fix(release): repair source builds and regression ownership contracts

[loopx-agent]

Two source installers can build the same cold checkout at once. Their independent npm ci calls mutate the same dashboard dependencies, so one installer can remove files while the other compiles. Serialize the existing Chat build and delivery publication with the shared cross-platform file lock, then recheck the bundle after acquiring it so waiters reuse the completed delivery. Qualified read-only bundles keep their fast path. Build failures preserve the previous delivery and release the lock for recovery.

Refresh the generated English and Chinese RFC status indexes to match the existing research ledger. No product UI, command, persisted contract, or model qualification oracle changes.

Validation: 37 focused tests pass, including a real two-process concurrency regression and failed-build recovery. The unchanged base fails the new concurrency regression. Two cold production builder processes both pass with real npm, executing one install and one build; the published bundle validates. Documentation governance, Ruff, semantic advisory and diff hygiene pass. Risk-based premerge runs 14 selected and four direct checks with zero failures and no manual holds. The duplicate-ZIP warning is an intentional malformed archive fixture. PR CI was not queried. Final release-source qualification remains separate.

Future-facing pass: reuse the existing file-lock owner and keep the private unlocked operations cohesive under their public entrypoints; no second locking protocol or speculative build service.

The full release pytest run also exposed stale ownership fixtures and an unrealistically short startup deadline. Reuse the canonical digest pattern for retained static-site revisions; pin the actual history owner after the outbox split; preserve missing-readback failure while proving status can work without the writer adapter; move the prepared-only mutation to its actual owner. The synthetic startup deadline is three seconds instead of 0.5 seconds, allowing process launch under load while preserving retry counts, old-process closure, original request identity, and no Turn replay. Production deadlines are unchanged.

Additional validation: 323 affected architecture, cold-source, mutation-locator, Chat recovery and real static-site tests pass. Nine matched base/head rollback digest probes preserve accepted and rejected shapes. The real prepared-only mutation control passes and the deliberately broken owner is killed by an assertion. Expanded risk validation runs 17 selected and five direct checks with no failures or manual holds. The previous full release run remains recorded as 20,735 passed, six failed and335 skipped; it is not relabeled as a new-head pass. Final source qualification will cover these repaired paths and the complete public smoke suite.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; xhigh.

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Exact head: ad1602dedacc34e2532f10043211d7f79331e55e.

动机

从同一源码 checkout 并行安装 LoopX 的开发者，以及维护发布回归验证的维护者。两个独立安装进程同时重建前端：此前 npm ci 相互删除依赖，修复后两个进程成功且只构建一次；正常 shadow 状态读取不再被测试错误要求依赖写入模块。真实冷源码 npm 并发只执行一次安装和构建，两个进程退出成功；修复后的摘要、冷源导入、恢复及变异回归通过。本 PR 修复共享源码构建、摘要规则归属和失效的回归夹具；不改 UI、命令、权限、Goal/Todo 状态、生产超时或模型判定。完整发布来源资格、真实模型 portfolio 和公共产物发布尚未完成；此前主线全量 pytest 的六项失败保留原记录，本 PR 的360项针对性检查不能改写该记录。本改动是 justified_increment；不把本次针对性通过写成原全量检查通过。

改动思路

复用已有跨平台文件锁和摘要 owner，保持构建与发布操作在同一临界区；测试跟随真实读写模块，保留原始失败断言，不新增协议或服务。本 PR 修复共享源码构建、摘要规则归属和失效的回归夹具；不改 UI、命令、权限、Goal/Todo 状态、生产超时或模型判定。Long-horizon preserved：没有 Goal、Todo、quota、scheduler 或 lease 规则变化；user_experience improved：源码安装等待者复用完整的当前资源，失败构建保留旧交付。Python 留在既有源码打包与文件 IO owner；摘要归属复用 TypeScript value owner 的生成绑定。

具体改动

关键代码讲解

build 的公共入口取得 checkout-local 的共享文件锁，包住 npm ci、编译和既有资源发布；私有 _build 复用原代码。ensure 对已合格的只读 archive 保留无写入快路径；需要变更时取得同一锁并重新检查，再调用私有 _ensure/_build，没有嵌套取锁。finish_delivery 的原 manifest、上一代资源与失败恢复逻辑保持。

_validate_retained_revision_files 去掉第二份摘要模式，使用既有 BARE_SHA256_PATTERN；九个 base/head 输入判定一致。消费者清单明确登记 static-site 和实际 history owner。shadow 缺失模块测试分别覆盖读取 owner 缺失失败、写入 owner 缺失仍可只读查询、drain 缺失写入 owner 失败；每条都检查没有写入。prepared-only 变异改到真实 history owner，原断言不变。stdio 启动夹具等待从0.5秒调为3秒：原失败发生在子进程来不及记录启动或第二次启动之前，这个限值应约束故意的 RPC 静默，而不应把负载下的 Python 启动当作重试判定。生产默认仍为30秒；原重试次数、进程退出、请求身份、权限/审批门与禁止重复派发断言都保留。英文和中文 RFC 索引按生成器把既有 ledger 数从2更正为3。

依据 release readiness，spec_revision b6217cb236035ca1508c993398f7886dba3847d7：Compatibility Gate implemented；Atomic Local Promotion Failure Matrix implemented；Final release qualification deferred。没有改动 UI 布局或首屏。

对主干的风险

主要反例是锁影响无 Node 的只读 archive、失败后无法重试、摘要复用改变合法输入、或更新 fixture 后隐藏真实恢复错误。实际 archive ensure 回读字节不变且不创建锁目录；失败构建保留原交付并可成功恢复；九个摘要判定完全相同。正常 prepared-only 控制退出0；故意隐藏该事实的变异退出1且被原断言杀死，而不是 import/timeout/setup 错误。

360项相关检查通过（37构建/bootstrap/launcher/索引，323摘要/冷源/shadow mutation/Chat恢复/静态站点）。两个真实冷源 npm 进程都退出0，仅执行一次 npm ci 和一次 build；未修改 base 能触发新并发回归。风险验证17 selected/five direct，无失败、警告或 manual hold；Ruff、语义 advisory、文档治理、diff 与公开边界检查通过。验证代码字节与该 head 一致，未查询 PR CI。原全量20,735通过、6失败、335跳过及 wrapper临时目录清理问题保留；360项不是重新跑过全部 Python 的声明。真实模型、发布包与完整 final-source gate 继续分别验证。

我的整体评价

APPROVE，justified_increment。复用已有跨平台文件锁和摘要 owner，保持构建与发布操作在同一临界区；测试跟随真实读写模块，保留原始失败断言，不新增协议或服务。本 PR 修复共享源码构建、摘要规则归属和失效的回归夹具；不改 UI、命令、权限、Goal/Todo 状态、生产超时或模型判定。Future-facing pass 复用文件锁与摘要 owner，退役重复的形状知识，测试遵守已完成的读写分离；没有新增服务、CLI、持久化协议或平行决策源。完整发布来源资格、真实模型 portfolio 和公共产物发布尚未完成；此前主线全量 pytest 的六项失败保留原记录，本 PR 的360项针对性检查不能改写该记录。

English verdict: APPROVE at ad1602dedacc34e2532f10043211d7f79331e55e. Serialize shared source build/publication and recheck for waiters; retain readonly archive and failed-build recovery. Reuse the canonical rollback digest pattern and reconcile history/readback, mutation and loaded-startup fixtures without changing production state, authority or deadlines.360 affected tests, real cold npm concurrency, nine digest parity probes, the assertion-killed prepared-only mutant, and17 selected/five direct risk checks pass. Prior full-suite failures remain recorded; final release-source and model qualification are separate.