mirror29 · Oct 14, 2026 · Oct 14, 2026 · Oct 14, 2026 · Oct 14, 2026 · Oct 14, 2026
@@ -39,6 +39,8 @@ Inalpha 是 AI agent 编排与多 Python kernel 的量化实验框架。D-12 与
 | 在途响应未知时退出 | 已有费用/响应回归 | 同镜像重启及再次重启均停在`LOOP_PROPOSAL_RESPONSE_UNCONFIRMED`；调用总数2，未知预留0.0340608保持，额度1充足 | 未取得真实供应商对账与生产未知费用恢复证据 |
 | 其他故障、交接与一次性holdout | 已有相关状态机与自动化 | 部分源码进程/受控数据库证据；完整矩阵待补 | 生产恢复、冠军与长期正向链路未完成 |
 
+已将双进程探索整理为 [固定镜像接手工具](../services/evolver/scripts/validate_campaign_takeover.py)，新增镜像/连接边界与清理超时、已退出竞争和夹具契约9项回归。最终同镜像运行先以相同reservation/参数在有效租约下完成并回滚写入作为对照，再在新租约仍为`replaying`且未过期时，直接旧token调用`proposal_responses.complete()`收到`LOOP_AUTHORIZATION_UNAVAILABLE`；预留0.0340608、非空响应0和阶段保持不变。两容器退出0，env删除及独立Docker清理确认；9项测试、Ruff/格式、一致性19/0/12通过。见 [维护工具回执](validation/e2-maintained-takeover-validator-2026-10-14.json)。这是实际存储调用拒绝证据，不是旧SDK回调收包、完整外围授权栈或生产fencing通过；其他故障场景尚未整理为维护套件。
+
 同镜像双进程补充：旧应用SIGSTOP后租约自然过期，新应用接手并拒绝未知响应重发；恢复旧应用、释放离线响应后连续20秒观察费用预留、零非空响应、零提案及阶段均未变化。未直接采样旧SDK成功收包或旧complete()调用，不能区分心跳取消与写入fencing；仍不视为整个旧worker矩阵完成。见 [暂停worker接手回执](validation/e2-paused-worker-takeover-2026-10-14.json)。
 
 同镜像回执：[已知响应恢复](validation/e2-same-image-response-recovery-2026-10-14.json) / [未知响应阻断](validation/e2-same-image-unknown-response-2026-10-14.json)。无效DSL使用既有回退，成功实现数不代表有效变异或改善；两项都是临时探索脚本，尚非CI维护套件。前期失败与观察端超时保留在回执，不删除审计库。

@@ -0,0 +1,229 @@
+{
+  "database": "inalpha_container_audit_0bd5a5582eb04c2b9815529a559b73ce",
+  "result": "passed",
+  "scope": "full actual Evolver application lifespan and dispatchers; provider SDK HTTP transport replaced, synthetic local signer/Dashboard/Data; actual fixed business image, local AMD64 emulation, not real owner/production",
+  "initial_health": {
+    "status": "ok",
+    "service": "inalpha-evolver",
+    "event_evolution": "enabled"
+  },
+  "live_write_positive_control": {
+    "result": "accepted_rolled_back",
+    "operation": "proposal_responses.complete",
+    "active_lease_at_attempt": {
+      "status": "replaying",
+      "lease_token": "f02e141a-8508-40f9-ab23-06f8bf0f5d1f",
+      "lease_expires_at": "2026-10-14 08:53:35.576676+00:00",
+      "observed_at": "2026-10-14 08:53:11.073594+00:00"
+    },
+    "reservation_id": "4e42807f-7024-421b-82a2-73e2ea0c256e"
+  },
+  "sigstop_completed_at": "2026-10-14T08:53:11.455161+00:00",
+  "fault": "SIGSTOP old application; wait natural lease expiry; second application claims",
+  "before": {
+    "status": "replaying",
+    "active_generation": 1,
+    "lease_token": "f02e141a-8508-40f9-ab23-06f8bf0f5d1f",
+    "lease_expires_at": "2026-10-14 08:53:35.576676+00:00",
+    "locked_candidate_id": null,
+    "forward_sandbox_id": null,
+    "holdout_consumed_at": null,
+    "failure_code": null,
+    "observed_at": "2026-10-14 08:53:11.457961+00:00",
+    "proposal_count": 0,
+    "stored_response_count": 0,
+    "response_count": 2,
+    "succeeded": 0,
+    "ledger": {
+      "spent_usd": "0",
+      "reserved_usd": "0.0340608",
+      "max_cost_usd": "1",
+      "attempts": 2
+    },
+    "expired": false
+  },
+  "expired_lease_observation": {
+    "status": "replaying",
+    "active_generation": 1,
+    "lease_token": "f02e141a-8508-40f9-ab23-06f8bf0f5d1f",
+    "lease_expires_at": "2026-10-14 08:53:35.576676+00:00",
+    "locked_candidate_id": null,
+    "forward_sandbox_id": null,
+    "holdout_consumed_at": null,
+    "failure_code": null,
+    "observed_at": "2026-10-14 08:53:36.049514+00:00",
+    "proposal_count": 0,
+    "stored_response_count": 0,
+    "response_count": 2,
+    "succeeded": 0,
+    "ledger": {
+      "spent_usd": "0",
+      "reserved_usd": "0.0340608",
+      "max_cost_usd": "1",
+      "attempts": 2
+    },
+    "expired": true
+  },
+  "observation_lock_acquired_at": "2026-10-14T08:53:36.076120+00:00",
+  "second_application_started_at": "2026-10-14T08:53:36.076340+00:00",
+  "restart_health": {
+    "status": "ok",
+    "service": "inalpha-evolver",
+    "event_evolution": "enabled"
+  },
+  "second_application_claim": {
+    "status": "replaying",
+    "lease_token": "85851308-ee2a-42d8-a55a-fbe1a48bca37",
+    "lease_expires_at": "2026-10-14 08:54:22.027023+00:00",
+    "updated_at": "2026-10-14 08:53:52.027031+00:00",
+    "observed_at": "2026-10-14 08:53:52.541338+00:00"
+  },
+  "direct_stale_write": {
+    "result": "rejected",
+    "code": "LOOP_AUTHORIZATION_UNAVAILABLE",
+    "operation": "proposal_responses.complete",
+    "active_lease_at_attempt": {
+      "status": "replaying",
+      "lease_token": "85851308-ee2a-42d8-a55a-fbe1a48bca37",
+      "lease_expires_at": "2026-10-14 08:54:22.027023+00:00",
+      "observed_at": "2026-10-14 08:53:56.905621+00:00"
+    },
+    "scope": "direct same-image storage write attempt, not an old SDK callback"
+  },
+  "observation_lock_released_at": "2026-10-14T08:53:57.229046+00:00",
+  "after": {
+    "status": "failed",
+    "active_generation": 1,
+    "lease_token": null,
+    "lease_expires_at": null,
+    "locked_candidate_id": null,
+    "forward_sandbox_id": null,
+    "holdout_consumed_at": null,
+    "failure_code": "LOOP_PROPOSAL_RESPONSE_UNCONFIRMED",
+    "observed_at": "2026-10-14 08:53:57.810103+00:00",
+    "proposal_count": 0,
+    "stored_response_count": 0,
+    "response_count": 2,
+    "succeeded": 0,
+    "ledger": {
+      "spent_usd": "0",
+      "reserved_usd": "0.0340608",
+      "max_cost_usd": "1",
+      "attempts": 2
+    },
+    "expired": null
+  },
+  "offline_provider_calls": [
+    "before",
+    "before"
+  ],
+  "local_peripheral_requests": [
+    "snapshot",
+    "local-fixture-grant",
+    "credential",
+    "snapshot",
+    "local-fixture-grant",
+    "credential"
+  ],
+  "old_application_resumed_and_fixture_released_at": "2026-10-14T08:53:57.935548+00:00",
+  "after_old_worker_return": {
+    "status": "failed",
+    "active_generation": 1,
+    "lease_token": null,
+    "lease_expires_at": null,
+    "locked_candidate_id": null,
+    "forward_sandbox_id": null,
+    "holdout_consumed_at": null,
+    "failure_code": "LOOP_PROPOSAL_RESPONSE_UNCONFIRMED",
+    "observed_at": "2026-10-14 08:54:06.227804+00:00",
+    "proposal_count": 0,
+    "stored_response_count": 0,
+    "response_count": 2,
+    "succeeded": 0,
+    "ledger": {
+      "spent_usd": "0",
+      "reserved_usd": "0.0340608",
+      "max_cost_usd": "1",
+      "attempts": 2
+    },
+    "expired": null
+  },
+  "late_response_observation_seconds": 20,
+  "purpose": "Observe takeover/resume invariance and direct old-token checkpoint write rejection; not successful old SDK receipt or full fencing acceptance",
+  "cleanup_errors": [],
+  "observer_transient_failures": [],
+  "old_worker_cleanup": {
+    "exit_code": 0,
+    "errors": []
+  },
+  "new_worker_cleanup": {
+    "exit_code": 0,
+    "errors": []
+  },
+  "env_file_removed": true,
+  "owned_container_removed": true,
+  "image": "ghcr.io/mirror29/inalpha-evolver:a275f8be7679578e4aef62cffb3ff5c6f13a988e",
+  "actual_image_id": "sha256:5aadcaf79089ece40137a11ad39085c3f190b2eff645219e9c9324e19e5be7df",
+  "runtime": "local Docker AMD64 emulation on ARM host; CPUs2/memory4GB; no production container restarted",
+  "entrypoint_shim_sha256": "e025efe7315ee9c80196bad678673aba78b10b4a80a13698dd264be182202b90",
+  "business_sha": "a275f8be7679578e4aef62cffb3ff5c6f13a988e",
+  "new_production_model_calls": 0,
+  "production_e2_searches_started": 0,
+  "acceptance_limits": [
+    "Direct complete() invocation runs inside the actual business image while a different current lease is live. This proves the observed storage-call rejection, not successful receipt by an old SDK callback.",
+    "Full Evolver lifespan and dispatchers with offline peripheral HTTP/provider fixtures, local AMD64 emulation on an ARM host. Not full peripheral service stack, normal-owner authorization, production recovery, strategy improvement or supplier billing.",
+    "Audit databases retained; only owned UUID containers and private temporary environment files removed.",
+    "Correct fresh migration chain through 0069; no legacy audit database upgrade or force stamp.",
+    "An ACCESS EXCLUSIVE lock on the isolated proposal-response table holds recovery while the replacement claim is observed. Acquire/release UTC anchors are recorded; application-side blocking was not separately sampled. The lock is released before unknown-response termination and resumed-worker invariance checks. These timings are instrumented, not natural recovery latency."
+  ],
+  "local_validation": {
+    "boundary_and_cleanup_tests": 9,
+    "ruff": "passed",
+    "ruff_format": "passed",
+    "consistency": {
+      "passed": 19,
+      "failed": 0,
+      "existing_warnings": 12
+    }
+  },
+  "development_attempts": [
+    {
+      "database": "inalpha_container_audit_df417ccdcaca4dbbbc67c76d506bf52e",
+      "result": "failed",
+      "cause": "Fixture directory bind conflicted with writable exchange child mount; no app startup."
+    },
+    {
+      "database": "inalpha_container_audit_9101162e638447edb2b60247d5594f33",
+      "result": "failed",
+      "cause": "Same fixture directory bind conflict; no app startup."
+    },
+    {
+      "database": "inalpha_container_audit_1b3ded83010b44798fa9d94454888349",
+      "result": "failed",
+      "cause": "Observer closure used global instead of nonlocal after conversion to main; startup passed, observation failed."
+    },
+    {
+      "database": "inalpha_container_audit_5f91711d698a473ab6ab202e0580d43f",
+      "result": "passed",
+      "scope": "Intermediate direct stale write probe before cleanup robustness revision."
+    },
+    {
+      "database": "inalpha_container_audit_1bcfcca48d54466db4df125f25b20687",
+      "result": "passed",
+      "scope": "Cleanup revision probe before supported event-type fixture alignment."
+    },
+    {
+      "database": "inalpha_container_audit_a891ed653b0a4fcc9e8dddd31de5e225",
+      "result": "passed",
+      "scope": "Previous maintained probe without positive write control or lock time anchors; retained historical evidence."
+    }
+  ],
+  "harness_commit": "1fae2a18",
+  "harness_files_sha256": {
+    "services/evolver/scripts/validate_campaign_takeover.py": "120662d3f65d6811888acc40208218b1ef75ed469298530a23d9915ecbbd53a9",
+    "services/evolver/scripts/takeover_fixture/app.py": "e025efe7315ee9c80196bad678673aba78b10b4a80a13698dd264be182202b90",
+    "services/evolver/scripts/takeover_fixture/seed.py": "2c655702d2809a57c7ead5e63d2827aa86b1474d967377f764b3ba3c2a8426c4",
+    "services/evolver/scripts/takeover_fixture/stale_write.py": "753ef7d648fddd4899bb8cef112b4d87e5628b7a6b99089a11d48e2b53603c1c"
+  },
+  "positive_control_scope": "The same reservation and arguments were accepted under the original live lease and rolled back; after natural expiry and replacement claim the old token was rejected. This isolates stale authority from invalid reservation/phase operands; it is not an old SDK callback."
+}
@@ -253,3 +253,15 @@ Loop 每代两批模型请求分别持久化 dispatch、响应与费用预留，
 请求已登记但响应未保存时，系统无法证明供应商是否计费：保留预留费用并以 `LOOP_PROPOSAL_RESPONSE_UNCONFIRMED` 停止自动重发，也不会启动同代另一批新请求来绕过此状态。应先核对用量，再明确准备并批准新实验；不清除旧预留或伪装为免费重试。响应已保存但缺少 usage 时仍保留未知费用。
 
 该功能先迁移 `0068`（依赖 `0067`），再部署 Evolver；存在批次记录时禁止降级删除。独立 non-Loop campaign 不使用此缓存。53 项相关回归及离线进程注入已通过，生产部署/正常 owner 续跑尚待，详细范围见 [回执](../../docs/validation/e2-proposal-response-recovery-2026-10-12.json)。
+
+### 固定镜像接手与旧租约写入检查
+
+```bash
+# 先缓存对应业务 SHA 的 linux/amd64 镜像；本命令只使用已有缓存的固定 image ID。
+DATABASE_URL="<local-postgresql-url>" .venv/bin/python scripts/validate_campaign_takeover.py \
+  --image "ghcr.io/mirror29/inalpha-evolver:<40-character-business-sha>"
+```
+
+需要本地 PostgreSQL、Docker、Evolver dev 依赖和 migrations 虚拟环境。工具新建并迁移 UUID 审计库，启动两个完整 Evolver 应用；先以当前有效 token 对同一 reservation 执行并回滚 `proposal_responses.complete()` 作为正向对照；再暂停旧进程，等待真实租约过期，观察接手的新 token，并尝试旧 token 的相同写入。旧请求必须被拒绝，未知费用预留及阶段不得改变。外围 Data、签发与模型 HTTP 是合成夹具，不购买真实模型调用；不是正常 owner 或生产授权验收，也不证明旧 SDK 回调成功收包。
+
+回执和私有日志写入仓库 `.tmp/e2-takeover-validation/`；审计库保留，只清理本次 UUID 容器及临时 env。工具明确记录清理错误，不把 Docker 查询失败当作容器已删除。临时隔离响应表锁用于观察领取状态，回执记录取得/释放时间；失败阶段写入回执，traceback 只保存在私有日志中。合成 baseline 故意复用 checkout 的 `tests.test_loop_handoff.ready_loop`（需要 dev 依赖），由路径定位和 CI 契约测试防止无声漂移，不是可安装的生产 seed 接口。单次检查仍不能替代完整故障矩阵、真实五代搜索和长期 Forward/holdout；剩余清单见 [当前状态](../../docs/04-current-state.md#未完成--下一步)。