REITS / ARCHITECTURED05 · G04 · CUT 91
P55 · REPOSITORY EXPLICIT RETRY QUALIFIED · LIVE RETRY HELD

A checkpoint is not permission.
Rebind the remainder.
Issue a new attempt.

Cut 90 只证明某个批次可以从 checkpoint 恢复；Cut 91 只接受 RETRY 终态，精确读回 checkpoint，以 cursor 证明安全前缀并冻结剩余调用，再用全新的 attempt、lease 要求、预算和三方签名形成显式授权。授权仍不是执行。

GLOBAL CUT91 / 10413 cuts left
QA276 / 2763,596 cumulative
QUALIFIED24retry-only plans
REJECTED252fail closed
QUORUM3 / 3new roots
READBACKS94checkpoint exact
QUARANTINE56authorization burn
PRODUCTION0leases / calls
01

CURRENT EXTERNAL RED GATE

仓库授权不冒充真实 retry roots、durable resume registry、新 session lease issuer 或执行许可。

HOSTshared production portalDENIED
RETRY ROOTSthree live keys absent0 authorizations
NEW LEASE ISSUERisolated authority absent0 leases
CONTROLLERlistener remains absent8110 · 0
02

CUT 90 UPSTREAM — RETRY ONLY

SUCCESS 已完成，TERMINATE 已隔离；只有 RETRY checkpoint 可进入显式恢复授权。

CUT 90 TERMINALthree outcome classes
→
RETRY ELIGIBILITYexact receipt + checkpoint digest
→
ZERO EXECUTIONauthorization boundary only
03

PRIOR-DECISION ELIGIBILITY MATRIX

恢复许可不能修改 Cut 90 的终态语义。

SUCCESSalready finalizedDENIED
RETRYexplicit authorization onlyELIGIBLE · NO EXECUTION
TERMINATEterminal quarantineDENIED
04

18-FIELD CHECKPOINT EXACT READBACK

本刀只读原 checkpoint，不重写、不升级版本、不猜测超时结果。

05

FIVE RESPONSE SEALS PROVE THE CURSOR

cursor 之前必须全部 SUCCESS；cursor + 1 必须是第一个 RETRYABLE；TERMINAL 永远不允许恢复。

06

REMAINING-CALL SCOPE FREEZE

恢复范围只能缩小为 cursor 后缀，不能插入、重排、扩张或重新运行安全前缀。

cursorsafe prefixfrozen resume rangeremaining
0none1 → 55
112 → 54
21 → 23 → 53
31 → 34 → 52
41 → 451
07

9-FIELD REMAINING-CALL DESCRIPTOR

只携带调用身份、请求摘要、旧响应摘要与目标 schema；不携带 request 或 response payload。

08

22-FIELD CHECKPOINT RESUME PLAN

Plan 把旧 batch/checkpoint 固定为只读来源，把剩余调用重新绑定到 attempt 2。

09

SESSION LEASE NON-INHERITANCE FIREBREAK

Cut 89 lease 已撤销。Cut 91 只能声明需要新 lease，不能复制、续期或重新激活旧 lease。

PRIOR LEASECut 89 revokedREAD-ONLY IDENTITY
INHERITED LEASEplan fieldNULL · FORBIDDEN
NEW LEASEseparate future authorityREQUIRED
LEASES ISSUEDrepository qualification0 PRODUCTION
10

REQUEST, TIME & CONCURRENCY BUDGET REBIND

每个剩余调用重新绑定 request digest、response schema、单调用超时和总预算；并发始终为一。

REQUESTexact digestBOUND
RESPONSEexpected schemaBOUND
PER CALLmaximum≤ 500 ms
TOTALremaining × timeoutEXACT
CONCURRENCYno fan-out1
11

OLD RESPONSE IS EVIDENCE, NOT INPUT

旧 response digest 只用于证明历史；新 attempt 不得读取、复制或把旧 response 当成下一次 request。

PRIOR RESPONSE SEALdigest + class + schema
→
HISTORICAL EVIDENCEcursor and eligibility
≠
NEW REQUESTfresh lease + future ticket required
12

THREE DETACHED RETRY AUTHORITIES

Release 决定是否重试，SRE 审核恢复安全性，独立 Witness 见证 scope；三者不能复用 owner。

RELEASEexplicit retry authorizerteam:release-explicit-retry-authorization
SREcheckpoint resume plan authorityteam:sre-checkpoint-resume-plan
WITNESSindependent retry witnessteam:independent-retry-witness
13

21-FIELD SIGNED RETRY AUTHORIZATION

每份签名绑定同一个 plan digest、旧 checkpoint、cursor、新 attempt、45 秒窗口与独立 nonce。

14

UNANIMOUS 3 / 3 EXPLICIT QUORUM

不是多数投票。任一 owner、key、nonce、plan digest、attempt 或有效期不一致即拒绝。

3 VALID ROOTSreal fixture P-256 verificationrequired
3 ONE-TIME NONCEScross-plan reuse deniedrequired
1 PLAN DIGESTall sign exactly the same planunanimous
15

45-SECOND AUTHORIZATION WINDOW

短窗口只允许验证、claim、freeze 和 settlement；不允许刷新旧签名或自动申请 lease。

VALIDITYissuedAt → expiresAt≤ 45 seconds
USESeach authorization nonceexactly 1
ATTEMPTprior attempt + 12
AUTO EXECUTIONall pathsforbidden
16

PLAN ATTEMPT & AUTHORIZATION REPLAY CAS

Plan attempt claim 与三个 authorization nonce 必须一次占有；冲突后不能换 nonce 继续。

surfacefirst claimreplay / conflictterminal action
resume plan + attemptCLAIMED · 1DENIEDno auth claims
release nonceCLAIMED · 1DENIEDquarantine plan
SRE nonceCLAIMED · 1DENIEDquarantine plan
witness nonceCLAIMED · 1DENIEDquarantine plan
17

EIGHT-STATE RETRY AUTHORIZATION MACHINE

任何状态都不能直接跳到 Adapter invocation。

01 RETRY RECEIVEDCut 90 terminal
02 READBACKcheckpoint exact
03 SCOPEDremaining calls
04 PLANNEDattempt 2
05 SIGNED3 roots
06 CLAIMEDplan + nonces
07 FROZENzero execution
08 SETTLEDnew lease request only
18

CHECKPOINT-TO-AUTHORIZATION PIPELINE

历史事实、恢复范围、签名事实和 replay 事实在 settlement 前汇合。

CHECKPOINT FACTexact readback
→
REMAINING SCOPEcursor suffix
→
3 / 3 AUTHnew roots
→
FROZEN PLANno execution
19

AMBIGUITY QUARANTINE & AUTHORIZATION BURN

readback timeout、plan conflict、nonce conflict、freeze timeout 和 settlement ambiguity 都不能自动重试。

READBACK UNKNOWNbefore claimreject
CLAIM CONFLICTplan or noncequarantine
FREEZE UNKNOWNstate ambiguousburn
SECOND ATTEMPTautomatic recoveryforbidden
20

16 FAILURE CUTPOINTS

从 retry receipt 到 terminal projection 的每个关键边界都有显式安全终态。

21

24 QUALIFIED RETRY PLANS

五种 cursor 位置均覆盖；每个合法 plan 完成 checkpoint readback、三签、claim、freeze 与 settlement。

24 RETRY CHECKPOINTScursor 0..4
→
72 SIGNED AUTHORIZATIONS3 per plan
→
24 TERMINAL RECEIPTSnew lease request only
22

252 REJECTED OR CONTAINED PLANS

六个拒绝面独立覆盖 upstream、cursor、plan、signature、replay 与 failure recovery。

42 · UPSTREAMretry checkpoint integrity
42 · CURSORresponse seal scope
42 · PLANlease / budget rebind
42 · AUTHsignature / scope / nonce
42 · REPLAYattempt / nonce CAS
42 · FAILUREquarantine / zero effect
23

276-CASE EXECUTABLE QA LAB

按 suite 筛选、搜索并点击用例，核对 checkpoint、remaining scope、三签、freeze、quarantine 与生产零执行。

Select a QA case276 / 276 passed · inheritedSessionLeases=0 · automaticReplays=0 · productionSessionLeasesIssued=0 · productionAdapterInvocations=0
24

P55A–H SUBGATES

八个仓库子门全部闭环；真实 retry roots、durable registry、新 lease issuer 与执行 ticket 继续独立红门。

P55A · ELIGIBILITYCut 90 retry checkpointBOUND
P55B · CURSORremaining call scopeBOUND
P55C · PLANattempt 2 / 22 fieldsBOUND
P55D · BUDGETtimeout / total / concurrencyBOUND
P55E · QUORUMthree detached P-256 rootsBOUND
P55F · REPLAYplan + three noncesBOUND
P55G · FAILUREquarantine and burnBOUND
P55H · LIVE HOLDzero lease / zero callBOUND
25

117 / 125 QUALITY GATES & VISIBLE DEBT

八个 live 门未观测；仓库证明、fixture 证明和生产事实保持三层分离。

26

12 LIVE INTEGRATION DEBTS

每项债务都有 owner；任何开发者或 AI 都不能把 repository-bound 状态升级为 production-ready。

ownermissing production factstatus
CUT 92 / 104 · 13 CUTS REMAIN

CUT 92 HANDOFF — one-time retry execution ticket & re-entry firewall

下一刀将承接 capability-free Cut 91 terminal receipt，签发只对新 session lease 和 frozen remaining-call scope 有效的一次性 execution ticket；重新进入调用防火墙前仍需独立 preflight，不得使用旧 lease、扩张 scope 或自动执行。

01 · NEW LEASE PROOFnot inherited
02 · EXECUTION TICKETone use / short TTL
03 · RE-ENTRY FIREWALLremaining calls only
04 · ZERO AUTO EXECUTIONpreflight still required
surfacecanonical pathuse
Machine API/api/runner-controller/d05-g04-explicit-retry-authorization-checkpoint-resume-plan-admissionruntime evidence
JSON Schema/schemas/runner-controller-d05-g04-explicit-retry-authorization-checkpoint-resume-plan-admission.v1.schema.jsonconsumer validation
Candidateops/runner-factory/controller-production-adapter-explicit-retry-authorization-checkpoint-resume-plan-candidate.mjsqualification logic
Verifierscripts/verify-runner-controller-production-adapter-explicit-retry-authorization-checkpoint-resume-plan-candidate.mjs276 cases
Architecture docdocs/ui-blueprint/184-d05-g04-explicit-retry-authorization-checkpoint-resume-plan-admission.mdteam handoff