dsh-memsys 0.2.0 → 0.2.1

package/src/runtime/modules.mjs

@@ -0,0 +1,20 @@
+/**
+ * Core gate facade. The single merge/persistence source is ui-config.mjs;
+ * this file must never re-implement it.
+ */
+export {
+  DEFAULT_MODULES,
+  MODULE_KEYS,
+  moduleEnabled,
+  readUiConfig,
+  resolveModules,
+  resolveModulesDetail,
+  writeUiConfig,
+} from './ui-config.mjs';
+
+import { resolveModulesDetail } from './ui-config.mjs';
+
+/** Resolve the effective gate set for one plugin instance. */
+export function modulesFor({ dataDir = null, config = null, logger = console } = {}) {
+  return resolveModulesDetail({ dataDir, profileConfig: config, logger }).modules;
+}

package/src/runtime/summary.mjs

@@ -1,105 +1,47 @@
 /**
  * Host side of the optional Web UI (sidebar panel + settings section).
  *
- * Everything here is read-only over SQLite plus one small JSON file holding the
- * `auto_inject` override written by the settings switch. Both routes enforce
- * loopback + same-origin before touching data; nothing here is model-facing.
+ * Read-only over SQLite, plus the module switches read through `ui-config.mjs`
+ * (the same source the host gates use). Both routes enforce loopback +
+ * same-origin before touching data; nothing here is model-facing.
  */
-import fs from 'node:fs';
-import path from 'node:path';
+import {
+  DEFAULT_MODULES,
+  MODULE_KEYS,
+  readUiConfig,
+  resolveModulesDetail,
+  writeUiConfig,
+} from './ui-config.mjs';
 
-const UI_CONFIG_FILE = 'ui-config.json';
-const UI_CONFIG_VERSION = 1;
 const RECENT_LIMIT = 5;
 const TEXT_LIMIT = 80;
 const BODY_LIMIT = 4096;
 
-const warn = (logger, message) => {
-  try {
-    logger?.warn?.(`[dsh-memsys] ${message}`);
-  } catch {
-    // a logger that throws must never break boot
-  }
-};
-
-/**
- * Read the settings file written by the Web switch.
- * Returns `{ auto_inject }` or `null` when absent. A corrupt or foreign-version
- * file is ignored with one warning: a bad file must never stop the plugin.
- */
-export function readUiConfig(dataDir, logger = console) {
-  if (!dataDir) return null;
-  const file = path.join(dataDir, UI_CONFIG_FILE);
-  let raw = null;
-  try {
-    if (!fs.existsSync(file)) return null;
-    raw = fs.readFileSync(file, 'utf8');
-  } catch (err) {
-    warn(logger, `ui-config 读取失败（${err?.message ?? err}），回落 profile 配置`);
-    return null;
-  }
-  let parsed = null;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    warn(logger, 'ui-config 不是合法 JSON，回落 profile 配置');
-    return null;
-  }
-  if (parsed?.version !== UI_CONFIG_VERSION) {
-    warn(logger, `ui-config 版本不符（${parsed?.version ?? 'none'}，期望 ${UI_CONFIG_VERSION}），已忽略`);
-    return null;
-  }
-  if (typeof parsed?.auto_inject !== 'boolean') {
-    warn(logger, 'ui-config 缺少 auto_inject 布尔值，已忽略');
-    return null;
-  }
-  return { auto_inject: parsed.auto_inject };
-}
-
-/**
- * Priority: ui-config.json (when present and valid) > profile patch value > false.
- * The reported `source` is what the Web page shows next to the switch.
- */
-export function resolveAutoInject({ dataDir = null, profileValue = undefined, logger = console } = {}) {
-  const stored = readUiConfig(dataDir, logger);
-  if (stored !== null) return { value: stored.auto_inject, source: 'ui-config' };
-  if (typeof profileValue === 'boolean') return { value: profileValue, source: 'profile' };
-  return { value: false, source: 'default' };
-}
-
-/** Write-through with a temp file so a crash never leaves half a config. */
-export function writeUiConfig(dataDir, autoInject) {
-  if (!dataDir) return false;
-  fs.mkdirSync(dataDir, { recursive: true });
-  const target = path.join(dataDir, UI_CONFIG_FILE);
-  const temp = `${target}.tmp`;
-  fs.writeFileSync(
-    temp,
-    JSON.stringify({ version: UI_CONFIG_VERSION, auto_inject: autoInject === true }, null, 2),
-    'utf8',
-  );
-  fs.renameSync(temp, target);
-  return true;
-}
-
 const truncate = (text) => Array.from(String(text ?? '')).slice(0, TEXT_LIMIT).join('');
 
-/** Three counts plus the five latest memories; `candidates` means still-open ones. */
-export function buildSummary(main, { dataDir = null, autoInject = false, autoInjectSource = 'default' } = {}) {
+/** Three counts, the five latest memories, and the effective module map. */
+export function buildSummary(
+  main,
+  { dataDir = null, modules = DEFAULT_MODULES, modulesSource = 'default', autoInject = undefined } = {},
+) {
   const db = typeof main === 'function' ? main() : main;
   const one = (sql, ...params) => Number(db.prepare(sql).get(...params)?.n ?? 0);
   const recent = db
     .prepare('SELECT id, text FROM memories ORDER BY recorded_at DESC, id DESC LIMIT ?')
     .all(RECENT_LIMIT)
     .map((row) => ({ id: row.id, text: truncate(row.text) }));
+  const effective = {};
+  for (const key of MODULE_KEYS) effective[key] = modules?.[key] !== false;
   return {
     memories: one('SELECT COUNT(*) AS n FROM memories'),
     candidates: one("SELECT COUNT(*) AS n FROM candidates WHERE status IN ('pending', 'conflicted')"),
     pending_due: one("SELECT COUNT(*) AS n FROM memories WHERE due_state = 'pending-due'"),
     recent,
     data_dir: dataDir,
-    auto_inject: autoInject === true,
-    auto_inject_source: autoInjectSource,
+    auto_inject: autoInject === undefined ? effective.context : autoInject === true,
+    auto_inject_source: modulesSource,
+    modules: effective,
+    modules_source: modulesSource,
   };
 }
 
@@ -128,8 +70,8 @@ export function sameOrigin(req) {
 export function createSummaryHandler({
   main,
   dataDir = null,
-  getAutoInject = () => false,
-  onAutoInject = null,
+  getConfig = () => ({ modules: DEFAULT_MODULES, source: 'default' }),
+  onConfig = null,
 } = {}) {
   const send = (res, status, payload) => {
     res.statusCode = status;
@@ -138,6 +80,16 @@ export function createSummaryHandler({
     res.end(JSON.stringify(payload));
   };
 
+  const snapshot = () => {
+    const current = getConfig() ?? {};
+    const modules = current.modules ?? DEFAULT_MODULES;
+    return {
+      modules,
+      source: current.source ?? 'default',
+      auto_inject: modules?.context !== false,
+    };
+  };
+
   return (req, res) => {
     if (!isLoopback(req) || !sameOrigin(req)) {
       send(res, 403, { error: 'forbidden' });
@@ -168,13 +120,31 @@ export function createSummaryHandler({
           send(res, 400, { error: 'invalid_json' });
           return;
         }
-        if (typeof parsed?.auto_inject !== 'boolean') {
-          send(res, 400, { error: 'auto_inject_required' });
+        const wantsModules = parsed?.modules && typeof parsed.modules === 'object';
+        const wantsAutoInject = typeof parsed?.auto_inject === 'boolean';
+        if (!wantsModules && !wantsAutoInject) {
+          send(res, 400, { error: 'config_required' });
           return;
         }
+        if (wantsModules) {
+          const bad = Object.keys(parsed.modules).filter(
+            (key) => MODULE_KEYS.includes(key) && typeof parsed.modules[key] !== 'boolean',
+          );
+          if (bad.length > 0) {
+            send(res, 400, { error: 'module_value_not_boolean', keys: bad });
+            return;
+          }
+        }
         try {
-          onAutoInject?.(parsed.auto_inject);
-          send(res, 200, { ok: true, auto_inject: parsed.auto_inject, auto_inject_source: 'ui-config' });
+          const written = onConfig?.({ ...parsed }) ?? null;
+          const next = written ?? snapshot();
+          send(res, 200, {
+            ok: true,
+            auto_inject: next.auto_inject,
+            auto_inject_source: 'ui-config',
+            modules: next.modules,
+            modules_source: 'ui-config',
+          });
         } catch (err) {
           send(res, 500, { error: 'write_failed', message: String(err?.message ?? err) });
         }
@@ -186,12 +156,21 @@ export function createSummaryHandler({
       return;
     }
     try {
-      const current = getAutoInject();
-      const value = typeof current === 'boolean' ? current : current?.value === true;
-      const source = typeof current === 'boolean' ? 'ui-config' : (current?.source ?? 'default');
-      send(res, 200, buildSummary(main, { dataDir, autoInject: value, autoInjectSource: source }));
+      const state = snapshot();
+      send(
+        res,
+        200,
+        buildSummary(main, {
+          dataDir,
+          modules: state.modules,
+          modulesSource: state.source,
+          autoInject: state.auto_inject,
+        }),
+      );
     } catch (err) {
       send(res, 503, { error: 'summary_unavailable', message: String(err?.code ?? err?.message ?? err) });
     }
   };
 }
+
+export { readUiConfig, resolveModulesDetail, writeUiConfig };

package/src/runtime/tools.mjs

@@ -246,8 +246,22 @@ function textRender(value) {
 }
 
 /** Plain tool objects before the host wraps them with defineTool. */
-export function toolDefinitions(handlers = {}) {
-  return MEMSYS_TOOLS.map((name) => {
+export function enabledToolNames(modules = null) {
+  const enabled = modules ?? { context: true, read: true, write: true, dream: true, projects: true, due: true, feed: true };
+  return MEMSYS_TOOLS.filter((name) => {
+    if (['memsys_get', 'memsys_search', 'memsys_review_get', 'memsys_context_get', 'memsys_self_get'].includes(name)) {
+      return enabled.read !== false;
+    }
+    if (name === 'memsys_project_get') return enabled.read !== false && enabled.projects !== false;
+    if (['memsys_dream_record', 'memsys_organize'].includes(name)) return enabled.dream !== false;
+    if (name === 'memsys_feed') return enabled.feed !== false;
+    if (name === 'memsys_record') return true; // registered but call-gated for an explicit module_disabled
+    return true;
+  });
+}
+
+export function toolDefinitions(handlers = {}, modules = null) {
+  return enabledToolNames(modules).map((name) => {
     const spec = TOOL_SPECS[name];
     return {
       name,
@@ -255,6 +269,9 @@ export function toolDefinitions(handlers = {}) {
       parameters: spec.parameters,
       outputSchema: TOOL_OUTPUT_SCHEMAS[name] ?? openObject(),
       async execute(args, exec) {
+        if (name === 'memsys_record' && modules?.write === false) {
+          return { status: 'error', code: 'module_disabled', module: 'write' };
+        }
         const handler = handlers[name];
         if (typeof handler !== 'function') {
           return { status: 'error', code: 'handler_unavailable', tool: name };
@@ -292,7 +309,7 @@ export function toolCapabilityStatus(liveReport = null) {
  * Register against a host ctx. No ctx.tools -> tools-only, no throw.
  * `defineTool` is resolved dynamically so offline tests never need the host package.
  */
-export async function registerHostTools({ ctx = null, handlers = {}, defineTool: injectedDefineTool = null } = {}) {
+export async function registerHostTools({ ctx = null, handlers = {}, modules = null, defineTool: injectedDefineTool = null } = {}) {
   if (!ctx || !ctx.tools || typeof ctx.tools.register !== 'function') {
     return { status: 'tools_only', registered: [], reason: 'no_tools_service', defineTool: null, tools: [...MEMSYS_TOOLS] };
   }
@@ -313,7 +330,7 @@ export async function registerHostTools({ ctx = null, handlers = {}, defineTool:
   }
   const registered = [];
   const errors = [];
-  for (const spec of toolDefinitions(handlers)) {
+  for (const spec of toolDefinitions(handlers, modules)) {
     try {
       const tool = defineTool({
         name: spec.name,

package/src/runtime/ui-config.mjs

@@ -0,0 +1,176 @@
+/**
+ * The single source of truth for module switches.
+ *
+ * Both halves read this file: the Web data route (`src/runtime/summary.mjs`) and
+ * the host-side gates (`src/runtime/modules.mjs` re-exports from here). Nothing
+ * else may re-implement the merge — a second copy is how the switch becomes a
+ * lie.
+ *
+ * Priority: `<data_dir>/ui-config.json` > profile patch config > default (true).
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const UI_CONFIG_FILE = 'ui-config.json';
+export const UI_CONFIG_VERSION = 2;
+export const MODULE_KEYS = Object.freeze(['context', 'read', 'write', 'dream', 'projects', 'due', 'feed']);
+export const DEFAULT_MODULES = Object.freeze({
+  context: true,
+  read: true,
+  write: true,
+  dream: true,
+  projects: true,
+  due: true,
+  feed: true,
+});
+
+const warn = (logger, message) => {
+  try {
+    logger?.warn?.(`[dsh-memsys] ${message}`);
+  } catch {
+    // a logger that throws must never break boot
+  }
+};
+
+/** Missing keys mean `true`; only an explicit `false` disables a module. */
+export function normalizeModules(input = {}) {
+  const modules = { ...DEFAULT_MODULES };
+  if (input && typeof input === 'object') {
+    for (const key of MODULE_KEYS) {
+      if (typeof input[key] === 'boolean') modules[key] = input[key];
+    }
+  }
+  return modules;
+}
+
+/**
+ * v2 is `{ version: 2, auto_inject, modules }`.
+ * v1 (or versionless) files only carry `auto_inject`; they migrate by mapping it
+ * onto `modules.context` while every other module stays on.
+ */
+export function normalizeUiConfig(parsed, logger = console) {
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;
+  const version = parsed.version;
+  const known = version === undefined || version === 1 || version === UI_CONFIG_VERSION;
+  if (!known) {
+    warn(logger, `ui-config 版本不认识（${version}），已忽略`);
+    return null;
+  }
+  const hasModules = parsed.modules && typeof parsed.modules === 'object';
+  if (version === undefined && typeof parsed.auto_inject !== 'boolean' && !hasModules) {
+    warn(logger, 'ui-config 既无 auto_inject 也无 modules，已忽略');
+    return null;
+  }
+  const modules = normalizeModules(hasModules ? parsed.modules : {});
+  if (!hasModules && typeof parsed.auto_inject === 'boolean') modules.context = parsed.auto_inject;
+  return {
+    version: UI_CONFIG_VERSION,
+    auto_inject: modules.context,
+    modules,
+  };
+}
+
+export function readUiConfig(dataDir, logger = console) {
+  if (!dataDir) return null;
+  const file = path.join(dataDir, UI_CONFIG_FILE);
+  let raw = null;
+  try {
+    if (!fs.existsSync(file)) return null;
+    raw = fs.readFileSync(file, 'utf8');
+  } catch (err) {
+    warn(logger, `ui-config 读取失败（${err?.message ?? err}），回落 profile 配置`);
+    return null;
+  }
+  try {
+    return normalizeUiConfig(JSON.parse(raw), logger);
+  } catch {
+    warn(logger, 'ui-config 不是合法 JSON，回落 profile 配置');
+    return null;
+  }
+}
+
+/**
+ * Pure merge used by every caller: defaults <- profile config <- ui-config.
+ * A legacy `auto_inject` fills `modules.context` only when that source says
+ * nothing about `modules` at all.
+ */
+export function mergeModules(profileConfig = null, uiConfig = null) {
+  const base = { ...DEFAULT_MODULES };
+  const apply = (source) => {
+    if (!source || typeof source !== 'object') return;
+    const modules = source.modules;
+    if (modules && typeof modules === 'object') {
+      for (const key of MODULE_KEYS) {
+        if (typeof modules[key] === 'boolean') base[key] = modules[key];
+      }
+    }
+    if (typeof source.auto_inject === 'boolean' && modules?.context === undefined) {
+      base.context = source.auto_inject;
+    }
+  };
+  apply(profileConfig);
+  apply(uiConfig);
+  return base;
+}
+
+/** Kept under the name the host gates already import. */
+export function resolveModules(profileConfig = null, uiConfig = null) {
+  return Object.freeze(mergeModules(profileConfig, uiConfig));
+}
+
+export function moduleEnabled(modules, key) {
+  return (modules ?? DEFAULT_MODULES)[key] !== false;
+}
+
+const profileSaysSomething = (profileConfig) =>
+  Boolean(
+    profileConfig &&
+      (profileConfig.modules && typeof profileConfig.modules === 'object'
+        ? MODULE_KEYS.some((key) => typeof profileConfig.modules[key] === 'boolean')
+        : typeof profileConfig.auto_inject === 'boolean'),
+  );
+
+/**
+ * Resolve for the Web route: returns the effective map plus which rank won,
+ * so the settings page can show where the value came from.
+ */
+export function resolveModulesDetail({ dataDir = null, profileConfig = null, logger = console } = {}) {
+  const stored = readUiConfig(dataDir, logger);
+  const modules = mergeModules(profileConfig, stored);
+  const source = stored ? 'ui-config' : profileSaysSomething(profileConfig) ? 'profile' : 'default';
+  return { modules, source, auto_inject: modules.context };
+}
+
+/**
+ * Partial update: sends only the keys it owns. A legacy `auto_inject` maps onto
+ * `modules.context`; sending `modules.context` mirrors back into `auto_inject`
+ * so v1 readers keep working.
+ */
+export function writeUiConfig(dataDir, patch = {}, logger = console) {
+  if (!dataDir) return null;
+  const current = readUiConfig(dataDir, logger) ?? {
+    version: UI_CONFIG_VERSION,
+    auto_inject: DEFAULT_MODULES.context,
+    modules: { ...DEFAULT_MODULES },
+  };
+  const next = { ...current.modules };
+  if (patch.modules && typeof patch.modules === 'object') {
+    for (const key of MODULE_KEYS) {
+      if (typeof patch.modules[key] === 'boolean') next[key] = patch.modules[key];
+    }
+  }
+  if (typeof patch.auto_inject === 'boolean' && patch.modules?.context === undefined) {
+    next.context = patch.auto_inject;
+  }
+  const normalized = {
+    version: UI_CONFIG_VERSION,
+    auto_inject: next.context,
+    modules: next,
+  };
+  fs.mkdirSync(dataDir, { recursive: true });
+  const target = path.join(dataDir, UI_CONFIG_FILE);
+  const temp = `${target}.tmp`;
+  fs.writeFileSync(temp, JSON.stringify(normalized, null, 2), 'utf8');
+  fs.renameSync(temp, target);
+  return normalized;
+}

package/test/p4-p4-delivery.test.mjs

@@ -76,7 +76,13 @@ test('P4/P4-B E10: receipts must match the persistent manifest and groups', (t)
     receivedIds: expected,
     payloadHash,
   });
-  assert.equal(full.delivery, 'confirmed', JSON.stringify(full));
+  if (compiled.manifest.actual_ids.filter((id) => id.startsWith('mem_')).length === 0) {
+    // Design §6.2c: an empty actual set can never be confirmed, even if the receipt equals it.
+    assert.equal(full.delivery, 'incomplete', JSON.stringify(full));
+    assert.equal(full.code, 'receipt_incomplete');
+  } else {
+    assert.equal(full.delivery, 'confirmed', JSON.stringify(full));
+  }
   const exposure = ctx.main.prepare('SELECT memory_id FROM injections').all().map((row) => row.memory_id);
   assert.equal(exposure.length, 0, 'deferred members must not produce exposure');
 });

package/test/p6-c1c4.test.mjs

@@ -0,0 +1,69 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { recordDelivery } from '../src/context/delivery.mjs';
+import { getMemories } from '../src/read/get.mjs';
+import {
+  insertCandidate, insertEvidence, insertMemory, insertObservation, insertPointer, insertTimeline,
+} from '../src/storage/repositories.mjs';
+import { createTestContext, makeCandidate, makeMemory, makeObservation, mutableClock } from './helpers/fixtures.mjs';
+
+function deliveryFixture(ctx, { actualIds, expectedIds, receivedIds, hash = 'h' }) {
+  const roundId = 'r-c1';
+  const snapshotId = 'snap-c1';
+  ctx.control
+    .prepare("INSERT OR REPLACE INTO compilations (id, round_id, stream_key, source_revision, policy_revision, delivery_level, payload_hash, section_text, created_at) VALUES (?, ?, 'stream', 0, '1', 'grouped', ?, '', ?)")
+    .run(`comp:${snapshotId}`, roundId, hash, ctx.clock.at().at);
+  ctx.control
+    .prepare("INSERT OR REPLACE INTO context_snapshots (id, compilation_id, round_id, mode, source_revision, policy_revision, delivery_level, eligible_ids, expected_ids, deferred_groups, created_at, expires_at, manifest_json) VALUES (?, ?, ?, 'work', 0, '1', 'grouped', '[]', ?, '[]', ?, ?, ?)")
+    .run(snapshotId, `comp:${snapshotId}`, roundId, JSON.stringify(expectedIds), ctx.clock.at().at, ctx.clock.at().at, JSON.stringify({ expected_ids: expectedIds, actual_ids: actualIds, hashes: { payload: hash } }));
+  return recordDelivery({ main: ctx.main, control: ctx.control, clock: ctx.clock, roundId, snapshotId, receivedIds, payloadHash: hash, manifestHash: 'm', slots: {} });
+}
+
+test('P6/C1: group-only receipt with empty actual set is incomplete', (t) => {
+  const ctx = createTestContext({ clock: mutableClock().clock });
+  t.after(() => ctx.cleanup());
+  const result = deliveryFixture(ctx, { actualIds: [], expectedIds: ['group:g1'], receivedIds: ['group:g1'] });
+  assert.equal(result.delivery, 'incomplete');
+  assert.equal(result.code, 'receipt_incomplete');
+  assert.notEqual(result.delivery, 'confirmed');
+});
+
+test('P6/C1: non-empty actual set missing one memory is incomplete', (t) => {
+  const ctx = createTestContext({ clock: mutableClock().clock });
+  t.after(() => ctx.cleanup());
+  const result = deliveryFixture(ctx, { actualIds: ['mem_a', 'mem_b'], expectedIds: ['mem_a', 'mem_b', 'group:g1'], receivedIds: ['mem_a', 'group:g1'] });
+  assert.equal(result.delivery, 'incomplete');
+  assert.equal(result.code, 'receipt_incomplete');
+  assert.deepEqual(result.missing_ids, ['mem_b']);
+});
+
+test('P6/C4: evidence text pages reassemble byte-for-byte', (t) => {
+  const ctx = createTestContext({ clock: mutableClock().clock });
+  t.after(() => ctx.cleanup());
+  const original = '证据原文'.repeat(600);
+  const observation = makeObservation(ctx, { messageSeq: 30000, text: original });
+  insertObservation(ctx.main, observation);
+  const candidate = makeCandidate(ctx, observation, { businessKey: 'c4', text: '短摘要', why: 'w', type: 'fact', scene: 'work', scope: 'work-only' });
+  insertCandidate(ctx.main, candidate);
+  const memory = makeMemory(ctx, candidate);
+  insertMemory(ctx.main, memory);
+  insertTimeline(ctx.main, { memory_id: memory.id, start_at: null, end_at: null, prec_start: 'unknown', prec_end: 'unknown', time_state: 'point', revision: 1 });
+  insertPointer(ctx.main, { memory_id: memory.id, status: 'unknown', location: null, search_hint: null, lossy: 0, revision: 1 });
+  insertEvidence(ctx.main, { id: 'ev_c4', memory_id: memory.id, candidate_id: null, observation_id: observation.id, source_memory_id: null, role: 'basis', source_span: 'bytes:0:4', at: ctx.clock.at().at });
+
+  let cursor = null;
+  let joined = '';
+  for (let page = 0; page < 20; page += 1) {
+    const result = getMemories({ main: ctx.main, clock: ctx.clock, ids: [memory.id], includeEvidence: true, maxChars: 1000, cursor });
+    assert.equal(result.status, 'ok', JSON.stringify(result));
+    for (const item of result.items) {
+      for (const evidence of item.evidence ?? []) {
+        if (typeof evidence.observation_text === 'string') joined += evidence.observation_text;
+      }
+    }
+    cursor = result.next_cursor;
+    if (!cursor) break;
+  }
+  assert.equal(joined, original);
+});

package/test/p6-c3-append.test.mjs

@@ -0,0 +1,85 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { compileRound } from '../src/context/compile.mjs';
+import { conservativeTokens } from '../src/context/budget.mjs';
+import { getGroupPage } from '../src/context/snapshots.mjs';
+import { ingestInput } from '../src/write/observe.mjs';
+import { promoteCandidate, recordCandidates } from '../src/write/candidate.mjs';
+import { createTestContext, mutableClock } from './helpers/fixtures.mjs';
+import { fakeRuntime } from './helpers/runtime.mjs';
+
+let seq = 0;
+function addMemory(ctx, text) {
+  seq += 1;
+  const runtime = fakeRuntime({ role: 'daily', identity: 'c3a', callId: 'c3a-' + seq, messageSeq: 31000 + seq });
+  const observation = ingestInput(runtime, { text: 'C3-' + seq, messageSeq: 31000 + seq }, { main: ctx.main, control: ctx.control, clock: ctx.clock });
+  const created = recordCandidates(runtime, {
+    items: [{
+      observationId: observation.observation.id,
+      text,
+      why: 'w', type: 'fact', scene: 'work', scope: 'work-only',
+      evidenceRefs: [{ observationId: observation.observation.id, sourceSpan: 'bytes:0:3' }],
+    }],
+  }, { main: ctx.main, control: ctx.control, clock: ctx.clock });
+  promoteCandidate(runtime, created.items[0].id, null, { main: ctx.main, control: ctx.control, clock: ctx.clock });
+}
+
+function make(ctx) {
+  for (let i = 0; i < 12; i += 1) addMemory(ctx, 'C3混版-' + i + '-' + 'x'.repeat(500));
+}
+
+function compile(ctx, roundId) {
+  return compileRound({ main: ctx.main, control: ctx.control, clock: ctx.clock, sessionId: 's-c3a', roundId, mode: 'work', tokenizer: conservativeTokens, H: 300 });
+}
+
+function page(ctx, snapshotRevision, groupId, cursor = null) {
+  return getGroupPage({ control: ctx.control, main: ctx.main, clock: ctx.clock, snapshotRevision, groupId, cursor, maxChars: 1000 });
+}
+
+test('P6/C3: old cursor is stale after an append through the promote path', (t) => {
+  const ctx = createTestContext({ clock: mutableClock().clock });
+  t.after(() => ctx.cleanup());
+  make(ctx);
+  const first = compile(ctx, 'r-c3a');
+  assert.equal(first.delivery_level, 'grouped', JSON.stringify(first.delivery_level));
+  const groupId = first.groups[0].group_id;
+  const firstPage = page(ctx, first.snapshot_revision, groupId);
+  assert.equal(firstPage.status, 'ok', JSON.stringify(firstPage));
+  assert.ok(firstPage.next_cursor);
+  addMemory(ctx, '追加混版-' + 'y'.repeat(500));
+  const stale = page(ctx, first.snapshot_revision, groupId, firstPage.next_cursor);
+  assert.equal(stale.status, 'error', JSON.stringify(stale));
+  assert.equal(stale.code, 'stale_cursor');
+});
+
+test('P6/C3: same data recompiles to same id; append changes it', (t) => {
+  const ctx = createTestContext({ clock: mutableClock().clock });
+  t.after(() => ctx.cleanup());
+  make(ctx);
+  const a = compile(ctx, 'r-c3b1');
+  const b = compile(ctx, 'r-c3b2');
+  assert.equal(a.snapshot_revision, b.snapshot_revision);
+  addMemory(ctx, '追加换ID-' + 'z'.repeat(500));
+  const c = compile(ctx, 'r-c3b3');
+  assert.notEqual(c.snapshot_revision, a.snapshot_revision);
+});
+
+test('P6/C3: clean paging reaches the end without stale_cursor', (t) => {
+  const ctx = createTestContext({ clock: mutableClock().clock });
+  t.after(() => ctx.cleanup());
+  make(ctx);
+  const compiled = compile(ctx, 'r-c3c');
+  const groupId = compiled.groups[0].group_id;
+  let cursor = null;
+  let pages = 0;
+  for (;;) {
+    const result = page(ctx, compiled.snapshot_revision, groupId, cursor);
+    assert.equal(result.status, 'ok', JSON.stringify(result));
+    pages += 1;
+    cursor = result.next_cursor;
+    if (!cursor) break;
+    assert.ok(pages < 100);
+  }
+  assert.ok(pages >= 1);
+});