@modusensus/dsh-mneme 0.14.0-beta.1 → 0.14.0-beta.2

package/test/peak-hours-observability.test.js

@@ -1,70 +1,70 @@
-// Issue #622 可观测性回归：错峰时段串解析失败不许静默。
-//
-// parsePeakSpec 的失败语义（整串视为未配置）是刻意的契约——排程是省钱手段，绝不
-// 该因为写错格式把蒸馏/巩固停掉。但「不救错」不等于「不吭声」：#424 的排查只能靠
-// 「高峰期还在巩固」倒推，正是静默的全貌。本文件锁三件事：
-//   ① invalidPeakSpecs 只报「非空且解析失败」——空串/未配置/合法串/全角归一救得了
-//     的写法一律不报（验收第 2 条：不骚扰没配错峰的用户；#621 已落归一，两处共存）；
-//   ② index.js 的启动告警真的接在 cfg 装配之后（接线锁，仿 failure-retention 的
-//     写法）：告警读的是装配后的 cfg——面板改的 flatFlags 合并进来的值也算数；
-//   ③ /features 答复的 invalidPeakHours 与 helper 同源（api.test.js 里另有往返）。
-import test from "node:test";
-import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import path from "node:path";
-import { parsePeakSpec, invalidPeakSpecs, PEAK_SPEC_KEYS } from "../src/peak-hours.js";
-
-const here = path.dirname(fileURLToPath(import.meta.url));
-const indexSrc = readFileSync(path.join(here, "..", "src", "index.js"), "utf8");
-
-test("invalidPeakSpecs: 只报非空且解析失败的键；空串/未配置/合法串不报", () => {
-  // 未配置（undefined）与空串：合法的「未配置」，不告警
-  assert.deepEqual(invalidPeakSpecs({}), {});
-  assert.deepEqual(invalidPeakSpecs({ summarizePeakHours: "" }), {});
-  assert.deepEqual(invalidPeakSpecs({ summarizePeakHours: "   " }), {});
-  assert.deepEqual(invalidPeakSpecs({ dreamPeakHours: undefined }), {});
-  // 合法串：不报
-  assert.deepEqual(invalidPeakSpecs({ summarizePeakHours: "09:00-18:00" }), {});
-  assert.deepEqual(invalidPeakSpecs({ dreamPeakHours: "mon-fri 08:00-12:00,14:00-18:00" }), {});
-  // 全角等价写法：本批原基于未含 #621 归一的主线，当时 parsePeakSpec 解析失败、
-  // 「报」是真话。**#621 已并入 main**（全角逗号/冒号/数字归一），解析现在成功，
-  // 本断言随之翻转为不报——这正是 helper「只转述解析器、不自带第二套对错标准」
-  // 的意义：判据翻转由解析器驱动，本文件不需要改任何逻辑。
-  // ⚠️ 原注释里「两批共存无需联动改动」这句是错的：判据确实会翻，只是翻的位置
-  // 在这里而不在 src/。合并 #621 后必须同步翻这一行，否则就是假红。
-  assert.deepEqual(invalidPeakSpecs({ summarizePeakHours: "０９:００-１８:００" }), {});
-  // 非法串：报，且带原串（告警要对得上配置文件里那一行）
-  assert.deepEqual(invalidPeakSpecs({ summarizePeakHours: "24:00-08:00" }), { summarizePeakHours: "24:00-08:00" });
-  assert.deepEqual(invalidPeakSpecs({ dreamPeakHours: "09.00-18.00" }), { dreamPeakHours: "09.00-18.00" });
-  // 两个键互相独立，各查各的（"ok" 没有冒号、没有时段段——解析器视为非法，报得对）
-  const both = invalidPeakSpecs({ summarizePeakHours: "09:00-18:00", dreamPeakHours: "24:00-01:00" });
-  assert.deepEqual(both, { dreamPeakHours: "24:00-01:00" });
-  // 非对象（裸调用方传 undefined 之类）不抛、返回空
-  assert.deepEqual(invalidPeakSpecs(undefined), {});
-  assert.deepEqual(invalidPeakSpecs(null), {});
-  // 非字符串值（垃圾输入）不抛、不报——typeof 守卫
-  assert.deepEqual(invalidPeakSpecs({ summarizePeakHours: 42 }), {});
-});
-
-test("PEAK_SPEC_KEYS 恰好覆盖两个时段键，parsePeakSpec 对它们的失败语义不变", () => {
-  // 键名单独成表：告警点与提示点都要认同一份，谁加键谁改表（不各写数组各自漂移）
-  assert.deepEqual(PEAK_SPEC_KEYS, ["summarizePeakHours", "dreamPeakHours"]);
-  // 本 issue 不动解析语义：非法 → null、空 → null、合法 → 结构（#239 契约原样）
-  assert.equal(parsePeakSpec("24:00-08:00"), null);
-  assert.equal(parsePeakSpec(""), null);
-  assert.ok(parsePeakSpec("09:00-18:00"));
-});
-
-test("接线锁：index.js 的启动告警读装配后的 cfg，且在 sessionGate 之前", () => {
-  const cfgAt = indexSrc.indexOf("const cfg = { ...applyLightModePreset({ ...rawCfg, lightMode }), ...flatFlags };");
-  const callAt = indexSrc.indexOf("invalidPeakSpecs(cfg)");
-  const gateAt = indexSrc.indexOf("const sessionGate = createSessionGate(cfg);");
-  assert.ok(cfgAt > 0, "装配行必须在");
-  assert.ok(callAt > cfgAt, "告警必须排在 cfg 装配之后——读 rawCfg 会漏掉面板改的 flatFlags");
-  assert.ok(gateAt > callAt, "告警在 sessionGate 之前（纯 log，不参与装配顺序的实质，锁在这里只为防它被挪进更早、读不到合并值的分支）");
-  // 只 log：告警分支里不许出现改写 cfg 的语句（行为零变化是本 issue 的前提）
-  const block = indexSrc.slice(callAt, gateAt);
-  assert.ok(!/cfg\s*=[^=]/.test(block), "告警分支不得改写 cfg");
-  assert.ok(block.includes("logger?.warn?.("), "失败可见性走 logger.warn");
-});
+// Issue #622 可观测性回归：错峰时段串解析失败不许静默。
+//
+// parsePeakSpec 的失败语义（整串视为未配置）是刻意的契约——排程是省钱手段，绝不
+// 该因为写错格式把蒸馏/巩固停掉。但「不救错」不等于「不吭声」：#424 的排查只能靠
+// 「高峰期还在巩固」倒推，正是静默的全貌。本文件锁三件事：
+//   ① invalidPeakSpecs 只报「非空且解析失败」——空串/未配置/合法串/全角归一救得了
+//     的写法一律不报（验收第 2 条：不骚扰没配错峰的用户；#621 已落归一，两处共存）；
+//   ② index.js 的启动告警真的接在 cfg 装配之后（接线锁，仿 failure-retention 的
+//     写法）：告警读的是装配后的 cfg——面板改的 flatFlags 合并进来的值也算数；
+//   ③ /features 答复的 invalidPeakHours 与 helper 同源（api.test.js 里另有往返）。
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+import { parsePeakSpec, invalidPeakSpecs, PEAK_SPEC_KEYS } from "../src/peak-hours.js";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const indexSrc = readFileSync(path.join(here, "..", "src", "index.js"), "utf8");
+
+test("invalidPeakSpecs: 只报非空且解析失败的键；空串/未配置/合法串不报", () => {
+  // 未配置（undefined）与空串：合法的「未配置」，不告警
+  assert.deepEqual(invalidPeakSpecs({}), {});
+  assert.deepEqual(invalidPeakSpecs({ summarizePeakHours: "" }), {});
+  assert.deepEqual(invalidPeakSpecs({ summarizePeakHours: "   " }), {});
+  assert.deepEqual(invalidPeakSpecs({ dreamPeakHours: undefined }), {});
+  // 合法串：不报
+  assert.deepEqual(invalidPeakSpecs({ summarizePeakHours: "09:00-18:00" }), {});
+  assert.deepEqual(invalidPeakSpecs({ dreamPeakHours: "mon-fri 08:00-12:00,14:00-18:00" }), {});
+  // 全角等价写法：本批原基于未含 #621 归一的主线，当时 parsePeakSpec 解析失败、
+  // 「报」是真话。**#621 已并入 main**（全角逗号/冒号/数字归一），解析现在成功，
+  // 本断言随之翻转为不报——这正是 helper「只转述解析器、不自带第二套对错标准」
+  // 的意义：判据翻转由解析器驱动，本文件不需要改任何逻辑。
+  // ⚠️ 原注释里「两批共存无需联动改动」这句是错的：判据确实会翻，只是翻的位置
+  // 在这里而不在 src/。合并 #621 后必须同步翻这一行，否则就是假红。
+  assert.deepEqual(invalidPeakSpecs({ summarizePeakHours: "０９:００-１８:００" }), {});
+  // 非法串：报，且带原串（告警要对得上配置文件里那一行）
+  assert.deepEqual(invalidPeakSpecs({ summarizePeakHours: "24:00-08:00" }), { summarizePeakHours: "24:00-08:00" });
+  assert.deepEqual(invalidPeakSpecs({ dreamPeakHours: "09.00-18.00" }), { dreamPeakHours: "09.00-18.00" });
+  // 两个键互相独立，各查各的（"ok" 没有冒号、没有时段段——解析器视为非法，报得对）
+  const both = invalidPeakSpecs({ summarizePeakHours: "09:00-18:00", dreamPeakHours: "24:00-01:00" });
+  assert.deepEqual(both, { dreamPeakHours: "24:00-01:00" });
+  // 非对象（裸调用方传 undefined 之类）不抛、返回空
+  assert.deepEqual(invalidPeakSpecs(undefined), {});
+  assert.deepEqual(invalidPeakSpecs(null), {});
+  // 非字符串值（垃圾输入）不抛、不报——typeof 守卫
+  assert.deepEqual(invalidPeakSpecs({ summarizePeakHours: 42 }), {});
+});
+
+test("PEAK_SPEC_KEYS 恰好覆盖两个时段键，parsePeakSpec 对它们的失败语义不变", () => {
+  // 键名单独成表：告警点与提示点都要认同一份，谁加键谁改表（不各写数组各自漂移）
+  assert.deepEqual(PEAK_SPEC_KEYS, ["summarizePeakHours", "dreamPeakHours"]);
+  // 本 issue 不动解析语义：非法 → null、空 → null、合法 → 结构（#239 契约原样）
+  assert.equal(parsePeakSpec("24:00-08:00"), null);
+  assert.equal(parsePeakSpec(""), null);
+  assert.ok(parsePeakSpec("09:00-18:00"));
+});
+
+test("接线锁：index.js 的启动告警读装配后的 cfg，且在 sessionGate 之前", () => {
+  const cfgAt = indexSrc.indexOf("const cfg = { ...applyLightModePreset({ ...rawCfg, lightMode }), ...flatFlags };");
+  const callAt = indexSrc.indexOf("invalidPeakSpecs(cfg)");
+  const gateAt = indexSrc.indexOf("const sessionGate = createSessionGate(cfg);");
+  assert.ok(cfgAt > 0, "装配行必须在");
+  assert.ok(callAt > cfgAt, "告警必须排在 cfg 装配之后——读 rawCfg 会漏掉面板改的 flatFlags");
+  assert.ok(gateAt > callAt, "告警在 sessionGate 之前（纯 log，不参与装配顺序的实质，锁在这里只为防它被挪进更早、读不到合并值的分支）");
+  // 只 log：告警分支里不许出现改写 cfg 的语句（行为零变化是本 issue 的前提）
+  const block = indexSrc.slice(callAt, gateAt);
+  assert.ok(!/cfg\s*=[^=]/.test(block), "告警分支不得改写 cfg");
+  assert.ok(block.includes("logger?.warn?.("), "失败可见性走 logger.warn");
+});

package/test/peer-blockers.test.js

@@ -1,193 +1,193 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import { createStore } from "../src/store.js";
-import { createMirror } from "../src/mirror.js";
-import { createService } from "../src/service.js";
-
-const execFileP = promisify(execFile);
-
-/**
- * v0.3.8 回归测试（audit peer 6 项运行时阻断 → INSTALLATION_NOT_APPROVED）。
- *
- * 测试点：
- *  A. 崩溃窗口（真实语义）：store.save 在业务事务内原子递增 desired generation，
- *     崩溃在 COMMIT 后、syncMirror 前 → 重启 recoverMirror 仅凭
- *     generation > applied_generation 捕获并收敛（peer blocker 1）
- *  B. 业务写同事务原子性：INSERT 失败回滚时 generation 不得递增（peer blocker 1/3）
- *  C. 多进程并发原子递增：8 进程 × 10 次不丢增量（peer blocker 3）
- *  D. generation 上界/负数拒绝（peer blocker 6）
- */
-
-function setup(dbPath) {
-  const dir = mkdtempSync(join(tmpdir(), "dsh-mneme-peer-"));
-  const mirrorDir = join(dir, "mirror");
-  const store = createStore(dbPath ?? ":memory:");
-  const mirror = createMirror(mirrorDir);
-  const warns = [];
-  const logger = { warn: (...a) => warns.push(a.join(" ")) };
-  const service = createService({ store, mirror, config: {}, logger });
-  return { dir, mirrorDir, store, mirror, service, warns };
-}
-
-test("peer-A: 崩溃窗口——save 后（generation 已递增）不 sync 直接关闭重开，recoverMirror 捕获并收敛", () => {
-  const dir = mkdtempSync(join(tmpdir(), "dsh-mneme-peer-"));
-  const dbPath = join(dir, "mneme.db");
-  const mirrorDir = join(dir, "mirror");
-  try {
-    const store = createStore(dbPath);
-    const mirror = createMirror(mirrorDir);
-    const service = createService({ store, mirror, config: {}, logger: { warn() {} } });
-    try {
-      // 业务写：store.save 在事务内递增 desired generation，但不触发 mirror 渲染
-      store.save({ type: "project", title: "P", content: "x", importance: 3 });
-      const afterSave = store.getMirrorState();
-      assert.ok(afterSave.generation > afterSave.applied_generation,
-        "save 后 generation > applied（COMMIT 完成，mirror 未同步=崩溃窗口）");
-    } finally {
-      // 模拟崩溃：不调 syncMirror，直接关库
-      store.close();
-    }
-
-    // 重启：重新打开同一 DB，recoverMirror 必须捕获债务并收敛
-    const store2 = createStore(dbPath);
-    const mirror2 = createMirror(mirrorDir);
-    const service2 = createService({ store: store2, mirror: mirror2, config: {}, logger: { warn() {} } });
-    try {
-      const result = service2.recoverMirror();
-      assert.equal(result.recovered, true, "崩溃窗口必须被 recover 捕获");
-      assert.equal(result.error, null);
-      const state = store2.getMirrorState();
-      assert.equal(state.dirty, false, "收敛后 dirty 清");
-      assert.ok(state.generation <= state.applied_generation, "收敛后无未应用债务");
-    } finally {
-      store2.close();
-    }
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("peer-B: 业务写同事务原子性——INSERT 失败回滚时 generation 不得递增", () => {
-  const { dir, store } = setup();
-  try {
-    store.save({ id: "dup", type: "project", title: "A", content: "x", importance: 3 });
-    const before = store.getMirrorState().generation;
-    assert.throws(
-      () => store.save({ id: "dup", type: "project", title: "B", content: "y", importance: 3 }),
-      /UNIQUE|constraint/i,
-      "重复主键 INSERT 必须抛错"
-    );
-    assert.equal(store.getMirrorState().generation, before,
-      "回滚后 generation 不递增（写与 desired generation 同事务，失败一起回滚）");
-  } finally {
-    store.close();
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("peer-C: 多进程并发原子递增——8 进程×10 次 incrementGeneration 不丢增量", async () => {
-  const dir = mkdtempSync(join(tmpdir(), "dsh-mneme-peer-"));
-  const dbPath = join(dir, "concurrent.db");
-  const N = 8;
-  const M = 10;
-  try {
-    // 子进程：静态 worker 脚本（test/helpers/peer-worker.mjs，可审查、无动态
-    // 生成代码），execFile 参数数组、无 shell；DB 路径与迭代数经 argv 传入。
-    const workerPath = fileURLToPath(new URL("./helpers/peer-worker.mjs", import.meta.url));
-    await Promise.all(
-      Array.from({ length: N }, () =>
-        execFileP(process.execPath, [workerPath, dbPath, String(M)], { timeout: 30000 })
-      )
-    );
-    const store = createStore(dbPath);
-    try {
-      const state = store.getMirrorState();
-      assert.equal(state.generation, N * M,
-        `并发 ${N} 进程 × ${M} 次必须无丢失增量，得到 ${state.generation}`);
-    } finally {
-      store.close();
-    }
-  } finally {
-    // Windows：8 个 SQLite 子进程退出后 -shm/-wal 句柄延迟释放，删目录偶发 EPERM；
-    // rm 带 maxRetries 自动重试（30×100ms 共 3s），仍失败则放行——清理只是收尾，
-    // 并发断言正确性由上方 generation 断言保证，残留临时目录交给 OS/CI 回收，
-    // 绝不让句柄释放慢把 flaky 标红。
-    try {
-      rmSync(dir, { recursive: true, force: true, maxRetries: 30, retryDelay: 100 });
-    } catch (err) {
-      if (!["EPERM", "EBUSY", "EACCES"].includes(err.code)) throw err;
-    }
-  }
-});
-
-test("peer-D: generation 上界与负数拒绝", () => {
-  const { dir, store } = setup();
-  try {
-    // 负数拒绝
-    assert.throws(() => store.setMirrorState({ generation: -1 }), RangeError, "负数必须拒绝");
-    assert.throws(() => store.setMirrorState({ applied_generation: -5 }), RangeError, "负数 applied 必须拒绝");
-    // 超 MAX_SAFE_INTEGER 拒绝
-    assert.throws(
-      () => store.setMirrorState({ generation: Number.MAX_SAFE_INTEGER + 1 }),
-      RangeError,
-      "超出 MAX_SAFE_INTEGER 必须拒绝"
-    );
-    // 到上界后再 increment 必须抛错（读回不会 ERR_OUT_OF_RANGE）
-    store.setMirrorState({ generation: Number.MAX_SAFE_INTEGER });
-    assert.throws(() => store.incrementGeneration(), /exceeded MAX_SAFE_INTEGER/, "上界后再递增必须抛错");
-    // 正常递增仍工作
-    store.setMirrorState({ generation: 5 });
-    assert.equal(store.incrementGeneration().generation, 6, "正常递增不受影响");
-  } finally {
-    store.close();
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("v0.3.9-A: compareAndUpdate 的 CAS UPDATE 与 generation 同事务——miss 不得递增", () => {
-  const { dir, store } = setup();
-  try {
-    const saved = store.save({ type: "project", title: "CAS 原子", content: "v0" });
-    const before = store.getById(saved.id);
-    const genBefore = store.getMirrorState().generation;
-
-    // 成功 CAS：业务写入 + generation 递增必须一次提交（同事务）
-    const updated = store.compareAndUpdate(saved.id, before.updated_at, { content: "v1" });
-    assert.ok(updated, "当前版本 CAS 必须成功");
-    const genAfterOk = store.getMirrorState().generation;
-    assert.equal(genAfterOk, genBefore + 1, "成功 CAS 必须恰好递增一次 generation");
-
-    // miss CAS：不写任何东西，generation 也不得递增
-    const stale = store.getById(saved.id).updated_at; // v1 的 token
-    store.compareAndUpdate(saved.id, before.updated_at, { content: "v2" }); // 用旧 token → miss
-    assert.equal(store.getById(saved.id).content, "v1", "miss 不得改数据");
-    assert.equal(store.getMirrorState().generation, genAfterOk,
-      "CAS miss 不得递增 generation（UPDATE 与 increment 必须同事务）");
-  } finally {
-    store.close();
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("v0.3.9-F: generation 非整数必须拒绝（不得截断）", () => {
-  const { dir, store } = setup();
-  try {
-    // 审计 peer F：1.5 这类小数此前被 Math.trunc 截断 + SQLite CHECK 接受 → 静默脏值。
-    // fail-closed：JS 与 SQL 统一只接受整数。
-    assert.throws(() => store.setMirrorState({ generation: 1.5 }), RangeError, "小数 generation 必须拒绝");
-    assert.throws(() => store.setMirrorState({ applied_generation: -1.5 }), RangeError, "负数小数必须拒绝");
-    assert.throws(() => store.setMirrorState({ generation: Number.MAX_SAFE_INTEGER + 0.5 }), RangeError, "超界小数必须拒绝");
-    // 整数仍正常
-    const s = store.setMirrorState({ generation: 7 });
-    assert.equal(s.generation, 7, "整数 generation 正常");
-  } finally {
-    store.close();
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { createStore } from "../src/store.js";
+import { createMirror } from "../src/mirror.js";
+import { createService } from "../src/service.js";
+
+const execFileP = promisify(execFile);
+
+/**
+ * v0.3.8 回归测试（audit peer 6 项运行时阻断 → INSTALLATION_NOT_APPROVED）。
+ *
+ * 测试点：
+ *  A. 崩溃窗口（真实语义）：store.save 在业务事务内原子递增 desired generation，
+ *     崩溃在 COMMIT 后、syncMirror 前 → 重启 recoverMirror 仅凭
+ *     generation > applied_generation 捕获并收敛（peer blocker 1）
+ *  B. 业务写同事务原子性：INSERT 失败回滚时 generation 不得递增（peer blocker 1/3）
+ *  C. 多进程并发原子递增：8 进程 × 10 次不丢增量（peer blocker 3）
+ *  D. generation 上界/负数拒绝（peer blocker 6）
+ */
+
+function setup(dbPath) {
+  const dir = mkdtempSync(join(tmpdir(), "dsh-mneme-peer-"));
+  const mirrorDir = join(dir, "mirror");
+  const store = createStore(dbPath ?? ":memory:");
+  const mirror = createMirror(mirrorDir);
+  const warns = [];
+  const logger = { warn: (...a) => warns.push(a.join(" ")) };
+  const service = createService({ store, mirror, config: {}, logger });
+  return { dir, mirrorDir, store, mirror, service, warns };
+}
+
+test("peer-A: 崩溃窗口——save 后（generation 已递增）不 sync 直接关闭重开，recoverMirror 捕获并收敛", () => {
+  const dir = mkdtempSync(join(tmpdir(), "dsh-mneme-peer-"));
+  const dbPath = join(dir, "mneme.db");
+  const mirrorDir = join(dir, "mirror");
+  try {
+    const store = createStore(dbPath);
+    const mirror = createMirror(mirrorDir);
+    const service = createService({ store, mirror, config: {}, logger: { warn() {} } });
+    try {
+      // 业务写：store.save 在事务内递增 desired generation，但不触发 mirror 渲染
+      store.save({ type: "project", title: "P", content: "x", importance: 3 });
+      const afterSave = store.getMirrorState();
+      assert.ok(afterSave.generation > afterSave.applied_generation,
+        "save 后 generation > applied（COMMIT 完成，mirror 未同步=崩溃窗口）");
+    } finally {
+      // 模拟崩溃：不调 syncMirror，直接关库
+      store.close();
+    }
+
+    // 重启：重新打开同一 DB，recoverMirror 必须捕获债务并收敛
+    const store2 = createStore(dbPath);
+    const mirror2 = createMirror(mirrorDir);
+    const service2 = createService({ store: store2, mirror: mirror2, config: {}, logger: { warn() {} } });
+    try {
+      const result = service2.recoverMirror();
+      assert.equal(result.recovered, true, "崩溃窗口必须被 recover 捕获");
+      assert.equal(result.error, null);
+      const state = store2.getMirrorState();
+      assert.equal(state.dirty, false, "收敛后 dirty 清");
+      assert.ok(state.generation <= state.applied_generation, "收敛后无未应用债务");
+    } finally {
+      store2.close();
+    }
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("peer-B: 业务写同事务原子性——INSERT 失败回滚时 generation 不得递增", () => {
+  const { dir, store } = setup();
+  try {
+    store.save({ id: "dup", type: "project", title: "A", content: "x", importance: 3 });
+    const before = store.getMirrorState().generation;
+    assert.throws(
+      () => store.save({ id: "dup", type: "project", title: "B", content: "y", importance: 3 }),
+      /UNIQUE|constraint/i,
+      "重复主键 INSERT 必须抛错"
+    );
+    assert.equal(store.getMirrorState().generation, before,
+      "回滚后 generation 不递增（写与 desired generation 同事务，失败一起回滚）");
+  } finally {
+    store.close();
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("peer-C: 多进程并发原子递增——8 进程×10 次 incrementGeneration 不丢增量", async () => {
+  const dir = mkdtempSync(join(tmpdir(), "dsh-mneme-peer-"));
+  const dbPath = join(dir, "concurrent.db");
+  const N = 8;
+  const M = 10;
+  try {
+    // 子进程：静态 worker 脚本（test/helpers/peer-worker.mjs，可审查、无动态
+    // 生成代码），execFile 参数数组、无 shell；DB 路径与迭代数经 argv 传入。
+    const workerPath = fileURLToPath(new URL("./helpers/peer-worker.mjs", import.meta.url));
+    await Promise.all(
+      Array.from({ length: N }, () =>
+        execFileP(process.execPath, [workerPath, dbPath, String(M)], { timeout: 30000 })
+      )
+    );
+    const store = createStore(dbPath);
+    try {
+      const state = store.getMirrorState();
+      assert.equal(state.generation, N * M,
+        `并发 ${N} 进程 × ${M} 次必须无丢失增量，得到 ${state.generation}`);
+    } finally {
+      store.close();
+    }
+  } finally {
+    // Windows：8 个 SQLite 子进程退出后 -shm/-wal 句柄延迟释放，删目录偶发 EPERM；
+    // rm 带 maxRetries 自动重试（30×100ms 共 3s），仍失败则放行——清理只是收尾，
+    // 并发断言正确性由上方 generation 断言保证，残留临时目录交给 OS/CI 回收，
+    // 绝不让句柄释放慢把 flaky 标红。
+    try {
+      rmSync(dir, { recursive: true, force: true, maxRetries: 30, retryDelay: 100 });
+    } catch (err) {
+      if (!["EPERM", "EBUSY", "EACCES"].includes(err.code)) throw err;
+    }
+  }
+});
+
+test("peer-D: generation 上界与负数拒绝", () => {
+  const { dir, store } = setup();
+  try {
+    // 负数拒绝
+    assert.throws(() => store.setMirrorState({ generation: -1 }), RangeError, "负数必须拒绝");
+    assert.throws(() => store.setMirrorState({ applied_generation: -5 }), RangeError, "负数 applied 必须拒绝");
+    // 超 MAX_SAFE_INTEGER 拒绝
+    assert.throws(
+      () => store.setMirrorState({ generation: Number.MAX_SAFE_INTEGER + 1 }),
+      RangeError,
+      "超出 MAX_SAFE_INTEGER 必须拒绝"
+    );
+    // 到上界后再 increment 必须抛错（读回不会 ERR_OUT_OF_RANGE）
+    store.setMirrorState({ generation: Number.MAX_SAFE_INTEGER });
+    assert.throws(() => store.incrementGeneration(), /exceeded MAX_SAFE_INTEGER/, "上界后再递增必须抛错");
+    // 正常递增仍工作
+    store.setMirrorState({ generation: 5 });
+    assert.equal(store.incrementGeneration().generation, 6, "正常递增不受影响");
+  } finally {
+    store.close();
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("v0.3.9-A: compareAndUpdate 的 CAS UPDATE 与 generation 同事务——miss 不得递增", () => {
+  const { dir, store } = setup();
+  try {
+    const saved = store.save({ type: "project", title: "CAS 原子", content: "v0" });
+    const before = store.getById(saved.id);
+    const genBefore = store.getMirrorState().generation;
+
+    // 成功 CAS：业务写入 + generation 递增必须一次提交（同事务）
+    const updated = store.compareAndUpdate(saved.id, before.updated_at, { content: "v1" });
+    assert.ok(updated, "当前版本 CAS 必须成功");
+    const genAfterOk = store.getMirrorState().generation;
+    assert.equal(genAfterOk, genBefore + 1, "成功 CAS 必须恰好递增一次 generation");
+
+    // miss CAS：不写任何东西，generation 也不得递增
+    const stale = store.getById(saved.id).updated_at; // v1 的 token
+    store.compareAndUpdate(saved.id, before.updated_at, { content: "v2" }); // 用旧 token → miss
+    assert.equal(store.getById(saved.id).content, "v1", "miss 不得改数据");
+    assert.equal(store.getMirrorState().generation, genAfterOk,
+      "CAS miss 不得递增 generation（UPDATE 与 increment 必须同事务）");
+  } finally {
+    store.close();
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("v0.3.9-F: generation 非整数必须拒绝（不得截断）", () => {
+  const { dir, store } = setup();
+  try {
+    // 审计 peer F：1.5 这类小数此前被 Math.trunc 截断 + SQLite CHECK 接受 → 静默脏值。
+    // fail-closed：JS 与 SQL 统一只接受整数。
+    assert.throws(() => store.setMirrorState({ generation: 1.5 }), RangeError, "小数 generation 必须拒绝");
+    assert.throws(() => store.setMirrorState({ applied_generation: -1.5 }), RangeError, "负数小数必须拒绝");
+    assert.throws(() => store.setMirrorState({ generation: Number.MAX_SAFE_INTEGER + 0.5 }), RangeError, "超界小数必须拒绝");
+    // 整数仍正常
+    const s = store.setMirrorState({ generation: 7 });
+    assert.equal(s.generation, 7, "整数 generation 正常");
+  } finally {
+    store.close();
+    rmSync(dir, { recursive: true, force: true });
+  }
+});