[huangruiteng]

Goal And Delivered Outcome

Restore the main runtime snapshot feed after its shared release reaches GitHub's 1,000-asset limit.

At main 886f2cdff4b2daad642f08f1b9bcffc0edf66359, the runtime build and install qualification passed, but publication failed with HTTP 422: file_count limited to 1000 assets per release. Read-only release inspection confirmed exactly 1,000 assets. New snapshots cannot reach main-channel updaters.

• Store each new revision's five immutable assets in runtime-main-<full SHA>, marked prerelease and not latest.
• Keep runtime-main/loopx-runtime.json as the existing channel endpoint. Promote only after all immutable assets succeed, preserving lineage and no-backwards-promotion checks, then verify the uploaded pointer bytes.
• Preserve all historical immutable assets. Pinned SHA lookup uses the new address, with legacy fallback only for HTTP 404; corrupt metadata, wrong revisions and other transport failures remain refusals.
• Intended base: loopx-project/loopx:main. This is a self-contained reproduced release defect; no new roadmap scope or issue is required.

中文：修复 main 快照发布因单个 release 已有 1,000 个资产而持续失败。新快照使用各自的不可变预发布，最新入口及历史资产保留；不删除资产、不发布 release、不部署、不合并。

Author Declaration

Written by: model_agent, OpenAI Codex, under the user's direction. No human review is claimed.

Implemented against

The existing snapshot publication, immutable-byte retry, exact-revision update and stable-channel contracts at the base above, plus the reproduced GitHub service limit.

Criterion	Disposition	Evidence
A full legacy release cannot prevent the next immutable snapshot	implemented	Actual workflow Bash with a filesystem-backed GitHub peer: baseline fails with the same asset-limit error; candidate succeeds while all 999 historical assets remain unchanged
Publication never overwrites immutable bytes or promotes a wrong/older revision	implemented	Existing byte comparison retained; wrong tag identity, changed bytes, main ancestry and older-run regressions
Pointer retries recover uncertain outcomes	implemented	Real gh --clobber ordering modeled as deletion then upload; failure after deletion and after committed-but-unacknowledged upload both recover on retry
Existing channel and historical pin consumers remain supported	implemented with stated compatibility limit	New/legacy SHA, 404-only fallback, invalid/wrong-SHA refusal, and unchanged main/stable/version URLs
Stable predecessor selection remains correct	implemented	Existing real predecessor/extraction test now places stable releases after two full pages of snapshot prereleases

Self-check: read the owning workflow, builder, bootstrap resolver, install documentation and stable predecessor consumer. A separate read-only review of the identical committed content tree found no blocking findings. The full-tree qualification failures below remain blockers.

Scope And Continuation

The existing owners remain in place; no new publisher abstraction, schema, permission, dependency, cleanup policy or deployment route is introduced. Correct archive URLs are generated before manifest freezing and attestation.

Compatibility limits:

• Old installed clients can update through the unchanged main endpoint and still use historical SHA addresses. They must update before pinning a newly published SHA.
• Pointer replacement remains non-atomic because GitHub CLI deletes then uploads. This PR proves retry recovery, not uninterrupted pointer availability.
• Stable discovery excludes these prereleases, but its existing all-release pagination grows with snapshot history. Discovery redesign is not included.
• Real GitHub publication remains a post-merge qualification. No assets or release pointers were changed while developing this proposal.

Validation

Published head: a5902824564c0fb6f349c68a2f452ff3b055974f.
Content tree: 3cb9cee41744502e77ac23501c5a3f0a63220f7d, byte-identical to locally reviewed/tested commit d92cf8f0977839a68491a60528eb6216946c5564.
Input classes: synthetic, public_fixture.

Check kind	Result	Evidence / limitation
unit / real_entrypoint	passed	Six affected publisher, resolver, update, activation, archive-response and Chat-bundle modules: 165 passed, 3 existing native-Windows skips
regression_parity	passed	Workflow Bash runs with real files and cmp; only GitHub is replaced. Full legacy release, partial upload, exact retries, immutable collision, wrong tag, lineage, duplicate-create refusal, failed views and first-channel bootstrap covered
real_entrypoint	passed	Full Chat frontend build and source verification; existing large-chunk warnings remain
real_backend / integration	passed	Rebuilt exact published head: runtime 19,024,420 bytes, 3,694 runtime files and 979 optional files. Real isolated clean install and upgrade, doctor, skills, frontend HTTP/source contract, license notices, no frontend build tools, and activation-failure restoration all passed
static	passed	Changed tests/resolver Ruff, Python compile, semantic-vocabulary advisory, bilingual RFC diff gate, whitespace and seven-file public-boundary scan
integration	failed	Standard premerge on the identical tree: 18/19 selected checks passed; CLI output budget fails because the existing baseline probe loses interaction_contract, scheduler_hint, selected_todo. Same failure reproduced separately on untouched main; exact published-head replay also finished with the same sole smoke failure
static	failed	Required full Ruff: existing E731 in tests/test_manager_context_roundtrip.py:289; required mypy: existing task_orchestration_admission.py:110 no-any-return. Both reproduced on untouched main, not waived or bundled into this repair
unit / hosted CI	failed / still running	DCO and Dependency Review passed. Python Tests fails at the same baseline E731. Runtime snapshots: 143 passed, 3 skipped, 1 failed in the unchanged detached-worker refusal test. A deterministic reproduction confirms the pre-existing worker writes terminal status before result, exposing a missing-result window; independent repair #8065 is now open with six baseline-failing regressions and 261 passing update/activation tests. Frontstage Pages and Release Artifacts passed. All six associated workflows are terminal; the two failures remain the baseline lint gate and the existing update-result race documented above. Full local pytest stopped at approximately 21% after an unexpected telemetry attempt from an unchanged test fixture; no full-suite or aggregate pass is claimed

The standalone builder's existing two E402 import-order findings also reproduce unchanged on base; it is outside the repository's configured full Ruff command. The changed builder line introduces no new lint finding. An initial exact-head rebuild correctly rejected a cached frontend manifest from the equivalent local commit; a forced frontend rebuild then passed exact published-head construction and installation.

Full-suite limitation: tests/cli_commands/test_project_repository_ports.py constructs its child environment by dropping every LOOPX_* variable, including LOOPX_USAGE_PING=0. The fixture consequently attempted the default collector despite the outer test run disabling telemetry. No retry or complete-suite result is claimed, and this unrelated fixture is unchanged by this PR. Independent test-only repair #8068 preserves the opt-out and passes six network-isolated targeted tests.

Frontend / Visual Evidence

UI impact: none. Publication layout and bootstrap resolution change; product rendering, controls and frontend source are unchanged. The real packaged frontend HTTP contract was exercised; screenshots are not applicable.

Type Of Change / LoopX Area

• Bug fix
• Documentation update
• Test update
• Build, packaging, installer, or CI

Shared-authority RFC fixture impact: N/A; no authority-store, routing, promotion policy or compatibility-projection changes.

Boundary Checklist

• Public-safe diff and description; no private state, credentials, internal links, machine paths or raw traces.
• No maintainer-owned benchmark experiment, paid model run, release publication, deployment or merge.
• All historical immutable assets preserved; no deletion or migration logic.
• No paired RFC changed; bilingual diff gate passed.
• UI impact none.
• Commit includes a DCO Signed-off-by trailer.

[loopx-agent]

Reviewer: actor_kind=model_agent; model=gpt-6.1-sol; provider=OpenAI; declaration_source=runtime_reported; reasoning_effort=max.
Exact head: 8064@a5902824564c0fb6f349c68a2f452ff3b055974f

动机

安装或固定 main 快照的用户，以及发布已验证快照的维护者。旧布局把每次快照的资产累积在一个 release，容量满后无法继续发布；新布局把新资产放进按提交区分的 release，原 main 入口只更新指针，历史下载继续保留。独立发布模型中，满额旧 release 不再阻止新增快照；实际 HTTP 下载校验、隔离构建安装及失败回滚通过。本 PR 不迁移或删除历史资产，不授权发布或合并，不证明远端发布已经上线，也不声称无限制的 release 列表扫描成本已解决。

实际 GitHub 发布需在本 PR 合入后由已有 workflow 执行并读回；当前必需质量检查仍失败，不能作为已发布或可合并证明。

审查先读已有合同 docs/guides/installing-loopx.md，不可变 revision 886f2cdff4b2daad642f08f1b9bcffc0edf66359，条款 Stable, main and source builds。Qualified main bytes must be revision-addressed with digest/inventory validation; immutable metadata/artifact absence must refuse; stable main/source ownership and explicit source selection remain. Prechange one-release physical layout is intentionally amended, not used as its own proof. 原合同把 main 资产集中于单个 release 的物理布局，本次明确改为按 revision 分开；判断依据是历史固定下载仍保留、容量反例及实际包资格，不能用改后的文档反证实现。

改动思路

复用既有构建、发布和元数据解析 owner；按提交拆分 release 是 provider 存储布局修复，不需要新控制面、迁移器或第二套解码规则。本次边界为新 main 快照的发布布局及新旧固定 SHA 的消费兼容；稳定版选择、历史资产和现有安装 owner 保留。 旧布局把每次快照的资产累积在一个 release，容量满后无法继续发布；新布局把新资产放进按提交区分的 release，原 main 入口只更新指针，历史下载继续保留。 既有权限和失败 owner 继续负责拒绝与恢复，本次没有增加准入、配额、Host 切换或自动重试权限。 用户仍使用原 main 更新入口；新 SHA 定位先找不可变 release，只有明确404才允许读取历史布局。

具体改动

改动共7文件，+380/-13。复用既有构建、发布和元数据解析 owner；按提交拆分 release 是 provider 存储布局修复，不需要新控制面、迁移器或第二套解码规则。本次边界为新 main 快照的发布布局及新旧固定 SHA 的消费兼容；稳定版选择、历史资产和现有安装 owner 保留。 构建器在冻结元数据和 attestation 前确定新 URL，继续从 committed source 生成归档。发布步骤先检查不可变 tag 实际提交、上传并逐字比较固定资产，再用原有 Git compare 防止 main 指针后退；最后重新下载 main 元数据做 cmp。既有主线串行发布和 PR 不发布的门仍在。

场景	基线	当前提交
旧 release 达模型容量上限	新快照失败	新 release 5个资产，历史字节不变
main 最终读回被破坏	旧步骤可错误报成功	cmp 拒绝；清除故障后新工作目录重试成功
固定旧 SHA	旧位置直读	新位置404后回退旧位置

表格对应独立发布模型和 HTTP 执行结果；release 写入使用文件系统支持的 gh 边界模型，并非实际 GitHub 发布。解析器的 fallback 检查真实 HTTPError 的404原因；403、500、非法 JSON 和错误 revision 都拒绝，不能借旧资产掩盖失败。稳定版/main/版本输入仍访问原地址；元数据未知字段与下载 digest/size 保留。standalone_source 继续从同一个解析器生成，无第二解码实现。

• Publish immutable snapshot then channel pointer：Provider publication order。旧布局把每次快照的资产累积在一个 release，容量满后无法继续发布；新布局把新资产放进按提交区分的 release，原 main 入口只更新指针，历史下载继续保留。
• build：Committed-source archive/metadata producer。Main archive URLs now include full immutable revision tag.
• resolve_artifact：Artifact selection and validation。New SHA URL first; only actual404 falls back to legacy SHA URL.

本次独立验证：6个相关模块 head165 passed/base140 passed，各3个原生 Windows 用例跳过，既有 duplicate-zip warning 保留。发布模型每个 revision 3个用例、实际 HTTP 每个 revision 9个用例满足预期。当前 head 还实际构建前端、committed runtime 归档，并在隔离环境通过 clean install、upgrade、doctor、skills、frontend/source 合同、HTTP digest、无前端构建工具安装与 activation 失败回滚；未改用户安装。稳定前驱选择覆盖200个快照预发布，保留原分页扫描。改动涉及的适用 Python 模块 Ruff 通过。

对主干的风险

新 release 数量持续增长，既有稳定前驱列表扫描仍是线性冷路径；普通 stable 更新仍直接取 manifest。旧客户端能继续 main 与历史 SHA，但固定新 SHA 前须先升级，这个兼容代价已经公开说明。main 元数据 clobber 仍可能出现短暂下载缺口，应按原错误重试；本次没有宣称原子、持续可用的远端切换。历史资产未删除，错误 tag/字节、后退或分叉均不能被成功回执掩盖。

必需验证保持失败：uv run --extra test python -m mypy 在未改 task_orchestration_admission.py:110 报 no-any-return；配置范围的完整 Ruff 在未改 test_manager_context_roundtrip.py:289 报 E731。基线与两个 exact head 的完整输出分别208字节、697字节逐字一致。标准 premerge 的6项 direct checks 通过，19项选择检查18项通过；8个 risk 和 public-boundary 检查均通过。 唯一所选失败是 CLI-output-budget-regression：独立同命令固定 base/main 到 886f2cdff4b2daad642f08f1b9bcffc0edf66359，在 base measurement 阶段、尚未比较 head 前就缺 interaction_contract、scheduler_hint、selected_todo；三个 revision 的完整失败在仅规范化源/临时根路径后2688字节一致。相关因果源、测试、配置与 ignored lock 未改。归因说明本 PR 没有引入这些失败，不豁免必需门；change-quality cqr_d878676dcdff7f8d6706 仍为 FAIL。未查询、轮询或等待 CI，也未执行合并。

我的整体评价

APPROVE：当前 head 未发现需本 PR 修复的阻断性问题；这是已验证构建/消费边界的合理增量，实际 GitHub 发布读回和必需质量门仍有待完成。 已检查发布 workflow、安装文档、解析器、独立 HTTP 下载和隔离安装；没有渲染页面或布局变化，视觉评审不适用。 unverified_scope: none。代码批准与 change-quality、必需验证及合并权限分开；不把测试数、review 或包资格当作已部署、长期效果或完整成本收益的证明。

English verdict: APPROVE. The exact-head change is supported by independent base/head boundary evidence; required quality failures remain on hold. No merge performed.