@furongjun1999/dsh-memory 0.4.6 → 0.4.8

package/md_cg/test_audit_rotate.py

@@ -0,0 +1,270 @@
+# -*- coding: utf-8 -*-
+"""审计日志分片轮转验证（治本：给无上界增长装上界）。
+
+背景（第 4 条取证，2026-09-16）：审计日志无上界增长——实测 ~2 条/s 持续写入、
+累计 ~21.5 M 条 / 4.0 GB，且单文件形态使任何「读它」的操作随运行时长线性劣化。
+上一轮把**体检读数**降为 O(1) 元数据口径（_log_scale），只让「指标与代价错配」
+不再显形；**有界性的来源是轮转**：单文件 ≤ AUDIT_ROTATE_BYTES、分片数 ≤
+AUDIT_KEEP_SHARDS ⇒ 单片读取代价与总量都有上界。
+
+断言面：
+  ① 未达阈值不轮转（不产生空转切分）
+  ② 达阈值切分：产生归档分片、活动文件被重建
+  ③ 切分无损：轮转前记录序列是轮转后序列的前缀（rename 不动字节）
+  ④ 轮转自述留痕（首条新记录 op=audit_rotate，不静默）
+  ⑤ audit_scale 聚合口径 == 全量写入条数（分片走索引 + 活动实时）
+  ⑥ audit_records 跨分片按时间序合并 / limit 取尾部
+  ⑦ 保留策略：超 keep 淘汰最旧分片且索引同步
+  ⑧ health_os 透出轮转面（shards/total_bytes/total_exact）
+  ⑨ 可关闭：ROTATE_BYTES=0 → 不切分（退回无上界，供对照/应急）
+  ⑩ 超大历史分片分档读数：exact=False 且**零全量计数**（O(n) 守卫——否则刚修好的
+     「一次调用堵死通道」会在轮转路径上原样复现）
+  ⑪ 稳态 O(1)：二次 audit_scale 不重数分片（索引缓存生效）
+  ⑫ 归档目录不在 LAYERS → 不参与节点索引
+
+运行：python -m md_cg.test_audit_rotate
+"""
+from __future__ import annotations
+
+import os
+import shutil
+import tempfile
+
+from . import mdcos as mdcos_mod
+from .mdcos import MdCGOS
+
+PASS = FAIL = 0
+FAILS = []
+
+
+def ok(cond, label):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+    else:
+        FAIL += 1
+        FAILS.append(label)
+        print(f"  FAIL {label}")
+
+
+class _Spy:
+    """记录 mdcos 模块级 count_jsonl / read_jsonl 的调用路径（O(n) 守卫）。"""
+
+    def __enter__(self):
+        self.read, self.count = [], []
+        self._read, self._count = mdcos_mod.read_jsonl, mdcos_mod.count_jsonl
+        spy = self
+
+        def _r(p, *a, **k):
+            spy.read.append(p)
+            return spy._read(p, *a, **k)
+
+        def _c(p, *a, **k):
+            spy.count.append(p)
+            return spy._count(p, *a, **k)
+
+        mdcos_mod.read_jsonl, mdcos_mod.count_jsonl = _r, _c
+        return self
+
+    def __exit__(self, *exc):
+        mdcos_mod.read_jsonl, mdcos_mod.count_jsonl = self._read, self._count
+        return False
+
+
+def _mk(tmp, name, rotate=2048, keep=8, probe=1, count_max=None):
+    root = os.path.join(tmp, name)
+    os.makedirs(root, exist_ok=True)
+    cg = MdCGOS(root)
+    cg.AUDIT_ROTATE_BYTES = rotate
+    cg.AUDIT_KEEP_SHARDS = keep
+    cg.AUDIT_PROBE_EVERY = probe
+    if count_max is not None:
+        cg.AUDIT_COUNT_MAX_BYTES = count_max
+    return cg
+
+
+def _fill(cg, n, tag="x"):
+    for i in range(n):
+        cg._audit("add", "node_%s_%d" % (tag, i), pad="z" * 160)
+
+
+def main():
+    tmp = tempfile.mkdtemp(prefix="mdcg_rotate_")
+    try:
+        # ================= A：基本轮转 + 无损 + 聚合 + 尾部读 =================
+        cg = _mk(tmp, "a", rotate=(1 << 30))       # 先给超大阈值 → 不轮转
+        _fill(cg, 20, "p")
+
+        # ---------- ① 未达阈值不轮转 ----------
+        ok(not cg._audit_shards(),
+           "①未达阈值 → 零分片（无空转切分）")
+        ok(os.path.getsize(cg.audit_log) > 0 and len(cg.audit_records()) == 20,
+           "①b活动文件承载全部记录（20 条），不提前分片")
+
+        before = [r.get("id") for r in cg.audit_records()]
+
+        # ---------- ② 达阈值切分 ----------
+        cg.AUDIT_ROTATE_BYTES = 2048
+        _fill(cg, 20, "q")
+        shards = cg._audit_shards()
+        ok(len(shards) >= 1,
+           "②达阈值 → 产生归档分片（%s）" % (shards or "无"))
+        ok(all(n.startswith("_audit.") and n.endswith(".jsonl") for n in shards),
+           "②b分片命名规范（_audit.<6位序号>.jsonl，字典序==时间序）")
+        ok(os.path.exists(cg.audit_log),
+           "②c活动文件被重建（最新记录始终在 _audit.jsonl，读尾调用方不受影响）")
+
+        # ---------- ③ 切分无损 ----------
+        after = cg.audit_records()
+        ids = [r.get("id") for r in after if r.get("op") != "audit_rotate"]
+        ok(ids[:len(before)] == before,
+           "③轮转不丢记录：轮转前序列是轮转后序列的前缀（%d→%d 条）"
+           % (len(before), len(after)))
+        ok(len(after) == len(before) + 20 + len([r for r in after
+                                                 if r.get("op") == "audit_rotate"]),
+           "③b条数守恒：轮转前 %d + 新增 20 + 自述 %d == %d"
+           % (len(before), len([r for r in after if r.get("op") == "audit_rotate"]),
+              len(after)))
+
+        # ---------- ④ 自述留痕 ----------
+        marks = [r for r in after if r.get("op") == "audit_rotate"]
+        ok(bool(marks) and marks[0].get("id") in shards,
+           "④轮转自述留痕（op=audit_rotate，id 指向分片名，不静默）")
+
+        # ---------- ⑤ 聚合口径 ----------
+        sc = cg.audit_scale()
+        ok(sc["total_events"] == len(after) and sc["total_exact"] is True,
+           "⑤audit_scale 聚合 == 全量写入条数（%s vs %d），且标注精确"
+           % (sc["total_events"], len(after)))
+        ok(sc["shards"] == len(shards) and sc["oversized"] == 0,
+           "⑤b分片计数 + 零超大分片（阈值内分片走精确计数）")
+        ok(sc["total_bytes"] == sc["bytes"] + sc["shard_bytes"],
+           "⑤c总量字节 = 活动 + 分片（%d = %d + %d）"
+           % (sc["total_bytes"], sc["bytes"], sc["shard_bytes"]))
+        ok(sc["rotate_bytes"] == 2048 and sc["keep_shards"] == 8,
+           "⑤d读数透出轮转参数（有界性可观测，不用猜配置）")
+
+        # ---------- ⑥ 跨分片合并 / limit 尾部读 ----------
+        tail = cg.audit_records(limit=3)
+        ok(len(tail) == 3 and [r.get("id") for r in tail]
+           == [r.get("id") for r in after[-3:]],
+           "⑥limit=3 取尾部 3 条（巡检不必把有界日志读成全量）")
+
+        # ---------- ⑧ health_os 透出轮转面 ----------
+        o = cg.health_os()["os"]
+        ok(o["audit_shards"] == len(shards) and o["audit_total_exact"] is True
+           and o["audit_total_bytes"] == sc["total_bytes"],
+           "⑧health_os 透出轮转面（shards/total_bytes/total_exact）")
+
+        # ---------- ⑪ 稳态 O(1)：索引缓存生效 ----------
+        # 口径：守的是「分片不被重数」（分片走索引缓存）；活动文件的精确计数是
+        # **有界**代价（size ≤ AUDIT_ROTATE_BYTES），属设计内。
+        with _Spy() as spy:
+            sc2 = cg.audit_scale()
+        ok(not any(os.path.basename(p) in shards for p in spy.count),
+           "⑪二次 audit_scale 未重数任何分片（走索引缓存）[count=%s]" % spy.count)
+        ok(sc2["total_events"] == sc["total_events"],
+           "⑪b稳态读数一致（%s == %s），缓存不改变结论"
+           % (sc2["total_events"], sc["total_events"]))
+
+        # ---------- ⑫ 归档目录不参与节点索引 ----------
+        ok(not any("_audit" in k for k in cg.index["nodes"]),
+           "⑫归档目录不在 LAYERS → 分片不参与节点索引（检索面零污染）")
+
+        cg.close()
+
+        # ================= B：保留策略（淘汰最旧分片） =================
+        cgb = _mk(tmp, "b", rotate=2048, keep=2)
+        _fill(cgb, 60, "b")
+        sb = cgb._audit_shards()
+        ok(len(sb) == 2,
+           "⑦分片数受 keep 约束（保留最近 2 片，实际 %d）" % len(sb))
+        pruned = [r for r in cgb.audit_records() if r.get("op") == "audit_rotate"
+                  and r.get("pruned")]
+        ok(bool(pruned) and len(pruned[0]["pruned"]) >= 1,
+           "⑦b淘汰非静默：pruned 名单写进审计（%s）"
+           % (pruned[0]["pruned"] if pruned else "无"))
+        idx = cgb._load_audit_index()
+        ok(all(n in idx for n in sb) and all(n in sb for n in idx),
+           "⑦c索引与磁盘分片对齐（淘汰即摘索引，不留悬空项）")
+        cgb.close()
+
+        # ================= C：可关闭（退回无上界） =================
+        cgc = _mk(tmp, "c", rotate=0)
+        _fill(cgc, 40, "c")
+        ok(not cgc._audit_shards() and os.path.getsize(cgc.audit_log) > 0,
+           "⑨ROTATE_BYTES=0 → 不切分（应急/对照可退回无上界形态）")
+        cgc.close()
+
+        # ================= D：超大历史分片分档（O(n) 守卫） =================
+        cgd = _mk(tmp, "d", rotate=2048, keep=8, count_max=512)
+        _fill(cgd, 20, "d")
+        sd = cgd._audit_shards()
+        ok(bool(sd), "⑩超大分档前置：至少产生 1 个分片（%s）" % (sd or "无"))
+        with _Spy() as spy:
+            scd = cgd.audit_scale()
+        ok(scd["oversized"] >= 1 and scd["total_exact"] is False,
+           "⑩b历史超大分片 → oversized=%d、total_exact=False（不假装精确）"
+           % scd["oversized"])
+        ok(not any(os.path.basename(p) in sd for p in spy.count),
+           "⑩c超大分片零全量计数（走 _log_scale 元数据口径）——"
+           "否则「一次调用堵死通道」会在轮转路径上复现")
+        cgd.close()
+
+        # ================= E：真实规模（~113 MB 活动文件）轮转不得全量解析 =====
+        # 这是「4.0 GB 历史日志」场景的等价缩小版：轮转必须只做 rename（O(1)），
+        # 绝不能在写路径上解析整个文件——否则刚修好的「通道被堵死」原样复现。
+        import json as _json
+        import time as _time
+
+        cge = _mk(tmp, "e", rotate=64 << 20, keep=8, probe=1)
+        line = _json.dumps({"t": 1.0, "op": "add", "id": "bulk",
+                            "pad": "z" * 200}) + "\n"
+        with open(cge.audit_log, "w", encoding="utf-8") as f:
+            for _ in range(70):                 # 70 × ~1.6 MB ≈ 113 MB
+                f.write(line * 7000)
+        size_bulk = os.path.getsize(cge.audit_log)
+        rss0 = None
+        try:
+            import psutil
+            rss0 = psutil.Process(os.getpid()).memory_info().rss
+        except Exception:                       # noqa: BLE001 —— 无 psutil 则不假装
+            pass
+        t0 = _time.time()
+        cge._audit("add", "after_bulk")         # 探测到超阈值 → 触发轮转
+        rotate_dt = _time.time() - t0
+        ok(rotate_dt < 5.0,
+           "⑬超大活动文件（%.0f MB）轮转在秒级完成（%.2fs）——rename O(1)，"
+           "写路径不解析全量" % (size_bulk / 1048576.0, rotate_dt))
+        se = cge._audit_shards()
+        idxe = cge._load_audit_index()
+        ok(len(se) == 1 and idxe[se[0]]["bytes"] == size_bulk,
+           "⑬b超大分片登记字节 == 轮转前大小（%d），内容未重写"
+           % size_bulk)
+        ok(idxe[se[0]]["exact"] is False,
+           "⑬c超大分片条数走元数据口径（exact=False，不假装精确）")
+        t1 = _time.time()
+        sce = cge.audit_scale()
+        scale_dt = _time.time() - t1
+        ok(sce["oversized"] == 1 and sce["total_bytes"] >= size_bulk,
+           "⑬d体检识别 oversized=%d、总量 %.0f MB（历史分片仍在总量核算内）"
+           % (sce["oversized"], sce["total_bytes"] / 1048576.0))
+        if rss0 is not None:
+            import psutil
+            rss_delta = psutil.Process(os.getpid()).memory_info().rss - rss0
+            ok(rss_delta < (300 << 20) and scale_dt < 2.0,
+               "⑬e轮转+体检 RSS 增量 %.0f MB < 300 MB、体检 %.2fs —— 不物化不阻塞"
+               % (rss_delta / 1048576.0, scale_dt))
+        cge.close()
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+
+    print(f"\naudit_rotate: {PASS} pass / {FAIL} fail")
+    if FAILS:
+        for f in FAILS:
+            print(f" - {f}")
+    raise SystemExit(1 if FAIL else 0)
+
+
+if __name__ == "__main__":
+    main()

package/md_cg/test_autonomy.py

@@ -0,0 +1,117 @@
+# -*- coding: utf-8 -*-
+"""信息差驱动自主探索闭环（autonomy.explore）验证。
+
+断言面：
+  ① 无信号诚实：空反思日志 → 零提案、零步骤（不编造探索价值）
+  ② 信号聚合排序：|d2| 加速度 + BLINDSPOT/DEFER 计数 → 高信息差排前，
+     提案携带证据明细
+  ③ 全链路：提案 → learn_blindspots 五态终判 → 留痕 _explore.jsonl
+  ④ 幂等：重复 explore 终态一致、gap 回写不重复（gap_<sha1(bid)> 幂等）
+
+运行：python -m md_cg.test_autonomy
+"""
+from __future__ import annotations
+
+import os
+import shutil
+import tempfile
+
+from . import autonomy
+from .fsutil import append_jsonl
+from .mdcos import MdCGOS
+
+PASS = FAIL = 0
+FAILS = []
+
+
+def ok(cond, label):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+    else:
+        FAIL += 1
+        FAILS.append(label)
+        print(f"  FAIL {label}")
+
+
+def _sig(cg, t, query, d2, states):
+    append_jsonl(cg.reflection_log,
+                 {"t": t, "query": query, "d_prev": 1.0, "d_curr": 1.0,
+                  "d_delta": 0.0, "d2": d2, "states": states,
+                  "n_results": 3, "feedback": None})
+
+
+def main():
+    tmp = tempfile.mkdtemp(prefix="mdcg_autonomy_")
+    try:
+        root = os.path.join(tmp, "root")
+        os.makedirs(root, exist_ok=True)
+        cg = MdCGOS(root)
+
+        # ---------- ① 无信号诚实 ----------
+        pr = autonomy.proposals(cg)
+        ok(pr["ok"] and not pr["proposals"] and pr["n_signals"] == 0,
+           "①空反思日志 → 零提案（不编造探索价值）")
+        ex = autonomy.explore(cg)
+        ok(ex["ok"] and not ex["steps"],
+           "①b空信号 explore → 零步骤、ok=True")
+
+        # ---------- ② 信号聚合排序 ----------
+        _sig(cg, 1.0, "反应堆冷却方案", 0.9, {"BLINDSPOT": 2})
+        _sig(cg, 2.0, "反应堆冷却方案", 0.7, {"BLINDSPOT": 1})
+        _sig(cg, 3.0, "周末菜单", 0.05, {})
+        pr = autonomy.proposals(cg, limit=3)
+        ps = pr["proposals"]
+        ok(pr["n_signals"] == 2 and len(ps) == 2,
+           "②两查询聚类（同 query 归一）、n_signals=2")
+        ok(ps[0]["query"] == "反应堆冷却方案" and ps[0]["score"] > ps[1]["score"],
+           "②b高信息差排前（Σ|d2|=1.6 + BLINDSPOT×3 ＞ 0.05）")
+        ok("d2" in ps[0]["reason"] and "BLINDSPOT" in ps[0]["reason"],
+           "②c提案携带证据明细（可审计）")
+
+        # ---------- ③ 全链路：提案 → 五态终判 → 留痕 ----------
+        cg.add("k1", "# 功能名：反应堆冷却知识\n"
+                     "# 生效条件：问反应堆冷却方案\n"
+                     "# 子功能：知识片段\n"
+                     "# 执行：陈述知识\n"
+                     "# 验证方式：test\n"
+                     "# 不适用条件：无\n"
+                     "反应堆冷却方案概述。\n",
+               layer="knowledge", verification_basis="test")
+        ex = autonomy.explore(cg, apply=True, actor="test")
+        st0 = ex["steps"][0] if ex["steps"] else {}
+        ok(bool(ex["steps"]) and st0.get("terminal") in
+           ("unknowable", "no_anchor", "unresolved", "carried", "resolved"),
+           f"③提案进入五态终判（terminal={st0.get('terminal')}，"
+           f"routes={st0.get('routes')}）")
+        if st0.get("terminal") in ("carried", "unresolved"):
+            ok(bool(st0.get("written")),
+               f"③b carried/unresolved 已回写 gap_hint（{st0.get('written')}）")
+        else:
+            ok(True, f"③b终态={st0.get('terminal')}：按诚实原则无需回写"
+                     "（resolved=已有可判定终点；no_anchor=先补锚点）")
+        ok(os.path.exists(autonomy._explore_log_path(cg)),
+           "③c探索留痕 _explore.jsonl 落盘")
+
+        # ---------- ④ 幂等 ----------
+        ex2 = autonomy.explore(cg, apply=True, actor="test")
+        st2 = ex2["steps"][0] if ex2["steps"] else {}
+        ok(st2.get("terminal") == st0.get("terminal"),
+           "④重复 explore 终态一致（判定确定性）")
+        if st0.get("terminal") in ("carried", "unresolved"):
+            ok(not st2.get("written"),
+               "④b gap 回写幂等（第二次 written=None，节点已存在）")
+        else:
+            ok(True, "④b本终态无回写动作，幂等性由判定确定性保证")
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+
+    print(f"\nautonomy: {PASS} passed, {FAIL} failed")
+    if FAILS:
+        for f in FAILS:
+            print(f"  - {f}")
+    raise SystemExit(1 if FAIL else 0)
+
+
+if __name__ == "__main__":
+    main()

package/md_cg/test_branches.py

@@ -0,0 +1,249 @@
+# -*- coding: utf-8 -*-
+"""记忆演化分支（branches，Pi 移植④）验收：交接文档 §3④。
+
+蓝图验收两条：
+① fork → 分支改写 → merge 后主支节点 derived_from 链完整可回溯；
+② 放弃分支不污染主支检索（召回主支时分支节点零命中）。
+"""
+
+import os
+import shutil
+import sys
+import tempfile
+import traceback
+
+from . import branches
+from .mdcos import MdCGSecure
+from .security import AccessDenied, Principal
+
+_ok = 0
+_bad = []
+
+
+def _check(name, cond, detail=""):
+    global _ok
+    if cond:
+        _ok += 1
+        print("  ok   %s" % name)
+    else:
+        _bad.append("%s %s" % (name, detail))
+        print("  FAIL %s %s" % (name, detail))
+
+
+def _mk_cg(tmp, role="designer", seq=[0]):
+    seq[0] += 1
+    root = os.path.join(tmp, "root_%02d_%s" % (seq[0], role))
+    p = Principal(tenant="default", actor="t_" + role, role=role,
+                  can_write=(role != "guest"),
+                  can_admin=(role == "designer"))
+    return MdCGSecure(root, principal=p)
+
+
+def _fm(cg, nid):
+    rec = cg.get(nid) or {}
+    return rec.get("frontmatter") or {}
+
+
+def _content(cg, nid):
+    return ((cg.get(nid) or {}).get("content") or "").strip()
+
+
+def _hits(cg, q, **kw):
+    """命中集 id 清单（零污染断言的口径：分支 nid 不出现，而非结果为空——
+    T3 全扫兜底本就会返回低分主支节点，那是检索器既有行为不是污染）。"""
+    return [h[0].get("id") for h in cg.search(q, **kw)[0]]
+
+
+def main():
+    tmp = tempfile.mkdtemp(prefix="branches_")
+    try:
+        _run(tmp)
+    except Exception:
+        traceback.print_exc()
+        _bad.append("未捕获异常")
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+    print("\nbranches 验收：%d 通过%s" % (
+        _ok, ("，%d 失败：%s" % (len(_bad), "; ".join(_bad))) if _bad else ""))
+    return 1 if _bad else 0
+
+
+def _run(tmp):
+    # ---------- 1 fork：副本血缘 + 防呆 + 幂等 ----------
+    cg = _mk_cg(tmp)
+    cg.add("mem_a", "A内容alpha", layer="knowledge", verification_basis="test",
+           consistency=False)
+    cg.add("mem_b", "B内容beta", layer="contextual", verification_basis="test",
+           consistency=False, derived_from=["anc1"], relation="merged_from")
+    r = branches.fork(cg, ["mem_a", "mem_b"], branch_id="exp1", note="实验一")
+    _check("fork成功", r.get("ok") is True and r.get("branch_id") == "exp1",
+           repr(r))
+    fm_a = _fm(cg, "mem_a@exp1")
+    _check("副本血缘", fm_a.get("branch_id") == "exp1"
+           and fm_a.get("branched_from") == "mem_a"
+           and fm_a.get("derived_from") == ["mem_a"]
+           and fm_a.get("derived_relation") == "split_from", repr(fm_a))
+    _check("副本内容继承", _content(cg, "mem_a@exp1") == "A内容alpha")
+    _check("fork空入参拒", branches.fork(cg, []).get("ok") is False)
+    _check("fork非法id拒", branches.fork(
+        cg, ["mem_a"], branch_id="BAD ID!").get("ok") is False)
+    r2 = branches.fork(cg, ["mem_a", "mem_a", "mem_c"], branch_id="exp1")
+    _check("fork幂等skipped", r2.get("ok") is False
+           and len([s for s in r2.get("skipped", [])
+                    if "已存在" in s.get("why", "")]) == 2
+           and len([s for s in r2.get("skipped", [])
+                    if "不存在" in s.get("why", "")]) == 1, repr(r2))
+
+    # ---------- 2 蓝图验收②：主支检索零污染 ----------
+    # 分支上改写副本走 rewrite（唯一正路）——add 是全量重建 fm，裸 add
+    # 不重传 branch_id 会让副本在索引里退化成主支（实验泄漏进主支检索）。
+    rr = branches.rewrite(cg, "mem_a@exp1", "A改写exp版")
+    _check("rewrite改写成功", rr.get("ok") is True
+           and rr.get("branch_id") == "exp1", repr(rr))
+    # rewrite 防呆：非分支/不存在拒；归属与血缘不可篡改（extra 伪造键被剥离）
+    _check("rewrite非分支拒", branches.rewrite(
+        cg, "mem_a", "x").get("ok") is False)
+    _check("rewrite不存在拒", branches.rewrite(
+        cg, "mem_z@exp1", "x").get("ok") is False)
+    branches.rewrite(cg, "mem_a@exp1", "A改写exp版", branch_id="伪造",
+                     branched_from="mem_zzz", derived_from=["fake"])
+    fm_rr = _fm(cg, "mem_a@exp1")
+    _check("rewrite归属不可篡改", fm_rr.get("branch_id") == "exp1"
+           and fm_rr.get("branched_from") == "mem_a"
+           and fm_rr.get("derived_from") == ["mem_a"], repr(fm_rr))
+    _check("主支检索分支内容零命中",
+           "mem_a@exp1" not in _hits(cg, "A改写exp版"),
+           repr(_hits(cg, "A改写exp版")))
+    _check("主支检索原内容仍命中", bool(cg.search("A内容alpha")[0]))
+    _check("分支内检索命中改写",
+           bool(branches.search(cg, "A改写exp版", "exp1")[0]),
+           repr(branches.search(cg, "A改写exp版", "exp1")))
+    _check("分支内检索主支也可见",
+           bool(branches.search(cg, "B内容beta", "exp1")[0]))
+    # 其他分支互不可见（用各自独有内容词验：对方分支 nid 不在命中集）
+    branches.fork(cg, ["mem_a"], branch_id="exp2")
+    branches.rewrite(cg, "mem_a@exp2", "A改写exp2版")
+    h_e1 = [h[0].get("id") for h in branches.search(cg, "A改写exp2版",
+                                                    "exp1")[0]]
+    h_e2 = [h[0].get("id") for h in branches.search(cg, "A改写exp版",
+                                                    "exp2")[0]]
+    _check("跨分支隐身",
+           "mem_a@exp2" not in h_e1 and "mem_a@exp1" not in h_e2,
+           "e1=%r e2=%r" % (h_e1, h_e2))
+
+    # ---------- 3 蓝图验收①：merge 溯源链完整 ----------
+    r = branches.merge(cg, "exp1", reason="实验通过")
+    _check("merge成功", r.get("ok") is True and len(r.get("merged", [])) == 2,
+           repr(r))
+    _check("主支内容已回写", _content(cg, "mem_a") == "A改写exp版")
+    fm_a = _fm(cg, "mem_a")
+    chain = fm_a.get("derived_from") or []
+    _check("主支链追加分支且原链保留",
+           "mem_a@exp1" in chain
+           and fm_a.get("derived_relation") == "merged_from"
+           and fm_a.get("merged_from_branch") == "exp1", repr(fm_a))
+    anc = _fm(cg, "mem_b").get("derived_from") or []
+    _check("原链保留(mem_b)", "anc1" in anc and "mem_b@exp1" in anc, repr(anc))
+    _check("merge后主支检索命中回写", bool(cg.search("A改写exp版")[0]))
+    _check("merge幂等安全", branches.merge(cg, "exp1").get("ok") is True
+           and _content(cg, "mem_a") == "A改写exp版")
+    r = branches.merge(cg, "br_void")
+    _check("merge空分支拒", r.get("ok") is False)
+
+    # merge 时主支不可达 → skipped 不炸（索引与脏缓存一并摘除才是完整模拟）
+    cg2 = _mk_cg(tmp)
+    cg2.add("mem_x", "X内容", layer="knowledge", verification_basis="test",
+            consistency=False)
+    branches.fork(cg2, ["mem_x"], branch_id="orphan")
+    (cg2.index["nodes"]).pop("mem_x", None)
+    (cg2._dirty or {}).pop("mem_x", None)
+    r = branches.merge(cg2, "orphan")
+    _check("merge主支缺失skipped", r.get("ok") is False
+           and len(r.get("skipped", [])) == 1, repr(r))
+
+    # ---------- 4 discard：教训必填 + 冷归档 + 权限 ----------
+    cg3 = _mk_cg(tmp)
+    cg3.add("mem_k", "K内容", layer="knowledge", verification_basis="test",
+            consistency=False)
+    branches.fork(cg3, ["mem_k"], branch_id="dead")
+    branches.rewrite(cg3, "mem_k@dead", "K改写dead版")
+    r = branches.discard(cg3, "dead", "假设有错，教训：不要急")
+    _check("discard缺标记拒", r.get("ok") is False
+           and set(r.get("missing", [])) == {"分支假设", "实验结果"}
+           and r.get("required") == list(branches.BRANCH_MARKS), repr(r))
+    # guest 无 can_admin → 结构性拒绝（guest 无写权建不了节点，
+    # 分支由 designer 建好并 flush 后，guest 开同一 root 只试 discard）
+    branches.fork(cg3, ["mem_k"], branch_id="guest_br")
+    cg3.flush()
+    cg_guest = MdCGSecure(cg3.root,
+                          principal=Principal(tenant="default",
+                                              actor="t_guest", role="guest",
+                                              can_write=False,
+                                              can_admin=False))
+    try:
+        branches.discard(cg_guest, "guest_br",
+                         "分支假设x 实验结果y 教训z")
+        _check("discard需can_admin", False, "guest 未被拒")
+    except AccessDenied:
+        _check("discard需can_admin", True)
+    except Exception as e:  # noqa: BLE001
+        _check("discard需can_admin", False,
+               "异常=%s:%s" % (type(e).__name__, e))
+    # designer 全流程
+    r = branches.discard(cg3, "dead",
+                         "分支假设：覆盖写更快 实验结果：丢失血缘 教训：血缘必保留")
+    _check("discard成功", r.get("ok") is True and r.get("moved") == 1, repr(r))
+    _check("教训节点入库", bool(_fm(cg3, "branch_summary_dead")))
+    _check("教训节点可检索", bool(cg3.search("血缘必保留")[0]),
+           repr(cg3.search("血缘必保留")))
+    cold = os.path.join(cg3.root, branches.COLD_DIR, "dead",
+                        "mem_k@dead.md")
+    _check("分支文件冷区保留", os.path.exists(cold), cold)
+    _check("索引已摘除", "mem_k@dead" not in cg3.index["nodes"])
+    _check("list_branches已不含", all(
+        b.get("branch_id") != "dead"
+        for b in branches.list_branches(cg3).get("branches", [])))
+    _check("discard空分支拒",
+           branches.discard(cg3, "dead", "分支假设a 实验结果b 教训c").get("ok")
+           is False)
+
+    # ---------- 5 list_branches 聚合 + insight act 分派冒烟 ----------
+    cg4 = _mk_cg(tmp)
+    cg4.add("mem_p", "P内容", layer="knowledge", verification_basis="test",
+            consistency=False)
+    branches.fork(cg4, ["mem_p"], branch_id="live1")
+    lst = branches.list_branches(cg4)
+    g = {b.get("branch_id"): b for b in lst.get("branches", [])}.get("live1")
+    _check("list_branches聚合", g is not None and g.get("nodes") == ["mem_p@live1"]
+           and g.get("branched_from") == ["mem_p"], repr(lst))
+    r = cg4.insight("fork", node_ids=["mem_p"], branch_id="live2", note="n")
+    _check("insight act=fork", r.get("ok") is True
+           and r.get("branch_id") == "live2", repr(r))
+    r = cg4.insight("branches")
+    _check("insight act=branches", r.get("ok") is True
+           and len(r.get("branches", [])) == 2, repr(r))
+    r = cg4.insight("branch_rewrite", node_id="mem_p@live2", content="P内容v2")
+    _check("insight act=branch_rewrite", r.get("ok") is True
+           and _content(cg4, "mem_p@live2") == "P内容v2", repr(r))
+    r = cg4.insight("branch_search", content="P内容v2", branch_id="live2")
+    _check("insight act=branch_search", bool(r[0]), repr(r))
+    r = cg4.insight("branch_merge", branch_id="live2", reason="r")
+    _check("insight act=branch_merge", r.get("ok") is True
+           and _content(cg4, "mem_p") == "P内容v2", repr(r))
+    r = cg4.insight("branch_discard", branch_id="live2",
+                    content="分支假设p 实验结果q 教训r")
+    _check("insight act=branch_discard", r.get("ok") is True, repr(r))
+
+    # ---------- 6 session 过滤正交不回归 ----------
+    cg5 = _mk_cg(tmp)
+    cg5.add("mem_s1", "会话一内容", layer="knowledge", verification_basis="test",
+            consistency=False)
+    branches.fork(cg5, ["mem_s1"], branch_id="sx")
+    res, meta = cg5.search("会话一内容", session="sess_zzz")
+    _check("session过滤与branch过滤正交", not res, repr(res))
+    res, meta = cg5.search("会话一内容")
+    _check("默认检索主支正常", bool(res), repr(meta))
+
+
+if __name__ == "__main__":
+    sys.exit(main())