dsh-agent-board 1.7.6 → 1.7.7

package/test/helpers/mock-ctx.mjs

@@ -9,7 +9,8 @@
 //   · subagents.start(provider, req)            → 一次性 run（result promise 由测试驱动落定/拒绝）
 //   · subagents.startContinuable({...})         → { childId, messageId }（持久子会话，turn 结算走 emitStatus）
 //   · subagents.sendMessage / interrupt / listChildren → 记录器 + 可剧本化
-//   · agents.currentInitiator()/roots()/list()/isOwnedBy() → 按测试剧本返回（缺省单 root，actor=root）
+//   · agents.currentInitiator()/roots()/list()/get()/isOwnedBy() → 按测试剧本返回（缺省单 root，actor=root；env.setRoots 可清空模拟休眠）
+//   · ctx.get('sessionPersistence')             → 持久会话表 stat(id)（env.persistedHeaders 可写 parentSession 模拟子会话/根会话）
 //   · tools.register / webServer.register       → 捕获工具表与 RPC 路由（env.rpc 走真 readBody/handler 路径）
 //   · ctx.get('systemPrompt'|'llm')             → 记录器（注册了什么段/查了什么模型都留痕）
 //   · ctx.effect / ctx.on('agent/status')       → 真实执行 + disposer 收口 / 事件捕获与重放
@@ -48,6 +49,8 @@ import { Readable } from 'node:stream'
  * @property {Object} spSections     systemPrompt 注册段记录器
  * @property {Object} llm            llm 记录器（listProviders/listModels 调用留痕）
  * @property {string} actor          currentInitiator 返回值（缺省=root sid；测试可改写模拟子代理身份）
+ * @property {(list:Object[])=>void} setRoots  改写活跃 root 集（传 [] 模拟休眠根会话/重建窗口）
+ * @property {Object} persistedHeaders  持久会话表 sid → { id, parentSession }（写 parentSession 模拟子会话；缺省根会话 parentSession=undefined）
  * @property {()=>Object} board      读当前看板文件 JSON（不存在返回 null）
  * @property {(id:string)=>Object|undefined} task  看板里按 id 取任务
  * @property {(fn:Function, label?:string, timeoutMs?:number)=>Promise<any>} waitFor  真实时间轮询直到条件为真（默认 5s 上限）
@@ -188,10 +191,14 @@ export function createMockCtx(opts) {
     // whenIdle 刻意不实现：flushReceipts 走「无空闲门控 → 立即投递」分支（45s 窗口到点即投，可断言）
   }
   var env // 前向引用（currentInitiator 读 env.actor）
+  var rootsList = [root] // 活跃 root 集（测试可 env.setRoots([]) 清空模拟「休眠根会话」）
+  var persistedHeaders = {} // 持久会话表 sid → SessionHeader（测试可写 parentSession 模拟子会话/根会话）
+  persistedHeaders[sid] = { id: sid, parentSession: undefined }
   var agents = {
     currentInitiator: function () { return { id: env.actor } },
-    roots: function () { return [root] },
-    list: function () { return [root] },
+    roots: function () { return rootsList },
+    list: function () { return rootsList.slice() },
+    get: function (id) { for (var i = 0; i < rootsList.length; i++) { if (String(rootsList[i].id) === String(id)) return rootsList[i] } return undefined },
     isOwnedBy: function () { return false },
   }
 
@@ -228,6 +235,11 @@ export function createMockCtx(opts) {
           listModels: async function (p) { llmCalls.listModels.push(p); return [] },
         }
       }
+      if (name === 'sessionPersistence') {
+        return {
+          stat: async function (id) { var h = persistedHeaders[id]; return h ? { header: h } : undefined },
+        }
+      }
       return undefined
     },
     effect: function (fn) {
@@ -260,6 +272,8 @@ export function createMockCtx(opts) {
     spSections: spSections,
     llm: llmCalls,
     actor: sid,
+    setRoots: function (list) { rootsList = list || [] }, // 清空/改写活跃 root 集（模拟休眠/重建窗口）
+    persistedHeaders: persistedHeaders, // 持久会话表（sid → { id, parentSession }）；写 parentSession 模拟子会话
 
     // 以真 RPC 语义调用捕获的 webServer 路由（POST /dsh-agent-board → readBody → handlers[method]）
     rpc: async function (method, args) {

package/test/review-hints.test.mjs

@@ -0,0 +1,170 @@
+// dsh-agent-board — 风险队列「待你过目」+ 审视摘要区单测（test/review-hints.test.mjs，task-muzikj1y）
+// 覆盖（对应任务断言①~⑥ + 接线）：
+//   ① 四硬信号各命中/不命中（computeReviewHints：驳回/歧义/核心 touches/full 无 acceptance）
+//   ② 软信号平时不计 / 质量异动告警激活期间计入（diff>300 行 + 续跑≥2 次，联动加严）
+//   ③ reviewedAt 幂等落账（mark-reviewed RPC 只写一次）+ get-tasks 现算透出 reviewHint 零落库
+//   ④⑤ 客户端接线（徽章/chip/审视摘要区四块+来源徽标/digest 未过目）源码级 + 产物重组装
+//   ⑥ README 双份逐字一致 + 各补「待你过目」说明
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { readFileSync } from 'node:fs'
+import * as core from '../lib/core.mjs'
+import { createMockCtx } from './helpers/mock-ctx.mjs'
+import * as plugin from '../index.mjs'
+
+// 纯函数测试的任务形态：默认「干净卡」（无驳回/无歧义/无核心 touches/有 acceptance）→ score 0
+function mkTask(over) {
+  return Object.assign({ id: 't1', title: 'T', status: 'resolved', pipeline: 'full', acceptance: 'npm test', touches: [], messages: [], runs: [], rejectCount: 0 }, over || {})
+}
+
+// ===== ① 四硬信号各命中/不命中 =====
+test('① 四硬信号各命中/不命中（computeReviewHints）', () => {
+  // 干净卡 → score 0
+  assert.deepEqual(core.computeReviewHints([mkTask()]), { t1: { score: 0, reasons: [] } })
+  // 硬① 被驳回过：rejectCount>0（canonical 口径）
+  var h1 = core.computeReviewHints([mkTask({ id: 'a', rejectCount: 1 })])
+  assert.equal(h1.a.score, 1); assert.match(h1.a.reasons[0], /驳回/)
+  // 硬① 备选：verification.verdict='rejected'
+  assert.equal(core.computeReviewHints([mkTask({ id: 'a', verification: { verdict: 'rejected' } })]).a.score, 1)
+  // 硬① 备选：messages kind='rejection'
+  assert.equal(core.computeReviewHints([mkTask({ id: 'a', messages: [{ kind: 'rejection', text: 'x' }] })]).a.score, 1)
+  // 硬① 备选：runs 含 rejected 结局（老留档兼容，字面「runs 含 rejected」口径）
+  assert.equal(core.computeReviewHints([mkTask({ id: 'a', runs: [{ outcome: 'rejected' }] })]).a.score, 1)
+  // 硬① 不命中：零驳回
+  assert.equal(core.computeReviewHints([mkTask({ id: 'a', rejectCount: 0, verification: { verdict: 'approved' } })]).a.score, 0)
+  // 硬② 上报过歧义：messages kind='arbitration'
+  var h2 = core.computeReviewHints([mkTask({ id: 'a', messages: [{ kind: 'arbitration', text: 'x' }] })])
+  assert.equal(h2.a.score, 1); assert.match(h2.a.reasons[0], /歧义/)
+  // 硬② 不命中：无 arbitration 包
+  assert.equal(core.computeReviewHints([mkTask({ id: 'a', messages: [{ kind: 'progress', text: 'x' }] })]).a.score, 0)
+  // 硬③ touches 碰核心文件：三种核心文件 basename 各命中
+  assert.equal(core.computeReviewHints([mkTask({ id: 'a', touches: ['lib/dispatch.mjs'] })]).a.score, 1)
+  assert.equal(core.computeReviewHints([mkTask({ id: 'a', touches: ['lib/rpc.mjs'] })]).a.score, 1)
+  assert.equal(core.computeReviewHints([mkTask({ id: 'a', touches: ['core.mjs'] })]).a.score, 1)
+  assert.match(core.computeReviewHints([mkTask({ id: 'a', touches: ['./lib/core.mjs'] })]).a.reasons[0], /核心文件/)
+  // 硬③ 不命中：非核心文件 / glob
+  assert.equal(core.computeReviewHints([mkTask({ id: 'a', touches: ['src/a.mjs'] })]).a.score, 0)
+  assert.equal(core.computeReviewHints([mkTask({ id: 'a', touches: ['*.mjs'] })]).a.score, 0)
+  // 硬④ full 无 acceptance
+  var h4 = core.computeReviewHints([mkTask({ id: 'a', acceptance: '' })])
+  assert.equal(h4.a.score, 1); assert.match(h4.a.reasons[0], /验收脚本/)
+  // 硬④ 不命中：有 acceptance / work 档 / 空白 acceptance 但有内容（trim 后非空不算空）
+  assert.equal(core.computeReviewHints([mkTask({ id: 'a', acceptance: 'node --test' })]).a.score, 0)
+  assert.equal(core.computeReviewHints([mkTask({ id: 'a', acceptance: '', pipeline: 'work' })]).a.score, 0)
+})
+
+// ===== ② 软信号：平时不计 / 告警态计入（联动加严）=====
+test('② 软信号：质量异动告警未激活不计入 / 激活期间计入（diff>300 行 + 续跑≥2 次）', () => {
+  var diff = ' src/a.mjs | 200 +++++++\n 1 file changed, 350 insertions(+), 50 deletions(-)'
+  var t = mkTask({ id: 'a', deliverable: { diff: diff }, runs: [{ role: 'worker', resume: true }, { role: 'worker', resume: true }] })
+  // 平时（告警未激活）：软信号不计入 → score 0
+  assert.equal(core.computeReviewHints([t], {}).a.score, 0)
+  assert.equal(core.computeReviewHints([t], { qualityAlertActive: false }).a.score, 0)
+  // 告警激活：diff(400 行)>300 + 续跑 2 次≥2 → 两条软信号全计入
+  var h = core.computeReviewHints([t], { qualityAlertActive: true })
+  assert.equal(h.a.score, 2)
+  assert.match(h.a.reasons[0], /diff 超 300 行/)
+  assert.match(h.a.reasons[1], /续跑 ≥2 次/)
+  // 阈值边界：恰好 300 行不亮（>300 才亮）；续跑 1 次不亮
+  var diffEdge = ' 1 file changed, 250 insertions(+), 50 deletions(-)' // 300 行
+  assert.equal(core.computeReviewHints([mkTask({ id: 'a', deliverable: { diff: diffEdge } })], { qualityAlertActive: true }).a.score, 0)
+  assert.equal(core.computeReviewHints([mkTask({ id: 'a', runs: [{ resume: true }] })], { qualityAlertActive: true }).a.score, 0)
+  // 硬软叠加：硬④ + 软⑤ + 软⑥ → score 3
+  var tMix = mkTask({ id: 'a', acceptance: '', deliverable: { diff: diff }, runs: [{ resume: true }, { resume: true }] })
+  var hMix = core.computeReviewHints([tMix], { qualityAlertActive: true })
+  assert.equal(hMix.a.score, 3)
+})
+
+// ===== ③ reviewedAt 幂等落账 + get-tasks 现算透出 reviewHint（真 harness）=====
+test('③ mark-reviewed 幂等落账（只写一次）+ get-tasks 现算透出 reviewHint 零落库', async () => {
+  var env = createMockCtx()
+  try {
+    plugin.apply(env.ctx)
+    await env.rpc('create-task', { sessionId: env.sid, id: 'task-rv', title: 'R', description: 'd', pipeline: 'full', acceptance: 'npm test' })
+    assert.equal(env.task('task-rv').reviewedAt, undefined, '初始无 reviewedAt')
+    // 第一次落账
+    var r1 = await env.rpc('mark-reviewed', { sessionId: env.sid, taskId: 'task-rv' })
+    assert.equal(r1.ok, true)
+    var at1 = env.task('task-rv').reviewedAt
+    assert.ok(at1, '第一次落账 reviewedAt')
+    // 幂等：第二次不重写
+    var r2 = await env.rpc('mark-reviewed', { sessionId: env.sid, taskId: 'task-rv' })
+    assert.equal(r2.ok, true)
+    assert.equal(env.task('task-rv').reviewedAt, at1, '第二次调用不重写 reviewedAt')
+    // 未找到任务
+    var r3 = await env.rpc('mark-reviewed', { sessionId: env.sid, taskId: 'nope' })
+    assert.equal(r3.ok, false)
+    // get-tasks 透出 reviewHint（现算，不落盘）
+    await env.rpc('create-task', { sessionId: env.sid, id: 'task-gh', title: 'G', description: 'd', pipeline: 'full', acceptance: 'npm test' })
+    env.patchBoard(function (d) {
+      var t = d.tasks.find(function (x) { return x.id === 'task-gh' })
+      t.rejectCount = 1
+      t.touches = ['lib/core.mjs']
+      t.acceptance = ''
+    })
+    var d = await env.rpc('get-tasks', { sessionId: env.sid })
+    var gh = d.tasks.find(function (x) { return x.id === 'task-gh' })
+    assert.ok(gh.reviewHint, 'get-tasks 透出 reviewHint')
+    assert.equal(gh.reviewHint.score, 3, '驳回 + 核心文件 + 无 acceptance = 3 条硬信号')
+    assert.equal(gh.reviewHint.reasons.length, 3)
+    // 零落库：board 文件不存 reviewHint（现算字段不进盘）
+    var raw = env.board().tasks.find(function (x) { return x.id === 'task-gh' })
+    assert.equal(raw.reviewHint, undefined, 'reviewHint 现算零落库（board 文件不写 reviewHint）')
+  } finally { await env.cleanup() }
+})
+
+// ===== ④⑤⑥ 客户端接线 + 产物重组装 + README 双份（源码级）=====
+test('④⑤ 客户端接线：徽章/chip/审视摘要区四块+来源徽标/digest（源码级 + 产物重组装）', () => {
+  const ksrc = readFileSync(new URL('../lib/client/kernel.js', import.meta.url), 'utf8')
+  const bl = readFileSync(new URL('../lib/client/board-list.js', import.meta.url), 'utf8')
+  const td = readFileSync(new URL('../lib/client/task-detail.js', import.meta.url), 'utf8')
+  const dash = readFileSync(new URL('../lib/client/dashboard.js', import.meta.url), 'utf8')
+  const built = readFileSync(new URL('../lib/client.js', import.meta.url), 'utf8')
+  // kernel：单一事实源谓词 + 过滤接线 + state 默认字段
+  assert.match(ksrc, /function reviewPending\(t\)/)
+  assert.match(ksrc, /state\.filterReview && !reviewPending\(t\)/)
+  assert.match(ksrc, /filterReview: false/)
+  // board-list：chip「待你过目」+ 「建议过目」徽章
+  assert.ok(bl.indexOf('待你过目') >= 0, 'FilterBar 缺「待你过目」chip')
+  assert.ok(bl.indexOf('👁 建议过目') >= 0, '缺「建议过目」徽章')
+  assert.match(bl, /reviewPending\(t\) \?/)
+  // task-detail：审视摘要区四块 + 来源徽标 + mark-reviewed 触发
+  assert.ok(td.indexOf('tskb-review-summary') >= 0, '缺审视摘要区容器 id')
+  assert.ok(td.indexOf('① 为什么在这') >= 0, '缺四问①')
+  assert.ok(td.indexOf('② 改了什么') >= 0, '缺四问②')
+  assert.ok(td.indexOf('③ 机器怎么验的') >= 0, '缺四问③')
+  assert.ok(td.indexOf('④ 怎么亲自确认') >= 0, '缺四问④')
+  assert.ok(td.indexOf('Worker 汇报') >= 0, '缺「Worker 汇报」来源徽标')
+  assert.ok(td.indexOf('Verifier 实证') >= 0, '缺「Verifier 实证」来源徽标')
+  assert.ok(td.indexOf('系统记录') >= 0, '缺「系统记录」来源徽标')
+  assert.match(td, /rpc\('mark-reviewed'/)
+  // dashboard：digest 未过目计数 + buildReport 行
+  assert.match(dash, /reviewPending\(t\)/)
+  assert.ok(dash.indexOf('- 未过目：') >= 0, '报告缺「未过目」行')
+  // 产物重组装：关键标记逐一出现在 lib/client.js
+  for (const m of ['待你过目', '👁 建议过目', 'tskb-review-summary', '- 未过目：']) {
+    assert.ok(built.indexOf(m) >= 0, 'client.js 缺标记：' + m + '（需 npm run build-client 重组装）')
+  }
+})
+
+test('接线：core 纯函数 + rpc get-tasks 现算 + mark-reviewed（源码级）', () => {
+  const rpc = readFileSync(new URL('../lib/rpc.mjs', import.meta.url), 'utf8')
+  const coreSrc = readFileSync(new URL('../lib/core.mjs', import.meta.url), 'utf8')
+  assert.match(coreSrc, /export function computeReviewHints\(tasks, opts\)/)
+  assert.match(coreSrc, /export var REVIEW_CORE_FILES = \['dispatch\.mjs', 'rpc\.mjs', 'core\.mjs'\]/)
+  assert.match(rpc, /core\.computeReviewHints\(d\.tasks, \{ qualityAlertActive: __qch\.length > 0 \}\)/)
+  assert.match(rpc, /handle\('mark-reviewed'/)
+  assert.match(rpc, /if \(!t\.reviewedAt\) t\.reviewedAt = new Date\(\)\.toISOString\(\)/)
+  // tasksHash 序列化口径纳入 reviewedAt + reviewHint（已阅/软信号联动才能重渲染）
+  assert.match(coreSrc, /t\.reviewedAt,/)
+  assert.match(coreSrc, /t\.reviewHint \? String\(t\.reviewHint\.score\)/)
+})
+
+test('⑥ README 双份：逐字一致 + 各补「待你过目」说明', () => {
+  const r1 = readFileSync(new URL('../../../README.md', import.meta.url), 'utf8')
+  const r2 = readFileSync(new URL('../README.md', import.meta.url), 'utf8')
+  assert.equal(r1, r2, 'README 双份必须逐字一致（npm run sync-readme）')
+  assert.ok(r1.indexOf('待你过目') >= 0, 'README 缺「待你过目」说明')
+  assert.ok(r1.indexOf('审视摘要') >= 0, 'README 缺「审视摘要」说明')
+  assert.ok(r1.indexOf('reviewHint') >= 0, 'README 缺 reviewHint 说明')
+})

package/test/store-data-safety.test.mjs

@@ -0,0 +1,112 @@
+// dsh-agent-board — 看板数据安全 P0 根修测试（task-mv0bl9vg）
+// 三件套：① 原子写盘（tmp+fsync+rename+unlink 兜底）② 腐坏隔离可见化（err hint + notify）
+//         ③ 自动 salvage 截断抢救（JSON.parse 报错 position 截断法）。
+// 全部跑在真实 index.mjs apply(mockCtx) 上；每个用例独立 mockCtx + 独立临时 HOME（HOME 是进程级，严禁并行）。
+// 建卡后不推进虚拟时钟 → 不触发派发，无 worker spawn 噪声。
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import path from 'node:path'
+import { createMockCtx } from './helpers/mock-ctx.mjs'
+import * as plugin from '../index.mjs'
+
+function boardFile(env) { return path.join(env.home, '.dsh', 'tasks-' + env.sid + '.json') }
+
+// 建卡封装：显式 description 避开空描述软提示
+async function createTask(env, id, extra) {
+  var args = { sessionId: env.sid, id: id, title: '数据安全卡 ' + id, description: '看板数据安全根修测试' }
+  if (extra) { for (var k in extra) args[k] = extra[k] }
+  var r = await env.rpc('create-task', args)
+  assert.equal(r.ok, true, 'create-task 成功: ' + id)
+  return r.task
+}
+
+// ===== ① 原子写：源码断言 + 行为级（rename 瞬断后旧文件不被撕裂）=====
+test('① 原子写（源码级）：store.mjs 写盘含 tmp+fsync+rename+unlink 兜底', () => {
+  var sto = fs.readFileSync(new URL('../lib/store.mjs', import.meta.url), 'utf8')
+  assert.match(sto, /async function writeTmpFsync/)        // fsync 专用写 tmp helper
+  assert.match(sto, /fh\.sync\(\)/)                         // fsync 落盘（先于 rename）
+  assert.match(sto, /fsNode\.promises\.rename\(tmp, p\)/)   // tmp → rename 覆盖目标
+  assert.match(sto, /unlinkRetry\(p, 6\)/)                  // 直覆失败降级 unlink 兜底
+  assert.match(sto, /降级 unlink\+rename/)                  // 降级记录（不静默）
+})
+
+test('① 原子写（行为级）：rename 瞬断（EBUSY 一次）→ 旧文件全程完整，退避重试后写回', async () => {
+  var env = createMockCtx()
+  plugin.apply(env.ctx)
+  var origRename = fs.promises.rename
+  try {
+    await createTask(env, 'a1')
+    var p = boardFile(env)
+    assert.equal(JSON.parse(fs.readFileSync(p, 'utf8')).tasks.length, 1, '初始一张卡，文件是完整 JSON')
+    // 注入一次瞬断：首次 rename 到主板路径时同步读盘取证 → 抛 EBUSY；之后恢复原样
+    var injected = false
+    var duringRename = null
+    fs.promises.rename = async function (from, to) {
+      if (!injected && String(to) === p) {
+        injected = true
+        duringRename = fs.readFileSync(p, 'utf8')           // 瞬断时刻主板文件内容取证
+        var e = new Error('EBUSY injected'); e.code = 'EBUSY'; throw e
+      }
+      return origRename.call(fs.promises, from, to)
+    }
+    await createTask(env, 'a2')
+    var after = JSON.parse(fs.readFileSync(p, 'utf8'))
+    assert.equal(after.tasks.length, 2, '退避重试后写盘成功，最终内容完整（未撕裂）')
+    assert.ok(injected, '瞬断确实被注入')
+    assert.equal(JSON.parse(duringRename).tasks.length, 1, '瞬断时刻旧文件仍是完整旧 JSON（rename 原子，绝不半写）')
+  } finally {
+    fs.promises.rename = origRename
+    await env.cleanup()
+  }
+})
+
+// ===== ② 腐坏隔离：坏文件 → 隔离 .corrupt + err hint + notify（不再静默）=====
+test('② 腐坏隔离：无法抢救的坏文件 → 隔离留档 + err hint + notify owner', async () => {
+  var env = createMockCtx()
+  plugin.apply(env.ctx)
+  try {
+    await createTask(env, 'b1')
+    var p = boardFile(env)
+    // 构造「无法抢救」的坏文件：单对象中部截断（无 position 可截 → salvage 失败 → 隔离）
+    fs.writeFileSync(p, '{"ownerSession":"' + env.sid + '","tasks":[{"id":"x"}', 'utf8')
+    var d = await env.rpc('get-tasks', { sessionId: env.sid })
+    assert.ok(Array.isArray(d.tasks) && d.tasks.length === 0, '隔离后空板重启')
+    var errHint = (d.healthHints || []).find(function (h) { return h && h.level === 'err' })
+    assert.ok(errHint, '隔离产出 err 级 hint')
+    assert.match(errHint.text, /腐坏已隔离/)
+    assert.match(errHint.text, /\.corrupt-/)
+    var corrupts = fs.readdirSync(path.join(env.home, '.dsh')).filter(function (f) { return f.indexOf('.corrupt-') >= 0 })
+    assert.equal(corrupts.length, 1, '坏文件已改名 .corrupt-<ts> 留档')
+    var msg = env.sent.find(function (m) { return m && m.content && /腐坏已隔离/.test(m.content[0].text) })
+    assert.ok(msg, 'notify 通知 owner 会话（不再静默）')
+  } finally { await env.cleanup() }
+})
+
+// ===== ③ 自动 salvage：完整 JSON + 撕裂残片 → 截断抢救出第一段完整板 =====
+test('③ 自动 salvage：完整 JSON 尾部夹杂撕裂残片 → 截断抢救出第一段完整板并写回', async () => {
+  var env = createMockCtx()
+  plugin.apply(env.ctx)
+  try {
+    await createTask(env, 'c1')
+    await createTask(env, 'c2')
+    await createTask(env, 'c3')
+    var p = boardFile(env)
+    var good = fs.readFileSync(p, 'utf8')
+    assert.equal(JSON.parse(good).tasks.length, 3, '前置：三张卡落盘')
+    // 构造真实腐坏样本形态：完整 JSON 尾部夹杂「另一版本残片」（未闭合的第二个 JSON 值）
+    var torn = good + '{"ownerSession":"' + env.sid + '","tasks":[{"id":"c4","title":"撕裂残片","status":"pend'
+    fs.writeFileSync(p, torn, 'utf8')
+    var d = await env.rpc('get-tasks', { sessionId: env.sid })
+    assert.equal(d.tasks.length, 3, '抢救出完整第一段（3 张卡），丢弃撕裂残片')
+    var after = JSON.parse(fs.readFileSync(p, 'utf8'))
+    assert.equal(after.tasks.length, 3, '抢救结果已原子写回主板文件（不再反复 poison）')
+    var errHint = (d.healthHints || []).find(function (h) { return h && h.level === 'err' })
+    assert.ok(errHint, '抢救产出 err 级 hint')
+    assert.match(errHint.text, /抢救保留 3 张卡/)
+    var corrupts = fs.readdirSync(path.join(env.home, '.dsh')).filter(function (f) { return f.indexOf('.corrupt-') >= 0 })
+    assert.equal(corrupts.length, 1, '原始撕裂文件已留档 .corrupt-<ts>')
+    var msg = env.sent.find(function (m) { return m && m.content && /抢救/.test(m.content[0].text) })
+    assert.ok(msg, 'notify 通知 owner（抢救型）')
+  } finally { await env.cleanup() }
+})

package/test/verify-timing.test.mjs

@@ -0,0 +1,266 @@
+// dsh-agent-board — 验收时序三洞根修（用户 n-mv0ebretgv1o）：task_verify 抢跑守卫 + 归档门禁查活跃 run + 迟到 verdict 落账
+// 事故：主窗口在 Verifier 活跃期 task_verify 抢批（早 0.4s）+ 归档，Verifier 的 verdict/自测指南被静默吞掉、无回执。
+// 三洞逐一锁：① 抢跑守卫（force 通道）② 归档门禁查活跃 run ③ 迟到 verdict 落 lateVerdict/回执/userTest 补挂。
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { createRpc } from '../lib/rpc.mjs'
+import { createDispatch } from '../lib/dispatch.mjs'
+import * as core from '../lib/core.mjs'
+
+const FULL_SID = 'session-mock-timing-00000000-0001'
+
+function mkTask(over) { return Object.assign({ id: 't1', title: 'T', description: '', status: 'pending', priority: 'medium', tags: [], parentId: null, assignMode: 'auto', assignee: null, context: { instructions: '' }, acceptance: '', dependsOn: [], pipeline: 'full', claimedBy: null, claimedAt: null, createdAt: '2026-01-01T00:00:00Z', resolvedAt: null, history: [], messages: [] }, over || {}) }
+function mkBoard(tasks) { return { version: 11, ownerSession: FULL_SID, boardMode: 'auto', verifyUserGuide: true, tasks: tasks || [] } }
+
+function waitFor(fn, label, ms) {
+  var t0 = Date.now(); var cap = ms || 2000
+  var p = function () { return new Promise(function (r) { setTimeout(r, 5) }) }
+  return (async function () {
+    for (;;) {
+      var v; try { v = await fn() } catch (_) { v = null }
+      if (v) return v
+      if (Date.now() - t0 > cap) throw new Error('waitFor 超时（' + cap + 'ms）: ' + (label || '(未命名)'))
+      await p()
+    }
+  })()
+}
+
+// ===== RPC/工具直调 harness（board_verdict / task_verify / archive-task / batch-op 三洞行为）=====
+function mkRpcHarness(board, runsTable, extra) {
+  const state = { handlers: {}, teamModeCache: {}, feedbackCache: {}, epicSplitCache: {}, poolHealth: {} }
+  const tools = {}
+  const lateRejects = []
+  const ctx = { tools: { register(t) { tools[t.name] = t } }, effect() {}, webServer: { register() { return () => {} } } }
+  const deps = Object.assign({
+    getActorId: () => 'tester', resolveRoot: (x) => x,
+    toolSessionId: () => FULL_SID, rpcSessionId: () => FULL_SID,
+    rootForSession: () => null, deriveWorkMode: () => 'solo',
+    runsFor: (sid) => (runsTable[sid] || {}),
+    rt: async () => board, mutateLocked: (sid, fn) => fn(board),
+    maybeNotify: () => {}, notifyTaskDone: () => {},
+    spawnOneShot: () => {}, accumulateRunUsage: () => {}, readContextPack: async () => null,
+    pushSysNote: () => {}, sessionCwd: () => '',
+    hasActiveRun: () => false,
+    notifyLateReject: (sid, t) => { lateRejects.push({ sid: sid, id: t.id }) },
+  }, extra || {})
+  createRpc(ctx, state, deps)
+  state.handlers.__tools = tools
+  state.handlers.__lateRejects = lateRejects
+  state.handlers.__state = state
+  return state.handlers
+}
+
+// ===== dispatch harness（settleVerifier 文本通道迟到落账）=====
+function mkSettleHarness(board) {
+  var runs = {}
+  var resolveRun = null
+  var boardRef = { b: board }
+  var lateRejects = []
+  var state = { knownSessions: {}, dispatchedEver: {}, badModels: {}, teamModeCache: {}, activeRuns: {}, poolHealth: {} }
+  var ctx = {
+    fs: {}, effect: function () {}, get: function () { return null }, timer: null,
+    subagents: {
+      list: function () { return ['mock'] },
+      getProvider: function () { return { inheritsParentContext: false } },
+      start: async function () { return { id: 'run-v1', result: new Promise(function (res) { resolveRun = res }), dispose: async function () {} } },
+    },
+  }
+  var dispatch = createDispatch(ctx, state, {
+    rt: async function () { return boardRef.b }, wt: async function () {}, mutateLocked: async function (sid, fn) { return fn(boardRef.b) },
+    kickCycle: function () {}, rootForSession: function () { return { id: FULL_SID } }, sessionCwd: function () { return '' },
+    withTimeout: function (p) { return p }, runsFor: function () { return runs }, feedbackOn: function () { return true }, epicSplitOn: function () { return true },
+    pushSysNote: function () {}, maybeNotify: function () {}, notifyTaskDone: function () {},
+    notifyLateReject: function (sid, t) { lateRejects.push(t.id) },
+  })
+  return { dispatch: dispatch, state: state, lateRejects: lateRejects, settle: function (text) { resolveRun({ output: [{ type: 'text', text: text }], stopReason: 'completed' }) } }
+}
+
+// ===== ① task_verify / verify-task 抢跑守卫 =====
+test('① 抢跑守卫：verifier 活跃 → task_verify 工具 + verify-task RPC 拦截；force:true 放行；已 settled 不拦', async () => {
+  // RPC 通道：活跃 verifier rec → 拦截
+  const board = mkBoard([mkTask({ id: 'v1', status: 'verifying' })])
+  const runs = { [FULL_SID]: { 'v1': { id: 'run-v1', role: 'verifier', settled: false } } }
+  const h = mkRpcHarness(board, runs)
+  const r = await h['verify-task']({ taskId: 'v1', verdict: 'approved' })
+  assert.equal(r.ok, false)
+  assert.match(r.error, /Verifier 还在跑（run run-v1）/); assert.match(r.error, /force:true/)
+  assert.equal(board.tasks[0].status, 'verifying') // 未放行，状态不动
+  // RPC 通道：force:true → 放行
+  const r2 = await h['verify-task']({ taskId: 'v1', verdict: 'approved', force: true })
+  assert.equal(r2.ok, true); assert.equal(board.tasks[0].status, 'resolved')
+  // 工具通道同口径
+  const board2 = mkBoard([mkTask({ id: 'v2', status: 'verifying' })])
+  const runs2 = { [FULL_SID]: { 'v2': { id: 'run-v2', role: 'verifier', settled: false } } }
+  const h2 = mkRpcHarness(board2, runs2)
+  const r3 = await h2.__tools['task_verify'].execute({ taskId: 'v2', verdict: 'approved' }, {})
+  assert.equal(r3.ok, false); assert.match(r3.error, /Verifier 还在跑（run run-v2）/); assert.equal(r3.verifierActive, 'run-v2')
+  const r4 = await h2.__tools['task_verify'].execute({ taskId: 'v2', verdict: 'approved', force: true }, {})
+  assert.equal(r4.ok, true); assert.equal(board2.tasks[0].status, 'resolved')
+  // 已 settled 的 rec（Verifier 已结束）→ 不拦截
+  const board3 = mkBoard([mkTask({ id: 'v3', status: 'verifying' })])
+  const runs3 = { [FULL_SID]: { 'v3': { id: 'run-v3', role: 'verifier', settled: true } } }
+  const h3 = mkRpcHarness(board3, runs3)
+  const r5 = await h3['verify-task']({ taskId: 'v3', verdict: 'approved' })
+  assert.equal(r5.ok, true)
+})
+
+// ===== ② 归档门禁查活跃 run =====
+test('② 归档门禁：resolved 卡有活跃 verifier run（内存 rec / 卡面 running 留档）→ 拒绝；无活跃 run 放行', async () => {
+  // 内存活跃表（最实时）
+  const board = mkBoard([mkTask({ id: 'a1', status: 'resolved', verifiedAt: '2026-01-01T00:01:00Z', verifiedBy: 'tester', verifierRun: 'run-v' })])
+  const runs = { [FULL_SID]: { 'a1': { id: 'run-v', role: 'verifier', settled: false } } }
+  const h = mkRpcHarness(board, runs)
+  const r = await h['archive-task']({ taskId: 'a1' })
+  assert.equal(r.ok, false)
+  assert.match(r.error, /有活跃 run（verifier run-v 仍在跑）/); assert.match(r.error, /等它落定或先 terminate/)
+  assert.equal(board.tasks[0].status, 'resolved') // 未归档
+  // 卡面 runs 留档兜底（无内存 rec，但 outcome running 且无 endedAt 且 id 匹配 verifierRun）
+  const board2 = mkBoard([mkTask({ id: 'a2', status: 'resolved', verifiedAt: 'x', verifierRun: 'run-v2', runs: [{ role: 'verifier', id: 'run-v2', outcome: 'running' }] })])
+  const h2 = mkRpcHarness(board2, {})
+  const r2 = await h2['archive-task']({ taskId: 'a2' })
+  assert.equal(r2.ok, false); assert.match(r2.error, /有活跃 run（verifier run-v2 仍在跑）/)
+  // resolved 无活跃 run → 放行（既有行为不破）
+  const board3 = mkBoard([mkTask({ id: 'a3', status: 'resolved' })])
+  const h3 = mkRpcHarness(board3, {})
+  const r3 = await h3['archive-task']({ taskId: 'a3' })
+  assert.equal(r3.ok, true); assert.equal(board3.tasks[0].status, 'archived')
+  // batch-op archive 同门禁
+  const board4 = mkBoard([mkTask({ id: 'b1', status: 'resolved', verifierRun: 'run-b', runs: [{ role: 'verifier', id: 'run-b', outcome: 'running' }] }), mkTask({ id: 'b2', status: 'resolved' })])
+  const h4 = mkRpcHarness(board4, {})
+  const r4 = await h4['batch-op']({ op: 'archive', ids: ['b1', 'b2'] })
+  assert.equal(r4.ok, true); assert.equal(r4.done, 1)
+  assert.deepEqual(r4.skipped, ['b1']); assert.match(r4.reasons['b1'], /有活跃 run/)
+})
+
+// ===== ② 归档门禁 × terminate 语义死结回归（Verifier 驳回回归根修）=====
+test('② 回归：terminate verifier → verifierRun 认领位清空，归档不再误判活跃（此前永久无法归档死结）', async () => {
+  const board = mkBoard([mkTask({ id: 'a4', status: 'verifying', verifierRun: 'run-vX', runs: [{ role: 'verifier', id: 'run-vX', outcome: 'running' }] })])
+  const runs = { [FULL_SID]: { 'a4': { id: 'run-vX', role: 'verifier', settled: false } } }
+  const h = mkRpcHarness(board, runs)
+  // 终止：内存表摘除 + 认领位清空（与 in-progress 清 claimedBy 同口径）
+  const r = await h['terminate-agent']({ taskId: 'a4' })
+  assert.equal(r.ok, true); assert.equal(r.terminated, 'verifier:a4')
+  assert.equal(board.tasks[0].verifierRun, null)
+  assert.equal(board.tasks[0].verifierRunAt, undefined)
+  // 终止后主窗口补批（无需 force：已无活跃 verifier）→ resolved
+  const r2 = await h.__tools['task_verify'].execute({ taskId: 'a4', verdict: 'approved' }, {})
+  assert.equal(r2.ok, true); assert.equal(board.tasks[0].status, 'resolved')
+  // 归档：修复前这里会因卡面 run-vX 仍 running 而误报「有活跃 run」并永久拒绝
+  const r3 = await h['archive-task']({ taskId: 'a4' })
+  assert.equal(r3.ok, true); assert.equal(board.tasks[0].status, 'archived')
+})
+
+test('② 回归：无活跃 rec 的 stale verifying 卡（terminate 空转场景）→ terminate 仍清 verifierRun，解除死结', async () => {
+  const board = mkBoard([mkTask({ id: 'a5', status: 'verifying', verifierRun: 'run-vX', runs: [{ role: 'verifier', id: 'run-vX', outcome: 'running' }] })])
+  const h = mkRpcHarness(board, {}) // 内存表空：rec 已不在（重启/已摘），正是报错文案推荐「先 terminate」却空转的场景
+  const r = await h['terminate-agent']({ taskId: 'a5' })
+  assert.equal(r.ok, true); assert.equal(r.terminated, 'no-active-run')
+  assert.equal(board.tasks[0].verifierRun, null) // 认领位仍被清空 → 卡面兜底不再误判
+  const r2 = await h.__tools['task_verify'].execute({ taskId: 'a5', verdict: 'approved' }, {})
+  assert.equal(r2.ok, true); assert.equal(board.tasks[0].status, 'resolved')
+  const r3 = await h['archive-task']({ taskId: 'a5' })
+  assert.equal(r3.ok, true); assert.equal(board.tasks[0].status, 'archived')
+})
+
+// ===== ③④⑤ 迟到 verdict 落账（工具通道 board_verdict）=====
+test('③ 迟到 approved：board_verdict 落到已 resolved 卡 → 落 lateVerdict，不炸、状态不动', async () => {
+  const board = mkBoard([mkTask({ id: 'l1', status: 'resolved', verifiedAt: '2026-01-01T00:01:00Z' })])
+  const h = mkRpcHarness(board, {})
+  const r = await h.__tools['board_verdict'].execute({ taskId: 'l1', verdict: 'approved', summary: '复跑通过', checks: '## 核对项\n- ok' }, {})
+  assert.equal(r.ok, true); assert.equal(r.late, true); assert.equal(r.lateRejected, false)
+  const t = board.tasks[0]
+  assert.equal(t.status, 'resolved') // 状态不动
+  assert.equal(t.lateVerdict.verdict, 'approved')
+  assert.equal(t.lateVerdict.summary, '复跑通过')
+  assert.match(t.lateVerdict.note, /迟到结论：卡在落定后收到/)
+  // 已落定卡上的 board_verdict 不触发正常回执/重派（返回体带 late 旗即可，无报错）
+})
+
+test('④ 迟到 rejected + 卡已 approved：board_verdict → err 通知 + healthHint（lateRejectNote）', async () => {
+  const board = mkBoard([mkTask({ id: 'l2', status: 'resolved', verifiedAt: '2026-01-01T00:01:00Z' })])
+  const h = mkRpcHarness(board, {})
+  const r = await h.__tools['board_verdict'].execute({ taskId: 'l2', verdict: 'rejected', summary: '单测没过', checks: '## 核对项\n- 红' }, {})
+  assert.equal(r.ok, true); assert.equal(r.late, true); assert.equal(r.lateRejected, true)
+  const t = board.tasks[0]
+  assert.equal(t.lateVerdict.verdict, 'rejected')
+  // err 通知已投（notifyLateReject 捕获，直投 owner 不走回执聚合）
+  assert.equal(h.__lateRejects.length, 1); assert.equal(h.__lateRejects[0].id, 'l2')
+  // healthHint 落点（poolHealth.lateRejectNote，health.mjs computeRuntimeHealthHints 现算透出）
+  assert.equal(h.__state.poolHealth[FULL_SID].lateRejectNote.taskId, 'l2')
+})
+
+test('⑤ userTest 补挂：迟到结论带 userTest → 补挂 t.verification.userTest；开关关则不挂', async () => {
+  const ut = { gist: '改了验收时序', steps: ['打开看板'], expect: '看到提示', tier: 'ui' }
+  const board = mkBoard([mkTask({ id: 'l3', status: 'resolved', verifiedAt: '2026-01-01T00:01:00Z' })])
+  const h = mkRpcHarness(board, {})
+  await h.__tools['board_verdict'].execute({ taskId: 'l3', verdict: 'rejected', summary: 'x', userTest: ut }, {})
+  const t = board.tasks[0]
+  assert.ok(t.lateVerdict.userTest, 'lateVerdict 挂 userTest')
+  assert.ok(t.verification, '原 verification 缺 → 补建')
+  assert.equal(t.verification.userTest.gist, '改了验收时序')
+  assert.equal(t.verification.verdict, 'rejected') // 补建的 verification 用迟到结论的 verdict 兜底，非空
+  // 开关关 → 不挂 userTest、不补建 verification
+  const board2 = mkBoard([mkTask({ id: 'l4', status: 'resolved', verifiedAt: 'x' })]); board2.verifyUserGuide = false
+  const h2 = mkRpcHarness(board2, {})
+  await h2.__tools['board_verdict'].execute({ taskId: 'l4', verdict: 'rejected', summary: 'x', userTest: ut }, {})
+  const t2 = board2.tasks[0]
+  assert.equal(t2.lateVerdict.userTest, undefined)
+  assert.equal(t2.verification, undefined)
+})
+
+// ===== ③④ 迟到 verdict 落账（文本通道 settleVerifier）=====
+test('③④ settleVerifier 迟到：主窗口抢批 resolved 后 Verifier 迟到 REJECTED → 落 lateVerdict + 通知 + healthHint', async () => {
+  const t = mkTask({ id: 's1', status: 'verifying' })
+  const board = mkBoard([t])
+  const h = mkSettleHarness(board)
+  await h.dispatch.poolCycle(FULL_SID)
+  assert.equal(t.verifierRun, 'run-v1') // 已派 Verifier
+  // 主窗口抢批（早于 verifier 结算）：直接把卡置 resolved（等价 task_verify force approved，不写 t.verification）
+  t.status = 'resolved'; t.verifiedAt = '2026-01-01T00:01:00Z'; t.verifiedBy = 'tester'
+  h.settle('REJECTED: 交付物与验收脚本不符\n\n## 测试概要\nnpm test 未跑通\n\n## 核对项\n- 断言①红')
+  await waitFor(function () { return t.lateVerdict }, 'settleVerifier 迟到落 lateVerdict')
+  assert.equal(t.lateVerdict.verdict, 'rejected')
+  assert.match(t.lateVerdict.summary, /npm test 未跑通/)
+  assert.match(t.lateVerdict.checks, /断言①红/)
+  assert.match(t.lateVerdict.note, /迟到结论/)
+  // err 通知 + healthHint
+  assert.equal(h.lateRejects.length, 1); assert.equal(h.lateRejects[0], 's1')
+  assert.equal(h.state.poolHealth[FULL_SID].lateRejectNote.taskId, 's1')
+  // 状态不被迟到的驳回改写（仍 resolved，不再回 pending 重派）
+  assert.equal(t.status, 'resolved')
+})
+
+test('settleVerifier 迟到落账：工具通道已落账（verification.by === rec.id）→ 不重复落 lateVerdict', async () => {
+  const t = mkTask({ id: 's2', status: 'verifying' })
+  const board = mkBoard([t])
+  const h = mkSettleHarness(board)
+  await h.dispatch.poolCycle(FULL_SID)
+  assert.equal(t.verifierRun, 'run-v1')
+  // 模拟 board_verdict 工具通道已落账（by = 本 run 的 rec.id）并推进到 resolved
+  t.verification = { verdict: 'approved', summary: 'OK', checks: '', at: '2026-01-01T00:01:00Z', by: 'run-v1' }
+  t.status = 'resolved'; t.verifiedAt = '2026-01-01T00:01:00Z'
+  h.settle('APPROVED: ok')
+  await new Promise(function (r) { setTimeout(r, 50) }) // 给结算链一点时间跑完，确认不落 lateVerdict
+  assert.equal(t.lateVerdict, undefined)
+  assert.equal(t.verification.verdict, 'approved') // 原结论不被覆盖
+})
+
+// ===== 纯函数口径：lateVerdictApply wasApproved 判定 =====
+test('lateVerdictApply：wasApproved 口径（resolved / archived-from-resolved / archived-from-cancelled）', () => {
+  // resolved → approved
+  const t1 = mkTask({ id: 'p1', status: 'resolved', verifiedAt: 'x' })
+  assert.equal(core.lateVerdictApply(t1, 'rejected', 's', 'c', null, 'at', 'by', true).wasApproved, true)
+  // archived 且带 verifiedAt → approved
+  const t2 = mkTask({ id: 'p2', status: 'archived', verifiedAt: 'x' })
+  assert.equal(core.lateVerdictApply(t2, 'rejected', 's', 'c', null, 'at', 'by', true).wasApproved, true)
+  // archived 无 approved 痕迹（从 cancelled 归档）→ 非 approved
+  const t3 = mkTask({ id: 'p3', status: 'archived' })
+  assert.equal(core.lateVerdictApply(t3, 'rejected', 's', 'c', null, 'at', 'by', true).wasApproved, false)
+  // cancelled → 非 approved
+  const t4 = mkTask({ id: 'p4', status: 'cancelled' })
+  assert.equal(core.lateVerdictApply(t4, 'rejected', 's', 'c', null, 'at', 'by', true).wasApproved, false)
+  // approved verdict → lateRejected false
+  const t5 = mkTask({ id: 'p5', status: 'resolved', verifiedAt: 'x' })
+  const r5 = core.lateVerdictApply(t5, 'approved', 's', 'c', null, 'at', 'by', true)
+  assert.equal(r5.lateRejected, false); assert.equal(r5.wasApproved, true)
+})