dsh-memsys 0.2.0 → 0.2.2

package/src/runtime/inject-round.mjs

@@ -0,0 +1,138 @@
+import { resolveConfig } from '../config.mjs';
+import { openAll } from '../storage/open.mjs';
+import { migrateAll } from '../storage/migrate.mjs';
+import { systemClock } from '../clock.mjs';
+import { withImmediate } from '../storage/open.mjs';
+
+const TOOLS_ONLY_TEXT = '[memsys] 注入：tools-only（未取得宿主预算与回执，不作逐轮交付承诺）';
+
+function sessionIdOf(turn) {
+  return turn?.session?.header?.id ?? turn?.sessionId ?? turn?.session?.id ?? null;
+}
+
+/**
+ * Runtime bridge between session turn events and the compile pipeline.
+ * Subscription is owned here (not the section), so a new turn refreshes text
+ * before the next prompt section read; no reply receipt means delivery=unknown.
+ */
+export function createRoundInjector({
+  ctx = null,
+  dataDir,
+  modules = null,
+  compileRound,
+  tokenizer = null,
+  H = null,
+  mode = 'work',
+  clock = systemClock,
+  logger = console,
+  handles = null,
+} = {}) {
+  const ownedHandles = !handles;
+  const stores = handles ?? openAll(resolveConfig({ dataDir }));
+  if (ownedHandles) migrateAll(stores, { clock });
+  let state = {
+    text: '',
+    delivery: 'unknown',
+    delivery_level: 'empty',
+    manifest: null,
+    sessionId: null,
+    roundId: null,
+    refreshed_at: null,
+  };
+  let counter = 0;
+  let disposed = false;
+
+  const disabled = modules?.context === false;
+
+  function recordInjections(roundId, manifest) {
+    const ids = manifest?.eligible_ids ?? [];
+    if (!ids.length) return;
+    const at = clock.at().at;
+    withImmediate(stores.main, () => {
+      for (const memoryId of ids) {
+        stores.main
+          .prepare('INSERT OR IGNORE INTO injections (round_id, memory_id, slots, topic_hits, manifest_hash, receipt_id, at) VALUES (?, ?, ?, 0, ?, NULL, ?)')
+          .run(roundId, memoryId, JSON.stringify(['context']), manifest?.manifest_hash ?? null, at);
+      }
+    });
+  }
+
+  function refresh(turn = {}) {
+    if (disposed) return state;
+    if (disabled) {
+      state = { text: '', delivery: 'unknown', delivery_level: 'disabled', manifest: null, sessionId: sessionIdOf(turn), roundId: null, refreshed_at: clock.at().at };
+      return state;
+    }
+    const sessionId = sessionIdOf(turn) ?? state.sessionId;
+    counter += 1;
+    const roundId = turn?.id ?? turn?.roundId ?? `turn-${counter}`;
+    let result;
+    try {
+      result = compileRound({
+        main: stores.main,
+        control: stores.control,
+        clock,
+        sessionId: sessionId ?? 'unknown-session',
+        roundId,
+        mode,
+        tokenizer,
+        H,
+        modules,
+      });
+    } catch (err) {
+      logger?.warn?.('[dsh-memsys] compile failed: ' + err.message);
+      result = null;
+    }
+    if (!result || result.delivery_level === 'unavailable') {
+      state = {
+        text: TOOLS_ONLY_TEXT,
+        delivery: 'unknown',
+        delivery_level: 'unavailable',
+        manifest: result?.manifest ?? null,
+        sessionId,
+        roundId,
+        refreshed_at: clock.at().at,
+      };
+      return state;
+    }
+    const text = result.section?.text ?? result.sectionText ?? '';
+    state = {
+      text,
+      delivery: 'unknown',
+      delivery_level: result.delivery_level,
+      manifest: result.manifest ?? null,
+      sessionId,
+      roundId,
+      refreshed_at: clock.at().at,
+    };
+    recordInjections(roundId, state.manifest);
+    return state;
+  }
+
+  function onSessionEvent(payload) {
+    const event = payload?.event ?? payload;
+    const type = event?.type ?? event?.name ?? event?.kind ?? null;
+    if (type !== 'turn/start') return;
+    refresh(payload?.turn ?? event?.turn ?? payload ?? {});
+  }
+
+  if (!disabled && typeof ctx?.on === 'function') {
+    ctx.on('session/event', onSessionEvent);
+    ctx.on('turn/start', (payload) => refresh(payload ?? {}));
+  }
+
+  return {
+    refresh,
+    current: () => state,
+    dispose() {
+      disposed = true;
+      try {
+        if (typeof ctx?.off === 'function') {
+          ctx.off('session/event', onSessionEvent);
+        }
+      } catch {
+        // disposal must not throw
+      }
+    },
+  };
+}

package/src/runtime/inject.mjs

@@ -7,8 +7,11 @@ export const SECTION_ORDER = 500;
  * The only verified injection call shape (probe-p0):
  *   ctx.inject(['systemPrompt'], c => c.systemPrompt.section({name, order, text}))
  * Static `export const inject` would leave the plugin pending forever.
+ *
+ * `dynamicText: true` registers the resolver itself so the host re-reads it per
+ * assembly; the default keeps the historical one-shot string.
  */
-export function registerSection(ctx, { getText, diagnosticMarker = null } = {}) {
+export function registerSection(ctx, { getText, diagnosticMarker = null, dynamicText = false } = {}) {
   if (!ctx || typeof ctx.inject !== 'function') {
     const err = new Error('invalid_ctx');
     err.code = 'invalid_ctx';
@@ -20,7 +23,12 @@ export function registerSection(ctx, { getText, diagnosticMarker = null } = {})
       err.code = 'system_prompt_unavailable';
       throw err;
     }
-    const text = typeof getText === 'function' ? getText() : String(getText ?? '');
+    const resolve = () => (typeof getText === 'function' ? getText() : String(getText ?? ''));
+    // Dynamic text stays a function: the host re-evaluates it on every
+    // `systemPrompt.assemble()`, i.e. once per model step (verified on a probe
+    // profile: two assemblies produced probe-1 then probe-2). A static string
+    // would freeze the first round forever.
+    const text = dynamicText ? resolve : resolve();
     c.systemPrompt.section({ name: SECTION_NAME, order: SECTION_ORDER, text });
     if (diagnosticMarker) {
       fs.writeFileSync(
@@ -29,7 +37,8 @@ export function registerSection(ctx, { getText, diagnosticMarker = null } = {})
           {
             name: SECTION_NAME,
             order: SECTION_ORDER,
-            text_length: String(text).length,
+            text_length: String(resolve()).length,
+            dynamic: dynamicText === true,
             registered_at: new Date().toISOString(),
           },
           null,

package/src/runtime/modules.mjs

@@ -0,0 +1,20 @@
+/**
+ * Core gate facade. The single merge/persistence source is ui-config.mjs;
+ * this file must never re-implement it.
+ */
+export {
+  DEFAULT_MODULES,
+  MODULE_KEYS,
+  moduleEnabled,
+  readUiConfig,
+  resolveModules,
+  resolveModulesDetail,
+  writeUiConfig,
+} from './ui-config.mjs';
+
+import { resolveModulesDetail } from './ui-config.mjs';
+
+/** Resolve the effective gate set for one plugin instance. */
+export function modulesFor({ dataDir = null, config = null, logger = console } = {}) {
+  return resolveModulesDetail({ dataDir, profileConfig: config, logger }).modules;
+}

package/src/runtime/summary.mjs

@@ -1,105 +1,48 @@
 /**
  * Host side of the optional Web UI (sidebar panel + settings section).
  *
- * Everything here is read-only over SQLite plus one small JSON file holding the
- * `auto_inject` override written by the settings switch. Both routes enforce
- * loopback + same-origin before touching data; nothing here is model-facing.
+ * Read-only over SQLite, plus the module switches read through `ui-config.mjs`
+ * (the same source the host gates use). Both routes enforce loopback +
+ * same-origin before touching data; nothing here is model-facing.
  */
-import fs from 'node:fs';
-import path from 'node:path';
+import {
+  DEFAULT_MODULES,
+  MODULE_KEYS,
+  readUiConfig,
+  resolveModulesDetail,
+  writeUiConfig,
+} from './ui-config.mjs';
 
-const UI_CONFIG_FILE = 'ui-config.json';
-const UI_CONFIG_VERSION = 1;
 const RECENT_LIMIT = 5;
-const TEXT_LIMIT = 80;
+// 主人要求：卡片展示 120 字（按码点截断，预算保护仍在 host 侧）
+const TEXT_LIMIT = 120;
 const BODY_LIMIT = 4096;
 
-const warn = (logger, message) => {
-  try {
-    logger?.warn?.(`[dsh-memsys] ${message}`);
-  } catch {
-    // a logger that throws must never break boot
-  }
-};
-
-/**
- * Read the settings file written by the Web switch.
- * Returns `{ auto_inject }` or `null` when absent. A corrupt or foreign-version
- * file is ignored with one warning: a bad file must never stop the plugin.
- */
-export function readUiConfig(dataDir, logger = console) {
-  if (!dataDir) return null;
-  const file = path.join(dataDir, UI_CONFIG_FILE);
-  let raw = null;
-  try {
-    if (!fs.existsSync(file)) return null;
-    raw = fs.readFileSync(file, 'utf8');
-  } catch (err) {
-    warn(logger, `ui-config 读取失败（${err?.message ?? err}），回落 profile 配置`);
-    return null;
-  }
-  let parsed = null;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    warn(logger, 'ui-config 不是合法 JSON，回落 profile 配置');
-    return null;
-  }
-  if (parsed?.version !== UI_CONFIG_VERSION) {
-    warn(logger, `ui-config 版本不符（${parsed?.version ?? 'none'}，期望 ${UI_CONFIG_VERSION}），已忽略`);
-    return null;
-  }
-  if (typeof parsed?.auto_inject !== 'boolean') {
-    warn(logger, 'ui-config 缺少 auto_inject 布尔值，已忽略');
-    return null;
-  }
-  return { auto_inject: parsed.auto_inject };
-}
-
-/**
- * Priority: ui-config.json (when present and valid) > profile patch value > false.
- * The reported `source` is what the Web page shows next to the switch.
- */
-export function resolveAutoInject({ dataDir = null, profileValue = undefined, logger = console } = {}) {
-  const stored = readUiConfig(dataDir, logger);
-  if (stored !== null) return { value: stored.auto_inject, source: 'ui-config' };
-  if (typeof profileValue === 'boolean') return { value: profileValue, source: 'profile' };
-  return { value: false, source: 'default' };
-}
-
-/** Write-through with a temp file so a crash never leaves half a config. */
-export function writeUiConfig(dataDir, autoInject) {
-  if (!dataDir) return false;
-  fs.mkdirSync(dataDir, { recursive: true });
-  const target = path.join(dataDir, UI_CONFIG_FILE);
-  const temp = `${target}.tmp`;
-  fs.writeFileSync(
-    temp,
-    JSON.stringify({ version: UI_CONFIG_VERSION, auto_inject: autoInject === true }, null, 2),
-    'utf8',
-  );
-  fs.renameSync(temp, target);
-  return true;
-}
-
 const truncate = (text) => Array.from(String(text ?? '')).slice(0, TEXT_LIMIT).join('');
 
-/** Three counts plus the five latest memories; `candidates` means still-open ones. */
-export function buildSummary(main, { dataDir = null, autoInject = false, autoInjectSource = 'default' } = {}) {
+/** Three counts, the five latest memories, and the effective module map. */
+export function buildSummary(
+  main,
+  { dataDir = null, modules = DEFAULT_MODULES, modulesSource = 'default', autoInject = undefined } = {},
+) {
   const db = typeof main === 'function' ? main() : main;
   const one = (sql, ...params) => Number(db.prepare(sql).get(...params)?.n ?? 0);
   const recent = db
     .prepare('SELECT id, text FROM memories ORDER BY recorded_at DESC, id DESC LIMIT ?')
     .all(RECENT_LIMIT)
     .map((row) => ({ id: row.id, text: truncate(row.text) }));
+  const effective = {};
+  for (const key of MODULE_KEYS) effective[key] = modules?.[key] !== false;
   return {
     memories: one('SELECT COUNT(*) AS n FROM memories'),
     candidates: one("SELECT COUNT(*) AS n FROM candidates WHERE status IN ('pending', 'conflicted')"),
     pending_due: one("SELECT COUNT(*) AS n FROM memories WHERE due_state = 'pending-due'"),
     recent,
     data_dir: dataDir,
-    auto_inject: autoInject === true,
-    auto_inject_source: autoInjectSource,
+    auto_inject: autoInject === undefined ? effective.context : autoInject === true,
+    auto_inject_source: modulesSource,
+    modules: effective,
+    modules_source: modulesSource,
   };
 }
 
@@ -128,8 +71,8 @@ export function sameOrigin(req) {
 export function createSummaryHandler({
   main,
   dataDir = null,
-  getAutoInject = () => false,
-  onAutoInject = null,
+  getConfig = () => ({ modules: DEFAULT_MODULES, source: 'default' }),
+  onConfig = null,
 } = {}) {
   const send = (res, status, payload) => {
     res.statusCode = status;
@@ -138,6 +81,16 @@ export function createSummaryHandler({
     res.end(JSON.stringify(payload));
   };
 
+  const snapshot = () => {
+    const current = getConfig() ?? {};
+    const modules = current.modules ?? DEFAULT_MODULES;
+    return {
+      modules,
+      source: current.source ?? 'default',
+      auto_inject: modules?.context !== false,
+    };
+  };
+
   return (req, res) => {
     if (!isLoopback(req) || !sameOrigin(req)) {
       send(res, 403, { error: 'forbidden' });
@@ -168,13 +121,31 @@ export function createSummaryHandler({
           send(res, 400, { error: 'invalid_json' });
           return;
         }
-        if (typeof parsed?.auto_inject !== 'boolean') {
-          send(res, 400, { error: 'auto_inject_required' });
+        const wantsModules = parsed?.modules && typeof parsed.modules === 'object';
+        const wantsAutoInject = typeof parsed?.auto_inject === 'boolean';
+        if (!wantsModules && !wantsAutoInject) {
+          send(res, 400, { error: 'config_required' });
           return;
         }
+        if (wantsModules) {
+          const bad = Object.keys(parsed.modules).filter(
+            (key) => MODULE_KEYS.includes(key) && typeof parsed.modules[key] !== 'boolean',
+          );
+          if (bad.length > 0) {
+            send(res, 400, { error: 'module_value_not_boolean', keys: bad });
+            return;
+          }
+        }
         try {
-          onAutoInject?.(parsed.auto_inject);
-          send(res, 200, { ok: true, auto_inject: parsed.auto_inject, auto_inject_source: 'ui-config' });
+          const written = onConfig?.({ ...parsed }) ?? null;
+          const next = written ?? snapshot();
+          send(res, 200, {
+            ok: true,
+            auto_inject: next.auto_inject,
+            auto_inject_source: 'ui-config',
+            modules: next.modules,
+            modules_source: 'ui-config',
+          });
         } catch (err) {
           send(res, 500, { error: 'write_failed', message: String(err?.message ?? err) });
         }
@@ -186,12 +157,21 @@ export function createSummaryHandler({
       return;
     }
     try {
-      const current = getAutoInject();
-      const value = typeof current === 'boolean' ? current : current?.value === true;
-      const source = typeof current === 'boolean' ? 'ui-config' : (current?.source ?? 'default');
-      send(res, 200, buildSummary(main, { dataDir, autoInject: value, autoInjectSource: source }));
+      const state = snapshot();
+      send(
+        res,
+        200,
+        buildSummary(main, {
+          dataDir,
+          modules: state.modules,
+          modulesSource: state.source,
+          autoInject: state.auto_inject,
+        }),
+      );
     } catch (err) {
       send(res, 503, { error: 'summary_unavailable', message: String(err?.code ?? err?.message ?? err) });
     }
   };
 }
+
+export { readUiConfig, resolveModulesDetail, writeUiConfig };

package/src/runtime/tools.mjs

@@ -246,8 +246,22 @@ function textRender(value) {
 }
 
 /** Plain tool objects before the host wraps them with defineTool. */
-export function toolDefinitions(handlers = {}) {
-  return MEMSYS_TOOLS.map((name) => {
+export function enabledToolNames(modules = null) {
+  const enabled = modules ?? { context: true, read: true, write: true, dream: true, projects: true, due: true, feed: true };
+  return MEMSYS_TOOLS.filter((name) => {
+    if (['memsys_get', 'memsys_search', 'memsys_review_get', 'memsys_context_get', 'memsys_self_get'].includes(name)) {
+      return enabled.read !== false;
+    }
+    if (name === 'memsys_project_get') return enabled.read !== false && enabled.projects !== false;
+    if (['memsys_dream_record', 'memsys_organize'].includes(name)) return enabled.dream !== false;
+    if (name === 'memsys_feed') return enabled.feed !== false;
+    if (name === 'memsys_record') return true; // registered but call-gated for an explicit module_disabled
+    return true;
+  });
+}
+
+export function toolDefinitions(handlers = {}, modules = null) {
+  return enabledToolNames(modules).map((name) => {
     const spec = TOOL_SPECS[name];
     return {
       name,
@@ -255,6 +269,9 @@ export function toolDefinitions(handlers = {}) {
       parameters: spec.parameters,
       outputSchema: TOOL_OUTPUT_SCHEMAS[name] ?? openObject(),
       async execute(args, exec) {
+        if (name === 'memsys_record' && modules?.write === false) {
+          return { status: 'error', code: 'module_disabled', module: 'write' };
+        }
         const handler = handlers[name];
         if (typeof handler !== 'function') {
           return { status: 'error', code: 'handler_unavailable', tool: name };
@@ -292,7 +309,7 @@ export function toolCapabilityStatus(liveReport = null) {
  * Register against a host ctx. No ctx.tools -> tools-only, no throw.
  * `defineTool` is resolved dynamically so offline tests never need the host package.
  */
-export async function registerHostTools({ ctx = null, handlers = {}, defineTool: injectedDefineTool = null } = {}) {
+export async function registerHostTools({ ctx = null, handlers = {}, modules = null, defineTool: injectedDefineTool = null } = {}) {
   if (!ctx || !ctx.tools || typeof ctx.tools.register !== 'function') {
     return { status: 'tools_only', registered: [], reason: 'no_tools_service', defineTool: null, tools: [...MEMSYS_TOOLS] };
   }
@@ -313,7 +330,7 @@ export async function registerHostTools({ ctx = null, handlers = {}, defineTool:
   }
   const registered = [];
   const errors = [];
-  for (const spec of toolDefinitions(handlers)) {
+  for (const spec of toolDefinitions(handlers, modules)) {
     try {
       const tool = defineTool({
         name: spec.name,

package/src/runtime/ui-config.mjs

@@ -0,0 +1,176 @@
+/**
+ * The single source of truth for module switches.
+ *
+ * Both halves read this file: the Web data route (`src/runtime/summary.mjs`) and
+ * the host-side gates (`src/runtime/modules.mjs` re-exports from here). Nothing
+ * else may re-implement the merge — a second copy is how the switch becomes a
+ * lie.
+ *
+ * Priority: `<data_dir>/ui-config.json` > profile patch config > default (true).
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const UI_CONFIG_FILE = 'ui-config.json';
+export const UI_CONFIG_VERSION = 2;
+export const MODULE_KEYS = Object.freeze(['context', 'read', 'write', 'dream', 'projects', 'due', 'feed']);
+export const DEFAULT_MODULES = Object.freeze({
+  context: true,
+  read: true,
+  write: true,
+  dream: true,
+  projects: true,
+  due: true,
+  feed: true,
+});
+
+const warn = (logger, message) => {
+  try {
+    logger?.warn?.(`[dsh-memsys] ${message}`);
+  } catch {
+    // a logger that throws must never break boot
+  }
+};
+
+/** Missing keys mean `true`; only an explicit `false` disables a module. */
+export function normalizeModules(input = {}) {
+  const modules = { ...DEFAULT_MODULES };
+  if (input && typeof input === 'object') {
+    for (const key of MODULE_KEYS) {
+      if (typeof input[key] === 'boolean') modules[key] = input[key];
+    }
+  }
+  return modules;
+}
+
+/**
+ * v2 is `{ version: 2, auto_inject, modules }`.
+ * v1 (or versionless) files only carry `auto_inject`; they migrate by mapping it
+ * onto `modules.context` while every other module stays on.
+ */
+export function normalizeUiConfig(parsed, logger = console) {
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;
+  const version = parsed.version;
+  const known = version === undefined || version === 1 || version === UI_CONFIG_VERSION;
+  if (!known) {
+    warn(logger, `ui-config 版本不认识（${version}），已忽略`);
+    return null;
+  }
+  const hasModules = parsed.modules && typeof parsed.modules === 'object';
+  if (version === undefined && typeof parsed.auto_inject !== 'boolean' && !hasModules) {
+    warn(logger, 'ui-config 既无 auto_inject 也无 modules，已忽略');
+    return null;
+  }
+  const modules = normalizeModules(hasModules ? parsed.modules : {});
+  if (!hasModules && typeof parsed.auto_inject === 'boolean') modules.context = parsed.auto_inject;
+  return {
+    version: UI_CONFIG_VERSION,
+    auto_inject: modules.context,
+    modules,
+  };
+}
+
+export function readUiConfig(dataDir, logger = console) {
+  if (!dataDir) return null;
+  const file = path.join(dataDir, UI_CONFIG_FILE);
+  let raw = null;
+  try {
+    if (!fs.existsSync(file)) return null;
+    raw = fs.readFileSync(file, 'utf8');
+  } catch (err) {
+    warn(logger, `ui-config 读取失败（${err?.message ?? err}），回落 profile 配置`);
+    return null;
+  }
+  try {
+    return normalizeUiConfig(JSON.parse(raw), logger);
+  } catch {
+    warn(logger, 'ui-config 不是合法 JSON，回落 profile 配置');
+    return null;
+  }
+}
+
+/**
+ * Pure merge used by every caller: defaults <- profile config <- ui-config.
+ * A legacy `auto_inject` fills `modules.context` only when that source says
+ * nothing about `modules` at all.
+ */
+export function mergeModules(profileConfig = null, uiConfig = null) {
+  const base = { ...DEFAULT_MODULES };
+  const apply = (source) => {
+    if (!source || typeof source !== 'object') return;
+    const modules = source.modules;
+    if (modules && typeof modules === 'object') {
+      for (const key of MODULE_KEYS) {
+        if (typeof modules[key] === 'boolean') base[key] = modules[key];
+      }
+    }
+    if (typeof source.auto_inject === 'boolean' && modules?.context === undefined) {
+      base.context = source.auto_inject;
+    }
+  };
+  apply(profileConfig);
+  apply(uiConfig);
+  return base;
+}
+
+/** Kept under the name the host gates already import. */
+export function resolveModules(profileConfig = null, uiConfig = null) {
+  return Object.freeze(mergeModules(profileConfig, uiConfig));
+}
+
+export function moduleEnabled(modules, key) {
+  return (modules ?? DEFAULT_MODULES)[key] !== false;
+}
+
+const profileSaysSomething = (profileConfig) =>
+  Boolean(
+    profileConfig &&
+      (profileConfig.modules && typeof profileConfig.modules === 'object'
+        ? MODULE_KEYS.some((key) => typeof profileConfig.modules[key] === 'boolean')
+        : typeof profileConfig.auto_inject === 'boolean'),
+  );
+
+/**
+ * Resolve for the Web route: returns the effective map plus which rank won,
+ * so the settings page can show where the value came from.
+ */
+export function resolveModulesDetail({ dataDir = null, profileConfig = null, logger = console } = {}) {
+  const stored = readUiConfig(dataDir, logger);
+  const modules = mergeModules(profileConfig, stored);
+  const source = stored ? 'ui-config' : profileSaysSomething(profileConfig) ? 'profile' : 'default';
+  return { modules, source, auto_inject: modules.context };
+}
+
+/**
+ * Partial update: sends only the keys it owns. A legacy `auto_inject` maps onto
+ * `modules.context`; sending `modules.context` mirrors back into `auto_inject`
+ * so v1 readers keep working.
+ */
+export function writeUiConfig(dataDir, patch = {}, logger = console) {
+  if (!dataDir) return null;
+  const current = readUiConfig(dataDir, logger) ?? {
+    version: UI_CONFIG_VERSION,
+    auto_inject: DEFAULT_MODULES.context,
+    modules: { ...DEFAULT_MODULES },
+  };
+  const next = { ...current.modules };
+  if (patch.modules && typeof patch.modules === 'object') {
+    for (const key of MODULE_KEYS) {
+      if (typeof patch.modules[key] === 'boolean') next[key] = patch.modules[key];
+    }
+  }
+  if (typeof patch.auto_inject === 'boolean' && patch.modules?.context === undefined) {
+    next.context = patch.auto_inject;
+  }
+  const normalized = {
+    version: UI_CONFIG_VERSION,
+    auto_inject: next.context,
+    modules: next,
+  };
+  fs.mkdirSync(dataDir, { recursive: true });
+  const target = path.join(dataDir, UI_CONFIG_FILE);
+  const temp = `${target}.tmp`;
+  fs.writeFileSync(temp, JSON.stringify(normalized, null, 2), 'utf8');
+  fs.renameSync(temp, target);
+  return normalized;
+}

package/test/p4-p4-delivery.test.mjs

@@ -76,7 +76,13 @@ test('P4/P4-B E10: receipts must match the persistent manifest and groups', (t)
     receivedIds: expected,
     payloadHash,
   });
-  assert.equal(full.delivery, 'confirmed', JSON.stringify(full));
+  if (compiled.manifest.actual_ids.filter((id) => id.startsWith('mem_')).length === 0) {
+    // Design §6.2c: an empty actual set can never be confirmed, even if the receipt equals it.
+    assert.equal(full.delivery, 'incomplete', JSON.stringify(full));
+    assert.equal(full.code, 'receipt_incomplete');
+  } else {
+    assert.equal(full.delivery, 'confirmed', JSON.stringify(full));
+  }
   const exposure = ctx.main.prepare('SELECT memory_id FROM injections').all().map((row) => row.memory_id);
   assert.equal(exposure.length, 0, 'deferred members must not produce exposure');
 });