fix(quota): reject late polls after unavailable Monitor closeout

[loopx-agent]

Goal And Delivered Outcome

An unavailable Monitor attempt must have one frozen outcome. Main 2e3ab4c4a accepted late non-material and material polls on the same Goal/Agent/Todo/Turn, changed observation fields, and broke original refresh replay. The four real File/SQLite counterexamples reproduced the #6178 reverse-order finding.

The shared TypeScript poll admission rejects a committed unavailable outcome before provider effects. Independent draft review then found a second order: the provider had committed but the quota ledger was pending; unavailable closeout succeeded and the new fence trapped the original poll recovery. That blocker at 4abab0768 is preserved in the advisory audit, rather than hidden by the earlier positive suite.

The revised settlement entrypoint checks the existing poll transaction owner under the same quota lock. A stored pending/prepared observation must be recovered or proven effect-free before competing unavailable closeout. Receipts remain intact. Durable poll replay and independently admitted auxiliary observation retain their paths. Both fences use the accounting Agent already used by the Turn/effect/run record. A second independent check exposed the reverse actor case at c4aa543: a registered provider actor B could commit an unclaimed Monitor for accounting Agent A, then the pending reader skipped it. A real File counterexample reproduced the accepted competing closeout. Pending v1 now checks its frozen admitted decision; legacy pending retains its exact accounting effect identity, while provider actor metadata remains business attribution. Conflicting frozen admission is rejected.

Dedup checked 53 open PRs, 60 recent merges, related issues and targeted searches. #6311 addressed legacy unavailable admission; #6251/#6268/#6285/#3412 addressed different boundaries. No other author's PR is taken over. This proposal targets main, remains Draft by explicit operator instruction, and closes no program tracker.

Author Declaration / Implemented Against

Written by: model_agent — OpenAI Codex (GPT-6 family), under human operator direction.

Specification: docs/reference/protocols/quota-blocked-causal-closeout-v0.md, “Unavailable Monitor observation” and exact frozen replay, at pre-change 2e3ab4c4a5665378b9e422f9483a820066fca40b. Existing quota GoalRef owner supplies instance isolation. The protocol edits disclose the repaired default refusal and historical scope hold; they are not the independent oracle.

Accepted criterion	Disposition / owning boundary	Decisive evidence
Exact identity and durable typed blocker/evidence	implemented: existing settlement reader and unavailable predicate	Actual recovery commands and real File/SQLite/Markdown CLI
Frozen fields and original exact retry	implemented: poll admission before provider effects	Late execute/preview refusal, unchanged clocks/hash/generation, original refresh replay
Observation and unavailable are competing outcomes	implemented: stored transaction reader inside quota admission	Provider-committed/ledger-pending material and non-material fault cases for accounting A with original or registered provider actor B; rejected refresh preserves WAL, exact recovery and replay produce one poll
No debit, completion or invented successor	implemented: existing no-spend owner	Zero debit/late poll, identical Todo IDs; recovery preserves already committed provider state
Genuine replay, auxiliary and Goal instance isolation	implemented: existing admission and GoalRef predicate	Native source matrix covers pending/prepared/committed, foreign instance, alias and auxiliary separation; live CLI legal auxiliary/replay

Scope And Continuation

Six files deliver one coherent defect repair: two existing TypeScript owners, two CLI regression modules, the existing native test module and bilingual protocol. The maintenance increment adds two test files/surfaces for the observed Windows failure: the existing copied-runtime replacement fixture and a small test-only diagnostic helper. No new product decision vocabulary, provider, permission, configuration or Python authority. The receipt reader reuses the existing decoder and artifact-scope check. New exact-source pending receipts preserve existing GoalRef metadata; known foreign receipts do not become current evidence. Historical pending without GoalRef in an exact-source context holds for owner reconciliation while retaining its bytes; alias compatibility remains.

The diagnostic instruments only that fixture's temporary TypeScript copies and retains the managed runtime's existing temporary stderr sink. Production cleanup modules remain unchanged. Successful tests emit no diagnostic; a failed original two-second retirement assertion prints allowlisted phase/release/error events, safe locator/lock state and non-signaling process liveness, then rethrows the original failure. Tokens, paths, environment values, raw stderr and arbitrary error text are excluded. Events are a bounded failure-time view: first 16 KiB / last 64 events per sink; duplicated descriptors share offsets and may race concurrent writes; each runtime's monotonic clock is independent. Later cleanup/Windows sharing remains unobserved. The event/code lists are local test observations, not a shared product protocol.

Live CLI poll admission spans preflight, provider and ledger commit under the same index kernel lock used by refresh; source sessions additionally hold the marker/source guard. Static independent review confirmed that lock boundary, and native concurrent same-effect/CAS tests remain covered. The decisive interrupted-process counterexample, rather than an unrelated soak, qualified the window after locks are released by exit. No live two-CLI contention experiment or PostgreSQL result is claimed for the revised head.

Source access, existing conflicting historical outcomes, installed adoption, physical Windows/minimum Node and release remain separate. Maintain this PR for valid feedback, CI and conflicts before starting another item. No merge, automatic merge, deploy, installation upgrade or model experiment.

Validation

Current head: 8d7b0f127c06dd2fde393f0fe9f98341bbee7a90, based on f44fe3d9e831c8137ec36a4d97a90caa79f351fc synchronized with main ea4ec4925e21185d8244243fe63bb59225705cec. Product/protocol blobs are unchanged since f44; only the authorized test diagnostic was added. Synthetic/public fixtures only; macOS source Python 3.14.8, Node 24.21.0. Local checks use isolated File/SQLite/Markdown and serial execution. The current head's focused results and prior-head product results are separated below.

Check	Result and scope
Baseline / mutation	Four original main late-poll cases failed; removing the first fence restored append/field mutation/failed original refresh. Independent File/SQLite interruption cases also failed at old PR head: unavailable appended, pending retry denied, ledger poll count zero.
Current diagnostic	At 8d7b0f127, the existing real runtime replacement case and stderr-filter case: 2 passed; successful run emits no diagnostic. A bounded temporary EPERM publication-release injection still fails the original retirement assertion, prints safe EPERM / release-false / self-owned-lock evidence and preserves the failure. Both fixture children exit 0; no user process is stopped. The synthetic expected failure is parity evidence, not a passed Windows test.
Prior f44 affected CLI	python -m pytest tests/control_plane/test_monitor_poll_unavailable_recovery.py tests/control_plane/test_monitor_unavailable_closeout_cli.py -k 'pending_poll or late' -q: 14 passed on unchanged product; interruption across both providers and poll kinds with original and distinct registered provider actors, exact WAL recovery/replay, six late/refused/replayed/auxiliary journeys, omitted/replaced native actor. Not rerun for this diagnostic increment.
Prior f44 native	Three poll/auxiliary/readback suites with --test-concurrency=1: 195 passed, including the added exact GoalRef pending/prepared/committed scope matrix. Not rerun for this diagnostic increment.
Prior synchronized regression	At 465a052fe07110714c79dc29abf12da6cd361303, the complete three-module CLI selection passed 48 cases and native suites passed 195. Subsequent Agent ownership fixes added forward and reverse actor counterexamples; the affected fourteen CLI cases and native suites reran at the final head. These 48 are retained prior-head evidence, not a fresh all-48 invocation at the final head.
Static / risk gate	At f44: typecheck, full CI Ruff inputs, mypy (19 source files), CLI output budget, semantic/public-boundary checks; premerge 4 direct and 18 selected passes plus inherited advisory. Current increment: Ruff, compilation, diff hygiene and canonical public-boundary scan of both changed files pass. The semantic advisory reports zero supported product paths; it cannot analyze the test-only helper, so this is not semantic equivalence certification.
Inherited advisory	Maintainability ratchet reports unchanged goal_frontier/__init__.py at 2007 lines against 2000; independently reproduced in original fixed main and unchanged at this diff. Existing premerge treats it as advisory. No limit or exception was modified.
Earlier failures retained	Six initial fresh-observation fixtures incorrectly selected a Monitor in the advancement lane; corrected through real Todo creation/current recovery/auxiliary flow. A renamed call, wrong replay field and wire-vs-typed GoalRef fixture were corrected. Sandbox IPC and optional offline SDK-cache setup failures were not runtime counterexamples.
Remote / unrun	f44 Windows failure and attribution evidence remain: 187 passed / 1 failed / 19 skipped; successful main's 188/19 and a conditional macOS mechanism are not an independently reproduced baseline failure. The current diagnostic commit triggers one normal CI run; no manual rerun or queue-chasing submission. New exact-head hosted CI and formal maintainer review remain pending. Prior-head DCO/PostgreSQL/other passes do not qualify this head. Local full Python/TS fleet, PostgreSQL, installed wheel/packaged App/Lark and physical Windows/minimum Node were not run.

Frontend / Boundary

UI impact: none. Existing CLI/managed-Turn settlement admission only; no frontend/Lark control or capability extension. Packaged/live adoption remains unverified. Shared-authority promotion/routing fixture: N/A; no provider promotion or compatibility projection change.

• Bug fix with meaningful regression and negative cases; existing typed quota owners reused.
• Public content contains no private state, credentials, raw traces, internal links or local absolute paths.
• Every contribution commit carries DCO; explicit path staging; no benchmark duplication.

中文：独立补审确认并修复了 provider 已提交、ledger 尚未提交时的竞争结算死锁。新的不可观察结算先保护原事务恢复，按既有 GoalRef owner 隔离实例，并以固定 accounting Agent 查询历史。原迟到 poll 拒绝、原 refresh 重放、合法辅助观察与真实 poll 重放保留。旧 head 的通过不计新 head；保留 Draft，待新 CI 与维护者审查。

[loopx-agent]

Reviewer: model_agent; GPT-6 family; OpenAI; self_reported

Draft advisory audit of exact head 4abab0768eb35a57ec7a95a711aed3173aa2a5e6; a confirmed blocker is being repaired in this same PR. The draft remains open for maintainer review.

动机

本 PR 修复 unavailable 尝试结算后迟到 poll 改写观察和破坏重放的缺陷。独立内部审查重点核对两个顺序、真实 poll 重放、辅助观察与中断/并发边界。依据是改动前 docs/reference/protocols/quota-blocked-causal-closeout-v0.md at 2e3ab4c4a5665378b9e422f9483a820066fca40b 的精确身份、冻结历史读回和原样重试要求。

改动思路

复用 typed quota owner 和既有 unavailable proof 是相称的；存活 CLI 的外层 quota admission 覆盖 preflight、provider 和 ledger commit，refresh 复用相同 index kernel lock。静态审查未发现两个存活 CLI 可直接插入 provider CAS 的窗口，但进程退出后的 pending WAL 需要另验。

具体改动

旧 head 的三个文件补上 poll admission 拒绝、六项真实 CLI 反向顺序/独立观察回归及双语说明。durable poll replay 在新 admission 前返回，auxiliary 仍校验独立 Monitor 与 advancement binding。

对主干的风险

P1 — provider 已提交、quota ledger 未提交的 poll 会被 unavailable closeout 截断。 复用现有 fault="quota_commit" 退出点，真实 File 和 SQLite 都得到：业务观察/后继已提交，provider_pending 回执仍在且 poll index 为零；同原身份的 typed unavailable refresh 返回成功并追加；精确重试原 poll 返回 monitor_poll_admission_rejected，poll ledger 仍为零。

settlement_readback.ts 只从 events/index 判断已有观察，未纳入 stored pending transaction；monitor_poll_commit.ts 新 admission 却会拒绝原 pending 的恢复。因此顺序性正例与 194 项 native 回归不能覆盖该中断窗口。修复应在同一 receipt owner 中拒绝 competing unavailable closeout，先恢复或取得可信 no-effect 证据，保留业务回执、精确重试和辅助观察。另需核对合法 native v0 缺失 actor 时，reader 与 provider 的 agent 回退一致。

我的整体评价

这个修复有真实价值，但上述中断反例阻塞旧 head 的通过。当前仅发布已验证的 draft advisory；正式审查 CLI 对 draft 没有 actionable plan，fresh-audit 也因不存在先前有效结论拒绝执行，不能据此声称 capability-owned 正式审批完成。CI 的 DCO 已通过，主要运行仍排队。未触发重复 CI、合并、部署或模型实验。

English verdict: REQUEST_CHANGES - 4abab07; File/SQLite provider-committed, ledger-pending poll can be closed as unavailable and its exact recovery then rejects. Repair and requalify this PR's interrupted-transaction boundary.

[loopx-agent]

Reviewer: model_agent; GPT-6 family; OpenAI; self_reported

Draft advisory follow-up for exact head f44fe3d9e831c8137ec36a4d97a90caa79f351fc. This records repaired findings and bounded evidence; it is not formal approval or merge authority.

动机

同一 Monitor 尝试的 unavailable 结算、业务观察与精确重试必须保持单一冻结结果。依据是改动前协议 quota-blocked-causal-closeout-v0.md at 2e3ab4c4a 的精确身份和冻结重放，而不是新增测试或改写后的文档。

改动思路

两个相反顺序由既有 quota owner 保护：unavailable 已落盘时，在 provider effect 前拒绝迟到 poll；provider 可能已经提交但 ledger 尚未完成时，保留其事务回执，拒绝竞争 unavailable，要求原样恢复或可信 no-effect 证明。判断使用 typed closeout、持久化 admission、精确 accounting identity 和 GoalRef；无 substring denylist 或产品专属分类。

具体改动

原 4abab0768 的 P1 中断审查记录 保留。后续独立检查又发现 c4aa543 的反向 actor 缺口：业务写者 B 合法提交未认领 Monitor 后，pending reader 用 B 与 accounting Agent A 比较而跳过回执。真实 File 负例验证 competing unavailable 返回成功并追加。现在 pending v1 核对冻结 admitted decision 的 Goal/Agent；legacy pending 依据已匹配的 canonical accounting effect 保守保留；错误冻结 Agent 明确拒绝。provider actor 仅保留业务归因。

最终 head 串行离线验证：14 项受影响真实 CLI（File/SQLite、material/nonmaterial、A/B actor 中断恢复及 Markdown/File/SQLite 迟到 execute/preview、原 refresh 与合法 auxiliary/replay）通过；三个 native suites 的 195 项通过。typecheck、全 CI Ruff 输入、mypy 19 个 source files、CLI output budget 通过。标准 premerge：4 direct 和 18 selected 通过，另有 1 个继承 advisory，无阻断失败。先前 465a052 的完整三模块 48 项保留为 prior-head evidence，没有算作本 head 的重新执行。

对主干的风险

静态独立检查确认活着的 CLI 使用同一 quota kernel lock，外层覆盖 preflight/provider/ledger commit；中断后锁释放窗口已有真实故障回归。GoalRef foreign instance 不得成为当前证据；历史 exact-source pending 缺 scope 时保留回执并要求 reconciliation，alias 兼容保留。此行为是默认拒绝，不应称为可忽略 guidance。没有新权限、配置、feature flag、debit 或辅助 advancement 语义。

维护性 advisory 仍是未改动的 goal_frontier/__init__.py 2007 对 2000；未删测试、改限额或改例外。新 head 的 hosted CI 与维护者正式审查仍待完成；本地全量 Python/TS、PostgreSQL、安装包/实体 Windows/minimum Node、两个存活 CLI 的实际竞争实验未跑。历史/native target-only 定位与原样重试是只读后续候选，未纳入本实现或当成已复现结论。

我的整体评价

两轮独立审查发现的具体阻断已在同一 PR 修复；最终内部只读复查在精确 Todo 绑定及既有 base/:todo effect 范围内未发现新增 P1/P2。Draft review capability 没有 actionable plan，fresh-audit 缺有效 prior conclusion，不能声称正式 capability-owned 审批完成。按 operator 指示保留 Draft，不合并、不启用自动合并、不因排队重触发 CI，也不新建自动化。

English verdict: COMMENTED - f44fe3d; both reported interrupted-transaction blockers are repaired with real provider regressions and bounded final-head validation. Hosted required CI and maintainer review remain pending; this draft advisory grants no approval or merge authority.

[loopx-agent]

Exact-head CI checkpoint for f44fe3d9e831c8137ec36a4d97a90caa79f351fc:

The Windows lifecycle job failed with 187 passed, 1 failed, 19 skipped. The failure is test_runtime_decode_change_rotates_identity_and_starts_replacement: after runtime.shutdown, the replacement runtime locator still exists when the existing two-second cleanup deadline expires.

The test, Python launcher, TypeScript shutdown/locator cleanup and workflow are unchanged from this branch's base ea4ec4925e21185d8244243fe63bb59225705cec, and from current main 509c38c502d3d0b4eafb01550efcdc4b5b5a1d17. The exercise uses transport-only runtime.ping / runtime.shutdown; those handlers do not dispatch the changed quota owners. That narrows the suspected boundary but does not prove a baseline failure or exclude timing/source-fingerprint effects.

Updated comparison: the existing main Windows job completed successfully, including the same lifecycle set (188 passed, 19 skipped). The exact-base workflow was cancelled before producing a Windows result. The #6304 Windows failure is a different test, test_runtime_drains_admitted_write_before_exit[connected-shutdown], returning EffectRuntimePermanentIOError from the admitted write; its aggregate 187/1/19 is not evidence that this PR's locator timeout reproduced there. The test/server/launcher/IO/cache match that older source, but lazy handler additions differ and the failed operation differs.

Precise conclusion: root cause remains unattributed. There is no independently reproduced same-base Windows failure and no demonstrated causal path from this quota change to the locator timeout. Main's success is counter-evidence to labeling it an established baseline failure; it does not qualify this PR's failed head. The failure remains a gate, not a pass or waiver. No Windows CI rerun, timeout increase, test deletion, unrelated runtime patch or macOS substitute claim has been made. A Windows reproduction or failure-time cleanup telemetry is still needed before changing the owning runtime rule.

Further bounded analysis (same PR head, no source changes):

• The failed job actually checked out merge 505e24839775f1cbb639d0f1db742ff4c886a0bc, whose parents are main 509c38c502d3d0b4eafb01550efcdc4b5b5a1d17 and head f44fe3d9e831c8137ec36a4d97a90caa79f351fc. Runner 2.337.0, Windows Server 2025 image windows-2025-vs2026 20260925.250.1, Python 3.11.9, Node 24.21.0, installed pip package versions and the serial lifecycle command match the successful main job. There is no -n/xdist execution in this step. The changed quota regression modules are not in its selected test list. The test, conftest, workflow, launcher, server, IO/handlers and compile-cache blobs match main. Full native-source fingerprint input differs because this PR changes two quota owners; their code is not dispatched by these ping/shutdown calls. That fingerprint/timing boundary has not been declared irrelevant by assumption.
• A single bounded macOS synthetic mechanism probe used temporary main/f44 native-source copies and actual ping, decoder-fingerprint rotation and shutdown. The control retired both locators in about 68 ms. Simulating only the replacement's initial publication-lock release returning false produced this case's exact shape in both main and f44: old locator gone, replacement locator still present at the unmodified two-second deadline, and its .ts-effect.lock owned by that runtime. After the existing five-second lock budget, the child exited with code 0 while its locator/lock stayed stranded. The first control attempt's PID-only probe treated an unreaped child as alive; the completed probe reaped only its own children. No business Goal, repository source or unrelated process was changed.
• This qualifies a conditional causal mechanism, not the actual Windows incident: best-effort publication release can fail silently while readiness is resolved; shutdown then cannot acquire the locator lock still held by its own live PID, and finally exits after the lock timeout. A Windows release failure/errno was not observed in existing logs. Slow compile-cache flush, failed locator read, failed unlink and a later cleanup remain distinguishable possibilities; main's successful Windows result still stands.
• Missing decisive evidence: monotonic cleanup-phase timestamps (shutdown ACK, close/drain, compile-cache enter/exit, lock attempt/acquire), the publication-release outcome and safe errno, lock owner PID/aliveness at the original deadline, locator read/unlink errno, and child exit plus locator presence after the existing lock budget. Token values, absolute private paths and raw user state are unnecessary. A single Windows diagnostic using the exact merge/main sources and existing predecessor order, with sanitized fixture-only phase tracing and the same 250 ms idle setting/two-second assertion, could distinguish these paths. No such new CI run has been started; macOS cannot qualify Windows file sharing or runner timing.

DCO, Dependency Review, Frontstage, real PostgreSQL, release build, Python change selection, chat-bundle and minimum-Node compatibility have succeeded on this exact head. Remaining full-fleet jobs are queued; the overall Python workflow has not passed. Local focused 14 real CLI and 195 native passes remain scoped evidence only. The PR stays Draft with no merge or auto-merge request; further Windows investigation and any demonstrated change-specific regression remain open.

[loopx-agent]

作者维护记录：失败时的 Windows fixture 诊断（非正式批准）

Reviewer: model_agent; GPT-6 family; OpenAI; self_reported. Current head: 8d7b0f127c06dd2fde393f0fe9f98341bbee7a90. Only two test surfaces changed since f44fe3d9e831c8137ec36a4d97a90caa79f351fc; product/protocol blobs are unchanged.

动机

旧 f44 Windows 失败仍未归因：replacement locator 在原两秒断言后存在；main 同测试集通过，#6304 是不同错误。合成机制不是基线证明。本增量只让下一次有意义提交的正常 CI 提供可区分清理阶段的证据，不修猜测中的生产行为。

改动思路

在既有替换 fixture 的临时 TypeScript 副本插入只记录事件的观察器，保留 runtime 原来的临时 stderr sink。生产源码、错误传播、锁释放结果、两秒阈值及原断言均保留。成功时不打印，原断言失败后才过滤并输出诊断，然后原样抛出。没有新权限、安装设置或真实 Goal 状态。

具体改动

runtime_retirement_diagnostics.py 观察 shutdown/close、compile-cache flush、locator lock attempt/acquire/release、read/unlink 与安全 errno；只接受已知事件、数值/布尔字段和既有 errno/code。test_effect_runtime_integration.py 仅为对应 fixture 保留自己的 stderr FD，记录 request/ACK/deadline 时点和 original/replacement PID，在失败时用已有不发送信号的 liveness probe 读取安全 locator/lock 状态。finalizer 只关闭自己的重复 FD。附一项有效隐私回归，验证 raw stderr、token/path 和未知事件不返回。整个 PR 的 poll admission、pending readback、actor/GoalRef 修复仍是未变的 f44 实现。

对主干的风险

诊断会给临时副本增加少量 trace 开销，不能把新 CI 一次成功称作原 Windows 根因定位。stdout 仅在已确认原断言失败后输出；trace 只读取前 16 KiB、每个 sink 保留最后 64 个允许事件。重复 FD 与 child 共享 offset，读取可能和后续写入竞争；这是有限证据，不是完整无干扰日志。各 PID 的 performance.now() 与 Python monotonic 秒数不直接对齐。两秒后的清理、子进程终态和 Windows 文件共享仍可能缺失；未增加等待阈值或失败后等待来掩盖问题。

我的整体评价

最终 8d7b0f127 本地串行离线：原 real-runtime 替换用例＋过滤单例 2 passed，正常日志没有诊断；临时 EPERM publication-release 注入仍在原 replacement assertion 失败，输出安全 EPERM、release false、自持锁和 cleanup lock-attempt 证据，两名自有 child 随后 exit 0。这是 expected-failure parity，不是 Windows PASS。Ruff、Python compilation、diff hygiene、两文件 canonical public-boundary scan 通过。独立内部只读审查未发现 P1/P2，读取/时钟限制已披露；不构成正式批准。

f44 的 14 CLI、195 native、静态和 premerge 结果仅是 prior-head 未变产品证据，没有重新计作新 head 全量通过。当前仅推送这一 DCO 提交，利用正常自动 CI；没有手动 rerun、重复提交追队列、第三 PR 或 merge/auto-merge/deploy。等待新 exact-head Windows 结果再据因果修复。

English advisory: 8d7b0f127c06dd2fde393f0fe9f98341bbee7a90 adds failure-only, allowlisted observations to the existing copied-runtime fixture. Production cleanup behavior and the original two-second assertion are unchanged. Final focused normal checks: 2 passes; injected EPERM retains the expected original assertion failure with safe phase/release evidence. Earlier f44 product results remain prior-head evidence. Windows CI is pending; this diagnostic neither identifies the actual old root cause nor grants formal approval.

[loopx-agent]

Post-merge author evidence checkpoint; this is not a formal review approval or a full-CI qualification.

GitHub now records this PR as merged at source head 8d7b0f127c06dd2fde393f0fe9f98341bbee7a90, merge commit 64bfb834365f240cfb5eabd5cac5f2ea4098bf2d. The author maintenance session marked it ready for review and read back the unchanged head; it did not merge, enable auto-merge, deploy or rerun CI. This supersedes the earlier Draft continuation wording, not the recorded evidence limits.

At this head, old shard 2 and old shard 4 have explicit one-hour maximum-execution-time annotations and missing JUnit. Shard 4 reported eight failed nodes but no traceback/summary. Its descendants [True] case passed on exact base 509c38c and failed here; the actual cause remains unverified. Seven other failed-node matches or truncated base assertions do not establish identical current failure mechanisms and do not waive the full Python gate.

Old shards 1/3 were cancelled at the ready-event replacement boundary, with empty steps; those cancellations are separate from the confirmed shard-2/4 timeouts. The automatically created ready-event run 38341235107 is now cancelled with no jobs returned. No new failure body was obtained from it. The 8d7b0f Windows result remains 189 passed / 19 skipped; it neither explains the earlier f44 Windows failure nor substitutes for complete Python qualification.

Related owners #6318, #6344 and #6347 have now merged. Their timing evidence, canonical/ACK fixture corrections and invariant fixes must be assessed through a new complete main-source run; their integration does not retrospectively prove the missing failure causes. A separately validated immediate, sanitized failure-location diagnostic remains unpublished and is not part of this merged head. No third PR was created or branch pushed after the merge was observed.

中文：已正式提交并由维护者合并，但完整 Python 门禁仍未通过。旧 shard2/4 的 60 分钟超时、旧 shard1/3 的替代取消与新 ready-event run 的取消分别记录。descendants 的 base PASS/current FAILED 仍缺实际错误正文；同节点基线失败不作为豁免。后续需要新 main 的完整验证及准确失败证据，不能将本地未发布诊断或单项 Windows 通过算作该合并 head 的完整资格。