@modusensus/dsh-mneme 0.2.7 → 0.2.8

package/src/dream.js

@@ -100,6 +100,78 @@ export function buildOutcome(decisions) {
   return { byId };
 }
 
+/**
+ * Content-addressed digest of the memories a verdict was decided against
+ * (id + title + content + importance), sorted by id so identical inputs always
+ * hash the same. This is the per-record "判定依据" fingerprint: a receipt whose
+ * digest cannot be reproduced from the involved memories is a bare claim, and a
+ * digest match with a divergent outcome pinpoints drift to the exact record.
+ */
+export function hashDecisionInput(memories) {
+  const canon = (memories ?? [])
+    .map((m) => [m.id, m.title, m.content, m.importance])
+    .sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0))
+    .map((p) => p.map((x) => String(x ?? "")).join("
"))
+    .join("");
+  return createHash("sha256").update(canon).digest("hex");
+}
+
+/**
+ * Build the per-record receipts for a run's actually-committed mutable verdicts
+ * (merge/conflict/update) — one row per verdict in the receipt_chain. Inputs
+ * are drawn from the run snapshot (what the LLM actually arbitrated against),
+ * and the idempotency counters count_before → count_after come from the
+ * committed sub-step, so replaying the same decision must reproduce the same
+ * numbers. verdict starts "live"; a later policy_epoch upgrade will batch-mark
+ * older verdicts "historical" (a receipt_chain rewrite driven by the store's
+ * getLatestPolicyEpoch — out of scope for this pass), while "revoked" is
+ * reserved for verdicts later overturned by an explicit human decision.
+ */
+function buildRecordReceipts({ runId, committed, snapshot, policyEpoch }) {
+  const at = (id) => snapshot?.get?.(id);
+  const receipts = [];
+  for (const c of committed ?? []) {
+    const base = {
+      run_id: runId,
+      verdict: "live",
+      count_before: c.count_before,
+      count_after: c.count_after,
+      policy_epoch: policyEpoch,
+      created_at: new Date().toISOString()
+    };
+    if (c.action === "merge") {
+      receipts.push({
+        ...base,
+        receipt_id: randomUUID(),
+        record_id: c.keepSource,
+        kind: "merge",
+        input_digest: hashDecisionInput((c.ids ?? []).map(at).filter(Boolean)),
+        keep_source: c.keepSource,
+        sources: c.ids
+      });
+    } else if (c.action === "conflict") {
+      receipts.push({
+        ...base,
+        receipt_id: randomUUID(),
+        record_id: c.winner,
+        kind: "conflict",
+        input_digest: hashDecisionInput([at(c.winner), at(c.loser)].filter(Boolean)),
+        winner_id: c.winner,
+        loser_id: c.loser
+      });
+    } else if (c.action === "update") {
+      receipts.push({
+        ...base,
+        receipt_id: randomUUID(),
+        record_id: c.ids[0],
+        kind: "update",
+        input_digest: hashDecisionInput([at(c.ids[0])].filter(Boolean))
+      });
+    }
+  }
+  return receipts;
+}
+
 /**
  * Consume an LLM stream and return the accumulated text. Direct text-delta
  * accumulation covers both the real protocol ({type:"text-delta", index, text})
@@ -304,6 +376,10 @@ export function createDreamScheduler({ onRun, thresholdCount = 10, thresholdChar
           model: route?.model,
           snapshot_hash: snapshotHash,
           input_count: snapshot.size,
+          // 裁决规则版本号：config.policyEpoch（默认 0）。规则升级后该行保留
+          // 当时的 epoch，旧裁决据此降级为历史证据（store 层 getLatestPolicyEpoch
+          // 只负责读取当前生效版本，写入由这里完成）。
+          policy_epoch: config.policyEpoch ?? 0,
           // Full input snapshot (canonical fields) so the exact arbitration
           // input can be rebuilt offline from the audit row alone — the
           // digest + decisions + outcome triple makes silent errors locatable
@@ -420,6 +496,19 @@ export function createDreamScheduler({ onRun, thresholdCount = 10, thresholdChar
     // a target changed during the LLM call is skipped and reported as a
     // conflict instead of being overwritten (item ①).
     const { applied, conflicts, failures, committed } = applyDecisions(decisions, service, logger, snapshot);
+    // Per-record receipt chain: one row per actually-committed merge/conflict/
+    // update verdict, stamped with the decision-basis digest + idempotency
+    // counters (count_before → count_after). Written here, before the run audit
+    // row, so the verdict trail always precedes the run trail it belongs to.
+    // Bookkeeping: a write failure is logged and swallowed — it must never
+    // block the consolidation flow.
+    try {
+      for (const r of buildRecordReceipts({ runId, committed, snapshot, policyEpoch: config.policyEpoch ?? 0 })) {
+        service.saveReceipt(r);
+      }
+    } catch (error) {
+      logger?.warn?.(`dsh-mneme dream: failed to write per-record receipt: ${String(error)}`);
+    }
     // Attach the pre-update snapshot to the audit copy of each update decision
     // so the recorded row shows the before/after delta, not just the target.
     const auditDecisions = decisions.map((d) =>

package/src/index.js

@@ -44,6 +44,23 @@ export const apply = (ctx, config) => {
   const mirror = createMirror(memoryDir);
   const service = createService({ store, mirror, config: cfg });
 
+  // Recall-layer receipt: when searchMemories runs with recordRecall=true, the
+  // retrieval scene (query/mode/topK/threshold + candidates) is persisted to
+  // recall_runs for audit/replay — the sibling of the dream_runs judgment trail.
+  // Best-effort: a failed recall write must never break the search.
+  service.setRecallRecorder((recall) => {
+    try {
+      store.saveRecallRun({
+        query: recall.query,
+        mode: recall.mode,
+        topK: recall.topK,
+        threshold: recall.threshold ?? null,
+        candidates: recall.candidates ?? [],
+        created_at: recall.createdAt
+      });
+    } catch { /* non-fatal: recall recording is bookkeeping */ }
+  });
+
   // User-configurable settings (profile, rules) and custom commands share the
   // same SQLite file but live in dedicated tables, isolated from memories.
   const settings = createSettings(store.db);

package/src/service.js

@@ -16,6 +16,13 @@ export function createService({ store, mirror, config, onWrite }) {
   let vectorIndex = null;
   let reranker = null;
 
+  // Optional recall recorder, installed via setRecallRecorder after creation.
+  // When searchMemories is called with recordRecall=true it receives the
+  // actual merged recall scene (candidates + scores + source + threshold) so
+  // the retrieval layer can be audited/replayed — the sibling of the dream
+  // judgment-layer audit trail (dream_runs).
+  let recallRecorder = null;
+
   // Transaction nesting depth. Inside service.transaction the per-mutation side
   // effects (mirror render, write notify, re-embed) are deferred so a ROLLBACK
   // never leaves the mirror file diverged from the database; transaction()
@@ -43,7 +50,7 @@ export function createService({ store, mirror, config, onWrite }) {
       const out = [];
       for (const s of scored) {
         const c = byId.get(s.id);
-        if (c) { out.push({ ...c, score: s.score }); if (out.length >= topK) break; }
+        if (c) { out.push({ ...c, score: s.score, source: "rerank" }); if (out.length >= topK) break; }
       }
       return out.length ? out : candidates.slice(0, topK);
     } catch {
@@ -78,15 +85,16 @@ export function createService({ store, mirror, config, onWrite }) {
     return base * (0.5 + (row.importance ?? 3) / 10);
   }
 
-  async function searchMemories(query, { mode = "auto", topK = 20, threshold, useRerank = true } = {}) {
+  async function searchMemories(query, { mode = "auto", topK = 20, threshold, useRerank = true, recordRecall = false } = {}) {
     const q = String(query ?? "").trim();
     if (!q) return [];
     const lim = topK > 0 ? topK : 20;
 
     // Keyword results, decorated with a score so they can be weight-blended
-    // with vector results and reported uniformly.
+    // with vector results and reported uniformly. source tracks where each
+    // candidate came from for the recall layer receipt.
     const rawKeyword = store.search(q, { limit: lim });
-    const keyword = rawKeyword.map((m) => ({ ...m, score: scoreKeyword(m, q) }));
+    const keyword = rawKeyword.map((m) => ({ ...m, score: scoreKeyword(m, q), source: "keyword" }));
     const wantVector = mode === "vector" || mode === "hybrid" || (mode === "auto" && !!embedder);
     let vector = [];
     if (wantVector && embedder) {
@@ -100,7 +108,7 @@ export function createService({ store, mirror, config, onWrite }) {
           const hits = vectorIndex
             ? vectorIndex.search(qv, { limit: lim * 2, threshold: threshold ?? 0 })
             : store.searchVector(qv, { limit: lim * 2, threshold: threshold ?? 0 });
-          vector = hits.map((m) => ({ ...m, vector: true }));
+          vector = hits.map((m) => ({ ...m, vector: true, source: "vector" }));
         }
       } catch { /* vector unavailable: keep keyword results */ }
     }
@@ -147,10 +155,34 @@ export function createService({ store, mirror, config, onWrite }) {
     }
 
     merged = merged.slice(0, lim);
-    if (useRerank && reranker && merged.length) {
-      return rerankCandidates(q, merged, lim);
+    const result = useRerank && reranker && merged.length
+      ? await rerankCandidates(q, merged, lim)
+      : merged;
+
+    // Recall layer receipt: with recordRecall on, hand the actual merged
+    // candidate list (id/title/content/score/source) to the injected recorder
+    // before returning, making the retrieval scene replayable — the sibling of
+    // the dream judgment-layer audit trail. Recorder failures must never break
+    // the search itself.
+    if (recordRecall && recallRecorder) {
+      try {
+        recallRecorder({
+          query: q,
+          mode,
+          topK: lim,
+          threshold: threshold ?? null,
+          candidates: result.map((m) => ({
+            id: m.id,
+            title: m.title,
+            content: m.content,
+            score: m.score ?? null,
+            source: m.source ?? "keyword"
+          })),
+          createdAt: new Date().toISOString()
+        });
+      } catch { /* recall receipt is best effort */ }
     }
-    return merged;
+    return result;
   }
 
   /**
@@ -355,6 +387,7 @@ export function createService({ store, mirror, config, onWrite }) {
     setEmbedder(emb) { embedder = emb; },
     setVectorIndex(vi) { vectorIndex = vi; },
     setReranker(rn) { reranker = rn; },
+    setRecallRecorder(fn) { recallRecorder = fn; },
     searchMemories,
     // passthroughs used by tools and api layers; mutations keep the mirror in sync
     search: (q, o) => store.search(q, o),
@@ -441,6 +474,11 @@ export function createService({ store, mirror, config, onWrite }) {
     // dream scheduler that just recorded the run.
     saveDreamRun: (run) => store.saveDreamRun(run),
     getDreamRun: (id) => store.getDreamRun(id),
-    listDreamRuns: (opts) => store.listDreamRuns(opts)
+    listDreamRuns: (opts) => store.listDreamRuns(opts),
+    // Per-record receipt chain (same bookkeeping semantics as saveDreamRun: an
+    // audit write, never a write-hook-triggering memory mutation).
+    saveReceipt: (r) => store.saveReceipt(r),
+    getReceipt: (id) => store.getReceipt(id),
+    listReceipts: (opts) => store.listReceipts(opts)
   };
 }

package/src/store.js

@@ -37,10 +37,27 @@ CREATE TABLE IF NOT EXISTS dream_runs (
   outcome        TEXT,                   -- JSON: { byId: {id: action} }
   applied        INTEGER NOT NULL DEFAULT 0,
   summary_stored INTEGER NOT NULL DEFAULT 0,
-  receipt        TEXT NOT NULL
+  receipt        TEXT NOT NULL,
+  policy_epoch   INTEGER NOT NULL DEFAULT 0  -- 裁决规则版本：规则升级后旧裁决降级为历史证据
 );
 CREATE INDEX IF NOT EXISTS idx_dream_runs_created ON dream_runs(created_at);
 
+-- recall_runs: recall-layer receipt. One row per retrieval scene — the query,
+-- mode, top-k, threshold and the exact candidate list (id/title/content/score/
+-- source) that was returned — so retrieval behavior can be audited and
+-- replayed after the fact. Sibling of the dream judgment-layer audit trail.
+CREATE TABLE IF NOT EXISTS recall_runs (
+  id          TEXT PRIMARY KEY,
+  query       TEXT NOT NULL,
+  mode        TEXT NOT NULL,
+  top_k       INTEGER,
+  threshold   REAL,
+  candidates  TEXT NOT NULL,   -- JSON: 召回候选数组（含 id/title/content/score/source）
+  created_at  TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_recall_runs_created ON recall_runs(created_at);
+CREATE INDEX IF NOT EXISTS idx_recall_runs_query ON recall_runs(query);
+
 -- failure_memories: records user corrections / reflection failures. Captures
 -- what a memory was (actual) vs what the user changed it to (expected)
 -- so later reflection passes can mine recurring correction patterns.
@@ -58,6 +75,31 @@ CREATE TABLE IF NOT EXISTS failure_memories (
 );
 CREATE INDEX IF NOT EXISTS idx_failure_memories_created ON failure_memories(created_at);
 CREATE INDEX IF NOT EXISTS idx_failure_memories_type ON failure_memories(failure_type);
+
+-- receipt_chain: per-record receipt chain. One row per mutable verdict
+-- (merge/conflict/update), carrying the input digest (the basis of the
+-- decision, content-addressed) and the idempotency check counters
+-- count_before → count_after. Replaying the same decision must reproduce the
+-- same result; a digest match with a divergent outcome pinpoints drift to the
+-- specific record/run. Sibling of the run-level dream audit trail.
+CREATE TABLE IF NOT EXISTS receipt_chain (
+  receipt_id   TEXT PRIMARY KEY,
+  run_id       TEXT NOT NULL,
+  record_id    TEXT NOT NULL,
+  kind         TEXT NOT NULL,         -- merge | conflict | update
+  input_digest TEXT NOT NULL,
+  winner_id    TEXT,
+  loser_id     TEXT,
+  keep_source  TEXT,
+  sources      TEXT,                  -- JSON: merge 全部参与 id 数组
+  verdict      TEXT NOT NULL,         -- live | revoked | historical
+  count_before INTEGER NOT NULL,
+  count_after  INTEGER NOT NULL,
+  policy_epoch INTEGER NOT NULL DEFAULT 0,
+  created_at   TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_receipt_chain_record ON receipt_chain(record_id);
+CREATE INDEX IF NOT EXISTS idx_receipt_chain_run ON receipt_chain(run_id);
 `;
 
 const TYPES = new Set(["preference", "project", "decision", "history", "summary"]);
@@ -116,10 +158,53 @@ function toDreamRun(row) {
     outcome: row.outcome ? JSON.parse(row.outcome) : undefined,
     applied: row.applied,
     summary_stored: row.summary_stored === 1,
-    receipt: row.receipt
+    receipt: row.receipt,
+    policy_epoch: row.policy_epoch ?? 0
   };
 }
 
+function toReceipt(row) {
+  if (!row) return undefined;
+  return {
+    receipt_id: row.receipt_id,
+    run_id: row.run_id,
+    record_id: row.record_id,
+    kind: row.kind,
+    input_digest: row.input_digest,
+    winner_id: row.winner_id ?? undefined,
+    loser_id: row.loser_id ?? undefined,
+    keep_source: row.keep_source ?? undefined,
+    sources: parseJsonArray(row.sources),
+    verdict: row.verdict,
+    count_before: row.count_before,
+    count_after: row.count_after,
+    policy_epoch: row.policy_epoch ?? 0,
+    created_at: row.created_at
+  };
+}
+
+function toRecallRun(row) {
+  if (!row) return undefined;
+  return {
+    id: row.id,
+    query: row.query,
+    mode: row.mode,
+    topK: row.top_k,
+    threshold: row.threshold,
+    candidates: parseJsonArray(row.candidates),
+    created_at: row.created_at
+  };
+}
+
+function parseJsonArray(raw) {
+  try {
+    const arr = JSON.parse(raw);
+    return Array.isArray(arr) ? arr : [];
+  } catch {
+    return [];
+  }
+}
+
 export function createStore(path) {
   const db = new DatabaseSync(path);
   db.exec("PRAGMA journal_mode = WAL;");
@@ -134,6 +219,12 @@ export function createStore(path) {
     db.exec("ALTER TABLE memories ADD COLUMN embedding TEXT");
   }
 
+  // Legacy dream_runs without policy_epoch → backfill with the default epoch.
+  const dreamCols = db.prepare("PRAGMA table_info(dream_runs)").all().map((c) => c.name);
+  if (!dreamCols.includes("policy_epoch")) {
+    db.exec("ALTER TABLE dream_runs ADD COLUMN policy_epoch INTEGER NOT NULL DEFAULT 0");
+  }
+
   // Per-instance monotonic timestamp guard: consecutive writes within the same
   // millisecond must still produce strictly increasing timestamps (test asserts
   // updated_at != created_at). State lives in the store closure, not module scope.
@@ -398,16 +489,17 @@ export function createStore(path) {
   function saveDreamRun(run) {
     const id = run.id ?? randomUUID();
     const now = nowIso();
+    const policyEpoch = Number.isInteger(run.policy_epoch) ? run.policy_epoch : 0;
     db.prepare(
       `INSERT INTO dream_runs (id, created_at, status, error, provider, model, snapshot_hash,
-        input_count, input, decisions, outcome, applied, summary_stored, receipt)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        input_count, input, decisions, outcome, applied, summary_stored, receipt, policy_epoch)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
        ON CONFLICT(id) DO UPDATE SET
          created_at=excluded.created_at, status=excluded.status, error=excluded.error,
          provider=excluded.provider, model=excluded.model, snapshot_hash=excluded.snapshot_hash,
          input_count=excluded.input_count, input=excluded.input, decisions=excluded.decisions,
          outcome=excluded.outcome, applied=excluded.applied, summary_stored=excluded.summary_stored,
-         receipt=excluded.receipt`
+         receipt=excluded.receipt, policy_epoch=excluded.policy_epoch`
     ).run(
       id,
       run.created_at ?? now,
@@ -422,7 +514,8 @@ export function createStore(path) {
       run.outcome !== undefined ? JSON.stringify(run.outcome) : null,
       run.applied ?? 0,
       run.summary_stored ? 1 : 0,
-      run.receipt
+      run.receipt,
+      policyEpoch
     );
     return getDreamRun(id);
   }
@@ -440,6 +533,136 @@ export function createStore(path) {
     return rows.map(toDreamRun);
   }
 
+  /**
+   * Latest ruling-rule version seen on the audit trail. policy_epoch is a config
+   * value stamped onto each run by the caller; reading the newest row's epoch
+   * gives the current effective version, falling back to 0 (default) when the
+   * trail is empty. Rules upgrades leave older runs with their original epoch,
+   * so those decisions can be demoted to historical evidence.
+   */
+  function getLatestPolicyEpoch() {
+    const row = db.prepare(
+      "SELECT policy_epoch FROM dream_runs ORDER BY created_at DESC, id LIMIT 1"
+    ).get();
+    return row ? (row.policy_epoch ?? 0) : 0;
+  }
+
+  // --- per-record receipt chain --------------------------------------------
+
+  /**
+   * Persist one per-record receipt (a single merge/conflict/update verdict).
+   * The run-level dream audit trail answers "did this run happen and with what
+   * input"; the receipt chain drills down to each mutable verdict, carrying the
+   * input digest (decision basis) plus count_before → count_after idempotency
+   * checkpoints so replay drift can be located to the exact record/run. Like
+   * the dream trail this is bookkeeping: it never triggers write hooks. Writes
+   * are idempotent on receipt id (replay overwrites, never duplicates).
+   */
+  function saveReceipt(run) {
+    const id = run.receipt_id ?? randomUUID();
+    const now = nowIso();
+    const policyEpoch = Number.isInteger(run.policy_epoch) ? run.policy_epoch : 0;
+    db.prepare(
+      `INSERT INTO receipt_chain (receipt_id, run_id, record_id, kind, input_digest,
+        winner_id, loser_id, keep_source, sources, verdict, count_before, count_after,
+        policy_epoch, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT(receipt_id) DO UPDATE SET
+         run_id=excluded.run_id, record_id=excluded.record_id, kind=excluded.kind,
+         input_digest=excluded.input_digest, winner_id=excluded.winner_id,
+         loser_id=excluded.loser_id, keep_source=excluded.keep_source,
+         sources=excluded.sources, verdict=excluded.verdict,
+         count_before=excluded.count_before, count_after=excluded.count_after,
+         policy_epoch=excluded.policy_epoch, created_at=excluded.created_at`
+    ).run(
+      id,
+      run.run_id,
+      run.record_id,
+      run.kind,
+      run.input_digest,
+      run.winner_id ?? null,
+      run.loser_id ?? null,
+      run.keep_source ?? null,
+      JSON.stringify(run.sources ?? []),
+      run.verdict,
+      run.count_before,
+      run.count_after,
+      policyEpoch,
+      run.created_at ?? now
+    );
+    return getReceipt(id);
+  }
+
+  function getReceipt(id) {
+    const row = db.prepare("SELECT * FROM receipt_chain WHERE receipt_id = ?").get(id);
+    return toReceipt(row);
+  }
+
+  function listReceipts({ limit = 50, offset = 0, run_id } = {}) {
+    const { limit: lim, offset: off } = sanitizePage(limit, offset, 50);
+    const clauses = [];
+    const params = [];
+    if (run_id) {
+      clauses.push("run_id = ?");
+      params.push(run_id);
+    }
+    const where = clauses.length ? `WHERE ${clauses.join(" AND ")}` : "";
+    const rows = db.prepare(
+      `SELECT * FROM receipt_chain ${where} ORDER BY created_at DESC, receipt_id LIMIT ? OFFSET ?`
+    ).all(...params, lim, off);
+    return rows.map(toReceipt);
+  }
+
+  // --- recall-layer audit trail -------------------------------------------
+
+  /**
+   * Persist one recall run (the retrieval scene: query/mode/top-k/threshold +
+   * the exact candidate list handed to the caller). Like the dream audit trail
+   * this is bookkeeping, so it never triggers write hooks — a notify here would
+   * loop back into search itself. Writes are idempotent on run id (replay
+   * overwrites, never duplicates), matching saveDreamRun.
+   */
+  function saveRecallRun(run) {
+    const id = run.id ?? randomUUID();
+    db.prepare(
+      `INSERT INTO recall_runs (id, query, mode, top_k, threshold, candidates, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT(id) DO UPDATE SET
+         query=excluded.query, mode=excluded.mode, top_k=excluded.top_k,
+         threshold=excluded.threshold, candidates=excluded.candidates,
+         created_at=excluded.created_at`
+    ).run(
+      id,
+      run.query,
+      run.mode,
+      run.topK ?? null,
+      run.threshold ?? null,
+      JSON.stringify(run.candidates ?? []),
+      run.created_at ?? nowIso()
+    );
+    return getRecallRun(id);
+  }
+
+  function getRecallRun(id) {
+    const row = db.prepare("SELECT * FROM recall_runs WHERE id = ?").get(id);
+    return toRecallRun(row);
+  }
+
+  function listRecallRuns({ limit = 50, offset = 0, query } = {}) {
+    const { limit: lim, offset: off } = sanitizePage(limit, offset, 50);
+    const clauses = [];
+    const params = [];
+    if (query) {
+      clauses.push("query LIKE ? ESCAPE '\\'");
+      params.push(`%${escapeLike(String(query))}%`);
+    }
+    const where = clauses.length ? `WHERE ${clauses.join(" AND ")}` : "";
+    const rows = db.prepare(
+      `SELECT * FROM recall_runs ${where} ORDER BY created_at DESC, id LIMIT ? OFFSET ?`
+    ).all(...params, lim, off);
+    return rows.map(toRecallRun);
+  }
+
   // --- failure memories ----------------------------------------------------
 
   /**
@@ -510,6 +733,13 @@ export function createStore(path) {
     saveDreamRun,
     getDreamRun,
     listDreamRuns,
+    getLatestPolicyEpoch,
+    saveReceipt,
+    getReceipt,
+    listReceipts,
+    saveRecallRun,
+    getRecallRun,
+    listRecallRuns,
     saveFailure,
     listFailures,
     getFailureStats,

package/test/audit.test.js

@@ -6,6 +6,7 @@ import { join } from "node:path";
 import {
   createDreamScheduler,
   hashSnapshot,
+  hashDecisionInput,
   buildReceipt,
   parseReceipt,
   buildOutcome
@@ -104,6 +105,97 @@ test("successful runDream writes an audit row with receipt, decisions and outcom
   store.close();
 });
 
+// ---------------------------------------------------------------- per-record receipt chain
+
+test("hashDecisionInput is deterministic, order-independent and content-addressed", () => {
+  const mk = (id, title, content = "c") => ({ id, title, content, importance: 3 });
+  const a = mk("a", "t1");
+  const b = mk("b", "t2");
+  assert.equal(hashDecisionInput([a, b]), hashDecisionInput([b, a]), "order independent");
+  assert.equal(hashDecisionInput([a, b]), hashDecisionInput([{ ...a }, { ...b }]), "clone independent");
+  assert.notEqual(hashDecisionInput([a, b]), hashDecisionInput([a, { ...b, content: "changed" }]), "content change flips digest");
+  assert.match(hashDecisionInput([]), /^[0-9a-f]{64}$/, "empty input hashes stably");
+});
+
+test("runDream writes one per-record receipt per committed merge/conflict/update", async () => {
+  const { store, service, dream } = setup();
+  const { memory: a } = service.saveWithDedupe({ type: "project", title: "插件", content: "旧", importance: 3 });
+  const { memory: b } = service.saveWithDedupe({ type: "project", title: "插件2", content: "新细节", importance: 4 });
+  const { memory: w } = service.saveWithDedupe({ type: "decision", title: "截止", content: "8月20日", importance: 4 });
+  const { memory: l } = service.saveWithDedupe({ type: "decision", title: "截止旧", content: "8月15日", importance: 4 });
+  const { memory: u } = service.saveWithDedupe({ type: "preference", title: "语言", content: "喜欢 Python" });
+  const ctx = mockCtx({
+    onConsolidation: () => JSON.stringify([
+      { action: "merge", ids: [a.id, b.id], keepSource: b.id, title: "插件总览", content: "合并内容", importance: 4 },
+      { action: "conflict", winner: w.id, loser: l.id, reason: "更新" },
+      { action: "update", ids: [u.id], content: "喜欢 Rust" }
+    ])
+  });
+  // Backdate the update target so the update age guard (minAgeHours) sees a
+  // settled record rather than a sub-second-old one — store.nowIso() can drift
+  // a few ms ahead of the wall clock when seeds land in the same millisecond.
+  store.db.prepare("UPDATE memories SET created_at = ? WHERE id = ?")
+    .run(new Date(Date.now() - 3600000).toISOString(), u.id);
+  const result = await dream.runDream(ctx, service, { reflectionUpdateMinAgeHours: 0, policyEpoch: 3 });
+  assert.equal(result.status, "ok");
+
+  const receipts = store.listReceipts({ run_id: result.runId });
+  assert.equal(receipts.length, 3, "one receipt per mutable verdict, none for keep/archive");
+
+  const byKind = Object.fromEntries(receipts.map((r) => [r.kind, r]));
+  assert.deepEqual(Object.keys(byKind).sort(), ["conflict", "merge", "update"]);
+
+  const merge = byKind.merge;
+  assert.equal(merge.run_id, result.runId);
+  assert.equal(merge.record_id, b.id, "merge receipt keyed on keepSource");
+  assert.equal(merge.keep_source, b.id);
+  assert.deepEqual(merge.sources, [a.id, b.id], "merge sources = full id array");
+  assert.equal(merge.count_before, 2);
+  assert.equal(merge.count_after, 1);
+  assert.equal(merge.verdict, "live");
+  assert.equal(merge.policy_epoch, 3, "policy epoch stamped from config");
+  assert.equal(merge.input_digest, hashDecisionInput([a, b]), "digest over the pre-apply basis memories");
+  assert.match(merge.created_at, /^2\d{3}-/, "created_at is an ISO timestamp");
+
+  const conflict = byKind.conflict;
+  assert.equal(conflict.record_id, w.id, "conflict receipt keyed on winner");
+  assert.equal(conflict.winner_id, w.id);
+  assert.equal(conflict.loser_id, l.id);
+  assert.equal(conflict.keep_source, undefined, "no keep_source on a conflict");
+  assert.equal(conflict.count_before, 2);
+  assert.equal(conflict.count_after, 1);
+  assert.equal(conflict.input_digest, hashDecisionInput([w, l]), "digest over winner+loser");
+
+  const update = byKind.update;
+  assert.equal(update.record_id, u.id);
+  assert.equal(update.winner_id, undefined, "no winner/loser on an update");
+  assert.equal(update.count_before, 1);
+  assert.equal(update.count_after, 1);
+  assert.equal(update.input_digest, hashDecisionInput([u]), "digest over the pre-update target");
+  store.close();
+});
+
+test("a throwing per-record receipt writer never breaks the run (bookkeeping fails safe)", async () => {
+  const { store, service, dream } = setup();
+  const { memory: a } = service.saveWithDedupe({ type: "project", title: "甲", content: "A", importance: 3 });
+  const { memory: b } = service.saveWithDedupe({ type: "project", title: "乙", content: "B", importance: 4 });
+  service.saveReceipt = () => { throw new Error("receipt store boom"); };
+  const ctx = mockCtx({
+    onConsolidation: () => JSON.stringify([
+      { action: "merge", ids: [a.id, b.id], keepSource: b.id, title: "甲乙", content: "合并", importance: 4 }
+    ])
+  });
+  const result = await dream.runDream(ctx, service, {});
+  assert.equal(result.ok, true, "consolidation unaffected by receipt failure");
+  assert.equal(result.applied, 1);
+  const run = store.listDreamRuns()[0];
+  assert.equal(run.status, "ok", "audit row still written");
+  assert.equal(store.getById(b.id).title, "甲乙", "merge still applied");
+  assert.equal(store.getById(a.id).archived, true, "merge source still archived");
+  assert.equal(store.listReceipts().length, 0, "no receipts persisted");
+  store.close();
+});
+
 test("failed runDream records status failed with the error", async () => {
   const { store, service, dream } = setup();
   service.saveWithDedupe({ type: "preference", title: "语言", content: "中文" });