@modusensus/dsh-mneme 0.9.0 → 0.9.2

package/test/pipeline.test.js

@@ -421,7 +421,7 @@ test("绕行不染色：被绕开不等于这一步坏了", () => {
   assert.equal(doc.nodes[0].credit.detoured, 1);
 });
 
-test(`跳过 ≥${RETIRE_AFTER_SKIPS} 次 → 提议删掉这一步`, () => {
+test(`必经步骤跳过 ≥${RETIRE_AFTER_SKIPS} 次 → drop-step 与 rework-path 并存（R2 新语义）`, () => {
   const pipeline = validatePipeline(minimal({
     steps: [
       { id: "A1", phase: "p", title: "这一步其实是多余的", when: "w", do: "d", who: "main", tool: "", done: "x", risk: "R0", needs: [], why: "y", evidence: ["e"] },
@@ -432,10 +432,24 @@ test(`跳过 ≥${RETIRE_AFTER_SKIPS} 次 → 提议删掉这一步`, () => {
                 { id: "r2", steps: [{ id: "A1", skipped: true }, { id: "A2" }] },
                 { id: "r3", steps: [{ id: "A1", skipped: true }, { id: "A2" }] }];
   const s = suggestRetirements(pipeline, { runs });
-  assert.equal(s.length, 1);
-  assert.equal(s[0].kind, "drop-step");
-  assert.equal(s[0].stepId, "A1");
-  assert.match(s[0].because, /跳过 3 次/);
+  // R2 新语义：必经的一步总被跳，删步（它可能多余）与修图（流程可能写错）两种读法
+  // **同时给人**——07 号文的教训：if/else 吞并会让一种提议永远发不出来。
+  assert.equal(s.some((x) => x.kind === "drop-step" && x.stepId === "A1"), true);
+  assert.equal(s.some((x) => x.kind === "rework-path" && x.stepId === "A1" && /必经/.test(x.because)), true);
+  assert.match(s.find((x) => x.kind === "drop-step").because, /跳过 3 次/);
+});
+
+test(`optional 步骤跳过再多次也绝不提议删（R2 新语义）`, () => {
+  const pipeline = validatePipeline(minimal({
+    steps: [
+      { id: "OPT", phase: "p", title: "可跑可不跑", when: "w", do: "d", who: "main", tool: "npm run lint", done: "x", risk: "R0", needs: [], why: "y", optional: true },
+      { id: "A2", phase: "p", title: "b", when: "w", do: "d", who: "main", tool: "", done: "x", risk: "R0", needs: ["OPT"], why: "y" }
+    ]
+  }));
+  const runs = [1, 2, 3, 4].map((i) => ({ id: `r${i}`, steps: [{ id: "OPT", skipped: true }, { id: "A2" }] }));
+  const s = suggestRetirements(pipeline, { runs });
+  assert.equal(s.some((x) => x.kind === "drop-step"), false, "可选步骤绝不提议删");
+  assert.equal(s.some((x) => x.kind === "optional-skip-ok"), true, "给信息项供人留意");
 });
 
 test(`绕开 ≥${RETIRE_AFTER_DETOURS} 次 → 提议重看这条路径（不是删节点）`, () => {
@@ -467,7 +481,7 @@ test("没到阈值就不提议；两种提议可以同时出现但各自独立",
                 { id: "r2", steps: [{ id: "A1", skipped: true, detoured: true }] },
                 { id: "r3", steps: [{ id: "A1", skipped: true, detoured: true }] }];
   const s = suggestRetirements(pipeline, { runs });
-  assert.deepEqual(s.map((x) => x.kind).sort(), ["drop-step", "rework-path"], "同一节点上两种提议互不吞并");
+  assert.deepEqual(s.map((x) => x.kind).sort(), ["drop-step", "rework-path", "rework-path"], "同一节点上两种提议互不吞并；必经被跳时 drop-step 与 rework-path 并存");
 });
 
 test("readPipelineDoc 带上 suggestions（没到阈值时是空数组，不是缺字段）", () => {
@@ -475,6 +489,123 @@ test("readPipelineDoc 带上 suggestions（没到阈值时是空数组，不是
   assert.ok(Array.isArray(doc.suggestions), "字段必须在——缺字段会让面板分不清「没有」和「读不到」");
 });
 
+// ── 字段白名单锁：给「静默掉字段」这个洞装一道闸 ────────────────────────────
+//
+// 为什么需要这道锁：`validatePipeline` 的步骤归一化是**显式字段映射**——白名单外的键
+// 会被无声丢弃，不告警、不报错。所以「往工作流里写一个新字段」的默认结局是「它消失了，
+// 而面板上看不出少了东西」。这正是本仓历史上反复抓到的那一类「声称改了但产物里查不到」。
+//
+// 探针实测过（三面逐个数）：往步骤里塞 `assert` / `onFailure` / `retries`，三个全部消失。
+// 将来真要加字段，就得同时改三处——归一化返回、节点投影、首屏清单——漏掉任何一处，
+// 症状都是「加了但看不见」，且**不会红**。这道锁把那个症状提前到测试里：
+// 谁动了字段集合，这里当场变红，逼人把三处一起改完、并把新集合写进断言。
+//
+// 反面提醒：断言里写的是**全集**而不是「包含」。包含式断言挡不住「多加了一个字段」，
+// 而多出来的字段同样会进投影、同样会被前端与 agent 读到——那也是一种契约变更。
+//
+// 2026-10-16：`assert` 正式进产品（这一步改了四处：校验、归一化返回、节点投影、
+// 首屏计数）。三处集合相应更新——**这道锁逼着人一次改完，正是它存在的理由**。
+
+const STEP_KEYS = [
+  "assert", "do", "done", "evidence", "gate", "id", "needs", "optional", "phase", "risk", "title", "tool", "when", "who", "why"
+];
+const NODE_KEYS = [
+  "action", "assert", "counterfactual", "credit", "done", "id", "kind", "phase", "risk", "situation",
+  "source", "state", "title", "tool", "who", "why"
+];
+const AVAILABLE_KEYS = [
+  "assertable", "contrast", "done", "file", "gates", "id", "project", "scope", "scopeLabel", "states",
+  "status", "steps", "title", "trigger", "version"
+];
+const NODE_STATE_KEYS = ["candidate", "refuted", "stale", "trusted"];
+
+test("字段白名单锁：步骤归一化只留这 14 个键，白名单外的键会被静默丢弃", () => {
+  const norm = validatePipeline(minimal({
+    steps: [{
+      id: "A1", phase: "准备", title: "第一步", when: "有人要跑", do: "做一件事",
+      who: "main", done: "做完了", risk: "R0", needs: [], why: "因为",
+      assert: ["npm test 全绿"],
+      // 这两个仍在白名单外：它们属执行侧，等形状定了再加，免得又造两个存不下的字段。
+      onFailure: "halt",
+      retries: 0
+    }]
+  }), "lock.json");
+
+  assert.deepEqual(Object.keys(norm.steps[0]).sort(), STEP_KEYS,
+    "步骤键集合变了。若这是有意的：请同时改 pipeline.js 的归一化返回、toPipelineV1 的节点投影、summarizePipeline 的首屏计数，再把这里的集合更新掉。");
+
+  // assert 现在留得住（这是 2026-10-16 那一刀要证明的事）
+  assert.deepEqual(norm.steps[0].assert, ["npm test 全绿"]);
+
+  // 仍被丢弃的两个：明写断言，将来若接住了这条会红，提醒更新契约与文档。
+  for (const key of ["onFailure", "retries"]) {
+    assert.equal(Object.prototype.hasOwnProperty.call(norm.steps[0], key), false,
+      `${key} 今天不该出现在归一化结果里；它出现了说明白名单被改过，请一并更新本锁与相关文档`);
+  }
+});
+
+test("字段白名单锁：节点投影 16 个键、首屏清单 15 个键，节点状态恒为四态", () => {
+  const norm = validatePipeline(minimal(), "lock.json");
+  const withOrigin = { ...norm, origin: { scope: "project", label: "demo", dir: "", file: "lock.json" } };
+
+  const v1 = toPipelineV1(withOrigin, {});
+  assert.deepEqual(Object.keys(v1.nodes[0]).sort(), NODE_KEYS,
+    "节点键集合变了——前端与 agent 读的是这一份，改它要同步面板");
+  assert.equal(v1.nodes[0].credit, null,
+    "没有运行记录时 credit 必须是 null——一个「补了默认值的空 credit 对象」会让前端以为「跑过但全是 0」");
+  const doc = readPipelineDoc({ projectRoot: REPO_ROOT });
+  assert.ok(doc.available.length >= 1);
+  assert.deepEqual(Object.keys(doc.available[0]).sort(), AVAILABLE_KEYS,
+    "首屏清单行的键集合变了——面板第一屏读的就是这一份");
+  assert.deepEqual(Object.keys(doc.available[0].states).sort(), NODE_STATE_KEYS,
+    "节点状态只能是这四态；多一态就意味着前端有分支没接");
+});
+
+test("可断言节点：没写断言时投影是 null 而不是空数组（「没写」不等于「写了没通过」）", () => {
+  const bare = validatePipeline(minimal(), "lock.json"); // minimal 的步骤没有 assert
+  const withOrigin = { ...bare, origin: { scope: "project", label: "demo", dir: "", file: "lock.json" } };
+  const v1 = toPipelineV1(withOrigin, {});
+
+  assert.equal(v1.nodes[0].assert, null,
+    "空数组会让「作者没写断言」与「写了但一条都没过」长得一样——验收时这是两件事");
+  // 首屏计数同样要说得清：0/1 是实话，不是缺陷。
+  const doc = readPipelineDoc({ projectRoot: REPO_ROOT });
+  assert.equal(typeof doc.available[0].assertable, "number");
+});
+
+test("可断言节点：写了断言就进投影与首屏计数，且逐条可读", () => {
+  const p = validatePipeline(minimal({
+    steps: [{
+      id: "A1", phase: "准备", title: "第一步", when: "有人要跑", do: "做一件事",
+      who: "main", done: "做完了", risk: "R0", needs: [], why: "因为",
+      assert: ["git tag 已推送", "release.yml 绿"]
+    }]
+  }), "lock.json");
+  const withOrigin = { ...p, origin: { scope: "project", label: "demo", dir: "", file: "lock.json" } };
+  const v1 = toPipelineV1(withOrigin, {});
+
+  assert.deepEqual(v1.nodes[0].assert, { checks: ["git tag 已推送", "release.yml 绿"], count: 2 });
+});
+
+test("可断言节点的形参校验：非数组、空串、非字符串都要拒（坏形状不许静默通过）", () => {
+  const base = {
+    id: "demo", name: "演示", project: "a/b", version: 0, status: "active", done: "做完",
+    trigger: [{ kind: "phrase", value: "跑一下" }],
+    steps: [{
+      id: "A1", phase: "准备", title: "第一步", when: "有人要跑", do: "做一件事",
+      who: "main", done: "做完了", risk: "R0", needs: [], why: "因为"
+    }]
+  };
+  const withAssert = (value) => validatePipeline(
+    { ...base, steps: [{ ...base.steps[0], assert: value }] }, "x.json");
+
+  assert.throws(() => withAssert("npm test 全绿"), /assert 必须是字符串数组/);
+  assert.throws(() => withAssert([""]), /assert\[0\] 必须是非空字符串/);
+  assert.throws(() => withAssert([42]), /assert\[0\] 必须是非空字符串/);
+  // 空数组是合法的：它就是「判断节点」，只是作者显式写了个空。
+  assert.deepEqual(withAssert([]).steps[0].assert, []);
+});
+
 // ── 候选路由：与工作流路由是两处不同的东西 ──────────────────────────────────
 
 test("路由 /api/dsh-mneme/candidates：读候选层，且把三条边界写进契约", async () => {

package/test/readme-claims.test.js

@@ -0,0 +1,68 @@
+// 两份 README 曾经都写着「默认全离线」「offline by default」「默认零网络依赖」——
+// 这与代码默认值相反：autoDream 与 autoSummarize 默认开（src/config.js），
+// 两者都把记忆正文交给 ctx.llm.stream(...)（src/dream.js / src/summarize.js）；
+// embedProvider 默认还是 "openai"，只有显式改成 "local"（ONNX）才真正离线。
+// 一句假话比不写更坏：读者会据此以为装完就能断网用，而它默认会把正文发给宿主模型。
+// 所以这里锁两件事：一、绝对离线声明不许回来；二、隐私节必须写出「巩固走宿主模型」这个出站事实——
+// 删掉假话后如果什么都不说，误导是一样的。
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+
+const pkgRoot = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const repoRoot = path.dirname(pkgRoot);
+const rootReadmePath = path.join(repoRoot, "README.md");
+
+// npm 的 files 清单把整个 test/ 打进包里，所以在 packed / installed 包里跑 npm test 时，
+// 这个文件照样会被执行——但那里没有仓库根 README（只有包内 dsh-mneme/README.md）。
+// 直接 readFileSync 会让整个测试文件在加载阶段 ENOENT 崩掉，把「不是这个仓」报成「断言失败」。
+// 所以仓库根不在时显式 skip：这条守卫的适用面本来就只是仓库，不该在包内假红。
+const hasRepoRoot = existsSync(rootReadmePath);
+const rootReadme = hasRepoRoot ? readFileSync(rootReadmePath, "utf8") : "";
+const pkgReadme = readFileSync(path.join(pkgRoot, "README.md"), "utf8");
+const outsideRepo = hasRepoRoot ? {} : { skip: "not a repo checkout: 仓库根 README 不存在（包内安装态）" };
+
+// 只锁「默认 / 无条件」的说法。带条件的离线表述（把 embedProvider 改成 local、离线巩固论文、
+// 运行时离线取件）都是真话，不在这个列表里，否则守卫会把正确写法也判红。
+const ABSOLUTE_CLAIMS = [
+  "默认全离线",
+  "默认零网络依赖",
+  "offline by default",
+  "Zero network dependency by default",
+  "完全离线的语义记忆引擎",
+];
+
+function section(text, heading) {
+  const start = text.indexOf(heading);
+  assert.ok(start >= 0, `README 里应有「${heading}」一节`);
+  const rest = text.slice(start + heading.length);
+  const next = rest.search(/\r?\n## /);
+  return next === -1 ? rest : rest.slice(0, next);
+}
+
+test("两份 README 都不许再把「离线」写成默认行为", outsideRepo, () => {
+  for (const [name, text] of [
+    ["README.md", rootReadme],
+    ["dsh-mneme/README.md", pkgReadme],
+  ]) {
+    for (const claim of ABSOLUTE_CLAIMS) {
+      assert.ok(!text.includes(claim), `${name} 仍含绝对离线声明：${claim}`);
+    }
+  }
+});
+
+test("隐私节必须写出「巩固与摘要走宿主模型」这个出站事实", outsideRepo, () => {
+  const zh = section(rootReadme, "## 隐私承诺");
+  assert.ok(zh.includes("宿主模型"), "中文隐私节应说明巩固与摘要走宿主模型");
+  assert.ok(
+    zh.includes("autoDream") || zh.includes("autoSummarize"),
+    "中文隐私节应点名 autoDream / autoSummarize，否则读者不知道是谁在出站",
+  );
+  const en = section(rootReadme, "## Privacy");
+  assert.ok(
+    en.includes("host model"),
+    "English Privacy section should disclose that consolidation uses the host model",
+  );
+});

package/test/reindex-backfill.test.js

@@ -28,13 +28,13 @@ test("Issue #128: fingerprint match no longer blocks backfill; archived rows are
   };
 
   const logs = [];
-  const indexed = await backfillMissingEmbeddings({
+  const summary = await backfillMissingEmbeddings({
     store, embedder, vectorIndex,
     logger: { info: (m) => logs.push(m) },
     rateLimitMs: 0
   });
 
-  assert.equal(indexed, 1, "the active row is backfilled despite the matching fingerprint");
+  assert.equal(summary.indexed, 1, "the active row is backfilled despite the matching fingerprint");
   assert.equal(store.getEmbeddings([active.id]).get(active.id)?.length, 3, "active row now carries a vector");
   assert.equal(store.getEmbeddings([dead.id]).get(dead.id), undefined, "archived row is skipped");
   assert.equal(vectorIndex.modelHash(), "mock-model#abc", "fingerprint unchanged (markModel idempotent)");
@@ -51,12 +51,91 @@ test("Issue #128: backfill is bounded by maxTotal; the rest stays queued", async
   const embedder = { embedSingle: async () => [1, 0, 0], modelHash: "h#1", dimension: 3 };
   const vectorIndex = createVectorIndex({ store });
 
-  const indexed = await backfillMissingEmbeddings({
+  const summary = await backfillMissingEmbeddings({
     store, embedder, vectorIndex,
     logger: { info() {} },
     maxTotal: 4, batchSize: 2, rateLimitMs: 0
   });
-  assert.equal(indexed, 4, "stops at the maxTotal bound");
+  assert.equal(summary.indexed, 4, "stops at the maxTotal bound");
+  // A capped run must SAY it was capped. The old bare-count return made a
+  // capped run indistinguishable from a run that drained the backlog.
+  assert.equal(summary.finishReason, "capped");
+  assert.equal(summary.stillStale, true, "reports that work remains");
   assert.equal(store.needsEmbedding(10).length, 1, "remaining rows stay queued for the next boot");
   store.close();
 });
+
+test("maxTotal: 0 drains the whole backlog in one run", async () => {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  for (let i = 0; i < 5; i++) {
+    service.saveWithDedupe({ type: "preference", title: `记忆${i}`, content: `内容${i}` });
+  }
+  const embedder = { embedSingle: async () => [1, 0, 0], modelHash: "h#1", dimension: 3 };
+  const vectorIndex = createVectorIndex({ store });
+
+  const summary = await backfillMissingEmbeddings({
+    store, embedder, vectorIndex,
+    logger: { info() {} },
+    maxTotal: 0, batchSize: 2, rateLimitMs: 0
+  });
+  assert.equal(summary.indexed, 5, "no cap: every row is embedded");
+  assert.equal(summary.finishReason, "drained");
+  assert.equal(summary.stillStale, false, "nothing left behind");
+  store.close();
+});
+
+test("a full-model switch re-embeds old vectors, not just the empty ones", async () => {
+  // The old selector only matched NULL/'' — vectors from the previous model
+  // stayed "present" forever and were never re-embedded, so they kept
+  // inflating coverage while being incomparable to the new query embedding.
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  const a = service.saveWithDedupe({ type: "preference", title: "旧向量", content: "甲" }).memory;
+  const b = service.saveWithDedupe({ type: "preference", title: "无向量", content: "乙" }).memory;
+  store.setEmbedding(a.id, [1, 0, 0], "old-model#aaa");
+  // b stays empty.
+
+  const embedder = { embedSingle: async () => [0, 1, 0], modelHash: "new-model#bbb", dimension: 3 };
+  const vectorIndex = createVectorIndex({ store });
+  const summary = await backfillMissingEmbeddings({
+    store, embedder, vectorIndex, logger: { info() {} }, rateLimitMs: 0
+  });
+
+  assert.equal(summary.indexed, 2, "both the stale-model row and the empty row are re-embedded");
+  assert.equal(summary.finishReason, "drained");
+  assert.equal(store.needsEmbeddingFor("new-model#bbb", 10).length, 0, "nothing stale remains");
+  const breakdown = store.embeddingModelBreakdown();
+  assert.equal(breakdown.length, 1, "every vector now carries the new model");
+  assert.equal(breakdown[0].model, "new-model#bbb");
+  assert.equal(breakdown[0].c, 2);
+  store.close();
+});
+
+test("rows with unknown provenance (NULL embedding_model) count as stale", async () => {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  const r = service.saveWithDedupe({ type: "preference", title: "存量", content: "丙" }).memory;
+  // Simulate a pre-migration row: vector present, provenance unknown.
+  store.setEmbedding(r.id, [1, 0, 0]);
+
+  assert.equal(store.needsEmbedding(10).length, 0, "old selector sees nothing to do");
+  assert.equal(store.needsEmbeddingFor("new-model#bbb", 10).length, 1, "new selector flags unknown origin");
+  assert.equal(store.hasStaleEmbedding("new-model#bbb"), true);
+  store.close();
+});
+
+test("setEmbedding records provenance and clearing the vector clears it", async () => {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  const r = service.saveWithDedupe({ type: "preference", title: "出身", content: "丁" }).memory;
+
+  store.setEmbedding(r.id, [1, 0, 0], "m#1");
+  assert.equal(store.embeddingModelBreakdown()[0].model, "m#1");
+
+  store.setEmbedding(r.id, null);
+  const row = store.db.prepare("SELECT embedding, embedding_model FROM memories WHERE id = ?").get(r.id);
+  assert.equal(row.embedding, null);
+  assert.equal(row.embedding_model, null, "a cleared vector never keeps a stale model name");
+  store.close();
+});

package/test/release-docs.test.js

@@ -0,0 +1,130 @@
+// 锁发布准备里「改文档表格」这一段的三件事，它们各自都静默失效过或随时会：
+//
+// 1. 根 README 的路线图版本列写的是两段式 **v0.9**，旧实现只认三段式 **v0.9.0**，于是
+//    对根 README 一个字节没改，打印的却是「无版本表格行，跳过」——把「没做」说成「不需要做」。
+// 2. 往 CRLF 文件里插一行而不显式保行尾，会把文件混成一半 CRLF 一半 LF（changelog-prep 踩过）。
+// 3. SECURITY.md 的支持版本表跨 minor 时必须由人挪格。脚本只核对；核对一旦退化成永真，
+//    0.10.0 就能带着「0.9.x 活跃开发中」的表格发出去——那是安全策略文档里的谎话。
+//
+// 前两类直接读真实 README 断言（正则被改窄时，用户会静默看到「跳过」，而测试必须变红）。
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+import { checkSupportTable, scanReleaseRows, syncReadmeTables } from "../scripts/release-docs.mjs";
+
+const pkgRoot = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const repoRoot = path.dirname(pkgRoot);
+const rootReadme = readFileSync(path.join(repoRoot, "README.md"), "utf8");
+const pkgReadme = readFileSync(path.join(pkgRoot, "README.md"), "utf8");
+const securityDoc = readFileSync(path.join(repoRoot, "SECURITY.md"), "utf8");
+const { version } = JSON.parse(readFileSync(path.join(pkgRoot, "package.json"), "utf8"));
+
+const CRLF = "\r\n";
+const crlf = (...lines) => lines.join(CRLF) + CRLF;
+
+test("两份真实 README 的版本表都还认得出（根按 minor、子按 patch）", () => {
+  const root = scanReleaseRows(rootReadme);
+  assert.ok(root.two.length >= 3, `根 README 的路线图应解析出至少 3 行两段式版本行，实际 ${root.two.length}`);
+  assert.equal(root.three.length, 0,
+    "根 README 的路线图按 minor 排，不该出现三段式版本行——出现了说明表格形状变了，插入位置需要重算");
+  const sub = scanReleaseRows(pkgReadme);
+  assert.ok(sub.three.length >= 1, `子 README 的版本历史应解析出至少 1 行三段式版本行，实际 ${sub.three.length}`);
+});
+
+test("根 README 的两段式路线图能插进新 minor 占位行（旧实现零命中）", () => {
+  const sample = crlf(
+    "| 版本 | 主题 | 状态 |",
+    "|------|------|------|",
+    "| **v0.8** | 生态化 | ✅ 已发布（至 v0.8.16） |",
+    "| **v0.9** | 手法 beta | ✅ 已发布（v0.9.0） |",
+  );
+  const { text, actions } = syncReadmeTables(sample, "0.10.0", "2026-11-01");
+  assert.equal(actions.filter((a) => a.kind === "insert").length, 1, "应插入且只插入一行");
+  assert.match(text, /\| \*\*v0\.10\*\* \| （待填） \| ✅ 已发布（v0\.10\.0） \|/,
+    "占位行按 minor 写 v0.10，状态写这次要发出去的完整版本");
+  // 插在 v0.9 之后，而不是表尾——表尾将来会有更高的计划行
+  assert.ok(text.indexOf("**v0.10**") > text.indexOf("**v0.9**"), "占位行应排在 v0.9 之后");
+});
+
+test("真实根 README 的中英两张路线图各插一行（同一版本号，不能只插一张）", () => {
+  // 两张表版本行完全一样，旧实现把全文件版本行合成一个数组判断「已存在」，
+  // 于是先插的中文表会让英文表被跳过——英文读者永远等不到那一行。
+  const { actions } = syncReadmeTables(rootReadme, "0.10.0", "2026-11-01");
+  const inserts = actions.filter((a) => a.kind === "insert");
+  assert.equal(inserts.length, 2, "中英路线图各一行，实际：" + JSON.stringify(actions));
+});
+
+test("子 README 的版本历史插占位行时写完整 patch 号并带日期", () => {
+  const sample = crlf(
+    "| 版本 | 主题 |",
+    "|------|------|",
+    "| **v0.9.0**（2026-10-17） | 手法 beta |",
+    "| **v0.8.x** | 作用域隔离 |",
+  );
+  const { text } = syncReadmeTables(sample, "0.9.1", "2026-10-18");
+  assert.match(text, /\| \*\*v0\.9\.1\*\*（2026-10-18） \| （待填） \|/);
+  assert.ok(text.indexOf("**v0.9.1**") < text.indexOf("**v0.8.x**"),
+    "占位行要排在低于它的最新版本之后、概括行之前");
+});
+
+test("路线图里上一版留下的「🚧 准备中」在发版准备时回填成已发布", () => {
+  const sample = crlf(
+    "| 版本 | 主题 | 状态 |",
+    "|------|------|------|",
+    "| **v0.9** | 手法 beta | 🚧 准备中 |",
+  );
+  const { text } = syncReadmeTables(sample, "0.9.0", "2026-10-17");
+  assert.match(text, /\| \*\*v0\.9\*\* \| 手法 beta \| ✅ 已发布（v0\.9\.0） \|/);
+  // 已经写着已发布的行不动：脚本跑在打 tag 之前，改写补丁号等于提前宣布一个还没发出去的版本。
+  const already = crlf(
+    "| 版本 | 主题 | 状态 |",
+    "|------|------|------|",
+    "| **v0.9** | 手法 beta | ✅ 已发布（v0.9.0） |",
+  );
+  assert.equal(syncReadmeTables(already, "0.9.1", "2026-10-18").text, already,
+    "已发布的补丁号由人在真正发出去之后更新，脚本不擅自提前改");
+});
+
+test("插入占位行不改变行尾风格（CRLF 文件不会混进裸 LF）", () => {
+  const sample = crlf(
+    "| 版本 | 主题 |",
+    "|------|------|",
+    "| **v0.9.0**（2026-10-17） | 手法 beta |",
+  );
+  const { text } = syncReadmeTables(sample, "0.9.1", "2026-10-18");
+  const bareLf = (text.match(/(?<!\r)\n/g) || []).length;
+  assert.equal(bareLf, 0, `输出里出现了 ${bareLf} 个裸 LF——CRLF 文件被混写了一半 LF`);
+});
+
+test("重复跑是幂等的：已有目标的占位行就不再插第二行", () => {
+  const sample = crlf(
+    "| 版本 | 主题 |",
+    "|------|------|",
+    "| **v0.9.0**（2026-10-17） | 手法 beta |",
+  );
+  const once = syncReadmeTables(sample, "0.9.1", "2026-10-18").text;
+  const twice = syncReadmeTables(once, "0.9.1", "2026-10-18");
+  assert.equal(twice.text, once);
+  assert.deepEqual(twice.actions, [], "第二次应报告零变更，而不是再插一行");
+});
+
+test("SECURITY.md 支持版本表：同 minor 通过，跨 minor 如实报出中英两处", () => {
+  const sameMinor = checkSupportTable(securityDoc, version);
+  assert.equal(sameMinor.ok, true, `真实 SECURITY.md 应与 package.json ${version} 一致：${sameMinor.problems.join("；")}`);
+
+  const nextMinor = `${version.split(".")[0]}.${Number(version.split(".")[1]) + 1}.0`;
+  const crossing = checkSupportTable(securityDoc, nextMinor);
+  assert.equal(crossing.ok, false, "跨 minor 时必须报错——否则会带着过时的支持范围发版");
+  assert.equal(crossing.problems.length, 2, "中英两张表各报一条：" + crossing.problems.join("；"));
+  assert.ok(crossing.problems.every((p) => p.includes(crossing.expected)),
+    "每条问题都要写出期望值，否则人不知道改成什么：" + crossing.problems.join("；"));
+});
+
+test("SECURITY.md 支持版本表：节缺失或表格形状变了也报错（不能静默通过）", () => {
+  assert.equal(checkSupportTable("# Security\n\n## 别的节\n", "0.9.0").ok, false);
+  const noRows = "## Supported Versions\r\n\r\n没有表格\r\n\r\n## 支持版本\r\n\r\n没有表格\r\n";
+  assert.equal(checkSupportTable(noRows, "0.9.0").ok, false,
+    "解析不出任何版本行时必须失败：正则失配不能变成永真");
+});