kiokuko-dsh 0.2.41 → 0.2.42

package/docs/lisp.md

@@ -605,6 +605,6 @@ Clean installation and platform status: [code intelligence setup](code-intellige
 ## Coding task choice and recovery
 
 For a new coding task, `coding_workflow` first defines and displays the Goal, implementation items and observable conditions. The host then asks whether to use Lisp. Configuration alone never implies yes; an explicit manual session ON is reused as the selected route.
-`startupDefaults.lisp` (default `ask`) only preselects the Lisp answer on the task-startup card, which stays editable; a saved answer still wins. The default never enables the module or satisfies a yes: a missing runtime or failed startup remains the same recoverable blocker. Closing the question leaves it pending and `coding_workflow next` reopens the same question. Explicit continuation after a host restart restores the task choice; a new task or material scope change asks again. A saved yes followed by startup failure remains a visible blocker; recover the runtime or explicitly change the task route with `/kioku-lisp disable`. No uses ordinary tools and still requires fresh item checks followed by a final user-entry Goal check. Lisp evaluation success alone is insufficient: bind `task_completion` and collect actual host process evidence. See [coding workflow](coding-workflow.md).
+`startupDefaults.lisp` (default `ask`) only preselects the Lisp answer on the task-startup card, which stays editable; a saved answer still wins. The default never enables the module or satisfies a yes: a missing runtime or failed startup remains the same recoverable blocker. Closing the question leaves it pending and `coding_workflow next` reopens the same question. The combined startup card reuses the chat choice after restart and on ordinary follow-ups. A different chat or repository asks separately; explicit Lisp commands still override the inherited choice. A saved yes followed by startup failure remains a visible blocker; recover the runtime or explicitly change the task route with `/kioku-lisp disable`. No uses ordinary tools and still requires fresh item checks followed by a final user-entry Goal check. Lisp evaluation success alone is insufficient: bind `task_completion` and collect actual host process evidence. See [coding workflow](coding-workflow.md).
 
 Live opt-in condition/restart recovery: see [bounded recovery](lisp-recovery.md).

package/docs/on-demand-intake.md

@@ -9,13 +9,15 @@ await mountCore(context, {
 })
 ```
 
-An explicit `intakeMode: 'eager'` retains upfront preparation for known intent. Native adapters now hand classifier abstention, failure or rejected input to ordinary model reasoning instead of asking the generic task-category question. The original request is retained; explicitly prepared and owned effects still require their preparation and existing host checks. Ordinary native Bash remains on its native permission path, independently of optional preparation. Disabling typed decisions defers interpretation to the main model using the same source-bound contract. Unknown mode values are rejected.
+An explicit `intakeMode: 'eager'` retains upfront preparation for known intent. Native Akinator first asks the configured decision provider to answer each missing intake question. A decision below 51% certainty, abstention, failure or rejected input sends that question to the human through the native question UI. The original request is retained; explicitly prepared and owned effects still require their preparation and existing host checks. Ordinary native Bash remains on its native permission path, independently of optional preparation. Disabling typed decisions defers interpretation to the main model using the same source-bound contract. Unknown mode values are rejected.
 
 A separately supplied custom execution host can use the exported `createDshHostAdapter`, or must implement the same native `onDemandIntake` ownership contract; it cannot be safely synthesized from a tool list. Unsupported custom execution hosts fail with an actionable error rather than silently reverting to upfront questions. They may be updated or deliberately configured with the legacy eager opt-out. Prompt/Skill-only custom hosts own no execution ingress and remain supported.
 
 ## Conversation before execution
 
-The native model receives the complete original user messages and may answer or ask a concrete clarification without opening Akinator's generic purpose question. The initial answer path does not fabricate a chat profile, ready intake, active ledger run, or completed task. Laya's result is provisional intent only; an abstention does not prevent conversation. A queued human request after a normal turn is classified independently rather than inheriting that stale turn's execution readiness.
+The native model receives the complete original user messages. Akinator resolves purpose, target and success criteria through decisions first. Answers at or above 51% certainty are accepted; lower certainty, abstention or unavailable decisions ask the human the unresolved question. Probability-based providers use the selected answer's probability; TypeSafe uses its confidence. This threshold applies only to Akinator and does not change execution or permission decisions. Target and success answers must select actual request or current task evidence; the working directory and a generic completion promise are not substitutes. Human and decision answers are labelled separately alongside the unchanged request.
+
+When decisions are explicitly OFF, ordinary conversation proceeds normally, while unresolved action references such as “Fix it” still ask for missing target and success criteria. Prepared task intake likewise leaves missing fields unanswered. Clarification creates no execution authority, active ledger run or completed task. A queued human request after a normal turn is classified independently rather than inheriting that stale turn's execution readiness.
 
 Research, writing and action requests remain work requests. The host guidance tells the assistant to prepare requested tool-backed work rather than silently substitute a text answer or claim unperformed work.
 

package/docs/repository-learning.md

@@ -1,22 +1,20 @@
 # Continuous repository learning
 
-Kiokuko automatically checks each **native conversation turn** (`turn/start` through
-`turn/end`), not every token or intermediate model step. Task completion and a
-post-task approval dialog are not prerequisites. Failed, cancelled, no-tool and
-unknown turns are retained as those lifecycle observations, never as verified task
-success.
+Kiokuko offers review after each completed or failed **native conversation turn**, including answers without tools. First it asks whether to organize the turn. It then shows the exact proposed summary, lessons and sources and asks whether to save them. Neither a completed turn nor model output authorizes persistence.
+
+Decline, dismissal, missing question UI, Stop, a new turn and plugin reload save no pending proposal. Cancelled and unknown turns do not open review or create memories. Existing stored memories are preserved.
 
 ## Normal startup and data flow
 
 The public plugin's lifecycle memory mounts the repository-learning coordinator.
 At a turn boundary it freezes bounded, redacted native user/tool/result/assistant
-observations, the native session/turn identity and the current model route. It uses
+observations, the native session/turn identity and the current model route. After the human chooses to organize, it uses
 the host's actual `llm.prepareCall` / `llm.stream` API on that route, with no tools,
 to propose up to four source-cited hypotheses. An externally registered
 `kiokukoReplayReflector` service is **not required** for this path.
 
 The reflector receives the previous repository compact and this turn's evidence.
-It can refine previous hypotheses in light of new evidence. SQLite appends the
+It can refine previous hypotheses in light of new evidence. After approval of the displayed proposal, SQLite appends the
 turn and atomically updates a bounded projection: recent observations and compact
 hypotheses, including provenance, uncertainty, repeated occurrence counts and
 repository tags. A correction may name existing hypothesis IDs in `supersedes`, supply a
@@ -27,8 +25,7 @@ model-proposed corrections, not established truth. Distinct remaining hypotheses
 retain an unresolved-compatibility assessment. History remains in SQLite while the
 model-visible projection has a whole-point budget; omitted points are counted.
 
-Before subsequent model steps, the coordinator waits for preceding repository
-learning and reads that repository's projection directly. **Keyword overlap is not
+A new turn cancels any pending review, then reads the repository's approved projection. **Keyword overlap is not
 required**. A new session in the same canonical repository gets the accumulated
 compact; another repository does not. Root identity comes from trusted host cwd
 and repository resolution, not model-supplied tags. The injected section is
@@ -42,20 +39,17 @@ on the active prompt surface.
 Migration `048_repository_learning.sql` adds the append-only turn ledger and
 bounded repository projection. Idempotent session/turn identities prevent duplicate
 records. Updates use an immediate SQLite transaction and capture-policy revision
-checks. At plugin reload the latest native turn is reconstructed from up to 512
-session events (excluding inherited fork history); already saved turns are not
-reflected again. Earlier unsaved turns beyond this bounded recovery window are not
-claimed recovered.
+checks. At plugin reload, up to 512 session events reconstruct an active turn, excluding inherited history. Historical terminal events do not reopen review or repeat reflection. Approval closures do not survive reload.
 
 Ignorable session plugin records named `plugin:kiokuko-dsh/repository-learning`
 (and live host events `kiokuko/repository-learning`) report capture and retrieval:
 
-- capture: saved, duplicate, excluded or unavailable; revision and reflection status;
+- capture: saved, duplicate, declined, review_unavailable, discarded, excluded or unavailable; revision and reflection status;
 - retrieval: injected, empty or unavailable; injected and omitted point counts.
 
 A missing model route, malformed/ungrounded result or 15-second model deadline
 produces an explicit unavailable/invalid reflection status. The observed turn can
-still be saved without invented model lessons. Database/capture failures are
+still be proposed without invented model lessons, but requires approval before saving. Database/capture failures are
 reported as unavailable, not silently described as successful saving. This feature
 never launches DSH, changes repository source, runs learned commands or grants tool
 permissions.
@@ -85,25 +79,8 @@ process.
 
 ## Interrupted saves and recovery
 
-Reflection has a bounded deadline and no automatic network retry. A disconnected
-or invalid model stream may still save the observed turn with an unavailable or
-invalid reflection, without inventing a lesson. Foreground work can continue.
-SQLite writes retry only recognized lock contention under the existing finite
-backoff policy; no tool or external side effect is replayed by learning recovery.
-
-| Boundary                                               | Durable result and recovery                                                                                                                                                                                         |
-| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Before/during/after the model response                 | Save observations only if reflection fails; the next turn remains usable.                                                                                                                                           |
-| Failure inside the save transaction                    | Roll back turn and projection together. Capture diagnostics report `saveState: not_saved`; reload the plugin to retry the latest retained native turn, or use `/kioku-memory learning reset` to discard it.         |
-| Commit succeeded but acknowledgement was lost          | Re-read the exact repository/session/turn. Report `saved` when found, `unknown` if storage cannot be read. Do not assume rollback or repeat tools. Reload reconciles the stored identity before any new reflection. |
-| Process exits before/after commit                      | SQLite rollback or committed turn survives reopening. The exact identity prevents a second save. Recovery remains limited to the latest 512 retained native events.                                                 |
-| Explicit native Stop or agent/workspace ownership loss | Discard unsaved in-flight reflection, retain only a payload-free retired identity, and reject its late result after reload. Already committed observations are not undone.                                          |
-| Plugin reload                                          | Abort the old coordinator; reconstruct the latest retained turn. A saved turn is a duplicate, an unsaved turn can be retried. No raw reflection response is persisted for retry.                                    |
-| New instruction or next turn                           | Completed earlier turns append in order to the current projection; they do not replace a newer snapshot with an old snapshot. Stop can cancel outstanding reflection so the next instruction can proceed.           |
-| Reset/forget                                           | Existing admission epochs and tombstones reject pre-reset results. Reset also clears current-repository pending admissions; new turns remain enabled.                                                               |
-
-Capture diagnostics retain only safe identities/counts, `saveState`, and a
-`reload_or_reset` recovery hint when a save is absent or uncertain. There is no
-background retry queue or indefinite lease on a model request. A model timeout,
-unknown save outcome or exhausted SQLite retry is not claimed automatically
-recovered. Reset does not erase native logs or user data.
+Reflection has a bounded deadline and no automatic network retry. A failed model call may produce a summary-only proposal; it never permits an automatic save. Foreground work remains usable.
+
+SQLite retries recognized lock contention under its finite backoff policy only while the same approval remains active. An uncertain commit is reconciled against the exact repository/session/turn identity. A failed save is reported as absent or unknown; reload never recreates its approval or retries the old proposal. A new completed turn offers a new review.
+
+Reset, forgetting, native Stop, owner changes and capture exclusions retain their existing fences. Already saved records are not undone by cancelling a later proposal. Native conversation logs are separate from reusable memory and are not erased by declining a save.

package/docs/typed-decisions.md

@@ -145,8 +145,9 @@ shown in the card; selection does not prove authentication or successful inferen
 options as the preset; the native question UI preselects a label ending in
 ` (Recommended)`, so the card still opens editable. A preset grants no authority.
 Immutable existing decision bindings also retain the task choice, without granting
-tool or file authority. The same request and explicit continuation reuse the choice;
-an unrelated new request asks again. Cancel/Skip starts no task. Headless operation with `ask` keeps the
+tool or file authority. Later turns in the same chat and repository reuse the accepted
+choice, including new tasks and session reloads. Cancel/Skip starts no task and is not
+inherited by a later turn. Headless operation with `ask` keeps the
 configured decision mode and explicit manual Lisp preference; `on`/`off` supply that
 answer instead. An explicit
 `typedDecisions.startup: { decision: true, lisp: true }` config selects both and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kiokuko-dsh",
-  "version": "0.2.41",
+  "version": "0.2.42",
   "description": "Kiokuko plugin for DeepSeek Harness",
   "type": "module",
   "license": "MIT",