@modusensus/dsh-mneme 0.9.5 → 0.10.0

package/test/provenance-http.test.js

@@ -16,12 +16,19 @@ import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import {
   DISTILL_RECORDS_DISABLED,
+  PROVENANCE_DEFAULT_WINDOWS,
+  PROVENANCE_MAX_WINDOWS,
   PROVENANCE_UNAVAILABLE,
   isDistillRecordsEnabled,
-  parseProvenanceQuery,
+  parseProvenanceLimit,
+  parseProvenanceSelector,
   provenanceReply
 } from "../src/provenance-http.js";
 
+// 方向 1 的选择器：绝大多数用例只关心「读出去的那一侧」，方向本身用这个常量固定。
+const MEM = { mode: "memory", memoryId: "m1", limit: PROVENANCE_DEFAULT_WINDOWS };
+const SES = { mode: "session", sessionId: "s1", limit: PROVENANCE_DEFAULT_WINDOWS };
+
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 
 // 开着开关的 cfg：这个端点返回蒸馏窗口的逐字原文，所以测试里的「正常路径」必须
@@ -31,19 +38,73 @@ const RECORDS_ON = { distillRecords: { enabled: true } };
 function fakeService(over = {}) {
   return {
     provenanceFor: (id) => over.links ?? [],
+    // #524 方向 2 的存储读法：按会话列窗口（store 侧 GROUP BY 成一行一窗口）。
+    distillWindowsFor: (sessionId, limit) => over.windows ?? [],
     distillRecordsFor: (sessionId, from, to) => over.records ?? [],
     ...over.service
   };
 }
 
-test("parseProvenanceQuery：空/缺失 id 报 400，非空原样通过", () => {
-  for (const raw of [null, undefined, "", "   "]) {
-    const r = parseProvenanceQuery(raw);
-    assert.equal(r.ok, false, `${JSON.stringify(raw)} 不该通过`);
+// --- 入参：两个互斥主键 + limit（#524）---------------------------------------
+// 方向 2 复用同一条路径，于是「哪个主键说了算」必须是个**显式**判断：都缺是请求
+// 不成立（400 missing-id），都给也要 400——择一意味着调用方发一个自己也不知道会
+// 读哪个主键的请求，而两个方向的结果形状不同（memoryId / sessionId 各有自己的键）。
+
+test("parseProvenanceSelector：两个主键都缺 → 400 missing-id", () => {
+  for (const params of [
+    {}, { memoryId: null, sessionId: null }, { memoryId: "", sessionId: "" },
+    { memoryId: "   ", sessionId: "\t" }
+  ]) {
+    const r = parseProvenanceSelector(params);
+    assert.equal(r.ok, false, `${JSON.stringify(params)} 不该通过`);
     assert.equal(r.status, 400);
     assert.equal(r.error, "missing-id");
   }
-  assert.deepEqual(parseProvenanceQuery(" m1 "), { ok: true, id: "m1" }, "id 两端空白要裁掉");
+});
+
+test("parseProvenanceSelector：两个主键都给 → 400 ambiguous-id（不静默择一）", () => {
+  const r = parseProvenanceSelector({ memoryId: "m1", sessionId: "s1" });
+  assert.equal(r.ok, false);
+  assert.equal(r.status, 400);
+  assert.equal(r.error, "ambiguous-id");
+});
+
+test("parseProvenanceSelector：两端空白裁掉，方向按哪个主键非空确定，limit 缺省 20", () => {
+  assert.deepEqual(parseProvenanceSelector({ memoryId: " m1 " }), {
+    ok: true,
+    selector: { mode: "memory", memoryId: "m1", limit: PROVENANCE_DEFAULT_WINDOWS }
+  });
+  assert.deepEqual(parseProvenanceSelector({ sessionId: " s1 ", memoryId: "  " }), {
+    ok: true,
+    selector: { mode: "session", sessionId: "s1", limit: PROVENANCE_DEFAULT_WINDOWS }
+  }, "另一侧是空白串时按缺省处理，不算「都给」");
+});
+
+test("parseProvenanceLimit：只收十进制整数字面量，畸形与越界都算 400", () => {
+  assert.equal(parseProvenanceLimit(null).limit, PROVENANCE_DEFAULT_WINDOWS, "不带就是缺省");
+  assert.equal(parseProvenanceLimit("1").limit, 1);
+  assert.equal(parseProvenanceLimit(String(PROVENANCE_MAX_WINDOWS)).limit, PROVENANCE_MAX_WINDOWS);
+  // 两端空白是**裁掉**而不是判畸形——与 id 的处理保持一致（"  12 " 就是 12）。
+  // 但裁完必须是纯十进制字面量。
+  assert.equal(parseProvenanceLimit(" 12 ").limit, 12, "两端空白裁掉，与 id 一致");
+  // 下面这些如果走 Number()，"" / " " 会化成 0 个窗口，十六进制与指数写法也会被
+  // 静默接受——一个畸形输入拿到最坏解释。所以这里逐个钉住。
+  for (const raw of [
+    "", "   ", "0", "-1", "1.5", "1e3", "0x10", "abc", "+1", "12abc",
+    String(PROVENANCE_MAX_WINDOWS + 1), "99999999999999999999"
+  ]) {
+    const r = parseProvenanceLimit(raw);
+    assert.equal(r.ok, false, `${JSON.stringify(raw)} 不该通过`);
+    assert.equal(r.status, 400);
+    assert.equal(r.error, "invalid-limit");
+  }
+});
+
+test("parseProvenanceSelector：limit 畸形时连着主键一起 400（入参形状先于功能开关）", () => {
+  const r = parseProvenanceSelector({ sessionId: "s1", limit: "abc" });
+  assert.equal(r.ok, false);
+  assert.equal(r.status, 400);
+  assert.equal(r.error, "invalid-limit");
 });
 
 test("provenanceReply：一个链接一个窗口，原文按 seq 升序且不越界", () => {
@@ -55,7 +116,7 @@ test("provenanceReply：一个链接一个窗口，原文按 seq 升序且不越
       return [{ seq: 12 }, { seq: 10 }, { seq: 11 }];
     }
   };
-  const r = provenanceReply({ service, id: "m1", config: RECORDS_ON });
+  const r = provenanceReply({ service, selector: MEM, config: RECORDS_ON });
   assert.equal(r.status, 200);
   assert.equal(r.body.memoryId, "m1");
   assert.equal(r.body.windows.length, 1);
@@ -68,15 +129,57 @@ test("provenanceReply：一个链接一个窗口，原文按 seq 升序且不越
   assert.deepEqual(seen, [["s1", 10, 12]], "区间原样透传给 store");
 });
 
+test("provenanceReply #512：窗口带得动归属的那一轮 run，读不到就整组缺省而不是猜", () => {
+  const runs = new Map([["r1", { run_type: "autoSummarize", trigger_source: "autoSummarize", status: "ok" }]]);
+  const service = {
+    provenanceFor: () => [
+      { session_id: "s1", seq_start: 10, seq_end: 12, created_at: "2026-11-02T00:00:00Z", distill_run_id: "r1" },
+      // 改造之前写下的链接：distill_run_id 是 NULL。
+      { session_id: "s1", seq_start: 20, seq_end: 22, created_at: "2026-09-01T00:00:00Z", distill_run_id: null }
+    ],
+    distillRecordsFor: () => [],
+    getDistillRun: (id) => runs.get(id),
+    mintsFor: () => [{ run_id: "d1", run_type: "dream", trigger_source: "autoDream", created_at: "2026-11-01T00:00:00Z" }]
+  };
+  const r = provenanceReply({ service, selector: MEM, config: RECORDS_ON });
+  assert.equal(r.status, 200);
+  const [fresh, legacy] = r.body.windows;
+  assert.equal(fresh.distill_run_id, "r1");
+  assert.equal(fresh.run_type, "autoSummarize");
+  assert.equal(fresh.trigger_source, "autoSummarize");
+  assert.equal(fresh.run_status, "ok");
+  // 历史链接：id 为 null，三个派生字段也必须是 null——不许拿区间或时间戳反推一轮。
+  assert.equal(legacy.distill_run_id, null);
+  assert.equal(legacy.run_type, null, "没有 run 就不给类型，否则等于替用户编了一次归因");
+  assert.equal(legacy.trigger_source, null);
+  assert.equal(legacy.run_status, null);
+  assert.equal(r.body.mints.length, 1);
+  assert.equal(r.body.mints[0].run_type, "dream");
+});
+
+test("provenanceReply #512：service 没有 run 读取能力时，窗口字段照旧齐全但归因为空", () => {
+  // headless / 旧装配：provenanceFor 与 distillRecordsFor 在，getDistillRun / mintsFor 不在。
+  const service = {
+    provenanceFor: () => [{ session_id: "s1", seq_start: 1, seq_end: 2, created_at: "2026-11-02T00:00:00Z", distill_run_id: "r9" }],
+    distillRecordsFor: () => []
+  };
+  const r = provenanceReply({ service, selector: MEM, config: RECORDS_ON });
+  assert.equal(r.status, 200, "读 run 的能力缺一档不算装配坏——窗口本身仍可读");
+  assert.equal(r.body.windows[0].distill_run_id, "r9");
+  assert.equal(r.body.windows[0].run_type, null);
+  assert.deepEqual(r.body.mints, []);
+});
+
 test("provenanceReply：没有链接是有效答案——空 windows，200 不是 404", () => {
-  const r = provenanceReply({ service: fakeService(), id: "m1", config: RECORDS_ON });
+  const r = provenanceReply({ service: fakeService(), selector: MEM, config: RECORDS_ON });
   assert.equal(r.status, 200);
-  assert.deepEqual(r.body, { memoryId: "m1", windows: [] });
+  // #524 的 truncated 与 #512 的 mints 都是答复级读数，各自独立缺省。
+  assert.deepEqual(r.body, { memoryId: "m1", windows: [], truncated: false, mints: [] });
 });
 
 test("provenanceReply：方法没接线是装配坏了——503，不与「没有来源」混为一个读数", () => {
   // headless / 旧装配：service 上没有这两个方法。
-  const r = provenanceReply({ service: {}, id: "m1", config: RECORDS_ON });
+  const r = provenanceReply({ service: {}, selector: MEM, config: RECORDS_ON });
   assert.equal(r.status, 503);
   assert.equal(r.body.error, PROVENANCE_UNAVAILABLE);
 });
@@ -87,7 +190,7 @@ test("provenanceReply：读抛错只 warn 并回 500，不把异常漏给调用
     provenanceFor: () => { throw new Error("db locked"); },
     distillRecordsFor: () => []
   };
-  const r = provenanceReply({ service, id: "m1", config: RECORDS_ON, warn: (m) => warnings.push(m) });
+  const r = provenanceReply({ service, selector: MEM, config: RECORDS_ON, warn: (m) => warnings.push(m) });
   assert.equal(r.status, 500);
   assert.equal(r.body.error, "internal");
   assert.equal(warnings.length, 1, "失败要留痕");
@@ -114,7 +217,7 @@ test("isDistillRecordsEnabled：只认严格的 true，其余一律算关（fail
 test("provenanceReply：开关没开 → 409 distill-records-disabled，一个键都不多带", () => {
   // config 整个缺失（旧调用方直连、daemon 最小 cfg）也走这一格：默认方向必须是关。
   for (const cfg of [null, undefined, {}, { distillRecords: { enabled: false } }]) {
-    const r = provenanceReply({ service: fakeService(), id: "m1", config: cfg });
+    const r = provenanceReply({ service: fakeService(), selector: MEM, config: cfg });
     assert.equal(r.status, 409, `${JSON.stringify(cfg)} → 409`);
     assert.deepEqual(r.body, { error: DISTILL_RECORDS_DISABLED },
       "body 只准有 error 一个键——不带 memoryId / windows，调用方不会把「功能关了」读成「这条记忆没有来源」");
@@ -123,7 +226,7 @@ test("provenanceReply：开关没开 → 409 distill-records-disabled，一个
 
 test("provenanceReply：409 赢 503——「用户关了」比「装配坏了」更具体", () => {
   // 关着 + service 上连方法都没有：报 503 会让人去查一个没坏的部署。
-  const r = provenanceReply({ service: {}, id: "m1", config: { distillRecords: { enabled: false } } });
+  const r = provenanceReply({ service: {}, selector: MEM, config: { distillRecords: { enabled: false } } });
   assert.equal(r.status, 409);
   assert.equal(r.body.error, DISTILL_RECORDS_DISABLED);
 });
@@ -135,20 +238,100 @@ test("provenanceReply：开关关着时一次 SQL 都不发（不碰 service）"
     provenanceFor: () => { touched++; return []; },
     distillRecordsFor: () => { touched++; return []; }
   } });
-  provenanceReply({ service, id: "m1", config: null });
+  provenanceReply({ service, selector: MEM, config: null });
   assert.equal(touched, 0);
 });
 
 test("provenanceReply：开关开着才读得到——200 与 409 是同一把门的两个方向", () => {
   const service = fakeService({ links: [{ session_id: "s1", seq_start: 1, seq_end: 1, created_at: "t" }], records: [{ seq: 1 }] });
-  const on = provenanceReply({ service, id: "m1", config: RECORDS_ON });
+  const on = provenanceReply({ service, selector: MEM, config: RECORDS_ON });
   assert.equal(on.status, 200);
   assert.equal(on.body.windows.length, 1);
-  const off = provenanceReply({ service, id: "m1", config: { distillRecords: { enabled: false } } });
+  const off = provenanceReply({ service, selector: MEM, config: { distillRecords: { enabled: false } } });
   assert.equal(off.status, 409);
   assert.deepEqual(off.body, { error: DISTILL_RECORDS_DISABLED });
 });
 
+// --- 方向 2：会话 → 窗口（#524）--------------------------------------------
+
+test("provenanceReply（session 方向）：一行一窗口，原文按区间取，答复带 sessionId", () => {
+  const asked = [];
+  const service = {
+    distillWindowsFor: (sid, limit) => {
+      asked.push([sid, limit]);
+      return [
+        { session_id: "s1", seq_start: 5, seq_end: 9, created_at: "t2", link_count: 2 },
+        { session_id: "s1", seq_start: 1, seq_end: 4, created_at: "t1", link_count: 1 }
+      ];
+    },
+    distillRecordsFor: (sid, from, to) => [{ seq: from }, { seq: to }]
+  };
+  const r = provenanceReply({ service, selector: SES, config: RECORDS_ON });
+  assert.equal(r.status, 200);
+  assert.equal(r.body.sessionId, "s1", "session 方向的答复用 sessionId 认领，不冒充 memoryId");
+  assert.equal(r.body.truncated, false);
+  assert.deepEqual(r.body.windows.map((w) => [w.seq_start, w.seq_end]), [[5, 9], [1, 4]],
+    "次序由 store 的 ORDER BY seq_start 保证，答复层不改序");
+  assert.deepEqual(r.body.windows[0].records.map((x) => x.seq), [5, 9], "每个窗口装自己区间的原文");
+  assert.equal(r.body.windows[0].link_count, 2, "同一窗口派生了 2 条记忆——这个计数是「按窗口看」的第二维");
+  // 多取一行判截断：store 侧只照 limit 取，不替调用方判断「还有没有」。
+  assert.deepEqual(asked, [["s1", PROVENANCE_DEFAULT_WINDOWS + 1]]);
+});
+
+test("provenanceReply：撞上 limit 时 truncated=true，且多出来的那条不许漏出去", () => {
+  // 少了这个读数，被截断的答复与「本来就只有这么多」逐字节相同——调用方会把半份
+  // 转录当成全部，这正是这张脸最容易骗人的地方。
+  const service = {
+    distillWindowsFor: () => [1, 2, 3].map((n) => ({
+      session_id: "s1", seq_start: n, seq_end: n, created_at: "t", link_count: 1
+    })),
+    distillRecordsFor: () => []
+  };
+  const r = provenanceReply({ service, selector: { ...SES, limit: 2 }, config: RECORDS_ON });
+  assert.equal(r.status, 200);
+  assert.equal(r.body.truncated, true);
+  assert.equal(r.body.windows.length, 2, "limit=2 就只许回 2 个窗口，探针那一条不能混进答复");
+});
+
+test("provenanceReply：memory 方向也带 truncated（两个方向共一个读数）", () => {
+  const service = {
+    provenanceFor: () => [1, 2].map((n) => ({
+      session_id: "s1", seq_start: n, seq_end: n, created_at: "t"
+    })),
+    distillRecordsFor: () => []
+  };
+  const r = provenanceReply({ service, selector: { ...MEM, limit: 1 }, config: RECORDS_ON });
+  assert.equal(r.status, 200);
+  assert.equal(r.body.truncated, true);
+  assert.equal(r.body.windows.length, 1);
+  assert.equal(r.body.memoryId, "m1");
+});
+
+test("provenanceReply：503 按方向判——只缺 session 那侧的方法时，memory 查询照旧 200", () => {
+  // 把一个方向的问题报成整张脸坏了，会让人去查一个没坏的部署。
+  const onlyMemory = {
+    provenanceFor: () => [],
+    distillRecordsFor: () => []
+  };
+  const ses = provenanceReply({ service: onlyMemory, selector: SES, config: RECORDS_ON });
+  assert.equal(ses.status, 503);
+  assert.equal(ses.body.error, PROVENANCE_UNAVAILABLE);
+  const mem = provenanceReply({ service: onlyMemory, selector: MEM, config: RECORDS_ON });
+  assert.equal(mem.status, 200, "缺的只是方向 2 的方法，方向 1 不该跟着坏");
+});
+
+test("provenanceReply：开关关着时 session 方向也 409，且一次 SQL 都不发", () => {
+  let touched = 0;
+  const service = {
+    distillWindowsFor: () => { touched++; return []; },
+    distillRecordsFor: () => { touched++; return []; }
+  };
+  const r = provenanceReply({ service, selector: SES, config: { distillRecords: { enabled: false } } });
+  assert.equal(r.status, 409);
+  assert.deepEqual(r.body, { error: DISTILL_RECORDS_DISABLED }, "方向不同，门是同一把");
+  assert.equal(touched, 0);
+});
+
 test("🔴 静态锁：口径字面量与共用答复只许出现在本模块，两个入口都要真的走它", () => {
   // #509 第一版把整段复制到了两张皮各一份——本仓 #411 之后不收这个形状。
   for (const name of ["api.js", "api-standalone.js"]) {
@@ -162,7 +345,7 @@ test("🔴 静态锁：口径字面量与共用答复只许出现在本模块，
     assert.ok(!src.includes("distillRecords?.enabled === true"),
       `src/${name} 不准自己写开关判据——只许把 config 转交给共用模块`);
     // 而且要真的转交了：壳里调 provenanceReply 时必须带上 config。
-    assert.match(src, /provenanceReply\(\{ service, id: parsed\.id, config,/,
+    assert.match(src, /provenanceReply\(\{ service, selector: parsed\.selector, config,/,
       `src/${name} 要把本入口的 config 传给共用模块，否则门永远读不到用户的开关`);
   }
 });

package/test/release-docs.test.js

@@ -51,7 +51,13 @@ test("根 README 的两段式路线图能插进新 minor 占位行（旧实现
 test("真实根 README 的中英两张路线图各插一行（同一版本号，不能只插一张）", () => {
   // 两张表版本行完全一样，旧实现把全文件版本行合成一个数组判断「已存在」，
   // 于是先插的中文表会让英文表被跳过——英文读者永远等不到那一行。
-  const { actions } = syncReadmeTables(rootReadme, "0.10.0", "2026-11-01");
+  //
+  // 目标版本**不能写死**：写死当次要发的版本，这条用例在 release-prep 分支上必红——那一行
+  // 恰好已经由发版准备脚本插进去了，「各插一行」于是退化成零插入。取比现存的最高 major 再高一档，
+  // 断言就与「这次发的是哪一版」彻底无关，也不会在下一个 minor 上重新长成定时炸弹。
+  const maxMajor = Math.max(...scanReleaseRows(rootReadme).two.map((r) => Number(r.ver.split(".")[0])));
+  const target = `${maxMajor + 1}.0`;
+  const { actions } = syncReadmeTables(rootReadme, target, "2026-11-01");
   const inserts = actions.filter((a) => a.kind === "insert");
   assert.equal(inserts.length, 2, "中英路线图各一行，实际：" + JSON.stringify(actions));
 });

package/test/security-doc.test.js

@@ -104,10 +104,22 @@ function routesInBullet(line) {
   return out;
 }
 
-function bullet(prefix) {
-  const line = doc.split(/\r?\n/).find((l) => l.startsWith(prefix));
-  assert.ok(line, `SECURITY.md 里应有以「${prefix}」开头的清单行`);
-  return routesInBullet(line);
+// 清单行必须**恰好一条**。原先用 .find() 只读第一条命中，于是「同一条目出现两份」
+// 这件事守卫完全无感：#509 的 merge 把两份 Open reads / Gated routes 一起解进来，
+// 其中一份 stale（少 /memory/provenance），CI 却全绿——因为 .find() 读的是第一份。
+// 「文档与代码平价」的全部信心都来自这个文件，一旦它对重复条目零感知，第二份就是没有守卫的谎话。
+// 所以这里先收全部命中，再判唯一；多于一条时把行号报出来，避免变成「哪份算数」的新谜题。
+// source 参数只为可测：守卫本身是「唯一性」，喂一份合成的重复文档就能验，不必真去改 SECURITY.md。
+function bullet(prefix, source = doc) {
+  const hits = [];
+  source.split(/\r?\n/).forEach((line, i) => {
+    if (line.startsWith(prefix)) hits.push({ line, no: i + 1 });
+  });
+  assert.ok(hits.length > 0, `SECURITY.md 里应有以「${prefix}」开头的清单行`);
+  assert.equal(hits.length, 1,
+    `SECURITY.md 里以「${prefix}」开头的清单行必须恰好一条，实际 ${hits.length} 条（行号 ${hits.map((h) => h.no).join(", ")}）。` +
+    "清单只许有一份：多出来的那份不会被本文件校验，改它不会红，只能靠删掉来保持平价。");
+  return routesInBullet(hits[0].line);
 }
 
 // 文档里的 /semantic/graph/* 覆盖代码里的 /semantic/graph/ego 与 /semantic/graph/entity-attrs。
@@ -137,3 +149,30 @@ test("SECURITY.md 的受门控清单与代码里的 policy 声明一致", () =>
     assert.deepEqual(stale, [], `${prefix} 写了代码里并不受门控的路由：${stale.join(", ")}`);
   }
 });
+
+// 上面那条唯一性断言本身要有回归：把 SECURITY.md 的清单行复制成两份必须红。
+// 这条用例喂合成文档，不碰真文件——真文件的平价由上面两条双向比对负责。
+// 变异自证（人工做过一次，记录在 PR 里）：把 Gated routes 那一行原样复制一份 → 红；
+// 复制成两份且第二份把 /memory/provenance 换成别的 → 也红。两种都只在「恰好一条」上红。
+test("重复的清单行会被守卫抓住（#523）", () => {
+  const gated = doc.split(/\r?\n/).find((l) => l.startsWith("- **Gated routes"));
+  assert.ok(gated, "SECURITY.md 里应有 Gated routes 清单行");
+
+  const withDup = ["# synthetic", gated, gated].join("\n");
+  assert.throws(
+    () => bullet("- **Gated routes", withDup),
+    /必须恰好一条，实际 2 条（行号 2, 3）/,
+    "同一清单行出现两份时必须报出重复的行号——这正是 #509 merge 时守卫看不见的形状"
+  );
+
+  // 内容不同的两份同样要红：危险的不是写错了什么，而是那份副本对守卫隐形。
+  const staleDup = ["# synthetic", gated, gated.replace("/memory/provenance", "/memory/provenance-OLD")].join("\n");
+  assert.throws(
+    () => bullet("- **Gated routes", staleDup),
+    /必须恰好一条，实际 2 条/,
+    "两份内容不同的清单同样必须红，否则陈旧副本可以一直过期"
+  );
+
+  // 只有一份时不能误伤。
+  assert.ok(bullet("- **Gated routes", gated).length > 0);
+});

package/test/session-gate.test.js

@@ -0,0 +1,264 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { Config } from "../src/config.js";
+import { createSessionGate } from "../src/session-gate.js";
+import { createStore } from "../src/store.js";
+import { createService } from "../src/service.js";
+import { createSettings } from "../src/settings.js";
+import { createInjector } from "../src/inject.js";
+import { MEMORY_GUIDE_SECTION } from "../src/guide.js";
+import { createTools } from "../src/tools.js";
+import { createSummarizer } from "../src/summarize.js";
+
+test("session gate defaults off and gates subagents by the host's delegation marks", () => {
+  const defaults = Config({});
+  assert.equal(defaults.sessionGateEnabled, false);
+  assert.equal(defaults.sessionGateSubagents, true);
+  assert.deepEqual(defaults.sessionGateSessions, []);
+
+  const gate = createSessionGate({ sessionGateEnabled: true, sessionGateSubagents: true });
+  const sessions = [
+    { id: "header-origin", header: { origin: "subagent" } },
+    { id: "header-depth", header: { delegationDepth: 2 } },
+    { id: "header-both", header: { parentSession: "captain", origin: "subagent", delegationDepth: 1 } },
+    { id: "request-origin", requestHeader: () => ({ config: { origin: "subagent", delegationDepth: 1 } }) }
+  ];
+  for (const session of sessions) {
+    assert.equal(gate.isOff(session), true, session.id);
+  }
+
+  const firstEvent = { id: "first-event", header: { parentSession: "captain", origin: "subagent" } };
+  assert.equal(gate.isOff(firstEvent), true, "header match works before any session/event was observed");
+  gate.observe(firstEvent);
+  assert.equal(gate.isOff("first-event"), true, "observed child ids remain recognizable in log scans");
+});
+
+// 形状锁：`parentSession` 是「有父会话」，不是「是子代理」。dsh-session 的
+// sessions.fork() 给**主会话分支**也写 parentSession（且不写 origin / 不带
+// delegationDepth），把它当判据就会让用户 fork 出来的普通会话整体失忆。
+// 本机 641 个真实会话头实测：origin/delegationDepth 命中 455 个子代理、零漏检，
+// parentSession 对子代理识别零贡献、只多判出 3 个 fork 主会话（各有 74–136 条
+// 用户消息、694 次工具调用）。这条用例锁的就是那次误判不许回来。
+test("parentSession alone never gates: forked captain sessions stay fully enabled", () => {
+  const gate = createSessionGate({ sessionGateEnabled: true, sessionGateSubagents: true });
+  const forked = { id: "forked-captain", header: { parentSession: "captain", isSeeded: true, delegationDepth: 0 } };
+  assert.equal(gate.isOff(forked), false, "a fork of a captain session is still a captain session");
+  assert.equal(gate.isOff({ id: "flat-parent", parentSession: "captain" }), false);
+  assert.equal(gate.isOff({ id: "alias-parent", parentSessionId: "captain" }), false);
+  assert.equal(gate.isOff({ id: "request-parent", requestHeader: () => ({ config: { parentSession: "captain" } }) }), false);
+  gate.observe(forked);
+  assert.equal(gate.isOff("forked-captain"), false, "observing a non-child must not record it as one");
+});
+
+test("manual ids survive the subagent switch, master-off is inert, and config is read live", () => {
+  const cfg = { sessionGateEnabled: false, sessionGateSubagents: false, sessionGateSessions: ["manual"] };
+  const gate = createSessionGate(cfg);
+  const manual = { id: "manual" };
+  const child = { id: "child", header: { origin: "subagent" } };
+
+  assert.equal(gate.isOff(manual), false, "the master is the only opt-in");
+  cfg.sessionGateEnabled = true;
+  assert.equal(gate.isOff(manual), true, "manual id matches even when automatic child detection is off");
+  assert.equal(gate.isOff(child), false, "subagent switch independently controls automatic matching");
+  cfg.sessionGateSubagents = true;
+  assert.equal(gate.isOff(child), true, "the next call sees a live config change");
+  cfg.sessionGateEnabled = false;
+  assert.equal(gate.isOff(manual), false, "turning the master off restores normal behavior immediately");
+
+  // 复现 comment 6541389（#541）：上面刚把总开关关掉，若在这里直接断言
+  // doesNotThrow，isEnabled() 就先把调用挡回去了，id getter 那条保护路径
+  // 一次都不会执行——测的是「关掉时不出事」，不是「读不到 id 时不出事」。
+  // 所以先开总开关，再断言两件事：不抛，且被当成普通会话（false），
+  // 而不是被当成「id 为空所以放行」的巧合。
+  cfg.sessionGateEnabled = true;
+  const inaccessible = {};
+  Object.defineProperty(inaccessible, "id", { get() { throw new Error("host getter"); } });
+  assert.doesNotThrow(() => gate.isOff(inaccessible));
+  assert.equal(gate.isOff(inaccessible), false, "an unreadable id is an ordinary session, not a gated one");
+});
+
+// #539 原文：「子会话在首次 session/event 之前就可能组装上下文，故必须直接检查
+// 传入 session，不能只靠事件后记录 ID」。所以「拿不到 id」不能当作「不是无痕
+// 会话」——那一行早退正是这条要求最容易失守的地方（注入面在上下文组装期跑的
+// 就是这条路径）。手动名单仍然依赖 id，那是名单本身的形状，不是缺陷。
+test("a subagent session without a usable id is still gated", () => {
+  const gate = createSessionGate({ sessionGateEnabled: true, sessionGateSubagents: true });
+  assert.equal(gate.isOff({ header: { origin: "subagent" } }), true, "id-less subagent header");
+  assert.equal(gate.isOff({ header: { delegationDepth: 1 } }), true, "id-less delegation depth");
+  assert.equal(gate.isOff({ id: "", header: { origin: "subagent" } }), true, "empty id is the same as missing");
+  assert.equal(gate.isOff({}), false, "no id and no child mark is an ordinary session");
+  assert.equal(gate.isOff(null), false);
+  assert.equal(gate.isOff(undefined), false);
+  const offSwitch = createSessionGate({ sessionGateEnabled: true, sessionGateSubagents: false });
+  assert.equal(offSwitch.isOff({ header: { origin: "subagent" } }), false, "the subagent switch still wins");
+});
+
+// 记账表只服务「日志扫描拿得到 id、却解析不出头」这一条退路，所以它必须有界：
+// 长驻宿主跑上几百个子代理后只涨不落会把每个 id 永久留在内存里，而淘汰最旧的
+// 代价只是那一次日志过滤少认一个会话，活路径永远直接用会话对象判定。
+test("tracked child ids stay bounded and eviction only costs the log-scan fallback", () => {
+  const gate = createSessionGate({ sessionGateEnabled: true, sessionGateSubagents: true });
+  for (let i = 0; i < 600; i += 1) gate.observe({ id: `child-${i}`, header: { origin: "subagent" } });
+  assert.equal(gate.isOff("child-599"), true, "the newest child is still tracked");
+  assert.equal(gate.isOff("child-0"), false, "the oldest id was evicted instead of kept forever");
+  gate.observe({ id: "child-599", header: { origin: "subagent" } });
+  assert.equal(gate.isOff("child-599"), true, "re-observing the same id stays stable");
+});
+
+function injectionSetup() {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  const settings = createSettings(store.db);
+  service.saveWithDedupe({ type: "preference", title: "语言", content: "中文", importance: 5 });
+  settings.setProfile("用户画像正文");
+  settings.setRules(["先给结论"]);
+  const contexts = [];
+  const sections = [];
+  const ctx = {
+    systemPrompt: {
+      context(definition) { contexts.push(definition); return () => {}; },
+      section(definition) { sections.push(definition); return () => {}; }
+    }
+  };
+  const gate = createSessionGate({
+    sessionGateEnabled: true,
+    sessionGateSubagents: true,
+    sessionGateSessions: ["private"]
+  });
+  createInjector(ctx, service, settings, { injectGuidanceEnabled: true }, null, gate);
+  return { store, contexts, sections, gate };
+}
+
+test("all system-prompt surfaces are empty for incognito and remain available to captain", () => {
+  const { contexts, sections, gate } = injectionSetup();
+  const memory = contexts.find((item) => item.name === "memory");
+  const userSettings = contexts.find((item) => item.name === "user-settings");
+  const guide = sections.find((item) => item.name === "memory-guide");
+  const privateContext = { agent: { session: { id: "private" } } };
+  const childContext = { agent: { session: { id: "worker", header: { parentSession: "captain", origin: "subagent" } } } };
+  const captainContext = { agent: { session: { id: "captain", header: { origin: "main" } } } };
+
+  assert.equal(memory.text(privateContext), "");
+  assert.equal(userSettings.text(privateContext), "");
+  assert.equal(guide.text(privateContext), "");
+  assert.equal(memory.text(childContext), "");
+  assert.equal(userSettings.text(childContext), "");
+  assert.equal(guide.text(childContext), "");
+
+  assert.match(memory.text(captainContext), /\[记忆库\]/);
+  assert.match(userSettings.text(captainContext), /用户画像正文/);
+  assert.equal(guide.text(captainContext), MEMORY_GUIDE_SECTION);
+  gate.observe(childContext.agent.session);
+  assert.equal(gate.isOff("worker"), true);
+});
+
+test("every registered memory tool rejects before side effects for an incognito session", async () => {
+  const store = createStore(":memory:");
+  const baseService = createService({ store, mirror: null, config: {} });
+  let serviceCalls = 0;
+  const service = new Proxy(baseService, {
+    get(target, key, receiver) {
+      const value = Reflect.get(target, key, receiver);
+      if (typeof value !== "function") return value;
+      return (...args) => {
+        serviceCalls += 1;
+        return value.apply(target, args);
+      };
+    }
+  });
+  const registered = [];
+  const registry = { register(tool) { registered.push(tool); return () => {}; } };
+  const gate = createSessionGate({ sessionGateEnabled: true, sessionGateSessions: ["private"] });
+  createTools({ tools: registry }, service, {}, null, gate);
+  const exec = { agent: { session: { id: "private" } } };
+
+  assert.ok(registered.length >= 11);
+  for (const tool of registered) {
+    await assert.rejects(tool.execute({}, exec), /incognito session/, tool.name);
+  }
+  assert.equal(serviceCalls, 0, "rejected calls do not reach memory service reads or writes");
+  assert.equal(store.count(), 0, "no memory rows were written through an executor");
+  assert.equal(store.db.prepare("SELECT COUNT(*) AS n FROM scope_state").get().n, 0, "set_scope_state also rejects before writing");
+
+  const captainSave = registered.find((tool) => tool.name === "memory_save");
+  const result = await captainSave.execute(
+    { type: "preference", title: "captain", content: "可用", importance: 4 },
+    { agent: { session: { id: "captain", header: { origin: "main" } } } }
+  );
+  assert.equal(result.action, "created", "normal captain tool use is unaffected");
+  assert.equal(store.count(), 1);
+  store.close();
+});
+
+test("retained tool executors use the latest gate after live registry reapply", async () => {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  const registered = [];
+  const registry = { register(tool) { registered.push(tool); return () => {}; } };
+  const initialGate = createSessionGate({ sessionGateEnabled: true, sessionGateSessions: ["private"] });
+  createTools({ tools: registry }, service, {}, null, initialGate);
+  const retainedSave = registered.find((tool) => tool.name === "memory_save");
+  const privateExec = { agent: { session: { id: "private" } } };
+  const args = { type: "preference", title: "live gate", content: "check", importance: 4 };
+
+  await assert.rejects(retainedSave.execute(args, privateExec), /incognito session/);
+  const openGate = createSessionGate({ sessionGateEnabled: false });
+  createTools({ tools: registry }, service, {}, null, openGate);
+  assert.equal(registered.length, 11, "live reapply keeps the host's existing tool registrations");
+  assert.equal((await retainedSave.execute(args, privateExec)).action, "created", "off restores the original tool behavior");
+  const closedGate = createSessionGate({ sessionGateEnabled: true, sessionGateSessions: ["private"] });
+  createTools({ tools: registry }, service, {}, null, closedGate);
+  await assert.rejects(
+    retainedSave.execute({ ...args, content: "blocked" }, privateExec),
+    /incognito session/,
+    "a retained tool uses the gate from the latest live reapply"
+  );
+  assert.equal(store.count(), 1, "the re-applied gate still runs before any write");
+  store.close();
+});
+
+function summarySession(id, header = {}) {
+  return {
+    id,
+    header,
+    requestHeader: () => ({ config: { provider: "deepseek", model: "deepseek-chat" } }),
+    events: [
+      { type: "user/message", data: { source: { kind: "user" }, content: [{ type: "text", text: "选型" }] } },
+      { type: "turn/end", seq: 2 }
+    ]
+  };
+}
+
+test("distillation skips incognito sessions before model or storage work", async () => {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  const listeners = [];
+  const calls = [];
+  const ctx = {
+    on(name, handler) { listeners.push({ name, handler }); return () => {}; },
+    llm: {
+      stream() {
+        calls.push(true);
+        const output = JSON.stringify([{ type: "decision", title: "选择", content: "落库", importance: 4 }]);
+        return (async function* () {
+          yield { type: "block-start", block: { type: "text" } };
+          yield { type: "text-delta", delta: output };
+          yield { type: "block-end", block: { type: "text" } };
+          yield { type: "finish", kind: "ok" };
+        })();
+      }
+    }
+  };
+  const gate = createSessionGate({ sessionGateEnabled: true, sessionGateSessions: ["private"] });
+  const summarizer = createSummarizer(ctx, service, { autoSummarize: true, distillRateLimitIntervalMs: 0 }, {}, gate);
+  const handler = listeners.find((item) => item.name === "session/event").handler;
+
+  await handler(summarySession("private"), { type: "turn/end", seq: 2 });
+  assert.equal(calls.length, 0);
+  assert.equal(store.count(), 0);
+  await handler(summarySession("captain", { origin: "main" }), { type: "turn/end", seq: 2 });
+  assert.equal(calls.length, 1);
+  assert.equal(store.count(), 1, "captain still distills normally");
+  summarizer.dispose();
+  store.close();
+});