@modusensus/dsh-mneme 0.8.15 → 0.8.16

package/test/inject.test.js

@@ -418,3 +418,26 @@ test("issue #334: snapshot query carries no lone surrogate (query path cut at ex
   assert.ok(snap.query.length > 0, "query recorded");
   assert.ok(!hasLoneSurrogate(snap.query), "snapshot query is surrogate-clean");
 });
+
+// surface.nodes 是宿主 getter：消息投影所属插件被移除时，dsh-session 的
+// _assertProjections 直接 throw。读取不设防的话，异常会冒到调用方的 try，表现为
+// 热记忆整块不渲染 + 语义查询为空——比「沿用可见面失效前的旧行为」更糟。
+// 夹具用宿主真实的抛错文案，锁住「拿不到可见面就退回全量事件」这条退化路径。
+test("throwing surface getter degrades to full-log hot memory instead of a blank block", () => {
+  const { contexts } = setup();
+  const events = [
+    { type: "user/message", data: { source: { kind: "user" }, content: [{ type: "text", text: "把投影插件卸了会怎样" }] } },
+    { type: "assistant/message", data: { message: { content: [{ type: "text", text: "热记忆不该因此整块消失" }] } } }
+  ];
+  const session = {
+    snapshotEvents: () => events,
+    get surface() {
+      throw new Error('session message projection "dsh-rewind" was removed or replaced; restore the session with its owning plugin');
+    }
+  };
+  const text = contexts[0].text({ agent: { session } });
+  assert.ok(text.includes("[短期上下文]"), "热记忆块仍应渲染");
+  assert.ok(text.includes("把投影插件卸了会怎样"), "轮次提问应照旧进入");
+  assert.ok(text.includes("热记忆不该因此整块消失"), "轮次回复应照旧进入");
+  assert.equal(getInjectionSnapshot().query, "把投影插件卸了会怎样", "语义查询不受 getter 抛错影响");
+});

package/test/llm-audit.test.js

@@ -468,6 +468,67 @@ test("GET /api/dsh-mneme/semantic/llm-audit/stats aggregates by source and statu
   store.close();
 });
 
+// by_operation / by_day 是面板「token 去向」环形图与 7 天柱状的数据源。
+// 锁三件事：① 环形图直接按返回顺序画段，所以 by_operation 必须按
+// total_tokens 降序、by_day 必须按 day 升序（前端不再排）；② 每行带完整的
+// in/out/total 拆分（by_source 只有 total，画不出输入/输出对照）；
+// ③ write_admission 只计量不调 LLM，token 恒 0 是设计——它必须作为一行
+// 出现且为 0，防的是将来有人把 0 行过滤掉或当成异常补齐。
+test("GET /api/dsh-mneme/semantic/llm-audit/stats breaks spend down by operation and by day", async () => {
+  const { store, service, routes } = apiSetup();
+  const day1 = new Date(Date.now() - 2 * 86400000).toISOString();
+  const day2 = new Date(Date.now() - 1 * 86400000).toISOString();
+  service.saveLlmAudit({
+    timestamp: day1,
+    trigger_source: "autoDream", operation_type: "dream_consolidate",
+    model_id: "m", input_tokens: 100, output_tokens: 40, status: "success"
+  });
+  service.saveLlmAudit({
+    timestamp: day1,
+    trigger_source: "writeAdmission", operation_type: "write_admission",
+    model_id: "m", input_tokens: 0, output_tokens: 0, status: "success"
+  });
+  service.saveLlmAudit({
+    timestamp: day2,
+    trigger_source: "autoDream", operation_type: "dream_consolidate",
+    model_id: "m", input_tokens: 10, output_tokens: 5, status: "success"
+  });
+  service.saveLlmAudit({
+    timestamp: day2,
+    trigger_source: "autoSummarize", operation_type: "summarize_compress",
+    model_id: "m", input_tokens: 30, output_tokens: 10, status: "success"
+  });
+  const route = routes.find((r) => r.path === "/api/dsh-mneme/semantic/llm-audit/stats");
+  const res = new FakeRes();
+  await route.handler(req("/api/dsh-mneme/semantic/llm-audit/stats?days=7"), res);
+  const stats = JSON.parse(res.body);
+  assert.equal(res.statusCode, 200);
+
+  // by_operation：total_tokens 降序，含 in/out/total 拆分
+  assert.deepEqual(
+    stats.by_operation.map((o) => o.operation),
+    ["dream_consolidate", "summarize_compress", "write_admission"]
+  );
+  const consolidate = stats.by_operation[0];
+  assert.equal(consolidate.c, 2);
+  assert.equal(consolidate.input_tokens, 110);
+  assert.equal(consolidate.output_tokens, 45);
+  assert.equal(consolidate.total_tokens, 155);
+  const admission = stats.by_operation.find((o) => o.operation === "write_admission");
+  assert.equal(admission.c, 1);
+  assert.equal(admission.total_tokens, 0);
+
+  // by_day：date(timestamp)（UTC）分组，day 升序
+  const d1 = day1.slice(0, 10);
+  const d2 = day2.slice(0, 10);
+  assert.deepEqual(stats.by_day.map((d) => d.day), [d1, d2]);
+  assert.equal(stats.by_day[0].c, 2);
+  assert.equal(stats.by_day[0].total_tokens, 140);
+  assert.equal(stats.by_day[1].c, 2);
+  assert.equal(stats.by_day[1].total_tokens, 55);
+  store.close();
+});
+
 // ------------------------------------------- entity extraction (issue #250)
 // 实体抽取是「每次写入记忆都会跑」的后台 LLM 链路，但 createEntityStreamAdapter
 // 只拿到 llm 句柄、没有 service，所以从来没有写审计的能力——面板因此回答不了
@@ -596,3 +657,40 @@ test("boot retention purge reads the assembled config, not rawCfg", async () =>
   after.close();
   assert.equal(left, 0, "面板开着的审计必须按 cfg 清理，否则审计行只增不减");
 });
+
+// #399 的启动期裁剪同理：留存开关与保留期都要取装配后的 cfg。这里额外锁一条
+// 「默认关就不动手」——留存是 opt-in，默认关时一张空表不该被每次启动扫一遍。
+test("boot purge trims expired distill records only when retention is on (issue #399)", async () => {
+  const dir = mkdtempSync(join(tmpdir(), "mneme-distill-retention-"));
+  const dbPath = join(dir, "memory.db");
+
+  const seed = createStore(dbPath);
+  createSettings(seed.db).setFeatureFlags({ "distillRecords.enabled": true, "distillRecords.retentionDays": 1 });
+  seed.saveDistillRecords([
+    {
+      sessionId: "s-boot",
+      seq: 1,
+      role: "user",
+      text: "过期原文",
+      windowId: "s-boot:1",
+      distilledAt: new Date(Date.now() - 2 * 86400000).toISOString()
+    }
+  ]);
+  assert.equal(seed.db.prepare("SELECT count(*) AS c FROM distill_records").get().c, 1, "先放一行过期原文");
+  seed.close();
+
+  const ctx = new Context();
+  ctx.provide("tools", { register() { return () => {}; } });
+  ctx.provide("commands", { register() { return () => {}; } });
+  ctx.provide("systemPrompt", { context() { return () => {}; } });
+  ctx.provide("agentDefaultModel", { currentSelection() { return { provider: "mock", model: "mock" }; } });
+  ctx.provide("llm", { async *stream() { yield { type: "finish", reason: { kind: "stop" } }; } });
+  ctx.provide("webServer", { register() { return () => {}; } });
+  // bundle 说关、面板说开（保留期 1 天，那行已过期 2 天）：只有读装配后的 cfg 才会清掉
+  await ctx.plugin(mneme, { memoryDir: dir, distillRecords: { enabled: false, retentionDays: 1 } });
+
+  const after = new DatabaseSync(dbPath);
+  const left = after.prepare("SELECT count(*) AS c FROM distill_records").get().c;
+  after.close();
+  assert.equal(left, 0, "面板开着的留存必须按 cfg 裁剪，否则原文只增不减");
+});

package/test/maintenance.test.js

@@ -102,8 +102,8 @@ test("dry-run：报出将清理的行数与列文本大小，一个字节都不
 
     assert.equal(report.dryRun, true);
     assert.equal(report.olderThanDays, 7, "默认保留窗口 7 天");
-    assert.deepEqual(report.planned, { dream_run_inputs: 1, archived_embeddings: 1 });
-    assert.deepEqual(report.cleared, { dream_run_inputs: 0, archived_embeddings: 0 });
+    assert.deepEqual(report.planned, { dream_run_inputs: 1, archived_embeddings: 1, distill_records: 0 });
+    assert.deepEqual(report.cleared, { dream_run_inputs: 0, archived_embeddings: 0, distill_records: 0 });
     assert.ok(report.column_bytes.dream_run_inputs > 600, "列文本大小要给真实数字（它是上界）");
     assert.equal(typeof report.size.before_bytes, "number");
     assert.equal(report.vacuum.ran, false);
@@ -116,6 +116,41 @@ test("dry-run：报出将清理的行数与列文本大小，一个字节都不
   }
 });
 
+test("dry-run 与执行：蒸馏原文进报告，裁剪只删原文、溯源链接留住（#399）", () => {
+  const { store, close } = fileStore();
+  try {
+    seed(store);
+    const old = new Date(NOW - 30 * DAY).toISOString();
+    const fresh = new Date(NOW - 1 * DAY).toISOString();
+    store.saveDistillRecords([
+      { sessionId: "s-old", seq: 1, role: "user", text: "z".repeat(600), windowId: "s-old:1", distilledAt: old },
+      { sessionId: "s-fresh", seq: 1, role: "user", text: "新窗口的原文", windowId: "s-fresh:1", distilledAt: fresh }
+    ]);
+    const memoryId = store.all()[0].id;
+    store.saveMemoryProvenance({ memoryId, sessionId: "s-old", seqStart: 1, seqEnd: 1, createdAt: old });
+
+    // dry-run：第三项要报出真实行数与列文本大小（上界），且一个字节都不改
+    const dry = maintenanceFor(store).reclaim({ dryRun: true });
+    assert.equal(dry.planned.distill_records, 1, "只有窗口外那行算数");
+    assert.ok(dry.column_bytes.distill_records >= 600, "蒸馏原文的列文本大小要给真实数字");
+    assert.equal(store.db.prepare("SELECT count(*) AS c FROM distill_records").get().c, 2, "dry-run 不删原文");
+
+    const applied = maintenanceFor(store).reclaim({ dryRun: false });
+    assert.equal(applied.cleared.distill_records, 1);
+    const rows = store.db.prepare("SELECT session_id FROM distill_records").all();
+    assert.deepEqual(rows.map((r) => r.session_id), ["s-fresh"], "窗口内原文留住");
+    // 裁剪只删原文：链接与记忆都留着，面板/CLI 显示「来源已过期」而不是查无此记忆。
+    assert.equal(
+      store.db.prepare("SELECT count(*) AS c FROM memory_provenance").get().c,
+      1,
+      "溯源链接刻意保留，指向已空区间"
+    );
+    assert.equal(rawMemoryCount(store), 2, "裁剪原文不删记忆");
+  } finally {
+    close();
+  }
+});
+
 test("执行：只清窗口外的输入快照，run 的骨架与决策原文留住", () => {
   const { store, close } = fileStore();
   try {
@@ -191,6 +226,8 @@ test("VACUUM 失败不回吞：清理照做、报告与回执都带上失败原
         clearDreamRunInputs: (b) => store.clearDreamRunInputs(b),
         archivedEmbeddingStats: () => store.archivedEmbeddingStats(),
         clearArchivedEmbeddings: () => store.clearArchivedEmbeddings(),
+        distillRecordStats: (b) => store.distillRecordStats(b),
+        clearDistillRecords: (b) => store.clearDistillRecords(b),
         storageStats: () => store.storageStats(),
         saveLlmAudit: (e) => store.saveLlmAudit(e),
         vacuum: () => { throw new Error("SQLITE_BUSY: database is locked"); }
@@ -389,3 +426,76 @@ test("CLI：--vacuum 单独用会被拒（dry-run 没有可回收的页），也
   assert.equal(result.status, 1);
   assert.match(result.stderr, /--vacuum 需要配 --apply/);
 });
+
+test("HTTP 面（数据面）：窗口上界与确认门里的抛错都跟面板侧同口径（#411）", async () => {
+  // 这张脸曾是面板路由的整段复制，于是 #410 修好面板侧之后它停在旧形态：#508 没有
+  // 上界（1e20 打进来 → maintenance 算日期抛 RangeError → 一个字节都不回），#523 的
+  // confirm-required 报告也没兜错。现在两处口径都来自 src/reclaim-http.js，这条锁从
+  // **数据面自己的端口**打真 HTTP，证明它真的走的是同一份。
+  const { store, close } = fileStore();
+  const maintenance = maintenanceFor(store);
+  const service = createService({ store, mirror: null, config: {} });
+  const settings = createSettings(store.db);
+  const api = createStandaloneApi({ service, store, config: {}, settings, logger: null, port: 0, maintenance });
+  await api.ready;
+  const url = `http://127.0.0.1:${api.port}/maintenance/reclaim`;
+  const post = (body) =>
+    fetch(url, {
+      method: "POST",
+      headers: { authorization: `Bearer ${api.token}`, "content-type": "application/json" },
+      body: JSON.stringify(body)
+    });
+  // 第二个实例：不传 maintenance（「没接线」的那一档）。在 try 之外建、在 finally 里
+  // 关——它要是漏关，node --test 会挂着一个开着的 server 句柄永不退出（变异检验里
+  // 一旦断言先炸就正好踩这条）。
+  const unplugged = createStandaloneApi({ service, store, config: {}, settings, logger: null, port: 0 });
+  await unplugged.ready;
+  try {
+    const { archived } = seed(store);
+
+    // 顺序也是契约：端点整个没接线时，报「窗口不合法」是误导——调用方会去改窗口，
+    // 改完照样 503。所以 503 必须赢过字段校验（面板侧同一条，见 api-routes-gaps.test.js）。
+    const unpluggedRes = await fetch(`http://127.0.0.1:${unplugged.port}/maintenance/reclaim`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${unplugged.token}`, "content-type": "application/json" },
+      body: JSON.stringify({ olderThanDays: 1e20 })
+    });
+    assert.equal(unpluggedRes.status, 503, "没接线要赢过字段校验");
+    assert.equal((await unpluggedRes.json()).error, "maintenance-unavailable");
+
+    // 量级超界：旧形态下这一发既不改数据、也不回任何字节。
+    for (const huge of [3651, 1e20]) {
+      const out = await post({ dryRun: false, olderThanDays: huge });
+      assert.equal(out.status, 400, `olderThanDays=${huge} 必须被拒，而不是把连接挂住`);
+      assert.equal((await out.json()).error, "invalid-older-than-days");
+    }
+    const atLimit = await post({ olderThanDays: 3650 });
+    assert.equal(atLimit.status, 200, "上界本身合法");
+    assert.equal((await atLimit.json()).olderThanDays, 3650);
+    assert.ok(rawVec(store, archived.id), "被拒的那几发一个字节都不能改");
+
+    // 确认门的报告要描述「将要执行的那个动作」，且窗口是调用方问的那个。
+    const refused = await post({ dryRun: false, olderThanDays: 30, vacuum: true });
+    assert.equal(refused.status, 400);
+    const refusedBody = await refused.json();
+    assert.equal(refusedBody.error, "confirm-required");
+    assert.equal(refusedBody.report.olderThanDays, 30, "报告必须说的是被问的那个窗口");
+    assert.equal(refusedBody.report.vacuum.requested, true, "报告必须描述将要执行的那个动作（含 vacuum）");
+    assert.ok(rawVec(store, archived.id), "缺 confirm 时一个字节都不改");
+
+    const applied = await post({ dryRun: false, confirm: true, vacuum: true });
+    assert.equal(applied.status, 200);
+    const appliedBody = await applied.json();
+    assert.equal(appliedBody.olderThanDays, 7, "不传窗口就是默认 7 天");
+    assert.equal(appliedBody.cleared.dream_run_inputs, 1);
+    assert.equal(appliedBody.vacuum.requested, true, "勾了 VACUUM 就必须真带上");
+    assert.equal(appliedBody.vacuum.ran, true);
+    assert.equal(rawVec(store, archived.id), null);
+  } finally {
+    unplugged.server.closeIdleConnections?.();
+    unplugged.server.close();
+    api.server.closeIdleConnections?.();
+    api.server.close();
+    close();
+  }
+});

package/test/pre-inject-gate.test.js

@@ -365,6 +365,16 @@ test("lightMode：预设翻转 preInjectGate.enabled 且不污染用户配置对
   assert.equal(flat.heatEnabled, false, "平铺键照旧直赋（既有行为回归）");
 });
 
+test("lightMode：预设关掉 distillRecords.enabled，但保留用户显式设的 retentionDays（#399）", () => {
+  // 轻量模式关的是「留存原文」这个成本/隐私面；retentionDays 是保留窗口的时长，
+  // 不在 LIGHT_MODE_OFF 里——用户显式设过就照旧，别把配置顺手抹成默认值。
+  const user = { lightMode: true, distillRecords: { enabled: true, retentionDays: 30 } };
+  const preset = applyLightModePreset(user);
+  assert.equal(preset.distillRecords.enabled, false, "轻量模式必须关掉原始记录留存");
+  assert.equal(preset.distillRecords.retentionDays, 30, "保留窗口时长不受轻量模式影响");
+  assert.equal(user.distillRecords.enabled, true, "不改到用户原对象");
+});
+
 test("判定超时：abort 底层流（真宿主守约）→ degraded 审计 + 不缓存 + 下一帧重试（CodeRabbit on #382）", async () => {
   const llm = fakeLlm([{ hang: true }, { json: { ids: [], reason: "recovered" } }]);
   const s = setup({ preInjectGate: { enabled: true } }, llm, { judgeTimeoutMs: 50 });

package/test/recall-stats.test.js

@@ -124,21 +124,106 @@ test("windowDays/exemptDays 越界回默认；扫描超上限标 truncated", ()
 
 // ============================ 第五指标（#275）：归档净增速率 + 可压掉行数
 
-test("归档净增速率：按 updated_at 取归档时刻，窗外归档只进总数不进净增", () => {
+test("归档净增速率：按 archived_at 取归档时刻，窗外归档只进总数不进净增", () => {
   const { store, service } = setup();
   const fresh = service.saveWithDedupe({ type: "history", title: "刚归档", content: "x", importance: 3 }).memory;
   const old = service.saveWithDedupe({ type: "history", title: "早归档", content: "y", importance: 3 }).memory;
   service.saveWithDedupe({ type: "history", title: "活跃件", content: "z", importance: 3 });
   store.setArchived(fresh.id, true);
   store.setArchived(old.id, true);
-  // 归档时刻 = 最后一次写（setArchived 刷 updated_at）：把这行推到窗口外
-  store.db.prepare("UPDATE memories SET updated_at = ? WHERE id = ?")
+  // 精确口径：归档时刻是 archived_at 列（#275 第二批），把这行推到窗口外
+  store.db.prepare("UPDATE memories SET archived_at = ? WHERE id = ?")
     .run(new Date(Date.now() - 100 * 86400000).toISOString(), old.id);
 
   const stats = service.recallStats({ windowDays: 30, exemptDays: 0 });
   assert.equal(stats.archive.total, 2, "归档区现有行数（活跃件不算）");
   assert.equal(stats.archive.addedInWindow, 1, "窗外那次归档不算本窗口净增");
   assert.equal(stats.archive.perDay, Math.round((1 / 30) * 100) / 100);
+  assert.equal(stats.archive.undated, 0, "两行都有 archived_at，都不算时刻不可追溯");
+  store.close();
+});
+
+test("回归锁：归档后再 memory_update 刷 updated_at，不得算作本窗口新进归档", () => {
+  // 本批的核心回归锁。代理口径下归档时刻取 updated_at（setArchived 刷它），于是
+  // 「对已归档行做一次普通更新」就会把旧归档算成窗口内新进，perDay 偏高——这正是
+  // #275 第二批要消灭的假阳性。任何人把 recall-stats 改回 Date.parse(m.updated_at)
+  // 或改回 `m.archived_at ?? m.updated_at`，本用例立刻失败。
+  const { store, service } = setup();
+  const m = service.saveWithDedupe({ type: "history", title: "早归档", content: "x", importance: 3 }).memory;
+  store.setArchived(m.id, true);
+  store.db.prepare("UPDATE memories SET archived_at = ? WHERE id = ?")
+    .run(new Date(Date.now() - 100 * 86400000).toISOString(), m.id);
+  // 已归档行上的一次普通更新：updated_at 被刷到当下，archived_at 必须岿然不动
+  store.update(m.id, { content: "改过一遍" });
+  const row = store.getById(m.id);
+  assert.ok(
+    Date.parse(row.updated_at) > Date.now() - 60000,
+    "前提成立：update 确实把 updated_at 刷到了当下（否则本用例是恒真的）"
+  );
+
+  const stats = service.recallStats({ windowDays: 30, exemptDays: 0 });
+  assert.equal(stats.archive.total, 1);
+  assert.equal(stats.archive.addedInWindow, 0, "旧归档不因一次 update 变成窗口新进");
+  assert.equal(stats.archive.perDay, 0);
+  store.close();
+});
+
+test("取消归档清空 archived_at；再次归档重新落新时刻", () => {
+  const { store } = setup();
+  const m = store.save({ type: "history", title: "t", content: "c" });
+  const archived = store.setArchived(m.id, true);
+  assert.ok(archived.archived_at, "活跃 → 归档：落当前时刻");
+
+  const restored = store.setArchived(m.id, false);
+  assert.equal(restored.archived, false);
+  assert.equal(restored.archived_at, undefined, "取消归档清 NULL（toRow 读作 undefined，不是陈旧时刻）");
+
+  const again = store.setArchived(m.id, true);
+  assert.ok(again.archived_at, "重新归档重新落时刻");
+  assert.notEqual(again.archived_at, archived.archived_at, "是新一次归档，不是复用旧时刻");
+  store.close();
+});
+
+test("幂等：重复归档不刷新 archived_at（否则重复调用又变成一次净增）", () => {
+  // 代理口径被推翻的两个假阳性之一就是「对同一行重复调 setArchived(true)」。精确
+  // 口径下重复归档不是新一次归档，时刻保持首次值；刷新它就等于把旧毛病换个入口复活。
+  const { store } = setup();
+  const m = store.save({ type: "history", title: "t", content: "c" });
+  const first = store.setArchived(m.id, true);
+  const second = store.setArchived(m.id, true);
+  const third = store.setArchived(m.id, true);
+  assert.equal(second.archived_at, first.archived_at);
+  assert.equal(third.archived_at, first.archived_at);
+  store.close();
+});
+
+test("存量归档行（archived_at 为 NULL）计入 undated，不静默顶替成窗口新进", () => {
+  // NULL = 本列落地前就已归档的行，归档时刻不可追溯。用 updated_at 顶替就是退回被
+  // 推翻的代理口径；按 0 充数则是把「不知道」伪装成「没有」。这里锁的是第三种做法：
+  // 单独计数、不计入 addedInWindow。
+  const { store, service } = setup();
+  const m = service.saveWithDedupe({ type: "history", title: "存量归档", content: "x", importance: 3 }).memory;
+  store.setArchived(m.id, true);
+  store.db.prepare("UPDATE memories SET archived_at = NULL WHERE id = ?").run(m.id);
+
+  const stats = service.recallStats({ windowDays: 30, exemptDays: 0 });
+  assert.equal(stats.archive.total, 1);
+  assert.equal(stats.archive.addedInWindow, 0, "时刻不可追溯 → 不算窗口新进");
+  assert.equal(stats.archive.undated, 1, "单独暴露，不伪装成 0");
+  store.close();
+});
+
+test("口径升级不波及其他四项指标：归档行照旧不进活跃 / 僵尸 / 豁免", () => {
+  const { store, service } = setup();
+  service.saveWithDedupe({ type: "project", title: "活跃", content: "x", importance: 3 });
+  const arch = service.saveWithDedupe({ type: "project", title: "归档", content: "y", importance: 3 }).memory;
+  store.setArchived(arch.id, true);
+
+  const stats = service.recallStats({ windowDays: 30, exemptDays: 0 });
+  assert.equal(stats.zombie.activeCount, 1, "归档行不算活跃");
+  assert.equal(stats.zombie.zombieCount, 1, "零曝光的活跃行照旧算僵尸");
+  assert.equal(stats.zombie.exemptCount, 0);
+  assert.equal(stats.archive.total, 1);
   store.close();
 });
 
@@ -183,7 +268,7 @@ test("没有归档行时给 0，不返回 null / NaN", () => {
   service.saveWithDedupe({ type: "project", title: "只有活跃", content: "x", importance: 3 });
   const stats = service.recallStats({ windowDays: 30, exemptDays: 0 });
   assert.deepEqual(stats.archive, {
-    total: 0, addedInWindow: 0, perDay: 0, compressible: { rows: 0, groups: 0 }
+    total: 0, addedInWindow: 0, perDay: 0, undated: 0, compressible: { rows: 0, groups: 0 }
   });
   store.close();
 });

package/test/reclaim-http.test.js

@@ -0,0 +1,209 @@
+// 存储回收（maintenance/reclaim）的 HTTP 口径 —— 共用模块自己的锁。
+//
+// 这个文件盯两类回归：
+//   a) 口径本身（解析、校验、答复形状）。表驱动跑全量边界，因为这张脸有两个入口，
+//      任何一处口径松掉都会同时污染面板与数据面；
+//   b) **不许再长出第二份实现**。历史上两个入口是整段复制的，于是 #410 修好面板侧
+//      之后数据面还停在旧形态（#411）。下面的静态锁把「校验字面量只许出现在本模块」
+//      写成断言：谁要是再复制一段出去，这里直接转红。
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  MAX_RECLAIM_WINDOW_DAYS,
+  RECLAIM_CONFIRM_HINT,
+  parseReclaimQuery,
+  parseReclaimJson,
+  readReclaimFields,
+  reclaimReply
+} from "../src/reclaim-http.js";
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+/** 假 maintenance：记下每次调用的实参，回一个固定报告对象（用来锁「不加包装层」）。 */
+function fakeMaintenance(report = { dryRun: true, planned: { dream_run_inputs: 1 } }) {
+  const calls = [];
+  return {
+    calls,
+    reclaim(options) {
+      calls.push(options);
+      return report;
+    }
+  };
+}
+
+// ---------------------------------------------------------------------------
+// GET 侧：query 是字符串域
+// ---------------------------------------------------------------------------
+test("parseReclaimQuery: 只收十进制整数字面量，缺省才落默认窗口", () => {
+  assert.deepEqual(parseReclaimQuery(null), { ok: true, olderThanDays: undefined }, "不传 = 落默认窗口");
+  assert.deepEqual(parseReclaimQuery("0"), { ok: true, olderThanDays: 0 }, "0 是合法值（清全部快照）");
+  assert.deepEqual(parseReclaimQuery("3"), { ok: true, olderThanDays: 3 });
+  assert.deepEqual(parseReclaimQuery(String(MAX_RECLAIM_WINDOW_DAYS)), { ok: true, olderThanDays: MAX_RECLAIM_WINDOW_DAYS }, "上界本身合法");
+});
+
+test("parseReclaimQuery: 畸形输入一律 400，绝不被静默读成 0", () => {
+  // Number() 会把 ""/[]/" " 都化成 0，而 0 在这里是「清掉全部快照」——最坏解释绝不能
+  // 从一个畸形输入静默拿到。所以这里的每一条都必须拒，而不是回落。
+  for (const bad of ["", " ", "3.5", "-1", "1e3", "0x10", "٣", "3 ", "+3", "abc"]) {
+    assert.deepEqual(
+      parseReclaimQuery(bad),
+      { ok: false, error: "invalid-older-than-days" },
+      `olderThanDays=${JSON.stringify(bad)} 必须被拒`
+    );
+  }
+});
+
+test("parseReclaimQuery: 量级超界被拒（十进制字面量不保证是个能算日期的数）", () => {
+  // 400 位十进制字面量会化成 Infinity，maintenance 拿它算日期直接抛 RangeError。
+  for (const huge of [String(MAX_RECLAIM_WINDOW_DAYS + 1), "100000000000000000000", "9".repeat(400)]) {
+    assert.deepEqual(parseReclaimQuery(huge), { ok: false, error: "invalid-older-than-days" }, `olderThanDays=${huge.slice(0, 12)}… 必须被拒`);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// POST 侧：JSON 数字域
+// ---------------------------------------------------------------------------
+test("parseReclaimJson: invalid-json 与 invalid-body 是两个不同的错", () => {
+  assert.deepEqual(parseReclaimJson(""), { ok: true, body: {} }, "空 body 等价于 {}");
+  assert.deepEqual(parseReclaimJson('{"a":1}'), { ok: true, body: { a: 1 } });
+  assert.deepEqual(parseReclaimJson("{bad"), { ok: false, error: "invalid-json" }, "发坏了");
+  assert.deepEqual(parseReclaimJson("null"), { ok: false, error: "invalid-body" }, "发成了 null");
+  assert.deepEqual(parseReclaimJson("[]"), { ok: false, error: "invalid-body" }, "发成了数组");
+  assert.deepEqual(parseReclaimJson('"x"'), { ok: false, error: "invalid-body" }, "发成了字符串");
+});
+
+test("readReclaimFields: 默认值与透传", () => {
+  assert.deepEqual(
+    readReclaimFields({}),
+    { ok: true, dryRun: true, olderThanDays: undefined, vacuum: false, confirm: false },
+    "缺省 = dry-run、默认窗口、不 VACUUM、未确认"
+  );
+  assert.deepEqual(
+    readReclaimFields({ dryRun: false, olderThanDays: 30, vacuum: true, confirm: true }),
+    { ok: true, dryRun: false, olderThanDays: 30, vacuum: true, confirm: true }
+  );
+  assert.deepEqual(readReclaimFields({ olderThanDays: null }).olderThanDays, undefined, "null 与缺省同义：落默认窗口，不是 0");
+  assert.deepEqual(readReclaimFields({ olderThanDays: 0 }).olderThanDays, 0, "0 是合法值");
+  assert.deepEqual(readReclaimFields({ olderThanDays: MAX_RECLAIM_WINDOW_DAYS }).olderThanDays, MAX_RECLAIM_WINDOW_DAYS);
+});
+
+test("readReclaimFields: 只收 JSON 数字，量级与形状都要过", () => {
+  for (const bogus of ["", [], false, "3", true, 3.5, -1]) {
+    assert.deepEqual(
+      readReclaimFields({ olderThanDays: bogus }),
+      { ok: false, error: "invalid-older-than-days" },
+      `olderThanDays=${JSON.stringify(bogus)} 必须被拒`
+    );
+  }
+  // 上界与 GET 侧同一条：1e20 也是「整数」，但 maintenance 拿它算日期会抛 RangeError。
+  for (const huge of [MAX_RECLAIM_WINDOW_DAYS + 1, 1e20, 1e21]) {
+    assert.deepEqual(readReclaimFields({ olderThanDays: huge }), { ok: false, error: "invalid-older-than-days" });
+  }
+  assert.deepEqual(readReclaimFields({ vacuum: "true" }), { ok: false, error: "invalid-vacuum" }, "vacuum 只收布尔");
+  assert.equal(readReclaimFields({ confirm: "true" }).confirm, false, "confirm 只认真布尔：字符串不算确认");
+});
+
+// ---------------------------------------------------------------------------
+// 答复：两个入口共用的那一份
+// ---------------------------------------------------------------------------
+test("reclaimReply: 没接线时 503，且根本不碰 maintenance", () => {
+  const out = reclaimReply({ maintenance: null, dryRun: true });
+  // 字面量而不是常量：这是调用方要分支的错误码，改一个字母就是对外行为变更。
+  assert.deepEqual(out, { status: 503, body: { error: "maintenance-unavailable" } });
+});
+
+test("reclaimReply: dry-run 报原样透传，不加包装层", () => {
+  const report = { dryRun: true, planned: { dream_run_inputs: 1 }, olderThanDays: 7 };
+  const maintenance = fakeMaintenance(report);
+  const out = reclaimReply({ maintenance, dryRun: true, olderThanDays: 7 });
+  assert.equal(out.status, 200);
+  assert.equal(out.body, report, "报告必须原样回，套一层 {report} 会打断既有消费方");
+  assert.deepEqual(maintenance.calls, [{ olderThanDays: 7, vacuum: false, dryRun: true }]);
+});
+
+test("reclaimReply: 缺 confirm 只回报告不执行，且报告描述的是将要执行的那个动作", () => {
+  const report = { dryRun: true, vacuum: { requested: true, ran: false } };
+  const maintenance = fakeMaintenance(report);
+  const out = reclaimReply({ maintenance, dryRun: false, olderThanDays: 30, vacuum: true });
+  assert.equal(out.status, 400);
+  assert.equal(out.body.error, "confirm-required");
+  assert.equal(out.body.hint, RECLAIM_CONFIRM_HINT, "提示是给调用方看的下一步动作，两个入口必须逐字一致");
+  assert.equal(out.body.report, report);
+  assert.deepEqual(
+    maintenance.calls,
+    [{ olderThanDays: 30, vacuum: true, dryRun: true }],
+    "报告必须带 vacuum：否则调用方看到的是「不 VACUUM」的数字，却带着 vacuum 去执行"
+  );
+});
+
+test("reclaimReply: 确认后按原样执行", () => {
+  const maintenance = fakeMaintenance({ dryRun: false, cleared: { dream_run_inputs: 1 } });
+  const out = reclaimReply({ maintenance, dryRun: false, olderThanDays: 30, vacuum: true, confirm: true });
+  assert.equal(out.status, 200);
+  assert.deepEqual(maintenance.calls, [{ olderThanDays: 30, vacuum: true, dryRun: false }]);
+});
+
+test("reclaimReply: 抛错回 500 并留日志，原始错误文本不能吞", () => {
+  const warnings = [];
+  const maintenance = {
+    reclaim() { throw new Error("database is locked"); }
+  };
+  for (const input of [
+    { dryRun: true },
+    { dryRun: false, confirm: true },
+    { dryRun: false } // confirm-required 那份报告也是这里算的（#410）
+  ]) {
+    const out = reclaimReply({ maintenance, ...input, warn: (m) => warnings.push(String(m)) });
+    assert.equal(out.status, 500, "三条会调 reclaim 的路径都必须回 500，不能无响应");
+    assert.deepEqual(out.body, { error: "internal" });
+  }
+  assert.equal(warnings.length, 3);
+  for (const w of warnings) {
+    assert.match(w, /storage reclaim failed/);
+    assert.match(w, /database is locked/, "原始错误文本要留住，否则现场无从下手");
+  }
+});
+
+test("reclaimReply: 没有 logger 也不许把异常漏出去", () => {
+  // warn 是可选的（数据面可能没接 logger）。少一个回调不能让异常穿出去变成
+  // unhandled rejection——那正是 #410 的形态：客户端拿到的是「一个字节都没回」。
+  const maintenance = { reclaim() { throw new Error("boom"); } };
+  const out = reclaimReply({ maintenance, dryRun: false });
+  assert.equal(out.status, 500);
+});
+
+// ---------------------------------------------------------------------------
+// 防分叉：口径只许有一份实现
+// ---------------------------------------------------------------------------
+test("两个入口都不许再自己写一份回收口径", () => {
+  // 每个字面量都是这张脸独有的：出现第二次就意味着又复制了一段校验/答复出去。
+  const FORKED = [
+    '"invalid-older-than-days"',
+    '"invalid-vacuum"',
+    '"confirm-required"',
+    '"maintenance-unavailable"',
+    "storage reclaim failed",
+    "MAX_RECLAIM_WINDOW_DAYS"
+  ];
+  for (const name of ["api.js", "api-standalone.js"]) {
+    const src = readFileSync(join(ROOT, "src", name), "utf8");
+    for (const literal of FORKED) {
+      assert.equal(
+        src.includes(literal),
+        false,
+        `src/${name} 里不该再出现 ${literal}——回收口径只有 src/reclaim-http.js 一份`
+      );
+    }
+    // 反向也要锁：光删掉字面量、不调共用模块，等于把功能删了。
+    assert.ok(src.includes("reclaim-http.js"), `src/${name} 必须从共用模块取口径`);
+  }
+  const panel = readFileSync(join(ROOT, "src", "api.js"), "utf8");
+  const data = readFileSync(join(ROOT, "src", "api-standalone.js"), "utf8");
+  assert.ok(panel.includes("reclaimReply("), "面板侧要真的走共用答复");
+  assert.ok(data.includes("reclaimReply("), "数据面要真的走共用答复");
+  assert.ok(panel.includes("readReclaimFields("), "面板侧 POST 要真的走共用校验");
+  assert.ok(data.includes("readReclaimFields("), "数据面要真的走共用校验");
+});

package/test/service.test.js

@@ -53,7 +53,10 @@ test("injectCandidates returns preferences + high-importance items within limit"
   const types = candidates.map((c) => c.type);
   assert.ok(types.includes("preference"), "preferences included");
   assert.ok(types.includes("project"), "high-importance project included");
-  assert.ok(!types.includes("history"), "history excluded by default");
+  // #369：history 曾被注入白名单挡在门外，现按「注入侧收编」进池（理由与实测数字
+  // 见 src/service.js 的 INJECT_TYPES 注释）。这里从「锁排除」改成「锁收编」——
+  // 白名单日后若被收窄，这条会红，而不是静默把两成条目关回不可注入。
+  assert.ok(types.includes("history"), "history included since #369");
   assert.ok(candidates.length <= 5, "respects maxItems");
 });
 
@@ -220,7 +223,9 @@ test("Bug4: injectCandidates with an empty query keeps the legacy rule-based sel
   assert.deepEqual(noQuery.map((c) => c.id), legacy.map((c) => c.id), "empty query behaves identically to the old logic");
   assert.deepEqual(blankQuery.map((c) => c.id), legacy.map((c) => c.id), "whitespace-only query degrades too");
   assert.equal(legacy[0].type, "summary", "summary still leads");
-  assert.ok(!legacy.some((c) => c.type === "history"), "history still excluded");
+  // #369 收编后 history 可进池；本用例的重心是「空查询与旧规则路逐字节同序」，
+  // 这条只确认收编没有撼动优先级分层——summary 仍打头。
+  assert.ok(legacy.some((c) => c.type === "history"), "history included since #369");
 });
 
 test("Bug4: injectCandidates ignores the query when hybridInject is disabled", () => {