feat(share): memory share pack (lanes A-D) - #510

classifyRowForShare returned row.title raw on every skip path, while the
skip list is what tells a sharer why a row left the pack. The same prefix
now goes through the one redact the include branch already uses, so a
title carrying the local home directory cannot reach a pack body or a
terminal.

正文里用 JSON 或引号包一段 Windows 路径时，落库的字节是双反斜杠形态。它既不等于
base 也不等于那两个单分隔符形态，于是两边都不匹配，用户名原样进包——而漏的这一类
恰恰是代码片段与转义正文里最常见的那种写法。forms 补上第三个形态，仍走同一个
redact，不新建第二条脱敏路径。

同批修正 content_hash 的注释：它是 store 从未脱敏的 title/content 派生的归一化锚
（content-hash.js:49-53），脱敏一发生它与包里的正文就必然对不上，所以它不是
「正文没在路上被改」的凭证。车道 C 别拿它做完整性校验。

buildSharePack: filters -> per-row verdict -> external_id -> serialize ->
measure. The water mark is read off the final serialized UTF-8 bytes (the pack
is POSTed as-is, so a char-count check would hand the 413 to the receiver), and
an over-limit pack is refused rather than trimmed: which row to drop is the
sharer's call, made with filters. Skip counters stay full while skip_list is
capped at SHARE_SKIP_LIST_MAX.

Same commit closes the two deferred items from the A1/A2 reviews:
- createHomeRedactor now matches separator runs instead of three fixed
  spellings, so mixed escaping and doubly-encoded JSON paths fold too (a
  privacy function patched one spelling at a time always leaks the next one);
- deriveExternalId strips U+0000 from its inputs, closing the field-recut
  collision the NUL separator alone did not cover, for the minting side and
  lane C's recomputation alike.

A filter shape this function can't read narrows instead of widening: a bare
string --type used to be ignored, i.e. it would ship the whole library.

…like type

deriveExternalId took (pack_id, type, title), but the library dedupes on
(type, content_hash, agent_scope, workspace_scope, sensitivity) (store.js:1233),
so two rows with the same type and title but different bodies are two legitimate
memories that minted the SAME external_id. Lane C's pre-check would then skip the
second row as "already ingested" while report.included said 2 -- the pack's own
account lying about its contents. The key is now pack_id \0 type \0 title \0
content_hash, keeping the NUL stripping and the 16-hex output; every argument is
taken from verdict.row, so the receiver can recompute it from the bytes that
actually ship (a test asserts equality per memory, and a mutation check -- deriving
from the pre-redaction title -- fails only that test).

filters.tag now shares one shape rule with filters.type: a string or an array both
narrow (multi-value = any-of), blank entries and an empty array mean "not filled".
Array-only tag was the same over-share hole the bare-string type used to be, and
repeated --tag produces exactly that array. An unreadable entry (non-string) stays
in the set so it narrows to zero instead of widening to the whole library.

Two locks added for properties nothing pinned: the skip counters and skip_list stay
all-zero when a filter removes rows that classifyRowForShare would have skipped
anyway (proven by moving the filter after classification -- only that test fails),
and the tag-array form itself. Comments corrected: the separator-run cost note no
longer claims C:Users "used to match" (the three-form version never did), and the
NUL note states that "a\0b" now equals "ab" -- the same normalization class as trim.

parseShareBody accepted `dryRun: true` and registered it in `options` without
anyone reading it: share is pure-read, so spec 4 keeps it outside reclaim's
dry-run/confirm discipline, and the CLI's --dry-run is decided locally (it never
sends the key). A copied-in shape from reclaim-http.js that survived the first
commit becomes public API the moment it is documented -- giving it meaning later,
or removing it later, is a breaking change against callers already sending it,
and today such a caller gets a real pack, not a dry run.

The key now follows the same rule as every other extra key: dropped. One lock in
the existing "unknown option keys" test pins the drop so it cannot come back as
"backwards compatibility", and the module's JSDoc states why it is absent.

POST /api/dsh-mneme/share is the panel-facing half of the share pack. policy is
"token", not "token-write": a pack is a whole-library read (archived and
forgotten rows included, which share.js then filters), so it gates like /export
does -- the 2026-10 audit P0 was precisely this route family shipping a
library-wide read without an auth branch. GET answers 405: the route exists
because somebody presses the share key, not for the panel to poll.

Not one criterion lives here. The reply shape comes from shareReply, which is
why this handler can only differ from the future data-plane one in two ways:
the Content-Disposition header (sendJson takes a headers argument that
api-standalone.js does not have) and the warn callback. That second one matters
more than it looks -- shareReply swallows a throw and answers 500, mirroring
reclaimReply, and a 500 with no log line is the incident report that says only
"internal". It is wired to ctx.logger the way the reclaim route is.

`if (text === null) return` stays: readBody has already answered 413 itself when
the body passes 4 MiB, and parseShareBody(null) is a legal empty body, so
without the guard the handler packs the whole library and writes a second
response on a socket that already answered -- #410's failure class.

Tests run on a file-backed store, following reclaimSetup. The harness feeds the
body bytes on a process.nextTick rather than before invoking the handler:
EventEmitter does not queue, so data/end emitted while no listener is attached
vanish and readBody's promise never settles (the test hangs instead of failing).

The panel route landed before its line in the two lists, so
test/security-doc.test.js compared the mounted policies against a doc that
still had four gated reads and turned red. /share is a whole-library read
delivered over POST, so it belongs with the reads, not the writes.

The panel route already answered through src/share-http.js; without this
half the CLI had only the host-internal face to talk to. GET answers 405
rather than falling through to 404 the way /maintenance/reclaim does —
#411 allows the two surfaces to differ only in auth and path, so a
different status code would have been a third difference. The reply
builder is wrapped in a catch because the async chain here outruns the
file's synchronous try (the shape that made #410 an unhandled rejection),
and the cross-surface anti-fork lock lands now that both faces are wired.

#411 allows the two surfaces to differ only in auth and path, and the
data-plane half already asserts 405 alone. Accepting 404 here let the
panel silently fall back to the catch-all not-found, adding a third
difference nobody would have been warned about.

failHttp only echoed data.error, so an over-limit share pack (413 with
bytes, limitBytes and a server-authored hint) reached the terminal as
"HTTP 413: too-large" and lost both the numbers and the batching advice.
The command side must not grow a second error branch for it, and the
full report already reaches stdout-capable callers through --json's
rawJson passthrough.

POST /share on the Bearer data plane already builds the pack, refuses an
oversize one and accounts for every skipped row; the CLI was the missing
exit for actually producing a file to hand over. --out is the only output
flag and a run with neither --out nor --dry-run refuses to dump a whole
pack onto stdout, because that is exactly what buries the report.

--dry-run stays CLI-local: share is pure read and the server has no
dryRun option, so the flag only suppresses the write.

…plane

cmdShare/printShare/expandHome were only ever exercised by a throwaway
probe. This commits the harness: spawn bin/cli.mjs against an in-process
127.0.0.1 server whose replies come from the shipped parseShareBody +
shareReply, so the wire shape cannot drift into a fiction.

Locked: dry-run writes nothing (also when --out is present), --out writes
the reply verbatim, the no-flag refusal happens before any request, ~/ and
~\ expansion, the 413 hint plus both byte counts through failHttp (56f7b06
had no lock), and --json staying parseable on one success and one refusal
branch. Four mutation probes against bin/cli.mjs confirm each lock bites.

Four review findings were the same class of defect: the doc described a
neighbour of the shipped path, so a reader could not reconcile it with
what they actually get.

- skip accounting: blank_or_noise is the sixth reason and was missing; the
  table and the sample row now carry report.skipped's real keys next to the
  CLI's Chinese labels, and blank_or_noise is stated as 0 on this library
  rather than as something that never fires.
- the skip list is capped at SHARE_SKIP_LIST_MAX = 50 while that run skipped
  5,837 rows, so "the list shows the titles" was only true for the first 50
  in iteration order — the counters stay full-scale, the list does not.
- the pack's whitelisted row shape (no id/embedding/content_history/
  _full_content/evidence/doc_path/scopes/sensitivity) was undocumented; it is
  what the shape test locks and why the water mark measures serialized bytes
  instead of rows.
- the 98 ms figure came from a whole-library probe, not from the shipped path,
  which returns before scanning archived, wrong-type and blank rows. It is now
  labelled as an upper bound next to buildSharePack's real 123-143 ms.

Also folded in: --alias/--tag and the neither---out-nor---dry-run refusal in
the usage block, the panel-side POST /api/dsh-mneme/share named next to the
data-plane route, and 3 MiB (share-side water mark) separated from 4 MiB
(pre-existing inbound body cap on both surfaces).

B1 shipped two guards but only one had a behavioural lock: mutating the
explicit-target gate away turned nothing red, and B2's pool list covers the
read-side row pools in dream/sleep/organize, not service.js. Add a case that
names an imported row through _mergeInto and asserts the save creates its own
row, plus the literal lock on both guard needles so neither site can be
renamed or dropped silently.

Blocking saveWithDedupe covers the write side, but consolidation, sleep
demotion, pattern scanning, relation completion and organize's comparison
pool read row pools and can setArchived / demoteToSummary a row without ever
going through it. Prepend !isImportedRow(m) to all nine pool predicates,
leaving the existing conditions and withoutPaused in place. The predicate is
inert today because no source='imported' row exists yet, so behaviour for our
own rows is unchanged; dream.js's summary lookup stays unguarded because it
selects by source === "dream" and cannot reach a foreign row.

Lock the nine sites as a literal list plus a line scan proving dream.js has
no unguarded service.all() pool left: a behaviour case can never cover the
tenth pool someone adds later, and most of these pools sit behind an LLM
route. Also give the same-title case its content_history assertion and
rewrite the choke-point rationale, which still claimed the second gate had
no case of its own.

B2 locked the nine pool predicates as a literal list and showed, with a
throwaway probe it then deleted, that organize would report a same-title
imported row as an archive target without them. That left the guard's only
committed evidence a string match: nothing in the tree proved the predicate
changes a result. Add the behavioural case - drive the real dryRun/apply path
on a file-backed temp store and assert the imported id never reaches the
report. It has to be a behavioural case here because the report is apply's
only archive licence and the archive step calls store.setArchived directly,
so neither saveWithDedupe gate covers it.

The imported row is seeded with higher importance than the local same-title
row on purpose: store.list orders by importance DESC, so with the predicate
removed the foreign row wins rows.find deterministically instead of by an id
tiebreak. Verified by mutation - removing src/organize.js's predicate turns
this case red at the "never reach the report" assertion, restoring it makes
the file green again.

…open hole

The lane-B guard had no doc: code and tests carried it, SHARE.md stopped at
export. The section now states what the predicate covers (the two saveWithDedupe
gates plus the nine row pools), why foreign rows are outside our disposal in the
first place (our last_accessed_at carries no recall for a row the other side
recalled, so time tiering and heat misread it systematically), and the
consolidation-schedule consequence: dream.js:64 is both a pool and the trigger
baseline, so once lane C lands imported rows will not inflate when dreaming
fires. That is the ruling, not an oversight - dreaming cadence has to be a
function of our own memory, and a friend's row count must not be able to spend
our own per-run LLM budget.

The boundary still open is named rather than glossed: registerDocument's
evidence absorb (document.js:286) bulk-archives caller-cited rows and a
searchable imported atomic row can be cited, so lane C must either filter
there or accept the hole. The doc therefore says "the consolidation side never
rewrites foreign rows", not "foreign rows are never rewritten". Two nearby
sites are called out as deliberately out of scope, so nobody draws the line in
the wrong place: document.js:269 only ever selects type=document, and document
rows never travel in a pack; the panel PATCH route is a human action.
Closes with the part a reader is most likely to get wrong - the guard is inert
until lane C, there is no receive, so nothing can be eaten yet.

SLEEP.md describes all four sleep phases and their pools, and its "输入：全量"
line was no longer what the code does; one sentence scopes it to our own active
rows. DISTILL.md untouched - it documents distill_records and provenance, not
this layer, so it makes no claim the guard changed. AGENTS.md's module map was
missing src/memory-source.js, the one file whose whole job is this contract.

skip_list is the mechanism that tells her what stayed home, and it shipped the
secret anyway. The reviewer's repro: a row whose body reads `password: <value>`
and whose title repeats that value, skipped because it is archived - the list
came back containing 生产库密码 <value> 别丢. scanSensitive only ran at the end
of classifyRowForShare, so the five earlier skip branches had all returned a
title that was home-masked and never sensitive-scanned; the sensitive branch
itself leaked the same way. That title is in the pack, and a whole-library send
refused for size still exports the report on the 413 path.

The predicate has to be the whole row, not the title: the ruleset matches
"keyword + assignment + value shape", so a bare credential literal in a title
does not hit on its own - which is exactly why the reviewer's title survived.
Scanning title+content+tags once, before the reason ladder, and withholding the
title when the row is credential-bearing closes both directions. Reason
attribution is unchanged (blank/noise still precedes sensitive), only the string
disappears. Empty rather than a digest on purpose: skip_list travels inside the
pack, so a hash of the title is an offline-crackable oracle handed to the
recipient, and low-entropy passwords are what these rows contain.

Cost: archived rows are now scanned too, so the whole-library scan number lives
inside the shipping path (~+50 ms against the measured full-pack build, docs).
That path already pays a ~1.1 s full-table read, so the magnitude is unchanged.

Three assertions legitimately change, all named in the test comments: the
sensitive branch's title goes from "~/退路方案" to "" (share-pack), the 413
reply grows two assertions (share-http), and the CLI gains a covering case that
the terminal prints （标题不外发） instead of a trailing space. The repro is
committed as a pack-level test asserting the credential appears nowhere in the
serialized pack - mutation (skipTitle = title) reddens exactly that one case.

The id is (pack_id, type, title, content_hash) and carries no scope, while the
library's dedupe key does (store.js:1233 matches on agent_scope,
workspace_scope, sensitivity). Two rows that differ only by scope are two
legitimate memories here and one key in the pack: measured as included: 2 with
two byte-identical external_ids. Lane C cannot absorb that - share_external_id
is a UNIQUE index, the second INSERT throws out through runAtomically's
ROLLBACK and the whole pack fails, and the ledger's "先查再跳过，重跑就
created=0" does not rescue it, because the two rows inside one pack cannot see
each other at query time and a rerun collides on the same dead key.

Ruling applied: fold at build time. Ship the first row, count the rest in
report.deduped, so `included` is now the number actually shipped and
included + deduped is the number that qualified. The justification for dropping
the twin rather than the pack: title and content anchor are identical, and the
recipient's store has no scope dimension for them to differ on - two copies
would be two identical rows there. The CLI prints the fold, otherwise the
counters look like rows that went missing.

The duplicate-distinct-bodies case keeps passing (different content -> different
anchor -> two ids) and now also asserts deduped === 0, so the fold cannot widen
into "collapse by title". Pack-level locks added: report key set is exactly
(included, deduped, skipped, skip_list), and external_id is unique across
memories, which is the precondition lane C's index relies on. Mutation
(deleting the fold) reddens exactly that one case.

…e pack

informationlessReason is a combined title+content test, so "有标题、正文只有空白"
used to ship - test/share-pack.locked that as the判据本意 for two rounds. The
judgment criterion is right about writes and wrong about this exit: the
receiver's content column is NOT NULL and lane C validates every row per spec
§5, so one blank-content row is not "one row less", it is "nothing imported and
a pack that says why nothing happened".

Ruling applied: classifyRowForShare treats content that is empty after trimming
as blank_or_noise, in the same slot, without inventing a seventh reason key -
six are locked by the docs table, the CLI's档位 names and the counter test, and
"it has no body" is already what that reason means. The order lock still holds
(blank/noise before sensitive), so the reason attribution did not move.

The assertion at share-pack:192 flips from include === true to
reason === "blank_or_noise", stated in the test comment with the receiver-side
reason rather than as a preference. Two new locks: undefined/null content also
counts as blank, and a pack-level case that no memory in memories has blank
content (that is the invariant lane C gets to rely on). Mutation (dropping the
trim guard) reddens both new cases and nothing else.

Measured numbers in docs/SHARE.md predate this and the dedup fold; the section
now says so instead of letting the table read as current.

…ifted

One decision the next reader would otherwise file as a leak: shareReply reads
raw service.all() while every consolidation pool wraps withoutPaused
(dream.js:77). Ruling - pausing is an injection/consolidation axis, not an
export axis. A muted scope means "do not serve this to my own context", not
"this row is not mine" and certainly not "this row must not leave the machine";
share is a human pressing a button and the only narrowing it has is --type /
--tag plus the water mark. No filter added; SHARE.md now says so, including the
half that matters for expectations - nobody should believe pressing a scope
also stopped it from being exported. The note also records why this is not a
one-line filter patch: a paused-axis would collide with the "filters are not
skips" ledger the pack report already keeps.

Six stale claims, each verified against the code before rewriting:
- the nine-pool list had 493 and 1021 swapped (493 is generateNarratives'
  inputs, 1021 is runDream's consolidation snapshot); dream.js:64 is the
  trigger baseline, not the snapshot's row source - it shares the snapshot's
  filter, which is what the cadence paragraph actually claims;
- the panel PATCH citation said api.js:812-813, service.update is at :811
  (setArchived at :812);
- registerDocument's evidence absorb also exempts forgotten rows
  (document.js:284), which the "open boundary" paragraph left out while
  listing the other three conditions;
- share.js's header cited api.js:55 / api-standalone.js:29 for the 4 MiB
  inbound cap; both drifted to :57 / :31;
- the apiToken sensitive-read inventories (SECURITY.md English table row 27
  and its Chinese twin at :408, plus the package README's API-security line)
  still stopped at /maintenance/* - /share is a whole-library read and
  security-doc.test.js only locks the two gated-route bullets, so nothing in
  the suite could see this one. Bilingual symmetry kept where the file is
  bilingual.

…ir sweep

Two things this file did that only look safe because every call site happens to
pass --url/--token today.

Blanking DSH_MNEME_URL made resolution fall through
firstNonEmpty(flag, env, file) ?? DEFAULT_URL to 127.0.0.1:8790 - her live
instance's default port. A future call site that forgets the flags would read
the real store and, since /share is read-only there, fail as 401/404 flakiness
instead of as a wrong-host bug. The env now carries the fixture's own URL and
token, so a missing flag lands on the server this test started; the new case
drives exactly that path (no --url/--token) and asserts the request arrives
here. Reverting the env to the old blanking reddens that one case and nothing
else.

The fallback rmSync targeted os.homedir(): it only ever fires when the HOME
override failed - the case where the test should stop and show her the artifact
- and what it removed was a same-named file in her real home, not an inode this
test created. Deleted; the two existsSync(join(ctx.home, ...)) assertions above
are what prove the override worked.

…'s copied literals

The committed evidence that the nine pool predicates are not inert rested on
store.list's default ordering: the foreign row carried importance 5 against our
own row's 3, so with the predicate removed it surfaced first and rows.find took
it. That proves the guard bites only while the sort is what it is today. Added a
second candidate whose only same-title row in the comparison pool is an imported
one - there is nobody to compete with, so "predicate removed -> this row is
named" no longer depends on ordering. The importance trick stays as the
"our own row must still match" half, and the test comment now says which lock
proves what. Mutation (dropping !isImportedRow in organize.js:164) reddens the
behavioural case plus the literal list, nothing else.

bin/cli.mjs deliberately does not import server modules, so the six skip-reason
keys and the SHARE_SKIP_LIST_MAX cap are copied literals there: rename a key in
share.js and the CLI silently reads that bucket as 0, change the cap and the
"list truncated" line fires at the wrong count. Added the seam that was missing
- a static lock that the two literal sets are the same six strings in the same
order and the two numbers are equal, with both regexes asserted to have matched
so the case cannot degrade to vacuous truth.

"两边只许差在鉴权与路径" was the sentence right above the one that documents the
panel side's extra Content-Disposition, so SHARE.md contradicted itself in two
lines and under-stated the invariant #411 actually enforces. The allowed set is
three: auth, path, and that header (the two sendJson signatures differ - only
the host surface has a headers argument, which is why the filename is assembled
there and the shared layer returns {status, body}). Everything else has to stay
identical, GET 405 included, and the note now says plainly that 405 is
deliberately unlike the neighbouring /maintenance/reclaim shape.

三处真冲突，两边意图都保住：

- SECURITY.md（中英各一处）：这一支加了 `/receive`、`/receive/undo`（写本机库，归 token-write，
  GET/HEAD 只剩 405）与第五条受门控读 `/share`；main 加了 `/profile/extract`（只收 POST 的画像草稿）。
  两个列表合并成一条，读的数量措辞按合并后的五条走。security-doc 的双向比对绿，说明这张表仍是代码的投影。
- src/dream.js：这一支加的是 isImportedRow 的 import 与「池子各挡一遍」的注释，main 加的是
  streamText / runAuditedLlm 两个再导出。注释与 import 保留，导出表取两者并集。
- lib/dream.js 是 sync 产物，不手解，由 npm run sync 从 src 重生成。

自动合并但逐处看过的：src/organize.js 与 src/service.js（这一支的 imported 守卫 × main 的
caller visibility 过滤同时成立，九池静态锁与 organize 新测试一起绿）；lib/client.js 能过
node --check；main 新增的 profile-extract / user-settings 四份文件与三份测试都在树里。

…ength

那句「… 跳过清单已截断，计数仍为全量」先前由 `skip_list.length >= 50` 判定。清单长度
是被服务端截过的读数（src/share.js 在 SHARE_SKIP_LIST_MAX 处封口），拿它当截断证据的
话，恰好 50 条被跳时清单是**全量**的，这句话就在撒谎——而那一格是常见尺寸，不是边角。
真证据一直在同一份 report 里：skipped 的六个计数走全量。判据因此改成「账比清单长」，
与面板 ShareReport 那一条完全同款（lib/client.js 也是 totalSkipped > list.length，
同样从不写 50）；水位将来改了判据仍然对，CLI 侧不再有一份要跟着漂的抄本。

测试两件事，方向相反：
  - 行为锁（真跑 CLI 打假数据面）：造恰好到水位的被跳行 → 计数报全量而**不许**出现那句
    提示（旧判据在这一格红，RED 实测：终端确实打了「已截断」）；再加 5 条 → 账比清单长，
    提示必须在（防「把提示删掉」冒充修复）。水位从 src/share.js 的常量读，不在测试里
    再抄一个 50。
  - 静态锁那半条换掉而不是删掉：原先比对的「CLI 的格数 == SHARE_SKIP_LIST_MAX」如今没有
    可比的对象（CLI 里那个数消失了）。改锁 ① 六个计数键在求和那一行也与 report.skipped
      同序同源（这条接缝照旧存在），② `).length >= 数字` 那个形状不许再出现，③ 那句提示
      由 skippedTotal 与清单长度之比判定。判据真不真由上面那条行为用例证明，这里只锁形状。