dsh-instruction-memory 1.5.2 → 1.5.3

package/CHANGELOG.md

@@ -7,6 +7,33 @@
 > 1.0.13 起由 CI 经 OIDC Trusted Publishing 发布（首个带 provenance 的版本）。
 > 这些历史 tag **不应回填**——npm 上的版本号已被占用。
 
+## [1.5.3] — 2026-11-09
+
+1.5.2 的发布后修正，两处都是当天发现：一处**判断依据用错**，一处**依赖了初始化顺序**。没有新功能，
+存储格式、注入文本与面板行为不变。
+
+### 修复
+
+- **背压判断把健康但读得慢的订阅者当成死连接（1.5.2 引入）**：1.5.2 让 `send()` 返回 `res.write()`
+  的结果，并在返回 `false` 时立刻 `cleanup()`。但 `write()` 的 `false` 只表示**这一次写入超过了
+  socket 缓冲的高水位**——一个健康、但此刻读得慢的客户端同样会拿到 `false`。于是一个大帧（极限存储
+  约 3.4 MB）就可能把正常订阅者踢下线。现在返回值不再用作存活判据：心跳只负责让"写失败"这条路走通
+  ——对端真的消失时，写入会报错并触发该流早已注册的 `close`/`error` 清理；`pushSnapshot` 恢复
+  1.5.1 的语义。
+- **`diskRevFrom()` 的声明顺序依赖**：1.5.2 把它定义在 `writeToDisk()` 之后。`apply()` 是同步函数，
+  通常情况下没有问题；但"缺主文件时从 `.bak` 恢复"这条路径会在 boot 序列里调用 `writeToDisk()`，
+  那是一次**可能先于声明执行**的调用，而 `const` 会落在暂时性死区并抛 `ReferenceError`（保存因此
+  失败、`storageError` 报"保存失败"）。现在两个 helper 提到 `writeToDisk()` 之前，用顺序消除这个
+  假设，而不是依赖"今天恰好先 await"。
+
+### 验收
+
+- 全套 7 个套件与 `node check-metadata.mjs` 全绿；`contract-test.mjs` 连续独立运行 5 次均 ALL PASS。
+- 1.5.2 的 CI 在 `windows-latest / Node 24` 上失败了 2 条 SSE 断言：
+  `sse: a writer that throws on broadcast is fully disposed (response ended)` 与
+  `sse: disposing the dead writer does not interrupt a healthy stream`。本版按上面的修正重新验证这两个
+  断言所在的路径（死连接清理 + 健康流不受牵连）。
+
 ## [1.5.2] — 2026-11-09
 
 针对 2026-11-09 的代码审查（Host 侧与 Client 侧并行只读审查，逐条复核后落地）。本版**没有新增功能、

package/lib/index.js

@@ -2238,7 +2238,13 @@ export function apply(ctx) {
       }
       for (const [send, entry] of Array.from(sseStreams)) {
         try {
-          if (send(SSE_PING_FRAME) === false) entry.cleanup()
+          // The RETURN VALUE is deliberately not read as a liveness signal:
+          // res.write() answers false when THIS write exceeded the socket's
+          // high-water mark, which a healthy but momentarily slow reader
+          // produces too — killing on it tore down live streams. A dead peer
+          // is detected the reliable way instead: the write fails, which fires
+          // the close/error handler this stream has already registered.
+          send(SSE_PING_FRAME)
         } catch {
           entry.cleanup()
         }
@@ -2268,12 +2274,10 @@ export function apply(ctx) {
     for (const [send, entry] of Array.from(sseStreams)) {
       try {
         if (entry.lite === true) {
-          // A false return means the socket buffer is full — this subscriber
-          // stopped reading. Drop it now rather than queue frames in memory.
-          if (send(litePayload) === false) entry.cleanup()
+          send(litePayload)
         } else {
           if (fullPayload === null) fullPayload = 'data: ' + JSON.stringify(snapshot()) + '\n\n'
-          if (send(fullPayload) === false) entry.cleanup()
+          send(fullPayload)
         }
       } catch {
         // The response is dead: run its full teardown (end + unsubscribe),
@@ -2449,6 +2453,28 @@ export function apply(ctx) {
 
   const storePath = resolveStorePath()
 
+  /**
+   * The rev a PARSED store carries, or 0 when it carries none usable.
+   *
+   * Defined BEFORE writeToDisk on purpose: the missing-primary recovery path
+   * calls writeToDisk from the boot sequence, and a `const` declared later in
+   * apply() would still be in its temporal dead zone if that write ever ran
+   * before apply() reached the declaration. Ordering it here removes the
+   * question instead of relying on the await that happens to come first today.
+   */
+  const diskRevFrom = (parsed) => {
+    const rev = parsed !== null && parsed !== undefined && typeof parsed === 'object' ? parsed.rev : null
+    return typeof rev === 'number' && Number.isFinite(rev) && rev > 0 ? Math.round(rev) : 0
+  }
+
+  const readDiskRev = async () => {
+    try {
+      return diskRevFrom(await readStoreFile(storePath))
+    } catch {
+      return 0
+    }
+  }
+
   /**
    * The exact object written to memory.json — and the one an export carries.
    *
@@ -3132,25 +3158,6 @@ export function apply(ctx) {
    * then silently misses the second save; and (b) deciding whether a save made
    * while another process holds the lock would clobber a newer store.
    */
-  /**
-   * The rev a PARSED store carries, or 0 when it carries none usable. Split out
-   * so a caller that already read the file — writeToDisk does, once, inside the
-   * lock — can derive the same number without a second read. Called at request
-   * time, long after apply() finished defining it.
-   */
-  const diskRevFrom = (parsed) => {
-    const rev = parsed !== null && parsed !== undefined && typeof parsed === 'object' ? parsed.rev : null
-    return typeof rev === 'number' && Number.isFinite(rev) && rev > 0 ? Math.round(rev) : 0
-  }
-
-  const readDiskRev = async () => {
-    try {
-      return diskRevFrom(await readStoreFile(storePath))
-    } catch {
-      return 0
-    }
-  }
-
   /**
    * Load the store from disk. Most branches only read; two of them also write —
    * the missing-primary recovery promotes the backup to memory.json, and the
@@ -5364,9 +5371,7 @@ export function apply(ctx) {
     // restarted) instead of hammering the route.
     res.write('retry: 5000\n\n')
     const lite = isLiteStreamRequest(req)
-    // The write() result is the backpressure signal that pushSnapshot and the
-    // heartbeat act on: false means the peer stopped reading this stream.
-    const send = (payload) => res.write(payload)
+    const send = (payload) => { res.write(payload) }
     let closed = false
     const cleanup = () => {
       closed = true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-instruction-memory",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "description": "User-only instruction memory for DSH: long-term instructions maintained in the settings UI and auto-injected into every conversation — the model has no write access. 指令记忆：只由用户在设置页维护的长期指令，自动注入此后每轮对话；模型没有任何写入口。",
   "license": "MIT",
   "type": "module",