preInjectGate 注入前判定：意见/立场记忆先判定后处置（#380，opt-in 默认关） - #382

No actionable comments were generated in the recent review. 🎉

sequenceDiagram
  participant Injector
  participant PreInjectGate
  participant LLM
  participant Service
  Injector->>PreInjectGate: 提交查询与候选池
  PreInjectGate-->>Injector: 缓存未命中，当前帧原样处理
  PreInjectGate-)LLM: 后台提交池级判定
  LLM-->>PreInjectGate: 返回判定结果
  PreInjectGate->>Service: 写入判定审计
  Injector->>PreInjectGate: 后续帧读取相同缓存键
  PreInjectGate-->>Injector: 返回缓存判定状态与标记 ID

Merge Risk: ⚪ Minimal · up to 87f73

No confirmed issue blocks merging. Changes to the gate’s feature flags take effect after a plugin restart, as intended.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 87f73

Default-off behavior limits exposure. When enabled, request details may enter broadly readable diagnostic records, and specially crafted content may reuse a decision made for different content. Deployment access restrictions and adversarial-input handling remain partly unverified.

Retained concerns

• Medium · security · inferred: The new judgment receives the current request and memory content, then persists an unrestricted free-text reason, truncated to 300 characters. The existing audit API returns that metadata without the configured API-token check or session filtering. Reasons could therefore disclose request details to readers outside the originating session. The endpoint and public memory reads predate this PR; the concern is the new request-derived explanatory data, not newly introduced endpoint exposure. Actual external accessibility depends on unverified host controls.
• Medium · security · inferred: Verdict identity concatenates candidate IDs and content using unescaped delimiters. If content contains U+0001 and a candidate-ID prefix, distinct two-memory content assignments can serialize identically while retaining the same IDs and pool size. Enforcement could then reuse the old flagged-ID set against changed content, defeating the intended content-change invalidation. This is a new cache-integrity weakness; end-to-end delimiter preservation and attacker control of the necessary mutations remain unverified.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

Codecov Report

❌ Patch coverage is 98.45815% with 7 lines in your changes missing coverage. Please review.

📢 Thoughts on this report? Let us know!

已按评审推了加固提交（25e8944 + 87f7323），四个行为面：

1. 记账纪律：判定与滤除原来在 injectCandidates 返回之后（inject.js 侧）做，被滤掉的记忆照样刷温时钟、照样落 mode='inject' 曝光账——反馈环会把闸门想压下的意见记忆重新顶上来。现由 gate 入参在 service.injectCandidates 内、touchRecalled 之前消费（与 strictScope 同纪律），recall_runs 的「实际注入集」只吃滤后集合；帧状态经 gateStats 出参回给注入器做面板快照（不动「返回数组」契约，不传 gate 的检索侧/独立服务调用逐字节等于改前）。
2. 审计无条件落：条件里去掉 && modelId，无默认模型路由时 model_id 落 unknown 占位（summarize.js 同款）；session_key 不再写（该列语义是 write-admission 的话题回填键，写进去会挤占 TOPIC_LOOKBACK_ROWS 窗口）。
3. 黑屏保护：整池被标记时放弃本帧 enforce（fail-open）并 warn 一次——记忆正文可影响判定模型，一条指令型记忆不该把整个记忆块打成空白；该形态在审计里就是 n_flagged == n_pool，判定与审计按原样保留。
4. 资源护栏：连续降级熔断（连坏 3 次停判一个冷却期，到期自动恢复）、宿主不守取消契约的悬挂流也计入熔断（冷却按 key，跨 key 只能靠熔断兜）、缓存命中刷新序改 LRU、clear() 后置 disposed 且在飞结果不回写、超时宽限定时器显式 clear、cooldownMs / settleGraceMs 可注入（测试用，默认值不变）。

测试 13 → 21 个用例，新增 8 条回归锁（记账纪律 / 熔断 / 跨 key 悬挂流 / llmAudit 关不运行 / 无路由仍落账 / 整池标记 fail-open / dispose 不回写 / 缓存命中刷新序）；超时类用例改为轮询落账行，不再真等 2.3s。文档（CONFIGURATION.md 降级段 / CHANGELOG #380 条目 / README 行）同步。

验证：npm run badge:sync 内部全量 npm test 通过（1582 tests / 0 fail），徽章随之刷新；node scripts/check-sync.js 报 src/ 与 lib/ 一致（55 文件）。

pin 池是否也受判仍是未定项（本分支按 #249 逐字保真豁免，见 #381 的关闭说明），不影响本次合并。