feat(goals): add source-session lifetime transaction

[Duang777]

Goal And Delivered Outcome

• Goal/source and gap: Complete Goal instance identity M2 from [Task]: Add the source-session Goal lifetime transaction #4940 and the Goal instance identity RFC. M1 classifies exact Goal references but does not prevent a process holding lifetime A from binding after same-alias recreation publishes lifetime B.
• Observable before -> after, with the validation row that proves it: The opt-in source_session_v1 profile now publishes immutable Goal instance identity before registry exposure; bind, unbind, and A-to-B recreation share an alias-scoped guard and exact operation receipts; stale A cannot mutate B. Registration rejects unknown v2 profiles, orphaned state without its journal, and competing reservations.
• Issue/task and intended base: Closes [Task]: Add the source-session Goal lifetime transaction #4940. Built on merged feat(goals): characterize Goal instance bindings #4930 and synchronized with main@eb16c54; the PR diff contains only the M2 source-session slice.

Scope And Continuation

• Completed scope and remaining work: M2 is complete within its fresh-project, source-session-only boundary. All returned evidence has execution_authority: false, generic runtime paths reject the profile, and legacy/v1 behavior remains available through its existing commands.
• Slice boundary / successor: M3 must qualify supported effect owners before existing-project activation or global routing can open. M4 owns orphan discovery and recovery. Neither is implemented here.

Validation

• Tested revision: 44f4828520ea4f196d97474b68ade8a88a7df415
• Run state: finished
• Input classes: synthetic, public_fixture

Check kind	Result	Public-safe evidence / limitation
real_entrypoint	passed	tests/cli_commands/test_source_session_lifetime.py: 20 real CLI cases cover fresh v2 registration, exact bind/unbind, A-to-B recreation, paused stale-A ABA rejection, exact-byte rollback, replay, capacity, operation conflicts, missing journals, process death, and lock ordering.
unit	passed	Exact-head focused Python lifetime, codec, denial, and I/O census suite: 41 passed. Focused TypeScript source-session and runtime-handler suite: 17 passed.
recovery	passed	A subprocess is killed after reservation and state creation but before registry publication. Retry reclaims dead lock markers, reuses the reserved Goal instance, and publishes it once.
concurrency	passed	A bind holds the lifetime guard while recreation waits. Bind commits first; recreation then retires the binding and publishes instance B.
integration	baseline_blocked	The full TypeScript control-plane run still reports the terminal-lifecycle wire regex mismatch in authority_source.test.ts. The focused M2 suite passes, and the mismatch reproduces on clean main.
static	passed	TypeScript typecheck, targeted Ruff checks, repository hygiene, project-registry I/O manifest validation with 227 sites, and git diff --check passed.
static	passed	Exact-head loopx canary premerge --from-git-diff --git-diff-base origin/main: 19/19 selected checks passed, with no failures, warnings, or manual holds; self_merge_allowed=false.
static	failed	The full docs-governance mirror scan remains blocked by the pre-existing automatic-execution-admission-v0.md mirror failure; this PR does not modify that RFC.

• Coverage and gaps: The checks cover the shipped CLI path, TypeScript decision owner, Python transaction effects, strict v2 profile validation, generic runtime denial, ABA rejection, conflicting operation IDs, bounded history, crash recovery, and public/private scanning. M3 effect qualification and M4 orphan recovery remain out of scope.

See validation disclosure guidance.

Frontend / Visual Evidence

• UI impact: none
• Before: N/A
• After: N/A
• States and viewports shown: N/A
• Source data: none
• Attention review: N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Direction / acceptance reference, when applicable: Core control-plane hardening; Goal instance identity and orphan recovery RFC, M2 source-session transaction.

Shared-authority RFC fixture impact

• Production-scale fixture schema: Adds the opt-in loopx_project_registry_envelope_v2 / goal_instance_v2 source-session registry with bounded exact receipts.
• Semantic dimensions changed, or reviewed no-impact rationale: Adds exact GoalRef lifecycle identity, alias-scoped transaction ordering, immutable operation replay, bounded history, and explicit non-authority results. Default legacy/v1 behavior is unchanged.
• Provider conformance arms run: File-backed project-registry CLI and transaction paths only; this stage does not promote a provider.
• Read-only legacy/file/PostgreSQL three-arm rehearsal (required for promotion, runtime-routing, or compatibility-projection changes): Not applicable. The new profile is fresh-only, file-only, and rejected by ordinary runtime/effect paths.

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths (including .loopx/, .codex/goals/, and live ACTIVE_GOAL_STATE.md).
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• I completed the visual evidence section for UI changes, or marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

[Duang777]

@huangruiteng The exact-head Python Tests run is blocked by a stale run on an obsolete head.

• stale run: https://github.com/loopx-project/loopx/actions/runs/35846327815 (04be5316b), with only pytest still queued
• exact-head run: https://github.com/loopx-project/loopx/actions/runs/35851733857 (ed4fa83f7), still pending with no jobs
• both use the python-tests-${{ github.ref }} concurrency group

I attempted to cancel the stale run, but GitHub returned 403 Must have admin rights to Repository. Could you cancel run 35846327815 so the exact-head workflow can start?

[Duang777]

Follow-up after head 44f482852 was pushed: the same Actions concurrency issue recurred.

• stale Python run: https://github.com/loopx-project/loopx/actions/runs/35851733857 (ed4fa83f7), now blocked with only checks and stage2c-correctness-e2e queued
• exact-head Python run: https://github.com/loopx-project/loopx/actions/runs/35854996581 (44f482852), pending with no jobs

@huangruiteng Could you also cancel stale run 35851733857? I cannot cancel official-repository Actions runs from the fork owner account.

[Duang777]

Exact-head CI triage for 44f482852:

node-minimum-compatibility reported five failures. All five reproduce unchanged on clean base eb16c5443 under Node 22.18.0:

• authority_source.test.ts: 5/6 pass; the terminal-lifecycle wire-error regex fails with the same message.
• deferred_hard_lease_lifecycle.test.ts: all four File cases pass; all four SQLite seed commits fail identically because this suite is not excluded from the Node-minimum lane, while that lane documents SQLite as requiring the qualified runtime.

This branch does not modify either failing test or sqlite_authority_store.ts. I have not mixed unrelated baseline fixes into this PR. The remaining kernel-static-checks job is still running.

[Duang777]

Exact-head run 35854996581 has completed. The M2-specific and broad qualification lanes passed, including all four test shards, Windows, both Stage 2C real CLI/recovery lanes, installed-package checks, and mutant rejection.

kernel-static-checks ran 2,855 tests and failed only the same pre-existing authority_source.test.ts terminal-lifecycle wire-error assertion seen on clean base eb16c5443. node-minimum-compatibility failed the same five tests already documented above. The downstream checks, pytest, and merge-gate failures are consequences of those baseline failures.

No #4944 code change is warranted from this run; head remains 44f482852. I will keep baseline CI repairs isolated from this feature branch.

[Duang777]

Final exact-head result for run 35854996581: all four Python shards, Windows, Dashboard, Stage 2C, DCO, dependency review, release build, and PostgreSQL passed. kernel-static-checks failed only on the same authority_source.test.ts baseline assertion reproduced at eb16c5443; node-minimum-compatibility failed on that assertion plus the four reproduced unqualified-SQLite cases. The aggregate checks, pytest, and merge-gate failures follow from those two baseline causes. A separate minimal baseline-fix branch is being validated; #4944 remains unchanged at 44f482852.

[Duang777]

The isolated main-baseline repair is now #4952 (b408fe63d). Its local Node 22 gate-equivalent run completed with 2,499 tests, 0 failures. After #4952 lands, #4944 can sync main and rerun exact-head CI without carrying unrelated test repairs.

[Duang777]

The isolated baseline repair #4952 is now green at exact head 820e88593: Node minimum, kernel static checks, all four Python shards, Windows, Stage 2C, pytest, PostgreSQL, and merge-gate passed. The only cancelled lane is the documented non-blocking Node 26 forward probe.

#4944 remains unchanged at 44f482852. After a maintainer merges #4952, I will sync main into #4944 and rerun exact-head qualification; no baseline repair is being mixed into this feature branch.

[Duang777]

The isolated baseline repair in #4952 is now green on exact head 820e88593: Node minimum, all four Python shards, Kernel, checks, pytest, and merge-gate passed. The Node forward probe cancelled at its expected non-blocking 20-minute budget.

#4944 remains unchanged at 44f482852. Once #4952 is merged, I will sync main into this branch and rerun exact-head qualification.

[huangruiteng]

动机

按 Goal instance identity RFC 的 M2 和 #4940，现有仅凭人类可读 goal_id 的 session 绑定无法区分删除前的 A 与同名重建后的 B。本 PR 在新项目显式选择 source_session_v1 时引入源注册表持有的实例身份、别名级事务锁和精确操作收据；M3 效果所有者资格、全局路由及 M4 孤儿恢复仍被明确保留。

改动思路

project register 在发布 v2 envelope 前以 journal 预留实例；bind/unbind 和 recreate 在别名锁与注册表事务内交给 TypeScript 判定 commit/replay/reject，再由 Python 完成文件效果。v2 使用不兼容的 writer protocol 拒绝旧写入，普通 runtime/bootstrap/configure/migration 路径拒绝生命周期专用 profile；返回值仍为 execution_authority: false。这符合源注册表是身份权威、M2 不能提前开放执行的边界。v1/legacy codec、事务与文件锁得到复用；新增模块的体量虽大，但覆盖了同一个可独立验证的本地生命周期。

具体改动

• registry_codec.py 增加 v2 envelope 和专用事务；project.py / registry.py 接入显式注册、精确绑定/解绑、重建和只读解析。多个既有入口加入 v2 拒绝，I/O census 和双语 RFC 更新相应契约。
• source_session_lifetime.ts 定义精确 GoalRef 与绑定/重建判定；Python registration、binding、recreation 与 registry-state 模块实现 journal、收据、锁和原子提交。新增真实 CLI/崩溃/并发/ABA、codec、拒绝路径和 TypeScript 测试。
• 我在 exact head 44f4828520ea4f196d97474b68ade8a88a7df415 跑了 35 个聚焦 Python、17 个 TypeScript、71 个旧项目路径测试，TypeScript typecheck、Ruff、与最新 main 的无冲突合并树，以及 19/19 premerge 检查均通过。按 Goal 的 wait_for_ci=false，没有把远端 CI 当作本次结论的证据。

对主干的风险

[P1] 已发布创建收据的精确重放仍依赖可变的当前 Goal/状态文件。 source_session_registration.py 的 existing_receipt 分支在找到同一 operation_id 和请求摘要后，仍要求当前 Goal 是原始 A（第 314–323 行），并用最初渲染的状态文本检查现存文件（第 325–328 行）。我用真实临时文件和 CLI 复现两种情况：注册 A、重建为 B 后重试原注册，返回 “creation receipt does not match current Goal”；注册后给状态文件增加正常进展再重试，返回状态冲突。两次收据都仍存在，源注册表未发生新写入，但响应丢失后的调用者无法取得原操作结果。这与 M2 的精确操作收据/重放退出条件不符，也与本 PR 的 bind/recreate 先检查收据再判断当前实例的规则不一致。

建议把首次发布时的 state 冲突校验与已提交收据的重放分开：重放返回不可变的原收据、不覆盖后续状态；如需要，让结果明确标示当前实例已变化。补上“注册 A→重建 B→同 operation_id 重试”和“注册后状态内容更新→同 operation_id 重试”的真实 CLI 零写入回归，再复跑 M2 与旧路径测试。另一个面向下一次改动的小型重构是将创建的首次发布检查和 receipt-first replay 在现有 registration owner 内明确拆开；无需在此引入更广泛的 TS 迁移。

我的整体评价

M2 的 ABA、锁序、崩溃恢复和默认关闭边界有扎实的局部实现与验证；但精确重放是此阶段承诺的核心恢复语义，上述可复现缺口需要在当前 PR 修复，因此请求修改。即使修复后，本 PR 仍是控制平面行为变更，应由维护者在新 head 复审后决定合并，不能因为本地检查通过而自合并。

English verdict: REQUEST_CHANGES - exact head 44f4828; delayed creation replay fails after A-to-B recreation or legitimate state progress despite a retained receipt. Focused Python/TS/legacy suites and 19/19 premerge checks passed; add receipt-first no-write replay regressions.

[Duang777]

Addressed the requested receipt-first replay fix at exact head 62376c001.

• Completed creation receipts are now matched by operation_id and exact request digest before consulting the mutable current Goal or state projection.
• Exact replay returns the original GoalRef/receipt with changed=false and replayed=true; it does not overwrite a recreated Goal or later state progress.
• Added real CLI regressions for both reported cases: A -> recreate B -> retry A's operation, and state progress -> retry the original operation. Both tests replace registry, journal, and state writers with rejecting stubs and assert all three artifacts remain byte-identical.

Validation on this head:

• focused registration file: 22 passed
• M2/registry/legacy Python set: 117 passed
• source-session TypeScript set: 10 passed
• Ruff and control-plane typecheck: passed
• loopx canary premerge --from-git-diff: 19/19 passed, 0 manual holds

The branch remains unmerged. I will sync the maintainer's Node-floor baseline change only after #4960 lands in main, then rerun exact-head qualification.

[huangruiteng]

动机

在 #4940 的 M2 范围内，为新建 source-session Goal 建立不可变实例身份。旧方案仅看当前 Goal/alias 时，A 创建后重建为 B，再重放 A 的创建操作会被当前状态误判；这不是扩大到存量 Goal 迁移的授权。本次评审固定在 62376c0。

改动思路

source_session_v1 只对全新项目显式启用。TypeScript 的 typed decision 负责 bind/unbind/recreate 合法性；Python 在 alias 级锁和严格 v2 registry transaction 下完成 journal、state、registry 写入及回读。创建操作优先按 operation id + request digest 查历史 receipt，再判断当前可变 Goal，因此 A→B 后的 A 重放仍返回原 A 的 GoalRef，不会再建实例或改写 B。通用 v1 writer 明确拒绝 v2 profile。

具体改动

注册、绑定、重建分别落在 source_session_registration、source_session_binding、source_session_recreation；registry codec/transaction 与 connect/CLI/TS effect handler 接入新 profile；双语 M2 RFC、生成的 IO manifest、Python CLI/拒绝用例和 TypeScript transition 用例同步覆盖。新状态是实例 id、绑定与操作 receipt；journal 只承担崩溃恢复，不是第二套决策权。相关的前瞻性重构已把规则留在 typed TS 边界、文件效果留在 Python 的相邻服务，未另造泛化框架。

对主干的风险

主要风险是 alias 重用、旧实例误命中新实例以及 v1/v2 registry 混读。精确 receipt 重放、retired-instance 拒绝、schema/profile 隔离和无效果回读覆盖了这些路径。代码体量较大（28 文件，+3953/-170），但属于完整的 M2 fresh-only 生命周期；M3–M5 和存量迁移仍是显式未交付边界。首次 Python 汇总运行有 1 个子进程 barrier 的 10 秒超时；该单项重跑通过，完整套件重跑 43/43 通过，故保留这一波动记录。未触碰真实活跃 Goal，亦未按当前 review 契约查询远端 CI。

我的整体评价

APPROVE 此精确 head 的 fresh-only M2 增量，不将其解释为存量迁移或执行权限开放。Python 43/43、TypeScript 17/17、TS typecheck、Ruff 及风险 canary 19/19 通过，未见阻断性发现；公开/私有边界与默认关闭路径已核对。此批准不等于合并授权：这是控制面/持久状态变更，留给维护者按 exact-head 门槛合并。

English verdict: APPROVE - 62376c0; receipt-first A-to-B replay and fresh-only v2 isolation verified; 43 Python, 17 TypeScript, typecheck, Ruff and 19 canaries passed. Maintainer merge required.