[cocolord]

The small-kernel RFC lacked an observed managed execution closure after capability discovery merged. This checkpoint proposes the existing generic-cli/SQLite composition and records a source-bound task, interruption, recovery and independent result readback. It extends the discovery checkpoint in this same proposal; both RFC mirrors carry the evidence and remaining gaps.

At product revision 62e234c939996ad42f2b1168451cc9a656dce11d, the ordinary and interrupted synthetic fixtures each finish with one host invocation/attempt, one writeback and one debit. The owned CLI is killed after typed host-result persistence, then resumed from the original journal. The resumed path validates cached work without invoking the host again; committed replay reports no repeated host, writeback, debit or scheduler effect. Separate validators check the literal squares of zero through seven, and both artifacts have identical bytes. Only disposable isolated SQLite fixtures were faulted.

The ordinary Python execution loads 538 LoopX modules across 21 capability namespaces, without the full CLI or Chat tree. A second successful drill traces the existing native runtime under an isolated broker: 231 TypeScript and eight JSON files load under control_plane. The second drill's head 33e3323eb differs from the product baseline only in RFC documentation; runtime and test source equality was checked. These observations identify actual loading, rather than approving every loaded module as core.

The candidate table names installation, host, authority, required logical core, optional activation and identity/recovery boundaries. The scaffold seeds a soft_claim shadow, so this drill does not qualify normal hard-lease V2. Test extras and a monolithic source checkout do not qualify a minimal install. Model-host V4, context V5, interruption during unconfirmed host work, complete R0/V10/R1, D2/D5 adoption and split installation remain open. Imported helpers do not establish optional activation. Parent-side network tracing distinguishes local RPC from external connections; child/broker CPU and RSS, full context/wire bytes and model costs remain unmeasured. No matched performance or long-horizon benefit claim is made.

Bounded refactoring is deferred to the evidenced existing seam: turn_run_once.py imports DSH builders before host selection although their call sites are under the DSH branch. The next reversible owner change should retain established exports/patch points and qualify generic/DSH/Codex behavior and default-off parity. This proposal changes two RFC files only. D2/D5 remain owner decisions; no runtime, provider, default, authority, dependency, installed-host or release change is included. The separate #8011 status proposal retains its holds.

Validation:

• Discovery/protected dispatch: 23 existing tests pass on 62e234c93; the independent settlement-plan cold-import oracle also passes. The November 4 failure remains historical; fix(quota): keep capture IO out of the settlement plan's cold import #8054 removes only that prerequisite.
• Managed recovery: six SQLite cases of test_managed_start_interruption_preserves_reservation_and_attempt, plus test_turn_run_once_cli_rejects_unproven_host_claim_before_writeback and test_turn_run_once_cli_replays_declared_successor_after_interruption pass in tests/test_loopx_turn_driver.py. Two source drills additionally exercise real host/validator subprocesses, interruption, recovery and committed replay.
• Bilingual staged gate and whitespace checks pass. Standard premerge passes on exact head aee08c0d7b1373ff921b5eb4cc784860dcd5c356: four direct and 11 selected checks, no failures, warnings or advisories. Both RFC files pass the public-boundary scan. The local selector also sees an untracked generated uv.lock; that file remains outside the two-file committed PR scope. Goal change-quality policy is disabled, so no receipt or safe-fix authority is inferred. Root development dependencies report four moderate advisories; no dependency repair is included.
• Earlier wheel/performance evidence retains its original revision/environment; wider suites and configured mypy are not current qualifications. Probe setup refusals (network observer, schema, resume flags) were retained and corrected without production changes or authority relaxation. Raw probes, logs, fixtures and generated lockfile are excluded from the proposal.
• Remote CI, exact-head review and merge readiness remain separate. No merge or installed-host action was taken.

中文：本次双语 RFC 检查点补齐既有 generic-cli/SQLite 任务执行闭包、中断恢复与独立结果回读的源码证据，并提出 D2/D5 装配候选。正常与中断夹具均只有一次宿主调用、一次回写和一次扣额；原 journal 恢复及 committed 重放不重复已确认效果。下一步在既有 Turn owner 延迟加载未选择的 DSH builder，继续验证宿主行为和默认关闭一致性。hard-lease、模型宿主、完整性能成本、minimal preset、拆包安装和 owner 采纳仍未完成，不能将模块数量或本次演练当作收益资格。

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | reasoning_effort=max

未发现需要修改的阻塞项。评审范围为 aee08c0d7b1373ff921b5eb4cc784860dcd5c356 的完整双语 RFC 差异；认可源码刻画这一增量，保留提案列出的资格缺口。

动机 / Motivation

选择小内核首个宿主与 authority 组合的维护者和后续实现者。

以前只有发现路径和历史 import 失败；现在对照固定产品版本说明已修前置问题、实际任务/中断恢复边界、未完成成本，并定位未选择 DSH builder 的真实 eager import。

32项关联测试独立通过；隔离的真实 host/validator 与 SIGKILL 恢复演练确认各一次宿主调用、回写与扣额，并得到相同产物字节。加载 census 仍是作者测量，未独立重测。

D2/D5 owner adoption、hard-lease/context parity、未确认宿主工作期间中断、完整成本与拆包安装仍未完成。

不批准 preset、默认值、host/权限/依赖/安装/发布变更；不宣称 full R0/R1、hard-lease、V5/V10、模型宿主或长程收益。

改动思路 / Approach

复用既有 Turn、host selector、SQLite/TypeScript authority、journal 与 settlement owner，先刻画普通执行、故障后恢复及独立验收，再提出可逆的下一 owner 变更；不添加运行时或并行治理规则。两份非规范性 ledger 可独立评审和回滚，规范性验收与 owner 决策继续有效。当前经验建议中的 outcome-first/staged-evidence 适用于这里：成功演练帮助确定下一接缝，不等于批准所有已加载模块进入 core。

具体改动 / Changes

关键内容讲解

依据变更前已接受的 docs/architecture/rfcs/monorepo-distribution-split-v0.md，revision 62e234c939996ad42f2b1168451cc9a656dce11d，对照其原有条目：

• I2 / I7 / I9：保留单一治理 owner 和可选激活边界；测量写明版本、环境和限制，不把模块计数当收益。两份镜像一致，只新增160行 ledger，没有 runtime/test 或规范性段落差异。
• I8 / V4：已独立复验本地合成任务、同 journal 恢复及零重复效果；完整上下文连续性与受支持组合资格继续延期，不冒充模型宿主或 hard-lease 验收。
• V10：仍延期。父进程观察与单次演练没有覆盖 child/broker CPU、RSS、完整 wire/context、模型成本或重复成对样本；文中的538/21、231/8加载数量保留为作者测量，本评审未独立重做该 census。
• D2 / D5 / R1：候选、owner 采纳和里程碑完成明确分离，没有新增 minimal preset 或拆包安装资格。下一步仍由既有 Turn CLI owner 在刻画 exports/patch points 后延迟加载未选择 DSH builder，并验证 generic/DSH/Codex 及默认关闭一致性。

当前 source 的 turn_run_once.py:45 确实提前导入两个 DSH builder，而调用位于 args.host == "dsh" 分支，下一步有实际消费者依据。

对主干的风险 / Risks

主要风险是把源码观察读成默认值或安装资格；两份镜像保留 soft_claim 脚手架、单体 checkout、未确认工作和完整成本限制，历史失败也没有被重写为通过。本评审在 exact head 独立通过23项 discovery、1项 cold-import oracle 和8项 recovery/拒绝用例；另用真实本地 host/validator 子进程、隔离 SQLite 和 OS SIGKILL 复验普通执行、同身份恢复及 committed replay：两条路径各一次 host、一次 writeback、一次 debit，重启前无 debit，产物字节相同，重放效果全为 false。此为合成源码边界，不是模型或已安装宿主资格。标准 premerge 的4项直接检查、2项选择检查、双语 gate、whitespace 和两文件公开边界扫描均通过。未查询或等待远端 CI，也未启动 benchmark 或故障注入活跃状态。

我的整体评价 / Verdict

这是 justified_increment：它修正当前前置条件判断、提供可复验的执行闭包并缩小下一 owner 变更，不要求用文档 PR 完成整个 R1。长期运行与产品交互契约保持，未据此声称长期收益；没有新增用户操作轮次。仅两份非规范性 RFC Markdown ledger 改变，没有 renderer、layout、App/Lark 控件或产品首屏变化；未验证已安装宿主或产品 UI 资格。保留现有 RFC 比新增文档/状态更小，lazy-loading 实现按已指出的原 owner 接缝继续。批准本次提案记录不授予 merge、安装或发布权限。

English verdict: APPROVE — HEAD aee08c0; bounded source characterization with recovery evidence, not minimal-preset or installation qualification.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @cocolord.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[loopx-agent]

APPROVE — exact head 495ab319ed45720c0a8cba07bd7436b45a4aa12b.

Re-reviewed after integrating current main 4a33eb4b.

• The only conflicts were independent English/Chinese RFC checkpoint insertions; all records and evidence are preserved.
• No runtime or test source changed by this docs-only merge.
• Exact-head checks: RFC bilingual verifier and diff hygiene pass; the merge commit carries DCO.

Approval is limited to merge readiness at this exact head.