fix: integrate recovery, evidence and publication repairs

[loopx-agent]

Goal And Delivered Outcome

Qualify one code version containing the existing recovery, research-history, trajectory-evidence and publication repairs. The previous integration exposed additional CI consumer defects. This update incorporates their completed source repair into the same proposal, so those fixes can be validated together with the product changes.

Base: main at cd148933bb0cb00232cb3cc494f898a171ffe36c. Candidate: 1258cfbe8a46af765ee258ffa5fa560ceea6ce28; Git tree: 4dd7c62abfe07c1e72729441e5008f386c1bfc54.

Existing proposal	Included immutable head	Resulting behavior
#6691	560fc66b99460aebd25fb2a24b484d9be6d94410	UTF-8 trajectory artifacts/child transport and the existing shared digest owner
#6693	96a01cf0ef0bc2b6a6bfc6c7b407af4748c214e5	Recovery inspection returns the verified captured revision/cursor after the source disappears
#6690	e35b3bf49c70dd5af06f3c2cdb8f8cbfe8845386	Research-history navigation reaches its actual frontend
#6688	d55bc6987dabffb2c4878dc56bfdbf96ac32ed76	Administrative consumer contracts, authenticated disposable-runtime cleanup, strict lease refusal inspection, isolated nested collectors and correctly bounded output-limit probes
#6684	acc16b42cf459eb389f39dcdaebbaeef795d311e	Normal publication checks exercise the approved Time Machine journey and focus ordering

Author Declaration

Written by: model_agent — OpenAI Codex, GPT-6 family. Source proposals retain their original authorship and review histories.

Implemented against the pinned base's administrative and execution-proof contract, lease refusal inspection, runtime isolation and actual exit, and Time Machine journey. Individual source proposals identify their accepted recovery and evidence specifications.

Criterion	Disposition	Evidence
Include the current base and five exact sources without unrelated changes	implemented	Native integration owner verifies ancestry and the exact 28-path source union
Preserve existing implementations and incorporate the completed consumer repair	implemented	All 25 prior proposal blobs retained; three new test paths equal their source blobs; old integration is an ancestor; 21 DCO-signed commits beyond the base
Retain protected refusal fields and real cleanup/isolation boundaries	implemented	Current combined-source tests plus the source repair's independent negative cases
Complete required six-shard hosted execution/JUnit/combined coverage	not_met	Previous cohort failed; this updated combination requires its own normal qualification

Scope And Continuation

This update adds one signed integration merge, with no conflict resolution or new producer implementation. The configuration now resolves the verified remote consumer source instead of its obsolete local ref. The candidate also contains current main's already merged wakeup change as baseline context; its focused real File/Core tests are included in the combined validation.

The future-facing pass preserves the existing single digest owner, runtime shutdown owner and strict refusal assertion. No composer framework, duplicate configuration or new protocol vocabulary is introduced. Existing source PRs remain independent. The author proposal is ready for review; the earlier exact-head review of bbe5e84 does not approve this new head.

The workflow keeps six shards, two workers per shard, the one-hour limit, complete inventory/JUnit/coverage, fork boundaries and frozen sustained acceptance. Merge, installed-App adoption and public deployment retain their existing authority and validation requirements.

Validation

Tested revision: 1258cfbe8a46af765ee258ffa5fa560ceea6ce28. Inputs: synthetic and public fixtures. Local validation: running. New hosted qualification: pending.

Check kind	Result	Evidence / limitation
integration	passed	Native candidate readback proves current base, all five immutable source heads, retained prior integration ancestry and exact 28-path union
real_backend / real_entrypoint	running	Current candidate is executing 26 complete affected modules, including real disposable File/SQLite lease recovery, source/runtime cleanup and current main wakeup fixtures. No completed-module result is claimed yet.
regression_parity	passed	The source repair rejects five independent refusal-oracle fault profiles. Actual collector writes remain rejected; a controlled parent-namespace race and 600 ms output startup distinguish the repaired fixture conditions. These negative runs belong to source d55bc6987; their producer/consumer blobs are identical in this candidate
integration / collection	not_run	Unsplit plus six native split collections will be read after the running suite; no current union/disjoint or full execution claim yet.
unit / integration	passed	Three complete typed recovery/digest/evidence suites: 29 passed, zero failures/cancellations/skips, on this exact head with Node 24.21.0
static	passed	All 28 paths pass the public-boundary scan; Python Ruff, browser-helper syntax, diff and semantic advisory checks pass. The advisory detects no supported new vocabulary carrier; it does not prove semantic equivalence
integration	blocked	Six direct checks and 19 selected commands executed with zero command failures. The policy remains held by the exact-scope CQR: local qualification is running, previous hosted qualification failed and new full qualification is pending. Benchmark-sensitive review remains separate.
hosted integration	failed	Prior run 38993375769, attempt 1: four failed shards and two cancelled at the unchanged one-hour limit. All six logs and four digest-verified JUnit archives were read. All four completed shards also fail the default-runtime-directory guard; shard 6 has zero assertion failures and still fails that guard. Missing shard reports/coverage remain unqualified
hosted final head	pending	This updated head's normal PR qualification is required. No manual dispatch, rerun, comparison cohort or failed-check waiver
manual	not_run	Independent exact-head review/readiness, installed adoption, actual public deployment and sustained CI acceptance remain separate

Local Linux uses Python 3.11.17, SQLite 3.40.1 and Node 24.21.0 in an owned container with two CPUs, 3 GiB and PID512, no host mounts and no test network. All 53 original dependency pins match the installed readback. This is neither the latest hosted resolver nor a hosted performance comparison; selected-module coverage will not replace full combined coverage.

The earlier 714-case Linux run, packaged six-journey readback and 190-link Frontstage check belong to the earlier exact composed tree. They are historical evidence, not reruns on this new head. The packaged chat bundle for this candidate has a valid source manifest and byte-verified Linux copy; that is packaging provenance, not a fresh browser journey.

The execution-time default-runtime writer, stream-unsubscribe failure and incomplete shard execution remain unresolved. Three demonstrated consumer/fixture gaps are now repaired; collection-only success does not identify every hosted writer or explain the two timeouts. The exact-scope change-quality result retains the required full-qualification blocker.

Frontend / Visual Evidence

UI impact: none. This integration changes no layout, hero, capture, settings or Lark interaction beyond accepted mainline context. Browser helpers validate existing shipped behavior. No new screenshot or installed/public adoption is asserted here.

Type / Area / Boundary

Bug fixes and integration validation; control plane, benchmark evidence and publication CI. Existing S10/S12 outcome coverage remains partial until qualification and adoption. No authority promotion, scoring/model run, resource/timeout change, deployment or private-state publication. No paired RFC changes relative to the pinned base. Public-boundary checks cover the diff and final description.

[loopx-agent]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max.

本地代码评审未发现阻断性问题，结论为 APPROVE，对应完整 head bbe5e84dc6d6539468eaebcd1797c988d8954b21。这不是合并就绪或完整 CI 资格结论；作者列出的完整托管资格仍未满足，原 CQR 的阻塞也保留。

动机

受影响的是从现有设置页或 CLI 检查备份的人、显式读取轨迹证据的人，以及运行历史记录和公开站点验收的维护者。 例如原始 File/SQLite 来源写入新提交后丢失，用户检查旧备份：旧实现遗漏原检查点，新实现直接显示已封存的版本和游标，无须重建来源或手填位置。

已验证的提案源码能在现有恢复页面和 CLI 读回原检查点，UTF-8 证据能通过真实子进程往返，结束的测试临时目录不再保留其认证运行时，现有历史记录和时光机验收能走完整条交互。 本次代码结论不证明完整托管 CI、持续容量、已安装应用或公开站点已经采用，也不授予恢复激活、模型评估、合并、部署或关闭来源 PR 的权限。 单次自然完整 CI 的六片执行及完整 JUnit、覆盖率仍待资格读回；维护者合并授权和真实安装／公开采用仍未完成。

该整合阶段的价值在于让已经分别修复的恢复、证据和验收路径同时存在于一个可审查源码树，消除来源 PR 缺少彼此修复的交叉失败。它交付可运行的提案和本地实际读回，距离公共采用仍有上述明确缺口。保留完整 CI 要求，不把收集测试、局部通过或一次历史成功称为全部验收完成。

规范基准是 docs/reference/configuration-backup.md，固定修订 fdf03ec6112aedf497b7ab1d6e5bc4db19c2ae5f，并结合该修订的行政编辑与显式执行证明、临时进程隔离与实际退出、轨迹证据和时光机约定。这些规范在整合前已经存在，当前 PR 没有修改规范来迎合测试。

验收项	本次判断与证据
CapturedCheckpoint	已实现：File/SQLite 的归档版本与游标来自封存检查点，后续写入及来源丢失不能替换它。
InertReadback	已实现：历史报告保留原观察，旧字段缺失仍为未知；检查不激活 Goal。
AdministrativeFence	已实现：普通本人文案编辑保留租约历史，显式旧／部分／他人证明和完成操作仍被原 owner 拒绝。
DisposableRuntimeExit	已实现：真实源码及复制包进程在测试结束后退出；外部目录、错误 PID、损坏元数据不能授权关闭。
EvidenceIntegrity	已实现：显式 UTF-8 和共用摘要 owner 保留原文本及既有标识边界，没有改变评分或分析授权。
HistoricalJourney	已实现：三种历史案例的两种选择均读回同一记录，原始文本、键盘和 HTTP404 后重试经过真实产品路径。

改动思路

保留现有 owner：历史位置由已验证归档派生，字符编码属于既有 IO，临时测试进程的收尾属于测试生命周期，浏览器验收应到达真实产品。五个已存在修复组合已足够，无须新增决策状态、CLI、集成框架或第二套激活策略。 当前评审覆盖精确 head 的 25 路径完整并集；本地代码审查、仍然必需的托管资格、合并授权和真实安装／公开采用分别保留各自结果，当前交付任务及持续验收条件继续开放。

我比较了不合入、仅修改旧测试断言、复用既有修复组合三条路径。不合入会保留可复现的原位置遗漏和非 ASCII 输入失败；只改断言无法修复这两个真实用户结果。当前五次普通 Git 合并已经保留基线和各精确来源，全部 17 个提交有 DCO，树与既有完整本地组合一致；没有冲突处理、隐藏补丁或新 composer。这是成立的整合边界，同时不替代后续集成资格。

主要因果链均有现有 owner：完整归档验证 → 原检查点投影 → 既有审计／CLI／设置页；临时测试目录 → fixture finalizer 完成 → 认证 ping 核对 PID／指纹 → 原运行时 drain／实际退出。Python 只承接既有文件和子进程 IO，状态与资格判断仍在现有 TypeScript 边界。没有增加用户输入、配置开关或交互轮次，也不要求用户拼接底层命令来查看已经存在的信息。

具体改动

1. inspectAuthorityBackup 在完整 seal、状态链、依赖摘要及来源身份核对后，从 archive.summary 返回原 provider_revision 和 cursor。没有查询当前源来补值。基线重放中真实 File/SQLite 的 Python 测试都在缺失字段处失败，两个 TypeScript 捕获测试也得到 undefined；当前 head 均通过。后写提交、原源移除、伪造清单借用真实后写版本和旧报告重载都在原 owner 边界验证。

2. 轨迹 IO 与存储读写 明确使用 UTF-8，包括 prompt、JSON、事件和子进程文本传输。ASCII 默认 locale 的真实子进程在不可变基线抛出 UnicodeDecodeError，相同驱动在 head 完成原文本往返。模拟分析器只验证传输，没有运行付费模型或证明评估有效性。parseTrajectoryInput 复用既有摘要常量；摘要正负例在基线和 head 都通过，这里是消除重复知识，未声称新增拒绝能力。

3. pytest teardown 在 finalizer 前捕获临时目录中的 locator，等 monkeypatch 恢复和目录处理后再调用小型测试 helper。它检查根目录和 symlink 边界、元数据、认证返回的 ready／PID／指纹，随后复用原实际退出观察。真实源码／复制包、成功／失败测试、保留／删除目录都被覆盖；错误 PID 和外部 symlink 不会关闭外部进程，未退出也不能静默通过。生产五分钟空闲复用行为未改变。

4. 九处 canonical 消费者测试按已经接受的行政文案约定补足正例及显式证明负例，没有改生产准入 owner。普通编辑后直接比较租约历史；显式未获取、已释放或错误版本仍拒绝，完成和不可用 provider 也继续拒绝且不回退 Markdown。暂停路径验证同一 CAS 释放本人的旧租约，陈旧显式证明失败时原状态完全不变。这些断言是由已有规范推导，而不是用新输出生成期望。

5. 历史记录浏览器场景 只代理 pathname 为 /status.json 的请求，含该字符串的页面 query 仍导航到真实前端，后续导航保留传入 base。Frontstage 验收 检查已批准的时光机入口及三个完整案例，并等真实焦点到达原文标题后发键盘事件。页面、首屏、捕获内容和 Lark 交互没有改动。

对主干的风险

最强的反例是 locator 消失但复制包进程仍活着，或者读回了当前源而非备份中的位置。新增的不可变基线／head 对照使用相同驱动和已核对的源文件：Python 是基线 4 个失败、head 4 个通过；TypeScript 是基线 2 个失败加 1 个摘要边界通过、head 3 个通过。它们观察真实 Node 进程、File/SQLite 与 CLI/归档，不用 mock 提供待证明的退出或检查点。未退出断言的注入测试只证明失败可见，实际退出由前面的真实进程用例证明。

复用的较广证据来自完全相同 Git 树 ad925bc674aa22480ccc77919d30506ca704d460：Linux 原固定依赖环境的 21 个完整受影响模块共 714 通过、无失败／错误／跳过；开发／打包环境六条实际恢复／历史旅程，及完整组装站点的中英桌面／手机、三种结果、原始记录和 HTTP404／重试、190 条链接。复用依据是整树及调用者一致、基线一致，没有把旧执行改称本次新运行。Linux 固定依赖不代表最新托管 resolver；本地字体使用声明的真实 bundled 字体，不代表外部字体网络已获资格。初次缺依赖／工具、网络字体超时等历史尝试仍保留失败或中断记录，当前证据不解释旧托管超时根因。

当前 scope 的 Ruff、Node 语法、diff、增量 advisory 后全树语义检查通过；native premerge 的 6 项直接及 19 项选中命令均成功。premerge 总门仍未通过：完整托管资格对应的 required CQR 保持失败，benchmark 敏感面仍有维护者 review hold。当前代码审查依照 native review contract 使用本地证据，未用远程 CI 的运行状态决定代码结论；另行执行的自然 cohort 资格观察也不会使此评审成为完整 CI、合并权限或发布证明。

我的整体评价

这是一段成立的 justified_increment：完整检查五个来源后的代码在真实现有入口提供了可观察改进，也保留恢复与执行边界。没有发现需要修改当前 head 的阻断性代码问题。对未来改动的整理已经落在同一摘要 owner 和最近的测试生命周期 helper；继续抽象为通用框架或重写未变动 owner 缺乏当前调用需求，因此无需扩大本 PR。

当前采用范围仍是提案及本地构建，完整托管六片执行、JUnit／覆盖率、持续 CI 条件、维护者合并及公开采用继续由各自的实际读回完成。作者的完整 CI not_met 项没有被本评审改成通过，required CQR 也未放宽；剩余最重要验证就是既有单次自然 cohort 的终态与完整产物。无需为此退回 Draft、重跑第二套资格、取消其他有效任务或改变 worker、资源、超时及冻结标准。若后续新证据暴露当前代码风险，按精确 head 重新核对。

English verdict: APPROVE — exact head bbe5e84dc6d6539468eaebcd1797c988d8954b21. Local real-boundary review found no blocking code issue. Full hosted qualification, native merge gates, maintainer authority and installed/public adoption remain unqualified and separate.

[songoow]

补充：为什么需要整合验证，以及它没有覆盖什么

针对候选头 bbe5e84dc6d6539468eaebcd1797c988d8954b21，不新增评审或合并结论。

必要性不是“把更多 PR 放在一起”：用户需要同一版本中可靠的恢复读回、研究历史访问、轨迹证据和发布体验。单个来源测试通过，只证明该来源在当时组合下的行为，不能证明与其余修复组合后仍成立。因此本 PR 以正文列出的五个不可变来源、实际 Git 树和正常完整验证入口限定组合，避免把不同版本的通过结果拼接成一个不存在的已验证版本。

这解释了为什么选择明确来源的整合提交，而不再复制实现、另加决策 owner，或通过减少测试/改变资源和超时来让结果变绿。相同树的本地结果、完整收集和真正完整执行也仍是不同证据；作者声明、CI 状态和精确头审查不可互相替代，正文中现有资格要求保持有效。

本批另有 #6624 的运行/检查点拒绝恢复、#6698 的当前 warm 准备核验、#6702 的在线复盘普通结果关联，以及 #6700 的 Goal research 显式分析入口。这些链接是分工说明，不声明本候选已包含它们。 后续若要组合，必须按实际来源版本、差异和重叠变更重新核对，并验证组合头；不能因为标题中有 recovery/evidence 就视为全部缺口已闭合。

整合可靠性也不等于研究有效性。初次质量、长程新增结果，以及分析是否改变下一步选择，仍需各自证据；本补充不把工程测试转换成模型或得分收益，不触发新的模型/benchmark 运行，也不改变来源 PR 或当前源码。