perf(authority): copy journal JSON without repeated primitive allocation

[LIHUA919]

Goal, gap and delivered result

Refs #4224 and RFC 7.2; follows merged #4931.

A source-stable matched-1m --cli baseline at 3009cdfbe had 13 passed / 1 failed / 10 missing: 100k scan-100 p95 was 251.909 ms against 250 ms. This PR removes repeated projection materialization through the existing strict-JSON owner. Historical failures and qualification holds remain recorded.

• Share an order-preserving JSON copy/validation walker beside canonical encoding.
• Use it for replay snapshots and independent public journal pages; SQLite reads historical projections from verified replay snapshots.
• Preserve unknown JSON metadata, key order, sparse arrays, negative zero, mutable-result isolation, cursor/lookahead rules and persisted proof bytes.

Owner: existing coordination codec, replay and journal boundaries. No new provider, capability, configuration, format, default or budget. Existing frontend/Lark JSON contracts remain unchanged; real CLI readback/update/failure tests cover the affected entrypoint.

Runtime acceptance

At aabf55979: 692 File/SQLite/archive/migration tests; 303 tests on a disposable real PostgreSQL 16.15 server, zero skipped; 5 real Python-to-TypeScript SQLite CLI tests; TypeScript typecheck passed. A historical-projection mutation fails the independent real-SQLite oracle. Matched 128-commit/1 MiB diagnostic scan p95 improved 194.902 -> 67.940 ms; this is not formal qualification.

The full source-stable formal report at aabf55979 was independently verified: 14 passed / 0 failed / 10 missing. Scan p95 was 137.646 ms at 10k and 77.918 ms at 100k; receipt p95 at 100k was 31.756 ms. Workload, sample counts, 20 cold CLI samples per command/axis, WAL/FULL, source fingerprint and cleanup were checked. Original failed reports remain intact.

Integration and CI repairs

All commits are signed and appended without rewriting history.

Commit	Repair and evidence
64a75ca94	Refresh stale census locator, reproduced on base/head with Python 3.11/3.12. Nine architecture tests pass; exact-head CI had 28 successful / 4 conditional skips / zero failures.
748ace442	Merge upstream 738115bde, preserving commits and resolving the census conflict to line1063. Architecture, real CLI and typecheck pass; four Python-child Node PATH failures pass with qualified Node22.22.3 after retaining the initial failures.
1df14ecc6	Repair six stale user-Todo/scheduler-ACK fixture assumptions reproduced on unchanged main. Related Python27, typed negative10 and final ACK2 pass; runtime rules remain unchanged.
53fab7f09	Replace a 0.4-second timing proxy with the real lifetime-lock invariant. Related suite30 passes; unrelated0.65-second delay distinguishes the old/new oracle, and a held-real-guard mutation is rejected. All four remote Python shards pass.

At 53fab7f09, the remaining Windows lifecycle failure was an ambiguous coordination.runtime_shadow.bootstrap response at its 10-second request deadline: 1 failed / 151 passed / 5 skipped. merge-gate failed downstream. The original failed result remains recorded. Exact-head workflow.

Latest fixture repair: 8e5c3dca3

The outbox fixture now handles the typed ambiguous-response exception by reading the exact completed bootstrap result under the existing maintenance lock. It verifies operation/request identity, immutable manifest, source path and capture binding. It never resends bootstrap. Missing, pending, wrong-operation and damaged evidence still fail; semantic rejection is not converted to success.

The RPC request budget remains 10 seconds and the existing maintenance-lock wait remains 5 seconds. The additional bounded readback checks an already-dispatched operation; it does not raise either deadline or change product runtime behavior.

A private real TCP relay withheld the actual bootstrap response beyond the unchanged 10-second deadline. Unchanged main (b6c3d3d4b) fails with a complete durable receipt; the candidate reads that receipt and continues, with one bootstrap dispatch in each arm. The complete outbox suite has 17 passed; the related outbox/management/Effect integration set has 88 passed. These controls prove response-loss recovery, not the cause of Windows runner latency. At 8e5c3dca3, Windows passed; two Python failures shared the stale CLI registry locator846/835 in CI merge 31f166846 (PR8e into mainb6). Unchanged main reproduces both failures (2 failed / 7 passed). This failed run remains retained.

The future-facing pass keeps recovery beside this fixture and reuses existing typed exception, lock and journal readers; a wider fixture framework is unnecessary. Public/private scans and whitespace checks pass; private probes, raw reports, databases and local paths are excluded.

Current integration/census repair: 0097931ea

Signed merge aa790fd8f appends current main at ee1ea64b0 without rewriting commits. The single overlapping Todo fixture conflict adopts upstream's valid user_action/goal_bound representation and retains the existing task-class readback assertion.

The actual merged source reproduces the two census failures (2 failed / 7 passed). A separate signed commit changes only the loopx/cli.py locator from846 to835. Site, column, API, classification and source policy remain identical; the direct complete inventory comparison is clean. Existing architecture inventories, resolved real File/SQLite fixture and real SQLite CLI entrypoints: 21 passed. Control-plane typecheck, whitespace and public/private checks passed. At exact head 0097931ea, full CI completed: 28 successful / 4 expected conditional skips / 0 failed or pending. All five workflows passed, including four Python shards, Windows, the real PostgreSQL server, release build and merge-gate. CI tested merge b36c96e60 (parents009/main ee1); its complete Git tree 77069228d1141494bda8070a6db13aee8ba0b539 equals the PR head tree. Accepted workflow.

The bounded future-facing pass keeps the existing AST census/generator owner and strict metadata equality. No classifier, protocol or additional test framework is needed. Upstream's fixture repair is reused; there is no duplicate fixture implementation. The PR base is main and its merge base is ee1ea64b0, so upstream history is excluded from the contribution diff.

The accepted009 source is now frozen in a separate qualification checkout. Its source-stable rehearsal completed100/1000 commits with real cold CLI3 samples per command/axis and verified cleanup on Node22.22.3/SQLite3.51.3. This is execution preflight, not formal10k/100k qualification; the full run and independent report acceptance remain pending.

Current main integration: 6902346f1

Two signed merge commits append current canonical main at 649826221 without rewriting the original PR history. The first resolves scheduler ACK fixture assumptions: an ACK for the current settled Turn succeeds; after a newer heartbeat, the old ACK is rejected as stale, while the new ACK and replay preserve scheduler bytes and Goal accounting. The second incorporates upstream GoalRef scope into the existing outbox ambiguous-response fixture without resending bootstrap. The checked-in registry census matches the merged source; the final contribution diff against main contains 12 focused files and excludes upstream history.

Local validation on the merged source: 102 architecture/quota tests, 25 outbox/registry tests, 61 real File/SQLite TypeScript snapshot/coordination tests, control-plane typecheck, public/private scan of 13 own files and whitespace checks passed. These are local acceptance checks; fresh exact-head CI for 6902346f1 is pending. Older 0097931ea CI and qualification evidence remain attributed only to their old source. The formal 10k/100k D2 run is held until this integrated head is accepted and frozen.

Exact-head CI fixture repair: 106b923a5

The 6902346f1 Python CI run completed with two independent stale test assumptions: the prompt-upgrade read test omitted the newly projected turn_start_capability_hook_dispatch field, and the dual-runtime-twin test still pinned one verified generated twin after main added the generated content-digest pair. Python shard 1 had 1 failed / 3387 passed / 18 skipped; shard 2 had 2 failed / 3384 passed / 20 skipped. pytest and merge-gate failed downstream. The failing tests and their owning hook/semantic-smoke sources had identical Git blobs on canonical main and the PR head before repair.

This signed test-only commit asserts the exact hook/read projection and two verified generated twins while retaining the independent-twin budget mutation. The complete related hook, Turn contract and semantic-binding suites pass locally: 71 passed. Runtime/API behavior and frozen formal evidence are unchanged. Public boundary and whitespace checks pass; the new exact-head CI remains pending.

Latest Host-process test repair: e4e754982

Exact-head 106b923a5 CI finished with one independent failure in TypeScript core shard 2: host_process.test.ts read the descendant counter as 27 after managed return and as an empty string 100 ms later. The test's in-place writeFileSync marker can be truncated if termination lands during a write, so an empty read cannot distinguish a partial write from continued descendant work. checks, pytest and merge-gate failed downstream. This test and the Host-process implementation were unchanged relative to main before the repair.

The fixture now writes the next count to a sibling file and atomically renames it into the observed marker. A surviving child still publishes changing counts; interruption during a write cannot expose an empty marker. Five complete local runs of the nine Host-process tests passed (45/45), as did control-plane typecheck, whitespace and public boundary checks. Runtime behavior is unchanged.

Signed merge d38a830aa incorporates canonical main b76ca16ce with no overlapping PR paths; the PR contribution merge base is that main commit. Signed test repair e4e754982 was pushed without rewriting history. That commit is historical; current-head CI and the formal D2 result are recorded below.

Current integration and CI repairs: 786b5edbf

The earlier frozen d767b06f1 source passed all five exact-head workflows: Python Tests, DCO, Dependency Review, real PostgreSQL Integration, and Release Artifacts. Its separate formal result is recorded below and remains failed.

Signed merge 0546b4f41 incorporates canonical main 3156771e4 without rewriting PR commits. Two conflicts were confined to test assertions: the generated Turn binding census now follows main's source-verified count while retaining the independent-twin budget, and the prompt-upgrade hook test retains the complete dispatch/read projection assertions. The three adjacent Python suites passed 117 tests with a supported Node runtime. The contribution diff against main was 12 paths before the following test-only repair, with no private artifacts or generated lockfile. PR mergeability is restored. On 0546b4f41, one same-head Python Tests run was cancelled by a later run in the same concurrency group; the replacement workflow exposed one genuine shard-1 failure (1 failed / 3527 passed / 19 skipped) in source-churn readiness. Its test and runtime-source Git blobs were identical to main. The fixture scheduled two file reads concurrently but assumed the first would delete the second before it ran. Unchanged head reproduced this failure in 20/20 local runs. Signed test-only commit 70f4d3684 adds a bounded event barrier to both source-churn cases; the entire readiness file passes 17/17, and the original failure passes 20/20 repeated runs. No runtime rule, budget, or protocol changed. On 70f4d3684, TypeScript core shard 1 exposed another upstream baseline failure: task_lease_workspace.ts carried a private whole-value 64-hex matcher, violating the shared content-digest owner check. The file's Git blob matched canonical main. Signed commit 6e897e489 replaces that matcher with the existing BARE_SHA256_PATTERN and registers the reviewed consumer; valid/invalid identity semantics are unchanged. Focused TypeScript tests passed 20 / 1 expected PostgreSQL skip, and control-plane typecheck passed. Signed merge 5196aed15 incorporates canonical main 9c9b90d8e with no overlapping PR paths or conflicts, preserving all signed PR commits. On this exact source, 237 related Python lease/registry/readiness tests and 73 related TypeScript tests passed (one expected PostgreSQL skip); control-plane typecheck passed. A fresh 64 KiB 100/1000 SQLite rehearsal completed both axes, real cold CLI samples and cleanup with Node 22.22.3/SQLite 3.51.3. These checks do not qualify the 1 MiB 10k/100k profile. The current contribution diff against the integrated main is 16 paths, with no private artifacts or generated lockfile. At 5196aed15, Python shard 2 had one genuine failure (3526 passed / 19 skipped): the source-first CLI test pinned usage notice v4 while the accepted runtime and dedicated usage-ping tests use v5. Both files had identical Git blobs on main and the PR before repair. The unchanged head reproduced the exact 5 != 4 failure locally. Signed test-only commit 786b5edbf aligns that one assertion with the established v5 contract; related source CLI and usage-ping suites pass 74/74 with no runtime or telemetry-policy change. Canonical main later advanced to f49b4a008 on seven non-overlapping paths with a clean merge tree; any later integration remains a new source for formal qualification. Exact-head Python Tests for 786b5edbf finished with all four Python shards and upstream checks successful, but its aggregate coverage report failed before the unchanged 19.6% floor: a disposable semantic-probe subprocess contributed /tmp/pytest-of-runner/.../loopx/a.py, which was gone when shard data was combined. Signed test-only commit e9a5d348b removes pytest-cov/Coverage instrumentation from that copied CLI subprocess; it does not omit production source or relax the floor. The architecture file passes 17/17 under two-worker coverage, and the resulting coverage data has no temporary pytest source. Exact-head CI for e9a5d348b has completed: 29 successful / 4 expected conditional skips / 0 failed or pending. Python Tests is bound to head e9a5d348bf7fae13379f61a6c55439185b4123f1; all four test shards, aggregate pytest coverage, upstream checks and merge-gate succeeded. Sign-off, real PostgreSQL integration and release build also succeeded. This verifies the CI repair only; frozen d767 still fails six fixed D2 budgets and has ten missing conditions. The d767 performance report does not qualify this merged source. The draft remains under maintainer review and merge authority.

Current main integration: 02d3dee83

Signed merge 02d3dee83 appends canonical main f49b4a008 without rewriting PR commits. The seven upstream paths do not overlap the PR contribution, Git merge-tree was conflict-free, and the PR merge base now equals f49b4a008. Four related CLI-output/semantic-probe suites passed 150 tests on the integrated source; whitespace checks passed. This merge changes test/developer CLI-output support, not the SQLite capacity runner or the fixed D2 budgets. Exact-head CI for 02d3dee83 has completed: 29 successful / 4 expected conditional skips / 0 failed or pending. Python Tests is bound to the full head 02d3dee83dfb54fc5d899b3676b4ba12e777bb4d; all four shards, aggregate coverage, upstream checks and merge-gate succeeded. The fresh detached source passed a real CLI 64 KiB 100/1000 rehearsal with source-fingerprint readback; this is not the 1 MiB formal profile. Formal D2 qualification remains pending and frozen d767 retains its six fixed-budget failures and ten missing conditions. Earlier e9a5d348b CI remains valid only for that prior head; a fresh qualification source will be frozen after the integrated head is accepted.

Completed source-specific 1 MiB profile: 02d3dee83

One supervised matched-1m --cli run completed 10k and 100k commits on the clean detached 02d3dee83dfb54fc5d899b3676b4ba12e777bb4d source with Node 22.22.3, SQLite 3.51.3 and WAL/FULL. Independent source, sample-count, cleanup and fixed-budget arithmetic checks found 14 passed / 0 failed / 10 missing. At 100k, receipt p95 was 31.936 ms against 50 ms, scan-100 p95 was 77.731 ms against 250 ms, and the cold CLI mutation increment was 194.788 ms against 200 ms (5.212 ms margin). The six fixed-budget failures in the older frozen d767 report did not recur under this source/run context. This comparison does not isolate the cause of the earlier failures; the ten missing D2 conditions, elapsed/HALT recovery and promotion remain open. No threshold changed.

Canonical main subsequently advanced to b3879f96f. Signed append-only merge 59208b5ad incorporates that main head and resolves its sole test conflict by adopting the current runtime-fingerprint regression; the prior PR barrier was superseded by main's new source algorithm. The merge also removes a duplicate digest import present in main that initially broke TypeScript compilation. On the merged source, 188 focused Python tests and 361 focused TypeScript tests passed (one expected PostgreSQL skip), control-plane typecheck passed, and a fresh real-CLI 64 KiB 100/1000 rehearsal verified source stability and cleanup. The contribution diff against current main is 14 scoped paths; the merge base is b3879f96f. Exact-head CI for 59208b5ad is pending. The 14/0/10 formal report belongs only to frozen source 02d3dee83; it does not qualify the new merged head. Runtime changes remain for maintainer review and merge.

Formal matched-1m result and remaining acceptance

A single supervised, source-stable d767 run completed both 1 MiB axes at 10k and 100k commits with Node 22.22.3, SQLite 3.51.3, WAL/FULL, 20 cold CLI samples per command and axis, and verified axis cleanup. Independent checks confirmed the source fingerprint, sample counts, exit and fixed-budget arithmetic. The measured profile failed: 8 passed / 6 failed / 10 missing. At 100k, receipt p95 was 65.172 ms against 50 ms; commit/head/receipt history-growth ratios were 2.634/3.086/2.170 against 2; cold CLI status p95 was 2594.854 ms against 2000 ms; and the cold CLI mutation increment was 1623.362 ms against 200 ms. The scan-100 p95 was 177.430 ms against 250 ms. No budget has been raised and no D2 pass is claimed. Diagnosis is open; previous aabf and 3009 reports retain their own source and run context.

The older frozen 64a75ca94 attempt remains interrupted without a complete report. The ten missing D2 conditions, elapsed/HALT recovery and promotion are separate holds. This PR does not resume that attempt, migrate active Goals or grant promotion. Maintainer review and merge remain required.

中文摘要

本 PR 在既有 strict-JSON 边界修复重复投影复制，保留字段顺序、未知元数据、可变对象隔离及持久证明。真实 File/SQLite 回归692项、真实 PostgreSQL16.15回归303项（零跳过）、真实CLI5项与类型检查通过；诊断扫描 p95 为194.902 -> 67.940ms，不替代正式资格。

冻结版本 aabf55979 的正式报告已独立核验：14通过、零失败、10 missing；10万笔扫描 p95 为77.918ms、收据为31.756ms。原失败报告保留。追加提交依次修复旧清单定位、上游冲突、六项过期 Todo/ACK 夹具与 claim 等待的计时代理；53fab7f09 的四个远端 Python 分片均通过。

该版本的剩余 Windows 失败发生在 bootstrap 的10秒请求期限，写操作可能已提交，不能自动重发。最新 8e5c3dca3 只修复 outbox 夹具：在现有维护锁下核验同一操作的持久完成结果、请求、不可变清单、源路径与绑定；缺失、未完成、错操作、损坏回执和语义拒绝仍失败。请求10秒和既有锁等待5秒均未增加，运行时规则不变。

真实 TCP 响应延迟对照中，未修改 main 有完整回执但旧夹具失败，候选读回执后继续，两组均只发送一次 bootstrap。outbox 套件17项、相关管理/Effect集成88项通过；它不证明 Windows 延迟根因，8e5c3dca3 的 Windows 检查通过；两个 Python 失败均来自 CI 合并基线的 census846/835 漂移，未修改 mainb6 同样复现。追加签署合并 aa790fd8f 接入 main ee1ea64b0，唯一夹具冲突采用上游合法定义并保留 task-class 读回断言。最新 0097931ea 只更新 CLI 定位846→835，site/列/API/分类/policy 不变。架构 inventory、真实 File/SQLite 夹具和 CLI 共21项、类型及边界检查通过；最新 0097931ea 的全部 CI 已结束：28通过、4项预期条件跳过、零失败或待处理；四个 Python 分片、Windows、真实 PostgreSQL、发布构建和 merge-gate 均通过。CI 合并版本b36的完整 Git tree 与009相同。随后 main 前进，原009的28/4/0仅属于旧合并树。现已追加两个签署合并提交，将规范 main 649826221 纳入 6902346f1；保留旧 ACK 失效、新 ACK 幂等和 Goal 状态隔离，也保留模糊 bootstrap 回执核验与上游 GoalRef 范围。合并后的本地架构/配额102项、outbox/清单25项、真实 File/SQLite TypeScript61项、类型和公开边界检查通过；head690 的远端 CI 已完成并暴露两处上游测试前提漂移：提示词升级 hook 新增的必读派发字段未纳入旧断言，生成的 content-digest 配对也未纳入旧的单配对计数。签署测试修复 106b923a5 保留派发内容和独立配对预算的负例，相关套件本地71项通过；新 head 的 CI 待验收，正式长跑继续等待该版本冻结。复用现有类型、锁与读回接口，不新增通用框架。

64a75ca94 的独立复测已中断，缺少退出回执与完整报告；其部分证据保留原来源，不能作为资格通过。现有 d767 正式复测已完整结束，但性能预算失败；十项 D2 缺口、自然时间/HALT 恢复和晋升仍未闭合。PR 保持草稿，交由维护者评审和合并。

进一步复测中，head106 的 TypeScript core 分片出现一项独立失败：子进程计数标记先读到27、后读到空串。原夹具在位写入，进程终止落在写入期间可能留下截断文件，不能据此断言子进程仍在继续工作。签署提交 e4e754982 改为同目录原子替换标记；存活的子进程仍会持续改变计数。Host 进程测试本地完整复跑5次共45项通过，类型与公开边界检查通过。另以签署合并 d38a830aa 接入最新 main b76ca16ce；该旧版本的远端 CI 状态由下文当前版本结果替代，正式 D2 资格仍未确认。

旧冻结版本 d767b06f1 的五项精确版本 CI 均已成功，包括真实 PostgreSQL；其正式性能结果在下文单独列出，结论仍为失败。签署合并 0546b4f41 接入规范 main 3156771e4，保留原 PR 提交历史。两处冲突仅在测试断言：生成的 Turn 绑定数量采用上游来源核验规则并保留独立配对预算，提示词升级 hook 保留完整派发与必读投影核验。相邻三组 Python 测试在受支持的 Node 环境下 117 项通过。相对 main 的贡献差异原为12个路径，无私有产物或生成锁文件；PR 已恢复可合并。0546b4f41 的同 head 首轮 Python Tests 被后续同组运行取消，替代运行在 shard 1 出现一项真实失败（1失败、3527通过、19跳过）：源码变动检测夹具并发读取两个文件，却假定第一个必先删除第二个。该测试与运行时源码在原 head 和 main 的 Git blob 完全相同；原版本地重复20次均失败。签署的纯测试提交 70f4d3684 在两个检测夹具中加入有界同步屏障；整个 readiness 文件17项通过，原失败用例重复20次均通过，运行时规则、预算和协议不变。70f 的 TypeScript core 分片1又暴露一项上游基线失败：task_lease_workspace.ts 自行定义整值64位十六进制校验，与公共 content-digest 归属断言冲突；该文件在 70f 和规范 main 的 Git blob 相同。签署提交 6e897e489 改用既有 BARE_SHA256_PATTERN 并登记受审查的消费者，合法/非法身份判断语义不变。相关 TypeScript 测试20项通过、1项预期 PostgreSQL 跳过，控制平面类型检查通过；签署合并 5196aed15 接入规范 main 9c9b90d8e，与 PR 自有路径无交集、无冲突，并保留已有签署提交。该精确源码的租约/清单/readiness Python 测试237项和相关 TypeScript 测试73项通过（另1项预期 PostgreSQL 跳过），控制平面类型检查通过。Node22.22.3/SQLite3.51.3 下 fresh 64KiB 100/1000 rehearsal 两轴、真实冷 CLI 和清理均通过；不能替代1MiB 1万/10万笔正式资格。相对已整合 main 的贡献差异为16个路径，无私有产物或生成锁文件。5196 的 Python shard 2 出现一项真实失败（3526通过、19跳过）：source-first CLI 测试仍断言使用通知 v4，而当前运行时及专门的 usage-ping 测试均采用已接受的 v5；修复前该测试和产品源码在 main 与 PR 的 Git blob 相同。未改动版本地复现完全相同的5与4断言失败。签署的纯测试提交 786b5edbf 将单个断言对齐 v5，相关 source CLI/usage-ping 测试74项通过，运行时和遥测策略未变。规范 main 此后前进至 f49b4a008，七个变更路径与 PR 无交集且合并树无冲突；后续整合仍须重新绑定正式资格源码。786 的精确版本 Python Tests 中四个分片及上游 checks 均通过，但汇总 coverage 在既定 19.6% 下限检查前失败：临时语义探针子进程把即将删除的 loopx/a.py 路径写入覆盖率数据。签署的纯测试提交 e9a5d348b 禁止该复制 CLI 子进程继承 pytest-cov/Coverage 插桩；不排除正式源码，也不降低门槛。架构文件在双 worker 覆盖率运行中17项通过，覆盖率数据不再含临时 pytest 源码。e9 的精确版本 CI 已完成：29 项通过、4 项预期条件跳过、零失败或待处理。Python Tests 绑定完整 head e9a5d348bf7fae13379f61a6c55439185b4123f1；四个测试分片、汇总 pytest 覆盖率、上游 checks 与 merge-gate 均通过。签署、真实 PostgreSQL 集成及发布构建也通过。这只确认 CI 修复；冻结 d767 仍有六项固定 D2 预算失败和十项缺失条件。d767 的失败报告不能自动证明或否定此合并源码，草稿仍待维护者评审与合并。

追加签署合并 02d3dee83 接入规范 main f49b4a008，保留原 PR 提交历史；七个上游路径与本 PR 贡献无交集，merge-tree 无冲突，合并基点现为 f49b4a008。整合源码的 CLI 输出及语义探针四组测试 150 项通过，空白检查通过；此次主线增量属于测试/开发辅助路径，未修改 SQLite 容量 runner 或固定 D2 预算。02d3dee83 的精确版本 CI 已完成：29 项通过、4 项预期条件跳过、零失败或待处理。Python Tests 绑定完整 head 02d3dee83dfb54fc5d899b3676b4ba12e777bb4d；四个分片、覆盖率汇总、上游检查与 merge-gate 均通过。独立冻结源码的真实 CLI 64 KiB 100/1000 预检和来源指纹读回通过，但不属于 1 MiB 正式资格。正式 D2 仍待复测，冻结 d767 的六项固定预算失败和十项缺失条件保留；先前 e9 的 CI 只属于旧源码，整合版本通过后再冻结新资格源码。

追加说明：冻结源码 02d3dee83 的单次 1 MiB、1万/10万笔 matched-1m --cli 正式运行已结束，独立核验来源、样本数、清理和固定预算算术后为 14 通过、0 失败、10 缺失。十万笔收据 p95 为31.936ms（预算50ms），scan-100 为77.731ms（预算250ms），冷 CLI 变更增量为194.788ms（预算200ms，余量5.212ms）。旧 d767 报告的六项失败本次未复现，但不同源码和运行窗口不足以证明根因；十项 D2 缺口、自然时间/HALT 恢复与晋升仍未闭合，阈值未调整。规范 main 此后前进至 b3879f96f。追加签署合并 59208b5ad 接入该主干，采用其新 runtime 指纹算法的夹具以解决唯一测试冲突，并移除主干遗留的重复 digest 导入（该重复导入曾使合并源码的类型检查失败）。合并源码相关 Python 188 项、TypeScript 361 项通过（另1项预期 PostgreSQL 跳过），控制平面类型检查及真实 CLI 64 KiB 100/1000 预检、来源稳定性和清理通过；相对当前 main 的贡献差异为14个路径，合并基点为 b3879f96f。59208b5ad 的精确版本 CI 待验收。14/0/10 正式报告仅属于冻结源码 02d3dee83，不能自动证明新合并源码已获资格；运行时改动仍待维护者评审与合并。

一次受监督、源码稳定的 d767 正式 matched-1m 测试已完成 1 MiB、1万/10万笔两轴，Node22.22.3/SQLite3.51.3、WAL/FULL、每个命令每轴20个冷 CLI 样本与轴清理均核验。独立验证结果为 8通过、6失败、10缺失。十万笔时收据 p95 为65.172ms（预算50ms），提交/头/收据历史增长比为2.634/3.086/2.170（预算2），冷 CLI 状态 p95 为2594.854ms（预算2000ms），变更命令增量为1623.362ms（预算200ms）；scan-100 p95 为177.430ms（预算250ms）。固定阈值未上调，P1 已转为查明原因；不声明 D2 通过或推进晋升。

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @LIHUA919.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @LIHUA919.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[Duang777]

Commit 106b923a57c60d411dba9276c37d1f927e0023bc also fixes three failures currently reproducible on main@996bcc027 and blocking #5340. I applied only that signed commit to an isolated current-main worktree; the affected tests passed (3 passed in 6.74s).

Could you split this test-only commit into a small standalone PR? That would let the baseline repair land without waiting for this draft performance change and its main synchronization.

[Duang777]

I extracted the test-only repair into #5344 to unblock the current main baseline while preserving Lihua as the commit author. No performance changes from this draft were copied.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @LIHUA919.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @LIHUA919.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork