loopx-project · huangruiteng · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026
@@ -1,8 +1,9 @@
 # Default cutover: reconciled implementation frontier
 
-- Baseline: `37bbaec79` on `main`, 2026-09-25; open PR states are a snapshot, not merge promises.
+- Baseline: `41ba6f4d9` on `main`, 2026-09-25; open PR states are a snapshot, not merge promises.
 - Owners: overall roadmap #4574 R5/G2; shared authority L2–L9/D1–D3; TS migration T1–T4.
-- Delivery: current registration admission, complete saved migration intent and truthful fence recovery.
+- Delivered #5040: current registration admission, complete saved migration intent and truthful fence recovery.
+- Current increment: long-history closeout reuse and TS-owned monitor evidence; the migration packages below remain open.
 - This checkpoint supersedes numerical remaining-PR estimates in earlier delivery entries.
 
 ## Correct the accounting
@@ -63,6 +64,39 @@ capacity qualification remain its separate medium-term path. Local default
 does not wait for PostgreSQL deployment; a passing conformance suite does not
 establish production service readiness.
 
+## Long-history closeout: this repair and its remaining boundary
+
+A live long-running lane lost the response to the five-second
+`quota.prior_host_turn_closeout.preflight` query; later read-only inspection and
+same-Turn retry recovered. Per-request indexing already exists. This repair
+removes repeated JSON decoding across reads: always read fresh bytes and hash
+the entire retained newline-terminated prefix before reuse; decode only appended
+lines when it matches. Rewrites, truncation, replacement, malformed rows and
+unfinished tails remain visible, as do conflicts in old Turns. Retain at most
+four logs and prefixes representing 128 MiB of source bytes; oversized histories
+use uncached parsing. This bounds retained source volume, not exact JS heap size.
+The cache is disposable and introduces no durable index, format or authority.
+
+Cold parsing yields between data batches to share the runtime event loop. Full
+byte reads remain necessary: this is not constant-time arbitrary-history support
+or D2 retention/capacity qualification. The five-second budget is unchanged. The
+incident's transient process/host scheduling cause was not reproduced reliably;
+validation establishes reduced duplicate work and concurrency headroom, not the
+absence of every possible environmental timeout.
+
+Monitor closeout now consumes the existing TS settlement rule for an exact
+committed poll. Python no longer scans the run log a second time and adapts only
+current Todo facts. Later uncommitted observations cannot hide earlier exact
+commit evidence; foreign identities and wrong effects cannot settle a Turn.
+A lost read-only preflight response reports `closeout_query_unavailable`, without
+asking for a nonexistent preflight write receipt. Unknown queries remain closed;
+there is no automatic mutation replay or shared-runtime restart.
+
+This is an evidenced R1/R5/S7 liveness repair and bounded Python retirement, not
+completion of implementation package 2. The three named boundaries above and
+separate #4931/D2 evidence gates remain. Existing quota CLI/heartbeat entrypoints
+adopt the change; no new setting or separate frontend/Lark policy is needed.
+
 ## Delivered #5013: complete-source transport and budget decision
 
 Before #5013, `test_canonical_snapshot_integration` failed before provider

@@ -1,8 +1,9 @@
 # 默认切换：按实现证据重算交付边界
 
-- 核对基线：2026-09-25 `main` 的 `37bbaec79`；开放 PR 状态是快照，不是合入承诺。
+- 核对基线：2026-09-25 `main` 的 `41ba6f4d9`；开放 PR 状态是快照，不是合入承诺。
 - 归属：总目标 #4574 R5/G2；shared authority L2–L9/D1–D3；TS 迁移 T1–T4。
-- 本次交付：当前注册事实约束晋升，保存的模式意图完整执行，准确恢复 fence 状态。
+- 已交付 #5040：当前注册事实约束晋升，保存的模式意图完整执行，准确恢复 fence 状态。
+- 当前增量：长历史 closeout 读取复用与 TS monitor 回执归一；没有完成下列迁移工作包。
 - 本检查点取代此前交付记录中的剩余 PR 数量估算。
 
 ## 先纠正统计口径
@@ -53,6 +54,31 @@ PostgreSQL 复用 typed command 和 AuthorityStore，部署 transport、认证/t
 策略、restore identity、运维和 capacity 资格仍是独立中期路线。本地默认不等待
 PostgreSQL 部署，conformance 通过也不等于生产服务已合格。
 
+## 长历史收尾检查：本次修复与剩余边界
+
+真实长期运行暴露了 `quota.prior_host_turn_closeout.preflight` 的 5 秒超时；
+后续只读检查和同 Turn 重试恢复。历史已经在单次请求内建索引，不能把该优化当作
+未做。本次去除跨请求重复 JSON 解码：每次仍读取并 SHA-256 核验完整既有前缀，
+只复用字节相同且以换行结尾的解析结果，追加只解析新行。截断、同长度改写、替换、
+损坏、未完成尾行均重新验证；旧 Turn 冲突仍阻止推进。缓存最多保留四份日志、
+128 MiB 原始输入对应的解析前缀，超限回到普通读取。它不是持久索引或新 authority，
+不改变日志格式；原始字节预算不等于 JS heap 的硬上限。
+
+冷解析按数据批次让出事件循环，避免长历史独占共享 runtime。仍需读取全部字节，
+因此不宣称任意历史长度恒定耗时，也不替代 retention、D2 容量/恢复资格。5 秒预算
+保持不变，原事故的瞬时进程/机器调度原因未能稳定重现；回归证明的是重复工作降低
+以及长历史/并发下的可用余量，不声称消灭所有环境超时。
+
+Monitor 的精确已提交回执复用 TS settlement 的同一个查询规则；Python 删除第二遍
+run log 扫描，只适配当前 Todo 事实。后来的未提交观察不再遮住较早的精确提交证据；
+跨 Goal/Agent/Turn/Todo 或错误 effect 仍不能结算。只读 preflight 丢失响应报告
+`closeout_query_unavailable`，不会建议寻找不存在的 preflight 写回执；查询失败依旧
+阻止推断准入，不自动重试 mutation 或重启共享进程。
+
+这是 R1/R5/S7 的实测阻塞修复与有界 Python 退役，不是上表第 2 项整体完成。
+三个后续实现边界和 #4931/D2 的独立证据门不变。CLI/heartbeat 收益来自原有配额
+入口；没有新增设置，frontend/Lark 也无需各维护一套策略。
+
 ## 已交付 #5013：完整来源传输与预算决定
 
 在 #5013 之前，`test_canonical_snapshot_integration` 曾在 provider 准入之前失败：完整

@@ -50,6 +50,11 @@ shadow lineage, still default-off and subject to explicit bootstrap.
 
 ## Current implementation checkpoint
 
+Long-history closeout reuse retains only re-verifiable parsed prefixes; it adds
+no durable authority and relaxes no writer fence or D2 gate. This runtime repair
+does not mechanically subtract one of the three remaining implementation packages.
+[Evidence and boundary](ledger/shared-goal-authority-state-provider-v0/2026-09-24-default-cutover-reconciliation.md#long-history-closeout-this-repair-and-its-remaining-boundary).
+
 Promotion admission now binds complete sources to a current registry witness
 and rechecks it inside the TS lock scope. Saved execution retains the reviewed
 handoff policy, and failures report durable fence presence. Recovery of a

@@ -43,6 +43,10 @@
 
 ## 当前实现检查点
 
+长历史 closeout 读取复用仅缓存可重新验证的解析前缀，不新增持久 authority 或放宽
+writer fence/D2。剩余三个实现边界不因该运行缺陷修复而机械减一。
+[证据与边界](ledger/shared-goal-authority-state-provider-v0/2026-09-24-default-cutover-reconciliation.zh-CN.md#长历史收尾检查本次修复与剩余边界)。
+
 晋升准入现将完整来源绑定到当前 registry witness，并在 TS 持锁范围内重新校验；
 保存计划执行保留已审核的 handoff 策略，失败结果如实报告持久 fence。
 已提交事务的恢复仍按原 fence/receipt，不要求失去权威的旧来源重新有效。

@@ -42,6 +42,12 @@ Retain T0 caller/parity inventory, T1/T2 transaction/effect convergence, T3 comp
 
 ## Current implementation checkpoint
 
+Long-history closeout now reuses byte-verified TS receipt prefixes and the
+single committed-monitor rule. Python retires its duplicate run-log scan and
+adapts Todo facts only; lost queries are distinguished from ambiguous writes.
+This is bounded retirement within closeout, not complete Python removal.
+[Delivery and limits](ledger/shared-goal-authority-state-provider-v0/2026-09-24-default-cutover-reconciliation.md#long-history-closeout-this-repair-and-its-remaining-boundary).
+
 Promotion admission now binds complete sources to a current registry witness
 and rechecks it inside the TS lock scope. Saved execution retains the reviewed
 handoff policy, and failures report durable fence presence. Recovery of a

@@ -45,6 +45,10 @@ shared-authority 的当前核对表区分已合入实现、在途 PR、新代码
 
 ## 当前实现检查点
 
+长历史 closeout 现在复用经原始字节校验的 TS 日志前缀与统一 monitor 提交规则，
+Python 删除重复 run log 读取，只适配 Todo 事实。只读失败与提交不确定性分开报告。
+这是收尾边界内的有界退役，不是全量 Python 移除；[当前交付与限制](ledger/shared-goal-authority-state-provider-v0/2026-09-24-default-cutover-reconciliation.zh-CN.md#长历史收尾检查本次修复与剩余边界)。
+
 晋升准入现将完整来源绑定到当前 registry witness，并在 TS 持锁范围内重新校验；
 保存计划执行保留已审核的 handoff 策略，失败结果如实报告持久 fence。
 已提交事务的恢复仍按原 fence/receipt，不要求失去权威的旧来源重新有效。

@@ -21,8 +21,12 @@
 )
 from ..control_plane.quota.effective_action import EffectiveAction
 from ..control_plane.quota.effect_program import SettlementIdentity
-from ..control_plane.quota.error_codes import QuotaCommandValidationError
+from ..control_plane.quota.error_codes import (
+    CloseoutQueryUnavailableError,
+    QuotaCommandValidationError,
+)
 from ..control_plane.quota.heartbeat_receipt import (
+    attach_uncommitted_heartbeat_receipt,
     fail_heartbeat_receipt,
     find_heartbeat_receipt,
     heartbeat_receipt_view,
@@ -65,7 +69,6 @@
 )
 from .quota_action_selection import (
     RequestedQuotaActionSelection,
-    attach_uncommitted_action_selection_receipt,
     commit_requested_action_selection,
     load_requested_quota_action_selection,
     reconcile_requested_quota_action_selection,
@@ -333,6 +336,7 @@ def handle_quota_command(
     heartbeat_receipt_existing_appended = False
     heartbeat_receipt_ready = False
     action_selection_preflight_failed = False
+    closeout_query_unavailable = False
     action_selection: RequestedQuotaActionSelection | None = None
     heartbeat_stall_observation = "not_evaluated"
     detail_sections: frozenset[str] = frozenset()
@@ -551,6 +555,7 @@ def handle_quota_command(
             runtime_root_arg=runtime_root_arg,
         )
     except Exception as exc:  # noqa: BLE001 - CLI fail-safe boundary; error_code is typed below.
+        closeout_query_unavailable = isinstance(exc, CloseoutQueryUnavailableError)
         payload = quota_failure_payload(
             args,
             registry_path=registry_path,
@@ -571,7 +576,7 @@ def handle_quota_command(
             replan_obligation_id=rollout_replan_obligation_id,
         )
         if heartbeat_turn_id and args.quota_command == "should-run":
-            if action_selection_preflight_failed:
+            if action_selection_preflight_failed or closeout_query_unavailable:
                 if heartbeat_receipt_existing:
                     render_existing_heartbeat_receipt_payload(
                         payload,
@@ -581,7 +586,7 @@ def handle_quota_command(
                         appended=heartbeat_receipt_existing_appended,
                     )
                 else:
-                    attach_uncommitted_action_selection_receipt(
+                    attach_uncommitted_heartbeat_receipt(
                         payload,
                         turn_instance_id=heartbeat_turn_id,
                     )

@@ -11,7 +11,6 @@
     QuotaActionSelectionConflictKind,
 )
 from ..control_plane.quota.heartbeat_receipt import (
-    HEARTBEAT_RECEIPT_SCHEMA_VERSION,
     find_heartbeat_receipt,
     heartbeat_receipt_pending_action_todo_id,
     heartbeat_receipt_settlement_replan_obligation_id,
@@ -282,24 +281,6 @@ def reconcile_requested_quota_action_selection(
     )
 
 
-def attach_uncommitted_action_selection_receipt(
-    payload: dict[str, object],
-    *,
-    turn_instance_id: str,
-) -> None:
-    """Expose an accurate non-durable receipt for a rejected preflight."""
-
-    payload["heartbeat_receipt"] = {
-        "schema_version": HEARTBEAT_RECEIPT_SCHEMA_VERSION,
-        "turn_instance_id": turn_instance_id,
-        "status": "not_committed",
-        "stall_observation": "not_evaluated",
-        "reason_code": str(
-            payload.get("error_code") or "quota_action_selection_rejected"
-        ),
-    }
-
-
 def commit_requested_action_selection(
     payload: Mapping[str, object],
     *,

@@ -19,7 +19,9 @@
     LocalCoordinationAuthorityUnavailable,
 )
 from ..control_plane.effect_runtime import EffectRuntimeStartupError
+from ..control_plane.quota.effective_action import EffectiveAction
 from ..control_plane.quota.error_codes import (
+    CloseoutQueryUnavailableError,
     HeartbeatReceiptIdentityConflictError,
     QuotaActionSelectionConflictError,
     QuotaCommandValidationError,
@@ -112,7 +114,8 @@ def quota_failure_payload(
     public_reason = (
         str(error)
         if isinstance(
-            error, (HeartbeatReceiptIdentityConflictError, EffectRuntimeStartupError)
+            error,
+            (CloseoutQueryUnavailableError, HeartbeatReceiptIdentityConflictError, EffectRuntimeStartupError),
         )
         else "quota collection failed"
     )
@@ -134,6 +137,16 @@ def quota_failure_payload(
         **verbose_debug,
         **lock_timeout_fields,
     }
+    if isinstance(error, CloseoutQueryUnavailableError):
+        payload.update({
+            "status": error.diagnostic_code,
+            "effective_action": EffectiveAction.CONTROL_PLANE_HEALTH_REPAIR.value,
+            "recommended_action": (
+                "check runtime health, then retry quota should-run with the same "
+                "Turn identity to read the closeout state; do not infer settlement "
+                "or replay work from a missing query response"
+            ),
+        })
     if isinstance(error, QuotaActionSelectionConflictError):
         # The requested Todo could not be reconciled with the projection. Report
         # the real conflict and the next read to make, rather than the generic

@@ -4,6 +4,13 @@
 from enum import StrEnum
 
 
+class CloseoutQueryUnavailableError(RuntimeError):
+    """A read-only closeout query returned no verified result; no verdict exists."""
+
+    error_code = "quota_closeout_query_unavailable"
+    diagnostic_code = "closeout_query_unavailable"
+
+
 class QuotaCommandValidationError(ValueError):
     """Public-safe diagnostic for an invalid ``loopx quota`` invocation."""
 
@@ -199,6 +206,8 @@ def __init__(
 
 
 def quota_error_code(exc: BaseException) -> str:
+    if isinstance(exc, CloseoutQueryUnavailableError):
+        return exc.error_code
     if isinstance(exc, json.JSONDecodeError):
         return "quota_state_invalid_json"
     if isinstance(exc, QuotaCommandValidationError):

@@ -552,6 +552,24 @@ def heartbeat_receipt_view(
     return receipt
 
 
+def attach_uncommitted_heartbeat_receipt(
+    payload: dict[str, object],
+    *,
+    turn_instance_id: str,
+) -> None:
+    """Expose an accurate non-durable receipt for an incomplete preflight."""
+
+    payload["heartbeat_receipt"] = {
+        "schema_version": HEARTBEAT_RECEIPT_SCHEMA_VERSION,
+        "turn_instance_id": turn_instance_id,
+        "status": "not_committed",
+        "stall_observation": "not_evaluated",
+        "reason_code": str(
+            payload.get("error_code") or "quota_preflight_incomplete"
+        ),
+    }
+
+
 def fail_heartbeat_receipt(
     payload: dict[str, object],
     *,