@modusensus/dsh-mneme 0.3.6 → 0.3.8

package/src/api.js

@@ -289,6 +289,14 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
         sendJson(res, 200, { mirror: { dirty: null, status: "unknown", last_error: null, last_attempt: null, success_at: null } });
         return;
       }
+      // Real read failure surfaces as dirty === null (peer blocker 5): report
+      // unknown explicitly instead of collapsing into a false "ok"/"degraded".
+      if (state.dirty === null) {
+        sendJson(res, 200, {
+          mirror: { dirty: null, status: "unknown", last_error: null, last_attempt: null, success_at: null }
+        });
+        return;
+      }
       // Sanitized: boolean dirty + coarse status only; error string is mapped to
       // a bounded code, never echoed verbatim.
       let code = null;

package/src/index.js

@@ -80,11 +80,28 @@ export const apply = (ctx, config) => {
   const vectorIndex = createVectorIndex({ store, logger: ctx.logger });
   service.setVectorIndex(vectorIndex);
 
+  // Human edits in mirror files win on every sync; merge them back first.
+  // TYPE_FILE maps each memory type to its mirror filename. Read every type's
+  // edits up front: mergeHumanEdits re-renders ALL mirror files on success, so
+  // a per-type read-then-merge loop would overwrite edits in files not yet read
+  // (e.g. preferences.md merging would clobber unsynced projects.md edits).
+  const humanEdits = new Map();
+  for (const type of Object.keys(TYPE_FILE)) {
+    humanEdits.set(type, mirror.readHumanEdits(type));
+  }
+  const applyHumanEdits = () => {
+    for (const [type, edits] of humanEdits) {
+      if (edits.length) service.mergeHumanEdits(type, edits);
+    }
+  };
+
   let embedder = null;
   let reranker = null;
   if (cfg.embedProvider === "openai") {
     embedder = createEmbedder({ store, settings, logger: ctx.logger });
     service.setEmbedder(embedder);
+    // legacy OpenAI embedder is immediately usable
+    applyHumanEdits();
   } else {
     try {
       embedder = createEmbedderByProvider(cfg.embedProvider, {
@@ -97,12 +114,18 @@ export const apply = (ctx, config) => {
         logger: ctx.logger
       });
       service.setEmbedder(embedder);
-      embedder.init().catch((error) => {
-        ctx.logger?.warn?.(`[dsh-mneme] embedder init failed, search degrades to keyword: ${String(error)}`);
-        service.setEmbedder(null);
-      });
+      // issue #6: wait for extractor init before applying human edits, so
+      // scheduled embeddings see a ready embedder.
+      embedder.init()
+        .then(() => applyHumanEdits())
+        .catch((error) => {
+          ctx.logger?.warn?.(`[dsh-mneme] embedder init failed, search degrades to keyword: ${String(error)}`);
+          service.setEmbedder(null);
+          applyHumanEdits();
+        });
     } catch (error) {
       ctx.logger?.warn?.(`[dsh-mneme] embedder unavailable, search degrades to keyword: ${String(error)}`);
+      applyHumanEdits();
     }
   }
 
@@ -139,19 +162,6 @@ export const apply = (ctx, config) => {
     commands.sync();
   }
 
-  // Human edits in mirror files win on every sync; merge them back first.
-  // TYPE_FILE maps each memory type to its mirror filename. Read every type's
-  // edits up front: mergeHumanEdits re-renders ALL mirror files on success, so
-  // a per-type read-then-merge loop would overwrite edits in files not yet read
-  // (e.g. preferences.md merging would clobber unsynced projects.md edits).
-  const humanEdits = new Map();
-  for (const type of Object.keys(TYPE_FILE)) {
-    humanEdits.set(type, mirror.readHumanEdits(type));
-  }
-  for (const [type, edits] of humanEdits) {
-    if (edits.length) service.mergeHumanEdits(type, edits);
-  }
-
   // Dream scheduler: automatic consolidation + summary runs, triggered by
   // store growth. Writes through the service fire the dream hook, which asks
   // the scheduler to (re)schedule a run once absolute and since-last-run

package/src/local-embedder.js

@@ -58,16 +58,21 @@ export class LocalEmbedder {
     // Test hook: replace the pipeline factory without touching modules.
     this.engineFactory = opts.engineFactory || defaultPipelineLoader;
     this.extractor = null;
+    // issue #6: readiness flag for the service's scheduleEmbed gate. False until
+    // init() succeeds, so "ready" in embedder is observable even pre-init.
+    this.ready = false;
   }
 
-  /** Load the model; throws when it cannot be loaded. */
+  /** Load the model; throws when it cannot be loaded. Idempotent. */
   async init() {
+    if (this.extractor) return this; // already initialized: no-op
     const options = {
       dtype: this.useDtype,
       device: this.device
     };
     if (this.cacheDir) options.cache_dir = this.cacheDir;
     this.extractor = await this.engineFactory("feature-extraction", this.model, options);
+    this.ready = true; // service reads this to flush queued re-embeds
     this.logger?.info?.(
       `[dsh-mneme] local embedder ready: ${this.model} (dim=${this._dimension}, device=${this.device})`
     );
@@ -107,6 +112,7 @@ export class LocalEmbedder {
       // best-effort: some engines free resources on GC
     }
     this.extractor = null;
+    this.ready = false;
   }
 }
 

package/src/service.js

@@ -37,11 +37,69 @@ export function createService({ store, mirror, config, onWrite, logger }) {
   // replays them exactly once against the committed state.
   let txDepth = 0;
 
+  // issue #6 (part 2): startup race defense. A local embedder (LocalEmbedder /
+  // Ollama) exposes an async init(), so between `setEmbedder` and init()
+  // resolving there is a window where embedSingle would throw "not initialized"
+  // and the re-embed would be silently dropped. When the embedder carries a
+  // `ready` flag we queue writes in embedPending until init sets ready=true,
+  // then flush them through the embedder's real interface. Embedders without a
+  // `ready` flag (legacy OpenAI, instantly usable) keep their old behavior.
+  let embedPending = [];
+  let embedReadyTimer = null;
+  const EMBED_PENDING_MAX = 100; // bound the queue; drop oldest beyond this
+  const EMBED_READY_POLL_MS = 100;
+  const EMBED_READY_POLL_LIMIT = 30; // ~3s ceiling; never poll forever
+
+  /** Flush the queued re-embeds once the embedder is ready. Fail-safe. */
+  function flushEmbedPending() {
+    if (!embedder || embedPending.length === 0) return;
+    const batch = embedPending.splice(0, embedPending.length);
+    for (const memory of batch) {
+      try {
+        if (!memory?.id) continue;
+        if (typeof embedder.schedule === "function") {
+          embedder.schedule(memory);
+        } else if (typeof embedder.embedSingle === "function") {
+          const text = [memory.title, memory.content].filter(Boolean).join("\n");
+          if (!text) continue;
+          embedder
+            .embedSingle(text)
+            .then((vec) => {
+              if (Array.isArray(vec) && vec.length) {
+                store.setEmbedding(memory.id, vec);
+              }
+            })
+            .catch((err) => {
+              logger?.warn?.("flushEmbedPending embedSingle failed:", err);
+            });
+        }
+      } catch (err) {
+        logger?.warn?.("flushEmbedPending failed:", err);
+      }
+    }
+  }
+
+  function stopEmbedReadyPolling() {
+    if (embedReadyTimer) {
+      clearInterval(embedReadyTimer);
+      embedReadyTimer = null;
+    }
+  }
+
   function scheduleEmbed(memory) {
     try {
       if (txDepth > 0) return; // deferred to the transaction's commit
       if (!embedder || !memory?.id) return;
 
+      // Readiness gate: embedder exposes `ready` (async init) and is not ready
+      // yet — queue instead of firing embedSingle into a half-built extractor.
+      const hasReady = "ready" in embedder;
+      if (hasReady && embedder.ready !== true) {
+        if (embedPending.length >= EMBED_PENDING_MAX) embedPending.shift();
+        embedPending.push(memory);
+        return;
+      }
+
       if (typeof embedder.schedule === "function") {
         embedder.schedule(memory);
         return;
@@ -326,10 +384,12 @@ export function createService({ store, mirror, config, onWrite, logger }) {
       throw error;
     } finally {
       txDepth--;
-      try {
-        syncMirror();
-      } catch (error) {
-        logger?.warn?.("syncMirror failed after transaction:", error);
+      // Sync failures are surfaced, not swallowed (peer blocker 2): the mirror
+      // debt was already recorded by markMirrorDirty inside syncMirror, so a
+      // restart recovers — but the operator must see it now, not after restart.
+      const syncResult = syncMirror();
+      if (!syncResult?.success && !syncResult?.deferred) {
+        logger?.warn?.("mirror sync failed after transaction:", syncResult?.error);
       }
       notifyWrite();
     }
@@ -350,7 +410,7 @@ export function createService({ store, mirror, config, onWrite, logger }) {
         tags: memory.tags ?? existing.tags,
         title: memory.title ?? existing.title
       });
-      syncMirror();
+      afterSync("write");
       notifyWrite();
       scheduleEmbed(merged);
       return { action: "merged", memory: merged };
@@ -363,7 +423,7 @@ export function createService({ store, mirror, config, onWrite, logger }) {
       importance: memory.importance ?? 3,
       source: memory.source ?? "manual"
     });
-    syncMirror();
+    afterSync("write");
     notifyWrite();
     scheduleEmbed(created);
     scheduleEntityExtraction(created);
@@ -423,7 +483,7 @@ export function createService({ store, mirror, config, onWrite, logger }) {
       }
     }
     if (applied) {
-      syncMirror();
+      afterSync("write");
       notifyWrite();
     }
     return applied;
@@ -519,16 +579,17 @@ export function createService({ store, mirror, config, onWrite, logger }) {
   //   - 逐 type 用 setTypeStatus 记录部分成功/失败（type_status JSON）；
   //   - 所有 store 状态写入各自 try/catch，失败只 warn，绝不向外抛（F-NEW-03）。
   function syncMirror() {
-    if (txDepth > 0 || !mirror) return; // deferred to the transaction's commit
+    if (txDepth > 0 || !mirror) return { success: true, deferred: true }; // deferred to the transaction's commit
     const now = new Date().toISOString();
     let gen;
     try {
-      // 绑定本次期望轮次，必须在任何渲染之前，避免制造幽灵债务
-      const state = store.incrementGeneration();
-      gen = state.generation;
+      // desired generation 已在业务写事务中原子递增（peer blocker 1）；这里
+      // 直接读当前值作为本次同步的目标轮次，不再自行 incrementGeneration。
+      const state = store.getMirrorState();
+      gen = state?.generation ?? 0;
     } catch (stateError) {
-      logger?.warn?.("syncMirror: incrementGeneration failed:", stateError);
-      return;
+      logger?.warn?.("syncMirror: getMirrorState failed:", stateError);
+      return { success: false, error: stateError?.message ?? String(stateError) };
     }
     // coveredTypes 提到 try 外初始化：即使 store.list 先抛错，catch 分支也有
     // 合法的空 Set 可迭代，保证 syncMirror 自身绝不抛（fail-safe）。
@@ -545,37 +606,53 @@ export function createService({ store, mirror, config, onWrite, logger }) {
       // 全量渲染
       mirror.sync(reconcileHumanEdits(list));
 
-      // 成功：CAS/fence 绑定到本地 gen，旧 worker（gen 已过期）会被拦截
+      // 成功：CAS/fence 绑定到本地 gen，旧 worker（gen 已过期）会被拦截。
+      // 此步失败说明核心 clean 状态没写成功，向上层报失败（不再静默）。
       try {
         store.markMirrorCleanForGeneration(gen, now);
       } catch (stateError) {
         logger?.warn?.("syncMirror: markMirrorCleanForGeneration failed:", stateError);
+        return { success: false, error: stateError?.message ?? String(stateError) };
       }
-      // 逐 type 标记为 clean
+      // 逐 type 标记为 committed（peer blocker 4: per-type receipt）
       for (const type of coveredTypes) {
         try {
-          store.setTypeStatus(type, { dirty: false, applied_gen: gen, last_error: null });
+          store.setTypeStatus(type, { status: "committed", applied_gen: gen, last_error: null });
         } catch (stateError) {
-          logger?.warn?.(`syncMirror: setTypeStatus(${type}) clean failed:`, stateError);
+          logger?.warn?.(`syncMirror: setTypeStatus(${type}) committed failed:`, stateError);
         }
       }
+      return { success: true };
     } catch (error) {
       const errMsg = error?.message ?? String(error);
       logger?.warn?.("syncMirror failed:", error);
       try {
-        // 债务绑定到新的一轮（desired generation +1）
+        // 债务绑定到新的一轮（desired generation 原子递增；即便 dirty 写失败，
+        // generation 已推进，recoverMirror 仍能捕获，不产生 false-clean）。
         store.markMirrorDirty(errMsg, now);
       } catch (stateError) {
         logger?.warn?.("syncMirror: markMirrorDirty failed:", stateError);
       }
-      // 逐 type 标记为 dirty（applied_gen 不动）
+      // 逐 type 标记为 failed（applied_gen 不动）
       for (const type of coveredTypes) {
         try {
-          store.setTypeStatus(type, { dirty: true, last_error: errMsg });
+          store.setTypeStatus(type, { status: "failed", last_error: errMsg });
         } catch (stateError) {
-          logger?.warn?.(`syncMirror: setTypeStatus(${type}) dirty failed:`, stateError);
+          logger?.warn?.(`syncMirror: setTypeStatus(${type}) failed:`, stateError);
         }
       }
+      return { success: false, error: errMsg };
+    }
+  }
+
+  // afterSync: run syncMirror and surface a failure to the operator instead of
+  // swallowing it (peer blocker 2). The mirror debt has already been persisted
+  // by markMirrorDirty inside syncMirror, so a restart recovers — but the
+  // calling write path must not report clean while the mirror is known-stale.
+  function afterSync(label) {
+    const r = syncMirror();
+    if (!r?.success && !r?.deferred) {
+      logger?.warn?.(`${label}: mirror sync failed (will recover on restart):`, r?.error);
     }
   }
 
@@ -660,10 +737,11 @@ export function createService({ store, mirror, config, onWrite, logger }) {
         success_at: state.success_at ?? null
       };
     } catch (error) {
-      // fail-safe：状态读取失败也不向外抛
+      // fail-safe：状态读取失败也不向外抛，但必须显式表达"未知"而非伪装成
+      // 干净（peer blocker 5：真实读取失败要显式 unknown，不得归一为 dirty:false）。
       logger?.warn?.("getMirrorHealth failed:", error);
       return {
-        dirty: false,
+        dirty: null,
         last_error: error?.message ?? String(error),
         last_attempt: null,
         success_at: null
@@ -681,7 +759,32 @@ export function createService({ store, mirror, config, onWrite, logger }) {
     toApiList,
     transaction,
     setDreamHook(fn) { dreamHook = fn; },
-    setEmbedder(emb) { embedder = emb; },
+    setEmbedder(emb) {
+      embedder = emb;
+      if (!emb) {
+        // embedder removed (init failed in index.js): stop polling and drop
+        // queued re-embeds — search just degrades to keyword.
+        stopEmbedReadyPolling();
+        embedPending = [];
+        return;
+      }
+      if (emb.ready === true) {
+        flushEmbedPending();
+        return;
+      }
+      // Async-initializing embedder: poll `ready` until it flips, then flush.
+      if ("ready" in emb && embedReadyTimer === null) {
+        let attempts = 0;
+        embedReadyTimer = setInterval(() => {
+          attempts++;
+          if (emb.ready === true || attempts >= EMBED_READY_POLL_LIMIT) {
+            stopEmbedReadyPolling();
+            if (emb.ready === true) flushEmbedPending();
+            else embedPending = []; // init never landed: drop the queue
+          }
+        }, EMBED_READY_POLL_MS);
+      }
+    },
     setEntityExtractor(fn) { entityExtractor = fn; },
     setVectorIndex(vi) { vectorIndex = vi; },
     setReranker(rn) { reranker = rn; },
@@ -697,7 +800,7 @@ export function createService({ store, mirror, config, onWrite, logger }) {
     getById: (id) => store.getById(id),
     remove: (id) => {
       store.remove(id);
-      syncMirror();
+      afterSync("write");
       notifyWrite();
     },
     update: (id, p, ctx = {}) => {
@@ -723,7 +826,7 @@ export function createService({ store, mirror, config, onWrite, logger }) {
           memory_id: id
         });
       }
-      syncMirror();
+      afterSync("write");
       notifyWrite();
       scheduleEmbed(updated);
       return updated;
@@ -752,19 +855,19 @@ export function createService({ store, mirror, config, onWrite, logger }) {
           memory_id: id
         });
       }
-      syncMirror();
+      afterSync("write");
       notifyWrite();
       scheduleEmbed(updated);
       return updated;
     },
     setForget: (id, f) => {
       const updated = store.setForget(id, f);
-      syncMirror();
+      afterSync("write");
       return updated;
     },
     setArchived: (id, f) => {
       const updated = store.setArchived(id, f);
-      syncMirror();
+      afterSync("write");
       return updated;
     },
     // autoDream audit trail: passthroughs deliberately bypass write hooks —

package/src/store.js

@@ -180,14 +180,19 @@ CREATE TABLE IF NOT EXISTS mirror_state (
   last_error TEXT,                   -- 最近失败原因
   last_attempt TEXT,                 -- 最近尝试时间（ISO）
   success_at TEXT,                   -- 最近成功时间（ISO）
-  generation INTEGER NOT NULL DEFAULT 0,         -- 期望的同步轮次（desired）
-  applied_generation INTEGER NOT NULL DEFAULT 0, -- 已成功应用的轮次
+  generation INTEGER NOT NULL DEFAULT 0 CHECK (generation >= 0 AND generation <= 9007199254740991),         -- 期望的同步轮次（desired）
+  applied_generation INTEGER NOT NULL DEFAULT 0 CHECK (applied_generation >= 0 AND applied_generation <= 9007199254740991), -- 已成功应用的轮次
   type_status TEXT                               -- JSON: 逐 type 状态 {type: {dirty, applied_gen, last_error}}
 );
 `;
 
 const TYPES = new Set(["preference", "project", "decision", "history", "summary"]);
 
+// Per-type mirror sync receipts (peer blocker 4): a type is either committed
+// (file written + fence applied), failed (last sync round errored for it), or
+// pending (still owed a write).
+const VALID_TYPE_STATUS = new Set(["committed", "failed", "pending"]);
+
 // Pure helpers: no shared module state.
 
 function sanitizePage(limit, offset, defaultLimit) {
@@ -387,6 +392,10 @@ function parseJsonArray(raw) {
 export function createStore(path) {
   const db = new DatabaseSync(path);
   db.exec("PRAGMA journal_mode = WAL;");
+  // Concurrent writers (peer probe: 8 independent processes) must wait for the
+  // write lock instead of failing immediately with SQLITE_BUSY — otherwise the
+  // atomic generation increment loses whole writes, not just increments.
+  db.exec("PRAGMA busy_timeout = 5000;");
   db.exec(SCHEMA);
 
   // Schema migrations for legacy databases (idempotent).
@@ -467,10 +476,17 @@ export function createStore(path) {
     const embedding = Array.isArray(memory.embedding) && memory.embedding.length
       ? JSON.stringify(memory.embedding)
       : null;
-    db.prepare(
-      `INSERT INTO memories (id, type, title, content, tags, importance, forgotten, source, embedding, created_at, updated_at)
-       VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ?)`
-    ).run(id, type, memory.title, memory.content, tags, importance, memory.source ?? null, embedding, now, now);
+    runAtomically(() => {
+      db.prepare(
+        `INSERT INTO memories (id, type, title, content, tags, importance, forgotten, source, embedding, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ?)`
+      ).run(id, type, memory.title, memory.content, tags, importance, memory.source ?? null, embedding, now, now);
+      // desired generation bumped in the same transaction as the write: once
+      // this commits, generation > applied_generation, so a crash right after
+      // (before syncMirror) is caught by recoverMirror on restart (peer
+      // blocker 1). ROLLBACK on error rolls this back with the write.
+      incrementGeneration();
+    });
     return getById(id);
   }
 
@@ -486,24 +502,34 @@ export function createStore(path) {
     const embedding = patch.embedding !== undefined
       ? (Array.isArray(patch.embedding) && patch.embedding.length ? JSON.stringify(patch.embedding) : null)
       : existing.embedding ?? null;
-    db.prepare(
-      `UPDATE memories SET type=?, title=?, content=?, tags=?, importance=?, source=?, embedding=?, updated_at=? WHERE id=?`
-    ).run(
-      type,
-      patch.title ?? existing.title,
-      patch.content ?? existing.content,
-      JSON.stringify(patch.tags ?? existing.tags),
-      Number.isInteger(patch.importance) ? patch.importance : existing.importance,
-      patch.source !== undefined ? patch.source : (existing.source ?? null),
-      embedding,
-      now,
-      id
-    );
+    runAtomically(() => {
+      db.prepare(
+        `UPDATE memories SET type=?, title=?, content=?, tags=?, importance=?, source=?, embedding=?, updated_at=? WHERE id=?`
+      ).run(
+        type,
+        patch.title ?? existing.title,
+        patch.content ?? existing.content,
+        JSON.stringify(patch.tags ?? existing.tags),
+        Number.isInteger(patch.importance) ? patch.importance : existing.importance,
+        patch.source !== undefined ? patch.source : (existing.source ?? null),
+        embedding,
+        now,
+        id
+      );
+      // Desired generation bumped in the same transaction as the update (peer
+      // blocker 1: crash between write and sync must still be recoverable).
+      incrementGeneration();
+    });
     return getById(id);
   }
 
   function remove(id) {
-    db.prepare("DELETE FROM memories WHERE id = ?").run(id);
+    runAtomically(() => {
+      db.prepare("DELETE FROM memories WHERE id = ?").run(id);
+      // Mirror sync must reflect the deletion; bump desired generation so a
+      // crash between the delete and syncMirror leaves a recoverable debt.
+      incrementGeneration();
+    });
   }
 
   /**
@@ -542,18 +568,26 @@ export function createStore(path) {
       expectedUpdatedAt
     );
     if (result.changes === 0) return undefined; // CAS miss: a concurrent write won
+    // Only bump desired generation on a successful CAS — a miss writes nothing.
+    runAtomically(() => { incrementGeneration(); });
     return getById(id);
   }
 
   function setForget(id, forgotten) {
-    db.prepare("UPDATE memories SET forgotten = ?, updated_at = ? WHERE id = ?")
-      .run(forgotten === true || forgotten === 1 ? 1 : 0, nowIso(), id);
+    runAtomically(() => {
+      db.prepare("UPDATE memories SET forgotten = ?, updated_at = ? WHERE id = ?")
+        .run(forgotten === true || forgotten === 1 ? 1 : 0, nowIso(), id);
+      incrementGeneration();
+    });
     return getById(id);
   }
 
   function setArchived(id, archived) {
-    db.prepare("UPDATE memories SET archived = ?, updated_at = ? WHERE id = ?")
-      .run(archived ? 1 : 0, nowIso(), id);
+    runAtomically(() => {
+      db.prepare("UPDATE memories SET archived = ?, updated_at = ? WHERE id = ?")
+        .run(archived ? 1 : 0, nowIso(), id);
+      incrementGeneration();
+    });
     return getById(id);
   }
 
@@ -1189,7 +1223,10 @@ export function createStore(path) {
       if (key === "dirty") {
         value = value ? 1 : 0;
       } else if (key === "generation" || key === "applied_generation") {
-        value = Math.trunc(Number(value)) || 0;
+        value = Math.trunc(Number(value));
+        if (!Number.isFinite(value) || value < 0 || value > Number.MAX_SAFE_INTEGER) {
+          throw new RangeError(`mirror_state.${key} out of range: ${value}`);
+        }
       } else if (key === "type_status" && value != null && typeof value !== "string") {
         value = JSON.stringify(value);
       }
@@ -1220,12 +1257,15 @@ export function createStore(path) {
    * recent as this one may.
    */
   function markMirrorDirty(error, now) {
-    const current = getMirrorState();
+    // Bump the desired generation atomically first — the new debt must be bound
+    // to a fresh round so a stale worker cannot fence-clean it. Even if this
+    // write fails (peer blocker 2), generation still advanced, so recoverMirror
+    // sees generation > applied_generation and retries rather than false-clean.
+    incrementGeneration();
     return setMirrorState({
       dirty: 1,
       last_error: error,
-      last_attempt: now ?? nowIso(),
-      generation: (current.generation || 0) + 1
+      last_attempt: now ?? nowIso()
     });
   }
 
@@ -1262,13 +1302,23 @@ export function createStore(path) {
 
   /**
    * Record per-type mirror status (partial success bookkeeping). `status` is a
-   * partial patch {dirty?, applied_gen?, last_error?} merged into the existing
-   * entry for `type` (other types untouched). Returns the updated full state.
+   * patch {status: 'committed'|'failed'|'pending', applied_gen?, last_error?}
+   * replacing the entry for `type` (other types untouched). Standardizing on an
+   * explicit status gives per-type committed/failed/pending receipts — a type
+   * whose file was written while a sibling failed is recorded as such, not
+   * collapsed into a bulk "dirty" (peer blocker 4). Returns the updated state.
    */
   function setTypeStatus(type, status) {
+    if (!VALID_TYPE_STATUS.has(status?.status)) {
+      throw new TypeError(`setTypeStatus: status must be one of committed|failed|pending, got ${status?.status}`);
+    }
     const current = getMirrorState();
     const statuses = current.type_status || {};
-    statuses[type] = { ...(statuses[type] || {}), ...status };
+    statuses[type] = {
+      status: status.status,
+      ...(status.applied_gen !== undefined ? { applied_gen: status.applied_gen } : {}),
+      ...(status.last_error !== undefined ? { last_error: status.last_error } : {})
+    };
     return setMirrorState({ type_status: JSON.stringify(statuses) });
   }
 
@@ -1278,10 +1328,40 @@ export function createStore(path) {
     return current.type_status || {};
   }
 
-  /** Bump the desired generation (new sync round), returning the new state. */
+  /** Run fn atomically: when the connection is already inside a transaction
+   *  (service.transaction's BEGIN), just run it — the outer COMMIT covers us.
+   *  Otherwise wrap in BEGIN/COMMIT so a memory write and its desired-generation
+   *  bump commit together: a crash between them can never leave a mutated store
+   *  with generation == applied (audit peer blocker 1, "crash window"). */
+  function runAtomically(fn) {
+    if (db.isTransaction) return fn();
+    db.exec("BEGIN");
+    try {
+      const result = fn();
+      db.exec("COMMIT");
+      return result;
+    } catch (error) {
+      try { db.exec("ROLLBACK"); } catch { /* connection may be closed */ }
+      throw error;
+    }
+  }
+
+  /** Bump the desired generation atomically (SQLite single-statement increment,
+   *  no SELECT-then-UPSERT race: peer blocker 3 lost 10 of 91 concurrent
+   *  increments under an 8-process probe). Returns the new mirror state.
+   *  Guards the upper bound: generation must stay within MAX_SAFE_INTEGER so
+   *  reads never hit ERR_OUT_OF_RANGE (peer blocker 6). */
   function incrementGeneration() {
-    const current = getMirrorState();
-    return setMirrorState({ generation: (current.generation || 0) + 1 });
+    return runAtomically(() => {
+      // Ensure the singleton row exists before incrementing (UPDATE alone would
+      // match nothing on a fresh DB).
+      db.prepare("INSERT OR IGNORE INTO mirror_state (id) VALUES ('main')").run();
+      const row = db.prepare(
+        "UPDATE mirror_state SET generation = generation + 1 WHERE id = 'main' AND generation < ? RETURNING generation"
+      ).get(Number.MAX_SAFE_INTEGER);
+      if (!row) throw new RangeError("mirror_state.generation exceeded MAX_SAFE_INTEGER");
+      return getMirrorState();
+    });
   }
 
   return {