dsh-instruction-memory 1.4.8 → 1.5.0

package/CHANGELOG.md

@@ -7,6 +7,55 @@
 > 1.0.13 起由 CI 经 OIDC Trusted Publishing 发布（首个带 provenance 的版本）。
 > 这些历史 tag **不应回填**——npm 上的版本号已被占用。
 
+## [1.5.0] — 2026-11-04
+
+针对 2026-11-04 全面复核（数据安全 / 并发 / 注入 / SMTP / 设置面板）逐项修复。主线是
+**“合法 JSON 但不是本插件的存储”这一整类输入**：1.4.8 会把 `[]`、`123`、`{"version":"3"}`
+当作未声明格式的空 store 载入，然后在用户下一次保存时用空库覆盖磁盘。
+
+### 数据安全
+
+- **存储形状门**：新增 `storeShapeVerdict()`，区分「不是对象」「对象但不是本插件的存储」
+  「空对象」「合规存储」。前两种不再被采纳，写入被暂停并给出可操作的提示；用户可经历史回滚 /
+  备份整体替换 / 修正文件后重新载入恢复，首次成功写盘后自动解除。
+- **`.bak` 轮转守卫兑现注释承诺**：旧实现只验 `JSON.parse`，畸形主文件会覆盖唯一的好备份；
+  现在只有通过形状门的文件才配称为“上一版备份”。
+- **版本声明收紧**：`{"version":"3"}`、`{"version":"2.0"}` 这类字符串声明不再被当作“未声明版本”
+  而静默降级覆盖，一律拒绝写入。
+- **`adoptParsedStore` 改用同一形状判定**（导入 / 整体替换路径）。
+- **旧位置迁移**：cwd 里的历史文件不是存储时忽略并保留原文件，不再迁移。
+
+### 并发与持久性
+
+- **锁回收不再误删**：陈旧锁在 `unlink` 前二次 `stat` 比对 mtime/size，`LOCK_STALE_MS` 10s → 30s。
+- **临时文件唯一化**：`memory.json.tmp-<pid>-<uuid>`，两个进程不会再写同一个临时文件。
+- **落盘栅栏**：tmp 写入 `fsync`，备份复制后 `fsync`，`rename` 后对目录 `fsync`。
+- **重载后强制真写盘**：`readFromDisk` 重置 `lastPersistedKey`，消除“内容巧合相同 → 跳写却报
+  saved:true”导致的面板与磁盘分叉；跳写分支同步更新 `savedAt`。
+- 历史清理的设备预算与全局兜底在注释中改为如实描述（跨设备删除是有意保留的例外）。
+
+### 注入与快照
+
+- `buildProfilesBlock` 删除死变量；`snapshot()` 的 `injection.profiles` 恢复 `truncated` 标记。
+
+### 反馈邮件（零依赖 SMTP）
+
+- EHLO 失败（500/502/504）回落 HELO。
+- 多行响应以最后一行的状态码为准；跨 TCP 块的 UTF-8 用 `StringDecoder` 解码。
+- 服务器未声明 LOGIN/PLAIN 时直接给出机制清单，不再盲目发 `AUTH LOGIN`。
+- `Message-ID` 只接受形如 `local@domain` 的值，其余回退生成；加解密与投递统一走 `mailboxVerdict`。
+
+### 设置面板
+
+- **乱序响应不再回退视图**：`absorb()` 拒绝 rev 更旧的快照。
+- **初始加载失败可自愈**：lite 帧在 `view === null` 时也触发重新拉取，并新增「重新载入」按钮。
+- **冲突后不再无限重试**：源码保存的 `baseRev` 在冲突响应后同步为最新 rev；单条记忆在冲突时
+  会先请求确认再覆盖对方修改。
+- **`busy` 改为计数**：首个返回的请求不再提前解锁按钮。
+- **卸载后不再 setState**：组件级 `disposed` 标志。
+- **历史回滚先过体积门**，确认文案带上快照文件名；**切换记忆集前检查用户形象草稿**是否未保存。
+- `normalizeResult` 校验 `data` 是对象且 `entries` 是数组；`resolveSlots()` 的异常不再逃出挂载守卫。
+
 ## [1.4.8] — 2026-11-03
 
 针对 2026-11-03 三方复核（架构 / 安全 / 验收）下达的 R1–R11 逐项修复，以及同日第二轮复核

package/lib/client.js

@@ -260,6 +260,7 @@ window.__ModuleLoader__.load({
         'panel.title': '指令记忆',
         'panel.subtitle': '保存后自动写入系统提示词，对此后所有对话、问答与任务执行生效。',
         'panel.loading': '正在读取指令记忆…',
+        'panel.retry': '重新载入',
         'panel.masterSwitch': '总开关',
         'status.mounted': '已挂载到系统提示词——后续每轮对话自动生效（{chars} 字符）',
         'status.notMountedEmpty': '未挂载：当前没有启用中的指令',
@@ -291,6 +292,7 @@ window.__ModuleLoader__.load({
         'editor.cancel': '取消',
         'editor.hint': '保存后对下一轮对话立即生效',
         'editor.needTitleOrContent': '请至少填写标题或指令内容',
+        'editor.conflictOverwrite': '这条记忆刚被其他窗口或进程修改过。继续保存会用你当前的编辑内容覆盖对方的修改，确定要继续吗？',
         'editor.confirmDiscard': '当前编辑内容尚未保存，确定放弃这些修改吗？',
         'confirm.unavailable': '当前环境无法弹出确认对话框，操作已取消，未做任何改动。',
         'body.expand': '展开全部',
@@ -493,7 +495,7 @@ window.__ModuleLoader__.load({
         'history.itemMetaLite': '{size} KB（文件较大，未统计条目数）',
         'history.foreign': '来自其他设备（{device}）',
         'history.restore': '回滚到此版本',
-        'history.restoreConfirm': '确定把当前记忆整体回滚到 {time} 的快照（rev {rev}）？当前内容仍保留在 memory.json.bak 中，且回滚本身会生成一份新快照，可以再回滚回来。',
+        'history.restoreConfirm': '确定把当前记忆整体回滚到 {time} 的快照（rev {rev}，文件 {name}）？当前内容仍保留在 memory.json.bak 中，且回滚本身会生成一份新快照，可以再回滚回来。',
         'history.delete': '删除',
         'history.deleteConfirm': '确定删除这份历史快照？删除后无法恢复。',
         'history.dir': '快照目录：{dir}',
@@ -545,6 +547,7 @@ window.__ModuleLoader__.load({
         'panel.title': 'Instruction Memory',
         'panel.subtitle': 'Saved instructions are written into the system prompt and apply to every conversation, answer, and task that follows.',
         'panel.loading': 'Loading instruction memory…',
+        'panel.retry': 'Reload',
         'panel.masterSwitch': 'Master switch',
         'status.mounted': 'Mounted into the system prompt — effective for every turn that follows ({chars} chars)',
         'status.notMountedEmpty': 'Not mounted: no enabled instructions',
@@ -576,6 +579,7 @@ window.__ModuleLoader__.load({
         'editor.cancel': 'Cancel',
         'editor.hint': 'Takes effect for the next conversation turn once saved',
         'editor.needTitleOrContent': 'Fill in at least a title or the instruction content',
+        'editor.conflictOverwrite': 'Another window or process just changed this entry. Saving now replaces their edit with yours. Continue?',
         'editor.confirmDiscard': 'The draft has unsaved changes. Discard them?',
         'confirm.unavailable': 'This shell cannot show a confirmation dialog, so the action was cancelled and nothing changed.',
         'body.expand': 'Show all',
@@ -778,7 +782,7 @@ window.__ModuleLoader__.load({
         'history.itemMetaLite': '{size} KB (file too large to count items)',
         'history.foreign': 'From another device ({device})',
         'history.restore': 'Roll back to this',
-        'history.restoreConfirm': 'Roll the whole memory back to the snapshot from {time} (rev {rev})? The current content stays in memory.json.bak, and the rollback itself creates a new snapshot, so you can roll forward again.',
+        'history.restoreConfirm': 'Roll the whole memory back to the snapshot from {time} (rev {rev}, file {name})? The current content stays in memory.json.bak, and the rollback itself creates a new snapshot, so you can roll forward again.',
         'history.delete': 'Delete',
         'history.deleteConfirm': 'Delete this snapshot? This cannot be undone.',
         'history.dir': 'Snapshot folder: {dir}',
@@ -1165,10 +1169,16 @@ window.__ModuleLoader__.load({
      */
     function normalizeResult(result) {
       if (result === null || typeof result !== 'object') return null
-      const snapshot = result.snapshot !== undefined && result.snapshot !== null ? result.snapshot : result
+      const hasEnvelope = result.snapshot !== undefined && result.snapshot !== null
+      const snapshot = hasEnvelope ? result.snapshot : result
       // data === null passes a typeof check but poisons every consumer that
       // reads data.budgetChars; it is exactly as unusable as a missing data.
-      if (snapshot === null || typeof snapshot !== 'object' || snapshot.data === undefined || snapshot.data === null) return null
+      if (snapshot === null || typeof snapshot !== 'object' || Array.isArray(snapshot)) return null
+      const data = snapshot.data
+      if (data === undefined || data === null || typeof data !== 'object' || Array.isArray(data)) return null
+      // Every consumer reads data.entries and sortEntries() calls .slice() on
+      // it; a non-array threw mid-render instead of surfacing a readable error.
+      if (!Array.isArray(data.entries)) return null
       return {
         snapshot,
         ok: result.ok !== false,
@@ -1986,6 +1996,14 @@ window.__ModuleLoader__.load({
           setError(t('err.unrecognized'))
           return
         }
+        // Out-of-order responses: an older request can resolve after a newer one
+        // (an SSE-triggered refresh racing a POST reply) and would restore a
+        // stale snapshot over fresher data. rev only ever increases, so a
+        // snapshot older than the one already rendered is dropped. Equal revs
+        // are still absorbed — they are the same state.
+        const nextRev = revOfFrom(normalized.snapshot)
+        const currentRev = revOf()
+        if (typeof nextRev === 'number' && typeof currentRev === 'number' && nextRev < currentRev) return
         setView(normalized.snapshot)
         viewRef.current = normalized.snapshot
         // Keep the user's in-progress budget edit when a push arrives while
@@ -2007,17 +2025,29 @@ window.__ModuleLoader__.load({
         }
       }
 
+      // A single boolean was cleared by whichever request finished first, which
+      // re-enabled every button while other requests were still in flight.
+      const pendingRef = React.useRef(0)
+      // The panel can be unmounted while a request is in flight; setState after
+      // unmount is a no-op in React 18 but it also loses the error the user
+      // needed to see. Track disposal so late responses are dropped.
+      const disposedRef = React.useRef(false)
+      React.useEffect(() => () => { disposedRef.current = true }, [])
+
       async function send(method, args) {
+        pendingRef.current += 1
         setBusy(true)
         try {
           const result = await callHost(method, args)
+          if (disposedRef.current) return null
           absorb(result)
           return result
         } catch (err) {
-          setError(String(err && err.message ? err.message : err))
+          if (!disposedRef.current) setError(String(err && err.message ? err.message : err))
           return null
         } finally {
-          setBusy(false)
+          pendingRef.current = Math.max(0, pendingRef.current - 1)
+          if (pendingRef.current === 0 && !disposedRef.current) setBusy(false)
         }
       }
 
@@ -2140,6 +2170,13 @@ window.__ModuleLoader__.load({
       /** Switch the active set. The one click that changes what is injected. */
       function switchSet(id) {
         if (busy || id === '') return
+        // A switch closes every open form. The entry editor has always asked
+        // before discarding; the persona editor did not, so a typed persona was
+        // silently discarded while the entry form next to it would have asked.
+        const openProfile = profileDraftRef.current
+        if (openProfile !== null
+          && profileIsDirty(openProfile, view !== null && Array.isArray(view.data.profiles) ? view.data.profiles : [])
+          && !confirmDiscard()) return
         void send('set-active-set', { id, baseRev: revOf() }).then((result) => {
           // A switch invalidates any list selection: the ids belong to the set
           // that is no longer displayed.
@@ -2226,8 +2263,17 @@ window.__ModuleLoader__.load({
 
       function rollbackTo(item) {
         if (busy) return
+        // Restoring makes the Host read a whole file; a snapshot far larger
+        // than any real store is refused BEFORE the user confirms an operation
+        // that cannot succeed.
+        const sizeVerdict = importSizeVerdict(Number(item.bytes),
+          view !== null && view.limits !== null && typeof view.limits === 'object' ? view.limits.maxBodyChars : undefined)
+        if (!sizeVerdict.ok) {
+          setError(sizeVerdict.message)
+          return
+        }
         const when = new Date(item.epoch).toLocaleString()
-        const ask = askConfirm(t('history.restoreConfirm', { time: when, rev: item.rev }))
+        const ask = askConfirm(t('history.restoreConfirm', { time: when, rev: item.rev, name: item.name }))
         if (ask !== CONFIRM_YES) {
           if (ask === CONFIRM_UNAVAILABLE) setError(t('confirm.unavailable'))
           return
@@ -2377,11 +2423,16 @@ window.__ModuleLoader__.load({
       function saveSource() {
         if (busy) return
         void send('write-source', { text: sourceText, baseRev: sourceBaseRev }).then((result) => {
-          if (result === null || result.ok !== true) return
+          if (result === null) return
+          // A conflict response carries the FRESH snapshot. Keeping the old
+          // baseRev made every retry conflict again against a rev the Host had
+          // already told us about — an unwinnable loop with no way forward.
+          const freshRev = revOfFrom(result.snapshot)
+          if (typeof freshRev === 'number') setSourceBaseRev(freshRev)
+          if (result.ok !== true) return
           // The draft now matches the committed store, so the rev it is based
           // on must move with it — otherwise the very next save would be
           // refused as a conflict against our own write.
-          setSourceBaseRev(revOfFrom(result.snapshot))
           sourceBaselineRef.current = sourceText
           void loadHistory()
         })
@@ -2584,9 +2635,13 @@ window.__ModuleLoader__.load({
             const pushed = JSON.parse(ev.data)
             if (pushed !== null && typeof pushed === 'object' && pushed.lite === true) {
               const current = viewRef.current
-              // A null view means the initial POST `state` is still in flight;
-              // its response already carries the current rev.
-              if (current !== null && current.data !== null && current.data.rev !== pushed.rev) refresh()
+              // A null view used to be ignored here on the assumption that the
+              // initial POST `state` is always in flight. When that request
+              // failed, nothing ever refetched and the panel stayed on its
+              // loading text for the rest of the session. A lite frame proves
+              // the Host is alive, so it is a safe trigger to retry.
+              if (current === null) refresh()
+              else if (current.data !== null && current.data.rev !== pushed.rev) refresh()
               return
             }
             if (sameSnapshot(pushed, viewRef.current)) return
@@ -2600,7 +2655,11 @@ window.__ModuleLoader__.load({
 
       if (view === null) {
         return h('div', { className: 'im-root' },
-          h('div', { className: 'im-empty' }, error === '' ? t('panel.loading') : error))
+          h('div', { className: 'im-empty' }, error === '' ? t('panel.loading') : error),
+          error === ''
+            ? null
+            : h('div', { className: 'im-row im-row-end' },
+              h('button', { type: 'button', className: 'im-btn', onClick: () => { setError(''); send('state', null) } }, t('panel.retry'))))
       }
 
       if (draft !== null) {
@@ -2618,13 +2677,26 @@ window.__ModuleLoader__.load({
               setDraft(null); setError('')
             },
             onSave: () => {
+              if (busy) return
               if (draft.title.trim() === '' && draft.content.trim() === '') {
                 setError(t('editor.needTitleOrContent'))
                 return
               }
-              send('save-entry', { entry: draft, baseRev: revOf() }).then((result) => {
-                if (result && result.ok === true) { setDraft(null); setError('') }
-              })
+              const commit = (baseRev, allowOverwrite) => {
+                void send('save-entry', { entry: draft, baseRev }).then((result) => {
+                  if (result === null) return
+                  if (result.ok === true) { setDraft(null); setError(''); return }
+                  // The Host refuses a write built on a stale rev and answers
+                  // with the fresh snapshot (already absorbed into the view).
+                  // Retrying on our own would replace the other window's edit
+                  // with this draft — a silent overwrite. Ask first, and only
+                  // then retry against the rev we just learned.
+                  if (result.conflict === true && !allowOverwrite) {
+                    if (askConfirm(t('editor.conflictOverwrite'), 'allow') === CONFIRM_YES) commit(revOf(), true)
+                  }
+                })
+              }
+              commit(revOf(), false)
             },
           }),
           // The editor is an early return, so it must render its OWN error
@@ -3707,7 +3779,18 @@ window.__ModuleLoader__.load({
       // published before or after this plugin activates.
       runtimeCtx = ctx
 
-      const resolveSlots = () => (ctx.slots !== undefined ? ctx.slots : ctx.get('slots'))
+      const resolveSlots = () => {
+        // ctx.get() can throw on a disposed context, and this call sits outside
+        // safeMount's try — an escaping throw here killed the retry timer with
+        // no message anywhere.
+        try {
+          return ctx.slots !== undefined ? ctx.slots : ctx.get('slots')
+        } catch (err) {
+          console.error('[instruction-memory] 读取 slots 服务失败：'
+            + (err !== null && err !== undefined && typeof err.message === 'string' ? err.message : String(err)))
+          return undefined
+        }
+      }
 
       // A retry can fire after the fiber was disposed (plugin disabled, host
       // shutting down); registering into a dead context throws, and an uncaught

package/lib/index.js

@@ -25,7 +25,7 @@
  * user-chosen backup directory (F18).
  */
 
-import { chmod, copyFile, mkdir, readdir, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises'
+import { chmod, copyFile, mkdir, open, readdir, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises'
 import { readFileSync, realpathSync, statSync, watch } from 'node:fs'
 import { randomUUID } from 'node:crypto'
 import { isIP } from 'node:net'
@@ -102,6 +102,17 @@ const MAX_HISTORY = 20
  * when it alone exceeds the budget.
  */
 const MAX_HISTORY_BYTES = 32 * 1024 * 1024
+/**
+ * The largest single snapshot this build will READ back. Every other read path
+ * is bounded (the store by MAX_BODY_CHARS, exports by their own ceilings); the
+ * restore path historically was not, so a corrupt or hostile file in the
+ * history directory could be pulled whole into memory by one click. Snapshots
+ * are serialised stores, so this sits above the store ceiling with room to
+ * spare while still refusing an absurd file.
+ */
+const MAX_HISTORY_FILE_BYTES = 8 * 1024 * 1024
+/** The feedback config is a handful of keys; anything near this is not one. */
+const MAX_FEEDBACK_CONFIG_BYTES = 1024 * 1024
 /**
  * F7: the longest single pause. Doubles as the setTimeout guard — 7 days is
  * far below the 2^31-1 ms (≈24.8 days) timer ceiling, so the delay never
@@ -288,6 +299,14 @@ export function expandDisplayPath(value, home = homedir(), platform = process.pl
  * .bak — and only the last two may never be treated as "no memory yet".
  */
 const EMPTY_STORE_CODE = 'EEMPTYSTORE'
+/**
+ * A primary that parses as JSON but is not a store at all. Same role as
+ * EMPTY_STORE_CODE, for the state JSON.parse cannot flag: the file is valid
+ * JSON, so "it read" says nothing about whether it is a store. Keeping it a
+ * distinct code is what lets the .bak rotation refuse to copy it over the last
+ * good backup while leaving the file itself untouched for hand repair.
+ */
+const NOT_A_STORE_CODE = 'ENOTASTORE'
 
 const DEFAULT_BUDGET = 4000
 const MIN_BUDGET = 800
@@ -371,8 +390,14 @@ export const LIMITS = Object.freeze({
   maxFeedbackContact: FEEDBACK_LIMITS.maxContact,
 })
 
-/** How long a crashed holder's `memory.json.lock` may block writes before it is stolen. */
-const LOCK_STALE_MS = 10_000
+/**
+ * How long a crashed holder's `memory.json.lock` may block writes before it is
+ * stolen. This must exceed the worst-case hold time (tmp write + two copies +
+ * rename + a large history snapshot), so a LIVE slow holder is not mistaken for
+ * debris and swept mid-write: the reclaim path re-checks stat identity, but a
+ * wide margin is cheaper than relying on that.
+ */
+const LOCK_STALE_MS = 30_000
 /** How long a write waits for the cross-process lock before proceeding unlocked. */
 const LOCK_WAIT_MS = 2_000
 /** Coalescing window for store-directory watcher events before a re-read. */
@@ -775,6 +800,40 @@ const describeValue = (value) => {
  * `dropped`: the next save persists the corrected values, so the user must be
  * told their hand edit did not survive verbatim.
  */
+/**
+ * Does this PARSED json carry a store's shape, as opposed to merely being
+ * valid JSON?
+ *
+ * The distinction is load-bearing: a file that parses but is an array, a
+ * number, or some other tool's object used to be adopted as "an empty
+ * memory" with no warning at all, so the very next save wrote that emptiness
+ * back over the user's memory and rotated the result into `.bak`. JSON.parse
+ * answering is not the same question as "is this a store", and every place
+ * that has to ask the second one now asks it here.
+ *
+ * @returns 'store' for anything adoptable, 'empty-object' for a truthy but
+ *   empty store (`{}`, or only option keys — a hand-cleared file), and
+ *   'not-object' / 'not-store' for the two states that must never be adopted.
+ */
+export function storeShapeVerdict(parsed) {
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) return 'not-object'
+  // A declared, supported version is enough on its own: `{"version":2}` is a
+  // store that happens to be empty (and its formatNote says so), not a
+  // foreign file. An unsupported one is handled before this test by the
+  // version gate in normalizeData.
+  if (typeof parsed.version === 'number' && SUPPORTED_VERSIONS.includes(parsed.version)) return 'store'
+  if (Array.isArray(parsed.entries) || Array.isArray(parsed.sets)) return 'store'
+  // Every key is one the loader itself understands: `{}` and `{"rev":3}` are
+  // empty stores, not somebody else's document.
+  const OPTION_KEYS = new Set([
+    'version', 'rev', 'enabled', 'disabledUntil', 'budgetChars',
+    'backupDir', 'activeSetId', 'entries', 'sets', 'profiles',
+  ])
+  const keys = Object.keys(parsed)
+  if (keys.length === 0 || keys.every((key) => OPTION_KEYS.has(key))) return 'empty-object'
+  return 'not-store'
+}
+
 function normalizeData(raw) {
   const data = {
     version: FORMAT_VERSION,
@@ -790,8 +849,18 @@ function normalizeData(raw) {
   }
   const loaded = { data, dropped: 0, droppedProfiles: 0, droppedSets: 0, reattributed: 0, optionFixes: [], formatNote: null }
   if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) return loaded
-  if (typeof raw.version === 'number' && !SUPPORTED_VERSIONS.includes(raw.version)) {
-    return { data, dropped: 0, droppedProfiles: 0, droppedSets: 0, reattributed: 0, optionFixes: [], rejectedVersion: raw.version }
+  // A declared version this build does not support is refused whatever its
+  // TYPE. The old test was `typeof raw.version === 'number'`, so a file
+  // carrying `"2.0"` or `"3"` read as "no version declared" and the next save
+  // rewrote it as the current format — the exact downgrade this gate exists
+  // to prevent, merely reached through a string.
+  if ('version' in raw && raw.version !== null && raw.version !== undefined) {
+    if (!(typeof raw.version === 'number' && SUPPORTED_VERSIONS.includes(raw.version))) {
+      return {
+        data, dropped: 0, droppedProfiles: 0, droppedSets: 0, reattributed: 0, optionFixes: [],
+        rejectedVersion: typeof raw.version === 'number' ? raw.version : String(raw.version),
+      }
+    }
   }
   if (typeof raw.rev === 'number' && Number.isFinite(raw.rev) && raw.rev >= 0) {
     data.rev = Math.round(raw.rev)
@@ -1443,7 +1512,6 @@ function buildProfilesBlock(profiles, budget) {
   const blocks = []
   const items = []
   let used = PERSONA_HEADER.length + 1
-  let omitted = 0
   for (const profile of active) {
     const name = typeof profile.name === 'string' && profile.name !== ''
       ? profile.name
@@ -1475,7 +1543,6 @@ function buildProfilesBlock(profiles, budget) {
       items.push({ id, name, chars: head.length + note.length, truncated: true })
       used += sep + head.length + note.length
     }
-    omitted = active.length - blocks.length
     break
   }
   const text = PERSONA_HEADER + '\n' + blocks.join('\n\n') + footerFor(Math.max(0, active.length - blocks.length))
@@ -1748,6 +1815,15 @@ export function apply(ctx) {
      */
     versionRejected: false,
     rejectedVersion: null,
+    /**
+     * Set while the file on disk parses as JSON but is not a store at all (an
+     * array, a number, another tool's object). Adopting it as "an empty
+     * memory" and then saving over it is precisely the silent-loss chain the
+     * rolling backup exists to survive, so ordinary edits are refused in this
+     * state; the repair doors (history restore, restore-from-backup, import,
+     * source mode) stay open and clear it on the first successful write.
+     */
+    shapeRejected: false,
     sectionRegistered: false,
     sectionError: null,
     /** Whether a store file is actually present on disk (diagnostics + the panel). */
@@ -2459,12 +2535,22 @@ export function apply(ctx) {
         if (err.code !== 'EEXIST') throw err
         const info = await stat(lockPath).catch(() => null)
         if (info !== null && Date.now() - info.mtimeMs > LOCK_STALE_MS) {
-          // Crashed-holder debris. It may be recreated by a live process
-          // between this unlink and the next wx attempt — that case simply
-          // loops and re-evaluates freshness instead of forcing its way in.
-          // A failed unlink must not become a tight loop, so every attempt
-          // still sleeps below.
-          await unlink(lockPath).catch(() => {})
+          // Confirm the marker we are about to delete is STILL the one we just
+          // judged stale. Between the stat above and the unlink a live holder
+          // can release it and a new owner can create a fresh marker; deleting
+          // THAT would unlock a live writer, the same TOCTOU the token closed
+          // on release. The mtime+size re-check makes the sweep ownership-safe
+          // without needing to know the dead holder's token.
+          const after = await stat(lockPath).catch(() => null)
+          if (after !== null && after.mtimeMs === info.mtimeMs && after.size === info.size
+            && Date.now() - after.mtimeMs > LOCK_STALE_MS) {
+            // Crashed-holder debris. It may be recreated by a live process
+            // between this unlink and the next wx attempt — that case simply
+            // loops and re-evaluates freshness instead of forcing its way in.
+            // A failed unlink must not become a tight loop, so every attempt
+            // still sleeps below.
+            await unlink(lockPath).catch(() => {})
+          }
         }
         await new Promise((resolve) => setTimeout(resolve, 50))
       }
@@ -2545,14 +2631,22 @@ export function apply(ctx) {
   let lastPersistedKey = null
 
   /**
-   * Enforce the per-device retention policy: the count and byte ceilings from
-   * planHistoryPrune(). Grouping by the device tag inside the filename is
-   * deliberate: two machines sharing one backup folder (the documented F18
-   * setup) each keep their OWN budget, so one device can never prune the
-   * other's history away. Files that do not match our naming pattern are never
-   * touched. Sizes come from stat() rather than a maintained index because the
-   * directory is shared with other processes and a stale index would prune the
-   * wrong files.
+   * Enforce the retention policy: the count and byte ceilings from
+   * planHistoryPrune(), applied PER DEVICE first. Grouping by the device tag
+   * inside the filename is deliberate: two machines sharing one backup folder
+   * (the documented F18 setup) each keep their OWN budget, so a device that
+   * saves a lot cannot prune a quiet device's history.
+   *
+   * The GLOBAL byte ceiling afterwards is the documented exception to that:
+   * per-device budgets multiply by the number of machines (ten machines = ten
+   * × 32 MB), so the folder as a whole is also bounded, and that pass deletes
+   * the oldest snapshots whichever device they came from. It is disclosed
+   * rather than hidden — the name ordering is chronological across devices
+   * because the stamp is fixed-width UTC.
+   *
+   * Files that do not match our naming pattern are never touched. Sizes come
+   * from stat() rather than a maintained index because the directory is shared
+   * with other processes and a stale index would prune the wrong files.
    */
   const pruneHistory = async (dir) => {
     const names = (await readdir(dir)).filter((name) => HISTORY_FILE_PATTERN.test(name))
@@ -2652,7 +2746,19 @@ export function apply(ctx) {
       const source = await readFile(fileURLToPath(new URL('../' + SCHEMA_FILE_NAME, import.meta.url)), 'utf8')
       const target = join(dirname(storePath), SCHEMA_FILE_NAME)
       const existing = await readFile(target, 'utf8').catch(() => null)
-      if (existing !== source) await writeFile(target, source, 'utf8')
+      if (existing !== source) {
+        // Atomic like the store itself: a crash mid-copy must not leave a
+        // truncated schema for the user's editor to validate against, and the
+        // 0600 bit matches every other file this plugin writes.
+        const tmp = target + '.tmp-' + randomUUID()
+        try {
+          await writeFile(tmp, source, { encoding: 'utf8', mode: 0o600 })
+          await rename(tmp, target)
+        } catch (err) {
+          await unlink(tmp).catch(() => {})
+          throw err
+        }
+      }
     } catch {
       // Best effort by design.
     }
@@ -2673,6 +2779,21 @@ export function apply(ctx) {
     }
   }
 
+  /**
+   * Best-effort durability fence. `rename` is atomic against a crash but NOT
+   * durable on its own: without an fsync the directory entry can reach disk
+   * after the data does, so power loss may leave the previous file or a 0-byte
+   * one even though the save reported success. A failure here is deliberately
+   * not a save failure (the bytes are already in the page cache, and Windows
+   * refuses to open directories at all), so it degrades durability only.
+   */
+  const syncPath = async (target) => {
+    try {
+      const fh = await open(target, 'r')
+      try { await fh.sync() } finally { await fh.close() }
+    } catch { /* unsupported here: durability degrades, correctness does not */ }
+  }
+
   const writeToDisk = async () => {
     // Atomic replace (write a sibling temp file, then rename) with a rolling
     // one-version backup: a crash mid-write must never leave a truncated
@@ -2687,7 +2808,13 @@ export function apply(ctx) {
     // user's memory while their real data sat untouched in .bak. Copying keeps
     // the primary in place until the atomic replace succeeds, so a failure at
     // any step leaves the previous store readable at its own path.
-    const tmpPath = storePath + '.tmp'
+    // A UNIQUE tmp name per attempt: two processes sharing a $DSH_HOME must
+    // never interleave their writes into one temp file. The fixed
+    // `storePath + '.tmp'` meant the second writer's rename could publish a
+    // half-written mix of both serialisations. The lock narrows the window; a
+    // per-attempt name removes the shared resource, so the window cannot
+    // corrupt anything even when the lock is unavailable.
+    const tmpPath = storePath + '.tmp-' + process.pid + '-' + randomUUID()
     let lock = null
     let previousRev = null
     try {
@@ -2730,6 +2857,10 @@ export function apply(ctx) {
       const contentKey = JSON.stringify({ ...persistableData(), rev: 0 })
       if (state.storeExists && lastPersistedKey !== null && contentKey === lastPersistedKey) {
         logDebug('save skipped: the store content did not change')
+        // The caller's "上次保存" clock reports the last successful SAVE, and
+        // this call is one, even though the bytes were already correct. Leaving
+        // it untouched made the panel look stalled after a no-op save.
+        state.savedAt = Date.now()
         return true
       }
       // The rev is bumped before serialising so the file on disk and the state
@@ -2747,7 +2878,15 @@ export function apply(ctx) {
       // user profile) personal notes, so on a multi-user POSIX host it must not
       // land world-readable the way a bare writeFile (0666 & ~umask = 0644)
       // would. Windows ignores the bit and inherits the directory ACL instead.
-      await writeFile(tmpPath, text, { encoding: 'utf8', mode: 0o600 })
+      const tmpHandle = await open(tmpPath, 'w', 0o600)
+      try {
+        await tmpHandle.writeFile(text, 'utf8')
+        // Flush the temp file BEFORE the rename publishes it: otherwise a
+        // power cut can leave the new name pointing at unwritten blocks.
+        await tmpHandle.sync()
+      } finally {
+        await tmpHandle.close()
+      }
       // Both rolling copies stand for the PREVIOUS good version, so both are
       // taken before the atomic replace, and neither may ever be renamed into
       // place (see the long note above).
@@ -2762,8 +2901,22 @@ export function apply(ctx) {
       // discloses it (the .bak may be stale, and the panel says so).
       let hadPrevious = true
       try {
-        await readStoreFile(storePath)
+        const previous = await readStoreFile(storePath)
+        // "Reads as a store", not merely "reads as JSON" — this is the test the
+        // comment above promises. A foreign-but-parseable primary (an array, a
+        // scalar, another tool's object) must NOT be copied over the last good
+        // backup: that is exactly what turns a recoverable state into a
+        // permanent one.
+        const previousShape = storeShapeVerdict(previous)
+        if (previousShape === 'not-object' || previousShape === 'not-store') {
+          const shapeError = new Error('memory.json is not a store (' + previousShape + ')')
+          shapeError.code = NOT_A_STORE_CODE
+          throw shapeError
+        }
         await copyFile(storePath, localBackupPath())
+        // The recovery copy exists to survive a crash; an unflushed copy may
+        // roll back with the very crash it is meant to answer.
+        await syncPath(localBackupPath())
         state.backupError = null
       } catch (err) {
         if (err !== null && err !== undefined && err.code === 'ENOENT') {
@@ -2772,6 +2925,12 @@ export function apply(ctx) {
           // would adopt as an "empty store" — the trap this guard exists for.
           hadPrevious = false
           state.backupError = null
+        } else if (err !== null && err !== undefined && err.code === NOT_A_STORE_CODE) {
+          hadPrevious = false
+          const previous = await stat(localBackupPath()).catch(() => null)
+          state.backupError = previous !== null && previous.size > 0
+            ? 'memory.json 的内容不是记忆存储，已保留上一版备份 ' + localBackupPath() + ' 不被覆盖'
+            : 'memory.json 的内容不是记忆存储，且没有可用的上一版备份'
         } else {
           hadPrevious = false
           const previous = await stat(localBackupPath()).catch(() => null)
@@ -2800,6 +2959,9 @@ export function apply(ctx) {
         await unlink(tmpPath).catch(() => {})
         throw err
       }
+      // Make the directory entry itself durable: without this the rename can be
+      // lost on power failure even though the file contents were flushed.
+      await syncPath(dirname(storePath))
       state.storagePath = storePath
       state.storageDisplay = storePath
       state.storageError = null
@@ -2816,6 +2978,9 @@ export function apply(ctx) {
       // committed, and the store is on disk whatever happens next.
       await writeHistorySnapshot(text, contentKey)
       lastPersistedKey = contentKey
+      // The disk holds a store again, so a "primary is not a store" refusal no
+      // longer describes reality — this is the one place that can prove it.
+      state.shapeRejected = false
       await ensureSchemaFile()
       logDebug('store written: ' + storePath + ' bytes=' + text.length
         + ' entries=' + state.data.entries.length + ' rev=' + state.data.rev
@@ -2891,6 +3056,13 @@ export function apply(ctx) {
     state.storeExists = false
     state.versionRejected = false
     state.rejectedVersion = null
+    state.shapeRejected = false
+    // A reload replaces what "the last persisted content" means. Leaving the
+    // old identity in place made a later save that happened to match the
+    // PRE-reload content skip the write while reporting saved:true, so the disk
+    // and the panel silently disagreed. Forcing the next save to write is the
+    // cheap side of that trade.
+    lastPersistedKey = null
 
     /**
      * A store declaring an unsupported format version: adopt nothing, write
@@ -2914,6 +3086,54 @@ export function apply(ctx) {
       state.storeExists = true
     }
 
+    /**
+     * The primary parses as JSON but is not a store (an array, a scalar, or
+     * another tool's object). Adopt NOTHING from it: the in-memory data — a
+     * freshly booted empty store, or whatever this process already had — stays
+     * authoritative, ordinary edits are refused, and both files stay on disk.
+     * The repair doors (history restore, restore-from-backup, import, source
+     * mode) remain open and clear the flag on the first successful write.
+     */
+    const rejectShape = (describe) => {
+      state.shapeRejected = true
+      state.storageError = 'memory.json 的内容不是本插件的记忆存储：' + describe
+        + '。已暂停写入以免覆盖原文件（原文件已保留）。请用「历史回滚」或「用备份整体替换」恢复，或修正该文件后点「重新载入」'
+      state.loadedFrom = 'memory.json (not a store; writes paused)'
+      state.storeExists = true
+    }
+
+    /**
+     * A primary that is not a store still leaves the rolling backup intact, so
+     * the last good version is usually one file away. Promote it into memory
+     * (never back onto disk here) and disclose both facts: the primary is
+     * foreign, and the panel is temporarily showing the backup.
+     */
+    const recoverFromForeignPrimary = async (shape) => {
+      state.storeExists = true
+      const describe = shape === 'not-object'
+        ? '顶层不是对象（是数组或标量）'
+        : '顶层对象里没有 entries / sets / version 等记忆字段'
+      try {
+        const backup = await readStoreFile(storePath + '.bak')
+        if (backup !== null && storeShapeVerdict(backup) === 'store') {
+          const loaded = normalizeData(backup)
+          if (loaded.rejectedVersion !== undefined) {
+            rejectVersion(loaded.rejectedVersion, 'memory.json.bak')
+            return
+          }
+          state.data = loaded.data
+          const warnings = loadWarnings(loaded)
+          state.storageWarning = (warnings !== null ? warnings + '；' : '')
+            + 'memory.json ' + describe + '，不是本插件的记忆存储（原文件已保留）；已临时回退到最近备份 memory.json.bak'
+          state.loadedFrom = 'memory.json.bak (primary is not a store)'
+          return
+        }
+      } catch {
+        // No usable backup either; refuse rather than guess.
+      }
+      rejectShape(describe)
+    }
+
     // 1. The canonical location under the harness home.
     try {
       const parsed = await readStoreFile(storePath)
@@ -2923,6 +3143,14 @@ export function apply(ctx) {
           rejectVersion(loaded.rejectedVersion, 'memory.json')
           return false
         }
+        // Parsing is not the same as being a store: an array or a foreign
+        // object used to be adopted as "empty memory" with no warning, and the
+        // next save wrote that emptiness back. Never adopt it.
+        const shape = storeShapeVerdict(parsed)
+        if (shape === 'not-object' || shape === 'not-store') {
+          await recoverFromForeignPrimary(shape)
+          return false
+        }
         state.data = loaded.data
         state.storageWarning = loadWarnings(loaded)
         state.loadedFrom = 'memory.json'
@@ -2964,7 +3192,7 @@ export function apply(ctx) {
             : 'memory.json 解析失败（' + describeErrorSafe(err) + '）'
           try {
             const backup = await readStoreFile(storePath + '.bak')
-            if (backup !== null) {
+            if (backup !== null && storeShapeVerdict(backup) === 'store') {
               const loaded = normalizeData(backup)
               if (loaded.rejectedVersion !== undefined) {
                 rejectVersion(loaded.rejectedVersion, 'memory.json.bak')
@@ -3001,7 +3229,7 @@ export function apply(ctx) {
     //     canonical path so the next boot finds it normally.
     try {
       const backup = await readStoreFile(storePath + '.bak')
-      if (backup !== null) {
+      if (backup !== null && storeShapeVerdict(backup) === 'store') {
         const loaded = normalizeData(backup)
         if (loaded.rejectedVersion !== undefined) {
           rejectVersion(loaded.rejectedVersion, 'memory.json.bak')
@@ -3026,22 +3254,29 @@ export function apply(ctx) {
     try {
       const parsed = await readStoreFile(legacyPath)
       if (parsed !== null) {
-        const loaded = normalizeData(parsed)
-        if (loaded.rejectedVersion !== undefined) {
-          // A legacy file in a future format is not ours to migrate or judge.
-          state.storageError = '旧位置文件为不支持的格式版本 ' + loaded.rejectedVersion + '，已忽略'
-          return false
-        }
-        state.data = loaded.data
-        state.storageWarning = loadWarnings(loaded)
-        const migrated = await writeToDisk()
-        if (migrated) {
-          state.migratedFrom = legacyPath
-          // Keep the original as evidence instead of deleting user data.
-          await rename(legacyPath, legacyPath + '.migrated').catch(() => {})
+        const legacyShape = storeShapeVerdict(parsed)
+        if (legacyShape === 'not-object' || legacyShape === 'not-store') {
+          // Some other program's JSON beside the old store path is not a store
+          // to migrate, and must never become memory.json.
+          state.storageError = '旧位置文件不是本插件的记忆存储，已忽略'
+        } else {
+          const loaded = normalizeData(parsed)
+          if (loaded.rejectedVersion !== undefined) {
+            // A legacy file in a future format is not ours to migrate or judge.
+            state.storageError = '旧位置文件为不支持的格式版本 ' + loaded.rejectedVersion + '，已忽略'
+            return false
+          }
+          state.data = loaded.data
+          state.storageWarning = loadWarnings(loaded)
+          const migrated = await writeToDisk()
+          if (migrated) {
+            state.migratedFrom = legacyPath
+            // Keep the original as evidence instead of deleting user data.
+            await rename(legacyPath, legacyPath + '.migrated').catch(() => {})
+          }
+          state.loadedFrom = 'legacy cwd file (migrated)'
+          return migrated
         }
-        state.loadedFrom = 'legacy cwd file (migrated)'
-        return migrated
       }
     } catch (err) {
       // A missing or unreadable legacy file must never block a fresh store.
@@ -3301,9 +3536,16 @@ export function apply(ctx) {
          * Persona section detail: rendered profiles (id/name/chars, in order)
          * and their total size. `entryChars` is the instruction half alone,
          * which is what the budget meter measures; `chars` above stays the
-         * whole section (personas + instructions) for diagnostics.
+         * whole section (personas + instructions) for diagnostics. `truncated`
+         * mirrors the entry list: a persona cut by the injection ceiling has to
+         * be DISCLOSED, or the panel shows full text the model never received.
          */
-        profiles: plan.profiles.map((item) => ({ id: item.id, name: item.name, chars: item.chars })),
+        profiles: plan.profiles.map((item) => ({
+          id: item.id,
+          name: item.name,
+          chars: item.chars,
+          truncated: item.truncated === true,
+        })),
         profileChars: plan.profileChars,
         entryChars: plan.entryChars,
         /**
@@ -3394,6 +3636,20 @@ export function apply(ctx) {
     snapshot: snapshot(),
   })
 
+  /**
+   * Refusal while memory.json parses as JSON but is not a store at all (an
+   * array, a scalar, another tool's object). Same reason as versionRefusal:
+   * a save would rewrite the file in this build's format over content this
+   * build never understood. The repair doors stay open — that is what
+   * `shapeRejected` is for, and why they deliberately skip this check.
+   */
+  const shapeRefusal = () => ({
+    ok: false,
+    saved: false,
+    message: 'memory.json 的内容不是本插件的记忆存储，修改已暂停以免覆盖原文件。请用「历史回滚」或「用备份整体替换」恢复，或修正该文件后点「重新载入」',
+    snapshot: snapshot(),
+  })
+
   /**
    * Adopt a whole parsed store — the shared core of 源码模式 (F16) and the
    * 整体替换 restore (F14). Both hand the user the SAME safety story as every
@@ -3407,17 +3663,23 @@ export function apply(ctx) {
    * before the path existed — must not silently redirect where backups go.
    */
   const adoptParsedStore = (parsed) => {
-    const looksLikeStore = parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)
-      && ['version', 'rev', 'enabled', 'budgetChars', 'backupDir', 'activeSetId', 'sets', 'entries', 'profiles']
-        .some((key) => key in parsed)
-    if (!looksLikeStore) {
+    // Version first. `{"version":3}` is a FUTURE store, and the honest answer
+    // is "unsupported version", not "not a store" — an unsupported version is
+    // by definition not a shape this build recognises, so the shape test below
+    // would mislabel it.
+    const loaded = normalizeData(parsed)
+    if (loaded.rejectedVersion !== undefined) return { rejectedVersion: loaded.rejectedVersion }
+    // Then shape, with the loader's own verdict rather than a looser one. A
+    // file carrying a single stray option key (`{"version":2}`,
+    // `{"enabled":false}`) is NOT a store to adopt wholesale: on the
+    // import/restore path that would replace real memory with near-nothing and
+    // report saved:true.
+    if (storeShapeVerdict(parsed) !== 'store') {
       return {
-        error: '内容不像本插件的存储文件：顶层需要是对象，且至少包含 entries / profiles / sets / version 之一。'
+        error: '内容不像本插件的存储文件：顶层需要是对象，且必须包含 entries / sets 数组（或受支持的 version）。'
           + '若要清空记忆，请使用界面上的删除操作，而不是保存一个空对象',
       }
     }
-    const loaded = normalizeData(parsed)
-    if (loaded.rejectedVersion !== undefined) return { rejectedVersion: loaded.rejectedVersion }
     loaded.data.backupDir = backupDirOf()
     return { loaded }
   }
@@ -3489,6 +3751,7 @@ export function apply(ctx) {
 
   const saveEntry = (raw, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
+    if (state.shapeRejected) return shapeRefusal()
     if (isStaleBaseRev(baseRev)) return conflictResponse()
     const entry = sanitizeEntry(raw)
     if (entry === null) return { ok: false, saved: false, message: '标题与指令内容不能同时为空', snapshot: snapshot() }
@@ -3540,6 +3803,7 @@ export function apply(ctx) {
 
   const deleteEntry = (id, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
+    if (state.shapeRejected) return shapeRefusal()
     if (isStaleBaseRev(baseRev)) return conflictResponse()
     // Deleting an id that is not there changes nothing, so it must not touch
     // disk, bump rev, or push an echo frame — otherwise two panels deleting
@@ -3562,6 +3826,7 @@ export function apply(ctx) {
 
   const setOptions = (patch, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
+    if (state.shapeRejected) return shapeRefusal()
     if (isStaleBaseRev(baseRev)) return conflictResponse()
     // The custom backup location (F18) is validated BEFORE anything is queued
     // into the store: an unusable path must be refused with a reason, not
@@ -3711,6 +3976,7 @@ export function apply(ctx) {
    */
   const batchEntries = (op, ids, value, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
+    if (state.shapeRejected) return shapeRefusal()
     if (isStaleBaseRev(baseRev)) return conflictResponse()
     if (typeof op !== 'string' || !BATCH_OPS.includes(op)) {
       return { ok: false, saved: false, message: '未知的批量操作：' + String(op), snapshot: snapshot() }
@@ -3818,6 +4084,7 @@ export function apply(ctx) {
 
   const saveProfile = (raw, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
+    if (state.shapeRejected) return shapeRefusal()
     if (isStaleBaseRev(baseRev)) return conflictResponse()
     const profile = sanitizeProfile(raw)
     if (profile === null) return { ok: false, saved: false, message: '形象名称与内容不能同时为空', snapshot: snapshot() }
@@ -3848,6 +4115,7 @@ export function apply(ctx) {
 
   const deleteProfile = (id, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
+    if (state.shapeRejected) return shapeRefusal()
     if (isStaleBaseRev(baseRev)) return conflictResponse()
     // Mirror deleteEntry: an absent id changes nothing and must not touch disk,
     // and an id belonging to a different set is not this panel's to delete.
@@ -3875,6 +4143,7 @@ export function apply(ctx) {
    */
   const saveSet = (raw, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
+    if (state.shapeRejected) return shapeRefusal()
     if (isStaleBaseRev(baseRev)) return conflictResponse()
     const wanted = sanitizeSet(raw)
     if (wanted === null) {
@@ -3915,6 +4184,7 @@ export function apply(ctx) {
    */
   const deleteSet = (id, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
+    if (state.shapeRejected) return shapeRefusal()
     if (isStaleBaseRev(baseRev)) return conflictResponse()
     const index = state.data.sets.findIndex((set) => set.id === id)
     if (index < 0) {
@@ -3943,6 +4213,7 @@ export function apply(ctx) {
    */
   const setActiveSet = (id, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
+    if (state.shapeRejected) return shapeRefusal()
     if (isStaleBaseRev(baseRev)) return conflictResponse()
     const target = state.data.sets.find((set) => set.id === id)
     if (target === undefined) {
@@ -3964,6 +4235,7 @@ export function apply(ctx) {
    */
   const duplicateSet = (id, name, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
+    if (state.shapeRejected) return shapeRefusal()
     if (isStaleBaseRev(baseRev)) return conflictResponse()
     const source = state.data.sets.find((set) => set.id === id)
     if (source === undefined) {
@@ -4093,13 +4365,28 @@ export function apply(ctx) {
    */
   const historyRestore = (name, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
+    // Deliberately NOT gated on shapeRejected: restoring a snapshot is the
+    // repair door for a primary that is not a store.
     if (isStaleBaseRev(baseRev)) return conflictResponse()
     if (typeof name !== 'string' || !HISTORY_FILE_PATTERN.test(name)) {
       return { ok: false, saved: false, message: '历史快照名称无效', snapshot: snapshot() }
     }
     let parsed = null
+    const snapshotPath = join(historyDirPath(), name)
     try {
-      parsed = JSON.parse(await readFile(join(historyDirPath(), name), 'utf8'))
+      // Bounded read: stat first, so an absurd file in a shared backup folder
+      // (or a corrupted one) is refused instead of pulled into memory whole.
+      const info = await stat(snapshotPath)
+      if (!info.isFile()) throw new Error('不是普通文件')
+      if (info.size > MAX_HISTORY_FILE_BYTES) {
+        return {
+          ok: false,
+          saved: false,
+          message: '该历史快照过大（' + info.size + ' 字节，上限 ' + MAX_HISTORY_FILE_BYTES + ' 字节），已拒绝读取',
+          snapshot: snapshot(),
+        }
+      }
+      parsed = JSON.parse(await readFile(snapshotPath, 'utf8'))
     } catch (err) {
       return { ok: false, saved: false, message: '无法读取该历史快照：' + describeErrorSafe(err), snapshot: snapshot() }
     }
@@ -4294,6 +4581,8 @@ export function apply(ctx) {
 
   const writeSource = (text, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
+    // Deliberately NOT gated on shapeRejected: hand-editing the source is how
+    // a user repairs a primary that is not a store.
     if (isStaleBaseRev(baseRev)) return conflictResponse()
     if (typeof text !== 'string') {
       return { ok: false, saved: false, message: '源码必须是 JSON 文本', snapshot: snapshot() }
@@ -4324,6 +4613,8 @@ export function apply(ctx) {
    */
   const restoreData = (payload, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
+    // Deliberately NOT gated on shapeRejected: wholesale replacement from a
+    // backup is the repair door for a primary that is not a store.
     if (isStaleBaseRev(baseRev)) return conflictResponse()
     if (payload === null || typeof payload !== 'object') {
       return { ok: false, saved: false, message: '恢复内容不是有效的 JSON 对象', snapshot: snapshot() }
@@ -4337,6 +4628,8 @@ export function apply(ctx) {
 
   const importData = (payload, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
+    // Deliberately NOT gated on shapeRejected: importing a real store is a
+    // repair path for a primary that is not one.
     if (isStaleBaseRev(baseRev)) return conflictResponse()
     if (payload === null || typeof payload !== 'object') {
       return { ok: false, saved: false, message: '导入内容不是有效的 JSON 对象', snapshot: snapshot() }
@@ -4624,6 +4917,14 @@ export function apply(ctx) {
   const readFeedbackConfigFile = async (path) => {
     let text
     try {
+      // Bounded read: this file is operator-authored, but a wrong path (a log,
+      // a database) must not be dragged into memory just because the send
+      // button was pressed.
+      const info = await stat(path)
+      if (!info.isFile()) throw new Error('不是普通文件')
+      if (info.size > MAX_FEEDBACK_CONFIG_BYTES) {
+        throw new Error('文件过大（' + info.size + ' 字节，上限 ' + MAX_FEEDBACK_CONFIG_BYTES + ' 字节）')
+      }
       text = await readFile(path, 'utf8')
     } catch (err) {
       if (err !== null && typeof err === 'object' && err.code === 'ENOENT') return null

package/lib/mailer.js

@@ -25,6 +25,7 @@
  */
 
 import { createCipheriv, createDecipheriv, randomBytes, randomUUID, scryptSync } from 'node:crypto'
+import { StringDecoder } from 'node:string_decoder'
 import { connect as netConnect } from 'node:net'
 import { connect as tlsConnect } from 'node:tls'
 import { hostname } from 'node:os'
@@ -253,7 +254,11 @@ function assertSecret(secret) {
  */
 export function encryptRecipient(address, secret) {
   const clean = textOf(address)
-  if (!EMAIL_RE.test(clean)) throw new Error('收件邮箱格式不正确，无法加密')
+  // Same verdict the delivery path uses: encrypting an address that SMTP could
+  // never deliver (non-ASCII without SMTPUTF8) only surfaced the problem at
+  // send time, when the configuration already looked correct.
+  const verdict = mailboxVerdict(clean)
+  if (verdict !== '') throw new Error('收件邮箱' + verdict + '，无法加密')
   const phrase = textOf(secret)
   assertSecret(phrase)
   const salt = randomBytes(SALT_BYTES)
@@ -288,7 +293,8 @@ export function decryptRecipient(payload, secret) {
   } catch {
     throw new Error('无法解密反馈收件邮箱：密钥不匹配或密文已损坏')
   }
-  if (!EMAIL_RE.test(clear)) throw new Error('解密后的反馈收件邮箱格式不正确')
+  const verdict = mailboxVerdict(clear)
+  if (verdict !== '') throw new Error('解密后的反馈收件邮箱' + verdict)
   return clear
 }
 
@@ -600,7 +606,14 @@ export function buildRawMail(options = {}) {
   const from = assertHeaderSafe(textOf(options.from), '发件邮箱')
   const to = assertHeaderSafe(textOf(options.to), '收件邮箱')
   const now = options.now instanceof Date ? options.now : new Date()
-  const messageId = textOf(options.messageId) || (randomUUID() + '@' + messageDomain(from))
+  // Message-ID is the one header this formatter used to interpolate without
+  // validation — and it is exported, so a caller-supplied value could inject
+  // CRLF or angle brackets. Only a syntactically id-shaped value survives;
+  // anything else falls back to a generated id.
+  const candidateId = textOf(options.messageId)
+  const messageId = /^[^\s<>@\r\n]+@[^\s<>@\r\n]+$/.test(candidateId)
+    ? candidateId
+    : randomUUID() + '@' + messageDomain(from)
   const subject = oneLine(options.subject)
   const replyTo = oneLine(options.replyTo)
   const body64 = b64(options.text).replace(/(.{76})/g, '$1\r\n')
@@ -628,6 +641,10 @@ export function buildRawMail(options = {}) {
  */
 function createChannel(socket, timeoutMs) {
   const state = { buffer: '', lines: [], waiters: [], error: null }
+  // Decode across chunk boundaries: `chunk.toString('utf8')` corrupts a
+  // multi-byte character split between two TCP segments, which turns a server's
+  // error text into replacement characters and makes it undiagnosable.
+  const decoder = new StringDecoder('utf8')
 
   const fail = (err) => {
     if (state.error === null) state.error = err
@@ -635,7 +652,7 @@ function createChannel(socket, timeoutMs) {
     for (const waiter of waiters) waiter.reject(state.error)
   }
   const onData = (chunk) => {
-    state.buffer += chunk.toString('utf8')
+    state.buffer += decoder.write(chunk)
     // A peer that keeps sending bytes without CRLF must not be able to grow this
     // buffer without bound; every other read is line-delimited and small.
     if (state.buffer.length > MAX_RESPONSE_BYTES) {
@@ -690,7 +707,7 @@ function createChannel(socket, timeoutMs) {
     const first = await readLine()
     const match = /^(\d{3})([ -])(.*)$/.exec(first)
     if (match === null) throw new Error('SMTP 响应无法解析：' + cutText(first, 120))
-    const code = Number(match[1])
+    let code = Number(match[1])
     const lines = [match[3]]
     if (match[2] === '-') {
       for (;;) {
@@ -698,6 +715,11 @@ function createChannel(socket, timeoutMs) {
         const nextMatch = /^(\d{3})([ -])(.*)$/.exec(next)
         if (nextMatch === null) throw new Error('SMTP 多行响应无法解析：' + cutText(next, 120))
         lines.push(nextMatch[3])
+        // A continuation line carrying a DIFFERENT status code is how some
+        // servers report the real outcome (e.g. `250-...` then `550 ...`).
+        // Keeping the first line's code silently turned a rejection into a
+        // success; the last line is the verdict.
+        code = Number(nextMatch[1])
         if (nextMatch[2] === ' ') break
       }
     }
@@ -732,10 +754,22 @@ async function command(channel, line, codes, what) {
   return expectCode(channel, codes, what)
 }
 
-/** EHLO; returns the capability lines the server advertised. */
+/**
+ * EHLO; returns the capability lines the server advertised.
+ *
+ * RFC 5321 §4.1.1.1: a server that does not implement EHLO answers 500, 502 or
+ * 504 and expects HELO instead. Without the fallback such a server made the
+ * feedback feature unusable with a misleading "EHLO failed (500)" message.
+ */
 async function hello(channel, name) {
-  const response = await command(channel, 'EHLO ' + name, 250, 'EHLO')
-  return response.lines.map((line) => line.trim())
+  await channel.write('EHLO ' + name + '\r\n')
+  const response = await channel.readResponse()
+  if (response.code === 250) return response.lines.map((line) => line.trim())
+  if ([500, 502, 504].includes(response.code)) {
+    const helo = await command(channel, 'HELO ' + name, 250, 'HELO')
+    return helo.lines.map((line) => line.trim())
+  }
+  throw smtpError('EHLO', response)
 }
 
 /**
@@ -759,7 +793,14 @@ async function authenticate(channel, smtp, caps) {
     + cutText(response.lines.join(' '), 300)
     + '。请检查用户名 / 密码；Gmail、QQ 邮箱等服务需要「应用专用密码」，不能用登录密码。')
 
-  if (canLogin || !canPlain) {
+  if (!canLogin && !canPlain) {
+    // Sending AUTH LOGIN to a server that never offered it produced a 504 and
+    // an error pointing at the password, which sent users to the wrong place.
+    throw new Error('SMTP 服务器不支持 LOGIN / PLAIN 认证（服务器声明的机制：'
+      + (mechanisms.length > 0 ? mechanisms.join('、') : '未声明')
+      + '）。请改用支持 LOGIN 或 PLAIN 的服务器')
+  }
+  if (canLogin) {
     await command(channel, 'AUTH LOGIN', 334, 'AUTH LOGIN')
     await command(channel, b64(smtp.user), 334, 'AUTH LOGIN 用户名')
     const done = await (async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-instruction-memory",
-  "version": "1.4.8",
+  "version": "1.5.0",
   "description": "User-only instruction memory for DSH: long-term instructions maintained in the settings UI and auto-injected into every conversation — the model has no write access. 指令记忆：只由用户在设置页维护的长期指令，自动注入此后每轮对话；模型没有任何写入口。",
   "license": "MIT",
   "type": "module",