@furongjun1999/dsh-memory 0.4.7 → 0.4.9

package/md_cg/test_lifecycle.py

@@ -0,0 +1,309 @@
+# -*- coding: utf-8 -*-
+"""test_lifecycle · 节点显式生命周期状态机（Pi 可学习优点 ②）
+
+背景：状态散落四处各说各话——`writelimit` 用 tag `tidy:converged`、`forgetting`
+用 importance 升降、`protect` 用 `fm.protected`、`_evolution/ledger.md` 记账本；
+**没有任何地方校验「这一步迁移合不合法」**。本测试覆盖唯一真源 `lifecycle.py`
+及其四条收口路径。
+
+覆盖：① 纯函数裁决 ② 索引快照带状态（内存+磁盘） ③ 合法逐级迁移（历史+审计）
+④ 非法迁移拒绝（负路由，且拒绝不留痕） ⑤ 幂等 ⑥ 受保护豁免降级 / 回升不受限
+⑦ add 全量重建 fm 时的状态继承 ⑧ 存量回填 backfill ⑨ 收口点（writelimit /
+forgetting） ⑩ 边界（节点不存在 / 永不删除）
+
+运行：python -m md_cg.test_lifecycle
+"""
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import tempfile
+
+from . import lifecycle, writelimit
+from .forgetting import reinforce
+from .mdcos import MdCGOS
+
+_root = tempfile.mkdtemp(prefix="mdcg_life_")
+cg = MdCGOS(_root)
+
+_ok = 0
+_fail = []
+
+
+def check(name, cond, detail=""):
+    global _ok
+    if cond:
+        _ok += 1
+        print("[ok] " + name)
+    else:
+        _fail.append(name)
+        print("[FAIL] %s  · %s" % (name, str(detail)[:240]))
+
+
+def _fm(nid):
+    return ((cg.get(nid) or {}).get("frontmatter")) or {}
+
+
+def _idx(nid):
+    return (cg.index.get("nodes") or {}).get(nid) or {}
+
+
+def _disk_index():
+    """读**磁盘** `_index.json`——「免读文件可查」的硬验收面。"""
+    p = os.path.join(cg.root, "_index.json")
+    if not os.path.exists(p):
+        return {}
+    with open(p, encoding="utf-8", errors="replace") as f:
+        return json.load(f)
+
+
+def _index_log():
+    """读**增量索引日志**（ShardedLog 分片）——`flush()` 的实际落点（`_index.json`
+    是快照，由 `rebuild_index()` 写）。"""
+    out = []
+    d = os.path.join(cg.root, "_index_log")
+    if not os.path.isdir(d):
+        return out
+    for fn in sorted(os.listdir(d)):
+        p = os.path.join(d, fn)
+        if not os.path.isfile(p):
+            continue
+        with open(p, encoding="utf-8", errors="replace") as f:
+            for line in f:
+                if not line.strip():
+                    continue
+                try:
+                    out.append(json.loads(line))
+                except Exception:
+                    pass
+    return out
+
+
+def _audit():
+    p = os.path.join(cg.root, lifecycle.AUDIT_FILE)
+    out = []
+    if os.path.exists(p):
+        with open(p, encoding="utf-8", errors="replace") as f:
+            for line in f:
+                if line.strip():
+                    out.append(json.loads(line))
+    return out
+
+
+# ------------------------------------------------------------ ① 纯函数裁决
+check("①1 缺字段 / 未知值 / 非 dict → active（存量兼容，不猜测）",
+      lifecycle.state_of({}) == "active"
+      and lifecycle.state_of({lifecycle.STATE_FIELD: "frozen"}) == "active"
+      and lifecycle.state_of(None) == "active")
+check("①2 状态集内值原样返回",
+      all(lifecycle.state_of({lifecycle.STATE_FIELD: s}) == s
+          for s in lifecycle.STATES))
+check("①3 合法迁移对可通行（逐级降级 + 逐级回升）",
+      lifecycle.can_transition("active", "converged")
+      and lifecycle.can_transition("converged", "demoted")
+      and lifecycle.can_transition("demoted", "archived")
+      and lifecycle.can_transition("archived", "active"))
+check("①4 跳级迁移一律不通",
+      not lifecycle.can_transition("active", "archived")
+      and not lifecycle.can_transition("converged", "archived")
+      and not lifecycle.can_transition("archived", "demoted"))
+check("①5 同状态幂等可通行", lifecycle.can_transition("demoted", "demoted"))
+check("①6 check 未知状态 → unknown_state",
+      lifecycle.check("active", "frozen")[:2] == (False, "unknown_state"))
+check("①7 check 同状态 → noop",
+      lifecycle.check("active", "active")[:2] == (True, "noop"))
+check("①8 check 跳级 → illegal_transition",
+      lifecycle.check("active", "archived")[:2]
+      == (False, "illegal_transition"))
+check("①9 check 受保护降级 → protected；override 放行",
+      lifecycle.check("active", "demoted", protected=True)[:2]
+      == (False, "protected")
+      and lifecycle.check("active", "demoted", protected=True,
+                          override=True)[:2] == (True, "ok"))
+check("①10 is_downgrade 方向正确（回升不算降级）",
+      lifecycle.is_downgrade("active", "archived")
+      and not lifecycle.is_downgrade("archived", "active"))
+
+# ------------------------------------------------------------ ② 新节点与索引
+n1 = cg.add("lc_n1", "生命周期状态机测试节点甲", layer="knowledge")
+check("②1 新节点**显式**落 active（不再依赖缺省约定）",
+      _fm(n1).get(lifecycle.STATE_FIELD) == "active", _fm(n1))
+check("②2 索引快照带状态（内存）",
+      _idx(n1).get(lifecycle.STATE_FIELD) == "active", _idx(n1))
+cg.flush()
+check("②3 增量日志（_index_log）带状态",
+      any((r.get("e") or {}).get(lifecycle.STATE_FIELD) == "active"
+          for r in _index_log() if r.get("id") == n1), _index_log())
+cg.rebuild_index()
+check("②4 磁盘 _index.json 快照带状态（免读文件即可回答「这节点什么状态」）",
+      ((_disk_index().get("nodes") or {}).get(n1) or {}
+       ).get(lifecycle.STATE_FIELD) == "active")
+
+# ------------------------------------------------------------ ③ 合法逐级迁移
+r1 = cg.set_state(n1, "converged", reason="同构聚合定型", actor="test")
+check("③1 active→converged 通过且落盘",
+      r1.get("ok") and r1.get("changed")
+      and _fm(n1).get(lifecycle.STATE_FIELD) == "converged", r1)
+check("③2 索引同步到 converged",
+      _idx(n1).get(lifecycle.STATE_FIELD) == "converged")
+r2 = cg.set_state(n1, "demoted", reason="弱化", actor="test")
+r3 = cg.set_state(n1, "archived", reason="归档", actor="test")
+check("③3 converged→demoted→archived 逐级通过",
+      r2.get("ok") and r3.get("ok")
+      and _fm(n1).get(lifecycle.STATE_FIELD) == "archived")
+h1 = _fm(n1).get(lifecycle.HISTORY_FIELD) or []
+check("③4 迁移历史逐条留痕（from/to/reason/actor）",
+      len(h1) == 3 and h1[-1]["from"] == "demoted"
+      and h1[-1]["to"] == "archived" and h1[-1]["reason"] == "归档"
+      and h1[-1]["actor"] == "test", h1)
+check("③5 审计 _lifecycle.jsonl 留痕 3 条",
+      len([a for a in _audit() if a.get("node_id") == n1]) == 3, _audit())
+check("③6 永不删除：archived 后节点文件仍在且可读",
+      bool(cg.get(n1))
+      and os.path.exists(os.path.join(cg.root, cg.get(n1)["path"])))
+
+# ------------------------------------------------------------ ④ 非法迁移拒绝
+n2 = cg.add("lc_n2", "生命周期状态机测试节点乙", layer="knowledge")
+bad = cg.set_state(n2, "archived", reason="跳级归档", actor="test")
+check("④1 跳级 active→archived 被拒（负路由，不抛）",
+      (not bad.get("ok")) and bad.get("error") == "illegal_transition", bad)
+check("④2 拒绝后 frontmatter 未被改动（不留痕）",
+      _fm(n2).get(lifecycle.STATE_FIELD) in (None, "active")
+      and not (_fm(n2).get(lifecycle.HISTORY_FIELD) or []), _fm(n2))
+check("④3 拒绝后索引未被改动",
+      _idx(n2).get(lifecycle.STATE_FIELD) in (None, "active"))
+check("④4 未知状态被拒",
+      cg.set_state(n2, "frozen").get("error") == "unknown_state")
+check("④5 节点不存在如实上报（不静默创建）",
+      cg.set_state("lc_missing", "converged").get("error") == "node_not_found")
+try:
+    lifecycle.require_transition("active", "archived")
+    _hard = False
+except lifecycle.TransitionError:
+    _hard = True
+check("④6 require_transition 硬拒（写路径抛异常）", _hard)
+try:
+    cg.add("lc_n2", "覆写并试图跳级归档", state="archived")
+    _add_hard = False
+except lifecycle.TransitionError:
+    _add_hard = True
+check("④7 add 覆写显式非法状态 → 硬拒", _add_hard)
+check("④8 硬拒后磁盘内容未被改写（校验先于写盘）",
+      _fm(n2).get(lifecycle.STATE_FIELD) in (None, "active"))
+
+# ------------------------------------------------------------ ⑤ 幂等
+h_before = len(_fm(n1).get(lifecycle.HISTORY_FIELD) or [])
+aud_before = len([a for a in _audit() if a.get("node_id") == n1])
+same = cg.set_state(n1, "archived", reason="重复归档", actor="test")
+check("⑤1 同状态幂等（noop / changed=False）",
+      same.get("ok") and same.get("changed") is False
+      and same.get("code") == "noop", same)
+check("⑤2 幂等不刷历史",
+      len(_fm(n1).get(lifecycle.HISTORY_FIELD) or []) == h_before)
+check("⑤3 幂等不写审计",
+      len([a for a in _audit() if a.get("node_id") == n1]) == aud_before)
+
+# ------------------------------------------------------------ ⑥ 受保护豁免降级
+n3 = cg.add("lc_n3", "受保护节点丙", layer="knowledge", importance=0.8)
+check("⑥0 新建即自动受保护（importance≥0.7）",
+      _fm(n3).get("protected") is True, _fm(n3))
+prot = cg.set_state(n3, "demoted", reason="试图降级", actor="test")
+check("⑥1 受保护节点降级被拒 → protected 码",
+      (not prot.get("ok")) and prot.get("error") == "protected", prot)
+check("⑥2 拒绝后状态未变（保护 = 不可遗忘）",
+      _fm(n3).get(lifecycle.STATE_FIELD) == "active")
+ov = cg.set_state(n3, "demoted", reason="显式放行", actor="test",
+                  override=True)
+check("⑥3 override=True 放行降级",
+      ov.get("ok") and _fm(n3).get(lifecycle.STATE_FIELD) == "demoted", ov)
+up = cg.set_state(n3, "active", reason="回升不受限", actor="test")
+check("⑥4 回升不受保护限制（无需 override）",
+      up.get("ok") and _fm(n3).get(lifecycle.STATE_FIELD) == "active")
+
+# ------------------------------------------------------------ ⑦ add 状态继承
+n4 = cg.add("lc_n4", "状态继承节点丁", layer="knowledge")
+cg.set_state(n4, "converged", reason="定型", actor="test")
+cg.add("lc_n4", "覆写内容（裸 add，不带状态）", layer="knowledge")
+check("⑦1 裸 add 覆写**继承**旧状态（不静默打回 active）",
+      _fm(n4).get(lifecycle.STATE_FIELD) == "converged", _fm(n4))
+check("⑦2 继承后索引仍是 converged",
+      _idx(n4).get(lifecycle.STATE_FIELD) == "converged")
+cg.add("lc_n4", "覆写并合法回升", layer="knowledge", state="active")
+check("⑦3 显式合法迁移放行（converged→active）",
+      _fm(n4).get(lifecycle.STATE_FIELD) == "active")
+check("⑦4 新节点显式状态从 active 起算（active→converged 合法）",
+      _fm(cg.add("lc_n5", "显式定型节点", layer="knowledge",
+                 state="converged")).get(lifecycle.STATE_FIELD) == "converged")
+
+# ------------------------------------------------------------ ⑧ 存量回填
+node4 = cg.get(n4)
+fm4 = dict(node4["frontmatter"])
+fm4.pop(lifecycle.STATE_FIELD, None)                 # 造「旧库缺字段」形态
+cg._write_node(n4, os.path.join(cg.root, node4["path"]), fm4,
+               node4.get("content") or "")
+_idx(n4).pop(lifecycle.STATE_FIELD, None)
+check("⑧0 旧库形态成立（字段已摘除）",
+      lifecycle.STATE_FIELD not in _fm(n4))
+pre = lifecycle.backfill(cg, apply=False)
+check("⑧1 dry-run 盘点缺失且不改盘",
+      pre.get("dry_run") and n4 in (pre.get("planned") or [])
+      and lifecycle.STATE_FIELD not in _fm(n4), pre)
+app = lifecycle.backfill(cg, apply=True)
+check("⑧2 apply 回填为显式 active",
+      app.get("backfilled", 0) >= 1
+      and _fm(n4).get(lifecycle.STATE_FIELD) == "active", app)
+check("⑧3 回填幂等（第二次无缺失）",
+      lifecycle.backfill(cg, apply=True).get("backfilled") == 0)
+check("⑧4 缺字段节点在回填前也按 active 工作（state_of 缺省）",
+      lifecycle.state_of({}) == "active")
+
+# ------------------------------------------------------------ ⑨ 收口点
+n6 = cg.add("lc_n6", "同构聚合成员节点", layer="contextual", importance=0.4)
+node6 = cg.get(n6)
+e6 = {"id": n6, "path": node6["path"],
+      "frontmatter": dict(node6["frontmatter"]),
+      "content": node6.get("content") or ""}
+writelimit._demote(cg, e6)
+check("⑨1 tidy 降权 → lifecycle_state=converged",
+      _fm(n6).get(lifecycle.STATE_FIELD) == "converged", _fm(n6))
+check("⑨2 兼容别名 tidy:converged tag 保留（历史数据不破）",
+      "tidy:converged" in (_fm(n6).get("tags") or []))
+check("⑨3 降权后索引同步 converged",
+      _idx(n6).get(lifecycle.STATE_FIELD) == "converged")
+_imp_before = float(_fm(n6).get("importance") or 0)
+reinforce(cg, n6)
+check("⑨4 MERGE 强化 → 逐级回升 active",
+      _fm(n6).get(lifecycle.STATE_FIELD) == "active", _fm(n6))
+check("⑨5 回升与 importance 强化同批落盘（+delta）",
+      float(_fm(n6).get("importance") or 0) > _imp_before)
+h6 = _fm(n6).get(lifecycle.HISTORY_FIELD) or []
+check("⑨6 两处收口共用同一迁移历史（active→converged→active 两条，同一 actor 面）",
+      len(h6) == 2 and (h6[0]["from"], h6[0]["to"]) == ("active", "converged")
+      and (h6[1]["from"], h6[1]["to"]) == ("converged", "active")
+      and h6[0]["actor"] == "sustain_tidy"
+      and h6[1]["actor"] == "forgetting:reinforce", h6)
+n7 = cg.add("lc_n7", "普通节点庚", layer="knowledge")
+h7_before = len(_fm(n7).get(lifecycle.HISTORY_FIELD) or [])
+reinforce(cg, n7)
+check("⑨7 强化 active 节点：状态幂等（不刷历史、不误降）",
+      _fm(n7).get(lifecycle.STATE_FIELD) == "active"
+      and len(_fm(n7).get(lifecycle.HISTORY_FIELD) or []) == h7_before)
+
+# ------------------------------------------------------------ ⑩ 边界
+check("⑩1 状态字段名与裁决四态 state 不撞名（消歧）",
+      lifecycle.STATE_FIELD == "lifecycle_state"
+      and lifecycle.STATE_FIELD != "state")
+check("⑩2 set_state 返回体恒带 from/to/code（可审计）",
+      set(("from", "to", "code")) <= set(cg.set_state(n7, "active").keys()))
+check("⑩3 迁移历史滚动上限（不无界膨胀）",
+      lifecycle.HISTORY_KEEP > 0
+      and len(_fm(n1).get(lifecycle.HISTORY_FIELD) or [])
+      <= lifecycle.HISTORY_KEEP)
+
+print("=" * 58)
+print("test_lifecycle: %d 通过 / %d 失败" % (_ok, len(_fail)))
+if _fail:
+    print("失败项：" + "、".join(_fail))
+shutil.rmtree(cg.root, ignore_errors=True)
+raise SystemExit(1 if _fail else 0)

package/md_cg/test_linkref.py

@@ -0,0 +1,306 @@
+# -*- coding: utf-8 -*-
+"""linkref（正文裸 id 引用 → reference 边）验收：R-L1b，2026-09-17。
+
+验收口径：抽取语义（命中/去重保序/排除自身/白名单防幽灵边/真实前缀域全覆盖/
+脏键与含中文 id 排除/id 紧邻汉字不漏抽/YAML 键名不误匹配）｜端到端建边与幂等｜
+覆写后「边跟随新正文」｜负路由（REJECT/DEFER/gated 短路不建边）｜韧性
+（append_edge 抛异常不阻断写入）｜opt-out｜源判据（self 层留痕与脏键不作源）｜
+链权重 reference=0.50 且不入因果链默认集｜**读隔离两面**：密级面（known_ids 经
+_readable 过滤，与库读面同口径）+ 密钥面（live_targets 实读校验，剔除密级够但
+无 DEK 的死目标，免生悬空边）。
+"""
+
+import json
+import os
+import shutil
+import sys
+import tempfile
+import traceback
+
+from . import chain, linkref, writepipe
+from .mdcos import MdCGSecure
+from .security import Principal
+
+_ok = 0
+_bad = []
+_seq = [0]
+
+
+def _check(name, cond, detail=""):
+    global _ok
+    if cond:
+        _ok += 1
+        print("  ok   %s" % name)
+    else:
+        _bad.append("%s %s" % (name, detail))
+        print("  FAIL %s %s" % (name, detail))
+
+
+def _mk_cg(tmp, role="designer"):
+    _seq[0] += 1
+    root = os.path.join(tmp, "root_%02d_%s" % (_seq[0], role))
+    p = Principal(tenant="default", actor="t_" + role, role=role,
+                  can_write=(role != "guest"),
+                  can_admin=(role == "designer"))
+    return MdCGSecure(root, principal=p)
+
+
+def _policy(tmp, required=("PASSED",), forbidden=("FORBIDDEN_WORD",)):
+    path = os.path.join(tmp, "policy.json")
+    with open(path, "w", encoding="utf-8") as f:
+        json.dump({"forbidden": list(forbidden),
+                   "required": list(required)}, f)
+    os.environ["MDCG_POLICY_FILE"] = path
+    return path
+
+
+def _fm(cg, nid):
+    got = cg._edge_node(nid)
+    return got[0] if got else {}
+
+
+def _ref_edges(cg, nid):
+    fm = _fm(cg, nid)
+    return [e for e in (fm.get("edges") or [])
+            if isinstance(e, dict) and e.get("relation_type") == linkref.RELATION]
+
+
+def main():
+    tmp = tempfile.mkdtemp(prefix="linkref_")
+    old_policy = os.environ.pop("MDCG_POLICY_FILE", None)
+    try:
+        _run(tmp)
+    except Exception:
+        traceback.print_exc()
+        _bad.append("未捕获异常")
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+        if old_policy is not None:
+            os.environ["MDCG_POLICY_FILE"] = old_policy
+        else:
+            os.environ.pop("MDCG_POLICY_FILE", None)
+    print("\nlinkref 验收：%d 通过%s" % (
+        _ok, ("，%d 失败：%s" % (len(_bad), "; ".join(_bad))) if _bad else ""))
+    return 1 if _bad else 0
+
+
+def _run(tmp):
+    policy = _policy(tmp)
+    pipe = writepipe.install_default_gates(writepipe.WritePipeline())
+    cg = _mk_cg(tmp)
+    A, B, TGT = "mem_1789125080573", "concept_d8eee20f2f", "mem_tgt0001"
+
+    # ---------- 1 纯函数：抽取语义 ----------
+    txt = "见 %s 与 %s；再一次 %s；%s" % (A, B, A, A)
+    got = linkref.extract_refs(txt, known={A, B})
+    _check("裸id命中", got == [A, B], repr(got))
+    _check("去重保序", got.count(A) == 1, repr(got))
+    _check("排除自身", linkref.extract_refs(txt, known={A, B}, exclude=A) == [B])
+    _check("白名单过滤未知id(防幽灵边)",
+           linkref.extract_refs(txt + " 幽灵 mem_9999999999999", known={A, B})
+           == [A, B])
+    _check("known=None按形态放行", linkref.extract_refs(txt, known=None) == [A, B])
+    _check("真实前缀域命中(kp/note/vpipe/arc)",
+           linkref.extract_refs(
+               "见 kp_GIL_1787752832598 与 note_abc123 与 vpipe_0001 与 arc_0001",
+               known={"kp_GIL_1787752832598", "note_abc123", "vpipe_0001",
+                      "arc_0001"})
+           == ["kp_GIL_1787752832598", "note_abc123", "vpipe_0001", "arc_0001"])
+    _check("非库内id被白名单拦截(rev/prop/sess)",
+           linkref.extract_refs("rev_483f03ac3558_r1 prop_1a2b3c sess_abc",
+                                known=set()) == [])
+    _check("YAML式键名被白名单拦截",
+           linkref.extract_refs("part_of: x derived_from: y relation_type: z",
+                                known={A}) == [])
+    _check("id紧邻汉字仍命中(非词边界误判)",
+           linkref.extract_refs("见%s的说明" % A, known={A}) == [A])
+    _check("形态近似但更长的id不误命中",
+           linkref.extract_refs(A + "9", known={A}) == [])
+    _check("形态判据放行规范id",
+           linkref.is_linkable_id(A) and linkref.is_linkable_id("kp_GIL_1787"))
+    _check("形态判据排除脏键(None/中文标题式/含中文混合id)",
+           not linkref.is_linkable_id("None")
+           and not linkref.is_linkable_id("README中英差距报告节（94.6vs52）")
+           and not linkref.is_linkable_id("kp_GIL全局解_1787752832598"))
+    _check("空文本", linkref.extract_refs("", known={A}) == [])
+
+    # ---------- 2 边形态与链权重 ----------
+    e = linkref.make_edge(A)
+    _check("边形态", e["target"] == A and e["relation_type"] == "reference"
+           and e["verified"] is False and "created_at" in e, repr(e))
+    _check("边权重=0.50", chain.edge_weight(e) == 0.5, repr(chain.edge_weight(e)))
+    _check("reference已登记权重表", chain.EDGE_WEIGHTS.get("reference") == 0.50)
+    _check("reference不入因果链默认集",
+           "reference" not in chain.CHAIN_TYPES_DEFAULT)
+    _check("reference不入因果类型集", "reference" not in chain.CAUSAL_TYPES)
+
+    # ---------- 2b 源节点层/形态判据（审计留痕与脏键不作源） ----------
+    _check("self层不作源", linkref.is_linkable_source(A, "self") is False)
+    _check("记忆本体层可作源",
+           all(linkref.is_linkable_source(A, x)
+               for x in ("knowledge", "contextual", "rejected", "", None)))
+    _check("脏键id不作源", linkref.is_linkable_source("None", "knowledge") is False)
+    _check("self层排除常量", linkref.SOURCE_EXCLUDE_LAYERS == ("self",))
+
+    # ---------- 2c 白名单读隔离一致性（known_ids 与库读面同口径） ----------
+    class _StubCG:
+        def __init__(self, nodes, guard=None):
+            self.index = {"nodes": nodes}
+            if guard is not None:
+                self._readable = guard
+    _n = {A: {"s": "internal"}, B: {"s": "secret"}}
+    _check("known_ids按读隔离过滤",
+           linkref.known_ids(_StubCG(_n, lambda e: e["s"] == "internal"))
+           == {A})
+    _check("known_ids无读面时不过滤(非安全库MdCG)",
+           linkref.known_ids(_StubCG(_n)) == {A, B})
+    _check("known_ids读面抛异常则fail-closed",
+           linkref.known_ids(_StubCG(_n, lambda e: 1 / 0)) == set())
+    _check("known_ids无索引回退空集", linkref.known_ids(object()) == set())
+
+    # ---------- 2d 目标侧第二道读隔离：密钥面（live_targets 实读校验） ----------
+    # 背景（20260917 取证）：private/secret 正文是密文，解封需本身份 DEK；
+    # 无 DEK 时 get 返回 None，但 _readable 只看索引密级字段 → 白名单会混入
+    # 「密级够、密钥不够」的死目标（真实库 secret 下 459 条），建边即产生悬空边。
+    class _StubReadCG:
+        def __init__(self, ok, boom=()):
+            self.calls = []
+            self._ok = set(ok)
+            self._boom = set(boom)
+
+        def get(self, nid):
+            self.calls.append(nid)
+            if nid in self._boom:
+                raise RuntimeError("locked")
+            return {"id": nid} if nid in self._ok else None
+
+    _s = _StubReadCG(ok={A}, boom={"mem_locked1"})
+    _check("live_targets保留实读可得目标、剔除密钥隔离目标",
+           linkref.live_targets(_s, [A, "mem_locked1", "mem_missing1"]) == [A],
+           repr(_s.calls))
+    _check("live_targets夹带抛异常目标fail-closed",
+           linkref.live_targets(_s, ["mem_locked1"]) == [])
+    _s2 = _StubReadCG(ok={A})
+    _cache = {}
+    linkref.live_targets(_s2, [A, A], cache=_cache)
+    _check("live_targets缓存复用(同id只实读一次)",
+           _s2.calls == [A] and _cache.get(A) is True, repr(_s2.calls))
+    _check("live_targets空输入", linkref.live_targets(_s2, []) == [])
+
+    # ---------- 3 端到端 ----------
+    out_t = pipe.execute(cg, {"content_kind": "text", "content": "目标 PASSED",
+                              "layer": "knowledge", "node_id": TGT})
+    _check("目标节点落盘", out_t.get("committed") is True, repr(out_t))
+    out_s = pipe.execute(cg, {"content_kind": "text",
+                              "content": "PASSED 关联 %s 的说明" % TGT,
+                              "layer": "knowledge", "node_id": "mem_src0001"})
+    _check("源节点落盘", out_s.get("committed") is True, repr(out_s))
+    refs = _ref_edges(cg, "mem_src0001")
+    _check("端到端建reference边",
+           len(refs) == 1 and refs[0]["target"] == TGT, repr(refs))
+
+    pipe.execute(cg, {"content_kind": "text",
+                      "content": "PASSED 关联 %s 的说明" % TGT,
+                      "layer": "knowledge", "node_id": "mem_src0001"})
+    _check("重复写入幂等", len(_ref_edges(cg, "mem_src0001")) == 1,
+           repr(_ref_edges(cg, "mem_src0001")))
+
+    pipe.execute(cg, {"content_kind": "text",
+                      "content": "PASSED 关联 mem_ghost9999",
+                      "layer": "knowledge", "node_id": "mem_src0002"})
+    _check("未入库目标不建边", _ref_edges(cg, "mem_src0002") == [])
+
+    pipe.execute(cg, {"content_kind": "text",
+                      "content": "PASSED 本节点 mem_self0001 见 %s" % TGT,
+                      "layer": "knowledge", "node_id": "mem_self0001"})
+    _check("正文自引用被排除",
+           [x["target"] for x in _ref_edges(cg, "mem_self0001")] == [TGT],
+           repr(_ref_edges(cg, "mem_self0001")))
+
+    pipe.execute(cg, {"content_kind": "text",
+                      "content": "PASSED 关联 %s" % TGT, "linkref": False,
+                      "layer": "knowledge", "node_id": "mem_src0003"})
+    _check("linkref=False显式关闭", _ref_edges(cg, "mem_src0003") == [])
+
+    pipe.execute(cg, {"content_kind": "text", "content": "目标2 PASSED",
+                      "layer": "knowledge", "node_id": "mem_tgt0002"})
+    pipe.execute(cg, {"content_kind": "text",
+                      "content": "PASSED 现改关联 mem_tgt0002",
+                      "layer": "knowledge", "node_id": "mem_src0001"})
+    _check("覆写后边跟随新正文",
+           [x["target"] for x in _ref_edges(cg, "mem_src0001")]
+           == ["mem_tgt0002"], repr(_ref_edges(cg, "mem_src0001")))
+
+    # ---------- 4 负路由 ----------
+    out_r = pipe.execute(cg, {"content_kind": "text",
+                              "content": "FORBIDDEN_WORD 关联 %s" % TGT,
+                              "layer": "knowledge", "node_id": "mem_rej0001"})
+    _check("REJECT路径不落盘不建边",
+           out_r.get("committed") is False and _fm(cg, "mem_rej0001") == {},
+           repr(out_r))
+
+    os.environ.pop("MDCG_POLICY_FILE", None)
+    out_d = pipe.execute(cg, {"content_kind": "text",
+                              "content": "无规则可判 关联 %s" % TGT,
+                              "layer": "knowledge", "node_id": "mem_def0001"})
+    _check("DEFER路径不落盘不建边",
+           out_d.get("moved_to") == "review_queue"
+           and _fm(cg, "mem_def0001") == {}, repr(out_d))
+    os.environ["MDCG_POLICY_FILE"] = policy
+
+    out_g = pipe.execute(cg, {"content_kind": "text",
+                              "content": "PASSED 关联 %s" % TGT, "gated": True,
+                              "layer": "contextual", "node_id": "mem_gat0001"})
+    _check("gated走替代执行路径(短路→after不执行)",
+           "gate" in out_g, repr(out_g))
+
+    # ---------- 5 韧性：建链失败不阻断写入 ----------
+    p2 = writepipe.install_default_gates(writepipe.WritePipeline())
+    cg2 = _mk_cg(tmp)
+    p2.execute(cg2, {"content_kind": "text", "content": "目标 PASSED",
+                     "layer": "knowledge", "node_id": "mem_f0"})
+    orig = cg2.append_edge
+
+    def _boom(*a, **k):
+        raise RuntimeError("append_edge boom")
+
+    cg2.append_edge = _boom
+    try:
+        out = p2.execute(cg2, {"content_kind": "text",
+                               "content": "PASSED 关联 mem_f0",
+                               "layer": "knowledge", "node_id": "mem_f1"})
+        _check("建链失败不阻断写入", out.get("committed") is True, repr(out))
+    except Exception as ex:  # noqa: BLE001
+        _check("建链失败不阻断写入", False, "异常%r" % ex)
+    finally:
+        cg2.append_edge = orig
+
+    # ---------- 5b 目标实读不出（密钥隔离）→ 不建边 ----------
+    p3 = writepipe.install_default_gates(writepipe.WritePipeline())
+    cg3 = _mk_cg(tmp)
+    p3.execute(cg3, {"content_kind": "text", "content": "目标3 PASSED",
+                     "layer": "knowledge", "node_id": "mem_k0"})
+    g_orig = cg3.get
+
+    def _locked(nid, *a, **k):
+        return None if nid == "mem_k0" else g_orig(nid, *a, **k)
+
+    cg3.get = _locked
+    try:
+        out = p3.execute(cg3, {"content_kind": "text",
+                               "content": "PASSED 关联 mem_k0",
+                               "layer": "knowledge", "node_id": "mem_k1"})
+        _check("目标实读不出(密钥隔离)不建边——免生悬空边",
+               out.get("committed") is True and _ref_edges(cg3, "mem_k1") == [],
+               repr(_ref_edges(cg3, "mem_k1")))
+    finally:
+        cg3.get = g_orig
+
+    # ---------- 6 边域幂等（append_edge 本体） ----------
+    _check("append_edge自身幂等",
+           cg.append_edge("mem_tgt0002", linkref.make_edge(TGT)) is True
+           and cg.append_edge("mem_tgt0002", linkref.make_edge(TGT)) is False)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_md_access_parity.py

@@ -25,7 +25,7 @@ import tempfile
 _HERE = os.path.dirname(os.path.abspath(__file__))
 sys.path.insert(0, os.path.dirname(_HERE))
 
-from .md_whitebox import DEFAULT_ROOT, build_db_from_md  # noqa: E402
+from .md_whitebox import DEFAULT_ROOT, build_db_from_md, corpus_gap  # noqa: E402
 
 # 平铺导入引导（对齐 whitebox_kb/__init__：md_access 需在 sys.path 注入后导入）
 _WB = os.path.join(_HERE, "whitebox_kb")
@@ -134,6 +134,13 @@ def _param_groups(arg_tpls, samples):
 
 def main():
     ok = True
+    # 依赖自辩（2026-09-20 v14 缺陷 F）：md 语料是 gitignored 本地数据面，
+    # 缺失/空壳时**本模块自己**打 SKIP 返回 0——不再依赖外部 runner 探测
+    # （旁路执行时 runner 不在场），也不再留下未捕获异常或空壳副作用。
+    _gap = corpus_gap(DEFAULT_ROOT)
+    if _gap:
+        print("SKIP test_md_access_parity：%s" % _gap)
+        return 0
     print("== [1] 重建派生库 + 建 MdConn ==")
     stats = build_db_from_md(force=True, verbose=True)
     md_conn = MdConn(DEFAULT_ROOT, layers=LAYERS)
@@ -142,8 +149,13 @@ def main():
         n_sq = sq.execute("SELECT COUNT(*) FROM nodes").fetchone()[0]
         n_md = len(md_conn._all_rows())
         print(f"  派生库 nodes={n_sq}  md 直读行={n_md}")
-        ok &= _ok(n_sq == n_md == stats["nodes"] == 4355,
-                  "行数等价且为 4355")
+        # 判据=三方等价（派生库 == md 直读 == 还原计数）。旧断言把 `== 4355`（导出前
+        # 快照行数）一并写死：绝对行数是本地数据面规模、非代码契约，锚死它会让「数据面
+        # 正常生长」被误判成等价性破坏（2026-09-19 重跑 migrate_wisdom_graph.export 后
+        # 4355 → 4459 即由此假红）。保留量级下界防退化为空库。
+        ok &= _ok(n_sq == n_md == stats["nodes"] and n_sq >= 4000,
+                  f"行数三方等价（派生库 {n_sq} == md 直读 {n_md} == "
+                  f"还原 {stats['nodes']}）且 >= 4000")
 
         print("== [2] 8 处真实 SQL 逐位对拍 ==")
         names, prefixes, kps = _sample_params(md_conn)