REITS / ARCHITECTURED05 · G04 · CUT 92
P56 · REPOSITORY RE-ENTRY PREFLIGHT QUALIFIED · LIVE EXECUTION HELD

A new lease is identity.
A ticket is scope.
Preflight is still not execution.

Cut 92 将 Cut 91 的 frozen remaining-call plan 重新绑定到全新的 Lease Grant、一次性 Execution Ticket 与独立 Re-entry Preflight。三个签名根、三个 nonce claim、精确 scope 和预算全部成立后，仍只输出 capability-free 预进入回执：不激活 Lease，不签发调用 permit，不执行 Adapter。

GLOBAL CUT92 / 10412 cuts left
QA288 / 2883,884 cumulative
QUALIFIED24preflight receipts
REJECTED264fail closed
ROOTS3 / 3detached P-256
PLAN READBACKS90frozen scope exact
QUARANTINE51ticket burn
PRODUCTION0leases / calls
01

CURRENT EXTERNAL RED GATE

仓库中的签名 fixture 不能冒充 production lease issuer、execution ticket root、replay registry 或 invocation permit。

HOSTshared production portalDENIED
LEASE ISSUERlive Platform root absent0 PROD GRANTS
TICKET ROOTlive Runtime root absent0 PROD TICKETS
CONTROLLERlistener remains absent8110 · 0
02

CUT 91 INPUT — CAPABILITY-FREE TERMINAL RECEIPT

只接受 P55 已冻结的 resume plan 事实；旧 lease 已撤销，任何 callable、handle、response payload 或自动执行意图都拒绝。

CUT 91 RECEIPTfrozen plan + 3-authority digest
→
CUT 92 REBINDnew lease + ticket + proof
→
ZERO EXECUTIONpreflight receipt only
03

BOUNDARY CONTRACT — IDENTIFIERS ARE NOT CAPABILITIES

newLeaseId、ticketId 和 preflightId 都是可审计身份，不含连接、socket、调用闭包或密钥材料。

PURE-DATA IDENTIFIERSdigest-bound evidenceALLOWED
CALLABLE LEASE HANDLEimplicit runtime authorityDENIED
AUTO RE-ENTRYticket triggers invocationDENIED
04

22-FIELD FROZEN RESUME PLAN EXACT READBACK

Cut 91 plan 只读回，不重写 validUntil、attempt、request digest、response schema 或剩余范围。

05

REMAINING-SCOPE DIGEST

计划后缀的 ordinal、port、method、request digest、历史 response digest 与目标 schema 共同形成不可扩张的 scope。

FROZEN DESCRIPTORScursor + 1 → call 5remainingCalls[]
SHA-256
REMAINING SCOPE DIGESTlease, ticket and preflight must matchexact · immutable
06

REQUEST-SET DIGEST

执行票据只绑定未来请求身份，不吸收旧 response payload；每个 ordinal 的目标 response schema 同时进入摘要。

bound fieldsourcepurposepayload access
ordinalremaining descriptorordering fenceNONE
portId + methodCut 89 allowlistoperation fenceNONE
requestDigestCut 91 frozen planrequest identityNONE
expectedResponseSchemaCut 91 response sealfuture response contractNONE
07

NEW LEASE IDENTITY — NOT THE PRIOR LEASE

新 Lease 使用新 ID、新 generation 和 attempt 2；priorLeaseId 只保留为拒绝继承的历史证据。

PRIOR LEASECut 89 · revokedleaseId A
≠
NEW LEASE GRANTCut 92 · preflight onlyleaseId B · generation + 1
≠
LEASE ACTIVATIONfuture live authority0 · NOT ISSUED
08

28-FIELD SIGNED NEW SESSION LEASE GRANT

Platform 签名绑定 plan、scope、预算、generation 与 20 秒窗口；Grant 明确声明没有 activation authority。

09

LEASE NON-INHERITANCE FIREBREAK

任何旧 lease ID、相同 generation、续期语义或 inherited flag 都在 ticket 产生前失败。

PRIOR IDhistory onlyNOT ACCEPTED
NEW IDunique typed identityREQUIRED
INHERITANCEgrant booleanFALSE
ACTIVATIONSall fixture paths0
10

GENERATION & ATTEMPT TRANSITION

generation 负责隔离 session 世代；attempt 负责隔离同一 resume plan 的执行尝试，两者必须同时推进且不可倒退。

dimensionpriorCut 92invalid
lease identitypriorLeaseIdnewLeaseIdsame / inherited
generationGG + 1G / G + 2
attempt1 terminal2 re-entryreuse / skip
concurrencyclosed1 maximumfan-out
11

31-FIELD ONE-TIME RETRY EXECUTION TICKET

Ticket 精确绑定 Lease Grant、resume plan、remaining scope、request set、source revision、generation、attempt 和全部预算。

12

TICKET SCOPE — SUFFIX ONLY

Ticket 的 resumeStartOrdinal 和 resumeEndOrdinal 必须与 Cut 91 完全一致；不能恢复成功前缀、插入调用或扩大终点。

cursorticket rangecallsprefix replay
01 → 55DENIED
12 → 54DENIED
23 → 53DENIED
34 → 52DENIED
451DENIED
13

TIME, BYTE & CONCURRENCY BUDGET

票据预算不会因为 retry 自动放大；总预算严格等于 remainingCallCount × perCallTimeoutMs。

TTLsignature window≤ 20 SEC
USESticket nonce1
PER CALLtimeout ceiling≤ 500 MS
TOTALexact multiplicationNO CREDIT
CONCURRENCYre-entry fan-out1
14

ALLOWED PORT-METHOD SET

每个剩余 descriptor 只能匹配原五端口计划中的同 ordinal 操作；Ticket 不能增加新方法。

ordinalportmethodre-entry rule
01PACKAGE_VERIFIERVERIFY_PACKAGE_DIGESTonly when in frozen suffix
02ATOMIC_NONCE_REGISTRYCLAIM_FIXTURE_NONCEonly when in frozen suffix
03RECOVERY_JOURNALAPPEND_FIXTURE_RECOVERY_EVENTonly when in frozen suffix
04ARGV_EXECUTOREXECUTE_ALLOWLISTED_FIXTURE_ARGVonly when in frozen suffix
05INDEPENDENT_WITNESSRECORD_FIXTURE_INVOCATION_WITNESSonly when in frozen suffix
15

THREE DETACHED RE-ENTRY AUTHORITIES

Platform 证明新 lease 身份，Runtime 限定执行票据，SRE 独立证明 re-entry 安全；owner、key 和 nonce 不可复用。

PLATFORMnew session lease issuerteam:platform-new-session-lease
RUNTIMEretry execution ticket authorityteam:runtime-retry-execution-ticket
SREindependent re-entry preflightteam:sre-reentry-preflight
16

25-FIELD INDEPENDENT RE-ENTRY PREFLIGHT PROOF

SRE Proof 重新计算 ticket、lease、plan、scope 和 request-set digest，不信任 Runtime 的布尔结论。

17

20-SECOND AUTHORIZATION WINDOW

三个签名都必须在短窗口内独立有效；过期后不得刷新、换 nonce 或自动重签。

LEASE GRANTissuedAt → expiresAt≤ 20 SEC
EXECUTION TICKETissuedAt → expiresAt≤ 20 SEC
PREFLIGHT PROOFissuedAt → expiresAt≤ 20 SEC
AUTO REFRESHall three rootsFORBIDDEN
18

LEASE · TICKET · ATTEMPT ATOMIC CLAIM ORDER

三种 claim 固定顺序；Ticket 或 Attempt 冲突发生在 Lease Grant claim 之后时，整条链必须 quarantine 并 burn。

ordinalclaim surfacefirst claimreplayterminal action
01lease grant nonceCLAIMEDDENIEDstop before ticket
02execution ticket nonceCLAIMEDDENIEDquarantine + burn
03resume plan attemptCLAIMEDDENIEDquarantine + burn
19

RE-ENTRY FIREWALL PREFLIGHT

Firewall 只记录可验证的 preflight receipt；它没有 Lease activation、per-call permit 或 Adapter invocation 权限。

INPUT EVIDENCE
  • Cut 91 terminal receipt
  • frozen resume plan
  • three P-256 artifacts
RE-ENTRY FIREWALLrecompute · compare · claim · record
  • old lease = false
  • scope expansion = false
  • automatic replay = false
  • adapter invocation = 0
OUTPUT EVIDENCE
  • preflight receipt
  • terminal settlement
  • ticket held
  • no callable capability
20

NINE-STATE RETRY RE-ENTRY MACHINE

每个状态都必须经由显式 receipt；不存在从 Ticket Verified 直接跳到 Adapter Invocation 的边。

01 RECEIVEDCut 91 receipt
02 READBACKfrozen plan
03 LEASE PROOFnew identity
04 TICKETexact scope
05 PREFLIGHTSRE proof
06 CLAIM LEASEnonce one
07 CLAIM TICKETnonce two
08 CLAIM ATTEMPTnonce three
09 SETTLEDzero execution
21

AMBIGUITY QUARANTINE & TICKET BURN

一旦 Lease Grant 已 claim，后续 ticket、attempt、preflight 或 settlement 的未知结果都不能重新进入。

BEFORE LEASE CLAIMread/signature failureREJECT
AFTER LEASE CLAIMticket or attempt conflictQUARANTINE
PREFLIGHT UNKNOWNreceipt ambiguousBURN TICKET
SECOND ENTRYsame or replacement nonceFORBIDDEN
22

17 FAILURE CUTPOINTS

从 Cut 91 receipt 到 capability-free terminal projection 的每个关键边界都有零激活、零连接和零调用终态。

23

24 QUALIFIED RE-ENTRY PREFLIGHTS

五种 cursor 后缀全部覆盖；每个合法 case 完成三签、plan readback、三 claim、preflight receipt 与 terminal settlement。

24 FROZEN PLANScursor 0..4
→
72 P-256 ARTIFACTS3 detached roots
→
24 TERMINAL RECEIPTSticket held · no execution
24

264 REJECTED OR CONTAINED PREFLIGHTS

六个拒绝面分别覆盖 upstream、new lease、ticket、preflight、atomic replay 与 failure containment。

44 · CUT 91terminal receipt integrity
44 · NEW LEASEidentity / generation / signature
44 · TICKETscope / request set / budget
44 · PREFLIGHTwitness / old lease / expansion
44 · REPLAYlease / ticket / attempt
44 · FAILUREquarantine / ticket burn
25

288-CASE EXECUTABLE QA LAB

按 suite 筛选、搜索并点击用例，核对新 Lease、Ticket、Preflight、三 claim、quarantine 与生产零执行。

Select a QA case288 / 288 passed · inheritedSessionLeases=0 · oldLeasesAccepted=0 · scopeExpansions=0 · leaseActivations=0 · productionSessionLeasesIssued=0 · productionAdapterInvocations=0
26

P56A–H SUBGATES

八个仓库子门全部闭环；真实 lease/ticket roots、durable replay registry、permit issuer 与 Controller listener 继续独立红门。

P56A · UPSTREAMCut 91 capability-free receiptBOUND
P56B · READBACKfrozen plan exact scopeBOUND
P56C · NEW LEASEnon-inherited generationBOUND
P56D · TICKETone use / exact budgetBOUND
P56E · PREFLIGHTindependent SRE proofBOUND
P56F · REPLAYlease + ticket + attemptBOUND
P56G · FAILUREquarantine and burnBOUND
P56H · LIVE HOLDzero activation / callBOUND
27

120 / 129 QUALITY GATES & VISIBLE DEBT

九个 live 门未观测；repository、isolated fixture 与 production evidence 仍是三个不可混淆的事实层。

CUT 93 / 104 · 12 CUTS REMAIN

13 LIVE DEBTS · CUT 93 HANDOFF — per-call retry permit & sequential resume transaction

下一刀承接 Cut 92 capability-free re-entry receipt，定义每个 remaining descriptor 的一次性调用 permit、固定顺序 resume transaction、响应重新封印和中途失败补偿。Cut 92 的 Ticket 不直接调用 Adapter。

01 · PER-CALL PERMITone descriptor / one use
02 · FIXED ORDERcursor suffix only
03 · RESPONSE RE-SEALno payload retention
04 · COMPENSATIONstop and revoke
ownermissing production factstatus
surfacecanonical pathuse
Machine API/api/runner-controller/d05-g04-one-time-retry-execution-ticket-reentry-firewall-admissionruntime evidence
JSON Schema/schemas/runner-controller-d05-g04-one-time-retry-execution-ticket-reentry-firewall-admission.v1.schema.jsonconsumer validation
Candidateops/runner-factory/controller-production-adapter-one-time-retry-execution-ticket-reentry-firewall-candidate.mjsqualification logic
Verifierscripts/verify-runner-controller-production-adapter-one-time-retry-execution-ticket-reentry-firewall-candidate.mjs288 cases
Architecture docdocs/ui-blueprint/185-d05-g04-one-time-retry-execution-ticket-reentry-firewall-admission.mdteam handoff