@furongjun1999/dsh-memory 0.4.6 → 0.4.7

package/md_cg/mdcos.py

@@ -24,14 +24,15 @@ import os
 import re
 import time
 
-from .mdcg import (MdCG, expand_query_terms, bigrams, STATE_ACCEPT, STATE_REJECT,
-                   STATE_DEFER, STATE_BLINDSPOT, TIER_BUCKET_LIKE,
+from .mdcg import (MdCG, expand_query_terms, bigrams, normalize_en, STATE_ACCEPT,
+                   STATE_REJECT, STATE_DEFER, STATE_BLINDSPOT, TIER_BUCKET_LIKE,
                    TIER_BUCKET_SCAN, TIER_GLOBAL_LIKE, TIER_GLOBAL_SCAN,
                    GLOBAL_CAP, expand_query_terms_weighted,
-                   expand_query_terms_llm)
+                   expand_query_terms_llm, en_zh_bigrams, semantic_on)
 from . import (nodefile, routing, chain, subgraph, forgetting, protect,
                identity, consistency, metacognition, crypto, sustain,
-               self_state, predict, evolution, weights, pooling)
+               self_state, predict, evolution, weights, pooling,
+               writelimit)
 from .fsutil import FileLock, atomic_write, append_jsonl, read_jsonl
 from .security import (Principal, TenantRegistry, AccessDenied,
                        SENSITIVITY_ORDER, DEFAULT_SENSITIVITY, _rank)
@@ -55,6 +56,9 @@ _FIX_RE = re.compile(
 
 RRF_K = 60          # RRF 常数
 DEFAULT_BUDGET = 1200  # recall 默认 token 预算
+# recall 单条上限：超预算的条目按此截断纳入（而非丢弃），避免"逆向淘汰"。
+# 0 = 关闭截断，回到"超大一律跳过"的旧行为。
+DEFAULT_MAX_ITEM_TOKENS = 250
 
 
 def est_tokens(text: str) -> int:
@@ -67,6 +71,35 @@ def est_tokens(text: str) -> int:
     return int(cjk * 0.6 + other / 4) + 1
 
 
+def excerpt_tokens(text: str, max_tokens: int) -> str:
+    """按 est_tokens 口径截取正文前 max_tokens 的摘录（用于 recall 的单条上限）。
+
+    定义在模块级而非类内：它被 MdCGOS.recall 的装包循环调用，放在任一类的内部
+    都可能让另一处拿不到（同类错误曾导致 AttributeError）。
+    预算含省略号本身（"…" 也是 CJK 字符，会被计费），因此先扣除其开销再取正文，
+    保证返回值的 est_tokens 严格 ≤ max_tokens。
+    """
+    if not text or max_tokens <= 0:
+        return ""
+    if est_tokens(text) <= max_tokens:
+        return text                      # 已足够小，原样返回（不放大）
+    ellipsis = "…"
+    ell_cost = est_tokens(ellipsis)
+    body_budget = max_tokens - ell_cost
+    if body_budget <= 0:
+        return ellipsis if ell_cost <= max_tokens else ""
+    approx = min(len(text), max(1, int(body_budget / 0.6)))
+    while approx > 1 and est_tokens(text[:approx]) > body_budget:
+        approx -= max(1, approx // 10)   # 精确口径回退，步长随窗口收缩
+    keep = max(0, approx)
+    out = text[:keep].rstrip() + ellipsis
+    if est_tokens(out) > max_tokens:      # 兜底：仍超则继续收缩
+        while keep > 1 and est_tokens(text[:keep].rstrip() + ellipsis) > max_tokens:
+            keep -= max(1, keep // 10)
+        out = text[:keep].rstrip() + ellipsis
+    return out
+
+
 def _sig(text: str, n: int = 12) -> str:
     return hashlib.sha1(text.strip().encode("utf-8")).hexdigest()[:n]
 
@@ -254,7 +287,8 @@ class MdCGOS(MdCG):
 
     def _audit(self, op: str, node_id: str, **meta):
         """只记事件与载荷哈希，绝不记录内容（payload-free）。"""
-        rec = {"t": time.time(), "op": op, "id": node_id, "actor": self.actor}
+        rec = {"t": time.time(), "op": op, "id": node_id, "actor": self.actor,
+               "session": getattr(self, "session", None)}
         rec.update(meta)
         try:
             append_jsonl(self.audit_log, rec)
@@ -280,12 +314,19 @@ class MdCGOS(MdCG):
                     payload_hash=_sig(content))
         return nid
 
-    def _candidates(self, layer=None, roles=None, include_work=False):
-        """候选池：按层 + role 过滤。默认剔除工作角色（工具输出/命令/编辑）。"""
+    def _candidates(self, layer=None, roles=None, include_work=False,
+                    session=None):
+        """候选池：按层 + role 过滤。默认剔除工作角色（工具输出/命令/编辑）。
+
+        session：会话归属过滤（frontmatter.session，写入时自动落盘）——
+        多会话共用一个 root 时，按它区分「本会话记忆 / 其他会话记忆」。
+        """
         out = []
         for e in self.index["nodes"].values():
             if e.get("layer") in ("rejected", "unresolved", "goals"):
                 continue  # 负记忆走覆盖标记；目标只做定向，都不进正排
+            if session and e.get("session") != session:
+                continue
             if layer and e.get("layer") != layer:
                 continue
             r = e.get("role")
@@ -334,7 +375,8 @@ class MdCGOS(MdCG):
     def search(self, query: str, layer: str = None, k: int = 20,
                context=None, min_results: int = 1, record: bool = True,
                include_neg: bool = True, judge: bool = True,
-               roles=None, include_work: bool = False, pools=None):
+               roles=None, include_work: bool = False, pools=None,
+               session=None):
         """在父类语义之上加 role 过滤（默认剔除工具输出/命令/编辑）。
 
         返回 (results, meta)，与 MdCG.search 完全同构（T0–T3 阶梯 + 资格判定）。
@@ -344,13 +386,17 @@ class MdCGOS(MdCG):
         if not q:
             return [], {"tier": None, "reason": "empty_query", "scanned": 0}
         pool_cfg = pooling.resolve(pooling.from_env(pools))
-        entries = self._candidates(layer=layer, roles=roles, include_work=include_work)
+        entries = self._candidates(layer=layer, roles=roles, include_work=include_work,
+                                   session=session)
         if not entries:
             return [], {"tier": None, "reason": "no_candidates", "scanned": 0}
 
         terms = expand_query_terms(q)
-        qb = bigrams(q)
-        stat = {"scanned": 0}
+        # qb 与 _score 文档侧口径对齐（文档侧已是 normalize_en 小写化），
+        # 否则大小写断裂 → 词法分恒 0 → LIKE 层失效（p33 ⑤ 回归根因）；
+        # + 英→中语素 bigram 补充（与 mdcg.search/_lexical 打分口径同步）
+        qb = bigrams(normalize_en(q)) | en_zh_bigrams(q)
+        stat = {"scanned": 0, "query": q}
         route_bucket = None
         if context is not None:
             ctx = context if isinstance(context, dict) else {}
@@ -372,7 +418,9 @@ class MdCGOS(MdCG):
             in_bucket = [e for e in entries if e.get("bucket") == route_bucket]
             if in_bucket:
                 docs = self._read_many(in_bucket, stat)
-                hits = [d for d in docs if self._like(d[2], d[1], terms)]
+                # 语义资格（MDCG_SEMANTIC=1）：fm.semantic 节点无条件入池
+                hits = [d for d in docs if self._like(d[2], d[1], terms)
+                        or (semantic_on() and d[1].get("semantic"))]
                 out = try_stage(hits, TIER_BUCKET_LIKE)
                 if out:
                     return out
@@ -381,7 +429,9 @@ class MdCGOS(MdCG):
                     return out
 
         docs_all = self._read_many(entries, stat)
-        hits = [d for d in docs_all if self._like(d[2], d[1], terms)]
+        # 语义资格（MDCG_SEMANTIC=1）：fm.semantic 节点无条件入池
+        hits = [d for d in docs_all if self._like(d[2], d[1], terms)
+                or (semantic_on() and d[1].get("semantic"))]
         stat["pre_cap"] = len(hits)
         stat["cap"] = GLOBAL_CAP
         hits, _rep = pooling.cut_report(hits, GLOBAL_CAP, pools=pool_cfg,
@@ -413,9 +463,14 @@ class MdCGOS(MdCG):
         不再取插入序前 CAP。
         """
         terms = expand_query_terms(query)
-        qb = bigrams(query)
+        # qb 与文档侧 normalize_en 口径对齐（同 MdCGOS.search，防大小写断裂）
+        # + 英→中语素 bigram 补充（跨语词法分恢复）
+        qb = bigrams(normalize_en(query)) | en_zh_bigrams(query)
         docs = self._read_many(entries, stat)
-        hits = [d for d in docs if self._like(d[2], d[1], terms)]
+        # 语义资格（MDCG_SEMANTIC=1）：fm.semantic 节点无条件入池——
+        # 语义摘要=检索面（设想核心），否则摘要层只在 LIKE 全空时生效
+        hits = [d for d in docs if self._like(d[2], d[1], terms)
+                or (semantic_on() and d[1].get("semantic"))]
         if not hits:
             hits = sorted(
                 docs, key=lambda d: (-float(d[1].get("importance") or 0),
@@ -672,7 +727,8 @@ class MdCGOS(MdCG):
                    judge: bool = True, paths=("lexical", "bucket", "entity", "graph"),
                    record: bool = True, query_expand=None,
                    path_weights=None, recall_only=None, fusion: str = "sum",
-                   goal_text=None):
+                   goal_text=None, judge_ranking: bool = False,
+                   session=None):
         """并行多路召回 + RRF 融合。返回 (results, meta)。
 
         每路各自排序 → Reciprocal Rank Fusion：
@@ -697,11 +753,17 @@ class MdCGOS(MdCG):
             sum 奖励「多路共识」，但会系统性低估**单路独有**候选：当强路漏掉目标、
             弱路捞到时，目标的单路贡献必然低于任何「两路都有排名」的干扰项。
             max 只认「最好的一次排名」，不奖励共识，适合「任一路捞到即可」的召回。
+        judge_ranking: 白箱终排（证据防火墙，显式启用）。融合排序只产生候选
+            （语义负责「不要漏」），资格裁决决定最终优先级（白箱负责「不要错」）：
+            REJECT / BLINDSPOT 剔除，DEFER 降权 ×0.5，ACCEPT 保位。候选池取
+            fused 前 max(k*2,10) 再裁决补位。语义联系可以是认知噪声（等权 RRF
+            双重奖励「多路都靠前」的干扰项），唯有条件证据可授予优先级。
         """
         q = (query or "").strip()
         if not q:
             return [], {"tier": None, "reason": "empty_query", "paths": {}}
-        entries = self._candidates(layer=layer, roles=roles, include_work=include_work)
+        entries = self._candidates(layer=layer, roles=roles, include_work=include_work,
+                                   session=session)
         if not entries:
             return [], {"tier": None, "reason": "no_candidates", "paths": {}}
 
@@ -766,18 +828,40 @@ class MdCGOS(MdCG):
         for scored in ranked.values():
             for node, s in scored:
                 node_by_id.setdefault(node["id"], (node, s))
-        fused = sorted(rrf.items(), key=lambda kv: -kv[1])[:k]
+        fused_all = sorted(rrf.items(), key=lambda kv: -kv[1])
+
+        quals = {}
+        filtered = 0
+        if judge and judge_ranking:
+            # 证据防火墙：语义/词法融合产生候选（不要漏），资格授予优先级（不要错）
+            kept = []
+            for nid, fs in fused_all[:max(k * 2, 10)]:
+                node, s = node_by_id[nid]
+                qual = self.judge_qualification(node, q, context)
+                quals[nid] = qual
+                st = qual.get("state")
+                if st in (STATE_REJECT, STATE_BLINDSPOT):
+                    filtered += 1
+                    continue
+                kept.append((nid, fs if st == STATE_ACCEPT else fs * 0.5))
+            kept.sort(key=lambda x: -x[1])
+            fused = kept[:k]
+        else:
+            fused = fused_all[:k]
 
         results = []
         for nid, fs in fused:
             node, s = node_by_id[nid]
-            qual = (self.judge_qualification(node, q, context) if judge
-                    else {"state": None, "reason": "judge_disabled"})
+            qual = (quals.get(nid)
+                    or (self.judge_qualification(node, q, context) if judge
+                        else {"state": None, "reason": "judge_disabled"}))
             results.append((node, round(fs, 6), qual, prov.get(nid, [])))
         if record and results:
             self.record_access([r[0]["id"] for r in results], "RRF")
         return results, {"tier": "RRF", "scanned": stat["scanned"],
                          "paths": per_path, "fused": len(results),
+                         "judge_ranking": bool(judge and judge_ranking),
+                         "judge_filtered": filtered,
                          "expand_source": fuzzy_source,
                          "goal_used": goal_used,
                          "provenance": prov}
@@ -788,8 +872,18 @@ class MdCGOS(MdCG):
                layer: str = None, context=None, roles=None,
                include_work: bool = False, judge: bool = True, use_rrf: bool = True,
                paths=None, query_expand=None, fusion=None,
-               goal_text=None, include_recent=False, recent_limit: int = 10):
-        """按 token 预算装包：装到预算花完为止；**超大条目跳过而非停下**。
+               goal_text=None, include_recent=False, recent_limit: int = 10,
+               judge_ranking: bool = False, session=None,
+               max_item_tokens: int = DEFAULT_MAX_ITEM_TOKENS):
+        """按 token 预算装包：装到预算花完为止。
+
+        装包策略（2026-09-14 调整）：
+        · 条目超预算时，**若开启 max_item_tokens（默认 250）则纳入该条前 N token 的摘录**
+          （返回体标注 truncated=True），而不是直接丢弃；
+        · 仅当剩余预算不足以放下一份最小摘录时，才跳过并继续尝试更小的条目（原行为）；
+        · 传 max_item_tokens=0 可显式关闭截断，回到"超大一律跳过"的旧行为。
+        动机：旧策略是「跳过超大、继续试更小的」——预算紧张时形成**逆向淘汰**，
+        越有价值的详实条目越容易被排除（实测 budget=1500 时 16 条被刷、只装 2 条）。
 
         paths/query_expand 缺省时行为与既有完全一致（默认四路、纯白箱扩展）；
         显式传 paths 才启用新路，例如
@@ -802,7 +896,7 @@ class MdCGOS(MdCG):
         """
         if use_rrf:
             kw = dict(k=k, layer=layer, context=context, roles=roles,
-                      include_work=include_work, judge=judge)
+                      include_work=include_work, judge=judge, session=session)
             if paths is not None:
                 kw["paths"] = tuple(paths)
             if query_expand is not None:
@@ -811,24 +905,47 @@ class MdCGOS(MdCG):
                 kw["fusion"] = fusion
             if goal_text is not None:
                 kw["goal_text"] = goal_text
+            kw["judge_ranking"] = judge_ranking
             results, meta = self.search_rrf(query, **kw)
             items = [(r[0], r[1], r[2], r[3]) for r in results]
         else:
             res, meta = self.search(query, layer=layer, k=k, context=context,
-                                    judge=judge)
+                                    judge=judge, session=session)
             items = [(r[0], r[1], r[2], []) for r in res]
 
         pack, skipped, used = [], [], 0
+        # 单条最小摘录下限：剩余预算低于此值就不值得再放一条残缺内容
+        min_excerpt = max(1, min(50, max_item_tokens // 5)) if max_item_tokens else 0
         for node, score, qual, prov in items:
-            t = est_tokens(node.get("content") or "")
+            content = node.get("content") or ""
+            t = est_tokens(content)
+            truncated = False
             if used + t > budget_tokens:
-                skipped.append({"id": node["id"], "tokens": t, "reason": "oversize_or_over_budget"})
-                continue          # 跳过超大，继续尝试更小的
+                # 超预算：优先纳入"前 N token 摘录"，而不是直接丢弃。
+                # 旧行为（跳过超大、继续试更小的）在预算紧张时会把最有价值的
+                # 详实条目系统性排除，因此这里改为截断纳入。
+                room = budget_tokens - used
+                if max_item_tokens and room >= min_excerpt:
+                    keep = min(max_item_tokens, room)
+                    content = excerpt_tokens(content, keep)
+                    t = est_tokens(content)
+                    if t <= 0:
+                        skipped.append({"id": node["id"], "tokens": 0,
+                                        "reason": "excerpt_empty"})
+                        continue
+                    truncated = True
+                else:
+                    skipped.append({"id": node["id"], "tokens": t,
+                                    "reason": "oversize_or_over_budget"})
+                    continue          # 关闭截断或预算不足：跳过，继续尝试更小的
             used += t
-            pack.append({"id": node["id"], "score": score, "state": qual.get("state"),
-                         "tokens": t, "content": node.get("content"),
-                         "frontmatter": node.get("frontmatter"),
-                         "provenance": prov})
+            entry = {"id": node["id"], "score": score, "state": qual.get("state"),
+                     "tokens": t, "content": content,
+                     "frontmatter": node.get("frontmatter"),
+                     "provenance": prov}
+            if truncated:
+                entry["truncated"] = True
+            pack.append(entry)
         # 近期事件（第 5 篇第 3 章）：只作上下文尾巴，不参与 RRF 正排；
         # 计入 token 预算（诚实口径：附了就是占了）。
         recent, left = [], budget_tokens - used
@@ -929,7 +1046,8 @@ class MdCGOS(MdCG):
                "layer": layer, "tags": list(tags or []),
                "condition_space": condition_space or {},
                "verify": verify or {}, "verify_hash": vhash,
-               "extra": kw, "actor": self.actor}
+               "extra": kw, "actor": self.actor,
+               "session": getattr(self, "session", None)}
         append_jsonl(self.inbox_log, rec)
         self._audit("propose", node_id, pid=pid, layer=layer,
                     payload_hash=_sig(content), verify_hash=vhash)
@@ -1791,6 +1909,13 @@ class MdCGOS(MdCG):
                 max_nodes=(kw.get("max_nodes") or subgraph.RECON_MAX_NODES),
                 neighbors=(True if kw.get("neighbors") is None
                            else bool(kw.get("neighbors"))))
+        if act == "explore":
+            # 信息差驱动自主探索（opt-in）：提案 → 五态验证 → 回写 gap_hint
+            from . import autonomy
+            return autonomy.explore(self, apply=bool(kw.get("apply")),
+                                    limit=(kw.get("limit") or 3),
+                                    window=(kw.get("window") or 200),
+                                    actor=actor)
         if act == "learn":
             lkw = {k: kw[k] for k in ("blindspot_id", "limit", "horizon",
                                       "max_branches") if kw.get(k) is not None}
@@ -1845,7 +1970,7 @@ class MdCGOS(MdCG):
             "consistency": consistency.summary(self),
             # 独立元认知（观察自身认知的二阶单元，不参与裁决）
             "metacognition": metacognition.summary(self),
-            # 自我状态层（薄自我 + 富索引：八项自我信息的一致性载体）
+            # 自我状态层（薄自我 + 富索引：九项自我信息的一致性载体）
             "self_state": self_state.summary(self),
             # 演化账本（md 载体：每一次修改 = 补一条缺失条件，记录规律与状态）
             "evolution": evolution.summary(self),
@@ -1906,6 +2031,35 @@ class MdCGOS(MdCG):
                     "node_id": node_id,
                     "written": self.add(node_id, content, layer=layer,
                                         override=override, **kw)}
+        # 流水污染治理（写入侧前置限流，工程策略独立于三问裁决）：
+        # 同源频率限制 → DEFER；同构聚合 → 并入既有节点（不新增）。
+        # 只拦 contextual（自动写入落层），knowledge 手动纪律写入不受限；
+        # DEFER 的原始事件仍在 recent log 时间线，可追溯不丢失。
+        lim = writelimit.check(self, content, layer=layer, role=role,
+                               node_id=node_id, importance_hint=hint)
+        if lim is not None:
+            if lim["verdict"] == "CONVERGE":
+                tgt = lim["target"]
+                out = {"verdict": "MERGE", "node_id": node_id,
+                       "merged_into": tgt, "gate": lim,
+                       "converged": writelimit.converge_into(self, tgt,
+                                                             content)}
+                fv = "MERGE"
+            elif lim["verdict"] == "DROP":
+                # 精确重复（与既有节点正文一致）：零新信息，交回旧闸门
+                # DROP 语义——不落库、不追加、不强化既有
+                out = {"verdict": "DROP", "node_id": node_id, "gate": lim}
+                fv = "DROP"
+            else:                                    # DEFER
+                out = {"verdict": "DEFER", "node_id": node_id,
+                       "gate": lim}
+                fv = "DEFER"
+            forgetting.log(self, {"t": time.time(), "node_id": node_id,
+                                  "layer": layer, "verdict": fv,
+                                  "reason": lim.get("reason", ""),
+                                  "limiter": lim.get("limiter"),
+                                  "actor": self.actor})
+            return out
         verdict = forgetting.assess(self, content, layer=layer, role=role,
                                     verification_basis=vb, importance_hint=hint,
                                     node_id=node_id)
@@ -1926,6 +2080,9 @@ class MdCGOS(MdCG):
             else:
                 if out.get("written") is None:  # on_conflict=defer：冲突未落盘
                     v = out["verdict"] = "DEFER"
+                else:
+                    # 落盘成功 → 签名→节点映射兜底回填（同构聚合的锚点）
+                    writelimit.record_accepted(self, node_id, content)
         elif v == "MERGE":
             tgt = verdict["redundancy"]["with"]
             out["merged_into"] = tgt
@@ -2050,7 +2207,7 @@ class MdCGOS(MdCG):
         return metacognition.catalog()
 
     # ============ 自我状态层（薄自我 + 富索引）============
-    # self 层只放状态卡（单例）+ 关系节点；八项自我信息只登记当前值与指针，
+    # self 层只放状态卡（单例）+ 关系节点；九项自我信息只登记当前值与指针，
     # 具体任务/人物/会话/时间/信任的细节由认知图按五维索引连接（不搬运内容）。
 
     def self_state_snapshot(self, subject=self_state.DEFAULT_SUBJECT):
@@ -2058,7 +2215,7 @@ class MdCGOS(MdCG):
         return self_state.snapshot(self, subject)
 
     def self_state_refresh(self, subject=self_state.DEFAULT_SUBJECT, **kw):
-        """刷新状态卡：聚合八项自我信息 → 写卡 + 版本链留痕（幂等）。
+        """刷新状态卡：聚合九项自我信息 → 写卡 + 版本链留痕（幂等）。
 
         会话归因缺省取本进程会话（嵌套身份 (harness, session)），可显式覆盖。
         """
@@ -2101,7 +2258,7 @@ class MdCGOS(MdCG):
                                   session=session or getattr(self, "session", None))
 
     def self_state_catalog(self):
-        """自描述：八项自我信息 + 五维索引 + 审计规则。"""
+        """自描述：九项自我信息 + 五维索引 + 审计规则。"""
         return self_state.catalog()
 
     def causal_chain(self, node_id, relation_types=None,
@@ -2133,10 +2290,15 @@ class MdCGOS(MdCG):
                               limit=limit, semantic=semantic)
 
     def predict_feedback(self, predicted_node_id, actual_node_id=None,
-                         hit=None, note="", actor="predict"):
-        """预测反馈（D-006）：命中 → 边置信度 +0.05；未命中 → 登记 rejected。"""
+                         hit=None, note="", actor="predict", sync_self=True):
+        """预测反馈（D-006）：命中 → 边置信度 +0.05；未命中 → 登记 rejected。
+
+        `sync_self=True` 时同步刷新自我状态卡的「预测校准」面，闭合
+        「预测 → 事实 → 误差 → 自我更新」。
+        """
         return predict.feedback(self, predicted_node_id, actual_node_id,
-                                hit=hit, note=note, actor=actor)
+                                hit=hit, note=note, actor=actor,
+                                sync_self=sync_self)
 
     def predict_stats(self, limit=20):
         """预测统计：调用数 / 路线数 / 命中率 / 动态阈值。"""
@@ -2327,7 +2489,20 @@ class MdCGSecure(MdCGOS):
                                      "reason": str(e)[:120]})
             return None
 
-    # ---------- 索引：把 role / sensitivity 一并索引 ----------
+    # ---------- 索引：把 role / sensitivity / 写入归属一并索引 ----------
+
+    def _attribution(self, kw):
+        """写入归属注入（归因维度，不参与授权）。
+
+        writer/session/harness 缺省取当前身份；库层调用方可显式传值覆盖
+        （如会话台账写入），MCP 面不透传该入参——客户端不得伪造归属。
+        writer 语义=最后写入者（更新路径自然刷新），created_at 记首写。
+        """
+        kw.setdefault("writer", self.principal.actor)
+        kw.setdefault("session", self.session)
+        if self.principal.harness:
+            kw.setdefault("harness", self.principal.harness)
+        return kw
 
     def _scan_nodes(self):
         nodes = super()._scan_nodes()
@@ -2336,6 +2511,8 @@ class MdCGSecure(MdCGOS):
             if fm:
                 e["role"] = fm.get("role")
                 e["sensitivity"] = fm.get("sensitivity") or DEFAULT_SENSITIVITY
+                e["writer"] = fm.get("writer")
+                e["session"] = fm.get("session")
         return nodes
 
     def _index_sensitivity(self, nid, sens):
@@ -2351,6 +2528,7 @@ class MdCGSecure(MdCGOS):
         sens = sensitivity or DEFAULT_SENSITIVITY
         _rank(sens)
         self.principal.require_layer_write(layer, sens)
+        self._attribution(kw)
         nid = super().add(node_id, content, layer=layer, sensitivity=sens, **kw)
         self._index_sensitivity(nid, sens)
         return nid
@@ -2358,6 +2536,7 @@ class MdCGSecure(MdCGOS):
     def add_rejected(self, hypothesis: str, reason: str, sensitivity: str = None, **kw) -> str:
         sens = sensitivity or DEFAULT_SENSITIVITY
         self.principal.require_layer_write("rejected", sens)
+        self._attribution(kw)
         nid = super().add_rejected(hypothesis, reason, sensitivity=sens, **kw)
         self._index_sensitivity(nid, sens)
         return nid
@@ -2366,6 +2545,7 @@ class MdCGSecure(MdCGOS):
                        sensitivity: str = None, **kw) -> str:
         sens = sensitivity or DEFAULT_SENSITIVITY
         self.principal.require_layer_write("unresolved", sens)
+        self._attribution(kw)
         nid = super().add_unresolved(question, known_clues, goal, sensitivity=sens, **kw)
         self._index_sensitivity(nid, sens)
         return nid
@@ -2451,8 +2631,10 @@ class MdCGSecure(MdCGOS):
         self.principal.require_admin("clear_recent")
         return super().clear_recent()
 
-    def _candidates(self, layer=None, roles=None, include_work=False):
-        out = super()._candidates(layer=layer, roles=roles, include_work=include_work)
+    def _candidates(self, layer=None, roles=None, include_work=False,
+                    session=None):
+        out = super()._candidates(layer=layer, roles=roles, include_work=include_work,
+                                  session=session)
         return [e for e in out if self._readable(e)]
 
     def _neg_coverage(self, terms):

package/md_cg/predict.py

@@ -42,6 +42,11 @@ BASE_HIT_RATE = 0.40        # 基线阈值（工程初值，非协议承诺）
 HIT_HISTORY_MAX = 200       # 命中历史滚动窗口
 EDGE_BOOST = 0.05           # 命中 → 因果/时序边置信度增量
 
+# Beta-Bernoulli 先验强度（等效先验样本数 κ，P-T-73/74 通道贝叶斯）：
+# α0 = BASE_HIT_RATE·κ，β0 = (1−BASE_HIT_RATE)·κ。κ 越大小样本越向基线收缩。
+# 性质：先验均值 = BASE_HIT_RATE（与 hit_rate() 空历史兜底同值，口径无缝）。
+PRIOR_STRENGTH = 20
+
 CAUSAL_BRANCH_TYPES = ("causal", "sequential")
 SEMANTIC_TOP_K = 5
 SEMANTIC_MIN_SIM = 0.05
@@ -309,6 +314,67 @@ def hit_rate(cg):
     return round(sum(1 for x in h if x) / len(h), 4)
 
 
+# ---------------------------------------------------------------- P-T-73/74 通道贝叶斯
+
+def beta_posterior(hits, prior_k=PRIOR_STRENGTH, base=BASE_HIT_RATE):
+    """Beta-Bernoulli 后验（纯函数）：命中序列 → 后验参数与区间。
+
+    置信度≠可信度（P-T-73/74）：`hit_rate` 是滑动计数（小样本过度自信：
+    n=5 全命中 → 1.0）；后验均值 = (α0+k)/(α0+β0+n) 随样本量向基线收缩
+    （n=5 全命中 → 0.52），诚实反映「证据还很少」。置信度的动态死区
+    （dynamic_hit_threshold）不动——本函数只提供**更诚实的可信度估计面**，
+    默认链路零行为变更。
+
+    返回：{alpha, beta, mean, std, ci95, samples, hits}；
+    空序列 → 先验（mean=base，与 hit_rate 空历史兜底同值）。
+    ci95 用正态近似 mean±1.96σ（零依赖；样本大时近似良好，小样本区间
+    偏窄，故另带 samples 供阅读方自判权重）。
+    """
+    a0 = float(base) * float(prior_k)
+    b0 = (1.0 - float(base)) * float(prior_k)
+    xs = [bool(x) for x in (hits or [])]
+    k = sum(1 for x in xs if x)
+    n = len(xs)
+    a, b = a0 + k, b0 + (n - k)
+    mean = a / (a + b)
+    var = (a * b) / ((a + b) ** 2 * (a + b + 1.0))
+    std = var ** 0.5
+    return {"alpha": round(a, 4), "beta": round(b, 4),
+            "mean": round(mean, 4), "std": round(std, 4),
+            "ci95": [round(max(0.0, mean - 1.96 * std), 4),
+                     round(min(1.0, mean + 1.96 * std), 4)],
+            "samples": n, "hits": k}
+
+
+def channel_history(cg, limit=HIT_HISTORY_MAX):
+    """feedback 留痕按通道分组（P-T-74 通道级可信度）→ {channel: [hit...]}。
+
+    通道 = 预测发出的面（feedback 的 `channel` 参数，如 "causal"/"semantic"）。
+    早期留痕无 channel 字段 → 归 "unlabeled"（诚实标注，不冒充分通道）。
+    """
+    out = {}
+    for r in _read_log(cg, limit=limit):
+        if r.get("type") != "feedback":
+            continue
+        ch = str(r.get("channel") or "unlabeled")
+        out.setdefault(ch, []).append(bool(r.get("hit")))
+    return out
+
+
+def channel_posterior(cg, channel=None, limit=HIT_HISTORY_MAX):
+    """通道级后验查询：channel=None → 全量+分通道；channel=str → 单通道。"""
+    hist = channel_history(cg, limit=limit)
+    if channel is not None:
+        ch = str(channel)
+        post = beta_posterior(hist.get(ch) or [])
+        post["channel"] = ch
+        return post
+    all_hits = [x for hits in hist.values() for x in hits]
+    return {"all": beta_posterior(all_hits),
+            "channels": {ch: beta_posterior(hits)
+                         for ch, hits in sorted(hist.items())}}
+
+
 def score_route(cg, route, verification=None):
     """D-004 T_pred 四维评分（verification 跨路线共享，来自命中率）。"""
     trend = float(route.get("confidence") or 0.0)
@@ -610,10 +676,17 @@ def dynamic_hit_threshold(cg, limit=HIT_HISTORY_MAX):
 
 
 def feedback(cg, predicted_node_id, actual_node_id=None, hit=None, note="",
-             actor="predict"):
+             actor="predict", sync_self=True, channel=None):
     """预测反馈（D-006）：hit → 边置信度 +0.05；miss → 登记 rejected。
 
     `hit` 未显式给出时按 `predicted == actual` 判定。
+    `channel`（可选，P-T-74）：预测发出的面（如 "causal"/"semantic"），
+    供通道级 Beta-Bernoulli 后验（channel_posterior）按面分层估计可信度；
+    不传 → 留痕归 "unlabeled"，不改变任何既有行为。
+
+    `sync_self`（默认 True）：反馈后**回写自我模型**——刷新自我状态卡的
+    「预测校准」面，形成「预测 → 事实 → 误差 → 自我更新」闭环。
+    自我模型是二阶观测，其刷新失败不阻塞一阶反馈结果。
     """
     pred = str(predicted_node_id or "").strip()
     act = str(actual_node_id or "").strip() or pred
@@ -621,7 +694,8 @@ def feedback(cg, predicted_node_id, actual_node_id=None, hit=None, note="",
         hit = (pred == act)
     hit = bool(hit)
     _append(cg, {"type": "feedback", "t": time.time(), "predicted": pred,
-                 "actual": act, "hit": hit, "note": str(note or "")[:200]})
+                 "actual": act, "hit": hit, "note": str(note or "")[:200],
+                 "channel": (str(channel) if channel else None)})
     out = {"ok": True, "hit": hit, "predicted": pred, "actual": act}
     if hit:
         out["boosted"] = _boost_incoming(cg, act, EDGE_BOOST, actor=actor)
@@ -634,6 +708,14 @@ def feedback(cg, predicted_node_id, actual_node_id=None, hit=None, note="",
         except Exception as exc:                              # pragma: no cover
             out["rejected_error"] = str(exc)
     out.update(dynamic_hit_threshold(cg))
+    # 闭环：预测误差 → 自我模型更新。延迟导入避免与 self_state 的循环依赖，
+    # 且自我模型刷新属于二阶观测，失败不阻塞一阶反馈结果。
+    if sync_self:
+        try:
+            from . import self_state
+            out["self_state"] = self_state.refresh(cg, actor=actor)
+        except Exception as exc:                          # pragma: no cover
+            out["self_state_error"] = str(exc)
     return out
 
 
@@ -814,6 +896,7 @@ def stats(cg, limit=20):
             "feedback_samples": len(h), "hits": sum(1 for x in h if x),
             "hit_rate": (round(sum(1 for x in h if x) / len(h), 4) if h
                          else BASE_HIT_RATE),
+            "beta": channel_posterior(cg),
             "dynamic": dynamic_hit_threshold(cg),
             "recent": recs[-int(limit):] if limit else []}
 
@@ -894,6 +977,8 @@ def catalog():
             "D-004": "T_pred 四维评分 trend/boundary/verification/balance",
             "D-005": "AttentionPolicy 适配器 + 降级（边置信度排序）",
             "D-006": "命中率动态校准（样本 < 50 不触发反思）",
+            "P-T-73/74": "通道贝叶斯后验（Beta-Bernoulli，置信度≠可信度；"
+                         "feedback channel 参数 + channel_posterior 查询）",
         },
         "weights": {"trend": W_TREND, "boundary": W_BOUNDARY,
                     "verification": W_VERIFICATION, "balance": W_BALANCE},