feat(checkpoint): rotate managed checkpoint banks by default

[loopx-agent]

Checkpoint capture otherwise accumulates a complete copy at every boundary. New controller-enabled benchmark checkpoint banks now rotate automatically after a successful capture reply, keeping the latest complete point plus explicitly pinned sources. --no-checkpoint-retention retains every point; --checkpoint-retention-policy FILE overrides the default. Capture itself still requires its existing explicit declaration and controller.

The existing TypeScript artifact owner supplies the single latest-only default and selects uniform or exponentially spaced history, latest/origin/grace protections and exact digest pins. Each default-enabled bank saves its editable private policy. Pins identify a point directory and its manifest digest; arbitrary conversational or experiment references are not automatically discovered. Removing a custom policy option reselects the default rather than disabling rotation.

The local POSIX transport previews the complete plan, can bind execution to its digest, verifies retained members before deletion, rechecks publication generation, quarantines whole points and records recoverable unlink receipts. Missing/changed pins, corrupt retained points, aliases and unexpected point members hold cleanup. Incomplete captures and response/error sidecars are preserved. Shared managed-bank reader locks permit concurrent restores while excluding rotation; maintenance runs separately from the writer barrier and capture reply. Maintenance failures are reported separately and do not cancel source research.

research-checkpoint rotate previews the bank policy, or the typed default if none is saved; --execute is still required to delete. A standalone watcher supports frozen running donors without changing their research runtime. Ordinary single-point capture accepts an arbitrary destination and does not implicitly sweep its parent. Native evaluator banks, scoring, opportunities and budgets keep their existing owners.

Validation on the composed head, including the merged bounded member-I/O repair from #6781:

• 25 TypeScript artifact/retention cases and control-plane typecheck passed.
• 12 real filesystem/CLI cases passed on both macOS and Linux: default policy and editable pins, concurrent readers, stale plans, corrupt newest points, interrupted unlink/recovery and watcher generations/grace expiry.
• 184 benchmark/native cases passed on Linux with real Docker and native HTTP, including default rotation, explicit-off retain-all parity, custom policy, pinned old points, maintenance failure and restore/next-grade behavior. No skipped cases in this set.
• An isolated built wheel passed source-hash checks and actual default CLI preview/apply/verify plus inert materialization. Frontend assets were built for packaging; this PR changes no frontend source.
• Semantic advisory/full inventory, bilingual RFC check, diff checks and private-boundary scan passed. Policy/reason/receipt vocabulary stays local to this artifact contract and grants no Goal lifecycle or execution authority.

This extends the existing CLI/Host checkpoint stage; a packaged frontend retention editor remains open. Mutation is qualified on POSIX, with Windows rejected before moving points. Actual optional Codex-session variants remain unbound; no research gain is claimed. The bounded companion refactor reuses the kernel-lock transport and isolates warm verification/upload under the same read boundary. Shared defaults remain in TypeScript; Python adapts local configuration and filesystem effects. Merge and broader installed adoption remain separate from author validation.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewed exact head 44c44208f2913e222e370f698e8d97acbbf81169 against merge base b5a331d0b9cc8956a109ab45880a492c6bafba4a. No blocking implementation finding found. CI was not fetched, polled or awaited. The benchmark-sensitive maintainer hold remains.

动机

已经显式使用 checkpoint CLI 或原生 benchmark 捕获控制器的操作者。 过去捕获后保留全部点；现在新建受管库默认保留最新点和钉选点，显式关闭时继续保留全部，普通单点捕获仍不清扫父目录。 真实 CLI 的五个合成快照在钉选后清理为原始点与最新点，两者均恢复出原字节；保留点损坏或存在读取者时拒绝删除，释放读取后可继续，未封存内容和旁路回执保留。 不改变评分、任务语义、原生 evaluator 独立快照库、预算、模型执行或 Goal 权限，也不声称任意外部引用会自动被发现。 完整恢复前端、安装版采用、自动发现跨会话依赖、持续大规模存储可靠性和研究收益资格仍由既有验收边界负责。

改动思路

选择策略只有一个 TypeScript owner，Python 负责物理文件与恢复，benchmark adapter 只在成功捕获回执后触发可失败的维护；核心完整性保证与可选采样策略、原生评分权威分开，范围与存储问题相称。 本 PR 交付已有 CLI/Host 阶段的本地快照保留闭环；不交付完整恢复前端、引用自动发现、安装版或研究收益资格。 将完整性检查和原始删除恢复保留为执行硬条件，均匀或分层采样只是同一 owner 的策略；不会把清理计划当成新的运行许可。原生捕获回复先完成，存储维护随后在独立线程执行，后者失败只记录精简错误，不取消仍有用的源研究工作。

路径	保留/副作用	明确边界
普通单点捕获或预览	不清扫父目录；预览不建状态	CLI 安装不等于启用删除
新受管库默认维护	最新完整点＋精确钉选点	未钉选历史可能永久删除
自定义策略／显式关闭	自定义保护／继续保留全部	关闭不恢复已删除字节
读取或删除出错	拒绝危险删除或恢复原隔离区	不重新捕获、不补预算

这是源码路径说明；内容恢复、并发读取和原生后续评分有独立执行证据。

具体改动

先读的基线规范为 docs/reference/research-checkpoint.md，固定版本 b5a331d0b9cc8956a109ab45880a492c6bafba4a；其文档 blob 与目标主干基线相同。explicit-local-artifact-effects：原有捕获与采用仍显式，单点捕获不扫描任意父目录，rotate 默认预览；original-capture-and-member-integrity：保留点完整校验、原摘要钉选和原隔离区恢复已实现；native-admission-budget-is-separate：原生 evaluator、预算和后续机会保持原 owner，并以真实原生恢复后继续评分验证；cli-host-stage-product-qualification：完整前端、安装版与持续研究收益仍 deferred。新增的 latest-only 默认是本 PR 提议并披露的行为变化，不能拿本 PR 新写的规范反过来证明其原先已获接受。

关键代码讲解

1. checkpointRetentionPlan：唯一默认和选择 owner。最新点至少一个；缺失或摘要改变的 pin 拒绝；pin、最近窗口和保护时间叠加。历史采样独立于 pin，避免新增保护反而挤掉原历史代表。
2. rotate_bank / _rotate_locked：要求物理、私有、操作者所有的库；核对保留内容与当前清单，写原身份回执后原子移入隔离区。耗时 unlink 在读取锁外进行，另有单飞锁防止恢复互相竞跑；中断后沿用原隔离区而非重新捕获。
3. checkpoint_bank_use：受管库中的支持读取者使用共享锁，同点读取能并行、删除需独占；未标记库不创建锁状态。原有 CLI verify/admit/adopt、native restore/upload 接入同一传输边界。
4. CheckpointSupervisor._maintain 与 CLI handler：捕获回执后触发维护；默认策略由 typed owner 生成，显式 --no-checkpoint-retention 保留原 keep-all，自定义文件覆盖当前操作。watch 的 execute、时间间隔、错误退出和新发布/宽限触发均有实际测试。

独立验证：25 项 TypeScript、12 项真实文件系统/CLI、6 项模块预算通过，TypeScript typecheck 通过；四文件原生集成 436 项通过。原生 provider 固定到 071a884012754127f28f5b84be10f533a42db527，使用文档要求的 harbor==0.20.0；不可变基线的3项真实 Docker/native 恢复及后续评分亦通过，当前对应3项包含在436中。另建五个不同实际内容版本，经 CLI 钉选原始点并清理后，两份保留内容逐字节恢复，源、未封存文件及 sidecar 不变；保留点损坏、正在读取时均先拒绝，修复或释放后恢复进展。

对主干的风险

这是默认行为变化：未钉选旧点会被永久删除。 需要继续使用的研究来源、双分支接收者和依赖必须预先钉选精确目录 ID 与摘要；系统不扫描任意会话/计划推断引用。改变 pin 前应停 watcher 或静置 supervisor，预览后再恢复。首次启用前已开始的读取，以及旧版或直接 Effect 客户端，也必须钉选或静置。实时编辑策略并不构成对已删除内容的恢复。

标准预合并全部自动项通过：6项直接、10项目录、8项风险与1项公共边界检查；但其最终状态仍是 manual_review_required：benchmark_sensitive 1项人工保留，不能描述为合并门全绿。首次原生运行有149通过/287失败，所有失败同属缺少 harbor.agents 的验证环境；按既有文档补齐隔离环境并回读真实版本/导入路径后，不改源码与断言的同四文件命令为436通过。首次记录保留，未将其归因于评分或产品回归。

本次实际资格是 POSIX 文件、内核锁、CLI 和合成 native HTTP/Docker 输入；不证明恶意同用户并发改写、无限大库持续可靠性、完整 GUI、安装版或研究收益。关闭只停止未来清理；原隔离区恢复和独立副本才是已发生删除的恢复边界。source 研究与 native writer barrier 的既有失败语义未被存储维护接管。

语义与 CI 对齐

复用并扩展既有 runtime.checkpoint_artifacts 与 research-checkpoint 操作；策略及保护原因在 TypeScript，删除阶段是 provider 本地 IO 事实，没有引入泛化的 Goal/Agent 权限状态。diff advisory 报告0个其支持形式的候选，不涵盖所有 type union/dispatch 字符串，因此另作人工完整 owner/调用方比较；不把空扫描当作没有新语义。按当前策略未查询或等待 CI，代码结论与人工合并保留分开。

我的整体评价

APPROVE，交付判定 justified_increment；long_horizon=accepted_tradeoff，user_experience=accepted_tradeoff。 基线已接受 checkpoint 的 CLI/Host 阶段；新默认在 PR、两处文档及关闭/自定义选项明确披露，并有真实默认/关闭/钉选/恢复反例。维护者仍需单独审核 benchmark 敏感改动后才能合并。 新增捕获流程无需额外人工轮次；需要保留历史依赖时操作者必须在清理前钉选其精确摘要，并先停 watcher 或静置 supervisor 再改策略。关闭只停止未来删除，已删除数据只能从独立副本恢复。 成本和不可逆边界已披露，唯一选择 owner、独立 IO 与真实恢复消费者的组合与问题相称，无需额外垃圾回收框架或重复配置。参考恢复评审经验，本次要求了原字节和后续原生合成工作，而非只看计划、摘要与回执；完整用户恢复旅程和科学收益仍未声称完成。此 COMMENTED 结论不授予自合并、bypass、运行真实研究或变更评分的权限。

English verdict: APPROVE at 44c44208f2913e222e370f698e8d97acbbf81169 as a bounded CLI/Host storage increment. Current25TS/12filesystem/6budget and436native tests pass, with3real native restore-and-next-grade cases compared at the immutable baseline. Exact pinned/latest contents survive; corrupt retained points and active readers hold deletion. Latest-only deletion is intentional and irreversible for unpinned history; the benchmark-sensitive maintainer hold, full frontend/installed qualification and scientific utility remain separate.