fix(ci): restore full-public fleet readiness

[JasonBuildAI]

Importance

The daily 514-check full-public-smokes fleet is the project's complete public-behavior sweep and the documented pre-release full readback, and it cannot report ready on main because two public smokes still assert behavior that two intentional changes replaced. The latest run (38970425445, 2026-10-16) recorded 512 passed, 2 failed, 0 timed out, 0 missing, so loopx canary smoke-health returns ready=false. The last green run was 38744587115 (2026-10-15 13:39Z, 514/514, ready=true); the intermediate run 38811582023 was already not ready for a larger, different failure set (508/515, 7 failures, including the vision smoke but not the backup smoke). The two current failures are false: the product output is correct, but the smokes were not updated with the priority-prefix (#6539) and backup-source-capture (#6667) changes. Updating them restores the release-verification signal for the other 512 checks and removes a mandatory waiver from release readback.

What changed

• examples/state-backup-smoke.py: compare the stable registry_discovery projection after fix(backup): refuse registry drift after dependency discovery #6667 added its source_capture member, and validate the new capture itself (the three captured registry sources, 64-char sha256 digests, non-empty archive routes, and ordered start/completion timestamps) instead of dropping the new behavior from the smoke.
• examples/project/goal-vision-refresh-state-budget-smoke.py: after fix(todos): default new work to P1 and preserve successor priority intent #6539, a new agent todo defaults to P1 and the canonical text carries the [P1] prefix while title keeps the authored sentence; assert both instead of the superseded bare text.

No product code changes. The priority contract is already pinned by tests/control_plane_ts/todo_priority.test.ts, and the backup execution witness by tests/control_plane/test_backup_discovery_capture.py; this smoke is the public plan-shape coverage.

Evidence

At f9bdae675 (before):

examples/state-backup-smoke.py:184 AssertionError: {'registry_discovery': {..., 'source_capture': {...}}, ...}
examples/project/goal-vision-refresh-state-budget-smoke.py:638 AssertionError

At this head (8ec0ffb46, rebased onto main dffede5af; patch unchanged):

examples/project/goal-vision-refresh-state-budget-smoke.py | passed | rc=0 | 149.335s
examples/state-backup-smoke.py | passed | rc=0 | 4.611s
status=passed failure_count=0 selected=2

The suite runner at this clean head records both checks as passed. With these two observations passing, the fleet receipt's 512 passed + 2 passed = 514 passed and 0 failed, 0 timeouts, 0 missing scripts, which is the ready=true contract in loopx/canary/smoke_health.py (readiness requires no failed observation). The 514/514 figure is inferred from the last receipt plus these head reruns, not from a full head sweep; the next daily or manual fleet run is the end-to-end confirmation.

The failure evidence is public in run 38970425445's smoke-fleet-health artifact (failure_count 2, timeout_count 0, missing_script_count 0). Superseding changes: #6539 (9c6f4d459) and #6667 (7076a21cf).

Validation

• Both changed smokes: passed at this head through loopx canary smoke-suite.
• ruff check on both changed files: clean.
• git diff --check upstream/main...HEAD: clean.
• loopx check --scan-path on both files: public boundary scan clean (2 files).
• loopx canary premerge --from-git-diff at this head: direct 5/5 passed, catalog 10/10 passed, boundary 1/1 passed, risk profile 7/8. The only failure is the unrelated examples/content-ops-issue-fix-metadata-preview-smoke.py, which fetches live GitHub metadata under the runner's isolated HOME; it passes when run in the normal environment, is not selected by either changed file, and is included by the docs-project-content-ops risk profile.
• Pre-existing local Windows note (not caused by this change): tests/control_plane/test_vision_budget_cli.py fails its 界 parameter on a cp936 host because the test reads the UTF-8 run index with the locale codec (index.read_text() at line 50). That line is unchanged here and the file is green on the Linux CI shards.

Fixes #6739

• Branch state: main advanced to 1ac26edb6 (an unrelated prompt/instruction merge) after this head was reviewed. The head is left unchanged so the exact-head review record stays attached, per the repository rule against force-pushing after review; a maintainer update/merge flow can rebase it.

AI disclosure: this change was drafted with AI assistance at my request, under my direction and review.

[JasonBuildAI]

Independent review of head 8ec0ffb46 against current main dffede5af. Verdict: APPROVE WITH NOTES. This review was performed by an independent AI subagent at my request; I verified and applied its findings.

1. Importance - real, not cosmetic. full-public-smokes is the documented daily/pre-release readback and smoke_health.py requires zero failed observations. Run 38970425445 reports inventory 514, 512 passed / 2 failed / 0 timeouts / 0 missing, ready=false, with the two failures being exactly the changed smokes; run 38744587115 is the last green 514/514. The cost is a mandatory waiver in every release readback and lost signal for 512 checks.
2. Scope - exactly one problem: align two stale public expectations with #6539 and #6667. No product code, refactor, rename, or cleanup.
3. Logic and edge cases - the backup smoke keeps the old exact-dict check minus source_capture, then pins the three captured registry sources, 64-char digests, non-empty archive routes, and ordered timestamps; both sides resolve paths, and the execution step still validates plan hashes against copied bytes. The vision smoke covers both file and sqlite providers and matches the documented priority contract. No order or time dependence found; the lexicographic timestamp compare is consistent with the shipped format.
4. Design - minimal inline assertions; no new abstraction or machinery. Right-sized.
5. Tests - the reviewer reproduced both base failures from upstream/main copies (state-backup at line 184, vision at line 638) and confirmed the head passes; reverting #6539/#6667 would fail the new assertions. The 514/514 head figure is inferred from the last receipt plus the two head reruns, not a full head sweep; the next fleet run confirms.
6. Checks - head runner: vision passed 149.335s, state-backup passed 4.611s, failure_count=0; ruff check clean; git diff --check clean; boundary scan clean. Premerge: direct 5/5, catalog 10/10, boundary 1/1, risk profile 7/8; the only failure is the unrelated content-ops-issue-fix-metadata-preview-smoke.py under the runner's isolated HOME (passes in the normal environment, not selected by either changed file).

No blocking code findings. The one substantive note - the PR/issue narrative incorrectly said run 38811582023 failed the same two checks - has been corrected: that run was 508/515 with 7 failures, including the vision smoke but not the state-backup smoke. Non-blocking nits not applied to keep the fix minimal: length-only sha256 check (execution validates content), lexicographic timestamp compare (matches the shipped format), and no separate priority == "P1" assertion (covered by the product test).

[loopx-agent]

Reviewer: model_agent; model=gpt-6.1-sol; provider=OpenAI; runtime_reported; reasoning_effort=max

动机

维护发布检查的开发者，在运行完整公开 smoke 集合时，需要失败信号对应仍有效的产品契约。

旧 smoke 把新备份计划多出的来源见证和新任务的优先级前缀判作失败；本次在保留原断言的同时核对新见证，并分别检查任务正文与标题。

独立同一命令在固定 base 的两项检查都失败，在当前 head 的两项检查都通过；这恢复了这两个公开检查的有效性。

本 PR 只改两份既有 smoke，不修改产品、优先级、备份安全规则或预算上限，也不证明整套 fleet 已在此 head 全绿。

改动思路

没有阻断项。更小且完整的修复就是在现有两个公开入口中更新被有意替换的期望，不需要改产品返回值、扩大预算、删掉检查或再建一套 smoke。备份的新字段不是多余噪声：它把发现依赖时读到的 registry 字节与真正归档的成员绑定起来；任务 [P1] 是既有 canonical 创建规则，标题则保留原句。

独立读取当前 owner 后再决定期望：todo_create.ts 调用 planTodoCreationPriority；state_backup.py 的 discovery capture 记录时间、hash、archive route，执行阶段仍核对复制字节。此次只修公开验证的消费者，没有增加状态、授权、用户设置、确认轮次或后台任务。相邻未来改动检查认定无需新抽象：两处各自跟随既有 owner 即可。

具体改动

完整 head 8ec0ffb465ed858f3c6ede9f7f2a210a33bbd028，base dffede5af0d8e6c282bff9ff439b0fb1061e2c33；全部2个文件、+23/-2，均为既有 smoke。

规范先读 [Bug]: daily full-public fleet cannot report ready because two public smokes assert superseded behavior，spec_ref=https://github.com/loopx-project/loopx/issues/6739；本次读取正文版本 sha256:8f0763df562b87a8c83d0fb6774b54dc80938f1e622911521e1cb56df1e51f27。逐项映射：source_capture 已实现，稳定的 discovery 字段仍严格相等，并新增三处来源、摘要长度、非空归档路径及时间顺序检查；[P1] 已实现，canonical text 与作者 title 分别断言；ready=true 的整套 fleet 结果仍待下一次完整 sweep，此 head 不以 512+2 的算术替代真实全量读回。

关键内容讲解

1. examples/state-backup-smoke.py:184–216 只从原 exact-dict 比较中剥离已命名的 source_capture，没有将整个比较改为包含关系。新增集合检查要求全局 registry、当前项目 registry、远端项目 registry 三者齐全。原归档执行、成员存在、远端状态、排除旧备份及 current-project-only 断言继续执行。
2. examples/project/goal-vision-refresh-state-budget-smoke.py:638–641 把新任务正文固定为 [P1] 加原文，并新增 title 等于原文。File/SQLite 两种实际 provider 都走完整 smoke；既有 vision 拒绝/预算、原任务逐行不变、验收和原生结算断言未放宽。

既有覆盖检索包括两个 smoke、test_backup_discovery_capture.py、test_vision_budget_cli.py、todo_priority.test.ts 与公开 canary 清单。unit 侧负责优先级/发现期间变动和执行见证；这里负责真实公开脚本的完整组合，两者有不同消费者边界。最近30个同作者 PR 涉及不同 Windows/runtime/维护问题，没有证据表明这是近同时生成的同形重复批次；无需贡献限制或新跟进任务。

对主干的风险

独立验证：同一 smoke-suite 命令在 base 为 0/2 通过，失败点分别是旧 exact dictionary 和旧裸正文；当前 head 为 2/2 通过（vision约45.1s、backup约1.5s）。另 16项 Python owner/CLI 测试、7项 TypeScript 优先级测试通过。原生 premerge 5 direct、10 catalog、8 risk-profile、1 boundary 全过，0失败、0跳过；Ruff/diff 检查通过，没有查询、派发或等待 CI。

对真实临时 IO 产生的备份 witness 分别删 capture、删一处 registry、破坏摘要长度、清空 route、反转时钟，五个受控变体均被当前 smoke 拒绝；这证明断言有区分力，不宣称产品真的产生坏备份。当前 capture 的摘要检查仅校验长度，格式与内容完整性仍由既有执行验证和负例承担；不是新增的密码学验证。时间比较依赖 owner 已固定的同一 ISO 格式。两点均无须为此小修另建框架。

作者此前记录的隔离 HOME 下 live metadata smoke 失败，本次原生 premerge 的相同风险检查实际通过；只说明当前所需本地检查没有未解决失败，不宣称已解释历史环境故障。Windows cp936、历史 hosted fleet 数字和完整 head sweep 本次没有重跑或查询。没有把两项局部通过记成514项通过。

我的整体评价

APPROVE，当前完整 head 8ec0ffb465ed858f3c6ede9f7f2a210a33bbd028。本次对长期持续工作的改善是让公开验证再次识别真实回归，避免后续版本不断豁免同一已过时断言；用户交互保持原样。来源见证和优先级的决策仍由原 owner 唯一承担，smoke没有创造新 vocabulary 或改写安全/预算门。

此次独立完整切片是修复这两个公共验证信号；最终 fleet ready=true 需在准确候选上完成整套 sweep后才能宣称。当前没有阻断代码发现；最强未验证项是全量准确候选的跨平台 fleet。APPROVE 不包含合并、CI派发、回滚产品契约或变更其他评审结论的授权。

English verdict: APPROVE - 8ec0ffb. Both stale public smokes fail on the immutable base and pass on this head; new capture assertions reject five controlled corrupt witnesses. 16 Python tests, 7 TypeScript tests and all local premerge checks pass. Full-fleet readiness and Windows qualification remain unverified.