@modusensus/dsh-mneme 0.2.8 → 0.2.10

package/README.md

@@ -5,7 +5,7 @@
 [![npm version](https://img.shields.io/npm/v/@modusensus/dsh-mneme?color=blue&label=npm)](https://www.npmjs.com/package/@modusensus/dsh-mneme)
 [![license](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 [![Awesome](https://awesome-dsh-plugin.com/badge.svg)](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin)
-[![tests](https://img.shields.io/badge/tests-263%20passed-success)](https://github.com/modusensus/dsh-mneme)
+[![tests](https://img.shields.io/badge/tests-363%20passed-success)](https://github.com/modusensus/dsh-mneme)
 
 > 给 DeepSeek Harness 的跨会话记忆插件：让 Agent 记住你、记住项目、自动整理记忆。**Mneme**（Μνήμη）——希腊记忆女神 Mnemosyne 之名，掌管记忆与梦境，正如 autoDream 在后台巩固记忆。
 
@@ -225,7 +225,7 @@ src/
 lib/
 ├── client.js         # Web 面板（手写 ModuleLoader bundle）
 └── *.js              # src 的同步分发产物
-test/                 # 263 个 node:test 测试（含审计与三轴线压测不变量）
+test/                 # 363 个 node:test 测试（含审计与三轴线压测不变量）
 scripts/              # e2e-dsh.js 端到端演示 · stress-dsh.js 三轴线压测 · sync-lib.js 同步
 ```
 
@@ -234,7 +234,7 @@ scripts/              # e2e-dsh.js 端到端演示 · stress-dsh.js 三轴线压
 ```bash
 cd dsh-mneme
 npm install        # 安装 peer 依赖（以 devDependencies 形式，用于本地测试）
-npm test           # 运行 263 个测试
+npm test           # 运行 363 个测试
 npm run stress     # 三轴线压测：长会话检索 / 冲突仲裁 / 多 Agent 并发（离线 mock LLM）
 npm run sync       # 把 src/ 同步到 lib/（发布时由 prepack 钩子自动执行）
 ```

package/lib/config.js

@@ -67,5 +67,12 @@ export const Config = z.object({
   reflectionUpdateEnabled: z.boolean().default(true),
   reflectionFailureTracking: z.boolean().default(true),
   reflectionUpdateMaxPerRun: z.natural().min(0).max(5).default(2),
-  reflectionUpdateMinAgeHours: z.natural().min(0).max(168).default(24)
+  reflectionUpdateMinAgeHours: z.natural().min(0).max(168).default(24),
+
+  // --- conflict freeze: manual review for conflicting memories (v0.2.1) ---
+  // Opt-in by default: when true, conflicting memories are not auto-merged
+  // and are marked as pending manual review instead.
+  conflictFreezeEnabled: z.boolean().default(false),
+  // Maximum number of frozen conflicts to keep pending for manual review.
+  conflictFreezeMaxPending: z.natural().min(1).max(1000).default(100),
 });

package/lib/dream.js

@@ -350,6 +350,10 @@ export function createDreamScheduler({ onRun, thresholdCount = 10, thresholdChar
     const route = resolveRoute(ctx, config, logger);
     const runId = randomUUID();
     const snapshotHash = hashSnapshot([...snapshot.values()]);
+    // Conflict freeze (opt-in): when enabled, conflict decisions are parked for
+    // manual review instead of auto-adjudicated. Read once up front so the
+    // prompt hint and the apply-split agree on the same gate.
+    const freezeEnabled = config.conflictFreezeEnabled === true;
     // Every exit (success or failure) funnels through `finish`, which writes
     // the audit row + receipt. A record failure is logged, never thrown —
     // auditing must not break the consolidation path. Failed runs still
@@ -440,6 +444,12 @@ export function createDreamScheduler({ onRun, thresholdCount = 10, thresholdChar
       ).join("\n");
     }
 
+    // Freeze-aware prompt: in freeze mode the conflict branch still outputs
+    // winner/loser (validation requires them) but they are treated as tentative
+    // candidates — the human makes the final call, not the model.
+    const consolidationPrompt = freezeEnabled
+      ? CONSOLIDATION_PROMPT + `\n\n当前为「冲突冻结」模式：检测到内容矛盾的条目时，仍请输出 conflict，并以 winner/loser 作为候选、reason 说明理由；冲突不会被自动裁决，而会冻结待人工确认。`
+      : CONSOLIDATION_PROMPT;
     let decisionText;
     try {
       decisionText = await streamText(ctx, {
@@ -448,7 +458,7 @@ export function createDreamScheduler({ onRun, thresholdCount = 10, thresholdChar
         purpose: "compaction",
         maxTokens: config.dreamMaxTokens ?? 4096,
         messages: [
-          { role: "system", content: [{ type: "text", text: CONSOLIDATION_PROMPT }] },
+          { role: "system", content: [{ type: "text", text: consolidationPrompt }] },
           { role: "user", content: [{ type: "text", text: listText }] }
         ]
       });
@@ -492,10 +502,46 @@ export function createDreamScheduler({ onRun, thresholdCount = 10, thresholdChar
       }
     }
 
+    // Conflict freeze (opt-in): when enabled, conflict decisions are not
+    // auto-adjudicated — no winner kept, no loser archived. The pair is parked
+    // in conflict_pending for human review instead. Best-effort: a store
+    // failure here must never block the run (fail-safe — the memories are left
+    // untouched and nothing is arbitrated). The cap (conflictFreezeMaxPending)
+    // bounds the review queue; overflow is skipped with a warning.
+    let frozenCount = 0;
+    const frozenIds = [];
+    const applyList = freezeEnabled ? decisions.filter((d) => d.action !== "conflict") : decisions;
+    if (freezeEnabled) {
+      const conflictsToFreeze = decisions.filter((d) => d.action === "conflict");
+      if (conflictsToFreeze.length > 0) {
+        try {
+          const maxPending = Number.isInteger(config.conflictFreezeMaxPending) ? config.conflictFreezeMaxPending : 100;
+          const pendingNow = service.countConflictPending();
+          const budget = Math.max(0, maxPending - pendingNow);
+          const toFreeze = conflictsToFreeze.slice(0, budget);
+          if (conflictsToFreeze.length > budget) {
+            logger?.warn?.(`dsh-mneme dream: conflict freeze queue full (${pendingNow}/${maxPending}), skipped ${conflictsToFreeze.length - budget} conflict(s)`);
+          }
+          for (const d of toFreeze) {
+            try {
+              service.saveConflictPending({ run_id: runId, memory_a: d.winner, memory_b: d.loser, reason: d.reason });
+              frozenCount++;
+              frozenIds.push(d.winner, d.loser);
+            } catch (error) {
+              logger?.warn?.(`dsh-mneme dream: failed to freeze conflict ${d.winner}/${d.loser}: ${String(error)}`);
+            }
+          }
+        } catch (error) {
+          logger?.warn?.(`dsh-mneme dream: conflict freeze lookup failed: ${String(error)}`);
+        }
+      }
+    }
+
     // CAS-guarded, per-decision-transactional apply against the run snapshot:
     // a target changed during the LLM call is skipped and reported as a
-    // conflict instead of being overwritten (item ①).
-    const { applied, conflicts, failures, committed } = applyDecisions(decisions, service, logger, snapshot);
+    // conflict instead of being overwritten (item ①). Frozen conflicts are
+    // excluded from this list (they are parked, not applied).
+    const { applied, conflicts, failures, committed } = applyDecisions(applyList, service, logger, snapshot);
     // Per-record receipt chain: one row per actually-committed merge/conflict/
     // update verdict, stamped with the decision-basis digest + idempotency
     // counters (count_before → count_after). Written here, before the run audit
@@ -521,18 +567,25 @@ export function createDreamScheduler({ onRun, thresholdCount = 10, thresholdChar
     // claim "merge-archived" (item ②). Conflicts/failures ride along so the
     // audit row records why the run diverged.
     const outcome = { ...buildOutcome(committed), conflicts, failures };
+    // Frozen conflicts were not adjudicated: mark both sides pending in the
+    // per-id outcome so the audit row shows they were parked, not skipped.
+    if (frozenIds.length) {
+      for (const id of frozenIds) outcome.byId[id] = "conflict-pending";
+    }
     // Decisions validated but not fully committed → reconcile (not ok).
     const partial = conflicts.length > 0 || failures.length > 0;
     // No decision landed (all-keep, or every decision skipped as an idempotent
     // replay) → nothing substantive changed. Distinct from a success: such a
     // run must never be reported as ok, or the audit claims work that never
     // happened and the scheduler refreshes the baseline on a false positive.
-    const noChange = applied === 0 && committed.every((c) => c.action === "keep");
+    // Frozen conflicts are substantive output (parked for review), so a run
+    // that only froze conflicts is not a noop.
+    const noChange = frozenCount === 0 && applied === 0 && committed.every((c) => c.action === "keep");
 
     // Keep the vector index consistent with the post-dream store state.
     if (semantic?.embedder && semantic?.vectorIndex) {
       try {
-        await maintainIndexAfterDream(decisions, service, semantic);
+        await maintainIndexAfterDream(applyList, service, semantic);
       } catch (error) {
         logger?.warn?.(`[dsh-mneme] dream index maintenance failed: ${String(error)}`);
       }
@@ -554,7 +607,7 @@ export function createDreamScheduler({ onRun, thresholdCount = 10, thresholdChar
       });
     } catch (error) {
       logger?.warn?.(`dsh-mneme dream: summary llm call failed: ${String(error)}`);
-      return finish({ ok: false, error: "llm failed", applied, decisions: auditDecisions, outcome, summary: false });
+      return finish({ ok: false, error: "llm failed", applied, decisions: auditDecisions, outcome, frozen: frozenCount, summary: false });
     }
     let summaryStored = false;
     if (summaryText !== undefined && summaryText.trim()) {
@@ -601,6 +654,7 @@ export function createDreamScheduler({ onRun, thresholdCount = 10, thresholdChar
       outcome,
       conflicts,
       failures,
+      frozen: frozenCount,
       summary: summaryStored
     });
   }

package/lib/mirror.js

@@ -1,4 +1,5 @@
 import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { join } from "node:path";
 
 export const TYPE_FILE = {
@@ -21,6 +22,13 @@ function unescape(text) {
 }
 
 function renderMemory(m) {
+  // last-rendered digest baseline: sha256(title \x00 content). service.js
+  // compares the file hash against this to tell "untouched by a human" (machine
+  // write wins) apart from a real human edit, so a not-yet-re-rendered store
+  // update is not misread as a concurrent human edit.
+  const digest = createHash("sha256")
+    .update(`${m.title}\x00${m.content}`)
+    .digest("hex");
   const lines = [];
   lines.push(`## ${esc(m.title)}`);
   lines.push("");
@@ -31,6 +39,7 @@ function renderMemory(m) {
   lines.push(`- **更新时间**: ${m.updated_at}`);
   if (m.source) lines.push(`- **来源**: ${esc(m.source)}`);
   lines.push("");
+  lines.push(`<!-- mirror-digest: ${digest} -->`);
   lines.push(m.content);
   lines.push("");
   lines.push("---");
@@ -86,7 +95,8 @@ export function createMirror(dir) {
         let body = text
           .slice(blockStart, blockEnd)
           .replace(/^- \*\*ID\*\*: `[^`]+`\n?/, "")
-          .replace(/^(- \*\*(类型|重要性|标签|更新时间|来源)\*\*:.*\n?)+/, "");
+          .replace(/^(- \*\*(类型|重要性|标签|更新时间|来源)\*\*:.*\n?)+/, "")
+          .replace(/^<!-- mirror-digest: [a-f0-9]+ -->\n?/m, "");
         const separators = [...body.matchAll(/^---\s*$/gm)];
         const lastSep = separators[separators.length - 1];
         if (lastSep) body = body.slice(0, lastSep.index);
@@ -97,11 +107,13 @@ export function createMirror(dir) {
         // during a three-way merge of human edits (see service.syncMirror).
         const block = text.slice(blockStart, blockEnd);
         const updatedMatch = block.match(/- \*\*更新时间\*\*: ([^\n]+)/);
+        const digestMatch = block.match(/<!-- mirror-digest: ([a-f0-9]+) -->/);
         edits.push({
           id: anchor[1],
           title: titleMatch ? unescape(titleMatch[1]).trim() : undefined,
           content: body,
-          updated_at: updatedMatch ? updatedMatch[1].trim() : undefined
+          updated_at: updatedMatch ? updatedMatch[1].trim() : undefined,
+          digest: digestMatch ? digestMatch[1] : undefined
         });
 
         const lineEnd = text.indexOf("\n", blockStart);

package/lib/service.js

@@ -1,4 +1,4 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { TYPE_FILE } from "./mirror.js";
 
 const INJECT_TYPES = new Set(["preference", "project", "decision", "summary"]);
@@ -349,8 +349,21 @@ export function createService({ store, mirror, config, onWrite }) {
         const humanChanged = (typeof edit.title === "string" && edit.title !== m.title)
           || (typeof edit.content === "string" && edit.content !== m.content);
         if (!humanChanged) { result.push(m); continue; }
-        // Store changed since the file was last rendered (file records the
-        // store's updated_at at render time) AND the file was hand-edited.
+        // 判断文件是否被人工动过：digest 存在且匹配则无人触碰，否则视为人工动过。
+        // digest 是渲染时对 sha256(title \x00 content) 的记录；机器 store 更新后
+        // 镜像还没重渲染时读到旧内容，digest 仍匹配 → 机器 wins，不会误判为
+        // 并发人工编辑导致机器写丢失 + 伪冲突标记。
+        const digestMatches = typeof edit.digest === "string"
+          && typeof edit.title === "string"
+          && typeof edit.content === "string"
+          && createHash("sha256").update(`${edit.title}\x00${edit.content}`).digest("hex") === edit.digest;
+        if (digestMatches) {
+          // 无人触碰，机器 wins，走原样
+          result.push(m);
+          continue;
+        }
+        // 人工动过（digest 不存在=老文件/手工文件保守视为人工动过），走三方合并
+        // （保留现有 storeChanged 逻辑）
         const storeChanged = edit.updated_at !== undefined && m.updated_at !== edit.updated_at;
         if (storeChanged) {
           const marker = `\n\n> ⚠️ 并发冲突：人工编辑 vs 记忆库并发更新（${m.updated_at}）\n> 记忆库版本：${m.content}`;
@@ -479,6 +492,12 @@ export function createService({ store, mirror, config, onWrite }) {
     // audit write, never a write-hook-triggering memory mutation).
     saveReceipt: (r) => store.saveReceipt(r),
     getReceipt: (id) => store.getReceipt(id),
-    listReceipts: (opts) => store.listReceipts(opts)
+    listReceipts: (opts) => store.listReceipts(opts),
+    // Conflict freeze bookkeeping (same semantics as the audit passthroughs
+    // above: an audit write, never a write-hook-triggering memory mutation).
+    saveConflictPending: (r) => store.saveConflictPending(r),
+    listConflictPending: (opts) => store.listConflictPending(opts),
+    resolveConflictPending: (id, o) => store.resolveConflictPending(id, o),
+    countConflictPending: () => store.countConflictPending()
   };
 }

package/lib/store.js

@@ -100,6 +100,24 @@ CREATE TABLE IF NOT EXISTS receipt_chain (
 );
 CREATE INDEX IF NOT EXISTS idx_receipt_chain_record ON receipt_chain(record_id);
 CREATE INDEX IF NOT EXISTS idx_receipt_chain_run ON receipt_chain(run_id);
+
+-- conflict_pending: conflicts parked for manual review (conflict freeze mode,
+-- opt-in via config.conflictFreezeEnabled). When enabled, the dream layer does
+-- NOT auto-adjudicate winner/loser — the conflicting pair is parked here until
+-- a human reviews it. resolveConflictPending stamps resolved_at (plus the chosen
+-- winner) so the review action stays auditable. Like the other audit tables this
+-- is bookkeeping: it never triggers write hooks.
+CREATE TABLE IF NOT EXISTS conflict_pending (
+  id              TEXT PRIMARY KEY,
+  run_id          TEXT,
+  memory_a        TEXT NOT NULL,
+  memory_b        TEXT NOT NULL,
+  reason          TEXT,
+  created_at      TEXT NOT NULL,
+  resolved_at     TEXT,
+  resolved_winner TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_conflict_pending_unresolved ON conflict_pending(resolved_at);
 `;
 
 const TYPES = new Set(["preference", "project", "decision", "history", "summary"]);
@@ -183,6 +201,20 @@ function toReceipt(row) {
   };
 }
 
+function toConflictPending(row) {
+  if (!row) return undefined;
+  return {
+    id: row.id,
+    run_id: row.run_id ?? undefined,
+    memory_a: row.memory_a,
+    memory_b: row.memory_b,
+    reason: row.reason ?? undefined,
+    created_at: row.created_at,
+    resolved_at: row.resolved_at ?? undefined,
+    resolved_winner: row.resolved_winner ?? undefined
+  };
+}
+
 function toRecallRun(row) {
   if (!row) return undefined;
   return {
@@ -702,6 +734,66 @@ export function createStore(path) {
     return db.prepare("DELETE FROM failure_memories WHERE created_at < ?").run(before).changes;
   }
 
+  // --- conflict freeze: pending manual review ------------------------------
+
+  /**
+   * Park a detected conflict for human review (conflict freeze mode). The pair
+   * order is normalized (sorted by id) so the same two memories are only ever
+   * pending once — a re-detection in a later dream run is a no-op, never a
+   * duplicate queue entry. Returns the pending row (freshly inserted, or the
+   * existing unresolved row when the pair is already pending).
+   */
+  function saveConflictPending({ run_id, memory_a, memory_b, reason }) {
+    const [a, b] = [memory_a, memory_b].sort();
+    const existing = db.prepare(
+      "SELECT * FROM conflict_pending WHERE memory_a = ? AND memory_b = ? AND resolved_at IS NULL LIMIT 1"
+    ).get(a, b);
+    if (existing) return toConflictPending(existing);
+    const id = randomUUID();
+    const now = nowIso();
+    db.prepare(
+      `INSERT INTO conflict_pending (id, run_id, memory_a, memory_b, reason, created_at)
+       VALUES (?, ?, ?, ?, ?, ?)`
+    ).run(id, run_id ?? null, a, b, reason ?? null, now);
+    return toConflictPending(db.prepare("SELECT * FROM conflict_pending WHERE id = ?").get(id));
+  }
+
+  /**
+   * List pending conflicts, newest first. Unresolved rows only by default;
+   * pass includeResolved to include resolved ones (audit view).
+   */
+  function listConflictPending({ limit = 50, offset = 0, includeResolved = false } = {}) {
+    const { limit: lim, offset: off } = sanitizePage(limit, offset, 50);
+    const clauses = [];
+    const params = [];
+    if (!includeResolved) clauses.push("resolved_at IS NULL");
+    const where = clauses.length ? `WHERE ${clauses.join(" AND ")}` : "";
+    const rows = db.prepare(
+      `SELECT * FROM conflict_pending ${where} ORDER BY created_at DESC, id LIMIT ? OFFSET ?`
+    ).all(...params, lim, off);
+    return rows.map(toConflictPending);
+  }
+
+  /**
+   * Mark a pending conflict as reviewed. winner (optional) records which side
+   * the human chose, keeping the resolution auditable. Returns the updated row,
+   * or undefined for an unknown id.
+   */
+  function resolveConflictPending(id, { winner } = {}) {
+    const row = db.prepare("SELECT * FROM conflict_pending WHERE id = ?").get(id);
+    if (!row) return undefined;
+    db.prepare("UPDATE conflict_pending SET resolved_at = ?, resolved_winner = ? WHERE id = ?")
+      .run(nowIso(), winner ?? null, id);
+    return toConflictPending(db.prepare("SELECT * FROM conflict_pending WHERE id = ?").get(id));
+  }
+
+  /** Number of unresolved (awaiting review) pending conflicts. */
+  function countConflictPending() {
+    return db.prepare(
+      "SELECT count(*) AS c FROM conflict_pending WHERE resolved_at IS NULL"
+    ).get().c;
+  }
+
   function getFailureStats({ since } = {}) {
     const clause = since ? "WHERE created_at >= ?" : "";
     const params = since ? [since] : [];
@@ -744,6 +836,10 @@ export function createStore(path) {
     listFailures,
     getFailureStats,
     deleteOldFailures,
+    saveConflictPending,
+    listConflictPending,
+    resolveConflictPending,
+    countConflictPending,
     close() {
       db.close();
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@modusensus/dsh-mneme",
   "description": "Cross-session memory plugin for DeepSeek Harness with autoDream consolidation: SQLite store, Markdown mirrors, 6 model tools, automatic injection, session summarization, user profile/rules, custom slash commands, vector (semantic) search, and a Web GUI panel",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "license": "MIT",
   "type": "module",
   "main": "lib/index.js",

package/src/config.js

@@ -67,5 +67,12 @@ export const Config = z.object({
   reflectionUpdateEnabled: z.boolean().default(true),
   reflectionFailureTracking: z.boolean().default(true),
   reflectionUpdateMaxPerRun: z.natural().min(0).max(5).default(2),
-  reflectionUpdateMinAgeHours: z.natural().min(0).max(168).default(24)
+  reflectionUpdateMinAgeHours: z.natural().min(0).max(168).default(24),
+
+  // --- conflict freeze: manual review for conflicting memories (v0.2.1) ---
+  // Opt-in by default: when true, conflicting memories are not auto-merged
+  // and are marked as pending manual review instead.
+  conflictFreezeEnabled: z.boolean().default(false),
+  // Maximum number of frozen conflicts to keep pending for manual review.
+  conflictFreezeMaxPending: z.natural().min(1).max(1000).default(100),
 });

package/src/dream.js

@@ -350,6 +350,10 @@ export function createDreamScheduler({ onRun, thresholdCount = 10, thresholdChar
     const route = resolveRoute(ctx, config, logger);
     const runId = randomUUID();
     const snapshotHash = hashSnapshot([...snapshot.values()]);
+    // Conflict freeze (opt-in): when enabled, conflict decisions are parked for
+    // manual review instead of auto-adjudicated. Read once up front so the
+    // prompt hint and the apply-split agree on the same gate.
+    const freezeEnabled = config.conflictFreezeEnabled === true;
     // Every exit (success or failure) funnels through `finish`, which writes
     // the audit row + receipt. A record failure is logged, never thrown —
     // auditing must not break the consolidation path. Failed runs still
@@ -440,6 +444,12 @@ export function createDreamScheduler({ onRun, thresholdCount = 10, thresholdChar
       ).join("\n");
     }
 
+    // Freeze-aware prompt: in freeze mode the conflict branch still outputs
+    // winner/loser (validation requires them) but they are treated as tentative
+    // candidates — the human makes the final call, not the model.
+    const consolidationPrompt = freezeEnabled
+      ? CONSOLIDATION_PROMPT + `\n\n当前为「冲突冻结」模式：检测到内容矛盾的条目时，仍请输出 conflict，并以 winner/loser 作为候选、reason 说明理由；冲突不会被自动裁决，而会冻结待人工确认。`
+      : CONSOLIDATION_PROMPT;
     let decisionText;
     try {
       decisionText = await streamText(ctx, {
@@ -448,7 +458,7 @@ export function createDreamScheduler({ onRun, thresholdCount = 10, thresholdChar
         purpose: "compaction",
         maxTokens: config.dreamMaxTokens ?? 4096,
         messages: [
-          { role: "system", content: [{ type: "text", text: CONSOLIDATION_PROMPT }] },
+          { role: "system", content: [{ type: "text", text: consolidationPrompt }] },
           { role: "user", content: [{ type: "text", text: listText }] }
         ]
       });
@@ -492,10 +502,46 @@ export function createDreamScheduler({ onRun, thresholdCount = 10, thresholdChar
       }
     }
 
+    // Conflict freeze (opt-in): when enabled, conflict decisions are not
+    // auto-adjudicated — no winner kept, no loser archived. The pair is parked
+    // in conflict_pending for human review instead. Best-effort: a store
+    // failure here must never block the run (fail-safe — the memories are left
+    // untouched and nothing is arbitrated). The cap (conflictFreezeMaxPending)
+    // bounds the review queue; overflow is skipped with a warning.
+    let frozenCount = 0;
+    const frozenIds = [];
+    const applyList = freezeEnabled ? decisions.filter((d) => d.action !== "conflict") : decisions;
+    if (freezeEnabled) {
+      const conflictsToFreeze = decisions.filter((d) => d.action === "conflict");
+      if (conflictsToFreeze.length > 0) {
+        try {
+          const maxPending = Number.isInteger(config.conflictFreezeMaxPending) ? config.conflictFreezeMaxPending : 100;
+          const pendingNow = service.countConflictPending();
+          const budget = Math.max(0, maxPending - pendingNow);
+          const toFreeze = conflictsToFreeze.slice(0, budget);
+          if (conflictsToFreeze.length > budget) {
+            logger?.warn?.(`dsh-mneme dream: conflict freeze queue full (${pendingNow}/${maxPending}), skipped ${conflictsToFreeze.length - budget} conflict(s)`);
+          }
+          for (const d of toFreeze) {
+            try {
+              service.saveConflictPending({ run_id: runId, memory_a: d.winner, memory_b: d.loser, reason: d.reason });
+              frozenCount++;
+              frozenIds.push(d.winner, d.loser);
+            } catch (error) {
+              logger?.warn?.(`dsh-mneme dream: failed to freeze conflict ${d.winner}/${d.loser}: ${String(error)}`);
+            }
+          }
+        } catch (error) {
+          logger?.warn?.(`dsh-mneme dream: conflict freeze lookup failed: ${String(error)}`);
+        }
+      }
+    }
+
     // CAS-guarded, per-decision-transactional apply against the run snapshot:
     // a target changed during the LLM call is skipped and reported as a
-    // conflict instead of being overwritten (item ①).
-    const { applied, conflicts, failures, committed } = applyDecisions(decisions, service, logger, snapshot);
+    // conflict instead of being overwritten (item ①). Frozen conflicts are
+    // excluded from this list (they are parked, not applied).
+    const { applied, conflicts, failures, committed } = applyDecisions(applyList, service, logger, snapshot);
     // Per-record receipt chain: one row per actually-committed merge/conflict/
     // update verdict, stamped with the decision-basis digest + idempotency
     // counters (count_before → count_after). Written here, before the run audit
@@ -521,18 +567,25 @@ export function createDreamScheduler({ onRun, thresholdCount = 10, thresholdChar
     // claim "merge-archived" (item ②). Conflicts/failures ride along so the
     // audit row records why the run diverged.
     const outcome = { ...buildOutcome(committed), conflicts, failures };
+    // Frozen conflicts were not adjudicated: mark both sides pending in the
+    // per-id outcome so the audit row shows they were parked, not skipped.
+    if (frozenIds.length) {
+      for (const id of frozenIds) outcome.byId[id] = "conflict-pending";
+    }
     // Decisions validated but not fully committed → reconcile (not ok).
     const partial = conflicts.length > 0 || failures.length > 0;
     // No decision landed (all-keep, or every decision skipped as an idempotent
     // replay) → nothing substantive changed. Distinct from a success: such a
     // run must never be reported as ok, or the audit claims work that never
     // happened and the scheduler refreshes the baseline on a false positive.
-    const noChange = applied === 0 && committed.every((c) => c.action === "keep");
+    // Frozen conflicts are substantive output (parked for review), so a run
+    // that only froze conflicts is not a noop.
+    const noChange = frozenCount === 0 && applied === 0 && committed.every((c) => c.action === "keep");
 
     // Keep the vector index consistent with the post-dream store state.
     if (semantic?.embedder && semantic?.vectorIndex) {
       try {
-        await maintainIndexAfterDream(decisions, service, semantic);
+        await maintainIndexAfterDream(applyList, service, semantic);
       } catch (error) {
         logger?.warn?.(`[dsh-mneme] dream index maintenance failed: ${String(error)}`);
       }
@@ -554,7 +607,7 @@ export function createDreamScheduler({ onRun, thresholdCount = 10, thresholdChar
       });
     } catch (error) {
       logger?.warn?.(`dsh-mneme dream: summary llm call failed: ${String(error)}`);
-      return finish({ ok: false, error: "llm failed", applied, decisions: auditDecisions, outcome, summary: false });
+      return finish({ ok: false, error: "llm failed", applied, decisions: auditDecisions, outcome, frozen: frozenCount, summary: false });
     }
     let summaryStored = false;
     if (summaryText !== undefined && summaryText.trim()) {
@@ -601,6 +654,7 @@ export function createDreamScheduler({ onRun, thresholdCount = 10, thresholdChar
       outcome,
       conflicts,
       failures,
+      frozen: frozenCount,
       summary: summaryStored
     });
   }

package/src/mirror.js

@@ -1,4 +1,5 @@
 import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { join } from "node:path";
 
 export const TYPE_FILE = {
@@ -21,6 +22,13 @@ function unescape(text) {
 }
 
 function renderMemory(m) {
+  // last-rendered digest baseline: sha256(title \x00 content). service.js
+  // compares the file hash against this to tell "untouched by a human" (machine
+  // write wins) apart from a real human edit, so a not-yet-re-rendered store
+  // update is not misread as a concurrent human edit.
+  const digest = createHash("sha256")
+    .update(`${m.title}\x00${m.content}`)
+    .digest("hex");
   const lines = [];
   lines.push(`## ${esc(m.title)}`);
   lines.push("");
@@ -31,6 +39,7 @@ function renderMemory(m) {
   lines.push(`- **更新时间**: ${m.updated_at}`);
   if (m.source) lines.push(`- **来源**: ${esc(m.source)}`);
   lines.push("");
+  lines.push(`<!-- mirror-digest: ${digest} -->`);
   lines.push(m.content);
   lines.push("");
   lines.push("---");
@@ -86,7 +95,8 @@ export function createMirror(dir) {
         let body = text
           .slice(blockStart, blockEnd)
           .replace(/^- \*\*ID\*\*: `[^`]+`\n?/, "")
-          .replace(/^(- \*\*(类型|重要性|标签|更新时间|来源)\*\*:.*\n?)+/, "");
+          .replace(/^(- \*\*(类型|重要性|标签|更新时间|来源)\*\*:.*\n?)+/, "")
+          .replace(/^<!-- mirror-digest: [a-f0-9]+ -->\n?/m, "");
         const separators = [...body.matchAll(/^---\s*$/gm)];
         const lastSep = separators[separators.length - 1];
         if (lastSep) body = body.slice(0, lastSep.index);
@@ -97,11 +107,13 @@ export function createMirror(dir) {
         // during a three-way merge of human edits (see service.syncMirror).
         const block = text.slice(blockStart, blockEnd);
         const updatedMatch = block.match(/- \*\*更新时间\*\*: ([^\n]+)/);
+        const digestMatch = block.match(/<!-- mirror-digest: ([a-f0-9]+) -->/);
         edits.push({
           id: anchor[1],
           title: titleMatch ? unescape(titleMatch[1]).trim() : undefined,
           content: body,
-          updated_at: updatedMatch ? updatedMatch[1].trim() : undefined
+          updated_at: updatedMatch ? updatedMatch[1].trim() : undefined,
+          digest: digestMatch ? digestMatch[1] : undefined
         });
 
         const lineEnd = text.indexOf("\n", blockStart);

package/src/service.js

@@ -1,4 +1,4 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { TYPE_FILE } from "./mirror.js";
 
 const INJECT_TYPES = new Set(["preference", "project", "decision", "summary"]);
@@ -349,8 +349,21 @@ export function createService({ store, mirror, config, onWrite }) {
         const humanChanged = (typeof edit.title === "string" && edit.title !== m.title)
           || (typeof edit.content === "string" && edit.content !== m.content);
         if (!humanChanged) { result.push(m); continue; }
-        // Store changed since the file was last rendered (file records the
-        // store's updated_at at render time) AND the file was hand-edited.
+        // 判断文件是否被人工动过：digest 存在且匹配则无人触碰，否则视为人工动过。
+        // digest 是渲染时对 sha256(title \x00 content) 的记录；机器 store 更新后
+        // 镜像还没重渲染时读到旧内容，digest 仍匹配 → 机器 wins，不会误判为
+        // 并发人工编辑导致机器写丢失 + 伪冲突标记。
+        const digestMatches = typeof edit.digest === "string"
+          && typeof edit.title === "string"
+          && typeof edit.content === "string"
+          && createHash("sha256").update(`${edit.title}\x00${edit.content}`).digest("hex") === edit.digest;
+        if (digestMatches) {
+          // 无人触碰，机器 wins，走原样
+          result.push(m);
+          continue;
+        }
+        // 人工动过（digest 不存在=老文件/手工文件保守视为人工动过），走三方合并
+        // （保留现有 storeChanged 逻辑）
         const storeChanged = edit.updated_at !== undefined && m.updated_at !== edit.updated_at;
         if (storeChanged) {
           const marker = `\n\n> ⚠️ 并发冲突：人工编辑 vs 记忆库并发更新（${m.updated_at}）\n> 记忆库版本：${m.content}`;
@@ -479,6 +492,12 @@ export function createService({ store, mirror, config, onWrite }) {
     // audit write, never a write-hook-triggering memory mutation).
     saveReceipt: (r) => store.saveReceipt(r),
     getReceipt: (id) => store.getReceipt(id),
-    listReceipts: (opts) => store.listReceipts(opts)
+    listReceipts: (opts) => store.listReceipts(opts),
+    // Conflict freeze bookkeeping (same semantics as the audit passthroughs
+    // above: an audit write, never a write-hook-triggering memory mutation).
+    saveConflictPending: (r) => store.saveConflictPending(r),
+    listConflictPending: (opts) => store.listConflictPending(opts),
+    resolveConflictPending: (id, o) => store.resolveConflictPending(id, o),
+    countConflictPending: () => store.countConflictPending()
   };
 }