@furongjun1999/dsh-memory 0.4.11 → 0.5.0

package/md_cg/test_read_clip.py

@@ -1,141 +1,141 @@
-# -*- coding: utf-8 -*-
-"""md_cg · Pi⑦② read 截断 + 续读提示（_clip_text / _node_view / schema 落点）
-
-验收三件事：
-① 单次 read 返回受「2000 行 / 50KB」双阈值约束，且**不静默丢内容**——
-   截断必带 total_lines / total_bytes / next_offset / note；
-② 续读按 offset 连续取回可拼回原文（不丢不重，可裁决的等价性判据）；
-③ 小内容行为兼容——旧四键（id/path/frontmatter/content）不丢、content 原样；
-   验证态 `verification_state` 为**有意的 additive 透出**（不参与排序），
-   故 B1 断言「旧键 ⊆ 新键 ∧ 验证态在场」而非「键集逐一相等」。
-   真源：protocol.py 的 read.node.required 已把 `verification_state` 列为必需键。
-
-运行：python -m md_cg.test_read_clip
-"""
-
-import os
-import sys
-
-from .mcp_server import KERNEL_TOOLS, READ_MAX_BYTES, READ_MAX_LINES, \
-    _cg_call, _clip_text, _node_view
-
-_ok = 0
-_bad = []
-
-
-def check(name, cond, detail=""):
-    global _ok
-    if cond:
-        _ok += 1
-        print(f"  [ok] {name}" + (f"  · {detail}" if detail else ""))
-    else:
-        _bad.append(name)
-        print(f"  [FAIL] {name}  · {detail}")
-
-
-class _FakeCG:
-    """只实现 read 面所需的最小取节点契约。"""
-
-    def __init__(self, nodes):
-        self._nodes = nodes
-
-    def get(self, nid, *a, **k):
-        return self._nodes.get(nid)
-
-
-def main():
-    print("[A] _clip_text 双阈值与续读语义")
-    small = "第一行\n第二行\n第三行"
-    c = _clip_text(small)
-    check("A1 小文本原样返回（note 空串、无截断位点）",
-          c["text"] == small and c["truncated"] is False
-          and c["next_offset"] is None and c["total_lines"] == 3
-          and c["note"] == "", str(c)[:160])
-
-    many = "\n".join(f"line-{i:05d}" for i in range(READ_MAX_LINES + 500))
-    c = _clip_text(many)
-    check("A2 行数上限：超 2000 行截断且给出续读位点",
-          c["truncated"] is True and c["returned_lines"] == READ_MAX_LINES
-          and c["next_offset"] == READ_MAX_LINES + 1
-          and str(READ_MAX_LINES) in c["note"], c["note"])
-
-    wide = "\n".join("x" * 60 for _ in range(3000))   # 约定 180KB > 50KB
-    c = _clip_text(wide)
-    check("A3 字节上限生效（行未满 2000 但字节先到顶）",
-          c["truncated"] is True and c["returned_lines"] < READ_MAX_LINES
-          and len(c["text"].encode("utf-8")) <= READ_MAX_BYTES
-          and str(READ_MAX_BYTES) in c["note"], f"{c['returned_lines']}行/{c['total_bytes']}B")
-
-    # 续读拼接等价性：按 next_offset 连续取回，拼回必须与原文逐字一致
-    got, off, hops = [], 0, 0
-    while True:
-        c = _clip_text(many, offset=off)
-        got.append(c["text"])
-        hops += 1
-        if not c["truncated"]:
-            break
-        off = c["next_offset"]
-        if hops > 10:
-            break
-    check("A4 续读拼接 == 原文（不丢不重）",
-          "\n".join(got) == many and hops == 2, f"hops={hops}")
-
-    c = _clip_text("a\nb", offset=99)
-    check("A5 offset 越界：返回空并如实说明（不假装有内容）",
-          c["text"] == "" and c["truncated"] is False and "超出总行数" in c["note"],
-          c["note"])
-
-    c = _clip_text("y" * (READ_MAX_BYTES + 100))
-    check("A6 单行超字节上限也保底返回一行（不返回空）",
-          c["returned_lines"] == 1 and c["truncated"] is False
-          and len(c["text"]) == READ_MAX_BYTES + 100, str(c["returned_lines"]))
-
-    print("[B] _node_view 兼容与截断字段")
-    node = {"id": "n1", "path": "/p/n1.md", "frontmatter": {"layer": "knowledge"},
-            "content": "短内容"}
-    v = _node_view(node)
-    check("B1 旧四键不丢（零回归）+ 验证态 additive 透出",
-          {"id", "path", "frontmatter", "content"} <= set(v)
-          and v["content"] == "短内容"
-          and v["verification_state"] == "unverified", str(sorted(v)))
-    check("B2 空节点维持 None（旧契约）", _node_view(None) is None)
-
-    big = dict(node, content=many)
-    v = _node_view(big)
-    check("B3 大节点截断 + 审计字段（truncated/next_offset/note）",
-          v["truncated"] is True and v["next_offset"] == READ_MAX_LINES + 1
-          and v["content_lines"] == READ_MAX_LINES + 500
-          and v["content"].split("\n")[-1] == f"line-{READ_MAX_LINES - 1:05d}",
-          str({k: v[k] for k in ("truncated", "next_offset", "content_lines")}))
-    v2 = _node_view(big, offset=v["next_offset"])
-    check("B4 按 next_offset 续读可取回尾部且拼回原文",
-          "\n".join([v["content"], v2["content"]]) == many
-          and v2["offset"] == READ_MAX_LINES + 1, str(v2["offset"]))
-
-    print("[C] 工具面落点（schema + 分发透传）")
-    cg = next(t for t in KERNEL_TOOLS if t["name"] == "cg")
-    props = cg["inputSchema"]["properties"]
-    check("C1 cg schema 暴露 offset 且描述含续读语义",
-          props["offset"]["type"] == "integer" and "next_offset" in props["offset"]["description"])
-    check("C2 read 面描述声明截断与续读（调用方可知情）",
-          "next_offset" in cg["description"] and "截断" in cg["description"])
-
-    fcg = _FakeCG({"n1": node})
-    out = _cg_call(fcg, {"op": "read", "node_id": "n1"})
-    check("C3 未传 offset：行为与旧版一致",
-          out["content"] == "短内容" and "truncated" not in out, str(out)[:160])
-    fcg = _FakeCG({"n1": big})
-    out = _cg_call(fcg, {"op": "read", "node_id": "n1", "offset": READ_MAX_LINES + 1})
-    check("C4 offset 经 _cg_call 透传到节点视图（真实续读通路）",
-          out["offset"] == READ_MAX_LINES + 1 and out["truncated"] is False
-          and out["content"].startswith(f"line-{READ_MAX_LINES:05d}")
-          and out["content"].endswith("line-02499"), str(out["offset"]))
-
-    print(f"\n结果：{_ok} 通过 / {len(_bad)} 失败")
-    if _bad:
-        print("失败项：" + "、".join(_bad))
-    return 1 if _bad else 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())
+# -*- coding: utf-8 -*-
+"""md_cg · Pi⑦② read 截断 + 续读提示（_clip_text / _node_view / schema 落点）
+
+验收三件事：
+① 单次 read 返回受「2000 行 / 50KB」双阈值约束，且**不静默丢内容**——
+   截断必带 total_lines / total_bytes / next_offset / note；
+② 续读按 offset 连续取回可拼回原文（不丢不重，可裁决的等价性判据）；
+③ 小内容行为兼容——旧四键（id/path/frontmatter/content）不丢、content 原样；
+   验证态 `verification_state` 为**有意的 additive 透出**（不参与排序），
+   故 B1 断言「旧键 ⊆ 新键 ∧ 验证态在场」而非「键集逐一相等」。
+   真源：protocol.py 的 read.node.required 已把 `verification_state` 列为必需键。
+
+运行：python -m md_cg.test_read_clip
+"""
+
+import os
+import sys
+
+from .mcp_server import KERNEL_TOOLS, READ_MAX_BYTES, READ_MAX_LINES, \
+    _cg_call, _clip_text, _node_view
+
+_ok = 0
+_bad = []
+
+
+def check(name, cond, detail=""):
+    global _ok
+    if cond:
+        _ok += 1
+        print(f"  [ok] {name}" + (f"  · {detail}" if detail else ""))
+    else:
+        _bad.append(name)
+        print(f"  [FAIL] {name}  · {detail}")
+
+
+class _FakeCG:
+    """只实现 read 面所需的最小取节点契约。"""
+
+    def __init__(self, nodes):
+        self._nodes = nodes
+
+    def get(self, nid, *a, **k):
+        return self._nodes.get(nid)
+
+
+def main():
+    print("[A] _clip_text 双阈值与续读语义")
+    small = "第一行\n第二行\n第三行"
+    c = _clip_text(small)
+    check("A1 小文本原样返回（note 空串、无截断位点）",
+          c["text"] == small and c["truncated"] is False
+          and c["next_offset"] is None and c["total_lines"] == 3
+          and c["note"] == "", str(c)[:160])
+
+    many = "\n".join(f"line-{i:05d}" for i in range(READ_MAX_LINES + 500))
+    c = _clip_text(many)
+    check("A2 行数上限：超 2000 行截断且给出续读位点",
+          c["truncated"] is True and c["returned_lines"] == READ_MAX_LINES
+          and c["next_offset"] == READ_MAX_LINES + 1
+          and str(READ_MAX_LINES) in c["note"], c["note"])
+
+    wide = "\n".join("x" * 60 for _ in range(3000))   # 约定 180KB > 50KB
+    c = _clip_text(wide)
+    check("A3 字节上限生效（行未满 2000 但字节先到顶）",
+          c["truncated"] is True and c["returned_lines"] < READ_MAX_LINES
+          and len(c["text"].encode("utf-8")) <= READ_MAX_BYTES
+          and str(READ_MAX_BYTES) in c["note"], f"{c['returned_lines']}行/{c['total_bytes']}B")
+
+    # 续读拼接等价性：按 next_offset 连续取回，拼回必须与原文逐字一致
+    got, off, hops = [], 0, 0
+    while True:
+        c = _clip_text(many, offset=off)
+        got.append(c["text"])
+        hops += 1
+        if not c["truncated"]:
+            break
+        off = c["next_offset"]
+        if hops > 10:
+            break
+    check("A4 续读拼接 == 原文（不丢不重）",
+          "\n".join(got) == many and hops == 2, f"hops={hops}")
+
+    c = _clip_text("a\nb", offset=99)
+    check("A5 offset 越界：返回空并如实说明（不假装有内容）",
+          c["text"] == "" and c["truncated"] is False and "超出总行数" in c["note"],
+          c["note"])
+
+    c = _clip_text("y" * (READ_MAX_BYTES + 100))
+    check("A6 单行超字节上限也保底返回一行（不返回空）",
+          c["returned_lines"] == 1 and c["truncated"] is False
+          and len(c["text"]) == READ_MAX_BYTES + 100, str(c["returned_lines"]))
+
+    print("[B] _node_view 兼容与截断字段")
+    node = {"id": "n1", "path": "/p/n1.md", "frontmatter": {"layer": "knowledge"},
+            "content": "短内容"}
+    v = _node_view(node)
+    check("B1 旧四键不丢（零回归）+ 验证态 additive 透出",
+          {"id", "path", "frontmatter", "content"} <= set(v)
+          and v["content"] == "短内容"
+          and v["verification_state"] == "unverified", str(sorted(v)))
+    check("B2 空节点维持 None（旧契约）", _node_view(None) is None)
+
+    big = dict(node, content=many)
+    v = _node_view(big)
+    check("B3 大节点截断 + 审计字段（truncated/next_offset/note）",
+          v["truncated"] is True and v["next_offset"] == READ_MAX_LINES + 1
+          and v["content_lines"] == READ_MAX_LINES + 500
+          and v["content"].split("\n")[-1] == f"line-{READ_MAX_LINES - 1:05d}",
+          str({k: v[k] for k in ("truncated", "next_offset", "content_lines")}))
+    v2 = _node_view(big, offset=v["next_offset"])
+    check("B4 按 next_offset 续读可取回尾部且拼回原文",
+          "\n".join([v["content"], v2["content"]]) == many
+          and v2["offset"] == READ_MAX_LINES + 1, str(v2["offset"]))
+
+    print("[C] 工具面落点（schema + 分发透传）")
+    cg = next(t for t in KERNEL_TOOLS if t["name"] == "cg")
+    props = cg["inputSchema"]["properties"]
+    check("C1 cg schema 暴露 offset 且描述含续读语义",
+          props["offset"]["type"] == "integer" and "next_offset" in props["offset"]["description"])
+    check("C2 read 面描述声明截断与续读（调用方可知情）",
+          "next_offset" in cg["description"] and "截断" in cg["description"])
+
+    fcg = _FakeCG({"n1": node})
+    out = _cg_call(fcg, {"op": "read", "node_id": "n1"})
+    check("C3 未传 offset：行为与旧版一致",
+          out["content"] == "短内容" and "truncated" not in out, str(out)[:160])
+    fcg = _FakeCG({"n1": big})
+    out = _cg_call(fcg, {"op": "read", "node_id": "n1", "offset": READ_MAX_LINES + 1})
+    check("C4 offset 经 _cg_call 透传到节点视图（真实续读通路）",
+          out["offset"] == READ_MAX_LINES + 1 and out["truncated"] is False
+          and out["content"].startswith(f"line-{READ_MAX_LINES:05d}")
+          and out["content"].endswith("line-02499"), str(out["offset"]))
+
+    print(f"\n结果：{_ok} 通过 / {len(_bad)} 失败")
+    if _bad:
+        print("失败项：" + "、".join(_bad))
+    return 1 if _bad else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_readcache_prodpath.py

@@ -0,0 +1,155 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""检索读缓存生产路径守卫（批次 21，issue #31 P2）。
+
+外部报告实测（诚实边界照录）：
+  - 567 池单次检索 572 次 builtins.open（~70-86% 耗时）；
+  - install_read_cache 6.53x（126→19.3 ms）但只用于 benchmark；
+  - path-only 无失效的朴素实现在「写入后检索」场景**陈旧读**（旧内容命中）。
+
+本守卫五项：
+  P1 默认关零变更（env 未设 → 行为与改动前逐位一致）；
+  P2 开启后检索结果与关闭态一致（缓存不改变结果，只改变速度）；
+  P3 写后失效（能红 path-only 无失效实现）：写入新内容 → 检索必须命中
+     新内容、不得命中旧内容——哨兵（_dirty 代际）失效的核心断言；
+  P4 open 计数：开启后二次检索零磁盘 open（打桩 builtins.open）；
+  P5 clear() 强制兜底可用。
+"""
+import builtins
+import os
+import sys
+import tempfile
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from md_cg.mdcos import MdCGSecure
+from md_cg.security import Principal
+
+PASS = 0
+FAIL = 0
+FAILS = []
+
+
+def check(name, cond, detail=""):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  OK   {name}")
+    else:
+        FAIL += 1
+        FAILS.append(name)
+        print(f"  FAIL {name}  {detail}")
+
+
+def build_lib(root, n=12):
+    cg = MdCGSecure(root, principal=Principal(
+        actor="rc", clearance="secret", can_write=True,
+        role="designer", auth_mode="test"))
+    for i in range(n):
+        cg.add("mem_%03d" % i, "# 功能名：读缓存样本 %d\n# 正文：蜂群调度 节点 %d"
+               % (i, i), layer="knowledge")
+    cg.flush()
+    return cg
+
+
+def count_opens(fn):
+    """打桩 builtins.open 计数（只统计读模式，排除访问日志）。
+
+    访问日志（record_access）的「读后写」是 #31 P5 登记项（环境相关、
+    另案缓解），不属本守卫的「节点正文读」度量面——P4 只断言正文零盘。
+    """
+    n = 0
+    real = builtins.open
+
+    def _spy(file, mode="r", *a, **kw):
+        nonlocal n
+        is_access = "access" in str(file)
+        if ("r" in mode and not ("w" in mode or "a" in mode or "+" in mode)
+                and not is_access):
+            n += 1
+        return real(file, mode, *a, **kw)
+
+    builtins.open = _spy
+    try:
+        return fn(), n
+    finally:
+        builtins.open = real
+
+
+def main():
+    root = tempfile.mkdtemp(prefix="mdcg_readcache_")
+    os.environ.pop("MDCG_READ_CACHE", None)
+    cg = build_lib(root)
+    try:
+        # P1 默认关零变更
+        print("== P1 默认关（env 未设）零变更 ==")
+        check("P1a 未启用时无 _read_cache 属性", not hasattr(cg, "_read_cache"))
+        r0, _ = cg.search("蜂群调度")
+        check("P1b 检索正常（基线）", len(r0) >= 1, f"results={len(r0)}")
+
+        # P2/P3/P4 开启态
+        print("== P2/P3/P4 MDCG_READ_CACHE=1 ==")
+        os.environ["MDCG_READ_CACHE"] = "1"
+        import importlib
+        import md_cg.readcache as rc
+        importlib.reload(rc)
+        rc.install(cg)
+
+        r1, m1 = cg.search("蜂群调度")
+        check("P2a 开启后结果一致（同库同 query）",
+              [x[0].get("id") for x in r1] == [x[0].get("id") for x in r0],
+              f"on={[x[0].get('id') for x in r1][:3]} off={[x[0].get('id') for x in r0][:3]}")
+
+        # P3 写后失效（能红 path-only 无失效实现）
+        print("== P3 写后失效（能红朴素实现）==")
+        cg.add("mem_new", "# 功能名：写入后的新内容BBB\n# 正文：更新后内容BBB 独有标记",
+               layer="knowledge")
+        cg.flush()
+        r3, _ = cg.search("更新后内容BBB")
+        ids3 = [x[0].get("id") for x in r3]
+        check("P3a 写入后新内容可检索（不陈旧）", "mem_new" in ids3,
+              f"ids={ids3[:5]}")
+        r3b, _ = cg.search("独有标记")
+        check("P3b 独有标记命中新节点", any(
+            x[0].get("id") == "mem_new" for x in r3b), f"ids={[x[0].get('id') for x in r3b]}")
+
+        # P4 open 计数：热缓存后二次检索零读盘
+        print("== P4 二次检索零磁盘 open ==")
+        cg.search("蜂群调度")            # 预热（首检索装缓存）
+        (_res, n_open), = (count_opens(lambda: cg.search("蜂群调度")),)
+        check("P4a 热缓存后二次检索 open=0（报告基线：572/查询）",
+              n_open == 0, f"opens={n_open}")
+
+        # P6 派生物缓存（_doc_norm_bigrams 钩子）：identity 快照断言——
+        # 二检后缓存条目的值对象不变（重算必然生成新对象）
+        print("== P6 文档侧派生物缓存（_score 88% 热点面）==")
+        nbc = getattr(cg, "_norm_bigrams_cache", {})
+        snap = {k: v[1] for k, v in nbc.items()}
+        check("P6pre 缓存已装载", len(snap) > 0, f"entries={len(snap)}")
+        cg.search("蜂群调度")               # 二检
+        nbc2 = getattr(cg, "_norm_bigrams_cache", {})
+        same = all(nbc2[k][1] is snap[k] for k in snap if k in nbc2)
+        check("P6a 热缓存后二次检索派生物零重算（identity 不变）",
+              same and len(snap) > 0, f"snap={len(snap)}")
+
+        # P5 clear 兜底（破坏性，放最后）
+        n = rc.clear(cg)
+        check("P5 clear 返回清空条目数", n > 0, f"cleared={n}")
+
+        # 还原
+        os.environ.pop("MDCG_READ_CACHE", None)
+    finally:
+        os.environ.pop("MDCG_READ_CACHE", None)
+        import shutil
+        shutil.rmtree(root, ignore_errors=True)
+
+    print("\n" + "=" * 60)
+    print(f"结果：PASS {PASS} / FAIL {FAIL}")
+    if FAILS:
+        for f in FAILS:
+            print(f"  - {f}")
+    return 0 if FAIL == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_retr_gates_prodpath.py

@@ -0,0 +1,140 @@
+# -*- coding: utf-8 -*-
+"""issue #25 生产路径门控守卫：MdCGSecure.search（生产类）必须真实吃到门控。
+
+病灶（2026-09-23 外部报告）：检索门控 S1/S1b/S2/S4 只存在于 MdCG.search，
+而生产调用链 mcp_server → MdCGSecure → MdCGOS 走的是 MdCGOS.search 覆写——
+门控在生产路径从未生效，专项测试（test_retr_s*.py）全测非生产路径，
+绿灯是假信号（gates=None、scanned=全表）。
+
+本文件是「门控确实接进生产路径」的守卫：
+  P1 生产类开关生效：gates 出现且 scanned 真实收敛（旧代码必红）；
+  P2 默认路径零变更：总开关未设 → meta 无 gates 键（契约纪律）；
+  P3 两路共享同一实现：MdCG.search 与 MdCGOS.search 的 gates 结构一致；
+  P4 覆写防悬空：两份 search 源码都必须引用 apply_retrieval_gates——
+     防止未来再写出第三个不含门控的覆写（本病灶的复发形态）。
+"""
+import inspect
+import json
+import os
+import sys
+import tempfile
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from md_cg.mdcos import MdCGSecure, MdCGOS
+from md_cg.mdcg import MdCG, apply_retrieval_gates
+
+PASS = 0
+FAIL = 0
+FAILS = []
+
+
+def check(name, cond, detail=""):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  OK   {name}")
+    else:
+        FAIL += 1
+        FAILS.append(name)
+        print(f"  FAIL {name}  {detail}")
+
+
+def build_lib(root, n=30):
+    """小库：一半节点挂在中文桶键（含查询词面），一半无关桶。
+
+    桶键用中文（批次 15）：S1b 桶推理经 bucket_key_readable+domain_similarity，
+    英文桶键对中文 query 恒 no_key_match（跨语失效——真实缺陷已登记），
+    守卫锚定收敛机制本身，桶键与 query 同语言才可断言。
+    """
+    cg = MdCGSecure(root)
+    for i in range(n):
+        bucket = "蜂群调度" if i < n // 2 else "无关奶牛"
+        text = ("# 功能名：蜂群调度样本 %d\n# 正文：dispatch 调度内容样本 %d"
+                % (i, i)) if i < n // 2 else \
+               ("# 功能名：无关样本 %d\n# 正文：cow 内容样本 %d" % (i, i))
+        cg.add("mem_%03d" % i, text, layer="knowledge")
+        # S1b 依赖 entry.bucket（平铺字段）；big_domain 同理（S1 面）
+        e = cg.index["nodes"]["mem_%03d" % i]
+        e["bucket"] = bucket
+        e["big_domain"] = "swarm" if i < n // 2 else "farm"
+    cg.flush()
+    return cg
+
+
+def main():
+    print("== P1 生产类（MdCGSecure）开关生效（能红旧实现）==")
+    root = tempfile.mkdtemp(prefix="mdcg_gate_prod_")
+    cg = build_lib(root)
+    os.environ["MDCG_RETRIEVAL_PIPELINE"] = "1"
+    os.environ["MDCG_GATE_S1B_BUCKET"] = "1"
+    try:
+        # query 用中文核心词（批次 15 起 query 经统一归一层——英文词面会随
+        # 词表演进而变，守卫锚定检索行为本身不该锚定词表内容）
+        r, meta = cg.search("调度")
+        gates = meta.get("gates") or {}
+        check("P1a 生产类 gates 审计出现（旧代码 gates=None）",
+              isinstance(gates, dict) and "s1b" in gates,
+              json.dumps(meta, ensure_ascii=False, default=str)[:200])
+        check("P1b scanned 真实收敛（< 全库节点数）",
+              meta.get("scanned", 10**9) < 30,
+              f"scanned={meta.get('scanned')}")
+        check("P1c 召回不丢（收敛后仍有结果）",
+              len(r) >= 1, f"results={len(r)}")
+    finally:
+        os.environ.pop("MDCG_RETRIEVAL_PIPELINE", None)
+        os.environ.pop("MDCG_GATE_S1B_BUCKET", None)
+
+    print("== P2 默认路径零变更 ==")
+    os.environ.pop("MDCG_RETRIEVAL_PIPELINE", None)
+    r, meta = cg.search("调度")
+    check("P2 默认（总开关未设）meta 无 gates 键",
+          "gates" not in meta, json.dumps(meta, ensure_ascii=False, default=str)[:160])
+
+    print("== P3 两路共享同一实现（同库同查询 gates 结构一致）==")
+    base = MdCG(tempfile.mkdtemp(prefix="mdcg_gate_base_"))
+    # 把同形状节点直接写进基类实例（经 add 共享落盘口径）
+    for i in range(30):
+        bucket = "蜂群调度" if i < 15 else "无关奶牛"
+        text = ("# 功能名：蜂群调度样本 %d\n# 正文：dispatch 调度内容样本 %d"
+                % (i, i)) if i < 15 else \
+               ("# 功能名：无关样本 %d\n# 正文：cow 内容样本 %d" % (i, i))
+        base.add("mem_%03d" % i, text, layer="knowledge")
+        e = base.index["nodes"]["mem_%03d" % i]
+        e["bucket"] = bucket
+        e["big_domain"] = "swarm" if i < 15 else "farm"
+    base.flush()
+    os.environ["MDCG_RETRIEVAL_PIPELINE"] = "1"
+    os.environ["MDCG_GATE_S1B_BUCKET"] = "1"
+    try:
+        _, meta_os = cg.search("调度")
+        _, meta_cg = base.search("调度")
+        g_os, g_cg = meta_os.get("gates") or {}, meta_cg.get("gates") or {}
+        check("P3a MdCGOS 与 MdCG 的 s1b 审计键集合一致",
+              bool(g_os) and set(g_os) == set(g_cg),
+              f"os={sorted(g_os)} cg={sorted(g_cg)}")
+        check("P3b MdCG.search 自身收敛不回归（搬移未改行为）",
+              meta_cg.get("scanned", 10**9) < 30,
+              f"scanned={meta_cg.get('scanned')}")
+    finally:
+        os.environ.pop("MDCG_RETRIEVAL_PIPELINE", None)
+        os.environ.pop("MDCG_GATE_S1B_BUCKET", None)
+
+    print("== P4 覆写防悬空（病灶复发形态的结构守卫）==")
+    src_os = inspect.getsource(MdCGOS.search)
+    src_cg = inspect.getsource(MdCG.search)
+    check("P4a MdCGOS.search 引用共享门控", "apply_retrieval_gates" in src_os)
+    check("P4b MdCG.search 引用共享门控", "apply_retrieval_gates" in src_cg)
+    check("P4c 共享函数存在且可调（两路 MRO 都能到达）",
+          callable(apply_retrieval_gates))
+
+    print()
+    if FAILS:
+        print(f"FAILED: {len(FAILS)} 项 → {', '.join(FAILS)}")
+        return 1
+    print(f"ALL OK: {PASS} 项（生产路径门控守卫全绿）")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())