dsh-memu-memory 1.1.2 → 1.2.0

package/tests/coalesce.test.mjs

@@ -0,0 +1,113 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+const home = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-memu-memory-coalesce-'))
+process.env.DSH_MEMU_HOME = home
+
+const state = await import('../lib/state.js')
+
+const stateFile = path.join(home, 'state.json')
+
+test.after(() => {
+  try { state.flushState() } catch {}
+  try { fs.rmSync(home, { recursive: true, force: true }) } catch {}
+})
+
+function countWrites(match) {
+  const original = fs.writeFileSync
+  const hits = []
+  fs.writeFileSync = function (file, ...rest) {
+    if (String(file).includes(match)) hits.push(String(file))
+    return original.call(this, file, ...rest)
+  }
+  return {
+    hits,
+    stop() { fs.writeFileSync = original },
+  }
+}
+
+test('a turn of bookkeeping updates collapses into one disk write', () => {
+  state.ensureSession('coalesce', { cwd: path.join(home, 'coalesce') })
+  state.flushState()
+
+  const spy = countWrites('state.json.tmp-')
+  try {
+    for (let i = 0; i < 10; i++) state.touchSession('coalesce')
+    assert.equal(spy.hits.length, 0, 'nothing is written while the timer is pending')
+    state.flushState()
+    assert.equal(spy.hits.length, 1, 'all ten updates land in a single write')
+  } finally {
+    spy.stop()
+  }
+})
+
+test('every coalesced change is present on disk afterwards', () => {
+  state.ensureSession('coalesce-all', { cwd: path.join(home, 'coalesce-all') })
+  state.markInjected('coalesce-all', ['mem-a', 'mem-b'], 3)
+  state.setSessionMood('coalesce-all', { valence: 0.5, arousal: 0.6 })
+  state.flushState()
+
+  const raw = JSON.parse(fs.readFileSync(stateFile, 'utf8'))
+  const binding = raw.sessions['coalesce-all']
+  assert.ok(binding)
+  assert.ok(binding.injectedIds.includes('mem-a'))
+  assert.ok(binding.injectedIds.includes('mem-b'))
+  assert.equal(binding.lastInjectedTurn, 3)
+  assert.equal(binding.mood.valence, 0.5)
+})
+
+test('memory indexes are never coalesced', () => {
+  const binding = state.ensureSession('no-coalesce', { cwd: path.join(home, 'no-coalesce') })
+  state.flushState()
+
+  const spy = countWrites('.json.tmp-')
+  try {
+    state.savePrivateIndex(binding.libraryId, { version: 1, entries: { a: { id: 'a' } } })
+    state.savePrivateIndex(binding.libraryId, { version: 1, entries: { a: { id: 'a' }, b: { id: 'b' } } })
+    const indexWrites = spy.hits.filter((file) => file.includes(binding.libraryId))
+    assert.equal(indexWrites.length, 2, 'a memory write hits disk immediately, every time')
+  } finally {
+    spy.stop()
+  }
+  assert.deepEqual(Object.keys(state.loadPrivateIndex(binding.libraryId).entries).sort(), ['a', 'b'])
+})
+
+test('a read-modify-write after an await keeps what landed during it', async () => {
+  const binding = state.ensureSession('await-merge', { cwd: path.join(home, 'await-merge') })
+
+  // A caller that reads first and awaits (a MemU commit, a consolidation job).
+  const slowCaller = (async () => {
+    const early = state.loadPrivateIndex(binding.libraryId)
+    await new Promise((resolve) => setTimeout(resolve, 5))
+    return early
+  })()
+
+  // Another writer lands inside that window.
+  state.updatePrivateIndex(binding.libraryId, (index) => {
+    index.entries['mem-other'] = { id: 'mem-other', content: 'other' }
+  })
+  const early = await slowCaller
+  assert.equal(early.entries['mem-other'], undefined, 'the early snapshot really is stale')
+
+  // The correct pattern re-reads instead of saving the stale snapshot.
+  state.updatePrivateIndex(binding.libraryId, (index) => {
+    index.entries['mem-mine'] = { id: 'mem-mine', content: 'mine' }
+  })
+
+  const after = state.loadPrivateIndex(binding.libraryId)
+  assert.deepEqual(Object.keys(after.entries).sort(), ['mem-mine', 'mem-other'])
+})
+
+test('an externally modified state.json is picked up instead of the cache', () => {
+  state.ensureSession('external', { cwd: path.join(home, 'external') })
+  state.flushState()
+
+  const raw = JSON.parse(fs.readFileSync(stateFile, 'utf8'))
+  raw.sessions['external'].useGlobal = false
+  fs.writeFileSync(stateFile, `${JSON.stringify(raw, null, 2)}\n`, 'utf8')
+
+  assert.equal(state.getSessionBinding('external').useGlobal, false)
+})

package/tests/config.test.mjs

@@ -0,0 +1,159 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+const home = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-memu-memory-config-'))
+process.env.DSH_MEMU_HOME = home
+process.env.MEMU_CONFIG = path.join(home, 'config.env')
+
+const config = await import('../lib/memu-config.js')
+const remote = await import('../lib/remote-summary.js')
+
+test.after(() => {
+  try { fs.rmSync(home, { recursive: true, force: true }) } catch {}
+})
+
+test('writes and reads embedding config without leaking the key', () => {
+  const saved = config.saveMemuConfig({
+    provider: 'jina',
+    model: 'jina-embeddings-v3',
+    baseUrl: 'https://api.jina.ai/v1',
+    apiKey: 'secret-key',
+  })
+  assert.equal(saved.provider, 'jina')
+  assert.equal(saved.model, 'jina-embeddings-v3')
+  assert.equal(saved.hasKey, true)
+  assert.ok(!JSON.stringify(saved).includes('secret-key'))
+  const text = fs.readFileSync(process.env.MEMU_CONFIG, 'utf8')
+  assert.ok(text.includes('MEMU_EMBED_PROVIDER=jina'))
+  assert.ok(text.includes('MEMU_API_KEY=secret-key'))
+})
+
+test('clearKey removes the key', () => {
+  config.saveMemuConfig({ clearKey: true })
+  assert.equal(config.getMemuConfig().hasKey, false)
+  const text = fs.readFileSync(process.env.MEMU_CONFIG, 'utf8')
+  assert.ok(!text.includes('MEMU_API_KEY='))
+})
+
+test('source follows vectorSource independently of the saved API endpoint', async () => {
+  const state = await import('../lib/state.js')
+  state.updateSettings({ memoryBackend: 'api', vectorSource: 'api' })
+  config.saveMemuConfig({ provider: 'openai', baseUrl: 'http://localhost:1234/v1', model: 'custom-local-api' })
+  assert.equal(config.getMemuConfig().source, 'api')
+  assert.equal(state.effectiveVectorRoute(), 'remote-api')
+  state.updateSettings({ vectorSource: 'local' })
+  config.saveMemuConfig({ baseUrl: 'https://api.openai.com/v1' })
+  assert.equal(config.getMemuConfig().source, 'local')
+  assert.equal(state.effectiveVectorRoute(), 'managed-local')
+})
+
+test('local/api source round trips preserve the complete saved API configuration', async () => {
+  const state = await import('../lib/state.js')
+  config.saveMemuConfig({ provider: 'voyage', baseUrl: 'https://api.voyageai.com/v1', apiKey: 'keep-me', model: 'voyage-3' })
+  const before = fs.readFileSync(process.env.MEMU_CONFIG, 'utf8')
+  for (const source of ['local', 'api', 'local', 'remote']) {
+    const normalized = source === 'remote' ? 'api' : source
+    const after = config.setEmbeddingSource(source)
+    assert.equal(after.source, normalized)
+    assert.equal(state.getSettings().vectorSource, normalized)
+    assert.equal(after.provider, 'voyage')
+    assert.equal(after.baseUrl, 'https://api.voyageai.com/v1')
+    assert.equal(after.model, 'voyage-3')
+    assert.equal(after.hasKey, true)
+    assert.ok(!JSON.stringify(after).includes('keep-me'))
+    assert.equal(fs.readFileSync(process.env.MEMU_CONFIG, 'utf8'), before)
+  }
+})
+
+test('an API localhost endpoint remains configured without a vendor key', () => {
+  config.setEmbeddingSource('api')
+  config.saveMemuConfig({
+    provider: 'openai',
+    model: 'custom-local-api',
+    baseUrl: 'http://localhost:1234/v1',
+    clearKey: true,
+  })
+  const local = config.getMemuConfig()
+  assert.equal(local.source, 'api')
+  assert.equal(local.baseUrl, 'http://localhost:1234/v1')
+  assert.equal(local.hasKey, false)
+})
+
+test('an unknown source is rejected without modifying saved settings or configuration', async () => {
+  const state = await import('../lib/state.js')
+  const before = fs.readFileSync(process.env.MEMU_CONFIG, 'utf8')
+  const source = state.getSettings().vectorSource
+  assert.throws(() => config.setEmbeddingSource('sideways'), /local or api/)
+  assert.equal(state.getSettings().vectorSource, source)
+  assert.equal(fs.readFileSync(process.env.MEMU_CONFIG, 'utf8'), before)
+})
+
+test('storage mode follows the setting instead of being pinned to local', async () => {
+  const state = await import('../lib/state.js')
+  state.updateSettings({ memoryMode: 'cloud' })
+  config.saveMemuConfig({ provider: 'openai' })
+  assert.equal(config.getMemuConfig().mode, 'cloud')
+  state.updateSettings({ memoryMode: 'local' })
+  config.saveMemuConfig({ provider: 'openai' })
+  assert.equal(config.getMemuConfig().mode, 'local')
+})
+
+test('summary config is stored and read without leaking its key', () => {
+  config.saveMemuConfig({
+    summaryModel: 'deepseek-chat',
+    summaryBaseUrl: 'https://api.deepseek.com/v1/',
+    summaryApiKey: 'summary-secret',
+  })
+  const summary = config.getSummaryConfig()
+  assert.equal(summary.model, 'deepseek-chat')
+  assert.equal(summary.baseUrl, 'https://api.deepseek.com/v1')
+  assert.equal(summary.hasKey, true)
+  assert.equal(summary.ready, true)
+  assert.ok(!JSON.stringify(summary).includes('summary-secret'))
+})
+
+test('remote summary parses model-written memories from chat completions', async () => {
+  config.saveMemuConfig({
+    summaryModel: 'deepseek-chat',
+    summaryBaseUrl: 'https://api.deepseek.com/v1',
+    summaryApiKey: 'summary-secret',
+  })
+  const originalFetch = globalThis.fetch
+  let seen = null
+  globalThis.fetch = async (url, init) => {
+    seen = { url, init, body: JSON.parse(init.body) }
+    return {
+      ok: true,
+      status: 200,
+      text: async () => JSON.stringify({
+        choices: [{
+          message: {
+            content: JSON.stringify({
+              memories: [
+                { title: '香菜', content: '他记得我不吃香菜。', tags: ['food'], open_loop: true, confidence: 0.7 },
+                { title: '', content: '', tags: [] },
+              ],
+            }),
+          },
+        }],
+      }),
+    }
+  }
+  try {
+    const memories = await remote.summarizeRemote({
+      transcript: '用户说他不吃香菜', libraryName: '测试库', domain: 'general',
+    })
+    assert.equal(seen.url, 'https://api.deepseek.com/v1/chat/completions')
+    assert.equal(seen.init.headers.authorization, 'Bearer summary-secret')
+    assert.equal(seen.body.model, 'deepseek-chat')
+    assert.equal(memories.length, 1)
+    assert.equal(memories[0].title, '香菜')
+    assert.equal(memories[0].openLoop, true)
+    assert.equal(memories[0].confidence, 0.7)
+  } finally {
+    globalThis.fetch = originalFetch
+  }
+})

package/tests/consolidation-credential.test.mjs

@@ -0,0 +1,320 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+const home = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-memu-memory-cons-credential-'))
+process.env.DSH_MEMU_HOME = home
+
+const state = await import('../lib/state.js')
+const ledger = await import('../lib/consolidation-ledger.js')
+const receipt = await import('../lib/consolidation-receipt.js')
+const { requestPrivateConsolidation, isConsolidating } = await import('../lib/private.js')
+
+test.after(() => {
+  try { fs.rmSync(home, { recursive: true, force: true }) } catch {}
+})
+
+function fence(json) {
+  const tick = String.fromCharCode(96)
+  return [tick + tick + tick + receipt.RECEIPT_TAG, JSON.stringify(json, null, 2), tick + tick + tick].join('\n')
+}
+
+function writeMemory(libraryId, id) {
+  state.updatePrivateIndex(libraryId, (index) => {
+    index.entries[id] = {
+      title: '记忆 ' + id,
+      content: '正文 ' + id,
+      layer: 'long_term',
+      status: 'active',
+      createdAt: new Date().toISOString(),
+      updatedAt: new Date().toISOString(),
+    }
+  })
+}
+
+// 真实宿主的四件事都在这里：agents.create 的顶层 inheritedEventCount、公共 session/event
+// 事件流、request/header 里的工具表、以及可选的 observeSession 租约。
+function host({
+  live = true,
+  requestConfig = { provider: 'test-provider', model: 'test-model' },
+  headerTools = null,
+  workerText = '',
+  workerWrites = [],
+  whenIdle = null,
+  turnReason = { kind: 'completed' },
+  events = null,
+  observe = null,
+  emitTurnEnd = true,
+} = {}) {
+  const rec = { created: [], handlers: [], followedUp: [], disposed: [] }
+  const transcript = events || [
+    { seq: 0, type: 'user/message', data: { source: { kind: 'user' }, content: [{ type: 'text', text: '记住：我不吃香菜，另外别再提那件事' }] } },
+    { seq: 1, type: 'assistant/message', data: { message: { content: [{ type: 'text', text: '记住了' }] } } },
+    { seq: 2, type: 'turn/end', data: { turn: 1, reason: { kind: 'completed' } } },
+    ...(headerTools ? [{ seq: 3, type: 'request/header', data: { header: { config: requestConfig, tools: headerTools } } }] : []),
+  ]
+  const emit = (session, event) => { for (const handler of [...rec.handlers]) handler(session, event) }
+  const parentLive = live ? { id: 'parent', session: { requestHeader: () => ({ config: requestConfig, ...(headerTools ? { tools: headerTools } : {}) }) } } : undefined
+  const ctx = {
+    rec,
+    emit,
+    parentLive,
+    on: (name, handler) => {
+      if (name !== 'session/event') return () => {}
+      rec.handlers.push(handler)
+      return () => {
+        const index = rec.handlers.indexOf(handler)
+        if (index >= 0) rec.handlers.splice(index, 1)
+      }
+    },
+    get: (name) => {
+      if (name === 'agents') {
+        return {
+          get: () => parentLive,
+          create: async (spec) => {
+            rec.created.push(spec)
+            const childSession = { id: spec.sessionId }
+            return {
+              agent: {
+                session: childSession,
+                followup: (message) => {
+                  rec.followedUp.push(message)
+                  // 子会话的 binding 是在 create 之后才写入的，这里必须现取。
+                  const childBinding = state.getSessionBinding(spec.sessionId)
+                  for (const id of workerWrites) writeMemory(childBinding.libraryId, id)
+                  if (workerText) {
+                    const text = typeof workerText === 'function' ? workerText(childBinding) : workerText
+                    emit(childSession, { type: 'assistant/message', seq: 90, data: { message: { content: [{ type: 'text', text }] } } })
+                  }
+                  if (emitTurnEnd) emit(childSession, { type: 'turn/end', seq: 91, data: { turn: 1, reason: turnReason } })
+                },
+                whenIdle: whenIdle || (async () => {}),
+              },
+              dispose: async () => { rec.disposed.push(spec.sessionId) },
+            }
+          },
+        }
+      }
+      if (name === 'sessionQuery') {
+        const query = {
+          readSession: async () => ({ events: transcript, session: { cwd: path.join(home, 'proj'), agentPreset: 'standard' } }),
+        }
+        if (observe) query.observeSession = async () => observe
+        return query
+      }
+      return undefined
+    },
+  }
+  return ctx
+}
+
+// C 包第 6 条：写前重验父授权、凭证只认对账过的结果。
+
+test('a verified receipt becomes the completion credential and advances the checked cursor', async () => {
+  const sessionId = 'cred-ok'
+  const binding = state.ensureSession(sessionId, { cwd: path.join(home, 'proj'), agentPreset: 'standard' })
+  const ctx = host({
+    workerWrites: ['mem-cred-1'],
+    workerText: (child) => fence({ jobId: child.jobId, snapshotHash: child.snapshotHash, status: 'completed', outcome: 'created', createdIds: ['mem-cred-1'], updatedIds: [], heldIds: [], checkedRange: { fromSeq: 0, throughSeq: 2 } }),
+  })
+  const result = await requestPrivateConsolidation(ctx, sessionId, { force: true })
+  assert.equal(result.ok, true)
+  assert.equal(result.settled, true)
+  assert.equal(result.status, 'completed')
+  assert.equal(result.outcome, 'created')
+  assert.deepEqual(result.createdIds, ['mem-cred-1'])
+  assert.equal(result.receipt.status, 'completed')
+  assert.equal(result.credential.checked.throughSeq, 2)
+  assert.equal(result.wrote, 1)
+  assert.equal(state.getSessionBinding(sessionId).lastSleepSeq, 2)
+  assert.equal(ledger.sessionState(sessionId).checked.throughSeq, 2)
+  assert.equal(ledger.sessionState(sessionId).inflight, null, 'a finished job releases its lease')
+  assert.equal(state.getSessionBinding(ctx.rec.created[0].sessionId), null, 'disposed worker leaves no persistent child binding')
+  assert.equal(ctx.rec.followedUp.length, 1)
+  assert.equal(ctx.rec.disposed.length, 1)
+})
+
+test('a worker that reports but gives no receipt is a failure, not a success', async () => {
+  const sessionId = 'cred-no-receipt'
+  state.ensureSession(sessionId, { cwd: path.join(home, 'proj-nr'), agentPreset: 'standard' })
+  const ctx = host({ workerText: '我把能记的都记下来了。' })
+  const result = await requestPrivateConsolidation(ctx, sessionId, { force: true })
+  assert.equal(result.ok, false)
+  assert.equal(result.settled, false)
+  assert.equal(result.reasonCode, 'receipt-missing')
+  assert.match(result.error, /receipt/)
+  assert.equal(state.getSessionBinding(sessionId).lastSleepSeq, undefined, 'without a credential the cursor must not advance')
+  const job = ledger.sessionState(sessionId)
+  assert.equal(job.checked, null)
+  assert.equal(job.pending.throughSeq, 2, 'the range stays pending for the next attempt')
+})
+
+test('a receipt that cites a memory nobody wrote is rejected', async () => {
+  const sessionId = 'cred-ghost'
+  state.ensureSession(sessionId, { cwd: path.join(home, 'proj-ghost'), agentPreset: 'standard' })
+  const ctx = host({
+    workerText: (child) => fence({ jobId: child.jobId, snapshotHash: child.snapshotHash, status: 'completed', outcome: 'created', createdIds: ['mem-does-not-exist'], checkedRange: { fromSeq: 0, throughSeq: 2 } }),
+  })
+  const result = await requestPrivateConsolidation(ctx, sessionId, { force: true })
+  assert.equal(result.ok, false)
+  assert.equal(result.reasonCode, 'receipt-unverified')
+  assert.match(result.error, /mem-does-not-exist/)
+  assert.equal(state.getSessionBinding(sessionId).lastSleepSeq, undefined)
+})
+
+test('no closed turn on a live session defers instead of forking', async () => {
+  const sessionId = 'cred-open-turn'
+  state.ensureSession(sessionId, { cwd: path.join(home, 'proj-open'), agentPreset: 'standard' })
+  const ctx = host({
+    events: [
+      { seq: 0, type: 'user/message', data: { source: { kind: 'user' }, content: [{ type: 'text', text: '这轮还没答完' }] } },
+      { seq: 1, type: 'turn/start', data: { turn: 1 } },
+    ],
+    observe: {
+      source: 'live',
+      header: { cwd: path.join(home, 'proj-open') },
+      inheritedEventCount: 0,
+      events: [
+        { seq: 0, type: 'user/message', data: { source: { kind: 'user' }, content: [{ type: 'text', text: '这轮还没答完' }] } },
+        { seq: 1, type: 'turn/start', data: { turn: 1 } },
+      ],
+      cursor: 1,
+      [Symbol.dispose]: () => {},
+    },
+  })
+  const result = await requestPrivateConsolidation(ctx, sessionId, { force: true })
+  assert.equal(result.ok, true)
+  assert.equal(result.settled, false)
+  assert.equal(result.skipped, 'no-closed-turn')
+  assert.equal(ctx.rec.created.length, 0, 'a half turn must not be seeded into a worker')
+})
+
+test('a tool surface without memory tools is unavailable, and nothing is forked', async () => {
+  for (const [name, tools, reasonCode] of [
+    ['missing', [{ name: 'read' }, { name: 'write' }], 'worker-tools-missing'],
+  ]) {
+    const sessionId = 'cred-tools-' + name
+    state.ensureSession(sessionId, { cwd: path.join(home, 'proj-tools-' + name), agentPreset: 'standard' })
+    const ctx = host({ headerTools: tools })
+    const result = await requestPrivateConsolidation(ctx, sessionId, { force: true })
+    assert.equal(result.ok, false)
+    assert.equal(result.code, 'unavailable')
+    assert.equal(result.reasonCode, reasonCode)
+    assert.match(result.error, /memu_private_remember/)
+    assert.equal(ctx.rec.created.length, 0, 'no doomed fork is created')
+    assert.equal(state.getSessionBinding(sessionId).lastSleepSeq, undefined)
+  }
+})
+
+test('a PTC-only tool surface is reported as PTC and not as a generic miss', async () => {
+  const sessionId = 'cred-tools-ptc'
+  state.ensureSession(sessionId, { cwd: path.join(home, 'proj-ptc'), agentPreset: 'standard' })
+  const ctx = host({
+    headerTools: [{ name: 'ptc_exec' }],
+    events: [
+      { seq: 0, type: 'user/message', data: { source: { kind: 'user' }, content: [{ type: 'text', text: '用 PTC 跑一下' }] } },
+      { seq: 1, type: 'turn/end', data: { turn: 1, reason: { kind: 'completed' } } },
+      { seq: 2, type: 'tool/ptc-dispatch', data: {} },
+      { seq: 3, type: 'request/header', data: { header: { config: { provider: 'p', model: 'm' }, tools: [{ name: 'ptc_exec' }] } } },
+    ],
+  })
+  const result = await requestPrivateConsolidation(ctx, sessionId, { force: true })
+  assert.equal(result.ok, false)
+  assert.equal(result.reasonCode, 'worker-tools-ptc-only')
+  assert.equal(result.ptc, true)
+  assert.equal(ctx.rec.created.length, 0)
+})
+
+test('a parent that changes its library mid-run voids the credential', async () => {
+  const sessionId = 'cred-scope-change'
+  const binding = state.ensureSession(sessionId, { cwd: path.join(home, 'proj-scope'), agentPreset: 'standard' })
+  const other = state.ensureLibraryForCwd(path.join(home, 'proj-scope-other'))
+  let release = null
+  const gate = new Promise((resolve) => { release = resolve })
+  const ctx = host({
+    whenIdle: () => gate,
+    workerWrites: ['mem-scope-1'],
+    workerText: fence({ status: 'completed', outcome: 'created', createdIds: ['mem-scope-1'], checkedRange: { fromSeq: 0, throughSeq: 2 } }),
+  })
+  const running = requestPrivateConsolidation(ctx, sessionId, { force: true })
+  await new Promise((resolve) => setTimeout(resolve, 30))
+  assert.equal(isConsolidating(sessionId), true)
+  // 用户在整理期间把会话切到另一个库：父会话自己发的 turn/start 就是这次的信号。
+  state.setSessionBinding(sessionId, { libraryId: other.id })
+  ctx.emit(ctx.parentLive.session, { type: 'turn/start', data: { turn: 2 } })
+  release()
+  const result = await running
+  assert.equal(result.ok, false)
+  assert.equal(result.reasonCode, 'parent-scope-changed')
+  assert.equal(result.retryable, false)
+  assert.equal(state.getSessionBinding(sessionId).lastSleepSeq, undefined)
+  const job = ledger.sessionState(sessionId)
+  assert.equal(job.checked, null, 'a credential from a stale authorization is worth nothing')
+  assert.ok(binding.libraryId !== other.id)
+})
+
+test('a lease held in the ledger blocks a second run across a restart', async () => {
+  const sessionId = 'cred-lease-held'
+  const binding = state.ensureSession(sessionId, { cwd: path.join(home, 'proj-lease'), agentPreset: 'standard' })
+  ledger.beginJob({ sessionId, jobId: 'ghost-job', snapshot: { hash: 'h', fromSeq: 0, throughSeq: 2, eventCount: 3 }, binding })
+  const ctx = host({})
+  const result = await requestPrivateConsolidation(ctx, sessionId, { force: true })
+  assert.equal(result.ok, false)
+  assert.equal(result.running, true)
+  assert.equal(result.reasonCode, 'lease-held')
+  assert.equal(ctx.rec.created.length, 0)
+  assert.equal(ledger.sessionState(sessionId).inflight.jobId, 'ghost-job')
+})
+
+test('a ledger persistence failure never creates a worker', async () => {
+  const sessionId = 'cred-ledger-unavailable'
+  state.ensureSession(sessionId, { cwd: path.join(home, 'proj-ledger-failure'), agentPreset: 'standard' })
+  const file = ledger.ledgerPath()
+  const original = fs.existsSync(file) ? fs.readFileSync(file) : null
+  const ctx = host({})
+  try {
+    fs.writeFileSync(file, '{broken-json')
+    const result = await requestPrivateConsolidation(ctx, sessionId, { force: true })
+    assert.equal(result.ok, false)
+    assert.equal(result.reasonCode, 'ledger-unavailable')
+    assert.equal(result.retryable, true)
+    assert.equal(result.settled, false)
+    assert.equal(ctx.rec.created.length, 0)
+    assert.equal(state.getSessionBinding(sessionId).lastSleepSeq, undefined)
+  } finally {
+    if (original) fs.writeFileSync(file, original)
+    else fs.rmSync(file, { force: true })
+  }
+})
+
+test('a timeout leaves the range pending instead of pretending it was consolidated', async () => {
+  const sessionId = 'cred-timeout'
+  state.ensureSession(sessionId, { cwd: path.join(home, 'proj-timeout'), agentPreset: 'standard' })
+  const ctx = host({ whenIdle: () => new Promise(() => {}), emitTurnEnd: false })
+  const result = await requestPrivateConsolidation(ctx, sessionId, { force: true, maxWaitMs: 30 })
+  assert.equal(result.ok, false)
+  assert.equal(result.timedOut, true)
+  const job = ledger.sessionState(sessionId)
+  assert.equal(job.inflight, null)
+  assert.equal(job.checked, null)
+  assert.equal(job.pending.throughSeq, 2)
+  assert.equal(job.lastReasonCode, 'timeout')
+})
+
+test('the same snapshot is not consolidated twice', async () => {
+  const sessionId = 'cred-idempotent'
+  state.ensureSession(sessionId, { cwd: path.join(home, 'proj-idem'), agentPreset: 'standard' })
+  const ctx = host({
+    workerWrites: ['mem-idem-1'],
+    workerText: (child) => fence({ jobId: child.jobId, snapshotHash: child.snapshotHash, status: 'completed', outcome: 'created', createdIds: ['mem-idem-1'], checkedRange: { fromSeq: 0, throughSeq: 2 } }),
+  })
+  const first = await requestPrivateConsolidation(ctx, sessionId, { force: true })
+  assert.equal(first.ok, true)
+  const second = await requestPrivateConsolidation(ctx, sessionId, { force: true })
+  assert.equal(second.ok, true)
+  assert.equal(second.skipped, 'already-consolidated')
+  assert.equal(second.settled, true)
+  assert.equal(ctx.rec.created.length, 1, 'an unchanged snapshot is not paid for twice')
+})