@modusensus/dsh-mneme 0.13.0 → 0.14.0-beta.1

package/test/release-notes.test.js

@@ -67,6 +67,19 @@ test("findSection：版本号里的点被转义过，不会当成通配", () =>
   assert.equal(findSection(text, "0.8.16"), null, "点若被当通配就会误命中 0x8x16");
 });
 
+test("findSection：预发布版本号（带 -beta.N）能取到自己的小节", () => {
+  // 预发布版本号带 `-` 与额外的点。此前入口正则只认 x.y.z，release job 抽正文这步直接
+  // exit 1，预发布版根本发不出去；findSection 也只转义了点，元字符会被当语义用。
+  const text = SAMPLE.replace(
+    "## [0.8.16] - 2026-10-12",
+    "## [0.14.0-beta.1] - 2026-11-11\n\n- 预发布条目\n\n## [0.8.16] - 2026-10-12"
+  );
+  const sec = findSection(text, "0.14.0-beta.1");
+  assert.ok(sec.includes("预发布条目"), "预发布小节要能取到");
+  assert.equal(sec.includes("旧条目"), false, "不能越过下一版标题");
+  assert.equal(findSection(text, "0.14.0"), null, "0.14.0 不该误命中 0.14.0-beta.1（反之亦然）");
+});
+
 test("parseBullet：拆出标题与正文；非该形状返回 null 由调用方原样保留", () => {
   assert.deepEqual(parseBullet("- **标题**：正文在这里"), { title: "标题", body: "正文在这里" });
   assert.deepEqual(parseBullet("- **只有标题**"), { title: "只有标题", body: "" });
@@ -238,3 +251,15 @@ test("入口：版本号格式不对时直接拒绝", () => {
   assert.notEqual(res.status, 0, "只接受 x.y.z");
   assert.match(res.stderr, /usage: release-notes\.mjs/, "要说清用法，别静默退出");
 });
+
+test("入口：预发布版本号不被当成格式错误（否则 beta 版发不出去）", () => {
+  // 反向验证上面那条守卫没有收紧过头：0.14.0-beta.1 是合法发布版本，此前会被
+  // 「格式不对」拦下。这里走到 findSection，报的必须是「找不到小节」而不是"usage"。
+  const root = mkdtempSync(join(tmpdir(), "mneme-release-notes-"));
+  mkdirSync(join(root, "dsh-mneme"), { recursive: true });
+  writeFileSync(join(root, "dsh-mneme", "CHANGELOG.md"), SAMPLE, "utf8");
+  const res = spawnSync(process.execPath, [scriptPath, "0.14.0-beta.1"], { cwd: root, encoding: "utf8" });
+  assert.notEqual(res.status, 0, "样例 CHANGELOG 里没有这一版，应当非零退出");
+  assert.doesNotMatch(res.stderr, /usage: release-notes\.mjs/, "不许当成格式错误：" + res.stderr);
+  assert.match(res.stderr, /changelog section not found: 0\.14\.0-beta\.1/, "要报找不到小节");
+});

package/test/security-doc.test.js

@@ -34,12 +34,22 @@ function section(heading) {
 }
 
 test("SECURITY.md 的支持版本表跟着 package.json 走（中英各一份）", () => {
+  // 预发布版（0.14.0-beta.1）不占支持表的格：beta 不是受支持的稳定版本，把首行挪成
+  // 0.14.x 等于对外宣称 0.14 已在活跃维护。这里改成「首行必须不是 beta 的 minor」——
+  // 仍是断言，不是跳过：真有人给 beta 挪了格，这条会红。
+  const isPrerelease = version.includes("-");
   for (const heading of ["## Supported Versions", "## 支持版本"]) {
     const body = section(heading);
     // 表第一行就是「当前支持」的那一行；锁它，别锁整表（历史版本行本来就该在）。
     const rows = body.split(/\r?\n/).filter((l) => /^\|\s*[\d<]/.test(l));
     assert.ok(rows.length >= 2, `${heading} 的版本表应至少两行，实际 ${rows.length} 行`);
     const current = rows[0].split("|")[1].trim();
+    if (isPrerelease) {
+      assert.notEqual(current, expectedVersionRow,
+        `${heading} 的首行不该是 ${expectedVersionRow}（package.json 为预发布版 ${version}）——`
+        + "预发布版占格等于宣称它已在活跃维护");
+      continue;
+    }
     assert.equal(current, expectedVersionRow,
       `${heading} 的首行应写 ${expectedVersionRow}（package.json 为 ${version}），实际写了 ${current}`);
   }

package/test/sleep.test.js

@@ -1416,3 +1416,40 @@ test("sleep: trait candidates pushed out by the cap are recorded as dropped", as
   assert.ok(capped.every((d) => typeof d.target === "string" && d.target), "每条都要能看出是哪条结论被截");
   store.close();
 });
+
+test("sleep: an affective stream failure keeps its cause on the phase", async () => {
+  // #619 可见化 A。这条与 conflict 相位那条同源：只写 "llm failed" 的话，
+  // 事后看 dream_runs 完全分不清是上下文超限、模型拒收、还是上游 502。
+  // 实测出处 2026-11-10T16:09 那一轮：outcome.affective 只有
+  // {"status":"failed","error":"llm failed"}，真正的 502 原文只能去
+  // llm_audit_logs 里捞，而那张表不是给人看面板用的。
+  // 所以这里钉两件事：失败原因必须写进返回值的 failure；同时必须打 warn。
+  const { service, store } = setup();
+  service.createEntity({ name: "桉桉", type: "person" });
+  service.createEntity({ name: "答辩", type: "concept" });
+  const mem = makeMemory(service, "答辩前一天", "明天答辩，他很焦虑");
+  linkSession(service, mem.id, "session-A");
+
+  const warnings = [];
+  const ctx = affectiveCtx([]);
+  ctx.logger = { warn: (line) => warnings.push(String(line)), info: () => {} };
+  // 只让 affective 这一路失败，别的相位照常回 "[]"——否则测的是整轮，不是这一路。
+  ctx.llm.stream = async function* (options) {
+    if (options.purpose === "sleep-affective") {
+      yield { type: "finish", reason: { kind: "error", failure: { code: "SERVER", message: "502: upstream fetch failed" } } };
+      return;
+    }
+    yield { type: "text-delta", index: 0, text: "[]" };
+    yield { type: "finish", reason: { kind: "stop" } };
+  };
+
+  const result = await runSleep(ctx, service, affectiveConfig(), ctx.logger, { embedder, vectorIndex: null }, null);
+  const phase = result.phases.affective;
+  assert.equal(phase.status, "failed");
+  assert.equal(phase.error, "llm failed", "粗粒度分类保持不变，面板与审计都依赖它");
+  assert.ok(String(phase.failure ?? "").includes("502"),
+    `失败原因要带上游原文，实际拿到 ${JSON.stringify(phase.failure)}`);
+  assert.ok(warnings.some((w) => w.includes("affective stream aborted or errored")),
+    "同一份原因也要进日志，光靠返回值救不了已经过去的运行");
+  store.close();
+});

package/test/wiki-api.test.js

@@ -5,7 +5,7 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import { EventEmitter } from "node:events";
-import { mkdtempSync, rmSync, writeFileSync, mkdirSync, existsSync, unlinkSync } from "node:fs";
+import { mkdtempSync, rmSync, writeFileSync, readFileSync, mkdirSync, existsSync, unlinkSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { execFileSync } from "node:child_process";
@@ -493,10 +493,12 @@ function countingChoro(store, { throwOnRun = false } = {}) {
     calls,
     choro: {
       ...base,
-      runT0Apply: ({ repoRoot }) => {
+      // guardT1Loss 必须原样透给真 T0：这条守卫的意义就在于「自动刷新那条路会拒绝」，
+      // 外壳把它吞掉就等于测了一个不存在的实现。
+      runT0Apply: ({ repoRoot, guardT1Loss = false }) => {
         calls.push(repoRoot);
         if (throwOnRun) throw new Error("磁盘只读（模拟）");
-        return runChoroT0({ repoRoot, store, apply: true });
+        return runChoroT0({ repoRoot, store, apply: true, guardT1Loss });
       }
     }
   };
@@ -597,6 +599,71 @@ test("/choro/repos 自动重跑失败：读照常 200、数据在、错误进 au
   }
 });
 
+// 自动刷新碰上已富化的仓库：不许动手。这条是「静默降级」的正对面——读页本来
+// 只是个浏览动作，却会替用户把语义段和 claims 一起清掉，而屏幕上没有任何提示。
+// 现在它变成一次主动拒绝，且拒绝与失败分开报（autoRefreshSkipped vs autoRefreshError）。
+test("/choro/repos 自动重跑：仓库里有富化页时主动跳过，不动字节、不说成失败", async () => {
+  const store = createStore(":memory:");
+  const root = driftRepo(store);
+  try {
+    const repo = store.choroRepoByRoot(root);
+    const page = store.choroPageBySlug(repo.id, "src");
+    store.markChoroPageEnriched(page.id, "2026-11-01T00:00:00.000Z", null);
+    const pagePath = join(root, page.rel_path);
+    writeFileSync(pagePath, `${readFileSync(pagePath, "utf8")}\n<!-- CHORO:T1:START -->\n## 架构\n\na.js 是入口。\n<!-- CHORO:T1:END -->\n`, "utf8");
+    const before = readFileSync(pagePath, "utf8");
+
+    const { calls, choro } = countingChoro(store);
+    const { routes } = setup({ config: { chorographyEnabled: true, chorographyAutoRefresh: true }, choro });
+    const REPOS_PATH = "/api/dsh-mneme/choro/repos";
+    const res = await invoke(handler(routes, REPOS_PATH), `${REPOS_PATH}?repo=1`);
+
+    assert.equal(res.status, 200);
+    assert.equal(calls.length, 0, "有富化页时连 T0 都不该被叫起来");
+    assert.equal(res.body.autoRefreshed, false);
+    assert.equal(res.body.autoRefreshSkipped, "t1-loss", "跳过要和失败分开报");
+    assert.equal(res.body.autoRefreshError, undefined, "主动拒绝不是错误");
+    assert.match(res.body.autoRefreshSkipNote, /1 页/, "说清为什么没做");
+    assert.equal(readFileSync(pagePath, "utf8"), before, "页一字节未动");
+    assert.equal(res.body.repos[0].staleReason, "git", "没刷就照实说过期");
+    assert.equal(res.body.repos[0].enrichedPages, 1, "面板要靠这个数解释原因");
+  } finally {
+    store.close();
+    rmTempBestEffort(root);
+  }
+});
+
+// 库里的账和磁盘对不上时（status 还是 skeleton、页里却有 T1 段），T0 的读盘判断
+// 会抛 would-drop-t1。到这一层仍按「主动跳过」回，绝不报成刷新失败。
+test("/choro/page 自动重跑：T0 拒绝（would-drop-t1）时回 skipped 而非 error", async () => {
+  const store = createStore(":memory:");
+  const root = driftRepo(store);
+  try {
+    const repo = store.choroRepoByRoot(root);
+    const page = store.choroPageBySlug(repo.id, "src");
+    const pagePath = join(root, page.rel_path);
+    // 故意不改库里的 status：模拟「有人手改了 MD」这类账实不符。
+    writeFileSync(pagePath, `${readFileSync(pagePath, "utf8")}\n<!-- CHORO:T1:START -->\n## 架构\n\na.js 是入口。\n<!-- CHORO:T1:END -->\n`, "utf8");
+    const before = readFileSync(pagePath, "utf8");
+
+    const { choro } = countingChoro(store);
+    const { routes } = setup({ config: { chorographyEnabled: true, chorographyAutoRefresh: true }, choro });
+    const PAGE_PATH = "/api/dsh-mneme/choro/page";
+    const res = await invoke(handler(routes, PAGE_PATH), `${PAGE_PATH}?repo=1&slug=src`);
+
+    assert.equal(res.status, 200);
+    assert.equal(res.body.autoRefreshed, false);
+    assert.equal(res.body.autoRefreshSkipped, "t1-loss");
+    assert.equal(res.body.autoRefreshError, undefined);
+    assert.match(res.body.autoRefreshSkipNote, /富化/, "T0 那句人话原样透出去");
+    assert.equal(readFileSync(pagePath, "utf8"), before, "拒绝发生在写盘之前");
+    assert.ok(res.body.page.content.includes("CHORO:T1:START"), "页正文照常回，别把读也带坏");
+  } finally {
+    store.close();
+    rmTempBestEffort(root);
+  }
+});
+
 // /choro/page 是面板主路径，也是「读地志页时发现代码变了」那句文案的真正时刻。
 // 顶栏「代码已变」徽章读 state.repo.stale —— 回执里没有 repo 这份数据，徽章永远不亮。
 test("/choro/page 回执带 repo.stale/staleReason，并在这条读路径上自动重跑", async () => {
@@ -625,4 +692,44 @@ test("/choro/page 回执带 repo.stale/staleReason，并在这条读路径上自
   } finally {
     rmTempBestEffort(root);
   }
+});
+// --- /choro/claims（claim 粒度失效，Grounded Claims）-----------------------
+// 锁的是一条态度：算不出来 ≠ 没事。基线认不出时必须 anchorStale，不许回一张空清单
+// 让面板显示「全部结论都还准」——那是 #607 同类的假成功。
+
+test("/choro/claims 在册且 policy open，四层闸与其余读路由一致", async () => {
+  const off = setup({});
+  const route = handler(off.routes, "/api/dsh-mneme/choro/claims");
+  assert.ok(route, "/choro/claims 在册");
+  assert.equal(route.policy, "open");
+  const a = await invoke(route, "/api/dsh-mneme/choro/claims");
+  assert.equal(a.status, 503, "queries 缺装配 → 503");
+
+  const disabled = setup({ config: { chorographyEnabled: false }, choro: createChoroQueries({ store: createStore(":memory:") }) });
+  const b = await invoke(handler(disabled.routes, "/api/dsh-mneme/choro/claims"), "/api/dsh-mneme/choro/claims");
+  assert.equal(b.status, 409, "开关关 → 409");
+  assert.equal(b.body.error, "disabled");
+});
+
+test("/choro/claims：快乐路径带页清单与 totals；未知 repo 404", async () => {
+  const store = createStore(":memory:");
+  const root = makeRepo(store);
+  try {
+    const { routes } = setup({ config: { chorographyEnabled: true }, choro: createChoroQueries({ store }) });
+    const route = handler(routes, "/api/dsh-mneme/choro/claims");
+    const repoId = store.db.prepare("SELECT id FROM choro_repos LIMIT 1").get().id;
+    const r = await invoke(route, `/api/dsh-mneme/choro/claims?repo=${repoId}`);
+    assert.equal(r.status, 200);
+    assert.ok(r.body.repo && r.body.repo.id === repoId);
+    assert.equal(typeof r.body.head, "string");
+    assert.ok(Array.isArray(r.body.pages), "页清单要在——面板靠它说「这页没问题」");
+    assert.ok(r.body.totals && Number.isInteger(r.body.totals.claims));
+    assert.equal(r.body.clean, true, "刚跑完 T0，基线就是 HEAD");
+
+    const missing = await invoke(route, "/api/dsh-mneme/choro/claims?repo=999999");
+    assert.equal(missing.status, 404);
+  } finally {
+    store.close();
+    rmTempBestEffort(root);
+  }
 });

package/test/wiki-claims.test.js

@@ -0,0 +1,194 @@
+// claims 粒度的失效判定（借 openwiki 的 Grounded Claims，issue #607 后续）。
+//
+// 锁的是「结论失准 vs 锚点错位」这条分界线：把 shifted 混进 touched，面板就会对一堆
+// 只是行号偏了几行的结论喊「要重写」，喊几次就没人信了——这是本模块存在的全部理由。
+// 还锁三种「算不出来」不许冒充「没事」：基线认不出、git 目录不可读、空 diff。
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { execFileSync } from "node:child_process";
+import { parseDiffRanges, assessClaims, summarizeClaims, diffSince } from "../src/wiki/claims.js";
+
+const DIFF = [
+  "diff --git a/src/a.js b/src/a.js",
+  "--- a/src/a.js",
+  "+++ b/src/a.js",
+  "@@ -7,3 +7,4 @@ export function x() {",
+  "-old",
+  "+new",
+  "+extra",
+  "diff --git a/src/gone.js b/src/gone.js",
+  "--- a/src/gone.js",
+  "+++ /dev/null",
+  "@@ -1,2 +0,0 @@",
+  "-a",
+  "-b",
+].join("\n");
+
+test("parseDiffRanges：hunk 头取新旧两侧坐标，/dev/null 进 deleted", () => {
+  const d = parseDiffRanges(DIFF);
+  assert.deepEqual([...d.files.keys()], ["src/a.js"]);
+  assert.deepEqual(d.files.get("src/a.js"), [{ oldStart: 7, oldCount: 3, newStart: 7, newCount: 4 }]);
+  assert.deepEqual(d.deleted, ["src/gone.js"]);
+  // `@@ -c +c @@` 不带计数时按 1 算（`+c` 与 `+c,1` 同义；只有显式 `,0` 才是纯增删）。
+  const one = parseDiffRanges("diff --git a/x b/x\n--- a/x\n+++ b/x\n@@ -3 +3,2 @@\n-a\n+b\n+c\n");
+  assert.deepEqual(one.files.get("x"), [{ oldStart: 3, oldCount: 1, newStart: 3, newCount: 2 }]);
+});
+
+test("assessClaims：touched / shifted / deleted / unverifiable 四档分开，未变的不报", () => {
+  const d = parseDiffRanges(DIFF);
+  const claims = [
+    { id: 1, statement: "A", sourcePath: "src/a.js", startLine: 8, endLine: 9, pageSlug: "p1" },
+    { id: 2, statement: "B", sourcePath: "src/a.js", startLine: 2, endLine: 3, pageSlug: "p1" },
+    { id: 3, statement: "C", sourcePath: "src/gone.js", startLine: 1, endLine: 1, pageSlug: "p2" },
+    { id: 4, statement: "D", sourcePath: "src/a.js", pageSlug: "p1" },
+    { id: 5, statement: "E", sourcePath: "src/untouched.js", startLine: 1, endLine: 1, pageSlug: "p3" },
+  ];
+  const out = assessClaims(claims, d);
+  assert.deepEqual(out.map((c) => [c.id, c.reason]), [
+    [1, "touched"],
+    [2, null],
+    [3, "deleted"],
+    [4, "unverifiable"],
+    [5, null],
+  ]);
+  assert.equal(out[0].shift, 0, "相交时 shift 记的是「相交之前累计了多少行");
+});
+
+test("assessClaims：区间没被碰但上方有增删 → shifted 带 shift，不升级成 touched", () => {
+  // 第 2 行插了一行 → 第 10 行的结论内容还在，只是行号往后挪 1。
+  const diff = parseDiffRanges("diff --git a/y b/y\n--- a/y\n+++ b/y\n@@ -2,0 +3,1 @@\n+inserted\n");
+  const [c] = assessClaims([{ id: 9, statement: "S", sourcePath: "y", startLine: 10, endLine: 11, pageSlug: "p" }], diff);
+  assert.equal(c.reason, "shifted");
+  assert.equal(c.shift, 1);
+});
+
+test("assessClaims：纯插入落在结论行区间内部也算 touched，插在首行之前只是 shifted", () => {
+  // @@ -5,0 +6,1 @@ 表示「旧第 5 行之后插入一行」。结论占旧第 4-6 行时，新行插在
+  // 第 5 与第 6 行之间——结论的原文区间被切开了，不能报「没事」。
+  const inside = parseDiffRanges("diff --git a/z b/z\n--- a/z\n+++ b/z\n@@ -5,0 +6,1 @@\n+inserted\n");
+  const [hit] = assessClaims([{ id: 1, statement: "S", sourcePath: "z", startLine: 4, endLine: 6, pageSlug: "p" }], inside);
+  assert.equal(hit.reason, "touched", "插在结论区间内部：原文被切断");
+  // 插在结论首行之前（旧第 2 行之后）只是把整个区间推下去，内容没变。
+  const above = parseDiffRanges("diff --git a/z b/z\n--- a/z\n+++ b/z\n@@ -2,0 +3,1 @@\n+inserted\n");
+  const [pushed] = assessClaims([{ id: 2, statement: "S", sourcePath: "z", startLine: 4, endLine: 6, pageSlug: "p" }], above);
+  assert.equal(pushed.reason, "shifted");
+  assert.equal(pushed.shift, 1);
+  // 单行结论（start === end）边界：插在它上面一行 → shifted（内容没动，行号后移）；
+  // 插在它下面 → null（既不碰到也不移动）。把「后面插」算成 shifted 会让一堆没变的
+  // 结论被喊去复核。
+  const [singleAbove] = assessClaims([{ id: 3, statement: "S", sourcePath: "z", startLine: 4, endLine: 4, pageSlug: "p" }], above);
+  assert.equal(singleAbove.reason, "shifted", "单行结论上方插一行，内容没动只是后移");
+  assert.equal(singleAbove.shift, 1);
+  const [singleBelow] = assessClaims([{ id: 4, statement: "S", sourcePath: "z", startLine: 4, endLine: 4, pageSlug: "p" }], inside);
+  assert.equal(singleBelow.reason, null, "单行结论下方插一行，既不碰到也不移动");
+});
+
+test("parseDiffRanges + assessClaims：git 八进制转义的中文路径要还原（否则漏判成没事）", () => {
+  // core.quotepath 默认开着，中文路径在 diff 里长这样：
+  //   --- "a/\344\270\255\346\226\207.js"
+  // 只脱引号不解转义的话，归一出来的字符串永远对不上库里存的 source_path，
+  // 这些文件上的结论就再也判不成 touched——不是报错，是静默漏判。
+  const quoted = '"a/\\344\\270\\255\\346\\226\\207.js"';
+  const diff = parseDiffRanges(
+    "diff --git " + quoted + " " + quoted + "\n"
+    + "--- " + quoted + "\n"
+    + "+++ " + quoted + "\n"
+    + "@@ -2,2 +2,2 @@\n-a\n+b\n"
+  );
+  assert.deepEqual([...diff.files.keys()], ["中文.js"], "八进制转义要还原成真文件名");
+  const [c] = assessClaims([{ id: 1, statement: "S", sourcePath: "中文.js", startLine: 2, endLine: 3, pageSlug: "p" }], diff);
+  assert.equal(c.reason, "touched", "中文名文件上的结论必须能判成 touched");
+});
+
+test("diffSince：重命名按「删旧 + 增新」处理，旧路径上的结论判成 deleted", () => {
+  const root = mkdtempSync(join(tmpdir(), "choro-claims-rename-"));
+  try {
+    mkdirSync(join(root, "src"), { recursive: true });
+    // 中文名一起测：rename 与 quotepath 两条转义路径都走一遍。
+    writeFileSync(join(root, "src", "旧名.js"), "export const a = 1;\nexport const b = 2;\n", "utf8");
+    execFileSync("git", ["init", "-b", "main"], { cwd: root, stdio: "pipe" });
+    execFileSync("git", ["-c", "user.email=t@t", "-c", "user.name=t", "add", "-A"], { cwd: root, stdio: "pipe" });
+    execFileSync("git", ["-c", "user.email=t@t", "-c", "user.name=t", "commit", "-m", "init", "--no-gpg-sign"], { cwd: root, stdio: "pipe" });
+    const base = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim();
+    execFileSync("git", ["mv", "src/旧名.js", "src/新名.js"], { cwd: root, stdio: "pipe" });
+    execFileSync("git", ["-c", "user.email=t@t", "-c", "user.name=t", "commit", "-m", "rename", "--no-gpg-sign"], { cwd: root, stdio: "pipe" });
+    const head = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim();
+    const d = diffSince(root, base, head);
+    assert.equal(d.ok, true);
+    // 不传 --no-renames 时 git 只输出 `rename from/to`，files 与 deleted 里都没有这条
+    // 路径，结论会被静默判成 untouched（漏判）。关掉检测后旧路径必须进 deleted。
+    assert.ok(d.deleted.includes("src/旧名.js"), "重命名后旧路径上的结论必须判成 deleted");
+    const [c] = assessClaims([{ id: 1, statement: "S", sourcePath: "src/旧名.js", startLine: 1, endLine: 2, pageSlug: "p" }], d);
+    assert.equal(c.reason, "deleted");
+  } finally {
+    for (let i = 0; i < 5; i++) {
+      try { rmSync(root, { recursive: true, force: true }); break; } catch { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 200); }
+    }
+  }
+});
+
+test("summarizeClaims：按页聚合，hasT1 却零 claims 的页单独记 inconsistent", () => {
+  const d = parseDiffRanges(DIFF);
+  const claims = [
+    { id: 1, statement: "A", sourcePath: "src/a.js", startLine: 8, endLine: 9, pageSlug: "p1", pageTitle: "P1" },
+    { id: 3, statement: "C", sourcePath: "src/gone.js", startLine: 1, endLine: 1, pageSlug: "p2", pageTitle: "P2" },
+  ];
+  const s = summarizeClaims(claims, d, {
+    pages: [
+      { slug: "p1", title: "P1", hasT1: true },
+      { slug: "p2", title: "P2", hasT1: true },
+      { slug: "p3", title: "P3", hasT1: true },
+      { slug: "p4", title: "P4", hasT1: false },
+    ],
+  });
+  assert.deepEqual(s.pages.map((p) => p.slug), ["p1", "p2", "p3", "p4"], "有风险的排前面，干净的在后");
+  assert.equal(s.totals.claims, 2);
+  assert.equal(s.totals.atRiskClaims, 2);
+  assert.equal(s.totals.atRiskPages, 2);
+  assert.equal(s.totals.inconsistentPages, 1, "p3 有 T1 段但库里零 claims：T1 落盘非原子的残局");
+  assert.equal(s.pages.find((p) => p.slug === "p4").inconsistent, false, "没 T1 段也没 claims 是正常骨架页");
+});
+
+test("summarizeClaims：diff 为 null（算不出来）时一条都不判，交回执 honesty 给调用方", () => {
+  const claims = [{ id: 1, statement: "A", sourcePath: "src/a.js", startLine: 1, endLine: 1, pageSlug: "p1" }];
+  const s = summarizeClaims(claims, null, { pages: [{ slug: "p1", title: "P1", hasT1: true }] });
+  assert.equal(s.totals.atRiskClaims, 0, "不能把「没算」说成「有风险」");
+  assert.equal(s.totals.claims, 1);
+});
+
+test("diffSince：基线非法 / 不是 git 目录 / 真 diff 三态分开", () => {
+  const bad = diffSince(tmpdir(), "not-a-sha", "abc1234");
+  assert.equal(bad.ok, false);
+  assert.equal(bad.reason, "baseline-unreadable");
+
+  const root = mkdtempSync(join(tmpdir(), "choro-claims-"));
+  try {
+    mkdirSync(join(root, "src"), { recursive: true });
+    writeFileSync(join(root, "src", "a.js"), "export const a = 1;\n", "utf8");
+    // 还没 git init：必须如实报算不出来，不许返回空 diff 冒充「没变」。
+    const notRepo = diffSince(root, "0123456", "0123456");
+    assert.equal(notRepo.ok, false);
+    assert.equal(notRepo.reason, "diff-failed");
+
+    execFileSync("git", ["init", "-b", "main"], { cwd: root, stdio: "pipe" });
+    execFileSync("git", ["-c", "user.email=t@t", "-c", "user.name=t", "add", "-A"], { cwd: root, stdio: "pipe" });
+    execFileSync("git", ["-c", "user.email=t@t", "-c", "user.name=t", "commit", "-m", "init", "--no-gpg-sign"], { cwd: root, stdio: "pipe" });
+    const base = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim();
+    writeFileSync(join(root, "src", "a.js"), "export const a = 1;\nexport const b = 2;\n", "utf8");
+    execFileSync("git", ["-c", "user.email=t@t", "-c", "user.name=t", "commit", "-am", "more", "--no-gpg-sign"], { cwd: root, stdio: "pipe" });
+    const head = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim();
+
+    const ok = diffSince(root, base, head);
+    assert.equal(ok.ok, true);
+    const [c] = assessClaims([{ id: 1, statement: "A", sourcePath: "src/a.js", startLine: 2, endLine: 2, pageSlug: "p" }], ok);
+    assert.equal(c.reason, "shifted", "第 1 行后追加一行 → 第 2 行结论行号后移");
+    assert.equal(c.shift, 1);
+  } finally {
+    for (let i = 0; i < 5; i++) {
+      try { rmSync(root, { recursive: true, force: true }); break; } catch { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 200); }
+    }
+  }
+});

package/test/wiki-provenance.test.js

@@ -0,0 +1,202 @@
+// ① 语义段溯源（verifiedBaseline / verifiedAt）的回归锁。
+//
+// 这一层要防的不是「少写一个字段」，而是两个具体的假象：
+// 1. **T1 晚于 T0 的误报**：claims 的行号是 T1 那一刻的代码树，全仓 git_baseline 是 T0 的。
+//    若拿全仓基线起算 diff，T1 之前就发生、claim 早已算进去的改动会被报成 touched
+//    ——面板上就是「明明没动过，却催你复核」。所以起点必须是每页自己的 verified_baseline。
+// 2. **T0 的确定性被污染**：verified 字段只由 T1 写。T0 一旦也写时间戳，
+//    「同状态两次 apply 逐字节相同」这条不变量就破了（测试 wiki-t0.test.js 里那条）。
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, writeFileSync, mkdirSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { execFileSync } from "node:child_process";
+import { runChoroT0, gitHead } from "../src/wiki/t0.js";
+import { createStore } from "../src/store.js";
+import { createChoroQueries } from "../src/wiki/queries.js";
+import { createT1 } from "../src/wiki/t1.js";
+import {
+  FM_VERIFIED_AT,
+  FM_VERIFIED_BASELINE,
+  readFrontmatterKey,
+  setFrontmatterKeys,
+  T1_SECTION_START,
+} from "../src/wiki/render.js";
+
+const FIXED_NOW = () => "2026-11-05T12:00:00.000Z";
+
+function makeFixture() {
+  const root = mkdtempSync(join(tmpdir(), "choro-prov-"));
+  writeFileSync(join(root, "package.json"), JSON.stringify({ name: "provfix", scripts: { test: "node --test" } }, null, 2) + "\n", "utf8");
+  mkdirSync(join(root, "src"), { recursive: true });
+  writeFileSync(join(root, "src", "a.js"), 'import { b } from "./b.js";\nexport const a = () => b();\n', "utf8");
+  writeFileSync(join(root, "src", "b.js"), "export const b = () => 1;\n", "utf8");
+  execFileSync("git", ["init", "-b", "main"], { cwd: root, stdio: "pipe" });
+  commit(root, "init");
+  return root;
+}
+
+function commit(root, message) {
+  execFileSync("git", ["-c", "user.email=t@t", "-c", "user.name=t", "add", "-A"], { cwd: root, stdio: "pipe" });
+  execFileSync("git", ["-c", "user.email=t@t", "-c", "user.name=t", "commit", "-m", message, "--no-gpg-sign"], { cwd: root, stdio: "pipe" });
+  return gitHead(root);
+}
+
+function rmTempBestEffort(dir) {
+  try {
+    rmSync(dir, { recursive: true, force: true });
+  } catch {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 200);
+    try { rmSync(dir, { recursive: true, force: true }); } catch { /* 留给系统清理 */ }
+  }
+}
+
+const GOOD_OUTPUT = JSON.stringify({
+  architecture: "src 模块承载核心导出面，a.js 依赖 b.js。",
+  convention: "导出全部用 export const 函数式风格。",
+  techStack: "纯 ESM，无框架。",
+  setup: "npm test。",
+  claims: [{ statement: "a.js 从 b.js 导入 b", kind: "architecture", sourcePath: "src/a.js", startLine: 1, endLine: 1 }],
+});
+
+// --- frontmatter 读写（页面格式层，与 T0/T1 无关的纯函数）---------------------
+
+test("setFrontmatterKeys：无则追加、有则覆盖、空值删键、无 frontmatter 原样返回", () => {
+  const page = "---\nchoro: v1\nslug: src\n---\n\n# 标题\n";
+  const added = setFrontmatterKeys(page, [[FM_VERIFIED_BASELINE, "abc1234"], [FM_VERIFIED_AT, FIXED_NOW()]]);
+  assert.equal(readFrontmatterKey(added, FM_VERIFIED_BASELINE), "abc1234");
+  assert.equal(readFrontmatterKey(added, FM_VERIFIED_AT), FIXED_NOW());
+  assert.ok(added.indexOf("---") < added.indexOf("verifiedBaseline"), "落在 frontmatter 里，不是正文");
+
+  const overwritten = setFrontmatterKeys(added, [[FM_VERIFIED_BASELINE, "def5678"]]);
+  assert.equal(readFrontmatterKey(overwritten, FM_VERIFIED_BASELINE), "def5678");
+  assert.equal(overwritten.match(/^verifiedBaseline:/gm).length, 1, "覆盖而不是重复追加");
+
+  const removed = setFrontmatterKeys(added, [[FM_VERIFIED_BASELINE, null]]);
+  assert.equal(readFrontmatterKey(removed, FM_VERIFIED_BASELINE), null);
+  assert.equal(/^verifiedBaseline:/m.test(removed), false, "删键不留空行——「没记下」要查得出来");
+
+  // 人写的坏文件（没有 frontmatter）不许被凭空造一个块出来
+  assert.equal(setFrontmatterKeys("# 纯正文\n", [[FM_VERIFIED_BASELINE, "x"]]), "# 纯正文\n");
+  assert.equal(readFrontmatterKey("# 纯正文\n", FM_VERIFIED_BASELINE), null);
+});
+
+test("readFrontmatterKey：缩进列表项不算顶层键，带引号的值剥引号", () => {
+  const page = '---\nslug: src\nsourceFiles:\n  - verifiedBaseline: 假的\nverifiedBaseline: "a:b"\n---\n';
+  assert.equal(readFrontmatterKey(page, FM_VERIFIED_BASELINE), "a:b", "只认顶层键，列表里同名的行不误命中");
+});
+
+// --- T0 一个字节都不产出这两个键 ---------------------------------------------
+
+test("T0 骨架页不含 verified 键：确定性不变量不许被溯源污染", () => {
+  const root = makeFixture();
+  const store = createStore(":memory:");
+  try {
+    runChoroT0({ repoRoot: root, store, apply: true, now: FIXED_NOW });
+    const page = readFileSync(join(root, ".chorography", "modules", "src.md"), "utf8");
+    assert.equal(page.includes(FM_VERIFIED_BASELINE), false, "骨架页没有「哪次验证的」这回事");
+    assert.equal(page.includes(FM_VERIFIED_AT), false);
+  } finally {
+    store.close();
+    rmTempBestEffort(root);
+  }
+});
+
+// --- T1 写下那一刻的 HEAD，且 claims 起点跟着它走 -----------------------------
+
+test("T1 富化写下 verifiedBaseline/verifiedAt，且等于那一刻的 HEAD", async () => {
+  const root = makeFixture();
+  const store = createStore(":memory:");
+  try {
+    runChoroT0({ repoRoot: root, store, apply: true, now: FIXED_NOW });
+    const head = commit(root, "t1 之前的一次提交");
+    const t1 = createT1({ store, runSession: async () => ({ ok: true, text: GOOD_OUTPUT }), now: FIXED_NOW });
+    const receipt = await t1.runT1({ repoRoot: root, moduleSlug: "src" });
+    assert.equal(receipt.enriched.length, 1);
+    assert.equal(receipt.enriched[0].verifiedBaseline, head, "回执里带得出来，人不用去翻文件");
+
+    const page = readFileSync(join(root, ".chorography", "modules", "src.md"), "utf8");
+    assert.equal(readFrontmatterKey(page, FM_VERIFIED_BASELINE), head);
+    assert.equal(readFrontmatterKey(page, FM_VERIFIED_AT), FIXED_NOW());
+    assert.ok(page.includes(T1_SECTION_START), "语义段照旧");
+
+    const row = store.db.prepare(
+      "SELECT p.verified_baseline, p.verified_at FROM choro_pages p JOIN choro_modules m ON p.module_id = m.id WHERE m.slug = 'src'"
+    ).get();
+    assert.equal(row.verified_baseline, head, "文件与库同源同写");
+    assert.equal(row.verified_at, FIXED_NOW());
+
+    const evidence = JSON.parse(readFileSync(join(root, ".chorography", "evidence", "src.json"), "utf8"));
+    assert.equal(evidence.verifiedBaseline, head, "evidence 旁证也带起点");
+  } finally {
+    store.close();
+    rmTempBestEffort(root);
+  }
+});
+
+test("claimDrift：T1 晚于 T0 时，T1 之前的改动不误报 touched（这就是 per-page 基线的理由）", async () => {
+  const root = makeFixture();
+  const store = createStore(":memory:");
+  try {
+    runChoroT0({ repoRoot: root, store, apply: true, now: FIXED_NOW });
+    // T0 之后、T1 之前有人改了 a.js 第 1 行——claim 读的就是改完之后的这棵树。
+    writeFileSync(join(root, "src", "a.js"), 'export const a = () => 1;\n', "utf8");
+    commit(root, "T0 之后、T1 之前");
+    const t1 = createT1({ store, runSession: async () => ({ ok: true, text: GOOD_OUTPUT }), now: FIXED_NOW });
+    await t1.runT1({ repoRoot: root, moduleSlug: "src" });
+
+    const q = createChoroQueries({ store });
+    const repo = q.resolveRepo(undefined);
+    const drift = q.claimDrift(repo.id);
+    assert.equal(drift.totals.claims, 1);
+    assert.equal(drift.totals.atRiskClaims, 0, "拿全仓基线起算会在这里误报 touched（旧的 bug）");
+    assert.equal(drift.clean, true);
+    const pageDrift = drift.pages.find((p) => p.slug === "src");
+    assert.equal(pageDrift.verifiedBaseline, drift.head, "起点就是 HEAD");
+    assert.equal(pageDrift.baselineApprox, false);
+
+    // 真改了 claim 锚点所在行：这时必须报出来，别因为「起点是 HEAD」就永远说干净。
+    writeFileSync(join(root, "src", "a.js"), 'export const a = () => 2;\n', "utf8");
+    commit(root, "真的动了锚点");
+    const drift2 = q.claimDrift(repo.id);
+    assert.equal(drift2.clean, false);
+    assert.equal(drift2.totals.atRiskClaims, 1);
+    assert.equal(drift2.pages.find((p) => p.slug === "src").atRisk[0].reason, "touched");
+  } finally {
+    store.close();
+    rmTempBestEffort(root);
+  }
+});
+
+test("claimDrift：老数据（没有逐页基线）退到全仓基线，并标明这是近似起点", () => {
+  const root = makeFixture();
+  const store = createStore(":memory:");
+  try {
+    runChoroT0({ repoRoot: root, store, apply: true, now: FIXED_NOW });
+    const q = createChoroQueries({ store });
+    const repo = q.resolveRepo(undefined);
+    // 本功能之前富化的页：库里有 claims、没有 verified_baseline（迁移加列后的老行）。
+    const page = store.choroPageBySlug(repo.id, "src");
+    store.saveChoroPageClaims(page.id, [
+      { statement: "a 依赖 b", kind: "architecture", sourcePath: "src/a.js", startLine: 2, endLine: 2, createdAt: FIXED_NOW() },
+    ]);
+    store.db.prepare("UPDATE choro_pages SET verified_baseline = NULL, verified_at = NULL WHERE id = ?").run(page.id);
+
+    const drift = q.claimDrift(repo.id);
+    const pageDrift = drift.pages.find((p) => p.slug === "src");
+    assert.equal(pageDrift.verifiedBaseline, null, "真话：这页没记过逐页基线");
+    assert.equal(pageDrift.baselineApprox, true, "退而求其次的起点要标出来");
+    assert.equal(pageDrift.baselineUnknown, false, "有了保底起点就不再是「判不了」");
+    assert.equal(pageDrift.diffBaseline, drift.baseline, "用的就是全仓基线");
+
+    // 全仓基线也缺（极老的行）→ 才轮到 baselineUnknown，一条都不判。
+    store.db.prepare("UPDATE choro_repos SET git_baseline = '' WHERE id = ?").run(repo.id);
+    const drift2 = q.claimDrift(repo.id);
+    assert.equal(drift2.pages.find((p) => p.slug === "src").baselineUnknown, true);
+    assert.equal(drift2.totals.atRiskClaims, 0, "判不了就是判不了，不冒充没事");
+  } finally {
+    store.close();
+    rmTempBestEffort(root);
+  }
+});