agentic-flow-kit 1.7.16 → 1.8.0

package/templates/_agents/scripts/check-ledger-invariant.test.mjs

@@ -1,6 +1,9 @@
 #!/usr/bin/env node
 // check-ledger-invariant.test.mjs — 台账提交不变量 fixture 套件（2026-10-02 ledger-ci-invariant）
 // 真 git 仓注入：合法追加放行 / 六类篡改与行级违例检出 / --staged 双态 / 首次入库与空台账静默。
+// 2026-10-13 深水批次并集：分片 H 系 / 特许修剪 P 系 / 归档感知 A 系 / 合并并集与合并审计 M 系
+// （M6 合并收口删片·首父盲区 / M7 借收口抹账 / M8 补登追认·语义身份）/ 历史基线 B1——
+// 场景自实战实现同名套件移植，判据适配处见各场景注释。
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -9,6 +12,7 @@ import { fileURLToPath } from 'node:url';
 
 const SCRIPT_DIR = path.dirname(fileURLToPath(import.meta.url));
 const SCRIPT = path.join(SCRIPT_DIR, 'check-ledger-invariant.mjs');
+const PRUNE_REL = '.agents/ledger-prune-manifest.json'; // 与脚本单源（ledger-prune.mjs）同路径
 
 let pass = 0;
 let fail = 0;
@@ -25,8 +29,8 @@ const row = (o = {}) => JSON.stringify({
 
 const G = (root, args) => spawnSync('git', args, { cwd: root, encoding: 'utf8' });
 const commitAll = (root, msg) => { G(root, ['add', '-A']); G(root, ['-c', 'user.email=t@t', '-c', 'user.name=t', 'commit', '-qm', msg]); };
-const run = (root, args = []) => {
-  const r = spawnSync(process.execPath, [SCRIPT, '--root', root, ...args], { encoding: 'utf8' });
+const run = (root, args = [], env = {}) => {
+  const r = spawnSync(process.execPath, [SCRIPT, '--root', root, ...args], { encoding: 'utf8', env: { ...process.env, ...env } });
   return { code: r.status, out: `${r.stdout || ''}${r.stderr || ''}` };
 };
 
@@ -46,6 +50,19 @@ const mkrepo = (firstRow = row()) => {
 const ledPath = (d) => path.join(d, '.agents', 'confirmations.jsonl');
 const append = (d, line) => fs.appendFileSync(ledPath(d), line + '\n');
 
+// ---- 分片台账夹具（追加合法 / 改写硬拦 / 归并后删片合法 / 未归并存片硬拦）----
+// 夹具注意：分片行的 doc 必须在树上有对应文件，否则行级校验「doc 不存在」会盖过被测判据。
+const shardDirOf = (d) => path.join(d, '.agents', 'confirmations.d');
+const mkDoc = (d, name) => fs.writeFileSync(path.join(d, 'workflow', 'intents', `${name}.md`), `---\n状态: approved\n级别: L1\n日期: 2026-10-02\n模块: pipeline\n---\n# ${name}\n`);
+const shardWrite = (d, name, rows) => {
+  fs.mkdirSync(shardDirOf(d), { recursive: true });
+  fs.writeFileSync(path.join(shardDirOf(d), `${name}.jsonl`), rows.join('\n') + '\n');
+};
+// 特许修剪夹具
+const sha256Of = (s) => spawnSync(process.execPath, ['-e', `console.log(require('crypto').createHash('sha256').update(process.argv[1],'utf8').digest('hex'))`, s], { encoding: 'utf8' }).stdout.trim();
+const manifestPath = (d) => path.join(d, ...PRUNE_REL.split('/'));
+const writeManifest = (d, obj) => { fs.mkdirSync(path.dirname(manifestPath(d)), { recursive: true }); fs.writeFileSync(manifestPath(d), JSON.stringify(obj, null, 2) + '\n'); };
+
 // S1：合法追加 ×2 → 历史全扫过
 {
   const d = mkrepo();
@@ -177,5 +194,418 @@ const append = (d, line) => fs.appendFileSync(ledPath(d), line + '\n');
   fs.rmSync(d, { recursive: true, force: true });
 }
 
+// ---- S13-S17：--staged 分片触发面（2026-10-13 ledger-shard-default：分片为默认写入口径，触发面扩大）----
+{
+  const d = mkrepo();
+  const shardDir = path.join(d, '.agents', 'confirmations.d');
+  fs.mkdirSync(shardDir, { recursive: true });
+  const shardP = path.join(shardDir, 'demo.jsonl');
+  fs.writeFileSync(shardP, row({ ts: '2026-10-02T02:00:00.000Z', stage: 'done' }) + '\n');
+  G(d, ['add', '-A']);
+  let r = run(d, ['--staged']);
+  check('S13 --staged 新分片首入库（无 HEAD 基线）→ exit 0', r.code === 0, r.out);
+  commitAll(d, 'shard base');
+  r = run(d);
+  check('S13 分片入库后历史全扫 exit 0（分片历史干净）', r.code === 0, r.out);
+
+  // S14：分片纯追加 → --staged 放行
+  fs.appendFileSync(shardP, row({ ts: '2026-10-02T03:00:00.000Z', stage: 'done' }) + '\n');
+  G(d, ['add', '-A']);
+  r = run(d, ['--staged']);
+  check('S14 --staged 分片纯追加 → exit 0', r.code === 0, r.out);
+  commitAll(d, 'shard append');
+
+  // S15：分片重写 → --staged 拦（分片同受 append-only 前缀不变量约束）
+  const lines = fs.readFileSync(shardP, 'utf8').split('\n').filter(Boolean);
+  lines[0] = lines[0].replace('确认', '篡改后');
+  fs.writeFileSync(shardP, lines.join('\n') + '\n');
+  G(d, ['add', '-A']);
+  r = run(d, ['--staged']);
+  check('S15 --staged 分片重写 → exit 1（报文点名分片重写）', r.code === 1 && r.out.includes('分片重写'), r.out);
+  G(d, ['checkout', 'HEAD', '--', '.agents/confirmations.d/demo.jsonl']); // 还原到 HEAD 基线
+
+  // S16：compact 归并删分片（分片行全部并入暂存主台账）→ --staged 放行
+  fs.appendFileSync(ledPath(d), fs.readFileSync(shardP, 'utf8'));
+  fs.rmSync(shardP);
+  G(d, ['add', '-A']);
+  r = run(d, ['--staged']);
+  check('S16 --staged compact 归并删分片（行全并入暂存主台账）→ exit 0', r.code === 0, r.out);
+  commitAll(d, 'compact merge');
+
+  // S17：未并入即删分片（丢行）→ --staged 拦
+  fs.writeFileSync(shardP, row({ ts: '2026-10-02T04:00:00.000Z', stage: 'done' }) + '\n');
+  G(d, ['add', '-A']);
+  commitAll(d, 'shard again');
+  fs.rmSync(shardP);
+  G(d, ['add', '-A']);
+  r = run(d, ['--staged']);
+  check('S17 --staged 未并入即删分片 → exit 1（报文点名分片删除丢行）', r.code === 1 && r.out.includes('分片删除丢行'), r.out);
+  fs.rmSync(d, { recursive: true, force: true });
+}
+
+// ---- 分片台账不变量（2026-10-12 ledger-shard-write 实战套件移植）：----
+// H1：分片合法追加 ×2 → 历史全扫过（跨端确认不同 doc 写不同分片，互不干扰）
+// H2：分片删历史行 → 前缀破坏硬拦（--staged 与历史全扫双态）
+// H3：分片归并后删除（compact-ledgers 形态：全部行已逐字进主台账）→ 合法且 loud 记录
+// H4：分片删除但行未进主台账（抹账）→ 硬拦
+// H5：主台账删除仍恒拦（分片的合法删除形态不外溢到主台账）
+// H6：分片行级违例（ts 乱序）在分片自身被检出，不因主台账无恙而漏
+//     （判据适配：kit 行级 ts 口径为「同 doc 内非降序」，报文措辞「追加时序倒挂」——见脚本头注①）
+{
+  const d = mkrepo();
+  mkDoc(d, 'a');
+  shardWrite(d, 'doc-a', [row({ ts: '2026-10-02T01:00:00.000Z', doc: 'workflow/intents/a.md' })]);
+  commitAll(d, 'shard doc-a v1');
+  fs.appendFileSync(path.join(shardDirOf(d), 'doc-a.jsonl'), row({ ts: '2026-10-02T02:00:00.000Z', stage: 'done', doc: 'workflow/intents/a.md' }) + '\n');
+  commitAll(d, 'shard doc-a v2');
+  const r = run(d);
+  check('H1 分片合法追加两次 → 历史全扫 exit 0', r.code === 0, r.out);
+  fs.rmSync(d, { recursive: true, force: true });
+}
+{
+  const d = mkrepo();
+  mkDoc(d, 'b');
+  shardWrite(d, 'doc-b', [
+    row({ ts: '2026-10-02T01:00:00.000Z', doc: 'workflow/intents/b.md' }),
+    row({ ts: '2026-10-02T02:00:00.000Z', stage: 'done', doc: 'workflow/intents/b.md' }),
+  ]);
+  commitAll(d, 'shard doc-b v1');
+  shardWrite(d, 'doc-b', [row({ ts: '2026-10-02T01:00:00.000Z', doc: 'workflow/intents/b.md' })]); // 删第二行
+  G(d, ['add', '-A']);
+  const rs = run(d, ['--staged']);
+  check('H2a 分片删历史行 → --staged 前缀破坏 exit 1', rs.code === 1 && /分片重写|台账重写/.test(rs.out) && /doc-b\.jsonl/.test(rs.out), rs.out);
+  commitAll(d, 'shard doc-b tampered');
+  const rh = run(d);
+  check('H2b 分片删历史行 → 历史全扫 exit 1 且点名分片', rh.code === 1 && /confirmations\.d\/doc-b\.jsonl/.test(rh.out), rh.out);
+  fs.rmSync(d, { recursive: true, force: true });
+}
+{
+  const d = mkrepo();
+  mkDoc(d, 'c');
+  const s1 = row({ ts: '2026-10-02T01:00:00.000Z', doc: 'workflow/intents/c.md' });
+  const s2 = row({ ts: '2026-10-02T02:00:00.000Z', stage: 'done', doc: 'workflow/intents/c.md' });
+  shardWrite(d, 'doc-c', [s1, s2]);
+  commitAll(d, 'shard doc-c');
+  // 归并：分片两行原样追加进主台账，再删分片（compact-ledgers.mjs 的真实动作序列）
+  append(d, s1); append(d, s2);
+  fs.rmSync(path.join(shardDirOf(d), 'doc-c.jsonl'));
+  commitAll(d, 'compact doc-c into main');
+  const r = run(d);
+  check('H3 分片归并后删除 → exit 0 且 loud 记录「归并后删除」', r.code === 0 && /归并后删除/.test(r.out), r.out);
+  fs.rmSync(d, { recursive: true, force: true });
+}
+{
+  const d = mkrepo();
+  mkDoc(d, 'e');
+  const s1 = row({ ts: '2026-10-02T01:00:00.000Z', doc: 'workflow/intents/e.md' });
+  shardWrite(d, 'doc-e', [s1]);
+  commitAll(d, 'shard doc-e');
+  fs.rmSync(path.join(shardDirOf(d), 'doc-e.jsonl')); // 直接删，不归并
+  commitAll(d, 'delete shard without merge');
+  const r = run(d);
+  check('H4 分片删除而行未归并主台账 → hard 拦「分片删除」', r.code === 1 && /分片删除/.test(r.out) && /不在同提交主台账内/.test(r.out), r.out);
+  fs.rmSync(d, { recursive: true, force: true });
+}
+{
+  const d = mkrepo();
+  fs.rmSync(ledPath(d));
+  commitAll(d, 'delete main ledger');
+  const r = run(d);
+  check('H5 主台账删除 → 恒 hard 拦「台账删除」', r.code === 1 && /台账删除/.test(r.out), r.out);
+  fs.rmSync(d, { recursive: true, force: true });
+}
+{
+  const d = mkrepo();
+  mkDoc(d, 'f');
+  shardWrite(d, 'doc-f', [
+    row({ ts: '2026-10-02T05:00:00.000Z', doc: 'workflow/intents/f.md' }),
+    row({ ts: '2026-10-02T01:00:00.000Z', stage: 'done', doc: 'workflow/intents/f.md' }), // 早于前行
+  ]);
+  commitAll(d, 'shard doc-f out-of-order');
+  const r = run(d);
+  check('H6 分片内 ts 倒挂 → 行级拦且点名分片', r.code === 1 && /追加时序倒挂/.test(r.out) && /doc-f\.jsonl/.test(r.out), r.out);
+  fs.rmSync(d, { recursive: true, force: true });
+}
+
+// ---- 特许修剪（2026-10-09 user-directed-prune）：manifest 逐行对账 ----
+// P1：--staged 特许修剪——删中段行 + manifest 恰对账 → 放行
+{
+  const r2 = row({ ts: '2026-10-02T01:00:00.000Z', stage: 'done', doc: 'workflow/intents/gone.md' });
+  const r3 = row({ ts: '2026-10-02T02:00:00.000Z', stage: 'done' });
+  const d = mkrepo();
+  append(d, r2); append(d, r3); commitAll(d, '3 rows');
+  fs.writeFileSync(ledPath(d), [row(), r3].join('\n') + '\n'); // 删 r2
+  writeManifest(d, { ts: '2026-10-09T00:00:00.000Z', authority: 'test', reason: 'test prune', removes: [sha256Of(r2)], docs: ['gone'] });
+  G(d, ['add', '-A']);
+  const r = run(d, ['--staged']);
+  check('P1 --staged 特许修剪 manifest 对账 → exit 0 且 loud 记录', r.code === 0 && /特许修剪通过/.test(r.out) && /1 行/.test(r.out), r.out);
+  commitAll(d, 'sanctioned prune');
+  const rh = run(d);
+  check('P1b 历史全扫认领同一修剪 → exit 0', rh.code === 0, rh.out);
+  fs.rmSync(d, { recursive: true, force: true });
+}
+// P2：--staged 删行但 manifest 哈希不对（对账失败）→ 拦
+{
+  const r2 = row({ ts: '2026-10-02T01:00:00.000Z', stage: 'done', doc: 'workflow/intents/gone.md' });
+  const d = mkrepo();
+  append(d, r2); commitAll(d, '2 rows');
+  fs.writeFileSync(ledPath(d), row() + '\n');
+  writeManifest(d, { ts: '2026-10-09T00:00:00.000Z', authority: 'test', reason: 'x', removes: ['f'.repeat(64)], docs: ['gone'] });
+  G(d, ['add', '-A']);
+  const r = run(d, ['--staged']);
+  check('P2 manifest 哈希不命中 → exit 1 且报对账失败', r.code === 1 && r.out.includes('特许修剪对账失败'), r.out);
+  fs.rmSync(d, { recursive: true, force: true });
+}
+// P3：--staged 删行且无 manifest → 仍拦（append-only 红线对未授权场景不变）
+{
+  const r2 = row({ ts: '2026-10-02T01:00:00.000Z', stage: 'done', doc: 'workflow/intents/gone.md' });
+  const d = mkrepo();
+  append(d, r2); commitAll(d, '2 rows');
+  fs.writeFileSync(ledPath(d), row() + '\n');
+  G(d, ['add', '-A']);
+  const r = run(d, ['--staged']);
+  check('P3 无 manifest 删行 → exit 1（S10 语义回归）', r.code === 1 && r.out.includes('台账重写'), r.out);
+  fs.rmSync(d, { recursive: true, force: true });
+}
+// P4：manifest 在场但删了 manifest 之外的行（夹带私删）→ 拦
+{
+  const r2 = row({ ts: '2026-10-02T01:00:00.000Z', stage: 'done', doc: 'workflow/intents/gone.md' });
+  const r3 = row({ ts: '2026-10-02T02:00:00.000Z', stage: 'done', doc: 'workflow/intents/sneak.md' });
+  const d = mkrepo();
+  append(d, r2); append(d, r3); commitAll(d, '3 rows');
+  fs.writeFileSync(ledPath(d), [row(), r3].join('\n') + '\n'); // 删 r2；r3 保留
+  writeManifest(d, { ts: '2026-10-09T00:00:00.000Z', authority: 't', reason: 'x', removes: [sha256Of(r2), sha256Of(r3)], docs: ['gone', 'sneak'] }); // 多报一行
+  G(d, ['add', '-A']);
+  const r = run(d, ['--staged']);
+  check('P4 manifest 多报（哈希命中 1 ≠ 声明 2）→ exit 1', r.code === 1 && r.out.includes('特许修剪对账失败'), r.out);
+  fs.rmSync(d, { recursive: true, force: true });
+}
+
+// ---- ④ 归档感知（2026-10-13 archive-aware-doc）：关单即归档移动文件后行仍指向真实文档 ----
+// A1：行指向归档批次中的文档 → 放行；A2：行指向真消失文档（四目录与归档批次均无）→ 拦且报新口径
+{
+  const d = mkrepo();
+  fs.mkdirSync(path.join(d, 'workflow', 'archive', '2026-10', 'plans'), { recursive: true });
+  fs.writeFileSync(path.join(d, 'workflow', 'archive', '2026-10', 'plans', 'archived.md'), '---\n状态: done\n---\n# A\n');
+  append(d, row({ ts: '2026-10-02T01:00:00.000Z', stage: 'done', doc: 'workflow/plans/archived.md' }));
+  commitAll(d, 'append archived-doc row');
+  const r = run(d);
+  check('A1 doc 已归档（archive/2026-10/plans）→ 行级放行 exit 0', r.code === 0, r.out);
+  fs.rmSync(d, { recursive: true, force: true });
+}
+{
+  const d = mkrepo();
+  append(d, row({ ts: '2026-10-02T01:00:00.000Z', stage: 'done', doc: 'workflow/plans/vanished.md' }));
+  commitAll(d, 'append vanished-doc row');
+  const r = run(d);
+  check('A2 doc 真消失（无归档批次命中）→ 拦且报「归档批次均未命中」', r.code === 1 && r.out.includes('归档批次均未命中'), r.out);
+  fs.rmSync(d, { recursive: true, force: true });
+}
+
+// ---- 合并并集语义（2026-10-13 merge-union-aware）：多父提交按「并集无丢失」判 ----
+// M1：两侧各追加一行，合并结果 = 三行之并 → union 认可、全扫过
+// M2：合并结果丢掉一侧的行 → 拦且报「合并丢失」
+const mkMergeRepo = () => {
+  const d = mkrepo();
+  const BR = G(d, ['symbolic-ref', '--short', 'HEAD']).stdout.trim();
+  const r2 = row({ ts: '2026-10-02T01:00:00.000Z', stage: 'done' });
+  const r3 = row({ ts: '2026-10-02T02:00:00.000Z', stage: 'fixed' });
+  G(d, ['checkout', '-qb', 'br']);
+  append(d, r2); commitAll(d, 'br append r2');
+  G(d, ['checkout', '-q', BR]);
+  append(d, r3); commitAll(d, 'main append r3');
+  G(d, ['merge', '--no-commit', 'br']); // 冲突（双改同文件）——预期非零，手工写并集
+  return { d, r2, r3 };
+};
+{
+  const { d, r2, r3 } = mkMergeRepo();
+  fs.writeFileSync(ledPath(d), [row(), r2, r3].join('\n') + '\n'); // union 结果
+  commitAll(d, 'merge union');
+  const r = run(d);
+  check('M1 合并=父母行集之并 → union 认可 exit 0', r.code === 0 && /union 合并语义认可/.test(r.out), r.out);
+  fs.rmSync(d, { recursive: true, force: true });
+}
+{
+  const { d, r2 } = mkMergeRepo();
+  fs.writeFileSync(ledPath(d), [row(), r2].join('\n') + '\n'); // 丢了 main 侧 r3
+  commitAll(d, 'merge losing main-side line');
+  const r = run(d);
+  check('M2 合并丢行 → exit 1 且报「合并丢失」', r.code === 1 && r.out.includes('合并丢失'), r.out);
+  fs.rmSync(d, { recursive: true, force: true });
+}
+
+// ---- 合并审计加固（复核②实修回归）：ours 丢行 / 合并携带修剪 / 凭空造行 ----
+// M3：-X ours 合并静默丢 br 侧行（合并树与第一父同 blob，前缀通过）→ union 无条件对账必须拦
+{
+  const d = mkrepo();
+  const BR = G(d, ['symbolic-ref', '--short', 'HEAD']).stdout.trim();
+  const r2 = row({ ts: '2026-10-02T01:00:00.000Z', stage: 'done' });
+  G(d, ['checkout', '-qb', 'br']);
+  append(d, r2); commitAll(d, 'br append r2');
+  G(d, ['checkout', '-q', BR]);
+  const rM3 = row({ ts: '2026-10-02T02:00:00.000Z', stage: 'fixed' });
+  append(d, rM3); commitAll(d, 'main append r3');
+  G(d, ['merge', '-X', 'ours', '-q', 'br', '-m', 'ours merge drops br line']); // 树=第一父，r2 静默消失
+  const r = run(d);
+  check('M3 ours 合并静默丢行 → exit 1 且报「合并丢失」', r.code === 1 && r.out.includes('合并丢失'), r.out.slice(-300));
+  fs.rmSync(d, { recursive: true, force: true });
+}
+// M4：合并丢弃父母并集中的行 + manifest——(a) 诚实全量申报（对父母并集）→ 放行；(b) 只报第一父相对差集（p2 独有行无凭据消失）→ 拦
+{
+  const d = mkrepo();
+  const BR = G(d, ['symbolic-ref', '--short', 'HEAD']).stdout.trim();
+  const r2 = row({ ts: '2026-10-02T01:00:00.000Z', stage: 'done' });
+  const r3 = row({ ts: '2026-10-02T02:00:00.000Z', stage: 'fixed' });
+  G(d, ['checkout', '-qb', 'br']);
+  append(d, r2); commitAll(d, 'br r2');
+  G(d, ['checkout', '-q', BR]);
+  append(d, r3); commitAll(d, 'main r3');
+  G(d, ['merge', '--no-commit', 'br']);
+  fs.writeFileSync(ledPath(d), row() + '\n'); // r2、r3 全丢
+  writeManifest(d, { ts: '2026-10-13T00:00:00.000Z', authority: 't', reason: 'honest full prune', removes: [sha256Of(r2), sha256Of(r3)], docs: ['demo', 'demo'] });
+  commitAll(d, 'merge with honest full manifest');
+  const r = run(d);
+  check('M4a 合并丢双侧行+诚实全量 manifest → 集合对账放行 exit 0', r.code === 0 && /合并携带特许修剪/.test(r.out), r.out.slice(-300));
+  fs.rmSync(d, { recursive: true, force: true });
+}
+{
+  const d = mkrepo();
+  const BR = G(d, ['symbolic-ref', '--short', 'HEAD']).stdout.trim();
+  const r2 = row({ ts: '2026-10-02T01:00:00.000Z', stage: 'done' });
+  const r3 = row({ ts: '2026-10-02T02:00:00.000Z', stage: 'fixed' });
+  G(d, ['checkout', '-qb', 'br']);
+  append(d, r2); commitAll(d, 'br r2');
+  G(d, ['checkout', '-q', BR]);
+  append(d, r3); commitAll(d, 'main r3');
+  G(d, ['merge', '--no-commit', 'br']);
+  fs.writeFileSync(ledPath(d), row() + '\n'); // r2、r3 全丢
+  writeManifest(d, { ts: '2026-10-13T00:00:00.000Z', authority: 't', reason: 'p1-relative partial', removes: [sha256Of(r3)], docs: ['demo'] }); // 只报 main 侧，br 的 r2 无凭据消失
+  commitAll(d, 'merge with partial manifest');
+  const r = run(d);
+  check('M4b 合并丢行+部分 manifest（p2 行无凭据）→ exit 1', r.code === 1 && /修剪集合对账/.test(r.out), r.out.slice(-300));
+  fs.rmSync(d, { recursive: true, force: true });
+}
+// M5：合并凭空多出父母都没有的行 → 拦
+{
+  const d = mkrepo();
+  const BR = G(d, ['symbolic-ref', '--short', 'HEAD']).stdout.trim();
+  const r2 = row({ ts: '2026-10-02T01:00:00.000Z', stage: 'done' });
+  const r3 = row({ ts: '2026-10-02T02:00:00.000Z', stage: 'fixed' });
+  G(d, ['checkout', '-qb', 'br']);
+  append(d, r2); commitAll(d, 'br r2');
+  G(d, ['checkout', '-q', BR]);
+  append(d, r3); commitAll(d, 'main r3'); // 双侧分叉，保证是真合并而非 fast-forward
+  G(d, ['merge', '--no-commit', 'br']);
+  append(d, row({ ts: '2026-10-02T09:00:00.000Z', quote: '凭空造行' }));
+  commitAll(d, 'merge with fabricated line');
+  const r = run(d);
+  check('M5 合并凭空多出行 → exit 1 且报「凭空多出」', r.code === 1 && r.out.includes('凭空多出'), r.out.slice(-300));
+  fs.rmSync(d, { recursive: true, force: true });
+}
+// M6：合并收口删片（首父侧早已归并删片、分片仅第二父仍持有）→ 各父并集对账认可
+// （合并感知删片①：单读首父只看一侧会把合法收口误判成「增删同提交」——首父盲区形态）
+// 形态：A 首父侧建分片 → B 首父侧归并删片 → br（第二父，模拟他端未同步修剪）仍持分片并
+//   独立追加主台账 → 真合并，分片按首父态在结果中缺席、主台账取父母并集。
+{
+  const d = mkrepo();
+  mkDoc(d, 'm');
+  const s1 = row({ ts: '2026-10-02T01:00:00.000Z', doc: 'workflow/intents/m.md' });
+  const r2 = row({ ts: '2026-10-02T02:00:00.000Z', stage: 'done' });
+  const r9 = row({ ts: '2026-10-02T03:00:00.000Z', stage: 'fixed' });
+  shardWrite(d, 'doc-m', [s1]);
+  commitAll(d, 'A main create shard doc-m');
+  const BR = G(d, ['symbolic-ref', '--short', 'HEAD']).stdout.trim();
+  G(d, ['checkout', '-qb', 'br']); // br 自 A 分叉：仍持有分片（他端未做归并）
+  append(d, r2);
+  commitAll(d, 'C br append r2 (shard still present)');
+  G(d, ['checkout', '-q', BR]);
+  append(d, s1); // B 首父侧归并：行进主台账后删片（compact-ledgers 动作序列）
+  fs.rmSync(path.join(shardDirOf(d), 'doc-m.jsonl'));
+  commitAll(d, 'B main compact doc-m (append row then drop shard)');
+  append(d, r9);
+  commitAll(d, 'D main unrelated append');
+  G(d, ['merge', '--no-commit', 'br']); // 主台账双侧追加 → 冲突，手工写并集；分片呈删除态（delete/modify 自动取删除）
+  fs.writeFileSync(ledPath(d), [row(), s1, r2, r9].join('\n') + '\n');
+  commitAll(d, 'merge: ledger union + shard stays dropped');
+  const r = run(d);
+  check('M6 合并收口删片（分片仅第二父有）→ 各父并集对账认可 exit 0', r.code === 0 && /归并后删除/.test(r.out), r.out.slice(-400));
+  fs.rmSync(d, { recursive: true, force: true });
+}
+// M7：合并收口删片而行未归并主台账（借合并收口抹账）→ 硬拦
+{
+  const d = mkrepo();
+  mkDoc(d, 'n');
+  const s1 = row({ ts: '2026-10-02T01:00:00.000Z', doc: 'workflow/intents/n.md' });
+  const r2 = row({ ts: '2026-10-02T02:00:00.000Z', stage: 'done' });
+  const r9 = row({ ts: '2026-10-02T03:00:00.000Z', stage: 'fixed' });
+  shardWrite(d, 'doc-n', [s1]);
+  commitAll(d, 'A main create shard doc-n');
+  const BR = G(d, ['symbolic-ref', '--short', 'HEAD']).stdout.trim();
+  G(d, ['checkout', '-qb', 'br']);
+  append(d, r2);
+  commitAll(d, 'C br append r2 (shard still present, rows never in main ledger)');
+  G(d, ['checkout', '-q', BR]);
+  append(d, r9); // 首父侧【不归并】直接独立推进
+  commitAll(d, 'D main unrelated append (no compaction)');
+  G(d, ['merge', '--no-commit', 'br']);
+  fs.writeFileSync(ledPath(d), [row(), r2, r9].join('\n') + '\n'); // 并集无 s1——分片行从未进主台账
+  fs.rmSync(path.join(shardDirOf(d), 'doc-n.jsonl')); // 合并解析把分片一并丢弃 → 借收口抹账
+  commitAll(d, 'merge: drop shard without compaction');
+  const r = run(d);
+  check('M7 合并收口删片未归并 → exit 1 且报「分片删除」', r.code === 1 && /分片删除/.test(r.out) && /不在同提交主台账内/.test(r.out), r.out.slice(-400));
+  fs.rmSync(d, { recursive: true, force: true });
+}
+// M8：合并删片缺行但终树已补登（merge-shard-restore-aware）→ 丢失追认 exit 0 且 loud
+// 形态：br 侧分片多出 s2 未归并主台账，合并解析删片（s2 丢失）→ 后续提交把 s2 以补偿形态
+//   （ts 改现时刻 + note 引原 ts，doc/stage/fingerprint 沿原行）回append进主台账 → 语义身份比对追认。
+{
+  const d = mkrepo();
+  mkDoc(d, 'p');
+  mkDoc(d, 'p2');
+  const s1 = row({ ts: '2026-10-02T01:00:00.000Z', doc: 'workflow/intents/p.md' });
+  const s2 = row({ ts: '2026-10-02T04:00:00.000Z', doc: 'workflow/intents/p2.md' });
+  const r2 = row({ ts: '2026-10-02T02:00:00.000Z', stage: 'done' });
+  const r9 = row({ ts: '2026-10-02T03:00:00.000Z', stage: 'fixed' });
+  shardWrite(d, 'doc-p', [s1]);
+  commitAll(d, 'A main create shard doc-p');
+  const BR = G(d, ['symbolic-ref', '--short', 'HEAD']).stdout.trim();
+  G(d, ['checkout', '-qb', 'br']);
+  append(d, r2);
+  fs.appendFileSync(path.join(shardDirOf(d), 'doc-p.jsonl'), s2 + '\n'); // br 侧分片多出 s2（未归并）
+  commitAll(d, 'C br append r2 + shard gains s2 (not compacted)');
+  G(d, ['checkout', '-q', BR]);
+  append(d, s1); // 首父侧归并 s1 后删片
+  fs.rmSync(path.join(shardDirOf(d), 'doc-p.jsonl'));
+  commitAll(d, 'B main compact s1 + drop shard');
+  append(d, r9);
+  commitAll(d, 'D main unrelated append');
+  G(d, ['merge', '--no-commit', 'br']);
+  fs.writeFileSync(ledPath(d), [row(), s1, r2, r9].join('\n') + '\n'); // 并集（无 s2——s2 在合并中丢失）
+  fs.rmSync(path.join(shardDirOf(d), 'doc-p.jsonl')); // 合并解析按首父态删片
+  commitAll(d, 'merge: s2 lost by shard drop');
+  const s2c = JSON.stringify({ ...JSON.parse(s2), ts: '2026-10-02T05:00:00.000Z', note: '补偿行：原行 ts 2026-10-02T04:00:00.000Z 合并丢失后补登' });
+  append(d, s2c); // 终树补登：s2 以**补偿形态**回append（doc/stage/fingerprint 沿原行）
+  commitAll(d, 'E restore lost s2 into main ledger (compensation form)');
+  const r = run(d);
+  check('M8 合并删片缺行终树已补登（补偿形态，语义身份比对）→ 丢失追认 exit 0', r.code === 0 && /补登/.test(r.out) && /丢失追认/.test(r.out), r.out.slice(-400));
+  fs.rmSync(d, { recursive: true, force: true });
+}
+
+// ---- 历史基线（2026-10-13 ledger-history-baseline）：owner 声明豁免前基线时代 ----
+// B1：前基线改写无凭据——无基线全史扫描拦；LEDGER_HISTORY_BASELINE 指到 HEAD 后豁免过
+//     （kit 缺省无基线 = 全量扫描，与源实现「缺省基线指向自身仓提交、外来仓退化为全扫」同语义）
+{
+  const d = mkrepo();
+  append(d, row({ ts: '2026-10-02T01:00:00.000Z', stage: 'done' }));
+  commitAll(d, 'append');
+  fs.writeFileSync(ledPath(d), row({ ts: '2026-10-02T02:00:00.000Z', quote: '改写' }) + '\n'); // 非 append 改写，无 manifest
+  commitAll(d, 'rewrite pre-baseline');
+  const head = G(d, ['rev-parse', 'HEAD']).stdout.trim();
+  const rNoBase = run(d); // kit 缺省无基线 → 全史扫描拦
+  const rBase = run(d, [], { LEDGER_HISTORY_BASELINE: head });
+  check('B1 历史基线：无基线改写拦 / 基线=HEAD 豁免过且 loud', rNoBase.code === 1 && rBase.code === 0 && /豁免/.test(rBase.out), `noBase=${rNoBase.out.slice(-200)} base=${rBase.out.slice(-200)}`);
+  fs.rmSync(d, { recursive: true, force: true });
+}
+
 console.log(`\n${fail ? `❌ ${fail} failed` : '✅ all passed'}（${pass} passed）`);
-process.exit(fail ? 1 : 0);
+process.exit(fail ? 1 : 0);

package/templates/_agents/scripts/check-loop-rev.test.mjs

@@ -220,7 +220,7 @@ try {
   fs.mkdirSync(path.join(tree, '.agents', 'scripts'), { recursive: true });
   copyAgentsFiles(path.join(tree, '.agents'), ['workflow-enums.txt']);
   // 索引生成器 + 预算判定件的整闭包（含 workflow-enums.mjs 与日后新增依赖）
-  copyScriptClosure(path.join(tree, '.agents', 'scripts'), ['gen-workflow-index.mjs', 'rule-budget.sh']);
+  copyScriptClosure(path.join(tree, '.agents', 'scripts'), ['gen-workflow-index.mjs', 'rule-budget.mjs']);
   fs.writeFileSync(path.join(tree, '.agents', 'rule-budgets.txt'), 'big.txt 10\n');
   fs.writeFileSync(path.join(tree, 'big.txt'), 'ok\n');
   for (const sub of ['intents', 'specs', 'plans', 'incidents']) {
@@ -239,7 +239,8 @@ try {
   gitRun(tree, ['add', '--', '.']);
   gitRun(tree, ['commit', '-q', '-m', 'drift']);
   const drift = gitRun(tree, ['rev-parse', 'HEAD']);
-  const drifted = loop(tree, ['--rev', drift]);
+  // --all 显式全量（2026-10-13 分道：本场景断言的是卫生面「索引漂移」告警）
+  const drifted = loop(tree, ['--rev', drift, '--all']);
   check('被推送提交索引损坏：--rev 报索引漂移', outOf(drifted).includes('索引漂移'), outOf(drifted));
   fs.writeFileSync(path.join(tree, 'big.txt'), 'x'.repeat(100));
   const restored = spawnSync(process.execPath, [path.join(tree, '.agents', 'scripts', 'gen-workflow-index.mjs')], { cwd: tree, encoding: 'utf8' });
@@ -250,8 +251,9 @@ try {
   fs.writeFileSync(path.join(tree, 'big.txt'), 'ok\n');
   gitRun(tree, ['add', '--', '.']);
   gitRun(tree, ['commit', '-q', '-m', 'slim']);
-  const atFat = loop(tree, ['--rev', fat]);
-  const atSlim = loop(tree, []);
+  // --all 同上：预算/索引漂移都是卫生面告警，须全量面才可见
+  const atFat = loop(tree, ['--rev', fat, '--all']);
+  const atSlim = loop(tree, ['--all']);
   check('预算只在被推送提交里超限：--rev 报 100B', outOf(atFat).includes('常驻面超限') && outOf(atFat).includes('100B'), outOf(atFat));
   check('工作区预算未超限：不带 --rev 不报常驻面超限，也不报索引漂移',
     !outOf(atSlim).includes('常驻面超限') && !outOf(atSlim).includes('索引漂移'), outOf(atSlim));
@@ -315,7 +317,8 @@ try {
 |------|----------|------------|------|------|
 | 2026-09-12 | x | y | 一次通过 | ${name} |
 `);
-    const atOld = loop(repo, ['--rev', sha]);
+    // --all：委派台账对账是卫生面（检查 18），--rev 硬门面不含它
+  const atOld = loop(repo, ['--rev', sha, '--all']);
     check('委派行只在工作区：--rev 旧提交仍输出委派台账',
       outOf(atOld).includes('委派台账') && outOf(atOld).includes(`intents/${name}`),
       outOf(atOld));

package/templates/_agents/scripts/check-loop-unit.test.mjs

@@ -42,6 +42,14 @@ const W = (root, rel, content) => { fs.mkdirSync(path.join(root, path.dirname(re
   // root 不可访问 → exit 1（不抛异常）
   const r3 = runCheckLoop({ root: path.join(root, '不存在目录') });
   check('run：root 不可访问 → exit 1（同款报错语义）', r3.exitCode === 1, `exit=${r3.exitCode}`);
+  // 分道 mode opt（2026-10-13 B6b-1）：缺省=硬门（上方缺配对即拦）；'hygiene' 只跑卫生段（硬违例不出）；
+  // 'all' 两段都跑（等价分道前裸跑全量）。
+  const rHy = runCheckLoop({ root, mode: 'hygiene' });
+  check('run：mode=hygiene 只跑卫生段——L2 缺配对不出（exit 0 blockers 空）',
+    rHy.exitCode === 0 && rHy.blockers.length === 0, `exit=${rHy.exitCode} b=${rHy.blockers.length}`);
+  const rAll = runCheckLoop({ root, mode: 'all' });
+  check('run：mode=all 两段都跑——同样拦 L2 缺配对',
+    rAll.exitCode === 1 && rAll.blockers.some((b) => b.includes('配对断裂')), `exit=${rAll.exitCode}`);
   fs.rmSync(root, { recursive: true, force: true });
 }