@furongjun1999/dsh-memory 0.4.7 → 0.4.8

package/md_cg/test_p40_refine_worklist.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 """G6 · node_ 结构提炼抽检工单与扩批闸门（P40 设计态验收）。
 
-对照 `docs/认知图_G4-G8缺口裁定单_v0.1.md` §四 G6：`node_*`（P37 派生记忆）
+对照 `docs/mdcg/认知图_G4-G8缺口裁定单_v0.1.md` §四 G6：`node_*`（P37 派生记忆）
 自带 `ccg_exempt=true`，只声明「功能名 / 生效条件」，`子功能/执行/不适用条件` 全缺。
 条件 A 要求**先抽 20 条做提炼预演、人工核对提炼口径，绝不盲跑全量**。
 

package/md_cg/test_p41_evolve_patrol.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 """G7 · 自主演化巡检（把「有能力」变成「有驱动」）（P41 设计态验收）。
 
-对照 `docs/认知图_G4-G8缺口裁定单_v0.1.md` §五 G7：固化 / 重要性 / 去污染三类自我
+对照 `docs/mdcg/认知图_G4-G8缺口裁定单_v0.1.md` §五 G7：固化 / 重要性 / 去污染三类自我
 演化动作早已具备，但**没有任何驱动源**周期性问「现在有多少该固化 / 该重算的候选」，
 于是能力被饿死。本项给常驻循环挂上**只读**演化巡检 + **受控**自愈。
 

package/md_cg/test_p42_provenance.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 """G8 · 派生溯源（新增即建链 + 失败不阻断 + 悬空可检出）（P42 设计态验收）。
 
-对照 `docs/认知图_G4-G8缺口裁定单_v0.1.md` §六 G8：节点拆并/派生后**血缘丢失**，
+对照 `docs/mdcg/认知图_G4-G8缺口裁定单_v0.1.md` §六 G8：节点拆并/派生后**血缘丢失**，
 库根无 `_link.jsonl`、frontmatter 的派生字段全空，事后无从回答「这个节点从哪来」。
 本项只对**新增**节点常态化建链（历史不回填），且立三条硬约束。
 

package/md_cg/test_p43_pooling.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 """§七 · 召回分池与降权（P43 设计态验收）。
 
-对照 `docs/认知图_G4-G8缺口裁定单_v0.1.md` §七：索引/产物类节点（`code_`/`doc_`）
+对照 `docs/mdcg/认知图_G4-G8缺口裁定单_v0.1.md` §七：索引/产物类节点（`code_`/`doc_`）
 词面更易命中，在 `GLOBAL_CAP` 单条截断点**先把知识节点挤掉**。本项把截断额度
 **显式分池**（不是抬高额度），并立四条纪律。
 
@@ -41,7 +41,11 @@ PASS = FAIL = 0
 FAILS = []
 
 BODY = "召回截断 索引 分池 内容"
-QUERY = "召回截断"
+# 多词查询：索引类含全部查询词、知识类缺「分池」→ 相关度有**区分度**。
+# 原语料下 16 条分数全等（覆盖度口径），截断谁入榜只能由传入序决定——而传入序
+# 本身不确定（目录枚举 + 并行 prefetch），断言 `off=6` 实为顺序抽签的产物。
+QUERY = "召回截断 分池"
+KBODY = "召回截断 索引 内容"
 
 
 def ok(cond, label):
@@ -71,7 +75,12 @@ def _snapshot(root):
 
 
 def _mk(root):
-    """6 个索引类（code_/doc_）+ 10 个知识类，正文同源 → 词面完全等价竞争。"""
+    """6 个索引类（code_/doc_）+ 10 个知识类。
+
+    §七 的真实机制是「索引/产物类节点**词面命中率更高**」（正文短、查询词占比大），
+    故索引类正文短、知识类正文长（含背景说明），使索引类相似度**确实**高于知识类
+    ——挤占由相关度驱动，不依赖写入顺序（截断依据已改为相关度，见 `cut_by_relevance`）。
+    """
     cg = MdCGOS(root, actor="test")
     for i in range(4):
         cg.add(f"code_{i}", f"# 功能名：索引条目 {i}\n# 生效条件：条件 I\n\n{BODY} {i}\n",
@@ -80,7 +89,10 @@ def _mk(root):
         cg.add(f"doc_{i}", f"# 功能名：文档索引 {i}\n# 生效条件：条件 D\n\n{BODY} {i}\n",
                layer="knowledge", tags=["index"])
     for i in range(10):
-        cg.add(f"kp_{i}", f"# 功能名：知识 {i}\n# 生效条件：条件 K\n\n{BODY} {i}\n",
+        cg.add(f"kp_{i}",
+               f"# 功能名：知识 {i}\n# 生效条件：条件 K\n\n{KBODY} {i}\n"
+               f"备注：本条为知识类条目，含背景说明、推理链与引用出处，正文较长，"
+               f"查询词在全文中的占比因此显著低于索引类条目。\n",
                layer="knowledge")
     cg.add("n_rej", f"# 功能名：被否决\n# 生效条件：条件 R\n\n{BODY} 否\n",
            layer="rejected")
@@ -238,12 +250,27 @@ def main():
         # 但「乘数可复算」这一被测语义不变。
         base = {r[0]["id"]: r[1] for r in off}
         sc = {r[0]["id"]: r[1] for r in on}
-        ok(abs(sc["code_0"] - base.get("code_0", 0.0) * 0.6) < 1e-9,
-           f"(8) 索引类命中分 == 基础分 × 0.6（base={base.get('code_0', 0.0):.6f} → "
-           f"{sc.get('code_0', float('nan')):.6f}）")
-        common = [i for i in range(6) if f"kp_{i}" in base and f"kp_{i}" in sc]
-        ok(common and all(abs(sc[f"kp_{i}"] - base[f"kp_{i}"]) < 1e-9 for i in common),
-           f"(8) 知识类命中分不被削（权重 1.0；逐条比对 {len(common)} 条）")
+
+        def _pick_idx(d):
+            """挑一条「关闭态也有基础分」的索引类入榜条目。
+
+            截断依据改为相关度后，具体哪条索引入榜由分数序决定（不再是固定的
+            `code_0`——那正是按传入序截断时代的产物），故动态取。
+            """
+            return next((i for i in d if PL.pool_of(i) == "index" and i in base), None)
+
+        iid = _pick_idx(sc)
+        ok(iid is not None, "(8) 分池态含索引类条目（额度保底生效）")
+        ok(iid is not None and abs(sc[iid] - base[iid] * 0.6) < 1e-9,
+           f"(8) 索引类命中分 == 基础分 × 0.6（{iid}: base={base.get(iid, 0.0):.6f} → "
+           f"{sc.get(iid, float('nan')):.6f}）")
+        # 知识类权重 1.0 → 命中分应与关闭态同源分一致。不硬编码编号：关闭态额度
+        # 被索引类占满，只余 2 条知识类入榜，与分池态取的 6 条未必有同编号交集
+        # （全同分下由稳定序决定），故按「关闭态知识分基准」比对。
+        base_kp = [v for k, v in base.items() if k.startswith("kp_")]
+        sc_kp = [v for k, v in sc.items() if k.startswith("kp_")]
+        ok(base_kp and sc_kp and all(abs(v - base_kp[0]) < 1e-9 for v in sc_kp),
+           f"(8) 知识类命中分不被削（权重 1.0；base={base_kp[:1]} → on={sc_kp[:2]}）")
         ok(PL.weight_of("code_x", {}, True) == PL.WEIGHTS["index"]["weight"],
            "(8) weight_of 与表内系数一致")
         alt = {"knowledge": {"cap_ratio": 0.5, "weight": 1.0},
@@ -251,9 +278,10 @@ def main():
                "negative": {"cap_ratio": 0.1, "weight": 0.5}}
         on2, _m2 = cg.search(QUERY, k=20, record=False, pools=alt)
         sc2 = {r[0]["id"]: r[1] for r in on2}
-        ok(abs(sc2["code_0"] - base.get("code_0", 0.0) * 0.3) < 1e-9,
-           f"(8) 换表即换行为（base×0.3={base.get('code_0', 0.0) * 0.3:.6f} → "
-           f"{sc2.get('code_0', float('nan')):.6f}）")
+        iid2 = _pick_idx(sc2)
+        ok(iid2 is not None and abs(sc2[iid2] - base[iid2] * 0.3) < 1e-9,
+           f"(8) 换表即换行为（{iid2}: base×0.3={base.get(iid2, 0.0) * 0.3:.6f} → "
+           f"{sc2.get(iid2, float('nan')):.6f}）")
         ok(PL.caps(10, PL.resolve(alt)) == {"knowledge": 4, "index": 4, "negative": 2},
            f"(8) 换表额度同步可复算（实得 {PL.caps(10, PL.resolve(alt))}）")
 

package/md_cg/test_read_clip.py

@@ -0,0 +1,137 @@
+# -*- coding: utf-8 -*-
+"""md_cg · Pi⑦② read 截断 + 续读提示（_clip_text / _node_view / schema 落点）
+
+验收三件事：
+① 单次 read 返回受「2000 行 / 50KB」双阈值约束，且**不静默丢内容**——
+   截断必带 total_lines / total_bytes / next_offset / note；
+② 续读按 offset 连续取回可拼回原文（不丢不重，可裁决的等价性判据）；
+③ 小内容行为逐位兼容（不新增键、content 原样）——防回归。
+
+运行：python -m md_cg.test_read_clip
+"""
+
+import os
+import sys
+
+from .mcp_server import KERNEL_TOOLS, READ_MAX_BYTES, READ_MAX_LINES, \
+    _cg_call, _clip_text, _node_view
+
+_ok = 0
+_bad = []
+
+
+def check(name, cond, detail=""):
+    global _ok
+    if cond:
+        _ok += 1
+        print(f"  [ok] {name}" + (f"  · {detail}" if detail else ""))
+    else:
+        _bad.append(name)
+        print(f"  [FAIL] {name}  · {detail}")
+
+
+class _FakeCG:
+    """只实现 read 面所需的最小取节点契约。"""
+
+    def __init__(self, nodes):
+        self._nodes = nodes
+
+    def get(self, nid, *a, **k):
+        return self._nodes.get(nid)
+
+
+def main():
+    print("[A] _clip_text 双阈值与续读语义")
+    small = "第一行\n第二行\n第三行"
+    c = _clip_text(small)
+    check("A1 小文本原样返回（note 空串、无截断位点）",
+          c["text"] == small and c["truncated"] is False
+          and c["next_offset"] is None and c["total_lines"] == 3
+          and c["note"] == "", str(c)[:160])
+
+    many = "\n".join(f"line-{i:05d}" for i in range(READ_MAX_LINES + 500))
+    c = _clip_text(many)
+    check("A2 行数上限：超 2000 行截断且给出续读位点",
+          c["truncated"] is True and c["returned_lines"] == READ_MAX_LINES
+          and c["next_offset"] == READ_MAX_LINES + 1
+          and str(READ_MAX_LINES) in c["note"], c["note"])
+
+    wide = "\n".join("x" * 60 for _ in range(3000))   # 约定 180KB > 50KB
+    c = _clip_text(wide)
+    check("A3 字节上限生效（行未满 2000 但字节先到顶）",
+          c["truncated"] is True and c["returned_lines"] < READ_MAX_LINES
+          and len(c["text"].encode("utf-8")) <= READ_MAX_BYTES
+          and str(READ_MAX_BYTES) in c["note"], f"{c['returned_lines']}行/{c['total_bytes']}B")
+
+    # 续读拼接等价性：按 next_offset 连续取回，拼回必须与原文逐字一致
+    got, off, hops = [], 0, 0
+    while True:
+        c = _clip_text(many, offset=off)
+        got.append(c["text"])
+        hops += 1
+        if not c["truncated"]:
+            break
+        off = c["next_offset"]
+        if hops > 10:
+            break
+    check("A4 续读拼接 == 原文（不丢不重）",
+          "\n".join(got) == many and hops == 2, f"hops={hops}")
+
+    c = _clip_text("a\nb", offset=99)
+    check("A5 offset 越界：返回空并如实说明（不假装有内容）",
+          c["text"] == "" and c["truncated"] is False and "超出总行数" in c["note"],
+          c["note"])
+
+    c = _clip_text("y" * (READ_MAX_BYTES + 100))
+    check("A6 单行超字节上限也保底返回一行（不返回空）",
+          c["returned_lines"] == 1 and c["truncated"] is False
+          and len(c["text"]) == READ_MAX_BYTES + 100, str(c["returned_lines"]))
+
+    print("[B] _node_view 兼容与截断字段")
+    node = {"id": "n1", "path": "/p/n1.md", "frontmatter": {"layer": "knowledge"},
+            "content": "短内容"}
+    v = _node_view(node)
+    check("B1 小节点键集不变（零回归）",
+          set(v) == {"id", "path", "frontmatter", "content"}
+          and v["content"] == "短内容", str(sorted(v)))
+    check("B2 空节点维持 None（旧契约）", _node_view(None) is None)
+
+    big = dict(node, content=many)
+    v = _node_view(big)
+    check("B3 大节点截断 + 审计字段（truncated/next_offset/note）",
+          v["truncated"] is True and v["next_offset"] == READ_MAX_LINES + 1
+          and v["content_lines"] == READ_MAX_LINES + 500
+          and v["content"].split("\n")[-1] == f"line-{READ_MAX_LINES - 1:05d}",
+          str({k: v[k] for k in ("truncated", "next_offset", "content_lines")}))
+    v2 = _node_view(big, offset=v["next_offset"])
+    check("B4 按 next_offset 续读可取回尾部且拼回原文",
+          "\n".join([v["content"], v2["content"]]) == many
+          and v2["offset"] == READ_MAX_LINES + 1, str(v2["offset"]))
+
+    print("[C] 工具面落点（schema + 分发透传）")
+    cg = next(t for t in KERNEL_TOOLS if t["name"] == "cg")
+    props = cg["inputSchema"]["properties"]
+    check("C1 cg schema 暴露 offset 且描述含续读语义",
+          props["offset"]["type"] == "integer" and "next_offset" in props["offset"]["description"])
+    check("C2 read 面描述声明截断与续读（调用方可知情）",
+          "next_offset" in cg["description"] and "截断" in cg["description"])
+
+    fcg = _FakeCG({"n1": node})
+    out = _cg_call(fcg, {"op": "read", "node_id": "n1"})
+    check("C3 未传 offset：行为与旧版一致",
+          out["content"] == "短内容" and "truncated" not in out, str(out)[:160])
+    fcg = _FakeCG({"n1": big})
+    out = _cg_call(fcg, {"op": "read", "node_id": "n1", "offset": READ_MAX_LINES + 1})
+    check("C4 offset 经 _cg_call 透传到节点视图（真实续读通路）",
+          out["offset"] == READ_MAX_LINES + 1 and out["truncated"] is False
+          and out["content"].startswith(f"line-{READ_MAX_LINES:05d}")
+          and out["content"].endswith("line-02499"), str(out["offset"]))
+
+    print(f"\n结果：{_ok} 通过 / {len(_bad)} 失败")
+    if _bad:
+        print("失败项：" + "、".join(_bad))
+    return 1 if _bad else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_review_conformance.py

@@ -0,0 +1,310 @@
+# -*- coding: utf-8 -*-
+"""md_cg · 审核队列 conformance（数据健康不变量，pi storage conformance 口径）
+
+把存储承诺写成断言，防止未来改动静默破坏：
+  ① strict 锁语义：不能丢的写超时必须显式报错，而非静默放行退化为无锁并发
+  ② 幂等对账：同内容重试（超时重试/崩溃恢复）→ 幂等返回既有 pid，不重复入队
+  ③ 已裁决内容的对账：accepted/rejected 内容重提 → 返回原 pid + 终态
+  ④ 存量兼容：无 payload_hash 的旧格式记录参与对账（现算）
+  ⑤ 级联出清：主提案终态裁决后，同内容存量兄弟提案自动关闭
+  ⑥ close/reopen 状态保持：重开实例后队列视图一致
+  ⑦ 并发幂等（真多进程）：N 进程同内容并发 propose → 恰好 1 条、pid 全同
+  ⑧ 并发不丢（真多进程）：N 进程×M 条不同内容 → inbox 读回恰好 N×M 条
+  ⑨ decisions 并发不丢（真多进程）：并发裁决 → 记录恰好 N 条且指纹完整
+
+运行：python -m md_cg.test_review_conformance
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+
+from .fsutil import FileLock, append_jsonl
+from .mdcos import MdCGOS
+from .security import Principal
+from .mdcos import MdCGSecure
+
+PASS = FAIL = 0
+FAILS = []
+
+REPO = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+WORKER = '''# -*- coding: utf-8 -*-
+"""conformance worker：子进程内建 MdCGOS 执行单次 propose / review_decide。"""
+import json
+import sys
+
+sys.path.insert(0, sys.argv[1])
+from md_cg.mdcos import MdCGOS
+
+root, mode = sys.argv[2], sys.argv[3]
+arg = sys.argv[4] if len(sys.argv) > 4 else ""
+cg = MdCGOS(root, actor="conf-worker")
+if mode == "propose":                 # arg = content
+    print(json.dumps(cg.propose("w-node", arg, layer="knowledge", tags=["w"])))
+elif mode == "propose_n":             # arg = json list of contents
+    out = [cg.propose("w-node-%d" % i, c, layer="knowledge")
+           for i, c in enumerate(json.loads(arg))]
+    print(json.dumps(out))
+elif mode == "decide":                # arg = pid
+    print(json.dumps(cg.review_decide(arg, "reject", reason="conformance")))
+'''
+
+
+def check(name, cond, detail=""):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  [PASS] {name}" + (f"  · {detail}" if detail else ""))
+    else:
+        FAIL += 1
+        FAILS.append(name)
+        print(f"  [FAIL] {name}  · {detail}")
+
+
+def _ensure_worker(workdir):
+    wk = os.path.join(workdir, "worker.py")
+    if not os.path.exists(wk):
+        with open(wk, "w", encoding="utf-8") as f:
+            f.write(WORKER)
+    return wk
+
+
+def _run_worker(workdir, root, mode, arg="", timeout=120):
+    """子进程跑 worker（argv 列表 + UTF-8 + shell=False，纪律 15）。"""
+    wk = _ensure_worker(workdir)
+    env = dict(os.environ, PYTHONUTF8="1")
+    return subprocess.run(
+        [sys.executable, wk, REPO, root, mode, arg],
+        capture_output=True, text=True, encoding="utf-8", errors="replace",
+        timeout=timeout, env=env, shell=False)
+
+
+def main():
+    workdir = tempfile.mkdtemp(prefix="mdcg_conf_wk_")
+    root = tempfile.mkdtemp(prefix="mdcg_conf_")
+    root2 = root2b = root3 = root4 = ""
+    _ensure_worker(workdir)
+    try:
+        cg = MdCGOS(root, actor="test")
+
+        # ---------------- ① strict 锁语义 ----------------
+        print("\n【1】strict 锁：不能丢的写超时报错，不放行")
+        lock_path = os.path.join(root, "hippocampus", "inbox.jsonl")
+        blocker = FileLock(lock_path, timeout=30.0)
+        blocker.__enter__()
+        t0 = time.time()
+        raised = None
+        try:
+            FileLock(lock_path, timeout=0.3, strict=True).__enter__()
+        except TimeoutError as e:
+            raised = e
+        check("strict 占锁下获锁超时抛 TimeoutError", raised is not None,
+              str(raised)[:60])
+        check("strict 超时不做长等待", time.time() - t0 < 5.0,
+              f"耗时={time.time()-t0:.2f}s")
+        soft = FileLock(lock_path, timeout=0.3).__enter__()
+        check("非 strict 维持放行语义（best-effort 簿记不受影响）",
+              soft.acquired is False, f"acquired={soft.acquired}")
+        blocker.__exit__()
+
+        # ---------------- ② 幂等对账：pending ----------------
+        print("\n【2】幂等对账：同内容重试返回既有 pid")
+        c_body = "# 功能名：conformance 幂等探针\n\n同内容重试不应重复入队。\n"
+        p1 = cg.propose("dup1", c_body, layer="knowledge")
+        p2 = cg.propose("dup1", c_body, layer="knowledge")       # 模拟重试
+        p3 = cg.propose("dup2", c_body, layer="knowledge")       # 换 node_id 同内容
+        check("三次 propose 返回同一 pid", p1 == p2 == p3,
+              f"{p1} / {p2} / {p3}")
+        pend = [r for r in cg.review_list() if r.get("id") in ("dup1", "dup2")]
+        check("inbox 恰好 1 条该内容提案", len(pend) == 1, f"pending={len(pend)}")
+        info = cg.propose("dup1", c_body, layer="knowledge", info=True)
+        check("info=True 透出去重信息",
+              info.get("dedup") is True and info.get("dup_of") == p1
+              and info.get("dup_status") == "pending", str(info))
+
+        # ---------------- ③ 幂等对账：已裁决内容 ----------------
+        print("\n【3】幂等对账：已裁决内容重提返回原 pid + 终态")
+        d = cg.review_decide(p1, "accept")
+        check("accept 落库", d.get("ok") is True, str(d.get("error") or "")[:60])
+        again = cg.propose("dup3", c_body, layer="knowledge", info=True)
+        check("accepted 内容重提幂等返回原 pid",
+              again.get("dedup") is True and again.get("dup_of") == p1
+              and again.get("dup_status") == "accepted", str(again))
+        check("重提未产生新队列条目",
+              not any(r.get("id") == "dup3" for r in cg.review_list()), "")
+
+        # ---------------- ④ 存量兼容：无 payload_hash 旧记录 ----------------
+        print("\n【4】存量兼容：旧格式记录（无 payload_hash）参与对账")
+        # 独立内容探针（c_body 在【3】已被 accept，会抢先命中终态分支）
+        leg_body = "# 功能名：存量兼容探针\n\n旧账无 hash 也要能对账。\n"
+        old = {"t": time.time(), "pid": "prop_legacy0001", "id": "legacy1",
+               "content": leg_body, "layer": "knowledge", "tags": [],
+               "condition_space": {}, "verify": {}, "verify_hash": "",
+               "extra": {}, "actor": "legacy"}
+        append_jsonl(cg.inbox_log, old)
+        leg = cg.propose("dup4", leg_body, layer="knowledge", info=True)
+        check("对账命中存量记录（现算 hash）",
+              leg.get("dedup") is True and leg.get("dup_of") == "prop_legacy0001"
+              and leg.get("dup_status") == "pending", str(leg))
+
+        # ---------------- ⑤ 级联出清：同 hash 存量兄弟 ----------------
+        print("\n【5】级联出清：主提案终态后兄弟自动关闭")
+        sib_body = "# 功能名：级联探针\n\n存量重复入队产物。\n"
+        main_pid = cg.propose("casc_main", sib_body, layer="knowledge")
+        # 手工构造存量兄弟（绕过 propose 的入队查重，模拟修复上线前的旧账）
+        for i, nid in enumerate(("casc_sib_a", "casc_sib_b")):
+            ph = hashlib.sha1(sib_body.strip().encode("utf-8")).hexdigest()[:12]
+            append_jsonl(cg.inbox_log, {
+                "t": time.time(), "pid": f"prop_sib{i}000000", "id": nid,
+                "content": sib_body, "layer": "knowledge", "tags": [],
+                "condition_space": {}, "payload_hash": ph,
+                "verify": {}, "verify_hash": "", "extra": {}, "actor": "legacy"})
+        sibs_before = [r for r in cg.review_list()
+                       if r.get("id") in ("casc_main", "casc_sib_a", "casc_sib_b")]
+        check("裁决前 3 条同内容提案全部可见", len(sibs_before) == 3,
+              f"n={len(sibs_before)}")
+        dmain = cg.review_decide(main_pid, "accept")
+        check("accept 成功且级联出清 2 条兄弟",
+              dmain.get("ok") and len(dmain.get("cascade_closed") or []) == 2,
+              f"cascade={dmain.get('cascade_closed')}")
+        left = [r for r in cg.review_list()
+                if r.get("id") in ("casc_main", "casc_sib_a", "casc_sib_b")]
+        check("裁决后队列无同内容残留", len(left) == 0, f"left={len(left)}")
+        decs = [x for x in cg.decisions() if "cascade_dedup" in (x.get("reason") or "")]
+        check("级联裁决落 decisions 且带说明", len(decs) == 2
+              and all(x.get("status") == "rejected" for x in decs),
+              f"n={len(decs)}")
+
+        # ---------------- ⑥ close/reopen 状态保持 ----------------
+        print("\n【6】close/reopen：重开实例队列视图一致")
+        cg2 = MdCGOS(root, actor="test-reopen")
+        rl2 = cg2.review_list()
+        check("重开后 review_list 与原实例一致", rl2 == cg.review_list(),
+              f"n={len(rl2)}")
+
+        # ---------------- ⑦⑧⑨ 真多进程并发 ----------------
+        print("\n【7】并发幂等：4 进程同内容并发 propose")
+        root2 = tempfile.mkdtemp(prefix="mdcg_conf_p_")
+        content = "# 功能名：并发幂等探针\n\n四进程同时入队只应产生一条。\n"
+        procs = [subprocess.Popen(
+            [sys.executable, os.path.join(workdir, "worker.py"), REPO,
+             root2, "propose", content],
+            stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=False,
+            env=dict(os.environ, PYTHONUTF8="1")) for _ in range(4)]
+        pids = []
+        for p in procs:
+            out, _err = p.communicate(timeout=120)
+            pids.append(json.loads(out.strip()))
+        check("4 进程返回同一 pid", len(set(pids)) == 1, str(pids))
+        inbox2 = os.path.join(root2, "hippocampus", "inbox.jsonl")
+        with open(inbox2, encoding="utf-8") as f:
+            lines = [ln for ln in f if ln.strip()]
+        check("inbox 恰好 1 条（无重复入队）", len(lines) == 1,
+              f"lines={len(lines)}")
+        rec1 = json.loads(lines[0])
+        check("入队记录带 payload_hash", bool(rec1.get("payload_hash")), "")
+
+        print("\n【8】并发不丢：4 进程×5 条不同内容")
+        root2b = tempfile.mkdtemp(prefix="mdcg_conf_p2_")
+        contents = [json.dumps([
+            f"# 功能名：并发不丢 {i}-{j}\n\n第 {i} 进程第 {j} 条。\n"
+            for j in range(5)]) for i in range(4)]
+        procs = [subprocess.Popen(
+            [sys.executable, os.path.join(workdir, "worker.py"), REPO,
+             root2b, "propose_n", contents[i]],
+            stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=False,
+            env=dict(os.environ, PYTHONUTF8="1")) for i in range(4)]
+        for p in procs:
+            p.communicate(timeout=180)
+        with open(os.path.join(root2b, "hippocampus", "inbox.jsonl"),
+                  encoding="utf-8") as f:
+            all_lines = [ln for ln in f if ln.strip()]
+        recs = []
+        bad = 0
+        for ln in all_lines:
+            try:
+                recs.append(json.loads(ln))
+            except ValueError:
+                bad += 1
+        check("4×5 并发后读回恰好 20 条（一条不丢）",
+              len(recs) == 20 and bad == 0, f"read={len(recs)} bad={bad}")
+        check("pid 互不重复", len({r.get("pid") for r in recs}) == 20, "")
+
+        # 【8c】pid 唯一性守卫（2026-09-16 取证修复）：旧式
+        # "prop_" + _sig(node_id + time.time()) 无进程熵，同一时刻多 worker
+        # 用相同 node_id 入队会碰撞——本项在单进程内高频连续入队，把
+        # 「同一时刻多次 propose」这一碰撞条件压缩到必然暴露，防回归。
+        root2c = tempfile.mkdtemp(prefix="mdcg_conf_p3_")
+        cg2c = MdCGOS(root2c, actor="test")
+        pids2c = [cg2c.propose("same-node", f"# 功能名：唯一性 {i}\n\n内容 {i}。\n",
+                               layer="knowledge") for i in range(20)]
+        check("同 node_id 高频连续 propose：20 pid 互不重复",
+              len(set(pids2c)) == 20, f"uniq={len(set(pids2c))}/20")
+        check("pid 复现格式（prop_ + 12 hex，调用方依赖）",
+              all(isinstance(p, str) and len(p) == 17 and p.startswith("prop_")
+                  and all(ch in "0123456789abcdef" for ch in p[5:])
+                  for p in pids2c), pids2c[0])
+
+
+        print("\n【9】decisions 并发：4 进程各裁决 1 个 pid")
+        root3 = tempfile.mkdtemp(prefix="mdcg_conf_d_")
+        cg3 = MdCGOS(root3, actor="test")
+        pids3 = [cg3.propose(f"cc{i}", f"# 功能名：并发裁决 {i}\n\n内容 {i}。\n",
+                             layer="knowledge") for i in range(4)]
+        procs = [subprocess.Popen(
+            [sys.executable, os.path.join(workdir, "worker.py"), REPO,
+             root3, "decide", pids3[i]],
+            stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=False,
+            env=dict(os.environ, PYTHONUTF8="1")) for i in range(4)]
+        outs = []
+        for p in procs:
+            out, _err = p.communicate(timeout=180)
+            outs.append(out.strip())
+        check("4 项裁决全部成功", all(json.loads(o).get("ok") for o in outs),
+              str([o[:40] for o in outs]))
+        drecs = cg3.decisions()
+        check("decisions 读回恰好 4 条（无交错丢失）", len(drecs) == 4,
+              f"n={len(drecs)}")
+        check("每条裁决带 record_hash 指纹",
+              all(r.get("record_hash") for r in drecs), "")
+        check("重开后裁决状态保持",
+              len(MdCGOS(root3, actor="x")._closed_pids()) == 4, "")
+
+        # ---------------- ⑩ MdCGSecure.propose info 转发 ----------------
+        print("\n【10】安全层转发：MdCGSecure.propose 幂等透传")
+        root4 = tempfile.mkdtemp(prefix="mdcg_conf_s_")
+        sec = MdCGSecure(root4, principal=Principal(
+            actor="conf", clearance="private", can_write=True, can_admin=True))
+        sec_body = "# 功能名：安全层幂等\n\n转发链上的去重。\n"
+        sp1 = sec.propose("sec1", sec_body, layer="knowledge", info=True)
+        sp2 = sec.propose("sec1", sec_body, layer="knowledge", info=True)
+        check("安全层两次入队同一 pid 且 dedup 命中",
+              sp1.get("pid") == sp2.get("pid") and sp2.get("dedup") is True,
+              f"{sp1.get('pid')} / {sp2}")
+        with open(os.path.join(root4, "hippocampus", "inbox.jsonl"),
+                  encoding="utf-8") as f:
+            sec_rec = json.loads(f.readline())
+        check("info 不泄漏进 extra",
+              "info" not in (sec_rec.get("extra") or {}),
+              str(sec_rec.get("extra")))
+
+        print(f"\n===== conformance：PASS={PASS} FAIL={FAIL} =====")
+        if FAILS:
+            print("失败项：", "；".join(FAILS))
+        return 1 if FAIL else 0
+    finally:
+        shutil.rmtree(workdir, ignore_errors=True)
+        for r in (root, root2, root2b, root3, root4):
+            if r:
+                shutil.rmtree(r, ignore_errors=True)
+
+
+if __name__ == "__main__":
+    sys.exit(main())