dsh-memu-memory 1.2.1 → 1.2.2

package/lib/rpc.js

@@ -11,7 +11,7 @@ import { commit } from './memu.js'
 import { privateList, privateUpdate, privateRemember, privateRecall, privateArchive, privateDelete, globalList, globalRecall, domainOf, decayStrength, appliesToDomain, importMemories, resolveMemoryReview, visibleToSession, isMemoryEligible } from './memory.js'
 import { normalizeMemoryContext } from './context.js'
 import { requestPrivateConsolidation } from './private.js'
-import { startGlobalCuration, getCurationJob, cancelCurationJob, listCurationJobs } from './curator.js'
+import { startGlobalCuration, getCurationJob, cancelCurationJob, listCurationJobs, undoGlobalAbsorb } from './curator.js'
 import { maybeMigrateLibraries } from './migrate.js'
 import { getPromptStates, savePromptOverride, resetPrompt, resetAllPrompts } from './prompts.js'
 import { statsView } from './stats.js'
@@ -21,6 +21,7 @@ import { webUiHtml, WEBUI_PATH, standaloneHtml, standaloneAsset, SETTINGS_PATH }
 import { getGraph, listEntities, createEntity, renameEntity, deleteEntity, linkEntries, unlinkEntry, getRelationship, updateRelationship, graphExport, restoreGraphData } from './graph.js'
 import { getAttachment, attachmentThumbnail, attachmentPreview, exportMediaBundle, importMediaBundle, streamMediaExport, importMediaStream } from './media.js'
 import { listEvents, logStats, clearEvents } from './activity-log.js'
+import { warn } from './paths.js'
 
 const ENDPOINT = '/dsh-memu-memory'
 
@@ -54,6 +55,292 @@ function requireSessionId(payload) {
   return id.trim()
 }
 
+// Browser-facing library routes are authorized at the HTTP boundary. Direct
+// dispatch callers intentionally keep the historical API and do not pass an
+// authorization context. A session id is only trusted when its existing host
+// binding names the exact target library; requests without a session id must
+// go through the host's standalone/transfer callback.
+//
+// The map is the complete audit of library-addressed endpoints (§10 P0): every
+// entry's dispatch consumes `payload.libraryId` — or, for updateMemory and
+// archiveMemory, falls back to the same persisted session binding that
+// `routeLibraryId` resolves — so the target authorized here is exactly the
+// target dispatch works on. Endpoints that are session- or host-scoped
+// (getState, getSidebarState, initSession, setLibrary, setFolderPolicy, engine
+// and settings management, …) are not library-addressed: their credential is
+// the host's own requestRejection plus, for session-scoped reads, the session
+// id the host itself provided.
+const LIBRARY_ROUTE_OPERATIONS = new Map([
+  ['renameLibrary', 'rename'], ['archiveLibrary', 'archive'], ['deleteLibrary', 'delete'], ['restoreLibrary', 'restore'],
+  ['browseLibrary', 'read'], ['getMemory', 'read'], ['getStats', 'read'], ['addMemory', 'write'], ['updateMemory', 'write'],
+  ['importMemories', 'import'], ['exportLibrary', 'export'], ['getAttachment', 'attachment.read'],
+  ['browseWall', 'read'], ['getGraph', 'read'], ['listEntities', 'read'], ['createEntity', 'write'], ['renameEntity', 'write'],
+  ['deleteEntity', 'write'], ['linkEntries', 'write'], ['unlinkEntry', 'write'], ['getRelationship', 'read'], ['updateRelationship', 'write'],
+  ['listReviews', 'read'], ['resolveReview', 'write'], ['lexiconList', 'read'], ['lexiconSearch', 'read'], ['lexiconAdd', 'write'],
+  ['lexiconUpdate', 'write'], ['lexiconDelete', 'write'], ['lexiconArchive', 'write'], ['lexiconRestore', 'write'],
+  ['archiveMemory', 'archive'], ['deleteMemory', 'delete'],
+])
+
+function routeLibraryId(endpoint, payload) {
+  const explicit = typeof payload?.libraryId === 'string' ? payload.libraryId.trim() : ''
+  if (explicit) return explicit
+  // These endpoints deliberately support session-scoped operation without an
+  // explicit libraryId. Resolve the target only from the persisted binding.
+  if (payload?.sessionId !== undefined) {
+    if (typeof payload.sessionId !== 'string' || !payload.sessionId.trim()) return null
+    return getSessionBinding(payload.sessionId.trim())?.libraryId || null
+  }
+  return null
+}
+
+let capabilityAbsentWarned = false
+
+// One capability gate for both routes: absent callback falls back to the HTTP
+// boundary (requestRejection) and warns once; a present callback is strict true.
+// Keeping one helper makes the session-first / capability-second order identical
+// in the global queue and the library routes.
+async function authorizeWithCapability(connection, req, { libraryId, operation, label }) {
+  if (typeof connection?.authorizeLibrary !== 'function') {
+    if (!capabilityAbsentWarned) {
+      capabilityAbsentWarned = true
+      try { warn(`dsh-memu-memory: host does not implement connection.authorizeLibrary; ${label} falls back to the HTTP boundary (requestRejection)`) } catch {}
+    }
+    return true
+  }
+  try {
+    return (await connection.authorizeLibrary(req, { libraryId, operation })) === true
+  } catch {
+    return false
+  }
+}
+
+// Global review queue (listReviews/resolveReview without an explicit libraryId)
+// has no private-library target, so it cannot be authorized as a library route.
+// Embedded requests keep the session-level semantics: the queue is visible to
+// conversations, and a write (resolveReview) additionally demands the session
+// exists and is still bound. In both scopes a session id is only a credential
+// while its persisted binding names a library — an empty or dangling id is
+// never one. Standalone requests are the management plane and fail closed on
+// the host's `review.manage` grant: a missing callback (current host) falls back
+// to the HTTP boundary, while a present callback must return strict true.
+async function authorizeGlobalReviewRoute(connection, req, endpoint, payload) {
+  if (payload?.sessionId !== undefined) {
+    if (typeof payload.sessionId !== 'string' || !payload.sessionId.trim()) return false
+    return Boolean(getSessionBinding(payload.sessionId.trim())?.libraryId)
+  }
+  return authorizeWithCapability(connection, req, { libraryId: null, operation: 'review.manage', label: 'global review queue' })
+}
+
+async function authorizeLibraryRoute(connection, req, endpoint, payload, libraryId = routeLibraryId(endpoint, payload)) {
+  // Review endpoints are dual-scope: without an explicit libraryId they address
+  // the global curator queue, which follows its own management model.
+  if ((endpoint === 'listReviews' || endpoint === 'resolveReview') && !String(payload?.libraryId || '').trim()) {
+    return authorizeGlobalReviewRoute(connection, req, endpoint, payload)
+  }
+  if (!LIBRARY_ROUTE_OPERATIONS.has(endpoint)) return true
+  // Session-bound requests are checked first: a valid binding must name the exact
+  // target library, and a present-but-unresolvable session is a bad credential
+  // (never a reason to fall back to the host callback). Without a session, the
+  // capability decides — including the explicit no-library aggregate read.
+  if (payload?.sessionId !== undefined) {
+    if (typeof payload.sessionId !== 'string' || !payload.sessionId.trim()) return false
+    if (!libraryId) return false
+    const binding = getSessionBinding(payload.sessionId.trim())
+    return Boolean(binding?.libraryId && binding.libraryId === libraryId)
+  }
+  return authorizeWithCapability(connection, req, {
+    libraryId,
+    operation: LIBRARY_ROUTE_OPERATIONS.get(endpoint),
+    label: 'library-level authorization',
+  })
+}
+
+function rejectLibraryRoute(res) {
+  if (res.headersSent) return
+  // JSON 信封而非裸文本：standalone fetch 客户端会 response.json()，裸 "forbidden"
+  // 抛 SyntaxError（Unexpected token），用户只看到白屏而不是可读错误。
+  res.writeHead(403, { 'Content-Type': 'application/json' })
+  res.end(JSON.stringify({ ok: false, error: { code: 'dsh-memu-memory/forbidden', message: 'forbidden', details: {} } }))
+}
+
+// 词典核心（lib/lexicon.js）按需加载：路由注册与既有 86 个
+// case 不能被一个尚未落地的模块卡死，集成落地后这里可以改回静态 import。
+let lexiconModulePromise = null
+function lexiconApi() {
+  if (!lexiconModulePromise) {
+    lexiconModulePromise = import('./lexicon.js').catch((error) => {
+      lexiconModulePromise = null
+      throw error
+    })
+  }
+  return lexiconModulePromise
+}
+
+// 全局图（lib/global-graph.js，F1 包）：resolveReview 的 unlink 动作按需加载。
+// 与词典核心同样的按需模式——F1 未落地时路由注册不被卡死，unlink 返回可读错误。
+let globalGraphModulePromise = null
+function globalGraphApi() {
+  if (!globalGraphModulePromise) {
+    globalGraphModulePromise = import('./global-graph.js').then((mod) => {
+      if (typeof mod.removeGlobalLink !== 'function') throw new Error('removeGlobalLink not exported yet')
+      return mod
+    }).catch((error) => {
+      globalGraphModulePromise = null
+      throw error
+    })
+  }
+  return globalGraphModulePromise
+}
+
+// 词典 RPC 的库映射（§4.1）：显式 libraryId 必须是已存在的库——不信任客户端任意
+// id——否则回落到会话绑定，与 case 'listReviews' 的入口模式一致。
+function lexiconLibraryId(payload) {
+  const id = String(payload?.libraryId || '').trim()
+  if (id) {
+    if (!getLibrary(id)) throw new Error('library not found')
+    if (payload?.sessionId !== undefined) {
+      const sessionId = requireSessionId(payload)
+      const binding = getSessionBinding(sessionId)
+      if (binding?.libraryId !== id) throw new Error('session is not authorized for this memory library')
+    }
+    return id
+  }
+  const binding = getSessionBinding(requireSessionId(payload))
+  if (!binding?.libraryId || !getLibrary(binding.libraryId)) throw new Error('session is not bound to a memory library')
+  return binding.libraryId
+}
+
+function lexiconTermView(e) {
+  return {
+    id: e.id,
+    term: e.term,
+    kind: e.kind || 'term',
+    meaning: String(e.meaning || '').slice(0, 2000),
+    usage: String(e.usage || '').slice(0, 800),
+    aliases: Array.isArray(e.aliases) ? e.aliases.slice(0, 20) : [],
+    examples: Array.isArray(e.examples) ? e.examples.slice(0, 8) : [],
+    context: e.context || {},
+    knownBy: Array.isArray(e.knownBy) ? e.knownBy : [],
+    visibility: e.visibility || 'shared',
+    sensitivity: e.sensitivity || 'normal',
+    strength: typeof e.strength === 'number' ? e.strength : null,
+    confidence: typeof e.confidence === 'number' ? e.confidence : null,
+    status: e.status || 'active',
+    source: e.source || 'user',
+    evidence: Array.isArray(e.evidence) ? e.evidence.slice(0, 6) : [],
+    sourceMemoryId: e.sourceMemoryId || null,
+    hitCounts: e.hitCounts && typeof e.hitCounts === 'object' ? e.hitCounts : { candidate: 0, injection: 0, query: 0 },
+    lastInjectedAt: e.lastInjectedAt || null,
+    createdAt: e.createdAt || null,
+    updatedAt: e.updatedAt || null,
+    reviewedAt: e.reviewedAt || null,
+    reviewedBy: e.reviewedBy || null,
+  }
+}
+
+// 导入合并（§4.4）。冲突判定用核心层自己的 normalizeLexeme（与存储同源，零漂移）：
+// 先在本侧把包内词面对到既有词条，active 且 sensitive 的既有词条永不覆盖——跳过并
+// 在结果里报告 skipped。导入以用户来源写入，所以其余词条直接应用字段（§2.1 起不再
+// 产生 pending revision）；真正需要守的是墓碑：rejected 是内部防重放墓碑，导入既不
+// 恢复背包里的 rejected 行，也不复活库里已有的 rejected 词条。legacy pending 按启动
+// 迁移的同一口径收口（新提案 → active、敏感 → archived、revision 草稿 → archived）。
+const LEXICON_KINDS = ['slang', 'meme', 'trigger', 'term']
+// 导入包里可能出现的状态：pending/rejected 是 legacy/墓碑，只用于识别并按下面的口径
+// 收口；公开生命周期只有 active / archived。
+const LEXICON_STATUSES = ['pending', 'active', 'rejected', 'archived']
+const LEXICON_PUBLIC_STATUSES = ['active', 'archived']
+// 字段长度策略与核心 lib/lexicon.js 的直接写入完全统一（§10 P2：同一把尺）：
+// meaning/usage/aliases/examples 超长一律按核心的 clip 落地，导入分支不再做自己的
+// 长度拒绝；唯一例外是 term 本身——term 是唯一键，截断会破坏唯一性，所以超长或
+// 规范化后为空的 term 由核心 upsert 抛 typed error（LEXICON_INVALID_TERM），该条
+// 进 failed。
+
+async function mergeLexiconImport(libraryId, member) {
+  if (!member || typeof member !== 'object' || Array.isArray(member)) throw new Error('lexicon member must be an object')
+  if (!Array.isArray(member.terms)) throw new Error('lexicon member has no "terms" array')
+  if (member.terms.length > 5000) throw new Error('lexicon member has too many terms')
+  const lexicon = await lexiconApi()
+  const normalize = typeof lexicon.normalizeLexeme === 'function' ? lexicon.normalizeLexeme : (value) => String(value ?? '').normalize('NFKC').toLowerCase().replace(/[\s\p{P}\p{S}]+/gu, '')
+  const data = lexicon.loadLexicon(libraryId)
+  const byKey = new Map()
+  for (const [termId, e] of Object.entries(data.terms || {})) {
+    for (const key of [...new Set([String(e?.normalizedTerm || ''), ...((Array.isArray(e?.normalizedAliases) ? e.normalizedAliases : []).map((a) => String(a)))])].filter(Boolean)) {
+      if (!byKey.has(key)) byKey.set(key, { termId, entry: e })
+    }
+  }
+  const report = { version: 1, applied: 0, added: 0, updated: 0, revisions: 0, skipped: [], failed: [] }
+  for (const raw of member.terms) {
+    const label = typeof raw?.term === 'string' ? raw.term : ''
+    try {
+      if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new Error('term entry must be an object')
+      const term = String(raw.term || '').trim()
+      const meaning = String(raw.meaning || '').trim()
+      if (!term) throw new Error('term is required')
+      if (!meaning) throw new Error('meaning is required')
+      // 长度不再在本侧拒绝：clip 与 reject 都以核心 upsert 的策略为准（见上方注释）。
+      // term 超长/规范化为空由 upsert 抛 LEXICON_INVALID_TERM，整条进 failed。
+      const kind = raw.kind == null || raw.kind === '' ? 'term' : String(raw.kind)
+      if (!LEXICON_KINDS.includes(kind)) throw new Error(`unknown lexicon kind: ${kind}`)
+      const aliases = raw.aliases == null ? undefined : raw.aliases
+      const examples = raw.examples == null ? undefined : raw.examples
+      const keys = [...new Set([String(raw.normalizedTerm || ''), normalize(term), ...((Array.isArray(raw.aliases) ? raw.aliases : []).map(normalize))])].filter(Boolean)
+      const target = keys.map((key) => byKey.get(key)).find(Boolean) || null
+      const status = raw.status == null || raw.status === '' ? 'active' : String(raw.status)
+      if (!LEXICON_STATUSES.includes(status)) throw new Error(`unknown lexicon status: ${status}`)
+      // 墓碑（§2.1）：rejected 是内部防重放墓碑，导入是恢复路径也不能把它洗回生命周期；
+      // 库里已有同词墓碑时同样跳过——用户来源的 upsert 会复活它并清掉拒绝指纹。
+      if (status === 'rejected') {
+        report.skipped.push({ term: label || term, reason: 'rejected terms are internal tombstones and are not restored by import' })
+        continue
+      }
+      const targetStatus = target ? (target.entry?.status || 'active') : null
+      if (targetStatus === 'rejected') {
+        report.skipped.push({ term: label || term, termId: target.termId, reason: 'a rejected tombstone is never resurrected by import' })
+        continue
+      }
+      if (targetStatus === 'active' && target.entry?.sensitivity === 'sensitive') {
+        report.skipped.push({ term: label || term, termId: target.termId, reason: 'an active sensitive term is never overwritten by import' })
+        continue
+      }
+      // legacy pending 与 migrateLegacyLexiconStatuses 同一口径（§2.1）：新提案 → active
+      // （敏感 → archived），revision 草稿 → archived。新写只有公开两态。
+      const sensitive = raw.sensitivity === 'sensitive' || (kind === 'trigger' && raw.sensitivity !== 'normal')
+      const effectiveStatus = status === 'pending' ? (raw.revisionOf || sensitive ? 'archived' : 'active') : status
+      // 收口成 archived 的 legacy 行如果撞上同词的 active 正条，user upsert 会把正条改写
+      // 并归档（撞线语义）——迁移会保留正条，这里也跳过草稿，不让它覆盖正条。
+      if (status === 'pending' && effectiveStatus === 'archived' && targetStatus === 'active') {
+        report.skipped.push({ term: label || term, termId: target.termId, reason: 'legacy pending draft skipped: its active target must not be overwritten by import' })
+        continue
+      }
+      const out = await lexicon.upsertLexiconTerm({
+        libraryId,
+        term,
+        kind,
+        meaning,
+        usage: raw.usage ?? undefined,
+        aliases,
+        examples,
+        context: raw.context ?? undefined,
+        knownBy: raw.knownBy ?? undefined,
+        visibility: raw.visibility ?? undefined,
+        sensitivity: raw.sensitivity ?? undefined,
+        confidence: raw.confidence ?? undefined,
+        evidence: raw.evidence ?? undefined,
+        source: 'user',
+        status: effectiveStatus,
+      })
+      report.applied += 1
+      if (out?.created === false) report.updated += 1
+      else report.added += 1
+      // revisions 在当前生命周期恒为 0（§2.1 不再生成 pending revision）；字段保留只为报告
+      // 形状稳定，旧客户端继续拿到一个数字。
+    } catch (error) {
+      report.failed.push({ term: label, reason: String(error?.message || error).slice(0, 300) })
+    }
+  }
+  return report
+}
+
 // List one library's memories. Retrieval needs the MemU engine, but the sidecar
 // index holds the same rows, so an engine that is still installing (or broken)
 // degrades to the index instead of failing the browser.
@@ -601,6 +888,8 @@ async function dispatch(ctx, endpoint, payload = {}) {
         'shortTermTtlHours',
         'sidebarSettings', 'visionCaptionEnabled',
         'inboundToolNames',
+        // 全局提炼的审核模式（spec §6.1）：恢复默认 = 回到 auto，不保留全审状态。
+        'curatorReviewMode',
       ]) patch[key] = DEFAULT_SETTINGS[key]
       return updateSettings(patch)
     }
@@ -618,6 +907,8 @@ async function dispatch(ctx, endpoint, payload = {}) {
         'memoryMode', 'memoryBackend', 'habitsInjection', 'purgeArchivedAfterDays',
         'shortTermTtlHours',
         'sidebarSettings', 'visionCaptionEnabled', 'inboundToolNames',
+        // 全局提炼的审核模式（spec §6.1）：不进 allowlist 的 patch 会被静默丢弃。
+        'curatorReviewMode',
       ])
       const clean = {}
       for (const [k, v] of Object.entries(patch)) if (allowed.has(k)) clean[k] = v
@@ -832,6 +1123,7 @@ async function dispatch(ctx, endpoint, payload = {}) {
       // The payload may be the parsed export (memories array) or the raw file text.
       let memories = payload?.memories
       let graphData = payload?.graph || null
+      let lexiconData = payload?.lexicon && typeof payload.lexicon === 'object' && !Array.isArray(payload.lexicon) ? payload.lexicon : null
       let missingAttachments = 0
       if (payload?.archiveBase64) {
         const archive = importMediaBundle(id, Buffer.from(String(payload.archiveBase64), 'base64'))
@@ -843,7 +1135,11 @@ async function dispatch(ctx, endpoint, payload = {}) {
         let parsed = null
         try { parsed = JSON.parse(memories) } catch { throw new Error('that file is not valid JSON') }
         if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
-          if (Array.isArray(parsed.memories)) { memories = parsed.memories; graphData = parsed.graph || null }
+          if (Array.isArray(parsed.memories)) {
+            memories = parsed.memories
+            graphData = parsed.graph || null
+            lexiconData = lexiconData || (parsed.lexicon && typeof parsed.lexicon === 'object' && !Array.isArray(parsed.lexicon) ? parsed.lexicon : null)
+          }
           else throw new Error('this JSON has no "memories" array')
         } else if (Array.isArray(parsed)) memories = parsed
         else throw new Error('this JSON has no "memories" array')
@@ -851,19 +1147,35 @@ async function dispatch(ctx, endpoint, payload = {}) {
       if (!Array.isArray(memories)) throw new Error('memories must be an array')
       const result = await importMemories({ libraryId: id, memories })
       if (graphData && result.idMap) restoreGraphData(id, graphData, result.idMap)
-      return { libraryId: id, ...result, missingAttachments }
+      // 词典是版本化 member（§4.4）：包里带了才合并恢复；term 冲突（规范化后同词）
+      // 更新既有词条，active+sensitive 一律跳过并上报，超长字段按核心 clip 落地、
+      // term 本身越界/归一化为空才进 failed。
+      const lexiconReport = lexiconData ? await mergeLexiconImport(id, lexiconData) : null
+      const value = { libraryId: id, ...result, missingAttachments }
+      return lexiconReport ? { ...value, lexicon: lexiconReport } : value
     }
     case 'exportLibrary': {
       const id = String(payload?.libraryId || '')
       const lib = getLibrary(id)
       if (!lib) throw new Error('library not found')
       const index = loadPrivateIndex(id)
+      // §4.4：导出包带上版本化词典 member。词典核心暂时不可用（未落地/文件损坏）
+      // 时导出不能整个失败——报 unavailable，让导入端知道这份包没有词典。
+      let lexiconMember = { version: 1, terms: [], unavailable: null }
+      try {
+        const lexicon = await lexiconApi()
+        const data = lexicon.loadLexicon(id)
+        lexiconMember = { version: 1, terms: Object.entries(data.terms || {}).map(([termId, e]) => ({ id: termId, ...e })) }
+      } catch (error) {
+        lexiconMember.unavailable = String(error?.message || error).slice(0, 300)
+      }
       const exported = {
         format: 'dsh-memu-memory-library@1',
         exportedAt: new Date().toISOString(),
         library: { id: lib.id, name: lib.name, scopeKey: lib.scopeKey || null, domain: lib.domain || null },
         memories: Object.entries(index.entries || {}).map(([memId, e]) => ({ id: memId, ...e })),
         graph: graphExport(id),
+        lexicon: lexiconMember,
       }
       if (payload?.includeAttachments === true) {
         if (payload?.delivery === 'download') return { filename: `${id}.zip`, downloadUrl: `/dsh-memu-memory/export/${id}.zip` }
@@ -890,6 +1202,15 @@ async function dispatch(ctx, endpoint, payload = {}) {
             expiresAt: entry.expiresAt || null, openLoop: entry.openLoop === true,
             marginalized: entry.marginalized === true, decay: Math.min(1, decayStrength(entry)),
             tags: Array.isArray(entry.tags) ? entry.tags : [], attachmentCount: entry.attachments?.length || 0,
+            // Global entries carry F1/F2 metadata; the wall drawer reads it from the
+            // same bounded item payload instead of a second full-body request.
+            ...(lib ? {} : {
+              links: Array.isArray(entry.links) ? entry.links : [],
+              absorbedFrom: Array.isArray(entry.absorbedFrom) ? entry.absorbedFrom : [],
+              absorbedAt: entry.absorbedAt || null,
+              representativeId: entry.representativeId || null,
+              absorbOpId: entry.absorbOpId || null,
+            }),
             // The first usable image becomes the card cover; the drawer requests
             // the full gallery from getMemory. Secret entries come back hidden
             // (no url), so the wall never fetches their pixels.
@@ -900,7 +1221,13 @@ async function dispatch(ctx, endpoint, payload = {}) {
       for (const library of libraries) {
         try { collect(loadPrivateIndex(library.id), library) } catch { errors.push({ libraryId: library.id, error: 'memory index unavailable' }) }
       }
-      if (!libraryId) { try { collect(loadGlobalIndex(), null) } catch { errors.push({ libraryId: null, error: 'global index unavailable' }) } }
+      // Global memory is shared across libraries and the wall always exposes a
+      // global scope. Include it even when a single private library was selected:
+      // the single-library authorization covers that library's private rows, and
+      // global rows are not library-private data. Without this, the standalone
+      // single-library fallback (hosts that deny the all-libraries read) shows an
+      // empty global scope.
+      try { collect(loadGlobalIndex(), null) } catch { errors.push({ libraryId: null, error: 'global index unavailable' }) }
       items.sort((a, b) => String(b.updatedAt || b.createdAt || '').localeCompare(String(a.updatedAt || a.createdAt || '')))
       const limit = Math.max(1, Math.min(1000, Number(payload?.limit) || 300))
       return { items: items.slice(0, limit), total: items.length, libraries, errors }
@@ -945,6 +1272,13 @@ async function dispatch(ctx, endpoint, payload = {}) {
             source: f.entry?.source || 'inferred',
             status: f.entry?.status || 'active',
             content: String(f.content || '').slice(0, 600),
+            // F1/F2 metadata: the global page renders link/absorb tags and the undo
+            // button from these fields; without them every tag is silently absent.
+            links: Array.isArray(f.entry?.links) ? f.entry.links : [],
+            absorbedFrom: Array.isArray(f.entry?.absorbedFrom) ? f.entry.absorbedFrom : [],
+            absorbedAt: f.entry?.absorbedAt || null,
+            representativeId: f.entry?.representativeId || null,
+            absorbOpId: f.entry?.absorbOpId || null,
           })),
         }
       } catch (error) {
@@ -957,6 +1291,11 @@ async function dispatch(ctx, endpoint, payload = {}) {
             confidence: e.confidence ?? null, status: e.status || 'active', content: String(e.content || '').slice(0, 600),
             evidence: e.evidence || [], layer: e.layer || 'long_term', decay: decayStrength(e),
             createdAt: e.createdAt || null, updatedAt: e.updatedAt || null, source: e.source || 'inferred',
+            links: Array.isArray(e.links) ? e.links : [],
+            absorbedFrom: Array.isArray(e.absorbedFrom) ? e.absorbedFrom : [],
+            absorbedAt: e.absorbedAt || null,
+            representativeId: e.representativeId || null,
+            absorbOpId: e.absorbOpId || null,
           })),
         }
       }
@@ -985,18 +1324,221 @@ async function dispatch(ctx, endpoint, payload = {}) {
             confidence: e.confidence ?? null,
             reviewReason: e.reviewReason || '',
             conflictingWith: e.conflictingWith || null,
+            // 包 F2（spec §6.7）：风险分与 pendingAbsorb 随队列下发，供 UI 打
+            // 「集合吸收」Tag、列出来源标题并按风险排序；旧条目按缺省读取。
+            reviewRisk: e.reviewRisk ?? null,
+            reviewRiskReasons: Array.isArray(e.reviewRiskReasons) ? e.reviewRiskReasons : [],
+            pendingAbsorb: e.pendingAbsorb || null,
             evidence: (e.evidence || []).slice(0, 6),
             updatedAt: e.updatedAt || null,
           })),
       }
     }
     case 'resolveReview': {
+      // 包 F2（spec §6.7）：unlink / undo-absorb 是两个全局元数据动作，不是内容复核
+      // ——都不新增路由，仍走 resolveReview 已在的全局复核授权路径；但它们只作用于
+      // 全局队列，带 libraryId 的调用是私有复核语义错位，直接报错。
+      const reviewAction = String(payload?.action || '')
+      if (reviewAction === 'unlink' || reviewAction === 'undo-absorb') {
+        if (String(payload?.libraryId || '').trim()) {
+          throw new Error(`${reviewAction} is a global review action; pass no libraryId`)
+        }
+        if (reviewAction === 'unlink') {
+          // lib/global-graph.js（F1 包）的 removeGlobalLink，按需加载——与词典核心
+          // 同一模式；模块缺席或未导出时抛固定错误（spec §6.7 RPC 约定）。
+          try {
+            const globalGraph = await globalGraphApi()
+            return globalGraph.removeGlobalLink({
+              linkId: payload?.linkId, fromId: payload?.fromId, toId: payload?.toId, kind: payload?.kind,
+            })
+          } catch (error) {
+            if (globalGraphModulePromise) throw error
+            throw new Error('link removal lands with F1')
+          }
+        }
+        return undoGlobalAbsorb({ id: String(payload?.id || '') })
+      }
       return resolveMemoryReview({
         libraryId: payload?.libraryId ? String(payload.libraryId) : null,
-        id: String(payload?.id || ''), action: String(payload?.action || ''),
+        id: String(payload?.id || ''), action: reviewAction,
         resolution: payload?.resolution || 'replace', reason: payload?.reason || '',
         content: payload?.content, title: payload?.title,
+        sessionId: payload?.sessionId ? String(payload.sessionId) : null,
+      })
+    }
+    // —— 词典：每本私有库一份；入口先由显式 id（须存在）或会话映射到库 ——
+    case 'lexiconList': {
+      const libraryId = lexiconLibraryId(payload)
+      const lexicon = await lexiconApi()
+      const data = lexicon.loadLexicon(libraryId)
+      // 公开两态（§2.1）：pending/rejected 是内部状态与墓碑，列表永不返回。status 只接受
+      // active / archived——未知值明确报错，别静默当成“全都要”把墓碑带出去。
+      const requestedStatus = String(payload?.status || '').trim()
+      if (requestedStatus && !LEXICON_PUBLIC_STATUSES.includes(requestedStatus)) {
+        throw new Error(`unknown lexicon status: ${requestedStatus}; expected active or archived`)
+      }
+      // 默认 active；includeArchived 只把默认视图扩大成 active + archived，显式 status 优先。
+      const includeArchived = payload?.includeArchived === true
+      const status = requestedStatus || (includeArchived ? '' : 'active')
+      const kind = String(payload?.kind || '')
+      const sensitivity = String(payload?.sensitivity || '')
+      const q = String(payload?.q || '').trim().toLowerCase()
+      const rows = Object.entries(data.terms || {})
+        .map(([termId, e]) => ({ ...e, id: termId, status: e?.status || 'active' }))
+        .filter((e) => LEXICON_PUBLIC_STATUSES.includes(e.status))
+      // 页签计数（§2.4）在 kind / 搜索 / 状态筛选之前算好：标签数字不随筛选跳动。
+      const statusCounts = { active: 0, archived: 0 }
+      for (const e of rows) statusCounts[e.status] += 1
+      const selected = rows
+        .filter((e) => !status || e.status === status)
+        .filter((e) => !sensitivity || e.sensitivity === sensitivity)
+        .filter((e) => !q || [e.term, e.meaning, e.usage, ...(Array.isArray(e.aliases) ? e.aliases : [])].join('\n').toLowerCase().includes(q))
+      // 总览计数行只跟随 kind 以外的过滤：kind 标签上的数字才是"点了会变"的实时数。
+      const counts = { slang: 0, meme: 0, trigger: 0, term: 0 }
+      for (const e of selected) if (counts[e.kind] !== undefined) counts[e.kind] += 1
+      // updatedAt 倒序；同一时间戳按 id 兜底——分页与多端渲染的顺序必须可复现。
+      const filtered = selected.filter((e) => !kind || e.kind === kind)
+        .sort((a, b) => String(b.updatedAt || b.createdAt || '').localeCompare(String(a.updatedAt || a.createdAt || ''))
+          || String(a.id).localeCompare(String(b.id)))
+      const pageSize = Math.max(1, Math.min(200, Number(payload?.pageSize) || 50))
+      const total = filtered.length
+      const pages = Math.max(1, Math.ceil(total / pageSize))
+      const page = Math.min(pages, Math.max(1, Number(payload?.page) || 1))
+      return {
+        libraryId,
+        version: data.version ?? null,
+        items: filtered.slice((page - 1) * pageSize, page * pageSize).map(lexiconTermView),
+        total,
+        page,
+        pages,
+        pageSize,
+        counts,
+        statusCounts,
+      }
+    }
+    case 'lexiconSearch': {
+      const explicit = String(payload?.libraryId || '').trim()
+      const libraryId = lexiconLibraryId(payload)
+      const query = String(payload?.q ?? payload?.query ?? '').trim()
+      if (!query) throw new Error('q is required')
+      // 会话路径带着该会话的 memoryContext 做可见过滤；设置页显式选库时是管理视角，
+      // 与 browseLibrary 一样不按场景收窄。归档词条只有管理面显式 includeArchived 才查；
+      // pending/rejected 由核心永远排除。
+      const binding = explicit ? null : getSessionBinding(requireSessionId(payload))
+      const lexicon = await lexiconApi()
+      const hits = await lexicon.searchLexicon(
+        { libraryId, query, memoryContext: binding?.memoryContext || {} },
+        { includeArchived: payload?.includeArchived === true },
+      )
+      return {
+        libraryId,
+        items: (Array.isArray(hits) ? hits : []).map((hit) => {
+          const e = hit?.entry && typeof hit.entry === 'object' ? hit.entry : hit
+          return {
+            id: hit?.id || hit?.termId || null,
+            term: e?.term,
+            kind: e?.kind || 'term',
+            meaning: String(e?.meaning || '').slice(0, 2000),
+            usage: String(e?.usage || '').slice(0, 800),
+            aliases: Array.isArray(e?.aliases) ? e.aliases.slice(0, 20) : [],
+            sensitivity: e?.sensitivity || 'normal',
+            status: e?.status || 'active',
+            strength: typeof e?.strength === 'number' ? e.strength : null,
+            evidence: Array.isArray(e?.evidence) ? e.evidence.slice(0, 6) : [],
+            sourceMemoryId: e?.sourceMemoryId || null,
+          }
+        }),
+      }
+    }
+    case 'lexiconAdd': {
+      const libraryId = lexiconLibraryId(payload)
+      const term = String(payload?.term || '').trim()
+      const kind = String(payload?.kind || '').trim()
+      const meaning = String(payload?.meaning || '').trim()
+      if (!term) throw new Error('term is required')
+      if (!kind) throw new Error('kind is required')
+      if (!meaning) throw new Error('meaning is required')
+      const lexicon = await lexiconApi()
+      const result = await lexicon.upsertLexiconTerm({
+        libraryId,
+        term,
+        kind,
+        meaning,
+        usage: payload?.usage,
+        aliases: Array.isArray(payload?.aliases) ? payload.aliases : undefined,
+        examples: Array.isArray(payload?.examples) ? payload.examples : undefined,
+        context: payload?.context,
+        knownBy: payload?.knownBy,
+        visibility: payload?.visibility,
+        sensitivity: payload?.sensitivity,
+        confidence: payload?.confidence,
+        evidence: payload?.evidence,
+        // 面板/管理入口是"用户"来源，直接落 active；敏感字段校验在核心层。
+        source: 'user',
+        status: 'active',
+      })
+      return { libraryId, ...result }
+    }
+    case 'lexiconUpdate': {
+      const libraryId = lexiconLibraryId(payload)
+      const termId = String(payload?.termId || '').trim()
+      if (!termId) throw new Error('termId is required')
+      const patch = payload?.patch && typeof payload.patch === 'object' && !Array.isArray(payload.patch) ? payload.patch : {}
+      // 只开放内容与观感字段；生命周期（归档/恢复）走 lexiconArchive / lexiconRestore，
+      // 来源与类型不在这里改。
+      // 与 updateMemory 同一规矩：名单外的键明确报错，不静默丢弃。
+      const allowed = ['meaning', 'usage', 'aliases', 'examples', 'sensitivity', 'strength', 'visibility', 'context', 'knownBy']
+      const unknown = Object.keys(patch).filter((key) => !allowed.includes(key))
+      if (unknown.length) throw new Error(`unknown lexicon field: ${unknown.join(', ')}; editable: ${allowed.join(', ')}`)
+      const lexicon = await lexiconApi()
+      const data = lexicon.loadLexicon(libraryId)
+      const existing = (data.terms || {})[termId]
+      if (!existing) throw new Error('unknown lexicon term')
+      // 用户来源直接应用字段（含敏感字段）；同规范词的撞线语义由核心层管。
+      const result = await lexicon.upsertLexiconTerm({
+        libraryId,
+        term: existing.term,
+        kind: existing.kind,
+        meaning: patch.meaning ?? existing.meaning,
+        usage: patch.usage ?? existing.usage,
+        aliases: patch.aliases ?? existing.aliases,
+        examples: patch.examples ?? existing.examples,
+        context: patch.context ?? existing.context,
+        knownBy: patch.knownBy ?? existing.knownBy,
+        visibility: patch.visibility ?? existing.visibility,
+        sensitivity: patch.sensitivity ?? existing.sensitivity,
+        strength: patch.strength ?? existing.strength,
+        confidence: existing.confidence,
+        evidence: existing.evidence,
+        source: 'user',
       })
+      return { libraryId, termId, ...result }
+    }
+    case 'lexiconDelete': {
+      const libraryId = lexiconLibraryId(payload)
+      const termId = String(payload?.termId || '').trim()
+      if (!termId) throw new Error('termId is required')
+      const lexicon = await lexiconApi()
+      const result = await lexicon.deleteLexiconTerm({ libraryId, termId })
+      return { libraryId, ...result }
+    }
+    // 归档 / 恢复（§2.3）：公开生命周期的两个用户动作，只承认 active↔archived；
+    // legacy pending 由迁移收口，rejected 是墓碑（核心 typed 拒绝）。
+    case 'lexiconArchive': {
+      const libraryId = lexiconLibraryId(payload)
+      const termId = String(payload?.termId || '').trim()
+      if (!termId) throw new Error('termId is required')
+      const lexicon = await lexiconApi()
+      const result = await lexicon.archiveLexiconTerm({ libraryId, termId })
+      return { libraryId, ...result }
+    }
+    case 'lexiconRestore': {
+      const libraryId = lexiconLibraryId(payload)
+      const termId = String(payload?.termId || '').trim()
+      if (!termId) throw new Error('termId is required')
+      const lexicon = await lexiconApi()
+      const result = await lexicon.restoreLexiconTerm({ libraryId, termId })
+      return { libraryId, ...result }
     }
     case 'generatePrivate': {
       const sessionId = requireSessionId(payload)
@@ -1214,10 +1756,22 @@ export function registerRpc(ctx) {
               res.end(rejection === 401 ? 'unauthorized' : 'forbidden')
               return
             }
-            const pathname = new URL(req.url || '/', 'http://dsh.internal').pathname
+            const requestUrl = new URL(req.url || '/', 'http://dsh.internal')
+            const pathname = requestUrl.pathname
               .replace(/^\/dsh-memu(?=\/|$)/, ENDPOINT)
+            // Entry inventory (§10 P0 audit): dispatch is reachable from exactly
+            // three places, each behind authorizeLibraryRoute — the export/import
+            // URL routes below (authorized before any body or media read), the
+            // GET attachment route (same), and the generic POST gate after the
+            // envelope parse. Every other GET here serves static UI bytes or 405s;
+            // no handler code path reaches dispatch without passing one gate.
             const exportMatch = /^\/dsh-memu-memory\/export\/([A-Za-z0-9._-]+)\.zip$/.exec(pathname)
             if (req.method === 'GET' && exportMatch) {
+              const sessionId = requestUrl.searchParams.has('sessionId') ? requestUrl.searchParams.get('sessionId') : undefined
+              if (!await authorizeLibraryRoute(c.connection, req, 'exportLibrary', { libraryId: exportMatch[1], ...(sessionId !== undefined ? { sessionId } : {}) })) {
+                rejectLibraryRoute(res)
+                return
+              }
               try {
                 const payload = await dispatch(ctx, 'exportLibrary', { libraryId: exportMatch[1] })
                 await streamMediaExport(exportMatch[1], payload, res)
@@ -1226,6 +1780,11 @@ export function registerRpc(ctx) {
             }
             const importMatch = /^\/dsh-memu-memory\/import\/([A-Za-z0-9._-]+)\.zip$/.exec(pathname)
             if (req.method === 'POST' && importMatch) {
+              const sessionId = requestUrl.searchParams.has('sessionId') ? requestUrl.searchParams.get('sessionId') : undefined
+              if (!await authorizeLibraryRoute(c.connection, req, 'importMemories', { libraryId: importMatch[1], ...(sessionId !== undefined ? { sessionId } : {}) })) {
+                rejectLibraryRoute(res)
+                return
+              }
               try {
                 const bundle = await importMediaStream(importMatch[1], req)
                 const value = await dispatch(ctx, 'importMemories', { libraryId: importMatch[1], memories: bundle.memories, graph: bundle.graph })
@@ -1251,9 +1810,13 @@ export function registerRpc(ctx) {
             }
             const attachment = /^\/dsh-memu-memory\/attachment\/([A-Za-z0-9._-]+)\/([a-f0-9]{64})$/.exec(pathname)
             if (req.method === 'GET' && attachment) {
+              const sessionId = requestUrl.searchParams.has('sessionId') ? requestUrl.searchParams.get('sessionId') : undefined
+              if (!await authorizeLibraryRoute(c.connection, req, 'getAttachment', { libraryId: attachment[1], ...(sessionId !== undefined ? { sessionId } : {}) })) {
+                rejectLibraryRoute(res)
+                return
+              }
               try {
-                const url = new URL(req.url, 'http://dsh.internal')
-                const thumbnail = await attachmentThumbnail({ libraryId: attachment[1], sha256: attachment[2], sessionId: url.searchParams.get('sessionId') })
+                const thumbnail = await attachmentThumbnail({ libraryId: attachment[1], sha256: attachment[2], sessionId: sessionId ?? null })
                 if (!thumbnail) { res.writeHead(404, { 'Cache-Control': 'no-store' }); res.end('attachment missing'); return }
                 res.writeHead(200, { 'Content-Type': thumbnail.mime, 'Cache-Control': 'private, no-store', 'X-Content-Type-Options': 'nosniff' })
                 res.end(thumbnail.data)
@@ -1323,8 +1886,13 @@ export function registerRpc(ctx) {
                 },
               }
             } else {
+              const payload = envelope.payload || {}
+              if (!await authorizeLibraryRoute(c.connection, req, endpoint, payload)) {
+                rejectLibraryRoute(res)
+                return
+              }
               try {
-                result = { ok: true, value: await dispatch(ctx, endpoint, envelope.payload || {}) }
+                result = { ok: true, value: await dispatch(ctx, endpoint, payload) }
               } catch (error) {
                 result = {
                   ok: false,