review: 前端 409 也按 error_code 判别，GET 读后补一次身份校验

Codex 两条，核实后都成立。

1. 我上一轮只在后端区分了 409 来源，前端 `_saveCharacterLanguagePreference`
   仍是无条件 `response.status === 409`。主服务端的 main_storage_limited_mode_guard
   对未白名单路径（本路由不在白名单）与 MaintenanceModeError 同样返 409，此时
   前端会宣告「被更新的偏好取代」并去重新水合，水合再失败就既不回滚也不报错，
   留下一个未持久化的选中值。改为只认 error_code=language_preference_superseded，
   其余 409 落到原有失败路径（回滚 + 报错）。

2. GET 去掉锁之后，`_load_existing_character` 通过到 memory server 读返回之间，
   角色可能被别的窗口删除/改名，端点仍会为已不存在的名字返回 200；进行中的卡片
   管理器水合可能在删除清理之后用这个陈旧响应重填 per-name 语言缓存，被后续复用
   的同名角色继承。读后补一次身份校验。

守卫：新增 tests/unit/test_language_preference_conflict_frontend.py，用 node
harness 跑真实的 _saveCharacterLanguagePreference 源码（分支行为静态断言抓不到），
覆盖 superseded / 存储受限 / 维护围栏 / 无 code 四种 409 与成功路径，并钉住三处
error_code 字面量一致。后端补
test_language_preference_get_revalidates_after_the_unlocked_read。两条均做变异验证。

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: wehos

main_routers/characters_router/language_preference.py

@@ -382,6 +382,12 @@ async def get_character_language_preference(name: str):
         # no longer leave an empty old-name directory behind.
         await _load_existing_character(name)
         payload = await _request_memory_prompt_locale("GET", name)
+        # Dropping the lock also dropped the guarantee that the character still
+        # exists once the read returns.  Without a second check this would answer
+        # 200 for a name deleted mid-read, and an in-flight card-manager
+        # hydration could repopulate that name's local language cache after the
+        # deletion cleanup -- which a later reuse of the same name would inherit.
+        await _load_existing_character(name)
         ui_language = await aload_ui_language_override()
         payload["effective_language"] = (
             payload.get("language")

static/js/character_card_manager/card-form-and-actions.js

@@ -219,7 +219,15 @@ async function _saveCharacterLanguagePreference(name, select, selectUi) {
         // A cross-window event or a newer local request may have superseded this
         // response while it was in flight. Never roll back or cache stale data.
         if (select.dataset.languageSaveId !== saveId || select.value !== language) return;
-        if (response.status === 409) {
+        // Only this endpoint's causal-order conflict means "re-read the state".
+        // Both servers also answer 409 for storage-limited startup and for the
+        // cloudsave maintenance fence; those persisted nothing, so they must
+        // fall through to the failure path below (roll back + report) instead
+        // of leaving an unsaved selection on screen.
+        if (
+            response.status === 409
+            && payload.error_code === 'language_preference_superseded'
+        ) {
             // Designed race, not a failure: another window persisted a newer
             // preference. Rolling back to this window's previous value would
             // display a locale that is already stale, so re-read durable state.

tests/unit/test_language_preference_conflict_frontend.py

@@ -0,0 +1,158 @@
+"""The card manager must only treat this endpoint's own 409 as superseded.
+
+Both servers answer 409 for storage-limited startup and for the cloudsave
+maintenance fence too. Those persisted nothing, so announcing "a newer
+preference won" and re-hydrating would leave an unsaved selection on screen.
+
+Driven through the real ``_saveCharacterLanguagePreference`` source rather than
+asserted statically: the distinction lives in a branch, and a static check
+cannot tell which path a given payload actually takes.
+"""
+
+import json
+import re
+import shutil
+import textwrap
+from pathlib import Path
+
+import pytest
+
+from tests.node_harness import run_node_script
+
+
+PROJECT_ROOT = Path(__file__).resolve().parents[2]
+SOURCE = (
+    PROJECT_ROOT
+    / "static"
+    / "js"
+    / "character_card_manager"
+    / "card-form-and-actions.js"
+)
+
+
+@pytest.fixture(scope="module")
+def node_path():
+    executable = shutil.which("node")
+    if not executable:
+        pytest.skip("node is required for browser runtime harnesses")
+    return executable
+
+
+def _extract_function(name: str) -> str:
+    source = SOURCE.read_text(encoding="utf-8")
+    start = source.find(f"async function {name}(")
+    assert start >= 0, f"{name} 已改名，请同步更新测试"
+    depth = 0
+    for index in range(start, len(source)):
+        if source[index] == "{":
+            depth += 1
+        elif source[index] == "}":
+            depth -= 1
+            if depth == 0:
+                return source[start : index + 1]
+    raise AssertionError(f"{name} 括号不平衡")
+
+
+def _harness(status: int, payload: dict) -> str:
+    return textwrap.dedent(
+        """
+        const calls = [];
+        let hydrated = 0;
+
+        function _characterLanguageT(_key, fallback) { return fallback; }
+        function showMessage(text, level) { calls.push(['message', level]); }
+        async function showAlert(text) { calls.push(['alert', String(text)]); }
+        async function _hydrateCharacterLanguagePreference() { hydrated += 1; }
+        async function _characterLanguageMutationFetch() {
+          return {
+            status: __STATUS__,
+            ok: __STATUS__ >= 200 && __STATUS__ < 300,
+            async json() { return __PAYLOAD__; },
+          };
+        }
+        function _cacheCharacterLanguagePreference() { calls.push(['cache']); }
+
+        __FUNCTION__
+
+        const select = {
+          value: 'ja',
+          dataset: { previousValue: 'en' },
+          disabled: false,
+        };
+
+        _saveCharacterLanguagePreference('Mimi', select, null).then(() => {
+          console.log(JSON.stringify({
+            hydrated,
+            value: select.value,
+            previousValue: select.dataset.previousValue,
+            calls,
+          }));
+        });
+        """
+    ).replace("__FUNCTION__", _extract_function("_saveCharacterLanguagePreference")) \
+     .replace("__STATUS__", str(status)) \
+     .replace("__PAYLOAD__", json.dumps(payload))
+
+
+def _run(node_path: str, status: int, payload: dict) -> dict:
+    result = run_node_script(
+        node_path, _harness(status, payload), capture_output=True, timeout=30,
+    )
+    assert result.returncode == 0, result.stderr
+    return json.loads(result.stdout.strip().splitlines()[-1])
+
+
+def test_superseded_conflict_rehydrates_without_rolling_back(node_path):
+    outcome = _run(
+        node_path,
+        409,
+        {"success": False, "error_code": "language_preference_superseded"},
+    )
+
+    assert outcome["hydrated"] == 1
+    # The stale local value must not be restored; hydration owns the control.
+    assert outcome["value"] == "ja"
+    assert not any(call[0] == "alert" for call in outcome["calls"]), (
+        "被取代不是保存失败，不该弹错误"
+    )
+
+
+@pytest.mark.parametrize(
+    "payload",
+    [
+        {"ok": False, "error_code": "storage_startup_blocked", "limited_mode": True},
+        {"success": False, "code": "cloudsave_maintenance", "retryable": True},
+        {"success": False},
+    ],
+)
+def test_unrelated_409_rolls_back_and_reports_failure(node_path, payload):
+    outcome = _run(node_path, 409, payload)
+
+    assert outcome["hydrated"] == 0, "非 superseded 的 409 不该触发重新水合"
+    assert outcome["value"] == "en", "保存失败必须回滚到先前的值"
+    assert any(call[0] == "alert" for call in outcome["calls"]), "必须报告保存失败"
+
+
+def test_successful_save_still_caches_and_reports(node_path):
+    outcome = _run(node_path, 200, {"success": True, "language": "ja"})
+
+    assert outcome["hydrated"] == 0
+    assert outcome["value"] == "ja"
+    assert outcome["previousValue"] == "ja"
+    assert any(call[0] == "cache" for call in outcome["calls"])
+
+
+def test_frontend_conflict_code_matches_the_backend_constant():
+    """Pin the two ends of the wire contract to the same literal."""
+    frontend = SOURCE.read_text(encoding="utf-8")
+    backend = (
+        PROJECT_ROOT / "main_routers" / "characters_router" / "language_preference.py"
+    ).read_text(encoding="utf-8")
+    memory_server = (
+        PROJECT_ROOT / "app" / "memory_server" / "routes.py"
+    ).read_text(encoding="utf-8")
+
+    code = "language_preference_superseded"
+    assert re.search(rf"error_code\s*===\s*'{code}'", frontend)
+    assert f'"{code}"' in backend
+    assert f'"{code}"' in memory_server

tests/unit/test_language_preference_lock_scope.py

@@ -368,6 +368,46 @@ async def serialized(data):
     assert observed["payload"]["character_card_name"] == "Mimi"
 
 
+async def test_language_preference_get_revalidates_after_the_unlocked_read(monkeypatch):
+    """Dropping the lock dropped the "still exists when we answer" guarantee.
+
+    Without a second check the endpoint answers 200 for a name deleted while the
+    memory-server read was in flight, and an in-flight card-manager hydration
+    could repopulate that name's local cache after the deletion cleanup.
+    """
+    state = {"exists": True}
+    loads = []
+
+    async def load_character(name):
+        loads.append(name)
+        if not state["exists"]:
+            raise LookupError("角色不存在")
+        return SimpleNamespace(memory_dir="unused"), {"猫娘": {name: {}}}
+
+    async def request_locale(_method, _name, *, language=None):
+        # The character is deleted while this read is awaiting.
+        state["exists"] = False
+        return {"success": True, "language": "ja"}
+
+    monkeypatch.setattr(preference_router, "_load_existing_character", load_character)
+    monkeypatch.setattr(preference_router, "_request_memory_prompt_locale", request_locale)
+    monkeypatch.setattr(
+        preference_router, "aload_ui_language_override", lambda: _async_value("en"),
+    )
+
+    response = await preference_router.get_character_language_preference("Mimi")
+
+    assert getattr(response, "status_code", 200) == 404
+    assert loads == ["Mimi", "Mimi"], "读前读后都要校验角色身份"
+
+
+def _async_value(value):
+    async def _inner():
+        return value
+
+    return _inner()
+
+
 def test_prompt_locale_read_does_not_create_the_character_directory(tmp_path, monkeypatch):
     import utils.config_manager as config_manager_module