@modusensus/dsh-mneme 0.9.1 → 0.9.3

package/test/api.test.js

@@ -538,6 +538,63 @@ test("GET /api/dsh-mneme/semantic reports configured/coverage/degraded", async (
   assert.equal(noIndex.degraded, false);
 });
 
+// --- distill-tx-embed-gap 后续：/semantic 区分「有向量」与「可检索」 -----------
+
+test("GET /api/dsh-mneme/semantic reports per-dimension/per-model vector breakdown", async () => {
+  const { routes, store, service } = setup(undefined);
+  // 三种状态混进一个库：3 维 2 条、旧 4 维 1 条、不可解析 1 条；
+  // 模型出身 m1#aaa 一行、m2#bbb 一行、无出身两行。
+  const a = service.saveWithDedupe({ type: "preference", title: "同维A", content: "x" }).memory;
+  const b = service.saveWithDedupe({ type: "preference", title: "同维B", content: "x" }).memory;
+  const c = service.saveWithDedupe({ type: "preference", title: "旧维C", content: "x" }).memory;
+  const d = service.saveWithDedupe({ type: "preference", title: "坏D", content: "x" }).memory;
+  store.db.prepare("UPDATE memories SET embedding = ? WHERE id = ?").run(JSON.stringify([1, 2, 3]), a.id);
+  store.db.prepare("UPDATE memories SET embedding = ?, embedding_model = ? WHERE id = ?").run(JSON.stringify([1, 2, 3]), "m1#aaa", b.id);
+  store.db.prepare("UPDATE memories SET embedding = ?, embedding_model = ? WHERE id = ?").run(JSON.stringify([1, 2, 3, 4]), "m2#bbb", c.id);
+  store.db.prepare("UPDATE memories SET embedding = ? WHERE id = ?").run("not-json", d.id);
+
+  const sem = routes.find((r) => r.path === "/api/dsh-mneme/semantic");
+  const res = new FakeRes();
+  await sem.handler(req("/api/dsh-mneme/semantic"), res);
+  assert.equal(res.statusCode, 200);
+  const data = JSON.parse(res.body);
+
+  // 无 embedder → 无当前维度可比对：unsearchable 报 0、retrievable 报 null。
+  assert.equal(data.vectors.unsearchable, 0);
+  assert.equal(data.vectors.retrievable, null);
+  const dims = Object.fromEntries(data.vectors.byDimension.map((e) => [e.dimension, e.count]));
+  assert.equal(dims["3"], 2);
+  assert.equal(dims["4"], 1);
+  assert.equal(dims[null], 1, "unparseable vector counted under null");
+  const models = Object.fromEntries(data.vectors.byModel.map((e) => [e.model, e.count]));
+  assert.equal(models["m1#aaa"], 1);
+  assert.equal(models["m2#bbb"], 1);
+  assert.equal(models[null], 2, "rows without provenance counted under null");
+});
+
+test("GET /api/dsh-mneme/semantic counts stale-dimension rows as unsearchable with a matching embedder", async () => {
+  // 核心回归锁：库里掺一条错维向量，端点必须报出 unsearchable ≥ 1。
+  // 旧实现无论怎么混都只给 coverage，状态卡说不出「有向量但检索不到」。
+  const { routes, store, service } = setup({ name: "OpenAI", embed() {}, dimension: 3 });
+  const a = service.saveWithDedupe({ type: "preference", title: "同维", content: "x" }).memory;
+  const b = service.saveWithDedupe({ type: "preference", title: "错维", content: "x" }).memory;
+  store.db.prepare("UPDATE memories SET embedding = ? WHERE id = ?").run(JSON.stringify([1, 2, 3]), a.id);
+  store.db.prepare("UPDATE memories SET embedding = ? WHERE id = ?").run(JSON.stringify([1, 2, 3, 4, 5, 6, 7, 8]), b.id);
+  const sem = routes.find((r) => r.path === "/api/dsh-mneme/semantic");
+  const res = new FakeRes();
+  await sem.handler(req("/api/dsh-mneme/semantic"), res);
+  assert.equal(res.statusCode, 200);
+  const data = JSON.parse(res.body);
+  assert.equal(data.vectors.unsearchable, 1, "the 8-dim row is not searchable against a 3-dim embedder");
+  assert.equal(data.vectors.retrievable, 1, "the 3-dim row is searchable");
+  // coverage 走 semantic.vectorIndex.getStats（本测试未挂 → 0），所以「有向量的行」
+  // 用 byDimension 总和对照：两条都在「有向量」里，但只有一条可检索 —— 这正是
+  // unsearchable 必须存在的原因。
+  const embeddedRows = data.vectors.byDimension.reduce((s, e) => s + e.count, 0);
+  assert.equal(embeddedRows, 2, "both rows have vectors");
+  assert.equal(data.vectors.unsearchable, 1, "yet only one is retrievable");
+});
+
 // --- Bug8: llm-audit API (pagination + stats) --------------------------------
 
 test("GET /api/dsh-mneme/semantic/llm-audit returns paginated rows", async () => {
@@ -686,8 +743,12 @@ test("GET /api/dsh-mneme/features returns empty overrides and effective config d
   // persona 页新增 personaEnabled（人格注入顶层总闸；顶层扁平键，同上）。
   // 计数锁钉的是「白名单键 ↔ config schema 成对」：schema 加了键而漏了白名单
   // （或反过来）时，effective 会静默少键/多键，面板读不到也报不出来。
+  // issue #471 新增 scopeState.enabled/scopeState.enforce（政策轴作用域级可逆闸门；
+  // 两个都是嵌套对象子字段，都进 NESTED_FLAG_PATHS）。
   // 合并 #451（人格页）后的真实计数：98（本批前）+ actionRunEnabled + personaEnabled = 99
-  assert.equal(Object.keys(data.effective).length, 99);
+  // #471 再 + 2 = 101。
+  // v0.9.3 新增 actionNudgeEnabled（M.O. 自动沉淀；顶层扁平键）= 102。
+  assert.equal(Object.keys(data.effective).length, 102);
   assert.equal(data.effective.dreamSkipInvalid, true);
   assert.equal(data.effective.allowCrossTypeMerge, false);
   assert.equal(data.effective.dreamMergeGuard, true);
@@ -695,6 +756,9 @@ test("GET /api/dsh-mneme/features returns empty overrides and effective config d
   // issue #380：注入前判定两级开关，默认全关（默认路径零行为变化）
   assert.equal(data.effective["preInjectGate.enabled"], false);
   assert.equal(data.effective["preInjectGate.enforce"], false);
+  // issue #471：政策轴作用域级可逆闸门，两级开关默认全关（默认路径零行为变化）
+  assert.equal(data.effective["scopeState.enabled"], false);
+  assert.equal(data.effective["scopeState.enforce"], false);
   assert.equal(data.effective.dreamMinIntervalMinutes, 0);
   assert.equal(data.effective.autoDreamFailureBackoff, false);
   assert.equal(data.effective.dreamMaxTokens, 131072);
@@ -729,6 +793,10 @@ test("GET /api/dsh-mneme/features returns empty overrides and effective config d
   assert.equal(data.effective.actionRunEnabled, false);
   // 人格页（beta）：注入总闸默认关，effective 必须能读到（同 #254 坑形防线）。
   assert.equal(data.effective.personaEnabled, false);
+  // v0.9.3：M.O. 自动沉淀的第三个键。与 actionPipelineEnabled（看图）、
+  // actionRunEnabled（记账）都不是一件事——它挂 session/event 并解压会话日志，
+  // 是三者里最重的一条，所以独立开关、默认关、且进 LIGHT_MODE_OFF。
+  assert.equal(data.effective.actionNudgeEnabled, false);
   // 新增字符串 / URL / 枚举键
   assert.equal(data.effective.localEmbedModel, "Xenova/bge-small-zh-v1.5");
   assert.equal(data.effective.ollamaBaseUrl, "http://localhost:11434");
@@ -755,6 +823,47 @@ test("GET /api/dsh-mneme/features returns empty overrides and effective config d
   assert.equal(data.effective.dreamCandidateMode, "window");
   assert.equal(data.effective.dreamCandidateMax, 0);
   assert.equal(data.effective.dreamCandidateMinSim, 0.85);
+  // #481：没有 overrides 时不存在「改了还没生效」的键，必须是空数组而不是缺字段
+  // ——面板按数组长度渲染提示条，字段缺失会让它渲染出 undefined.length 这类东西。
+  assert.ok(Array.isArray(data.pendingRestart), "pendingRestart must always be an array");
+  assert.deepEqual(data.pendingRestart, []);
+});
+
+test("GET /api/dsh-mneme/features reports only the overrides the frozen config has not picked up", async () => {
+  const { routes, settings } = setup(undefined, "", FLAGS_CFG);
+  const route = routes.find((r) => r.path === "/api/dsh-mneme/features");
+  // #481 实测现场：面板显示人格总闸「已开启」，人格段却不注入——因为开关在宿主
+  // 启动时合并进 cfg 并冻结，运行中改 kv 只是持久化。pendingRestart 就是把
+  // 「显式覆盖 ≠ 冻结值」这个落差报出来，否则用户只能靠反复试错发现。
+  settings.setFeatureFlags({
+    personaEnabled: true,                 // 冻结值 false → 待重启
+    autoDream: false,                     // 冻结值 true  → 待重启
+    "memoryQualityFilter.enabled": false, // 冻结值 true  → 待重启
+    distillMaxChars: 24000                // 与冻结值相同 → 不该报
+  });
+  const res = new FakeRes();
+  await route.handler(req("/api/dsh-mneme/features"), res);
+  assert.equal(res.statusCode, 200);
+  const data = JSON.parse(res.body);
+  // 比的是集合而非顺序（顺序跟白名单分组走，不是契约的一部分）。
+  assert.deepEqual([...data.pendingRestart].sort(), ["autoDream", "memoryQualityFilter.enabled", "personaEnabled"]);
+  assert.ok(!data.pendingRestart.includes("distillMaxChars"),
+    "a key whose override equals the frozen value is not pending");
+  // effective 仍然是「运行时取什么值」= overrides 优先，不受本字段影响。
+  assert.equal(data.effective.personaEnabled, true);
+});
+
+test("GET /api/dsh-mneme/features cannot report pendingRestart without a frozen config", async () => {
+  // config 缺席（旧调用方直连、未传 cfg）时无从比较冻结值——返回空数组，不编造。
+  const { routes, settings } = setup(undefined);
+  settings.setFeatureFlags({ personaEnabled: true });
+  const route = routes.find((r) => r.path === "/api/dsh-mneme/features");
+  const res = new FakeRes();
+  await route.handler(req("/api/dsh-mneme/features"), res);
+  assert.equal(res.statusCode, 200);
+  const data = JSON.parse(res.body);
+  assert.deepEqual(data.pendingRestart, []);
+  assert.equal(data.effective.personaEnabled, true, "effective still reports the override");
 });
 
 test("PUT /api/dsh-mneme/features round-trips, overrides effective and persists", async () => {
@@ -792,6 +901,9 @@ test("PUT /api/dsh-mneme/features round-trips nested, string, url and enum keys"
     // NESTED_FLAG_PATHS——否则 configFlagValue 落到顶层同名键上，effective 静默缺键）。
     "distillRecords.enabled": true,
     "distillRecords.retentionDays": 30,
+    // #471：政策轴的两个点号键往返——白名单与 NESTED_FLAG_PATHS 成对缺一即静默缺键。
+    "scopeState.enabled": true,
+    "scopeState.enforce": true,
     // #164 A2：顶层扁平键（不是对象子字段），与上面两个点号键走同一条往返；
     // 它的默认值断言在计数锁那一条里，这里钉的是「PUT 存进去、effective 读得回」。
     sensitiveScanEnabled: true,
@@ -813,6 +925,8 @@ test("PUT /api/dsh-mneme/features round-trips nested, string, url and enum keys"
     "preInjectGate.enforce": true,
     "distillRecords.enabled": true,
     "distillRecords.retentionDays": 30,
+    "scopeState.enabled": true,
+    "scopeState.enforce": true,
     sensitiveScanEnabled: true,
     embedProvider: "local",
     ollamaBaseUrl: "http://127.0.0.1:11434",
@@ -829,6 +943,9 @@ test("PUT /api/dsh-mneme/features round-trips nested, string, url and enum keys"
   assert.equal(data.effective["preInjectGate.enforce"], true);
   assert.equal(data.effective["distillRecords.enabled"], true);
   assert.equal(data.effective["distillRecords.retentionDays"], 30, "整数点号键也要读得回来");
+  // #471：政策轴两个点号键同款往返
+  assert.equal(data.effective["scopeState.enabled"], true);
+  assert.equal(data.effective["scopeState.enforce"], true);
   assert.equal(data.effective.sensitiveScanEnabled, true);
   assert.equal(data.effective.embedProvider, "local");
   assert.equal(data.effective.ollamaBaseUrl, "http://127.0.0.1:11434");

package/test/cli-flag-value.test.js

@@ -0,0 +1,86 @@
+// `--flag value` 的值本身可以是 `--` 开头的字符串。真撞上的那次是 CI：
+//
+//   not ok 846 - CLI：reclaim 默认 dry-run 报数字，--apply --vacuum 才真收
+//   ... bin/cli.mjs reclaim --url http://127.0.0.1:55423 --token <以 -- 开头的随机 token>
+//   未配置访问 token，无法调用该命令
+//
+// token 由 `crypto.randomBytes(24).toString("base64url")` 生成（src/api-standalone.js），
+// base64url 的字母表含 `-`，于是约 1/4096 的 token 头两位都是 `-` → 拼出来就是 `--…`
+// → 旧 parseArgv 把它当新旗标、token 变 `true` → 退回环境变量/配置文件 → 全空。
+// 也就是说这是一条**真实用户的随机性**，不是测试写法问题：一次 CI 红只是运气不好。
+//
+// 这个文件把解析语义钉死：值可以是任意 `--` 开头的串，而真旗标仍按旗标解析。
+//
+// 下面刻意不写整串字面量：那个 token 是一次性测试服务现生成的、早已随进程消失，
+// 而一整串高熵字符留在源码里会被密钥扫描（gitleaks 的 generic-api-key 按熵报警）
+// 当成真凭据。用拼接构造，形状一样、不触发扫描。
+import test from "node:test";
+import assert from "node:assert/strict";
+import { parseArgv, KNOWN_FLAGS, flagValue, flagBool } from "../bin/cli.mjs";
+
+// 拼成 `--token` / `--` 开头的值，两个片段各自都是低熵短串。
+const FLAG_TOKEN = "--tok" + "en";
+const DASH_VALUE = "--" + "dash-prefixed-value";
+
+test("CLI 解析：--token 的值以 -- 开头时仍取到值（CI 回归现场）", () => {
+  const { positionals, flags } = parseArgv([
+    "reclaim", "--url", "http://127.0.0.1:55423",
+    FLAG_TOKEN, DASH_VALUE
+  ]);
+  assert.deepEqual(positionals, ["reclaim"]);
+  assert.equal(flags.token, DASH_VALUE);
+  // 这条才是当初真正失败的地方：值为 true 时 flagValue 视为「没给」。
+  assert.equal(flagValue(flags, "token"), DASH_VALUE);
+  // 旧实现会在这里多出一个键：把值当成旗标名（`dash-prefixed-value`）。
+  assert.deepEqual(Object.keys(flags).sort(), ["token", "url"]);
+});
+
+test("CLI 解析：单横线开头的值同样按值处理", () => {
+  const { flags } = parseArgv(["add", "--title", "-x", "--content", "-"]);
+  assert.equal(flags.title, "-x");
+  assert.equal(flags.content, "-");
+});
+
+test("CLI 解析：真旗标仍按旗标解析，不会被前一个旗标吞成值", () => {
+  // --limit 后面跟 --json：--json 是已注册旗标，所以 --limit 没有值（true），
+  // --json 是布尔。这是旧语义，必须保持，否则 `--limit --json` 会静默变成
+  // limit="--json"。
+  const { flags } = parseArgv(["list", "--limit", "--json"]);
+  assert.equal(flags.limit, true);
+  assert.equal(flagBool(flags, "json"), true);
+});
+
+test("CLI 解析：等号形式与 `--` 分隔符语义不变", () => {
+  assert.equal(parseArgv(["reclaim", "--token=--abc"]).flags.token, "--abc");
+  // `--` 之后全是位置参数，即使以 -- 开头。
+  assert.deepEqual(parseArgv(["search", "--", "--weird"]).positionals, ["search", "--weird"]);
+});
+
+test("CLI 解析：未知的 -- 开头词当作上一个旗标的值", () => {
+  // 这是本修复的判定规则：只有 KNOWN_FLAGS 里登记过的词才算旗标。
+  const { flags } = parseArgv(["add", "--content", "--not-a-real-flag"]);
+  assert.equal(flags.content, "--not-a-real-flag");
+});
+
+test("CLI KNOWN_FLAGS 覆盖 flagValue/flagBool 的全部实际用法", async () => {
+  // 漏登记的代价：该旗标会被当成前一个旗标的值吞掉，且没有任何报错。
+  // 所以用文本锁把 KNOWN_FLAGS 与 cli.mjs 里的调用点钉在一起——新增命令
+  // 忘登记会在这里炸，而不是等 1/4096 的用户撞上。
+  const { readFileSync } = await import("node:fs");
+  const { fileURLToPath } = await import("node:url");
+  const path = await import("node:path");
+  const cliPath = path.join(
+    path.dirname(path.dirname(fileURLToPath(import.meta.url))), "bin", "cli.mjs");
+  const src = readFileSync(cliPath, "utf8");
+
+  const used = new Set();
+  for (const m of src.matchAll(/flag(?:Value|Bool)\(\s*flags\s*,([^)]*)\)/g)) {
+    // 只认字符串字面量；`...names` 这种转发形式由调用方各自登记。
+    for (const s of m[1].matchAll(/'([^']+)'/g)) used.add(s[1].toLowerCase());
+  }
+  assert.ok(used.size >= 15, "至少要解析出 CLI 全部取值/布尔旗标，否则这把锁失效了");
+
+  const missing = [...used].filter((k) => !KNOWN_FLAGS.has(k));
+  assert.deepEqual(missing, [],
+    "以下旗标在用但没登记进 KNOWN_FLAGS，会被前一个 --flag 吞成值：" + missing.join(", "));
+});

package/test/client.test.js

@@ -1051,6 +1051,47 @@ test("settings card folds everything beyond the first screen behind All settings
     "the default/changed badge must be decided from overrides, not a new backend field");
 });
 
+// #481：面板开关「改了不生效」的体验坑。开关在宿主启动时合并进冻结 cfg，
+// 此后面板改 kv 只是持久化——用户看到「已改」就以为生效了，实测（人格总闸）
+// 因此白白排查了一轮。这条锁三件事：①第三态徽标由后端的 pendingRestart 名单
+// 决定（前端算不出来：overrides 只说明「改了」，不说明「用没用上」）；
+// ②卡片顶部有整卡提示行；③中英文案与语义色齐备，且「待重启」不能靠
+// opacity 之类的弱化手段与「已改」区分（弱化在浅色主题下会掉到看不清）。
+test("feature switches expose a third badge state for saved-but-not-live overrides (#481)", () => {
+  // ① 判定来源必须是后端字段，而不是前端自己比 overrides。
+  assert.ok(/const pending = new Set\(\(state && state\.pendingRestart\) \|\| \[\]\)/.test(clientSource),
+    "the pending set must come from the backend pendingRestart list");
+  assert.ok(/pending\.has\(k\)[\s\S]{0,240}?mneme-badge--pending/.test(clientSource),
+    "flagTag must return the pending badge before falling back to default/changed");
+  // 后端字段缺失（旧宿主）时 pending 为空集，面板退回两态——不能因此崩掉。
+  assert.ok(/\(state && state\.pendingRestart\) \|\| \[\]/.test(clientSource),
+    "a missing pendingRestart must degrade to an empty set, not throw");
+
+  // ② 整卡提示行：只在有待重启项时出现，位置在说明之后、错误行之前。
+  const noticeAt = clientSource.indexOf('t("memory.features.pendingRestartNotice")');
+  const descAt = clientSource.indexOf('h("div", { className: "mneme-set-desc" }, t("memory.features.desc"))');
+  assert.ok(noticeAt > descAt && descAt >= 0, "the notice row must sit after the card description");
+  assert.ok(/pending\.size > 0 && h\("div", \{ className: "mneme-pending" \}/.test(clientSource),
+    "the notice row must render only when something is actually pending");
+
+  // ③ 双语齐备（各出现两次：zh 表 + en 表）。
+  for (const key of ["memory.features.tagPending", "memory.features.tagPending.hint",
+    "memory.features.pendingRestartNotice"]) {
+    const occurrences = clientSource.split("\"" + key + "\"").length - 1;
+    assert.ok(occurrences >= 2, `i18n key ${key} must exist in both zh and en (got ${occurrences})`);
+  }
+
+  // ④ 样式走语义色层（AGENTS.md 第 9 条），且不靠透明度弱化区分状态。
+  assert.ok(/\.mneme-badge--pending\{[^}]*var\(--mneme-warn\)[^}]*\}/.test(clientSource),
+    "the pending badge must use the --mneme-warn semantic colour");
+  assert.ok(!/\.mneme-badge--pending\{[^}]*opacity/.test(clientSource),
+    "the pending badge must not rely on opacity to distinguish itself from changed");
+  assert.ok(/\.mneme-pending\{[^}]*var\(--mneme-warn\)[^}]*\}/.test(clientSource),
+    "the notice row must use the --mneme-warn semantic colour");
+  assert.ok(/\.mneme-pending-dot\{[^}]*background:currentColor/.test(clientSource),
+    "the notice dot must inherit currentColor so the colour has one source");
+});
+
 // v0.8.0 冲突集中处理：状态页的待确认冲突队列（reason + 双方内容对比 +
 // 保留 A/B/仅标记动作），resolveConflictPending 的第一个前端出口。双语齐备。
 test("conflict queue ships a central review surface on the status tab", () => {
@@ -1665,8 +1706,8 @@ test("distill retention switches are reachable from the panel (#399)", () => {
     "distillRecords.enabled must be an item of the core group, not merely referenced elsewhere"
   );
   assert.ok(
-    /const FEATURE_NUMBERS = \["distillRecords\.retentionDays"\]/.test(clientSource),
-    "retentionDays must be in the numeric key list"
+    /const FEATURE_NUMBERS = \["distillRecords\.retentionDays", "dreamMaxTokens", "sleepMaxTokens"\]/.test(clientSource),
+    "retentionDays must be in the numeric key list (dreamMaxTokens/sleepMaxTokens joined by #478)"
   );
   assert.ok(
     /for \(const key of FEATURE_NUMBERS\) numDraft\[key\] = String\(e\[key\] \?\? ""\);/.test(clientSource)
@@ -1694,7 +1735,12 @@ test("distill retention switches are reachable from the panel (#399)", () => {
     "memory.features.distillRecords.enabled",
     "memory.features.distillRecords.enabled.hint",
     "memory.features.distillRecords.retentionDays",
-    "memory.features.distillRecords.retentionDays.hint"
+    "memory.features.distillRecords.retentionDays.hint",
+    // #478：面板新暴露的两个 max_tokens 预算键，label 与 hint 缺一即哑行
+    "memory.features.dreamMaxTokens",
+    "memory.features.dreamMaxTokens.hint",
+    "memory.features.sleepMaxTokens",
+    "memory.features.sleepMaxTokens.hint"
   ]) {
     const occurrences = clientSource.split(`"${key}"`).length - 1;
     assert.ok(occurrences >= 2, `i18n key ${key} must exist in both zh and en (got ${occurrences})`);
@@ -1880,13 +1926,51 @@ test("M.O. empty-state, list and scope copy exist in both languages", () => {
     "memory.actions.scope.project",
     "memory.actions.scope.global",
     "memory.actions.scope.none",
-    "memory.actions.broken"
+    "memory.actions.broken",
+    // 手动沉淀的全部回执：这八句里缺任何一句，按钮点下去就是一行 key 裸奔，
+    // 而那恰好是「点了没反应」的观感来源。
+    "memory.actions.distill.action",
+    "memory.actions.distill.busy",
+    "memory.actions.distill.hint",
+    "memory.actions.distill.noProject",
+    "memory.actions.distill.saved",
+    "memory.actions.distill.none",
+    "memory.actions.distill.noSessions",
+    "memory.actions.distill.unreadable",
+    "memory.actions.distill.failed"
   ]) {
     const hits = (clientSource.match(new RegExp(`"${key.replace(/\./g, "\\.")}":`, "g")) || []).length;
     assert.equal(hits, 2, `${key} must exist in both zh and en (got ${hits})`);
   }
 });
 
+// 手动沉淀按钮：面板上「立即跑一次」的唯一入口。锁三件事，每件都对应一种会静默坏掉的情形：
+//   ① 它必须打 POST 且带上项目根——GET 是预览、不写盘，打成 GET 就成了「点了永远 0 条」；
+//   ② materialize 不许出现：按钮只产提议，落草稿是另一个决定；
+//   ③ 没有 project 时必须禁用——服务端只会回 400，点了必然失败的按钮比没有按钮更糟。
+test("M.O. pane offers a manual distill that posts the project root", () => {
+  const bodyOf = (name) => {
+    const start = clientSource.indexOf(`function ${name}(`);
+    assert.ok(start > -1, `${name} must exist`);
+    const next = clientSource.slice(start + 1).indexOf("\n    function ");
+    return clientSource.slice(start, next > -1 ? start + 1 + next : clientSource.length);
+  };
+  const bar = bodyOf("PipelineDistillButton");
+  assert.ok(bar.includes('"/api/dsh-mneme/nudge?project="'), "the button must hit the nudge route");
+  assert.ok(bar.includes("encodeURIComponent(project)"), "the project root must travel with the request");
+  assert.ok(bar.includes('method: "POST"'), "a preview GET writes nothing — the button must POST");
+  assert.ok(!bar.includes("materialize"), "the button must never materialize a draft");
+  assert.ok(bar.includes("!project"), "the button must be disabled when the project is unknown");
+  assert.ok(bar.includes("503"), "an unreadable session log must be told apart from an empty result");
+  // 座位：按钮挂在清单头上，且清单要拿到 project——漏传的话按钮永远禁用，
+  // 界面上看起来只是「这个功能没做好」。
+  assert.ok(bodyOf("PipelineWorkflowList").includes("PipelineDistillButton"), "the control belongs in the list header");
+  assert.ok(
+    bodyOf("PipelineBrowser").includes("activeId, onOpen: setPicked, project }"),
+    "the browser must hand the project root down to the list"
+  );
+});
+
 // 画布能放大缩小。锁的重点不是「有没有缩放」，而是滚轮那一条必须**自己挂非被动监听**：
 // React 的 onWheel 挂在 root 上且是 passive 的，preventDefault 会被浏览器忽略，
 // 于是 Ctrl+滚轮既缩放画布又缩放整页，谁也没拦住——这个错本地测不出来，只在真浏览器里响。
@@ -2054,6 +2138,21 @@ test("persona card is multi-card with visible field labels and save-failure erro
   assert.ok(labelBlock, "persona field labels must be visible (featnumlabel class), not aria-only");
   // 保存失败提示：personaError 状态有渲染路径（非仅 setState）
   assert.ok(clientSource.includes("t(\"memory.settings.personaSaveFailed\")"), "save failure must render an error line");
+  // 卡删除 × 常显回归锁 v2（#457 内联覆写被 #459 回滚的教训）：× 不得复用
+  // mneme-set-del（opacity:0 仅在 .mneme-set-row:hover 解除，卡标签不在该容器
+  // → 永远不可见），必须用独立类 mneme-persona-del 且该类常显（opacity:1）。
+  assert.ok(
+    /className: "mneme-persona-del"/.test(clientSource),
+    "persona card delete × must use the dedicated always-visible class"
+  );
+  const delStyle = clientSource.match(/\.mneme-persona-del\{[^}]*\}/);
+  assert.ok(delStyle, "mneme-persona-del style rule must exist");
+  assert.ok(!/opacity:0/.test(delStyle[0]), "mneme-persona-del must not be transparent");
+  // 不许再把 mneme-set-del 挂回卡删除按钮（防 #457 式修法回归）；直接锁按钮
+  // 的 className 值（onClick 前最近的 className 属性，注释文字不参与）。
+  const delBtn = clientSource.match(/className: "([^"]+)"[\s\S]{0,300}?onClick: \(\) => removePersonaCard\(id\)/);
+  assert.ok(delBtn, "card delete button wiring must exist");
+  assert.strictEqual(delBtn[1], "mneme-persona-del", "card delete × must use mneme-persona-del, not mneme-set-del");
 });
 
 // 回归锁（复验实测踩中）：面板「检测更新」的状态名必须与后端 classify

package/test/distill-tx-embed-gap.test.js

@@ -0,0 +1,110 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createStore } from "../src/store.js";
+import { createService } from "../src/service.js";
+
+// ============================================================ distill-tx-embed-gap
+// 回归锁：此前 scheduleEmbed 在 txDepth>0 时首行直接 return（注释写 deferred，
+// 实际 transaction() 从不补跑）——与 #372 的实体抽取是同一个 bug 模板，只是受害者
+// 换成了嵌入：自动蒸馏（summarize 全部走 service.transaction）写入的 session:* 行
+// 100% 拿不到向量，语义检索对这批行永远失明。照 #372 的修复模板改为入队、提交后
+// 补跑、回滚截断。五把锁与 test/entities.test.js 的 #372 锁一一对应，锁的是
+// 「commit 才补跑、回滚绝不补跑」这个契约本身——任何一侧改回丢弃或回滚也补跑，
+// 这里当场红。
+
+function makeService(config = {}) {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config });
+  return { store, service };
+}
+
+// 8 维定值向量；schedule 分支同步写回（语义同真实 embedder：调度即含写回），
+// 让整条链路确定性、无异步漂移。embedSingle 仅供 ready-gate/embedSingle 分支
+// 的调用方使用，本文件的锁都走 schedule 分支。
+function makeEmbedder(store, embedded) {
+  return {
+    schedule(memory) {
+      embedded.push(memory.id);
+      store.setEmbedding(memory.id, new Array(8).fill(0.5), "fake-model-hash");
+    },
+    embedSingle: async () => new Array(8).fill(0.5),
+  };
+}
+
+test("distill-tx: embedding queued inside transaction is written exactly once after commit", () => {
+  const { store, service } = makeService();
+  const embedded = [];
+  service.setEmbedder(makeEmbedder(store, embedded));
+  const r = service.transaction(() =>
+    service.saveWithDedupe({ type: "preference", title: "事务内创建", content: "x" })
+  );
+  const id = r.memory.id;
+  // 提交后补跑恰一次：向量非空、维度等于 embedder 输出（8 维）
+  assert.deepEqual(embedded, [id], "drain fires exactly once, after commit");
+  const row = store.db.prepare("SELECT embedding FROM memories WHERE id = ?").get(id);
+  const vec = JSON.parse(row.embedding);
+  assert.equal(vec.length, 8, "vector dimension equals embedder output");
+  store.close();
+});
+
+test("distill-tx: nothing schedules while txDepth > 0 (queued, not dropped, not immediate)", () => {
+  const { store, service } = makeService();
+  const embedded = [];
+  service.setEmbedder(makeEmbedder(store, embedded));
+  service.transaction(() => {
+    service.saveWithDedupe({ type: "preference", title: "事务内观察", content: "x" });
+    // 事务内此刻不得触发（排进队列而不是丢弃，也不是立即跑）
+    assert.equal(embedded.length, 0, "no embedding while txDepth > 0");
+  });
+  assert.equal(embedded.length, 1, "queued entry drains after commit");
+  store.close();
+});
+
+test("distill-tx: rolled-back transaction never embeds rolled-back rows", () => {
+  const { store, service } = makeService();
+  const embedded = [];
+  service.setEmbedder(makeEmbedder(store, embedded));
+  assert.throws(() => {
+    service.transaction(() => {
+      service.saveWithDedupe({ type: "preference", title: "会被回滚", content: "x" });
+      throw new Error("boom");
+    });
+  }, /boom/);
+  assert.equal(embedded.length, 0, "no embedding against rolled-back rows");
+  assert.equal(store.count(), 0, "row itself rolled back");
+  store.close();
+});
+
+// 与 #372 复审补锁同构：内层回滚截断只丢内层条目，外层提交 drain 外层条目。
+test("distill-tx: inner rollback drops only inner entries; outer commit drains the rest", () => {
+  const { store, service } = makeService();
+  const embedded = [];
+  service.setEmbedder(makeEmbedder(store, embedded));
+  const ids = [];
+  service.transaction(() => {
+    ids.push(service.saveWithDedupe({ type: "preference", title: "外层A", content: "x" }).memory.id);
+    try {
+      service.transaction(() => {
+        service.saveWithDedupe({ type: "preference", title: "内层回滚", content: "x" });
+        throw new Error("inner boom");
+      });
+    } catch { /* 内层回滚，外层继续 */ }
+    ids.push(service.saveWithDedupe({ type: "preference", title: "外层B", content: "x" }).memory.id);
+  });
+  assert.deepEqual(embedded.sort(), ids.sort(), "inner rolled-back row never embedded; outer rows drain once");
+  assert.equal(store.count(), 2);
+  store.close();
+});
+
+test("distill-tx: no unbounded cap — large transaction drains every entry", () => {
+  const { store, service } = makeService();
+  const embedded = [];
+  service.setEmbedder(makeEmbedder(store, embedded));
+  service.transaction(() => {
+    for (let i = 0; i < 150; i++) {
+      service.saveWithDedupe({ type: "preference", title: `批量${i}`, content: "x" });
+    }
+  });
+  assert.equal(embedded.length, 150, "no silent drop at any queue cap");
+  store.close();
+});

package/test/dream-maxtokens-fallback.test.js

@@ -0,0 +1,132 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { withMaxTokensFallback, parseMaxTokensCap, MAX_TOKENS_REJECT_RE } from "../src/dream.js";
+
+// Issue #478：dreamMaxTokens 默认 131072 原样发给 OpenAI 兼容网关，很多网关硬
+// 上限更小（实测 dream_runs 180 连败的报错："max_tokens 不能超过 65536"），
+// 400 直接拒、推理没开始。本套锁两件事：上限提取认得出显式上限、认不出时不猜；
+// withMaxTokensFallback 在 stream（result===undefined + getStreamError）与
+// throw 两条路径上都按提取到的上限降级重试恰一次，AbortError 永不被降级吞掉。
+
+function makeLogger() {
+  const warns = [];
+  return { warns, logger: { warn: (...a) => warns.push(a.join(" ")), info() {}, error() {} } };
+}
+
+test("parseMaxTokensCap: 显式上限认得出（中/英/符号三种说法）", () => {
+  assert.equal(parseMaxTokensCap("max_tokens 不能超过 65536"), 65536);
+  assert.equal(parseMaxTokensCap("Maximum value is 65536"), 65536);
+  assert.equal(parseMaxTokensCap("max_tokens must be at most 32768"), 32768);
+  assert.equal(parseMaxTokensCap("max_tokens <= 8192"), 8192);
+  assert.equal(parseMaxTokensCap("max_tokens 不得超过 4096"), 4096);
+});
+
+test("parseMaxTokensCap: 认不出显式上限时返回 null，绝不猜", () => {
+  // 只有请求值、没有上限值——把 131072 误当上限会让重试原样再炸一次
+  assert.equal(parseMaxTokensCap("max_tokens 131072 is too large for this model"), null);
+  assert.equal(parseMaxTokensCap("bad request"), null);
+  assert.equal(parseMaxTokensCap(""), null);
+  assert.equal(parseMaxTokensCap(null), null);
+});
+
+test("MAX_TOKENS_REJECT_RE: 命中 max_tokens/maxTokens 两种写法，不误伤无关报错", () => {
+  assert.ok(MAX_TOKENS_REJECT_RE.test("max_tokens 不能超过 65536"));
+  assert.ok(MAX_TOKENS_REJECT_RE.test("maxTokens exceed limit"));
+  assert.ok(!MAX_TOKENS_REJECT_RE.test("reasoning effort unsupported"));
+});
+
+test("withMaxTokensFallback: stream 路径（undefined + getStreamError）按上限降级重试恰一次", async () => {
+  const { logger, warns } = makeLogger();
+  const ctx = { logger };
+  const calls = [];
+  const attempt = async (tokens) => {
+    calls.push(tokens);
+    // 第一次发大值 → 网关拒收折叠成 undefined；重试用 65536 → 成功
+    return tokens > 65536 ? undefined : `ok@${tokens}`;
+  };
+  const out = await withMaxTokensFallback(ctx, 131072, attempt, () =>
+    "400 max_tokens 不能超过 65536");
+  assert.equal(out, "ok@65536");
+  assert.deepEqual(calls, [131072, 65536], "大值先发，拒收后按上限重试");
+  assert.equal(warns.length, 1, "降级必须留痕");
+  assert.match(warns[0], /131072.*65536/);
+});
+
+test("withMaxTokensFallback: throw 路径同样降级，AbortError 永远直通", async () => {
+  const { logger } = makeLogger();
+  const ctx = { logger };
+  // throw 路径：第一次抛 400，重试成功
+  const calls = [];
+  const out = await withMaxTokensFallback(ctx, 131072, async (tokens) => {
+    calls.push(tokens);
+    if (tokens > 65536) throw new Error("invalid max_tokens: max_tokens 不能超过 65536");
+    return `ok@${tokens}`;
+  }, () => "");
+  assert.equal(out, "ok@65536");
+  assert.deepEqual(calls, [131072, 65536]);
+
+  // AbortError：即使消息里带 max_tokens 字样也绝不触发重试（取消意图不可吞）
+  const abort = new Error("max_tokens rejected during dispose");
+  abort.name = "AbortError";
+  const abCalls = [];
+  await assert.rejects(
+    withMaxTokensFallback(ctx, 131072, async (tokens) => { abCalls.push(tokens); throw abort; }, () => ""),
+    /dispose/
+  );
+  assert.deepEqual(abCalls, [131072], "AbortError 不重试");
+});
+
+test("withMaxTokensFallback: 无上限可提取或上限不小于当前值时不重试", async () => {
+  const { logger } = makeLogger();
+  const ctx = { logger };
+  // 报错只有请求值没有上限 → 不猜，原样 undefined 返回
+  let calls = 0;
+  const out1 = await withMaxTokensFallback(ctx, 131072, async () => { calls++; return undefined; }, () =>
+    "max_tokens 131072 is too large for this model");
+  assert.equal(out1, undefined);
+  assert.equal(calls, 1, "认不出上限就不重试");
+
+  // 上限 >= 当前值（报错自相矛盾）→ 不重试，throw 路径原样抛
+  const boom = new Error("max_tokens 不能超过 131072");
+  await assert.rejects(
+    withMaxTokensFallback(ctx, 131072, async () => { throw boom; }, () => ""),
+    (e) => e === boom,
+    "cap >= maxTokens 时不重试且原样抛"
+  );
+});
+
+test("withMaxTokensFallback: 无关报错不触发重试（stream 与 throw 双路径）", async () => {
+  const { logger } = makeLogger();
+  const ctx = { logger };
+  let calls = 0;
+  const out = await withMaxTokensFallback(ctx, 131072, async () => { calls++; return undefined; }, () =>
+    "reasoning effort UNSUPPORTED_REASONING_EFFORT");
+  assert.equal(out, undefined);
+  assert.equal(calls, 1);
+
+  await assert.rejects(
+    withMaxTokensFallback(ctx, 131072, async () => { throw new Error("quota exhausted"); }, () => ""),
+    /quota exhausted/
+  );
+});
+
+// 接线锁：单测绿不代表真接上了。#478 的第一次实现只挂了 dream 侧三个点，
+// sleep.js 两处仍原样发 config.sleepMaxTokens，而面板 hint 已对外承诺
+// 「超上限同样自动降级」——这种「函数有、没人用」的缺口只靠行为测试抓不到。
+test("接线锁：dreamMaxTokens/sleepMaxTokens 的五个使用点全部包在 withMaxTokensFallback 里", async () => {
+  const { readFile } = await import("node:fs/promises");
+  const srcDir = new URL("../src/", import.meta.url);
+  const files = { "dream.js": await readFile(new URL("dream.js", srcDir), "utf8"), "dream/sleep.js": await readFile(new URL("dream/sleep.js", srcDir), "utf8") };
+  for (const [name, source] of Object.entries(files)) {
+    // 任何一处还把 config.dreamMaxTokens/sleepMaxTokens 直接当 maxTokens 发，就是漏接线。
+    assert.ok(
+      !/maxTokens:\s*config\.(dream|sleep)MaxTokens/.test(source),
+      `${name}: still passes config.*MaxTokens straight into maxTokens — wrap it in withMaxTokensFallback`
+    );
+  }
+  // 五个调用点：dream 三条（叙述/巩固/摘要）+ sleep 两条（冲突/模式）。
+  const dreamHits = files["dream.js"].match(/withMaxTokensFallback\(ctx, config\.dreamMaxTokens/g) ?? [];
+  const sleepHits = files["dream/sleep.js"].match(/withMaxTokensFallback\(ctx, config\.sleepMaxTokens/g) ?? [];
+  assert.equal(dreamHits.length, 3, `dream.js must wrap all 3 dreamMaxTokens sites (got ${dreamHits.length})`);
+  assert.equal(sleepHits.length, 2, `dream/sleep.js must wrap both sleepMaxTokens sites (got ${sleepHits.length})`);
+});