dsh-memu-memory 1.2.1 → 1.2.2

package/lib/local-vector-service.js

@@ -89,17 +89,19 @@ function profileFor(catalogId) {
 }
 
 function installationFor(id, sharedRuntime = null) {
-  const status = getDownloader().getStatus(id, { deep: false })
+  const status = getDownloader().getStatus(id, { deep: true })
   // 所有可用模型 pin 的是同一个受管 runtime；每个模型各走一遍运行时目录树（几百个文件）
   // 会让每次 getState 多花几百毫秒。上层已经算过一次就复用。
   const runtime = sharedRuntime || localVectorRuntimeStatus({ modelId: id })
+  const degraded = status.state === 'installed' && status.verified === false
   return {
-    status: status.state,
-    installed: status.installed === true,
-    modelDir: status.installed ? path.join(root, id) : null,
+    status: degraded ? 'degraded' : status.state,
+    installed: status.installed === true && !degraded,
+    verified: status.verified ?? null,
+    modelDir: status.installed && !degraded ? path.join(root, id) : null,
     runtimeDir: runtime.ready ? runtime.path : null,
     fingerprintMatches: status.fingerprintMatches ?? null,
-    error: status.error || null,
+    error: degraded ? { code: 'EMBEDDING_INSTALL_TAMPERED', message: 'installed embedding files failed deep verification' } : (status.error || null),
     progress: status.progress || null,
   }
 }
@@ -164,7 +166,7 @@ export function getLocalVectorState() {
 
 export function selectLocalVectorModel(id) {
   const status = getDownloader().getStatus(String(id), { deep: true })
-  if (status.state !== 'installed' || status.fingerprintMatches === false) {
+  if (status.state !== 'installed' || status.verified !== true || status.fingerprintMatches === false) {
     const error = new Error('install and verify the local embedding model before selecting it')
     error.code = 'LOCAL_VECTOR_MODEL_NOT_INSTALLED'
     throw error

package/lib/managed-runtime.js

@@ -20,6 +20,28 @@ export function verifyRuntimeArchive(data, digest) {
   if (crypto.createHash('sha256').update(data).digest('hex') !== digest) throw new Error('managed runtime checksum mismatch; refusing to execute')
 }
 
+function executableFingerprint(file) {
+  try {
+    const stat = fs.lstatSync(file)
+    if (!stat.isFile() || stat.isSymbolicLink()) return null
+    const sha256 = crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex')
+    return { bytes: stat.size, sha256 }
+  } catch {
+    return null
+  }
+}
+
+function verifiedRuntimeMetadata(file, asset) {
+  try {
+    const metadata = JSON.parse(fs.readFileSync(file, 'utf8'))
+    return metadata && metadata.version === UV_VERSION && metadata.archive === asset[0] && metadata.archiveSha256 === asset[1] && Number.isInteger(metadata.executableBytes) && typeof metadata.executableSha256 === 'string'
+      ? metadata
+      : null
+  } catch {
+    return null
+  }
+}
+
 export async function ensureManagedPython({ run, log = () => {}, fetcher = fetch } = {}) {
   const platform = `${process.platform}-${process.arch}`
   const asset = ASSETS[platform]
@@ -33,7 +55,14 @@ export async function ensureManagedPython({ run, log = () => {}, fetcher = fetch
     UV_PYTHON_BIN_DIR: ensureDir(path.join(root, 'bin')),
     UV_NO_PROGRESS: '1', UV_PYTHON_PREFERENCE: 'only-managed', UV_NO_MODIFY_PATH: '1', UV_NO_CONFIG: '1',
   }
-  if (!fs.existsSync(executable)) {
+  const metadataFile = path.join(bin, 'verified.json')
+  const metadata = verifiedRuntimeMetadata(metadataFile, asset)
+  const fingerprint = executableFingerprint(executable)
+  const reusable = Boolean(metadata && fingerprint && metadata.executableBytes === fingerprint.bytes && metadata.executableSha256 === fingerprint.sha256)
+  if (!reusable) {
+    if (fingerprint || fs.existsSync(executable)) log(`managed uv ${UV_VERSION} is missing trusted metadata or was modified; replacing it`)
+    try { fs.rmSync(executable, { force: true }) } catch {}
+    try { fs.rmSync(metadataFile, { force: true }) } catch {}
     log(`no usable Python with pip; downloading pinned uv ${UV_VERSION}`)
     const response = await fetcher(`https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/${asset[0]}`, { signal: AbortSignal.timeout(120_000) })
     if (!response.ok || Number(response.headers.get('content-length')) > 64 * 1024 * 1024) throw new Error('managed runtime download failed or is too large')
@@ -63,7 +92,9 @@ export async function ensureManagedPython({ run, log = () => {}, fetcher = fetch
     }
     if (fs.existsSync(temporary)) fs.renameSync(temporary, executable)
     if (process.platform !== 'win32') fs.chmodSync(executable, 0o700)
-    writeJson(path.join(bin, 'verified.json'), { version: UV_VERSION, archive: asset[0], sha256: asset[1] })
+    const installedFingerprint = executableFingerprint(executable)
+    if (!installedFingerprint) throw new Error('managed runtime executable is not a regular file')
+    writeJson(metadataFile, { version: UV_VERSION, archive: asset[0], archiveSha256: asset[1], executableBytes: installedFingerprint.bytes, executableSha256: installedFingerprint.sha256 })
   }
   const version = await run(executable, ['--version'], { env, timeoutMs: 20_000 })
   if (version.code !== 0 || !version.stdout.startsWith(`uv ${UV_VERSION} `) && version.stdout.trim() !== `uv ${UV_VERSION}`) throw new Error('managed uv version mismatch')

package/lib/memory.js

@@ -20,6 +20,7 @@ import { attachmentRefs } from './media.js'
 import { normalizeMemoryContext, contextVisible, sameFactContext } from './context.js'
 import { activeEntryStamp, assertGeneration, assertVectorWriteAllowed, captureGeneration, enrollActiveLibrary, hasActiveVectorGeneration, isVectorStateError, readVectorState, withVectorWrite } from './vector-profile.js'
 import { bigrams, dice, similarTexts, DUP_DICE, DUP_REJECT_DICE, TOPIC_DICE } from './text-similarity.js'
+import { applyAbsorbIndexTransaction } from './curator.js'
 
 const HALF_LIFE_DAYS = 14
 // A short-term entry is meant to live for the length of a conversation, not a
@@ -595,6 +596,48 @@ export function findConflict(entries, candidate) {
   return null
 }
 
+// Duplicate/conflict gates may only consult entries this conversation could
+// actually surface. `secret` never auto-surfaces; knownBy/context-hidden rows are
+// equally invisible. A hidden hit must not leak its id (5.1).
+function visibleForDedupe(entry, sessionId) {
+  if (!entry || entry.visibility === 'secret') return false
+  return sessionId ? visibleToSession(entry, sessionId) : true
+}
+
+// Critical-section re-check for the duplicate gate (5.4): the pre-flight scan
+// runs before the backend await, so a concurrent writer can land a twin while the
+// commit is in flight. Same ruler, same visible scope, one pass inside the lock.
+function findNearDuplicate(entries, { id, title, content, context, sessionId, excludeId = null }) {
+  const text = `${title || ''} ${content || ''}`
+  let duplicate = null
+  let hidden = false
+  for (const [otherId, other] of Object.entries(entries || {})) {
+    if (otherId === id || otherId === excludeId) continue
+    if (!isMemoryEligible(other)) continue
+    if (!sameFactContext(other.context, context)) continue
+    const similarity = similarTexts(text, `${other.title || ''} ${other.content || ''}`)
+    if (!visibleForDedupe(other, sessionId)) {
+      if (similarity >= DUP_REJECT_DICE) hidden = true
+      continue
+    }
+    if (similarity > (duplicate?.similarity ?? 0)) duplicate = { id: otherId, similarity }
+  }
+  return { duplicate, hidden }
+}
+
+// The visible tail that the rewrite adds/changes, for a rejection response. Only
+// ever computed against a VISIBLE duplicate — a hidden twin's text must not leak.
+function nearDuplicateDiff(existingText, candidateText, max = 180) {
+  const a = String(existingText || '')
+  const b = String(candidateText || '')
+  let start = 0
+  while (start < a.length && start < b.length && a[start] === b[start]) start += 1
+  let end = 0
+  while (end < a.length - start && end < b.length - start && a[a.length - 1 - end] === b[b.length - 1 - end]) end += 1
+  const added = b.slice(start, b.length - end).trim()
+  return clampText(added || b, max)
+}
+
 function mirrorContent(file) {
   const raw = file?.content
   if (typeof raw === 'string' && raw.trim()) return raw
@@ -1350,7 +1393,10 @@ async function privateRememberImpl({
   // the library is not silently appended: it lands as pending_review with the id it
   // collides with, so the conflict surfaces instead of both copies being read as
   // true. Same mechanism the global curator uses; until now the private side had none.
-  const conflict = findConflict(Object.fromEntries(Object.entries(index.entries).filter(([key]) => key !== id)), entry)
+  // Hidden rows are excluded (5.1): otherwise a visible write could learn an id
+  // through conflictingWith, and a hidden claim could hold an unrelated new one.
+  const memorySession = memorySessionId(exec)
+  const conflict = findConflict(Object.fromEntries(Object.entries(index.entries).filter(([key, other]) => key !== id && visibleForDedupe(other, memorySession))), entry)
   if (conflict) {
     entry.status = 'pending_review'
     entry.conflictingWith = conflict.id
@@ -1366,24 +1412,58 @@ async function privateRememberImpl({
   // Never deletes or rewrites anything: a hit either refuses the new entry, or tags
   // it duplicateOf so recall can keep one seat per fact.
   let duplicate = null
+  let hiddenDuplicate = null
   if (!conflict && allowDuplicate !== true) {
     const text = `${entry.title || ''} ${content || ''}`
-    const grams = bigrams(text)
     for (const [otherId, other] of Object.entries(index.entries)) {
-      // Same filter set the recall side uses: only an entry a recall could actually
-      // surface can be "the same fact" — and a duplicateOf tag must point at one.
       if (otherId === id || !isMemoryEligible(other)) continue
       if (!sameFactContext(other.context, entry.context)) continue
       const similarity = similarTexts(text, `${other.title || ''} ${other.content || ''}`)
+      if (!visibleForDedupe(other, memorySession)) {
+        // Hidden near-duplicate: refuse generically, never return its id/similarity.
+        if (similarity >= DUP_REJECT_DICE) hiddenDuplicate = { similarity }
+        continue
+      }
       if (similarity > (duplicate?.similarity ?? 0)) duplicate = { id: otherId, similarity }
     }
   }
-  if (duplicate && duplicate.similarity >= DUP_REJECT_DICE) {
+  if (hiddenDuplicate || (duplicate && duplicate.similarity >= DUP_REJECT_DICE)) {
+    // 5.3：拒写不丢文本——新正文作为 pending_review 暂存，进入现有复核队列；
+    // 可见重复给出 id 与差异片段，隐藏重复只说“有重复”，不泄露 id/正文。
+    const visibleTarget = duplicate ? index.entries[duplicate.id] || null : null
+    const pendingEntry = {
+      ...entry,
+      status: 'pending_review',
+      reviewReason: 'near_duplicate',
+      conflictingWith: duplicate ? duplicate.id : null,
+      ...(duplicate ? { duplicateOf: duplicate.id } : {}),
+    }
+    await retryStoreWrite(() => updatePrivateIndex(scope.libraryId, (fresh) => {
+      if (fresh.entries[id]) throw new Error('memory changed concurrently; retry')
+      fresh.entries[id] = pendingEntry
+    }))
+    if (duplicate) {
+      const diff = nearDuplicateDiff(
+        `${visibleTarget?.title || ''} ${visibleTarget?.content || ''}`,
+        `${entry.title || ''} ${entry.content || ''}`,
+      )
+      return {
+        id,
+        entry: pendingEntry,
+        pending: true,
+        deduped: true,
+        existingId: duplicate.id,
+        similarity: duplicate.similarity,
+        hint: `库内已有一条几乎相同的记忆；新正文已暂存待复核（near_duplicate）。差异片段：${diff || '(无可见差异)'}。若确属两次独立观测，带 allowDuplicate=true 重写；要合并请改用 memu_private_update。`,
+      }
+    }
     return {
+      id,
+      entry: pendingEntry,
+      pending: true,
       deduped: true,
-      existingId: duplicate.id,
-      similarity: duplicate.similarity,
-      hint: '库内已有一条几乎相同的记忆；改用 memu_private_update 合并内容。若确属两次独立观测，带 allowDuplicate=true 重写',
+      similarityBand: '0.90+',
+      hint: '库内已有一条几乎相同的记忆，但它不在当前会话的可见范围内；新正文已暂存待复核（near_duplicate）。',
     }
   }
   if (duplicate && duplicate.similarity >= TOPIC_DICE) entry.duplicateOf = duplicate.id
@@ -1418,13 +1498,27 @@ async function privateRememberImpl({
     if (sessionIdOf(exec) && (!currentBinding || currentBinding.libraryId !== scope.libraryId)) throw new Error('memory scope changed during write; retry')
     if (currentBinding) assertScopeEnabled(currentBinding)
     if (previousHabit && JSON.stringify(fresh.entries[id]) !== JSON.stringify(previousHabit[1])) throw new Error('habit changed concurrently; recall and retry')
-    const latestConflict = findConflict(Object.fromEntries(Object.entries(fresh.entries).filter(([key]) => key !== id)), entry)
+    const latestConflict = findConflict(Object.fromEntries(Object.entries(fresh.entries).filter(([key, other]) => key !== id && visibleForDedupe(other, memorySession))), entry)
     if (latestConflict && !conflict) {
       if (db) throw new Error('memory conflict changed during write; retry for review')
       entry.status = 'pending_review'
       entry.conflictingWith = latestConflict.id
       entry.reviewReason = 'concurrent conflicting memory; review required'
     }
+    // 5.4：预检在 await 之前，提交期间另一个 turn 可能刚写入同事实。临界区用同一
+    // 尺子重扫；命中就 retry（有向量则 throw 让 compensation 撤掉刚提交的行），
+    // lexical 路由直接暂扣为 near_duplicate，不双写也不丢文本。
+    const latestDuplicate = allowDuplicate
+      ? { duplicate: null, hidden: false }
+      : findNearDuplicate(fresh.entries, {
+        id, title: entry.title, content: entry.content, context: entry.context, sessionId: memorySession,
+      })
+    if (latestDuplicate.hidden || (latestDuplicate.duplicate && latestDuplicate.duplicate.similarity >= DUP_REJECT_DICE)) {
+      if (db) throw new Error('memory duplicate changed during write; retry')
+      entry.status = 'pending_review'
+      entry.reviewReason = 'near_duplicate'
+      entry.conflictingWith = latestDuplicate.duplicate?.id || null
+    }
     if (layer === 'must_remember' && pinSource === 'self') {
       const pinned = Object.values(fresh.entries).filter(e => e.layer === 'must_remember' && isMemoryEligible(e)).length
       if (pinned >= Number(getSettings().mustRememberCap || 12)) throw new Error('must_remember soft cap reached; retry as long_term')
@@ -1745,6 +1839,7 @@ async function privateUpdateImpl({ exec, libraryId, id, content, title, tags, st
   const scope = resolveLibrary({ exec, libraryId })
   if (scope.binding) assertScopeEnabled(scope.binding)
   const index = loadPrivateIndex(scope.libraryId)
+  const memorySession = memorySessionId(exec)
   const id_ = resolveEntryId(index, id)
   const entry = index.entries[id_]
   assertEntryAccess(entry, exec)
@@ -1776,29 +1871,46 @@ async function privateUpdateImpl({ exec, libraryId, id, content, title, tags, st
   const nextContext = context === undefined ? entry.context : normalizeMemoryContext(context)
   const scanned = textChanged && entry.status !== 'pending_review'
   let duplicate = null
+  let hiddenDuplicate = null
   let text = null
   if (scanned) {
-    const others = Object.fromEntries(Object.entries(index.entries).filter(([key]) => key !== id_))
-    const conflict = findConflict(others, { ...entry, title: nextTitle, content: nextContent ?? entry.content })
+    const allOthers = Object.fromEntries(Object.entries(index.entries).filter(([key]) => key !== id_))
+    const visibleOthers = Object.fromEntries(Object.entries(allOthers).filter(([, other]) => visibleForDedupe(other, memorySession)))
+    const conflict = findConflict(visibleOthers, { ...entry, title: nextTitle, content: nextContent ?? entry.content })
     if (conflict) throw new Error(`content conflicts with ${conflict.id}; write a new memory for review`)
     text = `${nextTitle} ${nextContent ?? entry.content}`
-    for (const [otherId, other] of Object.entries(others)) {
+    for (const [otherId, other] of Object.entries(allOthers)) {
       // 与 remember 的门同一过滤集（isMemoryEligible + sameFactContext），再排除它原本的
       // duplicateOf 关系——那对条目是写入时就获准共存的，向它继续靠拢不该被拦。
       if (!isMemoryEligible(other)) continue
       if (otherId === entry.duplicateOf) continue
       if (!sameFactContext(other.context, nextContext)) continue
       const similarity = similarTexts(text, `${other.title || ''} ${other.content || ''}`)
+      if (!visibleForDedupe(other, memorySession)) {
+        if (similarity >= DUP_REJECT_DICE) hiddenDuplicate = { similarity }
+        continue
+      }
       if (similarity > (duplicate?.similarity ?? 0)) duplicate = { id: otherId, similarity }
     }
+    if (hiddenDuplicate) {
+      record({
+        kind: 'write', scope: 'private', sessionId: sessionIdOf(exec) || null, libraryId: scope.libraryId,
+        message: '拒绝重复更新：改写后与当前会话不可见的记忆几乎相同',
+        detail: { id: id_, deduped: true, hidden: true, similarityBand: '0.90+' },
+        refs: [id_],
+      })
+      throw new Error('update refused: a nearly identical memory exists outside this conversation\'s visible scope; rewrite the text or archive one of the two instead')
+    }
     if (duplicate && duplicate.similarity >= DUP_REJECT_DICE) {
+      const target = index.entries[duplicate.id]
+      const diff = nearDuplicateDiff(`${target?.title || ''} ${target?.content || ''}`, text)
       record({
         kind: 'write', scope: 'private', sessionId: sessionIdOf(exec) || null, libraryId: scope.libraryId,
         message: '拒绝重复更新：' + id_ + ' 改写后与 ' + duplicate.id + ' 几乎相同',
         detail: { id: id_, deduped: true, existingId: duplicate.id, similarity: duplicate.similarity },
         refs: [id_, duplicate.id],
       })
-      throw new Error(`update refused: the rewritten text is nearly identical to ${duplicate.id} (dice ${duplicate.similarity.toFixed(2)}); merge into ${duplicate.id} or archive one of the two instead`)
+      throw new Error(`update refused: the rewritten text is nearly identical to ${duplicate.id} (dice ${duplicate.similarity.toFixed(2)}); differences: ${diff || '(none visible)'}; merge into ${duplicate.id} or archive one of the two instead`)
     }
   }
   const route = engineRoute()
@@ -1831,6 +1943,16 @@ async function privateUpdateImpl({ exec, libraryId, id, content, title, tags, st
     const currentBinding = peekBinding(exec)
     if (sessionIdOf(exec) && (!currentBinding || currentBinding.libraryId !== scope.libraryId)) throw new Error('memory scope changed during update; retry')
     if (currentBinding) assertScopeEnabled(currentBinding)
+    if (scanned) {
+      const latestDuplicate = findNearDuplicate(fresh.entries, {
+        id: id_, title: nextTitle, content: nextContent ?? entry.content, context: nextContext,
+        sessionId: memorySession, excludeId: entry.duplicateOf,
+      })
+      if (latestDuplicate.hidden || (latestDuplicate.duplicate && latestDuplicate.duplicate.similarity >= DUP_REJECT_DICE)) {
+        throw new Error('duplicate changed during update; retry')
+      }
+      if (latestDuplicate.duplicate) duplicate = latestDuplicate.duplicate
+    }
     if (title !== undefined) target.title = clampText(title, 120)
     if (nextContent !== undefined) target.content = nextContent
     // 打标带与 remember 同口径：[0.55, 0.90) 改写后仍与另一条同主题 → duplicateOf。
@@ -1947,14 +2069,19 @@ async function privateUpdateImpl({ exec, libraryId, id, content, title, tags, st
 }
 
 /** Review activation and invalidation of the previous claim are one index commit. */
-async function resolveMemoryReviewImpl({ libraryId = null, id, action, resolution = 'replace', reason = '', content, title }) {
+async function resolveMemoryReviewImpl({ libraryId = null, id, action, resolution = 'replace', reason = '', content, title, sessionId = null }) {
   if (!['accept', 'reject'].includes(action)) throw new Error('action must be accept or reject')
-  if (!['replace', 'coexist'].includes(resolution)) throw new Error('resolution must be replace or coexist')
-  if (resolution === 'coexist' && String(reason).trim().length < 8) throw new Error('coexist needs a reason describing the distinct conditions (at least 8 characters)')
   if (libraryId && !getLibrary(libraryId)) throw new Error('library not found')
   const index = libraryId ? loadPrivateIndex(libraryId) : loadGlobalIndex()
   const entry = index.entries[id]
   if (!entry || entry.status !== 'pending_review') throw new Error('no such pending review')
+  // pendingAbsorb（spec §4.11 review-all / 安全门触发的 pending absorb）：走专用复核
+  // 分支——提案是"整簇合并稿"，accept/reject 的落库动作与普通复核完全不同。
+  if (!libraryId && entry.pendingAbsorb) {
+    return resolveAbsorbReviewImpl({ id, entry, index, action, resolution, reason, content, title, sessionId })
+  }
+  if (!['replace', 'coexist'].includes(resolution)) throw new Error('resolution must be replace or coexist')
+  if (resolution === 'coexist' && String(reason).trim().length < 8) throw new Error('coexist needs a reason describing the distinct conditions (at least 8 characters)')
   const next = { ...entry }
   if (action === 'accept') {
     if (typeof content === 'string' && content.trim()) next.content = content
@@ -1966,21 +2093,37 @@ async function resolveMemoryReviewImpl({ libraryId = null, id, action, resolutio
     // 复核的本来含义，不是重复。
     const text = `${next.title || ''} ${next.content || ''}`
     let duplicate = null
+    let hiddenDuplicate = null
     for (const [otherId, other] of Object.entries(index.entries || {})) {
       if (otherId === id || otherId === entry.conflictingWith) continue
       if (!isMemoryEligible(other)) continue
       if (!sameFactContext(other.context, next.context)) continue
       const similarity = similarTexts(text, `${other.title || ''} ${other.content || ''}`)
+      if (!visibleForDedupe(other, sessionId)) {
+        if (similarity >= DUP_REJECT_DICE) hiddenDuplicate = { similarity }
+        continue
+      }
       if (similarity > (duplicate?.similarity ?? 0)) duplicate = { id: otherId, similarity }
     }
+    if (hiddenDuplicate) {
+      record({
+        kind: 'write', scope: libraryId ? 'private' : 'global', libraryId: libraryId || null,
+        message: '拒绝复核接受：接受稿与当前会话不可见的记忆几乎相同',
+        detail: { id, deduped: true, hidden: true, similarityBand: '0.90+' },
+        refs: [id],
+      })
+      throw new Error('review accept refused: a nearly identical memory exists outside the visible scope; pass different content or change the review scope first')
+    }
     if (duplicate && duplicate.similarity >= DUP_REJECT_DICE) {
+      const target = index.entries[duplicate.id]
+      const diff = nearDuplicateDiff(`${target?.title || ''} ${target?.content || ''}`, text)
       record({
         kind: 'write', scope: libraryId ? 'private' : 'global', libraryId: libraryId || null,
         message: '拒绝复核接受：' + id + ' 与 ' + duplicate.id + ' 几乎相同',
         detail: { id, deduped: true, existingId: duplicate.id, similarity: duplicate.similarity },
         refs: [id, duplicate.id],
       })
-      throw new Error(`review accept refused: the accepted text is nearly identical to ${duplicate.id} (dice ${duplicate.similarity.toFixed(2)}); pass different content or archive ${duplicate.id} first`)
+      throw new Error(`review accept refused: the accepted text is nearly identical to ${duplicate.id} (dice ${duplicate.similarity.toFixed(2)}); differences: ${diff || '(none visible)'}; pass different content or archive ${duplicate.id} first`)
     }
     if (duplicate && duplicate.similarity >= TOPIC_DICE) next.duplicateOf = duplicate.id
     const reviewRoute = engineRoute()
@@ -2000,6 +2143,15 @@ async function resolveMemoryReviewImpl({ libraryId = null, id, action, resolutio
       || JSON.stringify(fresh.entries[entry.conflictingWith]) !== JSON.stringify(index.entries[entry.conflictingWith])) {
       throw new Error('review changed; reload and retry')
     }
+    if (action === 'accept') {
+      const latestDuplicate = findNearDuplicate(fresh.entries, {
+        id, title: next.title, content: next.content, context: next.context,
+        sessionId, excludeId: entry.conflictingWith,
+      })
+      if (latestDuplicate.hidden || (latestDuplicate.duplicate && latestDuplicate.duplicate.similarity >= DUP_REJECT_DICE)) {
+        throw new Error('review changed; reload and retry')
+      }
+    }
     const at = stamp()
     next.status = action === 'accept' ? 'active' : 'archived'
     next.reviewedAt = at
@@ -2024,6 +2176,119 @@ async function resolveMemoryReviewImpl({ libraryId = null, id, action, resolutio
   return { id, status: next.status, resolution }
 }
 
+/**
+ * pendingAbsorb 复核分支（spec §3.3/§4.11/§6.7）。只作用于全局队列（私有索引里
+ * 不存在 pendingAbsorb）。
+ *
+ * accept：resolution 必须 replace——合并稿不能与自己的来源"并存"，coexist 直接抛错；
+ * 重复门排除 [id, conflictingWith, ...sourceIds]，否则合并稿会被自己的来源判重；
+ * 快照校验 target/sources 仍 active 且 updatedAt === expectedUpdatedAt，否则抛
+ * 'review changed; reload and retry'；向量库只提交提案 id 本身（绝不提交 sources，
+ * §6.7 复核）；然后单事务落 §4.11 步骤 3c-6 并清 pendingAbsorb/reviewReason/
+ * conflictingWith。索引写失败时 pending 保持、已提交向量行未激活（现有行为，
+ * 本版不额外补偿）。
+ *
+ * reject：提案 archived；target/sources 原样。
+ */
+async function resolveAbsorbReviewImpl({ id, entry, index, action, resolution, reason, content, title, sessionId = null }) {
+  const pa = entry.pendingAbsorb || {}
+  const targetId = String(pa.targetId || '')
+  const sourceIds = (Array.isArray(pa.sourceIds) ? pa.sourceIds : []).map(String)
+  if (action === 'reject') {
+    await retryStoreWrite(() => updateGlobalIndex((fresh) => {
+      if (JSON.stringify(fresh.entries[id]) !== JSON.stringify(entry)) throw new Error('review changed; reload and retry')
+      const at = stamp()
+      const next = { ...entry, status: 'archived', reviewedAt: at, updatedAt: at, reviewResolution: resolution }
+      if (reason) next.reviewNote = String(reason).trim().slice(0, 1000)
+      fresh.entries[id] = next
+    }))
+    return { id, status: 'archived', resolution }
+  }
+  // —— accept ——
+  if (resolution !== 'replace') {
+    throw new Error('absorb review accept requires the replace resolution; a merged entry cannot coexist with its own sources')
+  }
+  const next = { ...entry }
+  if (typeof content === 'string' && content.trim()) next.content = content
+  if (typeof title === 'string' && title.trim()) next.title = title
+  const exclude = new Set([id, entry.conflictingWith, targetId, ...sourceIds].filter(Boolean))
+  const text = `${next.title || ''} ${next.content || ''}`
+  let duplicate = null
+  let hiddenDuplicate = null
+  for (const [otherId, other] of Object.entries(index.entries || {})) {
+    if (exclude.has(otherId)) continue
+    if (!isMemoryEligible(other)) continue
+    if (!sameFactContext(other.context, next.context)) continue
+    const similarity = similarTexts(text, `${other.title || ''} ${other.content || ''}`)
+    if (!visibleForDedupe(other, sessionId)) {
+      if (similarity >= DUP_REJECT_DICE) hiddenDuplicate = { similarity }
+      continue
+    }
+    if (similarity > (duplicate?.similarity ?? 0)) duplicate = { id: otherId, similarity }
+  }
+  if (hiddenDuplicate) {
+    record({
+      kind: 'write', scope: 'global', libraryId: null,
+      message: '拒绝集合吸收接受：接受稿与当前会话不可见的记忆几乎相同',
+      detail: { id, deduped: true, hidden: true, similarityBand: '0.90+' },
+      refs: [id],
+    })
+    throw new Error('review accept refused: a nearly identical memory exists outside the visible scope; pass different content or change the review scope first')
+  }
+  if (duplicate && duplicate.similarity >= DUP_REJECT_DICE) {
+    const target = index.entries[duplicate.id]
+    const diff = nearDuplicateDiff(`${target?.title || ''} ${target?.content || ''}`, text)
+    record({
+      kind: 'write', scope: 'global', libraryId: null,
+      message: '拒绝集合吸收接受：' + id + ' 与 ' + duplicate.id + ' 几乎相同',
+      detail: { id, deduped: true, existingId: duplicate.id, similarity: duplicate.similarity },
+      refs: [id, duplicate.id],
+    })
+    throw new Error(`review accept refused: the accepted text is nearly identical to ${duplicate.id} (dice ${duplicate.similarity.toFixed(2)}); differences: ${diff || '(none visible)'}; pass different content or archive ${duplicate.id} first`)
+  }
+  if (duplicate && duplicate.similarity >= TOPIC_DICE) next.duplicateOf = duplicate.id
+  // 快照校验（§4.11 accept 3）：target/sources 仍 active 且 updatedAt 未被并发改写。
+  const expected = pa.expectedUpdatedAt || {}
+  for (const memberId of [targetId, ...sourceIds].filter(Boolean)) {
+    const current = index.entries[memberId]
+    if (!current || current.status !== 'active'
+      || (expected[memberId] !== undefined && current.updatedAt !== expected[memberId])) {
+      throw new Error('review changed; reload and retry')
+    }
+  }
+  // 向量提交：只提交提案 id，绝不提交 sources（§6.7 复核）。
+  const reviewRoute = engineRoute()
+  if (reviewRoute !== 'lexical') {
+    await commit({
+      payload: { recall_files: [{ name: id, track: next.track || 'memory', description: clampText(next.title, 180), content: next.content }], resource: [], user: {} },
+      route: reviewRoute,
+      db: globalDbPath(),
+    })
+    next.vector = activeEntryStamp(reviewRoute) || next.vector
+  }
+  // 单事务：§4.11 步骤 3c-6。merged 入索引、target superseded、sources archived、
+  // rewire links、写 absorbSnapshot，然后清 pendingAbsorb/reviewReason/conflictingWith。
+  await retryStoreWrite(() => updateGlobalIndex((fresh) => {
+    if (JSON.stringify(fresh.entries[id]) !== JSON.stringify(entry)) throw new Error('review changed; reload and retry')
+    const at = stamp()
+    next.status = 'active'
+    next.updatedAt = at
+    next.reviewedAt = at
+    next.reviewResolution = resolution
+    next.validFrom = at
+    if (reason) next.reviewNote = String(reason).trim().slice(0, 1000)
+    const outcome = applyAbsorbIndexTransaction(fresh, {
+      mergedId: id, merged: next, targetId, sourceIds, expectedUpdatedAt: expected, now: at,
+    })
+    if (!outcome.landed) throw new Error('review changed; reload and retry')
+    const stored = fresh.entries[id]
+    delete stored.pendingAbsorb
+    delete stored.reviewReason
+    delete stored.conflictingWith
+  }))
+  return { id, status: 'active', resolution }
+}
+
 /**
  * Short-term entries expire instead of being deleted. Deleting would throw away the
  * only copy before the consolidation pass could decide what it was worth; flipping

package/lib/memu.js

@@ -2,7 +2,7 @@ import fs from 'node:fs'
 import path from 'node:path'
 import { spawn } from 'node:child_process'
 import { dataDir, ensureDir, redactSecrets, windowsSystemEnv } from './paths.js'
-import { readCurrent, verifyEngine } from './engine.js'
+import { ENGINE_VERSION, readCurrent, verifyEngine } from './engine.js'
 import { getSettings } from './state.js'
 import { activeProfile, captureVectorGeneration, assertVectorGeneration, assertProfileVerified, assertMigrationProfile } from './vector-profile.js'
 import { embeddingWorkerManager } from './local-embedding-manager.js'
@@ -219,6 +219,6 @@ export async function forget({ db, name, timeoutMs = 60_000 } = {}) {
 
 export async function probe() {
   const current = currentEngine()
-  const verified = await verifyEngine(current.python)
+  const verified = await verifyEngine(current.python, { expectedVersion: current.version || ENGINE_VERSION })
   return { ...verified, current }
 }

package/lib/migrate.js

@@ -7,11 +7,18 @@
 // the pass exists to rewrite the files: a library nobody writes to again would otherwise
 // keep the dead `sessionId` fields on disk forever, and an auditor reading the JSON would
 // have to know about a level the code no longer has.
+//
+// The lexicon half (§2.1 of the construction spec) is the same shape: older builds
+// wrote `pending` proposals and revision drafts; the current lifecycle has only active/archived. The rewrite rule
+// lives in `lib/lexicon.js` (`migrateLegacyLexiconStatuses`); this file only finds the
+// files and runs it, one library at a time, so a single corrupt lexicon cannot take the
+// sweep — or startup — down with it.
 import fs from 'node:fs'
 import path from 'node:path'
-import { indexDir, readJson, stamp } from './paths.js'
+import { dataDir, indexDir, isSafeId, readJson, readJsonStrict, stamp } from './paths.js'
 import { listLibrariesAll, updatePrivateIndex } from './state.js'
 import { countLegacyInRaw, migrateEntryVisibility } from './visibility.js'
+import { migrateLegacyLexiconStatuses } from './lexicon.js'
 
 const DEFAULT_MIN_INTERVAL_MS = 60_000
 const lastRun = { at: 0 }
@@ -109,11 +116,85 @@ export function maybeMigrateLibraries({ minIntervalMs = DEFAULT_MIN_INTERVAL_MS,
   return migrateLibraries({ now })
 }
 
+// ── lexicon lifecycle (§2.1): pending → active/archived ─────────────────────────
+// The directory holds exactly `<libraryId>.json`; a name that does not pass `isSafeId`
+// is skipped rather than guessed at, the same path boundary `lib/lexicon.js` enforces
+// before it builds a filename.
+
+function lexiconDir() {
+  return path.join(dataDir(), 'lexicon')
+}
+
+/** Library ids that own a lexicon file. Sorted, safe names only. */
+export function scanLexiconLibraries() {
+  let names = []
+  try { names = fs.readdirSync(lexiconDir()) } catch { return [] }
+  return names
+    .filter((name) => name.endsWith('.json'))
+    .map((name) => name.slice(0, -'.json'.length))
+    .filter((id) => isSafeId(id))
+    .sort()
+}
+
+// Counted on the raw file, before any load-time interpretation, so a sweep can tell a
+// library that still needs the rewrite from one that is already migrated. `readJsonStrict`
+// (not `readJson`) on purpose: a scan must not move files, and `readJson` quarantines a
+// corrupt one as a side effect. A file that does not parse counts 0 — it cannot hold
+// statuses to migrate, and `lib/lexicon.js` already blocks writes to it until restored.
+function legacyLexiconCount(libraryId) {
+  const result = readJsonStrict(path.join(lexiconDir(), `${libraryId}.json`))
+  if (!result.ok) return 0
+  const terms = result.value?.terms
+  if (!terms || typeof terms !== 'object') return 0
+  return Object.values(terms).filter((entry) => entry && entry.status === 'pending').length
+}
+
+/** Lexicon files that still hold legacy `pending` entries. */
+export function scanLegacyLexiconLibraries() {
+  return scanLexiconLibraries()
+    .map((libraryId) => ({ libraryId, legacy: legacyLexiconCount(libraryId) }))
+    .filter((report) => report.legacy > 0)
+}
+
+/**
+ * Rewrite every lexicon that still carries `pending` entries.
+ *
+ * Per-library try/catch is the point: a single corrupt or write-protected lexicon must
+ * not stop the others, and must never abort startup (the pass runs from the cycle tick).
+ * A library with nothing to do is not written at all — `migrateLegacyLexiconStatuses`
+ * skips the write (and the revision bump) when no entry changed.
+ */
+export function migrateLexiconLibraries() {
+  const reports = []
+  for (const { libraryId, legacy } of scanLegacyLexiconLibraries()) {
+    try {
+      const result = migrateLegacyLexiconStatuses(libraryId)
+      reports.push({
+        libraryId,
+        before: legacy,
+        migrated: result.migrated,
+        ...(result.details ? { details: result.details } : {}),
+      })
+    } catch (error) {
+      reports.push({ libraryId, before: legacy, migrated: 0, error: String(error?.message || error) })
+    }
+  }
+  return reports
+}
+
 export function runVisibilityMigrationPass({ now = stamp(), log = () => {} } = {}) {
   const reports = migrateLibraries({ now })
   for (const report of reports) {
     if (report.error) log(`visibility migration failed for ${report.libraryId}: ${report.error}`)
     else if (report.migrated > 0) log(`migrated ${report.migrated} legacy memory/memories to shared in ${report.libraryId}`)
   }
-  return { reports }
+  // §2.1: legacy lexicons may still carry pending proposals/revision drafts. The rewrite is
+  // idempotent and only writes files that change, so running it on every cycle tick
+  // costs a directory read plus one JSON parse per file that still has pending entries.
+  const lexicon = migrateLexiconLibraries()
+  for (const report of lexicon) {
+    if (report.error) log(`lexicon lifecycle migration failed for ${report.libraryId}: ${report.error}`)
+    else if (report.migrated > 0) log(`migrated ${report.migrated} legacy lexicon term(s) to the active/archived lifecycle in ${report.libraryId}`)
+  }
+  return { reports, lexicon }
 }