@furongjun1999/dsh-memory 0.4.8 → 0.4.9

package/md_cg/test_p27_docindex.py

@@ -20,20 +20,31 @@ R2 改造的验收（对照 docs/mdcg/认知图_索引与工程规范化_计划_
   ⑦ 不静默：truncated / skipped_suffixes / skipped_dirs 显式上报；排除为**追加**
      （只增不减，内置 .git/.venv/node_modules 不可被关闭）；只读契约（源 mtime 不变）；
      幂等（重跑节点数不变）；`index_doc` 进 ALL_OPS 且与工具 schema 一致。
+  ⑧ fence 往返列六件套的形状与边界：BINDING_FIELDS / binding_of / binding_key
+     （**不含行位**）/ binding_slug / validate_binding / binding_drift / locate。
+     为什么必须钉死：列形状漂移会让对账器把坏列当好消息（漏报）；键若悄悄带上
+     行位，真源上方插一行就会让整库失配——两者都是静默退化，只有断言看得见。
+  ⑨ 逐字节回放回归：对**真实索引出的卡**断言 `render(条目) + "\n" == 卡片正文`。
+     ⑧ 只证「列可定位」；只有逐字节相等才证明卡片是真源条目的**派生物**而非另一份
+     副本（渲染漂移或人工改写时列全然不变，对账器看不出来）。外部历史库另段抽样
+     （设 MDCG_ROOT 则跑，未设如实 SKIP 不虚报通过）。
 
 运行：python -m md_cg.test_p27_docindex
+     设 MDCG_ROOT=<认知图库根> 追加跑【12b】外部历史库逐字节回放抽样
 """
 from __future__ import annotations
 
 import os
+import random
 import shutil
 import sys
 import tempfile
 
-from . import codeindex, corpus, docindex, nodefile, routing, tokens
+from . import codeindex, corpus, docindex, nodefile, refindex, routing, tokens
 from . import mcp_server
-from .mdcos import MdCGOS          # 生产路径：forget 属 OS 层，基础层 MdCG 无删除原语
+from .mdcos import MdCGOS, MdCGSecure   # 生产路径：forget 属 OS 层，基础层 MdCG 无删除原语
 from .mcp_server import call_tool
+from .security import Principal
 
 PASS = FAIL = 0
 FAILS = []
@@ -55,6 +66,79 @@ def check(name, cond, detail=""):
         print(f"  [FAIL] {name}  · {detail}")
 
 
+def _norm(p):
+    """路径归一（大小写 + 分隔符）：root 归属比对用，避免同一目录被判成两个。"""
+    return os.path.normcase(os.path.normpath(str(p or "")))
+
+
+# 逐字节回放：把「往返列」从「形状可校验」推进到「内容可无损重建」。
+# 生效条件：cg 已索引完成的库；索引条目 tags 含 "doc" 且 frontmatter 有非空 doc_ref。
+# 判据：真源同键条目 `render(条目)` 补一个换行 == 卡片正文——`nodefile.dumps` 对不以
+# 换行结尾的正文补 '\n'，故卡片正文恒比 render 多 1 字节（是常态，不是缺陷；判等
+# 一律按 `render + "\n"`，避免把口径差当回归）。
+# 为什么非此不可：列形状对（validate_binding）只保证「可定位」；只有逐字节相等才
+# 证明卡片是真源条目的**派生物**而非另一份副本。渲染漂移或人工改写卡片正文时，
+# 列全都不变（路径/行位/hash 都是真源侧的值），对账器看不出来——本函数才看得见。
+# 悬空（真源已移出）/ 未解析如实计数：那是数据面事实，不冒充渲染失败。
+def _replay_cards(cg, roots=None, sample=0, seed=7):
+    nodes = (getattr(cg, "index", {}) or {}).get("nodes") or {}
+    picks = []
+    for nid in sorted(nodes):
+        if "doc" not in ((nodes.get(nid) or {}).get("tags") or []):
+            continue
+        kind, ref = refindex.ref_of(cg.get(nid))
+        if kind != "doc_ref" or not ref:
+            continue
+        if roots is not None and _norm(ref.get("root")) not in roots:
+            continue
+        picks.append((nid, ref))
+    if sample and len(picks) > sample:
+        picks = sorted(random.Random(seed).sample(picks, sample))
+    out = {"sampled": len(picks), "ok": 0, "dangling": 0, "gone": 0,
+           "unreadable": 0, "mismatch": []}
+    cache = {}
+    for nid, ref in picks:
+        fp = (str(ref.get("root") or ""), str(ref.get("path") or ""))
+        ckey = (_norm(fp[0]), fp[1])
+        if ckey not in cache:
+            # 把「源文件已移出」（数据面事实，非缺陷）与其它 IO/抽取异常（可能是真
+            # 问题：权限、编码、源被改成无标题文档）分开计数——混为一谈会把真实
+            # 故障伪装成历史遗留，静默吞掉回归。三态：True 读得 / False 不存在 /
+            # None 读不了。
+            try:
+                with open(os.path.join(fp[0], fp[1]), "r", encoding="utf-8",
+                          errors="replace") as f:
+                    cache[ckey] = (True, docindex.extract(f.read(), fp[1]))
+            except FileNotFoundError:
+                cache[ckey] = (False, None)
+            except (OSError, ValueError):
+                cache[ckey] = (None, None)
+        hit, items = cache[ckey]
+        if hit is not True:
+            out["gone" if hit is False else "unreadable"] += 1
+            continue
+        node = cg.get(nid) or {}
+        want = docindex.binding_key(docindex.binding_of(node))
+        # 键（path#heading_path）在同名标题重复时可能命中多条：先按行位锁定同名代，
+        # 行位也漂了才回落首条（此时本来就判「不符」，不掩盖结论）。
+        cands = [i for i in items if docindex.binding_key(i) == want]
+        if not cands:
+            out["dangling"] += 1
+            continue
+        item = next((i for i in cands if i.get("lineno") == ref.get("lineno")),
+                    cands[0])
+        got = docindex.render(item) + "\n"
+        content = node.get("content") or ""
+        if got == content:
+            out["ok"] += 1
+            continue
+        k = next((i for i in range(min(len(got), len(content)))
+                  if got[i] != content[i]), min(len(got), len(content)))
+        out["mismatch"].append(
+            f"{nid}@{k} 回放={got[k:k + 24]!r} 卡片={content[k:k + 24]!r}")
+    return out
+
+
 LONG = "这是总览段落，" + "用以验证章节切块在长正文下的表现，" * 12 + "结束。"
 
 GUIDE_LINES = [
@@ -514,6 +598,156 @@ def main():
         check("清幽灵后悬空仍为零", not (ck4.get("dangling") or []),
               str(ck4.get("dangling"))[:130])
 
+        # ============================================ ⑪ fence 往返列（binding）
+        # 缺口：往返列（取列 / 造键 / 校验 / 漂移 / 反查）是「条件卡 ↔ Markdown 真源」
+        # 的可校验面，此前零测试。列形状一旦漂移，对账器会把坏列当好消息（漏报）；
+        # 键若悄悄带上行位，真源上方插一行就会让整库失配——故两者都要钉死。
+        print("\n【11】fence 往返列：形状 / 键不含行位 / 校验 / 漂移 / 反查")
+        li = docindex.extract(GUIDE, "guide.md")
+        s9b = next(i for i in li if i["heading"] == "9. 分阶段实施")
+        rendered = docindex.render(s9b)
+        gnode = cg.get(g_id) or {}
+        g_ref = (gnode.get("frontmatter") or {}).get("doc_ref") or {}
+        b0 = docindex.binding_of(gnode)
+        check("必需列齐全且无空值",
+              isinstance(b0, dict)
+              and all(b0.get(k) not in (None, "") for k in docindex.BINDING_FIELDS),
+              str(sorted(docindex.BINDING_FIELDS)))
+        check("列面 = 必需列 + 附加列（无第二份列口径）",
+              set(b0 or {}) == set(docindex.BINDING_FIELDS)
+              | set(docindex.BINDING_OPTIONAL),
+              str(sorted(set(b0 or {}) ^ (set(docindex.BINDING_FIELDS)
+                                          | set(docindex.BINDING_OPTIONAL)))))
+        check("必需列/附加列 ⊆ 写侧 doc_ref 列（读写同一列面）",
+              (set(docindex.BINDING_FIELDS) | set(docindex.BINDING_OPTIONAL))
+              <= set(g_ref),
+              str(sorted(set(docindex.BINDING_FIELDS) - set(g_ref))))
+        check("binding_of 与直接读 frontmatter 同源（同一投影）",
+              b0 == docindex.binding_of({"frontmatter": {"doc_ref": g_ref}}))
+        check("binding_of 对非索引节点返回 None（不猜、不补默认值）",
+              docindex.binding_of(None) is None
+              and docindex.binding_of([]) is None
+              and docindex.binding_of({}) is None
+              and docindex.binding_of({"frontmatter": {"tags": ["doc"]}}) is None)
+        check("validate_binding：本仓卡片列形状合法（ok + 零 issue）",
+              docindex.validate_binding(b0) == {"ok": True, "issues": []},
+              str(docindex.validate_binding(b0)))
+        check("validate_binding：非 dict 如实报错且不抛",
+              docindex.validate_binding(None)
+              == {"ok": False, "issues": ["绑定不是字典（该节点无 doc_ref）"]})
+        lo0 = b0["lineno"]
+        bad_detail = []
+        for _nm, _b, _want in (
+                ("缺列", {k: v for k, v in b0.items() if k != "anchor"},
+                 "缺列 anchor"),
+                ("类型错 root", {**b0, "root": 123},
+                 "root 应为字符串，实为 int"),
+                ("类型错 lineno", {**b0, "lineno": "十"}, "行位不是整数"),
+                ("行位越界", {**b0, "lineno": 0}, "lineno 越界（0 < 1）"),
+                ("区间倒置", {**b0, "end": lo0 - 1},
+                 f"end 早于 lineno（{lo0}-{lo0 - 1}）")):
+            _v = docindex.validate_binding(_b)
+            if _v["ok"] or _want not in _v["issues"]:
+                bad_detail.append(f"{_nm}→{_v['issues']}")
+        check("validate_binding 逐类坏列均被点出（缺列/类型错/越界/区间倒置）",
+              not bad_detail, "; ".join(bad_detail)[:170])
+        b_shift = docindex.binding_of({"frontmatter": {"doc_ref": {
+            **g_ref, "lineno": lo0 + 40, "end": g_ref["end"] + 40}}})
+        check("键不含行位：行位位移不改键（重排后仍是同一章节）",
+              docindex.binding_key(b0) == docindex.binding_key(b_shift)
+              == "guide.md#总览/9. 分阶段实施",
+              docindex.binding_key(b0))
+        check("漂移按固定列序报出变化项（lineno → end → hash）",
+              docindex.binding_drift(b0, b_shift) == ["lineno", "end"]
+              and docindex.binding_drift(b0, {**b0, "hash": "zz"}) == ["hash"]
+              and docindex.binding_drift(
+                  b0, {**b0, "hash": "zz", "lineno": lo0 + 1})
+              == ["lineno", "hash"],
+              str(docindex.binding_drift(b0, b_shift)))
+        check("同列零漂移（无变化不报 / 空值不炸）",
+              docindex.binding_drift(b0, dict(b0)) == []
+              and docindex.binding_drift(None, None) == [])
+        check("binding_key 缺 heading_path 回落 path#anchor · 非 dict 返空串",
+              docindex.binding_key({"path": "a.md", "anchor": "s1"}) == "a.md#s1"
+              and docindex.binding_key({"path": "a.md"}) == "a.md#"
+              and docindex.binding_key(None) == "")
+        check("binding_slug 与 render 正文「本条目属于」逐字同源",
+              docindex.binding_slug(b0) == "guide.md#9-分阶段实施"
+              and f"本条目属于 {docindex.binding_slug(b0)}" in rendered,
+              docindex.binding_slug(b0))
+        check("反查取最内层（父节区间内的子节优先，不回落父节）",
+              docindex.locate(li, 12)["heading"] == "9. 分阶段实施"
+              and docindex.locate(li, 30)["heading"] == "代码示例",
+              str((docindex.locate(li, 12) or {}).get("heading")))
+        check("反查区间闭合（标题行与末行都算本节）",
+              docindex.locate(li, s9b["lineno"])["heading"] == "9. 分阶段实施"
+              and docindex.locate(li, s9b["end"])["heading"] == "9. 分阶段实施")
+        check("反查越界/非整数/空表 → None（fail-closed 不猜）",
+              docindex.locate(li, 10 ** 6) is None
+              and docindex.locate(li, 0) is None
+              and docindex.locate(li, "x") is None
+              and docindex.locate(li, None) is None
+              and docindex.locate([], 10) is None)
+
+        # ================================ ⑫ 逐字节回放回归（往返列无损）
+        # ⑪ 只证「列可校验」；本段把口径推到内容无损：卡片必须是真源条目的派生物
+        # （render 补一个换行 == 卡片正文）。root 限定为本次真正索引过的两个真源，
+        # 断言只落在本轮写入的卡上——历史残留不参与，避免把脏数据当回归。
+        print("\n【12】逐字节回放回归：render(条目) + 换行 == 卡片正文")
+        cg.flush()
+        rp = _replay_cards(cg, roots={_norm(fx), _norm(DOCS)})
+        print(f"      取样 {rp['sampled']} 卡：一致 {rp['ok']} · 键未命中 "
+              f"{rp['dangling']} · 源已移出 {rp['gone']} · 读不了 "
+              f"{rp['unreadable']}")
+        check("回放取样命中卡片（root 限定=本次索引的两个真源）",
+              rp["sampled"] > 0, str(rp["sampled"]))
+        check("可读卡 100% 逐字节回放一致（写侧 render 与读侧同源）",
+              not rp["mismatch"],
+              f"一致 {rp['ok']}/{rp['sampled']}；" + "；".join(rp["mismatch"][:2]))
+        check("零键未命中 / 零源已移出 / 零读不了（源在库则必可重定位并读回）",
+              rp["dangling"] == 0 and rp["gone"] == 0
+              and rp["unreadable"] == 0,
+              f"键未命中={rp['dangling']} 源已移出={rp['gone']} "
+              f"读不了={rp['unreadable']}")
+        check("回放账目闭合（一致 + 键未命中 + 源已移出 + 读不了 = 取样数）",
+              (rp["ok"] + rp["dangling"] + rp["gone"] + rp["unreadable"])
+              == rp["sampled"],
+              f"{rp['ok']}+{rp['dangling']}+{rp['gone']}+{rp['unreadable']}"
+              f" vs {rp['sampled']}")
+
+        # 历史抽样：真实认知图库（仓外数据面，历史卡最多）。以 MDCG_ROOT 显式声明；
+        # 裸 clone / CI 无此数据面 → 如实报 SKIP（不虚报通过、也不 FAIL）。
+        ext_root = os.environ.get("MDCG_ROOT") or ""
+        if not (ext_root and os.path.isdir(ext_root)):
+            print("\n【12b】历史抽样：跳过（未设 MDCG_ROOT 或目录不存在）"
+                  "—— 本仓语料回放见【12】")
+        else:
+            print(f"\n【12b】历史抽样：外部认知图库 {ext_root}（只读身份）")
+            ext = MdCGSecure(ext_root, principal=Principal(
+                actor="p27-replay", clearance="secret", can_write=False,
+                can_admin=False, role="designer", auth_mode="local-cli"))
+            try:
+                hp = _replay_cards(ext, sample=120)
+            finally:
+                ext.close()
+            print(f"      抽样 {hp['sampled']} 卡：一致 {hp['ok']} · 键未命中 "
+                  f"{hp['dangling']} · 源已移出 {hp['gone']} · 读不了 "
+                  f"{hp['unreadable']}")
+            check("【12b】历史库抽样命中卡片（数据面可达）",
+                  hp["sampled"] > 0, str(hp["sampled"]))
+            check("【12b】可读历史卡零回放不符（未被渲染漂移/人工改写腐化）",
+                  not hp["mismatch"],
+                  f"一致 {hp['ok']}/{hp['sampled']}；"
+                  + "；".join(hp["mismatch"][:2]))
+            check("【12b】未读回的全部是「源已移出」（非 IO/抽取故障）",
+                  hp["unreadable"] == 0,
+                  f"源已移出={hp['gone']} 读不了={hp['unreadable']}")
+            check("【12b】抽样账目闭合（无静默丢弃）",
+                  (hp["ok"] + hp["dangling"] + hp["gone"] + hp["unreadable"])
+                  == hp["sampled"],
+                  f"{hp['ok']}+{hp['dangling']}+{hp['gone']}+{hp['unreadable']}"
+                  f" vs {hp['sampled']}")
+
     finally:
         shutil.rmtree(tmp, ignore_errors=True)
 

package/md_cg/test_p2_mcp.py

@@ -268,7 +268,7 @@ def main():
                   info.get("surface") == "kernel"
                   and set(info.get("audit_kinds", {})) == {
                       "code", "image_desc", "text", "permission",
-                      "work_done", "work_wip", "ccg_marks"},
+                      "work_done", "work_wip", "ccg_marks", "hyperedge"},
                   str(list(info.get("audit_kinds", {})))[:120])
             check("cg info 自描述 CCG 契约角色（裁定 B）",
                   info.get("ccg_contract", {}).get("生效条件") == "前置条件 precondition"

package/md_cg/test_p31_insight.py

@@ -201,6 +201,30 @@ def main():
               mfm.get("induced_concept") == cid
               and cid in {e.get("target") for e in (mfm.get("edges") or [])},
               str(mfm.get("induced_concept")))
+        # ---- 2026-09-19 阶段一：巩固留痕字段一等公民 ----
+        check("成员侧记 consolidated_into（规范名·巩固进哪一条）",
+              mfm.get("consolidated_into") == cid
+              and mfm.get("induced_concept") == cid,
+              str(mfm.get("consolidated_into")))
+        check("成员侧记 consolidated_at（何时巩固）",
+              bool(mfm.get("consolidated_at")), str(mfm.get("consolidated_at")))
+        check("概念侧记 consolidated_at（概念形成即巩固时刻）",
+              bool(cfm.get("consolidated_at"))
+              and cfm.get("induced_at") == cfm.get("consolidated_at"),
+              f"{cfm.get('consolidated_at')} / {cfm.get('induced_at')}")
+        check("前身可定位：概念侧 induced_from 与成员侧列互查一致",
+              set(cfm.get("induced_from") or []) == {"ind_1", "ind_2", "ind_3"}
+              and all(((cg.get(m) or {}).get("frontmatter") or {}
+                       ).get("consolidated_into") == cid
+                      for m in ("ind_1", "ind_2", "ind_3")))
+        # add() 是**全量重建 fm**——覆写后留痕必须仍在（回读节点继承，非索引快照）
+        cg.add("ind_1", IND_A, layer="contextual", importance=0.4,
+               verification_basis="other", actor="p31")
+        mfm2 = (cg.get("ind_1") or {}).get("frontmatter") or {}
+        check("覆写后成员侧巩固留痕继承（consolidated_into/at 不丢）",
+              mfm2.get("consolidated_into") == cid
+              and bool(mfm2.get("consolidated_at")),
+              str(mfm2.get("consolidated_into")))
         check("induce 留痕 _maintain.jsonl",
               any(r.get("action") == "induce"
                   for r in consolidate._read_maintain(ROOT)))

package/md_cg/test_p44_md_whitebox.py

@@ -28,7 +28,7 @@ import tempfile
 
 _HERE = os.path.dirname(os.path.abspath(__file__))
 
-from .md_whitebox import build_db_from_md  # noqa: E402
+from .md_whitebox import build_db_from_md, corpus_gap  # noqa: E402
 
 SOURCE_DB = os.path.join(_HERE, "whitebox_kb", "wisdom", "wisdom-book-cloud.db")
 
@@ -129,6 +129,19 @@ def _report(rows):
 def main():
     ok = True
 
+    # 依赖自辩（2026-09-20 v14 缺陷 F）：源库与 md 语料均为 gitignored 本地
+    # 数据面——缺失时本模块自己打 SKIP 返回 0。旧形态下缺库会以未捕获的
+    # `sqlite3.OperationalError: unable to open database file` traceback 示人，
+    # 与兄弟目标「自建库后断言失败」构成同一根因的第三副面孔。
+    if not os.path.exists(SOURCE_DB):
+        print("SKIP test_p44_md_whitebox：依赖源库 %s（.gitignore 忽略，"
+              "需本地生成）" % SOURCE_DB)
+        return 0
+    _gap = corpus_gap()
+    if _gap:
+        print("SKIP test_p44_md_whitebox：%s" % _gap)
+        return 0
+
     # ---- 1) 结构等价 ----
     # force：从 md 语料**重新**还原，保证 access_count 等可变字段与源库快照
     # 同起点（复用旧库会带上此前问答累积的 access，造成假差异）。

package/md_cg/test_protocol.py

@@ -0,0 +1,243 @@
+# -*- coding: utf-8 -*-
+"""md_cg · 记忆动词协议 v1 形状钉死（静态对账 + 进程内真调形状）
+
+运行：python -m md_cg.test_protocol
+
+分工（三层，各自独立可裁）：
+  A 静态——协议声明 ↔ MCP 面实现：声明五动词 / live 有分支 / reserved 无分支 /
+    形状声明完备；`_ops_from_source` 的 AST 提取鲁棒性（单引号 · `op in` 元组 ·
+    `op.strip().lower()` 三写法 + 负例 `action ==` 不误取 + 语法错误不炸）。
+  B 动态——进程内真调 `_cg_call`，按协议声明的 required 子集校验**真实返回**：
+    route / read 三态（node · list · pack，含目标缺失返回 null）/ write 铁律三键 /
+    forget 两动作 + 失败形态 / op 推导兜底透出。
+  C 集成——`conformance.check()` 确实带上了 protocol.* 四条断言且全绿。
+
+边界（如实声明，不假装覆盖）：
+  · write 的 committed 形态在本环境不可达：未配置 MDCG_POLICY_FILE 时校验闸门恒
+    DEFER 入 review_queue（实测），故 B 段对 write 断言「铁律三键 + 未 committed
+    时去向可见（gate|moved_to）」，并按实际走的那一态校验对应形状；
+    committed 形态的字段依据是 writepipe 链尾执行器的源码事实。
+  · 本测试**不连真实库**：库根为 tempdir，断言面是形状（键集），不是数据正确性。
+"""
+import os
+import shutil
+import sys
+import tempfile
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from md_cg import conformance
+from md_cg import mcp_server as M
+from md_cg import protocol as P
+from md_cg.mdcos import MdCGSecure
+from md_cg.security import DEFAULT_SENSITIVITY, Principal
+
+_ok = 0
+_fail = []
+
+
+def check(name, cond, detail=""):
+    global _ok
+    if cond:
+        _ok += 1
+        print("[PASS] " + name)
+    else:
+        _fail.append(name)
+        print("[FAIL] %s  · %s" % (name, str(detail)[:240]))
+
+
+def _p(actor="proto"):
+    return Principal(actor=actor, clearance=DEFAULT_SENSITIVITY,
+                     can_write=True, can_admin=True, role="designer")
+
+
+def _sub(shape, ret):
+    """required 子集判定——协议形状断言的原语。"""
+    return set(shape["required"]) <= set(ret or {})
+
+
+def _raises(exc, fn):
+    try:
+        fn()
+        return False
+    except exc:
+        return True
+    except Exception:                                       # noqa: BLE001
+        return False
+
+
+# ==================== A. 静态：协议声明 ↔ MCP 面实现 ====================
+print("-- A 静态对账 --")
+_a = P.audit()
+
+check("A1 audit ok（声明与实现一致）", _a["ok"] is True, _a["errors"])
+check("A2 协议 v1 且 draft 期未冻结（冻结是单向门）",
+      _a["protocol_version"] == 1 and _a["frozen"] is False,
+      (_a["protocol_version"], _a["frozen"]))
+check("A3 声明五动词且顺序固定",
+      tuple(_a["declared"]) == ("route", "read", "write", "supersede", "forget"),
+      _a["declared"])
+check("A4 live 四动词有实现分支",
+      set(_a["live"]) == {"route", "read", "write", "forget"}, _a["live"])
+check("A5 supersede 登记 reserved 且未泄漏实现（不冒充）",
+      _a["reserved"] == ["supersede"] and _a["reserved_leaked"] == [],
+      _a["reserved"])
+check("A6 无 live 动词缺实现分支", _a["missing_impl"] == [], _a["missing_impl"])
+check("A7 扩展能力面如实报告（属能力不属违例）",
+      bool(_a["extension_ops"]) and "write" not in _a["extension_ops"],
+      _a["extension_ops"])
+check("A8 每动词至少一形态、每形态带 when", all(
+    P.VERB_SPECS[v]["shapes"]
+    and all(s.get("when") for s in P.VERB_SPECS[v]["shapes"].values())
+    for v in _a["declared"]), "")
+check("A9 write 各形态 required 均含铁律三键",
+      all(set(P.WRITE_TRIO) <= set(s["required"])
+          for s in P.VERB_SPECS["write"]["shapes"].values()), "")
+check("A10 reserved 动词给出 map_to 现状映射证据",
+      bool(P.VERB_SPECS["supersede"].get("map_to")), "")
+check("A11 read 显式登记 null 形态（目标缺失 ≠ 错误）",
+      P.shape_of("read", "node_missing").get("returns_null") is True, "")
+check("A12 非法动词 fail-closed（shape_of 抛 KeyError）",
+      _raises(KeyError, lambda: P.shape_of("nosuch")), "")
+check("A13 summary 单行含 ok=True", "ok=True" in P.summary(), P.summary())
+
+_src = '''
+def _d(op, action):
+    if op == "double":
+        return 1
+    if op == 'single':
+        return 2
+    if op in ("in_a", "in_b"):
+        return 3
+    if op.strip().lower() == "stripped":
+        return 4
+    if action == "not_op":
+        return 5
+    return 0
+'''
+_ops = P._ops_from_source(_src)
+check("A14 AST 提取四写法齐（双引号/单引号/in 元组/strip().lower）",
+      set(_ops) == {"double", "single", "in_a", "in_b", "stripped"}, _ops)
+check("A15 负例：action == 分支不被误取为 op", "not_op" not in _ops, _ops)
+check("A16 语法错误返回空列表且不抛异常",
+      P._ops_from_source("if (op ==") == [], "")
+check("A17 dispatch_ops 与 audit 同源（同一次提取口径）",
+      P.dispatch_ops()["ops"] == _a["actual"], P.dispatch_ops()["ops"])
+
+# ==================== B. 动态：进程内真调形状 ====================
+print("-- B 进程内真调形状 --")
+_root = tempfile.mkdtemp(prefix="mdcg_proto_")
+_body = ("# 功能名：协议形状探针\n# 生效条件：协议形状测试\n# 子功能：无\n"
+         "# 执行：探针\n# 验证方式：test_protocol 断言\n"
+         "# 不适用条件：非形状测试场景\n\n正文 material_proto")
+try:
+    cg = MdCGSecure(_root, principal=_p())
+
+    _r = M._cg_call(cg, {"op": "route", "intent": "记忆动词协议形状"})
+    check("B1 route 形态 required 齐（knowledge/meta）",
+          _sub(P.shape_of("route"), _r), _r)
+
+    _w = M._cg_call(cg, {"op": "write", "content_kind": "text",
+                         "layer": "knowledge", "tags": ["proto"],
+                         "content": _body})
+    check("B2 write 铁律三键齐（ok/id/committed——落盘与否不靠猜）",
+          set(P.WRITE_TRIO) <= set(_w or {}), _w)
+    check("B3 write 未 committed 时去向可见（gate 或 moved_to）",
+          bool((_w or {}).get("committed"))
+          or ("gate" in (_w or {}) or "moved_to" in (_w or {})), _w)
+    if _w.get("committed"):
+        check("B3b write committed 形态 required 齐",
+              _sub(P.shape_of("write", "committed"), _w), _w)
+    else:
+        check("B3c write 闸门短路形态 required 齐（moved_to/verdict/hint）",
+              _sub(P.shape_of("write", "gate_short_circuit"), _w), _w)
+    check("B4 verdict 字段集与协议声明一致（写闸门短路态）",
+          set(P.VERDICT_FIELDS) <= set(_w.get("verdict") or {}), _w.get("verdict"))
+
+    _nid = "mem_proto1"
+    cg.add(_nid, _body, content_kind="text", layer="knowledge", tags=["proto"])
+    cg.flush()
+
+    _rn = M._cg_call(cg, {"op": "read", "node_id": _nid})
+    check("B5 read(node) 形态 required 齐（含 verification_state）",
+          _sub(P.shape_of("read", "node"), _rn),
+          list(_rn.keys()) if isinstance(_rn, dict) else _rn)
+
+    _rl = M._cg_call(cg, {"op": "read", "query": "协议形状探针"})
+    check("B6 read(list) 形态 required 齐（meta/results）",
+          _sub(P.shape_of("read", "list"), _rl), _rl)
+
+    _rp = M._cg_call(cg, {"op": "read", "query": "协议形状探针",
+                          "budget_tokens": 300})
+    check("B7 read(pack) 形态 required 齐（pack/tokens_used/budget/skipped/recent/meta）",
+          _sub(P.shape_of("read", "pack"), _rp),
+          list(_rp.keys()) if isinstance(_rp, dict) else _rp)
+
+    check("B8 read 目标缺失返回 null（协议登记形态，非错误对象）",
+          M._cg_call(cg, {"op": "read", "node_id": "mem_不存在"}) is None, "")
+
+    _f = M._cg_call(cg, {"op": "forget", "node_id": _nid, "reason": "协议测试"})
+    check("B9 forget 成功形态 required 齐（ok/id/tombstone）",
+          _sub(P.shape_of("forget", "forgotten"), _f), _f)
+    check("B10 forget 后 read(node_id) 立即返回 null（软删对读面生效）",
+          M._cg_call(cg, {"op": "read", "node_id": _nid}) is None, "")
+
+    _ff = M._cg_call(cg, {"op": "forget", "node_id": _nid, "action": "restore"})
+    check("B11 restore 返回属声明两形态之一（restored / failed）",
+          _sub(P.shape_of("forget", "restored"), _ff)
+          or _sub(P.shape_of("forget", "failed"), _ff), _ff)
+
+    _fm = M._cg_call(cg, {"op": "forget", "node_id": "mem_不存在"})
+    check("B12 forget 目标缺失失败形态 required 齐（ok/error）",
+          _sub(P.shape_of("forget", "failed"), _fm), _fm)
+
+    _d1 = M._cg_call(cg, {"content": "推导探针 derive_probe_content"})
+    check("B13 op 推导兜底：content → write 且透出 op_derived",
+          (_d1 or {}).get("op") == "write" and _d1.get("op_derived") is True, _d1)
+    check("B14 推导附加键不破坏 write 铁律三键",
+          set(P.WRITE_TRIO) <= set(_d1 or {}), _d1)
+    check("B15 推导附加键集与协议声明一致（op/op_derived/hint）",
+          set(P.DERIVE_EXTRA_KEYS) <= set(_d1 or {}), _d1)
+
+    _d2 = M._cg_call(cg, {"query": "协议形状探针"})
+    check("B16 op 推导兜底：query → read",
+          (_d2 or {}).get("op") == "read"
+          and _sub(P.shape_of("read", "list"), _d2), _d2)
+finally:
+    shutil.rmtree(_root, ignore_errors=True)
+
+# ==================== C. 集成：conformance 静态对账 ====================
+print("-- C conformance 集成 --")
+_croot = tempfile.mkdtemp(prefix="mdcg_proto_conf_")
+try:
+    # conformance.check 需要 `_index.json` 存在，而 flush() 只写分片日志
+    # （`_index_log/`）——只有 compact_index()/rebuild_index() 才落 `_index.json`。
+    _ccg = MdCGSecure(_croot, principal=_p("proto_conf"))
+    _ccg.add("mem_conf1", _body, content_kind="text", layer="knowledge",
+             tags=["proto"])
+    _ccg.rebuild_index()
+    _rep = conformance.check(_croot)
+    check("C1 报告含 protocol 段", bool(_rep.get("protocol")),
+          list(_rep.keys())[:12])
+    _ids = {c["id"]: c for c in _rep["checks"]}
+    for _cid in ("protocol.op.extension_surface", "protocol.verb.implemented",
+                 "protocol.verb.reserved_clean", "protocol.shape.declared"):
+        _c = _ids.get(_cid)
+        check("C2 已钉入 conformance 且 ok：%s" % _cid,
+              bool(_c) and _c["ok"] is True, _c)
+    check("C3 协议外 op 面为报告项 WARN（能力不是违例）",
+          _ids["protocol.op.extension_surface"]["level"] == "WARN",
+          _ids["protocol.op.extension_surface"]["level"])
+    check("C4 protocol.* 全绿（无 FAIL 残留）",
+          [c["id"] for c in _rep["checks"]
+           if c["id"].startswith("protocol.") and not c["ok"]] == [],
+          [c["id"] for c in _rep["checks"]
+           if c["id"].startswith("protocol.") and not c["ok"]])
+finally:
+    shutil.rmtree(_croot, ignore_errors=True)
+
+print("=" * 60)
+print("protocol：%d 通过 / %d 失败" % (_ok, len(_fail)))
+if _fail:
+    print("失败项：" + "; ".join(_fail))
+sys.exit(1 if _fail else 0)