@modusensus/dsh-mneme 0.8.15 → 0.9.0

package/test/publish-gate.test.js

@@ -0,0 +1,272 @@
+// scripts/publish-gate.mjs 的回归测试。
+//
+// 这一步的价值全在「不许假绿」上：原先的 Verify published version 是
+//   echo "Published: $(npm view "@modusensus/dsh-mneme@${V}" version)"
+// 命令替换里的失败不让 `set -e` 退出 —— v0.8.16 那次日志里明明 `404 No match found for version
+// 0.8.16`，step 与 job 却都是 success。下面第一条与第三条各自钉住两端：
+//   · 版本已在 registry（幂等跳过路径）→ 立刻通过，不为传播延迟白等；
+//   · 等满预算仍看不见 → 必须 `ok:false` 且入口退出 1。
+// 谁要是把「拿不到」改成「跳过校验」或「返回成功」，第三条会红。
+//
+// 全部用例走假时钟 + 注入 probe：零网络、零真实等待，跑起来是毫秒级。
+// 还有一条走真进程（spawnSync）的端到端用例：工作流红不红只看真进程退出码，函数级断言钉不到
+// 「主模块判别 + process.exitCode」那条路径。
+import test from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import {
+  DEFAULT_INTERVAL_MS,
+  DEFAULT_TIMEOUT_MS,
+  PACKAGE_NAME,
+  main,
+  parseArgs,
+  probeVersion,
+  versionUrl,
+  waitForPublished
+} from "../scripts/publish-gate.mjs";
+
+/** 被测入口的真实路径：端到端用例要把它当子进程跑起来。 */
+const scriptDir = dirname(fileURLToPath(import.meta.url));
+
+/** 假时钟：只有 sleep() 会让时间前进，于是超时逻辑可以确定性断言。 */
+function fakeClock() {
+  let t = 0;
+  return {
+    now: () => t,
+    sleep: async (ms) => { t += ms; },
+    slept: () => t
+  };
+}
+
+const noop = () => {};
+
+/** 前 `misses` 次报 404、之后可见的 probe；锁的是「重试真的发生了」。 */
+function probeMissingTimes(misses, { version = "0.8.16" } = {}) {
+  let calls = 0;
+  return async () => {
+    calls += 1;
+    if (calls <= misses) return { ok: false, reason: "missing", detail: "HTTP 404，registry 上还看不到" };
+    return { ok: true, version, tarball: "https://registry.npmjs.org/x/-/x-0.8.16.tgz" };
+  };
+}
+
+test("版本已在 registry：首次探测即通过，不为传播延迟白等（幂等跳过路径）", async () => {
+  const clock = fakeClock();
+  let sleeps = 0;
+  const result = await waitForPublished("0.8.16", {
+    now: clock.now,
+    sleep: async (ms) => { sleeps += 1; await clock.sleep(ms); },
+    probe: probeMissingTimes(0),
+    log: noop
+  });
+  assert.equal(result.ok, true);
+  assert.equal(result.attempts, 1);
+  assert.equal(result.waitedMs, 0);
+  assert.equal(sleeps, 0, "已发布路径不该有任何等待");
+});
+
+test("传播延迟：前两次 404、第三次可见 → 通过，且等待时间与重试次数如实报出", async () => {
+  const clock = fakeClock();
+  const result = await waitForPublished("0.8.16", {
+    now: clock.now,
+    sleep: clock.sleep,
+    intervalMs: 15000,
+    probe: probeMissingTimes(2),
+    log: noop
+  });
+  assert.equal(result.ok, true);
+  assert.equal(result.attempts, 3);
+  assert.equal(result.waitedMs, 30000, "两次间隔的等待要计入");
+  assert.ok(result.tarball.includes("0.8.16"));
+});
+
+test("等满预算仍看不见：必须 ok:false + reason timeout（防的就是 v0.8.16 那种假绿）", async () => {
+  const clock = fakeClock();
+  const result = await waitForPublished("0.8.16", {
+    now: clock.now,
+    sleep: clock.sleep,
+    timeoutMs: 30000,
+    intervalMs: 15000,
+    probe: probeMissingTimes(Infinity),
+    log: noop
+  });
+  assert.equal(result.ok, false, "拿不到版本时绝不是成功");
+  assert.equal(result.reason, "timeout");
+  assert.equal(result.attempts, 3, "t=0 / 15s / 30s 各一次探测");
+  assert.equal(result.waitedMs, 30000);
+  assert.match(result.lastError, /404/);
+});
+
+test("探测自己耗时到超过预算、但回来时版本已可见：仍然通过（预算约束等待，不约束判定）", async () => {
+  // 锁的是刻意选择：单次探测带 HTTP 超时，晚到的成功最多超出预算十几秒；而版本真的在 registry 上
+  // 就是发布成功，为晚到几秒判红是假红——闸门要消灭的是假绿，不该顺手制造另一种失真。
+  const clock = fakeClock();
+  const result = await waitForPublished("0.8.16", {
+    now: clock.now,
+    sleep: clock.sleep,
+    timeoutMs: 15000,
+    intervalMs: 15000,
+    probe: async () => {
+      await clock.sleep(20000); // 这一次探测自己就把预算耗穿了
+      return { ok: true, version: "0.8.16", tarball: "" };
+    },
+    log: noop
+  });
+  assert.equal(result.ok, true);
+  assert.equal(result.attempts, 1);
+  assert.equal(result.waitedMs, 20000);
+});
+
+test("预算不是间隔整数倍时：最后一轮只睡到超时点，不多睡一整轮", async () => {
+  const clock = fakeClock();
+  const result = await waitForPublished("0.8.16", {
+    now: clock.now,
+    sleep: clock.sleep,
+    timeoutMs: 20000,
+    intervalMs: 15000,
+    probe: probeMissingTimes(Infinity),
+    log: noop
+  });
+  assert.equal(result.ok, false);
+  assert.equal(result.attempts, 3, "t=0 / 15s / 20s（最后一次落在超时点上）");
+  assert.equal(result.waitedMs, 20000);
+  assert.equal(clock.slept(), 20000, "总睡眠时间恰为预算，而不是 30000");
+});
+
+test("网络异常同样计入重试（既不崩也不当作成功），最终以最后一次原因报出", async () => {
+  const clock = fakeClock();
+  let calls = 0;
+  const result = await waitForPublished("0.8.16", {
+    now: clock.now,
+    sleep: clock.sleep,
+    timeoutMs: 15000,
+    intervalMs: 15000,
+    probe: async () => { calls += 1; return { ok: false, detail: `请求失败：fetch failed（第 ${calls} 次）` }; },
+    log: noop
+  });
+  assert.equal(result.ok, false);
+  assert.equal(result.attempts, 2, "异常也继续重试");
+  assert.match(result.lastError, /第 2 次/, "报的是最后一次原因");
+});
+
+test("probe 返回形状异常（undefined）也不炸，按拿不到处理", async () => {
+  const clock = fakeClock();
+  const result = await waitForPublished("0.8.16", {
+    now: clock.now,
+    sleep: clock.sleep,
+    timeoutMs: 0,
+    intervalMs: 15000,
+    probe: async () => undefined,
+    log: noop
+  });
+  assert.equal(result.ok, false);
+  assert.equal(result.reason, "timeout");
+});
+
+test("默认预算：超时 10 分钟 / 间隔 15 秒（覆盖实测 ~4.5 分钟的传播延迟）", () => {
+  assert.equal(DEFAULT_TIMEOUT_MS, 600000);
+  assert.equal(DEFAULT_INTERVAL_MS, 15000);
+});
+
+test("versionUrl：scoped 包名整体编码，origin 尾斜杠不重复", () => {
+  assert.equal(
+    versionUrl(PACKAGE_NAME, "0.8.16"),
+    "https://registry.npmjs.org/%40modusensus%2Fdsh-mneme/0.8.16"
+  );
+  assert.equal(
+    versionUrl(PACKAGE_NAME, "0.8.16", "https://registry.npmjs.org/"),
+    "https://registry.npmjs.org/%40modusensus%2Fdsh-mneme/0.8.16"
+  );
+});
+
+test("probeVersion：404 = 还没传播，200 且版本一致 = 可见（带 tarball）", async () => {
+  const missing = await probeVersion("0.8.16", {
+    fetchImpl: async () => ({ ok: false, status: 404, json: async () => ({}) })
+  });
+  assert.equal(missing.ok, false);
+  assert.equal(missing.reason, "missing");
+
+  const found = await probeVersion("0.8.16", {
+    fetchImpl: async () => ({
+      ok: true,
+      status: 200,
+      json: async () => ({ version: "0.8.16", dist: { tarball: "https://registry.npmjs.org/x/-/x-0.8.16.tgz" } })
+    })
+  });
+  assert.equal(found.ok, true);
+  assert.equal(found.tarball, "https://registry.npmjs.org/x/-/x-0.8.16.tgz");
+});
+
+test("probeVersion：请求抛错 / 5xx / 响应不是 JSON / 版本对不上，都折成 ok:false 而不抛", async () => {
+  const net = await probeVersion("0.8.16", { fetchImpl: async () => { throw new Error("fetch failed"); } });
+  assert.equal(net.reason, "network");
+
+  const http = await probeVersion("0.8.16", { fetchImpl: async () => ({ ok: false, status: 500, json: async () => ({}) }) });
+  assert.equal(http.reason, "http");
+
+  const badJson = await probeVersion("0.8.16", {
+    fetchImpl: async () => ({ ok: true, status: 200, json: async () => { throw new Error("boom"); } })
+  });
+  assert.equal(badJson.reason, "bad-json");
+
+  const mismatch = await probeVersion("0.8.16", {
+    fetchImpl: async () => ({ ok: true, status: 200, json: async () => ({ version: "0.8.15" }) })
+  });
+  assert.equal(mismatch.ok, false);
+  assert.equal(mismatch.reason, "mismatch");
+});
+
+test("parseArgs：位置参数给版本号，可覆盖预算；缺版本号如实回报", () => {
+  assert.deepEqual(parseArgs(["0.8.16"]), { ok: true, version: "0.8.16", timeoutMs: 600000, intervalMs: 15000 });
+  assert.deepEqual(parseArgs(["0.8.16", "--timeout-ms", "1000", "--interval-ms", "500"]), {
+    ok: true, version: "0.8.16", timeoutMs: 1000, intervalMs: 500
+  });
+  assert.equal(parseArgs([]).reason, "missing-version");
+  assert.equal(parseArgs(["0.8.16", "0.8.17"]).reason, "missing-version");
+  assert.equal(parseArgs(["0.8.16", "--timeout-ms", "abc"]).ok, false);
+});
+
+test("入口退出码：通过 → 0；超时 → 1 且 stderr 指明去翻 publish 步日志", async () => {
+  const logs = [];
+  const errors = [];
+  const okCode = await main(["0.8.16"], {
+    log: (line) => logs.push(line),
+    error: (line) => errors.push(line),
+    wait: async (version) => ({ ok: true, version, attempts: 1, waitedMs: 0, tarball: "" })
+  });
+  assert.equal(okCode, 0);
+  assert.equal(errors.length, 0);
+
+  const failCode = await main(["0.8.16"], {
+    log: noop,
+    error: (line) => errors.push(line),
+    wait: async () => ({ ok: false, reason: "timeout", attempts: 40, waitedMs: 600000, lastError: "HTTP 404" })
+  });
+  assert.equal(failCode, 1, "闸门未通过必须以非零退出让 job 变红");
+  assert.ok(errors.some((line) => line.includes("发布闸门未通过")));
+  assert.ok(errors.some((line) => line.includes("publish 步")));
+});
+
+test("入口退出码：缺版本号 → 1 并打印用法", async () => {
+  const errors = [];
+  const code = await main([], { log: noop, error: (line) => errors.push(line), wait: async () => ({ ok: true }) });
+  assert.equal(code, 1);
+  assert.ok(errors.some((line) => line.includes("用法")));
+});
+
+test("真进程端到端：不存在的版本 → 退出码 1 且 stderr 指明原因（这一步红了 job 才会红）", () => {
+  // 单测里的 main() 是函数调用，钉不到「主模块判别 + process.exitCode」这条真实退出路径——而
+  // 工作流红不红只看真进程的退出码。目标版本刻意取一个永不存在、与发布无关的名字：registry 回
+  // 404（连不上网络则是 network 原因），两种都会走到同一个超时分支，所以这条例外不引入网络依赖。
+  const result = spawnSync(
+    process.execPath,
+    [join(scriptDir, "..", "scripts", "publish-gate.mjs"), "0.0.0-mneme-gate-test", "--timeout-ms", "1", "--interval-ms", "1"],
+    { encoding: "utf8" }
+  );
+  assert.equal(result.status, 1, `期望非零退出，实际 ${result.status}（stderr: ${result.stderr}）`);
+  assert.match(result.stderr, /发布闸门未通过/);
+  assert.match(result.stdout, /等待 @modusensus\/dsh-mneme@0\.0\.0-mneme-gate-test/);
+});

package/test/recall-retention.test.js

@@ -0,0 +1,128 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { createStore } from "../src/store.js";
+
+// 2026-10-14 找回：recall_runs 的滚动清理（函数 + 启动调用）在 dd0ed78「release:
+// v0.7.12」里被整块弄丢，而配置键 recallRetentionDays、README.md 与
+// docs/CONFIGURATION.md 一直宣称它有保留期 —— 于是本机那张表只增不减，没人发现
+// （2026-10-13 当天实测就从 16,041 涨到 20,510 行）。
+//
+// 这组测试故意分两半，因为**弄丢的正是「两半都在」这件事**：
+//   1. 行为锁：函数真的删对行、边界正确、空表不炸；
+//   2. 接线锁：index.js 的启动块真的调它，且读的是装配后的 cfg（不是 rawCfg）。
+// 只锁 1 不锁 2，函数写得再对也没人调；只锁 2 不锁 1，调用调的可能是空壳。
+// 第二半用源码文本断言，理由与 test/client.test.js 的 bilingual 锁同款：这是
+// 「接线还在不在」的问题，运行时冒烟测不到一个**在运维时才会跑**的启动分支。
+
+const here = dirname(fileURLToPath(import.meta.url));
+const srcText = (name) => readFileSync(join(here, "..", "src", name), "utf8");
+
+function seedRun(store, { query, createdAt }) {
+  store.saveRecallRun({
+    query,
+    mode: "auto",
+    topK: 5,
+    threshold: null,
+    candidates: [],
+    created_at: createdAt
+  });
+}
+
+const daysAgo = (n) => new Date(Date.now() - n * 86400000).toISOString();
+
+test("保留期：删掉窗口外的行、留下窗口内的行，返回值是真实删除数", () => {
+  const store = createStore(":memory:");
+  seedRun(store, { query: "老", createdAt: daysAgo(120) });
+  seedRun(store, { query: "也老", createdAt: daysAgo(91) });
+  seedRun(store, { query: "新", createdAt: daysAgo(89) });
+  seedRun(store, { query: "很新", createdAt: daysAgo(1) });
+
+  const removed = store.purgeRecallRunsOlderThan(90);
+  assert.equal(removed, 2, "只有窗口外的两行该被删");
+
+  // 两侧都排过再比：assert 的是「留下了哪两行」，不是它们的物理顺序
+  const left = store.listRecallRunsSince(daysAgo(3650)).rows.map((r) => r.query).sort();
+  assert.deepEqual(left, ["很新", "新"].sort());
+  store.close();
+});
+
+test("保留期：边界按字典序比较，窗口内的留、窗口外的删（两侧各留 1 小时裕量）", () => {
+  const store = createStore(":memory:");
+  // 不骑刀刃：cutoff 是在**清理那一刻**用 Date.now() 现算的，而造数据也取一次
+  // Date.now()，测试跑几毫秒就足以让「正好 90 天前」翻到界外。这里两侧各留
+  // 1 小时，锁的是比较方向（`created_at < cutoff` 才删），不是毫秒级巧合。
+  const boundary = 90 * 86400000;
+  seedRun(store, { query: "窗口内一小时", createdAt: new Date(Date.now() - boundary + 3600000).toISOString() });
+  seedRun(store, { query: "窗口外一小时", createdAt: new Date(Date.now() - boundary - 3600000).toISOString() });
+
+  const removed = store.purgeRecallRunsOlderThan(90);
+  assert.equal(removed, 1, "越过界的才删，贴近界的要留");
+  assert.deepEqual(store.listRecallRunsSince(daysAgo(3650)).rows.map((r) => r.query), ["窗口内一小时"]);
+  store.close();
+});
+
+test("保留期：空表返回 0，不抛（清理是 bookkeeping，不许挡启动）", () => {
+  const store = createStore(":memory:");
+  assert.equal(store.purgeRecallRunsOlderThan(90), 0);
+  store.close();
+});
+
+test("接线锁：index.js 启动块真的调 purgeRecallRunsOlderThan，且读装配后的 cfg", () => {
+  const index = srcText("index.js");
+  assert.match(index, /store\.purgeRecallRunsOlderThan\(recallRetentionDays\)/,
+    "启动期必须真的调用清理——这对曾在 dd0ed78 里双双蒸发");
+  assert.match(index, /cfg\.recallRetentionDays/,
+    "必须读装配后的 cfg（面板改保留期才生效），不能读 rawCfg");
+  // 失败必须真的出声。这一对当初就是**无声**蒸发的：函数与调用一起没了、没人发现，
+  // 表涨到两万余行。清理再失败一次若仍然静默，同一类回归照样看不见——所以这里
+  // 两个方向都锁：接住（catch(err)，不 rethrow、不挡启动）与出声（真调 logger.warn）。
+  // 只锁「不挡启动」会放过静默吞，只锁「出声」会放过把异常抛出去挡启动。
+  const at = index.indexOf("store.purgeRecallRunsOlderThan(recallRetentionDays)");
+  assert.ok(at > 0, "启动期必须真的调用清理——这对曾在 dd0ed78 里双双蒸发");
+  const tail = index.slice(at, at + 600);
+  assert.match(tail, /catch \(err\) \{/, "清理失败要接住，不许挡插件启动");
+  assert.match(tail, /ctx\.logger\?\.warn\?\.\(/, "清理失败要 warn 出声，静默吞等于把回归再藏一次");
+  // 就近确认它落在同一族启动清理之间：失败表 → llm_audit → distill → recall_runs
+  const llm = index.indexOf("store.deleteOldLlmAudits");
+  const distill = index.indexOf("store.clearDistillRecords");
+  assert.ok(llm > 0 && distill > 0 && at > llm, "recall_runs 清理应排在 llm_audit 之后");
+  assert.ok(at > distill, "recall_runs 清理应排在 distill_records 之后（与现有启动顺序一致）");
+});
+
+test("接线锁：store.js 导出 purgeRecallRunsOlderThan（函数存在但没导出同样是断线）", () => {
+  const store = srcText("store.js");
+  assert.match(store, /function purgeRecallRunsOlderThan\(days\)/);
+  assert.match(store, /^\s*purgeRecallRunsOlderThan,\s*$/m, "必须在 createStore 的返回对象里导出");
+  assert.match(store, /DELETE FROM recall_runs WHERE created_at < \?/);
+});
+
+// 启动期清理是**一族的四个兄弟**：失败表 / llm_audit / distill_records / recall_runs。
+// 上面那条只锁了 recall_runs 一个，但四个的注释互相引用（llm_audit 那条原文写着
+// 「失败只 warn，与失败表清理同款」），而 2026-10-14 实测前三个全是
+// `catch { /* non-fatal */ }` —— 静默吞，与注释宣称的相反。recall_runs 那一对当初
+// 就是无声蒸发的，所以这一族必须一起锁：只要有一个偷偷退回静默吞，这条就红。
+test("接线锁：四个启动期清理都必须出声（catch(err) + logger.warn，不许静默吞）", () => {
+  const index = srcText("index.js");
+  const family = [
+    ["失败表", "store.deleteOldFailures("],
+    ["llm_audit", "store.deleteOldLlmAudits("],
+    ["distill_records", "store.clearDistillRecords("],
+    ["recall_runs", "store.purgeRecallRunsOlderThan(recallRetentionDays)"]
+  ];
+  for (const [label, call] of family) {
+    const at = index.indexOf(call);
+    assert.ok(at > 0, `${label} 的启动期清理调用必须在（弄丢过一次的就是这一族）`);
+    const tail = index.slice(at, at + 700);
+    assert.match(tail, /catch \(err\) \{/, `${label} 清理失败要接住，不许挡插件启动`);
+    assert.match(tail, /ctx\.logger\?\.warn\?\.\(/, `${label} 清理失败要 warn 出声，静默吞等于把回归再藏一次`);
+  }
+});
+
+test("接线锁：配置键与文档对外宣称的保留期一致（键还在、默认 90 天）", () => {
+  const cfgText = srcText("config.js");
+  assert.match(cfgText, /recallRetentionDays: z\.natural\(\)\.min\(1\)\.max\(3650\)\.default\(90\)/,
+    "配置键被改或删掉时，这条和文档一起要动——别让文档继续说谎");
+});

package/test/recall-stats.test.js

@@ -124,21 +124,106 @@ test("windowDays/exemptDays 越界回默认；扫描超上限标 truncated", ()
 
 // ============================ 第五指标（#275）：归档净增速率 + 可压掉行数
 
-test("归档净增速率：按 updated_at 取归档时刻，窗外归档只进总数不进净增", () => {
+test("归档净增速率：按 archived_at 取归档时刻，窗外归档只进总数不进净增", () => {
   const { store, service } = setup();
   const fresh = service.saveWithDedupe({ type: "history", title: "刚归档", content: "x", importance: 3 }).memory;
   const old = service.saveWithDedupe({ type: "history", title: "早归档", content: "y", importance: 3 }).memory;
   service.saveWithDedupe({ type: "history", title: "活跃件", content: "z", importance: 3 });
   store.setArchived(fresh.id, true);
   store.setArchived(old.id, true);
-  // 归档时刻 = 最后一次写（setArchived 刷 updated_at）：把这行推到窗口外
-  store.db.prepare("UPDATE memories SET updated_at = ? WHERE id = ?")
+  // 精确口径：归档时刻是 archived_at 列（#275 第二批），把这行推到窗口外
+  store.db.prepare("UPDATE memories SET archived_at = ? WHERE id = ?")
     .run(new Date(Date.now() - 100 * 86400000).toISOString(), old.id);
 
   const stats = service.recallStats({ windowDays: 30, exemptDays: 0 });
   assert.equal(stats.archive.total, 2, "归档区现有行数（活跃件不算）");
   assert.equal(stats.archive.addedInWindow, 1, "窗外那次归档不算本窗口净增");
   assert.equal(stats.archive.perDay, Math.round((1 / 30) * 100) / 100);
+  assert.equal(stats.archive.undated, 0, "两行都有 archived_at，都不算时刻不可追溯");
+  store.close();
+});
+
+test("回归锁：归档后再 memory_update 刷 updated_at，不得算作本窗口新进归档", () => {
+  // 本批的核心回归锁。代理口径下归档时刻取 updated_at（setArchived 刷它），于是
+  // 「对已归档行做一次普通更新」就会把旧归档算成窗口内新进，perDay 偏高——这正是
+  // #275 第二批要消灭的假阳性。任何人把 recall-stats 改回 Date.parse(m.updated_at)
+  // 或改回 `m.archived_at ?? m.updated_at`，本用例立刻失败。
+  const { store, service } = setup();
+  const m = service.saveWithDedupe({ type: "history", title: "早归档", content: "x", importance: 3 }).memory;
+  store.setArchived(m.id, true);
+  store.db.prepare("UPDATE memories SET archived_at = ? WHERE id = ?")
+    .run(new Date(Date.now() - 100 * 86400000).toISOString(), m.id);
+  // 已归档行上的一次普通更新：updated_at 被刷到当下，archived_at 必须岿然不动
+  store.update(m.id, { content: "改过一遍" });
+  const row = store.getById(m.id);
+  assert.ok(
+    Date.parse(row.updated_at) > Date.now() - 60000,
+    "前提成立：update 确实把 updated_at 刷到了当下（否则本用例是恒真的）"
+  );
+
+  const stats = service.recallStats({ windowDays: 30, exemptDays: 0 });
+  assert.equal(stats.archive.total, 1);
+  assert.equal(stats.archive.addedInWindow, 0, "旧归档不因一次 update 变成窗口新进");
+  assert.equal(stats.archive.perDay, 0);
+  store.close();
+});
+
+test("取消归档清空 archived_at；再次归档重新落新时刻", () => {
+  const { store } = setup();
+  const m = store.save({ type: "history", title: "t", content: "c" });
+  const archived = store.setArchived(m.id, true);
+  assert.ok(archived.archived_at, "活跃 → 归档：落当前时刻");
+
+  const restored = store.setArchived(m.id, false);
+  assert.equal(restored.archived, false);
+  assert.equal(restored.archived_at, undefined, "取消归档清 NULL（toRow 读作 undefined，不是陈旧时刻）");
+
+  const again = store.setArchived(m.id, true);
+  assert.ok(again.archived_at, "重新归档重新落时刻");
+  assert.notEqual(again.archived_at, archived.archived_at, "是新一次归档，不是复用旧时刻");
+  store.close();
+});
+
+test("幂等：重复归档不刷新 archived_at（否则重复调用又变成一次净增）", () => {
+  // 代理口径被推翻的两个假阳性之一就是「对同一行重复调 setArchived(true)」。精确
+  // 口径下重复归档不是新一次归档，时刻保持首次值；刷新它就等于把旧毛病换个入口复活。
+  const { store } = setup();
+  const m = store.save({ type: "history", title: "t", content: "c" });
+  const first = store.setArchived(m.id, true);
+  const second = store.setArchived(m.id, true);
+  const third = store.setArchived(m.id, true);
+  assert.equal(second.archived_at, first.archived_at);
+  assert.equal(third.archived_at, first.archived_at);
+  store.close();
+});
+
+test("存量归档行（archived_at 为 NULL）计入 undated，不静默顶替成窗口新进", () => {
+  // NULL = 本列落地前就已归档的行，归档时刻不可追溯。用 updated_at 顶替就是退回被
+  // 推翻的代理口径；按 0 充数则是把「不知道」伪装成「没有」。这里锁的是第三种做法：
+  // 单独计数、不计入 addedInWindow。
+  const { store, service } = setup();
+  const m = service.saveWithDedupe({ type: "history", title: "存量归档", content: "x", importance: 3 }).memory;
+  store.setArchived(m.id, true);
+  store.db.prepare("UPDATE memories SET archived_at = NULL WHERE id = ?").run(m.id);
+
+  const stats = service.recallStats({ windowDays: 30, exemptDays: 0 });
+  assert.equal(stats.archive.total, 1);
+  assert.equal(stats.archive.addedInWindow, 0, "时刻不可追溯 → 不算窗口新进");
+  assert.equal(stats.archive.undated, 1, "单独暴露，不伪装成 0");
+  store.close();
+});
+
+test("口径升级不波及其他四项指标：归档行照旧不进活跃 / 僵尸 / 豁免", () => {
+  const { store, service } = setup();
+  service.saveWithDedupe({ type: "project", title: "活跃", content: "x", importance: 3 });
+  const arch = service.saveWithDedupe({ type: "project", title: "归档", content: "y", importance: 3 }).memory;
+  store.setArchived(arch.id, true);
+
+  const stats = service.recallStats({ windowDays: 30, exemptDays: 0 });
+  assert.equal(stats.zombie.activeCount, 1, "归档行不算活跃");
+  assert.equal(stats.zombie.zombieCount, 1, "零曝光的活跃行照旧算僵尸");
+  assert.equal(stats.zombie.exemptCount, 0);
+  assert.equal(stats.archive.total, 1);
   store.close();
 });
 
@@ -183,7 +268,7 @@ test("没有归档行时给 0，不返回 null / NaN", () => {
   service.saveWithDedupe({ type: "project", title: "只有活跃", content: "x", importance: 3 });
   const stats = service.recallStats({ windowDays: 30, exemptDays: 0 });
   assert.deepEqual(stats.archive, {
-    total: 0, addedInWindow: 0, perDay: 0, compressible: { rows: 0, groups: 0 }
+    total: 0, addedInWindow: 0, perDay: 0, undated: 0, compressible: { rows: 0, groups: 0 }
   });
   store.close();
 });