连接池「响应归属校验」形同虚设：fork 后多进程共读一条 TCP 长连接，把别人的缓存值当成自己的静默接受（日志全绿、数据全错）

_POOL = None

def init_pool(cfg):
    global _POOL
    _POOL = GatewayPool(cfg["gwHost"], cfg["gwPort"], cfg["poolSize"])
    _POOL.warmup(rounds=3)            # ← 在【父进程】里把 4 条长连接建好 + 喂熟
    return _POOL

# app.py
init_pool(cfg)                        # 父进程预热
for i in range(cfg["workers"]):
    p = mp.Process(target=process_orders, args=(i, jobs, sleep_ms, cfg))  # Linux 默认 fork
    p.start()

def register_sent(request_id, conn_nonce):
    ...          # ← 函数存在，但从来没人调用 → 登记表永远是空的

def nonce_matches(ack_nonce, conn_nonce):
    if ack_nonce == conn_nonce:
        return True                    # 只证明"来自我用过的某条连接"
    owner_conn = _SENT.get(ack_nonce)  # 表是空的，永远查不到
    if owner_conn is not None:
        return owner_conn == conn_nonce
    return True                        # ← ⚠️ 兜底放行：任何响应都被当成"自己的"

git checkout 2026-09-14-1600
cd scenario/2026-09-14-1600

bash run.sh              # = docker compose up -d --build + 跑一轮 + 打印网关/应用日志
# bash run.sh <workers> <jobs> [poolSize]，默认 4 6 4

[app] 连接池就绪（owner_pid=7）：['<GatewayConnection pool-0 fd=3 created_pid=7 nonce=aca9f265a620>', ...]
[worker1] pid=14 拿到值=6/6 空值=0 抢到别人响应=0 池created_pid=7     ← 池是父进程 pid=7 建的！

预热请求总数 24  拿到值 22  空值 0  抢到别人响应 0  接受别人的值 9
SUMMARY_JSON {"total": 24, "ok": 22, "empty": 0, "mismatch": 0,
              "accepted_foreign": 9, "sent_registered": 0,
              "polluted_workers": 4, "errors": 2}

[app] ★ 值归属自检：
      worker0 期望值(应为 'v-w0') 读到=['v-w0', 'v-w1', 'v-w2', 'v-w2', 'v-w3']  → 污染
      worker1 期望值(应为 'v-w1') 读到=['v-w0', 'v-w1', 'v-w1', 'v-w1', 'v-w1', 'v-w1']  → 污染
      worker2 期望值(应为 'v-w2') 读到=['v-w0', 'v-w0', 'v-w0', 'v-w2', 'v-w2', 'v-w2']  → 污染
      worker3 期望值(应为 'v-w3') 读到=['v-w3', 'v-w2', 'v-w3', 'v-w3', 'v-w3']  → 污染

[app] ❌ 4/4 个 worker 读到了别人的值：共 9 条响应被「张冠李戴」地当成自己的值接受，
      而应用日志里【没有任何报错】(sent_registered=0)

[gw] -> reply requestId=w0-job1 task=cache:order:1001:w0 cacheHit='v-w0' ackNonce='72cf4ddce543'

docker compose exec -T app python3 /srv/app.py --workers 1 --jobs 10
# SUMMARY_JSON {"total": 10, "ok": 10, "accepted_foreign": 0, "errors": 0}

docker compose exec -T app python3 /srv/app.py --workers 8  --jobs 12
docker compose exec -T app python3 /srv/app.py --workers 16 --jobs 12

python3 experiments/fork_probe.py --phase=both --repeat=3
# phase=before：合计 OK=10/16，TimeoutError / JSONDecodeError
# phase=after ：合计 OK=16/16

bash verify.sh
# 修复前：结果：PASS=3 FAIL=7
# 修复后：结果：PASS=10 FAIL=0

父进程 pid=7 ── pool-0 fd=3 ──┐
worker0 pid=13 ─ fd=3（同一把 fd 的副本）│  内核里只有 4 条 TCP 连接
worker1 pid=14 ─ fd=3（同一把 fd 的副本）├─ 被 4×4 个进程抢着 recv()
worker2 pid=15 ─ fd=3（同一把 fd 的副本）│  谁先读谁先拿到数据
worker3 pid=16 ─ fd=3（同一把 fd 的副本）┘

{"requestId": "w0-job1", "cacheHit": "v-w3",
 "_reader_pid": 14, "_conn_created_pid": 7, "_conn_state": "INHERITED_BY_FORK", "_conn": "pool-1"}

def register_sent(request_id, conn_nonce, conn_name=""):
    _SENT[request_id] = {"nonce": conn_nonce, "conn": conn_name, "pid": os.getpid()}

def call(self, payload):
    with self._lock:
        register_sent(req_id, self.conn_nonce, self.name)   # ★ 发送前登记
        self.sock.sendall(FRAME_HDR.pack(len(body)) + body)
        ...  # 读回响应

def nonce_matches(request_id, ack_nonce, conn_nonce) -> bool:
    if ack_nonce is None:
        return False            # 服务端没回显身份 → 无法证明是我的 → 拒收
    if not request_id:
        return ack_nonce == conn_nonce
    entry = _SENT.get(request_id)
    if entry is None:
        return False            # 我从没发过这个 requestId → 一定不是我的
    return entry["nonce"] == ack_nonce and entry["nonce"] == conn_nonce

r = call_gateway_check(conn, req_id, task, sleep_ms)
if not r["ok"]:                       # FOREIGN_RESPONSE
    failures.append({... "error": r["reason"], "got": r["got"]})
    continue                          # 丢弃 + 报错，绝不使用 value
value = r["value"]

def get_pool(cfg):
    global _POOL
    if _POOL is not None and _POOL.owner_pid != os.getpid():
        for c in _POOL.conns:
            c.drop_copy_only()        # ★ 只丢引用，绝不 close()（fd 共享会误伤别人）
        _POOL = None
    if _POOL is None:
        _POOL = GatewayPool(...)      # 本进程重建自己的连接
    return _POOL

def claim_once(request_id) -> bool:
    if request_id in _ACCEPTED:
        return False
    _ACCEPTED.add(request_id)
    return True

docker compose up -d --build app     # ★ 必须重建镜像！容器里的 /srv/connpool.py 来自镜像
bash verify.sh

[worker0] pid=13 拿到值=6/6 空值=0 抢到别人响应=0 池created_pid=13    ← 池归属变成自己
[worker1] pid=14 拿到值=6/6 空值=0 抢到别人响应=0 池created_pid=14
[worker2] pid=15 拿到值=6/6 空值=0 抢到别人响应=0 池created_pid=15
[worker3] pid=16 拿到值=6/6 空值=0 抢到别人响应=0 池created_pid=16

SUMMARY_JSON {"total": 24, "ok": 24, "accepted_foreign": 0,
              "sent_registered": 18, "polluted_workers": 0, "errors": 0}
[app] ✅ 全部 4 个 worker 读到的都是自己的值 (sent_registered=18)

[inject] nonce_matches(requestId='CHANNEL-A1', ackNonce='NONCE-B', connNonce='NONCE-A') -> False
[inject] ✅ 这条「别人的响应」被正确识别为 FOREIGN_RESPONSE 并丢弃
INJECTION_RESULT PASS

worker 0 pid 161 pool_owner_pid 161 values ['v-w0', 'v-w0', 'v-w0']
worker 1 pid 162 pool_owner_pid 162 values ['v-w1', 'v-w1', 'v-w1']
...
worker15 pid 176 pool_owner_pid 176 values ['v-w15', 'v-w15', 'v-w15']

git checkout 2026-09-14-1600
cd scenario/2026-09-14-1600

bash run.sh                      # 复现：accepted_foreign > 0, polluted_workers=4
python3 experiments/fork_probe.py --phase=both --repeat=3   # 无 docker 最小复现

docker compose up -d --build app # 套用修复后重建
bash verify.sh                   # 期望 PASS=10 FAIL=0

docker compose exec -T app cat /srv/report.json             # 每条响应的 _reader_pid / _conn_created_pid
docker compose logs gateway | grep '\[gw\] -> reply'        # 服务端视角：回了什么值
docker compose down