From 75f673d5589c481cbbb42fee16935565eff385d4 Mon Sep 17 00:00:00 2001 From: "lusendong.6789" Date: Sat, 7 Nov 2026 13:08:06 +0800 Subject: [PATCH] docs(self-repair): qualify generated Todo pointer reader compatibility Signed-off-by: lusendong.6789 Co-authored-by: TRAE CLI --- .../rfcs/monorepo-distribution-split-v0.md | 31 ++++++++++++++++++- .../monorepo-distribution-split-v0.zh-CN.md | 24 +++++++++++++- .../references/repair-patterns.md | 1 + 3 files changed, 54 insertions(+), 2 deletions(-) diff --git a/docs/architecture/rfcs/monorepo-distribution-split-v0.md b/docs/architecture/rfcs/monorepo-distribution-split-v0.md index c8e7ce79f9..e2964172e4 100644 --- a/docs/architecture/rfcs/monorepo-distribution-split-v0.md +++ b/docs/architecture/rfcs/monorepo-distribution-split-v0.md @@ -852,4 +852,33 @@ cross-package breaking change for three consecutive releases. ## Appendix E: Incident and review lessons -None yet. +### Generated Todo pointer read compatibility (non-normative) + +The generated archive and active-field omission pointers belong to the existing +Todo projection owner. An older strict `machine_region.py` reader rejects their +`loopx:todo-archive-pointer` line as foreign content. The reader repair is already +on `main` through [#7834](https://github.com/loopx-project/loopx/pull/7834); an +installed reader whose bytes predate that repair needs composition qualification, +rather than another source fix or removal of live projection metadata. + +Author qualification at `97cc1e0c4` used the same synthetic source and real +File/SQLite stores under Python 3.13 and 3.14 with Node 26. The prior reader's +grammar matches `8d314af49`. Across the prior snapshot, current source and its +built wheel, 36 cases produced 20 expected successes and 16 expected refusals: +four prior-reader pointer failures and twelve foreign-narrative failures. All +four prior-reader failures recovered and replayed through the current source +under the original Turn identity. Canonical work remained unchanged and quota +debits stayed zero. Eight additional source/wheel console cases read the native +capture back with synthetic Session identities; fixture preparation failures +remain failures, and a committed capture was recovered without rerunning +admission. The existing region, projection and SQLite archive regressions passed +(83 cases). + +The 36-case matrix took 135.6 seconds; this is observation cost, not a speed or +long-horizon benefit qualification. Total model, service CPU and human costs are +unmeasured. Actual installed-host upgrade and readback remain unqualified. +Preserve I3 for at least one minor release. This evidence does not close full +R0/V10, M1/#8011, R1, context/model or split installation, or promote D2/D5/D6/D3. +Use the existing self-repair lookup for `marked_todo_archive_pointer_reader_drift` +to distinguish a shipped repair from installed-reader drift without weakening +foreign-content rejection or rewriting active state. diff --git a/docs/architecture/rfcs/monorepo-distribution-split-v0.zh-CN.md b/docs/architecture/rfcs/monorepo-distribution-split-v0.zh-CN.md index 5136da5181..5ba56619cf 100644 --- a/docs/architecture/rfcs/monorepo-distribution-split-v0.zh-CN.md +++ b/docs/architecture/rfcs/monorepo-distribution-split-v0.zh-CN.md @@ -622,4 +622,26 @@ R0 可以先于目录移动交付，但不代表内核合格。R3/R4 可选， ## 附录 E：事故与评审经验 -暂无。 +### 生成式 Todo 指针的读取兼容性（非规范性） + +归档和活跃字段省略指针由既有 Todo 投影 owner 生成。较旧的严格 +`machine_region.py` reader 会把 `loopx:todo-archive-pointer` 行作为外来内容拒绝。 +reader 修复已通过 [#7834](https://github.com/loopx-project/loopx/pull/7834) 进入 +`main`；实际 reader 字节早于该修复的安装需要装配资格验证，不能据此重复源码修复 +或删除活跃投影元数据。 + +作者在 `97cc1e0c4` 上，以相同合成 source 和真实 File/SQLite store，在 Python +3.13、3.14 与 Node 26 下验证。旧 reader 的语法与 `8d314af49` 一致。旧快照、当前 +源码及其构建 wheel 共 36 个场景得到 20 个预期成功、16 个预期拒绝：4 个旧 reader +指针失败和 12 个外来叙述失败。4 个旧 reader 失败均通过当前源码按原 Turn 身份恢复 +并重放；canonical work 保持不变，quota 扣费为零。另外 8 个 source/wheel console +场景以合成 Session 身份完成 native capture 回读；fixture 准备失败仍保留为失败， +已提交 capture 的恢复未重跑准入。既有 region、projection 和 SQLite archive 回归 +通过（83 个场景）。 + +36 场景矩阵耗时 135.6 秒；这是观察成本，不是速度或长程收益资格。完整 model、 +service CPU 与人工成本未测量。真实安装宿主的升级及回读仍未验证。I3 至少保留一个 +minor release。这些证据不关闭完整 R0/V10、M1/#8011、R1、context/model 或拆分安装， +也不晋升 D2/D5/D6/D3。使用既有 self-repair lookup 中的 +`marked_todo_archive_pointer_reader_drift`，区分已交付修复和安装 reader 漂移；保留 +外来内容拒绝，不重写活跃状态。 diff --git a/skills/loopx-self-repair/references/repair-patterns.md b/skills/loopx-self-repair/references/repair-patterns.md index bc95573fe9..1432dc5a84 100644 --- a/skills/loopx-self-repair/references/repair-patterns.md +++ b/skills/loopx-self-repair/references/repair-patterns.md @@ -5,6 +5,7 @@ teaches a reusable control-plane lesson. | Pattern | Symptoms | Evidence To Read | Likely Root | Durable Repair | | --- | --- | --- | --- | --- | +| `marked_todo_archive_pointer_reader_drift` | An installed `quota should-run` reports `quota_unexpected_collection_error` and `ValueError`; a scoped read-only `quota status --verbose` identifies `non-generated content inside marked Todo region`, while current source reads succeed. | Exact launcher, Python/import route and per-component hashes; the generated `loopx:todo-archive-pointer` format and the installed `machine_region.py` reader; owner-authorized snapshot parser controls and a minimal synthetic File/SQLite source/wheel reproduction. Keep verbose diagnostics and snapshots private. | A valid generated archive or active-field omission pointer reaches an older reader whose strict machine-region grammar predates that format. A package version or declared commit alone cannot establish installed bytes, especially for a dirty source snapshot. | First verify the pointer is produced by the existing projection owner and preserve rejection of foreign narrative. Compare the same synthetic source and real backend under the same interpreter; verify original-Turn recovery/replay, unchanged canonical work and zero quota debit. If current main already includes the reader repair, as in #7834, do not duplicate it, strip active metadata or relax the grammar. Qualify a complete source/wheel composition, then follow existing authority for an upgrade and original-binding readback. A successful source recovery does not qualify the installed runtime or prove long-horizon benefit. | | `answer_question_replaced_by_delivery_status` | A user asks why a result occurred or whether it is expected, but receives measurements, tests or PR progress even though the reply was delivered completely. | The actual question and relevant corrections, current receiver brief, shared answer guidance, and the complete message on its original return route. | The author answered implementation progress instead of the causal question; successful transport or correct counters were mistaken for a useful answer. | Retain the correction in the existing Task and outcome, then repair the existing shared generation guidance: explain meaning, supported mechanism, expectations and the specific unknown before supporting data. Keep hypotheses separate from confirmed causes and preserve the qualified investigation owner. Verify guidance at native callers and read back the actual explanatory answer. Do not add keyword-based answer scoring, a second model rewrite, another display or a duplicate investigation; a prompt test or delivery receipt does not prove model compliance or user adoption. | | `queue_action_type_coercion` | A queued input action such as `["edit"]` is accepted but applies cancellation, or a stored operation accepts a non-string action. | Original JSON types, the typed planner and receipt decoder, real HTTP responses, canonical Turn/transcript/events/Session snapshots and native IO before/after refusal. | Membership checks stringify the action while effect selection and replay compare its original literal value. | Validate the original literal action at the existing owner before branching and when decoding pending or committed receipts. Cover arrays, nested arrays, objects, nulls, numbers, booleans and unknown strings; require rejection without state or native effects, then verify legal edit/cancel, original-operation replay and queue races. Preserve malformed historical evidence rather than coercing or rewriting receipts. | | `collaboration_return_format_projection_gap` | A complete answer that fits the result budget is rejected, or a published versioned return becomes unreadable or cannot replay through the real CLI. | Selected renderer output and Unicode count; persisted reply, compact publication/Inbox observations, original-route delivery and legacy replay at the same boundary. | Validation counted a different renderer before choosing the immutable format, or a compact codec omitted the persisted format marker and silently treated it as legacy. | Apply the unchanged budget to the actual selected format, carry its existing marker through every compact observation, and retain old bytes on replay. Validate BMP/non-BMP exact-limit and one-character-over cases, unsupported versions, real CLI publication/retry, original-audience return and File/SQLite packaged readback. Do not raise the budget, truncate the answer, rewrite historical receipts or add a second model. |