dsh-trivium 0.6.0 → 0.7.1

package/README.md

@@ -16,7 +16,7 @@ The kernel stays close to DSH: no extra process, no extra nav by default. Pin me
 
 ## Installation
 
-> Prerequisite: install [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) and start `dsh web` at least once. Tested host: `@deepseek-ai/dsh@0.1.5-rc.1` (`dsh-llm` / `dsh-tools` peers also accept `0.1.1-rc.2` and `0.1.0-rc.8`).
+> Prerequisite: install [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) and start `dsh web` at least once. Current Web verification uses `0.2.1-rc.4`; see the [baseline and evidence index](docs/README.md) for desktop `0.2.1-rc.3` coverage and limitations. Node must satisfy `^22.19.0 || >=24`; `triviumdb` is pinned to `0.9.0-beta.3`.
 
 ```sh
 dsh plugin --profile web add dsh-trivium
@@ -26,7 +26,7 @@ Restart **dsh web**. Memory lives in the current workspace:
 
 ```
 <workspace>/.dsh/trivium.tdb      # local index (binary; gitignore this)
-<workspace>/.dsh/trivium.jsonl    # git source of truth (business facts)
+<workspace>/.dsh/trivium.jsonl    # optional Git exchange snapshot (business facts)
 ```
 
 Commit `trivium.jsonl`. Ignore the binary store:
@@ -94,8 +94,10 @@ The plugin loads inside the `dsh web` process. It does not open its own port or
 | Workspace `.dsh/trivium.jsonl` | read/write | Git sidecar (off by default). Business nodes/edges only; no embeddings |
 | `~/.dsh/trivium.json` | read/write | Settings and chip pins; may contain an embedding API key you typed |
 | `.dsh/trivium-pending.json` | read/write | Local queue when extract fails |
-| Network | off | Chat text is not sent out. Embedding outbound happens only if you turn it on and fill a URL. Settings **Check for updates** fetches the npm registry (version only, no transcript) |
-| Transcript | stays local | Extract and search run on this machine; with embedding on, retrieved text is sent to the URL you filled |
+| Model extraction | on | When the host exposes a model service, extraction sends a bounded conversation excerpt to the current session's provider/model through DSH. A remote provider means network traffic and possible model charges. Without that service, extraction uses local rules |
+| Remote embeddings | off | When enabled, node text and search queries are sent to the configured embedding URL. Keyword and graph retrieval work without it |
+| Update check | manual | **Check for updates** fetches npm package metadata, without the conversation |
+| Conversation excerpts | may be sent to the host model | Durable memory is stored locally. This does not make extraction or the DSH model conversation offline. Disable extraction and remote embeddings to stop those plugin-initiated model/embedding calls |
 
 The official DeepSeek chat API has no embeddings endpoint. Keyword + graph walk still work without it. Restart `dsh web` after changing settings or embedding.
 
@@ -179,7 +181,7 @@ Settings → **Trivium memory** manages the store. Check for updates sits at the
 | **Extract** | on | Write from compaction / idle. |
 | **Embedding** | off | Needs **Save** plus a URL; restart after changing the URL. |
 
-Injection detail: autoRecall injects at most 3 L0 hits when the step has user text; entity-name path injects 1-hop business neighbors only when the utterance names an existing entity. Checked chips share the budget and win first. Extract runs after `compaction/end` and a short idle; failures go to pending and replay on the next session-start (body ≤3000 chars, at most 24 items).
+Injection detail: autoRecall injects at most 3 L0 hits when the step has user text; entity-name path injects 1-hop business neighbors only when the utterance names an existing entity. Corrections for delivered facts take priority, followed by checked chips and recall, all within the same allowance. Disabled injection or insufficient budget keeps notices pending with a reason; delivery on the next message is not guaranteed. Later pre-steps detect expiry of delivered decisions; there is no background timer and the ledger clears on restart. Extract runs after `compaction/end` and a short idle; failures go to pending and replay on the next session-start (body ≤3000 chars, at most 24 items).
 
 - **Entries** — search, filter by type, expand business-edge neighbors, “only nodes hanging on this one”, hide expired decisions by default. Rename / edit body / aliases / until, merge same type, archive or delete.
 - **Export / import** — JSON is a real round-trip. Markdown is a read-only projection (for people). Git sync uses `.dsh/trivium.jsonl` (business facts, auto). One-shot strict import from WorkBuddy `MEMORY.md`, Claude Code `CLAUDE.md`, and Codex `AGENTS.md`. No watch of those files, no session jsonl dumps.
@@ -224,7 +226,7 @@ The kernel is still these four. Chips / session layer do not add a fifth tool.
 
 ## Screenshots
 
-Captured inside DSH Web (`0.1.1-rc.2`). Screenshots below are from the Chinese UI. The plugin follows the DSH host language unless you pick Chinese / English under **Settings**.
+Historical screenshots captured inside DSH Web (`0.1.1-rc.2`), illustrating the earlier Chinese UI. They do not establish 0.7.0 acceptance or show every current control. For versioned evidence and current limitations, see the [documentation index](docs/README.md). The plugin follows the host language unless you choose Chinese / English under **Settings**.
 
 ### Conversation — `ctx_find("鉴权")`
 
@@ -279,6 +281,10 @@ Off by default. After you turn **Chips (memory whitelist)** on in Settings, the
 
 ## Changelog
 
+**0.7.1** — Reliability fixes. JSON/JSONL share URI mapping, final-graph validation and a fact transaction; rejected input is preserved and recoverable, including archived revision history. Fix repeated corrections, clock-only expiry, stale projections and the 32-hop boundary. Corrections take priority within the existing shared budget; disabling injection still retains pending notices. Sidecar health and runtime diagnostics are scoped to the workspace. Settings requests stay bound to the displayed store; search races, keyboard expansion and nested dialogs are fixed. The deadline cleaner's dry run is now truly read-only. Data formats, four tools and defaults are unchanged. See the [release notes](docs/release-0.7.1.md).
+
+**0.7.0** — Observability release. Settings → Recall check now lists pending and recently delivered corrections per session, scoped to the workspace, and adds a **Check version chains** button that runs the same read-only check as `dsh-trivium-check`. New read-only endpoints: `GET /api/dsh-trivium/corrections` and `GET /api/dsh-trivium/integrity`. A fault-injection regression now proves a sidecar write failure is reported by health and repaired by `bootstrap-write` on reopen, and the README documents the host-side desktop `EPIPE`. Memory format, defaults and the four-tool surface are unchanged.
+
 **0.6.0** — Maintenance release. The read-only revision checker and the stale-deadline cleaner now ship with the package as `dsh-trivium-check` and `dsh-trivium-clear-until` (dry run by default; `--apply` clears only deadlines also present in the body, `--all` clears every stale one). The checker previously existed only in the Git checkout even though the 0.5.1 notes told users to run it. This release also pins two verifications: turn identity comes from the host's own user-message id (checked in a real session log), and a genuine second-window attempt with a stale ETag returns 409 and succeeds after refresh. No defaults or data formats changed.
 
 **0.5.1** — Correctness release for 0.5.0. A user turn is now booked by the text actually rendered, so three long chips can no longer ship 3 × ~217 tokens against one 300 allowance; commit is idempotent and an explicit zero budget stays zero. Version resolution returns the current node's own body, type, deadline and state instead of only its id, so a query matching a superseded decision no longer shows the old instruction under the new id. Imports plan URI identity and validate the whole resulting graph before one native transaction: two versions are never merged by similar text, no `supersedes` self-loop is written, and a failed transaction leaves no node, body or edge behind. When a delivered fact changes, the session that saw it gets a short correction notice (never the old body), scoped per workspace and consumed only after delivery. Kernel: `triviumdb@0.9.0-beta.3` (pinned prerelease). Windows are supported from 900 px upward; at 390 px the host's 188 px settings sidebar leaves ~154 px for the panel, which is not readable (it does not scroll horizontally). Upgrade note: `until` values written by 0.4.21 from prose dates are not rewritten automatically — clear them with **Show expired decisions** or `ctx_remember` with `until: ""`.
@@ -352,6 +358,7 @@ The peer ranges now explicitly admit the supported DSH `0.1.5`, `0.2.0`, and `0.
 | Memory still there after uninstall | Stop `dsh web` before `dsh plugin remove`. Leftover `.tdb` is a workspace never opened on 0.4.10+; delete `.dsh/trivium.tdb` in that folder. Committed `trivium.jsonl` comes back with `git checkout`. Disable-in-place does not wipe. |
 | Check for updates fails | That request only hits the npm registry for the latest version. Memory is unaffected; try again later. |
 | Old conversations will not open after rc.8 | That is DSH’s own session-store format change, not a broken `.tdb`. Graph memory still works via `ctx_find`; leftover boxes on unmatched old sessions are plot residue. |
+| Desktop shows “A JavaScript error occurred in the main process” with `EPIPE: broken pipe, write` | Host-side, not the plugin: `electron-updater` writes a log line to a console pipe whose parent process has exited (typical when the app was started by a test launcher with `--inspect`). No `dsh-trivium` frame is in that stack. Click OK and start the app from the Start menu; avoid launching it from a terminal or harness that closes. |
 
 **Maintenance commands** (shipped with the package since 0.6.0):
 
@@ -365,7 +372,7 @@ Local source checkout: `npm install`, then `node scripts/link-dsh.mjs`, then res
 ## Release info
 
 - GitHub: https://github.com/QWQcool/dsh-trivium
-- Package version: `0.6.0` · [npm](https://www.npmjs.com/package/dsh-trivium)
+- Package version: `0.7.1` · [npm](https://www.npmjs.com/package/dsh-trivium)
 - Tested host: `@deepseek-ai/dsh@0.2.1-rc.4` (the peer range also admits the 0.1.x lines)
 - License: MIT (depends on [TriviumDB](https://github.com/YoKONCy/TriviumDB), Apache-2.0)
 

package/README.zh-CN.md

@@ -14,7 +14,7 @@ DeepSeek Harness 的进程内图记忆插件：按节点和边记，默认少注
 
 ## 安装
 
-> 前提：已安装 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 并至少启动过一次 `dsh web`。当前测试宿主：`@deepseek-ai/dsh@0.1.5-rc.1`（`dsh-llm` / `dsh-tools` peer 兼容 `0.1.1-rc.2` 与 `0.1.0-rc.8`）。
+> 前提：已安装 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 并至少启动过一次 `dsh web`。当前使用 Web `0.2.1-rc.4` 验证；桌面 `0.2.1-rc.3` 的验证层级和局限见[文档入口](docs/README.md)。Node 要求 `^22.19.0 || >=24`，内核精确锁定 `triviumdb@0.9.0-beta.3`。
 
 ```sh
 dsh plugin --profile web add dsh-trivium
@@ -24,7 +24,7 @@ dsh plugin --profile web add dsh-trivium
 
 ```
 <workspace>/.dsh/trivium.tdb      # 本地索引（二进制，建议 gitignore）
-<workspace>/.dsh/trivium.jsonl    # git 源（业务事实）
+<workspace>/.dsh/trivium.jsonl    # 可选 Git 交换快照（业务事实）
 ```
 
 把 `trivium.jsonl` 交给 git。二进制库不要进版本库：
@@ -92,8 +92,10 @@ dsh plugin --profile web remove dsh-trivium
 | 工作区 `.dsh/trivium.jsonl` | 读写 | Git 旁路（默认关）。只含业务节点和边，不含向量 |
 | `~/.dsh/trivium.json` | 读写 | 设置和芯片钉选；可含你手填的 embedding API key |
 | `.dsh/trivium-pending.json` | 读写 | 抽取失败时的本地队列 |
-| 网络 | 关 | 对话不外发。打开 embedding 并填了 URL 才会把被检索文本发到你填的地址。设置页点「检查更新」会请求 npm registry（只拿版本号，不含对话） |
-| 对话原文 | 不外发 | 抽取和检索都在本机；embedding 开启后，被检索的文本会发到你填的地址 |
+| 模型抽取 | 开 | 宿主模型服务可用时，通过 DSH 把限长的对话片段交给当前会话选用的 provider/model；远程模型意味着联网和可能的模型费用。没有模型服务时使用本地规则 |
+| 远程 embedding | 关 | 开启后，节点正文和查询文本会发送到配置的 embedding URL。不开也可使用关键词和图检索 |
+| 检查更新 | 手动触发 | 请求 npm 包元数据，不发送对话 |
+| 对话片段 | 可能交给宿主模型 | 长期记忆存储在本地，不等于抽取或 DSH 对话全程离线。关闭抽取和远程 embedding，可停止插件主动发起的这两类模型／向量调用 |
 
 官方 DeepSeek 对话接口没有 embeddings。不开 embedding 也能用：关键词 + 图遍历。改完设置或 embedding 后需重启 `dsh web`。
 
@@ -175,7 +177,7 @@ Trivium 是记忆内核，不是日记、日历或聊天伴侣。它按**节点
 | **抽取** | 开 | compaction / 空闲后写入。 |
 | **embedding** | 关 | 要填 URL 并点「保存设置」，改 URL 后重启。 |
 
-注入细节：autoRecall 在本步含用户文本时最多灌 3 条 L0；实体名折中只在话里点到已有实体时灌 1 跳业务边邻居。芯片钉选优先占预算。抽取失败进 pending，下次 session-start 重放（每批正文 ≤3000 字、最多 24 条）。
+注入细节：autoRecall 在本步含用户文本时最多灌 3 条 L0；实体名折中只在话里点到已有实体时灌 1 跳业务边邻居。已送达事实的更正先占共享预算，其次是芯片和召回。注入关闭或同轮预算不足时，更正保留并显示原因，不承诺下一条必定送达。后续 pre-step 会检查已送达决策是否自然到期；没有后台计时器，重启会清空投递账本。抽取失败进 pending，下次 session-start 重放（每批正文 ≤3000 字、最多 24 条）。
 
 - **条目** — 可搜、按类型筛、展开业务边邻居、「只看挂在这上面的」、默认隐藏过期决策。可改名 / 改正文 / 别名 / until，同类型合并，归档或删除。
 - **导出导入** — JSON 是真回写。Markdown 只读投影（给人看）。给 git 用的是 `.dsh/trivium.jsonl`（业务事实，自动写）。WorkBuddy `MEMORY.md`、Claude Code `CLAUDE.md`、Codex `AGENTS.md` 可一次性严导入。不监视那些文件，不导入会话 jsonl。
@@ -220,7 +222,7 @@ Trivium 是记忆内核，不是日记、日历或聊天伴侣。它按**节点
 
 ## 界面截图
 
-以下入口在本机 DSH Web（`0.1.1-rc.2`）上仍在。截图为中文界面。插件默认跟随 DSH 宿主语言；也可在 **配置设置** 里锁定中文或英文。
+以下是 DSH Web `0.1.1-rc.2` 上的历史中文截图，用于说明早期界面，不代表 0.7.0 的验收，也未包含所有现行控件。分版本证据及当前边界见[文档入口](docs/README.md)。插件默认跟随 DSH 宿主语言；也可在 **配置设置** 里锁定中文或英文。
 
 ### 会话 — `ctx_find("鉴权")`
 
@@ -275,6 +277,10 @@ Trivium 是记忆内核，不是日记、日历或聊天伴侣。它按**节点
 
 ## 更新说明
 
+**0.7.1** — 可靠性修复。JSON/JSONL 共用身份映射、整图预检和事实事务，失败输入保留且可恢复；归档版本链可完整往返。修复连续更正、自然到期、过期投影和 32 跳边界，更正优先使用原有共享预算；关闭注入仍保留待发状态。旁路健康和运行诊断按工作区返回，设置页读写固定到所显示的库，修复搜索响应竞态、键盘展开和嵌套弹窗。期限清理 dry-run 真正只读。数据格式、四工具与默认开关保持不变，详情见 [0.7.1 发布说明](docs/release-0.7.1.md)。
+
+**0.7.0** — 可观测性版本。设置 → 召回检查现在按会话列出待发送与最近已发送的更正（按工作区过滤），并新增「检查版本链」按钮，复用 `dsh-trivium-check` 的只读检查。新增只读接口：`GET /api/dsh-trivium/corrections`、`GET /api/dsh-trivium/integrity`。新增故障注入回归：旁路写入失败会被 health 报告，重开时由 `bootstrap-write` 修复；README 补充桌面端 `EPIPE` 的宿主侧说明。记忆格式、默认值与四工具面均未变。
+
 **0.6.0** — 维护版本。只读版本链体检与过期期限清理现在随包分发：`dsh-trivium-check`、`dsh-trivium-clear-until`（默认只列不改；`--apply` 只清「期限同时出现在正文里」的那些，`--all` 清所有过期期限）。此前 0.5.1 的说明让用户运行 `scripts/check-integrity.mjs`，但该脚本并不在 npm 包里。本版同时固化两项验收：轮标识取自宿主自己的用户消息 id（已在真实会话日志中确认），以及真实第二窗口带过期 ETag 会得到 409、刷新后成功。默认值与数据格式均未变。
 
 **0.5.1** — 0.5.0 的正确性修复版。一轮的预算改为按**实际渲染出的文本**记账，三条长芯片不可能再在同一轮送出 3 × 约 217 token；`commit` 幂等，显式 0 预算保持为 0。版本解析返回当前节点自己的正文、类型、期限与状态，而不是只换 id——查询命中被替代的决策时，不会再把旧指令挂在新 id 下。导入先按 URI 规划身份、校验映射后的完整图，再用一次原生事务提交：两个版本不会因正文相近被合并，不会写出 `supersedes` 自环，事务失败也不留下节点、正文或边。已投递的事实被修改后，看过它的会话会收到一条短更正（不重发旧正文），按工作区隔离，且只有真正送达才消费。内核升到 `triviumdb@0.9.0-beta.3`（精确锁定预发布版）。界面支持宽度为 **≥900px**；390px 时宿主固定 188px 侧栏只给面板留下约 154px，不可读（但不会横向滚动）。升级说明：0.4.21 从正文日期误写的 `until` 不会自动清除，请在「显示过期决策」里清空，或用 `ctx_remember` 传 `until: ""`。
@@ -348,6 +354,7 @@ peer 范围显式接受已支持的 DSH `0.1.5`、`0.2.0`、`0.2.1` RC 版本线
 | 卸载后记忆还在 | 先停 `dsh web` 再 `dsh plugin remove`。剩下的 `.tdb` 是从未用 0.4.10 打开过的工作区，到该文件夹删 `.dsh/trivium.tdb`。已提交的 `trivium.jsonl` 用 `git checkout` 找回。只在配置里 disabled 不会清文件。 |
 | 检查更新失败 | 只请求 npm registry 拿最新版本号，不影响记忆；过一会儿再点即可。 |
 | rc.8 之后旧对话打不开 | 那是 DSH 自己的会话库格式变了，不是 `.tdb` 坏了。图记忆仍可 `ctx_find`；对不上号的旧方框可当情节残留。 |
+| 桌面端弹出「A JavaScript error occurred in the main process / EPIPE: broken pipe, write」 | 宿主侧问题，不是插件：`electron-updater` 往一个已经断开的控制台管道写日志（常见于用 `--inspect` 的测试启动器拉起、父进程随后退出）。栈里没有 `dsh-trivium`。点确定后从开始菜单正常启动；不要从会关闭的终端/测试器拉起。 |
 
 **维护命令**（0.6.0 起随包分发）：
 
@@ -361,7 +368,7 @@ peer 范围显式接受已支持的 DSH `0.1.5`、`0.2.0`、`0.2.1` RC 版本线
 ## 发布信息
 
 - GitHub: https://github.com/QWQcool/dsh-trivium
-- 包版本：`0.6.0` · [npm](https://www.npmjs.com/package/dsh-trivium)
+- 包版本：`0.7.1` · [npm](https://www.npmjs.com/package/dsh-trivium)
 - 测试宿主：`@deepseek-ai/dsh@0.2.1-rc.4`（peer 范围同时接受 0.1.x 各线）
 - License: MIT（依赖 [TriviumDB](https://github.com/YoKONCy/TriviumDB) 为 Apache-2.0）