dsh-memu-memory 1.1.3 → 1.2.0

package/lib/memory.js

@@ -10,8 +10,9 @@ import {
   getLibrary, setSessionBinding, setRecallError, effectiveScope, listLibrariesAll,
 } from './state.js'
 import { stamp, redactSecrets, retryStoreWrite, warn } from './paths.js'
+import { scopeGenerationOf } from './consolidation-ledger.js'
 import { record } from './activity-log.js'
-import { BASE_AROUSAL, moodCongruence, moodDecay } from './mood.js'
+import { BASE_AROUSAL, derivedValence, dominanceBias, emotionActive, maxShare, moodCongruence, moodDecay, normalizeEmotion, overlap, readMood } from './mood.js'
 import { commit, retrieve, listFiles, forget } from './memu.js'
 import { bumpStats } from './stats.js'
 import { recallRelations } from './graph.js'
@@ -93,7 +94,59 @@ function clearRecallError(exec) {
   if (sessionId) setRecallError(sessionId, null)
 }
 
+// Serialize backend-bearing private writes across every route in this module.
+// Acquire this queue BEFORE the vector lease; neither waits while holding a
+// synchronous file lock. This is not a cross-process/backend transaction.
+const privateWriteTails = new Map()
 async function withManagedPrivateWrite(libraryId, action) {
+  const previous = privateWriteTails.get(libraryId) || Promise.resolve()
+  const running = previous.then(() => withManagedPrivateWriteImpl(libraryId, action))
+  const settled = running.then(() => {}, () => {})
+  privateWriteTails.set(libraryId, settled)
+  try { return await running } finally {
+    if (privateWriteTails.get(libraryId) === settled) privateWriteTails.delete(libraryId)
+  }
+}
+
+function assertCompensationResult(result, operation) {
+  if (!result || typeof result !== 'object' || Array.isArray(result) || result.ok === false || result.error || result.parseWarning
+    || (operation === 'backend compensation delete' && (!Number.isSafeInteger(result.deleted) || result.deleted < 0))) {
+    throw new Error(operation + ' was not acknowledged')
+  }
+}
+
+// The index remains authoritative. Refuse destructive repair if another index
+// writer replaced the expected pre-await entry; otherwise rebuild that old row.
+// No transaction spans these external calls: crashes/other processes can still
+// interrupt compensation. Never describe an uncertain repair as success.
+async function compensatePrivateCommit(error, { libraryId, id, route, db, expectedEntry }) {
+  try {
+    const current = loadPrivateIndex(libraryId).entries[id]
+    if (JSON.stringify(current ?? null) !== JSON.stringify(expectedEntry ?? null)) {
+      throw new Error('memory changed before backend compensation')
+    }
+    const snapshot = JSON.stringify(current)
+    assertCompensationResult(await forget({ route, db, name: id }), 'backend compensation delete')
+    if (current && !['pending_review', 'superseded'].includes(current.status)) {
+      assertCompensationResult(await commit({ route, db, payload: {
+        recall_files: [{ name: id, track: current.track || 'memory', description: clampText(current.title, 180), content: current.content }],
+        resource: [], user: {},
+      } }), 'backend compensation restore')
+    }
+    if (JSON.stringify(loadPrivateIndex(libraryId).entries[id]) !== snapshot) {
+      throw new Error('memory changed during backend compensation')
+    }
+  } catch (compensationError) {
+    const failure = new Error('private memory index write failed; backend compensation uncertain: ' + String(compensationError?.message || compensationError), { cause: error })
+    failure.code = 'PRIVATE_BACKEND_COMPENSATION_FAILED'
+    failure.compensationError = compensationError
+    warn(failure.message)
+    throw failure
+  }
+  throw error
+}
+
+async function withManagedPrivateWriteImpl(libraryId, action) {
   const intent = managedVectorIntent()
   if (!intent.managed) return action()
   // 选了本地向量、但下载完模型后从没跑过迁移（vector-active 只有 requested）：这里
@@ -219,6 +272,7 @@ export function resolveLibrary({ exec, libraryId, readOnly = false }) {
   }
   const binding = readOnly ? peekBinding(exec) : bindingFor(exec)
   if (!binding) throw new Error('no bound session')
+  assertConsolidationParent(binding)
   // A binding without a library means the conversation explicitly opted out of
   // private memory. Writing through it used to land in `index/null.json` — a
   // "successful" write that can never be recalled. Refuse with an actionable
@@ -232,8 +286,18 @@ export function resolveLibrary({ exec, libraryId, readOnly = false }) {
 // The sidebar switches (and the folder ceiling behind them) must constrain tool
 // calls too, not just injection. One gate, sourced from `effectiveScope` so the
 // folder policy is always part of the answer.
+function assertConsolidationParent(binding) {
+  if (!binding?.consolidationFork) return
+  const parent = getSessionBinding(binding.parentSessionId)
+  if (!parent || !binding.parentScopeGeneration || scopeGenerationOf(parent) !== binding.parentScopeGeneration) {
+    throw new Error('DSH_MEMU_SCOPE_STALE: consolidation worker parent authorization changed')
+  }
+}
+
 function assertScopeEnabled(binding, { layer = 'library' } = {}) {
   if (!binding) return
+  assertConsolidationParent(binding)
+  if (binding.consolidationFork && layer === 'global') throw new Error('DSH_MEMU_WORKER_RESTRICTED: private worker cannot access global memory')
   const scope = effectiveScope(binding)
   if (layer === 'library' && !scope.useLibrary) {
     throw new Error(scope.libraryBlocked
@@ -788,9 +852,16 @@ function recallScore(file, rank, context) {
 
   // Fading affect bias: what pulls is the tint the memory still carries today, not
   // the one it was written with. Old grievances quieten down; old fondness does not.
-  const moodBias = context.moodEnabled
-    ? 1 + 0.3 * moodCongruence(fadedValence(entry, context.now), context.moodValence)
-    : 1
+  //
+  // Two paths, one decision: when both sides carry a composition, compare the
+  // compositions (how much of the present shape the memory shares). Otherwise fall
+  // back to the legacy signed-valence congruence. Entries written before this model
+  // existed have no composition and must keep working unchanged.
+  const moodBias = !context.moodEnabled
+    ? 1
+    : (context.emotion && entry.emotion
+      ? 1 + 0.3 * affectFadeFactor(entry, context.now) * (2 * overlap(entry.emotion, context.emotion) - 1)
+      : 1 + 0.3 * moodCongruence(fadedValence(entry, context.now), context.moodValence))
   const peak = entry.peak === true ? 1 : Math.max(0, Number(entry.arousal || 0))
   const end = context.lastCreatedAt && file.createdAtIdentity === context.lastCreatedAt ? 1 : 0
   const peakEnd = 1 + 0.25 * Math.max(peak, end)
@@ -802,13 +873,33 @@ function recallScore(file, rank, context) {
   // this asks "does its loudness match the room right now?" — different questions that
   // only look like duplicates.
   const arousalTerm = context.moodEnabled ? arousalBias(entry, context) : 1
+  // Dominance asks a third question: who was steering. Two equally sad memories pull
+  // differently depending on whether the present state is "I can fix this" or "nothing
+  // I do matters". Bounded to +-10% so it can only reorder near-ties.
+  const dominanceTerm = context.moodEnabled ? dominanceBias(entry.dominance, context.dominance) : 1
   // An open loop is an unfinished thread — a promise, a question, a plan nobody
   // closed. Those are what a person brings up unprompted, so they get a nudge and not
   // a trump card: 1.25 still loses to a clearly better semantic hit.
   const openLoopBias = entry.openLoop ? 1.25 : 1
   const habituation = habituationFactor(entry, context.now)
 
-  return retrieval * strengthTerm * marginal * moodBias * peakEnd * primacy * openLoopBias * habituation * arousalTerm
+  return retrieval * strengthTerm * marginal * moodBias * peakEnd * primacy * openLoopBias * habituation * arousalTerm * dominanceTerm
+}
+
+/**
+ * How much of a memory's original tint is still there, 0..1.
+ *
+ * Same curve as `fadedValence`, but returned as a bare factor so the composition path
+ * applies the *fading* to the whole comparison instead of decaying the shares (shares
+ * sum to 1, so decaying them proportionally would change nothing).
+ */
+function affectFadeFactor(entry, now = Date.now()) {
+  const valence = entry.emotion ? derivedValence(entry.emotion) : Number(entry.moodValence || 0)
+  if (!valence) return 0
+  const updated = Date.parse(entry.updatedAt || entry.createdAt || '') || now
+  const days = Math.max(0, (now - updated) / 86_400_000)
+  const halfLife = valence < 0 ? FAB_HALF_LIFE_DAYS.negative : FAB_HALF_LIFE_DAYS.positive
+  return Math.pow(0.5, days / halfLife)
 }
 
 /**
@@ -822,9 +913,12 @@ function recallScore(file, rank, context) {
 function arousalBias(entry, context) {
   const present = Number(context.arousal == null ? BASE_AROUSAL : context.arousal)
   const drive = Math.max(-0.35, Math.min(0.65, present - BASE_AROUSAL))
+  // A composed entry can be *very* angry while its legacy valence projection looks
+  // mild, so the largest share counts as intensity alongside the stored arousal.
   const intensity = Math.max(
     entry.peak === true ? 1 : 0,
     Math.min(1, Math.max(0, Number(entry.arousal || 0))),
+    Math.min(1, maxShare(entry.emotion)),
     Math.min(1, Math.abs(Number(entry.moodValence || 0)) * 0.8),
   )
   return 1 + 0.5 * drive * (intensity - 0.5)
@@ -858,7 +952,9 @@ function privateWeighted(result, max, context = {}) {
   const ctx = {
     moodEnabled: false,
     moodValence: 0,
+    emotion: null,
     arousal: BASE_AROUSAL,
+    dominance: 0,
     firstCreatedAt: null,
     lastCreatedAt: null,
     sessionId: null,
@@ -952,11 +1048,66 @@ function createdAtSpan(files) {
   return { first: stamps[0] || null, last: stamps[stamps.length - 1] || null }
 }
 
+/**
+ * Decide what an entry's affect actually is, and which tier answered.
+ *
+ * Order: the model said it; the conversation is in a mood and inheritance is allowed;
+ * the memory's own text reads as emotional; nothing. `emotionSource` keeps "neutral"
+ * and "no idea" distinguishable — they drive the same recall multiplier, but only one
+ * of them means the write path worked.
+ *
+ * Engineering facts stay neutral on purpose. A bug being hard to fix is not the
+ * project feeling sad, and letting the turn's mood leak into a technical entry is how
+ * "the deployment failed and we were furious" becomes a fact about the deployment.
+ */
+function resolveEntryEmotion({ emotion, dominance, emotionSource, owner, content, binding }) {
+  const providedDominance = Number(dominance)
+  const explicitDominance = dominance !== null && dominance !== undefined && Number.isFinite(providedDominance)
+    ? Math.max(-1, Math.min(1, providedDominance))
+    : null
+  // Three states, and they are not the same thing: omitted = inherit (a caller that
+  // says nothing wants the turn's context), null = explicitly neutral (the model looked
+  // and found nothing), an object = the model's reading. Collapsing null into "omitted"
+  // would silently reinstate inherited mood on a memory the model called neutral.
+  const explicitNeutral = emotion === null
+  const fromModel = emotion !== undefined && emotion !== null
+  let resolved = null
+  let sourceName = 'unknown'
+  let inheritedDominance = null
+  if (fromModel) {
+    resolved = normalizeEmotion(emotion)
+    sourceName = 'model'
+  } else if (!explicitNeutral && owner !== 'about_project') {
+    const sessionMood = binding && binding.mood ? binding.mood : null
+    if (sessionMood && sessionMood.emotion) {
+      resolved = normalizeEmotion(sessionMood.emotion)
+      sourceName = resolved ? 'session' : 'unknown'
+      const sessionDominance = Number(sessionMood.dominance)
+      if (Number.isFinite(sessionDominance)) inheritedDominance = Math.max(-1, Math.min(1, sessionDominance))
+    }
+    if (resolved === null && sourceName === 'unknown') {
+      const read = readMood(content)
+      if (read.emotion) {
+        resolved = read.emotion
+        sourceName = 'content'
+        inheritedDominance = read.dominance
+      }
+    }
+  }
+  return {
+    emotion: resolved,
+    dominance: explicitDominance === null ? (inheritedDominance === null ? 0 : inheritedDominance) : explicitDominance,
+    source: explicitNeutral ? 'model' : (emotionSource || sourceName),
+    neutral: explicitNeutral,
+  }
+}
+
 async function privateRememberImpl({
   exec, libraryId, content, title, layer, pinReason = null, pinSource = null,
   sideEventId = null, tags = [], openLoop = false, disclosure = 'can_tell',
   owner = 'me', visibility = 'shared', source = 'inferred', confidence = 0.8,
   moodValence = null, arousal = null, peak = false, salientDate = null,
+  emotion = undefined, dominance = undefined, emotionSource = null,
   attachments, track = 'memory',
   context,
 }) {
@@ -1036,6 +1187,12 @@ async function privateRememberImpl({
       && (item.attachments || []).some(attachment => media.some(candidate => candidate.sha256 === attachment.sha256)))
     : null
   const id = previousHabit?.[0] || newMemoryId('mem')
+  // A malformed share is refused here rather than clamped later: a negative or
+  // non-finite composition is a caller bug, and repairing it silently would keep the
+  // bug alive while the entry looks fine.
+  if (emotion !== null && emotion !== undefined) normalizeEmotion(emotion)
+  if (dominance !== null && dominance !== undefined && !Number.isFinite(Number(dominance))) throw new Error('dominance must be a number between -1 and 1')
+  const resolvedAffect = resolveEntryEmotion({ emotion, dominance, owner, content: String(content), binding })
   const entry = {
     ...(previousHabit?.[1] || {}),
     track,
@@ -1068,9 +1225,18 @@ async function privateRememberImpl({
     // Retrieval lens + resurface metadata. When the agent does not state a mood,
     // the current session read is stored instead, so a memory written during a
     // hard conversation is tinted by it without the model having to name it.
-    moodValence: moodValence === null || moodValence === undefined
-      ? (binding?.mood ? Number(binding.mood.valence) || 0 : 0)
-      : Math.max(-1, Math.min(1, Number(moodValence) || 0)),
+    // `moodValence` stays as the legacy projection of the four shares; the shares
+    // themselves are what the new recall path compares.
+    moodValence: resolvedAffect.emotion
+      ? derivedValence(resolvedAffect.emotion)
+      : (resolvedAffect.neutral
+        ? 0
+        : (moodValence === null || moodValence === undefined
+          ? (binding?.mood ? Number(binding.mood.valence) || 0 : 0)
+          : Math.max(-1, Math.min(1, Number(moodValence) || 0)))),
+    emotion: resolvedAffect.emotion,
+    dominance: resolvedAffect.dominance,
+    emotionSource: resolvedAffect.source,
     arousal: arousal === null || arousal === undefined
       ? (binding?.mood ? Number(binding.mood.arousal) || 0.35 : 0.35)
       : Math.max(0, Math.min(1, Number(arousal) || 0)),
@@ -1106,9 +1272,11 @@ async function privateRememberImpl({
   // would make a contested memory retrievable before anyone decided it. Accepting
   // the review later is what commits it (see resolveReview → privateUpdate).
   const route = engineRoute()
-  const result = (route !== 'lexical') && !conflict
-    ? await commit({ payload, route, db: memoryDbPath(scope.libraryId) })
+  const db = route !== 'lexical' && !conflict ? memoryDbPath(scope.libraryId) : null
+  const result = db
+    ? await commit({ payload, route, db })
     : { ok: true, backend: route, held: conflict ? true : undefined }
+  try {
   // 记下"这条进没进向量库"：只有真的带代际提交成功才写，冲突暂扣/降级都不写。
   // 之前没有任何字段能回答"哪条记忆进向量库了"，只能靠猜。
   if (route !== 'lexical' && !conflict && result?.ok !== false && !result?.parseWarning) {
@@ -1132,6 +1300,7 @@ async function privateRememberImpl({
     if (previousHabit && JSON.stringify(fresh.entries[id]) !== JSON.stringify(previousHabit[1])) throw new Error('habit changed concurrently; recall and retry')
     const latestConflict = findConflict(Object.fromEntries(Object.entries(fresh.entries).filter(([key]) => key !== id)), entry)
     if (latestConflict && !conflict) {
+      if (db) throw new Error('memory conflict changed during write; retry for review')
       entry.status = 'pending_review'
       entry.conflictingWith = latestConflict.id
       entry.reviewReason = 'concurrent conflicting memory; review required'
@@ -1142,6 +1311,10 @@ async function privateRememberImpl({
     }
     fresh.entries[id] = entry
   }))
+  } catch (error) {
+    if (db) await compensatePrivateCommit(error, { libraryId: scope.libraryId, id, route, db, expectedEntry: previousHabit?.[1] || null })
+    throw error
+  }
   if (!previousHabit) bumpStats(scope.libraryId, 'written')
   if (layer === 'must_remember' && pinSource === 'side_event') {
     consumeCue(sessionIdOf(exec), sideEventId)
@@ -1343,11 +1516,14 @@ export async function privateRecall({ exec, query, topK, relevanceThreshold, pur
   const span = createdAtSpan(Object.values(index.entries || {}).map((entry) => ({ entry })))
   const mood = moodDecay(binding.mood)
   const scored = privateWeighted(enriched, Number(topK || settings.privateTopK || 4), {
-    // Arousal is used even when valence is near neutral: a tense room with no clear
-    // good/bad reading still changes which memories come up.
-    moodEnabled: Math.abs(mood.valence) >= MOOD_MIN_STRENGTH || Math.abs(mood.arousal - BASE_AROUSAL) >= 0.1,
+    // Three independent legs: a clear composition, an arousal away from rest, or a
+    // clear sense of control. A null composition only closes the first one — a tense
+    // room with no clear good/bad reading still changes which memories come up.
+    moodEnabled: emotionActive({ emotion: mood.emotion, arousal: mood.arousal, dominance: mood.dominance }),
     moodValence: mood.valence,
+    emotion: mood.emotion,
     arousal: mood.arousal,
+    dominance: mood.dominance,
     firstCreatedAt: span.first,
     lastCreatedAt: span.last,
     relevanceThreshold: threshold,
@@ -1419,7 +1595,7 @@ export async function privateList({ exec, libraryId, preferIndex = false }) {
 // mood lens and the attachment list all change how an entry is scored, aggregated or
 // rendered, so a wrong value in any of them was a permanent mis-filing that could
 // only be undone by archiving the memory and writing it again.
-async function privateUpdateImpl({ exec, libraryId, id, content, title, tags, status, openLoop, disclosure, confidence, layer, owner, visibility, source, salientDate, track, peak, moodValence, arousal, attachments, context }) {
+async function privateUpdateImpl({ exec, libraryId, id, content, title, tags, status, openLoop, disclosure, confidence, layer, owner, visibility, source, salientDate, track, peak, moodValence, arousal, emotion, dominance, attachments, context }) {
   // `source` is editable because it is a claim about provenance, and claims get
   // corrected: a memory the model first filed as `inferred` may turn out to be
   // something the user actually said. Enum-checked like the rest — a typo here
@@ -1441,6 +1617,8 @@ async function privateUpdateImpl({ exec, libraryId, id, content, title, tags, st
   if (confidence !== undefined && !Number.isFinite(Number(confidence))) throw new Error('confidence must be a number between 0 and 1')
   if (moodValence !== undefined && !Number.isFinite(Number(moodValence))) throw new Error('moodValence must be a number between -1 and 1')
   if (arousal !== undefined && !Number.isFinite(Number(arousal))) throw new Error('arousal must be a number between 0 and 1')
+  if (emotion !== undefined && emotion !== null) normalizeEmotion(emotion)
+  if (dominance !== undefined && dominance !== null && !Number.isFinite(Number(dominance))) throw new Error('dominance must be a number between -1 and 1')
   // Throws for anything the library never received: an attachment list you cannot
   // correct would leave a mis-filed image attached forever.
   const nextAttachments = attachments === undefined ? undefined : attachmentRefs(scope.libraryId, attachments)
@@ -1455,6 +1633,7 @@ async function privateUpdateImpl({ exec, libraryId, id, content, title, tags, st
   }
   const route = engineRoute()
   const managed = route === 'managed-local'
+  let committedDb = null
   if ((nextContent !== undefined || managed) && entry.status !== 'pending_review' && status !== 'pending_review') {
     const payload = {
       recall_files: [{
@@ -1467,10 +1646,14 @@ async function privateUpdateImpl({ exec, libraryId, id, content, title, tags, st
       user: {},
     }
     if (route !== 'lexical') {
-      await commit({ payload, route, db: memoryDbPath(scope.libraryId) })
+      const db = memoryDbPath(scope.libraryId)
+      await commit({ payload, route, db })
+      committedDb = db
     }
   }
-  const updated = await retryStoreWrite(() => updatePrivateIndex(scope.libraryId, (fresh) => {
+  let updated
+  try {
+  updated = await retryStoreWrite(() => updatePrivateIndex(scope.libraryId, (fresh) => {
     const target = fresh.entries[id_]
     if (!target) throw new Error(`unknown memory: ${id_}`)
     if (JSON.stringify(target) !== JSON.stringify(entry)) throw new Error('memory changed concurrently; reload and retry')
@@ -1513,6 +1696,21 @@ async function privateUpdateImpl({ exec, libraryId, id, content, title, tags, st
     if (peak !== undefined) target.peak = peak === true
     if (moodValence !== undefined) target.moodValence = Math.max(-1, Math.min(1, Number(moodValence)))
     if (arousal !== undefined) target.arousal = Math.max(0, Math.min(1, Number(arousal)))
+    // Three states, not two: omitted keeps the stored composition, an explicit null
+    // clears it (and the source becomes "we no longer know"), an object replaces it.
+    // Collapsing null into "keep" would make it impossible to repair a wrong reading.
+    if (emotion !== undefined) {
+      if (emotion === null) {
+        target.emotion = null
+        target.emotionSource = 'unknown'
+        target.moodValence = Number(moodValence) || 0
+      } else {
+        target.emotion = normalizeEmotion(emotion)
+        target.emotionSource = 'model'
+        target.moodValence = derivedValence(target.emotion)
+      }
+    }
+    if (dominance !== undefined) target.dominance = dominance === null ? 0 : Math.max(-1, Math.min(1, Number(dominance)))
     if (nextAttachments !== undefined) target.attachments = nextAttachments
     // Vividness and accuracy are derived, not typed in: correcting the peak flag or
     // the arousal reading has to move `accuracy` too, otherwise the repair would only
@@ -1552,6 +1750,10 @@ async function privateUpdateImpl({ exec, libraryId, id, content, title, tags, st
     }
     target.updatedAt = stamp()
   }))
+  } catch (error) {
+    if (committedDb) await compensatePrivateCommit(error, { libraryId: scope.libraryId, id: id_, route, db: committedDb, expectedEntry: entry })
+    throw error
+  }
   if (status === 'archived' && !wasArchived) bumpStats(scope.libraryId, 'archived')
   return { id: id_, entry: updated.entries[id_] }
 }
@@ -1761,7 +1963,7 @@ export function privateUnpin({ exec, id, reason }) {
 
 export async function privateRemember(args) {
   const libraryId = resolveLibrary(args).libraryId
-  const result = await withManagedPrivateWrite(libraryId, () => privateRememberImpl(args))
+  const result = await withManagedPrivateWrite(libraryId, () => privateRememberImpl({ ...args, libraryId }))
   record({
     kind: 'write',
     scope: 'private',
@@ -1776,7 +1978,7 @@ export async function privateRemember(args) {
 
 export async function privateUpdate(args) {
   const libraryId = resolveLibrary(args).libraryId
-  const result = await withManagedPrivateWrite(libraryId, () => privateUpdateImpl(args))
+  const result = await withManagedPrivateWrite(libraryId, () => privateUpdateImpl({ ...args, libraryId }))
   record({
     kind: 'write',
     scope: 'private',
@@ -1791,7 +1993,7 @@ export async function privateUpdate(args) {
 
 export async function privateDelete(args) {
   const libraryId = resolveLibrary(args).libraryId
-  const result = await withManagedPrivateWrite(libraryId, () => privateDeleteImpl(args))
+  const result = await withManagedPrivateWrite(libraryId, () => privateDeleteImpl({ ...args, libraryId }))
   record({
     kind: 'write',
     scope: 'private',