fix(coordination): make Stage 2C capture and rollback recoverable

[wchwawa]

Summary

Bind each real primary mutation to recoverable Stage 2C capture. Cursor cleanup requires verified history, receipt and source bytes; qualification folds complete history and current Todo, handoff and lease state. Rollback archives the candidate and entire Goal outbox before publishing inactive, and rebootstrap starts a fresh lineage. Native Todo retains its own transaction contract.

The requested-change revision unifies Python/TS cursor progress for abandoned writes, adds complete caller observations across absent/disabled/enabled capture, fixes rollout placement from an unrelated cwd, and consolidates seven captured-primary persistence sequences in their existing adapter. The cursor finding is reproduced on the reviewed head before repair. The RC product delta is 47 additions / 49 deletions across nine existing files.

The fence-remediation revision (round 4) gives the shared write check a single responsibility, the stable typed reason plus the fence binding facts, and moves every operator-facing remediation to the two in-process caller adapters, which render one provider-neutral template from that data and carry the complete check result under write_check. That nesting also repairs a defect present on both the baseline and the reviewed head: the check's schema_version used to overwrite the task-lease envelope's, so every fenced CLI lease rejection printed RuntimeError. A fenced native acquire is now typed at its catch site as a receipt-free validation / permission_denied rejection, the shape its renew/transfer/release siblings already had on the baseline; the baseline's fabricated committed validation receipt is not restored, and the delta is recorded. Every terminal or holder verify branch checks the fence before its first receipt, so a preview under a fence reports the typed rejection instead of a successful preview of a forbidden write. A 46-row parity fixture pins the complete envelope, exit status and effect snapshot of every fenced writer entry point, five new mutants prove the rows are sensitive, and correctness.md states the contract with a nine-row baseline-delta table.

This is capture lane C and pre-promotion candidate retirement. The roadmap records the I/F and local-persistence L handoff, bridge/legacy removal conditions and the >=10-natural-day soak requirement. Old mixed histories remain read-only and ineligible; independent observation remains available pending Q14. Sustained parity is not_evaluated, and the nine undelivered ladder capabilities remain pending.

Issue Or Task

Shared Goal Authority RFC / Stage 2C correctness and recoverable rollback. No issue is closed. NoKV/Holt changes, remote parity, production promotion and #3820 are outside this batch.

Validation

• Round 4 (head 507b9f17a; main merged twice, first for the projection-module move of Recover Todo Markdown projection from canonical authority journal #4038, then for the promoted-claim compatibility tests of fix(todo): align claim agent-id folding and rejection exception contract #4020): fenced sibling-caller parity 21 TypeScript entry rows + 25 real-process CLI rows pass whole-object; render-identity test proves the Python and TypeScript adapters emit byte-identical remediation for seven guard shapes; five new mutants (TS remediation truncated, Python remediation truncated, check result spread flat, acquire receipt fabricated, lifecycle guard skipped) each killed by exactly one row with passing controls; full Python suite 6,664 passed / 25 skipped with 12 failures that are environment-only and identical on the current main checkout in this environment (nine repository-change-window git-hook tests, the doctor runtime-readiness and installation-scope tests, and the CI-workflow shard test that needs the pytest-split plugin); TypeScript control plane 776 passed / 1 PostgreSQL integration skipped; typecheck, configured mypy (21 files), pinned Ruff on the CI surfaces, generated-contract check, docs governance and asset smokes, git diff --check, and premerge canary all pass.
• Cursor TDD: reviewed head 1 failure / 1 control pass; rebased Todo/lease matrix 4 failures / 4 controls pass. All 12 new recovery/forged-digest cases now pass through real CLI/native processes and actual FileAuthorityStore commits.
• Caller comparison: the same 54 cases against both sources, in three switch modes; head 54 pass, base 43 pass / 11 intended-fix failures. Complete arguments, diagnostics, exit status and before/after file bytes are retained (340 base / 350 head recorded invocations). Source replacement, qualification gates, enriched native errors and corrected relative-root placement are explicit behavior changes, not asserted equal.
• Full Python: 6,498 passed plus 3 subtests; 25 existing platform/environment/ladder skips separately recorded. Mandatory E2E: 187 passed, zero skips.
• Full TS: 732 passed, zero skips on Node 22.6, including an isolated real PostgreSQL instance.
• 32 semantic mutants: every unchanged control passed; every mutation failed its intended assertion. Receipt/lineage/fence removal, lock ordering, duplicate mirrors, early committed markers, CAS removal, cursor regression, note intent and diagnostic truncation are covered.
• Wheel and sdist: each passes 5 mandatory checks / 18 real processes in empty environments outside the checkout. Every shipped Python/TS/JSON file matches the immutable final commit: 1,001 wheel resources / 1,123 sdist resources, including 1,000 product resources each.
• Ruff, mypy, TS typecheck, generated contract, CLI output smoke and diff checks.
• Premerge: all 18 selected checks passed, including unchanged maintainability budgets, compile and public/private boundary checks.
• New-head CI: Linux shards, Windows, coverage, DCO, dependency review, build and separate E2E/package job passed. Downloaded artifacts independently confirm 187 E2E cases, 32 mutants, both package runs, 54 complete caller records and 1,730 source hashes matching the actual CI checkout and identical PR tree.

Baseline: 0fb497af83dcb697f1617657869f05fd48668d2e. Head: ee1b17217c4d21be0da348097bccf84a1517bb03. Nineteen DCO commits; 94 changed paths (round 4 adds two merges of main and seven signed commits). Recovery/invariant mappings and reproducible commands are in correctness.md. The existing separate E2E job now uploads complete head caller observations alongside JUnit, mutant and installed-package evidence. Sonar analysis was skipped because the token is unavailable; its wrapper success is not an analysis result. CI TS has 706 passes / one PostgreSQL placeholder skip; the local run executes the corresponding 26 real PostgreSQL tests. Author evidence and CI do not grant reviewer approval.

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Core control-plane hardening

• Long-horizon benchmark evidence

• Operator surface and IM integration

• Shared Goal Authority and cross-host coordination

• Architecture and research incubator

• Target base branch: main.

• Direction tracker or promotion unit: Shared Goal Authority Stage 2C; this PR grants no promotion authority.

Boundary Checklist

• I did not commit .loopx/, .codex/goals/, live ACTIVE_GOAL_STATE.md, credentials, private benchmark traces, verifier output, raw agent sessions, internal document links, or local machine paths.
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

[huangruiteng]

架构方向评审：迁移准备、现有基线与后续收敛

Reviewed head: 36e3ff617f77d2dca0163a73d42367ca82690d72
Diff baseline: 8f72c21944b9d5ce9a130a7e962939e80c93c43e

结论：方向上支持将本 PR 定位为“迁移前事务捕获与候选撤销的正确性修复”。它增强现有 writer 边界，为 authority 迁移提供必要证据，但不切换默认 authority，也不完成 Stage 2C promotion。 本次按请求发布架构方向 COMMENT，结合定向源码核查和验证；不作合并批准。合并级全表面 default-off parity 与完整资格证据仍有本轮未独立验证的部分，不能从绿色 CI 推断完成。

动机

当前主状态仍由 legacy Markdown 与 task-lease 路径持有。候选账本若漏掉一次已提交变更、重复记录同一变更，或根据未经证明的 cursor 清理 outbox，那么最终快照即使相等，也不能证明候选历史可用于迁移。bootstrap/rollback 过程中若中断后无法恢复，迁移演练本身还会让正常 writer 长期停在维护状态。

因此这里的产品收益是：绑定真实主写入，保留崩溃与响应丢失后的恢复证据，并能准确撤掉尚未接管的候选。只修一个 cursor 条件不足以覆盖这些跨 Python/native writer 和多文件持久化窗口。与此同时，修复这些窗口不等于取得新的 Todo 事务能力、长程存储容量或生产 promotion 资格。

改动思路

与近期重构应按三个维度区分：

路线	已有方向/改动	本 PR 的位置
TS 语义与事务 owner 收敛	#3972 将默认与 promoted claim 接到同一 decision；#3973 原生 create；#3974 原生 update	围绕既有 owner 补 capture/maintenance/fence，不新增 complete-with-successor 或 archive 事务族
canonical authority 迁移	shared-authority RFC 的 C → I → F：capture、binding/资格集成、promotion/清理	主要补 C 的有界正确性和晋升前候选恢复，为 I/F 提供前置证据
长程本地持久化	#3960 与 RFC §7.2：嵌入式事务存储候选、有界热路径、容量与至少十个自然日 soak	尚未交付；file-v0 继续承担有界 conformance/import 演练

正向链路是：显式 bootstrap 建立 source/store/capture-lineage 绑定 → writer 持主锁 durable prepare → 提交主状态并记录 committed 证据 → 释放主锁后 drain → TS 核验事务历史/receipt → 持久 cursor 并清理已证明的文件 → qualification 对照当前 Todo、handoff 和 lease。管理状态转换由 TS 持有，Python shadow_management.py 是主写锁内的只读 guard。

我在 base/head 对照了旧 mirror、独立 observation、runtime-shadow 管理入口，以及未改动的 executeCoordinationTodoUpdate owner：本批删除 Todo/lease 旧 mirror，并把独立 observation 移入具名模块；native Todo 保留自己的 receipt 合同。这种收敛和有理由的兼容隔离，与 replacement-first 方向一致。独立 observation 的保留不应被解释为又一份协调决策 authority。

具体改动

全 diff 为 92 个路径、+10,862/-5,113。按文件职责归类：43 个非生成产品文件、2 个生成 binding、42 个测试/fixture/验证工具文件、2 个文档、3 个构建/CI/generator 文件。loopx/ 含生成物净增 1,098 行；大部分总行数来自验证，不能仅凭总 diff 大小判断产品复杂度。

• CLI 与 writer：Todo、lease、handoff、followup、event writeback 接入统一捕获；bootstrap、registry、state migration/rebuild 增加 source/fence 防护；refresh/reward 等 prose writer 校验协调状态不被顺带改变。共享原子写入 helper 与跨 runtime 锁也会触及普通路径。
• coordination：严格验证 outbox identity、原始字节、cursor 和完整历史；新增可恢复管理 journal/manifest；FileAuthorityStore 提供 existing-only 访问与固定 archive 目标；canonical Todo writer 参与 maintenance 边界。
• 验证与交付：增加真实 CLI/native 进程、崩溃/丢失响应、并发、跨 Goal/source override、安装包验证及 semantic mutants；CI 单列 Stage 2C E2E，并调整 pytest/sharding 依赖与锁定输入。这些是额外维护面，需要和运行时代码一起评审。

关键代码讲解

1. qualifySnapshot：验证 source、完整 lineage 和 pending outbox，再核对当前 projection 与 mutation coverage。结果明确为 scope=bounded、sustained_parity_verdict=not_evaluated、decision_read_from_shadow=false；qualified 不能被下游解读成生产晋升许可。
2. rollbackManagedShadow：以精确 revision 或待完成 bootstrap identity 为选择器，验证并归档 candidate 和完整 outbox，最后发布 inactive。恢复依赖 manifest 和实际字节，不能只相信 phase/result。外层 pre-promotion guard 拒绝已建立 legacy fence 的路径。
3. require_runtime_shadow_capture_prepared：active binding 下 prepare 失败会阻止主写。关闭配置不取消已有 capture 义务；这是机器执行的写入前置条件，不是 advisory observation。
4. withCanonicalWriter：在既有 native transaction owner 外统一获取 maintenance 锁并复查管理状态，避免 Todo 更新与管理操作交错；它没有重新实现 Todo decision。

对主干的风险

最值得区分的是“从未启用”和“已建立 active binding 后把配置关掉”。前者应保持普通 writer 的既有可观察合同；后者仍需 capture，prepare 失败就 hold，恢复或显式退役后才能继续。已核对 correctness.md 对这项行为有明确说明，也核对了非法 journal、prepare 失败、跨 source override 等失败路径。比如 active capture 的 durable prepare 抛错时，handoff writer 必须由 ShadowManagementError 拒绝，主状态字节保持不变；不能吞掉错误后继续写。

本轮独立验证（macOS，Python 3.13 / pytest 8.4.2，Node 25.5.0；不是作者的锁定 Linux/Python 3.11/Node 22.6 环境）：

• Python：test_shadow_cursor_safety.py、test_shadow_management.py、test_shadow_writer_boundaries.py、test_runtime_shadow_bounded_e2e.py，84 passed，0 skipped。包含真实 subprocess CLI/native FileAuthorityStore 读回、关闭配置仍保持 active capture、writer failure 边界。
• TS：coordination_runtime_shadow、shadow_management、shadow_cursor_safety、file_outbox_qualification、shadow_native_writer_boundary 五个模块，68 passed，0 skipped。
• generated-contract --check 与 base/head git diff --check 通过。

未独立完成的证据：所有共享改动面的 base/head × enabled/disabled 成对验证；全量 Python/TS、真实 PostgreSQL、25 mutants、wheel/sdist 及所有平台组合。本轮未将作者声明或 CI 状态记成这些项目的 reviewer-verified 结果，也未验证持续 parity、event-only Todo recovery 或十天 soak。生成 schema identifier 和只读 Python guard 的存在，也不自动证明全部跨语言 decoder 语义一致。

状态/权限表述上，本批以具名 management status、lineage/receipt 与 source binding 作依据，核心错误语义与 Goal 类型无关；没有发现需要把这批工作解释成 agent 权限扩张的依据。native lease failure envelope 中仍有按 reason-code 前缀分类的规则；本轮未证明它在所有 failure class 上的完整性，不作“全部 typed-state 分类已收敛”的结论。后续若扩展失败类别，应按显式错误类别验证，避免新增错误被误归为 validation 或 durable-writeback。

我的整体评价

这是有价值的迁移准备批次，但它的收益应按“捕获与恢复正确性”计，不按“新基线可用”计。 当前共享锁、统一原子写入和旧 mirror 删除属于同域的有界重构；管理 journal 的新增有崩溃恢复理由。更广的 legacy writer/bridge 删除应随真实 caller cutover 交付，不宜在本批扩大。

建议在 PR Summary 或 canonical RFC 中补一段紧凑的路线/退出说明，复用现有文档即可：

1. 明确归属 C lane；本批结束仍 hold 哪些 I/F 条件，以及它与 #3972/#3973/#3974 的汇合点。pre-promotion candidate rollback 与 promotion 后 fenced export/rollback 分开列，避免标题里的 rollback 被理解成完整迁移回退。
2. 给过渡部件注明保留/退役条件：legacy capture、独立 observation、Python guard/bridge，哪些是兼容期需要，哪些在最后一个 caller 切换后删除。下一批报告删除的 product LOC、新增 bridge LOC、runtime crossings 与剩余删除条件，沿用 TS RFC 的经济性要求。
3. 保持 file-v0 的有界定位：当前 10,000 笔 proof boundary 不证明十天容量；长程本地存储、有界热路径与自然时间 soak 在 L lane 完成后汇合。不要把本批通过测试等同于放开 production promotion，也不要为了补齐 roadmap 把这些独立切片全部塞入本 PR。

参考：TS migration RFC、Shared Goal Authority RFC。上述是方向与后续范围建议，不是声称本轮已完成完整合并资格审计。

[huangruiteng]

English verdict: COMMENT — architectural alignment, not merge approval, at exact head 36e3ff617f77d2dca0163a73d42367ca82690d72.

This PR primarily hardens pre-promotion transaction capture, qualification, and candidate retirement. It complements the replacement-first TypeScript Todo slices (#3972/#3973/#3974); it neither switches default authority nor delivers post-promotion fenced export/rollback, sustained parity, or long-horizon storage qualification. The active binding is a write prerequisite: disabling configuration does not cancel capture, and failed durable preparation holds the primary mutation.

Please add a concise roadmap/retirement note using the existing RFCs: place this batch in capture lane C, distinguish candidate rollback from post-promotion rollback, name the handoff to I/F and local-persistence lane L, and record removal conditions for legacy capture/bridges. Keep file-v0 bounded rather than treating these tests as production-promotion evidence.

Reviewer-run validation: 84 Python tests and 68 TypeScript tests passed with zero skips, including real CLI/native file-provider paths; generated-contract and diff-hygiene checks passed. These used macOS/Python 3.13/pytest 8.4.2/Node 25.5.0. Full cross-surface base/head disabled/enabled parity, the locked Linux/package/mutant matrix, and real PostgreSQL were not independently rerun; author/CI claims are not substituted for that evidence. Promotion holds remain unchanged.

[huangruiteng]

动机

Reviewed head: 36e3ff617f77d2dca0163a73d42367ca82690d72；diff baseline: 8f72c21944b9d5ce9a130a7e962939e80c93c43e。

本次结论是 REQUEST_CHANGES。这是完整改动面的正确性审查，不是沿用前面的架构方向 COMMENT；下面区分已复现缺陷、独立验证结果和仍未验证的合并资格。

本 PR 要解决的是候选 authority 的事务捕获与撤销能否在进程死亡、响应丢失、并发 writer 和多文件更新之后恢复。旧的提交后 snapshot mirror 可能重复观察或错过中间事务；仅比较最终快照，无法证明每次主写都被准确记录。游标也不能凭自身存在就授权删除证据。因此收益是可验证的捕获历史与可恢复的候选管理，而不是把 shadow 变为默认 authority。一个清理条件补丁不足以覆盖所有 writer 和管理窗口，但每项新持久状态都必须有实际恢复用途。

改动思路

正向流程是：显式 bootstrap 在源锁下验证注册路径、主状态和 lease inventory，建立 source/store/lineage 绑定；Python Todo 或 native lease writer 在原有主锁内 prepare，提交主状态后写 marker；释放主锁再 drain；TS 用真实 FileAuthorityStore 的历史、receipt、source continuity 和原始字节验证事务；Python 更新恢复 cursor 并回收已证明的残留；inspect/qualify 再对照当前源和候选。管理状态由 TS 持有，Python management 模块负责写入前检查，不重新实现 Todo decision。

rollback 的范围是 pre-promotion candidate：保留精确 request/manifest 及 candidate、整个 outbox 的归档证据，最后发布 inactive；中断后重入同一操作，不复用另一 Goal 或另一 lineage 的结果。rebootstrap 建立新 lineage；历史操作 replay 不等于重新审计旧归档的当前字节。已经 canonical 的 Todo 则保留原事务/receipt owner，只增加 maintenance 排他。

复用方面，base/head 对照覆盖旧 CLI mirror、独立 observation、outbox capture/drain、管理入口及其 writer callers：删除重复 snapshot mirror 是有意义的收敛；保留具名 legacy observation 有明确兼容边界，不能把它当 transaction qualification。共享 atomic replacement 和 source guard 比各 writer 自建规则更合适。仍有一个实际重复知识问题：Python drain 和 TS inspect 各自解释 cursor digest，现已出现分歧，见下方 P2。

具体改动

全 diff 为 92 个路径、+10,862/-5,113；其中测试目录 40 个路径、+5,712/-1,840，另含 examples 验证工具与生成 dependency lock。不能把新增验证行数等同于产品复杂度，也不能因此忽略横跨共享 writer 的风险。

• 源写入面：Todo add/update/complete/supersede/archive/followups、event completion、handoff、lease acquire/lifecycle、turn 和 CLI 错误出口接入边界检查；bootstrap、项目 registry、配置、迁移/重建检查 source replacement；refresh/reward/status-server 等 prose writer 保留协调投影并防止覆盖并发结果。事件 completion 的原 reducer/successor 逻辑移入排他范围，不应被误认为已实现 event-only outbox recovery。
• 协调与持久化：Python/TS outbox 绑定 source/root/lineage/sequence；history 验证、cursor proof 和 raw-byte reclamation 替代水位清理；新增 management state/manifest；FileAuthorityStore 的 existing-only/归档支持服务真实 bootstrap/rollback callers。旧 observation 提取到独立模块。
• 契约与验证：JSON schema 源及生成 Python/TS bindings 升级 outbox entry/marker/request/event/receipt 标识，新增 management schema；真实进程 fixtures 覆盖混合 writer、维护互斥、跨 Goal/source、崩溃、响应丢失与 replay。native canonical consumer fixtures 明确初始化已存在的 canonical provider，不再冒充 promotion 测试。
• 交付面：CI 单列 Stage 2C E2E、mutants 与 wheel/sdist；pytest/sharding 依赖更新并增加带哈希的工具锁。README/correctness 文档解释启用、撤销、rebootstrap、旧历史只读和 bounded qualification；九项长期 ladder 仍 pending，不宣称 sustained parity。

关键代码讲解

1. runtime_shadow.ts:241 qualifySnapshot：持 management/source 锁验证绑定和完整历史，再通过 pending-outbox 及当前投影检查生成 bounded qualification；它不是 promotion 许可。
2. local_authority_shadow_adapter.py:691 _PartitionDrainer._reconcile：在重新检查 cursor、entry inventory 和 source binding 后写持久 cursor，再回收 receipt 已证明的文件。这里目前把最后 transaction 的完整投影摘要写进 last_partition_digest，是本次缺陷的一端。
3. runtime_shadow.ts:235 pendingOutbox：从同一 partition 的历史中找最后一个 no_op === false 的 receipt；不存在时预期 digest 为 null。这与上一个 symbol 对首次 abandoned transaction 的解释不同。
4. shadow_management.ts:481 rollbackManagedShadow：以精确 revision/unfinished-bootstrap selector 驱动管理阶段，验证 manifest、归档和重入结果，最后切换 inactive。错误/重试归管理 owner，而非普通 Todo writer。
5. local_authority_runtime.ts:74 withCanonicalWriter：非 preview 的 canonical create/claim/update/edit/mutate 在 maintenance 锁内复查状态并完成真实 provider commit；保留原 Todo owner 和 receipt 合同。

对主干的风险

[P2] 首次主写在 replace 前死亡，drain 成功后却产生 inspect 不接受的 cursor

复现使用合成、一次性 workspace，调用真实 CLI 和真实文件 provider：

1. bootstrap 后 inspect 为 matched，尚未有任何已应用的 outbox mutation；
2. Todo add 在主状态 atomic replace 之前被 SIGKILL，主状态字节保持不变；
3. authority-shadow drain 返回 ok=true、no_op=1；
4. 随后 coordination-shadow inspect 返回 outbox_cursor_unproved。

独立回归用“首次 abandonment”和“先成功应用一个 mutation，再 abandonment”两组相同恢复流程：1 failed / 1 passed，后者会掩盖这个边界。不是把 setup failure 算作产品失败。

原因是 Python _reconcile 在上述 no-op transaction 后写入 unchanged baseline projection 的非空 digest；TS pendingOutbox 却预期最后 applied receipt 的 digest，尚无 applied receipt 时就是 null。Python 自身已有 cursor 的验证也采用 projection digest。因此只改写入端或只改一个比较条件，都不足以证明两个恢复消费者重新一致。

影响是一次合法、已恢复且没有改变主状态的中断，让候选后续检查/资格流程被错误阻塞；这里没有证明主状态数据丢失。最小修复应明确统一 cursor digest invariant，覆盖 bootstrap-only/no-op 前缀、已有 applied 前缀以及后续正常 mutation，保持严格的 forged-cursor/raw-byte proof。请增加 恢复后再 inspect/qualify 的组合回归，覆盖 Todo 与 lease 两种 partition；不要通过删除校验或手工清 cursor 掩盖问题。现有 crash tests 只证明 drain/receipt 成功，不证明下一消费者接受恢复结果。

独立验证与资格缺口

本次跨连续审查段独立执行了：Python drain 三套 48 passed；runtime-shadow 三套 28 passed；management 25 passed；writer/并发 40 passed；native-update/cursor/migration/outbox 64 passed。TS outbox 17 passed、runtime-shadow 11 passed、management 24 passed、cursor/native-writer/local-runtime 51 passed。不同批次按模块报告，不把总数包装成全量 suite。

本 head 重新构建的 wheel 与 sdist 均在空 venv、checkout 外通过 5 个 mandatory checks / 18 个真实进程：安装资源、bootstrap、三次 mutation/精确 receipt、默认 qualification/candidate read、rollback/inactive write/new lineage。环境是 Python 3.13.13、Node 25.5.0，不是作者的 Linux/Python 3.11/Node 22.6 组合。生成 dependency lock 是 CI 输入，不代表本机复现了该平台。

远端 checks 为成功或预期 skip；Sonar 的 wrapper 成功不代表 token 缺失时执行了分析。本人未独立跑全量 Python/TS、真实 PostgreSQL 或长期 soak，不把作者声明转换为 reviewer-verified。所有共享改动面完整的 base/head × enabled/disabled 成对可观察语义 也仍未完成：尤其 accepted input、完整 diagnostic/拒绝优先级、参数持久化独立读回与无副作用；因此 default-off parity 仍是 not_yet_proven，不是因普通测试绿色就等价。

契约明确区分从未启用与 active binding 后关闭配置：后者的 capture 是机器强制前置条件，不是 guidance。core management/source 错误基本保持 Goal-neutral，协议也没有声称新增 peer 权限。对全部异常分类分支的完备性不作未经验证的保证。

四个额外 semantic mutant（cursor regression、early committed marker、native update maintenance、duplicate mirror）均以通过的 unchanged control 对照，触发了预期 assertion failure。一次 native control 曾在并行安装包验证期间遇到本机磁盘空间不足；该次不计为 mutant 命中，临时环境退出后单独重跑的 control 通过，mutant 才按断言被捕获。没有宣称独立完成作者的全部 25 mutants。

我的整体评价

REQUEST_CHANGES，精确绑定上述 head。 捕获、源排他和可恢复撤销有明确产品价值；相关 writer、CLI、store、schema 与验证工具属于同一恢复边界，但这个批次不是“行为保持的机械重构”。已披露的旧 mirror 退役、active-binding 义务和 promotion 限制必须继续按行为变化验证。

面向下一次改动的有界重构建议，是在现有 coordination owner 内统一 cursor proof 的语义来源，同时保留 Python 文件适配和 TS 状态/receipt authority；不要再加第三套恢复规则或泛化框架。更大的存储迁移与长期容量验证留在既有后续阶段。代码量/投入收益的完整合并级判断仍以修复后全 inventory 的语义与资格证据为条件，不因本次找到的缺陷修复就自动批准。

复审至少需要：首次/已有 mutation 两类 abandonment 的跨消费者回归、严格负例仍生效，以及剩余 default-off/可观察语义资格。修复后需重新核对全部相关入口，不能只重跑触发这一条 finding 的测试。

English verdict: REQUEST_CHANGES at 36e3ff6. A real first-write SIGKILL before primary replacement recovers as a drain no-op but leaves a cursor rejected by inspect: Python records the baseline projection digest while TypeScript expects null without an applied receipt. Independent regression: one failing initial-abandonment case and one passing prior-mutation control. Focused real-process suites and both independently installed distributions pass; full baseline/default-off semantic parity and full backend qualification remain unverified. Unify the cursor invariant without weakening proof checks, then re-review the affected caller inventory.

[wchwawa]

Addressed at ee1b17217c4d21be0da348097bccf84a1517bb03, rebased onto 0fb497af83dcb697f1617657869f05fd48668d2e.

The P2 is valid: the reviewed-head regression produced 1 failure / 1 prior-mutation control pass; the rebased Todo/lease matrix produced 4 failures / 4 controls. Both consumers now use the existing validated partition progress marker: null before an applied mutation and unchanged across abandoned/no-op entries. All 12 new cross-consumer recovery/forged-digest cases pass. Receipt, lineage and raw-byte proof checks remain enforced, including through mutants that remove them.

The same 54 caller scenarios run against both sources across absent/disabled/enabled capture, retaining complete arguments, responses, diagnostics and before/after bytes. Head passes all 54; base has 43 passes / 11 explicit intended-fix failures. These cover source replacement/migration holds, candidate/event-only qualification, native error preservation and relative-root evidence placement; they are not asserted behavior-neutral. Native ownership/note intent, rejection priority, lease lifecycle, HTTP reward, followups and monitor successors retain their semantics. Six additional public supersede variants also pass on both sources. The one-line rollout root fix came from this comparison.

The future-facing pass reuses the cursor owner and consolidates seven captured-primary write sequences in the existing adapter. No budget exemption or recovery framework was added. The roadmap in correctness.md records lane C → I/F/L and retirement conditions; candidate rollback, Q14 and production promotion remain distinct.

Final local evidence: 6,498 Python passes (+3 subtests; 25 existing skips separately recorded), 732 TS passes with real PostgreSQL, 187 required E2E passes, 32/32 assertion-killed mutants, both isolated installed distributions, and all 18 premerge checks. New-head CI passes. Its downloaded artifact confirms the 187/32/package results, 54 complete caller records and 1,730 hashes matching the actual merged checkout and identical PR tree. Sonar analysis was skipped for unavailable token; no analysis or reviewer approval is inferred from its wrapper.

Ready for re-review. Sustained parity remains not_evaluated, and the nine undelivered ladder capabilities remain pending.

[huangruiteng]

Reviewed exact head: ee1b17217c4d21be0da348097bccf84a1517bb03 (baseline 0fb497af83dcb697f1617657869f05fd48668d2e).

动机

这个 PR 要把 Shared Goal Authority Stage 2C 从“提交后尽力镜像”收紧为可恢复、可证明的预晋级捕获：每一次真实 Markdown Todo 或 task-lease 主写都先留下 durable outbox 准备记录，主写成功后再确认；drain 只能依据完整 provider history、精确 receipt 和源字节证明来推进 cursor 与回收文件。它还补齐 bootstrap/rollback 崩溃恢复，确保候选 authority 与整份 Goal outbox 在退役时一起归档，且整个阶段仍不授予候选读写决策权。

改动思路

总体边界是合理的：TypeScript 继续拥有状态机、历史折叠、receipt 和 FileAuthorityStore 的权威语义；Python 只负责现有 writer 的锁内 prepare/commit bridge、源状态投影与 drain 编排，没有另建第二套 authority decision。shadow_management.ts 用持久化 journal/immutable manifest 管理 bootstrapping → active → rolling_back → inactive；writer 路径按 M → T → S → L → K 的顺序与管理操作互斥。local_authority_shadow_outbox.*、local_authority_shadow.ts 和 adapter 把 Todo/lease 分区序列、markerless 恢复、连续 receipt、provider revision 和 cursor 锚定到同一 lineage。rollback 使用 provider 自有的 archive path，并在发布 inactive 前核对候选与 outbox 归档。

正向路径是：bootstrap 验证注册 runtime/state 与源字节，提交无 receipt 的 baseline，发布 active binding；writer 在主锁内 prepare，原子主写后提交 marker；drain 重新验证 binding、源、outbox 文件与完整 history，再由 TypeScript 进行单 transaction commit，最后写 cursor 并逐个回收。负向路径包括管理中 hold、错误 Goal/runtime/state override、不可证明的 markerless entry、伪造 cursor/receipt、event-only source、历史不连续、精确 rollback selector 不匹配，均保持主状态或现场不变。

具体改动

全量 diff 为 94 个文件、+11,723/-5,163。按职责分类：45 个生产/构建文件 +4,342/-3,261，41 个测试文件 +6,468/-1,861，4 个 examples/文档/验证程序 +807/-20，3 个生成协议文件 +41/-20，CI +65/-1。核心生产面包括：management journal 与 rollback archive；严格 history/cursor/partition fold；Python Todo 与 TS lease 的两阶段捕获；跨 runtime/source/Goal fence；FileAuthorityStore existing-only 读取与 archive durability；bootstrap、project/registry、migration、handoff、reward、followup、event writer、CLI error envelope 与 registry-relative runtime-root 接线。独立 observation 路径被移出主 adapter，仍保持其原有、非 transaction-correlated 的证据语义。

验证面新增独立 Stage 2C CI job、真实进程 SIGKILL 恢复、轮子/源码包空环境安装、32 个语义 mutant、完整 caller observation 和 correctness 操作说明。我的独立验证结果：当前 head 的 cursor + caller E2E 66/66 通过；相同 caller suite 在基线为 43/54 通过、11 个声明的修复场景失败；TypeScript 全量 732/732 通过且包含隔离的真实 PostgreSQL；git diff --check 与 public/private 路径扫描通过。远端 DCO、build、Linux/Windows、coverage 与 Stage 2C job 均成功。完整 Python 6,498、installed-package 与 32-mutant 数字来自 CI/作者证据，本次未在本地重复跑完。

对主干的风险

[P1] 原生 task-lease fence 拒绝丢失了可执行恢复提示，而且 settlement 形状也未被覆盖。 在真实 executeTaskLeaseAcquire 入口、相同合成 authority、已持久化 engaged legacy fence 下，基线返回 legacy task-lease writer is fenced; use the canonical file authority；当前 head 只返回 legacy coordination writer is fenced。两边虽然都有 legacy_coordination_writer_fenced，但新错误不再告诉 operator 下一步应改走 canonical file authority。这与此前 --note 问题属于同一种 review 漏洞：只验证 parser/decision code 或“都拒绝”，没有验证完整诊断与 remediation 穿过实际 caller adapter 后仍然等价。

直接原因在 loopx/control_plane/coordination/legacy_writer_fence.ts：新的 LegacyCoordinationWriteError 从 payload.reason 取消息，而 blocked guard 没有 reason，于是落到泛化 fallback；executeTaskLeaseAcquire 又原样封装它。现有 native_diagnostic_truncated mutant 只变异 canonical Todo update，54 行为矩阵也没有构造 engaged fence 后调用原生 lease acquire，因此全绿仍漏掉这条 sibling caller。

同一复现还显示 settlement 从基线的“validation committed receipt + durable_writeback failure”变成“零 receipt + validation failure”。guard 提前到副作用之前可能正是更准确的分层，但这也是 public response 的可观察变化，当前没有独立 contract/oracle 说明它是刻意修复还是非预期漂移。修复时请：保留稳定 machine code，同时在 caller adapter 边界恢复具体、domain-neutral 的 canonical-authority remediation；为 acquire 及相关 renew/transfer/release sibling 路径加入真实 engaged-fence 回归，逐字段断言完整 error、error_code、settlement 与无状态副作用；若 settlement 新形状是预期行为，请把其依据和 baseline delta 明确写进测试与文档。不要仅断言 reason code 或前缀。

除这一项外，我没有发现第二个 blocking correctness 问题。default-off 的 absent/disabled 真实 CLI 对照、active capture obligation、source/Goal/runtime 绑定、rollback 归档与 history/cursor 恢复都有针对性覆盖。改动体量很大，但主要增量是跨 writer 的真实路径与故障验证；生产边界仍围绕同一个 Stage 2C 原因，且明确保留未晋级、未完成长期 soak 的非目标，因此我暂不要求为了行数机械拆分。残余风险主要是更多旧 caller 的完整诊断/receipt 契约仍可能被共享 guard 重构吞掉。

我的整体评价

架构方向、崩溃恢复和历史证明比前一版扎实，之前的 cursor finding 也在真实进程路径上得到修复；把旧 observation 与 transaction capture 分离、把 decision authority 留在 TypeScript、让 Python 只做桥接，是正确的未来边界。但这个 PR 正在重构所有 writer 的共享 guard，任何“码相同但可操作语义变弱”的漂移都属于合并阻塞。结论是 REQUEST_CHANGES：修复上述 lease fence 诊断并为整个 sibling caller 集合补充完整 observable contract 后，需要基于新 exact head 重新跑 caller matrix 和相关 TypeScript/Stage 2C 验证。

Future-facing pass：最有价值的有界改进不是再加一层抽象，而是让共享 guard 只拥有稳定 typed reason，调用者 adapter 统一负责可操作 remediation，并用数据驱动的 sibling-caller parity 表覆盖完整 error/settlement/no-effect；这与当前变更原因一致，也能防止下一次 --note 式漏审。

English verdict: REQUEST_CHANGES on exact head ee1b17217c4d21be0da348097bccf84a1517bb03: the recovery architecture and independent 66-case/732-test validation are strong, but the real native task-lease fenced path loses the baseline canonical-authority remediation and changes settlement semantics without a caller-level contract; restore and regress the full observable behavior across lease siblings before merge.

[wchwawa]

@huangruiteng Round 4 on exact head 1d58bc91e (rebased onto current main, including the projection-module move of #4038).

The P1 finding, and where I agree and disagree. The remediation loss and the untyped settlement change are real and are fixed. On the settlement shape I did not restore the baseline: on 0fb497af8 only acquire reported a committed validation receipt with a durable_writeback / writeback_rejected failure, while renew, transfer and release already reported validation / permission_denied with no receipt, and the guard ran before commitAcquire on every revision (probe evidence for both heads is attached to the fixture as baseline annotations). The baseline acquire shape was the inconsistent one, and RFC section 5 forbids fabricating an applied receipt for a rejected command. So the contract is now the same at every native guard site: rejected before the first side effect, {effect_id, receipts: [], failure: {step: validation, kind: permission_denied, code}}, with effect_id following each verb's existing rule. The previous head's validation + writeback_rejected pair on acquire is gone.

What changed (7 signed commits on top of the merge).

1. legacy_writer_fence.ts/.py: the shared write check is untouched and owns only reason_code plus authority_mode / fence_id; the two caller adapters render one template, legacy coordination writer is fenced; use the promoted canonical authority (<authority_mode>) for goal <goal_id>; fence <fence_id>; the primary record was not changed, by single-pass substitution, and carry the complete check result under write_check. That nesting also fixes a defect on both trees: the check's schema_version overwrote the envelope's, so every fenced CLI lease rejection printed RuntimeError: native task-lease ... shape mismatch.
2. task_lease_acquire.ts: the fence error is typed at the catch site (the mechanism lifecycle errorInfo already uses); only the startsWith("legacy_") clause leaves the step rule. task_lease_lifecycle.ts: the fence is checked once at the top of the verify path, before the first receipt, so the held and holder branches are covered too; a leased todo complete --dry-run under a fence no longer previews ok: true and no longer persists a closed lifecycle-fence receipt.
3. cli_commands/task_lease.py and turn.py: envelope-owned keys win over typed exception payloads.
4. Parity fixture tests/fixtures/control_plane/legacy_writer_fence_caller_parity_v0.json: 21 TypeScript entry rows (acquire, renew, transfer, release, terminal verify keyed and keyless, committed releasing fence-close; engaged, invalid, unreadable; two absent controls) and 25 real-process CLI rows (the lease verbs with and without capture, Todo complete/update/supersede/archive, capture-followups, handoff-mode set, four previews including the leased terminal preview, invalid and unreadable markers, fence without a store). Whole-object envelopes, exit status, exclusion-free effect snapshots, declared after-state and the fence-close retry; baseline entries document 0fb497af8 and ee1b17217 and are never executed.
5. Five mutants, each killed by exactly one row with a passing control; the TypeScript truncation is killed through the real CLI.
6. correctness.md "Fenced legacy write response" with a nine-row baseline-delta table and the one pre-existing gap I did not touch: loopx quota monitor-poll --execute re-types every non-validation exception to quota_unexpected_collection_error, so a fenced monitor writeback loses its code and remediation at that boundary on both revisions; that belongs to the quota domain's public-safety contract. Appendix C of the RFC names the guarded verbs and the typed rejection in both languages.

Validation on 1d58bc91e. full Python suite 6,664 passed / 25 skipped with 12 failures that are environment-only and identical on the current main checkout in this environment (nine repository-change-window git-hook tests, the doctor runtime-readiness and installation-scope tests, and the CI-workflow shard test that needs the pytest-split plugin); TypeScript control plane 776 passed / 1 PostgreSQL integration skipped; parity 21 + 25 rows; render identity 7/7; mutants 5/5 killed with green controls; typecheck, configured mypy (21 files), pinned Ruff on the CI surfaces, generated-contract check, docs governance and asset smokes, git diff --check, premerge canary. NoKV, PostgreSQL and file store code, the contract JSON, the generator and the generated bindings are untouched; the NoKV profile is exercised only at unit and diff level here.

[wchwawa]

Exact head moved to 507b9f17a: main merged again for the promoted-claim compatibility tests of #4020 (their _seed_promoted_store now seeds through this branch's canonical authority fixture and pins the legacy handoff mode explicitly, since this branch's projection builder defaults to hard_lease while the claim owner reads a missing mode as legacy), and the unused-import cleanup on coordination_shadow.py is reverted because four coordination-shadow command tests reach those names through the module. No product change beyond the round-4 commits; the same local validation is green on this head (full Python 6,728 passed with the same environment-only failures, TypeScript 777 / 1 skipped, lint, mypy, typecheck, contract, premerge).

[huangruiteng]

Reviewed exact head: 507b9f17ad7296762aa72d84696699cfa04edb48 (current base 8937fa7b29e787375fb75920714059b0b1155362; prior reviewed head ee1b17217c4d21be0da348097bccf84a1517bb03).

动机

这个 PR 把 Shared Goal Authority Stage 2C 从“主写后尽力镜像”收紧为可恢复、可证明的预晋级捕获：真实 Todo/lease 主写先持久化 outbox prepare，主写完成后提交 marker，drain 只根据完整 provider history、精确 receipt、source bytes 与 lineage 证明推进 cursor；bootstrap/rollback 在崩溃后可重入，并在发布 inactive 前归档候选 authority 和整份 Goal outbox。它仍是 capture lane C 和候选退役，不授予 promotion、远端 authority 或 sustained parity。

本轮复审还针对上一个 exact head 的阻塞项：共享 fence guard 重构虽然保留 machine code，却让真实 task-lease caller 丢失 canonical-authority remediation，并漂移了 envelope/settlement 可观察语义。当前 head 的目标是把这类“代码拒绝正确、operator 语义却丢失”的问题在 caller adapter 边界补齐，而不是只增加一条字符串断言。

改动思路

核心 authority 分层保持正确：TypeScript 拥有 management state、validated history fold、receipt/cursor、FileAuthorityStore CAS 与 rollback 决策；Python 负责现有 Markdown/lease writer 的锁内 capture bridge、文件编排和 CLI adapter，不重建第二套状态机。锁顺序维持 M → T → S → L → K；management 期间所有主写在首个副作用前 hold，普通 capture 在提交后由 drain 进入 TypeScript 的单 transaction owner。

针对复审项，共享 checkLegacyCoordinationWriteAllowed 只返回稳定 reason_code 和 fence binding facts；Python/TypeScript caller adapters 用同一模板渲染 provider-neutral remediation，并把完整 check 结果放在 write_check 下，避免它的 schema_version 覆盖外层 task-lease envelope。native acquire 与 renew/transfer/release/verify 统一为首个副作用前的 validation / permission_denied、零 receipt；terminal/holder verify 在第一次 receipt 前检查 fence。46 行数据驱动 fixture 覆盖 21 个 TypeScript entry rows 和 25 个真实 CLI rows，逐对象钉住 error、code、settlement、exit status 与全部 effect snapshot；五个定向 mutant 分别破坏 remediation、nesting、settlement 或 lifecycle guard。

正向路径仍是 bootstrap → active binding → writer prepare → 原子主写 → marker → history commit → cursor/reclaim；负向路径覆盖 unreadable/invalid/engaged fence、management crash、markerless recovery、伪造 cursor/receipt、跨 Goal/source/lineage 与 rollback selector 不匹配。active binding 之后关闭配置不解除 capture 义务；从未启用的 absent/disabled 路径保留旧行为。

具体改动

当前 base..head 为 105 个文件、+14,857/-5,217：约 47 个生产/运行时文件、48 个测试/示例文件、2 个公开 RFC、CI/构建与 3 个生成契约面。大部分体量来自真实进程 E2E、管理崩溃矩阵、caller observation、installed-package 检查、mutants 和 1,998 行完整 parity fixture；生产改动围绕同一个 capture/rollback/fence 原因，包含 management journal、outbox/history/cursor、源绑定、legacy writer guards、native task lease、Todo projection、bootstrap/migration 与 provider archive。

从上一复审 head 到当前 head，实质性修复集中在 3 组生产提交：两个 fence adapter 与其共享 remediation/nested payload；task-lease acquire/lifecycle 的 typed rejection 和 verify guard；CLI envelope 的保留字段顺序。其余增量是 parity fixture、五个 mutants、双语 RFC/correctness 说明、两次 main rebase 的适配，以及恢复误删测试 seam 的最终 revert。29 个提交均有 DCO trailer。

关键代码讲解

1. runtime_shadow.ts:242 qualifySnapshot：在 maintenance/source locks 内复查 source snapshot、existing-only store、capture binding、完整 lineage 与 pending outbox，再计算 bounded qualification；输出明确 sustained_parity_verified: false，不把候选检查伪装成 promotion。
2. local_authority_shadow_adapter.py:612 _PartitionDrainer._reconcile：先证明 cursor/history anchor 和每个 residue，再在主锁可用时复查 binding/inventory，写统一的 applied-mutation digest 并回收已证明文件；no-op 只推进位置，不合成 baseline digest，修复此前首次 abandonment 的跨消费者分歧。
3. shadow_management.ts:481 rollbackManagedShadow：以精确 provider revision 或未完成 bootstrap operation 为 selector，把 candidate 和完整 outbox inventory 写入 immutable manifest，归档、fsync、读回后才发布 inactive；重试由 operation evidence 归并。
4. local_authority_runtime.ts:78 withCanonicalWriter：非 dry-run canonical writer 在 management lock 内检查 shadow primary permission，再执行真实 provider write；这是 promoted authority 的生产入口，dry-run 保持无副作用。
5. legacy_writer_fence.ts:47 legacyCoordinationWriteRemediation 与 Python 同名 adapter：从 typed guard facts 单次替换生成完整恢复提示；LegacyCoordinationWriteError.payload 只暴露 {write_check}，防止外层 schema/error/action 被扁平 payload 覆盖。

对主干的风险

上次 [P1] 已修复。我重新走了真实 caller 路径：Python fence/CLI/parity 43/43 通过；Node fence parity、acquire 与 lifecycle 75/75 通过；cursor + observable real-process Python 66/66 通过。更宽的 Node shadow/management 集合首次为 72/73，唯一失败是测试子进程调用系统 Python 3.9，无法解析项目已使用的 dataclass(slots=True)；把 PATH 指向项目 Python 3.13 后，失败所在的 local_authority_shadow_outbox 17/17 通过，因此这是 reviewer 环境选择，不是产品失败。Ruff 通过，远端 14 个 checks 成功或预期 skip，Stage 2C E2E、Linux/Windows、build、DCO 与 dependency review 均绿色。

完整 observable contract 现在不只比较 reason_code 或前缀：engaged/invalid/unreadable fence、四个 lease verb、terminal/holder verify、fence close、Todo complete/update/supersede/archive、followup/handoff 和 previews 都有整对象与无副作用快照。settlement 的 baseline delta 已在 correctness/RFC 中明确，permission_denied 表示该 legacy writer 被 fail-closed 拒绝，并不授予 canonical 权限。协议名没有扩大 actor/peer authority；generic errors 保持 Goal-neutral。default-off 仍由 absent/disabled/enabled caller 对照、无自动 promotion 和 decision_read_from_shadow: false 约束。

残余风险有两项：其一是全量 PR 很大，review 成本和未来 rebase 成本高；但它围绕一次跨 writer 的 durability migration，测试/fixtures 占主要增量，拆开会失去崩溃与 caller parity 的同一原子证据。其二，文档明确记录 quota monitor-poll --execute 在 baseline 与当前 head 都会把 typed fence 例外重新包装为通用 collection error；这是已存在、未恶化的 quota adapter 缺口，应作为后续修复，但不阻塞本次 pre-promotion capture/rollback。真实 PostgreSQL和作者声称的全量 6,664 Python/776 TypeScript 未在本轮重新执行；它们由本 head CI/作者证据支持，本次独立验证集中在实际改动和先前 finding。

Change proportionality 重新从原问题判断：主写崩溃、不可证明 cursor、候选 rollback 不完整会直接阻断 authority migration 或留下双写风险，恢复成本高；现有机制虽大，但没有新增 promotion、远端 backend 或 speculative framework，production owner 仍收敛到既有 TypeScript coordination bounded context，现阶段是 proportionate。future-facing pass 已通过统一 adapter remediation、typed reason 和数据驱动 caller fixture落实；不需要再抽象第三层。

我的整体评价

APPROVE。 当前 exact head 完整修复了上一轮发现的可操作语义与 settlement 漂移：提示、machine code、envelope、receipt、effect snapshot 和 sibling caller 均被真实路径钉住，而且 main rebase 后核心恢复套件仍通过。Stage 2C 的权限边界也保持克制：候选不参与决策，qualification 不等于 promotion，sustained parity 仍明确未评估。

这是高风险且体量很大的改动，合并后应继续保留现有 promotion/soak hold，并单独修 quota monitor 的 typed-error adapter；但当前没有剩余 blocking finding。批准只绑定 507b9f17ad7296762aa72d84696699cfa04edb48，head 再变需重新验证。

English verdict: APPROVE on exact head 507b9f17ad7296762aa72d84696699cfa04edb48: the prior caller-level remediation/envelope/settlement blocker is fixed with whole-object parity across 46 sibling paths, and independent 43-Python, 75-Node, 66-real-process recovery plus corrected-environment 17-Node validation passes; the pre-existing quota monitor error-adapter gap remains a disclosed follow-up, not a Stage 2C merge blocker.