dsh-memu-memory 1.2.0 → 1.2.2

package/tests/curator-pairing.test.mjs

@@ -0,0 +1,252 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import {
+  bm25,
+  buildCorpus,
+  globalConflictCheck,
+  negationPolarity,
+  numericSetsDiffer,
+  pairDecision,
+  pairFeatures,
+  pairScore,
+  rankPairCandidates,
+  tokenize,
+} from '../lib/text-retrieval.js'
+import { similarityDetail, similarTexts, bigrams, dice } from '../lib/text-similarity.js'
+
+// —— §4.1 tokenize ——
+
+test('tokenize: latin runs of >=2 chars keep ._ - joins, single chars drop', () => {
+  assert.deepEqual(tokenize('use dsh-memu-memory_v2.today ok'), ['use', 'dsh-memu-memory_v2.today', 'ok'])
+  assert.deepEqual(tokenize('a b cd'), ['cd'])
+  assert.deepEqual(tokenize('per-turn retry'), ['per-turn', 'retry'])
+})
+
+test('tokenize: CJK runs become overlapping bigrams, isolated chars stay single', () => {
+  assert.deepEqual(tokenize('部署窗口'), ['部署', '署窗', '窗口'])
+  assert.deepEqual(tokenize('猫'), ['猫'])
+  // two CJK runs separated by latin/punct stay separate runs
+  assert.deepEqual(tokenize('猫。狗'), ['猫', '狗'])
+})
+
+test('tokenize: NFKC folds full-width forms, lowercases, dedupes', () => {
+  assert.deepEqual(tokenize('ＲＩＳＣＶ ＣＡＣＨＥ CACHE'), ['riscv', 'cache'])
+  assert.deepEqual(tokenize('缓存 缓存'), ['缓存'])
+})
+
+// —— §4.1 buildCorpus + bm25 ——
+
+function corpusFor() {
+  return buildCorpus([
+    { id: 'a', title: '部署窗口', content: '每周四凌晨部署窗口只做灰度', track: 'memory', domain: 'general' },
+    { id: 'b', title: '缓存策略', content: 'Redis 缓存统一 30 秒过期', track: 'memory', domain: 'coding' },
+    { id: 'c', title: '站会安排', content: '每周一上午十点开站会', track: 'memory', domain: 'general' },
+  ])
+}
+
+test('buildCorpus: tf/df/avgdl account for every doc and term', () => {
+  const corpus = corpusFor()
+  assert.equal(corpus.size, 3)
+  assert.equal(corpus.df.get('缓存'), 1)
+  assert.equal(corpus.df.get('每周'), 2)
+  const doc = corpus.docs.get('a')
+  assert.equal(doc.tf.get('部署'), 2)
+  assert.equal(doc.len, [...doc.tf.values()].reduce((sum, n) => sum + n, 0))
+  assert.ok(corpus.avgdl > 0)
+})
+
+test('bm25: docs containing query terms outscore non-matching docs', () => {
+  const corpus = corpusFor()
+  const query = tokenize('缓存 过期')
+  const scores = ['a', 'b', 'c'].map((id) => bm25(query, corpus.docs.get(id), corpus))
+  assert.ok(scores[1] > scores[0] && scores[1] > scores[2])
+  assert.equal(scores[2], 0)
+})
+
+test('bm25: queries wider than 64 terms keep the matching terms (junk never evicts them)', () => {
+  const corpus = corpusFor()
+  const junk = [...Array(80).keys()].map((i) => `raretoken${i}`)
+  const query = [...junk, '缓存']
+  // Absent terms carry the highest nominal IDF but zero scoring mass; the top-64
+  // quota must not spend itself on them and drop the one term that can score.
+  const hits = query.filter((t) => (corpus.df.get(t) || 0) > 0)
+  assert.equal(bm25(query, corpus.docs.get('b'), corpus), bm25(hits, corpus.docs.get('b'), corpus))
+  assert.ok(bm25(hits, corpus.docs.get('b'), corpus) > 0)
+})
+// —— §4.2 similarityDetail / pairFeatures / pairScore ——
+
+test('similarityDetail: length-comparable pairs report dice, pruned pairs report the containment floor', () => {
+  const near = similarityDetail('每周四凌晨部署窗口只做灰度', '每周四凌晨部署窗口只做灰度发布')
+  assert.equal(near.containment, 0)
+  assert.ok(near.dice > 0.9)
+  const contained = similarityDetail('Redis 缓存统一设置 30 秒过期。', 'Redis 缓存统一设置 30 秒过期。过期之后直接回源查询并把回源结果写回缓存，缓存击穿时用互斥锁保护。')
+  assert.equal(contained.dice, 0)
+  assert.equal(contained.containment, 0.92)
+  // similarTexts stays the max of the two — the pre-existing ruler, unchanged
+  assert.equal(similarTexts('每周四凌晨部署窗口只做灰度', '每周四凌晨部署窗口只做灰度发布'), near.dice)
+  assert.equal(similarTexts('Redis 缓存统一设置 30 秒过期。', 'Redis 缓存统一设置 30 秒过期。过期之后直接回源查询并把回源结果写回缓存，缓存击穿时用互斥锁保护。'), 0.92)
+  assert.ok(dice(bigrams('缓存策略'), bigrams('缓存策略')) > 0.99)
+})
+
+test('pairFeatures: entityJaccard is 0.5 neutral when both sides are empty, 1 when identical', () => {
+  const bothEmpty = pairFeatures({ title: 'A', content: '缓存策略内容' }, { title: 'A', content: '缓存策略内容' })
+  assert.equal(bothEmpty.entityJaccard, 0.5)
+  assert.equal(bothEmpty.titleExact, true)
+  const same = pairFeatures(
+    { title: 'A', content: '缓存策略内容', appliesTo: ['Deploy', ' coding '] },
+    { title: 'A', content: '缓存策略内容', appliesTo: ['deploy', 'CODING'] },
+  )
+  assert.equal(same.entityJaccard, 1)
+  const disjoint = pairFeatures(
+    { title: 'A', content: '缓存策略内容', appliesTo: ['deploy'] },
+    { title: 'A', content: '缓存策略内容', appliesTo: ['backend'] },
+  )
+  assert.equal(disjoint.entityJaccard, 0)
+})
+
+test('pairScore: weighted sum 0.50 lexical + 0.20 token + 0.15 title + 0.15 entity', () => {
+  const features = { lexical: 1, tokenJaccard: 1, titleDice: 1, entityJaccard: 1 }
+  assert.ok(Math.abs(pairScore(features) - 1) < 1e-9)
+  assert.ok(Math.abs(pairScore({ ...features, entityJaccard: 0.5 }) - 0.925) < 1e-9)
+  // entries form is accepted too
+  const entryScore = pairScore(
+    { title: '缓存策略', content: '缓存策略内容一致', appliesTo: ['x'] },
+    { title: '缓存策略', content: '缓存策略内容一致', appliesTo: ['x'] },
+  )
+  assert.ok(entryScore > 0.95)
+})
+
+// —— §4.2 pairDecision ——
+
+const base = { track: 'memory', domain: 'general', title: '缓存策略', content: 'Redis 缓存统一 30 秒过期', appliesTo: [] }
+
+test('pairDecision: different track is always none, even at identical text', () => {
+  const b = { ...base, track: 'skill' }
+  assert.equal(pairDecision(base, b), 'none')
+})
+
+test('pairDecision: cross-domain links only at >=0.65, never absorbs, rp<->coding never links', () => {
+  const same = { ...base, domain: 'coding', title: '缓存策略', content: 'Redis 缓存统一 30 秒过期，额外上下文让分数降下来一些' }
+  const d = pairDecision(base, same)
+  assert.ok(['link', 'none'].includes(d), `cross-domain must be link/none, got ${d}`)
+  const coding = { ...base, domain: 'coding' }
+  const rp = { ...base, domain: 'rp', title: '缓存策略', content: 'Redis 缓存统一 30 秒过期' }
+  assert.equal(pairDecision(coding, rp), 'none', 'rp and coding never link')
+})
+
+test('pairDecision: same-title different-body is conflict; identical text is duplicate', () => {
+  const different = { ...base, title: '缓存策略', content: '缓存全部走内存队列，不落 Redis' }
+  assert.equal(pairDecision(base, different), 'conflict')
+  assert.equal(pairDecision(base, { ...base }), 'duplicate')
+})
+
+test('pairDecision: band boundaries 0.90/0.82/0.55 come from the policy table', () => {
+  const probe = (tweakA, tweakB) => {
+    const a = { ...base, ...tweakA }
+    const b = { ...base, ...tweakB }
+    return { score: pairScore(pairFeatures(a, b)), decision: pairDecision(a, b) }
+  }
+  // construct scores inside each band by mixing known-similar/known-different text
+  const absorbish = probe(
+    { content: 'Redis 缓存统一设置 30 秒过期，命中直接返回' },
+    { content: 'Redis 缓存统一设置 30 秒过期，命中直接返回数据' },
+  )
+  assert.ok(absorbish.score >= 0.82 && absorbish.score < 0.90, `expected absorb band, got ${absorbish.score}`)
+  assert.equal(absorbish.decision, 'absorb')
+})
+
+// —— §4.3 rankPairCandidates ——
+
+function bigCorpus({ withTarget = true } = {}) {
+  // 301 fillers push the corpus past the exact-pair limit → blocking only.
+  const entries = []
+  for (let i = 1; i <= 301; i++) {
+    entries.push({
+      id: `filler-${i}`,
+      track: 'memory',
+      domain: 'filler',
+      title: `填充条目 ${i}`,
+      content: `这是第 ${i} 条填充记忆，用于撑大语料规模，内容彼此不同填充。`,
+      updatedAt: '2026-01-01T00:00:00.000Z',
+    })
+  }
+  if (withTarget) {
+    entries.push({ id: 'target', track: 'memory', domain: 'general', title: '缓存过期', content: 'Redis 缓存统一设置 30 秒过期，命中直接返回，不做全量。', appliesTo: ['deploy'], updatedAt: '2026-01-02T00:00:00.000Z' })
+    entries.push({ id: 'title-only', track: 'memory', domain: 'general', title: '缓存过期', content: '完全不同的词汇组织起来的另一段内容。', updatedAt: '2026-01-03T00:00:00.000Z' })
+    entries.push({ id: 'single-token', track: 'memory', domain: 'elsewhere', title: '项目排期', content: '安排下季度的路线图评审。', updatedAt: '2026-01-04T00:00:00.000Z' })
+  }
+  return buildCorpus(entries)
+}
+
+test('rankPairCandidates: blocking finds the shared-token target in a >300 corpus', () => {
+  const corpus = bigCorpus()
+  assert.ok(corpus.size > 300, 'corpus must exceed the exact-pair limit')
+  const proposal = { id: 'p', track: 'memory', domain: 'general', title: '缓存过期', content: 'Redis 缓存统一设置 30 秒过期，命中直接返回。', appliesTo: ['deploy'] }
+  const found = rankPairCandidates({ corpus, proposal, limit: 20 })
+  const ids = found.map((c) => c.id)
+  assert.ok(ids.includes('target'), `shared >=2 rare tokens must block, got ${ids.join(',')}`)
+  const target = found.find((c) => c.id === 'target')
+  assert.ok(['duplicate', 'absorb'].includes(target.decision), `same-fact band decision, got ${target.decision}`)
+  assert.ok(target.score >= 0.82)
+})
+
+test('rankPairCandidates: exact-title entries enter even without shared tokens', () => {
+  const corpus = bigCorpus()
+  const proposal = { id: 'p', track: 'memory', domain: 'general', title: '缓存过期', content: '完全无重叠词元的新内容组合安排。', appliesTo: [] }
+  const found = rankPairCandidates({ corpus, proposal, limit: 20 })
+  assert.ok(found.some((c) => c.id === 'title-only'))
+})
+
+test('rankPairCandidates: a one-shared-token candidate outside the proposal domain stays out', () => {
+  const corpus = bigCorpus()
+  const proposal = { id: 'p', track: 'memory', domain: 'general', title: '缓存过期', content: '完全无重叠词元的新内容组合安排。', appliesTo: [] }
+  const found = rankPairCandidates({ corpus, proposal, limit: 20 })
+  // 'single-token' shares exactly one rare token (安排) with the proposal and
+  // sits in a different domain: blocking needs >=2 shared tokens and the
+  // same-domain backfill never reaches a foreign domain.
+  assert.ok(!found.some((c) => c.id === 'single-token'))
+})
+
+test('rankPairCandidates: small corpora score every same-track entry and rank the partner first', () => {
+  const corpus = buildCorpus([
+    { id: 'partner', track: 'memory', domain: 'general', title: '部署窗口约定', content: '每周四凌晨两点到四点是固定的部署窗口，窗口内只允许灰度发布。', appliesTo: ['deploy'] },
+    { id: 'other', track: 'memory', domain: 'general', title: '咖啡偏好', content: '用户下午的咖啡只喝美式，上午喝拿铁。', appliesTo: [] },
+  ])
+  const proposal = { id: 'p', track: 'memory', domain: 'general', title: '部署窗口约定', content: '每周四凌晨两点到四点是固定部署窗口，窗口里只允许灰度发布操作。', appliesTo: ['deploy'] }
+  const found = rankPairCandidates({ corpus, proposal, limit: 20 })
+  assert.equal(found[0].id, 'partner')
+  assert.equal(found[0].decision, 'absorb')
+  assert.ok(found.some((c) => c.id === 'other'), 'same-domain backfill keeps the weak partner visible')
+})
+
+test('rankPairCandidates: deterministic — same input, same output', () => {
+  const corpus = bigCorpus()
+  const proposal = { id: 'p', track: 'memory', domain: 'general', title: '缓存过期', content: 'Redis 缓存统一设置 30 秒过期。', appliesTo: [] }
+  const run1 = rankPairCandidates({ corpus, proposal, limit: 20 })
+  const run2 = rankPairCandidates({ corpus, proposal, limit: 20 })
+  assert.deepEqual(run1, run2)
+})
+
+// —— §4.8 全局冲突预筛 ——
+
+test('globalConflictCheck: same title + different body is same_title; negation flips conflict', () => {
+  const a = { title: '缓存策略', content: 'Redis 缓存统一设置 30 秒过期' }
+  const b = { title: '缓存策略', content: '缓存全部走内存队列不落 Redis' }
+  assert.equal(globalConflictCheck(a, b), 'same_title')
+  // different titles (so same_title cannot fire first) + one side negated
+  const c = { title: '告警偏好', content: '用户希望每次部署失败都发告警通知' }
+  const d = { title: '告警设置', content: '用户不希望每次部署失败都发告警通知' }
+  assert.equal(globalConflictCheck(c, d), 'negation')
+  assert.equal(negationPolarity('不发告警'), true)
+  assert.equal(negationPolarity('每次都发告警'), false)
+})
+
+test('globalConflictCheck: differing numbers on similar titles raise value, containment exempts', () => {
+  const a = { title: '备份保留', content: '备份保留 14 天后轮转删除' }
+  const b = { title: '备份保留期', content: '备份保留 90 天后轮转删除' }
+  assert.equal(numericSetsDiffer(a.content, b.content), true)
+  assert.equal(globalConflictCheck(a, b), 'value')
+  const superset = { title: '备份保留', content: '备份保留 14 天后轮转删除，删除前先校验快照完整性' }
+  const detail = globalConflictCheck(a, superset)
+  assert.notEqual(detail, 'value', 'a long refinement of the same fact is not a value conflict')
+})

package/tests/curator-probe.test.mjs

@@ -296,7 +296,7 @@ test('six channels, layer by layer: transcript -> prompt -> simulated output ->
   const prompt = captured.request.prompt[0].text
   assert.match(prompt, /全局记忆提炼任务/)
   const input = promptInput(prompt)
-  assert.deepEqual(Object.keys(input).sort(), ['existing_global_index', 'sessions'])
+  assert.deepEqual(Object.keys(input).sort(), ['candidate_clusters', 'clusters_truncated', 'existing_global_index', 'index_truncated', 'sessions'])
   assert.equal(input.sessions.length, 1)
   assert.deepEqual(
     Object.keys(input.sessions[0]).sort(),
@@ -336,15 +336,23 @@ test('six channels, layer by layer: transcript -> prompt -> simulated output ->
     CHANNELS.map((channel) => channel.layers),
   )
 
-  // The simulated model echoed only what reached the prompt: four transcript
-  // channels plus the two visible existing-index entries.
-  assert.equal(job.result.created, 6)
-  for (const key of ['user', 'assistant', 'toolArgs', 'recallSecret', 'existing', 'pending']) {
+  // The simulated model echoed what reached the prompt: four transcript channels
+  // commit as active; the two index-only echoes (existing/pending never entered the
+  // transcript) fail evidence grounding and are held for review — §4.6 的防幻觉
+  // 门槛正是为这种情况设计的：prompt 里见过 ≠ 转录里说过。
+  assert.equal(job.result.created, 4)
+  for (const key of ['user', 'assistant', 'toolArgs', 'recallSecret']) {
     const entry = Object.values(loadGlobalIndex().entries).find((item) => item.title === 'Copied ' + key)
     assert.ok(entry, 'expected a committed entry copied from ' + key)
     assert.equal(entry.status, 'active')
     assert.match(entry.content, new RegExp(M[key]))
   }
+  for (const key of ['existing', 'pending']) {
+    const held = Object.values(loadGlobalIndex().entries).find((item) => item.title === 'Copied ' + key)
+    assert.ok(held, 'expected the index-only echo to be held, not committed')
+    assert.equal(held.status, 'pending_review')
+    assert.match(held.reviewReason, /missing evidence/)
+  }
   const secretEntry = Object.values(loadGlobalIndex().entries).find((item) => item.title === 'Copied recallSecret')
   assert.match(JSON.stringify(secretEntry.evidence), new RegExp(M.recallSecret))
   for (const key of ['secretAuto', 'recallPlain', 'toolTail', 'archived', 'modelOnly', 'invalidDomain']) {
@@ -391,7 +399,8 @@ test('commit accepts model output without provenance or secret filtering', async
         op: 'create', domain: 'general', track: 'memory', title: 'Credential shaped',
         content: 'api key: ' + M.credential,
         confidence: 0.9,
-        evidence: [{ session_id: 'probe-session', quote: 'q' }],
+        // 1 字 quote 不满足 grounding 的 ≥6 字门槛（§4.6）——加长，测试意图不变。
+        evidence: [{ session_id: 'probe-session', quote: 'credential quote for grounding' }],
       },
     ],
   }

package/tests/curator-review-mode.test.mjs

@@ -0,0 +1,314 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { registerHooks } from 'node:module'
+
+// Package A (spec §6.1): curator review mode + risk score + input fixes.
+//
+// One entry of `memories` must land in exactly one of three states — active
+// (committed), pending_review (index-only, held), or skipped — and the
+// decision must follow §4.10: hard gates (conflict / missing evidence /
+// invalid rewrite target) are pending in BOTH modes, `auto` passes clean
+// creates and passes rewrites below the 0.70 risk threshold, `review-all`
+// holds every content op. Unknown ops and invalid merge targets are skipped
+// and never degrade into a create (the §0.2 bug).
+//
+// Same hermetic pattern as tests/curator-commit.test.mjs: './memu.js' is
+// replaced before production modules load; everything else is the real module
+// stack against a temp DSH_MEMU_HOME. Default settings keep the vector route
+// lexical, so nothing here talks to an engine.
+const home = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-memu-curator-review-'))
+process.env.DSH_MEMU_HOME = home
+process.env.DSH_MEMU_MEMORY_HOME = home
+
+globalThis.__curatorReviewTest = {
+  async commit() { return { ok: true } },
+  async forget() { return { deleted: 1, segments: 1 } },
+  async retrieve() { return { files: [], segments: [], resources: [], raw: null } },
+  async listFiles() { return { recall_files: [], resources: [], raw: null } },
+}
+
+const memuSource = 'const bridge = globalThis.__curatorReviewTest;'
+  + 'export const commit = (args) => bridge.commit(args), forget = (args) => bridge.forget(args),'
+  + 'retrieve = (args) => bridge.retrieve(args), listFiles = (args) => bridge.listFiles(args);'
+const hooks = registerHooks({
+  resolve(specifier, context, nextResolve) {
+    if (specifier === './memu.js') return { url: 'data:text/javascript,' + encodeURIComponent(memuSource), shortCircuit: true }
+    return nextResolve(specifier, context)
+  },
+})
+
+const curator = await import('../lib/curator.js')
+const state = await import('../lib/state.js')
+const rpc = await import('../lib/rpc.js')
+
+test.after(async () => {
+  try { hooks.unregister?.() } catch {}
+  try { fs.rmSync(home, { recursive: true, force: true }) } catch {}
+})
+
+const TARGET = 'gmem-target'
+const TARGET_ENTRY = {
+  track: 'memory', domain: 'general', title: '部署窗口约定',
+  content: '每周四凌晨两点到四点是固定的部署窗口，窗口内只允许灰度发布。',
+  confidence: 0.9, status: 'active',
+  createdAt: '2026-01-01T00:00:00.000Z', updatedAt: '2026-01-01T00:00:00.000Z',
+  evidence: [{ sessionId: 'old', quote: 'old quote' }],
+}
+
+function seedGlobalIndex(entries = {}) {
+  state.saveGlobalIndex({ version: 1, entries: structuredClone(entries) })
+}
+
+// Every test sets the mode it means to exercise; nothing relies on leftover
+// settings from a previous case.
+function setMode(mode) {
+  state.updateSettings({ curatorReviewMode: mode })
+}
+
+const cleanCreate = (over = {}) => ({
+  op: 'create', domain: 'general', track: 'memory',
+  title: '独立的全新事实',
+  content: '用户倾向于在正式汇报里先给结论再给细节。',
+  confidence: 0.9,
+  evidence: [
+    { session_id: 's1', quote: '先说结论再说细节' },
+    { session_id: 's2', quote: '汇报的时候结论在前' },
+  ],
+  ...over,
+})
+
+function entryOf(index, predicate) {
+  return Object.values(index.entries).find(predicate) || null
+}
+
+test('auto + clean create with two evidence lands active with reviewRisk 0', async () => {
+  seedGlobalIndex({})
+  setMode('auto')
+  const result = await curator.commitCuratorOutput({ memories: [cleanCreate()] }, { job: { step: 'committing' } })
+  assert.equal(result.created, 1)
+  assert.equal(result.pending, 0)
+  assert.equal(result.files.length, 1)
+  // The risk summary is part of the contract: every written entry is counted.
+  assert.deepEqual(result.reviewRisk, { max: 0, flagged: 0, reasons: {} })
+  const index = state.loadGlobalIndex()
+  const entry = entryOf(index, (e) => e.title === '独立的全新事实')
+  assert.ok(entry, 'the create must land in the index')
+  assert.equal(entry.status, 'active')
+  assert.equal(entry.reviewRisk, 0)
+  assert.deepEqual(entry.reviewRiskReasons, [])
+})
+
+test('auto + create with needs_review still lands active; the flag only feeds the risk score', async () => {
+  seedGlobalIndex({})
+  setMode('auto')
+  const result = await curator.commitCuratorOutput({
+    memories: [cleanCreate({ needs_review: true, review_reason: '一次口误，证据偏薄' })],
+  }, { job: { step: 'committing' } })
+  assert.equal(result.created, 1, 'auto passes a flagged create by default')
+  const entry = entryOf(state.loadGlobalIndex(), (e) => e.title === '独立的全新事实')
+  assert.equal(entry.status, 'active')
+  // needs_review 0.70 + review_reason 0.20 + single-evidence 0.10 was avoided by
+  // passing two evidence items, so 0.70 + 0.20 = 0.90 exactly.
+  assert.equal(entry.reviewRisk, 0.9)
+  assert.ok(entry.reviewRiskReasons.includes('needs_review'))
+  assert.ok(entry.reviewRiskReasons.includes('review_reason'))
+  assert.equal(entry.reviewReason, undefined, 'an active entry carries no reviewReason')
+  assert.equal(result.reviewRisk.flagged, 1, 'the >=0.70 entry is flagged in the summary')
+  assert.equal(result.reviewRisk.max, 0.9)
+})
+
+test('auto + create with confidence 0.4 still lands active; low confidence only raises the risk score', async () => {
+  seedGlobalIndex({})
+  setMode('auto')
+  const result = await curator.commitCuratorOutput({
+    memories: [cleanCreate({ confidence: 0.4 })],
+  }, { job: { step: 'committing' } })
+  assert.equal(result.created, 1)
+  const entry = entryOf(state.loadGlobalIndex(), (e) => e.title === '独立的全新事实')
+  assert.equal(entry.status, 'active')
+  assert.equal(entry.reviewRisk, 0.7, 'confidence<0.50 is +0.70; the two evidence items avoid the single-evidence bump')
+  assert.ok(entry.reviewRiskReasons.includes('confidence<0.50'))
+})
+
+test('auto + merge with needs_review is held pending', async () => {
+  seedGlobalIndex({ [TARGET]: TARGET_ENTRY })
+  setMode('auto')
+  const result = await curator.commitCuratorOutput({
+    memories: [{
+      op: 'merge', domain: 'general', track: 'memory', target_id: TARGET,
+      title: '部署窗口的合并版本',
+      content: '每周四凌晨两点到四点是固定的部署窗口，窗口内只允许灰度发布，全量要等监控确认。',
+      confidence: 0.9, needs_review: true, review_reason: '模型标记待复核',
+      evidence: [{ session_id: 's3', quote: '部署窗口只在周四凌晨' }],
+    }],
+  }, { job: { step: 'committing' } })
+  assert.equal(result.merged, 0, 'a held merge is not counted as merged')
+  assert.equal(result.pending, 1)
+  assert.equal(result.files.length, 0, 'pending entries are never committed to the vector store')
+  const index = state.loadGlobalIndex()
+  const held = entryOf(index, (e) => e.status === 'pending_review')
+  assert.ok(held, 'the merge must be held for review')
+  assert.equal(held.conflictingWith, TARGET)
+  // non-hard pending: the model's own reason wins over the generic fallback.
+  assert.equal(held.reviewReason, '模型标记待复核')
+  assert.equal(held.reviewRisk, 1.2, 'needs_review 0.70 + merge 0.20 + review_reason 0.20 + single evidence 0.10')
+  assert.equal(index.entries[TARGET].status, 'active', 'a held merge never touches the target')
+})
+
+test('auto + conflict is pending in both modes with the hard reason', async () => {
+  seedGlobalIndex({ [TARGET]: TARGET_ENTRY })
+  setMode('auto')
+  const result = await curator.commitCuratorOutput({
+    memories: [{
+      op: 'conflict', domain: 'general', track: 'memory', target_id: TARGET,
+      title: '部署窗口的两个说法', content: '两个会话对部署窗口的说法不一致。',
+      confidence: 0.9,
+      evidence: [{ session_id: 's4', quote: '部署窗口是周四' }, { session_id: 's5', quote: '部署窗口是周五' }],
+    }],
+  }, { job: { step: 'committing' } })
+  assert.equal(result.pending, 1)
+  assert.equal(result.created, 0)
+  const held = entryOf(state.loadGlobalIndex(), (e) => e.status === 'pending_review')
+  assert.ok(held, 'a conflict is always held')
+  assert.equal(held.reviewReason, 'conflict')
+  assert.equal(held.reviewRisk, 2)
+  assert.deepEqual(held.reviewRiskReasons, ['conflict'])
+  assert.equal(held.conflictingWith, TARGET)
+})
+
+test('auto + missing evidence is pending with the hard reason', async () => {
+  seedGlobalIndex({})
+  setMode('auto')
+  const result = await curator.commitCuratorOutput({
+    memories: [{ op: 'create', domain: 'general', track: 'memory', title: '没有证据的说法', content: '模型没给引用。', confidence: 0.9 }],
+  }, { job: { step: 'committing' } })
+  assert.equal(result.created, 0)
+  assert.equal(result.pending, 1)
+  const held = entryOf(state.loadGlobalIndex(), (e) => e.status === 'pending_review')
+  assert.ok(held)
+  assert.equal(held.reviewReason, 'missing evidence')
+  assert.equal(held.reviewRisk, 2)
+})
+
+test('review-all holds even a clean create', async () => {
+  seedGlobalIndex({})
+  setMode('review-all')
+  const result = await curator.commitCuratorOutput({ memories: [cleanCreate()] }, { job: { step: 'committing' } })
+  assert.equal(result.created, 0)
+  assert.equal(result.pending, 1)
+  const held = entryOf(state.loadGlobalIndex(), (e) => e.status === 'pending_review')
+  assert.ok(held)
+  // Not a hard gate and the model gave no reason: the generic threshold note.
+  assert.equal(held.reviewReason, 'risk threshold')
+  assert.equal(held.reviewRisk, 0, 'a clean hold carries risk 0, the mode alone caused the hold')
+})
+
+test('merge with a nonexistent target is skipped and never degrades into a create', async () => {
+  seedGlobalIndex({ [TARGET]: TARGET_ENTRY })
+  setMode('auto')
+  const result = await curator.commitCuratorOutput({
+    memories: [{
+      op: 'merge', domain: 'general', track: 'memory', target_id: 'gmem-missing',
+      title: '没有落点的合并', content: '这段内容绝不能变成一条新记忆。',
+      confidence: 0.9,
+      evidence: [{ session_id: 's6', quote: '合并的目标丢了' }],
+    }],
+  }, { job: { step: 'committing' } })
+  assert.equal(result.created, 0, 'the §0.2 bug: a skipped merge must not continue as a create')
+  assert.equal(result.merged, 0)
+  assert.equal(result.pending, 0)
+  assert.equal(result.files.length, 0)
+  assert.equal(result.skipped.length, 1)
+  assert.match(result.skipped[0].reason, /target not found: gmem-missing/)
+  const index = state.loadGlobalIndex()
+  assert.equal(entryOf(index, (e) => e.title === '没有落点的合并'), null, 'no new entry was written')
+  assert.deepEqual(Object.keys(index.entries), [TARGET], 'the index gained nothing')
+})
+
+test('an unknown op is skipped instead of being forced into a create', async () => {
+  seedGlobalIndex({})
+  setMode('auto')
+  const result = await curator.commitCuratorOutput({
+    memories: [
+      { op: 'frobnicate', domain: 'general', track: 'memory', title: '未知操作', content: '模型写错了 op 名。', confidence: 0.9, evidence: [{ session_id: 's7', quote: '未知' }] },
+      // link 在 当前版本已进 OPS_ALLOWLIST（F1 落地），不再是 unknown op 的代表；
+      // 这里改用真正不在名单里的 op，测试意图不变：未知 op 不得默认 create。
+      { op: 'delete', domain: 'general', track: 'memory', title: '未接线的关联', content: '模型写错了另一个 op 名。', confidence: 0.9, evidence: [{ session_id: 's8', quote: '删除操作的原话记录' }] },
+    ],
+  }, { job: { step: 'committing' } })
+  assert.equal(result.created, 0, 'unknown ops must not default to create')
+  assert.equal(result.skipped.length, 2)
+  assert.ok(result.skipped.every((item) => /unknown op/.test(item.reason)))
+  assert.deepEqual(Object.keys(state.loadGlobalIndex().entries), [], 'nothing was written')
+})
+
+test('setSettings rejects a bogus curatorReviewMode and accepts review-all', async () => {
+  await assert.rejects(
+    () => rpc.dispatch({}, 'setSettings', { patch: { curatorReviewMode: 'bogus' } }),
+    /invalid setting/,
+    'the enum gate must reject unknown modes',
+  )
+  const accepted = await rpc.dispatch({}, 'setSettings', { patch: { curatorReviewMode: 'review-all' } })
+  assert.equal(accepted.curatorReviewMode, 'review-all', 'the allowlisted mode persists')
+  setMode('auto')
+})
+
+test('entries written before this version carry no reviewRisk and still read cleanly', async () => {
+  seedGlobalIndex({ [TARGET]: TARGET_ENTRY })
+  setMode('auto')
+  const result = await curator.commitCuratorOutput({
+    memories: [{
+      op: 'supersede', domain: 'general', track: 'memory', target_id: TARGET,
+      title: '部署窗口的替代版本', content: '部署窗口调整为周四凌晨的整段灰度时段。',
+      confidence: 0.92,
+      evidence: [{ session_id: 's9', quote: '窗口改成周四凌晨' }, { session_id: 's10', quote: '整段灰度时段一次性放开' }],
+    }],
+  }, { job: { step: 'committing' } })
+  assert.equal(result.superseded, 1)
+  const index = state.loadGlobalIndex()
+  const oldEntry = index.entries[TARGET]
+  assert.ok(oldEntry, 'the old entry is still there (superseded, never deleted)')
+  assert.equal(Object.hasOwn(oldEntry, 'reviewRisk'), false, 'the old entry keeps its old shape')
+  assert.equal(Object.hasOwn(oldEntry, 'reviewRiskReasons'), false)
+  assert.equal(oldEntry.status, 'superseded')
+  // Reading the mixed index through the default-value convention must not throw.
+  for (const entry of Object.values(index.entries)) {
+    assert.equal(typeof (entry.reviewRisk ?? 0), 'number')
+    assert.ok(Array.isArray(entry.reviewRiskReasons ?? []))
+  }
+  const fresh = entryOf(index, (e) => e.status === 'active')
+  assert.ok(fresh, 'the replacement landed active (risk 0.20 < 0.70)')
+  assert.equal(fresh.reviewRisk, 0.2, 'supersede adds 0.20; two evidence items avoid the single-evidence bump')
+})
+
+test('reviewDecision unit: absorb risk and skip reasons follow §4.10 verbatim', () => {
+  const index = { entries: { 'gmem-a': { status: 'active' } } }
+  // absorb with >3 sources: +0.20; clean otherwise → auto passes at 0.20.
+  const absorb = curator.reviewDecision({
+    m: { confidence: 0.9, source_ids: ['a', 'b', 'c', 'd'] },
+    op: 'absorb', evidence: [{ session_id: 's', quote: 'q' }, { session_id: 's2', quote: 'q2' }],
+    targetId: 'gmem-a', index, mode: 'auto',
+  })
+  assert.equal(absorb.review, false)
+  assert.equal(absorb.risk, 0.2)
+  assert.ok(absorb.reasons.includes('absorb>3 sources'))
+  // absorb with a missing target is a skip, never a pending.
+  const noTarget = curator.reviewDecision({
+    m: { confidence: 0.9 }, op: 'absorb',
+    evidence: [{ session_id: 's', quote: 'q' }],
+    targetId: '', index, mode: 'auto',
+  })
+  assert.equal(noTarget.skip, true)
+  assert.match(noTarget.reason, /target not found: \(empty\)/)
+  // Hard gates cap at risk 2 regardless of mode.
+  const conflictReviewAll = curator.reviewDecision({
+    m: {}, op: 'conflict', evidence: [{ session_id: 's', quote: 'q' }],
+    targetId: 'gmem-a', index, mode: 'review-all',
+  })
+  assert.equal(conflictReviewAll.review, true)
+  assert.equal(conflictReviewAll.risk, 2)
+  assert.equal(conflictReviewAll.hard, true)
+})

package/tests/disclosure.test.mjs

@@ -90,7 +90,8 @@ test('a secret stays out of the anchor but is still reachable through recall', a
   assert.equal(anchor.text.includes('PINNED-SECRET-BODY'), false, 'pinning does not override secrecy')
   assert.equal(anchor.text.includes(secretId), false)
   assert.equal(anchor.text.includes(pinnedSecretId), false)
-  assert.ok(anchor.text.includes('SHARED-BODY'), 'ordinary memories still show up')
+  assert.ok(anchor.text.includes('deploy window'), 'ordinary memories still show up as title cards')
+  assert.equal(anchor.text.includes('SHARED-BODY'), false, 'the anchor never carries the body')
 
   const recalled = await memory.privateRecall({ exec, query: 'leave company diagnosis deploy window', topK: 5, relevanceThreshold: 0 })
   assert.ok(recalled.files.some((file) => file.name === secretId), 'a secret is a recall target, not a hidden row')