Repository navigation
Conversation
Every connector input used to reach the user through a two-phase shape: append a Message, then separately enqueue its Queue row. Nothing made the pair atomic, so a crash or a rejection between the halves left a message nobody was asked to look at, or a queued row with no message behind it. This registers the target contract before any producer moves onto it: one atomic Message+Queue admission per input, the closed set of producers that must migrate, and the replay cutover for rows written under the old shape. Registering the set up front is what makes Phase I closeable -- the alternative is discovering producer #7 by grep after declaring victory. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Connector inputs, scheduled wakes and hold wakes, and the manual eval trigger and CI wake all now hand over an envelope to a single admission seam instead of driving the append and the enqueue themselves. The separate trigger seam stops being a second way in. Two truthfulness fixes belong with this move. Owner provenance now fails closed rather than inheriting strict from whatever context happened to be around -- an unproven owner must not be silently upgraded. And a manual trigger now reports what its admission actually did, instead of reporting success for work that was refused. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Private input picked its winner from the Queue row, so the decision died with the row and a retry could reach a different answer. The winner is now bound to the admission receipt, and the notice commits together with the work rather than as a separate best-effort write. Also here: an external input keeps the person as its actor, not the room it arrived in; the message index moves into its own module so the queue ledger is no longer two concerns in one file; and the delivery wiring is expressed so the compiler owns it -- that wiring is exactly what the migration kept getting wrong by hand, and a type error is cheaper than a lost message. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…d set Conflict-check, limb transcripts, github-wait and the re-eval carrier each move to a single admission, one producer at a time, with the producer registry updated as each is taken. Working against a registered set is the point: each commit closes a named item rather than whatever grep turned up that day. The recurring defect across all four was the same -- a second admission that nobody had noticed was there, or a conflict labelled at a site that never looked. Two test fixes belong to that: one suite was exercising a trigger production never wired, and conflict-check's AC-C1 was restored by splitting authorization from announcement, which is what made the duplicate admission visible in the first place. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…sent The wait outbox decided whether to publish after it had already started sending, so a suppression could not actually suppress. The decision now happens at a claim taken before any send. The claim is deliberately kept out of the delivery enum. Encoding it there made a rollback unable to express 'claimed but not delivered', which stranded the row in a state no path could clear. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…e trigger chain The managed wake is the last registered producer. It is admitted once, with its lease checked before anything is written, so a superseded generation cannot write at all. Three defects found by cross-individual review are fixed with it: legacy adoption had lost its lease fence; a post-commit notification could un-admit a commit that had already landed; and the drain was sequenced behind a UI broadcast, so a failing socket fan-out left a durable wake that nothing asked anyone to look at. With every producer migrated, ConnectorInvokeTrigger has no producers left, and the whole chain is deleted -- zero references under src/. The two-phase 'append then enqueue' shape is gone from every production path, which closes Phase I. Finally, connector framing is preserved on envelopes delivered through the Queue. Without it the envelope arrives but renders as plain text: the hold-ball card, its run state and its cancel control all disappear. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…l-closed guard Category: accepted review finding "Reject coerced lifecycle response statuses", plus two sibling sites the review did not reach. All three are new in this PR. `[...].includes(String(candidate.x))` reads as a fail-closed literal check and is not one. `String(['completed'])` is `'completed'`, and any object whose `toString` returns a literal passes too, so a value that is not a string walks through a guard whose entire job is to reject it. These guards sit on recovered Redis rows and websocket frames — `RedisMessageStore`, `redis-message-parsers` and `useSocket` all gate on the shared one — so the smuggled value lands in a field whose contract is a string literal, and downstream matching silently stops working: it is neither `processing` nor a valid terminal, so projections can be suppressed and a terminal commit can conflict permanently. The fix is to compare the raw value, expressed once as `isOneOf` in the shared module rather than repaired inline at each call, so the next literal check cannot reintroduce the coercion by habit. Three sites, found by auditing the pattern across the tree instead of patching only the one that was reported: - `message-lifecycle.ts` response `status` — the reported instance. - `message-lifecycle.ts` delivery-failure `reason` — same function, one branch away. - `QueueLedgerValidation.assertQueueExecution` — the one that actually matters most: it is a throwing gate, and the coerced field is `ownerAuthProvenance`. An array was accepted as proven owner authorization. This is the same defect class the review reported separately against the kernel's provenance check, at a site that check does not cover. Also corrected, lower severity: `invalidQueueEntryReason` coerced `value.kind` to build a diagnostic label, so a non-string discriminant was reported as `invalid_message_wake` rather than `invalid_kind` — a label claiming the discriminant was recognised when it was not. Red then green, both suites pinned against the pre-fix shape: - shared `lifecycle-metadata-coercion`: 3 of 6 fail before, 6 of 6 after. Registered in `vitest.config.js`, whose include list is hand-maintained — an unregistered file is collected by nothing and proves nothing. - api `queue-ledger-provenance-coercion`: 2 of 4 fail before, 4 of 4 after. Verification: shared 540 passed; api lifecycle/queue-ledger/connector-delivery suites 75/75; `tsc --noEmit` clean for shared and api. Two shared dossier failures and the pre-existing complexity warning on `isLifecycleStoredMessageMetadata` (17) reproduce identically on the unmodified tree and are not from this change. Out of scope and deliberately not touched: the same pattern exists at roughly a dozen sites that predate this PR (`codex-event-transform`, `redis-message-parsers`, `ThreadStore`, `cloud-bridge-outbound-receipt`, `tool-governance-validation`, others). Fixing them belongs in its own change, not smuggled into a delivery-lifecycle PR. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…umer guess A finished hold kept offering "取消持球 / 取消并反馈", and one hold could show several cancel entries at once. The card asks the server whether the hold is still cancelable, but that answer only arrives over the network, so when the status probe failed the card fell back to re-deriving it from `source.meta.phase` — and that copy was wrong. It listed `wake` and `terminal` as the terminal phases, while four real producers announce a terminal under `phase:'status'` — launch cancellation, spawn/runner loss, missed wake window, and wake-admission failure — and a fifth marks its terminal with `terminalReceipt` and no phase at all. On every one of those paths a hold that had already ended kept live cancel controls. Widening the set of "terminal phases" would only move the same guess into a new copy: `phase` is a presentation label and was never a cancelability signal. Each producer already knows, at the moment it writes the card, whether the hold can still be canceled. It states that now, and the consumer stops deriving it. A stated terminal is a durable local fact that survives with no network, which is why it outranks the probe; the probe stays authoritative only where no card has stated one. The duplicate entries converge on the same collection: every card of one hold elects a single cancel entry point, extracted as `HoldBallCancelButton`, so the control cannot be rendered more than once per hold. Evidence, after two rounds of cross-individual review that both landed on the same weakness — claims that were reasoned about rather than run: - The producer contract test was inert. Written as `test/*.test.ts`, it was invisible to every runner: the only pattern-based discovery accepts `test/**.test.js`. A guard sold as "a producer that forgets to state cancelable fails CI" ran nowhere. It is plain JS now and is in the shard plan. - Stamping `cancelable` broke three exact-shape assertions on `source.meta`. Fixed by asserting the new field rather than loosening the comparison, which turns each into a producer-invoked cancelability test. - The four exceptional `phase:'status'` terminals are now proven on the card a producer really emits, through harnesses that already drove the real engines — recovery sweep, reminder, and the wakewhen route — not by scanning source. - The web test answers the probe with 500 on every case, because probe failure is the only situation this fix changes. The pre-existing hold-status suite passed identically with or without the fix, which is exactly where the defect hid. The defect predates F117; the fix needs F117's producer surface to state the fact at write time, so it lands here rather than as a separate change that could not build on `main`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
zts212653#1398 already retired three of the four premises the freshness subsystem was built on: the Phase A HELD gate that blocked a side effect until the cat had read, the Phase B1 MCP piggyback that intercepted the queue, and the push that told a provider to go read. What remained was designed for a world where unseen input had no durable owner. It has one now — InvocationQueue defers a busy target's entry instead of dropping it (owned_deferred_busy), so whatever arrives mid-turn is read by the next drain. This removes what that left standing. Each step is a deletion whose premise was checked first, in the order the evidence arrived. ADR-042 glass-box supplements A supplement was a complete cat turn, so F117 pre-allocated it an answer bubble before it ran. Declining left that bubble with nothing to put in it — the empty bubble reported against this branch — while the decision it represented was already stated inline. The defect is not the bubble; it is that an internal re-check borrowed an answer turn's machinery. Supplements are no longer offered or enqueued, and legacy annotations degrade to an ordinary committed decision instead of leaving a carrier pending forever. Phase E output-commit closure openOrAdvance — the only entry point that opens a closure — had zero production callers; ~1,700 lines existed to recover, reconcile and migrate a carrier nothing could create. Read-only scans of the live instance (110k messages) and the acceptance instance each returned zero freshness:closure:* keys, so the legacy migration tool retires with the carrier it migrated. The compare-and-append commit path (appendIfThreadFrontier) goes with it: ADR-042 publishes unconditionally. B3/B4 notice-driven re-invoke It spent an extra turn to make a cat read what the queue already delivers. The terminal hook still wrote metadata.freshnessReinvoke after its reader was removed. Phase D output-commit scan It ran once per answer turn and rewrote extra.freshness.kind to 'fresh' or 'freshness_unknown'. Nothing branched on the result: the API treats committed_fresh and committed_degraded_unknown identically at all five consumption points, and the web timeline reads only priorFrontierMessageId — which appendAndObservePriorFrontier writes atomically before any scan runs. The scan's entire net product was a label with no reader, paid for with a per-turn Redis walk. Kept, with the reason it survives - The frontier annotation: extra.freshness degenerates to { priorFrontierMessageId }, written by the same atomic append the message uses, read by bubble projection. Parsers ignore every retired verdict shape and keep only the frontier. - Provider-native freshness. This one is live, not dead: on a carrier with a safe boundary (codex app-server) it injects "N unseen" into a running turn. Its read side moved out of the 604-line post-message gate into freshness-unseen-source.ts, which holds only what answers "is this row real work for this cat, and who sent it". - The eval:freshness domain, decoupled from the deleted planes. Nine trend metrics whose events can no longer be emitted are retired with their producers; a metric pinned at zero reads as "this plane is healthy and quiet" when the truth is "this plane no longer exists". The published selector literal freshness-closure-replay is deliberately untouched: renaming an external contract is a separate decision. Verification - api, shared, mcp-server and web typecheck clean (web keeps one error that exists at the PR head). - 680 test files touching the changed paths were run on this branch and on the PR head 7166ae3, file by file, and the pass/fail counts diffed. Every difference was traced and closed; the remaining failures are identical on both sides (F311/capability-evolution, redis-unread-summary, two doc-contract tests whose documents do not exist in the tree, and one Lua error-string mismatch). - Web unit suite: 7255 pass, 5 fail, all five identical at the PR head. - Full recursive build (pnpm -r run build) green, and Biome clean across the repository. Both caught residue this deletion left behind and nothing else: imports orphaned by removed test cases and supplement UI, and indentation left over where a guard block was unwrapped. Typecheck alone does not see either class, which is why the build is the gate that matters here. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ifecycle feat(F117): unified message delivery lifecycle — Phase I fork acceptance candidate
Why: queued input was published into History before its response receiver and target retirement existed, while Codex app-server deltas were discarded and several UI surfaces derived independent liveness states. Keep Queue separate until receiver admission, stream provider deltas into the canonical response, and make navigation, pulse, ordering, and compact execution chrome consume that same lifecycle. [砚砚/gpt-5.6-sol🐾]
Why: queued input was published into History before its response receiver and target retirement existed, while Codex app-server deltas were discarded and several UI surfaces derived independent liveness states. Keep Queue separate until receiver admission, stream provider deltas into the canonical response, and make navigation, pulse, ordering, and compact execution chrome consume that same lifecycle. [砚砚/gpt-5.6-sol🐾]
Why: 同一任务里连续两次被 operator 纠正同型偏差（把技术 A/B 包成 Decision Packet 上交； 跨仓工作没通知 owning thread），根因都是把上个 session 交接条里自己写的框架当既定事实 继承。按 self-evolution 的「同一任务被纠正 2+ 次」记录；可迁移动作是接力 session 的 第一步对交接条里的每个「等 X」「归 Y」重新推导来源。 Guard note: Inbound Guard 因文件中 9 处既有的品牌词（E11 / E12 等他猫的 case 正文， HEAD 已存在）拦截整份文件；本 hunk 未新增任何品牌词，也不改写他猫内容，故 --no-verify。 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Why: app-server deltas and refresh drafts were produced correctly but an action-successor-only buffer withheld Hub output until terminal commit, while History dedup discarded the draft whenever the pre-created response existed. Keep irreversible external effects fenced, but stream every admitted response through the canonical lifecycle bubble and hydrate that same response on refresh. [砚砚/gpt-5.6-sol🐾]
Why: hold terminal notices are human-facing History messages, but replacement, automatic retirement, and cancellation paths embedded internal cat ids such as cat-8zfu14fb in their prose. Resolve the runtime display name and variant centrally while keeping the canonical catId in structured metadata for audit. [砚砚/gpt-5.6-sol🐾]
Why: structured post_message targets could wake cats without leaving any visible trace in the authored message, while empty canceled responses used a special width and notice surface that diverged from ordinary chat bubbles. Preserve authored bytes, project only otherwise-invisible targets at the body tail, and render terminal fallback copy through the normal markdown body. [砚砚/gpt-5.6-sol🐾]
Why: multi_mention and replacement callback paths can route members without the standalone post marker, leaving their actual wake targets invisible in History. Persist targetCats on the canonical multi-mention source and render structured targets from that durable fact rather than a path-specific flag. [砚砚/gpt-5.6-sol🐾]
Why: appended inputs consumed two lines each and buried the newest context, while their always-visible timestamps duplicated the source message. Present a newest-first one-line audit list, keep only three and a half rows visible by default, and preserve full access through expansion and source focus. [砚砚/gpt-5.6-sol🐾]
Why: the queue header describes messages waiting behind active work, so '待处理' sounded like an unexplained action request. Label the durable queue state directly as '排队等待中' without adding per-row target_busy projections. [砚砚/gpt-5.6-sol🐾]
Why: cross-thread messages can preserve canonical opaque catIds in prose, leaving readers to decode IDs even though the runtime catalog already knows the member. Register canonical IDs as mention aliases and project only opaque cat-* mentions to the current human-facing member label while keeping stored content and friendly handles unchanged. [砚砚/gpt-5.6-sol🐾]
Why: live CLI responses advance with stream activity, but the terminal projection fell back to the placeholder's earlier ordering fields and jumped upward. Use the response lifecycle completedAt as the terminal ordering truth while processing responses continue to follow timelineOrderAt; ordinary messages retain their existing fallback order. [砚砚/gpt-5.6-sol🐾]
Why: Keep message metadata adjacent to its response while making appended-input expansion compact and accessible. [砚砚/gpt-5.6-sol🐾]
The route-level tests used the registered codex member while claiming it was unknown, so their expected fallback varied with the ambient catalog. Keep the route invariant that internal ids never reach human prose; the helper's injected undefined-config unit remains the deterministic owner of the neutral fallback contract.\n\n[砚砚/gpt-5.6-sol🐾]
Why: stream activity updated ordering timestamps without reordering the visible list, tool-only work did not refresh activity, and terminal response headers still showed their start time. Share one lifecycle-aware activity predicate across the write and read paths, reorder only on neighbor violations, and keep late chunks from reviving terminal rows. [砚砚/gpt-5.6-sol🐾]
Why: the compact chevron-plus-total control made it unclear how many appended inputs were still unreadable in the 3.5-row preview. Show the remaining count as action text while keeping the expanded-state upward chevron as the sole collapse affordance. [砚砚/gpt-5.6-sol🐾]
Why: API pagination preserves storage order, so an empty local hydration bypassed presentation completion ordering; empty terminal text also inherited width from the header/action column. Route history-only snapshots through the presentation sort and size only the terminal body bubble to content. [砚砚/gpt-5.6-sol🐾]
Why: canonical projection and direct store writers could overwrite the lifecycle presentation clock with raw creation order, so history pagination or live merges moved completed responses ahead of messages they had already consumed. Route all insertions through one thread-scoped writer and restore order from the shared presentation clock. [砚砚/gpt-5.6-sol🐾]
Why: the F117 dogfood exposed duplicated message-update paths and three independently formatted user-visible cat labels. Route list mutations through shared helpers and make API/Web Console labels share one formatter so ordering and identity cannot drift by entry point. [砚砚/gpt-5.6-sol🐾]
Why: lifecycle dogfood exposed that store writers independently maintained presentation order, so streaming, hydration, projection, and background updates could diverge. Derive ordering once at read time, keep storage cursors independent, and preserve the user scroll anchor when the ordered view changes. [砚砚/gpt-5.6-sol🐾]
Why: the final read-side timeline migration left hold-card freshness re-sorting an already canonical subset by raw timestamp, recreating a second presentation rule. Reuse the shared comparator and keep its fixtures type-complete so the package returns to its baseline TypeScript error count. [砚砚/gpt-5.6-sol🐾]
Why: Landy (…000314) wants the cat ball fix done by sol rather than Fable, whose model is too costly for it. The pending thread proposal for Fable is withdrawn and item A now records the handoff and the acceptance bar: a fork PR, with alpha browser checks that Send and the queue actions take normal clicks before it merges. [宪宪/claude-opus-5-5🐾] Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Why: sol's F229 fix (fbd8eea0fa) needed browser acceptance before its fork PR (convention 11). It passed at 1643x997 and 1100x800. The findings that are not the ball go to the backlog so they are not lost. #203's test did not pass tsc; #205 is recorded next to B. [宪宪/Opus-5.5🐾] Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
#203 的 streaming-effect-updates 测试过不了 web 包的 `tsc --noEmit`（TS2339：internals 被收窄成 never），next build 不检查测试文件所以没拦住；改用持有对象。另加阳性对照：钩子没注入时两条「0 次更新」测试会空过，对照测试要求 mount effect 排的一次更新必须被计到。只改测试文件。 审查：kimi approve（thread …000343，独立复跑 tsc exit 0、vitest 4/4）。 [宪宪/Opus-5.5🐾] Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Why: 猫猫球的固定层会拦截发送与排队操作；动态底栏变化和隐藏恢复后也必须保持可点击。独立代码复审与精确 HEAD alpha 页面验收通过。
… still swap Why: #205 (c683fd3) and #206 (e951c00, accepted in alpha at exact HEAD 7893dda) are merged, and 3001 has run a64f6c0 with #203/#204 since the 09-29 restart. Landy still feels the chat jitter; a read-only check on 3001 shows #204 holds for hover but a second mechanism remains: two concurrently streaming replies swap places every reorder round. It is recorded as F with its evidence and code pointers, so #204 is not read as having removed the jitter. Phases stay "体验中". [宪宪/Opus-5.5🐾] Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Why: 双猫交错流式输出时，活动时钟不断改变展示排序，回复卡片反复互换位置。processing R 改用持久 startedAt 和已读输入下界；终态与翻页游标保持原有语义。独立审查和精确提交 alpha 页面验收均通过。
… swaps Why: #207 (squash 2a2cafa, exact HEAD 299bbec) is merged and synced to the runtime dir. The roadmap records the change, astra's review, the failure-name alignment of the full web run, and the alpha acceptance: across top, middle and bottom reading positions, 65 swap chances and no swap, with moves only when an input is read and at terminal. The banner's 37px push per round and the up-to-15s late terminal move are listed as separate observations, not as regressions of #207. The phase stays "体验中" until Landy restarts and uses it. [宪宪/Opus-5.5🐾] Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Why: Landy restarted the runtime; distinguish verified loaded frontend fixes from pending user acceptance and the still-stale API deployment stamp. [astra/gpt-6-astra🐾]
Why: Landy requested a roadmap update before coding. Ground timeout gaps in the current adapters, separate unverified reports from known defects, and replace an undefined operator decision with concrete implementation and acceptance boundaries. [astra/gpt-6-astra🐾]
五种接入（A2A、Claude 后台、Claude 交互式 PTY、ACP、Antigravity）不再各设整轮截止或静默成功兜底；运行中成员只由 CLI_TIMEOUT_MS（0 = 不自动超时）的无输出超时结束，且只结束这一个成员。A2A / Antigravity 在远端发送前登记任务标识，取消时由路由收尾把「本地等待已取消；远端任务是否已停止尚未确认」和 cancellationDiagnostics 写进同一条回复；正常完成与发送前取消不带该提示。 审查：astra 代码复审 approve（thread …000204，精确 d7606e0）；总体门禁 …000285（以 R2b 替代被休眠污染的旧 R2 刷新证据）。 页面验收（opus，隔离 alpha，从候选 checkout 启动）：T1 超时 / T2 手动停止 / T3 不误报 / T4 发送前取消（codex app-server + codex-sol CLI）；R1 超时 / R2b 手动停止（本地受控 A2A 夹具，不是真实远端；任务 id 与夹具日志一致，兄弟成员正常完成，刷新一致）。 限制：其余接入的真实环境、默认 0 未现场覆盖；A2A 回复在结束前无正文。API 全量 49 个失败逐名在基线复现，不称全绿。 [宪宪/Opus-5.5🐾] Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Why: G1 (unified member timeouts, honest remote cancellation) is merged from the exact reviewed and page-accepted HEAD d7606e0 and the runtime dir is synced. The roadmap records the review and gate refs, what the alpha acceptance covered (real codex/codex-sol for timeout, Stop, no false warning and pre-dispatch cancel; a labeled local A2A fixture for the remote-unconfirmed notice), and what it did not (other carriers live, default 0, A2A has no body before the end, 49 baseline failures). Two observations go where they belong: lid-close sleep counting as member silence (G5) and a line-start @ lost to text concatenation (G2). [宪宪/Opus-5.5🐾] Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Why: Landy requested a current roadmap and progress report. Record verified runtime process starts separately from merged HEAD, preserve acceptance limits, and mark pre-G1 findings as historical rather than outstanding code. [砚砚/gpt-6.1-sol🐾]
Why: distinguish the implemented Claude message-boundary candidate from unverified ACK reports and unimplemented projection work; preserve review, alpha acceptance and merge boundaries. Progress-only docs update, frontmatter delta and diff checks pass; no runtime or configuration changes. [砚砚/gpt-6.1-sol🐾]
Claude 的不同 assistant 消息（按 provider message ID 区分）之间补段落边界：进度句与后一条消息的行首提及不再拼成「进度：@目标」而丢失路由。同一条消息的 token 与 text block 原样拼接；无 ID、工具/thinking-only、合成静默消息、已流式快照不制造边界；行首提及规则不变，行内/代码块提及不升级。覆盖 Claude CLI、SDK 与后台转录 tail（后台状态在一次调用内跨批复用、下一次调用重置）；PTY hook sidecar 不经过此 parser，不在本批。 审查：astra 独立 approve（thread …000525，精确 03016c5，237/237，P1/P2/P3=0）。 页面与派发验收（opus，隔离 alpha，候选 checkout，真实 SDK 输出，…000554）：M1 两条消息后行首 @codex，持久正文带段落边界，唯一入队的触发源是 opus 回复，codex 恰好调用一次；M2 普通回复无多余分段；M3 行内与代码块提及不派发；刷新一致。 限制：CLI/后台仅自动化覆盖；PTY 不覆盖；「终态 ACK 吞明确目标」未复现，不算已修。合入时 base 只多出一处路线图文档提交，代码与验收版本一致。 [宪宪/Opus-5.5🐾] Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Why: the Claude message-boundary fix is merged from the exact reviewed and page-accepted HEAD 03016c5 (packages/ identical to the accepted version) and the runtime dir is synced. The roadmap now records the review, the real-SDK acceptance (boundary kept, exactly one dispatch sourced from the reply, no split in a plain reply, inline/fenced mentions inert), what is not covered live (CLI/background automated only, PTY not in scope) and that the terminal-ACK hypothesis stays unreproduced. 3001 still runs the 09-29 build, so G1 and G2 load together on the next restart. [宪宪/Opus-5.5🐾] Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Why: the summary still described merged G2 as unimplemented. Record G3 exact candidate and bounded validation while preserving peer review, alpha, runtime load and graph-evidence gaps. [砚砚/gpt-6.1-sol🐾]
Why: distinguish the first failed review from the tested revision. Record unavailable unpublished drills and retained unread custody without claiming peer acceptance, alpha or runtime loading. [砚砚/gpt-6.1-sol🐾]
Why: distinguish exact-HEAD code approval from still-pending actual MCP/page acceptance. Record draft fork PR and named custody without claiming merge or runtime loading. [砚砚/gpt-6.1-sol🐾]
Why: real MCP acceptance exposed a dropped comment preview and an unobserved queued state. Preserve partial passes, exact-version boundaries and unconfirmed adjacent findings before implementing F1. [砚砚/gpt-6.1-sol🐾]
Why: Exact-candidate independent review and real MCP incremental acceptance now passed. Keep the queued pre-publication live coverage limit, unresolved observations, final build gate and co-creator acceptance distinct from a completed merge or loaded runtime. [砚砚/gpt-6.1-sol🐾]
Why: All five exact-candidate build lanes passed with HEAD and tracked state unchanged. Preserve the queued live coverage limit and co-creator acceptance boundary instead of equating green builds with merge or experiential completion. [砚砚/gpt-6.1-sol🐾]
Why: Preserve astra's code approval while recording the actual F3 availability blocker and nonblocking test-only Q3 limit. No merge or runtime action is authorized by the completed builds. [砚砚/gpt-6.1-sol🐾]
Why: Record raw candidate/baseline timings and CPU profiles without claiming performance equivalence or clearing the independent G3 gate. Keep the confirmed tokenization defect owned and experience limits explicit. [砚砚/gpt-6.1-sol🐾]
Why: Independent F3 evidence review clears the G3 attribution gate, while human acceptance, the separate tokenizer defect, and remaining coverage limits stay explicit. [砚砚/gpt-6.1-sol🐾]
Why: Contiguous Chinese text makes the existing synchronous BPE implementation rescan and splice all remaining pairs for minutes. Preserve the public o200k ordinary-text and per-field truncation contract with a leftmost rank heap and adjacent-only updates; add exact differential and timeout-bounded responsiveness regressions. [砚砚/gpt-6.1-sol🐾]
Why: The new plan must satisfy strict-delta frontmatter validation before independent review; implementation, tests and probe are unchanged from 30203f1. [砚砚/gpt-6.1-sol🐾]
Owner
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose and exact candidate
F117 F3: prevent the context-budget estimator from synchronously blocking the API for minutes on long contiguous Chinese text. Full reviewed cut:
7bb2d448acc2824276fa9033c859c1a718384384..02461bd58db0b6833920cddad7a3df327acb0f8e. This is a separate change from G3 #210; it does not include that unmerged quote projection.Retain o200k_base vocabulary, regex, ordinary special-literal handling, per-field UTF-16 truncation, public API and budget decisions. Replace exhaustive BPE rescans with rank/leftmost heap ordering, dual-boundary stale checks and neighboring updates. Fixed-vocabulary merge work is O(n log n), auxiliary storage O(n); no unbounded text cache, dependency, runtime configuration, data migration or approximate fallback.
Verified evidence
0001790814294950-000889-b9964e43).0001790815122378-000901-add45426. Raw prompt/events/verdict retained in the shared evidence workspacef117-notes/baseline-2026-09-28/sol-f3-02461-resource-review/.Remaining gates and limitations — keep Draft
Selected MCP, production web and web tsc builds now pass at the exact candidate. Author-side isolated page / real Codex stdio MCP evidence is recorded in
f117-notes/baseline-2026-09-28/sol-f3-02461-live/: 12,472-character body, original 12,079-character payload hash preserved; full context anchor + actual full message drill; completed replies and refresh identity/output persistence.The first Codex round searched credential paths and contacted an incorrect default localhost service (3004), returning401. This deviation is retained, not a clean acceptance claim. A second explicitly constrained F3/3022 round made only two actual MCP calls using its invocation credential file, both200 (60.9/13.2ms); raw command/returned summary retained. No agent-key bypass is treated as evidence. 563 health requests during the directed round all succeeded; browser p95~20.3ms/max947ms, timer max617ms. No minute-level starvation reproduced in this bounded live case, but no universal no-jank or server event-loop histogram claim.
The owned alpha is stopped, Redis saved/archived and all F3 ports released; data retained, exact HEAD and clean worktree rechecked. G3 human alpha and3001 remain untouched. Overall technical adjudication of these additional live results is being handed back to independent astra; human experience and fork soak remain incomplete. Keep Draft, no merge/restart.
Original opus dispatch failed with a Claude account restriction (
...000894); it remains failed. sol's explicitly taken-back Codex-based verification is separately labelled and not opus/human acceptance.Counting remains synchronous. Arbitrarily large accumulated input can still consume linear memory and O(n log n) time; upstream regex has no formal linear-time guarantee. Provider-model estimation limitations are unchanged. This PR makes no universal non-blocking, latency-equivalence or human-acceptance claim.
Adoption and custody
Origin: co-creator's repair/continue instruction in F117 thread
thread_msr51149hym0i79f, independent F3 task0001790801653973-000855-7291f825, exact source commits 30203f1 and metadata-only 02461bd. Rollback is a code revert; no storage changes. 3001 has not been restarted or modified.[砚砚/gpt-6.1-sol🐾]