[Duang777]

Summary

Current main has two independent CI failures: duplicate whole-value digest matchers and a research smoke that assumes Escape closes analysis while a help popover is open. Reuse the existing bare/enveloped SHA-256 owners, register both real consumers, and explicitly close the analysis reader before testing scope selection.

trajectory input digest -> content_digest.BARE_SHA256_PATTERN
native report Turn key -> content_digest.ENVELOPED_SHA256_PATTERN
research smoke -> close reader -> wait until hidden -> select unanalysed scope

The four-file diff is +8/-3. The smoke repair from #7219 stays in a separate signed commit within this PR so one branch can qualify both current-main CI failures. Bootstrap #7192 and lease #7204 remain separate proposals.

Evidence

• Before: the ownership guard reports the trajectory input matcher on the original base and the report-recovery matcher on current main. The complete research-history browser scenario also fails because Escape correctly dismisses a visible context-help popover while preserving its analysis reader.
• After: 59 focused TypeScript tests and 59 native-report/host Python tests pass. The complete research-history scenario passes in development and packaged builds with the explicit close precondition. Existing help-dismissal, keyboard-close, scope-selection and zero-analysis-write assertions remain.

Merge Danger

Door: two-way

Blast Radius: validation

Both canonical matchers accept the same language as their former local copies and have no stateful flags. The smoke changes its setup, with no application Escape, scope selection, analysis execution or storage change.

Goal And Delivered Outcome

• Outcome basis / optional anchor: reproduced current-main digest ownership and browser qualification failures found while following fix(bootstrap): validate goal ids before path construction #7192, fix(leases): canonicalize equivalent write scopes #7204 and this PR.
• Goal/source and gap: contributors cannot qualify full CI while duplicate digest rules and an invalid smoke setup remain on the baseline.
• Observable before -> after: existing ownership assertions pass without narrowing their scan or adding exceptions; the same complete browser scenario passes without changing expected values or removing its no-analysis-write assertion.
• Issue/task and intended base: related to fix(bootstrap): validate goal ids before path construction #7192, fix(leases): canonicalize equivalent write scopes #7204 and the absorbed fix(tests): close analysis explicitly before changing its scope #7219. Integration baseline: main at 659c1fd.

Author Declaration

• Written by: Codex, OpenAI, with user-authorized follow-up, implementation and submission.

Implemented against

• Specification and revision: existing content_digest_single_owner.test.ts, native report-recovery tests, and research-history no-analysis-write/help-dismissal assertions at 659c1fd.

Criterion	Disposition	Symbol / path	Test or command
Bare and enveloped whole-value digest rules have one owner	implemented	trajectory_input_usage.ts, steward_managed_mode.ts	content_digest_single_owner.test.ts
Real consumers import and use a canonical export	implemented	CANONICAL_CONSUMERS	Existing full-package static guard
Trajectory statistics and native Turn-key admission preserve behavior	implemented	Existing production consumers	Trajectory, steward_reports and native-report/host suites
Close analysis before testing an unanalysed scope	implemented	research-history.mjs	Complete development and packaged browser scenario
Help dismissal preserves the reader, and scope selection performs no analysis	implemented	Unchanged existing assertions	Complete research-history scenario

• Self-check before submission: inspected all four files and matcher flags; reproduced both current-main failures; observed the actual visible help popover and unchanged analysis route; ran the affected suites and complete browser scenario; checked public boundaries and signed commits.

Scope And Continuation

• Completed scope and remaining work: complete within these CI failure repairs. Remote CI and exact-head review remain pending.
• Slice boundary / successor: N/A. The separately reported packaged goal-hierarchy timeout passed locally in both build modes; its old build was queued for recheck, and refreshed CI will requalify it.
• Bounded refactoring: reuse existing digest exports; no new owner, protocol, configuration, exception or application interaction.

Validation

• Tested revision: 35e99bf18b5df593283c6aec16bf604a2b765b89.
• Run state: finished.
• Input classes: synthetic.

Check kind	Result	Public-safe evidence / limitation
regression_parity	passed	Both digest copies trigger the unchanged owner guard before repair. Canonical matcher character sets, anchors and flags preserve existing accepted formats.
unit	passed	59 TypeScript tests across digest ownership, trajectory input, trajectory assessment, native usage and steward reports.
unit	passed	59 Python tests across native steward report and Turn-host boundaries. These use synthetic fixtures and do not prove real-model behavior.
regression_parity	passed	Complete research-history scenario fails before the two-line smoke repair and passes after it, retaining zero-analysis-write and help-priority assertions.
integration	passed	Complete research-history scenario in development and packaged builds, Node 24.15.0, isolated Chromium contexts and synthetic fixtures. Both research-history and goal-hierarchy packaged scenarios also pass on the combined head.
static	passed	Control-plane TypeScript typecheck and dashboard build. Final combined-head standard diff canary: 4 direct checks, 2 catalog checks, 8 risk-profile smokes and the selected public-boundary scan passed.
integration	passed	Historical original fc7016b full control-plane suite: 5,413 passed, zero failures, 75 optional PostgreSQL skips. This does not certify the expanded current head's complete suite.
integration	not_run	Full Python and full TypeScript suites were not repeated locally for the expanded head. Required remote CI and independent exact-head review remain pending.

• Coverage and gaps: this qualifies existing validation consumers and the browser smoke's setup. No production state, real model, default-provider migration, installed-device journey, benchmark cost or adoption claim is made. The prior approval targets the original fc7016b; the expanded head needs fresh review.

Frontend / Visual Evidence

• UI impact: none.
• Before: N/A.
• After: N/A.
• First viewport and preview: N/A. Application rendering is unchanged; failure/pass and read-only DOM observations explain this test-only precondition repair.
• States and viewports shown: N/A.
• Source data: synthetic.
• Attention review: N/A.
• Craft review: N/A.

Type of Change

• Bug fix
• Refactoring (no functional changes)
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Build, packaging, installer, or CI

Technical Direction

• Direction / acceptance reference, when applicable: core control-plane ownership and reliable browser qualification.

Shared-authority RFC fixture impact

• N/A. No fixture schema, provider, compatibility projection, authority policy or persisted format changes.

Boundary Checklist

• No private state, credentials, raw traces, internal links or local paths are published.
• No maintainer-owned benchmark work is duplicated.
• The changes stay scoped to the demonstrated failures.
• No paired RFC changed; committed bilingual check passed.
• UI impact is none.
• Every commit includes a DCO Signed-off-by trailer.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · reasoning_effort=max

APPROVE — 未发现当前 head 的阻断问题。 精确 head fc7016b1ede30d6097cafb6730abf2fd08fc564b，基线 6f8b181400dc650234891b32b2bd99f3f3836164；本轮重新检查完整两文件及原调用路径。

动机

运行摘要单一所有者检查、维护轨迹用量统计的贡献者。

原来轨迹输入估算器另写了一份摘要格式正则，现有守卫因此失败；本次直接使用已有所有者，并登记这一实际消费者，使维护者修改规则时只需维护一处。

原有守卫失败已在基线复现；当前修复通过相关检查，81组完整旧输入的生产统计结果逐字节保持一致，未发现当前 head 的阻断问题。

本次不改变 token 归属规则、采集可信度、持久化格式、评估结论或用户操作，不宣布完整语义收敛计划或长期净收益已经完成。

更广的语义收敛仍按既有所有者推进；本切片完成一个真实重复定义的消除，实际采集、模型评估和长期成本收益不在本次验证范围。

改动思路

既有 content_digest.ts 已足以拥有同一裸摘要格式，直接导入比新增适配器或例外更小；守卫仍扫描原范围，仅补登记真实消费者，生产统计及错误路径均保持。

当前 PR 的完整边界是消除一个重复摘要规则并保持现有统计行为；原采集可信度、整体语义收敛、模型评估及长期收益各沿既有验收，不增设前端旅程。

保留现状会让原有包范围守卫继续失败；给这一个消费者加例外则保留未来规则漂移。现有导出可以直接表达相同的裸 SHA256 摘要格式，因此本次删除私有表达式，继续使用原有输入类型、错误及 request reconciliation。没有通过放宽 guard、缩小扫描范围或新增配置去适配测试。

两个正则均要求64个小写十六进制字符，锚点和 flags 相同，字符类顺序不改变含义；共享实例没有 g/y 标志，不会因重复 .test() 累积游标状态。这个静态比较还不足以证明完整调用结果，因此本轮先在基线产生并冻结完整 JSON 输入/结果，再把同一批输入送到当前生产调用入口。

具体改动

修改前的规范为 tests/control_plane_ts/content_digest_single_owner.test.ts，固定 revision 6f8b181400dc650234891b32b2bd99f3f3836164。逐项检查原测试中的三条既定要求：

• no second whole-value digest matcher is reachable in the static model, outside recorded exceptions：基线实际报告 trajectory_input_usage.ts:24 的重复 matcher；当前移除重复后原检查通过。
• the owner's consumers are the pinned set, each reading a canonical export：现有 guard 检查包内实际导入集合及使用，新增登记不是静态列表自证。
• class order cannot change a verdict：既有语法比较通过，并通过完整普通消费者的基线重放补充验证。

关键代码讲解

1. digest 保留 typeof value === 'string' 和原 Missing input source digest. 失败，只把私有正则换成共享 BARE_SHA256_PATTERN.test(value)。source/text、source artifact、trace、request 与 response 的六处摘要校验仍沿原分支执行。
2. BARE_SHA256_PATTERN 是修改前已经存在的所有者。它与带 sha256: 前缀的导出各保留独立含义，不将文件名、复合游标等其它语法强行合并。其它导入者和实现均未修改。
3. CANONICAL_CONSUMERS 增加实际 estimator 模块。原测试仍检查所有读者、导出及真实使用；无需复制一套新测试或登记一个永不使用的导入。

完整 diff +3/-1：生产一处 import、一处匹配调用替换，测试一项消费者登记。未新增 helper、schema、持久化写入、CLI、开关或界面。边界内已采用同域可逆的共享所有者简化；未发现需要先引入更大框架或迁移的理由。

对主干的风险

最强风险是格式或错误优先级悄然变化，使原 native usage 记录被错误归属。独立重放覆盖81组基线产生的完整输入：六处摘要的长短、大小写、非十六进制、前缀、换行、非字符串，以及缺观察、错误 Goal、序号缺口、计数冲突、未重放的前序响应、重复引用和歧义源。真实 summarizeTrajectoryCodexUsage 经原 request ledger 和 estimator 返回的完整输出 194698字节一致，无归一化；SHA256 为 de88a480d92fcd167c16e118fdc7bf1e73244c24885ea6d13b85f1138001c847。

有效输入仍是总输入400、cached260、LoopX packet40、占比0.1；无 trace 仍不产生归属；失败和 partial 不覆盖原生 totals。将 canonical matcher 在独立探针进程暂时替换为全接受后，48组完整结果发生差异，证明重放能抓到放宽校验；未修改仓库源码。上述 trace 为基线测试来源的合成文件，不证明真实采集或模型行为。

53项相关测试全部通过、无跳过；TypeScript typecheck 和标准 native premerge 全部通过。premerge 的原生范围包括4项直接检查、2项 catalog 和风险选择集，完整结果保留为本轮证据。基线守卫的具体失败与当前 pass 均保留；没有仅比较数量。最新目标 main 659c1fd441abf5bd9171f22d9a84981497856a63 相对基线的 canonical owner、实际 estimator 和原 guard 均未改变，重用假设已经核对。未查询、轮询或等待远端 CI。

语义与调用边界

这是既有 schema 的格式不变量复用，不是新的工作状态分类或义务；错误文字没有被缩短或改写。校验与架构 guard 仍是可执行约束，评审上下文只是建议，不赋予权限。可选 trace 的关闭路径与失败结果已通过真实消费者配对检查，没有把可用性当作自动启用；不涉及存储 provider、迁移、通用调度或 quota。

我的整体评价

既有 content_digest.ts 已足以拥有同一裸摘要格式，直接导入比新增适配器或例外更小；守卫仍扫描原范围，仅补登记真实消费者，生产统计及错误路径均保持。 当前 PR 的完整边界是消除一个重复摘要规则并保持现有统计行为；原采集可信度、整体语义收敛、模型评估及长期收益各沿既有验收，不增设前端旅程。 因此当前切片可批准：原有确定性失败已修复，现有统计语义、完整错误和可选关闭路径保持，并减少规则的同步维护点。未测量总体长期收益，也不因静态守卫通过而宣布整个收敛计划完成。

检查完整两文件、现有轨迹统计调用与测试消费者，没有渲染页面、布局或控件变化，视觉审查不适用。 未验证真实采集、模型评估、GUI、PostgreSQL 或总体长期收益；本次未改变这些路径的协议或存储。 对贡献者没有新增导航、输入复制、确认或恢复轮次；正常统计使用者仍走原调用。本次批准后还应独立执行原生 closeout 与合并就绪检查，评审本身不授予合并或消除其它讨论的权限。

English verdict: APPROVE — fc7016b1ede30d6097cafb6730abf2fd08fc564b. The original duplicate-matcher failure is reproduced on base and removed by using the existing owner. All81 complete ordinary usage replays are byte-identical and48 malformed-input cases detect a deliberately widened matcher.53 related tests, TypeScript compilation and native premerge pass; live capture/model utility remains outside this bounded repair.

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | reasoning_effort=max

动机

维护者在检查轨迹输入与报告恢复时，需要同一摘要格式由同一个定义维护，浏览器烟测也需要从确实已关闭分析面板的状态继续。 原来两处手写摘要正则会触发所有权检查，而 Escape 可能先关闭帮助浮层，导致后续断言仍带着打开的分析面板；现在复用既有模式，并点击已有关闭控件后观察隐藏状态。 保留原有摘要、错误与恢复语义，消除重复定义，并让未分析范围的检查从真实的已关闭状态开始。 本 PR 不改变 UI 布局、键盘行为、报告权限、恢复事务、任务评分或摘要格式，不声称完整浏览器套件或已安装宿主验收。

改动思路

两个格式已经有唯一的公共定义；复用它们并保持原类型检查和错误顺序，比添加新的摘要工具或放宽扫描器更直接。 当前边界是四文件内的格式所有权与浏览器测试前置状态修复；产品关闭逻辑、帮助浮层和报告准入规则均由既有实现承担。 格式定义只回答“字符串是什么格式”，来源完整性与报告执行权限继续由既有消费者判断，二者不能互相替代。浏览器部分只修复烟测的前置状态：帮助浮层可先消费 Escape，而既有关闭按钮明确指向分析面板。没有改生产键盘逻辑，也没有删后续范围 D 与缺失分析的断言。

具体改动

规范来源：docs/development/good-smokes.md，不可变修订 659c1fd441abf5bd9171f22d9a84981497856a63；同时读取该版本的摘要所有者、报告恢复入口与完整浏览器场景。independent-oracle 已实现：151 个完整消费者输出逐字比较，两种刻意放宽的变体均使独立预期失败。preserve-assertions 已实现：范围 D、未分析提示与面板不存在断言保留；public-safe-fixtures 已实现：使用合成身份与隔离状态。没有拿本 PR 新写的测试定义产品预期。

关键代码讲解

• digest：复用 BARE_SHA256_PATTERN，保留 string 检查、原始字节、错误与原生用量保全路径。大写、带前缀、换行、空白、长度和非字符串输入均不被悄悄转换。
• admitStewardManagedTurn：只替换恢复键的同义格式检查；当前 live Turn 或原事务无效果拒绝、窗口、订阅与任务证明仍全部必需。
• C→D 浏览器场景：点击“关闭分析”，等待隐藏，再切换到未分析范围；共享扫描器只增加这两处真实消费者，未放宽规则。

对主干的风险

未发现阻塞性问题。独立执行 72 个轨迹案例及 79 个报告案例，基线与当前 head 的完整结果完全相同，不只比较成功码；输入也未被修改。报告案例覆盖 live、保留事务、错误证明和无证明，另含关闭订阅、错窗口、错所有者、已扣额、第二次宿主执行及已生成结果等拒绝路径。在隔离副本将两种格式各放宽到 63–64 字符，两个消费者的独立断言均失败，未改变评审分支。

当前 head 通过 61 个类型层测试、42 个原生报告测试、类型检查和打包构建；标准预合并的 4 项直接检查及 11 项选择检查通过。当前范围质量收据 cqr_9cfb39b80b03cbd98c9d 为 pass；首次聚合中的旧收据过期保留记录，重新按当前范围资格确认。远端差异与本地全部路径、坐标和改动内容一致。未查询或等待 GitHub CI。

浏览器复用的是先前真实 Ego 的六个案例：两个帮助优先消费 Escape 的负例、两个明确关闭的正例、两个普通 Escape 与焦点返回对照，视口为 1200×888 与 390×844。六个产品／场景／后端／依赖对象及完整合成 fixture、证明摘要都在当前 head 重新核对一致；此前超时、一次被拒绝的会话 POST 均保留，不能声称从未发生 POST 或全套场景通过。

我的整体评价

APPROVE，交付判断为 goal_achieved；本次无需新增状态、兼容分支或更大的重构。long_horizon 与 user_experience 均为 preserved：报告权限、重试与轨迹未知值语义不变，烟测的关闭前提更真实，用户没有新增操作回合。examples/personal-workspace-browser/research-history.mjs changes only test actions. Inspected unchanged goal-research-analysis.tsx/context-help.tsx renderers, backend and lockfile; no rendered presentation change. 完整 Playwright 场景没有重跑；已复用实际 Ego 验证并逐个核验其源码、后端、依赖与合成数据未变。 未证明已安装产品、真实模型遵从或整个研究分析功能的长期收益；这些界限不改变本次等价维护修复的结论。评审绑定 35e99bf18b5df593283c6aec16bf604a2b765b89，批准不授予合并、发布或安装权限。

English verdict: APPROVE at 35e99bf18b5df593283c6aec16bf604a2b765b89. Canonical bare/enveloped digest reuse preserves all151 full consumer outcomes, error precedence and recovery fences; the browser smoke establishes its original closed-panel precondition. Local required checks pass. Full Playwright and installed-host qualification remain unclaimed.