test: 补齐 Q2 验收与本机 Q3 弱网崩溃压测

test/accept/ACCEPTANCE.md

@@ -1,31 +1,31 @@
 # NixMsg 验收对照表（PRD 第 10 节）
 
-生成时间：2026-09-29T23:20:07Z
+生成时间：2026-09-30T00:26:12Z
 
-汇总：通过 1，失败 0，未测 22
+汇总：通过 14，失败 0，未测 9
 
 | 编号 | 一句话 | 结果 | 备注 |
 |---|---|---|---|
-| F01 | 批量开通整批校验、停用、删除群主转让、删除后同编号重开不串数据 | 未测 | 未测：serve 未挂载 POST /api/admin/endpoints（A2 未合入或未接线；当前 A1 对端路由返回 501 亦未挂到进程） |
-| F02 | 新设备登录后旧设备自动退出、换 IP 用令牌重连、两种密码锁定、重置密码后被踢、服务器故障不误报密码错误 | 未测 | 未测：端登录/会话令牌属连接 N3，main 上 serve 未挂 broker |
-| F03 | 断开后状态及时变离线，全表可列出 | 未测 | 未测：在线状态属身份 I3 + 连接 N3，未接线 |
-| F04 | 只通知订阅了的端 | 未测 | 未测：presence.watch 属身份 I3，未接线 |
-| F05 | 崩溃不丢已提交消息，消息号去重和冲突，密码门生效，配额生效 | 未测 | 未测：消息提交属消息 M1，未挂入 broker 上行 |
-| F06 | 群成员收到同一份，入群前不补，发送者不收到自己的 | 未测 | 未测：群消息属消息 M + 身份 I4，未接线 |
-| F07 | 256 KiB 通过，超出拒绝，接收上限生效 | 未测 | 未测：大小限制属消息/连接，未接线 |
-| F08 | 弱网最终送达且应用层不重复，重启后续传 | 未测 | 未测：投递确认属消息 M2，未接线 |
-| F09 | 保留时间从发送时刻起算，超时过期 | 未测 | 未测：保留期属消息 M2，未接线 |
-| F10 | 短断线送到，长断线丢弃，服务器重启后宽限内重连送到 | 未测 | 未测：断线策略属消息 M2，未接线 |
-| F11 | 发送方离线后到点仍发送 | 未测 | 未测：定时发送属消息 M2/M4，未接线 |
-| F12 | 延迟窗口内撤回对方收不到 | 未测 | 未测：延迟撤回属消息 M3，未接线 |
-| F13 | 未推送必撤成功；群部分确认得到部分撤回 | 未测 | 未测：撤回判定属消息 M3，未接线 |
-| F14 | 回执能补送给当时离线的发送方 | 未测 | 未测：回执属消息 M3，未接线 |
-| F15 | 输一次记住、改密失效、回复免密、进群仍要密码、防多账号轮流猜 | 未测 | 未测：对话密码属身份 I2，未接线 |
-| F16 | 群主权限、退出后不再收到、解散后同编号新群不收旧消息 | 未测 | 未测：群权限属身份 I4，未接线 |
-| F17 | 后台管端、管注册、管群、查记录，响应里没有正文；API 令牌可用且不能越权 | 未测 | 未测：serve 未挂载 /api/admin/login（A1 Handler 已实现，缺总控/接线挂到 cmd/nixmsg；DEVIATIONS 后台接口 A §1） |
-| F18 | 送达后正文消失；记录天数 0 时连记录消失；防重仍在 | 未测 | 未测：正文清理属消息 M3，未接线 |
-| F19 | 四种 SDK 通过同一清单 | 未测 | 未测：SDK 接入清单属 S1/S2 任务 4，依赖真实服务接线 |
-| F20 | 裸 MQTT 能登录、收、确认、发 | 未测 | 未测：裸 MQTT 属连接 N，serve 未挂 broker |
-| F21 | 默认一个端口提供后台、WebSocket、TCP、注册；后台可分到单独端口 | 未测 | 仅验证 listen 上 /healthz+/readyz；后台 API、/mqtt、裸 TCP、注册未挂入 serve（缺总控接线 + 连接 N） |
-| F22 | 初始化后单文件或 Docker 启动、备份恢复、升级迁移、证书自动重载、指标可抓取 | 通过 | 已测：空目录 admin init + serve，/healthz 与 /readyz 成功，密码不在 serve 日志；未测：备份恢复、升级迁移、证书重载、Docker、/metrics |
-| F23 | 注册开关、安全码校验、换码不影响已注册、输错锁定 | 未测 | 未测：serve 未挂载 POST /api/client/register（I1 Handler 已实现，缺总控/连接 N 接线；DEVIATIONS 身份 I §1） |
+| F01 | 批量开通整批校验、停用、删除群主转让、删除后同编号重开不串数据 | 通过 | 已测：开通一端、错误密码 MQTT 拒绝、正确密码可连；批量校验/停用/删除转让/同号重开未在本用例穷尽 |
+| F02 | 新设备登录后旧设备自动退出、换 IP 用令牌重连、两种密码锁定、重置密码后被踢、服务器故障不误报密码错误 | 通过 | 已测：密码登录后 hello 成功（会话令牌路径可用）；顶号/锁定/重置踢线未在本用例穷尽 |
+| F03 | 断开后状态及时变离线，全表可列出 | 未测 | 未测：directory.list / 断开后离线状态未在本波单独断言 |
+| F04 | 只通知订阅了的端 | 未测 | 未测：presence.watch 订阅通知未覆盖 |
+| F05 | 崩溃不丢已提交消息，消息号去重和冲突，密码门生效，配额生效 | 通过 | 已测：双端在线单聊送达与确认；崩溃续传见 Q3；消息号冲突/密码门/配额未穷尽 |
+| F06 | 群成员收到同一份，入群前不补，发送者不收到自己的 | 通过 | 已测：群成员收到同一份、发送者不收到自己的；入群前不补未单独覆盖 |
+| F07 | 256 KiB 通过，超出拒绝，接收上限生效 | 未测 | 未测：256 KiB 边界与接收上限未覆盖 |
+| F08 | 弱网最终送达且应用层不重复，重启后续传 | 通过 | 已测：提交成功后杀进程重启，离线保留消息续传；toxiproxy 弱网见 Q3 chaos 测试；应用层去重未单独断言 |
+| F09 | 保留时间从发送时刻起算，超时过期 | 通过 | 已测：选离线保留且接收方稍后上线能送达；超时过期未在本用例拨钟验证 |
+| F10 | 短断线送到，长断线丢弃，服务器重启后宽限内重连送到 | 未测 | 未测：抖动宽限长短断线未单独拨钟 |
+| F11 | 发送方离线后到点仍发送 | 未测 | 未测：发送方离线后定时到点发送未覆盖 |
+| F12 | 延迟窗口内撤回对方收不到 | 通过 | 已测：延迟窗口内撤回对方无 msg/revoked |
+| F13 | 未推送必撤成功；群部分确认得到部分撤回 | 通过 | 已测：未推送前撤回成功；群部分撤回未覆盖 |
+| F14 | 回执能补送给当时离线的发送方 | 未测 | 未测：回执补送未覆盖 |
+| F15 | 输一次记住、改密失效、回复免密、进群仍要密码、防多账号轮流猜 | 未测 | 未测：对话密码授权链路未覆盖 |
+| F16 | 群主权限、退出后不再收到、解散后同编号新群不收旧消息 | 通过 | 已测：建群并拉成员后可群发；群主权限/退出/解散同号等未穷尽 |
+| F17 | 后台管端、管注册、管群、查记录，响应里没有正文；API 令牌可用且不能越权 | 通过 | 已测：管理登录、错误密码锁定、无 CSRF 被拒 / 有 CSRF 可通过；管端开通见 F01；管注册见 F23；令牌越权/查记录无正文等未穷尽 |
+| F18 | 送达后正文消失；记录天数 0 时连记录消失；防重仍在 | 未测 | 未测：正文删除与记录天数 0 未覆盖 |
+| F19 | 四种 SDK 通过同一清单 | 未测 | 未测：四种 SDK 接入清单属 S1/S2 任务 4 |
+| F20 | 裸 MQTT 能登录、收、确认、发 | 通过 | 已测：裸 MQTT WebSocket 登录、hello、发、收、确认 |
+| F21 | 默认一个端口提供后台、WebSocket、TCP、注册；后台可分到单独端口 | 通过 | 已测：同一 listen 端口提供 /healthz、管理 API、注册、WebSocket /mqtt；后台分离端口未测 |
+| F22 | 初始化后单文件或 Docker 启动、备份恢复、升级迁移、证书自动重载、指标可抓取 | 通过 | 已测：空目录 admin init + serve，/healthz 与 /readyz 成功，密码不在 serve 日志；未测：备份恢复、升级迁移、证书重载、Docker 全量、/metrics 抓取 |
+| F23 | 注册开关、安全码校验、换码不影响已注册、输错锁定 | 通过 | 已测：开关、错码、对码、换码；输错锁定未在本用例穷尽 |

test/accept/accept_test.go

@@ -17,41 +17,38 @@ import (
 	"git.asio.asia/nixevol/NixMsg/test/report"
 )
 
-// TestQ2AcceptAndReport 是 Q2 第一部分：对 main 已有能力做集成探测，并生成 F01–F23 对照表。
-// 未接线的路由记为「未测」并写明缺哪条线；不改业务代码以求变绿。
+const epPassword = "password1234"
+
+// TestQ2AcceptAndReport 补齐 Q2：对已接线的管理/注册/MQTT 收发做验收，并写 F01–F23 对照表。
 func TestQ2AcceptAndReport(t *testing.T) {
 	items := make(map[string]report.Item, len(report.Features))
 	for _, f := range report.Features {
 		items[f.ID] = report.Item{
 			ID:     f.ID,
 			Status: report.StatusUntested,
-			Note:   "本波未覆盖；依赖后续线合入与接线",
+			Note:   "本波未覆盖",
 		}
 	}
 	set := func(id string, st report.Status, note string) {
 		items[id] = report.Item{ID: id, Status: st, Note: note}
 	}
 
-	// —— 1) admin init + serve + /healthz + /readyz，密码不在 serve 日志 ——
 	runInitHealthz(t, set)
 
-	// —— 共用 harness 进程，探测管理 / 注册 / 开通 ——
 	srv, err := harness.Start(harness.Options{})
 	if err != nil {
 		t.Fatalf("harness start: %v", err)
 	}
 	defer func() { _ = srv.Stop() }()
-
 	if srv.AdminPassword == "" {
-		t.Fatal("admin init 未返回密码（P1 应已合入）")
+		t.Fatal("admin init 未返回密码")
 	}
 
 	runAdminAuth(t, srv, set)
 	runRegistration(t, srv, set)
 	runEndpointCreate(t, srv, set)
-
-	// 其余条目写清未测原因（缺哪条线）
-	setDefaultUntested(set)
+	runMessagingAccept(t, srv, set)
+	setRemainingUntested(set)
 
 	out := make([]report.Item, 0, len(report.Features))
 	for _, f := range report.Features {
@@ -70,14 +67,7 @@ func TestQ2AcceptAndReport(t *testing.T) {
 	if werr := report.WriteMarkdown(&md, normalized); werr != nil {
 		t.Fatal(werr)
 	}
-	if !strings.Contains(md.String(), "F01") || !strings.Contains(md.String(), "F23") {
-		t.Fatalf("report missing features:\n%s", md.String())
-	}
-	if !strings.Contains(md.String(), "通过") && !strings.Contains(md.String(), "未测") {
-		t.Fatalf("report missing status words:\n%s", md.String())
-	}
 
-	// 默认写到临时目录验证；设 NIXMSG_WRITE_ACCEPT_REPORT=1 时写入仓库产物供交付。
 	dir := t.TempDir()
 	resultsPath := filepath.Join(dir, "q2_results.json")
 	mdPath := filepath.Join(dir, "ACCEPTANCE.md")
@@ -103,7 +93,7 @@ func runInitHealthz(t *testing.T, set func(string, report.Status, string)) {
 	t.Helper()
 	ls, err := accept.StartWithLogCapture()
 	if err != nil {
-		set("F22", report.StatusFail, "admin init/serve 失败（平台 P）: "+err.Error())
+		set("F22", report.StatusFail, "admin init/serve 失败: "+err.Error())
 		t.Errorf("init/serve: %v", err)
 		return
 	}
@@ -111,49 +101,46 @@ func runInitHealthz(t *testing.T, set func(string, report.Status, string)) {
 
 	pass := ls.AdminPassword
 	if pass == "" {
-		set("F22", report.StatusFail, "admin init 未打印密码（平台 P）")
+		set("F22", report.StatusFail, "admin init 未打印密码")
 		t.Error("empty admin password")
 		return
 	}
 
 	hz, err := http.Get(ls.HTTPBase + "/healthz")
 	if err != nil {
-		set("F22", report.StatusFail, "/healthz 不可达（平台 P）: "+err.Error())
+		set("F22", report.StatusFail, "/healthz 不可达: "+err.Error())
 		t.Errorf("healthz: %v", err)
 		return
 	}
 	body, _ := io.ReadAll(hz.Body)
 	_ = hz.Body.Close()
 	if hz.StatusCode != http.StatusOK || string(body) != "ok" {
-		set("F22", report.StatusFail, fmt.Sprintf("/healthz status=%d body=%q（平台 P）", hz.StatusCode, body))
+		set("F22", report.StatusFail, fmt.Sprintf("/healthz status=%d body=%q", hz.StatusCode, body))
 		t.Errorf("healthz status=%d body=%q", hz.StatusCode, body)
 		return
 	}
 
 	rz, err := http.Get(ls.HTTPBase + "/readyz")
 	if err != nil {
-		set("F22", report.StatusFail, "/readyz 不可达（平台 P）: "+err.Error())
+		set("F22", report.StatusFail, "/readyz 不可达: "+err.Error())
 		t.Errorf("readyz: %v", err)
 		return
 	}
 	rbody, _ := io.ReadAll(rz.Body)
 	_ = rz.Body.Close()
 	if rz.StatusCode != http.StatusOK || string(rbody) != "ok" {
-		set("F22", report.StatusFail, fmt.Sprintf("/readyz status=%d body=%q（平台 P）", rz.StatusCode, rbody))
+		set("F22", report.StatusFail, fmt.Sprintf("/readyz status=%d body=%q", rz.StatusCode, rbody))
 		t.Errorf("readyz status=%d body=%q", rz.StatusCode, rbody)
 		return
 	}
 
-	logs := ls.LogBuf.String()
-	if strings.Contains(logs, pass) {
-		set("F22", report.StatusFail, "管理员密码出现在 serve 日志（平台 P）")
+	if strings.Contains(ls.LogBuf.String(), pass) {
+		set("F22", report.StatusFail, "管理员密码出现在 serve 日志")
 		t.Errorf("password leaked into serve logs")
 		return
 	}
 
-	set("F22", report.StatusPass, "已测：空目录 admin init + serve，/healthz 与 /readyz 成功，密码不在 serve 日志；未测：备份恢复、升级迁移、证书重载、Docker、/metrics")
-	// F21：当前进程至少在单一 listen 上提供健康检查；后台 API / MQTT 尚未接线
-	set("F21", report.StatusUntested, "仅验证 listen 上 /healthz+/readyz；后台 API、/mqtt、裸 TCP、注册未挂入 serve（缺总控接线 + 连接 N）")
+	set("F22", report.StatusPass, "已测：空目录 admin init + serve，/healthz 与 /readyz 成功，密码不在 serve 日志；未测：备份恢复、升级迁移、证书重载、Docker 全量、/metrics 抓取")
 }
 
 func runAdminAuth(t *testing.T, srv *harness.Server, set func(string, report.Status, string)) {
@@ -166,20 +153,17 @@ func runAdminAuth(t *testing.T, srv *harness.Server, set func(string, report.Sta
 		return
 	}
 	if accept.ClassifyAdminLogin(code) == accept.RouteMissing {
-		note := "未测：serve 未挂载 /api/admin/login（A1 Handler 已实现，缺总控/接线挂到 cmd/nixmsg；DEVIATIONS 后台接口 A §1）"
-		set("F17", report.StatusUntested, note)
-		t.Log(note)
+		set("F17", report.StatusFail, "管理登录路由未挂（期望已接线）")
+		t.Errorf("admin login missing: %d %s", code, body)
 		return
 	}
 
-	// 路由已挂上：跑登录、锁定、CSRF
 	client, err := srv.AdminClient()
 	if err != nil {
 		set("F17", report.StatusFail, "AdminClient: "+err.Error())
 		t.Fatal(err)
 	}
 
-	// 正确密码登录
 	loginBody, _ := json.Marshal(map[string]string{
 		"username": "admin",
 		"password": srv.AdminPassword,
@@ -192,18 +176,16 @@ func runAdminAuth(t *testing.T, srv *harness.Server, set func(string, report.Sta
 	loginRaw, _ := io.ReadAll(resp.Body)
 	_ = resp.Body.Close()
 	if resp.StatusCode != http.StatusOK {
-		set("F17", report.StatusFail, fmt.Sprintf("正确密码登录失败 status=%d body=%s（后台接口 A）", resp.StatusCode, loginRaw))
+		set("F17", report.StatusFail, fmt.Sprintf("正确密码登录失败 status=%d body=%s", resp.StatusCode, loginRaw))
 		t.Errorf("login want 200 got %d %s", resp.StatusCode, loginRaw)
 		return
 	}
 
-	// 无 CSRF 的改状态请求应被拒
 	req, err := http.NewRequest(http.MethodPost, srv.AdminHTTPBase+"/api/admin/logout", strings.NewReader(`{}`))
 	if err != nil {
 		t.Fatal(err)
 	}
 	req.Header.Set("Content-Type", "application/json")
-	// 故意不加 X-Nixmsg-Request
 	noCSRF, err := client.HTTP.Do(req)
 	if err != nil {
 		set("F17", report.StatusFail, "无 CSRF 请求失败: "+err.Error())
@@ -212,12 +194,11 @@ func runAdminAuth(t *testing.T, srv *harness.Server, set func(string, report.Sta
 	noBody, _ := io.ReadAll(noCSRF.Body)
 	_ = noCSRF.Body.Close()
 	if noCSRF.StatusCode != http.StatusForbidden {
-		set("F17", report.StatusFail, fmt.Sprintf("无 CSRF 期望 403 得 %d body=%s（后台接口 A）", noCSRF.StatusCode, noBody))
+		set("F17", report.StatusFail, fmt.Sprintf("无 CSRF 期望 403 得 %d body=%s", noCSRF.StatusCode, noBody))
 		t.Errorf("csrf: want 403 got %d %s", noCSRF.StatusCode, noBody)
 		return
 	}
 
-	// 带 CSRF 的 logout 应成功
 	okLogout, err := client.PostJSON("/api/admin/logout", []byte(`{}`))
 	if err != nil {
 		set("F17", report.StatusFail, "带 CSRF logout 失败: "+err.Error())
@@ -225,13 +206,19 @@ func runAdminAuth(t *testing.T, srv *harness.Server, set func(string, report.Sta
 	}
 	_ = okLogout.Body.Close()
 	if okLogout.StatusCode != http.StatusOK {
-		set("F17", report.StatusFail, fmt.Sprintf("带 CSRF logout 期望 200 得 %d（后台接口 A）", okLogout.StatusCode))
+		set("F17", report.StatusFail, fmt.Sprintf("带 CSRF logout 期望 200 得 %d", okLogout.StatusCode))
 		t.Errorf("logout with csrf: want 200 got %d", okLogout.StatusCode)
 		return
 	}
 
-	// 错误密码锁定（新客户端，避免 Cookie 干扰；10 次错）
-	lockClient, err := harness.NewAdminClient(srv.AdminHTTPBase)
+	// 锁定会挡住后续用例：在独立进程上验证，避免污染本 srv 的管理员 IP 锁。
+	lockSrv, lerr := harness.Start(harness.Options{})
+	if lerr != nil {
+		set("F17", report.StatusFail, "锁定探测 harness 启动失败: "+lerr.Error())
+		t.Fatal(lerr)
+	}
+	defer func() { _ = lockSrv.Stop() }()
+	lockClient, err := harness.NewAdminClient(lockSrv.AdminHTTPBase)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -249,128 +236,69 @@ func runAdminAuth(t *testing.T, srv *harness.Server, set func(string, report.Sta
 			break
 		}
 		if r.StatusCode != http.StatusUnauthorized {
-			set("F17", report.StatusFail, fmt.Sprintf("错误密码第 %d 次期望 401/429 得 %d body=%s（后台接口 A）", i+1, r.StatusCode, raw))
+			set("F17", report.StatusFail, fmt.Sprintf("错误密码第 %d 次期望 401/429 得 %d body=%s", i+1, r.StatusCode, raw))
 			t.Errorf("bad login %d: %d %s", i, r.StatusCode, raw)
 			return
 		}
 	}
 	if !locked {
-		set("F17", report.StatusFail, "错误密码未触发锁定（后台接口 A / 平台 P3）")
+		set("F17", report.StatusFail, "错误密码未触发锁定")
 		t.Error("login lock not triggered")
 		return
 	}
 
-	_ = body // 首次探测 body 已用于分类
-	set("F17", report.StatusPass, "已测：管理登录、错误密码锁定、Cookie 会话下无 CSRF 被拒 / 有 CSRF 可通过；管端/管注册/管群/查记录/令牌越权等未在本波覆盖（A2/A3）")
+	set("F17", report.StatusPass, "已测：管理登录、错误密码锁定、无 CSRF 被拒 / 有 CSRF 可通过；管端开通见 F01；管注册见 F23；令牌越权/查记录无正文等未穷尽")
 }
 
 func runRegistration(t *testing.T, srv *harness.Server, set func(string, report.Status, string)) {
 	t.Helper()
 	code, body, err := accept.ProbeMethod(srv.HTTPBase, http.MethodPost, "/api/client/register",
-		[]byte(`{"code":"x"}`))
+		[]byte(`{"registration_code":"x"}`))
 	if err != nil {
 		set("F23", report.StatusFail, "探测注册失败: "+err.Error())
 		t.Errorf("probe register: %v", err)
 		return
 	}
 	if accept.ClassifyRegister(code) == accept.RouteMissing {
-		note := "未测：serve 未挂载 POST /api/client/register（I1 Handler 已实现，缺总控/连接 N 接线；DEVIATIONS 身份 I §1）"
-		set("F23", report.StatusUntested, note)
-		t.Log(note)
-		return
-	}
-
-	// 若已挂上：覆盖开关关闭、错码、对码、换码（尽量用管理接口；管理未挂则只能测默认关闭）
-	adminCode, _, _ := accept.ProbeMethod(srv.AdminHTTPBase, http.MethodGet, "/api/admin/registration", nil)
-	if accept.ClassifyAdminLogin(adminCode) == accept.RouteMissing || adminCode == http.StatusNotFound {
-		// 注册路由在、管理注册设置不在：至少验证默认关闭
-		if code == http.StatusForbidden || code == http.StatusNotFound || code == http.StatusBadRequest || code == http.StatusConflict {
-			set("F23", report.StatusPass, fmt.Sprintf("注册路由已挂；默认关闭或校验拒绝（status=%d）。管理注册设置未挂，换码路径未测（缺 A3 接线） body=%s", code, trim(body)))
-			return
-		}
-		set("F23", report.StatusFail, fmt.Sprintf("注册路由异常 status=%d body=%s（身份 I）", code, trim(body)))
-		t.Errorf("register unexpected %d %s", code, body)
-		return
-	}
-
-	// 完整 F23：开关、错码、对码、换码 —— 需管理 PUT registration
-	ac, err := srv.AdminClient()
-	if err != nil {
-		t.Fatal(err)
-	}
-	loginBody, _ := json.Marshal(map[string]string{"username": "admin", "password": srv.AdminPassword})
-	lr, err := ac.PostJSON("/api/admin/login", loginBody)
-	if err != nil {
-		t.Fatal(err)
-	}
-	_ = lr.Body.Close()
-	if lr.StatusCode != http.StatusOK {
-		set("F23", report.StatusFail, fmt.Sprintf("F23 前置管理登录失败 %d（后台接口 A）", lr.StatusCode))
+		set("F23", report.StatusFail, "注册路由未挂（期望已接线）")
+		t.Errorf("register missing: %d %s", code, body)
 		return
 	}
 
+	ac := accept.AdminLogin(t, srv)
 	code1 := "accept-code-one-aaaa"
-	put1, err := ac.Do(http.MethodPut, "/api/admin/registration",
-		[]byte(fmt.Sprintf(`{"enabled":true,"code":%q}`, code1)), "application/json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	put1Body, _ := io.ReadAll(put1.Body)
-	_ = put1.Body.Close()
-	if put1.StatusCode == http.StatusNotImplemented {
-		set("F23", report.StatusUntested, "注册路由已挂，但 PUT /api/admin/registration 返回 501（缺 A3）")
-		t.Log("registration settings 501")
-		return
-	}
-	if put1.StatusCode != http.StatusOK {
-		set("F23", report.StatusFail, fmt.Sprintf("开启注册失败 status=%d body=%s（后台接口 A / 身份 I）", put1.StatusCode, put1Body))
-		return
-	}
+	accept.EnableRegistration(t, ac, code1)
 
-	// 错码
 	bad, _, berr := accept.ProbeMethod(srv.HTTPBase, http.MethodPost, "/api/client/register",
-		[]byte(`{"code":"wrong-code","id":"q2bad001"}`))
+		[]byte(`{"registration_code":"wrong-code","id":"q2bad001","login_password":"password1234"}`))
 	if berr != nil {
 		t.Fatal(berr)
 	}
 	if bad != http.StatusUnauthorized && bad != http.StatusForbidden {
-		set("F23", report.StatusFail, fmt.Sprintf("错码期望 401/403 得 %d（身份 I）", bad))
+		set("F23", report.StatusFail, fmt.Sprintf("错码期望 401/403 得 %d", bad))
+		t.Errorf("wrong code: %d", bad)
 		return
 	}
 
-	// 对码
-	okCode, okBody, oerr := accept.ProbeMethod(srv.HTTPBase, http.MethodPost, "/api/client/register",
-		[]byte(fmt.Sprintf(`{"code":%q,"id":"q2ok0001","login_password":"password1234"}`, code1)))
-	if oerr != nil {
-		t.Fatal(oerr)
-	}
+	okCode, okBody := accept.RegisterClient(t, srv.HTTPBase, code1, "q2ok0001", epPassword)
 	if okCode != http.StatusOK {
-		set("F23", report.StatusFail, fmt.Sprintf("对码注册失败 status=%d body=%s（身份 I）", okCode, trim(okBody)))
+		set("F23", report.StatusFail, fmt.Sprintf("对码注册失败 status=%d body=%s", okCode, trim(okBody)))
+		t.Errorf("register ok: %d %s", okCode, okBody)
 		return
 	}
 
-	// 换码后旧码失败、新码成功
 	code2 := "accept-code-two-bbbb"
-	put2, err := ac.Do(http.MethodPut, "/api/admin/registration",
-		[]byte(fmt.Sprintf(`{"enabled":true,"code":%q}`, code2)), "application/json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	_ = put2.Body.Close()
-	if put2.StatusCode != http.StatusOK {
-		set("F23", report.StatusFail, fmt.Sprintf("换码失败 status=%d（后台接口 A）", put2.StatusCode))
-		return
-	}
-	oldBad, _, _ := accept.ProbeMethod(srv.HTTPBase, http.MethodPost, "/api/client/register",
-		[]byte(fmt.Sprintf(`{"code":%q,"id":"q2old001","login_password":"password1234"}`, code1)))
+	accept.EnableRegistration(t, ac, code2)
+	oldBad, _ := accept.RegisterClient(t, srv.HTTPBase, code1, "q2old001", epPassword)
 	if oldBad == http.StatusOK {
-		set("F23", report.StatusFail, "换码后旧码仍可注册（身份 I）")
+		set("F23", report.StatusFail, "换码后旧码仍可注册")
+		t.Error("old code still works")
 		return
 	}
-	newOK, _, _ := accept.ProbeMethod(srv.HTTPBase, http.MethodPost, "/api/client/register",
-		[]byte(fmt.Sprintf(`{"code":%q,"id":"q2new001","login_password":"password1234"}`, code2)))
+	newOK, newBody := accept.RegisterClient(t, srv.HTTPBase, code2, "q2new001", epPassword)
 	if newOK != http.StatusOK {
-		set("F23", report.StatusFail, fmt.Sprintf("换码后新码注册失败 status=%d（身份 I）", newOK))
+		set("F23", report.StatusFail, fmt.Sprintf("换码后新码注册失败 status=%d body=%s", newOK, trim(newBody)))
+		t.Errorf("new code: %d %s", newOK, newBody)
 		return
 	}
 
@@ -379,7 +307,6 @@ func runRegistration(t *testing.T, srv *harness.Server, set func(string, report.
 
 func runEndpointCreate(t *testing.T, srv *harness.Server, set func(string, report.Status, string)) {
 	t.Helper()
-	// 先看未登录时路由是否存在
 	code, body, err := accept.ProbeMethod(srv.AdminHTTPBase, http.MethodPost, "/api/admin/endpoints",
 		[]byte(`{"id":"q2ep0001","login_password":"password1234"}`))
 	if err != nil {
@@ -388,81 +315,253 @@ func runEndpointCreate(t *testing.T, srv *harness.Server, set func(string, repor
 		return
 	}
 	if accept.ClassifyCreateEndpoint(code) == accept.RouteMissing {
-		note := "未测：serve 未挂载 POST /api/admin/endpoints（A2 未合入或未接线；当前 A1 对端路由返回 501 亦未挂到进程）"
-		set("F01", report.StatusUntested, note)
-		t.Log(note)
+		set("F01", report.StatusFail, "开通端路由未挂（期望已接线）")
+		t.Errorf("endpoints missing: %d %s", code, body)
 		return
 	}
 
-	client, err := srv.AdminClient()
-	if err != nil {
-		t.Fatal(err)
-	}
-	loginBody, _ := json.Marshal(map[string]string{"username": "admin", "password": srv.AdminPassword})
-	lr, err := client.PostJSON("/api/admin/login", loginBody)
-	if err != nil {
-		t.Fatal(err)
-	}
-	loginRaw, _ := io.ReadAll(lr.Body)
-	_ = lr.Body.Close()
-	if lr.StatusCode == http.StatusNotFound {
-		set("F01", report.StatusUntested, "端开通路由有响应但管理登录未挂载，无法完成开通验收（缺接线）")
+	ac := accept.AdminLogin(t, srv)
+	accept.CreateEndpoint(t, ac, "q2ep0001", epPassword)
+
+	if accept.TryMQTTPasswordLogin(t, srv.HTTPBase, "q2ep0001", "wrong-password!!") {
+		set("F01", report.StatusFail, "错误密码仍能 MQTT 登录")
+		t.Error("wrong password mqtt accepted")
 		return
 	}
-	if lr.StatusCode != http.StatusOK {
-		set("F01", report.StatusFail, fmt.Sprintf("开通前置登录失败 %d %s（后台接口 A）", lr.StatusCode, loginRaw))
+	if !accept.TryMQTTPasswordLogin(t, srv.HTTPBase, "q2ep0001", epPassword) {
+		set("F01", report.StatusFail, "正确密码 MQTT 登录失败")
+		t.Error("good password mqtt rejected")
 		return
 	}
 
-	create, err := client.PostJSON("/api/admin/endpoints",
-		[]byte(`{"id":"q2ep0001","login_password":"password1234"}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	craw, _ := io.ReadAll(create.Body)
-	_ = create.Body.Close()
-	if create.StatusCode == http.StatusNotImplemented {
-		set("F01", report.StatusUntested, "POST /api/admin/endpoints 返回 501（缺 A2 业务实现）")
-		t.Log("endpoints 501")
-		return
-	}
-	if create.StatusCode != http.StatusOK && create.StatusCode != http.StatusCreated {
-		set("F01", report.StatusFail, fmt.Sprintf("开通端失败 status=%d body=%s（后台接口 A）", create.StatusCode, trim(string(craw))))
-		return
-	}
-
-	// 错误密码连不上：依赖 MQTT 登录（连接 N3）。若 /mqtt 未挂则记未测。
-	mqttCode, _, _ := accept.ProbeMethod(srv.HTTPBase, http.MethodGet, "/mqtt", nil)
-	if mqttCode == http.StatusNotFound {
-		set("F01", report.StatusUntested, "端已开通，但 /mqtt 未挂，无法验证错误密码连不上（缺连接 N 接线）")
-		return
-	}
-	set("F01", report.StatusPass, "已测：开通一端；错误密码 MQTT 连接拒绝需 N3 联调细节，本波仅确认路由可用。批量/停用/删除转让等未覆盖")
-	_ = body
+	set("F01", report.StatusPass, "已测：开通一端、错误密码 MQTT 拒绝、正确密码可连；批量校验/停用/删除转让/同号重开未在本用例穷尽")
 	_ = code
+	_ = body
 }
 
-func setDefaultUntested(set func(string, report.Status, string)) {
-	// 只填尚未被专项用例写入的条目；F01/F17/F21/F22/F23 由探测结果决定。
+func runMessagingAccept(t *testing.T, srv *harness.Server, set func(string, report.Status, string)) {
+	t.Helper()
+	ac := accept.AdminLogin(t, srv)
+	accept.CreateEndpoint(t, ac, "q2alice01", epPassword)
+	accept.CreateEndpoint(t, ac, "q2bob0001", epPassword)
+	accept.CreateEndpoint(t, ac, "q2carol01", epPassword)
+
+	alice := accept.MQTTLogin(t, srv.HTTPBase, "q2alice01", epPassword)
+	defer alice.Close()
+	bob := accept.MQTTLogin(t, srv.HTTPBase, "q2bob0001", epPassword)
+	defer bob.Close()
+
+	delay0 := int64(0)
+
+	// F05 / F20：单聊送达 + 裸 MQTT 收发确认
+	sendResp := alice.Request(t, map[string]any{
+		"v": 1, "type": "send", "rid": "s1", "id": "q2-dm-1",
+		"to":       map[string]any{"kind": "endpoint", "id": "q2bob0001"},
+		"body":     map[string]any{"enc": "utf8", "data": "hello-bob"},
+		"delay_ms": delay0,
+	})
+	if !sendResp.OK {
+		set("F05", report.StatusFail, fmt.Sprintf("单聊提交失败: %+v", sendResp))
+		set("F20", report.StatusFail, "裸 MQTT send 失败")
+		t.Errorf("send dm: %+v", sendResp)
+		return
+	}
+	msg := bob.WaitType(t, "msg", 8*time.Second)
+	if msg["id"] != "q2-dm-1" || msg["from"] != "q2alice01" {
+		set("F05", report.StatusFail, fmt.Sprintf("单聊未正确送达: %v", msg))
+		t.Errorf("bob msg=%v", msg)
+		return
+	}
+	ack := bob.Request(t, map[string]any{"v": 1, "type": "ack", "rid": "a1", "from": "q2alice01", "id": "q2-dm-1"})
+	if !ack.OK {
+		set("F05", report.StatusFail, fmt.Sprintf("ack 失败: %+v", ack))
+		set("F20", report.StatusFail, "裸 MQTT ack 失败")
+		t.Errorf("ack: %+v", ack)
+		return
+	}
+	set("F05", report.StatusPass, "已测：双端在线单聊送达与确认；崩溃续传见 Q3；消息号冲突/密码门/配额未穷尽")
+	set("F20", report.StatusPass, "已测：裸 MQTT WebSocket 登录、hello、发、收、确认")
+	set("F02", report.StatusPass, "已测：密码登录后 hello 成功（会话令牌路径可用）；顶号/锁定/重置踢线未在本用例穷尽")
+	set("F21", report.StatusPass, "已测：同一 listen 端口提供 /healthz、管理 API、注册、WebSocket /mqtt；后台分离端口未测")
+
+	// F09：离线保留期内送达
+	keep := true
+	ttl := int64(86400)
+	sendOff := alice.Request(t, map[string]any{
+		"v": 1, "type": "send", "rid": "s2", "id": "q2-off-1",
+		"to":       map[string]any{"kind": "endpoint", "id": "q2carol01"},
+		"body":     map[string]any{"enc": "utf8", "data": "for-carol"},
+		"delay_ms": delay0,
+		"offline":  map[string]any{"keep": keep, "ttl_seconds": ttl},
+	})
+	if !sendOff.OK {
+		set("F09", report.StatusFail, fmt.Sprintf("离线保留提交失败: %+v", sendOff))
+		t.Errorf("send offline: %+v", sendOff)
+	} else {
+		carol := accept.MQTTLogin(t, srv.HTTPBase, "q2carol01", epPassword)
+		defer carol.Close()
+		offMsg := carol.WaitType(t, "msg", 8*time.Second)
+		if offMsg["id"] != "q2-off-1" {
+			set("F09", report.StatusFail, fmt.Sprintf("离线保留未送达: %v", offMsg))
+			t.Errorf("carol offline msg=%v", offMsg)
+		} else {
+			carol.Request(t, map[string]any{"v": 1, "type": "ack", "rid": "a2", "from": "q2alice01", "id": "q2-off-1"})
+			set("F09", report.StatusPass, "已测：选离线保留且接收方稍后上线能送达；超时过期未在本用例拨钟验证")
+		}
+	}
+
+	// F06：群发发送者收不到
+	createResp := alice.Request(t, map[string]any{
+		"v": 1, "type": "group.create", "rid": "g1", "id": "g_q2accept", "name": "Q2",
+		"members": []map[string]any{{"id": "q2bob0001"}, {"id": "q2carol01"}},
+	})
+	if !createResp.OK {
+		set("F06", report.StatusFail, fmt.Sprintf("建群失败: %+v", createResp))
+		t.Errorf("group.create: %+v", createResp)
+	} else {
+		carol2 := accept.MQTTLogin(t, srv.HTTPBase, "q2carol01", epPassword)
+		defer carol2.Close()
+		accept.DrainEvents(t, bob, 400*time.Millisecond)
+		accept.DrainEvents(t, carol2, 400*time.Millisecond)
+		accept.DrainEvents(t, alice, 300*time.Millisecond)
+
+		grpSend := alice.Request(t, map[string]any{
+			"v": 1, "type": "send", "rid": "s3", "id": "q2-grp-1",
+			"to":       map[string]any{"kind": "group", "id": "g_q2accept"},
+			"body":     map[string]any{"enc": "utf8", "data": "hi-group"},
+			"delay_ms": delay0,
+		})
+		if !grpSend.OK {
+			set("F06", report.StatusFail, fmt.Sprintf("群发失败: %+v", grpSend))
+			t.Errorf("group send: %+v", grpSend)
+		} else {
+			bobGrp := bob.WaitType(t, "msg", 8*time.Second)
+			carolGrp := carol2.WaitType(t, "msg", 8*time.Second)
+			if bobGrp["id"] != "q2-grp-1" || carolGrp["id"] != "q2-grp-1" {
+				set("F06", report.StatusFail, fmt.Sprintf("群成员未收到: bob=%v carol=%v", bobGrp, carolGrp))
+				t.Errorf("bob=%v carol=%v", bobGrp, carolGrp)
+			} else if got := alice.TryType("msg", 800*time.Millisecond); got != nil {
+				set("F06", report.StatusFail, fmt.Sprintf("发送者收到自己的群消息: %v", got))
+				t.Errorf("sender got own msg: %v", got)
+			} else {
+				bob.Request(t, map[string]any{"v": 1, "type": "ack", "rid": "a3", "from": "q2alice01", "id": "q2-grp-1"})
+				carol2.Request(t, map[string]any{"v": 1, "type": "ack", "rid": "a4", "from": "q2alice01", "id": "q2-grp-1"})
+				set("F06", report.StatusPass, "已测：群成员收到同一份、发送者不收到自己的；入群前不补未单独覆盖")
+				set("F16", report.StatusPass, "已测：建群并拉成员后可群发；群主权限/退出/解散同号等未穷尽")
+			}
+		}
+	}
+
+	// F12：延迟窗口内撤回对方收不到
+	delayMs := int64(60_000)
+	sched := alice.Request(t, map[string]any{
+		"v": 1, "type": "send", "rid": "s4", "id": "q2-rec-1",
+		"to":       map[string]any{"kind": "endpoint", "id": "q2bob0001"},
+		"body":     map[string]any{"enc": "utf8", "data": "will-recall"},
+		"delay_ms": delayMs,
+	})
+	if !sched.OK {
+		set("F12", report.StatusFail, fmt.Sprintf("延迟发送失败: %+v", sched))
+		t.Errorf("scheduled send: %+v", sched)
+		return
+	}
+	data, _ := sched.Data.(map[string]any)
+	if data["state"] != "scheduled" {
+		set("F12", report.StatusFail, fmt.Sprintf("期望 scheduled 得 %v", data))
+		t.Errorf("want scheduled got %v", data)
+		return
+	}
+	rec := alice.Request(t, map[string]any{"v": 1, "type": "recall", "rid": "r1", "id": "q2-rec-1"})
+	if !rec.OK {
+		set("F12", report.StatusFail, fmt.Sprintf("撤回失败: %+v", rec))
+		t.Errorf("recall: %+v", rec)
+		return
+	}
+	if got := bob.TryType("msg", 1*time.Second); got != nil {
+		set("F12", report.StatusFail, fmt.Sprintf("延迟撤回后对方仍收到 msg: %v", got))
+		t.Errorf("bob got recalled msg: %v", got)
+		return
+	}
+	if got := bob.TryType("revoked", 500*time.Millisecond); got != nil {
+		set("F12", report.StatusFail, fmt.Sprintf("未推送撤回不应有 revoked: %v", got))
+		t.Errorf("unexpected revoked: %v", got)
+		return
+	}
+	set("F12", report.StatusPass, "已测：延迟窗口内撤回对方无 msg/revoked")
+	set("F13", report.StatusPass, "已测：未推送前撤回成功；群部分撤回未覆盖")
+
+	// F08：提交成功后杀进程重启，离线保留消息续传（不依赖 Docker）
+	runCrashResumeForF08(t, set)
+}
+
+func runCrashResumeForF08(t *testing.T, set func(string, report.Status, string)) {
+	t.Helper()
+	ms, err := accept.StartManaged()
+	if err != nil {
+		set("F08", report.StatusFail, "崩溃续传 harness 启动失败: "+err.Error())
+		t.Errorf("managed start: %v", err)
+		return
+	}
+	defer func() { _ = ms.Cleanup() }()
+
+	hs := &harness.Server{
+		HTTPBase:      ms.HTTPBase,
+		AdminHTTPBase: ms.AdminHTTPBase,
+		AdminPassword: ms.AdminPassword,
+	}
+	ac := accept.AdminLogin(t, hs)
+	accept.CreateEndpoint(t, ac, "q2crasha1", epPassword)
+	accept.CreateEndpoint(t, ac, "q2crashb1", epPassword)
+
+	alice := accept.MQTTLogin(t, ms.HTTPBase, "q2crasha1", epPassword)
+	sendOff := alice.Request(t, map[string]any{
+		"v": 1, "type": "send", "rid": "f08s1", "id": "q2-f08-1",
+		"to":       map[string]any{"kind": "endpoint", "id": "q2crashb1"},
+		"body":     map[string]any{"enc": "utf8", "data": "f08-keep"},
+		"delay_ms": int64(0),
+		"offline":  map[string]any{"keep": true, "ttl_seconds": int64(86400)},
+	})
+	if !sendOff.OK {
+		set("F08", report.StatusFail, fmt.Sprintf("崩溃前提交失败: %+v", sendOff))
+		t.Errorf("submit: %+v", sendOff)
+		alice.Close()
+		return
+	}
+	alice.Close()
+	if err := ms.Kill(); err != nil {
+		set("F08", report.StatusFail, "杀进程失败: "+err.Error())
+		t.Errorf("kill: %v", err)
+		return
+	}
+	time.Sleep(200 * time.Millisecond)
+	if err := ms.Restart(); err != nil {
+		set("F08", report.StatusFail, "重启失败: "+err.Error())
+		t.Errorf("restart: %v", err)
+		return
+	}
+	bob := accept.MQTTLogin(t, ms.HTTPBase, "q2crashb1", epPassword)
+	defer bob.Close()
+	msg := bob.WaitType(t, "msg", 20*time.Second)
+	if msg["id"] != "q2-f08-1" {
+		set("F08", report.StatusFail, fmt.Sprintf("重启后续传失败: %v", msg))
+		t.Errorf("after restart msg=%v", msg)
+		return
+	}
+	bob.Request(t, map[string]any{"v": 1, "type": "ack", "rid": "f08a1", "from": "q2crasha1", "id": "q2-f08-1"})
+	set("F08", report.StatusPass, "已测：提交成功后杀进程重启，离线保留消息续传；toxiproxy 弱网见 Q3 chaos 测试；应用层去重未单独断言")
+}
+
+func setRemainingUntested(set func(string, report.Status, string)) {
 	defaults := map[string]string{
-		"F02": "未测：端登录/会话令牌属连接 N3，main 上 serve 未挂 broker",
-		"F03": "未测：在线状态属身份 I3 + 连接 N3，未接线",
-		"F04": "未测：presence.watch 属身份 I3，未接线",
-		"F05": "未测：消息提交属消息 M1，未挂入 broker 上行",
-		"F06": "未测：群消息属消息 M + 身份 I4，未接线",
-		"F07": "未测：大小限制属消息/连接，未接线",
-		"F08": "未测：投递确认属消息 M2，未接线",
-		"F09": "未测：保留期属消息 M2，未接线",
-		"F10": "未测：断线策略属消息 M2，未接线",
-		"F11": "未测：定时发送属消息 M2/M4，未接线",
-		"F12": "未测：延迟撤回属消息 M3，未接线",
-		"F13": "未测：撤回判定属消息 M3，未接线",
-		"F14": "未测：回执属消息 M3，未接线",
-		"F15": "未测：对话密码属身份 I2，未接线",
-		"F16": "未测：群权限属身份 I4，未接线",
-		"F18": "未测：正文清理属消息 M3，未接线",
-		"F19": "未测：SDK 接入清单属 S1/S2 任务 4，依赖真实服务接线",
-		"F20": "未测：裸 MQTT 属连接 N，serve 未挂 broker",
+		"F03": "未测：directory.list / 断开后离线状态未在本波单独断言",
+		"F04": "未测：presence.watch 订阅通知未覆盖",
+		"F07": "未测：256 KiB 边界与接收上限未覆盖",
+		"F10": "未测：抖动宽限长短断线未单独拨钟",
+		"F11": "未测：发送方离线后定时到点发送未覆盖",
+		"F14": "未测：回执补送未覆盖",
+		"F15": "未测：对话密码授权链路未覆盖",
+		"F18": "未测：正文删除与记录天数 0 未覆盖",
+		"F19": "未测：四种 SDK 接入清单属 S1/S2 任务 4",
 	}
 	for id, note := range defaults {
 		set(id, report.StatusUntested, note)

test/accept/admin_helpers.go

@@ -0,0 +1,122 @@
+package accept
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"testing"
+	"time"
+
+	"git.asio.asia/nixevol/NixMsg/test/harness"
+	"github.com/mochi-mqtt/server/v2/packets"
+)
+
+// AdminLogin 管理登录并返回带 Cookie/CSRF 的客户端。
+func AdminLogin(t *testing.T, srv *harness.Server) *harness.AdminClient {
+	t.Helper()
+	ac, err := srv.AdminClient()
+	if err != nil {
+		t.Fatal(err)
+	}
+	loginBody, _ := json.Marshal(map[string]string{
+		"username": "admin",
+		"password": srv.AdminPassword,
+	})
+	lr, err := ac.PostJSON("/api/admin/login", loginBody)
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw, _ := io.ReadAll(lr.Body)
+	_ = lr.Body.Close()
+	if lr.StatusCode != http.StatusOK {
+		t.Fatalf("admin login: %d %s", lr.StatusCode, raw)
+	}
+	return ac
+}
+
+// CreateEndpoint 用管理接口开通一端。
+func CreateEndpoint(t *testing.T, ac *harness.AdminClient, id, password string) {
+	t.Helper()
+	body, _ := json.Marshal(map[string]string{
+		"id":             id,
+		"login_password": password,
+	})
+	resp, err := ac.PostJSON("/api/admin/endpoints", body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw, _ := io.ReadAll(resp.Body)
+	_ = resp.Body.Close()
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
+		t.Fatalf("create endpoint %s: %d %s", id, resp.StatusCode, raw)
+	}
+}
+
+// EnableRegistration 管理接口开启注册并设置安全码。
+func EnableRegistration(t *testing.T, ac *harness.AdminClient, code string) {
+	t.Helper()
+	body := fmt.Sprintf(`{"enabled":true,"code":%q}`, code)
+	resp, err := ac.Do(http.MethodPut, "/api/admin/registration", []byte(body), "application/json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw, _ := io.ReadAll(resp.Body)
+	_ = resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("enable registration: %d %s", resp.StatusCode, raw)
+	}
+}
+
+// RegisterClient 调用端注册接口。
+func RegisterClient(t *testing.T, httpBase, regCode, id, password string) (status int, body string) {
+	t.Helper()
+	payload := fmt.Sprintf(`{"registration_code":%q,"id":%q,"login_password":%q}`, regCode, id, password)
+	code, text, err := ProbeMethod(httpBase, http.MethodPost, "/api/client/register", []byte(payload))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return code, text
+}
+
+// TryMQTTPasswordLogin 尝试密码登录；CONNACK 成功返回 true。
+func TryMQTTPasswordLogin(t *testing.T, httpBase, endpointID, password string) bool {
+	t.Helper()
+	mc, err := harness.DialMQTTWebSocket(httpBase, 5*time.Second)
+	if err != nil {
+		t.Logf("dial: %v", err)
+		return false
+	}
+	defer func() { _ = mc.Close() }()
+
+	pk := packets.Packet{
+		FixedHeader:     packets.FixedHeader{Type: packets.Connect},
+		ProtocolVersion: 5,
+		Connect: packets.ConnectParams{
+			ProtocolName:     []byte("MQTT"),
+			Clean:            true,
+			ClientIdentifier: endpointID,
+			Keepalive:        30,
+			UsernameFlag:     true,
+			Username:         []byte(endpointID),
+			PasswordFlag:     true,
+			Password:         []byte(password),
+		},
+	}
+	var buf bytes.Buffer
+	if encErr := pk.ConnectEncode(&buf); encErr != nil {
+		t.Fatal(encErr)
+	}
+	if sendErr := mc.Send(buf.Bytes()); sendErr != nil {
+		return false
+	}
+	ack, recvErr := mc.Recv()
+	if recvErr != nil {
+		return false
+	}
+	if len(ack) < 4 || ack[0]>>4 != packets.Connack {
+		return false
+	}
+	return ack[3] == 0
+}

test/accept/mqtt.go

@@ -0,0 +1,342 @@
+package accept
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"sync"
+	"testing"
+	"time"
+
+	"git.asio.asia/nixevol/NixMsg/internal/protocol"
+	"git.asio.asia/nixevol/NixMsg/test/harness"
+	"github.com/mochi-mqtt/server/v2/packets"
+)
+
+// MQTTSession 是验收/弱网用的端侧 MQTT 会话（WebSocket + hello + 应用帧）。
+type MQTTSession struct {
+	t          *testing.T
+	mc         harness.MQTTClient
+	EndpointID string
+	pktID      uint16
+	mu         sync.Mutex
+	inbox      []map[string]any
+	closed     bool
+	done       chan struct{}
+}
+
+// AppResp 是 type=resp 的解析结果。
+type AppResp struct {
+	OK    bool
+	Error map[string]any
+	Data  any
+	Raw   map[string]any
+}
+
+// MQTTLogin 用密码连上 /mqtt、订阅 down、完成 hello。
+func MQTTLogin(t *testing.T, httpBase, endpointID, password string) *MQTTSession {
+	t.Helper()
+	mc, err := harness.DialMQTTWebSocket(httpBase, 10*time.Second)
+	if err != nil {
+		t.Fatalf("dial mqtt: %v", err)
+	}
+	s := &MQTTSession{t: t, mc: mc, EndpointID: endpointID, pktID: 10, done: make(chan struct{})}
+	s.connectSubscribeHello(password)
+	go s.readLoop()
+	return s
+}
+
+// Close 关闭底层连接。
+func (s *MQTTSession) Close() {
+	s.mu.Lock()
+	if s.closed {
+		s.mu.Unlock()
+		return
+	}
+	s.closed = true
+	s.mu.Unlock()
+	_ = s.mc.Close()
+	select {
+	case <-s.done:
+	case <-time.After(3 * time.Second):
+	}
+}
+
+func (s *MQTTSession) nextPkt() uint16 {
+	s.pktID++
+	if s.pktID == 0 {
+		s.pktID = 1
+	}
+	return s.pktID
+}
+
+func (s *MQTTSession) connectSubscribeHello(password string) {
+	t := s.t
+	pk := packets.Packet{
+		FixedHeader:     packets.FixedHeader{Type: packets.Connect},
+		ProtocolVersion: 5,
+		Connect: packets.ConnectParams{
+			ProtocolName:     []byte("MQTT"),
+			Clean:            true,
+			ClientIdentifier: s.EndpointID,
+			Keepalive:        30,
+			UsernameFlag:     true,
+			Username:         []byte(s.EndpointID),
+			PasswordFlag:     true,
+			Password:         []byte(password),
+		},
+	}
+	var buf bytes.Buffer
+	if err := pk.ConnectEncode(&buf); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.mc.Send(buf.Bytes()); err != nil {
+		t.Fatal(err)
+	}
+	ack, err := s.mc.Recv()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(ack) < 4 || ack[0]>>4 != packets.Connack || ack[3] != 0 {
+		t.Fatalf("connack %x", ack)
+	}
+
+	sub := packets.Packet{
+		FixedHeader:     packets.FixedHeader{Type: packets.Subscribe, Qos: 1},
+		ProtocolVersion: 5,
+		PacketID:        s.nextPkt(),
+		Filters: packets.Subscriptions{
+			{Filter: "nix/c/" + s.EndpointID + "/down", Qos: 1},
+		},
+	}
+	buf.Reset()
+	if err := sub.SubscribeEncode(&buf); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.mc.Send(buf.Bytes()); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := s.mc.Recv(); err != nil {
+		t.Fatal(err)
+	}
+
+	hello, _ := protocol.Marshal(protocol.Hello{V: protocol.Version, Type: protocol.TypeHello, RID: "h0"})
+	s.publishRaw(hello)
+	deadline := time.Now().Add(10 * time.Second)
+	for time.Now().Before(deadline) {
+		raw, err := s.mc.Recv()
+		if err != nil {
+			t.Fatal(err)
+		}
+		m := s.handlePacket(raw)
+		if m == nil {
+			continue
+		}
+		if m["type"] == "resp" && m["ok"] == true {
+			return
+		}
+		if m["type"] == "resp" {
+			t.Fatalf("hello failed: %v", m)
+		}
+		s.push(m)
+	}
+	t.Fatal("hello timeout")
+}
+
+func (s *MQTTSession) publishRaw(payload []byte) {
+	t := s.t
+	pub := packets.Packet{
+		FixedHeader:     packets.FixedHeader{Type: packets.Publish, Qos: 1},
+		ProtocolVersion: 5,
+		TopicName:       "nix/c/" + s.EndpointID + "/up",
+		PacketID:        s.nextPkt(),
+		Payload:         payload,
+	}
+	var buf bytes.Buffer
+	if err := pub.PublishEncode(&buf); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.mc.Send(buf.Bytes()); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func (s *MQTTSession) readLoop() {
+	defer close(s.done)
+	for {
+		raw, err := s.mc.Recv()
+		if err != nil {
+			return
+		}
+		m := s.handlePacket(raw)
+		if m != nil {
+			s.push(m)
+		}
+	}
+}
+
+func (s *MQTTSession) handlePacket(raw []byte) map[string]any {
+	if len(raw) < 2 {
+		return nil
+	}
+	typ := raw[0] >> 4
+	qos := (raw[0] >> 1) & 0x3
+	switch typ {
+	case packets.Puback, packets.Pingresp, packets.Suback:
+		return nil
+	case packets.Publish:
+		payload, err := decodePublishPayload(raw)
+		if err != nil {
+			return nil
+		}
+		if qos == 1 {
+			rem, n, _ := decodeRemainingLength(raw[1:])
+			body := raw[1+n:]
+			pk := packets.Packet{ProtocolVersion: 5, FixedHeader: packets.FixedHeader{Type: packets.Publish, Remaining: rem, Qos: qos}}
+			if decErr := pk.PublishDecode(body); decErr == nil && pk.PacketID != 0 {
+				ack := packets.Packet{
+					FixedHeader:     packets.FixedHeader{Type: packets.Puback},
+					ProtocolVersion: 5,
+					PacketID:        pk.PacketID,
+				}
+				var buf bytes.Buffer
+				if encErr := ack.PubackEncode(&buf); encErr == nil {
+					_ = s.mc.Send(buf.Bytes())
+				}
+			}
+		}
+		var m map[string]any
+		if json.Unmarshal(payload, &m) != nil {
+			return nil
+		}
+		return m
+	default:
+		return nil
+	}
+}
+
+func (s *MQTTSession) push(m map[string]any) {
+	s.mu.Lock()
+	s.inbox = append(s.inbox, m)
+	s.mu.Unlock()
+}
+
+// Request 发上行帧并等同 rid 的 resp。
+func (s *MQTTSession) Request(t *testing.T, frame map[string]any) AppResp {
+	t.Helper()
+	rid, _ := frame["rid"].(string)
+	payload, err := protocol.Marshal(frame)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s.publishRaw(payload)
+	deadline := time.Now().Add(15 * time.Second)
+	for time.Now().Before(deadline) {
+		m := s.takeMatching(func(x map[string]any) bool {
+			return x["type"] == "resp" && x["rid"] == rid
+		})
+		if m != nil {
+			r := AppResp{OK: m["ok"] == true, Raw: m, Data: m["data"]}
+			if e, ok := m["error"].(map[string]any); ok {
+				r.Error = e
+			}
+			return r
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	t.Fatalf("timeout waiting resp rid=%s", rid)
+	return AppResp{}
+}
+
+// WaitType 等到指定 type 的下行帧。
+func (s *MQTTSession) WaitType(t *testing.T, typ string, timeout time.Duration) map[string]any {
+	t.Helper()
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		m := s.takeMatching(func(x map[string]any) bool { return x["type"] == typ })
+		if m != nil {
+			return m
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	t.Fatalf("timeout waiting type=%s", typ)
+	return nil
+}
+
+// TryType 在超时内尝试取指定 type；超时返回 nil。
+func (s *MQTTSession) TryType(typ string, timeout time.Duration) map[string]any {
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		m := s.takeMatching(func(x map[string]any) bool { return x["type"] == typ })
+		if m != nil {
+			return m
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	return nil
+}
+
+func (s *MQTTSession) takeMatching(pred func(map[string]any) bool) map[string]any {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for i, m := range s.inbox {
+		if pred(m) {
+			s.inbox = append(s.inbox[:i], s.inbox[i+1:]...)
+			return m
+		}
+	}
+	return nil
+}
+
+// DrainEvents 排空 group_event / presence，避免干扰断言。
+func DrainEvents(t *testing.T, s *MQTTSession, d time.Duration) {
+	t.Helper()
+	deadline := time.Now().Add(d)
+	for time.Now().Before(deadline) {
+		_ = s.takeMatching(func(x map[string]any) bool {
+			typ, _ := x["type"].(string)
+			return typ == "group_event" || typ == "presence"
+		})
+		time.Sleep(20 * time.Millisecond)
+	}
+}
+
+func decodePublishPayload(raw []byte) ([]byte, error) {
+	if len(raw) < 2 {
+		return nil, io.ErrUnexpectedEOF
+	}
+	rem, n, err := decodeRemainingLength(raw[1:])
+	if err != nil {
+		return nil, err
+	}
+	body := raw[1+n:]
+	if len(body) != rem {
+		return nil, io.ErrUnexpectedEOF
+	}
+	pk := packets.Packet{
+		ProtocolVersion: 5,
+		FixedHeader: packets.FixedHeader{
+			Type:      packets.Publish,
+			Remaining: rem,
+			Qos:       (raw[0] >> 1) & 0x3,
+		},
+	}
+	if err := pk.PublishDecode(body); err != nil {
+		return nil, err
+	}
+	return pk.Payload, nil
+}
+
+func decodeRemainingLength(b []byte) (value int, n int, err error) {
+	var mul uint32 = 1
+	var v uint32
+	for i := 0; i < len(b) && i < 4; i++ {
+		v += uint32(b[i]&127) * mul
+		n++
+		if b[i]&128 == 0 {
+			return int(v), n, nil
+		}
+		mul *= 128
+	}
+	return 0, 0, io.ErrUnexpectedEOF
+}

test/accept/proc.go

@@ -0,0 +1,120 @@
+package accept
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"time"
+
+	"git.asio.asia/nixevol/NixMsg/test/harness"
+)
+
+// ManagedServer 支持 Kill 后用同一 data_dir 再 Restart（崩溃续传验收）。
+type ManagedServer struct {
+	BinPath       string
+	ConfigPath    string
+	DataDir       string
+	Addr          string
+	AdminPassword string
+	HTTPBase      string
+	AdminHTTPBase string
+
+	cmd *exec.Cmd
+}
+
+// StartManaged 启动随机端口进程。
+func StartManaged() (*ManagedServer, error) {
+	bin, err := harness.Binary()
+	if err != nil {
+		return nil, err
+	}
+	dataDir, err := os.MkdirTemp("", "nixmsg-q3-*")
+	if err != nil {
+		return nil, err
+	}
+	cfgPath := filepath.Join(dataDir, "config.yaml")
+	cfg := fmt.Sprintf("listen: %q\ndata_dir: %q\n", "127.0.0.1:0", filepath.ToSlash(dataDir))
+	if err = os.WriteFile(cfgPath, []byte(cfg), 0o644); err != nil {
+		_ = os.RemoveAll(dataDir)
+		return nil, err
+	}
+
+	initCmd := exec.Command(bin, "admin", "init")
+	initCmd.Env = append(os.Environ(), "NIXMSG_CONFIG="+cfgPath)
+	initOut, initErr := initCmd.CombinedOutput()
+	if initErr != nil {
+		_ = os.RemoveAll(dataDir)
+		return nil, fmt.Errorf("admin init: %w\n%s", initErr, initOut)
+	}
+	password := parsePassword(string(initOut))
+	if password == "" {
+		_ = os.RemoveAll(dataDir)
+		return nil, fmt.Errorf("admin init password not found:\n%s", initOut)
+	}
+
+	s := &ManagedServer{
+		BinPath:       bin,
+		ConfigPath:    cfgPath,
+		DataDir:       dataDir,
+		AdminPassword: password,
+	}
+	if err := s.startServe(); err != nil {
+		_ = os.RemoveAll(dataDir)
+		return nil, err
+	}
+	return s, nil
+}
+
+func (s *ManagedServer) startServe() error {
+	_ = os.Remove(filepath.Join(s.DataDir, "listen.addr"))
+	cmd := exec.Command(s.BinPath, "serve")
+	cmd.Env = append(os.Environ(), "NIXMSG_CONFIG="+s.ConfigPath)
+	cmd.Stdout = os.Stderr
+	cmd.Stderr = os.Stderr
+	if err := cmd.Start(); err != nil {
+		return fmt.Errorf("start serve: %w", err)
+	}
+	s.cmd = cmd
+	addr, err := waitListenAddr(filepath.Join(s.DataDir, "listen.addr"), 20*time.Second)
+	if err != nil {
+		_ = cmd.Process.Kill()
+		_, _ = cmd.Process.Wait()
+		return fmt.Errorf("wait listen.addr: %w", err)
+	}
+	s.Addr = addr
+	s.HTTPBase = "http://" + addr
+	s.AdminHTTPBase = s.HTTPBase
+	return nil
+}
+
+// Kill 杀掉进程，保留数据目录。
+func (s *ManagedServer) Kill() error {
+	if s == nil || s.cmd == nil || s.cmd.Process == nil {
+		return nil
+	}
+	_ = s.cmd.Process.Kill()
+	_, _ = s.cmd.Process.Wait()
+	s.cmd = nil
+	return nil
+}
+
+// Restart 在同一配置与数据目录上重新 serve。
+func (s *ManagedServer) Restart() error {
+	if err := s.Kill(); err != nil {
+		return err
+	}
+	return s.startServe()
+}
+
+// Cleanup 停进程并删除数据目录。
+func (s *ManagedServer) Cleanup() error {
+	if s == nil {
+		return nil
+	}
+	_ = s.Kill()
+	if s.DataDir != "" {
+		return os.RemoveAll(s.DataDir)
+	}
+	return nil
+}

test/chaos/README.md

@@ -1,61 +1,22 @@
 # 混沌 / 弱网测试辅助（Q 线）
 
-用 toxiproxy 官方镜像做延迟和断开；Linux 丢包用容器内 netem。所有 Docker 资源名带 `q` 前缀，用完删除。
+用 toxiproxy 官方镜像做延迟和断开；Linux 丢包用容器内 netem。Q3 相关 Docker 资源名带 `q3` 前缀，用完删除。
 
 ## 启动 toxiproxy
 
-在仓库根目录（或本目录）执行：
-
 ```powershell
-docker compose -p q-chaos -f test/chaos/compose.yml up -d
-```
-
-API 默认映射到本机随机/固定端口见 compose 注释。查看实际端口：
-
-```powershell
-docker compose -p q-chaos -f test/chaos/compose.yml port toxiproxy 8474
+docker compose -p q3-chaos -f test/chaos/compose.yml up -d
+docker compose -p q3-chaos -f test/chaos/compose.yml port toxiproxy 8474
 ```
 
 清理：
 
 ```powershell
-docker compose -p q-chaos -f test/chaos/compose.yml down -v
+docker compose -p q3-chaos -f test/chaos/compose.yml down -v
 ```
 
-## 对运行中的服务注入故障
+集成测 `TestQ3ToxiproxyOfflineKeepDelivered` 会自动起停上述 compose。
 
-不要写死 `7443`。上游地址取自当前实例的实际监听端口（例如测试 harness 写入的 `listen.addr`，或你启动时打印的地址）。
+## netem
 
-1. 本机起好 NixMsg（或任意 TCP 服务），记下 `HOST:PORT`。
-2. 在 Windows 上，容器访问本机服务用 `host.docker.internal:PORT`。
-3. 用本包客户端或 curl 建代理（listen 用 `0.0.0.0:0` 让 toxiproxy 分配端口）：
-
-```go
-c := chaos.NewClient("http://127.0.0.1:<api端口>")
-p, err := c.CreateProxy("q-nixmsg", "0.0.0.0:0", "host.docker.internal:"+strconv.Itoa(port))
-// 客户端改连 p.Listen（把 0.0.0.0 换成 127.0.0.1）
-_, _ = c.AddLatency("q-nixmsg", "lag", 200, 50, "")
-_, _ = c.AddResetPeer("q-nixmsg", "rst", 0, "")
-```
-
-等价 curl：
-
-```bash
-curl -s -X POST http://127.0.0.1:<api>/proxies \
-  -H 'Content-Type: application/json' \
-  -d '{"name":"q-nixmsg","listen":"0.0.0.0:0","upstream":"host.docker.internal:<PORT>","enabled":true}'
-```
-
-延迟：`POST .../proxies/q-nixmsg/toxics`，`type=latency`，`attributes.latency` / `jitter`（毫秒）。
-
-断开：`type=reset_peer`，`attributes.timeout`（毫秒，0 表示尽快 RST）。
-
-## 单元测试
-
-```powershell
-go test ./test/chaos/ -count=1
-```
-
-## netem 丢包
-
-见 [netem/README.md](./netem/README.md)。脚本必须在 Linux 容器内执行（本机是 Windows）。
+见 [netem/README.md](./netem/README.md)。本机 Windows 上 Q3 将 netem 20% 丢包记为未测（见 `docs/DEVIATIONS.md` 测试交付 Q）。

test/chaos/compose.yml

@@ -1,15 +1,13 @@
-# toxiproxy：延迟与断开。项目名用 -p q-chaos，容器名带 q 前缀。
+# toxiproxy：延迟与断开。项目名用 -p q3-chaos，容器名带 q3 前缀。
 # API 与代理端口映射到本机，具体宿主机端口用 `docker compose port` 查询，不要写死业务端口。
 
 services:
   toxiproxy:
     image: ghcr.io/shopify/toxiproxy:2.12.0
-    container_name: q-toxiproxy
-    # 8474=API；8475 起可手工映射代理端口，或在 CreateProxy 时用 0.0.0.0:0 再 docker port 查询
+    container_name: q3-toxiproxy
     ports:
       - "8474"
       - "8475"
       - "8476"
-    # 允许代理到本机服务（Docker Desktop / Windows）
     extra_hosts:
       - "host.docker.internal:host-gateway"

test/chaos/q3_crash_test.go

@@ -0,0 +1,56 @@
+package chaos_test
+
+import (
+	"testing"
+	"time"
+
+	"git.asio.asia/nixevol/NixMsg/test/accept"
+	"git.asio.asia/nixevol/NixMsg/test/harness"
+)
+
+// TestQ3CrashSubmitThenRestart：提交返回成功后杀进程，重启后续传（离线保留消息）。
+func TestQ3CrashSubmitThenRestart(t *testing.T) {
+	srv, err := accept.StartManaged()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = srv.Cleanup() }()
+
+	hs := &harness.Server{
+		HTTPBase:      srv.HTTPBase,
+		AdminHTTPBase: srv.AdminHTTPBase,
+		AdminPassword: srv.AdminPassword,
+	}
+	ac := accept.AdminLogin(t, hs)
+	accept.CreateEndpoint(t, ac, "q3crasha1", epPassword)
+	accept.CreateEndpoint(t, ac, "q3crashb1", epPassword)
+
+	alice := accept.MQTTLogin(t, srv.HTTPBase, "q3crasha1", epPassword)
+	sendOff := alice.Request(t, map[string]any{
+		"v": 1, "type": "send", "rid": "cr1", "id": "q3-crash-1",
+		"to":       map[string]any{"kind": "endpoint", "id": "q3crashb1"},
+		"body":     map[string]any{"enc": "utf8", "data": "after-crash"},
+		"delay_ms": int64(0),
+		"offline":  map[string]any{"keep": true, "ttl_seconds": int64(86400)},
+	})
+	if !sendOff.OK {
+		t.Fatalf("submit before crash: %+v", sendOff)
+	}
+	alice.Close()
+
+	if err := srv.Kill(); err != nil {
+		t.Fatal(err)
+	}
+	time.Sleep(200 * time.Millisecond)
+	if err := srv.Restart(); err != nil {
+		t.Fatalf("restart: %v", err)
+	}
+
+	bob := accept.MQTTLogin(t, srv.HTTPBase, "q3crashb1", epPassword)
+	defer bob.Close()
+	msg := bob.WaitType(t, "msg", 20*time.Second)
+	if msg["id"] != "q3-crash-1" {
+		t.Fatalf("want q3-crash-1 after restart, got %v", msg)
+	}
+	bob.Request(t, map[string]any{"v": 1, "type": "ack", "rid": "cra1", "from": "q3crasha1", "id": "q3-crash-1"})
+}

test/chaos/q3_weak_test.go

@@ -0,0 +1,180 @@
+package chaos_test
+
+import (
+	"net"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"git.asio.asia/nixevol/NixMsg/test/accept"
+	"git.asio.asia/nixevol/NixMsg/test/chaos"
+	"git.asio.asia/nixevol/NixMsg/test/harness"
+)
+
+const (
+	q3ComposeProject = "q3-chaos"
+	q3ProxyName      = "q3-nixmsg"
+	epPassword       = "password1234"
+)
+
+// TestQ3ToxiproxyOfflineKeepDelivered：延迟 + 断开后，离线保留期内消息最终送达。
+func TestQ3ToxiproxyOfflineKeepDelivered(t *testing.T) {
+	if _, err := exec.LookPath("docker"); err != nil {
+		t.Skip("docker 不可用，跳过 toxiproxy 弱网")
+	}
+
+	composeFile := filepath.Join(moduleRoot(t), "test", "chaos", "compose.yml")
+	down := func() {
+		cmd := exec.Command("docker", "compose", "-p", q3ComposeProject, "-f", composeFile, "down", "-v", "--remove-orphans")
+		_ = cmd.Run()
+	}
+	down()
+	t.Cleanup(down)
+
+	up := exec.Command("docker", "compose", "-p", q3ComposeProject, "-f", composeFile, "up", "-d")
+	if out, err := up.CombinedOutput(); err != nil {
+		t.Fatalf("compose up: %v\n%s", err, out)
+	}
+
+	apiHostPort := waitComposePort(t, composeFile, "8474", 90*time.Second)
+	listenHostPort := waitComposePort(t, composeFile, "8475", 90*time.Second)
+	apiURL := "http://127.0.0.1:" + apiHostPort
+	waitHTTP(t, apiURL+"/version", 90*time.Second)
+
+	srv, err := harness.Start(harness.Options{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = srv.Stop() }()
+
+	_, nixPort, err := net.SplitHostPort(srv.Addr)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	c := chaos.NewClient(apiURL)
+	_ = c.DeleteProxy(q3ProxyName)
+	if _, err := c.CreateProxy(q3ProxyName, "0.0.0.0:8475", "host.docker.internal:"+nixPort); err != nil {
+		t.Fatalf("CreateProxy: %v", err)
+	}
+	t.Cleanup(func() { _ = c.DeleteProxy(q3ProxyName) })
+
+	proxyBase := "http://127.0.0.1:" + listenHostPort
+	if _, err := c.AddLatency(q3ProxyName, "q3-lag", 150, 50, ""); err != nil {
+		t.Fatalf("AddLatency: %v", err)
+	}
+
+	ac := accept.AdminLogin(t, srv)
+	accept.CreateEndpoint(t, ac, "q3alice01", epPassword)
+	accept.CreateEndpoint(t, ac, "q3bob0001", epPassword)
+
+	alice := accept.MQTTLogin(t, proxyBase, "q3alice01", epPassword)
+	defer alice.Close()
+
+	sendOff := alice.Request(t, map[string]any{
+		"v": 1, "type": "send", "rid": "q3s1", "id": "q3-off-keep",
+		"to":       map[string]any{"kind": "endpoint", "id": "q3bob0001"},
+		"body":     map[string]any{"enc": "utf8", "data": "keep-me"},
+		"delay_ms": int64(0),
+		"offline":  map[string]any{"keep": true, "ttl_seconds": int64(86400)},
+	})
+	if !sendOff.OK {
+		t.Fatalf("send offline keep: %+v", sendOff)
+	}
+
+	if _, err := c.AddResetPeer(q3ProxyName, "q3-rst", 0, ""); err != nil {
+		t.Fatalf("AddResetPeer: %v", err)
+	}
+	time.Sleep(400 * time.Millisecond)
+	_ = c.RemoveToxic(q3ProxyName, "q3-rst")
+	_ = c.RemoveToxic(q3ProxyName, "q3-lag")
+
+	bob := accept.MQTTLogin(t, proxyBase, "q3bob0001", epPassword)
+	defer bob.Close()
+	msg := bob.WaitType(t, "msg", 20*time.Second)
+	if msg["id"] != "q3-off-keep" {
+		t.Fatalf("want q3-off-keep got %v", msg)
+	}
+	bob.Request(t, map[string]any{"v": 1, "type": "ack", "rid": "q3a1", "from": "q3alice01", "id": "q3-off-keep"})
+}
+
+// TestQ3NetemUntested 记录本机 Windows 上 netem 20% 丢包未测原因。
+func TestQ3NetemUntested(t *testing.T) {
+	t.Log("未测：Linux netem 20% 丢包。本机为 Windows；无法在宿主直接用 tc/netem。" +
+		"若只对 toxiproxy 容器网卡挂 netshoot，不等于 NixMsg 业务端到端丢包验收。" +
+		"本波用 toxiproxy 延迟/断开覆盖弱网；netem 需 Linux 宿主或把服务放进同网络 Linux 容器后再测。")
+}
+
+func moduleRoot(t *testing.T) string {
+	t.Helper()
+	dir, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for {
+		if _, err := os.Stat(filepath.Join(dir, "go.mod")); err == nil {
+			return dir
+		}
+		parent := filepath.Dir(dir)
+		if parent == dir {
+			t.Fatal("go.mod not found")
+		}
+		dir = parent
+	}
+}
+
+func waitComposePort(t *testing.T, composeFile, containerPort string, timeout time.Duration) string {
+	t.Helper()
+	deadline := time.Now().Add(timeout)
+	var last string
+	for time.Now().Before(deadline) {
+		cmd := exec.Command("docker", "compose", "-p", q3ComposeProject, "-f", composeFile, "port", "toxiproxy", containerPort)
+		out, err := cmd.CombinedOutput()
+		last = strings.TrimSpace(string(out))
+		if err == nil && last != "" {
+			_, port, perr := net.SplitHostPort(normalizeComposeAddr(last))
+			if perr == nil && port != "" {
+				return port
+			}
+		}
+		time.Sleep(400 * time.Millisecond)
+	}
+	t.Fatalf("compose port %s timeout, last=%q", containerPort, last)
+	return ""
+}
+
+func normalizeComposeAddr(s string) string {
+	s = strings.TrimSpace(s)
+	if strings.HasPrefix(s, "[::]") {
+		return "127.0.0.1" + s[len("[::]"):]
+	}
+	if strings.HasPrefix(s, "0.0.0.0:") {
+		return "127.0.0.1" + s[len("0.0.0.0"):]
+	}
+	return s
+}
+
+func waitHTTP(t *testing.T, url string, timeout time.Duration) {
+	t.Helper()
+	client := &http.Client{Timeout: 2 * time.Second}
+	deadline := time.Now().Add(timeout)
+	var last error
+	for time.Now().Before(deadline) {
+		resp, err := client.Get(url)
+		if err == nil {
+			_ = resp.Body.Close()
+			if resp.StatusCode < 500 {
+				return
+			}
+			last = err
+		} else {
+			last = err
+		}
+		time.Sleep(400 * time.Millisecond)
+	}
+	t.Fatalf("wait HTTP %s: %v", url, last)
+}

test/load/q3_live_test.go

@@ -0,0 +1,78 @@
+package load_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"git.asio.asia/nixevol/NixMsg/test/accept"
+	"git.asio.asia/nixevol/NixMsg/test/harness"
+)
+
+const (
+	epPassword = "password1234"
+	// 本机短时压测目标：几十连接收发。不做 1000 / 10 分钟（见 DEVIATIONS）。
+	q3LivePairs = 16 // 32 个端、16 对收发
+)
+
+// TestQ3LiveShortBurst 短时几十连接登录并完成单聊收发。
+func TestQ3LiveShortBurst(t *testing.T) {
+	srv, err := harness.Start(harness.Options{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = srv.Stop() }()
+
+	ac := accept.AdminLogin(t, srv)
+	type pair struct {
+		a, b string
+	}
+	pairs := make([]pair, 0, q3LivePairs)
+	for i := 0; i < q3LivePairs; i++ {
+		a := fmt.Sprintf("q3la%04d", i)
+		b := fmt.Sprintf("q3lb%04d", i)
+		accept.CreateEndpoint(t, ac, a, epPassword)
+		accept.CreateEndpoint(t, ac, b, epPassword)
+		pairs = append(pairs, pair{a: a, b: b})
+	}
+
+	sessions := make([]*accept.MQTTSession, 0, q3LivePairs*2)
+	defer func() {
+		for _, s := range sessions {
+			s.Close()
+		}
+	}()
+
+	for _, p := range pairs {
+		sa := accept.MQTTLogin(t, srv.HTTPBase, p.a, epPassword)
+		sb := accept.MQTTLogin(t, srv.HTTPBase, p.b, epPassword)
+		sessions = append(sessions, sa, sb)
+	}
+
+	for i, p := range pairs {
+		sa := sessions[i*2]
+		sb := sessions[i*2+1]
+		msgID := fmt.Sprintf("q3-load-%d", i)
+		resp := sa.Request(t, map[string]any{
+			"v": 1, "type": "send", "rid": fmt.Sprintf("ls%d", i), "id": msgID,
+			"to":       map[string]any{"kind": "endpoint", "id": p.b},
+			"body":     map[string]any{"enc": "utf8", "data": "burst"},
+			"delay_ms": int64(0),
+		})
+		if !resp.OK {
+			t.Fatalf("pair %d send: %+v", i, resp)
+		}
+		msg := sb.WaitType(t, "msg", 15*time.Second)
+		if msg["id"] != msgID {
+			t.Fatalf("pair %d want %s got %v", i, msgID, msg)
+		}
+		ack := sb.Request(t, map[string]any{
+			"v": 1, "type": "ack", "rid": fmt.Sprintf("la%d", i),
+			"from": p.a, "id": msgID,
+		})
+		if !ack.OK {
+			t.Fatalf("pair %d ack: %+v", i, ack)
+		}
+	}
+	t.Logf("短时压测通过：%d 连接、%d 对单聊收发成功（未做 1000 连接 / 10 分钟）", q3LivePairs*2, q3LivePairs)
+}

test/report/testdata/q2_results.json

@@ -1,120 +1,120 @@
 {
-  "generated_at": "2026-09-29T23:20:07Z",
+  "generated_at": "2026-09-30T00:26:12Z",
   "items": [
     {
       "id": "F01",
-      "status": "untested",
-      "note": "未测：serve 未挂载 POST /api/admin/endpoints（A2 未合入或未接线；当前 A1 对端路由返回 501 亦未挂到进程）"
+      "status": "pass",
+      "note": "已测：开通一端、错误密码 MQTT 拒绝、正确密码可连；批量校验/停用/删除转让/同号重开未在本用例穷尽"
     },
     {
       "id": "F02",
-      "status": "untested",
-      "note": "未测：端登录/会话令牌属连接 N3，main 上 serve 未挂 broker"
+      "status": "pass",
+      "note": "已测：密码登录后 hello 成功（会话令牌路径可用）；顶号/锁定/重置踢线未在本用例穷尽"
     },
     {
       "id": "F03",
       "status": "untested",
-      "note": "未测：在线状态属身份 I3 + 连接 N3，未接线"
+      "note": "未测：directory.list / 断开后离线状态未在本波单独断言"
     },
     {
       "id": "F04",
       "status": "untested",
-      "note": "未测：presence.watch 属身份 I3，未接线"
+      "note": "未测：presence.watch 订阅通知未覆盖"
     },
     {
       "id": "F05",
-      "status": "untested",
-      "note": "未测：消息提交属消息 M1，未挂入 broker 上行"
+      "status": "pass",
+      "note": "已测：双端在线单聊送达与确认；崩溃续传见 Q3；消息号冲突/密码门/配额未穷尽"
     },
     {
       "id": "F06",
-      "status": "untested",
-      "note": "未测：群消息属消息 M + 身份 I4，未接线"
+      "status": "pass",
+      "note": "已测：群成员收到同一份、发送者不收到自己的；入群前不补未单独覆盖"
     },
     {
       "id": "F07",
       "status": "untested",
-      "note": "未测：大小限制属消息/连接，未接线"
+      "note": "未测：256 KiB 边界与接收上限未覆盖"
     },
     {
       "id": "F08",
-      "status": "untested",
-      "note": "未测：投递确认属消息 M2，未接线"
+      "status": "pass",
+      "note": "已测：提交成功后杀进程重启，离线保留消息续传；toxiproxy 弱网见 Q3 chaos 测试；应用层去重未单独断言"
     },
     {
       "id": "F09",
-      "status": "untested",
-      "note": "未测：保留期属消息 M2，未接线"
+      "status": "pass",
+      "note": "已测：选离线保留且接收方稍后上线能送达；超时过期未在本用例拨钟验证"
     },
     {
       "id": "F10",
       "status": "untested",
-      "note": "未测：断线策略属消息 M2，未接线"
+      "note": "未测：抖动宽限长短断线未单独拨钟"
     },
     {
       "id": "F11",
       "status": "untested",
-      "note": "未测：定时发送属消息 M2/M4，未接线"
+      "note": "未测：发送方离线后定时到点发送未覆盖"
     },
     {
       "id": "F12",
-      "status": "untested",
-      "note": "未测：延迟撤回属消息 M3，未接线"
+      "status": "pass",
+      "note": "已测：延迟窗口内撤回对方无 msg/revoked"
     },
     {
       "id": "F13",
-      "status": "untested",
-      "note": "未测：撤回判定属消息 M3，未接线"
+      "status": "pass",
+      "note": "已测：未推送前撤回成功；群部分撤回未覆盖"
     },
     {
       "id": "F14",
       "status": "untested",
-      "note": "未测：回执属消息 M3，未接线"
+      "note": "未测：回执补送未覆盖"
     },
     {
       "id": "F15",
       "status": "untested",
-      "note": "未测：对话密码属身份 I2，未接线"
+      "note": "未测：对话密码授权链路未覆盖"
     },
     {
       "id": "F16",
-      "status": "untested",
-      "note": "未测：群权限属身份 I4，未接线"
+      "status": "pass",
+      "note": "已测：建群并拉成员后可群发；群主权限/退出/解散同号等未穷尽"
     },
     {
       "id": "F17",
-      "status": "untested",
-      "note": "未测：serve 未挂载 /api/admin/login（A1 Handler 已实现，缺总控/接线挂到 cmd/nixmsg；DEVIATIONS 后台接口 A §1）"
+      "status": "pass",
+      "note": "已测：管理登录、错误密码锁定、无 CSRF 被拒 / 有 CSRF 可通过；管端开通见 F01；管注册见 F23；令牌越权/查记录无正文等未穷尽"
     },
     {
       "id": "F18",
       "status": "untested",
-      "note": "未测：正文清理属消息 M3，未接线"
+      "note": "未测：正文删除与记录天数 0 未覆盖"
     },
     {
       "id": "F19",
       "status": "untested",
-      "note": "未测：SDK 接入清单属 S1/S2 任务 4，依赖真实服务接线"
+      "note": "未测：四种 SDK 接入清单属 S1/S2 任务 4"
     },
     {
       "id": "F20",
-      "status": "untested",
-      "note": "未测：裸 MQTT 属连接 N，serve 未挂 broker"
+      "status": "pass",
+      "note": "已测：裸 MQTT WebSocket 登录、hello、发、收、确认"
     },
     {
       "id": "F21",
-      "status": "untested",
-      "note": "仅验证 listen 上 /healthz+/readyz；后台 API、/mqtt、裸 TCP、注册未挂入 serve（缺总控接线 + 连接 N）"
+      "status": "pass",
+      "note": "已测：同一 listen 端口提供 /healthz、管理 API、注册、WebSocket /mqtt；后台分离端口未测"
     },
     {
       "id": "F22",
       "status": "pass",
-      "note": "已测：空目录 admin init + serve，/healthz 与 /readyz 成功，密码不在 serve 日志；未测：备份恢复、升级迁移、证书重载、Docker、/metrics"
+      "note": "已测：空目录 admin init + serve，/healthz 与 /readyz 成功，密码不在 serve 日志；未测：备份恢复、升级迁移、证书重载、Docker 全量、/metrics 抓取"
     },
     {
       "id": "F23",
-      "status": "untested",
-      "note": "未测：serve 未挂载 POST /api/client/register（I1 Handler 已实现，缺总控/连接 N 接线；DEVIATIONS 身份 I §1）"
+      "status": "pass",
+      "note": "已测：开关、错码、对码、换码；输错锁定未在本用例穷尽"
     }
   ]
 }