@modusensus/dsh-mneme 0.9.5 → 0.10.1

package/test/sleep-failure-backoff.test.js

@@ -0,0 +1,156 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createStore } from "../src/store.js";
+import { createService } from "../src/service.js";
+import { createSleepScheduler } from "../src/dream/sleep.js";
+
+// Issue #529（C 项）：sleep 连续失败退避（sleepFailureBackoff，opt-in）。
+//
+// 报告里 C 的原案是「同一 snapshot_hash 连续失败就拉长间隔」，但 sleep 的
+// snapshot_hash 是**跑完之后**对 phases 结果算的哈希（dream/sleep.js runSleep 里
+// createHash(JSON.stringify(phases))），不是输入快照——同一批输入跑两次结果不同就
+// 得到不同哈希，判据不成立。这里改用与 #292（autoDreamFailureBackoff）同构的
+// 连续失败计数：有效间隔 = sleepMinIntervalHours × 2^连败数，成功清零，封顶 24h。
+//
+// 这些用例锁的是「退避语义」，防的回归是：
+//   ① 退避闸失效/写反 → 恒定失败的模型按 sleepMinIntervalHours 的固定节奏连发
+//      （#529 实测连续 23 轮 llm failed）；
+//   ② 成功不清零 → 模型恢复后仍被旧失败拖着推迟，sleep 变相停摆；
+//   ③ 24h 封顶失效 → 指数无限翻倍（8h 基数 × 2^5 = 10 天），睡眠维护彻底静默；
+//   ④ 默认关路径被顺手改掉 → 未 opt-in 用户的重试间隔漂移；
+//   ⑤ noop 被当成失败 → LLM 通路正常、只是库里没活干的库被越退越长。
+//
+// 时钟与定时器全部注入（同 test/sleep-scheduler-rearm.test.js 的房型）。
+
+function makeHarness(overrides = {}) {
+  let nowMs = 10_000_000;
+  const timers = [];
+  let seq = 1;
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  let runs = 0;
+  let outcome = () => ({ ok: false, status: "failed" });
+  const sched = createSleepScheduler({
+    service,
+    config: {
+      sleepModeEnabled: true,
+      sleepIdleMinutes: 5,
+      sleepMinIntervalHours: 1,
+      ...overrides
+    },
+    logger: { warn: () => {} },
+    onRun: async () => {
+      runs++;
+      return outcome();
+    },
+    now: () => nowMs,
+    setTimeoutFn: (fn, delay) => {
+      const t = { id: seq++, at: nowMs + delay, fn };
+      timers.push(t);
+      return t.id;
+    },
+    clearTimeoutFn: (id) => {
+      const i = timers.findIndex((t) => t.id === id);
+      if (i >= 0) timers.splice(i, 1);
+    }
+  });
+  const fireNext = async () => {
+    timers.sort((a, b) => a.at - b.at);
+    const t = timers.shift();
+    if (!t) throw new Error("no armed timer to fire");
+    nowMs = t.at;
+    await t.fn();
+  };
+  return {
+    sched,
+    store,
+    timers,
+    fireNext,
+    runs: () => runs,
+    now: () => nowMs,
+    setOutcome: (fn) => { outcome = fn; },
+    write: () => { nowMs += 1000; sched.noteWrite(); }
+  };
+}
+
+const HOUR = 3_600_000;
+
+test("issue#529 默认关：失败一次后重试间隔仍是基数，不翻倍", async () => {
+  const h = makeHarness({ sleepFailureBackoff: false });
+  h.write();
+  await h.fireNext();
+  assert.equal(h.runs(), 1, "idle 到点起跑一次");
+  const t0 = h.now();
+  assert.equal(h.sched.shouldRun(t0 + HOUR - 1), false, "基数间隔内照旧不放行");
+  assert.equal(h.sched.shouldRun(t0 + HOUR), true, "关键：基数一到即放行——默认关不翻倍");
+  h.store.close();
+});
+
+test("issue#529 开启：连败把下次放行时刻指数推迟", async () => {
+  const h = makeHarness({ sleepFailureBackoff: true });
+  h.write();
+  await h.fireNext(); // 败 1 → 有效间隔 1h × 2^1 = 2h
+  assert.equal(h.runs(), 1);
+  const t1 = h.now();
+  assert.equal(h.sched.shouldRun(t1 + HOUR), false, "关键：基数到点不放行（现状会放行）");
+  assert.equal(h.sched.shouldRun(t1 + 2 * HOUR), true, "满 2h 才放行第 2 次");
+
+  await h.fireNext(); // 败 2 → 有效间隔 4h
+  assert.equal(h.runs(), 2);
+  const t2 = h.now();
+  assert.equal(h.sched.shouldRun(t2 + 3 * HOUR), false, "连败 2 次后 4h 内不放行");
+  assert.equal(h.sched.shouldRun(t2 + 4 * HOUR), true, "满 4h 放行第 3 次");
+  h.store.close();
+});
+
+test("issue#529 成功一次即清零、间隔回到基数", async () => {
+  const h = makeHarness({ sleepFailureBackoff: true });
+  h.write();
+  await h.fireNext(); // 败 1 → 2h
+  const t1 = h.now();
+  assert.equal(h.sched.shouldRun(t1 + HOUR), false, "前置：退避确实在挡");
+
+  h.setOutcome(() => ({ ok: true, status: "ok" }));
+  await h.fireNext(); // 成功 → 连败清零
+  const t2 = h.now();
+  assert.equal(h.sched.shouldRun(t2 + HOUR), true, "关键：清零后基数即放行（未清零要等 2h）");
+  h.store.close();
+});
+
+test("issue#529 封顶：连败 5 次推迟 24h 即止（未封顶需等 32h）", async () => {
+  const h = makeHarness({ sleepFailureBackoff: true });
+  h.write();
+  await h.fireNext();
+  for (let i = 2; i <= 5; i++) {
+    const wait = Math.min(HOUR * 2 ** (i - 1), 24 * HOUR); // 与实现同一口径的期望间隔
+    assert.equal(h.sched.shouldRun(h.now() + wait), true, `第 ${i} 次起跑前满 ${wait / HOUR}h`);
+    await h.fireNext();
+  }
+  assert.equal(h.runs(), 5);
+  const t = h.now();
+  assert.equal(h.sched.shouldRun(t + 24 * HOUR - 1), false, "关键：封顶后 24h 内仍不放行");
+  assert.equal(h.sched.shouldRun(t + 24 * HOUR), true, "封顶生效：24h 放行，不再翻倍");
+  h.store.close();
+});
+
+test("issue#529 noop 不算失败：没活干的库不该被退避越拖越稀", async () => {
+  const h = makeHarness({ sleepFailureBackoff: true });
+  h.setOutcome(() => ({ ok: false, status: "noop" }));
+  h.write();
+  await h.fireNext();
+  assert.equal(h.runs(), 1);
+  const t0 = h.now();
+  assert.equal(h.sched.shouldRun(t0 + HOUR), true, "关键：noop 后基数即放行（当作失败要等 2h）");
+  h.store.close();
+});
+
+test("issue#529 抛错同样计入连败", async () => {
+  const h = makeHarness({ sleepFailureBackoff: true });
+  h.setOutcome(() => { throw new Error("boom"); });
+  h.write();
+  await h.fireNext();
+  const t0 = h.now();
+  assert.equal(h.sched.shouldRun(t0 + HOUR), false, "关键：抛错也退避到 2h");
+  assert.equal(h.sched.shouldRun(t0 + 2 * HOUR), true);
+  h.store.close();
+});

package/test/sleep.test.js

@@ -525,3 +525,296 @@ test("issue#250 sleep still adjudicates normally when llmAudit.enabled === false
   assert.equal(service.listLlmAudits().length, 0, "no audit rows when disabled");
   store.close();
 });
+// ------------------------------------------------------------ issue #529: input budget
+
+// seedSimilarPairs：造 n 条同类型、两两相似度都不低于阈值的记忆，且每条只可能与
+// 一条配成对（相似度按 i 递减）。用来验证「池子大于单批上限」时分批是否真的分开了。
+// 这些向量不是正交的——cosine 只在 [1,0,0] 与 [s, sin, 0] 之间算，因此给每对单独
+// 一个角度，与 seedConflictPair 同一套构造。
+function seedSimilarPairs(service, vectorIndex, n) {
+  const mems = [];
+  for (let i = 0; i < n; i++) {
+    const m = makeMemory(service, `主题${i}`, `内容${i}`, "project");
+    mems.push(m);
+  }
+  // 全部推到同一个方向附近：任意两条的 cosine 都 ≈ 1（> 0.85），findPotentialConflicts
+  // 会生成 C(n,2) 对，去重阶段按相似度留下 n/2 对（每记忆至多一对）。
+  for (const m of mems) vectorIndex.saveEmbedding(m.id, [1, 0, 0]);
+  return mems;
+}
+
+// 记录**冲突相位**每次往返送进去的候选对数（user 消息里每个候选行以 "id=" 开头）。
+// 必须按 purpose 过滤：同一轮里 pattern 相位也会调 LLM，把它的往返算进来会让
+// 「送了几批」这个断言凭空多一批。
+function countingCtx(responder, batchSizes = []) {
+  let call = 0;
+  const ctx = {
+    logger: { warn: () => {}, info: () => {} },
+    agentDefaultModel: { currentSelection: () => ({ provider: "mock", model: "sleep-model" }) },
+    llm: {
+      async *stream(options) {
+        const userText = options.messages.find((m) => m.role === "user")?.content?.[0]?.text ?? "";
+        let reply = "[]";
+        if (options.purpose === "sleep-conflict") {
+          batchSizes.push((userText.match(/id=/g) ?? []).length);
+          reply = responder(userText, ++call);
+        }
+        yield { type: "text-delta", index: 0, text: reply };
+        yield { type: "finish", reason: { kind: "stop" } };
+      }
+    }
+  };
+  return { ctx, batchSizes, calls: () => call };
+}
+
+test("issue#529 conflict pairs are sent in bounded batches, not one giant prompt", async () => {
+  const { service, store, vectorIndex } = setup();
+  seedSimilarPairs(service, vectorIndex, 8);
+  const { ctx, batchSizes } = countingCtx(() => "[]");
+  const config = baseConfig({ sleepConflictMaxPairs: 2, sleepConflictMaxPairsPerRun: 8 });
+  const result = await runSleep(ctx, service, config, ctx.logger, { embedder, vectorIndex }, null);
+  assert.ok(batchSizes.length > 1, `expected several batches, got ${batchSizes.length}`);
+  assert.ok(batchSizes.every((n) => n > 0 && n <= 4), `每批不超过 2 对（每对 2 个 id）: ${JSON.stringify(batchSizes)}`);
+  assert.deepEqual(batchSizes.slice(-2), [4, 4], "每对 2 个 id ⇒ 2 对 = 4 个 id 行");
+  assert.equal(result.phases.conflicts.batches, batchSizes.length, "审计里的批次数与真实往返次数一致");
+  store.close();
+});
+
+test("issue#529 a failing batch does not kill the whole run (degraded, not failed)", async () => {
+  const { service, store, vectorIndex } = setup();
+  seedSimilarPairs(service, vectorIndex, 8);
+  const { ctx } = countingCtx((_text, n) => {
+    // 第一批吐空（stream 正常结束但无文本 ⇒ llm failed），后面的批正常。
+    return n === 1 ? "" : "[]";
+  });
+  const config = baseConfig({ sleepConflictMaxPairs: 2, sleepConflictMaxPairsPerRun: 8 });
+  const result = await runSleep(ctx, service, config, ctx.logger, { embedder, vectorIndex }, null);
+  assert.equal(result.phases.conflicts.status, "degraded", "坏批只记 degraded，不判死整轮");
+  assert.ok(result.phases.conflicts.batches > 1, "后面的批照样跑完了");
+  store.close();
+});
+
+test("issue#529 a judged pair is not re-sent while neither side changed (keep leaves a trace)", async () => {
+  const { service, store, vectorIndex } = setup();
+  const { a, b } = seedConflictPair(service, vectorIndex, 1.0);
+  const config = baseConfig();
+  // 第一轮：判 keep（= 模型说这两条不冲突）。这曾经是彻底的 no-op。
+  const first = await runSleep(mockCtx(() => "[]"), service, config, { warn: () => {} }, { embedder, vectorIndex }, null);
+  assert.equal(first.phases.conflicts.status, "noop", "没有动作 ⇒ noop");
+  const ledger = service.listConflictReviewed();
+  assert.equal(ledger.length, 1, "判 keep 也要在台账里留一行");
+  assert.equal(ledger[0].outcome, "keep");
+  assert.deepEqual([ledger[0].memory_a, ledger[0].memory_b].sort(), [a.id, b.id].sort());
+
+  // 第二轮：两侧都没动 ⇒ 这对已经在台账里，不该再送 LLM。
+  const secondCtx = countingCtx(() => "[]");
+  const second = await runSleep(secondCtx.ctx, service, config, secondCtx.ctx.logger, { embedder, vectorIndex }, null);
+  assert.equal(secondCtx.calls(), 0, "同一对、两侧都没更新 ⇒ 不再送审");
+  assert.equal(second.phases.conflicts.ledgerSkipped, 1);
+
+  // 第三轮：动一下其中一侧（内容更新 ⇒ updated_at 前进），它就该重新入池。
+  // service.update 会把该行的向量作废并异步重算；测试里的 mock embedder 只支持
+  // 「一条一条 embed」的形式（embedSingle），批量 embed 的返回形状不是它覆盖的范围，
+  // 所以这里按既有夹具的做法手工补一次向量——被测的是台账判据，不是回填路径。
+  service.update(b.id, { content: "内容B 关于主题X（改）" });
+  vectorIndex.saveEmbedding(b.id, [1, 0, 0]);
+  const thirdCtx = countingCtx(() => "[]");
+  const third = await runSleep(thirdCtx.ctx, service, config, thirdCtx.ctx.logger, { embedder, vectorIndex }, null);
+  assert.equal(thirdCtx.calls(), 1, "任一侧更新过 ⇒ 重新送审");
+  assert.equal(third.phases.conflicts.ledgerSkipped, 0);
+  store.close();
+});
+
+test("issue#529 per-run cap bounds the pairs adjudicated in one run", async () => {
+  const { service, store, vectorIndex } = setup();
+  seedSimilarPairs(service, vectorIndex, 12);
+  const { ctx, calls } = countingCtx(() => "[]");
+  const config = baseConfig({ sleepConflictMaxPairs: 2, sleepConflictMaxPairsPerRun: 4 });
+  const result = await runSleep(ctx, service, config, ctx.logger, { embedder, vectorIndex }, null);
+  assert.ok(calls() <= 2, `每轮最多 4 对 ÷ 每批 2 对 = 2 次往返，实际 ${calls()}`);
+  assert.ok(result.phases.conflicts.perRunSkipped > 0, "超出本轮预算的对要被记下来");
+  store.close();
+});
+
+test("issue#529 user activity between batches aborts instead of reporting noop", async () => {
+  const { service, store, vectorIndex } = setup();
+  seedSimilarPairs(service, vectorIndex, 12);
+  const controller = new AbortController();
+  // 第一批返回之后用户恢复活动（noteWrite → abort）。此时第二、三批根本没送出去，
+  // 把它们算成「看过、没冲突」（noop）是这一相位最容易犯的谎。
+  const { ctx } = countingCtx(() => {
+    controller.abort();
+    return "[]";
+  });
+  const config = baseConfig({ sleepConflictMaxPairs: 1, sleepConflictMaxPairsPerRun: 12 });
+  const result = await runSleep(ctx, service, config, ctx.logger, { embedder, vectorIndex }, controller.signal);
+  assert.equal(result.phases.conflicts.status, "aborted", "中途被打断不是 noop");
+  assert.equal(result.phases.conflicts.batches, 6, "计划批次数照实记（不是实际送出的批次数）");
+  // 整轮层也要如实：deriveStatus 此前只认 failed/error，aborted 相位会被静默折成
+  // noop，审计行于是把「没跑完」记成「跑过、没什么事」——与相位层同一个谎。
+  assert.equal(result.status, "aborted", "整轮状态沿用相位的 aborted，不折回 noop");
+  store.close();
+});
+
+test("issue#529 failed batches still report pairs/batches (audit used to lose them)", async () => {
+  const { service, store, vectorIndex } = setup();
+  seedSimilarPairs(service, vectorIndex, 4);
+  const { ctx } = countingCtx(() => "");
+  const config = baseConfig({ sleepConflictMaxPairs: 2, sleepConflictMaxPairsPerRun: 4 });
+  const result = await runSleep(ctx, service, config, ctx.logger, { embedder, vectorIndex }, null);
+  const phase = result.phases.conflicts;
+  assert.equal(phase.status, "failed", "全部批次失败 ⇒ 整轮 failed");
+  assert.ok(Number.isInteger(phase.pairs) && phase.pairs > 0, "失败轮也带 pairs");
+  assert.ok(Number.isInteger(phase.batches) && phase.batches > 0, "失败轮也带 batches");
+  store.close();
+});
+
+
+// ------------------------------------------- issue #536 review: CodeRabbit 三条
+
+// 把一条记忆的 created_at / updated_at 一起回拨。update 决策有 24h 保护期，
+// 台账判据比的是 updated_at——两处都要动，只改一个会让用例互相干扰。
+function backdate(store, id, hours) {
+  const ts = new Date(Date.now() - hours * 3600000).toISOString();
+  store.db.prepare("UPDATE memories SET created_at = ?, updated_at = ? WHERE id = ?").run(ts, ts, id);
+}
+
+// 造一对向量完全相同的记忆（similarity = 1）。
+function seedIdenticalPair(service, vectorIndex, dir, tag) {
+  const a = makeMemory(service, `${tag}A`, `${tag} 内容A`, "project");
+  const b = makeMemory(service, `${tag}B`, `${tag} 内容B`, "project");
+  vectorIndex.saveEmbedding(a.id, dir);
+  vectorIndex.saveEmbedding(b.id, dir);
+  return { a, b };
+}
+
+test("issue#536 review ①: an already-judged pair must not eat a memory's pairing slot", async () => {
+  const { service, store, vectorIndex } = setup();
+  // a-b 相似度 1.0，a-c 与 b-c 都是 0.9：按相似度排序先去重的旧写法会先选中 a-b，
+  // 再把 a-b 当"已审"丢掉，于是 a 的名额被一个注定被过滤的对占住，a-c 进不来。
+  const a = makeMemory(service, "主题X", "内容A 关于主题X", "project");
+  const b = makeMemory(service, "主题X副本", "内容B 关于主题X", "project");
+  const c = makeMemory(service, "主题X变体", "内容C 关于主题X", "project");
+  vectorIndex.saveEmbedding(a.id, [1, 0, 0]);
+  vectorIndex.saveEmbedding(b.id, [1, 0, 0]);
+  vectorIndex.saveEmbedding(c.id, [0.9, Math.sqrt(1 - 0.81), 0]);
+  // a-b 已经判过（keep），且两侧此后都没动过 ⇒ 本轮不该再送。
+  service.saveConflictReviewed({
+    run_id: "seed",
+    memory_a: a.id,
+    memory_b: b.id,
+    outcome: "keep",
+    judged_at: new Date(Date.now() + 60000).toISOString()
+  });
+
+  const { ctx, calls } = countingCtx(() => "[]");
+  const result = await runSleep(ctx, service, baseConfig(), ctx.logger, { embedder, vectorIndex }, null);
+  assert.equal(calls(), 1, "台账预筛必须发生在去重之前，a 要能和 c 配对送出去");
+  assert.equal(result.phases.conflicts.ledgerSkipped, 1, "被台账挡下的对数照实记");
+  store.close();
+});
+
+test("issue#536 review ②: reflectionUpdateMaxPerRun stays a whole-run cap across batches", async () => {
+  const { service, store, vectorIndex } = setup();
+  // 两对向量正交，互不干扰 ⇒ 去重后正好两对，每批一对。
+  const p1 = seedIdenticalPair(service, vectorIndex, [1, 0, 0], "甲");
+  const p2 = seedIdenticalPair(service, vectorIndex, [0, 1, 0], "乙");
+  for (const m of [p1.a, p1.b, p2.a, p2.b]) backdate(store, m.id, 48);
+
+  // 每批都提一条 update：整轮上限 1，所以只有先跑的那批能落地。
+  const { ctx, calls } = countingCtx((text) => {
+    const id = text.includes(p1.a.id) ? p1.a.id : p2.a.id;
+    const next = text.includes(p1.a.id) ? "甲 内容A（更新）" : "乙 内容A（更新）";
+    return JSON.stringify([{ action: "update", ids: [id], content: next, reason: "内容有误" }]);
+  });
+  const config = baseConfig({ sleepConflictMaxPairs: 1, sleepConflictMaxPairsPerRun: 2, reflectionUpdateMaxPerRun: 1 });
+  const result = await runSleep(ctx, service, config, ctx.logger, { embedder, vectorIndex }, null);
+  assert.equal(calls(), 2, "两对各自成批，都要送");
+  const updated = [p1.a, p2.a].filter((m) => service.getById(m.id).content.endsWith("（更新）"));
+  assert.equal(updated.length, 1, "update 是整轮上限，不是每批上限——只能落地一条");
+  assert.equal(result.phases.conflicts.batches, 2);
+  store.close();
+});
+
+test("issue#536 review ③: a decision that never landed must not be recorded as judged", async () => {
+  const { service, store, vectorIndex } = setup();
+  const { a } = seedConflictPair(service, vectorIndex, 1.0);
+  // 提一条"不改任何字段"的 update：validateDecisions 会把它跳过（skipInvalid），
+  // 该条决策没有落地。若照旧把整批送审对都写进台账，这一对就会被判成"已审"
+  // 而永远不再送——沉默地永久压制一个真实冲突。
+  const { ctx, calls } = countingCtx(() =>
+    JSON.stringify([{ action: "update", ids: [a.id], content: "内容A 关于主题X" }])
+  );
+  const config = baseConfig({ reflectionUpdateMinAgeHours: 0 });
+  const result = await runSleep(ctx, service, config, ctx.logger, { embedder, vectorIndex }, null);
+  assert.equal(calls(), 1, "这一对确实被送出去判过");
+  assert.equal(service.listConflictReviewed().length, 0, "没落地的决策不能记成已审");
+  assert.ok(result.phases.conflicts.skipped.length > 0, "跳过明细照常进审计");
+  store.close();
+});
+
+test("issue#536 review ④: judged_at lives in the store's clock domain, not the wall clock", async () => {
+  const { service, store, vectorIndex } = setup();
+  const { a, b } = seedConflictPair(service, vectorIndex, 1.0);
+  // 造一次「库里的单调时钟比墙钟快」——src/store.js 的 nowIso 在同一毫秒内的连续
+  // 写入上逐次 +1ms，高频写入的库完全可能领先墙钟几毫秒（CI 的 test-host-legacy
+  // 腿抓到过这次真 flake）。这里直接把两侧推到墙钟之后，等价于那个状态。
+  const ahead = new Date(Date.now() + 5000).toISOString();
+  for (const id of [a.id, b.id]) {
+    store.db.prepare("UPDATE memories SET created_at = ?, updated_at = ? WHERE id = ?").run(ahead, ahead, id);
+  }
+
+  // 第一轮判 keep ⇒ 记台账。
+  const first = await runSleep(mockCtx(() => "[]"), service, baseConfig(), { warn: () => {} }, { embedder, vectorIndex }, null);
+  assert.equal(first.phases.conflicts.status, "noop");
+  const ledger = service.listConflictReviewed();
+  assert.equal(ledger.length, 1, "判 keep 要留一行");
+  assert.ok(
+    ledger[0].judged_at >= ahead,
+    "judged_at 不能早于被测行自己的 updated_at（" + ledger[0].judged_at + " vs " + ahead + "）"
+  );
+
+  // 第二轮：两侧确实没动过 ⇒ 不许重送。若 judged_at 取了墙钟，这里会读成
+  // 「判过之后又被改过」，判 keep 的死循环原样复活。
+  const second = countingCtx(() => "[]");
+  await runSleep(second.ctx, service, baseConfig(), second.ctx.logger, { embedder, vectorIndex }, null);
+  assert.equal(second.calls(), 0, "时钟领先墙钟时，已审的对仍然不许重送");
+  store.close();
+});
+
+test("issue#536 review ⑤: a batch that throws does not take the rest of the run with it", async () => {
+  const { service, store, vectorIndex } = setup();
+  // 两对正交向量 ⇒ 两批。让**第一批**的 LLM 往返直接抛（不是返回错误：返回错误那条
+  // 通路本来就有失败返回，早被前面的用例覆盖了）。要验的是：adjudicateBatch 内部
+  // 任何未被兜住的异常，都只折损它自己那一批，后面的批次照跑、之前的汇总不丢。
+  // applyDecisions 把 service.update 的异常吞进 failures（decisions.js:532-540），
+  // 所以打桩 service 的方法测不到这条守卫，必须在 LLM 这一层抛。
+  const p1 = seedIdenticalPair(service, vectorIndex, [1, 0, 0], "甲");
+  const p2 = seedIdenticalPair(service, vectorIndex, [0, 1, 0], "乙");
+  for (const m of [p1.a, p1.b, p2.a, p2.b]) backdate(store, m.id, 48);
+  const { ctx, calls } = countingCtx((text) => {
+    const id = text.includes(p1.a.id) ? p1.a.id : p2.a.id;
+    const next = text.includes(p1.a.id) ? "甲 内容A（更新）" : "乙 内容A（更新）";
+    return JSON.stringify([{ action: "update", ids: [id], content: next, reason: "内容有误" }]);
+  });
+  const realStream = ctx.llm.stream;
+  let thrown = false;
+  ctx.llm.stream = async function* (options) {
+    if (!thrown && options.purpose === "sleep-conflict") {
+      thrown = true;
+      throw new Error("boom inside adjudicateBatch");
+    }
+    yield* realStream.call(this, options);
+  };
+  const config = baseConfig({ sleepConflictMaxPairs: 1, sleepConflictMaxPairsPerRun: 2, reflectionUpdateMaxPerRun: 2 });
+  const result = await runSleep(ctx, service, config, ctx.logger, { embedder, vectorIndex }, null);
+  assert.equal(thrown, true, "第一批确实抛了，否则这条用例什么也没验");
+  assert.equal(calls(), 1, "第一批抛错后第二批仍然要跑");
+  assert.notEqual(result.phases.conflicts.status, "failed", "只要有一批活下来，就不是整轮 failed");
+  // 抛的是第一批（哪个 pair 先送取决于排序，所以两条都问，只要求"恰好一条活下来"）：
+  // 断言落在结果上，不落在顺序上，免得排序一变这条用例就假红。
+  const landed = [p1.a, p2.a].filter((m) => service.getById(m.id).content.endsWith("（更新）"));
+  assert.equal(landed.length, 1, "第二批照常落地，且只落地一批");
+  assert.equal(result.phases.conflicts.batches, 2, "抛错的批次不吞掉轮次的形状");
+  store.close();
+});

package/test/standalone-api.test.js

@@ -1268,3 +1268,53 @@ test("GET /memory/provenance: 409 beats 503 — feature off is more specific tha
     close();
   }
 });
+
+// --- #524 方向 2：?sessionId=<sid> 列该会话的蒸馏窗口 -----------------------
+// 与宿主内 API 是同一份口径（共用 provenance-http.js），这里只钉两张皮的那条差
+// 异之外的部分真的走通了：一行一窗口、按 seq_start 排、truncated 说出来。
+test("GET /memory/provenance?sessionId= lists a session's distill windows", async () => {
+  const { base, auth, store, close } = await setup({ config: RECORDS_ON });
+  try {
+    const a = await saveMemory(base, auth, { type: "decision", title: "核心决策", content: "选定 SQLite", importance: 5 });
+    const b = await saveMemory(base, auth, { type: "decision", title: "备选", content: "JSON 文件", importance: 3 });
+    const idA = a.memory?.id ?? a.id;
+    const idB = b.memory?.id ?? b.id;
+    // 同一窗口派生两条记忆：答复里必须并成一行（link_count=2），不是两行。
+    store.saveMemoryProvenance({ memoryId: idA, sessionId: "s1", seqStart: 10, seqEnd: 12, createdAt: "t2" });
+    store.saveMemoryProvenance({ memoryId: idB, sessionId: "s1", seqStart: 10, seqEnd: 12, createdAt: "t2" });
+    store.saveMemoryProvenance({ memoryId: idA, sessionId: "s1", seqStart: 1, seqEnd: 3, createdAt: "t1" });
+    store.saveMemoryProvenance({ memoryId: idA, sessionId: "s2", seqStart: 50, seqEnd: 51, createdAt: "t3" });
+
+    const res = await fetch(`${base}/memory/provenance?sessionId=s1`, { headers: auth });
+    assert.equal(res.status, 200);
+    const body = await res.json();
+    assert.equal(body.sessionId, "s1");
+    assert.equal(body.memoryId, undefined, "两个方向的认领键不许同时出现");
+    assert.equal(body.truncated, false);
+    assert.deepEqual(body.windows.map((w) => [w.seq_start, w.seq_end]), [[1, 3], [10, 12]],
+      "同一 (seq_start, seq_end) 并成一行，按 seq_start 升序；别的会话的窗口不出现");
+    assert.deepEqual(body.windows.map((w) => w.link_count), [1, 2]);
+  } finally {
+    close();
+  }
+});
+
+test("GET /memory/provenance: both selectors at once is 400, and limit is bounded", async () => {
+  const { base, auth, close } = await setup({ config: RECORDS_ON });
+  try {
+    const both = await fetch(`${base}/memory/provenance?id=m1&sessionId=s1`, { headers: auth });
+    assert.equal(both.status, 400, "两个主键都给不许静默择一");
+    assert.equal((await both.json()).error, "ambiguous-id");
+
+    for (const bad of ["0", "-1", "1.5", "abc", "1e3", "101"]) {
+      const res = await fetch(`${base}/memory/provenance?sessionId=s1&limit=${bad}`, { headers: auth });
+      assert.equal(res.status, 400, `limit=${bad} 必须 400`);
+      assert.equal((await res.json()).error, "invalid-limit");
+    }
+
+    const missing = await fetch(`${base}/memory/provenance`, { headers: auth });
+    assert.equal(missing.status, 400, "两个主键都缺仍是 400 missing-id");
+  } finally {
+    close();
+  }
+});