docs(rfc): define Goal instance identity and orphan recovery

[Duang777]

Goal And Delivered Outcome

Issue #4801 needs a durable way to distinguish successive same-name Goal lifetimes and recover orphan state. This bilingual RFC defines that design and its acceptance boundary, aligned with roadmap R5 and the R2/R3 consumers. It does not implement or activate identity enforcement.

The proposal incorporates the shipped #4917 registry codec rather than planning another M0. It separates codec compatibility from full identity enforcement, requires retirement/commit serialization, keeps lifecycle rules in the typed TS owner, and defines exact legacy cleanup and crash recovery. The roadmap and RFC index point to the same scope.

Scope And Continuation

• Source-owned random instance identity remains distinct from provider incarnation, lease epoch, intent revision and permissions.
• Activation needs an incompatible source format plus exclusion of old source/global/warm-process effect paths. Non-activated projects retain their behavior.
• The resolution lifecycle journals all plans, reconciles crash-before-ack, uses exact legacy observations for cleanup, and separates source safety from projection delivery.
• CLI, packaged frontend and qualified Lark share recovery and original-entry readback; native-provider adoption and R6 service qualification remain separate.
• Next: M1 compatibility/consumer characterization and the M2 local retirement/recreation seam. Activation remains held until M3 owner coverage is complete. This proposal does not close [Bug]: Guard orphaned Goal state before guided bootstrap or host activation #4801 runtime acceptance or D1–D3.

Validation

Tested head: e5e5f44f67490d74768e4f9181417a12422c0624.

• Docs-governance and repository-hygiene smokes passed; bilingual sections, code fences and normative vocabulary checked.
• Existing project-registry codec and M0 contract tests: 17 passed.
• Synthetic real CLI compatibility probe: v1 schema/v1 writer accepts mutation; v1 schema/v2 writer remains readable but rejects mutation; v2 schema rejects reading and mutation in M0. Temporary project and runtime fixtures were isolated for the final run. This is evidence about the existing codec, not future enforcement qualification.
• Diff hygiene and public/private boundary scan passed. Final risk-based canary and exact-head review evidence are recorded in the review.
• No runtime, live Goal, provider promotion, paid workload or UI implementation is part of this PR. Future concurrency, recovery, provider and end-to-end acceptance remain explicitly unverified.

Frontend / Visual Evidence

UI impact: none. This changes RFC prose, the RFC index below its opening navigation, and the roadmap R5 checkpoint. No public first viewport, primary CTA or product interaction changes. The future CLI/frontend/Lark validation contract is in the RFC.

Type of Change

• Documentation update
• Runtime behavior change

LoopX Area

• Control-plane architecture documentation
• Roadmap and public documentation

Shared-authority RFC fixture impact

No runtime fixture change or promotion claim. The design reuses existing TS/provider ownership and retains R6 and D1–D3 gates.

Boundary Checklist

• Public-safe design and synthetic evidence only; no credentials, raw logs, private state or local machine paths.
• Existing codec/fence and related open proposals are distinguished from unshipped acceptance.
• Every PR-branch commit has a DCO sign-off.
• Documentation-only merge does not authorize runtime activation or provider migration.

[huangruiteng]

Reviewed head: e5e5f44f67490d74768e4f9181417a12422c0624

动机

结论：本轮修订后，没有阻止这份 Draft RFC 文档 合并的问题。它把 #4801 的同名 Goal ABA 与 orphan 恢复放回 roadmap 的结果与恢复目标：R5 提供 lifetime fence，R2/R3 用它保护持续执行和迟到结果；不将文档合并视为运行时验收完成。

改动思路

保留源拥有的随机 instance identity、显式 preview、备份和幂等恢复。纠正了五个实质问题：

1. #4917 已交付 codec-only M0，而且已接受 v1。严格 array envelope 本身不能排除懂 codec 的旧版本；修订明确不兼容 activation schema、source/global/warm-process 矩阵及实际 effect exclusion。
2. 最后一次读不等于提交 fence。修订要求 retirement 与 protected commit 的线性化、外部 effect drain/reconciliation，并把精确 guard 留为 activation 前必须证明的 hold。
3. Match、admission、recovery transition 归 typed TS owner，Python 保留 codec/backup/host adapter。Source witness 不被提升为跨 store transaction；不另建 Python lifecycle policy engine。
4. Legacy orphan 没有 retired instance。修订使用精确 owner locator/revision/digest 的条件清理，不猜测身份、不按 Goal alias 批量删除；archive/delete-only 也必须先 journal。
5. 历史 receipt 和 late result 按 instance 隔离；file-only recovery 不接管 native provider head，source 安全完成后的 projection retry 单独处理。

具体改动

完整 diff 为五个文档：中英文 RFC、RFC index、双语 roadmap R5 checkpoint。RFC 第 3 节增加 TS/shared-authority/alignment/handoff/daemon 协同表；第 4 节改为已交付 M0 的真实基线；第 5 节重写 owner、activation、commit fence、legacy cleanup 与恢复；第 7–12 节同步 opt-in/default-off、验收矩阵、产品入口、交付顺序和未决 hold。其余 candidate/path/backup/rollback/privacy 约束保留并校正，附录区分事实和未来证据。

正向路径是显式 activation → 受 fence 的新 lifetime → owner binding → 既有权限与提交 → source/原入口 readback。负向路径是 A 校验后暂停 → A 退休/B 同名重建 → A 迟到：不得写 B、扣 B quota、继承 lease 或完成 B acceptance。Legacy cleanup revision 改变时拒绝并重新计划；不确定 external effect 不能被宣告已撤销。

有界重构建议已纳入契约：复用 M0 codec/I/O census、TS 整事务及 owner-local journal，删除分散重复判断；不扩展新 scheduler、通用 cleanup framework 或逐字段 RPC。R6 服务序列化、provider import 和 D1–D3 保持后续 owner，不把它们变成本地恢复的全部前置。

对主干的风险

本 PR 不改变执行、默认值、权限、持久化格式或 UI。Activation 格式及生命周期仍是设计提案；未完成的 guard/package matrix 保持实现 hold，不能用本次 docs approval 激活线上项目。协议身份不授予执行权限；未激活项目保持 parity；核心规则使用 typed variants，未引入 substring denylist 或特定业务领域义务。强制 fence 与 advisory cleanup/wake 已区分。

文档原有优点得到保留，主要风险是将未来约束误认为已交付；index、roadmap、M0 checkpoint 和附录已统一标识。合并只接受这份可继续实施和评审的设计，不完成 #4801，也不晋升 provider。前端/Lark 没有实现变化，未来完整交付需要原入口恢复与 packaged frontend/qualified Lark 验证。

验证：docs-governance、repository-hygiene、diff/public-boundary 检查通过；现有 codec/M0 测试 17 passed。最终隔离 synthetic CLI probe 使用生产 entrypoint：v1/v1 可修改，v1/v2 可读不可修改，v2 schema 被 M0 拒绝读写。这证明设计修正有真实代码依据，不证明未来 ABA、并发或 crash safety 已实现。未来各 owner 与真实 provider 的负例仍在第 9/12 节要求执行。

最终 premerge 风险验证执行 15 项：14 项首轮通过，semantic-vocabulary 一项因新 worktree 缺少 TypeScript 依赖失败；执行 npm ci --ignore-scripts --no-audit --no-fund 后，仅重跑失败项并通过。三项 diff hygiene 均通过。没有降低门禁、未跳过失败项；维护性与词汇扫描的既有统计不被当作完整 kernel 资格。CI 的运行时/跨平台项目因 docs-only 条件跳过，不构成本 RFC 的未来实现证据。此次范围不需要 UI/真实 PostgreSQL 运行；对应未来 runtime holds 仍保留。

最终 exact-head CI：文档站点构建及浏览器检查、DCO、dependency-review、changes、merge-gate 均通过；runtime/platform jobs 按 docs-only 条件跳过。

我的整体评价

批准文档范围。它现在是 R5 支撑 R2/R3 的完整设计切片，下一步是复用已交付能力来做 compatibility census 与本地 lifetime transaction，而不是继续增加字段或重建 codec。设计可独立审阅；实现、activation、R6 和 provider promotion 仍分别验收。用户已明确授权修改作者 fork 分支并在完成 exact-head review 与 merge-readiness 后自合并。

English verdict: APPROVE - e5e5f44. Documentation-only RFC and roadmap refinement: reuse shipped M0, require commit-time lifetime fencing, typed ownership and exact legacy recovery, and preserve activation/provider qualification holds. Docs checks, 17 existing codec tests and the isolated real-CLI compatibility probe passed; future runtime acceptance is not claimed.

[huangruiteng]

@Duang777 已在你的 codex/goal-instance-orphan-recovery-rfc 分支完成修订并发布精确版本 APPROVE 评审（e5e5f44f67490d74768e4f9181417a12422c0624）。保留了你提出的随机 lifetime identity、preview/backup、精确撤销和可恢复 journal，重点把它接入现有 roadmap 和 owner：

• R5 提供 lifetime fence，R2/R3 消费恢复和迟到结果隔离；R4 intent、R6 服务身份、D1–D3 provider promotion 保留原边界。
• feat(registry): add strict project registry codec #4917 已交付 M0，所以不再规划第二个 codec。现有 v1 能读写但不 enforce instance；RFC 改为不兼容 activation schema + source/global/warm-process 排除验证。
• “最后检查一次”补成 retirement/commit 串行化，明确 TS 规则 owner、Python effect adapter、现有 witness 的限制及 external-effect reconciliation。
• Legacy orphan 用精确 owner observation/revision 清理；archive/delete-only 也先写 journal；file-only adoption 不接管 canonical provider head。
• 补齐 default-off、原会话回读、packaged frontend/Lark 和小团队恢复验收；同步双语 roadmap/index，且仍保持 Draft/未实现边界。

建议下一步从 M1 的兼容版本及 binding/effect consumer 盘点进入 M2 本地 lifecycle transaction，复用已有 codec 和 TS 整事务。M2/M3 受支持 owner 尚未全部验证前保持 activation 关闭；不要以加字段、decoder 测试或文档合并宣告 ABA 已解决。

验证：文档治理/仓库卫生通过，现有 codec/M0 测试 17 项通过；最终隔离 CLI probe 验证三种 schema/protocol 组合。Premerge 首轮 14/15 通过，缺少 TypeScript 依赖的一项补齐环境后重跑通过；随后带严格质量回执的完整 premerge 复核 15/15 通过，3 项 diff 检查通过，0 failure/warning；最终 CI 与精确版本评审均通过。此次只修改设计文档，没有激活或迁移任何 Goal。

目前尚未合并：仓库 ruleset 要求 require_last_push_approval；本轮由维护者账号推送，该账号的 APPROVE 不满足“最后推送者之外的审阅者”条件。GitHub 仍为 REVIEW_REQUIRED，LoopX merge-readiness 明确返回 ready=false / github_review_decision_not_approved。请协助安排另一位符合条件的审阅者审阅最终 head；保留现有精确版本审阅和 CI 证据，之后再跑 merge-readiness。没有改规则或绕过该门禁。

完整评审：exact-head review。

最终 5 文件 diff 的 change-quality 回执已记录并验证：cqr_23614124d1f93a04d5e1，scope 23614124d1f93a04d5e1da5264634e79d350077012ef1cbfa6c2f4f2c6020d8c；本轮 qualification 未再改代码，0 blocker/warning/advisory。这份回执不授予合并权限。