dsh-memsys 0.1.0 → 0.2.1

package/README.md

@@ -10,9 +10,18 @@ node scripts/live-check.mjs --case tools        # 真机：插件能否装进宿
 
 已实测（隔离 profile，带 key）：插件加载 → 10 个 `memsys_*` 工具注册进宿主 → 模型调用 `memsys_search` 返回真实命中 → 模型调用 `memsys_record` 写入候选与记忆，`origin.author_kind=model`、会话与调用 ID 与宿主记录一致。
 
-## 从 GitHub 安装
+## 安装
 
-**尚未发布到 npm**，所以 `npm install dsh-memsys` 装不到。现在的装法是先克隆再让 DSH 从本地路径安装：
+**已发布到 npm**：`dsh-memsys@0.1.0`（https://www.npmjs.com/package/dsh-memsys）。
+
+装进一个**独立 profile**（不要直接装进你日常用的那个）：
+
+```bash
+dsh --profile memsys headless --from-default-profile --dump-config   # 初始化隔离 profile
+dsh plugin --profile memsys add dsh-memsys                            # 从 npm 装
+```
+
+或者不依赖 npm，从源码装：
 
 ```bash
 git clone https://github.com/tok-ryan/dsh-memsys.git dsh-memsys
@@ -20,10 +29,7 @@ cd dsh-memsys
 npm test                    # 先跑一遍，确认本地环境能过（Node >= 22.13）
 ```
 
-然后用一个**独立 profile** 装进去（不要直接装进你日常用的那个）：
-
 ```bash
-dsh --profile memsys headless --from-default-profile --dump-config   # 初始化一个隔离 profile
 dsh plugin --profile memsys add "file:///全/路径/dsh-memsys"          # 按实际路径改
 ```
 
@@ -57,9 +63,30 @@ node scripts/live-check.mjs --case tools --profile memsys      # 真机：插件
 
 **设计原则**：事实只追加；当前状态是可重建投影；模型只能提交候选，不能直接落事实；一切写后读回按固化预期比对，不是"行还在就算成功"。
 
-## 状态
+## 界面（0.2.0 起）
+
+装上之后 Web GUI 里会多三样东西，都来自同一个浏览器半 `client.js`：
+
+- **左侧栏「🐳 记忆」**：点开是一块面板——记忆条数 / 候选条数 / 待确认惦记数，加最近 5 条记忆正文（超长截断）
+- **设置 →「记忆系统」**：`auto_inject` 开关 + 当前数据目录；开关改完**立即生效**（重挂/撤下 system prompt 里的记忆段），刷新后仍在
+- 面板与设置页共用数据口 `/dsh-memsys/api/*`（loopback + 同源校验；跨源 403）
+
+**设置优先级**：`<data_dir>/ui-config.json`（存在且合法）> profile 的 `config` > 默认全开。
+`/api/summary` 会返回 `modules` / `modules_source`，告诉你每个开关的当前值和来源（`ui-config` / `profile` / `default`）。
+
+**注意生效时机**：自动注入、写入工具**改完立即生效**；读取工具 / 做梦 / 项目 / 待确认惦记 / 信息流是**下次启动生效**（工具在启动时一次性注册，宿主没有注销接口）。
+
+**headless 不受影响**：没有 `webServer` 时那段注册不激活，浏览器半也不加载。
+
+## 状态（0.2.1）
+
+- **读**：真机 `dispatch=ok`，`direct_hit_count: 2` 返回真实命中
+- **写**：真机 `record=ok`，库内落 candidate + memory，`origin.author_kind=model`、`call_id` 与宿主记录一致
+- **注入**：`compileRound` 已接进运行时，section 文本是**当轮编译出来的记忆目录**（`text` 为函数，每步 `assemble()` 重取）；无 tokenizer/H 时退回 tools-only，不假装投递（`delivery=unknown`）
+- **界面**：左侧栏「记忆」入口 + 面板（三数字 + 最近 5 条）+ 设置页七行模块开关
+- **测试**：356 项全绿
 
-已实现并在真机验证**读**与**写**；仍有 6 条设计条款未达标（合并时 due 语义、回退证明深度、门牌与骨架核验、混版分页测试等）。逐条列在本文件末尾"已知边界"一节，不粉饰。
+**仍不达标**：`L6` 只核到内容 hash 与关联，**没有逐项重放 relations 内容**；真实旧库尚未导入；生产 cutover 未跑；`feed` 生产 provider 未接。见文末"已知边界"。
 
 MIT License。
 

package/client.js

@@ -0,0 +1,137 @@
+window.__ModuleLoader__.load({
+  id: 'dsh-memsys',
+  factory(require) {
+    const React = require('react');
+    const h = React.createElement;
+    const NS = 'dsh-memsys';
+    const API = '/dsh-memsys/api/summary';
+    const CONFIG = '/dsh-memsys/api/config';
+
+    function useSummary() {
+      const [state, setState] = React.useState(null);
+      React.useEffect(() => {
+        let alive = true;
+        const load = () => {
+          fetch(API)
+            .then((response) => (response.ok ? response.json() : Promise.reject(new Error(String(response.status)))))
+            .then((data) => alive && setState(data))
+            .catch(() => alive && setState({ error: true }));
+        };
+        load();
+        const timer = setInterval(load, 15000);
+        return () => {
+          alive = false;
+          clearInterval(timer);
+        };
+      }, []);
+      return [state, setState];
+    }
+
+    function MemoryPanel() {
+      const [state] = useSummary();
+      if (!state) return h('p', { style: { padding: 16 } }, '读取记忆…');
+      if (state.error) return h('p', { style: { padding: 16 } }, '暂时读不到记忆数据。');
+      return h(
+        'div',
+        { style: { padding: 16, lineHeight: 1.7 } },
+        h('h2', { style: { margin: '0 0 8px' } }, '记忆'),
+        h('p', null, `记忆 ${state.memories} 条 · 候选 ${state.candidates} 条 · 待确认惦记 ${state.pending_due} 条`),
+        h('h3', { style: { margin: '16px 0 6px' } }, '最近 5 条'),
+        state.recent.length === 0
+          ? h('p', null, '还没有记忆。')
+          : h('ul', null, state.recent.map((memory) => h('li', { key: memory.id }, memory.text))),
+      );
+    }
+
+    function MemoryIcon() {
+      return h('span', { 'aria-hidden': true, role: 'img', title: '记忆' }, '🐳');
+    }
+
+    const SOURCE_LABEL = { 'ui-config': '设置文件', profile: 'profile 配置', default: '默认值' };
+
+    // key, 名字, 一句人话, 生效时机（别糊成"立即生效"，四个模块真的要重启）
+    const MODULE_ROWS = [
+      ['context', '自动注入', '每轮把记忆摘要注入系统提示；关掉后只能手动查', '改完立即生效'],
+      ['read', '读取工具', '关掉后查询类工具（get / search / review）不可用', '下次启动生效'],
+      ['write', '写入工具', '关掉后不再记录新记忆，候选也收', '改完立即生效'],
+      ['dream', '做梦', '关掉后不浮现、也不能记录梦', '下次启动生效'],
+      ['projects', '项目', '关掉后项目视角不可用', '下次启动生效'],
+      ['due', '待确认惦记', '关掉后不提醒到期的惦记，也不能确认或搁置', '下次启动生效'],
+      ['feed', '信息流', '关掉后不产出信息流候选', '下次启动生效'],
+    ];
+
+    function MemorySettings() {
+      const [state, setState] = React.useState(null);
+      const [note, setNote] = React.useState('');
+      React.useEffect(() => {
+        fetch(API)
+          .then((response) => (response.ok ? response.json() : Promise.reject(new Error(String(response.status)))))
+          .then(setState)
+          .catch(() => setState({ error: true }));
+      }, []);
+      const modules = state?.modules ?? {};
+      const save = (key, value) => {
+        const previous = modules[key] !== false;
+        setState((current) => ({ ...(current ?? {}), modules: { ...(current?.modules ?? {}), [key]: value } }));
+        setNote('保存中…');
+        fetch(CONFIG, {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ modules: { [key]: value } }),
+        })
+          .then((response) =>
+            response.ok
+              ? response.json().then((body) => setState((current) => ({ ...(current ?? {}), ...body })))
+              : Promise.reject(new Error(String(response.status))),
+          )
+          .then(() => setNote('已保存'))
+          .catch(() => {
+            setState((current) => ({ ...(current ?? {}), modules: { ...(current?.modules ?? {}), [key]: previous } }));
+            setNote('保存失败');
+          });
+      };
+      const disabled = !state || state.error === true;
+      return h(
+        'div',
+        { style: { padding: '8px 0', lineHeight: 1.7 } },
+        h('p', { style: { margin: '0 0 4px', opacity: 0.75 } }, '按模块开关，默认全开。关掉哪一项，那一项就不再工作。'),
+        ...MODULE_ROWS.map(([key, label, hint, timing]) =>
+          h(
+            'label',
+            { key, style: { display: 'block', margin: '6px 0' } },
+            h('span', { style: { display: 'flex', gap: 8, alignItems: 'center' } },
+              h('input', {
+                type: 'checkbox',
+                checked: modules[key] !== false,
+                disabled,
+                onChange: (event) => save(key, event.target.checked),
+              }),
+              label,
+            ),
+            h('span', { style: { display: 'block', marginLeft: 24, opacity: 0.7, fontSize: '0.92em' } },
+              `${hint}（${timing}）`),
+          ),
+        ),
+        h('p', { style: { opacity: 0.75, margin: '10px 0 0' } }, `数据目录：${state?.data_dir ?? '未配置'}`),
+        h('p', { style: { opacity: 0.75, margin: '4px 0 0' } },
+          `当前生效值来源：${SOURCE_LABEL[state?.modules_source] ?? state?.modules_source ?? '未知'}`),
+        note ? h('p', { style: { opacity: 0.75, margin: '4px 0 0' } }, note) : null,
+      );
+    }
+
+    return {
+      inject: ['slots'],
+      apply(ctx) {
+        ctx.slots.inject('main', () =>
+          ctx.slots.register({ name: 'main', key: NS }, MemoryPanel),
+        );
+        ctx.slots.inject('sidebar.panellist', () =>
+          ctx.slots.register({ name: 'sidebar.panellist', id: NS, order: 30, label: () => '记忆' }, MemoryIcon),
+        );
+        ctx.slots.inject('settings.section', () =>
+          ctx.slots.register({ name: 'settings.section', id: NS, order: 40, label: () => '记忆系统' }, MemorySettings),
+        );
+      },
+    };
+  },
+});

package/index.mjs

@@ -12,13 +12,81 @@ import { createFeedHandler } from './src/tools/feed.mjs';
 import { createSelfHandler } from './src/tools/self.mjs';
 import { createRecordHandler } from './src/tools/record.mjs';
 import { runtimeFromExec } from './src/runtime/identity.mjs';
+import { createSummaryHandler } from './src/runtime/summary.mjs';
+import { mergeModules, resolveModulesDetail, writeUiConfig } from './src/runtime/ui-config.mjs';
+import { createRoundInjector } from './src/runtime/inject-round.mjs';
+import { compileRound } from './src/context/compile.mjs';
 
 export const name = 'dsh-memsys';
 /** tools is a real host service; static inject is the verified registration path. */
 export const inject = ['tools'];
 
-function createHostHandlers(config = {}, ctx = null) {
+/**
+ * Module switches have three ranks, highest first:
+ *   1. `<data_dir>/ui-config.json` — written by the settings page;
+ *   2. the profile patch config (`auto_inject` / `modules`), which is itself a
+ *      per-key overlay on the default map;
+ *   3. every module on.
+ * The file wins so a toggle survives a restart without rewriting the profile,
+ * and the in-memory map is applied immediately (no restart).
+ */
+function createUiState(config = {}, logger = console) {
   const dataDir = config.data_dir ?? process.env.MEMSYS_DATA_DIR ?? null;
+  const detail = resolveModulesDetail({ dataDir, profileConfig: config, logger });
+  // One stable object: host tools capture it at registration, so a POST has to
+  // mutate it in place or the call-time gates would keep reading stale values.
+  const modules = { ...detail.modules };
+  let source = detail.source;
+  return {
+    dataDir,
+    get modules() {
+      return modules;
+    },
+    get source() {
+      return source;
+    },
+    get autoInject() {
+      return modules.context !== false;
+    },
+    apply(written) {
+      Object.assign(modules, written.modules);
+      source = 'ui-config';
+    },
+    sync: () => {},
+  };
+}
+
+function createHostHandlers(config = {}, ctx = null, ui = null) {
+  const dataDir = config.data_dir ?? process.env.MEMSYS_DATA_DIR ?? null;
+  const uiState = ui ?? {
+    get modules() {
+      return mergeModules(config, null);
+    },
+    get source() {
+      return typeof config.auto_inject === 'boolean' || config.modules ? 'profile' : 'default';
+    },
+    get autoInject() {
+      return mergeModules(config, null).context !== false;
+    },
+    apply() {},
+    sync: () => {},
+  };
+  const uiSummary = createSummaryHandler({
+    main: () => db().main,
+    dataDir,
+    getConfig: () => ({ modules: uiState.modules, source: uiState.source }),
+    onConfig: (patch) => {
+      if (!dataDir) {
+        const err = new Error('data_dir_missing');
+        err.code = 'data_dir_missing';
+        throw err;
+      }
+      const written = writeUiConfig(dataDir, patch);
+      uiState.apply(written);
+      uiState.sync();
+      return { auto_inject: written.auto_inject, modules: written.modules };
+    },
+  });
   let handles = null;
   const db = () => {
     if (!dataDir) {
@@ -67,6 +135,7 @@ function createHostHandlers(config = {}, ctx = null) {
     memsys_project_get: (args) => createProjectHandler({ main: db().main, clock: systemClock }).get(args),
     memsys_self_get: (args) => createSelfHandler({ main: db().main, clock: systemClock }).get(args),
     memsys_feed: (args) => createFeedHandler({ clock: systemClock }).feed(args),
+    memsys_ui_summary: (req, res) => uiSummary(req, res),
     memsys_record: (args, exec) => {
       const identity = runtimeFromExec({ exec, ctx, tool: 'record', args });
       if (!identity.ok) return { status: 'error', code: identity.code, ...identity };
@@ -94,8 +163,39 @@ function createHostHandlers(config = {}, ctx = null) {
  * section exists only for the isolated probe profile.
  */
 export async function apply(ctx, config = {}) {
-  const handlers = createHostHandlers(config, ctx);
-  const registration = await registerHostTools({ ctx, handlers });
+  const ui = createUiState(config);
+  const handlers = createHostHandlers(config, ctx, ui);
+  const registration = await registerHostTools({ ctx, handlers, modules: ui.modules });
+
+  // The round injector owns the session/turn subscription; the section only
+  // reads its current text. Verified empirically: a section's `text` function is
+  // re-evaluated on every `systemPrompt.assemble()` (once per model step), so no
+  // per-turn re-mount is needed — a toggle only has to change what `current()` says.
+  let injector = null;
+  const syncInjector = () => {
+    if (ui.modules.context === false || !ui.dataDir) {
+      injector?.dispose?.();
+      injector = null;
+      return;
+    }
+    if (!injector) {
+      injector = createRoundInjector({
+        ctx,
+        dataDir: ui.dataDir,
+        modules: ui.modules,
+        compileRound,
+        tokenizer: config.tokenizer ?? null,
+        H: config.H ?? null,
+        mode: config.mode ?? 'work',
+      });
+      try {
+        injector.refresh({});
+      } catch {
+        // a failed first compile must not stop the host half from booting
+      }
+    }
+  };
+  syncInjector();
   const toolProbe = process.env.MEMSYS_TOOL_PROBE ?? null;
   const writeToolProbe = (deferred) => {
     if (!toolProbe) return;
@@ -235,21 +335,62 @@ export async function apply(ctx, config = {}) {
     write();
   }
 
-  const autoInject = config.auto_inject === true;
+  if (typeof ctx?.inject === 'function') {
+    try {
+      ctx.inject(['webServer'], (web) => {
+        web.effect(
+          () =>
+            web.webServer.register({
+              kind: 'exact',
+              path: '/dsh-memsys/api/summary',
+              handler: (req, res) => handlers.memsys_ui_summary(req, res),
+            }),
+          'memsys: ui summary route',
+        );
+        web.effect(
+          () =>
+            web.webServer.register({
+              kind: 'exact',
+              path: '/dsh-memsys/api/config',
+              handler: (req, res) => handlers.memsys_ui_summary(req, res),
+            }),
+          'memsys: ui config route',
+        );
+      });
+    } catch {
+      // profiles without webServer stay headless
+    }
+  }
   const diagnostic = config.diagnostic_section === true;
   let disposeSection = () => {};
-  if (autoInject || diagnostic) {
-    const getText = () =>
-      autoInject
-        ? '[memsys] 注入：tools-only（本批未取得宿主预算与回执，不作逐轮交付承诺）'
-        : '[memsys] diagnostic section（auto_inject=false）';
+  const syncSection = () => {
+    disposeSection();
+    disposeSection = () => {};
+    // The section is owned by the `context` module; the probe profile may force
+    // a diagnostic section even while injection is off.
+    if (ui.modules.context === false && !diagnostic) return;
     disposeSection = registerSection(ctx, {
-      getText,
+      getText: () =>
+        ui.modules.context === false
+          ? '[memsys] diagnostic section（context=false）'
+          : (injector?.current().text ?? ''),
+      dynamicText: true,
       diagnosticMarker: process.env.MEMSYS_SECTION_PROBE ?? null,
     });
-  }
+  };
+  // A profile without systemPrompt (headless/embedded) must still boot the tools.
+  ui.sync = () => {
+    try {
+      syncInjector();
+      syncSection();
+    } catch {
+      // keep the host half alive; the section is optional
+    }
+  };
+  ui.sync();
   return () => {
     disposeSection();
+    injector?.dispose?.();
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-memsys",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "A memory system plugin for DeepSeek Harness: append-only facts, candidates and adjudication, dreams, and budget-aware context injection.",
   "license": "MIT",
   "repository": {
@@ -28,15 +28,22 @@
     "node": ">=22.13"
   },
   "exports": {
-    ".": "./index.mjs"
+    ".": "./index.mjs",
+    "./client": "./client.js"
   },
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true,
+      "inject": []
     }
   },
   "files": [
     "index.mjs",
+    "client.js",
     "cordis.patch.yml",
     "src",
     "scripts",

package/scripts/build.mjs

@@ -12,7 +12,8 @@ function walk(dir, out = []) {
     if (SKIP_DIRS.has(entry.name)) continue;
     const full = path.join(dir, entry.name);
     if (entry.isDirectory()) walk(full, out);
-    else if (entry.name.endsWith('.mjs')) out.push(full);
+    else if (entry.name.endsWith('.mjs') || (entry.name.endsWith('.js') && entry.name !== 'client.js')) out.push(full);
+    else if (entry.name === 'client.js') out.push(full);
   }
   return out;
 }

package/scripts/import-legacy.mjs

@@ -178,8 +178,10 @@ async function main() {
     required(deploymentDir, 'USAGE: activate --plan <plan.json> --data-dir <dir> --restore-report <report.json> --deployment-dir <dir>');
     const activateTarget = openTarget(dataDir);
     let businessRows = null;
+    let databaseFreeze = null;
     try {
       businessRows = rollback.snapshotBusinessRows(activateTarget.handles.main);
+      databaseFreeze = rollback.snapshotDatabaseFreeze(activateTarget.handles);
     } finally {
       closeAll(activateTarget.handles);
     }
@@ -193,6 +195,7 @@ async function main() {
         restoreBatch: restore.selected_batch,
         business_counts: businessRows?.counts ?? null,
         business_rows: businessRows,
+        db_freeze: databaseFreeze,
         activatedAt: systemClock.at().at,
       }, null, 2)}\n`,
       'utf8',
@@ -225,6 +228,7 @@ async function main() {
     }
     const restored = openAll(resolveConfig({ dataDir: restoredDir }));
     let comparison;
+    let freezeComparison = { ok: true, missing: [] };
     try {
       comparison = config.business_rows
         ? rollback.compareBusinessRows({ db: restored.main, baseline: config.business_rows })
@@ -232,11 +236,17 @@ async function main() {
             db: restored.main,
             expected: config.business_counts ?? {},
           });
+      if (config.db_freeze) {
+        freezeComparison = rollback.compareDatabaseFreeze(
+          { main: restored.main, control: restored.control, dream: restored.dream },
+          config.db_freeze,
+        );
+      }
     } finally {
       closeAll(restored);
     }
-    if (!comparison.ok) {
-      console.log(`ROLLBACK_CHECK_FAILED business_missing=${comparison.missing.join(',')}`);
+    if (!comparison.ok || !freezeComparison.ok) {
+      console.log(`ROLLBACK_CHECK_FAILED business_missing=${comparison.missing.join(',')} freeze_missing=${freezeComparison.missing.join(',')}`);
       process.exitCode = 1;
       return;
     }

package/scripts/live-check.mjs

@@ -125,7 +125,7 @@ record('profile_prepared', dumpBefore.status === 0, {
 // 2. Stage an ASCII copy; the live source tree is never linked into a profile.
 fs.rmSync(STAGE, { recursive: true, force: true });
 fs.mkdirSync(STAGE, { recursive: true });
-for (const name of ['package.json', 'index.mjs', 'cordis.patch.yml']) {
+for (const name of ['package.json', 'index.mjs', 'client.js', 'cordis.patch.yml']) {
   fs.copyFileSync(path.join(ROOT, name), path.join(STAGE, name));
 }
 fs.cpSync(path.join(ROOT, 'src'), path.join(STAGE, 'src'), { recursive: true });

package/src/context/compile.mjs

@@ -1,3 +1,4 @@
+import { currentRevision } from '../storage/open.mjs';
 import { payloadHash } from '../identity.mjs';
 import {
   COMPRESSION_STEPS,
@@ -188,6 +189,7 @@ function compileRoundInner({
   project = null,
   sessionId = null,
   dream = null,
+  modules = null,
 }) {
   if (!tokenizer || H === null) {
     return Object.freeze({
@@ -206,11 +208,11 @@ function compileRoundInner({
     feedback: (item) => feedback(item.id),
   });
   const depsDream = dream;
-  const dueItems = orderPendingDue(selectPendingDue({ main, mode, now: clock.now() }));
+  const dueItems = modules?.due === false ? [] : orderPendingDue(selectPendingDue({ main, mode, now: clock.now() }));
   const dueLines = dueItems.map((item) => dueDirectoryLine(item, 80));
   const dueTypedIds = dueItems.map((item) => item.typed_id);
   const dreamSurface =
-    depsDream && dreamSurfaceEnabled(main)
+    modules?.dream !== false && depsDream && dreamSurfaceEnabled(main)
       ? surfaceDreams({ main, dream: depsDream, clock, mode, sessionId: sessionId ?? 'unknown-session', enabled: true, limit: 1 })
       : { enabled: false, items: [] };
   const dreamItems = dreamSurface.items ?? [];
@@ -248,7 +250,6 @@ function compileRoundInner({
   const typedIds = project && mode === 'work' ? [`project:${project.projectId}`] : [];
   const fixedText = buildFixedText({ clock, mode, project: mode === 'work' ? project : null });
   const snapshotId = `snap:${payloadHash({
-    roundId,
     mode,
     revision: selected.revision,
     policyRevision,
@@ -443,7 +444,7 @@ function compileRoundInner({
     roundId,
     mode,
     level,
-    sourceRevision: selected.revision,
+    sourceRevision: currentRevision(main),
     policyRevision,
     sectionText: chosen.sectionText,
     sectionHash,
@@ -469,7 +470,7 @@ function compileRoundInner({
     mode: 'auto',
     snapshot_revision: snapshotId,
     roundId,
-    source_revision: selected.revision,
+    source_revision: currentRevision(main),
     policy_revision: policyRevision,
     delivery_level: level,
     delivery: 'unknown',

package/src/context/delivery.mjs

@@ -50,7 +50,7 @@ export function recordDelivery({
     missing = expected.filter((id) => !receivedSet.has(id));
     extra = received.filter((id) => !expectedSet.has(id));
     hashMatched = payloadHash !== null && manifest?.hashes?.payload === payloadHash;
-    if (missing.length === 0 && extra.length === 0 && hashMatched) {
+    if (actualMemories.length > 0 && missing.length === 0 && extra.length === 0 && hashMatched) {
       delivery = 'confirmed';
     } else if (received.length > 0) {
       delivery = 'incomplete';

package/src/context/snapshots.mjs

@@ -277,8 +277,16 @@ export function getGroupPage({
     if (decoded.s !== snapshotRevision || decoded.g !== groupId) {
       return { status: 'error', code: 'invalid_cursor', reason: 'cursor_binding_mismatch', clock: clock.at().at };
     }
-    if (main && Number(snapshot.source_revision) !== Number(currentRevision(main))) {
-      return staleCursor(control, clock);
+    if (main) {
+      const manifest = snapshot.manifest_json ? JSON.parse(snapshot.manifest_json) : {};
+      const expectedCount = Array.isArray(manifest.eligible_ids) ? manifest.eligible_ids.length : null;
+      const currentCount = Number(main.prepare('SELECT COUNT(*) AS n FROM memories').get().n);
+      if (
+        Number(snapshot.source_revision) !== Number(currentRevision(main)) ||
+        (expectedCount !== null && currentCount > expectedCount)
+      ) {
+        return staleCursor(control, clock);
+      }
     }
     offset = decoded.o;
   }

package/src/dream/organize.mjs

@@ -37,6 +37,19 @@ function dueDeadline(main, memoryId) {
   return queue?.deadline_at ?? null;
 }
 
+/** Merge may not silently erase due semantics; anything due-bearing is refused. */
+function assertMergeAdmissible(main, memory) {
+  if (['open', 'pending-due', 'pending-done', 'cooled-due', 'shelved-due', 'done', 'dropped'].includes(memory.due_state)) {
+    throw new WriteError('blocked_by_due_state', { memoryId: memory.id, dueState: memory.due_state });
+  }
+  if (memory.type === 'promise') {
+    throw new WriteError('blocked_by_due_state', { memoryId: memory.id, reason: 'promise' });
+  }
+  if (memory.due_at || dueDeadline(main, memory.id)) {
+    throw new WriteError('blocked_by_due_state', { memoryId: memory.id, reason: 'deadline' });
+  }
+}
+
 /**
  * Mechanical exact merge only: no similarity, no NFKC, no negation stripping.
  * Endpoints must be active, resolved and accepted; dream-linked rows only yield a
@@ -58,9 +71,7 @@ export function mergeExact(deps, { runtime, ids }) {
     }
   }
   for (const memory of memories) {
-    if (['open', 'pending-due', 'pending-done', 'cooled-due', 'shelved-due'].includes(memory.due_state)) {
-      throw new WriteError('blocked_by_due_state', { memoryId: memory.id, dueState: memory.due_state });
-    }
+    assertMergeAdmissible(main, memory);
     if (memory.key_status !== 'resolved') throw new WriteError('unresolved_forbidden', { memoryId: memory.id });
     if (memory.binding_status !== 'accepted') throw new WriteError('binding_not_accepted', { memoryId: memory.id });
   }
@@ -163,6 +174,10 @@ export function mergeExact(deps, { runtime, ids }) {
   };
   let returnStorage = null;
   withImmediate(main, () => {
+    for (const id of unique) {
+      const fresh = getMemory(main, id);
+      assertMergeAdmissible(main, fresh);
+    }
     insertObservation(main, {
       id: observationId,
       idempotency_key: `obs:merge:${mergeKey}`,

package/src/import/legacy.mjs

@@ -481,8 +481,27 @@ export function verifyPlan(deps, plan) {
       continue;
     }
     report.items += 1;
-    if (item.itemKind === 'graph_node') report.graph_nodes += 1;
-    if (item.itemKind === 'graph_edge') report.graph_edges += 1;
+    if (item.itemKind === 'graph_node') {
+      report.graph_nodes += 1;
+      const node = main.prepare('SELECT * FROM graph_nodes WHERE id = ?').get(item.payload.id);
+      if (!node) report.missing.push(`${item.itemId}:graph_node`);
+      else if (node.label !== item.payload.label || node.kind !== item.payload.kind || node.source_ref !== `node:${item.payload.id}`) {
+        report.missing.push(`${item.itemId}:graph_node_content`);
+      }
+    }
+    if (item.itemKind === 'graph_edge') {
+      report.graph_edges += 1;
+      const edge = main.prepare('SELECT * FROM graph_edges WHERE id = ?').get(item.payload.id);
+      if (!edge) report.missing.push(`${item.itemId}:graph_edge`);
+      else if (
+        edge.from_id !== item.payload.from ||
+        edge.to_id !== item.payload.to ||
+        edge.kind !== item.payload.kind ||
+        edge.source_ref !== `edge:${item.payload.id}`
+      ) {
+        report.missing.push(`${item.itemId}:graph_edge_content`);
+      }
+    }
     if (item.itemKind === 'memory') {
       const targets = JSON.parse(row.target_ids);
       const observation = targets[0] ? getObservation(main, targets[0]) : null;