dsh-memsys 0.1.0 → 0.2.0

package/src/import/rollback.mjs

@@ -1,16 +1,24 @@
+import { canonicalJson } from '../identity.mjs';
+
 const TABLES = ['observations', 'candidates', 'memories', 'relations', 'import_items', 'timeline', 'pointers'];
+const ID_TABLES = {
+  observations: 'id',
+  candidates: 'id',
+  memories: 'id',
+  relations: 'id',
+  import_items: 'id',
+};
+
+function rowHash(row) {
+  return canonicalJson({ ...row });
+}
 
 export function compareBusinessCounts({ db, expected = {} }) {
   const missing = [];
   const counts = {};
   for (const [table, minimum] of Object.entries(expected)) {
     if (!TABLES.includes(table)) continue;
-    let actual = 0;
-    try {
-      actual = Number(db.prepare('SELECT COUNT(*) AS n FROM ' + table).get().n);
-    } catch {
-      actual = 0;
-    }
+    const actual = Number(db.prepare('SELECT COUNT(*) AS n FROM ' + table).get().n);
     counts[table] = actual;
     if (actual < Number(minimum)) missing.push(table);
   }
@@ -20,60 +28,105 @@ export function compareBusinessCounts({ db, expected = {} }) {
 export function snapshotBusinessCounts(db) {
   const counts = {};
   for (const table of TABLES) {
-    try {
-      counts[table] = Number(db.prepare('SELECT COUNT(*) AS n FROM ' + table).get().n);
-    } catch {
-      counts[table] = 0;
-    }
+    counts[table] = Number(db.prepare('SELECT COUNT(*) AS n FROM ' + table).get().n);
   }
   return counts;
 }
 
-const ID_TABLES = {
-  observations: 'id',
-  candidates: 'id',
-  memories: 'id',
-  relations: 'id',
-  import_items: 'item_id',
-};
-
 export function snapshotBusinessRows(db) {
   const ids = {};
+  const content = {};
   for (const [table, key] of Object.entries(ID_TABLES)) {
-    try {
-      ids[table] = db.prepare('SELECT ' + key + ' AS id FROM ' + table + ' ORDER BY 1').all().map((row) => row.id);
-    } catch {
-      ids[table] = [];
-    }
+    const rows = db.prepare('SELECT * FROM ' + table + ' ORDER BY ' + key).all();
+    ids[table] = rows.map((row) => row[key]);
+    content[table] = Object.fromEntries(rows.map((row) => [row[key], rowHash(row)]));
+  }
+  const links = {};
+  for (const memoryId of ids.memories ?? []) {
+    const timeline = db.prepare('SELECT * FROM timeline WHERE memory_id = ?').get(memoryId) ?? null;
+    const pointer = db.prepare('SELECT * FROM pointers WHERE memory_id = ?').get(memoryId) ?? null;
+    const evidence = db.prepare('SELECT id FROM evidence WHERE memory_id = ? ORDER BY id').all(memoryId).map((row) => row.id);
+    links[memoryId] = {
+      timeline: timeline ? rowHash(timeline) : null,
+      pointer: pointer ? rowHash(pointer) : null,
+      evidence,
+    };
   }
-  return { counts: snapshotBusinessCounts(db), ids };
+  return { counts: snapshotBusinessCounts(db), ids, content, links };
 }
 
 export function compareBusinessRows({ db, baseline = {} }) {
   const missing = [];
   const ids = baseline.ids ?? {};
+  const content = baseline.content ?? {};
   for (const [table, key] of Object.entries(ID_TABLES)) {
     for (const id of ids[table] ?? []) {
-      let row = null;
-      try {
-        row = db.prepare('SELECT ' + key + ' AS id FROM ' + table + ' WHERE ' + key + ' = ?').get(id);
-      } catch {
-        row = null;
+      const row = db.prepare('SELECT * FROM ' + table + ' WHERE ' + key + ' = ?').get(id);
+      if (!row) {
+        missing.push(table + ':' + id);
+        continue;
+      }
+      const expectedHash = content[table]?.[id];
+      if (expectedHash && rowHash(row) !== expectedHash) {
+        missing.push(table + ':content:' + id);
       }
-      if (!row) missing.push(table + ':' + id);
     }
   }
   for (const memoryId of ids.memories ?? []) {
-    try {
-      const timeline = db.prepare('SELECT 1 AS ok FROM timeline WHERE memory_id = ?').get(memoryId);
-      const pointer = db.prepare('SELECT 1 AS ok FROM pointers WHERE memory_id = ?').get(memoryId);
-      const evidence = db.prepare('SELECT 1 AS ok FROM evidence WHERE memory_id = ? LIMIT 1').get(memoryId);
-      if (!timeline || !pointer || !evidence) missing.push('memory_links:' + memoryId);
-    } catch {
+    const expected = baseline.links?.[memoryId];
+    const timeline = db.prepare('SELECT * FROM timeline WHERE memory_id = ?').get(memoryId) ?? null;
+    const pointer = db.prepare('SELECT * FROM pointers WHERE memory_id = ?').get(memoryId) ?? null;
+    const evidence = db.prepare('SELECT id FROM evidence WHERE memory_id = ? ORDER BY id').all(memoryId).map((row) => row.id);
+    if (!timeline || !pointer || evidence.length === 0) {
       missing.push('memory_links:' + memoryId);
+      continue;
+    }
+    if (expected) {
+      if ((timeline ? rowHash(timeline) : null) !== expected.timeline) missing.push('timeline:content:' + memoryId);
+      if ((pointer ? rowHash(pointer) : null) !== expected.pointer) missing.push('pointer:content:' + memoryId);
+      if (canonicalJson(evidence) !== canonicalJson(expected.evidence)) missing.push('evidence:content:' + memoryId);
     }
   }
   const counts = compareBusinessCounts({ db, expected: baseline.counts ?? {} });
   for (const key of counts.missing) missing.push('count:' + key);
   return { ok: missing.length === 0, missing, counts: counts.counts };
 }
+
+const FREEZE_TABLES = {
+  main: ['observations', 'candidates', 'memories', 'relations', 'timeline', 'pointers', 'evidence', 'import_items', 'graph_nodes', 'graph_edges'],
+  control: ['operations', 'object_streams', 'context_snapshots', 'snapshot_groups', 'snapshot_items', 'operation_attempts'],
+  dream: ['dreams', 'propositions', 'relations', 'confirmation_snapshots'],
+};
+
+function tableFingerprint(db, table) {
+  const rows = db.prepare('SELECT * FROM ' + table + ' ORDER BY rowid').all();
+  return { count: rows.length, hash: canonicalJson(rows) };
+}
+
+export function snapshotDatabaseFreeze({ main, control, dream }) {
+  const freeze = { versions: {}, tables: {} };
+  for (const [label, db] of Object.entries({ main, control, dream })) {
+    if (!db) continue;
+    freeze.versions[label] = Number(db.prepare('SELECT COALESCE(MAX(version), 0) AS version FROM schema_migrations').get().version);
+    freeze.tables[label] = {};
+    for (const table of FREEZE_TABLES[label] ?? []) {
+      freeze.tables[label][table] = tableFingerprint(db, table);
+    }
+  }
+  return freeze;
+}
+
+export function compareDatabaseFreeze({ main, control, dream }, freeze = {}) {
+  const missing = [];
+  for (const [label, db] of Object.entries({ main, control, dream })) {
+    if (!db || !freeze.versions?.[label]) continue;
+    const version = Number(db.prepare('SELECT COALESCE(MAX(version), 0) AS version FROM schema_migrations').get().version);
+    if (version !== Number(freeze.versions[label])) missing.push(label + ':version');
+    for (const [table, expected] of Object.entries(freeze.tables?.[label] ?? {})) {
+      const actual = tableFingerprint(db, table);
+      if (actual.count !== expected.count) missing.push(label + ':' + table + ':count');
+      else if (actual.hash !== expected.hash) missing.push(label + ':' + table + ':content');
+    }
+  }
+  return { ok: missing.length === 0, missing };
+}

package/src/runtime/summary.mjs

@@ -0,0 +1,197 @@
+/**
+ * Host side of the optional Web UI (sidebar panel + settings section).
+ *
+ * Everything here is read-only over SQLite plus one small JSON file holding the
+ * `auto_inject` override written by the settings switch. Both routes enforce
+ * loopback + same-origin before touching data; nothing here is model-facing.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+
+const UI_CONFIG_FILE = 'ui-config.json';
+const UI_CONFIG_VERSION = 1;
+const RECENT_LIMIT = 5;
+const TEXT_LIMIT = 80;
+const BODY_LIMIT = 4096;
+
+const warn = (logger, message) => {
+  try {
+    logger?.warn?.(`[dsh-memsys] ${message}`);
+  } catch {
+    // a logger that throws must never break boot
+  }
+};
+
+/**
+ * Read the settings file written by the Web switch.
+ * Returns `{ auto_inject }` or `null` when absent. A corrupt or foreign-version
+ * file is ignored with one warning: a bad file must never stop the plugin.
+ */
+export function readUiConfig(dataDir, logger = console) {
+  if (!dataDir) return null;
+  const file = path.join(dataDir, UI_CONFIG_FILE);
+  let raw = null;
+  try {
+    if (!fs.existsSync(file)) return null;
+    raw = fs.readFileSync(file, 'utf8');
+  } catch (err) {
+    warn(logger, `ui-config 读取失败（${err?.message ?? err}），回落 profile 配置`);
+    return null;
+  }
+  let parsed = null;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    warn(logger, 'ui-config 不是合法 JSON，回落 profile 配置');
+    return null;
+  }
+  if (parsed?.version !== UI_CONFIG_VERSION) {
+    warn(logger, `ui-config 版本不符（${parsed?.version ?? 'none'}，期望 ${UI_CONFIG_VERSION}），已忽略`);
+    return null;
+  }
+  if (typeof parsed?.auto_inject !== 'boolean') {
+    warn(logger, 'ui-config 缺少 auto_inject 布尔值，已忽略');
+    return null;
+  }
+  return { auto_inject: parsed.auto_inject };
+}
+
+/**
+ * Priority: ui-config.json (when present and valid) > profile patch value > false.
+ * The reported `source` is what the Web page shows next to the switch.
+ */
+export function resolveAutoInject({ dataDir = null, profileValue = undefined, logger = console } = {}) {
+  const stored = readUiConfig(dataDir, logger);
+  if (stored !== null) return { value: stored.auto_inject, source: 'ui-config' };
+  if (typeof profileValue === 'boolean') return { value: profileValue, source: 'profile' };
+  return { value: false, source: 'default' };
+}
+
+/** Write-through with a temp file so a crash never leaves half a config. */
+export function writeUiConfig(dataDir, autoInject) {
+  if (!dataDir) return false;
+  fs.mkdirSync(dataDir, { recursive: true });
+  const target = path.join(dataDir, UI_CONFIG_FILE);
+  const temp = `${target}.tmp`;
+  fs.writeFileSync(
+    temp,
+    JSON.stringify({ version: UI_CONFIG_VERSION, auto_inject: autoInject === true }, null, 2),
+    'utf8',
+  );
+  fs.renameSync(temp, target);
+  return true;
+}
+
+const truncate = (text) => Array.from(String(text ?? '')).slice(0, TEXT_LIMIT).join('');
+
+/** Three counts plus the five latest memories; `candidates` means still-open ones. */
+export function buildSummary(main, { dataDir = null, autoInject = false, autoInjectSource = 'default' } = {}) {
+  const db = typeof main === 'function' ? main() : main;
+  const one = (sql, ...params) => Number(db.prepare(sql).get(...params)?.n ?? 0);
+  const recent = db
+    .prepare('SELECT id, text FROM memories ORDER BY recorded_at DESC, id DESC LIMIT ?')
+    .all(RECENT_LIMIT)
+    .map((row) => ({ id: row.id, text: truncate(row.text) }));
+  return {
+    memories: one('SELECT COUNT(*) AS n FROM memories'),
+    candidates: one("SELECT COUNT(*) AS n FROM candidates WHERE status IN ('pending', 'conflicted')"),
+    pending_due: one("SELECT COUNT(*) AS n FROM memories WHERE due_state = 'pending-due'"),
+    recent,
+    data_dir: dataDir,
+    auto_inject: autoInject === true,
+    auto_inject_source: autoInjectSource,
+  };
+}
+
+export function isLoopback(req) {
+  const address = req?.socket?.remoteAddress ?? '';
+  return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1';
+}
+
+export function sameOrigin(req) {
+  const origin = req?.headers?.origin;
+  const host = req?.headers?.host;
+  if (!origin) return true;
+  try {
+    return new URL(origin).host === host;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * One handler for GET summary and POST config.
+ *
+ * `main` may be a thunk so a profile that never opened the database still gets
+ * a structured 503 instead of a thrown route error.
+ */
+export function createSummaryHandler({
+  main,
+  dataDir = null,
+  getAutoInject = () => false,
+  onAutoInject = null,
+} = {}) {
+  const send = (res, status, payload) => {
+    res.statusCode = status;
+    res.setHeader('content-type', 'application/json');
+    res.setHeader('cache-control', 'no-store');
+    res.end(JSON.stringify(payload));
+  };
+
+  return (req, res) => {
+    if (!isLoopback(req) || !sameOrigin(req)) {
+      send(res, 403, { error: 'forbidden' });
+      return;
+    }
+    if (req.method === 'POST') {
+      const type = String(req.headers?.['content-type'] ?? '').toLowerCase();
+      if (!type.includes('application/json')) {
+        send(res, 415, { error: 'json_required' });
+        return;
+      }
+      let body = '';
+      let tooLarge = false;
+      req.on?.('data', (chunk) => {
+        if (tooLarge) return;
+        body += chunk;
+        if (body.length > BODY_LIMIT) tooLarge = true;
+      });
+      req.on?.('end', () => {
+        if (tooLarge) {
+          send(res, 413, { error: 'body_too_large' });
+          return;
+        }
+        let parsed = null;
+        try {
+          parsed = JSON.parse(body || '{}');
+        } catch {
+          send(res, 400, { error: 'invalid_json' });
+          return;
+        }
+        if (typeof parsed?.auto_inject !== 'boolean') {
+          send(res, 400, { error: 'auto_inject_required' });
+          return;
+        }
+        try {
+          onAutoInject?.(parsed.auto_inject);
+          send(res, 200, { ok: true, auto_inject: parsed.auto_inject, auto_inject_source: 'ui-config' });
+        } catch (err) {
+          send(res, 500, { error: 'write_failed', message: String(err?.message ?? err) });
+        }
+      });
+      return;
+    }
+    if (req.method && req.method !== 'GET') {
+      send(res, 405, { error: 'method_not_allowed' });
+      return;
+    }
+    try {
+      const current = getAutoInject();
+      const value = typeof current === 'boolean' ? current : current?.value === true;
+      const source = typeof current === 'boolean' ? 'ui-config' : (current?.source ?? 'default');
+      send(res, 200, buildSummary(main, { dataDir, autoInject: value, autoInjectSource: source }));
+    } catch (err) {
+      send(res, 503, { error: 'summary_unavailable', message: String(err?.code ?? err?.message ?? err) });
+    }
+  };
+}

package/test/fixtures/p3/c1-baseline.json

@@ -0,0 +1,90 @@
+{
+  "capturedAt": "2026-11-02T17:32:36.368Z",
+  "source": "P3-C1 pre-flight (plan-3 §2/§5.4)",
+  "protected_inputs": {
+    "whale-unify/memsys-design-v0.38.md": {
+      "bytes": 99880,
+      "sha256": "511cbd8ce3db4ff92706c641449ad83b195d4bd37f17b1b50a43e4847f028ac9"
+    },
+    "whale-unify/_build/contract.md": {
+      "bytes": 3520,
+      "sha256": "e3efb6588da5550cc1a526a31f0375b10abfc314a921ea8342a4b0d25396ff10"
+    },
+    "whale-unify/_build/plan-1.md": {
+      "bytes": 65433,
+      "sha256": "8b6572a59f9c968844f2a524202bf61bfb2a39f6d095961d6f849387cdfcf999"
+    },
+    "whale-unify/_build/plan-2.md": {
+      "bytes": 61363,
+      "sha256": "49e1cdec8f6fda36e40e27c0d1ce90e167c2cd77002608b8864b40fd3061fdc2"
+    },
+    "whale-unify/_build/plan-3.md": {
+      "bytes": 64985,
+      "sha256": "498550e1fe24fd075c43940a59dcf47d18ae19b7a914e2b0be917cf33578b3d6"
+    },
+    "whale-unify/_build/report-1.md": {
+      "bytes": 3448,
+      "sha256": "9a94435b1e61c2cd6c1dfe347eaac6669657239a364fcc3597c2892550e4d736"
+    },
+    "whale-unify/_build/report-2.md": {
+      "bytes": 3572,
+      "sha256": "42e00e3c7fbc50b3512362d2af8bfa68995fcb53faacd5f9c1d82439cb5e0c12"
+    },
+    "whale-unify/_build/decisions.md": {
+      "bytes": 10587,
+      "sha256": "2cbdda67546ea3b1dd8ded1b3355d47148c43cdad0d0bbe0a962e403debb434e"
+    }
+  },
+  "migrations": {
+    "control-001.sql": {
+      "bytes": 3504,
+      "sha256": "1b1e865dee83757213e7b5b09cd20d0ff19b4dd5ec53efb495205255b32e9f93"
+    },
+    "control-002.sql": {
+      "bytes": 3268,
+      "sha256": "df684d926d49b0c209d05ede4b533f46f0942ca80866a3d4bf54d05eb06d493c"
+    },
+    "control-003.sql": {
+      "bytes": 351,
+      "sha256": "7cf225bb30a80fb5ec7655bc6ad26ec5e296fd9edb86ea162770d3c418b56e32"
+    },
+    "dream-001.sql": {
+      "bytes": 370,
+      "sha256": "ac87b2becc5636645a4dcd14947040503091529eef114e9f589bea56ea1cc31e"
+    },
+    "main-001.sql": {
+      "bytes": 14497,
+      "sha256": "062d36f2651fc0ef55c3b329dd00ffff45ad0564d40d82fedffa7dfe75391bee"
+    },
+    "main-002.sql": {
+      "bytes": 3023,
+      "sha256": "dbbe52c06365c5903130283d22c295d0cc06492a6d9ee6a5f1702af6f789d96b"
+    },
+    "main-003.sql": {
+      "bytes": 706,
+      "sha256": "315330ffc9ffcfeecec7bf841688228630fd105b421d167ec080b559703ab633"
+    },
+    "main-004.sql": {
+      "bytes": 1285,
+      "sha256": "0a585a2115325db8d413e45ae97d287e77af061f435c77b528e9460dd1c33bba"
+    },
+    "main-005.sql": {
+      "bytes": 4675,
+      "sha256": "686a185473ed35c714768c9106a0f5165a14ee05a6f89c76be457894b0c81258"
+    },
+    "main-006.sql": {
+      "bytes": 1162,
+      "sha256": "695f0ad844bd6fb91813fc785ddebe1b1e6fa741300e89aff214250bd6389c1f"
+    }
+  },
+  "expected_versions_before": {
+    "main": 6,
+    "control": 3,
+    "dream": 1
+  },
+  "expected_versions_c1": {
+    "main": 7,
+    "control": 4,
+    "dream": 2
+  }
+}

package/test/p3-c1-dream.test.mjs

@@ -500,7 +500,7 @@ test('P3-C1 migration contract', async (t) => {
       }
       assert.deepEqual(versions, { main: 8, control: 4, dream: 2 });
       const baseline = JSON.parse(
-        fs.readFileSync(path.join(ROOT, '..', '_build', 'artifacts', 'p3', 'c1-baseline.json'), 'utf8'),
+        fs.readFileSync(path.join(ROOT, 'test', 'fixtures', 'p3', 'c1-baseline.json'), 'utf8'),
       );
       for (const [name, entry] of Object.entries(baseline.migrations)) {
         if (name === 'control-004.sql' || name === 'main-007.sql' || name === 'dream-002.sql') continue;

package/test/p6-b1-merge.test.mjs

@@ -0,0 +1,60 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  insertCandidate,
+  insertMemory,
+  insertObservation,
+  insertPointer,
+  insertTimeline,
+} from '../src/storage/repositories.mjs';
+import { mergeExact } from '../src/dream/organize.mjs';
+import { createTestContext, makeCandidate, makeMemory, makeObservation, mutableClock } from './helpers/fixtures.mjs';
+import { fakeRuntime } from './helpers/runtime.mjs';
+
+let seq = 0;
+
+function memory(ctx, { type = 'fact', dueState = 'none', deadline = null } = {}) {
+  seq += 1;
+  const text = '完全相同的合并记忆';
+  const observation = makeObservation(ctx, { messageSeq: 25000 + seq, text });
+  insertObservation(ctx.main, observation);
+  const candidate = makeCandidate(ctx, observation, { businessKey: `p6b1-${seq}`, text, why: 'w', type, scene: 'work', scope: 'work-only' });
+  Object.assign(candidate, { key_status: 'resolved', binding_status: 'accepted', binding_basis: '{}', origin_mode: 'self', semantic_status: 'quoted', record_kind: 'utterance' });
+  insertCandidate(ctx.main, candidate);
+  const row = makeMemory(ctx, candidate);
+  Object.assign(row, {
+    key_status: 'resolved', binding_status: 'accepted', binding_basis: '{}', origin_mode: 'self',
+    semantic_status: 'quoted', record_kind: 'utterance', due_state: dueState,
+  });
+  insertMemory(ctx.main, row);
+  insertTimeline(ctx.main, { memory_id: row.id, start_at: null, end_at: null, prec_start: 'unknown', prec_end: 'unknown', time_state: 'point', revision: 1 });
+  insertPointer(ctx.main, { memory_id: row.id, status: 'unknown', location: null, search_hint: null, lossy: 0, revision: 1 });
+  if (deadline) {
+    ctx.main
+      .prepare("INSERT INTO due_queue (memory_id, due_state, enqueued_seq, enqueued_at, opened_at, deadline_at, revision, reason) VALUES (?, 'none', 1, ?, NULL, ?, 0, 'test')")
+      .run(row.id, ctx.clock.at().at, deadline);
+  }
+  return row;
+}
+
+function merge(ctx, a, b) {
+  return mergeExact(
+    { main: ctx.main, control: ctx.control, clock: ctx.clock },
+    { runtime: fakeRuntime({ role: 'dream', callId: 'p6b1' }), ids: [a.id, b.id] },
+  );
+}
+
+test('P6/B1: promise, done/dropped and non-empty due are blocked from merge', (t) => {
+  const ctx = createTestContext({ clock: mutableClock().clock });
+  t.after(() => ctx.cleanup());
+  for (const options of [{ type: 'promise' }, { dueState: 'done' }, { dueState: 'dropped' }, { deadline: '2026-12-01T00:00:00Z' }]) {
+    const a = memory(ctx, options);
+    const b = memory(ctx, options);
+    assert.throws(
+      () => merge(ctx, a, b),
+      (err) => err.code === 'blocked_by_due_state',
+      JSON.stringify(options),
+    );
+  }
+});

package/test/p6-b2-pointers.test.mjs

@@ -0,0 +1,77 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+
+import { applyPlan, buildPlan, verifyPlan } from '../src/import/legacy.mjs';
+import { applyPointers, planPointers } from '../src/import/pointers.mjs';
+import { resolveConfig } from '../src/config.mjs';
+import { closeAll, openAll } from '../src/storage/open.mjs';
+import { migrateAll } from '../src/storage/migrate.mjs';
+import { seedInitialRegistry } from '../src/storage/repositories.mjs';
+import { canonicalJson } from '../src/identity.mjs';
+import { mutableClock } from './helpers/fixtures.mjs';
+
+function legacyCtx() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-memsys-p6b2-'));
+  const source = path.join(dir, 'source');
+  fs.mkdirSync(source, { recursive: true });
+  const clock = mutableClock().clock;
+  const handles = openAll(resolveConfig({ dataDir: path.join(dir, 'target') }));
+  migrateAll(handles, { clock });
+  handles.main.exec('BEGIN IMMEDIATE');
+  seedInitialRegistry(handles.main, clock);
+  handles.main.exec('COMMIT');
+  return {
+    dir, source, handles, clock,
+    deps: { main: handles.main, control: handles.control, clock },
+    cleanup() { try { closeAll(handles); } catch {} fs.rmSync(dir, { recursive: true, force: true }); },
+  };
+}
+
+test('P6/B2: changing a source byte blocks pointer apply before relation write', (t) => {
+  const ctx = legacyCtx();
+  t.after(() => ctx.cleanup());
+  const raw = '真实原文';
+  const record = { id: 'b2p', kind: 'point', raw, gist: '摘要', why: 'w', type: 'fact', scene: 'work', scope: 'work-only', pointer: { status: 'unknown' } };
+  fs.writeFileSync(path.join(ctx.source, 'legacy.json'), JSON.stringify({ records: [record], graph: { nodes: [], edges: [] } }), 'utf8');
+  const plan = buildPlan(ctx.source);
+  applyPlan(ctx.deps, plan);
+  const item = plan.items.find((entry) => entry.itemKind === 'memory');
+  const bytes = Buffer.from(raw, 'utf8');
+  const file = path.join(ctx.source, 'b2p.md');
+  fs.writeFileSync(file, bytes);
+  const versions = path.join(ctx.source, 'versions.json');
+  fs.writeFileSync(versions, JSON.stringify({ versions: [{
+    sourceObjectId: 'b2p', versionHash: item.sourceVersionHash,
+    location: file + '#bytes:0-' + bytes.length,
+    file, span: { start: 0, end: bytes.length },
+    spanHash: crypto.createHash('sha256').update(bytes).digest('hex'),
+  }] }), 'utf8');
+  const pointerPlan = planPointers({ main: ctx.handles.main, clock: ctx.clock }, versions);
+  assert.equal(pointerPlan.items.length, 1, JSON.stringify(pointerPlan.skipped));
+  fs.writeFileSync(file, Buffer.concat([bytes, Buffer.from('x')]));
+  assert.throws(
+    () => applyPointers({ main: ctx.handles.main, clock: ctx.clock }, pointerPlan),
+    (err) => err.code === 'source_bytes_changed',
+  );
+  const changes = ctx.handles.main.prepare("SELECT COUNT(*) AS n FROM relations WHERE type = 'pointer-change' AND json_extract(payload, '$.basis') = 'pointer-backfill'").get().n;
+  assert.equal(Number(changes), 0);
+});
+
+test('P6/B2: changed graph node label makes verifyPlan fail', (t) => {
+  const ctx = legacyCtx();
+  t.after(() => ctx.cleanup());
+  const record = { id: 'b2g', kind: 'point', raw: '文本', gist: '摘要', why: 'w', type: 'fact', scene: 'work', scope: 'work-only', pointer: { status: 'unknown' } };
+  const graph = { nodes: [{ id: 'n1', label: '旧标签', kind: 'concept' }], edges: [] };
+  fs.writeFileSync(path.join(ctx.source, 'legacy.json'), JSON.stringify({ records: [record], graph }), 'utf8');
+  const plan = buildPlan(ctx.source);
+  applyPlan(ctx.deps, plan);
+  ctx.handles.main.exec('DROP TRIGGER IF EXISTS trg_graph_nodes_no_update');
+  ctx.handles.main.prepare('UPDATE graph_nodes SET label = ? WHERE id = ?').run('新标签', 'n1');
+  const verify = verifyPlan({ main: ctx.handles.main, clock: ctx.clock }, plan);
+  assert.equal(verify.status, 'failed');
+  assert.ok(verify.missing.some((entry) => entry.includes('graph_node_content')), JSON.stringify(verify.missing));
+});

package/test/p6-l6-rollback.test.mjs

@@ -0,0 +1,38 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  compareBusinessRows,
+  compareDatabaseFreeze,
+  snapshotBusinessRows,
+  snapshotDatabaseFreeze,
+} from '../src/import/rollback.mjs';
+import { createTestContext, mutableClock } from './helpers/fixtures.mjs';
+
+test('P6/L6: rollback detects changed row content even when counts match', (t) => {
+  const ctx = createTestContext({ clock: mutableClock().clock });
+  t.after(() => ctx.cleanup());
+  ctx.main
+    .prepare("INSERT INTO observations (id, idempotency_key, at, payload_hash, text, source, author_kind, runtime_refs, origin, lossy, state_snapshot, initial_strength, recorded_at) VALUES ('obs_l6_content','obs:l6c',?, 'h','原始内容','file','unknown','{}','migrated',0,'{}',0.5,?)")
+    .run(ctx.clock.at().at, ctx.clock.at().at);
+  const baseline = snapshotBusinessRows(ctx.main);
+  ctx.main.exec('DROP TRIGGER IF EXISTS trg_observations_no_update');
+  ctx.main.prepare('UPDATE observations SET text = ? WHERE id = ?').run('改过的内容', 'obs_l6_content');
+  const compared = compareBusinessRows({ db: ctx.main, baseline });
+  assert.equal(compared.ok, false, 'same count must not pass when content changed');
+  assert.ok(compared.missing.some((entry) => entry.includes('content')), JSON.stringify(compared));
+});
+
+test('P6/L6: boundary freeze detects changed content with unchanged counts', (t) => {
+  const ctx = createTestContext({ clock: mutableClock().clock });
+  t.after(() => ctx.cleanup());
+  ctx.main
+    .prepare("INSERT INTO observations (id, idempotency_key, at, payload_hash, text, source, author_kind, runtime_refs, origin, lossy, state_snapshot, initial_strength, recorded_at) VALUES ('obs_l6_freeze','obs:l6f',?, 'h','原始','file','unknown','{}','migrated',0,'{}',0.5,?)")
+    .run(ctx.clock.at().at, ctx.clock.at().at);
+  const freeze = snapshotDatabaseFreeze(ctx.handles);
+  ctx.main.exec('DROP TRIGGER IF EXISTS trg_observations_no_update');
+  ctx.main.prepare('UPDATE observations SET text = ? WHERE id = ?').run('改过', 'obs_l6_freeze');
+  const compared = compareDatabaseFreeze(ctx.handles, freeze);
+  assert.equal(compared.ok, false);
+  assert.ok(compared.missing.some((entry) => entry.includes('content')), JSON.stringify(compared));
+});