@modusensus/dsh-mneme 0.7.31 → 0.8.0

package/src/service.js

@@ -1,7 +1,10 @@
 import { createHash, randomUUID } from "node:crypto";
 import { TYPE_FILE } from "./mirror.js";
+import { updatedAtBounds } from "./store.js";
+import { STR, langOf } from "./lang.js";
 import { computeHeat } from "./heat.js";
 import { evaluateMemoryQuality } from "./quality-filter.js";
+import { applyDecisions } from "./dream/decisions.js";
 import { createBM25Index } from "./search/bm25.js";
 import { adaptiveThreshold } from "./search/adaptive.js";
 
@@ -32,6 +35,71 @@ const EPISTEMIC_WEIGHTS = { observation: 1.0, inferred: 0.85, subjective: 0.7 };
 // how the version was superseded (auto_merge | human_override | overwrite).
 const CONTENT_HISTORY_MAX = 20;
 
+// Issue #135 附属发现 2：质量过滤器写下的系统信号标签（「为什么被降权/归档」的
+// 唯一审计线索）。更新路径整组替换 tags 会把它们抹掉——更新时按此清单并集保留。
+// 清单必须与 quality-filter.js 的写入端对齐（6 个，含 type 自指的 self_referential）。
+const SIGNAL_TAGS = ["low_quality", "duplicate", "meta", "repetitive", "short_content", "self_referential"];
+
+// v0.8.0 A1（issue #17）去重键的 scope 归一：非空 trim 字符串原样比较，其余
+// （NULL/undefined/空串）统一为「未标注」。与 store.normalizeScopeText 的落库
+// 口径一致——两把钥匙只有都过这里再比较，NULL 与 'global' 才不会错配。
+function scopeKeyOf(v) {
+  return typeof v === "string" && v.trim() ? v.trim() : null;
+}
+
+// v0.8.0 A2（issue #17）scope 检索加权系数：两维都无法确立 foreign 的候选
+// （命中行、未标注行、当前侧维度解析不到的行）→ 加成；只有确立了 foreign
+// （记忆带标注 + 当前维度可解析 + 值不等）→ 降权但保留可见（硬过滤是 A3
+// strictScope）。即未标注行与命中行同列、不吃惩罚，但注意它们吃的是 BOOST
+// 而非 ×1 中性。系数是模块常量而非配置项：A2 只定性行为，数值要等线上检索
+// 质量反馈再调（加配置面=提前优化）。
+const SCOPE_MATCH_BOOST = 1.25;
+const SCOPE_FOREIGN_PENALTY = 0.5;
+
+/**
+ * 单条候选的 scope 乘数。匹配语义与去重键一致（scopeKeyOf）：记忆侧未标注视同
+ * 该维度命中（全局记忆对谁都可见）；当前会话侧某维度解析不到则该维度不参与
+ * 比较（无法比较 ≠ 不匹配）。
+ */
+function scopeMultiplier(m, current) {
+  const agentForeign = scopeKeyOf(m.agent_scope) !== null
+    && current.agent_scope !== null
+    && scopeKeyOf(m.agent_scope) !== current.agent_scope;
+  const workspaceForeign = scopeKeyOf(m.workspace_scope) !== null
+    && current.workspace_scope !== null
+    && scopeKeyOf(m.workspace_scope) !== current.workspace_scope;
+  return (agentForeign || workspaceForeign) ? SCOPE_FOREIGN_PENALTY : SCOPE_MATCH_BOOST;
+}
+
+/**
+ * v0.8.0 A2：occurred_at 后置过滤谓词（搜索融合池用）。行侧取
+ * COALESCE(occurred_at, created_at)——与 store.list 的 SQL 过滤同口径，未标注
+ * 行回退创建时间；时间戳损坏的行保留（宁可放宽也不误杀，同 summarize inWindow）。
+ */
+function inOccurredBounds(m, bounds) {
+  const t = Date.parse(String(m.occurred_at ?? m.created_at ?? ""));
+  if (!Number.isFinite(t)) return true;
+  if (bounds.from && t < Date.parse(bounds.from)) return false;
+  if (bounds.to && t > Date.parse(bounds.to)) return false;
+  return true;
+}
+
+/**
+ * v0.8.0 A3（issue #17）strictScope 可见性谓词：issue 的四象限可见性公式
+ * （agent 不对称可见性）——记忆对当前会话可见 ⇔ (agent 维：未标注 或 命中当前
+ * agent) AND (workspace 维：未标注 或 命中当前 workspace)。NULL=未标注=全局；
+ * 当前会话某维度解析不到时，该维度带标注的记忆一律不可见（fail-closed：身份
+ * 不明的会话只见全局，不冒认）。sensitivity 是标签不参与可见性判定（其语义
+ * 留给后续批次）。store.list 的 SQL 过滤与此谓词同口径（见 store.js visibility）。
+ */
+function isVisibleInScope(m, current) {
+  const agent = scopeKeyOf(m.agent_scope);
+  if (agent !== null && (current.agent_scope === null || agent !== current.agent_scope)) return false;
+  const ws = scopeKeyOf(m.workspace_scope);
+  if (ws !== null && (current.workspace_scope === null || ws !== current.workspace_scope)) return false;
+  return true;
+}
+
 /** Prepend the previous content to a memory's content_history (FIFO capped). */
 function pushContentHistory(existing, source) {
   const history = Array.isArray(existing?.content_history) ? existing.content_history : [];
@@ -78,6 +146,7 @@ export function computeRetrievalMetrics(actualIds, expectedIds) {
 }
 
 export function createService({ store, mirror, config, onWrite, logger }) {
+  const language = langOf(config);
   // Optional dream scheduler hook, installed via setDreamHook after creation
   // (the scheduler holds a reference back to the service, so it cannot be
   // passed in the constructor). Fired on the same write events as onWrite.
@@ -582,7 +651,19 @@ export function createService({ store, mirror, config, onWrite, logger }) {
    * a vector/rerank failure degrades to keyword results.
    */
   async function searchMemories(query, options = {}) {
-    const { mode = "auto", topK = 20, threshold, useRerank = true, recordRecall = options.recordRecall ?? (config?.recallRecordDefault ?? true) } = options;
+    const {
+      mode = "auto",
+      topK = 20,
+      threshold,
+      useRerank = true,
+      // v0.8.0 A2（issue #17）：当前会话 scope（工具层从 exec 解析后传入）与
+      // occurred_at 时间窗。两者都只在显式传入时生效，既有调用方（注入/梦/评测）
+      // 不传 → 行为与 A2 前一致。
+      scope = null,
+      occurredFrom = null,
+      occurredTo = null,
+      recordRecall = options.recordRecall ?? (config?.recallRecordDefault ?? true)
+    } = options;
     const q = String(query ?? "").trim();
     if (!q) return [];
 
@@ -649,6 +730,19 @@ export function createService({ store, mirror, config, onWrite, logger }) {
 
     const { merged: fusedMerged, signals } = fuseRecall({ keyword, vector, bm25, lim, mode, wv, wk, wb });
     let merged = fusedMerged;
+    // v0.8.0 A3（issue #17）：strictScope 硬过滤——他 scope 的候选直接出局
+    // （区别于 A2 的降权保留可见）；未标注行与命中行保留。strict 与 A2 加权
+    // 叠加：过滤后剩下的命中行仍吃加成。scope 未传（flag 关）或完全解析不到
+    // 时跳过——identity 为空的对象（{null,null}）按 fail-closed 过滤。
+    if (config.strictScope === true && scope) {
+      merged = merged.filter((m) => isVisibleInScope(m, scope));
+    }
+    // v0.8.0 A2：occurred_at 时间过滤——在融合池上先滤再 dedup/slice，rerank
+    // 只看窗内候选，topK 槽位不被窗外行占用。
+    const occurredBounds = updatedAtBounds(occurredFrom, occurredTo);
+    if (occurredBounds.from || occurredBounds.to) {
+      merged = merged.filter((m) => inOccurredBounds(m, occurredBounds));
+    }
     // Signal transparency (#2): decorate each returned row with its per-source
     // scores and the final fused score. Purely additive — never changes rank.
     if (config?.signalTransparency === true) {
@@ -678,6 +772,18 @@ export function createService({ store, mirror, config, onWrite, logger }) {
         .slice(0, lim);
     }
 
+    // v0.8.0 A2（issue #17）：scope 检索加权——两维都无法确立 foreign 的候选
+    // （命中/未标注/当前侧解析不到）加成，确立 foreign 的候选降权但保留可见
+    // （硬过滤是 A3 strictScope）；未标注行与命中行同列吃 BOOST、不被压制。
+    // flag 关或调用方未传 scope 时不动分，排序与 A2 前逐字节一致。与
+    // epistemic 加权同款收尾：乘分 → 降序 → 截 topK。
+    if (config.scopeEnabled === true && scope && (scope.agent_scope || scope.workspace_scope)) {
+      result = result
+        .map((m) => ({ ...m, score: (m.score ?? 0) * scopeMultiplier(m, scope) }))
+        .sort((a, b) => (b.score ?? 0) - (a.score ?? 0))
+        .slice(0, lim);
+    }
+
     // Recall layer receipt: with recordRecall on, hand the actual merged
     // candidate list (id/title/content/score/source) to the injected recorder
     // before returning, making the retrieval scene replayable — the sibling of
@@ -865,6 +971,60 @@ export function createService({ store, mirror, config, onWrite, logger }) {
     }
   }
 
+  /**
+   * 写入端同会话语义去重（Issue #127，opt-in，默认 off）：落库前把新条目与
+   * 「同会话 + 时间窗」内已落库的记忆比对，命中即并入既有条目，不再新造一行。
+   *
+   * 分层：title 档走零成本的标题归一化；vector 档复用已有 embedding 列做近邻，
+   * 新条目的向量由 embedder 现算（embedQuery），全程无 LLM 调用。embedder 不可用
+   * 或向量缺失一律返回 undefined 回落正常写入——去重是增强，绝不能成为写入依赖。
+   *
+   * 作用域刻意限定「同会话」：跨会话的同类事实仍交给 autoDream / sleep 的批量裁决。
+   * 比对逻辑与并入动作分别复用 cosineVec 与 saveWithDedupe 的 _mergeInto 分支。
+   *
+   * @returns {{action: "merged", memory: object, sim: number}|undefined} 命中则返回
+   *          并入目标与相似度；未命中（含任何异常）返回 undefined。
+   */
+  async function findSessionDuplicate(memory, { mode = "off", minSim = 0.92, windowHours = 24, source } = {}) {
+    if (mode === "off" || !source || !memory?.title) return undefined;
+    try {
+      const sinceMs = windowHours > 0 ? Date.now() - windowHours * 3600000 : 0;
+      const inWindow = (m) => {
+        if (sinceMs <= 0) return true;
+        const t = Date.parse(m.created_at ?? "");
+        return !Number.isFinite(t) || t >= sinceMs; // 时间戳损坏时不误杀
+      };
+      const candidates = store
+        .list({ type: memory.type, source, limit: 200 })
+        .filter((m) => !m.archived && inWindow(m));
+      if (!candidates.length) return undefined;
+
+      if (mode === "title") {
+        const norm = (s) => String(s ?? "").toLowerCase().replace(/[\s\p{P}]+/gu, "");
+        const key = norm(memory.title);
+        if (!key) return undefined;
+        const hit = candidates.find((m) => norm(m.title) === key);
+        return hit ? { action: "merged", memory: hit, sim: 1 } : undefined;
+      }
+      if (mode !== "vector") return undefined;
+
+      const vecs = store.getEmbeddings(candidates.map((m) => m.id));
+      if (!vecs.size) return undefined;
+      const probe = await embedQuery([memory.title, memory.content].filter(Boolean).join("\n"));
+      if (!probe) return undefined;
+      let best;
+      for (const m of candidates) {
+        const v = vecs.get(m.id);
+        if (!v) continue; // 无向量的既有行不参与比对（无信号 = 不判定）
+        const sim = cosineVec(probe, v);
+        if (sim >= minSim && (!best || sim > best.sim)) best = { action: "merged", memory: m, sim };
+      }
+      return best;
+    } catch {
+      return undefined; // 去重失败绝不阻塞写入
+    }
+  }
+
   /**
    * Save a memory, merging into an existing one when title matches within the same type.
    *
@@ -900,9 +1060,32 @@ export function createService({ store, mirror, config, onWrite, logger }) {
         });
       } catch { /* quality scoring is best-effort */ }
     }
-    const existing = store
-      .list({ type: memory.type, limit: 100 })
-      .find((m) => m.title.trim() === String(memory.title).trim());
+    // dream 总览按 source 身份去重，而非本地化标题：memory.language 切换后
+    // 标题变化，若仍按 (type, title) 匹配会出现两个活跃的 summary 同时注入。
+    // 其余类型维持 (type, title) 匹配不变。
+    const candidates = store.list({ type: memory.type, limit: 100 });
+    // v0.8.0 A1（issue #17）：scopeEnabled 开启时去重键由 (type, title) 扩展为
+    // (type, title, agent_scope, workspace_scope, sensitivity)——不同作用域的同
+    // 标题记忆绝不互相物理合并（旧逻辑跨 agent/workspace 并行，事后无法拆分）。
+    // NULL 归一为「未标注」：未标注行之间互相匹配（含存量行），与已标注行不
+    // 匹配。flag 关闭时跳过比较，行为与 A1 前逐字节一致。
+    const scopeOn = config.scopeEnabled === true;
+    const scopeMatches = (m) =>
+      !scopeOn ||
+      (scopeKeyOf(m.agent_scope) === scopeKeyOf(memory.agent_scope) &&
+        scopeKeyOf(m.workspace_scope) === scopeKeyOf(memory.workspace_scope) &&
+        scopeKeyOf(m.sensitivity) === scopeKeyOf(memory.sensitivity));
+    // Issue #127：写入端语义去重命中时，调用方用 _mergeInto 指定并入目标——复用
+    // 下面这段并入逻辑（appendContent + content_history + 质量处置），不另写第二份
+    // 实现。目标已被并发删除时回落到常规匹配。显式目标同样过 scope 门：跨作用域
+    // 的语义相似不并入（防泄漏），回落为独立新行。
+    const explicitTarget = memory._mergeInto ? store.getById(memory._mergeInto) : undefined;
+    const existing = explicitTarget
+      ? (scopeMatches(explicitTarget) ? explicitTarget : undefined)
+      : (memory.type === "summary" && memory.source === "dream")
+        ? (candidates.find((m) => m.source === "dream" && scopeMatches(m))
+          ?? candidates.find((m) => scopeMatches(m) && m.title.trim() === String(memory.title).trim()))
+        : candidates.find((m) => scopeMatches(m) && m.title.trim() === String(memory.title).trim());
     if (existing) {
       const newContent = String(memory.content ?? "");
       if (!newContent.trim()) {
@@ -938,6 +1121,11 @@ export function createService({ store, mirror, config, onWrite, logger }) {
       tags: memory.tags ?? [],
       importance: memory.importance ?? 3,
       source: memory.source ?? "manual",
+      // v0.8.0 A1：scope 标注透传（store 端归一化，未标注落 NULL）。
+      agent_scope: memory.agent_scope,
+      workspace_scope: memory.workspace_scope,
+      sensitivity: memory.sensitivity,
+      occurred_at: memory.occurred_at,
       ...(quality ? { quality_score: quality.score } : {})
     });
     const result = applyQualityDisposition(created, quality, qf);
@@ -956,6 +1144,12 @@ export function createService({ store, mirror, config, onWrite, logger }) {
    * (importance × score/100). Best-effort: a disposition write failure must
    * never fail the save. Returns the (possibly refreshed) memory row so callers
    * see the archived/tagged state, not the pre-disposition snapshot.
+   *
+   * Issue #135 附属发现 1：importance ≥ memoryQualityFilter.exemptImportance
+   * （默认 4）的记忆不参与静默自动归档——评分与信号标签照常写入（可观测），
+   * 注入排序照常按 importance × score/100 降权，但 setArchived 跳过。报告实测
+   * 150 条低分归档里 128 条 importance ≥ 4（51 条 = 5）：一条被显式标为重要的
+   * 记忆不该被规则分静默归档、无感知无豁免。
    */
   function applyQualityDisposition(memory, quality, qf) {
     if (!quality || qf?.enabled !== true) return memory;
@@ -963,14 +1157,21 @@ export function createService({ store, mirror, config, onWrite, logger }) {
     // Signal tags (meta / repetitive / duplicate / short_content / low_quality)
     // are merged onto the stored row in every assessed band so the verdict is
     // observable, not just the numeric score. Below the archive threshold the
-    // memory is additionally archived (still explicitly searchable).
+    // memory is additionally archived (still explicitly searchable) — unless
+    // its importance reaches the exemption floor (kept active, demoted only).
     const tags = [...new Set([...(memory.tags ?? []), ...(quality.tags ?? [])])];
-    if (tags.length === (memory.tags?.length ?? 0) && quality.score >= archiveThreshold) {
+    const exemptImportance = qf.exemptImportance ?? 4;
+    const importanceExempt = Number.isInteger(memory.importance) && memory.importance >= exemptImportance;
+    if (tags.length === (memory.tags?.length ?? 0) && (quality.score >= archiveThreshold || importanceExempt)) {
       return memory; // no tag drift and not archived → nothing extra to write
     }
     try {
       store.update(memory.id, { tags, quality_score: quality.score });
-      if (quality.score < archiveThreshold) store.setArchived(memory.id, true);
+      if (quality.score < archiveThreshold && !importanceExempt) {
+        store.setArchived(memory.id, true);
+      } else if (quality.score < archiveThreshold) {
+        logger?.info?.(`[dsh-mneme] quality filter: memory ${memory.id} scored ${quality.score} < ${archiveThreshold} but importance ${memory.importance} >= exemptImportance ${exemptImportance}; demoted, not archived`);
+      }
       return store.getById(memory.id);
     } catch {
       return memory;
@@ -990,7 +1191,7 @@ export function createService({ store, mirror, config, onWrite, logger }) {
    * fills + dedupes the remaining slots. Empty query / no cached recall /
    * hybridInject off → pure legacy rule-based selection.
    */
-  function injectCandidates({ query = "", maxItems = 5, threshold = 3, queryVector } = {}) {
+  function injectCandidates({ query = "", maxItems = 5, threshold = 3, queryVector, scope = null } = {}) {
     const q = String(query ?? "").trim();
     // codingRetrospect 读取侧门控：编码记忆（rejected_solution / pitfall /
     // constraint）只在编码任务时注入，防噪声污染其他业务；编码任务时按
@@ -1080,6 +1281,11 @@ export function createService({ store, mirror, config, onWrite, logger }) {
         }
       } catch { /* topic re-rank unavailable: keep rule-based order */ }
     }
+    // v0.8.0 A3（issue #17）：strictScope 硬过滤同样作用于自动注入——scoped 记忆
+    // 泄进无关注入上下文是最典型的越权通道，检索侧过滤挡不住这里。
+    if (config?.strictScope === true && scope) {
+      candidates = candidates.filter((m) => isVisibleInScope(m, scope));
+    }
     const selected = candidates.slice(0, maxItems);
     touchRecalled(selected);
     return selected;
@@ -1133,6 +1339,94 @@ export function createService({ store, mirror, config, onWrite, logger }) {
     return applied;
   }
 
+  /**
+   * v0.8.0 冲突集中处理（issue 反馈：冻结冲突没有人工出口——store 的
+   * resolveConflictPending 此前无任何 API/UI 调用）。人工确认一条待审冲突：
+   * 盖章 resolved_at/resolved_winner（审计），可选按 dream 非冻结 conflict
+   * 路径**同款**处置落地——复用 applyDecisions 的 conflict 分支，CAS 快照 +
+   * 事务 + 胜者追加已否决注记 + 败者归档 + 幂等全部同源，不另写第二份裁决。
+   *
+   * @param {string} id conflict_pending 行 id
+   * @param {{winner?: "a"|"b"|null, apply?: boolean}} opts
+   *   winner: 选哪一方保留（a = memory_a，冻结时 LLM 的建议胜者；b = memory_b）；
+   *   null = 仅盖章标记已读、不落地处置。人工选择是权威裁决：传入
+   *   applyDecisions 的 config 关掉 trustEpistemicWeighting——可信度自动换位
+   *   只应作用于 LLM 提议对，不能推翻人工选择。
+   * @returns {object|undefined} 盖章后的冲突行 + disposition 摘要；未知 id 返回 undefined
+   */
+  function resolveConflictPending(id, { winner = null, apply = true } = {}) {
+    const rows = store.listConflictPending({ includeResolved: true, limit: 500 });
+    const row = rows.find((r) => r.id === id);
+    if (!row) return undefined;
+    const winnerId = winner === "a" ? row.memory_a : winner === "b" ? row.memory_b : null;
+    const loserId = winner === "a" ? row.memory_b : winner === "b" ? row.memory_a : null;
+    let disposition = null;
+    if (apply && winnerId && loserId) {
+      const snapshot = new Map();
+      for (const m of [store.getById(row.memory_a), store.getById(row.memory_b)]) {
+        if (m) snapshot.set(m.id, { updated_at: m.updated_at, content: m.content, title: m.title });
+      }
+      // applyDecisions 需要一个 service 形状的参数（getById/update/setArchived/
+      // transaction）——委托给闭包内的同名实现，mirror/通知/嵌入与主写路径同源。
+      const applyService = {
+        getById: (mid) => store.getById(mid),
+        update: (mid, patch) => updateMemory(mid, patch),
+        setArchived: (mid, v) => archiveMemory(mid, v),
+        transaction: (fn) => transaction(fn)
+      };
+      const { committed, failures } = applyDecisions(
+        [{ action: "conflict", winner: winnerId, loser: loserId, reason: row.reason ?? "" }],
+        applyService,
+        logger,
+        snapshot,
+        { ...config, trustEpistemicWeighting: false }
+      );
+      // Review 发现：处置必须**先于**盖章。原实现先 resolveConflictPending 盖章、
+      // 再 applyDecisions——若 CAS 拒掉（确认前双方被并发更新），行已 resolved 从
+      // 队列消失、前端仍显示成功，审计却记了"已确认"且无法重试。现在失败时不盖章
+      // 直接返回：行留在队列待重试，审计不被污染。
+      if (failures.length) {
+        return { ...row, disposition: { ok: false, failures } };
+      }
+      disposition = { ok: true, committed };
+    }
+    // 处置成功（或纯标记）后才盖章。幂等重放（败者已归档 → skipped）也走这里：
+    // 处置本就存在，标记已审即可。
+    const stamped = store.resolveConflictPending(id, { winner: winnerId });
+    if (!stamped) return undefined;
+    return { ...stamped, disposition };
+  }
+
+  /**
+   * v0.8.0 冲突队列视图数据源：未解决冲突行，联表带出双方的当前状态（标题/
+   * 内容/类型/重要性/归档标记），面板一处即可集中审阅，不必按徽章逐条找。
+   * 参与记忆被删除/失联时该侧返回 {missing: true}（队列不因此丢行）。
+   */
+  function listConflictQueue({ limit = 50, offset = 0 } = {}) {
+    const rows = store.listConflictPending({ limit, offset, includeResolved: false });
+    const side = (id) => {
+      const m = store.getById(id);
+      if (!m) return { id, missing: true };
+      return {
+        id,
+        title: m.title,
+        type: m.type,
+        importance: m.importance,
+        content: m.content,
+        archived: m.archived === true,
+        forgotten: m.forgotten === true
+      };
+    };
+    return rows.map((r) => ({
+      id: r.id,
+      run_id: r.run_id ?? null,
+      reason: r.reason ?? null,
+      created_at: r.created_at,
+      memory_a: side(r.memory_a),
+      memory_b: side(r.memory_b)
+    }));
+  }
+
   function toApiList(rows) {
     return rows.map((m) => ({
       id: m.id,
@@ -1143,7 +1437,14 @@ export function createService({ store, mirror, config, onWrite, logger }) {
       importance: m.importance,
       source: m.source,
       created_at: m.created_at,
-      updated_at: m.updated_at
+      updated_at: m.updated_at,
+      // v0.8.0 A2：scope 标注与事件发生时间透出——条件展开（未标注行不带键，
+      // DTO 与 A2 前逐字节同形；带 undefined 键会被 in-process schema 校验
+      // 判违规，JSON 序列化虽会丢弃但形状不稳定）。
+      ...(m.agent_scope !== undefined ? { agent_scope: m.agent_scope } : {}),
+      ...(m.workspace_scope !== undefined ? { workspace_scope: m.workspace_scope } : {}),
+      ...(m.sensitivity !== undefined ? { sensitivity: m.sensitivity } : {}),
+      ...(m.occurred_at !== undefined ? { occurred_at: m.occurred_at } : {})
     }));
   }
 
@@ -1195,7 +1496,8 @@ export function createService({ store, mirror, config, onWrite, logger }) {
         // （保留现有 storeChanged 逻辑）
         const storeChanged = edit.updated_at !== undefined && m.updated_at !== edit.updated_at;
         if (storeChanged) {
-          const marker = `\n\n> ⚠️ 并发冲突：人工编辑 vs 记忆库并发更新（${m.updated_at}）\n> 记忆库版本：${m.content}`;
+          // 三方合并保留双方时的冲突批注：随实例语言，写进记忆正文。
+          const marker = STR.serviceConflictMarker[language](m.updated_at, m.content);
           store.update(m.id, { title: edit.title, content: `${edit.content}${marker}` });
         } else {
           store.update(m.id, { title: edit.title, content: edit.content });
@@ -1423,6 +1725,62 @@ export function createService({ store, mirror, config, onWrite, logger }) {
     }
   }
 
+  // 返回字面量与内部裁决器（resolveConflictPending → applyDecisions 的 conflict
+  // 处置）共用的写路径：mirror 同步、写通知、嵌入调度全部同源，不能各写一份。
+  function updateMemory(id, p, ctx = {}) {
+    const old = store.getById(id);
+    // Issue #135 附属发现 2：质量过滤器把「为什么被降权/归档」写在系统信号标签
+    // 上（SIGNAL_TAGS，applyQualityDisposition 以并集写入），而这里整组替换
+    // tags——任何带 tags 的更新都会抹掉这条唯一的审计线索（报告实测 150 条低分
+    // 记忆里恰好缺的 2 条就是被 update 过的，并因此误判过归档来源）。把 existing
+    // 的系统信号标签并集保留；用户自传的标签照常生效。
+    const patch = (p && Array.isArray(p.tags) && old && Array.isArray(old.tags))
+      ? { ...p, tags: [...new Set([...p.tags, ...old.tags.filter((t) => SIGNAL_TAGS.includes(t))])] }
+      : p;
+    const updated = store.update(id, patch);
+    // Record a user correction when any meaningful field changed and the
+    // reflection failure tracker is enabled. expected = what it became,
+    // actual = what it was before; query (when provided) captures the
+    // user's original intent so later reflection can reason about recall.
+    const hasMeaningfulChange = old && updated && (
+      old.content !== updated.content ||
+      old.title !== updated.title ||
+      old.importance !== updated.importance
+    );
+    if (hasMeaningfulChange && config.reflectionFailureTracking) {
+      store.saveFailure({
+        id: randomUUID(),
+        query: ctx.query ?? null,
+        expected: updated.content,
+        actual: old.content,
+        before: { title: old.title, content: old.content, importance: old.importance },
+        failure_type: "user_correction",
+        memory_id: id
+      });
+    }
+    const sync = afterSync("write");
+    notifyWrite();
+    scheduleEmbed(updated);
+    // Audit peer B: when the mirror sync failed, the store write landed but
+    // the mirror did not converge — return an explicit degraded receipt rather
+    // than a plain success. Non-enumerable so existing deepEqual assertions on
+    // the memory shape keep passing.
+    if (!sync?.success && !sync?.deferred) {
+      Object.defineProperty(updated, "_mirror", {
+        value: { status: "degraded", error: sync?.error ?? "mirror sync failed" },
+        enumerable: false,
+        configurable: true
+      });
+    }
+    return updated;
+  }
+
+  function archiveMemory(id, f) {
+    const updated = store.setArchived(id, f);
+    afterSync("write");
+    return updated;
+  }
+
   return {
     saveWithDedupe,
     recoverMirror,
@@ -1431,6 +1789,7 @@ export function createService({ store, mirror, config, onWrite, logger }) {
     injectCandidates,
     mergeHumanEdits,
     toApiList,
+    isVisibleInScope,
     transaction,
     enqueue,
     setDreamHook(fn) { dreamHook = fn; },
@@ -1467,6 +1826,7 @@ export function createService({ store, mirror, config, onWrite, logger }) {
     setRecallRecorder(fn) { recallRecorder = fn; },
     searchMemories,
     embedQuery,
+    findSessionDuplicate,
     evaluateRetrieval,
     computeRetrievalMetrics,
     // passthroughs used by tools and api layers; mutations keep the mirror in sync
@@ -1482,45 +1842,7 @@ export function createService({ store, mirror, config, onWrite, logger }) {
       afterSync("write");
       notifyWrite();
     },
-    update: (id, p, ctx = {}) => {
-      const old = store.getById(id);
-      const updated = store.update(id, p);
-      // Record a user correction when any meaningful field changed and the
-      // reflection failure tracker is enabled. expected = what it became,
-      // actual = what it was before; query (when provided) captures the
-      // user's original intent so later reflection can reason about recall.
-      const hasMeaningfulChange = old && updated && (
-        old.content !== updated.content ||
-        old.title !== updated.title ||
-        old.importance !== updated.importance
-      );
-      if (hasMeaningfulChange && config.reflectionFailureTracking) {
-        store.saveFailure({
-          id: randomUUID(),
-          query: ctx.query ?? null,
-          expected: updated.content,
-          actual: old.content,
-          before: { title: old.title, content: old.content, importance: old.importance },
-          failure_type: "user_correction",
-          memory_id: id
-        });
-      }
-      const sync = afterSync("write");
-      notifyWrite();
-      scheduleEmbed(updated);
-      // Audit peer B: when the mirror sync failed, the store write landed but
-      // the mirror did not converge — return an explicit degraded receipt rather
-      // than a plain success. Non-enumerable so existing deepEqual assertions on
-      // the memory shape keep passing.
-      if (!sync?.success && !sync?.deferred) {
-        Object.defineProperty(updated, "_mirror", {
-          value: { status: "degraded", error: sync?.error ?? "mirror sync failed" },
-          enumerable: false,
-          configurable: true
-        });
-      }
-      return updated;
-    },
+    update: updateMemory,
     // Compare-and-set update: applies the patch only when the row still carries
     // `expectedUpdatedAt`. Returns undefined on a miss (no write) so the caller
     // can re-read and retry — the primitive that prevents lost updates across
@@ -1563,11 +1885,7 @@ export function createService({ store, mirror, config, onWrite, logger }) {
       afterSync("write");
       return updated;
     },
-    setArchived: (id, f) => {
-      const updated = store.setArchived(id, f);
-      afterSync("write");
-      return updated;
-    },
+    setArchived: archiveMemory,
     // sleep-mode storage (v0.4.0). demoteToSummary / restoreContent mutate
     // content so they ride the normal write-hook path (mirror re-renders).
     // touchLastAccess is a read-stamp — deliberately NO write hook (a recall
@@ -1599,7 +1917,8 @@ export function createService({ store, mirror, config, onWrite, logger }) {
     // above: an audit write, never a write-hook-triggering memory mutation).
     saveConflictPending: (r) => store.saveConflictPending(r),
     listConflictPending: (opts) => store.listConflictPending(opts),
-    resolveConflictPending: (id, o) => store.resolveConflictPending(id, o),
+    listConflictQueue,
+    resolveConflictPending,
     countConflictPending: () => store.countConflictPending(),
     // Recall evaluation trail (方案 B): audit-bookkeeping semantics like the
     // dream/recall passthroughs above — a recall_evals write is a snapshot, not

package/src/settings.js

@@ -64,6 +64,13 @@ const FEATURE_FLAG_BOOLEANS = [
   // Issue #89：宽容校验回归（默认开）+ 跨类型合并显式放宽（默认关）。
   "dreamSkipInvalid",
   "allowCrossTypeMerge",
+  // Issue #17（v0.8.0 A1）：scope 隔离存储层总开关。开启后写入标注
+  // agent_scope/workspace_scope、去重键扩展（含 sensitivity）；检索侧过滤在
+  // A2/A3。默认关=行为与 A1 前逐字节一致。
+  "scopeEnabled",
+  // Issue #17（v0.8.0 A3）：strictScope 硬过滤——他 scope 完全不可见（关闭时
+  // 为 A2 软隔离：降权保留可见）。
+  "strictScope",
   // 嵌套对象开关：config.js 里是 memoryQualityFilter / llmAudit 对象的 enabled
   // 子字段。kv 按点号键平铺存（"memoryQualityFilter.enabled": false），index.js
   // 合并时展开回嵌套对象，api.js 的 effective 从对象子字段取值。
@@ -78,7 +85,21 @@ const FEATURE_FLAG_INT_RANGES = {
   distillMaxChars: [1000, 200000],
   codingBoostFactor: [1, 5],
   dreamMinIntervalMinutes: [0, 10080],
-  dreamMaxTokens: [256, 131072]
+  dreamMaxTokens: [256, 131072],
+  // Issue #127：autoSummarize 节流三键（0 = 零行为变化，等同现状）。
+  summarizeMinIntervalMinutes: [0, 10080],
+  summarizeMaxEntriesPerRun: [0, 50],
+  summarizeDedupeWindowHours: [0, 168],
+  // Issue #125：hybrid 候选量上限（0 = 复用 dreamMaxSnapshotSize）。
+  dreamCandidateMax: [0, 5000]
+};
+// 浮点开关的闭区间（与 config.js 的 z.number().min().max() 对齐）。与整数开关
+// 分开：面板的整数控件要求 Number.isInteger，而余弦相似度阈值必须允许小数。
+const FEATURE_FLAG_NUMBER_RANGES = {
+  // Issue #127：vector 去重档的并入阈值。
+  summarizeDedupeMinSim: [0.5, 0.99],
+  // Issue #125：hybrid 判"高相似"的阈值。
+  dreamCandidateMinSim: [0.5, 0.99]
 };
 // 自由字符串开关（与 config.js 的 z.string() 同名同型）：trim 后 ≤200 字符，
 // 空串合法（= 跟随主对话模型/默认路径，面板显示 placeholder）。
@@ -106,7 +127,13 @@ const FEATURE_FLAG_ENUMS = {
   // rank/scale-aware alternatives selected by the panel.
   recallFusion: ["blend", "rrf", "minmax"],
   // 实体抽取思考强度（issue #109）：与 dreamReasoningEffort 枚举对齐。
-  entityExtractionReasoning: ["low", "medium", "high", "none"]
+  entityExtractionReasoning: ["low", "medium", "high", "none"],
+  // Issue #127：落库前去重档位（off 默认，等同现状）。
+  summarizeDedupeMode: ["off", "title", "vector"],
+  // Issue #126：sleep 冲突阶段的动作集（conflict 默认 = 现状；full = 六分支）。
+  sleepActionSet: ["conflict", "full"],
+  // Issue #125：dream 候选集构造方式（window 默认 = 现状；hybrid 并入向量组）。
+  dreamCandidateMode: ["window", "hybrid"]
 };
 const FEATURE_FLAG_STRING_MAX = 200;
 
@@ -114,6 +141,7 @@ const FEATURE_FLAG_STRING_MAX = 200;
 export const FEATURE_FLAG_SPEC = {
   booleans: FEATURE_FLAG_BOOLEANS,
   ints: FEATURE_FLAG_INT_RANGES,
+  numbers: FEATURE_FLAG_NUMBER_RANGES,
   strings: FEATURE_FLAG_STRINGS,
   urls: FEATURE_FLAG_URLS,
   enums: FEATURE_FLAG_ENUMS
@@ -145,6 +173,14 @@ function validateFlag(key, value) {
     }
     return value;
   }
+  const numRange = FEATURE_FLAG_NUMBER_RANGES[key];
+  if (numRange) {
+    const [min, max] = numRange;
+    if (typeof value !== "number" || !Number.isFinite(value) || value < min || value > max) {
+      throw new TypeError(`feature flag "${key}" must be a number in [${min}, ${max}]`);
+    }
+    return value;
+  }
   if (FEATURE_FLAG_STRINGS.includes(key)) {
     if (typeof value !== "string") {
       throw new TypeError(`feature flag "${key}" must be a string`);
@@ -185,6 +221,11 @@ function sanitizeFlags(raw) {
   for (const [key, [min, max]] of Object.entries(FEATURE_FLAG_INT_RANGES)) {
     if (Number.isInteger(raw[key]) && raw[key] >= min && raw[key] <= max) out[key] = raw[key];
   }
+  for (const [key, [min, max]] of Object.entries(FEATURE_FLAG_NUMBER_RANGES)) {
+    if (typeof raw[key] === "number" && Number.isFinite(raw[key]) && raw[key] >= min && raw[key] <= max) {
+      out[key] = raw[key];
+    }
+  }
   for (const key of FEATURE_FLAG_STRINGS) {
     if (typeof raw[key] === "string" && raw[key].trim().length <= FEATURE_FLAG_STRING_MAX) {
       out[key] = raw[key].trim();