REITS / ARCHITECTURED05 · G04 · CUT 90
P54 · REPOSITORY OUTCOME CHECKPOINT QUALIFIED · LIVE CHECKPOINT HELD

Five responses are not an outcome.
Seal the batch.
Require three voices.

Cut 89 的五个响应摘要只证明调用已结束，不代表可以提交结果。Cut 90 将摘要组合成不可变 batch，由 Runtime、SRE 与独立 Witness 三方共同签名；成功、重试、终止都必须落到可读回的幂等检查点，且不得保留响应 payload 或触发生产副作用。

GLOBAL CUT90 / 10414 cuts left
QA264 / 2643,320 cumulative
QUALIFIED248 × 3 outcomes
REJECTED240fail closed
QUORUM3 / 3distinct roots
CHECKPOINT44exact readbacks
QUARANTINE48terminate + faults
PRODUCTION0writes / calls
01

CURRENT EXTERNAL RED GATE

仓库裁决不冒充真实三方 root、线性一致 replay registry 或 durable checkpoint。

HOSTshared production portalDENIED
OUTCOME ROOTSthree production keys absent0 votes
CHECKPOINT ADAPTERdurable CAS absent0 writes
CONTROLLERlistener remains absent8110 · 0
02

CUT 89 UPSTREAM — DIGESTS, NOT PAYLOADS

本刀先补齐真实上游缝隙：Cut 89 终态现在投影五个有序 response seals 和 seal-set digest。

5 SEALED RESPONSEScall / port / method / digest / class
→
1 SEAL-SET DIGESTordered immutable aggregation
→
0 PAYLOADSreferences already released
03

11-FIELD RESPONSE SEAL ANATOMY

响应语义只保留裁决所需字段；正文、连接、函数与 connector handle 均不允许进入批次。

04

17-FIELD IMMUTABLE BATCH MANIFEST

Batch 同时绑定 session、source revision、五摘要、outcome policy、checkpoint plan 与 replay key。

05

30-SECOND BATCH WINDOW

短窗口只允许完成验证、裁决和 checkpoint；不允许续期、转移或自动重试。

VALIDITYcreatedAt → expiresAt≤ 30 seconds
USESbatch replay CASexactly 1
RESPONSE COUNTordered seal setexactly 5
AUTO EXECUTIONall decision classesforbidden
06

RESULT-CLASS PRECEDENCE

三方投票不能覆盖响应事实；TERMINAL 优先于 RETRYABLE，RETRYABLE 优先于 SUCCESS。

ANY TERMINAL?yes → terminate
→
ANY RETRYABLE?yes → retry checkpoint
→
ALL SUCCESSfinalize zero effect
07

THREE DETACHED OUTCOME AUTHORITIES

生产者、Runtime 裁决、SRE checkpoint 与独立见证职责分离；三个签名 owner 不可复用。

RUNTIMEsemantic outcome adjudicatorteam:runtime-batch-outcome-adjudication
SREcheckpoint safety authorityteam:sre-recovery-checkpoint
WITNESSindependent quorum witnessteam:independent-batch-witness
08

16-FIELD SIGNED OUTCOME VOTE

每票绑定 batch digest、seal set、checkpoint plan、decision、reason、30 秒窗口和独立 nonce。

09

UNANIMOUS 3 / 3 QUORUM

不是多数投票。任一签名、scope、decision 或 reason 不一致，批次立即 fail closed。

3 VALID ROOTSreal fixture P-256 verificationrequired
3 ONE-TIME NONCEScross-batch reuse deniedrequired
1 EXACT DECISIONmust match response factsunanimous
10

BATCH REPLAY KEY & SPLIT-BRAIN CLAIM

同一 batchId、nonce、replayKey、batchDigest 必须由一次 CAS 同时占有。

attemptpreviousresultaction
first exact claimAVAILABLECLAIMED · ordinal 1continue quorum
same replay keyCLAIMEDDENIEDno vote claim
same batch / different digestCONFLICTSPLIT BRAINquarantine
cross-session keyINVALID SCOPEDENIEDburn attempt
11

SEVEN-STATE BATCH MACHINE

任何状态都不能跳过 checkpoint readback 直接进入 terminal settlement。

01 SEALED5 response digests
02 BATCHEDmanifest exact
03 VOTED3 signatures
04 CLAIMEDreplay key owned
05 ADJUDICATEDfacts precede vote
06 CHECKPOINTEDCAS + readback
07 SETTLEDzero effect
12

OUTCOME ADJUDICATION PIPELINE

摘要事实、签名事实和存储事实三条证据链必须在 settlement 前交汇。

SEAL FACTSderive precedence
→
SIGNED QUORUM3 / 3 exact agreement
→
CHECKPOINT FACTCAS + exact readback
→
SETTLEMENTcapability free
13

THREE TERMINAL DECISION CLASSES

三类都是“无生产效果”的终态裁决；retry 只记录 cursor，不授权下一次调用。

SUCCESSall five seals successcursor 5 · finalized
RETRYretryable and no terminalcursor before first retryable
TERMINATEany terminal sealcursor before first terminal
14

18-FIELD RECOVERY CHECKPOINT

Checkpoint 是不可变恢复事实，不包含 response payload，也不是执行授权。

15

TERMINAL CURSOR SEMANTICS

Cursor 表示已经安全裁决的响应前缀，永远不隐含“可自动执行下一步”。

decisioncursormeaningnext execution
SUCCESS5five seals adjudicatednone
RETRYretry ordinal − 1safe prefix onlynew authorization required
TERMINATEterminal ordinal − 1safe prefix onlyforbidden
16

WRITE → EXACT READBACK → DIGEST

“写成功”不是证据；只有 version、prior digest、state 与所有字段完整读回才可 settlement。

CAS WRITEexpected absent → version 1
→
EXACT READBACK18 fields byte-for-byte
→
CHECKPOINT DIGESTbound into settlement
17

SPLIT-BRAIN & AMBIGUOUS-WRITE FENCE

超时、版本冲突、readback mismatch 和未知写结果都不能重试 CAS。

WRITE TIMEOUTstate unknownquarantine
VERSION CONFLICTanother writer observedquarantine
READBACK MISMATCHdigest or state driftquarantine
SECOND WRITEautomatic retryforbidden
18

TERMINATE OUTCOME QUARANTINE

合法的 TERMINATE quorum 也必须进入 quarantine；它是明确的安全终态，不是异常遗漏。

PREVIOUSbatch claimedCLAIMED
TERMINALno replayQUARANTINED
PAYLOADSnever admitted0 retained
EFFECTSno adapter or host0 production
19

FAILURE QUARANTINE & BATCH BURN

Batch claim 后的任一错误都先 quarantine，再以零 checkpoint digest burn；不得悄悄回到 AVAILABLE。

FAULTvote / adjudication / CAS / readback
→
QUARANTINEno replay, no payload
→
BURNterminal settlement
→
ZERO EFFECTprod writes 0
20

15 FAILURE CUTPOINTS

从 manifest 到 settlement 的每个关键边界都有明确终态，不存在“默认继续”。

21

24 QUALIFIED BATCHES · 8 PER OUTCOME

三类裁决对称覆盖；每个合法 batch 都完成三签、checkpoint write/readback 与 settlement。

8 SUCCESScursor 5checkpointed
8 RETRYexplicit future auth requiredcheckpointed
8 TERMINATEquarantined terminalcheckpointed
22

240 REJECTED OR CONTAINED BATCHES

六个拒绝面独立覆盖 upstream、quorum、语义、replay、checkpoint 与终态泄露。

40 · UPSTREAMseal order / digest / zero effect
40 · QUORUMsignature / scope / nonce
40 · SEMANTICSvote cannot override seals
40 · REPLAYbatch CAS / split brain
40 · CHECKPOINTwrite / readback ambiguity
40 · TERMINALpayload / capability fence
23

264-CASE EXECUTABLE QA LAB

按 suite 筛选、搜索并点击用例，核对 decision、quorum、checkpoint、quarantine 与生产零副作用。

Select a QA case264 / 264 passed · quorumVotesRequired=3 · terminalActiveCalls=0 · terminalConnections=0 · retainedResponsePayloads=0 · productionCheckpointWrites=0
24

P54A–H SUBGATES

八个仓库子门全部闭环；真实三签 root、durable CAS 和生产写授权继续独立红门。

P54A · UPSTREAMfive response seal setBOUND
P54B · BATCH17 fields / 30 secondsBOUND
P54C · QUORUMthree detached P-256 rootsBOUND
P54D · SEMANTICSterminate > retry > successBOUND
P54E · REPLAYbatch + vote one-useBOUND
P54F · CHECKPOINTCAS + exact readbackBOUND
P54G · FAILUREquarantine + burnBOUND
P54H · LIVE HOLDproduction writes remain zeroREPOSITORY BOUND
25

114 / 121 QUALITY GATES & VISIBLE DEBT

七个 live 门未观测；仓库证明、fixture 证明和生产事实保持三层分离。

CUT 91 / 104 · 14 CUTS REMAIN

CUT 91 HANDOFF — explicit retry authorization & checkpoint resume plan

下一刀将只承接 RETRY_FROM_CHECKPOINT_ZERO_EFFECT：验证原 batch、checkpoint、cursor 和失败原因，签发新的显式 retry intent，冻结可恢复调用范围和预算；仍不自动重放、不恢复 response payload、不调用生产 Adapter。

01 · RETRY INTENTnew authority, new nonce
02 · CURSOR RESUME PLANremaining calls only
03 · BUDGET REBINDno inherited lease
04 · ZERO AUTO EXECUTIONauthorization, not replay
surfacecanonical pathuse
Machine API/api/runner-controller/d05-g04-invocation-batch-outcome-adjudication-recovery-checkpoint-admissionruntime evidence
JSON Schema/schemas/runner-controller-d05-g04-invocation-batch-outcome-adjudication-recovery-checkpoint-admission.v1.schema.jsonconsumer validation
Candidateops/runner-factory/controller-production-adapter-invocation-batch-outcome-adjudication-recovery-checkpoint-candidate.mjsqualification logic
Verifierscripts/verify-runner-controller-production-adapter-invocation-batch-outcome-adjudication-recovery-checkpoint-candidate.mjs264 cases
Architecture docdocs/ui-blueprint/183-d05-g04-invocation-batch-outcome-adjudication-recovery-checkpoint-admission.mdteam handoff