@modusensus/dsh-mneme 0.9.5 → 0.10.0

package/test/sleep.test.js

@@ -525,3 +525,296 @@ test("issue#250 sleep still adjudicates normally when llmAudit.enabled === false
   assert.equal(service.listLlmAudits().length, 0, "no audit rows when disabled");
   store.close();
 });
+// ------------------------------------------------------------ issue #529: input budget
+
+// seedSimilarPairs：造 n 条同类型、两两相似度都不低于阈值的记忆，且每条只可能与
+// 一条配成对（相似度按 i 递减）。用来验证「池子大于单批上限」时分批是否真的分开了。
+// 这些向量不是正交的——cosine 只在 [1,0,0] 与 [s, sin, 0] 之间算，因此给每对单独
+// 一个角度，与 seedConflictPair 同一套构造。
+function seedSimilarPairs(service, vectorIndex, n) {
+  const mems = [];
+  for (let i = 0; i < n; i++) {
+    const m = makeMemory(service, `主题${i}`, `内容${i}`, "project");
+    mems.push(m);
+  }
+  // 全部推到同一个方向附近：任意两条的 cosine 都 ≈ 1（> 0.85），findPotentialConflicts
+  // 会生成 C(n,2) 对，去重阶段按相似度留下 n/2 对（每记忆至多一对）。
+  for (const m of mems) vectorIndex.saveEmbedding(m.id, [1, 0, 0]);
+  return mems;
+}
+
+// 记录**冲突相位**每次往返送进去的候选对数（user 消息里每个候选行以 "id=" 开头）。
+// 必须按 purpose 过滤：同一轮里 pattern 相位也会调 LLM，把它的往返算进来会让
+// 「送了几批」这个断言凭空多一批。
+function countingCtx(responder, batchSizes = []) {
+  let call = 0;
+  const ctx = {
+    logger: { warn: () => {}, info: () => {} },
+    agentDefaultModel: { currentSelection: () => ({ provider: "mock", model: "sleep-model" }) },
+    llm: {
+      async *stream(options) {
+        const userText = options.messages.find((m) => m.role === "user")?.content?.[0]?.text ?? "";
+        let reply = "[]";
+        if (options.purpose === "sleep-conflict") {
+          batchSizes.push((userText.match(/id=/g) ?? []).length);
+          reply = responder(userText, ++call);
+        }
+        yield { type: "text-delta", index: 0, text: reply };
+        yield { type: "finish", reason: { kind: "stop" } };
+      }
+    }
+  };
+  return { ctx, batchSizes, calls: () => call };
+}
+
+test("issue#529 conflict pairs are sent in bounded batches, not one giant prompt", async () => {
+  const { service, store, vectorIndex } = setup();
+  seedSimilarPairs(service, vectorIndex, 8);
+  const { ctx, batchSizes } = countingCtx(() => "[]");
+  const config = baseConfig({ sleepConflictMaxPairs: 2, sleepConflictMaxPairsPerRun: 8 });
+  const result = await runSleep(ctx, service, config, ctx.logger, { embedder, vectorIndex }, null);
+  assert.ok(batchSizes.length > 1, `expected several batches, got ${batchSizes.length}`);
+  assert.ok(batchSizes.every((n) => n > 0 && n <= 4), `每批不超过 2 对（每对 2 个 id）: ${JSON.stringify(batchSizes)}`);
+  assert.deepEqual(batchSizes.slice(-2), [4, 4], "每对 2 个 id ⇒ 2 对 = 4 个 id 行");
+  assert.equal(result.phases.conflicts.batches, batchSizes.length, "审计里的批次数与真实往返次数一致");
+  store.close();
+});
+
+test("issue#529 a failing batch does not kill the whole run (degraded, not failed)", async () => {
+  const { service, store, vectorIndex } = setup();
+  seedSimilarPairs(service, vectorIndex, 8);
+  const { ctx } = countingCtx((_text, n) => {
+    // 第一批吐空（stream 正常结束但无文本 ⇒ llm failed），后面的批正常。
+    return n === 1 ? "" : "[]";
+  });
+  const config = baseConfig({ sleepConflictMaxPairs: 2, sleepConflictMaxPairsPerRun: 8 });
+  const result = await runSleep(ctx, service, config, ctx.logger, { embedder, vectorIndex }, null);
+  assert.equal(result.phases.conflicts.status, "degraded", "坏批只记 degraded，不判死整轮");
+  assert.ok(result.phases.conflicts.batches > 1, "后面的批照样跑完了");
+  store.close();
+});
+
+test("issue#529 a judged pair is not re-sent while neither side changed (keep leaves a trace)", async () => {
+  const { service, store, vectorIndex } = setup();
+  const { a, b } = seedConflictPair(service, vectorIndex, 1.0);
+  const config = baseConfig();
+  // 第一轮：判 keep（= 模型说这两条不冲突）。这曾经是彻底的 no-op。
+  const first = await runSleep(mockCtx(() => "[]"), service, config, { warn: () => {} }, { embedder, vectorIndex }, null);
+  assert.equal(first.phases.conflicts.status, "noop", "没有动作 ⇒ noop");
+  const ledger = service.listConflictReviewed();
+  assert.equal(ledger.length, 1, "判 keep 也要在台账里留一行");
+  assert.equal(ledger[0].outcome, "keep");
+  assert.deepEqual([ledger[0].memory_a, ledger[0].memory_b].sort(), [a.id, b.id].sort());
+
+  // 第二轮：两侧都没动 ⇒ 这对已经在台账里，不该再送 LLM。
+  const secondCtx = countingCtx(() => "[]");
+  const second = await runSleep(secondCtx.ctx, service, config, secondCtx.ctx.logger, { embedder, vectorIndex }, null);
+  assert.equal(secondCtx.calls(), 0, "同一对、两侧都没更新 ⇒ 不再送审");
+  assert.equal(second.phases.conflicts.ledgerSkipped, 1);
+
+  // 第三轮：动一下其中一侧（内容更新 ⇒ updated_at 前进），它就该重新入池。
+  // service.update 会把该行的向量作废并异步重算；测试里的 mock embedder 只支持
+  // 「一条一条 embed」的形式（embedSingle），批量 embed 的返回形状不是它覆盖的范围，
+  // 所以这里按既有夹具的做法手工补一次向量——被测的是台账判据，不是回填路径。
+  service.update(b.id, { content: "内容B 关于主题X（改）" });
+  vectorIndex.saveEmbedding(b.id, [1, 0, 0]);
+  const thirdCtx = countingCtx(() => "[]");
+  const third = await runSleep(thirdCtx.ctx, service, config, thirdCtx.ctx.logger, { embedder, vectorIndex }, null);
+  assert.equal(thirdCtx.calls(), 1, "任一侧更新过 ⇒ 重新送审");
+  assert.equal(third.phases.conflicts.ledgerSkipped, 0);
+  store.close();
+});
+
+test("issue#529 per-run cap bounds the pairs adjudicated in one run", async () => {
+  const { service, store, vectorIndex } = setup();
+  seedSimilarPairs(service, vectorIndex, 12);
+  const { ctx, calls } = countingCtx(() => "[]");
+  const config = baseConfig({ sleepConflictMaxPairs: 2, sleepConflictMaxPairsPerRun: 4 });
+  const result = await runSleep(ctx, service, config, ctx.logger, { embedder, vectorIndex }, null);
+  assert.ok(calls() <= 2, `每轮最多 4 对 ÷ 每批 2 对 = 2 次往返，实际 ${calls()}`);
+  assert.ok(result.phases.conflicts.perRunSkipped > 0, "超出本轮预算的对要被记下来");
+  store.close();
+});
+
+test("issue#529 user activity between batches aborts instead of reporting noop", async () => {
+  const { service, store, vectorIndex } = setup();
+  seedSimilarPairs(service, vectorIndex, 12);
+  const controller = new AbortController();
+  // 第一批返回之后用户恢复活动（noteWrite → abort）。此时第二、三批根本没送出去，
+  // 把它们算成「看过、没冲突」（noop）是这一相位最容易犯的谎。
+  const { ctx } = countingCtx(() => {
+    controller.abort();
+    return "[]";
+  });
+  const config = baseConfig({ sleepConflictMaxPairs: 1, sleepConflictMaxPairsPerRun: 12 });
+  const result = await runSleep(ctx, service, config, ctx.logger, { embedder, vectorIndex }, controller.signal);
+  assert.equal(result.phases.conflicts.status, "aborted", "中途被打断不是 noop");
+  assert.equal(result.phases.conflicts.batches, 6, "计划批次数照实记（不是实际送出的批次数）");
+  // 整轮层也要如实：deriveStatus 此前只认 failed/error，aborted 相位会被静默折成
+  // noop，审计行于是把「没跑完」记成「跑过、没什么事」——与相位层同一个谎。
+  assert.equal(result.status, "aborted", "整轮状态沿用相位的 aborted，不折回 noop");
+  store.close();
+});
+
+test("issue#529 failed batches still report pairs/batches (audit used to lose them)", async () => {
+  const { service, store, vectorIndex } = setup();
+  seedSimilarPairs(service, vectorIndex, 4);
+  const { ctx } = countingCtx(() => "");
+  const config = baseConfig({ sleepConflictMaxPairs: 2, sleepConflictMaxPairsPerRun: 4 });
+  const result = await runSleep(ctx, service, config, ctx.logger, { embedder, vectorIndex }, null);
+  const phase = result.phases.conflicts;
+  assert.equal(phase.status, "failed", "全部批次失败 ⇒ 整轮 failed");
+  assert.ok(Number.isInteger(phase.pairs) && phase.pairs > 0, "失败轮也带 pairs");
+  assert.ok(Number.isInteger(phase.batches) && phase.batches > 0, "失败轮也带 batches");
+  store.close();
+});
+
+
+// ------------------------------------------- issue #536 review: CodeRabbit 三条
+
+// 把一条记忆的 created_at / updated_at 一起回拨。update 决策有 24h 保护期，
+// 台账判据比的是 updated_at——两处都要动，只改一个会让用例互相干扰。
+function backdate(store, id, hours) {
+  const ts = new Date(Date.now() - hours * 3600000).toISOString();
+  store.db.prepare("UPDATE memories SET created_at = ?, updated_at = ? WHERE id = ?").run(ts, ts, id);
+}
+
+// 造一对向量完全相同的记忆（similarity = 1）。
+function seedIdenticalPair(service, vectorIndex, dir, tag) {
+  const a = makeMemory(service, `${tag}A`, `${tag} 内容A`, "project");
+  const b = makeMemory(service, `${tag}B`, `${tag} 内容B`, "project");
+  vectorIndex.saveEmbedding(a.id, dir);
+  vectorIndex.saveEmbedding(b.id, dir);
+  return { a, b };
+}
+
+test("issue#536 review ①: an already-judged pair must not eat a memory's pairing slot", async () => {
+  const { service, store, vectorIndex } = setup();
+  // a-b 相似度 1.0，a-c 与 b-c 都是 0.9：按相似度排序先去重的旧写法会先选中 a-b，
+  // 再把 a-b 当"已审"丢掉，于是 a 的名额被一个注定被过滤的对占住，a-c 进不来。
+  const a = makeMemory(service, "主题X", "内容A 关于主题X", "project");
+  const b = makeMemory(service, "主题X副本", "内容B 关于主题X", "project");
+  const c = makeMemory(service, "主题X变体", "内容C 关于主题X", "project");
+  vectorIndex.saveEmbedding(a.id, [1, 0, 0]);
+  vectorIndex.saveEmbedding(b.id, [1, 0, 0]);
+  vectorIndex.saveEmbedding(c.id, [0.9, Math.sqrt(1 - 0.81), 0]);
+  // a-b 已经判过（keep），且两侧此后都没动过 ⇒ 本轮不该再送。
+  service.saveConflictReviewed({
+    run_id: "seed",
+    memory_a: a.id,
+    memory_b: b.id,
+    outcome: "keep",
+    judged_at: new Date(Date.now() + 60000).toISOString()
+  });
+
+  const { ctx, calls } = countingCtx(() => "[]");
+  const result = await runSleep(ctx, service, baseConfig(), ctx.logger, { embedder, vectorIndex }, null);
+  assert.equal(calls(), 1, "台账预筛必须发生在去重之前，a 要能和 c 配对送出去");
+  assert.equal(result.phases.conflicts.ledgerSkipped, 1, "被台账挡下的对数照实记");
+  store.close();
+});
+
+test("issue#536 review ②: reflectionUpdateMaxPerRun stays a whole-run cap across batches", async () => {
+  const { service, store, vectorIndex } = setup();
+  // 两对向量正交，互不干扰 ⇒ 去重后正好两对，每批一对。
+  const p1 = seedIdenticalPair(service, vectorIndex, [1, 0, 0], "甲");
+  const p2 = seedIdenticalPair(service, vectorIndex, [0, 1, 0], "乙");
+  for (const m of [p1.a, p1.b, p2.a, p2.b]) backdate(store, m.id, 48);
+
+  // 每批都提一条 update：整轮上限 1，所以只有先跑的那批能落地。
+  const { ctx, calls } = countingCtx((text) => {
+    const id = text.includes(p1.a.id) ? p1.a.id : p2.a.id;
+    const next = text.includes(p1.a.id) ? "甲 内容A（更新）" : "乙 内容A（更新）";
+    return JSON.stringify([{ action: "update", ids: [id], content: next, reason: "内容有误" }]);
+  });
+  const config = baseConfig({ sleepConflictMaxPairs: 1, sleepConflictMaxPairsPerRun: 2, reflectionUpdateMaxPerRun: 1 });
+  const result = await runSleep(ctx, service, config, ctx.logger, { embedder, vectorIndex }, null);
+  assert.equal(calls(), 2, "两对各自成批，都要送");
+  const updated = [p1.a, p2.a].filter((m) => service.getById(m.id).content.endsWith("（更新）"));
+  assert.equal(updated.length, 1, "update 是整轮上限，不是每批上限——只能落地一条");
+  assert.equal(result.phases.conflicts.batches, 2);
+  store.close();
+});
+
+test("issue#536 review ③: a decision that never landed must not be recorded as judged", async () => {
+  const { service, store, vectorIndex } = setup();
+  const { a } = seedConflictPair(service, vectorIndex, 1.0);
+  // 提一条"不改任何字段"的 update：validateDecisions 会把它跳过（skipInvalid），
+  // 该条决策没有落地。若照旧把整批送审对都写进台账，这一对就会被判成"已审"
+  // 而永远不再送——沉默地永久压制一个真实冲突。
+  const { ctx, calls } = countingCtx(() =>
+    JSON.stringify([{ action: "update", ids: [a.id], content: "内容A 关于主题X" }])
+  );
+  const config = baseConfig({ reflectionUpdateMinAgeHours: 0 });
+  const result = await runSleep(ctx, service, config, ctx.logger, { embedder, vectorIndex }, null);
+  assert.equal(calls(), 1, "这一对确实被送出去判过");
+  assert.equal(service.listConflictReviewed().length, 0, "没落地的决策不能记成已审");
+  assert.ok(result.phases.conflicts.skipped.length > 0, "跳过明细照常进审计");
+  store.close();
+});
+
+test("issue#536 review ④: judged_at lives in the store's clock domain, not the wall clock", async () => {
+  const { service, store, vectorIndex } = setup();
+  const { a, b } = seedConflictPair(service, vectorIndex, 1.0);
+  // 造一次「库里的单调时钟比墙钟快」——src/store.js 的 nowIso 在同一毫秒内的连续
+  // 写入上逐次 +1ms，高频写入的库完全可能领先墙钟几毫秒（CI 的 test-host-legacy
+  // 腿抓到过这次真 flake）。这里直接把两侧推到墙钟之后，等价于那个状态。
+  const ahead = new Date(Date.now() + 5000).toISOString();
+  for (const id of [a.id, b.id]) {
+    store.db.prepare("UPDATE memories SET created_at = ?, updated_at = ? WHERE id = ?").run(ahead, ahead, id);
+  }
+
+  // 第一轮判 keep ⇒ 记台账。
+  const first = await runSleep(mockCtx(() => "[]"), service, baseConfig(), { warn: () => {} }, { embedder, vectorIndex }, null);
+  assert.equal(first.phases.conflicts.status, "noop");
+  const ledger = service.listConflictReviewed();
+  assert.equal(ledger.length, 1, "判 keep 要留一行");
+  assert.ok(
+    ledger[0].judged_at >= ahead,
+    "judged_at 不能早于被测行自己的 updated_at（" + ledger[0].judged_at + " vs " + ahead + "）"
+  );
+
+  // 第二轮：两侧确实没动过 ⇒ 不许重送。若 judged_at 取了墙钟，这里会读成
+  // 「判过之后又被改过」，判 keep 的死循环原样复活。
+  const second = countingCtx(() => "[]");
+  await runSleep(second.ctx, service, baseConfig(), second.ctx.logger, { embedder, vectorIndex }, null);
+  assert.equal(second.calls(), 0, "时钟领先墙钟时，已审的对仍然不许重送");
+  store.close();
+});
+
+test("issue#536 review ⑤: a batch that throws does not take the rest of the run with it", async () => {
+  const { service, store, vectorIndex } = setup();
+  // 两对正交向量 ⇒ 两批。让**第一批**的 LLM 往返直接抛（不是返回错误：返回错误那条
+  // 通路本来就有失败返回，早被前面的用例覆盖了）。要验的是：adjudicateBatch 内部
+  // 任何未被兜住的异常，都只折损它自己那一批，后面的批次照跑、之前的汇总不丢。
+  // applyDecisions 把 service.update 的异常吞进 failures（decisions.js:532-540），
+  // 所以打桩 service 的方法测不到这条守卫，必须在 LLM 这一层抛。
+  const p1 = seedIdenticalPair(service, vectorIndex, [1, 0, 0], "甲");
+  const p2 = seedIdenticalPair(service, vectorIndex, [0, 1, 0], "乙");
+  for (const m of [p1.a, p1.b, p2.a, p2.b]) backdate(store, m.id, 48);
+  const { ctx, calls } = countingCtx((text) => {
+    const id = text.includes(p1.a.id) ? p1.a.id : p2.a.id;
+    const next = text.includes(p1.a.id) ? "甲 内容A（更新）" : "乙 内容A（更新）";
+    return JSON.stringify([{ action: "update", ids: [id], content: next, reason: "内容有误" }]);
+  });
+  const realStream = ctx.llm.stream;
+  let thrown = false;
+  ctx.llm.stream = async function* (options) {
+    if (!thrown && options.purpose === "sleep-conflict") {
+      thrown = true;
+      throw new Error("boom inside adjudicateBatch");
+    }
+    yield* realStream.call(this, options);
+  };
+  const config = baseConfig({ sleepConflictMaxPairs: 1, sleepConflictMaxPairsPerRun: 2, reflectionUpdateMaxPerRun: 2 });
+  const result = await runSleep(ctx, service, config, ctx.logger, { embedder, vectorIndex }, null);
+  assert.equal(thrown, true, "第一批确实抛了，否则这条用例什么也没验");
+  assert.equal(calls(), 1, "第一批抛错后第二批仍然要跑");
+  assert.notEqual(result.phases.conflicts.status, "failed", "只要有一批活下来，就不是整轮 failed");
+  // 抛的是第一批（哪个 pair 先送取决于排序，所以两条都问，只要求"恰好一条活下来"）：
+  // 断言落在结果上，不落在顺序上，免得排序一变这条用例就假红。
+  const landed = [p1.a, p2.a].filter((m) => service.getById(m.id).content.endsWith("（更新）"));
+  assert.equal(landed.length, 1, "第二批照常落地，且只落地一批");
+  assert.equal(result.phases.conflicts.batches, 2, "抛错的批次不吞掉轮次的形状");
+  store.close();
+});

package/test/standalone-api.test.js

@@ -1268,3 +1268,53 @@ test("GET /memory/provenance: 409 beats 503 — feature off is more specific tha
     close();
   }
 });
+
+// --- #524 方向 2：?sessionId=<sid> 列该会话的蒸馏窗口 -----------------------
+// 与宿主内 API 是同一份口径（共用 provenance-http.js），这里只钉两张皮的那条差
+// 异之外的部分真的走通了：一行一窗口、按 seq_start 排、truncated 说出来。
+test("GET /memory/provenance?sessionId= lists a session's distill windows", async () => {
+  const { base, auth, store, close } = await setup({ config: RECORDS_ON });
+  try {
+    const a = await saveMemory(base, auth, { type: "decision", title: "核心决策", content: "选定 SQLite", importance: 5 });
+    const b = await saveMemory(base, auth, { type: "decision", title: "备选", content: "JSON 文件", importance: 3 });
+    const idA = a.memory?.id ?? a.id;
+    const idB = b.memory?.id ?? b.id;
+    // 同一窗口派生两条记忆：答复里必须并成一行（link_count=2），不是两行。
+    store.saveMemoryProvenance({ memoryId: idA, sessionId: "s1", seqStart: 10, seqEnd: 12, createdAt: "t2" });
+    store.saveMemoryProvenance({ memoryId: idB, sessionId: "s1", seqStart: 10, seqEnd: 12, createdAt: "t2" });
+    store.saveMemoryProvenance({ memoryId: idA, sessionId: "s1", seqStart: 1, seqEnd: 3, createdAt: "t1" });
+    store.saveMemoryProvenance({ memoryId: idA, sessionId: "s2", seqStart: 50, seqEnd: 51, createdAt: "t3" });
+
+    const res = await fetch(`${base}/memory/provenance?sessionId=s1`, { headers: auth });
+    assert.equal(res.status, 200);
+    const body = await res.json();
+    assert.equal(body.sessionId, "s1");
+    assert.equal(body.memoryId, undefined, "两个方向的认领键不许同时出现");
+    assert.equal(body.truncated, false);
+    assert.deepEqual(body.windows.map((w) => [w.seq_start, w.seq_end]), [[1, 3], [10, 12]],
+      "同一 (seq_start, seq_end) 并成一行，按 seq_start 升序；别的会话的窗口不出现");
+    assert.deepEqual(body.windows.map((w) => w.link_count), [1, 2]);
+  } finally {
+    close();
+  }
+});
+
+test("GET /memory/provenance: both selectors at once is 400, and limit is bounded", async () => {
+  const { base, auth, close } = await setup({ config: RECORDS_ON });
+  try {
+    const both = await fetch(`${base}/memory/provenance?id=m1&sessionId=s1`, { headers: auth });
+    assert.equal(both.status, 400, "两个主键都给不许静默择一");
+    assert.equal((await both.json()).error, "ambiguous-id");
+
+    for (const bad of ["0", "-1", "1.5", "abc", "1e3", "101"]) {
+      const res = await fetch(`${base}/memory/provenance?sessionId=s1&limit=${bad}`, { headers: auth });
+      assert.equal(res.status, 400, `limit=${bad} 必须 400`);
+      assert.equal((await res.json()).error, "invalid-limit");
+    }
+
+    const missing = await fetch(`${base}/memory/provenance`, { headers: auth });
+    assert.equal(missing.status, 400, "两个主键都缺仍是 400 missing-id");
+  } finally {
+    close();
+  }
+});

package/test/store.test.js

@@ -476,6 +476,31 @@ test("countConflictPending counts unresolved rows only; resolve unknown id is un
   store.close();
 });
 
+// Issue #533：differentiate 的裁决账本。正文不再追加注记，改由这张表记住「这一对
+// 已经判过、两条都留」，候选构造阶段读它避免同一对每轮重判。
+test("Issue #533: differentiated_pairs survives a reopen and normalizes pair order", () => {
+  const dir = mkdtempSync(join(tmpdir(), "dsh-mneme-diffpair-"));
+  const path = join(dir, "memory.db");
+  const s1 = createStore(path);
+  // 送审顺序与存储顺序相反也要落到同一行（账本按 id 排序归一）。
+  s1.saveDifferentiatedPair({ run_id: "r1", memory_a: "mb", memory_b: "ma", hash_a: "hb", hash_b: "ha", distinctions: ["只看甲", "只看乙"] });
+  assert.equal(s1.listDifferentiatedPairs().length, 1);
+  s1.close();
+  const s2 = createStore(path);
+  const found = s2.findDifferentiatedPair("ma", "mb");
+  assert.ok(found, "lookups work in either argument order");
+  assert.equal(found.memory_a, "ma", "the row is stored sorted");
+  assert.equal(found.hash_a, "ha", "hashes travel with their side");
+  assert.deepEqual(found.distinctions, ["只看甲", "只看乙"]);
+  assert.equal(s2.listDifferentiatedPairs().length, 1, "re-saving the same pair updates instead of duplicating");
+  s2.saveDifferentiatedPair({ run_id: "r2", memory_a: "ma", memory_b: "mb", hash_a: "ha2", hash_b: "hb2" });
+  assert.equal(s2.listDifferentiatedPairs().length, 1, "still one row for one pair");
+  const updated = s2.findDifferentiatedPair("ma", "mb");
+  assert.equal(updated.hash_a, "ha2", "the refresh overwrites the hashes");
+  assert.equal(updated.distinctions, undefined, "an empty distinctions lands as NULL, not as an empty array");
+  s2.close();
+});
+
 test("conflict_pending table persists across store reopen", () => {
   const dir = mkdtempSync(join(tmpdir(), "dsh-mneme-conflict-"));
   const path = join(dir, "memory.db");
@@ -502,3 +527,198 @@ test("Issue #128: needsEmbedding skips archived and forgotten rows", () => {
   assert.deepEqual(ids, [active.id], "only the active row is a backfill candidate");
   store.close();
 });
+
+// Issue #495：listDreamRuns 的 excludeRunType 是**下推**条件而不是调用方后置过滤——
+// 后置过滤在 limit 生效之后就晚了：5 个名额已经被 organize 占掉，再筛只能得到空。
+// 三条一起钉：默认不过滤（审计面要看全量）、指定值真的排除、白名单之外的值不生效
+// （这个参数拼进 SQL 的 != 条件，任意外来字符串不能改变查询形状）。
+test("Issue #495: listDreamRuns excludes a run type by pushdown, and only accepts known types", () => {
+  const store = openMemory();
+  store.saveDreamRun({ created_at: "2026-01-01T00:00:00.000Z", status: "ok", snapshot_hash: "h", input_count: 0, run_type: "auto", receipt: "r1" });
+  store.saveDreamRun({ created_at: "2026-01-02T00:00:00.000Z", status: "ok", snapshot_hash: "h", input_count: 0, run_type: "organize", receipt: "r2" });
+  store.saveDreamRun({ created_at: "2026-01-03T00:00:00.000Z", status: "ok", snapshot_hash: "h", input_count: 0, run_type: "organize", receipt: "r3" });
+
+  assert.equal(store.listDreamRuns().length, 3, "no filter by default — the audit surface keeps every run type");
+  assert.equal(store.listDreamRuns({ limit: 1 })[0].run_type, "organize", "limit applies to the full set");
+
+  const onlyConsolidation = store.listDreamRuns({ limit: 1, excludeRunType: "organize" });
+  assert.equal(onlyConsolidation.length, 1);
+  assert.equal(onlyConsolidation[0].run_type, "auto", "the pushdown must apply before LIMIT, not after");
+
+  // 白名单之外的值按「不过滤」处理，不静默返回空集。诚实说：这条断言钉得住
+  // 「未知值 ⇒ 不过滤」这个可观测契约，钉不住白名单本身——把 includes 判断换成裸绑定，
+  // 四条断言仍然全绿（不存在的 run_type 本来也筛不掉任何行）。白名单的价值是纵深：
+  // 值来自调用方时只允许已知的三个字面量进 SQL 的 != 条件，查询形状不随外部字符串改变。
+  assert.equal(store.listDreamRuns({ excludeRunType: "auto' OR 1=1 --" }).length, 3,
+    "a hostile value is bound as a parameter and filters nothing, never widens the query");
+  assert.equal(store.listDreamRuns({ excludeRunType: "nope" }).length, 3);
+  store.close();
+});
+
+// ============================ #512 蒸馏 run 归因
+
+test("#512 迁移：老库补上 distill_run_id 列与两张新表，存量链接留 NULL 不猜", () => {
+  const dir = mkdtempSync(join(tmpdir(), "dsh-mneme-migrate-run-"));
+  const dbPath = join(dir, "legacy.db");
+  try {
+    // 存量库：#399 时代的形状——memory_provenance 没有 distill_run_id，也没有
+    // distill_runs 与 memory_mints。这一行代表「改造之前就落盘的链接」，它没有 run 可指。
+    const legacy = new DatabaseSync(dbPath);
+    legacy.exec("CREATE TABLE memories (" +
+      "id TEXT PRIMARY KEY, type TEXT NOT NULL, title TEXT NOT NULL, content TEXT NOT NULL, " +
+      "tags TEXT NOT NULL DEFAULT '[]', importance INTEGER NOT NULL DEFAULT 3, " +
+      "forgotten INTEGER NOT NULL DEFAULT 0, archived INTEGER NOT NULL DEFAULT 0, " +
+      "source TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL);");
+    legacy.exec("CREATE TABLE memory_provenance (" +
+      "memory_id TEXT NOT NULL, session_id TEXT NOT NULL, " +
+      "seq_start INTEGER NOT NULL, seq_end INTEGER NOT NULL, created_at TEXT NOT NULL);");
+    legacy.exec("INSERT INTO memories (id, type, title, content, tags, importance, forgotten, archived, source, created_at, updated_at) " +
+      "VALUES ('old1', 'history', '老记忆', '内容', '[]', 3, 0, 0, NULL, '2026-01-01T00:00:00.000Z', '2026-01-02T00:00:00.000Z');");
+    legacy.exec("INSERT INTO memory_provenance (memory_id, session_id, seq_start, seq_end, created_at) " +
+      "VALUES ('old1', 's-old', 1, 5, '2026-01-02T00:00:00.000Z');");
+    legacy.close();
+
+    const store = createStore(dbPath);
+    const cols = store.db.prepare("PRAGMA table_info(memory_provenance)").all().map((c) => c.name);
+    assert.ok(cols.includes("distill_run_id"), "存量库重开即补上 distill_run_id");
+    for (const table of ["distill_runs", "memory_mints"]) {
+      const row = store.db.prepare(
+        "SELECT name FROM sqlite_master WHERE type='table' AND name=?"
+      ).get(table);
+      assert.ok(row, "存量库重开即建 " + table);
+    }
+
+    const links = store.provenanceFor("old1");
+    assert.equal(links.length, 1);
+    assert.equal(
+      links[0].distill_run_id,
+      null,
+      "历史链接保持 NULL：反推一个合成 run id 比不填更坏（读数正常、实际是猜的）"
+    );
+    assert.equal(store.mintsFor("old1").length, 0, "历史记忆不补铸造记录——那时根本没有 run 概念");
+    store.close();
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("#512 迁移幂等：重开已升级的库不重复 ALTER、不动已落盘的 run 归因", () => {
+  const dir = mkdtempSync(join(tmpdir(), "dsh-mneme-migrate-run2-"));
+  const dbPath = join(dir, "upgraded.db");
+  try {
+    const first = createStore(dbPath);
+    const m = first.save({ type: "history", title: "t", content: "c" });
+    first.saveDistillRun({
+      id: "run-a",
+      status: "ok",
+      run_type: "autoSummarize",
+      trigger_source: "autoSummarize",
+      session_id: "s1",
+      seq_start: 1,
+      seq_end: 2,
+      memory_count: 1
+    });
+    first.saveMemoryProvenance({
+      memoryId: m.id, sessionId: "s1", seqStart: 1, seqEnd: 2,
+      createdAt: "2026-11-01T00:00:00.000Z", distillRunId: "run-a"
+    });
+    first.close();
+
+    const second = createStore(dbPath);
+    const cols = second.db.prepare("PRAGMA table_info(memory_provenance)")
+      .all().filter((c) => c.name === "distill_run_id");
+    assert.equal(cols.length, 1, "列只存在一份，没被重复 ALTER");
+    assert.equal(second.provenanceFor(m.id)[0].distill_run_id, "run-a", "重开不动已落盘的归因");
+    assert.equal(second.getDistillRun("run-a").status, "ok");
+    second.close();
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("#512 distill_runs：同 id replay 覆写而不重复", () => {
+  const store = openMemory();
+  store.saveDistillRun({
+    id: "r1", status: "failed", error: "boom",
+    run_type: "autoSummarize", trigger_source: "autoSummarize",
+    session_id: "s1", seq_start: 1, seq_end: 3, memory_count: 0,
+    created_at: "2026-11-01T00:00:00.000Z"
+  });
+  // 同一轮重放（等价于宿主重启后重试同一逻辑轮）：必须覆写，不能变成两行。
+  store.saveDistillRun({
+    id: "r1", status: "ok",
+    run_type: "autoSummarize", trigger_source: "autoSummarize",
+    session_id: "s1", seq_start: 1, seq_end: 3, memory_count: 2,
+    created_at: "2026-11-01T00:00:00.000Z"
+  });
+  const runs = store.listDistillRuns();
+  assert.equal(runs.length, 1, "一轮只有一行");
+  assert.equal(runs[0].status, "ok", "replay 覆写成最新的事实");
+  assert.equal(runs[0].error, undefined, "覆写清掉上一次的错误");
+  assert.equal(runs[0].memory_count, 2);
+  assert.equal(runs[0].audit_id, undefined, "没有 audit 行时是 undefined，不是 0");
+  store.close();
+});
+
+test("#512 distill_runs：audit_id 事后补注，补不存在的 run 静默返回 0", () => {
+  const store = openMemory();
+  store.saveDistillRun({ id: "r2", status: "ok", run_type: "autoSummarize", trigger_source: "autoSummarize" });
+  assert.equal(store.attachDistillRunAudit("r2", 42), 1);
+  assert.equal(store.getDistillRun("r2").audit_id, 42);
+  assert.equal(store.attachDistillRunAudit("missing", 42), 0, "行不存在时不动任何东西");
+  assert.equal(store.attachDistillRunAudit("r2", null), 0, "非整数 audit id 一律不写");
+  store.close();
+});
+
+test("#512 memory_mints：同一 (记忆, run) 只记一次，删记忆时显式清掉归因", () => {
+  const store = openMemory();
+  const m = store.save({ type: "pattern", title: "抽出来的规律", content: "c", source: "dream" });
+  const mint = { memoryId: m.id, runId: "run-d", runType: "dream", triggerSource: "autoDream", createdAt: "2026-11-01T00:00:00.000Z" };
+  assert.equal(store.saveMemoryMint(mint), 1);
+  assert.equal(store.saveMemoryMint(mint), 0, "INSERT OR IGNORE：重放不重复记一次铸造");
+  const rows = store.mintsFor(m.id);
+  assert.equal(rows.length, 1);
+  assert.equal(rows[0].run_type, "dream");
+  assert.equal(rows[0].trigger_source, "autoDream");
+
+  store.remove(m.id);
+  assert.equal(
+    store.db.prepare("SELECT count(*) AS c FROM memory_mints WHERE memory_id = ?").get(m.id).c,
+    0,
+    "记忆没了，归因不许悬空（CASCADE 之外仍显式清，与 memory_provenance 同一口径）"
+  );
+  store.close();
+});
+
+// ============================ #493 补充：失败计数持久化（读侧失效）
+// 这张表只服务一道默认关的护栏（summarizeParseFailureMaxRetries），但它的语义有三处
+// 容易写错、且错法都不可见：计数不落库（重启即清零）、失效不在读侧（几周前的失败
+// 直接熔断当前窗口）、清零写成 0（「从没失败过」与「刚清零」变得不可区分）。
+test("#493 补充：解析失败计数持久化、读侧带失效窗口、清零是真 DELETE", () => {
+  const store = openMemory();
+  const sid = "s-streak";
+  assert.equal(store.getDistillParseFailureStreak(sid), 0, "没有记录就是 0，不是 undefined");
+
+  assert.equal(store.bumpDistillParseFailureStreak(sid), 1);
+  assert.equal(store.bumpDistillParseFailureStreak(sid), 2, "累计加一");
+  assert.equal(store.getDistillParseFailureStreak(sid), 2);
+
+  // 读侧失效：时间戳挪到 30 天前，7 天窗口下必须当 0（不判失效时它仍是 2）。
+  const ancient = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000).toISOString();
+  store.db.prepare("UPDATE distill_parse_failures SET updated_at = ? WHERE session_id = ?").run(ancient, sid);
+  assert.equal(store.getDistillParseFailureStreak(sid), 2, "staleAfterMs 缺省不判失效（调用方显式要才判）");
+  assert.equal(store.getDistillParseFailureStreak(sid, { staleAfterMs: 7 * 24 * 60 * 60 * 1000 }), 0,
+    "过期的 streak 必须读成 0：拿几周前的失败去熔断当前窗口，护栏就成了新的误伤路径");
+
+  // 失效之后再加一，必须从 1 起（不是在旧值上 +1）——这条是本块实现的首版 bug，
+  // 被 summarize.test.js 的端到端用例抓出来：SQL 里写 streak + 1 会让失效判断失效。
+  assert.equal(store.bumpDistillParseFailureStreak(sid, { staleAfterMs: 7 * 24 * 60 * 60 * 1000 }), 1,
+    "过期的旧行不许把「新的第一次失败」加成 2");
+
+  // 清零是真删除：没有任何在途失败时不该留一行 0。
+  assert.equal(store.clearDistillParseFailureStreak(sid), 1);
+  assert.equal(store.getDistillParseFailureStreak(sid), 0);
+  assert.equal(store.db.prepare("SELECT count(*) AS c FROM distill_parse_failures").get().c, 0,
+    "清零是 DELETE，不是写 0——写 0 会让「从没失败过」与「刚清零」不可区分");
+  store.close();
+});