dsh-memsys 0.1.0 → 0.2.1

package/src/runtime/summary.mjs

@@ -0,0 +1,176 @@
+/**
+ * Host side of the optional Web UI (sidebar panel + settings section).
+ *
+ * Read-only over SQLite, plus the module switches read through `ui-config.mjs`
+ * (the same source the host gates use). Both routes enforce loopback +
+ * same-origin before touching data; nothing here is model-facing.
+ */
+import {
+  DEFAULT_MODULES,
+  MODULE_KEYS,
+  readUiConfig,
+  resolveModulesDetail,
+  writeUiConfig,
+} from './ui-config.mjs';
+
+const RECENT_LIMIT = 5;
+const TEXT_LIMIT = 80;
+const BODY_LIMIT = 4096;
+
+const truncate = (text) => Array.from(String(text ?? '')).slice(0, TEXT_LIMIT).join('');
+
+/** Three counts, the five latest memories, and the effective module map. */
+export function buildSummary(
+  main,
+  { dataDir = null, modules = DEFAULT_MODULES, modulesSource = 'default', autoInject = undefined } = {},
+) {
+  const db = typeof main === 'function' ? main() : main;
+  const one = (sql, ...params) => Number(db.prepare(sql).get(...params)?.n ?? 0);
+  const recent = db
+    .prepare('SELECT id, text FROM memories ORDER BY recorded_at DESC, id DESC LIMIT ?')
+    .all(RECENT_LIMIT)
+    .map((row) => ({ id: row.id, text: truncate(row.text) }));
+  const effective = {};
+  for (const key of MODULE_KEYS) effective[key] = modules?.[key] !== false;
+  return {
+    memories: one('SELECT COUNT(*) AS n FROM memories'),
+    candidates: one("SELECT COUNT(*) AS n FROM candidates WHERE status IN ('pending', 'conflicted')"),
+    pending_due: one("SELECT COUNT(*) AS n FROM memories WHERE due_state = 'pending-due'"),
+    recent,
+    data_dir: dataDir,
+    auto_inject: autoInject === undefined ? effective.context : autoInject === true,
+    auto_inject_source: modulesSource,
+    modules: effective,
+    modules_source: modulesSource,
+  };
+}
+
+export function isLoopback(req) {
+  const address = req?.socket?.remoteAddress ?? '';
+  return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1';
+}
+
+export function sameOrigin(req) {
+  const origin = req?.headers?.origin;
+  const host = req?.headers?.host;
+  if (!origin) return true;
+  try {
+    return new URL(origin).host === host;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * One handler for GET summary and POST config.
+ *
+ * `main` may be a thunk so a profile that never opened the database still gets
+ * a structured 503 instead of a thrown route error.
+ */
+export function createSummaryHandler({
+  main,
+  dataDir = null,
+  getConfig = () => ({ modules: DEFAULT_MODULES, source: 'default' }),
+  onConfig = null,
+} = {}) {
+  const send = (res, status, payload) => {
+    res.statusCode = status;
+    res.setHeader('content-type', 'application/json');
+    res.setHeader('cache-control', 'no-store');
+    res.end(JSON.stringify(payload));
+  };
+
+  const snapshot = () => {
+    const current = getConfig() ?? {};
+    const modules = current.modules ?? DEFAULT_MODULES;
+    return {
+      modules,
+      source: current.source ?? 'default',
+      auto_inject: modules?.context !== false,
+    };
+  };
+
+  return (req, res) => {
+    if (!isLoopback(req) || !sameOrigin(req)) {
+      send(res, 403, { error: 'forbidden' });
+      return;
+    }
+    if (req.method === 'POST') {
+      const type = String(req.headers?.['content-type'] ?? '').toLowerCase();
+      if (!type.includes('application/json')) {
+        send(res, 415, { error: 'json_required' });
+        return;
+      }
+      let body = '';
+      let tooLarge = false;
+      req.on?.('data', (chunk) => {
+        if (tooLarge) return;
+        body += chunk;
+        if (body.length > BODY_LIMIT) tooLarge = true;
+      });
+      req.on?.('end', () => {
+        if (tooLarge) {
+          send(res, 413, { error: 'body_too_large' });
+          return;
+        }
+        let parsed = null;
+        try {
+          parsed = JSON.parse(body || '{}');
+        } catch {
+          send(res, 400, { error: 'invalid_json' });
+          return;
+        }
+        const wantsModules = parsed?.modules && typeof parsed.modules === 'object';
+        const wantsAutoInject = typeof parsed?.auto_inject === 'boolean';
+        if (!wantsModules && !wantsAutoInject) {
+          send(res, 400, { error: 'config_required' });
+          return;
+        }
+        if (wantsModules) {
+          const bad = Object.keys(parsed.modules).filter(
+            (key) => MODULE_KEYS.includes(key) && typeof parsed.modules[key] !== 'boolean',
+          );
+          if (bad.length > 0) {
+            send(res, 400, { error: 'module_value_not_boolean', keys: bad });
+            return;
+          }
+        }
+        try {
+          const written = onConfig?.({ ...parsed }) ?? null;
+          const next = written ?? snapshot();
+          send(res, 200, {
+            ok: true,
+            auto_inject: next.auto_inject,
+            auto_inject_source: 'ui-config',
+            modules: next.modules,
+            modules_source: 'ui-config',
+          });
+        } catch (err) {
+          send(res, 500, { error: 'write_failed', message: String(err?.message ?? err) });
+        }
+      });
+      return;
+    }
+    if (req.method && req.method !== 'GET') {
+      send(res, 405, { error: 'method_not_allowed' });
+      return;
+    }
+    try {
+      const state = snapshot();
+      send(
+        res,
+        200,
+        buildSummary(main, {
+          dataDir,
+          modules: state.modules,
+          modulesSource: state.source,
+          autoInject: state.auto_inject,
+        }),
+      );
+    } catch (err) {
+      send(res, 503, { error: 'summary_unavailable', message: String(err?.code ?? err?.message ?? err) });
+    }
+  };
+}
+
+export { readUiConfig, resolveModulesDetail, writeUiConfig };

package/src/runtime/tools.mjs

@@ -246,8 +246,22 @@ function textRender(value) {
 }
 
 /** Plain tool objects before the host wraps them with defineTool. */
-export function toolDefinitions(handlers = {}) {
-  return MEMSYS_TOOLS.map((name) => {
+export function enabledToolNames(modules = null) {
+  const enabled = modules ?? { context: true, read: true, write: true, dream: true, projects: true, due: true, feed: true };
+  return MEMSYS_TOOLS.filter((name) => {
+    if (['memsys_get', 'memsys_search', 'memsys_review_get', 'memsys_context_get', 'memsys_self_get'].includes(name)) {
+      return enabled.read !== false;
+    }
+    if (name === 'memsys_project_get') return enabled.read !== false && enabled.projects !== false;
+    if (['memsys_dream_record', 'memsys_organize'].includes(name)) return enabled.dream !== false;
+    if (name === 'memsys_feed') return enabled.feed !== false;
+    if (name === 'memsys_record') return true; // registered but call-gated for an explicit module_disabled
+    return true;
+  });
+}
+
+export function toolDefinitions(handlers = {}, modules = null) {
+  return enabledToolNames(modules).map((name) => {
     const spec = TOOL_SPECS[name];
     return {
       name,
@@ -255,6 +269,9 @@ export function toolDefinitions(handlers = {}) {
       parameters: spec.parameters,
       outputSchema: TOOL_OUTPUT_SCHEMAS[name] ?? openObject(),
       async execute(args, exec) {
+        if (name === 'memsys_record' && modules?.write === false) {
+          return { status: 'error', code: 'module_disabled', module: 'write' };
+        }
         const handler = handlers[name];
         if (typeof handler !== 'function') {
           return { status: 'error', code: 'handler_unavailable', tool: name };
@@ -292,7 +309,7 @@ export function toolCapabilityStatus(liveReport = null) {
  * Register against a host ctx. No ctx.tools -> tools-only, no throw.
  * `defineTool` is resolved dynamically so offline tests never need the host package.
  */
-export async function registerHostTools({ ctx = null, handlers = {}, defineTool: injectedDefineTool = null } = {}) {
+export async function registerHostTools({ ctx = null, handlers = {}, modules = null, defineTool: injectedDefineTool = null } = {}) {
   if (!ctx || !ctx.tools || typeof ctx.tools.register !== 'function') {
     return { status: 'tools_only', registered: [], reason: 'no_tools_service', defineTool: null, tools: [...MEMSYS_TOOLS] };
   }
@@ -313,7 +330,7 @@ export async function registerHostTools({ ctx = null, handlers = {}, defineTool:
   }
   const registered = [];
   const errors = [];
-  for (const spec of toolDefinitions(handlers)) {
+  for (const spec of toolDefinitions(handlers, modules)) {
     try {
       const tool = defineTool({
         name: spec.name,

package/src/runtime/ui-config.mjs

@@ -0,0 +1,176 @@
+/**
+ * The single source of truth for module switches.
+ *
+ * Both halves read this file: the Web data route (`src/runtime/summary.mjs`) and
+ * the host-side gates (`src/runtime/modules.mjs` re-exports from here). Nothing
+ * else may re-implement the merge — a second copy is how the switch becomes a
+ * lie.
+ *
+ * Priority: `<data_dir>/ui-config.json` > profile patch config > default (true).
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const UI_CONFIG_FILE = 'ui-config.json';
+export const UI_CONFIG_VERSION = 2;
+export const MODULE_KEYS = Object.freeze(['context', 'read', 'write', 'dream', 'projects', 'due', 'feed']);
+export const DEFAULT_MODULES = Object.freeze({
+  context: true,
+  read: true,
+  write: true,
+  dream: true,
+  projects: true,
+  due: true,
+  feed: true,
+});
+
+const warn = (logger, message) => {
+  try {
+    logger?.warn?.(`[dsh-memsys] ${message}`);
+  } catch {
+    // a logger that throws must never break boot
+  }
+};
+
+/** Missing keys mean `true`; only an explicit `false` disables a module. */
+export function normalizeModules(input = {}) {
+  const modules = { ...DEFAULT_MODULES };
+  if (input && typeof input === 'object') {
+    for (const key of MODULE_KEYS) {
+      if (typeof input[key] === 'boolean') modules[key] = input[key];
+    }
+  }
+  return modules;
+}
+
+/**
+ * v2 is `{ version: 2, auto_inject, modules }`.
+ * v1 (or versionless) files only carry `auto_inject`; they migrate by mapping it
+ * onto `modules.context` while every other module stays on.
+ */
+export function normalizeUiConfig(parsed, logger = console) {
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;
+  const version = parsed.version;
+  const known = version === undefined || version === 1 || version === UI_CONFIG_VERSION;
+  if (!known) {
+    warn(logger, `ui-config 版本不认识（${version}），已忽略`);
+    return null;
+  }
+  const hasModules = parsed.modules && typeof parsed.modules === 'object';
+  if (version === undefined && typeof parsed.auto_inject !== 'boolean' && !hasModules) {
+    warn(logger, 'ui-config 既无 auto_inject 也无 modules，已忽略');
+    return null;
+  }
+  const modules = normalizeModules(hasModules ? parsed.modules : {});
+  if (!hasModules && typeof parsed.auto_inject === 'boolean') modules.context = parsed.auto_inject;
+  return {
+    version: UI_CONFIG_VERSION,
+    auto_inject: modules.context,
+    modules,
+  };
+}
+
+export function readUiConfig(dataDir, logger = console) {
+  if (!dataDir) return null;
+  const file = path.join(dataDir, UI_CONFIG_FILE);
+  let raw = null;
+  try {
+    if (!fs.existsSync(file)) return null;
+    raw = fs.readFileSync(file, 'utf8');
+  } catch (err) {
+    warn(logger, `ui-config 读取失败（${err?.message ?? err}），回落 profile 配置`);
+    return null;
+  }
+  try {
+    return normalizeUiConfig(JSON.parse(raw), logger);
+  } catch {
+    warn(logger, 'ui-config 不是合法 JSON，回落 profile 配置');
+    return null;
+  }
+}
+
+/**
+ * Pure merge used by every caller: defaults <- profile config <- ui-config.
+ * A legacy `auto_inject` fills `modules.context` only when that source says
+ * nothing about `modules` at all.
+ */
+export function mergeModules(profileConfig = null, uiConfig = null) {
+  const base = { ...DEFAULT_MODULES };
+  const apply = (source) => {
+    if (!source || typeof source !== 'object') return;
+    const modules = source.modules;
+    if (modules && typeof modules === 'object') {
+      for (const key of MODULE_KEYS) {
+        if (typeof modules[key] === 'boolean') base[key] = modules[key];
+      }
+    }
+    if (typeof source.auto_inject === 'boolean' && modules?.context === undefined) {
+      base.context = source.auto_inject;
+    }
+  };
+  apply(profileConfig);
+  apply(uiConfig);
+  return base;
+}
+
+/** Kept under the name the host gates already import. */
+export function resolveModules(profileConfig = null, uiConfig = null) {
+  return Object.freeze(mergeModules(profileConfig, uiConfig));
+}
+
+export function moduleEnabled(modules, key) {
+  return (modules ?? DEFAULT_MODULES)[key] !== false;
+}
+
+const profileSaysSomething = (profileConfig) =>
+  Boolean(
+    profileConfig &&
+      (profileConfig.modules && typeof profileConfig.modules === 'object'
+        ? MODULE_KEYS.some((key) => typeof profileConfig.modules[key] === 'boolean')
+        : typeof profileConfig.auto_inject === 'boolean'),
+  );
+
+/**
+ * Resolve for the Web route: returns the effective map plus which rank won,
+ * so the settings page can show where the value came from.
+ */
+export function resolveModulesDetail({ dataDir = null, profileConfig = null, logger = console } = {}) {
+  const stored = readUiConfig(dataDir, logger);
+  const modules = mergeModules(profileConfig, stored);
+  const source = stored ? 'ui-config' : profileSaysSomething(profileConfig) ? 'profile' : 'default';
+  return { modules, source, auto_inject: modules.context };
+}
+
+/**
+ * Partial update: sends only the keys it owns. A legacy `auto_inject` maps onto
+ * `modules.context`; sending `modules.context` mirrors back into `auto_inject`
+ * so v1 readers keep working.
+ */
+export function writeUiConfig(dataDir, patch = {}, logger = console) {
+  if (!dataDir) return null;
+  const current = readUiConfig(dataDir, logger) ?? {
+    version: UI_CONFIG_VERSION,
+    auto_inject: DEFAULT_MODULES.context,
+    modules: { ...DEFAULT_MODULES },
+  };
+  const next = { ...current.modules };
+  if (patch.modules && typeof patch.modules === 'object') {
+    for (const key of MODULE_KEYS) {
+      if (typeof patch.modules[key] === 'boolean') next[key] = patch.modules[key];
+    }
+  }
+  if (typeof patch.auto_inject === 'boolean' && patch.modules?.context === undefined) {
+    next.context = patch.auto_inject;
+  }
+  const normalized = {
+    version: UI_CONFIG_VERSION,
+    auto_inject: next.context,
+    modules: next,
+  };
+  fs.mkdirSync(dataDir, { recursive: true });
+  const target = path.join(dataDir, UI_CONFIG_FILE);
+  const temp = `${target}.tmp`;
+  fs.writeFileSync(temp, JSON.stringify(normalized, null, 2), 'utf8');
+  fs.renameSync(temp, target);
+  return normalized;
+}

package/test/fixtures/p3/c1-baseline.json

@@ -0,0 +1,90 @@
+{
+  "capturedAt": "2026-11-02T17:32:36.368Z",
+  "source": "P3-C1 pre-flight (plan-3 §2/§5.4)",
+  "protected_inputs": {
+    "whale-unify/memsys-design-v0.38.md": {
+      "bytes": 99880,
+      "sha256": "511cbd8ce3db4ff92706c641449ad83b195d4bd37f17b1b50a43e4847f028ac9"
+    },
+    "whale-unify/_build/contract.md": {
+      "bytes": 3520,
+      "sha256": "e3efb6588da5550cc1a526a31f0375b10abfc314a921ea8342a4b0d25396ff10"
+    },
+    "whale-unify/_build/plan-1.md": {
+      "bytes": 65433,
+      "sha256": "8b6572a59f9c968844f2a524202bf61bfb2a39f6d095961d6f849387cdfcf999"
+    },
+    "whale-unify/_build/plan-2.md": {
+      "bytes": 61363,
+      "sha256": "49e1cdec8f6fda36e40e27c0d1ce90e167c2cd77002608b8864b40fd3061fdc2"
+    },
+    "whale-unify/_build/plan-3.md": {
+      "bytes": 64985,
+      "sha256": "498550e1fe24fd075c43940a59dcf47d18ae19b7a914e2b0be917cf33578b3d6"
+    },
+    "whale-unify/_build/report-1.md": {
+      "bytes": 3448,
+      "sha256": "9a94435b1e61c2cd6c1dfe347eaac6669657239a364fcc3597c2892550e4d736"
+    },
+    "whale-unify/_build/report-2.md": {
+      "bytes": 3572,
+      "sha256": "42e00e3c7fbc50b3512362d2af8bfa68995fcb53faacd5f9c1d82439cb5e0c12"
+    },
+    "whale-unify/_build/decisions.md": {
+      "bytes": 10587,
+      "sha256": "2cbdda67546ea3b1dd8ded1b3355d47148c43cdad0d0bbe0a962e403debb434e"
+    }
+  },
+  "migrations": {
+    "control-001.sql": {
+      "bytes": 3504,
+      "sha256": "1b1e865dee83757213e7b5b09cd20d0ff19b4dd5ec53efb495205255b32e9f93"
+    },
+    "control-002.sql": {
+      "bytes": 3268,
+      "sha256": "df684d926d49b0c209d05ede4b533f46f0942ca80866a3d4bf54d05eb06d493c"
+    },
+    "control-003.sql": {
+      "bytes": 351,
+      "sha256": "7cf225bb30a80fb5ec7655bc6ad26ec5e296fd9edb86ea162770d3c418b56e32"
+    },
+    "dream-001.sql": {
+      "bytes": 370,
+      "sha256": "ac87b2becc5636645a4dcd14947040503091529eef114e9f589bea56ea1cc31e"
+    },
+    "main-001.sql": {
+      "bytes": 14497,
+      "sha256": "062d36f2651fc0ef55c3b329dd00ffff45ad0564d40d82fedffa7dfe75391bee"
+    },
+    "main-002.sql": {
+      "bytes": 3023,
+      "sha256": "dbbe52c06365c5903130283d22c295d0cc06492a6d9ee6a5f1702af6f789d96b"
+    },
+    "main-003.sql": {
+      "bytes": 706,
+      "sha256": "315330ffc9ffcfeecec7bf841688228630fd105b421d167ec080b559703ab633"
+    },
+    "main-004.sql": {
+      "bytes": 1285,
+      "sha256": "0a585a2115325db8d413e45ae97d287e77af061f435c77b528e9460dd1c33bba"
+    },
+    "main-005.sql": {
+      "bytes": 4675,
+      "sha256": "686a185473ed35c714768c9106a0f5165a14ee05a6f89c76be457894b0c81258"
+    },
+    "main-006.sql": {
+      "bytes": 1162,
+      "sha256": "695f0ad844bd6fb91813fc785ddebe1b1e6fa741300e89aff214250bd6389c1f"
+    }
+  },
+  "expected_versions_before": {
+    "main": 6,
+    "control": 3,
+    "dream": 1
+  },
+  "expected_versions_c1": {
+    "main": 7,
+    "control": 4,
+    "dream": 2
+  }
+}

package/test/p3-c1-dream.test.mjs

@@ -500,7 +500,7 @@ test('P3-C1 migration contract', async (t) => {
       }
       assert.deepEqual(versions, { main: 8, control: 4, dream: 2 });
       const baseline = JSON.parse(
-        fs.readFileSync(path.join(ROOT, '..', '_build', 'artifacts', 'p3', 'c1-baseline.json'), 'utf8'),
+        fs.readFileSync(path.join(ROOT, 'test', 'fixtures', 'p3', 'c1-baseline.json'), 'utf8'),
       );
       for (const [name, entry] of Object.entries(baseline.migrations)) {
         if (name === 'control-004.sql' || name === 'main-007.sql' || name === 'dream-002.sql') continue;

package/test/p4-p4-delivery.test.mjs

@@ -76,7 +76,13 @@ test('P4/P4-B E10: receipts must match the persistent manifest and groups', (t)
     receivedIds: expected,
     payloadHash,
   });
-  assert.equal(full.delivery, 'confirmed', JSON.stringify(full));
+  if (compiled.manifest.actual_ids.filter((id) => id.startsWith('mem_')).length === 0) {
+    // Design §6.2c: an empty actual set can never be confirmed, even if the receipt equals it.
+    assert.equal(full.delivery, 'incomplete', JSON.stringify(full));
+    assert.equal(full.code, 'receipt_incomplete');
+  } else {
+    assert.equal(full.delivery, 'confirmed', JSON.stringify(full));
+  }
   const exposure = ctx.main.prepare('SELECT memory_id FROM injections').all().map((row) => row.memory_id);
   assert.equal(exposure.length, 0, 'deferred members must not produce exposure');
 });

package/test/p6-b1-merge.test.mjs

@@ -0,0 +1,60 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  insertCandidate,
+  insertMemory,
+  insertObservation,
+  insertPointer,
+  insertTimeline,
+} from '../src/storage/repositories.mjs';
+import { mergeExact } from '../src/dream/organize.mjs';
+import { createTestContext, makeCandidate, makeMemory, makeObservation, mutableClock } from './helpers/fixtures.mjs';
+import { fakeRuntime } from './helpers/runtime.mjs';
+
+let seq = 0;
+
+function memory(ctx, { type = 'fact', dueState = 'none', deadline = null } = {}) {
+  seq += 1;
+  const text = '完全相同的合并记忆';
+  const observation = makeObservation(ctx, { messageSeq: 25000 + seq, text });
+  insertObservation(ctx.main, observation);
+  const candidate = makeCandidate(ctx, observation, { businessKey: `p6b1-${seq}`, text, why: 'w', type, scene: 'work', scope: 'work-only' });
+  Object.assign(candidate, { key_status: 'resolved', binding_status: 'accepted', binding_basis: '{}', origin_mode: 'self', semantic_status: 'quoted', record_kind: 'utterance' });
+  insertCandidate(ctx.main, candidate);
+  const row = makeMemory(ctx, candidate);
+  Object.assign(row, {
+    key_status: 'resolved', binding_status: 'accepted', binding_basis: '{}', origin_mode: 'self',
+    semantic_status: 'quoted', record_kind: 'utterance', due_state: dueState,
+  });
+  insertMemory(ctx.main, row);
+  insertTimeline(ctx.main, { memory_id: row.id, start_at: null, end_at: null, prec_start: 'unknown', prec_end: 'unknown', time_state: 'point', revision: 1 });
+  insertPointer(ctx.main, { memory_id: row.id, status: 'unknown', location: null, search_hint: null, lossy: 0, revision: 1 });
+  if (deadline) {
+    ctx.main
+      .prepare("INSERT INTO due_queue (memory_id, due_state, enqueued_seq, enqueued_at, opened_at, deadline_at, revision, reason) VALUES (?, 'none', 1, ?, NULL, ?, 0, 'test')")
+      .run(row.id, ctx.clock.at().at, deadline);
+  }
+  return row;
+}
+
+function merge(ctx, a, b) {
+  return mergeExact(
+    { main: ctx.main, control: ctx.control, clock: ctx.clock },
+    { runtime: fakeRuntime({ role: 'dream', callId: 'p6b1' }), ids: [a.id, b.id] },
+  );
+}
+
+test('P6/B1: promise, done/dropped and non-empty due are blocked from merge', (t) => {
+  const ctx = createTestContext({ clock: mutableClock().clock });
+  t.after(() => ctx.cleanup());
+  for (const options of [{ type: 'promise' }, { dueState: 'done' }, { dueState: 'dropped' }, { deadline: '2026-12-01T00:00:00Z' }]) {
+    const a = memory(ctx, options);
+    const b = memory(ctx, options);
+    assert.throws(
+      () => merge(ctx, a, b),
+      (err) => err.code === 'blocked_by_due_state',
+      JSON.stringify(options),
+    );
+  }
+});

package/test/p6-b2-pointers.test.mjs

@@ -0,0 +1,77 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+
+import { applyPlan, buildPlan, verifyPlan } from '../src/import/legacy.mjs';
+import { applyPointers, planPointers } from '../src/import/pointers.mjs';
+import { resolveConfig } from '../src/config.mjs';
+import { closeAll, openAll } from '../src/storage/open.mjs';
+import { migrateAll } from '../src/storage/migrate.mjs';
+import { seedInitialRegistry } from '../src/storage/repositories.mjs';
+import { canonicalJson } from '../src/identity.mjs';
+import { mutableClock } from './helpers/fixtures.mjs';
+
+function legacyCtx() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-memsys-p6b2-'));
+  const source = path.join(dir, 'source');
+  fs.mkdirSync(source, { recursive: true });
+  const clock = mutableClock().clock;
+  const handles = openAll(resolveConfig({ dataDir: path.join(dir, 'target') }));
+  migrateAll(handles, { clock });
+  handles.main.exec('BEGIN IMMEDIATE');
+  seedInitialRegistry(handles.main, clock);
+  handles.main.exec('COMMIT');
+  return {
+    dir, source, handles, clock,
+    deps: { main: handles.main, control: handles.control, clock },
+    cleanup() { try { closeAll(handles); } catch {} fs.rmSync(dir, { recursive: true, force: true }); },
+  };
+}
+
+test('P6/B2: changing a source byte blocks pointer apply before relation write', (t) => {
+  const ctx = legacyCtx();
+  t.after(() => ctx.cleanup());
+  const raw = '真实原文';
+  const record = { id: 'b2p', kind: 'point', raw, gist: '摘要', why: 'w', type: 'fact', scene: 'work', scope: 'work-only', pointer: { status: 'unknown' } };
+  fs.writeFileSync(path.join(ctx.source, 'legacy.json'), JSON.stringify({ records: [record], graph: { nodes: [], edges: [] } }), 'utf8');
+  const plan = buildPlan(ctx.source);
+  applyPlan(ctx.deps, plan);
+  const item = plan.items.find((entry) => entry.itemKind === 'memory');
+  const bytes = Buffer.from(raw, 'utf8');
+  const file = path.join(ctx.source, 'b2p.md');
+  fs.writeFileSync(file, bytes);
+  const versions = path.join(ctx.source, 'versions.json');
+  fs.writeFileSync(versions, JSON.stringify({ versions: [{
+    sourceObjectId: 'b2p', versionHash: item.sourceVersionHash,
+    location: file + '#bytes:0-' + bytes.length,
+    file, span: { start: 0, end: bytes.length },
+    spanHash: crypto.createHash('sha256').update(bytes).digest('hex'),
+  }] }), 'utf8');
+  const pointerPlan = planPointers({ main: ctx.handles.main, clock: ctx.clock }, versions);
+  assert.equal(pointerPlan.items.length, 1, JSON.stringify(pointerPlan.skipped));
+  fs.writeFileSync(file, Buffer.concat([bytes, Buffer.from('x')]));
+  assert.throws(
+    () => applyPointers({ main: ctx.handles.main, clock: ctx.clock }, pointerPlan),
+    (err) => err.code === 'source_bytes_changed',
+  );
+  const changes = ctx.handles.main.prepare("SELECT COUNT(*) AS n FROM relations WHERE type = 'pointer-change' AND json_extract(payload, '$.basis') = 'pointer-backfill'").get().n;
+  assert.equal(Number(changes), 0);
+});
+
+test('P6/B2: changed graph node label makes verifyPlan fail', (t) => {
+  const ctx = legacyCtx();
+  t.after(() => ctx.cleanup());
+  const record = { id: 'b2g', kind: 'point', raw: '文本', gist: '摘要', why: 'w', type: 'fact', scene: 'work', scope: 'work-only', pointer: { status: 'unknown' } };
+  const graph = { nodes: [{ id: 'n1', label: '旧标签', kind: 'concept' }], edges: [] };
+  fs.writeFileSync(path.join(ctx.source, 'legacy.json'), JSON.stringify({ records: [record], graph }), 'utf8');
+  const plan = buildPlan(ctx.source);
+  applyPlan(ctx.deps, plan);
+  ctx.handles.main.exec('DROP TRIGGER IF EXISTS trg_graph_nodes_no_update');
+  ctx.handles.main.prepare('UPDATE graph_nodes SET label = ? WHERE id = ?').run('新标签', 'n1');
+  const verify = verifyPlan({ main: ctx.handles.main, clock: ctx.clock }, plan);
+  assert.equal(verify.status, 'failed');
+  assert.ok(verify.missing.some((entry) => entry.includes('graph_node_content')), JSON.stringify(verify.missing));
+});