fix(checkpoint): preserve phase deadlines through full context adoption

[loopx-agent]

A mature checkpoint could restore its workspace and native conversation, then fail research-context adoption because the Core adapter still used the generic 10-second artifact RPC and 30-second native-history read defaults. This left the destination unable to begin its planned research even after launcher qualification.

The existing Core host adapter now permits complete artifact and native-history reads up to 90 seconds each. Warm preparation passes its original absolute phase deadline through adoption. Invalid or expired deadlines reject before artifact IO; late successful reads cannot authorize a subsequent write. Full byte/history checks, current claim and lease checks, immutable context staging, and original prepare/adopt replay identities are preserved. Ordinary callers retain current lease authority; the read allowance grants no execution extension.

This is a follow-up to #6630, based on the latest remote integration head 8548a5b5d352c2c11ce3ac66c22a20bf01041630 of codex/checkpoint-fresh-replan-20261016. It changes four files only; it does not duplicate the preceding stack.

Validation:

• Core context adoption: 16 passed, including real SQLite/typed continuation, lost prepare/adopt/projection/knowledge replies, invalid deadlines, and expiry after initial or last pre-prepare artifact verification without continuation writes.
• Linux receiver/controller/handoff/shared-runtime suites: 227 passed, 3 optional Docker smokes skipped. Two source-packaging checks initially lacked Git in the slim image, then both passed with Git installed (229 passes total).
• Real retained 87-turn point: production restore_workspace → production prepare_context → complete native history/replay → all 105 Explore events → production fresh-before-replan input preparation passed in about 198 seconds in an isolated non-root, network-disabled guest. No model inference or grading occurred. The prior revision failed at Core artifact verification on this same point; the failed attempt is retained privately.
• Semantic advisory found no new vocabulary carriers; full semantic-vocabulary smoke, source equivalence, public/private scan and diff checks passed.

Limits: this qualifies the observed receiver path and deadline/recovery behavior. It does not prove sustained performance, a fresh model's eventual replan or binding, native judging, or a strategy outcome. Those remain separate live acceptance. No active experiment was hot-patched.

Placement and refactor: Core remains the existing Python host IO adapter around TypeScript artifact and continuation authorities; no new decision owner, schema or enum. Local helpers share full-read allowance and expiry checks across the three artifact verifications and two native reads. The benchmark caller forwards its existing deadline. No frontend/Lark operation or scoring, opportunity, scheduler, cold-entry or capture policy changes; the existing benchmark guide discloses the read-default change.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · reasoning_effort=max · observation_id=93709c62b40bc6afa5cc5ee555f900164e54eab5aabc888fd499c776c37410ce

Request changes conclusion (author-owned PR; GitHub blocks formal self-review)

基线变更更正： 此 review 在10:07Z的 APPROVE 只审阅旧 base 8548a5b5d352c2c11ce3ac66c22a20bf01041630 到本 head 的四文件差分。10:09Z，#6622 被外部 squash 合入 e45cda87074e378fc4f339cdc7e64b6476e4364f，随后本 PR 被重定向，head未变。当前完整差分与提交范围已改变；本条现更正为 REQUEST_CHANGES，不保留旧基线的批准效力。旧测试观察保留为下述代码证据，不能当新整合资格。

动机

研究操作者恢复完整 checkpoint 后，需要把保留证据交给当前有权执行的目标任务。
此前 launcher 已读完历史，Core 仍可能在默认 10 秒 artifact RPC 或 30 秒 native 读取处停止；现在完整读取最多使用 90 秒，并受原绝对 deadline 限制。
Core deadline 与原操作恢复的独立验证仍成立；当前重定向后的完整提案因冲突、祖先和 DCO 缺口暂不能批准。
从当前真实远端 integration base 重放仅 Core deadline 修复，保留 DCO，解决冲突并收敛为实际四文件提案；随后按新 head 重新核验。可沿已有作者替代 PR 流程，不在旧头上依靠 tree 相等宣称完成。 真实新决策、后续封存及持续容量仍须独立验收。
本评审不证明科研收益、完整持续运行、通用恢复 UI 或 main 发布，也不授予合并或实验启动权限。

[P2] 将当前提案重放到真实新 base，移除未签署父提交并解决冲突。 实际merge-base回到072，差分扩大为12文件+481/-61；base..head仍含无Signed-off-by的8548。原四文件/旧base批准不覆盖当前提案，native已DIRTY/CONFLICTING、readyfalse。 从当前真实远端 integration base 重放仅 Core deadline 修复，保留 DCO，解决冲突并收敛为实际四文件提案；随后按新 head 重新核验。可沿已有作者替代 PR 流程，不在旧头上依靠 tree 相等宣称完成。 这不是远端 CI 等待：真实 Git 对象已经证明当前提交范围不满足仓库 DCO/基线要求。问题在提交元数据和依赖图，不伪造源码 inline 行。

改动思路

当前 target codex/edgebench-checkpoint-integration-20261016 的实际 tip为 e45cda87074e378fc4f339cdc7e64b6476e4364f，head为 c472e6fed206c572ae40a61f9c7b08ada0412159。本头parent仍为8548，真正共同祖先是 072178167e8e3389986502922495f2cc9a32e919；完整三点diff为十二文件 +481/-61。e45与8548的tree完全相同，但前者是以072为父的独立squash，后者不在它的祖先内。实际 e45..c472 仍列出7b8、8548和c472三提交，其中8548没有Signed-off-by；不能用tree相同或旧四文件评审抹掉它们。

当前 PR 的实际提交范围重带已 squash 合入的父栈，扩大到十二文件且仍含未签署提交；最小可评审边界应回到实际新 base 上的 Core 四文件修复。 当前源码机制保持现有 IO/typed owner；本次必须先修正真实祖先、冲突和 DCO 提交范围，不能把旧基线批准移用到新整合。 完整机制仍沿CLI/WarmStart→现有artifact/native准入→当前Core context prepare/adopt→fresh会话原stdout/CAS；bank锁只保护字节发布，typed owner仍控制当前claim/lease和原操作。先将实际提案收敛，再对新的实际head复核，成本比保留重复父栈并让reviewer逐次重建更低。

具体改动

当前完整十二文件是此前本轮已逐行审阅的 #6622 十文件与原 #6631 四文件的合并集合；head源码没有在本次改base时改变。重新核对了全部最终blob、真实DAG、三点diff和提交body，保留原两套入口与负例证据，不继承结论。

规范依据：docs/architecture/rfcs/hierarchical-agent-stride-control-v0.md#77-research-state-branching-and-matched-continuation，不可变revision e45cda87074e378fc4f339cdc7e64b6476e4364f；该RFC的blob与已读072版本相同。7.7 Research-state branching and matched continuation 对应完整源历史、当前权限和原操作恢复，代码证据保留；Explicit warm worker composition (qualification in progress) 对应原phase/准备成本/机会，代码证据保留；DCO Sign-Off 对应当前range中的8548缺签，判为not_met。仓库Worktree And PR Gate要求实际最新integration基线，不能把文件树同源当成依赖整合完成。

关键代码讲解

• adopt_todo_context：Compose complete reads and original continuation effects。Artifact/native windows up to90 with checks before subsequent writes. Invalid/expired original deadline rejects; original operation/revision/proof preserved.
• prepare_context：Forward original phase to existing Core adoption。Original declaration deadline now passed through unchanged. No fresh phase, lease, Todo or opportunity derived from old context.
• _prepare_fresh_replan：Select sealed pending boundary and prepare fresh input。New explicit pre-replan variant; old completed-review variant remains. Sealed packet exact bytes and typed select_replan equality; attempt must be original.
• _bank_import_lock：Serialize bank byte publication。Native HTTP two-run concurrent import base fails/head passes. Physical owner-only regular lock inode; bounded nonblocking flock; no unlink.
• CodexAgentSession.prepare_checkpoint_refresh：Existing once-only native replacement and output recovery。Exactly one completed-review or pending-replan provenance basis. Original attempt/output and current binding CAS; missing/ambiguous output refuses redispatch.

Core的complete artifact/native读取改为每次最多90秒，并透传原deadline；在下一新效果前复核剩余时间。原prepare/adopt字节、原lease proof与typed receipt owner保留，旧context-only输入和已提交原结果可重放。父栈的fresh处理仍是显式选择，冷入口未增加声明或自动权限；新的pre_replan_basis是原封存pending packet的来源证据，不是历史执行许可。通用共享session和Core诊断保持域中性；没有substring分类或平行Python决策owner。

对主干的风险

本轮原四文件Core套件73 passed；带绝对deadline的九种原操作丢响应重放均通过。真实native source/fork/CLI/cursor/profile套件10 passed、28 deselected。原两层head各有一项真实native＋SQLite＋artifact/session CAS的首次fresh输入及原stdout恢复通过：生产prepare_context、typed selector、native_command及绑定均实际执行；pending packet、任务和模型响应是明确合成数据，不冒充成熟私有点或科研收益。

父栈真实HTTP并发bank导入的相同用例在实际共同祖先072失败、8548通过；shared runtime/SForge/worker在同Harbor0.20.0环境base/head各282 passed、31 optional skips。全量ratchet报告只替换checkout根路径后相同；既有DSH93 statements/51decisions失败未改绿。初次缺Harbor的对照和私有测试字段/函数签名错误保留为harness记录，不作为产品失败或有效对照。

当前十二文件 scope 的 premerge 已另行执行：5 direct中0失败，19 selected实际执行，1项既有maintainability advisory failed；gate=quality_stale_receipt。未放宽原DSH93/51失败或继承旧CQR。

语义与 CI 对齐

完整语义advisory/full smoke与Ruff已通过；当前树仍是相同c472源码，但元数据、merge-base和提交集合必须重新验证。实际native readback现为 DIRTY / CONFLICTING，ready=false，merge_state_requires_update；10:08Z的旧base ready=true已失效，不是新的合并资格。依当前wait_for_ci=false未查询、轮询或等待CI。对方浏览器失败报告只作未独立复跑信息；旧fixture及对应UI源在相关base/head未变，主干f94619f已有read-count修正，不称本PR修复浏览器。

缺失原phase、源/profile漂移、未知输出或变更operation/proof仍拒绝；迟到读不能授权后续新写。Docker/Linux联合barrier、作者成熟guest记录、真实新策略决定和科学效果均未冒称本方通过。#6627仍是另一个OPEN删除提案，当前堆栈不会自动获得它的兼容或整合结论。

我的整体评价

REQUEST_CHANGES，绑定当前 6631@c472e6fed206c572ae40a61f9c7b08ada0412159 及新base e45cda87074e378fc4f339cdc7e64b6476e4364f。Core机制本身的独立验证仍成立，long_horizon在代码边界保留原预算与原结果恢复，user_experience的减少准备失败也仍有代码证据；这不等于当前扩大的提案可交付。当前 PR 的实际提交范围重带已 squash 合入的父栈，扩大到十二文件且仍含未签署提交；最小可评审边界应回到实际新 base 上的 Core 四文件修复。 当前源码机制保持现有 IO/typed owner；本次必须先修正真实祖先、冲突和 DCO 提交范围，不能把旧基线批准移用到新整合。

从当前真实远端 integration base 重放仅 Core deadline 修复，保留 DCO，解决冲突并收敛为实际四文件提案；随后按新 head 重新核验。可沿已有作者替代 PR 流程，不在旧头上依靠 tree 相等宣称完成。 新版本必须核实际父链、完整三点diff、DCO与最新本地/原生资格；不重复启动实验，也不能以旧APP、代码tree一致、receipt或外部merge替代。通用恢复UI、持续容量、真实新决定/后续封存和科研效用仍留在原验收。

English verdict: REQUEST_CHANGES — 6631@c472e6fed206c572ae40a61f9c7b08ada0412159 was retargeted after the parent squash. Its actual merge base is072, expanding the scope to12files and retaining unsigned8548; native readiness is now DIRTY/CONFLICTING and false. The old4-file approval is superseded. Replay only the Core fix on the actual current integration base, preserve DCO and review the new exact head. No merge or experiment authority.

[mergify]

This pull request has merge conflicts with codex/edgebench-checkpoint-integration-20261016 and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/codex/edgebench-checkpoint-integration-20261016
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/codex/edgebench-checkpoint-integration-20261016 and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[loopx-agent]

Superseded by #6636 on the latest integration base after #6622 was squash-merged. The replacement has the same complete code tree as this head, a single signed commit, and only the four intended changed files. Fresh-worktree context-adoption and semantic checks passed; independent review is requested on the replacement exact head/base. This branch and the existing review history are preserved.