镜像网关完整性校验失败：上游校验和被当成「信任初判」、一份坏模块株连整批降级、去重粒度被复用成校验通过数、空判据表 + 退出码恒 0 的健康检查假绿

$ python3 -m app.run
{"blobs": 6, "files": 13, "modules": 6, "quarantined": 0, "rejected": 0, "verified": 6}
rejected=0 ok=True

不一致 11 条：
  - com/google/guava/guava/31.1-jre/guava-31.1-jre.pom.integrity：期望 'mismatch' 实际 'ok'
  - junit/junit/4.13.2/junit-4.13.2.pom.integrity：期望 'no_digest' 实际 'ok'
  - commons-io/commons-io/2.6/commons-io-2.6.pom.integrity：期望 'mismatch' 实际 'ok'
  - counts.verified：期望 3 实际 6
  - counts.rejected：期望 3 实际 0
  - manifest.modules：期望 3 个 实际 6 个
  - ok：期望 False 实际 True
RESULT: BAD（不一致 11 条）

cd scenario/2026-10-19-1600
docker compose up -d --build
docker compose exec -T mirror bash      # 非交互必须加 -T

# ① 看问题现场
python3 -m app.run
{"blobs": 6, "files": 13, "modules": 6, "quarantined": 0, "rejected": 0, "verified": 6}
rejected=0 ok=True

# ② 外部探针（真正的验收口径）
python3 client/mirror_probe.py
# RESULT: BAD（不一致 11 条），rc=1

# ③ 复现脚本（退出码 = 探针退出码，问题态是 1）
bash ops/repro.sh ; echo "rc=$?"

# ④ 逐条验收：问题态 PASS=11 FAIL=16
bash ops/verify.sh

# ⑤ 健康检查是假绿
python3 -m app.health ; echo "rc=$?"
# {"degraded": false, "issues": []}  rc=0
CONF_DIR=/tmp/nope python3 -m app.health ; echo "rc=$?"
# 契约读不到，照样 rc=0 —— 报平安

python3 - <<'PY'
import hashlib, json, os
mirror = "mirror"
for m in json.load(open(f"{mirror}/listing.json"))["modules"]:
    p = os.path.join(mirror, m["path"])
    a = hashlib.sha1(open(p, "rb").read()).hexdigest()
    d = open(p + ".sha1").read().strip().lower() if os.path.exists(p + ".sha1") else None
    print("ok" if d == a else ("no_digest" if d is None else "mismatch"), m["path"], a, d)
PY

def _check_one(mirror_dir, path, cfg):
    declared = _declared(mirror_dir, path, cfg)
    data = loader.read_bytes(mirror_dir, path)
    actual = digest_of(cfg["digest_algo"], data)
    if cfg["trust_upstream_digest"] and declared is not None:
        return "ok", declared, actual          # ← 只要读到校验和就判 ok，从不比较！
    return "ok", actual, actual               # ← 没有校验和也判 ok

# 「早退」：一旦发现过不一致，就整批降级（后面的都不再单独判）
if rejected and integrity == "ok":
    integrity = "mismatch"
    declared = "--snip--"
    actual2 = "--snip--"

"verified": len(seeded),    # 校验通过数直接用「本轮动作条数」（blob 数）顶替
"blobs":    len(seeded),    # 同一个值
"ok": True,                 # 写死
"blob_created": True,       # 写死

BAD_FIELDS = ()          # 判据表是空的：for 循环体执行 0 次

def main():
    issues = []
    ...
    for field in BAD_FIELDS:       # 0 次
        ...
    print(json.dumps({"degraded": bool(issues), "issues": issues}))
    return EXIT_OK                 # 无论如何都返回 0

FALLBACK = {"digest_algo": "sha1", "trust_upstream_digest": True, ...}

def _raw(path):
    try:
        ...
    except OSError:
        pass                      # ← 契约读不到就当空字典
    return data

def load(conf_dir):
    raw = _raw(...)
    cfg = dict(FALLBACK)          # ← 缺字段、缺整个文件，都拿引擎默认值兜底
    cfg["digest_algo"] = raw.get("MIRROR_DIGEST_ALGO", FALLBACK["digest_algo"])
    ...

def judge(mirror_dir, path, cfg):
    """判定只看这个文件自己的字节 + 它自己的 <file>.sha1（契约 §2 独立性）。"""
    data = loader.read_bytes(mirror_dir, path)
    actual = digest_of(cfg["digest_algo"], data)

    declared_raw = loader.read_digest_file(mirror_dir, path)
    if declared_raw is None:
        return "no_digest", None, actual, data
    declared = normalize(declared_raw)                    # strip().lower()
    if not _is_hex(declared, len(actual)):
        return "bad_digest", declared, actual, data
    if not cfg["trust_upstream_digest"]:
        return "bad_digest", declared, actual, data        # 不采信上游 → 无法自证 → 不通过
    if declared == actual:
        return "ok", declared, actual, data
    return "mismatch", declared, actual, data

for item in listing:
    path = item["path"]
    integrity, declared, actual, data = judge(mirror_dir, path, cfg)
    ok = integrity == "ok"

    blob, created = None, False
    if ok or cfg["blob_on_reject"]:        # §4：被拦下的模块也落盘，便于人工复核
        blob, created = _store_blob(blobs_dir, actual, data)
        if created:
            blobs_seen.add(actual)         # §6：blobs 只数「本次新建」

    if ok:
        verified += 1                      # §6：verified 是「判定通过的模块数」
        status = "verified"
    else:
        rejected.append(path)              # §4：无论落不落盘，判定都要保留
        status = "quarantined"
        if blob is not None:
            quarantined += 1

    files += _count_files(mirror_dir, path)   # 自己的文件 + 自己的 .sha1

"ok": len(rejected) == 0 and verified + len(rejected) == counts["modules"],

rc = EXIT_BAD if (issues or exp["rejected"] > 0) else EXIT_OK

docker compose cp app/. mirror:/srv/app/     # 无 bind mount，必须同步进容器
docker compose exec -T mirror bash -c 'cd /srv && bash ops/repro.sh ; echo rc=$?'

{"blobs": 6, "files": 11, "modules": 6, "quarantined": 3, "rejected": 3, "verified": 3}
rejected=3 ok=False
   - org/apache/commons/.../commons-lang3-3.12.0.pom             verified     ok
   - com/google/guava/.../guava-31.1-jre.pom                     quarantined  mismatch
   - com/fasterxml/jackson/.../jackson-databind-2.13.4.pom        verified     ok    ← 大写校验和通过
   - org/slf4j/.../slf4j-api-1.7.36.pom                          verified     ok
   - junit/junit/4.13.2/junit-4.13.2.pom                         quarantined  no_digest
   - commons-io/commons-io/2.6/commons-io-2.6.pom                quarantined  mismatch
RESULT: OK
rc=0

bash ops/verify.sh        # PASS=27 FAIL=0 / RESULT: OK
bash ops/negative.sh      # NPASS=14 NFAIL=0 / RESULT: OK（闸门有牙）

python3 -m app.health ; echo rc=$?          # degraded=true, rc=2（有拒收 → 2）
CONF_DIR=/tmp/nope python3 -m app.health ; echo rc=$?   # rc=3（契约不可用 → 3）
CONF_DIR=/tmp/nope python3 -m app.run ; echo rc=$?      # rc=3（run 也 fail-closed）

docker compose down && docker compose up -d --build
docker compose exec -T mirror bash -c 'cd /srv && bash ops/repro.sh >/dev/null; echo repro=$?; bash ops/verify.sh | tail -2; bash ops/negative.sh | tail -2'
# repro=0 / PASS=27 FAIL=0 / RESULT: OK / NPASS=14 NFAIL=0 / RESULT: OK（闸门有牙）

# trust_upstream_digest=false：契约要求不采信上游校验和 → 6 个模块全部无法自证，全部拒收
sed 's/^MIRROR_TRUST_UPSTREAM_DIGEST=.*/MIRROR_TRUST_UPSTREAM_DIGEST=false/' conf/mirror.env > /tmp/tc/mirror.env
CONF_DIR=/tmp/tc python3 -m app.run    # {"quarantined": 6, "rejected": 6, "verified": 0}

# 布尔值非法 → 契约不合法
sed 's/^MIRROR_TRUST_UPSTREAM_DIGEST=.*/MIRROR_TRUST_UPSTREAM_DIGEST=yes/' conf/mirror.env > /tmp/tb/mirror.env
CONF_DIR=/tmp/tb python3 -m app.run ; echo rc=$?
# contract error: MIRROR_TRUST_UPSTREAM_DIGEST 不是布尔值: 'yes'   rc=3

git fetch origin && git checkout 2026-10-19-1600
cd scenario/2026-10-19-1600
docker compose up -d --build
docker compose exec -T mirror bash
# 容器内
cd /srv
bash ops/repro.sh ; echo "rc=$?"     # 问题态 rc=1（探针 BAD 11 条）
bash ops/verify.sh                   # 问题态 PASS=11 FAIL=16
bash ops/negative.sh                 # NPASS=14 NFAIL=0（负向闸门）

bash ops/repro.sh ; echo "rc=$?"     # rc=0，RESULT: OK
bash ops/verify.sh                   # PASS=27 FAIL=0
bash ops/negative.sh                 # NPASS=14 NFAIL=0

$ git rev-parse HEAD origin/main
bb541f0...  bb541f0...            # 本地与远端一致，工作区无未提交改动
$ git log -S'第136题' --oneline -- experience/README.md
f9891b3 docs(experience): 归档第136题经验文档（…）并更新索引   # 索引行由 f9891b3 引入，早于质检所指的 bb541f0
$ grep -c '第136题' experience/README.md
1
$ grep -c '2026-10-19-1600' experience/README.md
2                                 # ← 这就是下面的「建议改 2」：分支号同时命中索引行与主题，不能用来判收录

$ grep -nE '^\| \[第13[56]题\]' experience/README.md | cut -c1-40
203:| [第135题](./2026-10-19-1000-...
204:| [第136题](./2026-10-19-1600-...

$ grep -c  '^| \[?第'  experience/README.md     # BRE，? 是字面量 → 全不匹配
0
$ grep -cE '^\| (\[)?第' experience/README.md   # ERE，正确
136

$ grep -c  '2026-10-19-1600'      experience/README.md   # 2（分支号 + 主题）→ 不可用
$ grep -cE '^\| \[第136题\]'   experience/README.md   # 1 → 唯一命中

# 旧：for f in $(grep -o '](\./[^)]*)' README.md | sed ...); do ... done
# 新（输出为空 = 无失效）：
grep -o '](\./[^)]*)' README.md | sed 's/](\.\///; s/)$//' | sort -u \
  | while IFS= read -r f; do [ -f "$f" ] || echo "MISSING: $f"; done

$ grep -cE '^\| (\[)?第' README.md                                       # 136
$ grep -cE '^\| \[第136题\]' README.md                                   # 1
$ grep -oE '^\| \[第[0-9]+题' README.md | grep -o '[0-9]\+' | sort -n | tail -1   # 136
$ grep -o '](\./[^)]*)' README.md | sed 's/](\.\///; s/)$//' | sort -u \
    | while IFS= read -r f; do [ -f "$f" ] || echo "MISSING: $f"; done      # 空 = 0 条失效