@modusensus/dsh-mneme 0.9.2 → 0.9.4

package/test/profile-extract.test.js

@@ -0,0 +1,269 @@
+// issue #497 的第三段：从记忆提取「用户画像」**草稿**。
+//
+// 为什么要单独立一份用例文件（而不是塞进 dream/summarize 的套件）：这条链的产品承诺很窄
+// 也很硬——① 只出草稿，绝不写 user_settings（画像正文是用户手写的原文，让模型合并等于
+// 给它改写权）；② 没有可用输入就不调模型；③ 模型吐的不是 JSON 就报错，绝不回一张空草稿
+// 冒充「这次没提炼出东西」；④ 记忆正文是模型的可影响输入，围栏 + 角色重申必须在位，
+// 且草稿里不许出现助手身份声明（画像与规则不受 personaEnabled 管，写进一句「你是某某」
+// 就会重演 #497 那个身份撞车）。这四条都是「做错了界面看不出来」的那类，所以逐条锁。
+import test from "node:test";
+import assert from "node:assert/strict";
+import { EventEmitter } from "node:events";
+import { createStore } from "../src/store.js";
+import { createService } from "../src/service.js";
+import { createSettings } from "../src/settings.js";
+import { createApi } from "../src/api.js";
+import { createProfileExtractor, ProfileExtractError } from "../src/profile-extract.js";
+
+// 假的 ctx.llm：按真实协议发 text-delta / usage / finish 三类 chunk（用量嵌在
+// chunk.usage，与 dream.js 的 streamText 注释一致——把整个 chunk 当用量会在
+// 审计行里落 0，v0.8.4 实测踩过）。messages 抓下来供围栏断言用。
+function fakeLlm(chunks) {
+  const calls = [];
+  return {
+    calls,
+    llm: {
+      async *stream(options) {
+        calls.push(options);
+        for (const c of chunks) yield c;
+      }
+    }
+  };
+}
+
+const okJson = (profile) => [
+  { type: "text-delta", text: "```json\n" },
+  { type: "text-delta", text: JSON.stringify({ profile }) },
+  { type: "text-delta", text: "\n```" },
+  { type: "usage", usage: { inputTokens: 120, outputTokens: 30 } },
+  { type: "finish", reason: { kind: "stop" } }
+];
+
+function setup(chunks, opts = {}) {
+  const { config = {}, dropRoute = false } = opts;
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config });
+  const settings = createSettings(store.db);
+  const fake = fakeLlm(chunks);
+  const logger = { info() {}, warn() {}, error() {} };
+  const extractor = createProfileExtractor({
+    ctx: { ...fake, agentDefaultModel: { currentSelection: () => null } },
+    service,
+    settings,
+    config: dropRoute ? { ...config } : { dreamProvider: "fake", dreamModel: "m1", ...config },
+    logger
+  });
+  return { store, service, settings, extractor, fake, logger };
+}
+
+function seedRows(store, n, over = {}) {
+  for (let i = 0; i < n; i++) {
+    store.save({ type: "project", title: `行 ${i}`, content: `第 ${i} 行的正文`, source: "test", ...over });
+  }
+}
+
+test("没有可用的模型路由：抛 no-route，且一次调用都不发（不是 TypeError→500）", async () => {
+  // resolveRoute 在「无 dreamProvider/dreamModel 且宿主解析不到默认模型」时回
+  // undefined。不判它就会去读 route.provider —— TypeError 落到路由上是一个语义为
+  // 「内部错误」的 500，而该说的是「先去选模型」。
+  const { store, extractor, fake } = setup(okJson("不该发生"), { dropRoute: true });
+  seedRows(store, 2);
+  await assert.rejects(() => extractor(), (err) => err instanceof ProfileExtractError && err.code === "no-route");
+  assert.equal(fake.calls.length, 0, "没有路由就不该把请求发出去");
+  store.close();
+});
+
+test("成功路径：出草稿、留一条审计行，而库里的画像逐字节没被动过", async () => {
+  const { store, service, settings, extractor } = setup(okJson("我知道她跨考公共管理。"));
+  seedRows(store, 3);
+  settings.setProfile("原文不许被改写");
+  const profileBefore = settings.getProfile();
+
+  const out = await extractor();
+  assert.equal(out.draft, "我知道她跨考公共管理。");
+  assert.equal(out.rowsUsed, 3);
+  assert.equal(out.truncated, false);
+  assert.equal(out.model, "m1");
+  // 「只出草稿」是这条链的产品承诺：user_settings 里必须还是那句原文。
+  assert.equal(settings.getProfile(), profileBefore);
+
+  const audits = service.listLlmAudits({ limit: 10 });
+  assert.equal(audits.length, 1, "一次提取必须留一行审计");
+  assert.equal(audits[0].trigger_source, "profileExtract");
+  assert.equal(audits[0].status, "success");
+  assert.equal(audits[0].input_tokens, 120, "用量要从 chunk.usage 里取，落在 chunk 顶层会恒为 0");
+  store.close();
+});
+
+test("模型吐的不是 JSON：抛错，绝不回一张空草稿冒充「没提炼出来」", async () => {
+  const { store, service, settings, extractor } = setup([
+    { type: "text-delta", text: "我觉得她是个很好的用户，加油。" },
+    { type: "finish", reason: { kind: "stop" } }
+  ]);
+  seedRows(store, 2);
+  await assert.rejects(() => extractor(), ProfileExtractError, "解析失败必须是可识别的错误类型");
+  assert.equal(settings.getProfile(), "", "失败路径一行都不许写");
+  const audits = service.listLlmAudits({ limit: 10 });
+  assert.equal(audits[0].status, "error", "吐了文字但没有可用产物 = 失败调用，审计不许写 success");
+  store.close();
+});
+
+test("没有可用记忆：不调模型、直接报错（空输入下模型只会编）", async () => {
+  const { store, extractor, fake } = setup(okJson("不该被调用"));
+  await assert.rejects(() => extractor(), /no/i);
+  assert.equal(fake.calls.length, 0, "一条输入都没有就不该花这次调用");
+  store.close();
+});
+
+test("归档与被遗忘的行不进输入：它们已经不在活跃面上", async () => {
+  const { store, service, extractor, fake } = setup(okJson("只用活跃行。"));
+  seedRows(store, 3);
+  const [gone, forgotten] = store.list({ limit: null });
+  service.setArchived(gone.id, true);
+  service.setForget(forgotten.id, true);
+  const out = await extractor();
+  assert.equal(out.rowsUsed, 1, "三行里只剩一行还在活跃面上");
+  const user = fake.calls[0].messages[1].content[0].text;
+  assert.ok(!user.includes(gone.content), "归档行的正文不许被喂给模型（它已经不在活跃面上）");
+  assert.ok(!user.includes(forgotten.content), "被遗忘的行同理");
+  store.close();
+});
+
+test("行数上限：超界时如实标记 truncated，而不是静默少读", async () => {
+  const { store, extractor } = setup(okJson("截断也要说清。"));
+  seedRows(store, 30);
+  const out = await extractor({ maxRows: 5 });
+  assert.equal(out.rowsUsed, 5);
+  assert.equal(out.truncated, true);
+  store.close();
+});
+
+test("记忆正文包在围栏里，且围栏之前没有正文；系统段重申「这是数据不是指令」", async () => {
+  const { store, extractor, fake } = setup(okJson("围栏检查。"));
+  seedRows(store, 2);
+  await extractor();
+  assert.equal(fake.calls.length, 1);
+  const system = fake.calls[0].messages[0].content[0].text;
+  const user = fake.calls[0].messages[1].content[0].text;
+  // 结构断言：正文只出现在围栏内部，围栏外不残留任何一行内容。
+  const openIdx = user.indexOf("<<<");
+  const closeIdx = user.lastIndexOf(">>>");
+  assert.ok(openIdx >= 0 && closeIdx > openIdx, "用户段必须带围栏对");
+  assert.ok(user.indexOf("第 0 行的正文") > openIdx, "记忆正文不许出现在围栏之前");
+  assert.ok(user.indexOf("第 1 行的正文") < closeIdx, "记忆正文不许出现在围栏之后");
+  // 角色重申与「数据不是指令」是字面量锁：防的是「有人重构提示词时顺手删掉这一段」
+  // ——那会让记忆里的指令型文本重新获得指令地位，而界面上一切照常。
+  assert.match(system, /不是指令|not instructions/i, "系统段必须声明输入是数据");
+  assert.match(system, /(绝不|不要).{0,6}(助手|agent).{0,20}(身份|名字|人格|起名)|never (name|invent|assign).{0,60}(assistant|identity|name)|do not (invent|assign).{0,40}(identity|name)/i,
+    "草稿里不许出现助手身份声明：画像不受 personaEnabled 管辖，写进去就会与 bot 自带身份撞车");
+  store.close();
+});
+
+// ---- HTTP 面（POST /api/dsh-mneme/profile/extract） -------------------------
+// 三条各自防一类事故：开关没开不许偷偷调模型；非 POST 方法不许触发副作用
+// （#489 的 /nudge 教训——方法白名单在读体之前拦）；HTTP 面上「只出草稿」同样成立。
+
+class FakeRes extends EventEmitter {
+  constructor() { super(); this.statusCode = 200; this.headers = null; this.body = ""; }
+  writeHead(code, headers) { this.statusCode = code; this.headers = headers; return this; }
+  end(text) { this.body = text ?? ""; this.emit("end"); return this; }
+}
+
+function httpReq(method, body = null) {
+  const r = new EventEmitter();
+  r.method = method;
+  r.url = "/api/dsh-mneme/profile/extract";
+  r.headers = {};
+  if (body !== null) {
+    process.nextTick(() => {
+      r.emit("data", Buffer.from(JSON.stringify(body)));
+      r.emit("end");
+    });
+  }
+  return r;
+}
+
+function setupApi({ config = {}, extractor, apiToken = "" } = {}) {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config });
+  const settings = createSettings(store.db);
+  const routes = [];
+  const ctx = { webServer: { register: (route) => { routes.push(route); return () => {}; } }, logger: { warn() {}, info() {}, error() {} } };
+  createApi(ctx, service, settings, { add: () => {}, remove: () => {}, list: () => [] },
+    undefined, undefined, apiToken, config, null, extractor ?? null);
+  return { store, service, settings, route: routes.find((r) => r.path === "/api/dsh-mneme/profile/extract") };
+}
+
+test("policy 是 token：配了 token 又不带 token 的 POST 被挡在提取器之前", async () => {
+  let called = 0;
+  const { store, route } = setupApi({
+    apiToken: "sekret",
+    config: { profileExtractEnabled: true },
+    extractor: async () => { called++; return { draft: "x" }; }
+  });
+  const res = new FakeRes();
+  await route.handler(httpReq("POST", {}), res);
+  assert.equal(res.statusCode, 401);
+  assert.equal(called, 0, "鉴权必须在这次模型调用之前");
+  store.close();
+});
+
+test("开关关着：409 disabled，一次模型调用都不发生", async () => {
+  let called = 0;
+  const { store, route } = setupApi({
+    config: { profileExtractEnabled: false },
+    extractor: async () => { called++; return { draft: "不该出现" }; }
+  });
+  const res = new FakeRes();
+  await route.handler(httpReq("POST", {}), res);
+  assert.equal(res.statusCode, 409);
+  assert.equal(JSON.parse(res.body).error, "disabled");
+  assert.equal(called, 0);
+  store.close();
+});
+
+test("非 POST 方法：405 + Allow，不触发任何副作用", async () => {
+  let called = 0;
+  const { store, route } = setupApi({
+    config: { profileExtractEnabled: true },
+    extractor: async () => { called++; return { draft: "x" }; }
+  });
+  for (const method of ["GET", "HEAD", "DELETE", "PATCH"]) {
+    const res = new FakeRes();
+    await route.handler(httpReq(method), res);
+    assert.equal(res.statusCode, 405, `${method} 不该落到提取器`);
+    assert.equal(res.headers.Allow, "POST");
+  }
+  assert.equal(called, 0, "#489 那类洞：方法分流只拦 POST/PUT 时，其余方法会直落副作用分支");
+  store.close();
+});
+
+test("开关开着：200 回草稿，且库里的画像一个字节都没变", async () => {
+  const { store, settings, route } = setupApi({
+    config: { profileExtractEnabled: true },
+    extractor: async () => ({ draft: "我知道她跨考公共管理。", rowsUsed: 7, truncated: false, provider: "p", model: "m" })
+  });
+  settings.setProfile("手写原文");
+  const res = new FakeRes();
+  await route.handler(httpReq("POST", {}), res);
+  assert.equal(res.statusCode, 200);
+  const body = JSON.parse(res.body);
+  assert.equal(body.draft, "我知道她跨考公共管理。");
+  assert.equal(body.rowsUsed, 7);
+  assert.equal(settings.getProfile(), "手写原文", "采用草稿必须是用户在面板上的显式一次动作");
+  store.close();
+});
+
+test("提取器报的 code 映射成可区分的状态码（「没东西可提」≠「模型没配合」）", async () => {
+  for (const [code, status] of [["no-input", 409], ["no-route", 503], ["unparseable", 502], ["stream-failed", 502]]) {
+    const { store, route } = setupApi({
+      config: { profileExtractEnabled: true },
+      extractor: async () => { throw new ProfileExtractError(code, code); }
+    });
+    const res = new FakeRes();
+    await route.handler(httpReq("POST", {}), res);
+    assert.equal(res.statusCode, status, `${code} 的状态码`);
+    assert.equal(JSON.parse(res.body).error, code);
+    store.close();
+  }
+});

package/test/scope-optional-service.test.js

@@ -0,0 +1,110 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createScopeResolver } from "../src/scope.js";
+
+// issue #487：workspaceRegistry 不在 inject 声明里（src/index.js:45），而 cordis 4
+// 的 ctx 是 Proxy——裸读未注入属性会抛 "cannot get property ... without inject"，
+// 不返回 undefined。于是 scope.js 曾经那行 `ctx?.workspaceRegistry?.list?.()` 从
+// v0.8.0 起必然抛错走降级：canonical path 归一与成员资格校验静默失效，只剩
+// header.cwd。
+//
+// 为什么既有测试没拦住：scope-storage.test.js 里三处 registry 测试都用普通对象
+// 伪造 ctx（{ workspaceRegistry: {...} }），普通对象裸读不抛错。本文件改用
+// 「读未声明属性即抛」的 Proxy 复刻真实宿主形状，把两侧行为都钉死。
+
+/**
+ * cordis 4 形状的 ctx：只有显式提供的属性可读，其余一律抛错（不是 undefined）。
+ * @param {object} provided 已提供的属性（reflect / logger …）
+ */
+function proxyCtx(provided) {
+  return new Proxy(provided, {
+    get(target, prop) {
+      if (typeof prop === "symbol" || prop === "then" || String(prop).startsWith("_")) {
+        return target[prop];
+      }
+      if (prop in target) return target[prop];
+      throw new Error(`cannot get property "${String(prop)}" without inject`);
+    }
+  });
+}
+
+/** 带 workspaceRegistry 服务的 reflect（免 inject 读取出口）。 */
+function reflectWith(services, seen = []) {
+  return {
+    get(name) {
+      seen.push(name);
+      return services[name];
+    }
+  };
+}
+
+const EXEC = { agent: { session: { id: "s1", header: { agentPreset: "coder", cwd: "D:\\raw" } } } };
+
+function loggerSpy() {
+  const warnings = [];
+  return { warnings, logger: { warn: (m) => warnings.push(String(m)) } };
+}
+
+test("#487: unregistered ctx property never throws out of the resolver (Proxy shape)", () => {
+  // 没有任何服务：裸读 workspaceRegistry 在真宿主里会抛。解析器必须吞掉并降级。
+  const { warnings, logger } = loggerSpy();
+  const ctx = proxyCtx({ reflect: reflectWith({}), logger });
+  const resolve = createScopeResolver({ ctx, config: { scopeEnabled: true }, logger });
+  // 不会抛；agentPreset 照常解析，workspace 落到 header.cwd。
+  assert.deepEqual(resolve(EXEC), { agent_scope: "coder", workspace_scope: "D:\\raw" });
+  // 服务缺失是合法状态（headless / 旧宿主），不是故障——不许刷 warn。
+  assert.deepEqual(warnings, [], "missing optional service must stay silent");
+});
+
+test("#487: registry reached through reflect.get restores the canonical path", () => {
+  // 修复的收益不只是消 warning：宿主确实提供 workspaceRegistry（@deepseek-ai/
+  // dsh-workspace），走免 inject 读取能取回 realpath 归一后的 canonical path，
+  // 而不是退化成原始 cwd 字符串。
+  const registry = { list: () => [{ path: "C:\\canon", sessionIds: ["s1"] }] };
+  const seen = [];
+  const ctx = proxyCtx({ reflect: reflectWith({ workspaceRegistry: registry }, seen) });
+  const resolve = createScopeResolver({ ctx, config: { scopeEnabled: true } });
+
+  assert.deepEqual(resolve(EXEC), { agent_scope: "coder", workspace_scope: "C:\\canon" });
+  assert.ok(seen.includes("workspaceRegistry"), "registry must be read via reflect.get");
+});
+
+test("#487: membership miss still falls back to header cwd (registry hit is id-scoped)", () => {
+  const registry = { list: () => [{ path: "C:\\canon", sessionIds: ["other"] }] };
+  const ctx = proxyCtx({ reflect: reflectWith({ workspaceRegistry: registry }) });
+  const resolve = createScopeResolver({ ctx, config: { scopeEnabled: true } });
+
+  assert.deepEqual(resolve(EXEC), { agent_scope: "coder", workspace_scope: "D:\\raw" });
+});
+
+test("#487: hosts without ctx.reflect keep working through the plain-object shape", () => {
+  // 旧宿主：ctx 是普通对象、没有 reflect.get。普通对象裸读安全，行为必须和修复前一致。
+  const ctx = { workspaceRegistry: { list: () => [{ path: "C:\\canon", sessionIds: ["s1"] }] } };
+  const resolve = createScopeResolver({ ctx, config: { scopeEnabled: true } });
+  assert.deepEqual(resolve(EXEC), { agent_scope: "coder", workspace_scope: "C:\\canon" });
+});
+
+test("#487: registry explosion still degrades to header cwd and warns exactly once", () => {
+  // 既有语义（scope-storage.test.js 已有同款普通对象版）：服务确实炸了要出声，
+  // 但每次写一个解析器实例只警告一次、绝不影响写入。
+  const { warnings, logger } = loggerSpy();
+  const registry = { list: () => { throw new Error("boom"); } };
+  const ctx = proxyCtx({ reflect: reflectWith({ workspaceRegistry: registry }), logger });
+  const resolve = createScopeResolver({ ctx, config: { scopeEnabled: true }, logger });
+
+  assert.deepEqual(resolve(EXEC), { agent_scope: "coder", workspace_scope: "D:\\raw" });
+  assert.deepEqual(resolve(EXEC), { agent_scope: "coder", workspace_scope: "D:\\raw" });
+  assert.equal(warnings.length, 1, "warn once per resolver instance, never on every write");
+});
+
+test("#487: resolver never throws even when reflect.get itself explodes", () => {
+  const { logger } = loggerSpy();
+  const ctx = proxyCtx({
+    reflect: { get() { throw new Error("reflect boom"); } },
+    logger
+  });
+  const resolve = createScopeResolver({ ctx, config: { scopeEnabled: true }, logger });
+  assert.deepEqual(resolve(EXEC), { agent_scope: "coder", workspace_scope: "D:\\raw" });
+  // 无会话时照旧全 NULL（fail-closed 读取侧依赖这个契约）。
+  assert.deepEqual(resolve(undefined), { agent_scope: null, workspace_scope: null });
+});

package/test/session-usage.test.js

@@ -64,8 +64,17 @@ test("多帧 zstd：**每一帧**都要解出来（只解第一帧是踩过的
   assert.deepEqual(seen, ["第一帧的内容", "第二帧的内容", "第三帧的内容"], "三帧都要被回调到");
   assert.equal(stat.frames, 3);
   assert.equal(stat.failed, 0);
-  // 反证：证明这个夹具真能暴露「只解第一帧」——直接 zstdDecompressSync 只能拿到第一段
-  assert.equal(zlib.zstdDecompressSync(buf).toString("utf8"), "第一帧的内容");
+  // 反证：证明这个夹具真能暴露「只解第一帧」——数帧头，不依赖 Node 的 zstd 语义。
+  // 原来这行是 `zstdDecompressSync(buf)` 只解出第一段；Node 24.22.0 起整块解会吐出全部帧
+  // （nodejs/node#65865 让解码跨 chunk 边界），反证随之过期，所以改成数 magic。
+  // 注意这行锁的是「切帧判据仍是 magic」，**不是碰撞免疫**：payload 里撞上 magic 时
+  // 计数器与解码器会一起错（半片也解得出来），实测 frames 同样变成 4，这条测不出来。
+  let frameHeaders = 0;
+  for (let at = 0; (at = buf.indexOf(ZSTD_MAGIC, at)) !== -1; at += ZSTD_MAGIC.length) frameHeaders += 1;
+  assert.equal(frameHeaders, 3, "夹具必须是三帧，否则上面测不到「只解第一帧」");
+  // 帧头数 = 成功数 + 失败数，是实现的契约：`forEachFrame` 用 magic 切帧，每段要么解开要么记失败。
+  // 写成 `stat.frames` 只在 failed 恒为 0 时成立，那是巧合不是规矩。
+  assert.equal(frameHeaders, stat.frames + stat.failed, "帧头数必须交代得清：每一帧要么解开要么记失败");
 });
 
 test("多帧 zstd：每帧都解；截断产生的**半行**由 jsonl 层丢掉（宁可少一条，不要错一条）", () => {

package/test/summarize.test.js

@@ -1813,3 +1813,228 @@ test("v0.9.0: scopeEnabled 关时蒸馏写入一个 scope 字段都不加（老
     assert.equal(row.workspace_scope_source, undefined);
   }
 });
+
+// --- Issue #493：转录围栏 / 失败护栏 / 失败行可诊断性 ------------------------------
+// 现场：转录裸放 user 位 → 模型当成「该我回话了」接着往下写 → 输出无 `[` →
+// 解析器括号早退判失败 → 不推进游标 → 下一个 turn/end 同文同温重试 → 同一窗口
+// 确定性失败、窗口越攒越大（报告者 20 条失败 input 8194→11118 单调递增）。
+
+test("#493 提示构造：转录包进围栏，user 侧重申「第三方提炼员」，system 不动", async () => {
+  const { events, calls } = setup({ distillRateLimitIntervalMs: 0 });
+  await eventHandler(events)(
+    {
+      id: "s493-prompt",
+      requestHeader: () => ({ config: { provider: "deepseek", model: "deepseek-chat" } }),
+      events: [userMessage("把这段对话蒸馏一下", 1), { seq: 2, type: "turn/end" }]
+    },
+    { seq: 2, type: "turn/end" }
+  );
+
+  const [system, user] = calls[0].messages;
+  assert.equal(system.role, "system");
+  assert.ok(system.content[0].text.includes("原子记忆"), "system 提示词保持原样（既有回归断言依赖它）");
+  assert.equal(user.role, "user");
+  const body = user.content[0].text;
+  // 角色句与围栏都必须落在 user 侧：模型对「这段文本是什么」的判断由它所在的
+  // 那条消息决定，只写进 system 救不回来（实测同段转录只加 system 约束仍 0/2 出 JSON）。
+  assert.ok(body.includes("第三方提炼员"), "user 侧必须重申角色，否则模型接着对话往下写");
+  assert.ok(body.includes("不是下面这段会话的参与者"), "角色句要明说不参与，不能只说「请输出 JSON」");
+  const open = body.indexOf("<<<会话转录开始>>>");
+  const close = body.indexOf("<<<会话转录结束>>>");
+  assert.ok(open > 0 && close > open, "转录必须被围栏包住");
+  assert.ok(body.slice(open, close).includes("把这段对话蒸馏一下"), "原文仍在围栏内");
+  assert.ok(body.indexOf("第三方提炼员") < open, "角色句在围栏之前");
+});
+
+test("#493 提示构造：围栏是确定性的，重试收到的转录与首次逐字节相同", async () => {
+  let attempt = 0;
+  const { events, calls } = setup({ distillRateLimitIntervalMs: 0 }, {
+    stream() {
+      const output = attempt++ === 0 ? "不按格式的一整段中文点评" : "[]";
+      return (async function* () {
+        yield { type: "block-start", block: { type: "text" } };
+        yield { type: "text-delta", delta: output };
+        yield { type: "finish", kind: "ok" };
+      })();
+    }
+  });
+  const handler = eventHandler(events);
+  const session = {
+    id: "s493-deterministic",
+    requestHeader: () => ({ config: { provider: "deepseek", model: "deepseek-chat" } }),
+    events: [userMessage("同一窗口重试", 1), { seq: 2, type: "turn/end" }]
+  };
+  await handler(session, { seq: 2, type: "turn/end" });
+  await handler(session, { seq: 2, type: "turn/end" });
+  assert.equal(calls.length, 2);
+  const first = calls[0].messages.find((m) => m.role === "user").content[0].text;
+  const second = calls[1].messages.find((m) => m.role === "user").content[0].text;
+  // 围栏里不能有时间戳/随机数：否则「同文同温」这条前提就不成立，护栏阈值
+  // 会变成对着一堆各不相同的输入计数。
+  assert.equal(first, second, "重试必须收到逐字节相同的转录");
+});
+
+test("#493 计量口径：distillChars 只数转录正文，不被围栏与角色句撑大", async () => {
+  // 这条是护栏的邻居而非护栏本身：#493 给 user 消息加了约 100 字的固定包裹，
+  // 若 distillChars 仍按「消息总字符数」算，4 字的窗口会凭空越过任何阈值，
+  // summarizeMinWindowChars 等于被自己的提示词旁路掉。
+  const { events, service } = setup({ summarizeMinWindowChars: 60, distillRateLimitIntervalMs: 0 });
+  await eventHandler(events)(
+    {
+      id: "s493-metric",
+      requestHeader: () => ({ config: { provider: "deepseek", model: "deepseek-chat" } }),
+      events: [userMessage("短", 1), { seq: 2, type: "turn/end" }]
+    },
+    { seq: 2, type: "turn/end" }
+  );
+  const row = service.listLlmAudits()[0];
+  assert.equal(row.error_message, "window-too-small", "4 字正文不得被包裹撑过 60 字阈值");
+  assert.equal(row.metadata.distillChars, 4, "计的是转录正文（「用户：短」= 4 字）");
+});
+
+test("#493 失败行可诊断：metadata 带 raw_head / raw_has_bracket / streak", async () => {
+  const { events, service } = setup({ distillRateLimitIntervalMs: 0 }, {
+    stream() {
+      return (async function* () {
+        yield { type: "block-start", block: { type: "text" } };
+        yield { type: "text-delta", delta: "已按你的要求将值班轮单日上限改为 5，下面是具体改动…" };
+        yield { type: "finish", kind: "ok" };
+      })();
+    }
+  });
+  await eventHandler(events)(
+    {
+      id: "s493-diag",
+      requestHeader: () => ({ config: { provider: "deepseek", model: "deepseek-chat" } }),
+      events: [userMessage("帮我改一下值班轮上限", 1), { seq: 2, type: "turn/end" }]
+    },
+    { seq: 2, type: "turn/end" }
+  );
+
+  const row = service.listLlmAudits()[0];
+  assert.equal(row.status, "error");
+  assert.equal(row.error_message, "invalid summary JSON");
+  // 原先 metadata 恒为 null，90 条历史失败一条原始输出都没留 —— 事后无法回答
+  // 「模型到底吐了什么形状」。raw_has_bracket 是区分「没按格式写」与「格式对但
+  // 内容救不回来」的唯一低成本判据，也正是 #493 现场的关键特征。
+  assert.equal(row.metadata?.parse_failure, true);
+  assert.equal(row.metadata?.raw_has_bracket, false, "这段点评里没有方括号");
+  assert.ok(row.metadata?.raw_len > 0);
+  assert.ok(row.metadata?.raw_head.startsWith("已按你的要求"), "原始输出前缀要留档");
+  assert.equal(row.metadata?.streak, 1);
+  assert.ok(Number.isInteger(row.metadata?.distillChars), "失败行同样带窗口字符数");
+});
+
+test("#493 失败护栏默认关：连续失败也不放弃窗口（历史行为逐字节不变）", async () => {
+  const { events, calls } = setup({ distillRateLimitIntervalMs: 0 }, {
+    stream() {
+      return (async function* () {
+        yield { type: "block-start", block: { type: "text" } };
+        yield { type: "text-delta", delta: "永远不是 JSON" };
+        yield { type: "finish", kind: "ok" };
+      })();
+    }
+  });
+  const handler = eventHandler(events);
+  const session = {
+    id: "s493-guard-off",
+    requestHeader: () => ({ config: { provider: "deepseek", model: "deepseek-chat" } }),
+    events: [userMessage("窗口", 1), { seq: 2, type: "turn/end" }]
+  };
+  for (let i = 0; i < 5; i++) await handler(session, { seq: 2, type: "turn/end" });
+  // 默认 0 = 关：这是本仓新行为的既定纪律（AGENTS.md），也是既有 4 个
+  // 「解析失败不消费窗口」用例语义不变的前提。
+  assert.equal(calls.length, 5, "护栏关着时每个 turn/end 仍重试同一窗口");
+});
+
+test("#493 失败护栏：连续 N 次失败后强制消费游标跳过该窗口", async () => {
+  let attempt = 0;
+  const { events, calls, service, store, summarizer } = setup(
+    { summarizeParseFailureMaxRetries: 2, distillRateLimitIntervalMs: 0 },
+    {
+      stream() {
+        attempt++;
+        const output = attempt <= 2 ? "确定性失败：一段中文点评" : "[]";
+        return (async function* () {
+          yield { type: "block-start", block: { type: "text" } };
+          yield { type: "text-delta", delta: output };
+          yield { type: "finish", kind: "ok" };
+        })();
+      }
+    }
+  );
+  const handler = eventHandler(events);
+  const session = {
+    id: "s493-guard-on",
+    requestHeader: () => ({ config: { provider: "deepseek", model: "deepseek-chat" } }),
+    events: [userMessage("会被放弃的窗口", 1), { seq: 2, type: "turn/end" }]
+  };
+
+  await handler(session, { seq: 2, type: "turn/end" });
+  assert.equal(calls.length, 1);
+  assert.equal(service.getDistillCursor("s493-guard-on"), undefined, "第一次失败仍不推进游标");
+
+  await handler(session, { seq: 2, type: "turn/end" });
+  assert.equal(calls.length, 2, "阈值内仍重试");
+  // 达到阈值（2）：窗口被放弃，游标推进到本窗末尾，下一轮从全新窗口起算。
+  const cursor = service.getDistillCursor("s493-guard-on");
+  assert.equal(cursor?.last_seq, 2, "达到阈值后强制消费游标");
+  const errorRows = service.listLlmAudits().filter((r) => r.status === "error");
+  assert.equal(errorRows.length, 2);
+  // 按 streak 定位而不是按下标：审计表的返回顺序是存储层的事，不该被这条断言锁住。
+  const abandoned = errorRows.find((r) => r.metadata?.streak === 2);
+  assert.equal(abandoned?.metadata?.skipped, "parse-failure-streak", "放弃必须可观测");
+  assert.equal(abandoned?.metadata?.maxRetries, 2);
+  assert.equal(errorRows.find((r) => r.metadata?.streak === 1)?.metadata?.skipped, undefined,
+    "阈值前的那次失败仍按「可重试」记账，不得提前宣告放弃");
+
+  // 游标已消费 → 同一 turn/end 不再重试；新事件开新窗口并正常落库。
+  await handler(session, { seq: 2, type: "turn/end" });
+  assert.equal(calls.length, 2, "被放弃的窗口不再重试");
+  session.events.push(userMessage("新的窗口", 3), { seq: 4, type: "turn/end" });
+  await handler(session, { seq: 4, type: "turn/end" });
+  assert.equal(calls.length, 3, "新窗口正常蒸馏");
+  summarizer.dispose();
+  store.close();
+});
+
+test("#493 失败护栏：一次成功即清零计数，不会隔窗累计", async () => {
+  let attempt = 0;
+  const { events, calls, service, store, summarizer } = setup(
+    { summarizeParseFailureMaxRetries: 2, distillRateLimitIntervalMs: 0 },
+    {
+      stream() {
+        // 失败 → 成功 → 失败：第 3 次是「新一轮的第一次失败」，不该被判为第 2 次。
+        const outputs = ["不是 JSON", "[]", "又不是 JSON"];
+        const output = outputs[attempt++] ?? "[]";
+        return (async function* () {
+          yield { type: "block-start", block: { type: "text" } };
+          yield { type: "text-delta", delta: output };
+          yield { type: "finish", kind: "ok" };
+        })();
+      }
+    }
+  );
+  const handler = eventHandler(events);
+  const session = {
+    id: "s493-streak-reset",
+    requestHeader: () => ({ config: { provider: "deepseek", model: "deepseek-chat" } }),
+    events: [userMessage("第一窗", 1), { seq: 2, type: "turn/end" }]
+  };
+  await handler(session, { seq: 2, type: "turn/end" });   // 失败 #1
+  await handler(session, { seq: 2, type: "turn/end" });   // 成功 → 清零
+  session.events.push(userMessage("第二窗", 3), { seq: 4, type: "turn/end" });
+  await handler(session, { seq: 4, type: "turn/end" });   // 失败 #1（不是 #2）
+
+  // 两条失败行都必须是「新一轮的第一次」：只查最后一条会让「第一条其实被
+  // 记成 streak=2」这类回归漏网。
+  const errorRows = service.listLlmAudits().filter((r) => r.status === "error");
+  assert.equal(errorRows.length, 2);
+  for (const row of errorRows) {
+    assert.equal(row.metadata?.streak, 1, "成功必须清零，否则阈值会在跨窗处误触发");
+    assert.equal(row.metadata?.skipped, undefined, "计数未达阈值，不得放弃窗口");
+  }
+  assert.equal(calls.length, 3);
+  summarizer.dispose();
+  store.close();
+});