dsh-subagent-profile 0.3.4 → 0.4.0

package/lib/core/evolution-generate.mjs

@@ -0,0 +1,196 @@
+// lib/core/evolution-generate.mjs — 候选生成路径（从 evolution-engine 拆出守行门）：
+// 一条建议 → ≤3 条互斥候选，逐候选过三道闸（闸由装配层注入）后落资产域。更新策略
+// 与有效期用户可配：自动换新在「候选到期且数据显著变化」时把旧候选转 expired（留
+// 审计）再产新一代；手动维护不自动换代、不自动过期，只经「重新生成候选」刷新
+// （留审计）。纯函数 + 注入 deps，零 IO、零 LLM。
+
+import { sanitizeProfile } from './pure.mjs';
+import { profileKeyOf } from './evolution-summary.mjs';
+import { buildEvolutionCandidates, profileFingerprint, sourceConfigFromKey } from './evolution-draft.mjs';
+import { candidateExpired, candidateExpiryOf, dataFingerprintOf, dataSignificantlyChanged, expireAuditEntry, refreshAuditEntry } from './evolution-renewal.mjs';
+
+// 候选总量护栏：evolution 资产数达到 20 条即跳过生成并 warn（阈值待实测后校准）。
+const ASSET_CAP = 20;
+
+// 存量 profile 的 L1 身份键（与聚合层同口径：persona/toolFilter 只认存在性）。
+function keyCfg(profile) {
+  const cfg = {};
+  if (typeof profile.preset === 'string' && profile.preset !== '' && profile.preset !== 'inherit') cfg.preset = profile.preset;
+  if (typeof profile.provider === 'string' && profile.provider !== '') cfg.provider = profile.provider;
+  if (typeof profile.model === 'string' && profile.model !== '') cfg.model = profile.model;
+  if (typeof profile.persona === 'string' && profile.persona.length > 0) cfg.persona_present = true;
+  if (profile.toolFilter !== undefined && profile.toolFilter !== null) cfg.toolFilter_present = true;
+  return cfg;
+}
+
+// 注册表中与该 L1 身份键匹配的方案（净化后快照）——指纹输入，编辑任一方案
+// 都会使候选过期。
+export function matchingRegistryProfiles(store, profileKey) {
+  const profiles = store.profiles instanceof Map ? [...store.profiles.values()] : [];
+  return profiles
+    .filter((p) => p !== null && typeof p === 'object' && profileKeyOf(keyCfg(p)) === profileKey)
+    .map((p) => sanitizeProfile(p, { strict: false }).clean);
+}
+
+// 单条候选 → 资产对象。baseline_snapshot 留档金丝雀基线（from + 生成时刻的加权分/
+// 样本数）；data_fingerprint 留档换代判定输入；expiry 按用户设置（手动维护或不自动
+// 过期档为 null，否则 = 生成时刻 + 有效期小时数）。
+export function buildAsset(deps, item, draft, now, summaries) {
+  const l1Entry = summaries !== null && typeof summaries === 'object' && summaries.l1 !== null && typeof summaries.l1 === 'object'
+    ? summaries.l1[item.profileKey]
+    : undefined;
+  const l2 = summaries !== null && typeof summaries === 'object' ? summaries.l2 : undefined;
+  if (draft === null || typeof draft !== 'object') return null;
+  const from = sourceConfigFromKey(item.profileKey, l2);
+  const registry = matchingRegistryProfiles(deps.store, item.profileKey);
+  const fingerprint = profileFingerprint({ profileKey: item.profileKey, from, registryEntries: registry });
+  const axis = item.suggestion === '降' ? 'capability' : 'budget';
+  const direction = item.suggestion === '降' ? 'down' : 'up';
+  return {
+    v: 1,
+    id: draft.config.id,
+    source: 'evolution',
+    provenance: { pluginVersion: deps.pluginVersion, generatedAt: now, basis: draft.basis },
+    state: 'draft',
+    version: 1,
+    expiry: candidateExpiryOf(deps.getCandidateMode(), deps.getCandidateTtlH(), now),
+    from,
+    to: draft.config,
+    axis,
+    direction,
+    baseline_snapshot: {
+      from,
+      score: l1Entry?.score ?? null,
+      n: l1Entry?.confidence?.n ?? 0,
+      confidence: item.confidence ?? '',
+      generatedAt: now,
+    },
+    data_fingerprint: dataFingerprintOf(item, summaries),
+    profile_key: item.profileKey,
+    profile_fingerprint: fingerprint,
+    config: draft.config,
+    name: draft.name,
+    description: draft.description,
+    createdAt: now,
+    updatedAt: now,
+  };
+}
+
+// 单条建议 → ≤3 条候选，逐候选过三道闸（复用装配层注入的闸评估）后落盘；单条
+// 候选闸不过或落盘失败只跳过该候选（fail-soft），不影响其余候选与建议展示。
+async function generateCandidatesFor(deps, { item, snapshot, taken, now, summaries }) {
+  const l1Entry = summaries !== null && typeof summaries === 'object' && summaries.l1 !== null && typeof summaries.l1 === 'object'
+    ? summaries.l1[item.profileKey]
+    : undefined;
+  const l2 = summaries !== null && typeof summaries === 'object' ? summaries.l2 : undefined;
+  const drafts = buildEvolutionCandidates({
+    advice: item,
+    l1Entry,
+    l2,
+    snapshot,
+    whitelist: deps.whitelist,
+    takenIds: taken,
+    now,
+  });
+  const generated = [];
+  const skipped = [];
+  for (const draft of drafts) {
+    const gates = await deps.assessGates(draft.config);
+    if (!gates.ok) {
+      skipped.push({ profileKey: item.profileKey, candidateId: draft.config.id, reason: gates.reason });
+      continue;
+    }
+    const asset = buildAsset(deps, item, draft, now, summaries);
+    if (asset === null) continue;
+    const persisted = deps.assets.add(asset);
+    if (persisted.persisted) {
+      taken.add(asset.id);
+      generated.push(asset.id);
+    } else {
+      skipped.push({ profileKey: item.profileKey, candidateId: draft.config.id, reason: 'persist-failed' });
+    }
+  }
+  return { generated, skipped };
+}
+
+// auto 模式的待处置门槛：null = 可生成；{skip} = 幂等跳过；{expire} = 需先转
+// expired 再换代。观察期（proposed）恒阻断；手动维护不自动换代。
+function pendingGate(deps, item, now, summaries, mode) {
+  const unresolved = deps.assets.findUnresolved(item.profileKey);
+  if (unresolved.length === 0) return null;
+  if (mode === 'manual' || unresolved.some((entry) => entry.state === 'proposed')) return { skip: 'pending' };
+  const expired = unresolved.filter((entry) => candidateExpired(entry, now));
+  if (expired.length < unresolved.length) return { skip: 'pending' };
+  const next = dataFingerprintOf(item, summaries);
+  const changed = expired.some((entry) => {
+    const asset = deps.assets.get(entry.id);
+    return dataSignificantlyChanged(asset !== undefined ? (asset.data_fingerprint ?? {}) : {}, next);
+  });
+  return changed ? { expire: expired } : { skip: 'no-significant-change' };
+}
+
+// 生成候选（建议 → 资产域）：建议链开关门（evolutionAdvice）→ 总量护栏 → 逐条建议：
+//   auto：无未处置候选才生成；未到期幂等跳过；全部到期且数据显著变化 → 旧候选转
+//   expired（留审计）再产新一代；到期但数据没显著变化 → 保留旧候选跳过。
+//   manual：有任何未处置候选即幂等跳过（不自动换代、不自动过期）。
+//   forceProfileKey：只对该键绕过上述待处置门槛（「重新生成候选」内部复用）。
+export async function generateCandidates(deps, { advice, summaries, forceProfileKey = null } = {}) {
+  if (!deps.getAdviceEnabled()) return { generated: [], skipped: [], reason: 'advice-disabled' };
+  const snapshot = await deps.catalog.getSnapshot();
+  const now = Date.now();
+  const mode = deps.getCandidateMode();
+  const evolutionCount = deps.assets.countBySource('evolution');
+  if (evolutionCount >= ASSET_CAP) {
+    deps.logger.warn('[dsh-subagent-profile] 候选总量护栏：evolution 资产已达 20 条上限，跳过生成（阈值待实测后校准）');
+    return { generated: [], skipped: [] };
+  }
+  const taken = new Set([...deps.store.profiles.keys(), ...deps.assets.ids()]);
+  const generated = [];
+  const skipped = [];
+  for (const item of Array.isArray(advice) ? advice : []) {
+    if (evolutionCount + generated.length >= ASSET_CAP) break;
+    const forced = forceProfileKey !== null && item.profileKey === forceProfileKey;
+    if (!forced) {
+      const gate = pendingGate(deps, item, now, summaries, mode);
+      if (gate === null) { /* 无未处置候选，正常生成 */ }
+      else if (gate.skip !== undefined) { skipped.push({ profileKey: item.profileKey, reason: gate.skip }); continue; }
+      else {
+        for (const entry of gate.expire) {
+          const transitioned = deps.assets.transition(entry.id, 'expired', { expire_reason: 'expiry-and-data-change' });
+          if (transitioned.persisted) {
+            const asset = deps.assets.get(entry.id);
+            if (asset !== undefined) deps.evoLedger.recordGovernanceAudit(expireAuditEntry(asset, '候选到期且数据显著变化，已换新'));
+          }
+        }
+      }
+    }
+    const perItem = await generateCandidatesFor(deps, { item, snapshot, taken, now, summaries });
+    generated.push(...perItem.generated);
+    skipped.push(...perItem.skipped);
+  }
+  return { generated, skipped };
+}
+
+// 重新生成候选（人工触发）：该身份键所有未处置候选先转 expired，再产新一代；
+// 审计 suggestion-refresh 一条（人工触发即确认）。无当前建议时只清理不产新候选。
+export async function regenerateCandidates(deps, { profileKey, advice, summaries }) {
+  const unresolved = deps.assets.findUnresolved(profileKey);
+  const expired = [];
+  for (const entry of unresolved) {
+    const transitioned = deps.assets.transition(entry.id, 'expired', { expire_reason: 'manual-regenerate' });
+    if (transitioned.persisted) expired.push(entry.id);
+  }
+  const result = await generateCandidates(deps, { advice, summaries, forceProfileKey: profileKey });
+  const generatedIds = Array.isArray(result.generated) ? result.generated : [];
+  const item = (Array.isArray(advice) ? advice : []).find((a) => a !== null && typeof a === 'object' && a.profileKey === profileKey);
+  const l2 = summaries !== null && typeof summaries === 'object' ? summaries.l2 : undefined;
+  const first = generatedIds.length > 0 ? deps.assets.get(generatedIds[0]) : undefined;
+  deps.evoLedger.recordGovernanceAudit(refreshAuditEntry({
+    profileKey,
+    from: sourceConfigFromKey(profileKey, l2),
+    to: first !== undefined ? first.to : null,
+    axis: item?.suggestion === '升' ? 'budget' : 'capability',
+    direction: item?.suggestion === '升' ? 'up' : 'down',
+  }));
+  return { expired, generated: generatedIds, skipped: Array.isArray(result.skipped) ? result.skipped : [] };
+}

package/lib/core/evolution-ledger.mjs

@@ -2,6 +2,9 @@
 // 只 appendFileSync 追加一行，绝不改写既有行。import-free（仅 node 内置
 // fs/crypto/path + lib/core/pure.mjs），可被 bare-CI 单测直接 import。采集异常只
 // warn + 丢失计数，绝不阻断派发（fail-soft）。
+// 轮转：追加成功后在写路径惰性检查阈值（记录数/字节数），命中即封存当前台账为
+// dispatch-<seq>-<ts>.jsonl 并新建空台账续写；封存件超保留上限时淘汰最早者并
+// 提示回放窗口缩短。轮转失败只 warn（本条已落盘），下次写入重试。
 //
 // 审计分级：每类写失败分别计数，计数与 health 落盘到同目录的 ledger.meta.json
 // （{v:1, lostTelemetry, lostGovernance, health}）。派发台账写失败计 lostTelemetry
@@ -17,10 +20,11 @@
 // 不入库（写入那个时刻它们尚不存在，事后回填会破坏 append-only 不可变性，只由聚合层
 // 惰性 join）。
 
-import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { join } from 'node:path';
 import { textFrom } from './pure.mjs';
+import { createRotation } from './evolution-persistence.mjs';
 
 const LEDGER_VERSION = 1;
 const GOVERNANCE_AUDIT_VERSION = 1;
@@ -169,11 +173,26 @@ export function finishContinuableLedger(ledger, base, childId) {
 // --- 审计 meta（ledger.meta.json）----------------------------------------------
 
 // meta 默认态（缺失/损坏/形状不符均回退此值 → fail-soft 从零）。last_write_ts 为
-// 最近一次成功落盘时间（旧文件无该字段时经合并回退 0）。
-const META_DEFAULTS = { v: 1, lostTelemetry: 0, lostGovernance: 0, health: 'ok', last_write_ts: 0 };
+// 最近一次成功落盘时间（旧文件无该字段时经合并回退 0）。lost_count 计版本迁移
+// 类丢失；rotation_seq 为轮转序号（0 = 尚未轮转）。
+const META_DEFAULTS = {
+  v: 1,
+  lostTelemetry: 0,
+  lostGovernance: 0,
+  health: 'ok',
+  last_write_ts: 0,
+  lost_count: 0,
+  rotation_seq: 0,
+};
+
+// 可选字段（last_write_ts/lost_count/rotation_seq）缺省或非数字时回退默认，
+// 保证旧版本写出的 meta 文件可读。
+function optionalNumber(value, fallback) {
+  return typeof value === 'number' && Number.isFinite(value) ? value : fallback;
+}
 
 // 读取并校验 meta.json；缺失/损坏/形状不符回退默认并 warn（fail-soft 从零）。
-// 只接受 v:1 与必填三字段的数字/字符串形态，防止被手改的坏元数据冒充。
+// 只接受 v:1 与必填字段的数字/字符串形态，防止被手改的坏元数据冒充。
 function loadAuditMeta(metaFile, warn) {
   if (!existsSync(metaFile)) return { ...META_DEFAULTS };
   try {
@@ -184,7 +203,13 @@ function loadAuditMeta(metaFile, warn) {
       && typeof parsed.lostGovernance === 'number' && Number.isFinite(parsed.lostGovernance)
       && (parsed.health === 'ok' || parsed.health === 'degraded')
     ) {
-      return { ...META_DEFAULTS, ...parsed };
+      return {
+        ...META_DEFAULTS,
+        ...parsed,
+        last_write_ts: optionalNumber(parsed.last_write_ts, 0),
+        lost_count: optionalNumber(parsed.lost_count, 0),
+        rotation_seq: optionalNumber(parsed.rotation_seq, 0),
+      };
     }
     warn(`ledger meta: 审计元数据形状不符，已从零重建（${metaFile}）`);
     return { ...META_DEFAULTS };
@@ -201,7 +226,15 @@ function loadAuditMeta(metaFile, warn) {
 // fail-soft：清理 tmp + warn、返回 false。warnOnFailure 供派发遥测失败路径关闭——
 // 该路径已就台账写失败 warn 一次，避免重复告警。
 function persistAuditMeta(metaState, healthValue, warn, { warnOnFailure = true } = {}) {
-  const payload = { v: 1, lostTelemetry: metaState.lost, lostGovernance: metaState.governanceLost, health: healthValue, last_write_ts: Date.now() };
+  const payload = {
+    v: 1,
+    lostTelemetry: metaState.lost,
+    lostGovernance: metaState.governanceLost,
+    health: healthValue,
+    last_write_ts: Date.now(),
+    lost_count: metaState.migrationLost,
+    rotation_seq: metaState.rotationSeq,
+  };
   let reported = false;
   try {
     mkdirSync(metaState.dir, { recursive: true });
@@ -247,42 +280,105 @@ function appendGovernanceAudit(meta, dir, auditFile, persistMeta, warn, onAlert,
   }
 }
 
-export function createEvolutionLedger({ dshHome, pluginVersion, warn = () => {}, onAlert } = {}) {
+// 台账现有行数（按换行符计数，文件缺失/读失败回退 0）：轮转的记录数判据在
+// 内存累计，避免每次追加都读整文件。
+function countLines(file) {
+  try {
+    if (!existsSync(file)) return 0;
+    const text = readFileSync(file, 'utf8');
+    let count = 0;
+    for (let i = 0; i < text.length; i += 1) if (text[i] === '\n') count += 1;
+    return count;
+  } catch {
+    return 0;
+  }
+}
+
+// 台账字节数（文件缺失/读失败回退 0）。
+function fileBytes(file) {
+  try {
+    return statSync(file).size;
+  } catch {
+    return 0;
+  }
+}
+
+// 轮转执行器装配：追加成功后惰性检查；首次轮转前若 meta 文件缺失，先按现值落盘
+// （rotation_seq 从 0 起步），seq 递增后再落盘。文件操作异常向上抛，由调用方
+// fail-soft 处理。
+function makeRotationCheck({ dir, file, metaFile, meta, persistMeta, warn, rotation }) {
+  return createRotation({
+    dir,
+    dispatchFile: file,
+    getRotationSeq: () => meta.rotationSeq,
+    setRotationSeq: (seq) => { meta.rotationSeq = seq; },
+    initMetaIfMissing: () => {
+      if (!existsSync(metaFile)) persistMeta(meta.health, { warnOnFailure: false });
+    },
+    persistMeta: () => persistMeta(meta.health),
+    warn,
+    maxRecords: rotation.maxRecords,
+    maxBytes: rotation.maxBytes,
+    keep: rotation.keep,
+    now: rotation.now,
+  });
+}
+
+// 追加不可变：mkdir recursive + appendFileSync。写失败只 warn + 丢失计数 ++，
+// 绝不抛错、绝不阻断派发。写失败计 lostTelemetry 并落盘 meta；写成功恢复 ok。
+// 轮转检查独立于追加成败：轮转失败只 warn，本条已落盘、下次写入重试。
+function makeRecord({ dir, file, meta, persistMeta, warn, checkRotation }) {
+  return (entry) => {
+    try {
+      // 序列化也在 try 内（循环引用/BigInt 等理论异常会绕过 fail-soft 外泄；
+      // 实际 entry 为自产标量，防御性收口）。
+      const line = JSON.stringify({ v: LEDGER_VERSION, ts: Date.now(), ...entry });
+      mkdirSync(dir, { recursive: true });
+      appendFileSync(file, `${line}\n`, 'utf8');
+      meta.lineCount += 1;
+      if (meta.health === 'degraded') persistMeta('ok');
+    } catch (error) {
+      meta.lost += 1;
+      warn(`dispatch ledger: 派发台账写入失败，已丢失 ${meta.lost} 条（${error instanceof Error ? error.message : String(error)}）`);
+      persistMeta(meta.health, { warnOnFailure: false });
+      return;
+    }
+    try {
+      const result = checkRotation(meta.lineCount, fileBytes(file));
+      if (result.rotated) meta.lineCount = 0;
+    } catch (error) {
+      warn(`dispatch ledger: 台账轮转失败，将在下次写入重试（${error instanceof Error ? error.message : String(error)}）`);
+    }
+  };
+}
+
+export function createEvolutionLedger({ dshHome, pluginVersion, warn = () => {}, onAlert, rotation = {} } = {}) {
   if (typeof dshHome !== 'string' || dshHome.length === 0) {
     throw new Error('dispatch ledger: 派发台账需要 dshHome 目录');
   }
   const dir = join(dshHome, 'subagent-evolution');
   const file = join(dir, 'dispatch.jsonl');
   const auditFile = join(dir, 'governance-audit.jsonl');
-  const persisted = loadAuditMeta(join(dir, 'ledger.meta.json'), warn);
-  // 可写审计状态：lost（遥测）/governanceLost/health，初始为持久化值。
+  const metaFile = join(dir, 'ledger.meta.json');
+  const persisted = loadAuditMeta(metaFile, warn);
+  // 可写审计状态：lost（遥测）/governanceLost/migrationLost/rotationSeq/health，
+  // 初始为持久化值；lineCount 为内存行数累计（构造时读文件初始化）。
   const meta = {
     dir,
-    metaFile: join(dir, 'ledger.meta.json'),
+    metaFile,
     lost: persisted.lostTelemetry,
     governanceLost: persisted.lostGovernance,
+    migrationLost: persisted.lost_count,
+    rotationSeq: persisted.rotation_seq,
     health: persisted.health,
+    lineCount: countLines(file),
   };
   const persistMeta = (healthValue, opts) => persistAuditMeta(meta, healthValue, warn, opts);
+  const checkRotation = makeRotationCheck({ dir, file, metaFile, meta, persistMeta, warn, rotation });
 
   return {
     baseEntry: (input) => buildBase({ ...input, pluginVersion }),
-    // 追加不可变：mkdir recursive + appendFileSync。写失败只 warn + 丢失计数 ++，
-    // 绝不抛错、绝不阻断派发。写失败计 lostTelemetry 并落盘 meta；写成功恢复 ok。
-    record(entry) {
-      try {
-        // 序列化也在 try 内（循环引用/BigInt 等理论异常会绕过 fail-soft 外泄；
-        // 实际 entry 为自产标量，防御性收口）。
-        const line = JSON.stringify({ v: LEDGER_VERSION, ts: Date.now(), ...entry });
-        mkdirSync(dir, { recursive: true });
-        appendFileSync(file, `${line}\n`, 'utf8');
-        if (meta.health === 'degraded') persistMeta('ok');
-      } catch (error) {
-        meta.lost += 1;
-        warn(`dispatch ledger: 派发台账写入失败，已丢失 ${meta.lost} 条（${error instanceof Error ? error.message : String(error)}）`);
-        persistMeta(meta.health, { warnOnFailure: false });
-      }
-    },
+    record: makeRecord({ dir, file, meta, persistMeta, warn, checkRotation }),
     recordGovernanceAudit(entry) {
       appendGovernanceAudit(meta, dir, auditFile, persistMeta, warn, onAlert, entry);
     },
@@ -291,10 +387,19 @@ export function createEvolutionLedger({ dshHome, pluginVersion, warn = () => {},
     markGovernanceFailure() {
       markGovernanceFailureMeta(meta, persistMeta, onAlert);
     },
+    // 版本迁移类丢失计数：资产加载方在跳过不可迁移资产时调用（fail-soft 留痕，
+    // 不降级 health）。计数随 meta 落盘，重启保持。
+    markMigrationLoss() {
+      meta.migrationLost += 1;
+      persistMeta(meta.health, { warnOnFailure: false });
+    },
     // 进程内 health（'ok' | 'degraded'）。
     metaHealth: () => meta.health,
     // 设置页 summary 的 audit 字段来源：{lostTelemetry, lostGovernance, health}。
     auditState: () => ({ lostTelemetry: meta.lost, lostGovernance: meta.governanceLost, health: meta.health }),
     lostCount: () => meta.lost,
+    // 迁移类丢失计数与当前轮转序号（诊断/测试读取）。
+    migrationLostCount: () => meta.migrationLost,
+    rotationSeq: () => meta.rotationSeq,
   };
 }

package/lib/core/evolution-persistence.mjs

@@ -0,0 +1,213 @@
+// lib/core/evolution-persistence.mjs — 进化资产持久化机制：版本前向迁移与派发台账轮转。
+// 迁移：可重写资产顶层 v 版本号，load 时仅在内存链式前向迁移（v→v+1），迁移完成后
+// 原子写回（tmp+rename）；未知/超前版本或缺少迁移步骤一律 fail-soft 跳过并计丢失，
+// 绝不阻断其余功能、绝不改写台账号行。
+// 轮转：dispatch.jsonl 达阈值（记录数或字节数）时封存为 dispatch-<seq>-<ts>.jsonl，
+// 新建空台账续写；封存只 rename + 新建（内容字节不变、封存件不可变）；封存件超过
+// 保留份数时按最早封存淘汰，并一次性提示回放窗口缩短。
+// import-free（仅 node 内置），可被 bare-CI 单测直接导入。
+
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { dirname, join } from 'node:path';
+
+// --- 版本迁移 ---------------------------------------------------------------
+
+// 各可重写资产的当前版本号。新增资产类型在此登记。
+export const CURRENT_VERSIONS = Object.freeze({ summaries: 1 });
+
+// 前向迁移表：<kind, fromV> → 迁移函数（入参 v=n 的数据，须返回 v=n+1 的数据）。
+// 当前各资产无跨版本 schema 变化，表为空；机制（链式前向迁移 / 未知版本
+// fail-soft / 迁移后写回）由测试注入样例迁移覆盖。出现真实 schema 变化时在此
+// 登记步骤并同步提升 CURRENT_VERSIONS 对应项。
+export const MIGRATIONS = Object.freeze({});
+
+// 单次加载允许的最多迁移步数（防迁移表被误配成死循环）。
+const MAX_MIGRATION_STEPS = 100;
+
+// 迁移错误：版本非法/超前/缺步骤等，由调用方按 fail-soft 处理。
+export class MigrationError extends Error {}
+
+// 内存链式前向迁移：v 小于当前版本时逐级执行迁移表步骤，返回 {data, migrated,
+// fromV, toV}；v 等于当前版本原样返回；v 非法/超前或缺步骤抛 MigrationError。
+export function migrateUp(data, kind, { migrations = MIGRATIONS, currentVersions = CURRENT_VERSIONS } = {}) {
+  if (data === null || typeof data !== 'object' || Array.isArray(data)) {
+    throw new MigrationError('数据不是普通对象');
+  }
+  const current = currentVersions[kind];
+  if (typeof current !== 'number' || !Number.isInteger(current)) {
+    throw new MigrationError(`未知资产类型：${String(kind)}`);
+  }
+  const fromV = data.v;
+  if (!Number.isInteger(fromV) || fromV < 1) {
+    throw new MigrationError(`版本号非法：${String(fromV)}`);
+  }
+  if (fromV > current) throw new MigrationError(`版本 ${fromV} 超前于当前版本 ${current}`);
+  if (fromV === current) return { data, migrated: false, fromV, toV: fromV };
+  const steps = (migrations ?? {})[kind] ?? {};
+  let cursor = data;
+  let v = fromV;
+  while (v < current) {
+    const step = steps[v];
+    if (typeof step !== 'function') {
+      throw new MigrationError(`缺少 ${String(kind)} v${v} 到 v${v + 1} 的迁移步骤`);
+    }
+    cursor = step(cursor);
+    if (cursor === null || typeof cursor !== 'object' || Array.isArray(cursor)) {
+      throw new MigrationError(`迁移步骤 v${v} 产出非法数据`);
+    }
+    v += 1;
+    if (v - fromV > MAX_MIGRATION_STEPS) throw new MigrationError('迁移步数超过上限');
+  }
+  // 归一顶层版本号：迁移步骤可省略写 v，此处强制对齐当前版本。
+  cursor.v = current;
+  return { data: cursor, migrated: true, fromV, toV: current };
+}
+
+// 迁移写回（tmp+rename）：崩溃不产生截断文件；失败仅告警（内存迁移结果仍可用），
+// 不抛、不重复计丢失。
+function writeBack(file, data, warnLog) {
+  const tmp = `${file}.tmp`;
+  try {
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileSync(tmp, JSON.stringify(data, null, 2), 'utf8');
+    renameSync(tmp, file);
+  } catch (error) {
+    try { rmSync(tmp, { force: true }); } catch { /* best effort */ }
+    warnLog(`[dsh-subagent-profile] 资产迁移写回失败（${file}）：${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+
+// 读取并迁移单个资产文件。缺失返回 null（不告警不计丢失）；损坏/形状不符/版本
+// 无法迁移 → 告警 + onLoss + null（fail-soft 跳过）；迁移发生则原子写回后再返回。
+// logger 取带 warn 方法的对象（缺省静默）。
+export function loadWithMigration(
+  file,
+  kind,
+  { logger, migrations = MIGRATIONS, currentVersions = CURRENT_VERSIONS, onLoss } = {}
+) {
+  const warnLog = (message) => {
+    if (logger !== undefined && logger !== null && typeof logger.warn === 'function') logger.warn(message);
+  };
+  const lose = () => { if (typeof onLoss === 'function') onLoss(); };
+  if (!existsSync(file)) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(file, 'utf8'));
+  } catch (error) {
+    warnLog(`[dsh-subagent-profile] ${String(kind)} 资产损坏，跳过该资产（fail-soft）：${error instanceof Error ? error.message : String(error)}`);
+    lose();
+    return null;
+  }
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    warnLog(`[dsh-subagent-profile] ${String(kind)} 资产形状不符，跳过该资产（fail-soft）`);
+    lose();
+    return null;
+  }
+  let result;
+  try {
+    result = migrateUp(parsed, kind, { migrations, currentVersions });
+  } catch (error) {
+    const version = parsed.v !== undefined ? String(parsed.v) : '未知';
+    warnLog(`[dsh-subagent-profile] ${String(kind)} 资产版本 ${version} 无法迁移，跳过该资产（fail-soft）：${error instanceof Error ? error.message : String(error)}`);
+    lose();
+    return null;
+  }
+  if (result.migrated) writeBack(file, result.data, warnLog);
+  return result.data;
+}
+
+// --- 台账轮转 ----------------------------------------------------------------
+
+// 轮转阈值：记录数（>50k）或字节数（>5MB），任一命中即轮转。阈值为建议初值，
+// 待实测后校准。
+export const ROTATION_DEFAULT_MAX_RECORDS = 50000;
+export const ROTATION_DEFAULT_MAX_BYTES = 5 * 1024 * 1024;
+// 封存件保留上限（回放窗口）：超过按最早封存淘汰。
+export const ROTATION_DEFAULT_KEEP = 8;
+
+// 封存件文件名：dispatch-<seq>-<ts>.jsonl（同 seq 同毫秒碰撞时追加 -<n>）。
+const ARCHIVE_PATTERN = /^dispatch-(\d+)-(\d+)(?:-\d+)?\.jsonl$/;
+
+// 是否达轮转阈值：记录数超限或字节数超限（任一命中）。
+export function rotationNeeded(records, bytes, { maxRecords = ROTATION_DEFAULT_MAX_RECORDS, maxBytes = ROTATION_DEFAULT_MAX_BYTES } = {}) {
+  return records > maxRecords || bytes > maxBytes;
+}
+
+// 目录内封存件清单（按 seq、ts 升序 = 最早封存在前）。目录缺失/读失败返回空表。
+function listArchives(dir) {
+  let names;
+  try {
+    names = readdirSync(dir);
+  } catch {
+    return [];
+  }
+  return names
+    .map((name) => ARCHIVE_PATTERN.exec(name))
+    .filter((match) => match !== null)
+    .map((match) => ({ name: match[0], seq: Number(match[1]), ts: Number(match[2]) }))
+    .sort((a, b) => a.seq - b.seq || a.ts - b.ts);
+}
+
+// 淘汰最早封存件至保留上限；发生淘汰时一次性提示回放窗口缩短（每次轮转最多一次，
+// 因本函数每次轮转只执行一次）。单个文件删除失败不阻断其余淘汰。
+function pruneArchives(dir, keep, warn) {
+  const list = listArchives(dir);
+  if (list.length <= keep) return 0;
+  const excess = list.slice(0, list.length - keep);
+  let removed = 0;
+  for (const entry of excess) {
+    try {
+      rmSync(join(dir, entry.name), { force: true });
+      removed += 1;
+    } catch { /* 单个封存件删除失败不影响主流程 */ }
+  }
+  warn(`dispatch ledger: 回放窗口缩短——封存件已超过 ${keep} 份，淘汰最旧 ${removed} 份`);
+  return removed;
+}
+
+// 创建轮转执行器：check(records, bytes) 在阈值命中时执行一次轮转，返回
+// {rotated, archived, seq, pruned}；未命中返回 {rotated:false}。seq 账本与 meta
+// 落盘由调用方注入：getRotationSeq/setRotationSeq 管内存 seq，initMetaIfMissing
+// 保证首次轮转先建 meta（seq 现值落盘），persistMeta 以更新后的 seq 落盘。
+// 文件操作异常向上抛，由调用方按 fail-soft 处理（本条已落盘的追加不受影响）。
+export function createRotation({
+  dir,
+  dispatchFile,
+  getRotationSeq = () => 0,
+  setRotationSeq = () => {},
+  initMetaIfMissing = () => {},
+  persistMeta = () => true,
+  warn = () => {},
+  maxRecords = ROTATION_DEFAULT_MAX_RECORDS,
+  maxBytes = ROTATION_DEFAULT_MAX_BYTES,
+  keep = ROTATION_DEFAULT_KEEP,
+  now = Date.now,
+} = {}) {
+  return (records, bytes) => {
+    if (!rotationNeeded(records, bytes, { maxRecords, maxBytes })) return { rotated: false };
+    initMetaIfMissing();
+    const seq = getRotationSeq() + 1;
+    const stamp = now();
+    let archive = join(dir, `dispatch-${seq}-${stamp}.jsonl`);
+    let attempt = 0;
+    while (existsSync(archive)) {
+      attempt += 1;
+      archive = join(dir, `dispatch-${seq}-${stamp}-${attempt}.jsonl`);
+    }
+    // 只 rename + 新建：封存内容字节不变，绝不重写任何已写行。
+    renameSync(dispatchFile, archive);
+    setRotationSeq(seq);
+    persistMeta();
+    writeFileSync(dispatchFile, '', 'utf8');
+    const pruned = pruneArchives(dir, keep, warn);
+    return { rotated: true, archived: archive, seq, pruned };
+  };
+}