@modusensus/dsh-mneme 0.2.9 → 0.2.11

package/README.md

@@ -5,7 +5,7 @@
 [![npm version](https://img.shields.io/npm/v/@modusensus/dsh-mneme?color=blue&label=npm)](https://www.npmjs.com/package/@modusensus/dsh-mneme)
 [![license](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 [![Awesome](https://awesome-dsh-plugin.com/badge.svg)](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin)
-[![tests](https://img.shields.io/badge/tests-355%20passed-success)](https://github.com/modusensus/dsh-mneme)
+[![tests](https://img.shields.io/badge/tests-373%20passed-success)](https://github.com/modusensus/dsh-mneme)
 
 > 给 DeepSeek Harness 的跨会话记忆插件：让 Agent 记住你、记住项目、自动整理记忆。**Mneme**（Μνήμη）——希腊记忆女神 Mnemosyne 之名，掌管记忆与梦境，正如 autoDream 在后台巩固记忆。
 
@@ -225,7 +225,7 @@ src/
 lib/
 ├── client.js         # Web 面板（手写 ModuleLoader bundle）
 └── *.js              # src 的同步分发产物
-test/                 # 355 个 node:test 测试（含审计与三轴线压测不变量）
+test/                 # 373 个 node:test 测试（含审计与三轴线压测不变量）
 scripts/              # e2e-dsh.js 端到端演示 · stress-dsh.js 三轴线压测 · sync-lib.js 同步
 ```
 
@@ -234,7 +234,7 @@ scripts/              # e2e-dsh.js 端到端演示 · stress-dsh.js 三轴线压
 ```bash
 cd dsh-mneme
 npm install        # 安装 peer 依赖（以 devDependencies 形式，用于本地测试）
-npm test           # 运行 355 个测试
+npm test           # 运行 373 个测试
 npm run stress     # 三轴线压测：长会话检索 / 冲突仲裁 / 多 Agent 并发（离线 mock LLM）
 npm run sync       # 把 src/ 同步到 lib/（发布时由 prepack 钩子自动执行）
 ```

package/lib/mirror.js

@@ -1,4 +1,5 @@
 import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { join } from "node:path";
 
 export const TYPE_FILE = {
@@ -21,6 +22,13 @@ function unescape(text) {
 }
 
 function renderMemory(m) {
+  // last-rendered digest baseline: sha256(title \x00 content). service.js
+  // compares the file hash against this to tell "untouched by a human" (machine
+  // write wins) apart from a real human edit, so a not-yet-re-rendered store
+  // update is not misread as a concurrent human edit.
+  const digest = createHash("sha256")
+    .update(`${m.title}\x00${m.content}`)
+    .digest("hex");
   const lines = [];
   lines.push(`## ${esc(m.title)}`);
   lines.push("");
@@ -31,6 +39,7 @@ function renderMemory(m) {
   lines.push(`- **更新时间**: ${m.updated_at}`);
   if (m.source) lines.push(`- **来源**: ${esc(m.source)}`);
   lines.push("");
+  lines.push(`<!-- mirror-digest: ${digest} -->`);
   lines.push(m.content);
   lines.push("");
   lines.push("---");
@@ -86,7 +95,8 @@ export function createMirror(dir) {
         let body = text
           .slice(blockStart, blockEnd)
           .replace(/^- \*\*ID\*\*: `[^`]+`\n?/, "")
-          .replace(/^(- \*\*(类型|重要性|标签|更新时间|来源)\*\*:.*\n?)+/, "");
+          .replace(/^(- \*\*(类型|重要性|标签|更新时间|来源)\*\*:.*\n?)+/, "")
+          .replace(/^<!-- mirror-digest: [a-f0-9]+ -->\n?/m, "");
         const separators = [...body.matchAll(/^---\s*$/gm)];
         const lastSep = separators[separators.length - 1];
         if (lastSep) body = body.slice(0, lastSep.index);
@@ -97,11 +107,13 @@ export function createMirror(dir) {
         // during a three-way merge of human edits (see service.syncMirror).
         const block = text.slice(blockStart, blockEnd);
         const updatedMatch = block.match(/- \*\*更新时间\*\*: ([^\n]+)/);
+        const digestMatch = block.match(/<!-- mirror-digest: ([a-f0-9]+) -->/);
         edits.push({
           id: anchor[1],
           title: titleMatch ? unescape(titleMatch[1]).trim() : undefined,
           content: body,
-          updated_at: updatedMatch ? updatedMatch[1].trim() : undefined
+          updated_at: updatedMatch ? updatedMatch[1].trim() : undefined,
+          digest: digestMatch ? digestMatch[1] : undefined
         });
 
         const lineEnd = text.indexOf("\n", blockStart);

package/lib/service.js

@@ -1,4 +1,4 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { TYPE_FILE } from "./mirror.js";
 
 const INJECT_TYPES = new Set(["preference", "project", "decision", "summary"]);
@@ -221,7 +221,11 @@ export function createService({ store, mirror, config, onWrite }) {
       throw error;
     } finally {
       txDepth--;
-      syncMirror();
+      try {
+        syncMirror();
+      } catch (error) {
+        console.warn("syncMirror failed after transaction:", error);
+      }
       notifyWrite();
     }
   }
@@ -293,6 +297,17 @@ export function createService({ store, mirror, config, onWrite }) {
       if (typeof edit.title === "string" && edit.title.trim()) patch.title = edit.title.trim();
       if (typeof edit.content === "string" && edit.content.trim()) patch.content = edit.content.trim();
       if (Object.keys(patch).length) {
+        // 启动回灌（F-NEW-01）：digest 存在且匹配 = 文件自渲染后无人触碰（旧机器
+        // 镜像），机器 wins，DB 的 New 必须保留，静默改回 Old 是 bug。
+        const digestMatches = typeof edit.digest === "string"
+          && typeof edit.title === "string"
+          && typeof edit.content === "string"
+          && createHash("sha256").update(`${edit.title}\x00${edit.content}`).digest("hex") === edit.digest;
+        if (digestMatches) continue;
+        // 文件 == store（无实际变化）时不覆盖，也不计入 applied。
+        const hasDiff = (patch.title !== undefined && existing.title !== patch.title)
+          || (patch.content !== undefined && existing.content !== patch.content);
+        if (!hasDiff) continue;
         store.update(edit.id, patch);
         applied++;
       }
@@ -349,8 +364,21 @@ export function createService({ store, mirror, config, onWrite }) {
         const humanChanged = (typeof edit.title === "string" && edit.title !== m.title)
           || (typeof edit.content === "string" && edit.content !== m.content);
         if (!humanChanged) { result.push(m); continue; }
-        // Store changed since the file was last rendered (file records the
-        // store's updated_at at render time) AND the file was hand-edited.
+        // 判断文件是否被人工动过：digest 存在且匹配则无人触碰，否则视为人工动过。
+        // digest 是渲染时对 sha256(title \x00 content) 的记录；机器 store 更新后
+        // 镜像还没重渲染时读到旧内容，digest 仍匹配 → 机器 wins，不会误判为
+        // 并发人工编辑导致机器写丢失 + 伪冲突标记。
+        const digestMatches = typeof edit.digest === "string"
+          && typeof edit.title === "string"
+          && typeof edit.content === "string"
+          && createHash("sha256").update(`${edit.title}\x00${edit.content}`).digest("hex") === edit.digest;
+        if (digestMatches) {
+          // 无人触碰，机器 wins，走原样
+          result.push(m);
+          continue;
+        }
+        // 人工动过（digest 不存在=老文件/手工文件保守视为人工动过），走三方合并
+        // （保留现有 storeChanged 逻辑）
         const storeChanged = edit.updated_at !== undefined && m.updated_at !== edit.updated_at;
         if (storeChanged) {
           const marker = `\n\n> ⚠️ 并发冲突：人工编辑 vs 记忆库并发更新（${m.updated_at}）\n> 记忆库版本：${m.content}`;
@@ -374,7 +402,11 @@ export function createService({ store, mirror, config, onWrite }) {
    */
   function syncMirror() {
     if (txDepth > 0 || !mirror) return; // deferred to the transaction's commit
-    mirror.sync(reconcileHumanEdits(store.list({ limit: 500, includeForgotten: false })));
+    try {
+      mirror.sync(reconcileHumanEdits(store.list({ limit: 500, includeForgotten: false })));
+    } catch (error) {
+      console.warn("syncMirror failed:", error);
+    }
   }
 
   return {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@modusensus/dsh-mneme",
   "description": "Cross-session memory plugin for DeepSeek Harness with autoDream consolidation: SQLite store, Markdown mirrors, 6 model tools, automatic injection, session summarization, user profile/rules, custom slash commands, vector (semantic) search, and a Web GUI panel",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "license": "MIT",
   "type": "module",
   "main": "lib/index.js",

package/src/mirror.js

@@ -1,4 +1,5 @@
 import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { join } from "node:path";
 
 export const TYPE_FILE = {
@@ -21,6 +22,13 @@ function unescape(text) {
 }
 
 function renderMemory(m) {
+  // last-rendered digest baseline: sha256(title \x00 content). service.js
+  // compares the file hash against this to tell "untouched by a human" (machine
+  // write wins) apart from a real human edit, so a not-yet-re-rendered store
+  // update is not misread as a concurrent human edit.
+  const digest = createHash("sha256")
+    .update(`${m.title}\x00${m.content}`)
+    .digest("hex");
   const lines = [];
   lines.push(`## ${esc(m.title)}`);
   lines.push("");
@@ -31,6 +39,7 @@ function renderMemory(m) {
   lines.push(`- **更新时间**: ${m.updated_at}`);
   if (m.source) lines.push(`- **来源**: ${esc(m.source)}`);
   lines.push("");
+  lines.push(`<!-- mirror-digest: ${digest} -->`);
   lines.push(m.content);
   lines.push("");
   lines.push("---");
@@ -86,7 +95,8 @@ export function createMirror(dir) {
         let body = text
           .slice(blockStart, blockEnd)
           .replace(/^- \*\*ID\*\*: `[^`]+`\n?/, "")
-          .replace(/^(- \*\*(类型|重要性|标签|更新时间|来源)\*\*:.*\n?)+/, "");
+          .replace(/^(- \*\*(类型|重要性|标签|更新时间|来源)\*\*:.*\n?)+/, "")
+          .replace(/^<!-- mirror-digest: [a-f0-9]+ -->\n?/m, "");
         const separators = [...body.matchAll(/^---\s*$/gm)];
         const lastSep = separators[separators.length - 1];
         if (lastSep) body = body.slice(0, lastSep.index);
@@ -97,11 +107,13 @@ export function createMirror(dir) {
         // during a three-way merge of human edits (see service.syncMirror).
         const block = text.slice(blockStart, blockEnd);
         const updatedMatch = block.match(/- \*\*更新时间\*\*: ([^\n]+)/);
+        const digestMatch = block.match(/<!-- mirror-digest: ([a-f0-9]+) -->/);
         edits.push({
           id: anchor[1],
           title: titleMatch ? unescape(titleMatch[1]).trim() : undefined,
           content: body,
-          updated_at: updatedMatch ? updatedMatch[1].trim() : undefined
+          updated_at: updatedMatch ? updatedMatch[1].trim() : undefined,
+          digest: digestMatch ? digestMatch[1] : undefined
         });
 
         const lineEnd = text.indexOf("\n", blockStart);

package/src/service.js

@@ -1,4 +1,4 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { TYPE_FILE } from "./mirror.js";
 
 const INJECT_TYPES = new Set(["preference", "project", "decision", "summary"]);
@@ -221,7 +221,11 @@ export function createService({ store, mirror, config, onWrite }) {
       throw error;
     } finally {
       txDepth--;
-      syncMirror();
+      try {
+        syncMirror();
+      } catch (error) {
+        console.warn("syncMirror failed after transaction:", error);
+      }
       notifyWrite();
     }
   }
@@ -293,6 +297,17 @@ export function createService({ store, mirror, config, onWrite }) {
       if (typeof edit.title === "string" && edit.title.trim()) patch.title = edit.title.trim();
       if (typeof edit.content === "string" && edit.content.trim()) patch.content = edit.content.trim();
       if (Object.keys(patch).length) {
+        // 启动回灌（F-NEW-01）：digest 存在且匹配 = 文件自渲染后无人触碰（旧机器
+        // 镜像），机器 wins，DB 的 New 必须保留，静默改回 Old 是 bug。
+        const digestMatches = typeof edit.digest === "string"
+          && typeof edit.title === "string"
+          && typeof edit.content === "string"
+          && createHash("sha256").update(`${edit.title}\x00${edit.content}`).digest("hex") === edit.digest;
+        if (digestMatches) continue;
+        // 文件 == store（无实际变化）时不覆盖，也不计入 applied。
+        const hasDiff = (patch.title !== undefined && existing.title !== patch.title)
+          || (patch.content !== undefined && existing.content !== patch.content);
+        if (!hasDiff) continue;
         store.update(edit.id, patch);
         applied++;
       }
@@ -349,8 +364,21 @@ export function createService({ store, mirror, config, onWrite }) {
         const humanChanged = (typeof edit.title === "string" && edit.title !== m.title)
           || (typeof edit.content === "string" && edit.content !== m.content);
         if (!humanChanged) { result.push(m); continue; }
-        // Store changed since the file was last rendered (file records the
-        // store's updated_at at render time) AND the file was hand-edited.
+        // 判断文件是否被人工动过：digest 存在且匹配则无人触碰，否则视为人工动过。
+        // digest 是渲染时对 sha256(title \x00 content) 的记录；机器 store 更新后
+        // 镜像还没重渲染时读到旧内容，digest 仍匹配 → 机器 wins，不会误判为
+        // 并发人工编辑导致机器写丢失 + 伪冲突标记。
+        const digestMatches = typeof edit.digest === "string"
+          && typeof edit.title === "string"
+          && typeof edit.content === "string"
+          && createHash("sha256").update(`${edit.title}\x00${edit.content}`).digest("hex") === edit.digest;
+        if (digestMatches) {
+          // 无人触碰，机器 wins，走原样
+          result.push(m);
+          continue;
+        }
+        // 人工动过（digest 不存在=老文件/手工文件保守视为人工动过），走三方合并
+        // （保留现有 storeChanged 逻辑）
         const storeChanged = edit.updated_at !== undefined && m.updated_at !== edit.updated_at;
         if (storeChanged) {
           const marker = `\n\n> ⚠️ 并发冲突：人工编辑 vs 记忆库并发更新（${m.updated_at}）\n> 记忆库版本：${m.content}`;
@@ -374,7 +402,11 @@ export function createService({ store, mirror, config, onWrite }) {
    */
   function syncMirror() {
     if (txDepth > 0 || !mirror) return; // deferred to the transaction's commit
-    mirror.sync(reconcileHumanEdits(store.list({ limit: 500, includeForgotten: false })));
+    try {
+      mirror.sync(reconcileHumanEdits(store.list({ limit: 500, includeForgotten: false })));
+    } catch (error) {
+      console.warn("syncMirror failed:", error);
+    }
   }
 
   return {

package/test/fnew-0112.test.js

@@ -0,0 +1,316 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createHash } from "node:crypto";
+import { createStore } from "../src/store.js";
+import { createMirror, TYPE_FILE } from "../src/mirror.js";
+import { createService } from "../src/service.js";
+import { applyDecisions } from "../src/dream.js";
+
+/**
+ * F-NEW-01 / F-NEW-02 回归测试（audit peer 新阻断项）。
+ *
+ * F-NEW-01 启动回灌静默改回：mergeHumanEdits 必须按 last-rendered digest 判定
+ *   "无人触碰的旧机器镜像"（digest 匹配 → 机器 wins，保留 DB 的 New）与
+ *   "人工动过的镜像"（digest 缺失/不匹配 → 覆盖）。
+ * F-NEW-02 transaction mirror 失败误报未提交：COMMIT 后 syncMirror 抛错不得
+ *   外抛、不得把已提交事务当失败（applied/committed 必须如实反映真实提交）。
+ *
+ * 测试点由 Kimi K2.7 设计。
+ */
+
+const CONFLICT_MARKER = "并发冲突";
+
+function digestOf(title, content) {
+  return createHash("sha256").update(`${title}\x00${content}`).digest("hex");
+}
+
+function mirrorPath(dir, type) {
+  return join(dir, TYPE_FILE[type]);
+}
+
+function setup({ dbPath } = {}) {
+  const dir = mkdtempSync(join(tmpdir(), "dsh-mneme-fnew-"));
+  const mirrorDir = join(dir, "mirror");
+  const store = createStore(dbPath ?? ":memory:");
+  const mirror = createMirror(mirrorDir);
+  const service = createService({ store, mirror, config: {} });
+  return { dir, mirrorDir, store, mirror, service };
+}
+
+function stripDigestComment(text) {
+  return text.replace(/<!--\s*mirror-digest: [a-f0-9]+ -->\n?/g, "");
+}
+
+/**
+ * 构造"DB 已提交 New + 镜像仍为旧渲染"的真实状态：先用 service 保存 Old
+ * （渲染出带有效 digest 的旧镜像），再绕过 service 直接写 store 为 New，
+ * 模拟镜像同步失败后 DB 与镜像分叉。
+ */
+function seedStaleMirror(service, store, { type, title, old, next }) {
+  const { memory } = service.saveWithDedupe({ type, title, content: old, importance: 3 });
+  store.update(memory.id, { content: next });
+  assert.equal(store.getById(memory.id).content, next, "前置：DB 必须为 New");
+  return memory;
+}
+
+// ── F-NEW-01：启动回灌 digest 判定 ──────────────────────────────────────────
+
+test("F-NEW-01 a: 旧镜像带有效 digest → 回灌跳过覆盖，store 保持 New、applied=0", () => {
+  const { dir, mirrorDir, store, mirror, service } = setup();
+  try {
+    const m = seedStaleMirror(service, store, { type: "project", title: "启动回灌", old: "Old", next: "New" });
+    const edits = mirror.readHumanEdits("project");
+    assert.ok(edits.length >= 1, "镜像必须可读回编辑");
+    assert.equal(edits.find((e) => e.id === m.id)?.digest, digestOf("启动回灌", "Old"), "digest 必须随旧渲染写入");
+    const applied = service.mergeHumanEdits("project", edits);
+    assert.equal(applied, 0, "digest 匹配 = 无人触碰 → 不得覆盖");
+    assert.equal(store.getById(m.id).content, "New", "DB 的 New 必须保留");
+    assert.ok(!store.getById(m.id).content.includes(CONFLICT_MARKER), "不得出现冲突标记");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("F-NEW-01 b: 老文件无 digest → 保守覆盖成 Old（行为保留）", () => {
+  const { dir, mirrorDir, store, mirror, service } = setup();
+  try {
+    const m = seedStaleMirror(service, store, { type: "preference", title: "老文件", old: "Old", next: "New" });
+    const file = mirrorPath(mirrorDir, "preference");
+    writeFileSync(file, stripDigestComment(readFileSync(file, "utf8")), "utf8");
+    const edits = mirror.readHumanEdits("preference");
+    const edit = edits.find((e) => e.id === m.id);
+    assert.equal(edit.digest, undefined, "无 digest 字段");
+    const applied = service.mergeHumanEdits("preference", edits);
+    assert.equal(applied, 1, "digest 缺失 = 视为人工动过 → 覆盖");
+    assert.equal(store.getById(m.id).content, "Old", "store 被覆盖为旧值");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("F-NEW-01 c: 镜像被人工改（digest 不匹配）→ 覆盖成人工值", () => {
+  const { dir, mirrorDir, store, mirror, service } = setup();
+  try {
+    const m = seedStaleMirror(service, store, { type: "decision", title: "人工改", old: "机器旧", next: "机器新" });
+    const file = mirrorPath(mirrorDir, "decision");
+    // 人工改内容但保留 digest 注释行（此时 digest 已不匹配）
+    writeFileSync(file, readFileSync(file, "utf8").replace("机器旧", "人类编辑值"), "utf8");
+    const edits = mirror.readHumanEdits("decision");
+    const edit = edits.find((e) => e.id === m.id);
+    assert.equal(edit.content, "人类编辑值");
+    assert.notEqual(edit.digest, digestOf("人工改", "人类编辑值"), "digest 必须不匹配");
+    const applied = service.mergeHumanEdits("decision", edits);
+    assert.equal(applied, 1, "digest 不匹配 = 人工动过 → 覆盖");
+    assert.equal(store.getById(m.id).content, "人类编辑值", "人工值必须落地");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("F-NEW-01 d: 端到端启动回灌（index.js 同款读-merge 循环）→ DB New 保留且重开持久", () => {
+  const dir = mkdtempSync(join(tmpdir(), "dsh-mneme-fnew-"));
+  const dbPath = join(dir, "memory.db");
+  const mirrorDir = join(dir, "mirror");
+  try {
+    // 首次"启动"：保存 Old → DB 直写 New（镜像分叉）
+    let { store, mirror, service } = setup({ dbPath });
+    const m = seedStaleMirror(service, store, { type: "summary", title: "总览", old: "Old", next: "New" });
+    store.close();
+
+    // 第二次"启动"：完整走 index.js 的回灌循环（先读全部类型再逐类 merge）
+    store = createStore(dbPath);
+    mirror = createMirror(mirrorDir);
+    service = createService({ store, mirror, config: {} });
+    for (const type of Object.keys(TYPE_FILE)) {
+      const edits = mirror.readHumanEdits(type);
+      if (edits.length) service.mergeHumanEdits(type, edits);
+    }
+    assert.equal(store.getById(m.id).content, "New", "重启回灌不得把 DB 静默改回 Old");
+    store.close();
+
+    // 第三次打开：确认持久化且不会再被翻转
+    store = createStore(dbPath);
+    assert.equal(store.getById(m.id).content, "New", "重开后 DB 仍为 New");
+    store.close();
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("F-NEW-01: hasDiff 守卫——补丁与 store 相同则不覆盖、不计数、updated_at 不变", () => {
+  const { dir, mirrorDir, store, mirror, service } = setup();
+  try {
+    const m = seedStaleMirror(service, store, { type: "project", title: "无差异", old: "Old", next: "New" });
+    const file = mirrorPath(mirrorDir, "project");
+    // 文件内容 == store（New），但 digest 注释是旧渲染的 → 判定走覆盖分支，
+    // hasDiff 必须拦住无实际变化的 UPDATE。
+    writeFileSync(file, readFileSync(file, "utf8").replace("Old", "New"), "utf8");
+    const edits = mirror.readHumanEdits("project");
+    assert.equal(edits.find((e) => e.id === m.id).content, "New");
+    const before = store.getById(m.id).updated_at;
+    const applied = service.mergeHumanEdits("project", edits);
+    assert.equal(applied, 0, "无实际差异不得计入 applied");
+    assert.equal(store.getById(m.id).content, "New");
+    assert.equal(store.getById(m.id).updated_at, before, "不得发出无意义的 UPDATE");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("F-NEW-01: 混合编辑逐条独立判定（有效 digest 跳过 / 缺 digest 覆盖 / 不匹配覆盖）", () => {
+  const { dir, mirrorDir, store, mirror, service } = setup();
+  try {
+    const a = seedStaleMirror(service, store, { type: "project", title: "A", old: "A-旧", next: "A-新" });
+    const b = service.saveWithDedupe({ type: "project", title: "B", content: "B-旧", importance: 3 }).memory;
+    const c = service.saveWithDedupe({ type: "project", title: "C", content: "C-旧", importance: 3 }).memory;
+    store.update(b.id, { content: "B-新" });
+    store.update(c.id, { content: "C-新" });
+    // 手工构造编辑数组：a 有效 digest（跳过）；b 无 digest（覆盖）；c digest 不匹配（覆盖）
+    const edits = [
+      { id: a.id, title: "A", content: "A-旧", digest: digestOf("A", "A-旧") },
+      { id: b.id, title: "B", content: "B-旧" },
+      { id: c.id, title: "C", content: "C-人类", digest: digestOf("C", "C-旧") }
+    ];
+    const applied = service.mergeHumanEdits("project", edits);
+    assert.equal(applied, 2, "只有 b、c 被覆盖");
+    assert.equal(store.getById(a.id).content, "A-新", "a 保持 New");
+    assert.equal(store.getById(b.id).content, "B-旧", "b 无 digest → 覆盖成旧值");
+    assert.equal(store.getById(c.id).content, "C-人类", "c 人工值落地");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// ── F-NEW-02：transaction 已提交 + mirror 失败不得误报 ─────────────────────
+
+function throwingMirrorSync(mirror, message = "No space left on device") {
+  const original = mirror.sync.bind(mirror);
+  const err = new Error(message);
+  err.code = "ENOSPC";
+  mirror.sync = () => { throw err; };
+  return { original, err };
+}
+
+test("F-NEW-02 e: COMMIT 后 mirror.sync 抛 ENOSPC → transaction 正常返回、不抛、DB 已提交且重开持久", () => {
+  const dir = mkdtempSync(join(tmpdir(), "dsh-mneme-fnew-"));
+  const dbPath = join(dir, "memory.db");
+  const mirrorDir = join(dir, "mirror");
+  try {
+    const store = createStore(dbPath);
+    const mirror = createMirror(mirrorDir);
+    const service = createService({ store, mirror, config: {} });
+    const { original } = throwingMirrorSync(mirror);
+
+    let warns = 0;
+    let committedId;
+    const origWarn = console.warn;
+    console.warn = (...a) => { warns++; origWarn(...a); };
+    try {
+      let result;
+      assert.doesNotThrow(() => {
+        result = service.transaction(() => {
+          const { memory } = service.saveWithDedupe({ type: "project", title: "原子", content: "已提交", importance: 3 });
+          committedId = memory.id;
+          return "tx-result";
+        });
+      }, "syncMirror 失败不得向外抛（已 COMMIT 不得被当成未提交）");
+      assert.equal(result, "tx-result", "transaction 必须返回 fn 的结果");
+    } finally {
+      console.warn = origWarn;
+    }
+    assert.ok(warns >= 1, "fail-safe 应走 console.warn 路径");
+    assert.equal(store.count(), 1, "DB 必须已提交");
+    assert.equal(service.getById(committedId).content, "已提交");
+
+    // 恢复 mirror.sync，下一次写应能重新渲染，镜像最终与 store 一致
+    mirror.sync = original;
+    service.saveWithDedupe({ type: "project", title: "后续", content: "x", importance: 2 });
+    const file = readFileSync(mirrorPath(mirrorDir, "project"), "utf8");
+    assert.match(file, /已提交/, "失败后的下一次同步必须收敛镜像");
+
+    // 重开验证持久化
+    store.close();
+    const reopened = createStore(dbPath);
+    assert.equal(reopened.count(), 2, "重开后已提交数据仍在");
+    assert.equal(reopened.getById(committedId).content, "已提交");
+    reopened.close();
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("F-NEW-02 f: mirror.sync 抛错时 applyDecisions 的 applied/committed/failures 如实（不虚报 0）", () => {
+  const { dir, mirrorDir, store, mirror, service } = setup();
+  try {
+    const { memory: m } = service.saveWithDedupe({ type: "project", title: "归档目标", content: "x", importance: 3 });
+    const { original } = throwingMirrorSync(mirror);
+    try {
+      // 修复前：transaction finally 的 mirror 异常会向上抛 → 被 applyDecisions
+      // 当成 failure → applied:0、committed:[]，receipt/outcome 虚报 reconcile。
+      const { applied, conflicts, failures, committed } = applyDecisions(
+        [{ action: "archive", ids: [m.id] }],
+        service,
+        null,
+        null
+      );
+      assert.equal(applied, 1, "真实提交数为 1，不是 0");
+      assert.equal(failures.length, 0, "已提交的决策不得被误判为失败");
+      assert.equal(conflicts.length, 0);
+      assert.equal(committed.length, 1, "committed 必须来自真实提交子步骤");
+      assert.equal(committed[0].action, "archive");
+      assert.equal(store.getById(m.id).archived, true, "DB 必须真实归档");
+    } finally {
+      mirror.sync = original;
+    }
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("F-NEW-02 g: 回滚路径——fn 抛错 → ROLLBACK + 原错误传播（mirror 失败不得掩盖）", () => {
+  const { dir, mirrorDir, store, mirror, service } = setup();
+  try {
+    const { original } = throwingMirrorSync(mirror);
+    let threw = null;
+    try {
+      service.transaction(() => {
+        service.saveWithDedupe({ type: "project", title: "应回滚", content: "x", importance: 3 });
+        throw new Error("boom");
+      });
+    } catch (error) {
+      threw = error;
+    } finally {
+      mirror.sync = original;
+    }
+    assert.ok(threw, "必须抛错");
+    assert.equal(threw.message, "boom", "必须传播原始错误，而非 mirror 的 ENOSPC");
+    assert.equal(store.count(), 0, "回滚后无残留写入");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("F-NEW-02: mirror 自身 fail-safe——底层 sync 抛错被吞并 console.warn，不向上抛", () => {
+  const dir = mkdtempSync(join(tmpdir(), "dsh-mneme-fnew-"));
+  const dbPath = join(dir, "memory.db");
+  const mirrorDir = join(dir, "mirror");
+  try {
+    const store = createStore(dbPath);
+    const mirror = createMirror(mirrorDir);
+    const service = createService({ store, mirror, config: {} });
+    const { original } = throwingMirrorSync(mirror, "EACCES");
+    try {
+      assert.doesNotThrow(() => service.saveWithDedupe({ type: "history", title: "非事务路径", content: "x", importance: 3 }),
+        "事务外的写路径（saveWithDedupe→syncMirror）也必须 fail-safe");
+      assert.equal(store.count(), 1, "store 写入不受 mirror 失败影响");
+    } finally {
+      mirror.sync = original;
+    }
+    store.close();
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});

package/test/mirror-edit-digest.test.js

@@ -0,0 +1,185 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createHash } from "node:crypto";
+import { createStore } from "../src/store.js";
+import { createMirror } from "../src/mirror.js";
+import { createService } from "../src/service.js";
+import { applyDecisions } from "../src/dream.js";
+
+const CONFLICT_MARKER = "并发冲突";
+
+/**
+ * Regression tests for the mirror-digest fix: a machine store write that has
+ * not yet been re-rendered to the mirror must NOT be misread as a concurrent
+ * human edit (which lost the machine write and planted a fake conflict marker).
+ * Each machine-write path runs against a stale mirror file (the pre-transaction
+ * render), exactly like the audited reproductions.
+ */
+function setup() {
+  const dir = mkdtempSync(join(tmpdir(), "dsh-mneme-digest-"));
+  const store = createStore(":memory:");
+  const mirror = createMirror(dir);
+  const service = createService({ store, mirror, config: {} });
+  return { dir, store, mirror, service };
+}
+
+function mirrorFile(dir, type) {
+  return join(dir, { preference: "preferences.md", project: "projects.md", decision: "decisions.md", history: "history.md" }[type]);
+}
+
+function digestOf(title, content) {
+  return createHash("sha256").update(`${title}\x00${content}`).digest("hex");
+}
+
+test("digest 匹配：直接 update 后机器写落地、无伪冲突 marker", () => {
+  const { dir, store, service } = setup();
+  try {
+    const { memory: m } = service.saveWithDedupe({ type: "project", title: "直接更新", content: "v1", importance: 3 });
+    service.update(m.id, { content: "v2" });
+    // 镜像此时还是 v1 的旧渲染；digest 仍匹配 → 机器 wins
+    assert.equal(store.getById(m.id).content, "v2", "机器新值必须落地");
+    assert.ok(!store.getById(m.id).content.includes(CONFLICT_MARKER), "不得出现伪冲突 marker");
+    const file = readFileSync(mirrorFile(dir, "project"), "utf8");
+    assert.match(file, /v2/, "镜像已重渲染为新值");
+    assert.ok(!file.includes(CONFLICT_MARKER), "镜像不得包含伪冲突 marker");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("digest 匹配：事务内 update 后机器写落地、无伪冲突 marker", () => {
+  const { dir, store, service } = setup();
+  try {
+    const { memory: m } = service.saveWithDedupe({ type: "project", title: "事务更新", content: "tx v1", importance: 3 });
+    service.transaction(() => {
+      service.update(m.id, { content: "tx v2" });
+    });
+    assert.equal(store.getById(m.id).content, "tx v2", "事务内机器新值必须落地");
+    assert.ok(!store.getById(m.id).content.includes(CONFLICT_MARKER), "不得出现伪冲突 marker");
+    const file = readFileSync(mirrorFile(dir, "project"), "utf8");
+    assert.match(file, /tx v2/, "镜像已重渲染为新值");
+    assert.ok(!file.includes(CONFLICT_MARKER), "镜像不得包含伪冲突 marker");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("digest 匹配：saveWithDedupe 同标题 merge 后新值落地、无伪冲突 marker", () => {
+  const { dir, store, service } = setup();
+  try {
+    service.saveWithDedupe({ type: "preference", title: "语言", content: "旧内容", importance: 3 });
+    const result = service.saveWithDedupe({ type: "preference", title: "语言", content: "新内容", importance: 5 });
+    assert.equal(result.action, "merged");
+    assert.equal(store.count(), 1, "同标题合并不新增条目");
+    const m = service.getById(result.memory.id);
+    assert.equal(m.content, "新内容", "合并后新值必须落地");
+    assert.ok(!m.content.includes(CONFLICT_MARKER), "不得出现伪冲突 marker");
+    const file = readFileSync(mirrorFile(dir, "preference"), "utf8");
+    assert.match(file, /新内容/, "镜像已重渲染为新值");
+    assert.ok(!file.includes(CONFLICT_MARKER), "镜像不得包含伪冲突 marker");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("digest 匹配：Dream merge 后 keeper 是新值、无伪冲突、source 归档", () => {
+  const { dir, store, service } = setup();
+  try {
+    const a = service.saveWithDedupe({ type: "project", title: "DreamKeeper", content: "keep old", importance: 3 });
+    const b = service.saveWithDedupe({ type: "project", title: "DreamSource", content: "src old", importance: 3 });
+    // 真实 applyDecisions 路径：keeper 更新 + source 归档在同一事务里，
+    // 提交时 syncMirror 读到的是事务前渲染的旧镜像 → 修复前会误判为人工编辑。
+    const { applied, failures } = applyDecisions(
+      [{ action: "merge", ids: [a.memory.id, b.memory.id], keepSource: a.memory.id, title: "DreamKeeper", content: "keeper new", importance: 5 }],
+      service,
+      null,
+      null
+    );
+    assert.equal(applied, 1);
+    assert.equal(failures.length, 0);
+    const keeper = store.getById(a.memory.id);
+    assert.equal(keeper.content, "keeper new", "keeper 必须是合并后的新值");
+    assert.equal(keeper.title, "DreamKeeper");
+    assert.ok(!keeper.content.includes(CONFLICT_MARKER), "keeper 不得出现伪冲突 marker");
+    assert.equal(store.getById(b.memory.id).archived, true, "source 必须归档");
+    const file = readFileSync(mirrorFile(dir, "project"), "utf8");
+    assert.match(file, /keeper new/, "镜像已重渲染为新值");
+    assert.ok(!file.includes(CONFLICT_MARKER), "镜像不得包含伪冲突 marker");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("真实人工编辑控制组：只改文件 → 人工 wins、无 marker（store 未变）", () => {
+  const { dir, store, service } = setup();
+  try {
+    service.saveWithDedupe({ type: "preference", title: "语言", content: "机器内容", importance: 3 });
+    // 人工改文件内容，但保留 digest 注释行（digest 已不匹配）
+    const file = mirrorFile(dir, "preference");
+    writeFileSync(file, readFileSync(file, "utf8").replace("机器内容", "人类编辑内容"), "utf8");
+    // 下一次无关 store 写触发 syncMirror → 必须合并人工编辑回 store
+    service.saveWithDedupe({ type: "project", title: "无关", content: "x", importance: 3 });
+    const m = service.list({ type: "preference", includeArchived: true }).find((p) => p.title === "语言");
+    assert.equal(m.content, "人类编辑内容", "人工编辑必须合并回 store");
+    assert.ok(!m.content.includes(CONFLICT_MARKER), "store 未变时不得出现冲突 marker");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("真实人工编辑控制组：文件与 store 同时变更 → 三方合并保留双方 + marker", () => {
+  const { dir, store, service } = setup();
+  try {
+    const { memory: m } = service.saveWithDedupe({ type: "preference", title: "语言", content: "机器内容", importance: 3 });
+    // 人工改文件（digest 行保留但内容已变）
+    const file = mirrorFile(dir, "preference");
+    writeFileSync(file, readFileSync(file, "utf8").replace("机器内容", "人类编辑内容"), "utf8");
+    // 机器并发改 store → 下一次 sync 必须三方合并，保留双方 + marker
+    service.update(m.id, { content: "并发机器版本" });
+    const updated = service.getById(m.id);
+    assert.ok(updated.content.includes("人类编辑内容"), "人工版本必须保留为头部");
+    assert.ok(updated.content.includes("并发机器版本"), "store 并发版本必须保留");
+    assert.ok(updated.content.includes(CONFLICT_MARKER), "必须出现真正的冲突 marker");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("老文件无 digest → 保守走三方合并（保留双方 + marker）", () => {
+  const { dir, store, service } = setup();
+  try {
+    const { memory: m } = service.saveWithDedupe({ type: "history", title: "旧", content: "旧内容", importance: 3 });
+    // 模拟修复前渲染的老文件：去掉 digest 注释行，但内容仍是旧内容
+    const file = mirrorFile(dir, "history");
+    const rendered = readFileSync(file, "utf8");
+    writeFileSync(file, rendered.replace(/<!--\s*mirror-digest: [a-f0-9]+ -->\n?/g, ""), "utf8");
+    // 机器更新 → 无 digest 必须保守视为人工动过 → 三方合并
+    service.update(m.id, { content: "新机器内容" });
+    const updated = service.getById(m.id);
+    assert.ok(updated.content.includes("旧内容"), "老文件内容必须被保留");
+    assert.ok(updated.content.includes("新机器内容"), "机器新版本必须被保留");
+    assert.ok(updated.content.includes(CONFLICT_MARKER), "必须出现冲突 marker");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("digest 从 body 剥除：读回的 content 不含 digest 注释，digest 字段正确", () => {
+  const { dir, mirror, service } = setup();
+  try {
+    const { memory: m } = service.saveWithDedupe({ type: "decision", title: "剥离", content: "line1\nline2", importance: 3 });
+    const edits = mirror.readHumanEdits("decision");
+    const edit = edits.find((e) => e.id === m.id);
+    assert.ok(edit, "读到该条目");
+    assert.equal(edit.title, "剥离");
+    assert.equal(edit.content, "line1\nline2", "正文必须不含结构字段");
+    assert.ok(!edit.content.includes("mirror-digest"), "content 不得包含 digest 注释");
+    assert.ok(!edit.content.includes("<!--"), "content 不得包含任何 HTML 注释");
+    assert.equal(edit.digest, digestOf("剥离", "line1\nline2"), "digest 字段暴露给 reconcile 使用");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});