fix: unblock safe recovery and canonical migration for legacy Goals

[huangruiteng]

Legacy Markdown Goals can get stuck after an unavailable Monitor attempt: recovery requests the original failure closeout, but the closeout depended on a canonical retry flag. In multi-Agent Git projects that same non-delivery outcome also required a producing worktree. Complete cold-import backups can separately exceed the 16 MiB control-plane limit because unrelated file digests are transported with each Goal.

This change closes only the original typed unavailable attempt across Markdown, file and SQLite, without successful polling, Todo clock changes or quota debit. The CLI and App still validate the complete backup archive and every member, then transmit the digests covering the selected Goal's source, registry, evidence and leases. The TypeScript source-coverage checks and transport limit remain unchanged.

backup-state --configuration-goal-id adds explicit selection for the embedded configuration checkpoint when historical source registries are unreachable. Raw state discovery and missing-source reporting remain intact; default all-Goal capture and missing selected-source refusal remain strict. No configuration is reconstructed from a stale shared projection.

Validation: Markdown/file/SQLite closeout matrix (14 tests); focused cold-import/proof checks (9); HTTP cold-import suite plus isolated retry (44); adjacent settlement/workspace checks (59) and isolated workspace suite (10); configuration/state/member/source backup tests (39); typed causal closeout tests (7); TypeScript typecheck, repository lint, mypy, public-boundary scans and diff hygiene passed. An existing POSIX empty-venv fixture now uses symlinks so uv's macOS interpreter can resolve its shared library. Fresh source HTTP tests required building the Chat bundle; the affected cases were rerun successfully. The catalog/risk/boundary canary selected 19 checks; its stale registry I/O line-location check was repaired by the native generator and rerun successfully. The exact final change-quality receipt verifies as valid.

中文：修复旧 Markdown Goal 的失败 Monitor 收尾及完整冷导入备份的请求膨胀；保留完整备份、完整任务记录、原身份校验和 16 MiB 上限。配置范围显式选择，不放宽缺失源或共享投影的信任边界。实际迁移与私有状态审计不随 PR 发布；此 PR 不授权合并或恢复 Agent 执行。

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · xhigh

动机

维护旧 Markdown Goal、进行备份或迁移的本机操作者。旧 Markdown Goal 的失败 Monitor 尝试无法收尾；大型备份的无关成员让冷导入超过请求上限，历史配置源失联也会阻止默认全量备份。 原失败尝试可按原身份无观察、无扣费地收尾；完整归档仍校验，所选 Goal 可在原请求上限内导入并恢复原操作。 不把失败记成成功观察，不改 Monitor 时钟、代际或完成，不增加扣费、执行许可、数据恢复授权或存储默认切换。 完整 Goal 历史恢复与重新激活、真实宿主停止证明及正式发行采用不由这批验证资格化。

改动思路

复用现有 TS 判定与 Python IO 范围即可修复；提高请求上限、伪造成功观察或增加第二个结算 owner 都没有必要。 本 PR 交付旧 Goal 的失败尝试收尾、完整归档的所选来源传输及显式配置 cohort；全 Goal 历史重新激活、运行授权和正式发行采用继续由既有流程承担。

独立依据为 docs/reference/protocols/quota-blocked-causal-closeout-v0.md，修订 ffbd579502e6559ecf4d551b8837da1d6dd40a90；同一修订的 docs/reference/configuration-backup.md 与 docs/reference/local-authority-provider-selection.md 提供备份与冷导入边界。逐项核对原有 Unavailable Monitor observation（原准入、身份、证据与零观察/零扣费）、Physical file witnesses（真实字节覆盖）、Full-backup publication and retries（完整制品与不覆盖）、Configuration is not activation（配置不授予执行）及 coordination.cold_source.import（完整任务/证据/租约、原 operation/digest、writer stop 与只读恢复）。原 Monitor 文档限定 canonical；本 PR 有意扩展到受支持的 Markdown，不能用改后的文档自证等价。

具体改动

精确 head 99665771947ef5770f1f20a2fb1c371d52b1058a，全 PR 14 文件 +210/-28。本轮最初检查 a05cbdb4ed1284a5b280acb4549f24f71f86f529；远端更新后重读完整差异并重跑当前 head。新增 delta 仅修正生成的 registry IO 清单行号，未改变产品规则。

• prepareBlockedWait（blocked_wait.ts:113）取消 Monitor 对 canonical 重试开关的错误依赖；普通 advancement 的 implicit retry 仍在独立分支。typed proof 复用既有词义，原准入与证据继续由结算 owner 验证。
• refresh_state（state_refresh.py:1186）仅在已资格化的 unavailable Monitor proof 下免除 producing worktree；不把一般 blocked 工作或成功观察带过 workspace/lease 边界。
• read_cold_source_backup（cold_source_backup.py:26）接受真实 source paths，只筛选返回的 member digests；完整 archive、embedded source map、每个实际成员、前后 artifact hash 仍检查。coordination_shadow.py 与 goal_storage_api.py 传入所选 state、registry、完整 evidence 与 leases，TS source-coverage 判定和 16 MiB 上限均未放宽。
• support_control_backup.py / state_backup.py 将显式重复 --configuration-goal-id 送给已有严格配置 capture。省略参数仍捕获全部配置；选中源缺失仍拒绝。原始 registry/history 与 missing inventory 不因 cohort 被删减，也不从 stale projection 重建配置。
• 三份双语 reference 文档说明这些范围；三份测试覆盖 source scope、三 provider 的 closeout/recovery 及配置严格/显式 cohort。POSIX 空环境 fixture 使用 symlink 解决 uv Python 的动态库定位，Windows 分支保持原行为；生成清单只同步行号。

对主干的风险

最强反例是“测试得到失败回执，但真实入口仍不能继续”或“只发少量摘要便漏验源”。独立冻结 base 的同一 Markdown matrix 复现 3 个预期 closeout 失败，observed-poll 拒绝仍通过；当前三 provider matrix 验证原字段、零扣费、幂等重放和独立后继选择。额外构造 4,500 个无关归档成员，完整 witness 为 19,027,181 字节：冻结 base 的实际 CLI 被 16 MiB 限制拒绝；当前 File 与 SQLite 实际 CLI 均 prepare → apply → receiver Todo read → 原 operation recover 成功，保留 active/archived Todos，不授予执行，complete_goal_backup_verified=false。

当前 head 独立 Python 验证 191 passed in 467.41s (0:07:47)，包括真实 CLI、真实 File/SQLite owner 与 packaged-compatible HTTP 的 preview/reload/确认/原操作恢复、源/归档改变及别名拒绝。28 项 TS 用例、control-plane typecheck、Ruff、语义 advisory 与 scoped check、native premerge 的 5 direct + 19 catalog/risk/boundary 检查通过。首次旧 head 的 HTTP 接收包缺少生成的 Chat bundle，造成 35 个 setup errors；该失败保留，当前 head 构建并验证前端后完整重跑，没有删除断言或提高上限。

CLI 与 App 冷导入适配器都检查；已有 Settings 存储流程与配置备份的 Goal 选择面不新增 UI 决策。HTTP 试验使用真实源、制品及 owner，但合成且可丢弃的 Goal，不证明运行中的宿主确已停止、全历史重新激活、正式安装采用或 PostgreSQL 迁移。本变更没有 PG authority store refactor。默认全配置 capture 的缺失源拒绝仍有效；显式 cohort 需操作者审阅。未查询或等待 CI。

我的整体评价

复用现有 TS 判定与 Python IO 范围即可修复；提高请求上限、伪造成功观察或增加第二个结算 owner 都没有必要。 本 PR 交付旧 Goal 的失败尝试收尾、完整归档的所选来源传输及显式配置 cohort；全 Goal 历史重新激活、运行授权和正式发行采用继续由既有流程承担。 有用增量由原失败到原身份恢复的实际路径建立。相邻精简复用既有 typed proof 与 source-coverage owner，未建立平行 Python 决策、额外 retry 时钟或泛化框架。所有 required 当前验证通过，未发现阻断；完整历史恢复与执行/发行资格保持独立。批准此 exact head，不意味着合并或运行授权。

English verdict: APPROVE - 9966577; legacy unavailable-Monitor closeout and bounded cold-import transport are independently qualified through current CLI/HTTP, File/SQLite receiver readback, original-operation recovery, frozen-base counterexamples, complete artifact checks and strict configuration cohort refusal. Full reactivation and release adoption remain separate.