fix(stride): accept source-verified Explore pagination references

[Jim-jimu]

Goal And Delivered Outcome

A stride review can read an omitted Explore finding through the generated pagination command, then fail to cite it because considered_refs only accepts the default bounded context. This change lets the review attach the page's revision, offset and limit. Writeback resolves those coordinates against the current Explore source before admitting the cited finding.

• Outcome basis: reproduced source CLI integration gap; no separate issue.
• Before → after: a second-page finding is refused on the baseline; the same review now commits, settles once, and retains its citation in the next review. Wrong pages, forged membership and stale source still refuse before writeback.
• Base: loopx-project/loopx:main at af3ed549ee2679ea18d1e1edd733c40dd4c652f8; initial reproduction used b77f63495f2619237380755178c0780ae10a0f26.

Implemented Against

Specification: Structured stride control and Stride RFC §7.6 at the same baseline.

Criterion	Disposition	Implementation / validation
Scoped Explore references and omitted-result reads	implemented for global result pages	Existing Explore projection replays page membership; real CLI continuation and writeback regression
Source revision, review identity and original-Turn recovery	implemented	Existing stride/replan owners retain basis/context checks; stale-page correction preserves settlement identity
Subsequent review and historical readback	implemented	Extended review → work → review test retains page coordinates with the accepted decision

Self-check: traced both production readers and the typed qualifier, verified baseline failure, reviewed the complete diff, and exercised source drift, foreign references, peer-authored findings, read-only recovery and idempotent settlement.

Scope And Continuation

• Complete for revision-bound global Explore result pages. The optional v2 explore_review.result_pages field accepts at most three distinct pages; considered-reference limits and the existing Vision budget remain enforced.
• Page coordinates are claims to be source-checked, not caller-authored finding membership or proof of model understanding. Unresolved pages do not make an otherwise readable source appear unavailable.
• Existing decisions without pages, historical v1 reads and strategy-off behavior retain their paths. Older binaries do not support the new optional field. Reads create no receipt store, claims, spawn permission or extra quota debit.
• Node-filtered pages and planner detail routes are outside this citation path. Live-model adoption and research utility remain separate qualification work; no new successor task is needed for this scoped repair.
• Related cleanup shares one page-descriptor decoder between the existing Explore and stride owners. No new planner or scheduler is introduced.

Validation

• Final head: 6e25cc266bdd80254c7e318ed891705e2507a1ed. Relevant checks were repeated after merging af3ed549e. Broader runs below used the earlier working-tree content committed as f9c0f385c (tree f4a7fa2ee151ccecc1d9d84d04cfe217c3f5f955).
• Run state: partial; relevant checks finished, broader Python run interrupted after reported failures.
• Input classes: synthetic, public_fixture.

Check kind	Result	Public-safe evidence / limitation
regression_parity	passed	New CLI pagination regression fails on baseline b77f63495f26 because the descriptor is unsupported; passes with this change
real_entrypoint / integration	passed	60 tests across Explore context, long-chain closeout, replan ordering and Host projection; real source CLI, isolated local files, three admitted Turns, refusal-before-write, source-change recovery, retained history and single debit
unit	passed	39 focused TypeScript tests covering stride, replan and pagination; malformed descriptors, foreign Goal/reader, missing source replay, drift, unavailable/off paths and existing budget
unit	failed (baseline failure reproduced)	Before upstream sync, npm run -s test:control-plane: 4,551 passed, 38 skipped, one failure in content_digest_single_owner.test.ts. The unchanged baseline reproduces the same three existing duplicate digest matchers; this change uses the shared matcher. After sync, all 39 focused tests and 16 digest-owner tests pass; the same baseline failure remains
unit	failed / incomplete	Before upstream sync, python -m pytest -q -n 4 --maxfail=5: 6,563 passed, 312 skipped and five failures in test_actual_default_model_behavior_portfolio.py; interrupted after 18 minutes to inspect failures. All five reproduce on unchanged b77f63495f26 with the same source/actor semantic-contract mismatch. The rest of the full suite is unverified
static	passed	Control-plane typecheck, repository Ruff scope, configured mypy, semantic advisory/drift and diff checks
integration	passed	Risk-based premerge: loopx canary premerge --from-git-diff: all 19 selected checks and five direct checks passed, with no warnings
static	passed	CLI output-budget regression, bilingual docs governance and public-boundary scan

Reproduce the CLI journey in the active checkout environment: LOOPX_USAGE_PING=0 python -m pytest -q tests/control_plane/test_long_chain_projected_closeout.py.

Coverage and gaps: no live model, installed App, PostgreSQL or hosted CI qualification is claimed. The changed citation path uses the existing local Explore source and typed rules. Node-filtered citation support is excluded. Python subprocess tests used the active checkout virtual environment. The earlier global-executable mismatch was resolved in the test environment; all 17 repository-change-window tests then passed. The existing digest-rule failure is disclosed above.

Frontend / Visual Evidence

• UI impact: none. This extends an existing Agent decision attachment and its source validation; no setting, layout or navigation change.
• Before / after / states / attention / craft: N/A.
• Source data: synthetic.

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

Existing Stride §7.6 evidence-bound decisions and Explore result reuse. This does not claim completion of adaptive research or demonstrate scientific benefit.

Shared-authority RFC fixture impact

N/A: no store schema, provider routing, migration or promotion change; no progress against the shared-authority migration is claimed.

Boundary Checklist

• No private state, credentials, raw traces, internal links or local machine paths in the diff or PR body.
• No duplicated maintainer-owned benchmark work.
• Scope stays within the reproduced citation gap.
• UI impact is marked none.
• Every contribution commit includes a DCO sign-off.

[loopx-agent]

Reviewer: model_agent / gpt-6-astra / OpenAI / runtime_reported / high

审查版本：48224d17b671f8ab2596bcc619f0e32afb9b9784；基线：dfbf8fa657b785f040723c0597c13c283476e666。

动机

同时使用 Explore 与 stride 的 Agent 需要把补读的历史结果用于复盘决策。此前合法的第二页结果即使已被读取，也不在初始摘要允许引用的集合中；回写会拒绝它，迫使 Agent 只使用较窄的摘要。修复后，Agent 可提交有界分页坐标，系统从当前权威源重新核实成员，再接受对应引用。本 PR 不改变研究策略、预算或评测规则，也不证明模型会因此选择更好的研究路线。

按修改前的既有协议审查：Omitted-result reads 要求被省略结果有可用补读路径；Source revision and recovery 要求来源变化后重新核对、不能重复结算；Historical readback and off 要求历史兼容与关闭路径不受影响。三项均有实际入口或对应边界验证。Research utility 仍属于后续实验，不能由协议通过推导。

改动思路

保留现有 Explore 结果排序、全量来源 revision 与 TypeScript 决策 owner。模型只提供最多三页的 revision/offset/limit，不能自行指定页内成员；现有来源投影重放分页并给出成员，stride 才扩展合法引用集合。不是放宽为任意已知 finding ID，也不把所有历史结果塞进默认上下文。

具体改动

关键代码讲解

1. normalizeExploreResultPages（explore_result_page.ts:7）规范化可选坐标：严格字段、共享 digest 校验、非负安全整数 offset、1–20 的 limit，拒绝重复页及伪造 finding_refs。这是既有 Explore/stride 合同的可选字段扩展，没有新增状态枚举或独立能力。
2. projectExploreTurnContext（explore_turn_context.ts:56）用既有完整结果集合及排序重放所请求的页。revision 不匹配不会返回可信成员；Goal、reader 和 node 范围仍由既有来源约束。replan_context.ts 将可信页传递给校验器，补读不改变原 replan 身份。
3. strideReviewMismatch（stride_policy.ts:231）先校验原 Explore basis，再逐页匹配当前来源坐标和 revision，只接受默认摘要或已核实页中的引用。历史 v1 读取保持兼容；新鲜决策仍走原有 v2 规则。
4. refresh_state_run 的 read_explore_context（state_refresh.py:1081）把已经规范化的坐标交给现有 Python IO adapter，再调用 TypeScript 来源与决策逻辑；Python 没有复制成员判断。来源变化后，可在原 Turn 重读、修正并结算。

其余改动是中英文 RFC、协议和 Explore 使用说明；新增分页边界测试、扩展既有真实 CLI 长链测试、登记共享 digest consumer 及 TypeScript 测试配置。共 14 文件、311 增/6 删，未新增配置界面、调度器或持久化 owner。相关 #6373 优化投影摘要摘要量，仍保留来源 revision；本 PR 解决引用可接受性，二者职责不同。

对主干的风险

最值得防的是将模型声称读过的任意 ID 当成可信来源，或者补读导致第二次结算。实际验证覆盖：合法第二页 → grow/switch 决策 → 后续工作 → 下一次复盘历史；错误页、跨范围引用、伪造成员被拒且不落状态，旧来源 revision 被拒，补读修正后继续原 Turn。它证明来源成员资格，不证明模型理解或采纳了证据。

验证结果：

• 真实隔离 CLI 长链：head 9 passed；将完全相同的测试放到基线，7 passed / 2 failed，两项分页分支被旧版以 explore_review contains unsupported fields 拒绝。
• Explore/replan 上下文三套 Python 测试：基线与 head 均 51 passed；stride、replan、Explore 的 TypeScript 相关测试 35 passed。
• TypeScript typecheck、修改文件 Ruff、diff whitespace、语义 advisory 通过。风险选择的 premerge canary 10 项 catalog 检查＋5 项直接检查通过，没有手工 hold；没有声称跑完全部仓库测试。
• 额外运行修改到的 digest owner 套件：基线和 head 均 16 passed / 1 failed，均报告 goal_amendment_authority、turn_envelope、stride_policy 三处既有私有 matcher；仅行号随 import 移动。新增 helper 使用共享 matcher，consumer 登记断言通过。此失败已做同基线归因，不隐瞒为全绿。
• 未查询或等待远端 CI，遵循本次 review packet 的 wait_for_ci=false；没有启动付费模型或 benchmark。默认无分页与关闭 Explore 路径通过配对覆盖。分页只支持这里声明的全局结果视图，不能用 node-filtered 页绕过范围约束。

没有发现新增阻塞项。回滚不需状态迁移；已保存的分页元数据随决策读取，禁用策略不授予额外权限。相邻重构已经落实为一个小型、类型化分页规范化 helper，避免 producer/consumer 各自定义页格式；无需再扩展抽象。

架构判断：复用既有 Explore 来源和 stride 校验，只补上受界分页的来源重放。

补读引用的来源核验与回写接续；完整 checkpoint 和研究收益独立验收。

我的整体评价

复用既有 Explore 来源和 stride 校验，只补上受界分页的来源重放。

补读引用的来源核验与回写接续；完整 checkpoint 和研究收益独立验收。

建议合并。它修的是“历史证据可以查到，却无法合法用于决策”的具体断点，符合既有 owner 和失败恢复合同。当前交付边界是补读引用的来源核验与回写接续；完整 checkpoint 恢复、研究路线收益及模型实际采用仍须分别验证。无需把这些不同验收项塞入本 PR，也不应因这次合并声称长程收益已提高。

English verdict: APPROVE - 48224d1. Source-verified bounded Explore pages repair a real stride writeback gap without accepting caller-forged membership. Real CLI continuation, stale-source recovery and off-path checks pass; the digest inventory failure is identical on the base. No research-utility claim.