docs(sqlite): qualify complete CLI history impact

[loopx-agent]

Goal And Delivered Outcome

The SQLite warm-head diagnosis lacked a complete CLI consumer comparison. This updates the existing bilingual R5 checkpoint with 80 isolated, real-source status/quota calls over fully verified 64 KiB 10k/100k histories. Status p95 is 846/875 ms and quota p95 is 1,111/1,079 ms, with canonical-source and retained-state checks. The original 2.059x failure and 13/1/11 formal ledger remain intact.

Author Declaration

• Written by: model_agent — Codex (GPT-6 family, OpenAI).
• Specification: docs/architecture/rfcs/shared-goal-authority-state-provider-v0.md, Section 7.2, at 233cc76fd22760947d73e1501032b8b77e28148b; related to [Task]: Qualify SQLite D2 capacity and crash/replay recovery on the merged provider #4224.

Criterion	Disposition	Evidence
Judge consumer impact without erasing frozen failures	implemented	Both updated retirement/capacity checkpoints distinguish this fixed-history control from formal qualification.
Preserve authority, original proof and recovery semantics	implemented	No runtime/schema/budget change; canonical CLI readback, exact unchanged head/cursor/projection, oldest/middle receipt checks.
Formal capacity, full-domain and installed recovery exits	out_of_scope	Existing owners retain those exits; this evidence does not qualify them.

Scope And Continuation

Complete within the consumer-read diagnostic slice. The same single-Todo fixture and scan input are used at both history depths, with balanced sample order and a new CLI/managed runtime per call. This does not compare source revisions or measure mutations, concurrency, OS-cold caches, installed wheel/App or full-domain payloads.

The related future-facing pass keeps the existing TS ownership and persisted format. An index/proof change needs a concrete format/upgrade proposal and matched consumer benefit; these results alone do not justify one. Continue the existing whole-Goal consumer, installed recovery and contributor-owned formal qualification work rather than recreating it.

Validation

• Tested source: 233cc76fd22760947d73e1501032b8b77e28148b; documentation head: 1085bb2ff543c61e28a4fc875cedcdbd28706933.
• Run state: finished. Input classes: synthetic, public_fixture.

Check kind	Result	Public-safe evidence / limitation
real_entrypoint / real_backend	passed	80 source CLI reads; SQLite 3.53.4, Node 24.21.0, macOS arm64; 20 samples per command/depth; fixed 64 KiB histories, WAL/FULL; unchanged 1,353-file scan digest.
manual / static	passed	Raw owned aggregate values checked against both language versions; full projection/cursor and oldest/middle receipts preserved; isolated runtimes cleaned. Raw probes and captures remain private.
static / unit	passed	uv run --extra test loopx canary premerge --from-git-diff: 3 direct and 19 selected checks, no failures/skips/manual holds; current exact-scope change-quality receipt passes. Initial stale receipt and malformed review-input attempts were rejected, then corrected without changing evidence or policy.
regression_parity	not_run	No base/head runtime change exists; historical formal report is preserved, not relabeled or rerun.
integration	not_run	Installed wheel/App, full formal profile, concurrency, natural-time soak and PostgreSQL are outside this docs-only slice.

Private diagnostic setup initially rejected row/field assertions and an identity mismatch. The successful control binds only fresh isolated copies through full-history verification and the existing guarded TS selection publication owner; no selector editing or active Goal testing. The ephemeral probe is not a shipped public reproducer.

Frontend / Visual Evidence

UI impact: none. No frontend, Lark, CLI behavior, first viewport or documentation chrome changes.

Type of Change

• Documentation update

LoopX Area

• Public docs or presentation surface

Shared-authority RFC fixture impact

No fixture schema, provider conformance, routing, promotion or compatibility projection change. The diagnostic supports the existing R5 consumer-impact decision only; the three-arm promotion rehearsal is not applicable.

Boundary Checklist

• Public-safe aggregates only; no private state, raw traces, credentials, internal links or local paths.
• Existing contributor ownership and work reused; no replacement soak launched.
• Scoped to the existing diagnosis and decision checkpoint.
• UI impact none.
• DCO sign-off present.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh.

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

精确 head：1085bb2ff543c61e28a4fc875cedcdbd28706933。结论：APPROVE；未发现阻塞问题。批准范围是这次有边界的完整命令诊断记录，不是正式容量证书或发布默认资格。

动机

维护者在判断 SQLite 历史增长是否影响普通命令、是否需要改变存储格式时，会使用这份检查点。

此前只有 store 微基准的增长失败，缺少同一历史深度下完整 status／quota 的对照，容易把局部比例直接当成用户旅程或发布结论；本次补上固定输入的完整命令测量。

可观察结果是两种完整读取命令在 10k／100k 历史下的分位数，以及 canonical 来源和原始历史仍完整的读回证据。 本 PR 不修改运行时、默认值、预算或持久格式，也不把新对照当成旧正式报告通过。

原 2.059 倍失败的根因、正式容量缺失轴、安装态恢复、完整 Goal 和并发／写入旅程仍未由本对照证明。

改动思路

先核对已接受的 §7.2，再核对实际测量和全量 diff。这里的 canonical 指实际决策读取 SQLite 权威状态，公共 ledger 只报告证据，不决定 Todo 或发布策略。入口是既有 R5 检查点，消费者是维护者；决策和持久效果继续属于现有 TS AuthorityStore 与验收流程。

最强反对理由是：n=20 的单 Todo 源码读取不能替代完整产品资格。保留的方案把这个限制写清，复用两个现有语言版本，避免凭微基准比例直接实现索引／缓存。什么也不写会保留完整命令证据缺口；另建框架或改持久格式则超出已证明收益。当前边界可独立读回和撤销。

具体改动

关键内容讲解

英文检查点新增 32 行，中文新增 24 行，共 56 行；均为 docs，没有运行时代码、fixture、生成物或新词汇契约。测量源为 233cc76fd22760947d73e1501032b8b77e28148b；本 PR head 仅记录结果。

内容	核对结果
固定输入	64 KiB FULL/WAL、10k／100k 原历史，两个轴使用相同 1,353 文件扫描输入，前后 digest 一致。
完整进程成本	每轴 20 次 status、20 次 quota，交替命令和轴顺序；每次新 Python CLI 与 managed runtime，计时含启动、不含关闭，保留 OS 文件缓存。
用户命令结果	status p95 846／875 ms，quota p95 1,111／1,079 ms；全部 80 次 canonical Todo 读回，不是 legacy fallback。
历史保护	最终 cursor／完整 projection digest 不变，最老／中间原 receipt 校验成功，隔离 runtime 已清理。
结论限制	原 2.059 倍、13 通过／1 失败／11 缺失未改；不同源码／扫描输入不可称为修复前后对比。

规范依据：docs/architecture/rfcs/shared-goal-authority-state-provider-v0.md，不可变 revision 233cc76fd22760947d73e1501032b8b77e28148b。编辑后的 ledger 不是独立规范。

criterion_id	本 head 处置	对应验收
7.2	implemented	完整 status／quota 成本和历史扫描不能藏在消费者或被启动摊销；本对照含真实启动。
Proposed acceptance budgets	implemented	冻结的失败、缺失、工作负载和预算身份保留，新对照单独声明。
Retention, recovery and delivery gates	implemented	此变更保留原始 receipt、digest、连续性检查和持久格式；实测原历史读回。
Select the release default	out_of_scope	该条还要求受支持安装、迁移、恢复、回滚和代表性持续使用；本对照明确不验收这些出口。

对主干的风险

最强反例是“读取通过、真实写入或恢复仍坏”。这是仍存在的证据边界；它不能因这张表变成绿色。两版均列出 mutation、增长中的历史、并发 writer、安装 wheel／App、完整领域 payload 未测，并保留正式失败段。因此未发现误宣称或新运行时回归。此 PR 没有 UI、Lark、CLI 交互变化，无新增导航或授权步骤。

当前 head 的 uv run --extra test loopx canary premerge --from-git-diff：3 个直接检查和 19 个选定检查通过，无失败、跳过或 manual hold；精确范围的质量 receipt 有效。80 个实际源码／SQLite 读取结果已完整核对。探针是私有临时诊断，未作为公共重现工具交付。初次陈旧 receipt 和输入格式拒绝保留，修正输入后重验，没有放宽政策或删证据。未查询／等待远端 CI。

正式 profile、安装 wheel／App、并发写入、自然时间和 PostgreSQL 未运行，均超出本 docs-only 差异的宣称；历史正式失败仍未解决。若后续证据推翻对照，可修正／撤销本提交，不影响数据。未引入状态分类、默认开关或 authority 扩张，故相关运行时 review lens 不适用。

我的整体评价

交付判断是 justified_increment：补齐完整读取成本的真实诊断，剩余整 Goal／安装恢复与社区正式验收继续由既有 owner 推进，不新造平行 Todo 或全绿等待链。long_horizon=preserved，原历史证明、失败记录和后续迁移／退役路径保持；user_experience=preserved，普通命令和安装旅程没有改变。

code_volume=necessary，compatibility_assessment=not_applicable。相关重构审视已应用为复用现有 ledger 与 typed owner，暂不引入没有消费者收益证明的新持久机制。全部现有改动有可读回证据，公共／私有边界检查通过；剩余最重要证据缺口是完整负载及安装态恢复，而不是把本微观失败报告重标绿。PR 留给维护者合并。

English verdict: APPROVE - exact head 1085bb2; no blocking finding. This docs-only checkpoint reports 80 real-source canonical SQLite read commands at fixed 10k/100k history, with unchanged projection/cursor/original receipts and passing native local checks (3 direct + 19 selected). It preserves the original 2.059x and 13/1/11 formal report and explicitly excludes mutation, concurrency, installed wheel/App, full-domain payload and formal/default qualification. Existing recovery/formal owners retain those gaps; no runtime, budget, authority or format change is approved here.