fix(periodic-report): recover hooks from original canonical writebacks

[hhyykk]

After a canonical stage refresh commits, an interrupted optional report hook can lose its milestone: a later open Todo makes replay evaluate the latest frontier instead of the committed one. File/SQLite public CLI regression fails on main with zero intents; this change recovers one validated, discoverable milestone from the original writeback without another refresh or quota spend.

The existing TypeScript coordination owner validates the retained source authority, store lineage, revision and cursor, or the exact terminal operation/completion receipt. Refresh and Turn adapters reuse that source and the history prefix through the exact persisted run. Direct Turn execution/replay drains the existing optional hooks after primary settlement; terminal attribution requires the current same-Agent closed Vision. Large sources reuse the digest-checked private transport with its unchanged 64 MiB cap.

Canonical refreshes retain optional todo_source metadata even when reporting is off; this adds no caller requirement and does not activate reporting. Feature-off performs no optional settlement/source reads or sidecar writes. Primary settlement, host execution and spending remain unchanged.

Validation:

• Real File/SQLite public CLI: 13 cases, including interrupted original-source recovery after a later Todo, enabled/off Turn, exact replay and malformed optional sources; wheel and sdist each pass the same 13 cases with installed source hashes verified.
• Historical source/provider tests and TypeScript typecheck pass; over-2 MiB sources qualify the existing private transport. Isolated PostgreSQL 17.11: authority340, archive4, service1 pass; no full PostgreSQL Turn claim.
• Focused stage/hook checks, Ruff, diff checks and full staged-tree semantic scan pass. Premerge catalog9/10 and risk8/8 pass; its Dashboard budget remains failed. Same standalone workload on main and this change gives22,560/22,500; no budget change or hidden skip.

This is a source-recovery and caller-adoption slice, not completion of the entire Turn milestone journey. Native accepted-successor production depends on #5935 and its lawful replanning path; atomic refresh/Todo-frontier persistence, direct Turn legacy/unanchored recovery, full PostgreSQL Turn and frontend/Lark qualification remain open. The existing legacy CLI projection retains compatibility. No report generation, external publication or new capability authority is granted. Runtime merge remains maintainer-owned.

[hhyykk]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=ultra

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Exact head: 713b7fe

动机

启用周期报告的操作者在阶段写回成功、报告钩子中断后重试，会遇到已完成的里程碑丢失：期间新增的 Todo 改变了当前前沿，旧实现用最新状态判断原始写回。相同 File/SQLite 公开 CLI 反例在固定 main 上均返回零意图；本 head 都恢复一个可发现的已验证里程碑，没有再写回或扣额度。它交付原始来源恢复和直接 Turn 调用接入，不宣称整个 Turn 里程碑、前端报告旅程或 TypeScript 迁移已完成。原生接受后继生产依赖 #5935，完整 direct Turn 正向路径、原子 refresh/Todo 持久化、完整 PostgreSQL Turn、旧来源恢复和 frontend/Lark 仍是现有 owner 的后续验收。

改动思路

复用现有 TypeScript coordination 的事务历史、store identity、规范 Todo 集合与完成收据。新增只读来源方法，不建立另一套持久化、接受决策或阶段生命周期。Python 保留 CLI/报告适配职责；钩子注册、输入、意图及侧车收据仍由已有 TypeScript 生命周期监督。捕获来源比重试时读最新状态可靠，而复用私有大快照传输比提高 socket 上限直接。

规范先于实现读取：固定到 main 82d1b83 的 post-writeback RFC 第5节要求来源于已提交收据、重放恢复同一身份、钩子失败不影响主结算；同修订 periodic-report 协议要求 closed current Vision 和已验证继续结果。本次实现这些来源与当前 Vision 边界；完整正向集成仍依赖 #5935 与本 PR 的联合验收。

规范文件为 docs/architecture/rfcs/provider-neutral-post-writeback-capability-hooks-v0.md; docs/reference/protocols/periodic-report-v0.md，修订均为 82d1b837479dd5eb64b581bb0ca36d8c1ff1f0cc。post_writeback 的提交来源与恢复边界、bounded_segment_milestone 的当前 Vision 要求已实现；vision_successor_required 的完整直接 Turn 正向集成仍由 #5935 与本 PR 联合验收。

具体改动

1. refresh_state_run 将已经用于规划的四个来源字段写入原始 run，紧凑索引也保留它们；checkpoint 补充继承原锚点。canonical_snapshot.py 保留既有 store identity。没有额外读取当前头来补造来源。
2. readLocalCoordinationTodoSource 校验来源权限类型、store lineage、revision 和 cursor，再读该唯一历史事务。终结路径复用 completionTurnOperationId，比对同 Goal/Todo/Agent/Turn 的操作与完成收据；当前头变化、错误谱系、无效 cursor 或缺失历史都不能替代原事务。已有 canonicalTodoCollection 继续负责完整 Todo 与验收读模型。
3. read_report_source_history 要求原始时间、settlement identity 和 JSON artifact identity 唯一匹配，以 append 顺序截断历史；同秒的后续写入不会被借入。报告 builder 同时消费历史 Todo 与这段历史，拒绝只提供其中一半。
4. drain_committed_turn_post_writeback_hooks 在公开 Turn 主结算返回及重放后，分别恢复 refresh 与终结来源。关闭报告时直接退出；坏来源只产生可选失败，不能重复 host、refresh 或 spend。stage_completion_from_runs 的终结分支必须选中最新同 Agent Vision，不能跳过新的 active 或非 material closed Vision 复用旧阶段。

运行时 handler 与 Python/TS transport allowlist 接通同一个只读方法；大来源使用既有摘要校验私有传输，保留64 MiB上限。registry IO manifest 仅更新四处已登记调用坐标。六个测试文件覆盖实际 CLI/安装包、阶段否定、历史 File/SQLite 来源、provider 失败、超过2 MiB传输和真实 PostgreSQL；两份文档更新既有协议与 T3 检查点，没有另建路线图。

对主干的风险

主要风险是借用另一时间或 store 的事实，把旧阶段认作当前完成。原始锚点、唯一历史位置、事务/收据一致性和当前 Vision 检查共同拒绝这些情况。独立审查发现大来源 socket 上限、坏锚点逃逸和旧 closed Vision 误归属，均已修复并重验。File/SQLite 实际完成收据在 CLI 路径验证；TS 收据单测另含合成 fixture，不把它当作实际完成的全部证据。

可用的 todo_source 元数据无论报告开启或关闭都会保存，这是已披露的可选持久化字段增加，不要求调用者补输入。关闭报告不读可选结算/来源、不写钩子侧车；主结算、host 和额度效果保持原有行为。意图 write scope 为空，generation 与 external delivery 授权为 false。缺失历史或直接 Turn 旧/unanchored 来源失败关闭；现有旧 CLI 投影继续兼容，但不算历史恢复资格。超过64 MiB来源仍失败，不宣称任意规模合格。

当前 head 230项调用/阶段/钩子回归通过，13项实际 File/SQLite CLI 检查通过，wheel/sdist各13项通过且安装源码哈希一致。TS来源/provider检查、typecheck、Ruff、diff及新文件已登记后的完整语义检查通过。隔离 PostgreSQL17.11 的 authority340、archive4、service1通过，服务器均已停止；未验证完整 PG Turn、真实 host/model、前端/Lark、生成或对外发布。最初打包因缺少 Chat 构建失败，安装测试又暴露 fixture 缺少明确工作区，分别补构建与明确参数后真实安装路径通过，没有放宽产品校验。

语义与 CI 对齐

本次扩展既有 local snapshot 方法词汇与 coordination 只读请求/结果，复用原来的事务、cursor、完成收据和钩子 owner；没有新共享状态生命周期或平行 Python 接受源。四字段可选来源元数据和终结 current-Vision 拒绝是明确披露的行为变化，完整 staged-tree 语义检查通过。

预合并目录9/10、风险8/8、直接与公开边界检查通过；唯一失败仍为 Dashboard 预算。相同 standalone 工作负载在 main 与本改动均为22,560字符，超过未改动的22,500上限；canary启动环境的22,728单独保留，不混作相同测量。该故障未被隐藏或提高预算。新远程 CI 待完成，评审不替代合并就绪。

我的整体评价

结论为 justified_increment、APPROVE。真实旧来源丢失反例在两种后台与安装包上恢复为一个可发现的里程碑；长期恢复和既有 CLI 重试体验在此边界 improved。21文件规模包含595行真实调用测试与137行TS历史/负例，生产复杂度集中在现有事务读取和调用适配，没有新的配置或通用框架。相关收敛已应用：共享历史读取、既有操作身份与 Todo 集合 owner；完整直接 Turn 后继路径由 #5935集成验收继续推进，不另造来源变更。本结论不关闭父任务，不授权自合并，运行时合并由维护者负责。

English verdict: APPROVE 713b7fe. Exact original canonical sources recover one pending milestone after hook interruption and later Todo mutation, without repeating primary effects; both main counterexamples fail before this change. 230 regressions,13 real File/SQLite CLI cases,13 each wheel/sdist, and isolated PostgreSQL340/4/1 pass. The unchanged Dashboard budget remains failed and CI pending. Direct Turn-native positive integration with #5935, full PG Turn, legacy source and frontend/Lark qualification remain open; maintainer merge required.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh

动机

已启用周期报告、通过原生 CLI 结算阶段的用户或 agent。 原来：阶段写回成功，但可选报告 hook 的响应中断；后来新增一个未完成任务，重试会读取最新任务集合，丢失原阶段的报告候选。现在：重试绑定原写回时的任务快照和截至该写回的历史，恢复原候选，随后新增任务不会污染它。

真实 File/SQLite CLI 在写回后中断、另建任务、原 key 重试的流程中恢复一个可发现的 pending intent；阶段写回和额度支出均只有一次。 本 PR 不自动生成报告、授权外部发布、重新执行 host 或再次扣额度。 直接 Turn 的完整 accepted-successor 里程碑路径依赖 #5935 及合法重规划；原子 refresh/Todo-frontier、旧或无锚点 Turn、完整 PostgreSQL Turn、安装包与 App/Lark 产品路径，本轮未资格化。

改动思路

原始快照验证复用既有 TypeScript coordination owner，Python 只适配已提交事实并调用既有报告规则；可选 hook 在主结算之后运行，不获得主执行权限。 本 PR 交付可实际重试的原始来源恢复与 CLI/Turn 调用接入；报告生成、外部投递和整个 Turn 里程碑旅程仍由原能力及已声明后续边界负责。

不修改会继续丢失原候选；重读最新状态不能还原原始阶段；重新执行主 Turn 则可能重复工作和支出。因此保存实际消费的来源身份，再复用原 provider 的历史事务读。新增的是来源事实和适配入口，没有另一份 Todo 权威或报告决策 owner。

独立规范是 docs/reference/protocols/periodic-report-v0.md，spec_revision 82d1b837479dd5eb64b581bb0ca36d8c1ff1f0cc：Post-writeback hook boundary 要求在主写回后按稳定身份恢复、失败隔离；Trigger decision 要求真实可报告阶段；Product activation 与 Host handoff boundary 保持显式启用、生成和外部投递权限分离。本 PR 新文档只披露实现边界，不反向充当验收依据。

具体改动

完整 head 713b7fe8abb208765e07ee75c7161ac84eb34cd1，base 82d1b837479dd5eb64b581bb0ca36d8c1ff1f0cc；21文件 +1329/-35。state_refresh.py 在原规划快照上保存 optional todo_source（provider、store identity、revision、cursor），checkpoint supplement 保留原 anchor。该元数据即使报告关闭也保留，已明确披露；不新增调用者必填输入，也不启用报告。

readLocalCoordinationTodoSource（local_authority_read.ts:37）区分原 snapshot/terminal 两种严格输入，验证实际 store lineage、历史 cursor/revision，terminal 再核对原操作、receipt、actor、Turn 和完成事实，使用原 canonicalTodoCollection。completionTurnOperationId 直接复用；effect handlers/server/Python bridge 使用既有 digest 私有快照通道，保留64MiB cap，普通2MiB通道不放宽。

read_report_source_history（todo_source.py:23）选唯一原 run，按追加顺序取截至它的完整前缀；后续同秒记录也排除。post_writeback_hook.py 使用原 source/历史和既有 report evaluator。stage_completion.py 只允许当前同 agent 的 material closed Vision 支撑 terminal，避免借用被新 Vision 替代的旧闭合。

drain_committed_turn_post_writeback_hooks（turn_post_writeback.py:25）在真实 execute/resume 主结算之后读取原回执、派发 refresh/terminal observer；关闭时先返回，optional 失败形成可重试来源失败。turn_run_once.py 真实接入。两份协议/RFC文档保留未资格化边界；registry map 是源码位置更新；六个测试文件覆盖真实 CLI、stage、provider历史及完整私有传输。

对主干的风险

最强反例是中断后读了新任务/新 Vision，导致虚假或丢失 milestone，或重试重复主执行。独立相同 public CLI harness 在 base 的 File/SQLite 两例都实际失败（0 intents），本 head 两例通过（1 pending intent）。另两例在原 run 后追加同秒 ACTIVE Vision，真实 refresh replay 仍恢复原候选。报告关闭时两版相同实际 Turn/resume 两例通过：没有 hook/sidecar，host、refresh、spend 各一次；head 主测试还直接计数 optional source reads 为零。enabled 的 baseline 两例因尚无 hook 入口失败，head 对应两例通过，保留这项有意增量。

本轮124项 Python、379项 TS 通过；TS 包含隔离真实 PostgreSQL17.11，零 skipped；typecheck 通过。File/SQLite 真 CLI 覆盖 malformed source、普通无阶段进度、当前/被替代 Vision、延后 Todo 与原 key 重试；历史 reader 验错 lineage/revision/cursor/actor/Turn，>2MiB完整 source 使用既有私有通道。没有把 author 的 wheel/sdist 或完整 PG Turn 宣称当成本轮独立验证。

原生 premerge：5项直接检查通过，19项选定检查中18通过、1失败。失败是既有 dashboard budget：native runner 在不可变 base/head 都是22,728 >22,500；standalone 两版都是22,560 >22,500。不同运行环境测量分别保留，预算/fixture/dashboard因果路径未被本 PR 修改，受影响的来源恢复另有独立通过证据。该失败未修复、未放宽、未隐藏，仓库质量合并门仍未通过；代码 APPROVE 不把它变绿。首次不存在的测试路径已修正，属于验证入口错误。未查询、轮询或等待 CI。

我的整体评价

APPROVE 当前可用、独立可撤回的来源恢复增量，没有受影响契约的阻塞发现。原始快照验证复用既有 TypeScript coordination owner，Python 只适配已提交事实并调用既有报告规则；可选 hook 在主结算之后运行，不获得主执行权限。 本 PR 交付可实际重试的原始来源恢复与 CLI/Turn 调用接入；报告生成、外部投递和整个 Turn 里程碑旅程仍由原能力及已声明后续边界负责。 有限未来重构已体现在 canonical collection、completion identity、私有传输及报告 evaluator 的复用；没有引入重复策略框架。

直接 Turn 的完整 accepted-successor 里程碑路径依赖 #5935 及合法重规划；原子 refresh/Todo-frontier、旧或无锚点 Turn、完整 PostgreSQL Turn、安装包与 App/Lark 产品路径，本轮未资格化。 已有后续 owner/依赖维持原验收，不能把这份结论称作完整周期报告业务验收。默认安装和模型实际采用未测。Core 合并由维护者负责；预算质量门继续保持失败，需独立处理。

English verdict: APPROVE - 713b7fe; original committed sources and historical prefixes recover the lost pending milestone without repeated primary effects or publication authority. 124 Python/379 TypeScript tests with real PostgreSQL17.11 and typecheck passed; same-harness regression sensitivity and off/replay checks passed. The unchanged dashboard budget failure remains a separate merge-quality hold; full Turn/installed companion journeys remain unqualified.

[hhyykk]

Composition qualification for #5935, #5939 and draft #5951 on main 21707b7fb64123df02e730bf7959192010f85a1b:

• Runtime input heads: fix(periodic-report): recognize native accepted Vision successors #5935 1a34dcc36eebe2f6aa23b06398996e8affb24724; fix(periodic-report): recover hooks from original canonical writebacks #5939 713b7fe8abb208765e07ee75c7161ac84eb34cd1. Draft test(periodic-report): preserve Turn milestones through retry recovery #5951 contributes only the durable direct-Turn regression module at 852344fd1caa0613a0d019141b92f9c25f95b94e.
• The composed source passes122 native/stage/hook/direct-Turn cases. The preserved three ordinary/superseded-stage negative failures are now passing; no assertions were relaxed.
• Fresh composed wheel and sdist each pass26 actual native/terminal/Turn CLI cases, including the8 File/SQLite direct accepted-successor cases. Thirteen production source hashes and installed provenance match; no source-checkout fallback.
• Failure before terminal dispatch changes Todo and Vision before the first successful retry. Response loss retries after real dispatch. Both retain original-source stage, one host invocation/refresh/spend and no external effects. Feature-off does not read optional settlement state or create sidecars.

This qualifies the composed canonical File/SQLite caller and recovery boundary, not full PostgreSQL Turn, frontend/Lark, live model/provider adoption or the entire report/migration lifecycle. The standalone #5935 legacy Todo historical/current-terminal limitations remain disclosed; #5939 owns canonical source/current-Vision semantics. Draft #5951 stays dependent until runtime heads are adopted and its eight cases pass on resulting main. Existing budget/CI/maintainer holds remain; no self-merge.

[hhyykk]

CI qualification update for exact head 713b7fe8abb208765e07ee75c7161ac84eb34cd1:

Five deterministic failing cases sampled from the two failed Python shards reproduce with the same first failure on merge base 82d1b837479dd5eb64b581bb0ca36d8c1ff1f0cc and this unchanged head. Four also reproduce on inspected main a1890a37f4f759bc2e39823074bbe78f78e49fdb:

• native-child replan and failed-child closeout: the initial guard already includes settlement_identity where their shared assertion expects deferred binding;
• canonical history/status artifact observation: the fixture adds malformed index lines; strict settlement readback rejects them;
• invalidated-successor guard reentry: the existing receipt/obligation identity conflict precedes this PR;
• long-chain durable ACK: its canonical fixture supplies the parser's content_revision as an unversioned Todo domain field, rejected by the existing TS schema.

The relevant tests and owners are outside this PR's 21-file diff. This establishes baseline failures for these samples, not a green CI result or qualification of every failed test. Local checks used each intended checkout's source interpreter on macOS Python 3.13; CI used Linux Python 3.11. Paid-model transport failures and other unrelated CI failures were not rerun. The CI merge hold remains. The native binding contract is being checked before changing its assertions; strict schema/settlement rejection will not be weakened to make fixtures pass.