@modusensus/dsh-mneme 0.9.1 → 0.9.2

package/src/tools.js

@@ -7,6 +7,7 @@ import { matchesPlatform } from "./runtime/closure.js";
 import { verifyPayload } from "./runtime/verify.js";
 import { TOOL_GUIDE, CONTINUITY_TOOL_RULE } from "./guide.js";
 import { injectChildEnabled } from "./config.js";
+import { normalizeScopeStateDimension, normalizeScopeStateValue, normalizeScopeStateState } from "./scope-state.js";
 import { lastUserQuery } from "./inject.js";
 
 const TEXT_OUTPUT = (text) => [{ type: "text", text }];
@@ -500,6 +501,76 @@ export function createTools(ctx, service, config, embedder) {
       }
     }),
 
+    // #471：政策轴——作用域级可逆闸门。与 memory_forget/memory_archive 的分工：
+    // 那两个是事实轴的单条操作（改的是「这条记忆属于谁 / 还算不算数」，一条条来）；
+    // 本工具是政策轴的按作用域操作（改的是「这一路现在通不通」，跨会话存续、
+    // 松开即原样回来，一条记忆行都不动）。判断指引：整条工作线要临时静音用本工具；
+    // 单条记忆不该再被想起才用 memory_forget/memory_archive。
+    defineTool({
+      name: "set_scope_state",
+      description:
+        "Press or release the reversible scope gate for one scope (issue #471): while paused, that scope's memories stay stored and unchanged but are held back from injection and dream consolidation. " +
+        "This is not deletion and not forgetting — release with state=active and everything comes back exactly as it was, which is why it is the right tool for temporarily silencing a whole work stream rather than editing memories one by one. " +
+        "dimension is agent or workspace; scope_value is the label itself, or * for that dimension's global gate. " +
+        "Both switches (scopeState.enabled/enforce) are off by default, so setting a state has no effect on injection until the user turns them on in the panel.",
+      parameters: {
+        dimension: { type: "string", required: true, description: "Scope dimension to press: \"agent\" or \"workspace\"" },
+        scope_value: { type: "string", required: true, description: "The scope label, or \"*\" for that dimension's global gate" },
+        state: { type: "string", required: true, description: "\"paused\" presses the gate, \"active\" releases it" },
+        note: { type: "string", description: "Optional short reason, stored with the decision so the next reader knows why it was pressed" }
+      },
+      output: {
+        schema: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            scope: {
+              type: "object",
+              additionalProperties: false,
+              properties: {
+                dimension: { type: "string", required: true },
+                scope_value: { type: "string", required: true },
+                state: { type: "string", required: true },
+                // 理由要能读回来：不带它，下次读的人只知道「按下过」却不知道为什么。
+                // 这与库层 setScopeState 的 note 取舍是同一条理由——不带理由的重按
+                // 不抹掉旧理由，正是为了让这里读得回来。可选：从没写过就没有。
+                note: { type: "string" },
+                decided_at: { type: "string", required: true }
+              }
+            }
+          }
+        },
+        // 回执如实回显当前值（不是回显入参）：同一个状态重复按下时 decided_at 保持
+        // 首次值，回显它才看得出「这次没有真的改变什么」。
+        render: (_args, value) =>
+          TEXT_OUTPUT(
+            `Scope ${value.scope.dimension}:${value.scope.scope_value} is now ${value.scope.state} (decided at ${value.scope.decided_at}).`
+          )
+      },
+      async execute(args) {
+        const dimension = normalizeScopeStateDimension(args.dimension);
+        const scopeValue = normalizeScopeStateValue(args.scope_value);
+        const state = normalizeScopeStateState(args.state);
+        if (dimension === null) throw new Error("dimension must be \"agent\" or \"workspace\"");
+        if (scopeValue === null) throw new Error("scope_value must be a non-empty label or \"*\"");
+        if (state === null) throw new Error("state must be \"active\" or \"paused\"");
+        const row = service.setScopeState({ dimension, scope_value: scopeValue, state, note: args.note });
+        if (row === undefined) throw new Error("scope state could not be recorded");
+        return {
+          scope: {
+            dimension: row.dimension,
+            scope_value: row.scope_value,
+            state: row.state,
+            // 没写过理由时键整个不出现（而不是 note: undefined）：output schema 是
+            // 闭合的，DTO 矩阵会拿真实返回值过 validateJsonSchemaValue，留一个
+            // 值为 undefined 的键等于留个空壳。
+            ...(row.note === undefined ? {} : { note: row.note }),
+            decided_at: row.decided_at
+          }
+        };
+      }
+    }),
+
     // #230（#164 设计稿评审线）：document 型记忆注册——agent 产长文档的指针
     // 行铸造口。写入权分离：全文归 agent（管线对文件零读零写零改），库里只
     // 存摘要 + doc_path + evidence 三样；C2 比对去重、supersede 记账在

package/test/api.test.js

@@ -538,6 +538,63 @@ test("GET /api/dsh-mneme/semantic reports configured/coverage/degraded", async (
   assert.equal(noIndex.degraded, false);
 });
 
+// --- distill-tx-embed-gap 后续：/semantic 区分「有向量」与「可检索」 -----------
+
+test("GET /api/dsh-mneme/semantic reports per-dimension/per-model vector breakdown", async () => {
+  const { routes, store, service } = setup(undefined);
+  // 三种状态混进一个库：3 维 2 条、旧 4 维 1 条、不可解析 1 条；
+  // 模型出身 m1#aaa 一行、m2#bbb 一行、无出身两行。
+  const a = service.saveWithDedupe({ type: "preference", title: "同维A", content: "x" }).memory;
+  const b = service.saveWithDedupe({ type: "preference", title: "同维B", content: "x" }).memory;
+  const c = service.saveWithDedupe({ type: "preference", title: "旧维C", content: "x" }).memory;
+  const d = service.saveWithDedupe({ type: "preference", title: "坏D", content: "x" }).memory;
+  store.db.prepare("UPDATE memories SET embedding = ? WHERE id = ?").run(JSON.stringify([1, 2, 3]), a.id);
+  store.db.prepare("UPDATE memories SET embedding = ?, embedding_model = ? WHERE id = ?").run(JSON.stringify([1, 2, 3]), "m1#aaa", b.id);
+  store.db.prepare("UPDATE memories SET embedding = ?, embedding_model = ? WHERE id = ?").run(JSON.stringify([1, 2, 3, 4]), "m2#bbb", c.id);
+  store.db.prepare("UPDATE memories SET embedding = ? WHERE id = ?").run("not-json", d.id);
+
+  const sem = routes.find((r) => r.path === "/api/dsh-mneme/semantic");
+  const res = new FakeRes();
+  await sem.handler(req("/api/dsh-mneme/semantic"), res);
+  assert.equal(res.statusCode, 200);
+  const data = JSON.parse(res.body);
+
+  // 无 embedder → 无当前维度可比对：unsearchable 报 0、retrievable 报 null。
+  assert.equal(data.vectors.unsearchable, 0);
+  assert.equal(data.vectors.retrievable, null);
+  const dims = Object.fromEntries(data.vectors.byDimension.map((e) => [e.dimension, e.count]));
+  assert.equal(dims["3"], 2);
+  assert.equal(dims["4"], 1);
+  assert.equal(dims[null], 1, "unparseable vector counted under null");
+  const models = Object.fromEntries(data.vectors.byModel.map((e) => [e.model, e.count]));
+  assert.equal(models["m1#aaa"], 1);
+  assert.equal(models["m2#bbb"], 1);
+  assert.equal(models[null], 2, "rows without provenance counted under null");
+});
+
+test("GET /api/dsh-mneme/semantic counts stale-dimension rows as unsearchable with a matching embedder", async () => {
+  // 核心回归锁：库里掺一条错维向量，端点必须报出 unsearchable ≥ 1。
+  // 旧实现无论怎么混都只给 coverage，状态卡说不出「有向量但检索不到」。
+  const { routes, store, service } = setup({ name: "OpenAI", embed() {}, dimension: 3 });
+  const a = service.saveWithDedupe({ type: "preference", title: "同维", content: "x" }).memory;
+  const b = service.saveWithDedupe({ type: "preference", title: "错维", content: "x" }).memory;
+  store.db.prepare("UPDATE memories SET embedding = ? WHERE id = ?").run(JSON.stringify([1, 2, 3]), a.id);
+  store.db.prepare("UPDATE memories SET embedding = ? WHERE id = ?").run(JSON.stringify([1, 2, 3, 4, 5, 6, 7, 8]), b.id);
+  const sem = routes.find((r) => r.path === "/api/dsh-mneme/semantic");
+  const res = new FakeRes();
+  await sem.handler(req("/api/dsh-mneme/semantic"), res);
+  assert.equal(res.statusCode, 200);
+  const data = JSON.parse(res.body);
+  assert.equal(data.vectors.unsearchable, 1, "the 8-dim row is not searchable against a 3-dim embedder");
+  assert.equal(data.vectors.retrievable, 1, "the 3-dim row is searchable");
+  // coverage 走 semantic.vectorIndex.getStats（本测试未挂 → 0），所以「有向量的行」
+  // 用 byDimension 总和对照：两条都在「有向量」里，但只有一条可检索 —— 这正是
+  // unsearchable 必须存在的原因。
+  const embeddedRows = data.vectors.byDimension.reduce((s, e) => s + e.count, 0);
+  assert.equal(embeddedRows, 2, "both rows have vectors");
+  assert.equal(data.vectors.unsearchable, 1, "yet only one is retrievable");
+});
+
 // --- Bug8: llm-audit API (pagination + stats) --------------------------------
 
 test("GET /api/dsh-mneme/semantic/llm-audit returns paginated rows", async () => {
@@ -686,8 +743,11 @@ test("GET /api/dsh-mneme/features returns empty overrides and effective config d
   // persona 页新增 personaEnabled（人格注入顶层总闸；顶层扁平键，同上）。
   // 计数锁钉的是「白名单键 ↔ config schema 成对」：schema 加了键而漏了白名单
   // （或反过来）时，effective 会静默少键/多键，面板读不到也报不出来。
+  // issue #471 新增 scopeState.enabled/scopeState.enforce（政策轴作用域级可逆闸门；
+  // 两个都是嵌套对象子字段，都进 NESTED_FLAG_PATHS）。
   // 合并 #451（人格页）后的真实计数：98（本批前）+ actionRunEnabled + personaEnabled = 99
-  assert.equal(Object.keys(data.effective).length, 99);
+  // #471 再 + 2 = 101。
+  assert.equal(Object.keys(data.effective).length, 101);
   assert.equal(data.effective.dreamSkipInvalid, true);
   assert.equal(data.effective.allowCrossTypeMerge, false);
   assert.equal(data.effective.dreamMergeGuard, true);
@@ -695,6 +755,9 @@ test("GET /api/dsh-mneme/features returns empty overrides and effective config d
   // issue #380：注入前判定两级开关，默认全关（默认路径零行为变化）
   assert.equal(data.effective["preInjectGate.enabled"], false);
   assert.equal(data.effective["preInjectGate.enforce"], false);
+  // issue #471：政策轴作用域级可逆闸门，两级开关默认全关（默认路径零行为变化）
+  assert.equal(data.effective["scopeState.enabled"], false);
+  assert.equal(data.effective["scopeState.enforce"], false);
   assert.equal(data.effective.dreamMinIntervalMinutes, 0);
   assert.equal(data.effective.autoDreamFailureBackoff, false);
   assert.equal(data.effective.dreamMaxTokens, 131072);
@@ -755,6 +818,47 @@ test("GET /api/dsh-mneme/features returns empty overrides and effective config d
   assert.equal(data.effective.dreamCandidateMode, "window");
   assert.equal(data.effective.dreamCandidateMax, 0);
   assert.equal(data.effective.dreamCandidateMinSim, 0.85);
+  // #481：没有 overrides 时不存在「改了还没生效」的键，必须是空数组而不是缺字段
+  // ——面板按数组长度渲染提示条，字段缺失会让它渲染出 undefined.length 这类东西。
+  assert.ok(Array.isArray(data.pendingRestart), "pendingRestart must always be an array");
+  assert.deepEqual(data.pendingRestart, []);
+});
+
+test("GET /api/dsh-mneme/features reports only the overrides the frozen config has not picked up", async () => {
+  const { routes, settings } = setup(undefined, "", FLAGS_CFG);
+  const route = routes.find((r) => r.path === "/api/dsh-mneme/features");
+  // #481 实测现场：面板显示人格总闸「已开启」，人格段却不注入——因为开关在宿主
+  // 启动时合并进 cfg 并冻结，运行中改 kv 只是持久化。pendingRestart 就是把
+  // 「显式覆盖 ≠ 冻结值」这个落差报出来，否则用户只能靠反复试错发现。
+  settings.setFeatureFlags({
+    personaEnabled: true,                 // 冻结值 false → 待重启
+    autoDream: false,                     // 冻结值 true  → 待重启
+    "memoryQualityFilter.enabled": false, // 冻结值 true  → 待重启
+    distillMaxChars: 24000                // 与冻结值相同 → 不该报
+  });
+  const res = new FakeRes();
+  await route.handler(req("/api/dsh-mneme/features"), res);
+  assert.equal(res.statusCode, 200);
+  const data = JSON.parse(res.body);
+  // 比的是集合而非顺序（顺序跟白名单分组走，不是契约的一部分）。
+  assert.deepEqual([...data.pendingRestart].sort(), ["autoDream", "memoryQualityFilter.enabled", "personaEnabled"]);
+  assert.ok(!data.pendingRestart.includes("distillMaxChars"),
+    "a key whose override equals the frozen value is not pending");
+  // effective 仍然是「运行时取什么值」= overrides 优先，不受本字段影响。
+  assert.equal(data.effective.personaEnabled, true);
+});
+
+test("GET /api/dsh-mneme/features cannot report pendingRestart without a frozen config", async () => {
+  // config 缺席（旧调用方直连、未传 cfg）时无从比较冻结值——返回空数组，不编造。
+  const { routes, settings } = setup(undefined);
+  settings.setFeatureFlags({ personaEnabled: true });
+  const route = routes.find((r) => r.path === "/api/dsh-mneme/features");
+  const res = new FakeRes();
+  await route.handler(req("/api/dsh-mneme/features"), res);
+  assert.equal(res.statusCode, 200);
+  const data = JSON.parse(res.body);
+  assert.deepEqual(data.pendingRestart, []);
+  assert.equal(data.effective.personaEnabled, true, "effective still reports the override");
 });
 
 test("PUT /api/dsh-mneme/features round-trips, overrides effective and persists", async () => {
@@ -792,6 +896,9 @@ test("PUT /api/dsh-mneme/features round-trips nested, string, url and enum keys"
     // NESTED_FLAG_PATHS——否则 configFlagValue 落到顶层同名键上，effective 静默缺键）。
     "distillRecords.enabled": true,
     "distillRecords.retentionDays": 30,
+    // #471：政策轴的两个点号键往返——白名单与 NESTED_FLAG_PATHS 成对缺一即静默缺键。
+    "scopeState.enabled": true,
+    "scopeState.enforce": true,
     // #164 A2：顶层扁平键（不是对象子字段），与上面两个点号键走同一条往返；
     // 它的默认值断言在计数锁那一条里，这里钉的是「PUT 存进去、effective 读得回」。
     sensitiveScanEnabled: true,
@@ -813,6 +920,8 @@ test("PUT /api/dsh-mneme/features round-trips nested, string, url and enum keys"
     "preInjectGate.enforce": true,
     "distillRecords.enabled": true,
     "distillRecords.retentionDays": 30,
+    "scopeState.enabled": true,
+    "scopeState.enforce": true,
     sensitiveScanEnabled: true,
     embedProvider: "local",
     ollamaBaseUrl: "http://127.0.0.1:11434",
@@ -829,6 +938,9 @@ test("PUT /api/dsh-mneme/features round-trips nested, string, url and enum keys"
   assert.equal(data.effective["preInjectGate.enforce"], true);
   assert.equal(data.effective["distillRecords.enabled"], true);
   assert.equal(data.effective["distillRecords.retentionDays"], 30, "整数点号键也要读得回来");
+  // #471：政策轴两个点号键同款往返
+  assert.equal(data.effective["scopeState.enabled"], true);
+  assert.equal(data.effective["scopeState.enforce"], true);
   assert.equal(data.effective.sensitiveScanEnabled, true);
   assert.equal(data.effective.embedProvider, "local");
   assert.equal(data.effective.ollamaBaseUrl, "http://127.0.0.1:11434");

package/test/cli-flag-value.test.js

@@ -0,0 +1,86 @@
+// `--flag value` 的值本身可以是 `--` 开头的字符串。真撞上的那次是 CI：
+//
+//   not ok 846 - CLI：reclaim 默认 dry-run 报数字，--apply --vacuum 才真收
+//   ... bin/cli.mjs reclaim --url http://127.0.0.1:55423 --token <以 -- 开头的随机 token>
+//   未配置访问 token，无法调用该命令
+//
+// token 由 `crypto.randomBytes(24).toString("base64url")` 生成（src/api-standalone.js），
+// base64url 的字母表含 `-`，于是约 1/4096 的 token 头两位都是 `-` → 拼出来就是 `--…`
+// → 旧 parseArgv 把它当新旗标、token 变 `true` → 退回环境变量/配置文件 → 全空。
+// 也就是说这是一条**真实用户的随机性**，不是测试写法问题：一次 CI 红只是运气不好。
+//
+// 这个文件把解析语义钉死：值可以是任意 `--` 开头的串，而真旗标仍按旗标解析。
+//
+// 下面刻意不写整串字面量：那个 token 是一次性测试服务现生成的、早已随进程消失，
+// 而一整串高熵字符留在源码里会被密钥扫描（gitleaks 的 generic-api-key 按熵报警）
+// 当成真凭据。用拼接构造，形状一样、不触发扫描。
+import test from "node:test";
+import assert from "node:assert/strict";
+import { parseArgv, KNOWN_FLAGS, flagValue, flagBool } from "../bin/cli.mjs";
+
+// 拼成 `--token` / `--` 开头的值，两个片段各自都是低熵短串。
+const FLAG_TOKEN = "--tok" + "en";
+const DASH_VALUE = "--" + "dash-prefixed-value";
+
+test("CLI 解析：--token 的值以 -- 开头时仍取到值（CI 回归现场）", () => {
+  const { positionals, flags } = parseArgv([
+    "reclaim", "--url", "http://127.0.0.1:55423",
+    FLAG_TOKEN, DASH_VALUE
+  ]);
+  assert.deepEqual(positionals, ["reclaim"]);
+  assert.equal(flags.token, DASH_VALUE);
+  // 这条才是当初真正失败的地方：值为 true 时 flagValue 视为「没给」。
+  assert.equal(flagValue(flags, "token"), DASH_VALUE);
+  // 旧实现会在这里多出一个键：把值当成旗标名（`dash-prefixed-value`）。
+  assert.deepEqual(Object.keys(flags).sort(), ["token", "url"]);
+});
+
+test("CLI 解析：单横线开头的值同样按值处理", () => {
+  const { flags } = parseArgv(["add", "--title", "-x", "--content", "-"]);
+  assert.equal(flags.title, "-x");
+  assert.equal(flags.content, "-");
+});
+
+test("CLI 解析：真旗标仍按旗标解析，不会被前一个旗标吞成值", () => {
+  // --limit 后面跟 --json：--json 是已注册旗标，所以 --limit 没有值（true），
+  // --json 是布尔。这是旧语义，必须保持，否则 `--limit --json` 会静默变成
+  // limit="--json"。
+  const { flags } = parseArgv(["list", "--limit", "--json"]);
+  assert.equal(flags.limit, true);
+  assert.equal(flagBool(flags, "json"), true);
+});
+
+test("CLI 解析：等号形式与 `--` 分隔符语义不变", () => {
+  assert.equal(parseArgv(["reclaim", "--token=--abc"]).flags.token, "--abc");
+  // `--` 之后全是位置参数，即使以 -- 开头。
+  assert.deepEqual(parseArgv(["search", "--", "--weird"]).positionals, ["search", "--weird"]);
+});
+
+test("CLI 解析：未知的 -- 开头词当作上一个旗标的值", () => {
+  // 这是本修复的判定规则：只有 KNOWN_FLAGS 里登记过的词才算旗标。
+  const { flags } = parseArgv(["add", "--content", "--not-a-real-flag"]);
+  assert.equal(flags.content, "--not-a-real-flag");
+});
+
+test("CLI KNOWN_FLAGS 覆盖 flagValue/flagBool 的全部实际用法", async () => {
+  // 漏登记的代价：该旗标会被当成前一个旗标的值吞掉，且没有任何报错。
+  // 所以用文本锁把 KNOWN_FLAGS 与 cli.mjs 里的调用点钉在一起——新增命令
+  // 忘登记会在这里炸，而不是等 1/4096 的用户撞上。
+  const { readFileSync } = await import("node:fs");
+  const { fileURLToPath } = await import("node:url");
+  const path = await import("node:path");
+  const cliPath = path.join(
+    path.dirname(path.dirname(fileURLToPath(import.meta.url))), "bin", "cli.mjs");
+  const src = readFileSync(cliPath, "utf8");
+
+  const used = new Set();
+  for (const m of src.matchAll(/flag(?:Value|Bool)\(\s*flags\s*,([^)]*)\)/g)) {
+    // 只认字符串字面量；`...names` 这种转发形式由调用方各自登记。
+    for (const s of m[1].matchAll(/'([^']+)'/g)) used.add(s[1].toLowerCase());
+  }
+  assert.ok(used.size >= 15, "至少要解析出 CLI 全部取值/布尔旗标，否则这把锁失效了");
+
+  const missing = [...used].filter((k) => !KNOWN_FLAGS.has(k));
+  assert.deepEqual(missing, [],
+    "以下旗标在用但没登记进 KNOWN_FLAGS，会被前一个 --flag 吞成值：" + missing.join(", "));
+});

package/test/client.test.js

@@ -1051,6 +1051,47 @@ test("settings card folds everything beyond the first screen behind All settings
     "the default/changed badge must be decided from overrides, not a new backend field");
 });
 
+// #481：面板开关「改了不生效」的体验坑。开关在宿主启动时合并进冻结 cfg，
+// 此后面板改 kv 只是持久化——用户看到「已改」就以为生效了，实测（人格总闸）
+// 因此白白排查了一轮。这条锁三件事：①第三态徽标由后端的 pendingRestart 名单
+// 决定（前端算不出来：overrides 只说明「改了」，不说明「用没用上」）；
+// ②卡片顶部有整卡提示行；③中英文案与语义色齐备，且「待重启」不能靠
+// opacity 之类的弱化手段与「已改」区分（弱化在浅色主题下会掉到看不清）。
+test("feature switches expose a third badge state for saved-but-not-live overrides (#481)", () => {
+  // ① 判定来源必须是后端字段，而不是前端自己比 overrides。
+  assert.ok(/const pending = new Set\(\(state && state\.pendingRestart\) \|\| \[\]\)/.test(clientSource),
+    "the pending set must come from the backend pendingRestart list");
+  assert.ok(/pending\.has\(k\)[\s\S]{0,240}?mneme-badge--pending/.test(clientSource),
+    "flagTag must return the pending badge before falling back to default/changed");
+  // 后端字段缺失（旧宿主）时 pending 为空集，面板退回两态——不能因此崩掉。
+  assert.ok(/\(state && state\.pendingRestart\) \|\| \[\]/.test(clientSource),
+    "a missing pendingRestart must degrade to an empty set, not throw");
+
+  // ② 整卡提示行：只在有待重启项时出现，位置在说明之后、错误行之前。
+  const noticeAt = clientSource.indexOf('t("memory.features.pendingRestartNotice")');
+  const descAt = clientSource.indexOf('h("div", { className: "mneme-set-desc" }, t("memory.features.desc"))');
+  assert.ok(noticeAt > descAt && descAt >= 0, "the notice row must sit after the card description");
+  assert.ok(/pending\.size > 0 && h\("div", \{ className: "mneme-pending" \}/.test(clientSource),
+    "the notice row must render only when something is actually pending");
+
+  // ③ 双语齐备（各出现两次：zh 表 + en 表）。
+  for (const key of ["memory.features.tagPending", "memory.features.tagPending.hint",
+    "memory.features.pendingRestartNotice"]) {
+    const occurrences = clientSource.split("\"" + key + "\"").length - 1;
+    assert.ok(occurrences >= 2, `i18n key ${key} must exist in both zh and en (got ${occurrences})`);
+  }
+
+  // ④ 样式走语义色层（AGENTS.md 第 9 条），且不靠透明度弱化区分状态。
+  assert.ok(/\.mneme-badge--pending\{[^}]*var\(--mneme-warn\)[^}]*\}/.test(clientSource),
+    "the pending badge must use the --mneme-warn semantic colour");
+  assert.ok(!/\.mneme-badge--pending\{[^}]*opacity/.test(clientSource),
+    "the pending badge must not rely on opacity to distinguish itself from changed");
+  assert.ok(/\.mneme-pending\{[^}]*var\(--mneme-warn\)[^}]*\}/.test(clientSource),
+    "the notice row must use the --mneme-warn semantic colour");
+  assert.ok(/\.mneme-pending-dot\{[^}]*background:currentColor/.test(clientSource),
+    "the notice dot must inherit currentColor so the colour has one source");
+});
+
 // v0.8.0 冲突集中处理：状态页的待确认冲突队列（reason + 双方内容对比 +
 // 保留 A/B/仅标记动作），resolveConflictPending 的第一个前端出口。双语齐备。
 test("conflict queue ships a central review surface on the status tab", () => {
@@ -1665,8 +1706,8 @@ test("distill retention switches are reachable from the panel (#399)", () => {
     "distillRecords.enabled must be an item of the core group, not merely referenced elsewhere"
   );
   assert.ok(
-    /const FEATURE_NUMBERS = \["distillRecords\.retentionDays"\]/.test(clientSource),
-    "retentionDays must be in the numeric key list"
+    /const FEATURE_NUMBERS = \["distillRecords\.retentionDays", "dreamMaxTokens", "sleepMaxTokens"\]/.test(clientSource),
+    "retentionDays must be in the numeric key list (dreamMaxTokens/sleepMaxTokens joined by #478)"
   );
   assert.ok(
     /for \(const key of FEATURE_NUMBERS\) numDraft\[key\] = String\(e\[key\] \?\? ""\);/.test(clientSource)
@@ -1694,7 +1735,12 @@ test("distill retention switches are reachable from the panel (#399)", () => {
     "memory.features.distillRecords.enabled",
     "memory.features.distillRecords.enabled.hint",
     "memory.features.distillRecords.retentionDays",
-    "memory.features.distillRecords.retentionDays.hint"
+    "memory.features.distillRecords.retentionDays.hint",
+    // #478：面板新暴露的两个 max_tokens 预算键，label 与 hint 缺一即哑行
+    "memory.features.dreamMaxTokens",
+    "memory.features.dreamMaxTokens.hint",
+    "memory.features.sleepMaxTokens",
+    "memory.features.sleepMaxTokens.hint"
   ]) {
     const occurrences = clientSource.split(`"${key}"`).length - 1;
     assert.ok(occurrences >= 2, `i18n key ${key} must exist in both zh and en (got ${occurrences})`);
@@ -2054,6 +2100,21 @@ test("persona card is multi-card with visible field labels and save-failure erro
   assert.ok(labelBlock, "persona field labels must be visible (featnumlabel class), not aria-only");
   // 保存失败提示：personaError 状态有渲染路径（非仅 setState）
   assert.ok(clientSource.includes("t(\"memory.settings.personaSaveFailed\")"), "save failure must render an error line");
+  // 卡删除 × 常显回归锁 v2（#457 内联覆写被 #459 回滚的教训）：× 不得复用
+  // mneme-set-del（opacity:0 仅在 .mneme-set-row:hover 解除，卡标签不在该容器
+  // → 永远不可见），必须用独立类 mneme-persona-del 且该类常显（opacity:1）。
+  assert.ok(
+    /className: "mneme-persona-del"/.test(clientSource),
+    "persona card delete × must use the dedicated always-visible class"
+  );
+  const delStyle = clientSource.match(/\.mneme-persona-del\{[^}]*\}/);
+  assert.ok(delStyle, "mneme-persona-del style rule must exist");
+  assert.ok(!/opacity:0/.test(delStyle[0]), "mneme-persona-del must not be transparent");
+  // 不许再把 mneme-set-del 挂回卡删除按钮（防 #457 式修法回归）；直接锁按钮
+  // 的 className 值（onClick 前最近的 className 属性，注释文字不参与）。
+  const delBtn = clientSource.match(/className: "([^"]+)"[\s\S]{0,300}?onClick: \(\) => removePersonaCard\(id\)/);
+  assert.ok(delBtn, "card delete button wiring must exist");
+  assert.strictEqual(delBtn[1], "mneme-persona-del", "card delete × must use mneme-persona-del, not mneme-set-del");
 });
 
 // 回归锁（复验实测踩中）：面板「检测更新」的状态名必须与后端 classify

package/test/distill-tx-embed-gap.test.js

@@ -0,0 +1,110 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createStore } from "../src/store.js";
+import { createService } from "../src/service.js";
+
+// ============================================================ distill-tx-embed-gap
+// 回归锁：此前 scheduleEmbed 在 txDepth>0 时首行直接 return（注释写 deferred，
+// 实际 transaction() 从不补跑）——与 #372 的实体抽取是同一个 bug 模板，只是受害者
+// 换成了嵌入：自动蒸馏（summarize 全部走 service.transaction）写入的 session:* 行
+// 100% 拿不到向量，语义检索对这批行永远失明。照 #372 的修复模板改为入队、提交后
+// 补跑、回滚截断。五把锁与 test/entities.test.js 的 #372 锁一一对应，锁的是
+// 「commit 才补跑、回滚绝不补跑」这个契约本身——任何一侧改回丢弃或回滚也补跑，
+// 这里当场红。
+
+function makeService(config = {}) {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config });
+  return { store, service };
+}
+
+// 8 维定值向量；schedule 分支同步写回（语义同真实 embedder：调度即含写回），
+// 让整条链路确定性、无异步漂移。embedSingle 仅供 ready-gate/embedSingle 分支
+// 的调用方使用，本文件的锁都走 schedule 分支。
+function makeEmbedder(store, embedded) {
+  return {
+    schedule(memory) {
+      embedded.push(memory.id);
+      store.setEmbedding(memory.id, new Array(8).fill(0.5), "fake-model-hash");
+    },
+    embedSingle: async () => new Array(8).fill(0.5),
+  };
+}
+
+test("distill-tx: embedding queued inside transaction is written exactly once after commit", () => {
+  const { store, service } = makeService();
+  const embedded = [];
+  service.setEmbedder(makeEmbedder(store, embedded));
+  const r = service.transaction(() =>
+    service.saveWithDedupe({ type: "preference", title: "事务内创建", content: "x" })
+  );
+  const id = r.memory.id;
+  // 提交后补跑恰一次：向量非空、维度等于 embedder 输出（8 维）
+  assert.deepEqual(embedded, [id], "drain fires exactly once, after commit");
+  const row = store.db.prepare("SELECT embedding FROM memories WHERE id = ?").get(id);
+  const vec = JSON.parse(row.embedding);
+  assert.equal(vec.length, 8, "vector dimension equals embedder output");
+  store.close();
+});
+
+test("distill-tx: nothing schedules while txDepth > 0 (queued, not dropped, not immediate)", () => {
+  const { store, service } = makeService();
+  const embedded = [];
+  service.setEmbedder(makeEmbedder(store, embedded));
+  service.transaction(() => {
+    service.saveWithDedupe({ type: "preference", title: "事务内观察", content: "x" });
+    // 事务内此刻不得触发（排进队列而不是丢弃，也不是立即跑）
+    assert.equal(embedded.length, 0, "no embedding while txDepth > 0");
+  });
+  assert.equal(embedded.length, 1, "queued entry drains after commit");
+  store.close();
+});
+
+test("distill-tx: rolled-back transaction never embeds rolled-back rows", () => {
+  const { store, service } = makeService();
+  const embedded = [];
+  service.setEmbedder(makeEmbedder(store, embedded));
+  assert.throws(() => {
+    service.transaction(() => {
+      service.saveWithDedupe({ type: "preference", title: "会被回滚", content: "x" });
+      throw new Error("boom");
+    });
+  }, /boom/);
+  assert.equal(embedded.length, 0, "no embedding against rolled-back rows");
+  assert.equal(store.count(), 0, "row itself rolled back");
+  store.close();
+});
+
+// 与 #372 复审补锁同构：内层回滚截断只丢内层条目，外层提交 drain 外层条目。
+test("distill-tx: inner rollback drops only inner entries; outer commit drains the rest", () => {
+  const { store, service } = makeService();
+  const embedded = [];
+  service.setEmbedder(makeEmbedder(store, embedded));
+  const ids = [];
+  service.transaction(() => {
+    ids.push(service.saveWithDedupe({ type: "preference", title: "外层A", content: "x" }).memory.id);
+    try {
+      service.transaction(() => {
+        service.saveWithDedupe({ type: "preference", title: "内层回滚", content: "x" });
+        throw new Error("inner boom");
+      });
+    } catch { /* 内层回滚，外层继续 */ }
+    ids.push(service.saveWithDedupe({ type: "preference", title: "外层B", content: "x" }).memory.id);
+  });
+  assert.deepEqual(embedded.sort(), ids.sort(), "inner rolled-back row never embedded; outer rows drain once");
+  assert.equal(store.count(), 2);
+  store.close();
+});
+
+test("distill-tx: no unbounded cap — large transaction drains every entry", () => {
+  const { store, service } = makeService();
+  const embedded = [];
+  service.setEmbedder(makeEmbedder(store, embedded));
+  service.transaction(() => {
+    for (let i = 0; i < 150; i++) {
+      service.saveWithDedupe({ type: "preference", title: `批量${i}`, content: "x" });
+    }
+  });
+  assert.equal(embedded.length, 150, "no silent drop at any queue cap");
+  store.close();
+});