsTitle: "Corrections",
+        correctionsHint: "When a delivered fact changes, the session that saw it gets a short notice; it leaves this list only after delivery.",
+        correctionsPending: "applies with the next message",
+        correctionsSent: "Recently sent",
+        correctionsNone: "No pending or recently sent corrections.",
+        correctionsSession: "Session",
+        integrityTitle: "Version-chain check",
+        integrityCheck: "Check version chains",
+        integrityOk: "Version chains are clean.",
+        integrityIssues: "Issues found",
+        integrityScanned: "Scanned",
         recallWillSend: "Text that would be sent to the model",
         recallEmptyText: "Nothing would be injected this turn.",
         recallReasons: "Selected and filtered reasons",
@@ -748,6 +770,9 @@ window.__ModuleLoader__.load({
       const [previewBusy, setPreviewBusy] = react.useState(false);
       const [traces, setTraces] = react.useState([]);
       const [traceError, setTraceError] = react.useState("");
+      const [corrections, setCorrections] = react.useState(null);
+      const [integrity, setIntegrity] = react.useState(null);
+      const [integrityBusy, setIntegrityBusy] = react.useState(false);
       const [showSuperseded, setShowSuperseded] = react.useState(false);
       const [revisionDialog, setRevisionDialog] = react.useState(null);
       const [revisionBusy, setRevisionBusy] = react.useState(false);
@@ -950,9 +975,33 @@ window.__ModuleLoader__.load({
         }
       };
 
+      const loadCorrections = react.useCallback(async () => {
+        try {
+          const q = cwdQuery();
+          setCorrections(await api("/api/dsh-trivium/corrections" + (q ? "?" + q : "")));
+        } catch (err) {
+          setCorrections({ ok: false, error: String(err.message || err), sessions: [] });
+        }
+      }, [status]);
+
+      const runIntegrity = async () => {
+        setIntegrityBusy(true);
+        try {
+          const q = cwdQuery();
+          setIntegrity(await api("/api/dsh-trivium/integrity" + (q ? "?" + q : "")));
+        } catch (err) {
+          setIntegrity({ ok: false, error: String(err.message || err) });
+        } finally {
+          setIntegrityBusy(false);
+        }
+      };
+
       react.useEffect(() => {
-        if (tab === "recall") loadTraces();
-      }, [tab, loadTraces]);
+        if (tab === "recall") {
+          loadTraces();
+          loadCorrections();
+        }
+      }, [tab, loadTraces, loadCorrections]);
 
       /*
        * Dialog accessibility: focus moves into the panel, Escape closes it, and
@@ -1380,6 +1429,83 @@ window.__ModuleLoader__.load({
                   ],
                 })
               : null,
+            jsx("div", { style: ui.fieldLabel, children: L.integrityTitle }),
+            jsxs("div", {
+              style: ui.toolbar,
+              children: [
+                jsx(Button, {
+                  variant: "outline",
+                  size: "sm",
+                  disabled: integrityBusy,
+                  onClick: runIntegrity,
+                  children: integrityBusy ? L.loading : L.integrityCheck,
+                }),
+                integrity
+                  ? jsx("span", { style: ui.muted, children: integrity.ok ? L.integrityOk : L.integrityIssues })
+                  : null,
+              ],
+            }),
+            integrity && !integrity.ok && (integrity.issues || []).length
+              ? jsx("div", {
+                  style: ui.error,
+                  children: integrity.issues.map((issue) => "#" + (issue.id ?? "?") + " " + issue.code).join(" · "),
+                })
+              : null,
+            integrity && integrity.ok
+              ? jsx("div", { style: ui.muted, children: L.integrityScanned + " " + integrity.nodes + " / " + integrity.edges })
+              : null,
+            jsx("div", { style: ui.fieldLabel, children: L.correctionsTitle }),
+            jsx("div", { style: ui.hint, children: L.correctionsHint }),
+            corrections === null
+              ? null
+              : !(corrections.sessions || []).length
+                ? jsx("div", { style: ui.muted, children: L.correctionsNone })
+                : jsxs("div", {
+                    style: ui.stack,
+                    children: corrections.sessions.map((session) =>
+                      jsxs(
+                        "div",
+                        {
+                          style: ui.stack,
+                          children: [
+                            jsx("div", {
+                              style: ui.muted,
+                              children: L.correctionsSession + " " + String(session.sessionId || "").slice(0, 12),
+                            }),
+                            ...(session.pending || []).map((row) =>
+                              jsxs(
+                                "div",
+                                {
+                                  style: { ...ui.muted, display: "flex", gap: 6, flexWrap: "wrap" },
+                                  children: [
+                                    jsx("span", { style: ui.tag, children: "#" + row.id }),
+                                    jsx("span", { children: row.note || "" }),
+                                    jsx("span", { children: L.correctionsPending }),
+                                  ],
+                                },
+                                "cp-" + session.sessionId + "-" + row.id,
+                              ),
+                            ),
+                            ...(session.sent || []).slice(-3).map((row, i) =>
+                              jsxs(
+                                "div",
+                                {
+                                  style: { ...ui.muted, display: "flex", gap: 6, flexWrap: "wrap" },
+                                  children: [
+                                    jsx("span", { style: ui.tag, children: "✓ #" + row.id }),
+                                    jsx("span", { children: row.note || "" }),
+                                    jsx("span", { children: L.correctionsSent }),
+                                  ],
+                                },
+                                "cs-" + session.sessionId + "-" + i,
+                              ),
+                            ),
+                          ],
+                        },
+                        "corr-" + session.sessionId,
+                      ),
+                    ),
+                  }),
             jsx("div", { style: ui.fieldLabel, children: L.recallRecent }),
             !traces.length
               ? jsx("div", { style: ui.muted, children: L.recallNoTrace })

package/lib/server.js

@@ -21,6 +21,8 @@ import {
 import { embeddingPublicStatus } from "./embed.js";
 import { chipsEnabledOf, configPanelOpenOf, gitSidecarEnabledOf, listedWorkspaces, pluginLocaleOf, recallModeOf, sessionLayerEnabledOf, writeUiSettings } from "./settings.js";
 import { TURN_ADDITIONAL_BUDGET } from "./context-budget.js";
+import { checkRevisionIntegrity } from "./integrity.js";
+import { correctionSessions } from "./turn-ledger.js";
 import { discoverWorkbuddyFiles, discoverExternalFiles, exportMarkdown, importWorkbuddy, importExternal } from "./markdown.js";
 import { checkNpmUpdate, installedVersion } from "./update.js";
 import { writeGateMessage } from "./hygiene.js";
@@ -202,6 +204,28 @@ async function handle(req, res, { liveOptions, status }) {
     return;
   }
 
+  if (path === "/api/dsh-trivium/corrections" && method === "GET") {
+    const paramCwd = url.searchParams.get("cwd");
+    const cwd = paramCwd ? (isKnownCwd(paramCwd) ? paramCwd : "") : getActiveCwd();
+    sendJson(res, 200, {
+      ok: true,
+      cwd: cwd || "",
+      sessions: correctionSessions(cwd || ""),
+    });
+    return;
+  }
+
+  if (path === "/api/dsh-trivium/integrity" && method === "GET") {
+    const { cwd, db } = await dbForRequest(url);
+    if (!db) {
+      sendJson(res, 400, { ok: false, message: "no workspace" });
+      return;
+    }
+    const report = checkRevisionIntegrity(db);
+    sendJson(res, 200, { ok: true, cwd, ...report });
+    return;
+  }
+
   if (path === "/api/dsh-trivium/settings" && method === "POST") {
     const body = JSON.parse((await readBody(req)) || "{}");
     const saved = writeUiSettings(body);

package/lib/turn-ledger.js

@@ -35,6 +35,8 @@ function stateOf(sessionId) {
       // correction must not cross workspaces.
       cwd: "",
       delivered: new Set(),
+      // Last corrections actually handed to the host, for the settings panel.
+      sentCorrections: [],
       /*
        * What this session was actually shown, per node: body, state and the
        * fingerprint it was shown under. A later write consults this table to
@@ -120,6 +122,32 @@ export function pendingCorrections(sessionId) {
   return [...stateOf(sessionId).corrections];
 }
 
+/**
+ * Pending and recently delivered corrections, grouped by session.
+ *
+ * The panel is not tied to one session, so it asks per workspace and shows the
+ * short session id. A session that never received a fact never appears.
+ */
+export function correctionSessions(cwd = "") {
+  const want = cwd ? resolve(String(cwd)) : "";
+  const out = [];
+  for (const state of sessions.values()) {
+    if (want && state.cwd && state.cwd !== want) continue;
+    if (!state.corrections.length && !state.sentCorrections.length) continue;
+    out.push({
+      sessionId: state.sessionId,
+      cwd: state.cwd,
+      pending: state.corrections.map((c) => ({
+        id: c.id,
+        note: String(c.l0 || ""),
+        queuedAt: c.queuedAt || null,
+      })),
+      sent: [...state.sentCorrections].slice(-10),
+    });
+  }
+  return out;
+}
+
 /**
  * A fact changed after a session was shown it. Queue a short correction for
  * every session that actually received this node — "delivered once, never
@@ -220,6 +248,12 @@ export function commit(reservation) {
       // Consumed only now: an over-budget correction stays pending for the
       // next turn instead of being silently dropped.
       deliveredCorrections.add(record.id);
+      state.sentCorrections.push({
+        id: record.id,
+        note: String(record.l0 || ""),
+        at: new Date().toISOString(),
+      });
+      if (state.sentCorrections.length > 20) state.sentCorrections.shift();
       continue;
     }
     if (!record.fingerprint) continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-trivium",
-  "version": "0.5.1",
+  "version": "0.7.0",
   "description": "In-process graph memory for DeepSeek Harness, backed by TriviumDB.",
   "license": "MIT",
   "type": "module",
@@ -12,11 +12,17 @@
   },
   "files": [
     "lib",
+    "scripts/check-integrity.mjs",
+    "scripts/clear-expired-until.mjs",
     "cordis.patch.yml",
     "README.md",
     "README.zh-CN.md",
     "LICENSE"
   ],
+  "bin": {
+    "dsh-trivium-check": "scripts/check-integrity.mjs",
+    "dsh-trivium-clear-until": "scripts/clear-expired-until.mjs"
+  },
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"

package/scripts/check-integrity.mjs

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+/**
+ * Read-only check for decision revision integrity.
+ *
+ *   node scripts/check-integrity.mjs <workspace> [--json]
+ *
+ * Exit codes: 0 clean, 2 issues found, 1 cannot open.
+ *
+ * The database is opened with accessMode "readOnly": no WAL, no text index
+ * rebuild, no workspace registration. If a host is holding the file, the open
+ * is refused — close the host or run this on a copy, never let a checker modify
+ * the file it is judging.
+ */
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+
+import { checkRevisionIntegrity } from "../lib/integrity.js";
+import { dbPathFor, openWorkspaceDbReadOnly } from "../lib/store.js";
+
+const args = process.argv.slice(2);
+const asJson = args.includes("--json");
+const cwd = resolve(args.find((arg) => !arg.startsWith("--")) || process.cwd());
+const file = dbPathFor(cwd);
+
+if (!existsSync(file)) {
+  console.error(`no memory database at ${file}`);
+  process.exit(1);
+}
+
+let db;
+try {
+  db = openWorkspaceDbReadOnly(cwd);
+} catch (err) {
+  console.error(`cannot open read-only (is another host using it?): ${err.message}`);
+  process.exit(1);
+}
+
+try {
+  const report = checkRevisionIntegrity(db);
+  if (asJson) {
+    console.log(JSON.stringify({ cwd, file, ...report }, null, 2));
+  } else {
+    console.log(`workspace: ${cwd}`);
+    console.log(`database:  ${file}`);
+    console.log(`nodes: ${report.nodes}  revision edges: ${report.edges}`);
+    if (report.ok) {
+      console.log("integrity: ok");
+    } else {
+      console.log(`integrity: ${report.issues.length} issue(s)`);
+      for (const issue of report.issues) console.log(`- ${issue.code}: ${JSON.stringify(issue)}`);
+    }
+  }
+  process.exitCode = report.ok ? 0 : 2;
+} finally {
+  try {
+    db.close?.();
+  } catch {
+    // closing a read-only handle is best effort
+  }
+}

package/scripts/clear-expired-until.mjs

@@ -0,0 +1,120 @@
+#!/usr/bin/env node
+/**
+ * List or clear stale decision deadlines.
+ *
+ *   node scripts/clear-expired-until.mjs <workspace> [--json]
+ *   node scripts/clear-expired-until.mjs <workspace> --apply [--all]
+ *
+ * Default is a read-only listing. `--apply` clears deadlines only on decisions
+ * that are already stale, and by default only when the deadline text is also
+ * present in the body — that is the shape 0.4.21 produced when it parsed dates
+ * out of prose. Pass `--all` to clear every stale decision deadline, including
+ * ones the user typed explicitly; that is a deliberate, destructive choice.
+ *
+ * The workspace must not be open in another process (the kernel is single
+ * writer). Back up `.dsh/trivium.tdb` if you are not sure.
+ */
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+
+import {
+  closeAll,
+  dbPathFor,
+  describeDbFailure,
+  openWorkspaceDb,
+  updateNode,
+} from "../lib/store.js";
+import { isStalePayload } from "../lib/until.js";
+
+const args = process.argv.slice(2);
+const asJson = args.includes("--json");
+const apply = args.includes("--apply");
+const all = args.includes("--all");
+const cwd = resolve(args.find((arg) => !arg.startsWith("--")) || process.cwd());
+const file = dbPathFor(cwd);
+
+function compact(value) {
+  return String(value ?? "").replace(/\s+/g, "");
+}
+
+/** 0.4.21 turned a date in the prose into `until`; that date is still in the body. */
+function textMentionsUntil(text, until) {
+  const raw = String(until || "").trim();
+  if (!raw) return false;
+  const hay = compact(text);
+  const variants = [raw, raw.replace(/-/g, "."), raw.replace(/-/g, "/")];
+  return variants.some((value) => hay.includes(compact(value)));
+}
+
+function fail(message, code = 1) {
+  if (asJson) console.log(JSON.stringify({ ok: false, message }, null, 2));
+  else console.error(message);
+  process.exit(code);
+}
+
+if (!existsSync(file)) {
+  fail(`No database at ${file}. Pass the workspace directory that contains .dsh/trivium.tdb.`);
+}
+
+let db;
+try {
+  db = await openWorkspaceDb(cwd);
+} catch (err) {
+  const lock = describeDbFailure(err);
+  fail(lock ? lock.message : `Cannot open ${file}: ${err.message || err}`);
+}
+
+const rows = [];
+for (const id of db.allNodeIds?.() || []) {
+  const payload = db.get(id)?.payload || {};
+  if (payload.type !== "decision") continue;
+  if (!String(payload.until || "").trim()) continue;
+  if (!isStalePayload(payload)) continue;
+  rows.push({
+    id: Number(id),
+    name: String(payload.name || ""),
+    until: String(payload.until || ""),
+    untilAt: String(payload.untilAt || ""),
+    textMentionsUntil: textMentionsUntil(payload.text, payload.until),
+  });
+}
+
+const selected = apply ? (all ? rows : rows.filter((row) => row.textMentionsUntil)) : [];
+const cleared = [];
+for (const row of selected) {
+  try {
+    updateNode(db, row.id, { until: "" });
+    cleared.push(row.id);
+  } catch (err) {
+    fail(`#${row.id} could not be cleared: ${err.message || err}`);
+  }
+}
+if (cleared.length) db.flush();
+
+const report = {
+  ok: true,
+  cwd,
+  file,
+  applied: apply,
+  all,
+  staleDecisions: rows.length,
+  textMentionsUntil: rows.filter((row) => row.textMentionsUntil).length,
+  cleared,
+  rows,
+};
+closeAll();
+
+if (asJson) {
+  console.log(JSON.stringify(report, null, 2));
+} else {
+  console.log(`${rows.length} stale decision(s) with a deadline in ${file}`);
+  for (const row of rows) {
+    const mark = row.textMentionsUntil ? "date in body" : "explicit deadline";
+    console.log(`  #${row.id}  ${row.name || "(no name)"}  until=${row.until}  (${mark})`);
+  }
+  if (!apply) {
+    console.log("\nDry run. Re-run with --apply to clear dates that also appear in the body, or --apply --all for every stale deadline.");
+  } else {
+    console.log(`\nCleared ${cleared.length} deadline(s).`);
+  }
+}