@modusensus/dsh-mneme 0.8.15 → 0.9.0

package/test/client.test.js

@@ -600,9 +600,12 @@ test("explorer chrome aligns with the host design system", () => {
     /\.mneme-vtab\.mneme-active::after/.test(clientSource),
     "active sub-tabs use the host underline treatment"
   );
+  // #178：这里原本直接断言宿主品牌蓝。宿主蓝在浅色画布上只有 4.23:1，对 13px
+  // 正文不足 AA，所以面板改用自己的语义色层 --mneme-accent（同一条宿主 token
+  // 往 label-primary 方向混 15%），换肤仍跟随宿主。意图不变：激活态是品牌蓝。
   assert.ok(
-    clientSource.includes(".mneme-vtab.mneme-active{color:var(--dsw-alias-state-business-primary)}"),
-    "active sub-tab text must turn the host brand blue"
+    clientSource.includes(".mneme-vtab.mneme-active{color:var(--mneme-accent)}"),
+    "active sub-tab text must turn the host brand blue (via the panel accent layer)"
   );
   assert.equal(
     /\.mneme-xmain\{[^}]*border:1px/.test(clientSource),
@@ -664,6 +667,48 @@ test("heat badges render from the /list projection and self-hide when off", () =
   );
 });
 
+// Token 去向三屏（#412）：前端只拿 by_day 的稀疏行渲染两种时间尺度，三个坑
+// 都在这一层，且都是「不报错但图错了」的静默失效，所以锁形状而非锁行为：
+// ① 柱状图必须补连续 7 天——by_day 是 GROUP BY 的稀疏结果，直接映射会缺列；
+// ② 热力图的 56 格必须来自独立的 days=56 请求——复用 days=7 的响应会让 56 格
+//    里 48 格恒 0（图看着正常，其实只有一周有数据）；
+// ③ 开合不能挂在 details 上——details 的 onClick 会连折叠区子卡片的点击一起
+//    吃掉（preventDefault 拦掉冒泡的激活事件），必须挂 summary。
+test("token flow: 7-day bars pad to a continuous week, heatmap uses its own 56-day window", () => {
+  // ① 连续 7 天：右端对齐今天 UTC，缺日填 0
+  assert.ok(
+    /Array\.from\(\{ length: 7 \}/.test(clientSource),
+    "the 7-day bars must be generated as a fixed 7-slot array, not mapped straight off by_day"
+  );
+  assert.ok(
+    /rawDayMap\.get\(key\) \?\? 0/.test(clientSource),
+    "missing days must fill 0 so the x-axis stays a continuous week"
+  );
+  // stats 为 null（未到）与 {}（已知为空）必须分开：前者不画柱，后者补零
+  assert.ok(
+    /const rawDays = stats && Array\.isArray\(stats\.by_day\) \? stats\.by_day : null;/.test(clientSource),
+    "an unloaded response must stay null, else the loading state paints 7 zero bars"
+  );
+  // ② 热力图独立 56 天窗口
+  assert.ok(
+    clientSource.includes('llm-audit/stats?days=56'),
+    "the heatmap must issue its own days=56 request"
+  );
+  assert.ok(
+    /heatStats && Array\.isArray\(heatStats\.by_day\)/.test(clientSource),
+    "the heatmap must read heatStats.by_day, not stats.by_day"
+  );
+  // ③ 开合挂 summary，不挂 details
+  assert.ok(
+    !/className: "mneme-legacy",\s*\n\s*open: legacyOpen,\s*\n\s*onClick/.test(clientSource),
+    "the click handler must not sit on <details>: it swallows clicks from child cards"
+  );
+  assert.ok(
+    /h\("summary", \{ onClick: \(e\) => \{ e\.preventDefault\(\); setLegacyOpen\(!legacyOpen\); \} \}/.test(clientSource),
+    "the toggle must be bound on <summary>, the native disclosure handle"
+  );
+});
+
 // 巩固/睡眠模型路由 UI：下拉数据来自宿主侧已注册适配器（/llm-providers，
 // 云端插件侧端点），「测试连通性」走 POST /test-model 真实最小调用。旧后端
 // 端点 404 时必须回退纯文本输入——前端自门控，不挡旧版本。
@@ -794,8 +839,9 @@ test("stale route values are marked and explained at the row level (issue #191)"
     "the en stale hint must cover provider-absence too, not only the model case"
   );
   // 4. issue #215：三条路由各自透传自己的档位键——routeSelects 按路由行
-  // 传入键名、从生效配置取值；sleep 无回退重试，档位被拒时测试是事前唯一
-  // 的暴露口。
+  // 传入键名、从生效配置取值。（曾在此断言「sleep 无回退重试，测试是事前
+  // 唯一的暴露口」：该前提自 939fbfc 起就不成立——sleep/梦/蒸馏都走
+  // withEffortFallback，档位被拒会丢字段重试，测试从不是唯一暴露口。）
   assert.ok(
     /const routeSelects = \(providerKey, modelKey, testState, setTestState, effortKey\) => \{/.test(clientSource)
       && /const effort = effortKey \? \(eff\[effortKey\] \|\| ""\) : ""/.test(clientSource),
@@ -815,6 +861,31 @@ test("stale route values are marked and explained at the row level (issue #191)"
   );
 });
 
+// 探针降级的如实呈现（issue #215 后续）：后端档位被拒时不再 502，而是丢字段
+// 重试成功 + effortDropped:true。面板必须把「连通了、但不是按你配的档位」讲出来
+// ——静默成功和静默失败一样有害：前者让人以为档位生效，后者把人赶去换 Provider。
+test("panel surfaces a downgraded connectivity test instead of a silent success or a red failure", () => {
+  // 1. 只有后端明确置位才算降级（旧后端无字段 → 不误报）
+  assert.ok(
+    /dropped: j\.effortDropped === true/.test(clientSource),
+    "the panel must read effortDropped strictly (=== true) so an older backend never renders a phantom downgrade"
+  );
+  // 2. 降级文案只在成功行追加，失败行不得出现（失败就是失败，别混进降级措辞）
+  assert.ok(
+    /\(testState\.ok && testState\.dropped \? " · " \+ t\("memory\.features\.modelTestDowngraded"\) : ""\)/.test(clientSource),
+    "the downgrade note must be appended only on the success line"
+  );
+  // 3. 双语词表各一条（按行首的 "key": "…" 计数，与上面的全键计数锁同口径；
+  //    用 split 会把渲染处的 t("…") 一起数进来，那是 3 次不是 2 次）
+  const tableRows = clientSource.match(/^\s*"memory\.features\.modelTestDowngraded"\s*:\s*"/gm) || [];
+  assert.equal(tableRows.length, 2, `memory.features.modelTestDowngraded must be declared exactly twice in the tables (zh + en), got ${tableRows.length}`);
+  // 4. 那条陈旧前提不得复活：面板不得再声称 sleep/梦 侧无回退重试
+  assert.ok(
+    !/无回退重试|无回退|no fallback retry/.test(clientSource),
+    "the panel must not re-assert the stale 'no fallback retry' claim that withEffortFallback already covers"
+  );
+});
+
 // 帮助与反馈入口（v0.8）：设置页底部三个反馈链接——GitHub 新建 issue 预填
 // （环境信息）、邮件反馈、浏览已知问题。纯前端链接零后端成本；插件版本从
 // /info 拉取（version 只读，不铺任何 token/凭据）。公开链接不得带个人邮箱。
@@ -941,6 +1012,41 @@ test("scope isolation ships panel switches and provenance surfaces (A4)", () =>
   assert.ok(clientSource.includes('t("memory.explorer.detail.occurred")'), "drawer must render occurred row");
 });
 
+// Issue #427：设置面板把折叠线从「冷门」挪到「新手之外」。锁四件事：
+// ①首屏层 = 常用组（3 总开关）+ 作用域组——scope 留在首屏是因为「它记的东西
+// 会不会被别的会话看到」是新用户的必答题，藏进折叠等于没答；②其余组整组收进
+// 「全部设置」（第一层折叠），「高级」降为它内部的第二层；③每条开关挂
+// 「默认 / 已改」徽标，信号取自 overrides（键不在其中 = 仍是 config schema
+// 默认值），面板自判、不加后端字段；④分组与折叠键中英成对。验收口径：首屏
+// 可点项 = 3 总开关 + autoInject 的 2 个子开关 + scope 2 开关 + 「全部设置」
+// 按钮 = 8（≤ 8），由 ①② 的组成正则共同钉死，不另数 DOM。
+test("settings card folds everything beyond the first screen behind All settings (issue #427)", () => {
+  // ① 首屏层组成：两组都要在，且 basic 的成员是从 core/dream 移走的。
+  assert.ok(/const FEATURE_FIRST_SCREEN = \["group\.basic", "group\.scope"\];/.test(clientSource),
+    "the first screen must be exactly the basic and scope groups");
+  assert.ok(/key: "group\.basic", items: \["autoInject", "autoSummarize", "autoDream"\]/.test(clientSource),
+    "group.basic must carry exactly the three master switches");
+  assert.ok(!/key: "group\.core", items: \["autoInject/.test(clientSource) && !/key: "group\.dream", items: \["autoDream/.test(clientSource),
+    "basic members must be MOVED out of their old groups (render-once), not filtered at render time");
+  // ② 两层折叠的接线：restGroups 只在 showAll 展开后渲染；「高级」按钮出现在
+  // 「全部设置」之后（同一渲染分支内），showAdv 展开的条目走第二层。
+  assert.ok(/showAll && h\(react\.Fragment, null,\s*restGroups\.map\(renderGroup\)/.test(clientSource),
+    "the remaining groups must render only behind the All settings fold");
+  const allBtn = clientSource.indexOf('t("memory.features.allToggle")');
+  const advBtn = clientSource.indexOf('t("memory.features.advancedToggle")');
+  assert.ok(allBtn >= 0 && advBtn > allBtn, "the advanced fold must be nested after All settings");
+  assert.equal(clientSource.match(/const FEATURE_ADVANCED_BOOLS = \[([^\]]*)\];/)[1].split(",").filter((s) => s.trim()).length, 7,
+    "the advanced second tier must hold exactly the 7 rarer switches the label promises");
+  // ③ 徽标：两类各一套中英文案；判定读 overrides 本地判，不引入后端字段。
+  for (const key of ["memory.features.tagDefault", "memory.features.tagChanged",
+    "memory.features.group.basic", "memory.features.allToggle", "memory.features.advancedToggle"]) {
+    const occurrences = clientSource.split("\"" + key + "\"").length - 1;
+    assert.ok(occurrences >= 2, `i18n key ${key} must exist in both zh and en (got ${occurrences})`);
+  }
+  assert.ok(clientSource.includes("Object.prototype.hasOwnProperty.call(ovr, k)"),
+    "the default/changed badge must be decided from overrides, not a new backend field");
+});
+
 // v0.8.0 冲突集中处理：状态页的待确认冲突队列（reason + 双方内容对比 +
 // 保留 A/B/仅标记动作），resolveConflictPending 的第一个前端出口。双语齐备。
 test("conflict queue ships a central review surface on the status tab", () => {
@@ -1217,6 +1323,313 @@ test("mcp card: mount snippet is copyable and token-keyed to the external API",
     assert.ok(occurrences >= 2, `i18n key ${key} must exist in both zh and en (got ${occurrences})`);
   }
 });
+// --- #400 冲突裁决窗可读性（报障原话：窗口太小又不能放大，完全对比不了内容，只好
+// 两个都删或胡乱选一个）---
+// 锁四件事：展开切换存在且默认收起（折叠态仍走 140 字预览，既有布局不回归）；
+// 展开态渲染未截断全文并去掉 diff 的行数钳制；判读依据行（类型/重要度/字数/
+// 新旧 + 单侧复制）在位；窄容器降级单列。缺任何一条，报障就复发。
+test("conflict queue: expandable full text with decision metadata", () => {
+  assert.ok(clientSource.includes('"memory.status.conflictQueue.expand"'), "collapsed state must offer 展开全文");
+  assert.ok(clientSource.includes('"memory.status.conflictQueue.collapse"'), "expanded state must offer 收起全文");
+  assert.ok(clientSource.includes('"aria-expanded": open'), "the toggle must expose aria-expanded");
+  assert.ok(/open \? \(s\.content \|\| ""\) : \(s\.content \|\| ""\)\.slice\(0, 140\)/.test(clientSource),
+    "collapsed keeps the 140-char preview while expanded must render untruncated content");
+  assert.ok(clientSource.includes("mneme-conflict-diff--full"), "expanded diff must drop the 4-line clamp");
+  // 展开态高度上限必须与视口无关：宿主可能把面板放进零高视口（隐藏 webview /
+  // 后台页），那时 vh 会算成 0px，「展开全文」直接看不见字——肉眼验收实测踩过。
+  assert.ok(clientSource.includes("max-height:28em"), "expanded height cap must be viewport-independent");
+  assert.equal(/\.mneme-conflict-(diff--full|text)\{[^}]*\d+vh/.test(clientSource), false,
+    "conflict expand rules must not use vh");
+  assert.ok(clientSource.includes('"memory.status.conflictQueue.chars"'), "each side must show its length");
+  assert.ok(clientSource.includes('"memory.status.conflictQueue.updated"'), "each side must show which one is newer");
+  assert.ok(clientSource.includes("copySide"), "each side must be copyable for external comparison");
+  assert.ok(clientSource.includes("@container (max-width:560px){.mneme-conflict-pair{grid-template-columns:1fr}}"),
+    "a narrow panel must fall back to one column instead of two unreadable halves");
+  for (const key of [
+    "memory.status.conflictQueue.expand",
+    "memory.status.conflictQueue.collapse",
+    "memory.status.conflictQueue.copySide",
+    "memory.status.conflictQueue.copiedSide",
+    "memory.status.conflictQueue.importance",
+    "memory.status.conflictQueue.chars",
+    "memory.status.conflictQueue.updated",
+    "memory.status.conflictQueue.created"
+  ]) {
+    const occurrences = clientSource.split(`"${key}"`).length - 1;
+    assert.ok(occurrences >= 2, `i18n key ${key} must exist in both zh and en (got ${occurrences})`);
+  }
+});
+
+// #386 第 5 条：面板手动新增记忆。这一块最容易悄悄退化——菜单项被删掉、弹层被
+// 从树里摘掉、或者表单又长回 scope/sensitivity 输入框（那会绕开详情抽屉的「放宽
+// 可见性」二次确认），面板表面上看不出坏，只是入口没了。所以既锁「入口存在」，
+// 也锁「入口真的挂在树上」。
+test("panel can create a memory by hand: menu entry wired to the dialog", () => {
+  // 入口在「更多操作」菜单里，且菜单项真的调用 setCreateOpen(true)——只断言文案
+  // 存在的话，把 onClick 摘掉测试照样绿。
+  assert.ok(clientSource.includes('"memory.explorer.newMemory"'), "menu entry label must exist");
+  assert.ok(/role: "menuitem", onClick: \(\) => \{ setCreateOpen\(true\); setMenuOpen\(false\); \}/.test(clientSource),
+    "the menu item must actually open the create dialog");
+  assert.ok(clientSource.includes("const [createOpen, setCreateOpen] = useState(false)"),
+    "the dialog needs its own open state");
+  // 弹层必须挂在树上并接上回调：onCreated 同时刷新列表与选中新行（并入既有条目时
+  // 返回的 id 是被并入那一行，也该滚进视野）。
+  assert.ok(/createOpen && h\(CreateDialog, \{/.test(clientSource), "the dialog must be mounted conditionally");
+  assert.ok(/onCreated: \(d\) => \{ setReloadKey\(\(k\) => k \+ 1\); if \(d && d\.id\) setSelectedId\(d\.id\); \}/.test(clientSource),
+    "creating must refresh the list and select the resulting row");
+  // 打后端的路由是 /create，不是 standalone 的 /memories：面板与工具必须走同一条
+  // saveWithDedupe 路径，否则「同标题并入」的提示在面板上会失灵。
+  assert.ok(clientSource.includes('apiFetch("/api/dsh-mneme/create"'),
+    "the dialog must post to the panel create route");
+  assert.ok(/d\.action === "merged" \? t\("memory\.explorer\.newMerged"\) : t\("memory\.explorer\.newCreated"\)/.test(clientSource),
+    "merged and created are different facts and must be reported differently");
+  // 弹层源码切片：下面「表单里有什么 / 没有什么」的断言一律在这段上做。在整包上做
+  // 等于没锁——这些字段名在 bundle 里到处都是，`clientSource.includes("title")` 恒真。
+  const dialogStart = clientSource.indexOf("function CreateDialog");
+  const dialogEnd = clientSource.indexOf("function MemoryExplorer", dialogStart);
+  assert.ok(dialogStart >= 0 && dialogEnd > dialogStart, "CreateDialog must be findable in the bundle");
+  const dialogSource = clientSource.slice(dialogStart, dialogEnd);
+  // 表单字段与 memory_save 工具对齐，且锁的是**真实请求体写法**：多一个字段（比如
+  // scope/sensitivity）这段就匹配不上，少一个 trim 也匹配不上。锁裸字段名会恒真。
+  assert.match(dialogSource,
+    /JSON\.stringify\(\{\s*type,\s*title: title\.trim\(\),\s*content: content\.trim\(\),\s*importance,\s*tags: tags\.split\(","\)\.map\(\(s\) => s\.trim\(\)\)\.filter\(Boolean\)\s*\}\)/,
+    "the create request body must carry exactly type/title/content/importance/tags");
+  // 成功路径**不得**重置 busy：提示要停 900ms 才关窗，这期间按钮若重新可点，第二次
+  // 同 type+title 会落进同一行并把正文再追加一遍（service 走 appendContent），一次
+  // 误触就写坏一条记忆。所以全弹层只允许 catch 那条路重置 busy。
+  assert.equal(dialogSource.split("setBusy(false)").length - 1, 1,
+    "only the error path may reset busy; the success path must stay disabled until the dialog closes");
+  assert.match(dialogSource, /\.catch\(\(\) => \{ setBusy\(false\); setErr\(t\("memory\.explorer\.newFailed"\)\); \}\)/,
+    "the single busy reset must be the error path");
+  // 按钮文案同理：成功后 busy 仍为 true，若只看 busy，写入早就完成了按钮还写着「保存
+  // 中…」——既骗用户又和旁边那行「已新建」自相矛盾。msg 一置上就切回正常文案。
+  assert.match(dialogSource, /busy && !msg \? t\("memory\.explorer\.newSaving"\) : t\("memory\.explorer\.newConfirm"\)/,
+    "once the write succeeded the button must stop claiming it is still saving");
+  assert.equal(/newScope|sensitivity/.test(dialogSource), false,
+    "the create form must not offer scope/sensitivity: that path bypasses the widen-confirm guard");
+  // document 不在类型下拉里：铸造口唯一（registerDocument，#230），后端也会 400。
+  assert.equal(dialogSource.includes('"document"'), false,
+    "document rows are minted only via registerDocument and must not be offered here");
+  // 类型白名单与 src/tools.js 的 memory_save enum 逐字一致（缺一个就会有人点进去才被拒）。
+  for (const k of ["preference", "project", "decision", "history", "rejected_solution", "pitfall", "constraint"]) {
+    assert.ok(dialogSource.includes(`"${k}"`), `type option ${k} must be offered`);
+  }
+  // 前端空值拦截只是省一次往返，服务端校验才是权威——但两者都得在，否则空标题会
+  // 一路发出去再弹一个 400 给用户看。
+  assert.ok(dialogSource.includes('if (!title.trim()) { setErr(t("memory.explorer.newNoTitle")); return; }'),
+    "empty title must be caught before the round trip");
+  assert.ok(dialogSource.includes('if (!content.trim()) { setErr(t("memory.explorer.newNoContent")); return; }'),
+    "empty body must be caught before the round trip");
+  // 十四个新键必须中英成对（与上面那条全局锁同口径，这里列出名字便于定位）。
+  for (const key of [
+    "memory.explorer.newMemory",
+    "memory.explorer.newTitle",
+    "memory.explorer.newHint",
+    "memory.explorer.newType",
+    "memory.explorer.newTitlePlaceholder",
+    "memory.explorer.newContentPlaceholder",
+    "memory.explorer.newTagsPlaceholder",
+    "memory.explorer.newConfirm",
+    "memory.explorer.newSaving",
+    "memory.explorer.newCreated",
+    "memory.explorer.newMerged",
+    "memory.explorer.newFailed",
+    "memory.explorer.newNoTitle",
+    "memory.explorer.newNoContent"
+  ]) {
+    const occurrences = clientSource.split(`"${key}"`).length - 1;
+    assert.ok(occurrences >= 2, `i18n key ${key} must exist in both zh and en (got ${occurrences})`);
+  }
+});
+// --- issue #386 第 4 条：存储回收卡（dry-run 预估 + 两步确认执行）---
+// 这是「不可逆的内容丢弃」在面板上的唯一入口，所以锁的不是「有没有这张卡」，而是三条
+// 不变量：执行必须两步、POST 必须逐字带确认门、VACUUM 失败不得渲染成干净的成功。
+// 所有断言都做在**卡片切片**上：路由串/dryRun/confirm 这些字面量在整包里到处都是，
+// 在 clientSource 上做 includes 恒真、等于没锁（#408 评审踩过的坑）。
+const maintCardSource = () => {
+  const start = clientSource.indexOf("function MaintenanceCard");
+  const end = clientSource.indexOf("function MirrorHealthCard", start);
+  assert.ok(start >= 0 && end > start, "MaintenanceCard must be findable in the bundle (切片锚点变了？)");
+  return clientSource.slice(start, end);
+};
+
+test("maintenance card: i18n keys are bilingual and the section is really rendered", () => {
+  for (const key of [
+    "memory.status.sec.maintenance",
+    "memory.status.maint",
+    "memory.status.maint.freelist",
+    "memory.status.maint.plannedInputs",
+    "memory.status.maint.plannedEmbeddings",
+    "memory.status.maint.window",
+    "memory.status.maint.windowUnit",
+    "memory.status.maint.windowLabel",
+    "memory.status.maint.reestimate",
+    "memory.status.maint.reestimating",
+    "memory.status.maint.stale",
+    "memory.status.maint.vacuum",
+    "memory.status.maint.vacuumHint",
+    "memory.status.maint.execute",
+    "memory.status.maint.confirm",
+    "memory.status.maint.running",
+    "memory.status.maint.cancel",
+    "memory.status.maint.confirmHint",
+    "memory.status.maint.badWindow",
+    "memory.status.maint.failed",
+    "memory.status.maint.done",
+    "memory.status.maint.size",
+    "memory.status.maint.reclaimed",
+    "memory.status.maint.clearedInputs",
+    "memory.status.maint.clearedEmbeddings",
+    "memory.status.maint.receipt",
+    "memory.status.maint.receiptNone",
+    "memory.status.maint.duration",
+    "memory.status.maint.vacuumRan",
+    "memory.status.maint.vacuumOff",
+    "memory.status.maint.vacuumFailed",
+    "memory.status.maint.vacuumFailedHint"
+  ]) {
+    // 数的是**字典行**（`"key": "` 顶格成行），不是裸字符串出现次数。裸数会把调用点
+    // 一起算进来：`t("...maint.done")` 在卡片里本来就有一次，删掉一整行英文译文之后
+    // 「字典 zh 行 + 调用点」照样凑够 2——锁恒真，就是这么漏的（本条第一版被 M1 变异
+    // 抓出来了）。行首锚定后，少一侧译文就只剩 1。
+    const entries = clientSource.match(new RegExp(`^\\s*"${key.replace(/\./g, "\\.")}"\\s*:\\s*"`, "gm"));
+    const count = entries ? entries.length : 0;
+    assert.equal(count, 2, `i18n key ${key} must appear as exactly one dictionary line per language (got ${count})`);
+  }
+  // 分区键只在字典里躺着不算加分区：必须真的渲染出「维护」这段扫读锚点。
+  assert.ok(clientSource.includes('h("div", { className: "mneme-statushead" }, t("memory.status.sec.maintenance"))'),
+    "the maintenance section head must render from the dictionary key");
+});
+
+test("maintenance card: the reclaim route is the in-process one, not the standalone data plane", () => {
+  const src = maintCardSource();
+  // 走 /api/dsh-mneme/... 这条 in-process 路由：它才有 requireAuth + 与 CLI 同一条
+  // reclaim 实现。写成 standalone 数据面的路径会绕开面板身份的鉴权口径。
+  assert.equal(src.split('"/api/dsh-mneme/maintenance/reclaim"').length - 1, 1,
+    "the card must name the in-process reclaim route exactly once (via its path constant)");
+  // 预估走 GET 且把窗口作为查询参数带上；粘在按钮上——键入即发会让数字在半截输入时跳。
+  assert.ok(src.includes("`${RECLAIM_PATH}?olderThanDays=${days}`"),
+    "re-estimating must GET the route with the current window as a query parameter");
+  assert.equal(src.split("onClick: estimate").length - 1, 1,
+    "only the re-estimate button may trigger an estimate (no request per keystroke)");
+  assert.ok(src.includes('onChange: (e) => setDays(e.target.value)'),
+    "typing in the window field must only update local state");
+});
+
+test("maintenance card: execution carries the verbatim dryRun:false + confirm:true gate", () => {
+  const src = maintCardSource();
+  // 逐字锁请求体：多一个字段、少一个空格、把 Number(days) 换成裸 days 都匹配不上。
+  // 锁裸字段名（dryRun/confirm）会恒真——它们在这段源码里各自还有别的出现位置。
+  assert.match(src,
+    /JSON\.stringify\(\{ dryRun: false, confirm: true, olderThanDays: Number\(days\), vacuum \}\)/,
+    "the executing body must be exactly dryRun:false + confirm:true + olderThanDays + vacuum");
+  // 全卡只有一处能改库：确认门之外的任何一次 POST 都是「第一次点就真清了」。
+  assert.equal(src.split('method: "POST"').length - 1, 1, "the card must issue exactly one POST");
+  assert.equal(src.split("dryRun: false").length - 1, 1, "exactly one mutating body may exist");
+  // 窗口非法时不得发请求：0 在服务端是「清掉全部快照」，畸形输入绝不能静默落进最坏解释。
+  assert.ok(src.includes('if (!/^\\d+$/.test(days)) { setError(t("memory.status.maint.badWindow")); setArmed(false); return; }'),
+    "a non-numeric window must be rejected locally before any round trip");
+  // 上界同样在本地拦：/^\d+$/ 放得过 1e20 与 400 位数字（后者化成 Infinity），后端
+  // 会回 400，但那时用户只看到一句「回收失败」，分不清是窗口不合法还是网络问题。
+  assert.match(src, /const MAX_WINDOW_DAYS = 3650;/,
+    "the card must carry the same upper bound as the backend");
+  assert.ok(src.includes('if (Number(days) > MAX_WINDOW_DAYS) { setError(t("memory.status.maint.badWindow")); setArmed(false); return; }'),
+    "an out-of-range window must be rejected locally, before any round trip");
+});
+
+test("maintenance card: 'no receipt' does not claim a single cause", () => {
+  // writeReceipt 返回 null 有两种成因：审计被关（config.llmAudit.enabled === false），
+  // 或回执写库失败（saveLlmAudit 抛错，只 warn）。旧文案「无（审计未启用）」把第二种
+  // 情况说成第一种——而这行出现在不可逆操作的结果区，用户会照它去对账。
+  for (const wording of [
+    '"memory.status.maint.receiptNone": "未记录（审计未启用或回执写入失败）"',
+    '"memory.status.maint.receiptNone": "Not recorded (audit disabled or receipt write failed)"'
+  ]) {
+    assert.ok(clientSource.includes(wording),
+      `the missing-receipt wording must name both causes: ${wording}`);
+  }
+});
+
+test("maintenance card: no window.confirm — the host webview cannot be relied on for it", () => {
+  const src = maintCardSource();
+  assert.equal(/window\.confirm/.test(src), false,
+    "window.confirm is not reliably available in the host webview; the in-card confirm state is the gate");
+  assert.equal(/(^|[^.\w])confirm\s*\(/.test(src), false,
+    "no blocking confirm() call may exist in the card (the confirm state is a rendered branch)");
+  assert.ok(src.includes("mneme-btndangerconfirm"),
+    "the armed state must use the repo's existing danger-confirm styling");
+});
+
+test("maintenance card: mounted in the status view under the maintenance section", () => {
+  // 组件存在但没挂上树 = 用户永远看不到，正是这条 issue 报的缺口。
+  const panelStart = clientSource.indexOf("function StatusPanel");
+  const panelEnd = clientSource.indexOf("function ", clientSource.indexOf("h(WorkbenchSection", panelStart));
+  assert.ok(panelStart >= 0 && panelEnd > panelStart, "StatusPanel must be findable in the bundle");
+  const panel = clientSource.slice(panelStart, panelEnd);
+  assert.ok(panel.includes("h(MaintenanceCard, { t })"),
+    "the status panel must render the maintenance card");
+  assert.ok(panel.includes('t("memory.status.sec.maintenance")'),
+    "the card must sit under the maintenance section head, not loose in the grid");
+});
+
+test("maintenance card: success state exists only behind the confirm gate", () => {
+  const src = maintCardSource();
+  // 第一次点只能「武装」，不得直连执行：默认态是红描边钮（mneme-btndanger），只有武装
+  // 后的实心红确认钮（mneme-btndangerconfirm）才允许调用 execute。
+  assert.match(src, /mneme-btndangerconfirm"[\s\S]{0,200}?onClick: execute/,
+    "only the armed danger-confirm button may fire the mutating call");
+  assert.match(src, /mneme-btndanger"[\s\S]{0,200}?onClick: \(\) => setArmed\(true\)/,
+    "the first click must only arm the confirm state, never execute");
+  assert.equal(src.split("onClick: execute").length - 1, 1,
+    "the executing click must have exactly one entry point in the card");
+  // 非 2xx 必须先 return，成功态才能写在它之后——否则失败也会渲染成成功。
+  const guard = src.indexOf("if (!r.ok) {");
+  const success = src.indexOf("setResult(r.body)");
+  assert.ok(guard >= 0 && success > guard,
+    "a non-2xx response must return before the success report is written");
+  assert.equal(src.split("setResult(r.body)").length - 1, 1,
+    "the success report must be written exactly once, from the confirmed call");
+  // 窗口改过却没重新估算时，确认态里摆出来的会是上一次的数字——对不可逆动作来说这是最坏
+  // 的一种错位，所以那种状态下执行钮必须是禁用的。
+  assert.ok(src.includes("const stale = !report || String(report.olderThanDays) !== days;"),
+    "an estimate that no longer matches the input must be detectable");
+  assert.match(src, /disabled: running \|\| loading \|\| estimating \|\| stale/,
+    "the run button must stay disabled while the estimate is stale");
+});
+
+// VACUUM 失败 ≠ 成功（契约 §5 的硬要求）。清理的两个 UPDATE 各自提交且不可逆，VACUUM
+// 只负责把文件缩回去；把半成功渲染成成功，用户会以为白清了一次。这条锁住那个三元分支，
+// 防止未来被「简化」成只看 dryRun/receipt。
+test("maintenance card: a failed VACUUM is reported, never rendered as a clean success", () => {
+  const src = maintCardSource();
+  assert.ok(src.includes("const vacuumError = rv.error == null ? null : String(rv.error);"),
+    "vacuum.error is string|null and must be read as the failure signal it is");
+  assert.match(src, /vacuumError \? t\("memory\.status\.maint\.vacuumFailed"\) : t\("memory\.status\.maint\.done"\)/,
+    "a non-null vacuum.error must replace the success headline");
+  assert.ok(src.includes('t("memory.status.maint.vacuumFailedHint")'),
+    "the failed state must state that the reclaim already happened, is irreversible, and that a rerun is idempotent");
+  // receipt 也要露面：不可逆动作没有回执号，出事时无法对账。锁的是**取值表达式**而不是
+  // 行标签——`t("...maint.receipt")` 只是左侧那行文案，把右侧渲染删空它照样在，锁标签
+  // 等于没锁（M12 变异验证过）。
+  assert.match(src, /result\.receipt == null \? t\("memory\.status\.maint\.receiptNone"\) : String\(result\.receipt\)/,
+    "the receipt value must be rendered (id when present, an explicit 'not recorded' when absent)");
+});
+
+test("maintenance card: VACUUM defaults to off and a failed run is reported verbatim", () => {
+  const src = maintCardSource();
+  // VACUUM 会短暂独占数据库（别的进程此时写入会 SQLITE_BUSY），它是**可选**动作，
+  // 默认必须关着——默认开等于每次回收都替用户独占一次库。契约 §5 的硬要求。
+  assert.ok(src.includes("const [vacuum, setVacuum] = useState(false);"),
+    "VACUUM must default to off");
+  // 非 2xx 必须把服务端给的 error 串如实带出来：只说「失败」，现场就分不清是 400 的
+  // confirm-required 还是 500 的 internal。
+  assert.ok(src.includes('setResultError(`${t("memory.status.maint.failed")} · ${(r.body && r.body.error) || `HTTP ${r.status}`}`);'),
+    "a non-2xx response must surface the server's own error string, not a bare 'failed'");
+  // 执行成功后必须复位确认态：否则下一次点击落在已武装的分支上，一步就把不可逆动作
+  // 放出去，两步确认名存实亡。
+  assert.match(src, /setResult\(r\.body\);\s*setArmed\(false\);/,
+    "the confirm state must be reset on the success path");
+});
 // 面板 bundle 在本文件里只被当**文本**读（上面的断言全是正则/字符串包含），
 // 而仓库的 CI 里没有任何一步**解析**它：于是重复声明这类语法错误能一路绿灯进
 // 主干，后果却是整个面板加载失败（__ModuleLoader__ 拿到的模块一执行就抛
@@ -1228,3 +1641,301 @@ test("client bundle parses: 面板产物必须是合法 JS（无重复声明等
   const result = spawnSync(process.execPath, ["--check", join(root, "lib/client.js")], { encoding: "utf8" });
   assert.equal(result.status, 0, `lib/client.js 解析失败：\n${result.stderr || result.stdout}`);
 });
+
+// #399 的两个留存键（distillRecords.enabled / retentionDays）此前只有后端
+// 白名单与 docs/CONFIGURATION.md 的「面板可启停」，面板里根本没有这一行——
+// 文档承诺了一个够不着的开关。补上 UI 之后，这条锁住四件容易被「简化」掉的事：
+//   ① 两个键真的进了渲染清单（enabled 在组里、retentionDays 在数值清单里）；
+//   ② 数值项的草稿必须从 effective 初始化——漏掉这一句，行会永远显示空值，
+//      用户以为配置丢了（#191 的睡眠路由键踩过同一个坑，见 :738 那条注释）；
+//   ③ 天数行必须由父开关门控（关着不留存，改天数没有意义）；
+//   ④ 非整数在本地就被挡下并把草稿退回生效值——留着非法文本会让人以为改成功了。
+test("distill retention switches are reachable from the panel (#399)", () => {
+  // 认「组里有没有」不要用 `"key"]` 这种子串——`eff["distillRecords.enabled"]`
+  // 也长这样，把组里那一项删掉它照样命中（变异验证实测：删项后仍全绿）。
+  // 必须把 core 组的 items 数组抠出来单独看。
+  const coreGroup = clientSource.match(/key: "group\.core", items: \[([\s\S]*?)\]/);
+  assert.ok(coreGroup, "the core group must be declared");
+  assert.ok(
+    coreGroup[1].includes('"distillRecords.enabled"'),
+    "distillRecords.enabled must be an item of the core group, not merely referenced elsewhere"
+  );
+  assert.ok(
+    /const FEATURE_NUMBERS = \["distillRecords\.retentionDays"\]/.test(clientSource),
+    "retentionDays must be in the numeric key list"
+  );
+  assert.ok(
+    /for \(const key of FEATURE_NUMBERS\) numDraft\[key\] = String\(e\[key\] \?\? ""\);/.test(clientSource)
+      && /setNums\(numDraft\);/.test(clientSource),
+    "the numeric draft must be seeded from effective on mount, or the row always renders empty"
+  );
+  assert.ok(
+    /const distillSub = eff\["distillRecords\.enabled"\] && h\("div", \{ className: "mneme-featsub" \},\s*\n\s*numRow\("distillRecords\.retentionDays"\)/.test(clientSource),
+    "the retention-days row must be gated on the parent switch and live in its sub-block"
+  );
+  // 定义了不等于接线了：把 distillSub 从组尾子块里摘掉，上面每条断言照样全绿
+  // （变异验证实测：摘掉后仍全绿）。子块是在 items.map 之后按组尾追加的，所以必须确认
+  // 它真的出现在那一个渲染点上。
+  const coreTail = clientSource.match(/g\.key === "group\.core" && h\(react\.Fragment, null, ([^)]*)\)/);
+  assert.ok(coreTail, "the core group must append its sub-blocks at the group tail");
+  assert.ok(
+    /\bdistillSub\b/.test(coreTail[1]),
+    "distillSub must be rendered at the core group tail, not merely declared above"
+  );
+  assert.ok(
+    /if \(!\/\^\\d\+\$\/\.test\(raw\)\) \{\s*\n\s*setNums\(\(c\) => \(\{ \.\.\.c, \[key\]: String\(eff\[key\] \?\? ""\) \}\)\);\s*\n\s*return;\s*\n\s*\}/.test(clientSource),
+    "a non-integer draft must be rejected locally and reverted to the effective value"
+  );
+  for (const key of [
+    "memory.features.distillRecords.enabled",
+    "memory.features.distillRecords.enabled.hint",
+    "memory.features.distillRecords.retentionDays",
+    "memory.features.distillRecords.retentionDays.hint"
+  ]) {
+    const occurrences = clientSource.split(`"${key}"`).length - 1;
+    assert.ok(occurrences >= 2, `i18n key ${key} must exist in both zh and en (got ${occurrences})`);
+  }
+});
+
+test("a rejected feature write is visible and reverts the draft", () => {
+  // 锁的是「保存失败从不显示」：错误提示原先只有一个座位、且带 `!state` 条件
+  // （首屏加载失败才渲染）——state 一到手，此后每次写入失败都静默，输入框里
+  // 留着没保存的值。整数项把「越界」变成可达路径后，人能在面板上看到 99999
+  // 却以为它生效了。
+  // 认「座位存在」不能只看 setSaveError 出现几次（函数里调它、渲染处读它，
+  // 两处都在就算命中），要把写入路径与渲染路径分别钉住。
+  assert.ok(
+    clientSource.includes('const [saveError, setSaveError] = useState("");'),
+    "save failures need their own state slot"
+  );
+  // 渲染座位必须在主卡片里（描述行之后、运行时块之前），而不是被 !state 挡住。
+  const descAt = clientSource.indexOf('h("div", { className: "mneme-set-desc" }, t("memory.features.desc"))');
+  const seatAt = clientSource.indexOf('saveError && h("div", { className: "mneme-mainterr" }, saveError)');
+  const provAt = clientSource.indexOf("h(RuntimeProvisionBlock, { t })");
+  assert.ok(descAt > 0 && seatAt > descAt, "the save-error seat must live in the main card body");
+  assert.ok(provAt > seatAt, "the seat must sit in the card header area, before the runtime block");
+  const earlyReturn = clientSource.match(/if \(error && !state\) return[\s\S]{0,300}?error\)\);/);
+  assert.ok(earlyReturn, "the load-failure early return must still be there");
+  assert.ok(!earlyReturn[0].includes("saveError"), "the save-error seat must not ride the load-failure branch");
+
+  // 写入路径：服务端 400 的 body 带着键名与范围（api.js 那条 400 的设计），
+  // 要读出来；失败要能被调用方看见，所以返回值必须是真假。
+  const putBody = clientSource.match(/const put = async \(patch\) => \{([\s\S]*?)\r?\n      \};/);
+  assert.ok(putBody, "put must be declared");
+  assert.ok(putBody[1].includes("const detail = await res.json()"), "the server error body must be read");
+  assert.ok(putBody[1].includes('throw new Error(detail || ("HTTP " + res.status));'), "the body must win over the bare status");
+  assert.ok(putBody[1].includes("return true;") && putBody[1].includes("return false;"), "put must report success");
+  assert.ok(putBody[1].includes("setSaveError(`"), "a rejected write must set the visible error");
+
+  // 两个提交路径都要在同一处退回生效值：只报错不退，框里的值仍与在用的值分家。
+  assert.ok(clientSource.includes("put({ [key]: raw }).then((ok) => {"), "a rejected string draft must be revertible");
+  assert.ok(clientSource.includes("put({ [key]: Number(raw) }).then((ok) => {"), "a rejected number draft must be revertible");
+  assert.ok((clientSource.split("if (!ok) setStrs(").length - 1) >= 1, "the string draft must revert on rejection");
+  assert.ok((clientSource.split("if (!ok) setNums(").length - 1) >= 1, "the number draft must revert on rejection");
+
+  const occurrences = clientSource.split('"memory.features.saveFailed"').length - 1;
+  assert.ok(occurrences >= 2, `i18n key memory.features.saveFailed must exist in both zh and en (got ${occurrences})`);
+});
+
+// ── M.O.（Modus Operandi）面板的数据面 ────────────────────────────────────────
+// 第一版面板拿硬编码的 PIPELINE_MOCK 验证形状与交互（服务端管线当时还没落地）。
+// 接上真数据之后那份常量必须消失：留着它，面板随时可能退回展示一份并不存在的
+// 工作流——而这正是这一刀要修掉的东西。这里锁「没有」比锁「有什么」更要紧。
+test("M.O. panel carries no mock pipeline data", () => {
+  assert.equal(
+    clientSource.includes("PIPELINE_MOCK"),
+    false,
+    "the hardcoded PIPELINE_MOCK must be gone now that the panel reads the server"
+  );
+});
+
+// 四个座位——会话头图标、会话头浮层、右栏 tab、对话行结算卡——必须读同一份投影。
+// 分家的事故长这样：会话头说有 3 条候选、右栏说有 5 条，而两个数字都对、没人查得出来。
+// 所以缓存只许有一处（usePipeline），其余要么从它取，要么经 PipelineBrowser 取。
+test("M.O. seats share a single pipeline document", () => {
+  assert.equal(
+    (clientSource.match(/function usePipeline\(/g) || []).length,
+    1,
+    "usePipeline must be defined exactly once — one cache, every seat"
+  );
+  const bodyOf = (name) => {
+    const start = clientSource.indexOf(`function ${name}(`);
+    assert.ok(start > -1, `${name} must exist`);
+    const next = clientSource.slice(start + 1).indexOf("\n    function ");
+    return clientSource.slice(start, next > -1 ? start + 1 + next : clientSource.length);
+  };
+  for (const seat of ["PipelineHeaderEntry", "TurnRunCard"]) {
+    assert.ok(
+      bodyOf(seat).includes("usePipeline(project, null)"),
+      `${seat} must read the shared pipeline document`
+    );
+  }
+  // 另两个座位不再自己调 hook：它们把 project 交给 PipelineBrowser，由它按 openId 决定
+  // 读清单还是读某一条。hook 不能条件调用，所以这道分叉必须落在**组件之间**而不是
+  // 一个组件里的 if/else——后者会在点开那一下炸成「Rendered more hooks than during
+  // the previous render」，而那是运行期才看得见的错。
+  assert.ok(
+    bodyOf("PipelinePane").includes("h(PipelineBrowser, { t, project })"),
+    "PipelinePane must delegate to PipelineBrowser"
+  );
+});
+
+// 清单与图**同屏**。这条锁的形状换过两次，两次的教训都写在这里，免得再翻回去：
+//   一进来就是图 —— 没有名字、没有落点，要的是一串有名字的条目；
+//   清单 ⟷ 图两屏来回切 —— 条目有了，但画布藏在一次点击后面、界面上没有任何提示，
+//                          反馈连着两次说「看不到画布和节点」。
+// 所以锁的是：清单行渲染名字/作用域/规模，**且** 图与清单在同一个组件里同时出现。
+test("M.O. browser shows the named list and the canvas on one screen", () => {
+  const bodyOf = (name) => {
+    const start = clientSource.indexOf(`function ${name}(`);
+    assert.ok(start > -1, `${name} must exist`);
+    const next = clientSource.slice(start + 1).indexOf("\n    function ");
+    return clientSource.slice(start, next > -1 ? start + 1 + next : clientSource.length);
+  };
+  const list = bodyOf("PipelineWorkflowList");
+  assert.ok(list.includes("row.title || row.id"), "each row must show a name");
+  assert.ok(list.includes("memory.actions.scope.project"), "each row must show its scope");
+  assert.ok(list.includes("memory.actions.list.meta"), "each row must show its size");
+  const browser = bodyOf("PipelineBrowser");
+  assert.ok(browser.includes("PipelineWorkflowList"), "the named list must be on screen");
+  assert.ok(
+    browser.includes("h(PipelineView, { t, data: detailDoc })"),
+    "the canvas must be on the SAME screen — not behind a click"
+  );
+  assert.ok(browser.includes("rows.length ? rows[0].id : null"), "the first workflow must be expanded by default");
+});
+
+// 面板读的是服务端投影，不是本地算的：工作流本体住仓库、投影住服务端，
+// 面板只负责画。路由一旦改了名字、或者项目根忘了带，这条会先红。
+test("M.O. panel reads the server projection", () => {
+  assert.match(
+    clientSource,
+    /"\/api\/dsh-mneme\/pipeline" \+/,
+    "the panel must fetch the pipeline route"
+  );
+  // 项目根是**客户端从会话读出来带过去的**，不是服务端猜的：插件侧的 ctx 上没有 cwd
+  // （只有 logger / llm / reflect / webServer / inject / commands），猜不出来。
+  assert.ok(
+    clientSource.includes('params.push("project=" + encodeURIComponent(project))'),
+    "the panel must pass the session's project root to the route"
+  );
+  assert.ok(
+    clientSource.includes("function sessionProject(ctx, sessionId)"),
+    "the session cwd lookup must exist and stay named"
+  );
+  // 两条来源的先后：会话列表快照（byId[sessionId].cwd）是宿主给客户端的公开形状，
+  // sessions.get() 是宿主侧写法、客户端不一定有。顺序反了不会报错，只会让面板静悄悄
+  // 退回全局层——那跟「本项目还没有工作流」长得一模一样，是最难查的一类错。
+  // 而且两条必须各兜各的异常：一条抛了不能把另一条也带走，否则同样表现成「项目未知」。
+  const sessionProjectBody = clientSource.slice(
+    clientSource.indexOf("function sessionProject("),
+    clientSource.indexOf("function layoutDag(")
+  );
+  assert.ok(
+    sessionProjectBody.indexOf("sessions.list.getSnapshot") <
+      sessionProjectBody.indexOf("typeof sessions.get"),
+    "the host's public shape (list snapshot) must be tried before the host-side accessor"
+  );
+  const betweenLookups = sessionProjectBody.slice(
+    sessionProjectBody.indexOf("sessions.list.getSnapshot"),
+    sessionProjectBody.indexOf("typeof sessions.get")
+  );
+  assert.ok(
+    betweenLookups.includes("catch (err)"),
+    "each lookup must carry its own catch — a throwing accessor must not take out the next one"
+  );
+});
+
+// 右栏 tab 的正文单独包了一层具名组件，而不是把 hook 直接塞进 slots.register 的回调里：
+// 那个回调是不是当组件渲染由宿主决定，赌错就是「Rendered more hooks than during the
+// previous render」这种只在运行时炸、测试看不见的错。
+test("right-pane tab renders a named component instead of a bare hook callback", () => {
+  assert.match(clientSource, /function PipelinePane\(/, "PipelinePane must exist");
+  assert.ok(
+    clientSource.includes(
+      "}, (props) => h(PipelinePane, { t, project: sessionProject(ctx, props && props.sessionId) }));"
+    ),
+    "the tab callback must delegate to the named PipelinePane component, with the session's project"
+  );
+});
+
+// 「仓库里还没有工作流」与「一条运行记录都没有」是两句不同的话，都得中英齐全——
+// i18n 掉一边，界面上就是一行 key 裸奔。作用域那三句尤其不能缺：清单行上「项目」
+// 与「全局」是唯一的来源提示，缺了它，人分不清手里这条是本项目的还是跟着插件来的。
+test("M.O. empty-state, list and scope copy exist in both languages", () => {
+  for (const key of [
+    "memory.actions.empty.title",
+    "memory.actions.empty.body",
+    "memory.actions.noRuns",
+    "memory.actions.zoom.in",
+    "memory.actions.zoom.out",
+    "memory.actions.zoom.fit",
+    "memory.actions.list.heading",
+    "memory.actions.list.count",
+    "memory.actions.list.meta",
+    "memory.actions.scope.project",
+    "memory.actions.scope.global",
+    "memory.actions.scope.none",
+    "memory.actions.broken"
+  ]) {
+    const hits = (clientSource.match(new RegExp(`"${key.replace(/\./g, "\\.")}":`, "g")) || []).length;
+    assert.equal(hits, 2, `${key} must exist in both zh and en (got ${hits})`);
+  }
+});
+
+// 画布能放大缩小。锁的重点不是「有没有缩放」，而是滚轮那一条必须**自己挂非被动监听**：
+// React 的 onWheel 挂在 root 上且是 passive 的，preventDefault 会被浏览器忽略，
+// 于是 Ctrl+滚轮既缩放画布又缩放整页，谁也没拦住——这个错本地测不出来，只在真浏览器里响。
+test("M.O. canvas zooms: buttons plus a non-passive, modifier-gated wheel listener", () => {
+  const bodyOf = (name) => {
+    const start = clientSource.indexOf(`function ${name}(`);
+    assert.ok(start > -1, `${name} must exist`);
+    const next = clientSource.slice(start + 1).indexOf("\n    function ");
+    return clientSource.slice(start, next > -1 ? start + 1 + next : clientSource.length);
+  };
+  const view = bodyOf("PipelineView");
+  assert.ok(view.includes("PipelineZoomBar"), "the zoom control must be rendered");
+  assert.ok(view.includes("{ passive: false }"), "the wheel listener must be non-passive, or preventDefault is ignored");
+  assert.ok(view.includes("ev.ctrlKey") && view.includes("ev.metaKey"), "plain wheel must stay a scroll, not a zoom");
+  assert.ok(view.includes('width: (zoom * 100) + "%"'), "zoom must change the layout width so the container can scroll to it");
+  const bar = bodyOf("PipelineZoomBar");
+  assert.ok(bar.includes("memory.actions.zoom.in"), "zoom in must be reachable by button, not only by wheel");
+  assert.ok(bar.includes("memory.actions.zoom.out"), "zoom out must be reachable by button");
+});
+
+// 「tab 的类型」与「tab 的正文」必须是两件互不相干的事，而且类型注册要幂等。
+// 为什么会栽（2026-10-16 真机上现形）：宿主对重复的类型 id 会抛
+// （sidebarRight: tab type id "…" is already registered），而类型注册挂在宿主服务上、
+// 插件重挂（刷新 / 热重载 / 会话重建）时**留着**，正文座位却是挂插件 scope、随插件回收的。
+// 两件事原来同一个 try —— 第二次挂载时那一抛把正文一起带走，界面上只剩宿主的 fallback
+// 「这类内容还没有可用的查看方式」，错误只在浏览器控制台里，界面上零痕迹。
+test("M.O. tab type registration is idempotent and isolated from the pane body", () => {
+  const typeAt = clientSource.indexOf("id: PIPELINE_ACTIONS_TAB_ID,");
+  const bodyAt = clientSource.indexOf('ctx.slots.inject("sidebar.right.pane.tab"');
+  assert.ok(typeAt > -1, "the tab type registration must exist");
+  assert.ok(bodyAt > typeAt, "the pane body registration must exist, after the type");
+  assert.ok(
+    clientSource.includes("tabs.get(PIPELINE_ACTIONS_TAB_ID)"),
+    "the type registration must be idempotent — a re-mount must not re-register the id"
+  );
+  assert.ok(
+    clientSource.slice(typeAt, bodyAt).includes("catch (err)"),
+    "the type registration must carry its own catch — its failure must not take out the pane body"
+  );
+});
+
+// 回归锁：M.O. 段里每个 .mneme-pipe-* 类名在样式表里只许有**一条**规则。
+// 为什么会栽在这里（2026-10-16，真机上才现形）：新写的详情屏容器与既有的「节点详情」面板
+// 撞了同名 .mneme-pipe-detail —— 后写的 flex:1 赢下冲突，先写的 max-height:180px; overflow:auto
+// 却留着，于是详情屏被钉在 180px、里面的画布 flex:1 分到 0 像素，屏幕上只剩空白加一条滚动条。
+// 只查颜色的 contrast.test.js 抓不到这类撞车；它只有在屏幕上看才现形，所以要在这里钉住。
+test("M.O. class names do not collide in the stylesheet", () => {
+  const declared = new Map();
+  for (const m of clientSource.matchAll(/"\.mneme-pipe-([a-z0-9-]+)\{/g)) {
+    declared.set(m[1], (declared.get(m[1]) || 0) + 1);
+  }
+  const dupes = [...declared].filter(([, n]) => n > 1).map(([k, n]) => `.mneme-pipe-${k}×${n}`);
+  assert.deepEqual(dupes, [], `duplicate .mneme-pipe-* rule(s): ${dupes.join(", ")}`);
+  // 扫描量也得钉：正则一旦匹配不到东西，上面那条会静默变绿（例如样式表被整块挪走）。
+  assert.ok(declared.size >= 20, `the scan must actually see the pipeline stylesheet (saw ${declared.size})`);
+});