fix(review): bound idle reviews and pause incompatible Agent Teams

[Grivn]

摘要 / Summary

Long sessions repeatedly created idle-review children, and the published Agent Teams policy could fail after a review had already committed writes. This change bounds review frequency and attempts, defaults to a bounded spawn checkpoint, pauses the incompatible Team composition before child creation, and shows confirmed receipts when a started review fails.

长会话中的空闲审查现在受频率和次数限制，默认使用有界 spawn 检查点。遇到已发布 Agent Teams 的不兼容策略时，在创建子代理前暂停并说明原因；已开始的审查若在写入后失败，仍明确报告失败并保留回执，不会自动重放。

关联 Issue 或背景 / Related Issue or Context

Closes #100
Closes #255

The #255 fix uses the issue's permitted skip degradation for the affected Team composition. It does not claim to repair the upstream experimental Team policy: published DSH 0.1.5-rc.2 with both Agent Teams 0.1.5-alpha.2 packages fails under both fork and spawn. The service-only control remains supported.

涉及区域 / Affected Areas

• Host 激活、Headless 或 bundle / Host activation, Headless, or bundle
• 运行时记忆 / Runtime Memory
• 项目档案 / Project Documents
• 记忆空间或 Provider / Memory Spaces or Providers
• 子 Agent 或 Agent 工作流 / Subagent or Agent workflow
• Web UI 或对话交互 / Web UI or conversation interaction
• 设置、存储或安全 / Settings, storage, or security
• CLI、RPC、命令或工具 / CLI, RPC, commands, or tools
• 安装、更新或发布 / Installation, update, or release
• 测试、构建或文档 / Tests, build, or documentation
• 其他（请说明）/ Other (explain below)

PR 类型 / PR Type

• 面向用户的功能或行为变更 / User-facing feature or behavior change
• Bug 修复 / Bug fix
• 增强或优化 / Enhancement or optimization
• 兼容性适配 / Compatibility change
• 维护或重构 / Maintenance or refactor
• 测试或构建 / Tests or build

最新代码确认 / Latest Codebase Confirmation

• 我已基于最新 main 分支开发，或在提交前已 rebase 或合并最新 main。 / I developed from the latest main, or rebased or merged the latest main before submitting.

Base 1363ebffaf19c9ab4badf0137f6fe87acacaf989 was verified against the remote main ref on 2026-09-16:

同步命令 / Sync command:

git fetch origin main
git merge-base --is-ancestor origin/main HEAD
git ls-remote origin refs/heads/main

AI 编码披露 / AI Coding Disclosure

• 完全 AI 编码：全部编程改动由 AI 产出，并由贡献者接受和审查。 / Fully AI-coded: AI produced all programming changes, which the contributor accepted and reviewed.
• 部分 AI 辅助：AI 帮助编写或修改了部分内容。 / Partially AI-assisted: AI helped write or modify part of the change.
• 未使用 AI 编码辅助。 / No AI coding assistance was used.

使用的 AI 模型 / AI model used: GPT-6 Astra, max reasoning

使用的编码 Agent 工具 / Coding Agent tool used: Codex desktop

仓库规范检查 / Repository Rules

• 未修改 DSH 官方源码，未让 tsconfig 指向 DSH 源码 checkout，仅使用正式的 @deepseek-ai/* NPM 契约。 / I did not modify DSH source or point tsconfig at a DSH source checkout, and used only published @deepseek-ai/* NPM contracts.
• Client 与 Host 边界仍以浏览器安全的 src/host/protocol.ts 为准，没有在两侧重复定义 wire DTO。 / The Client and Host boundary still uses browser-safe src/host/protocol.ts as the source for wire DTOs.
• 持久化格式、RPC 权限、路径或凭据处理的变更包含兼容或拒绝路径、安全分析和相应测试。 / Changes to persistence formats, RPC authority, paths, or credentials include compatibility or rejection paths, security analysis, and tests.
• 没有提交 token、密钥、私有记忆、未脱敏日志或生成的 lib/ 文件。 / I did not commit tokens, credentials, private memory, unredacted logs, or generated lib/ files.
• 用户可见文案和长期文档已同步维护中文与英文版本，命令、配置键和路径保持一致。 / User-facing copy and long-lived documentation are synchronized in Chinese and English, with matching commands, configuration keys, and paths.
• 会改变发布制品或其元数据的 PR 已添加 changeset；仅测试、CI 或站点文档变更可不添加。 / A PR that changes a published artifact or its metadata includes a changeset; test-only, CI-only, and site-documentation-only changes may omit one.
• 新增和修改的代码、注释、文档、提交信息不含 emoji。 / New and modified code, comments, documentation, and commits contain no emoji.

兼容性与数据安全 / Compatibility and Data Safety

• Automatic review has an independent switch, five-minute minimum interval, and a default cap of 20 attempts per loaded parent Agent. Failed/cancelled attempts count. Clear/compact notifications keep the budget; Agent unload/reopen or Host restart resets it.
• The default spawn receives whole visible completed-checkpoint messages within 24,000 characters. Explicit fork retains inherited context; its configurable spawn/skip fallback applies only before startup. A started run is never retried through another provider. The 4,096-token default limits each model response, not total run usage.
• The Team pause uses public service and parent-scoped tool capabilities. It creates no child, does not consume an attempt, and resumes scheduling on a later eligible completed turn after Team tools are removed. Recall/writeback/manual-operation settings are unchanged; upstream manual delegation under the affected Team policy is not repaired.
• Public disposal removes resident children. Existing catalog history remains because published DSH exposes no plugin-scoped archive/TTL contract. No private persistence format, unrelated Agent, or other plugin policy is modified.
• Failed reviews stay failed, including cleanup failures. Only the owning child's confirmed mutation receipts are exposed, without raw memory content or tool arguments; committed inner Code Mode writes remain visible even when the outer call fails. Existing authorized Settings RPC and read-only restrictions remain in force.

本地验证 / Local Validation

执行的命令 / Commands run:

pnpm install --frozen-lockfile
MNEMON_NATIVE_TEST_CLI=/path/to/official/mnemon-0.2.8 pnpm run verify
node --experimental-strip-types scripts/fixtures/reproduce-published-team.mjs --profile /path/to/isolated-published-profile
node --experimental-strip-types scripts/fixtures/reproduce-published-team.mjs --profile /path/to/isolated-published-profile --guard
MNEMON_CLI_PATH=/path/to/official/mnemon-0.2.8 pnpm e2e:serve --idle-review --strategy-extensions

结果摘要 / Result summary:

• Reproduced before fixing: a 30-turn successful-review workload created 15 children instead of the configured cap 2; the failed-review workload attempted 29 runs in 150 seconds instead of respecting a five-minute interval. Fixed assertions pass, including clear/compact and live Settings changes.
• Full verify passed on macOS arm64, Node 25.1.0 and pnpm 11.19.0: 1,156 root tests passed; five opt-in real-model checks and the Windows-only plugin smoke check were skipped. Standard plugin suites and real Native CLI create/write/recall/forget passed.
• Types, deterministic builds, Headless activation with 39 tools, public entries, publint and attw passed. The package remains 47 files, at 298,457 packed / 1,335,573 unpacked bytes. The reviewed 1,338,000-byte ceiling allows the intentional checkpoint/receipt/UI growth without Source implementation leakage.
• Published rc.2 / alpha.2 integration proves both providers fail without the guard; both controls complete; guarded incompatible cases create no child and the parent Team task tool still works. Each six-case matrix passed; an asserted baseline failure is evidence of the defect, not a successful review.
• Real Host tests cover fork/spawn with native tools and Code Mode, complete 19,112-character overview evidence, denied foreign tools, partial receipts, cancellation, missing capabilities, invalid Settings limits, and read-only rejection.

用户可见变更证据 / Local Feature Evidence

The real DSH WebUI used disposable synthetic memory and all three Strategy enhancements. Published Agent Teams before/after evidence shows the original error versus a visible compatibility pause and zero child creation. Final-build checks show two committed receipts after an intentional later model failure, one child after four completed parent turns, a five-second interval with cap 1, and independent disabling with cap raised to 2.

The first partial-failure session used the default five-minute interval; a fresh final-build session separately isolated the cap and disable controls. Both sessions' committed Documents remain in the disposable Profile. Model responses are deterministic loopback fixtures, not evidence of external model quality or production API reliability.

Full commands, package/source revisions, sanitized observations, limits, and screenshots: English evidence / 中文证据.

Team error before	Team pause after	Final partial failure
Screenshot	Screenshot	Screenshot

Cap enabled	Review disabled with budget remaining	Four turns, one child
Screenshot	Screenshot	Screenshot